@estifanos-sh/convex-auth 0.0.2 → 0.0.4

package/dist/server/domains/user.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.js","names":[],"sources":["../../../src/server/domains/user.ts"],"sourcesContent":["import { Auth } from \"convex/server\";\nimport { ConvexError, GenericId } from \"convex/values\";\n\nimport { ErrorCode } from \"../../shared/codes\";\nimport type { ComponentCtx, ComponentReadCtx } from \"../component/context\";\nimport { configDefaults } from \"../config\";\nimport { getSessionUserId } from \"../context\";\nimport { cached, ctxCacheHas, invalidateCtxCache } from \"../cache/context\";\nimport type { Doc, UserOrderBy, UserWhere } from \"../types\";\n\ntype ComponentAuthReadCtx = ComponentReadCtx & { auth: Auth };\ntype UserDocLike = Doc<\"User\"> | null;\n\n/** Convex-native `PaginationResult<T>` shape returned by the `*List` component queries. */\ntype Paginated<T> = {\n  page: T[];\n  isDone: boolean;\n  continueCursor: string;\n  splitCursor?: string | null;\n  pageStatus?: \"SplitRecommended\" | \"SplitRequired\" | null;\n};\n\nexport type UserDeps = {\n  config: ReturnType<typeof configDefaults>;\n};\n\nexport function createUserDomain(deps: UserDeps) {\n  const { config } = deps;\n\n  function userGet(ctx: ComponentReadCtx, opts: { id: string }): Promise<UserDocLike>;\n  function userGet(\n    ctx: ComponentReadCtx,\n    opts: { ids: readonly string[] },\n  ): Promise<Array<UserDocLike>>;\n  async function userGet(\n    ctx: ComponentReadCtx,\n    opts: { id: string } | { ids: readonly string[] },\n  ): Promise<UserDocLike | Array<UserDocLike>> {\n    if (\"id\" in opts) {\n      return (await cached(ctx, `user:${opts.id}`, () =>\n        ctx.runQuery(config.component.user.get, {\n          id: opts.id,\n        }),\n      )) as UserDocLike;\n    }\n    const userIds = opts.ids;\n    if (userIds.length === 0) return [];\n    const unique = Array.from(new Set(userIds));\n    const toFetch: string[] = [];\n    for (const id of unique) {\n      if (!ctxCacheHas(ctx, `user:${id}`)) {\n        toFetch.push(id);\n      }\n    }\n    if (toFetch.length > 0) {\n      const docs = (await ctx.runQuery(config.component.user.get, {\n        ids: toFetch,\n      })) as Array<UserDocLike>;\n      for (let i = 0; i < toFetch.length; i += 1) {\n        const id = toFetch[i]!;\n        const value = docs[i] ?? null;\n        void cached(ctx, `user:${id}`, () => Promise.resolve(value));\n      }\n    }\n    return (await Promise.all(\n      userIds.map((id) =>\n        cached(ctx, `user:${id}`, () => ctx.runQuery(config.component.user.get, { id })),\n      ),\n    )) as Array<UserDocLike>;\n  }\n\n  async function emailPrimary(\n    ctx: ComponentAuthReadCtx,\n    opts?: { userId?: string },\n  ): Promise<Doc<\"UserEmail\"> | null>;\n  async function emailPrimary(\n    ctx: ComponentCtx & { auth: Auth },\n    email: string,\n    opts?: { userId?: string },\n  ): Promise<{ email: string }>;\n  async function emailPrimary(\n    ctx: ComponentAuthReadCtx | (ComponentCtx & { auth: Auth }),\n    emailOrOpts?: string | { userId?: string },\n    maybeOpts?: { userId?: string },\n  ): Promise<(Doc<\"UserEmail\"> | null) | { email: string }> {\n    const setting = typeof emailOrOpts === \"string\";\n    const opts = (setting ? maybeOpts : emailOrOpts) as { userId?: string } | undefined;\n    const userId = opts?.userId ?? (await getSessionUserId(ctx));\n    if (userId === null || userId === undefined) {\n      if (setting) {\n        throw new ConvexError({\n          code: ErrorCode.NOT_SIGNED_IN,\n          message: \"Authentication required.\",\n        });\n      }\n      return null;\n    }\n    if (setting) {\n      await (ctx as ComponentCtx).runMutation(config.component.user.email.promote, {\n        userId,\n        email: (emailOrOpts as string).toLowerCase(),\n      });\n      return { email: (emailOrOpts as string).toLowerCase() };\n    }\n    const rows = (await ctx.runQuery(config.component.user.email.list, {\n      userId,\n    })) as Doc<\"UserEmail\">[];\n    return rows.find((r) => r.isPrimary) ?? null;\n  }\n\n  const user = {\n    /**\n     * Fetch a user document by ID, or a batch of user documents by IDs.\n     *\n     * @example Single\n     * ```ts\n     * const user = await auth.user.get(ctx, { id: userId });\n     * ```\n     *\n     * @example Batched\n     * ```ts\n     * const users = await auth.user.get(ctx, { ids: memberIds });\n     * ```\n     */\n    get: userGet,\n    /**\n     * The current session's user id, or `null` when unauthenticated.\n     *\n     * Pairs with {@link viewer} which fetches the full document; use `id`\n     * when you only need the id (no DB read for the user row).\n     *\n     * @example\n     * ```ts\n     * const userId = await auth.user.id(ctx);\n     * if (userId === null) return null;\n     * ```\n     */\n    id: async (ctx: ComponentAuthReadCtx) => {\n      return (await getSessionUserId(ctx)) as GenericId<\"User\"> | null;\n    },\n    /**\n     * List users with optional filtering, pagination, and ordering.\n     *\n     * Supports filtering by `email`, `phone`, `name`, and `isAnonymous`.\n     * Results are paginated — pass `continueCursor` from a previous response\n     * into the next `paginationOpts.cursor`.\n     *\n     * @param ctx - Convex query or mutation context.\n     * @param opts.where - Filter criteria (all optional, combined with AND).\n     * @param opts.paginationOpts - Convex pagination options.\n     * @param opts.orderBy - Sort field: `\"_creationTime\"` (default), `\"email\"`, etc.\n     * @param opts.order - Sort direction: `\"asc\"` or `\"desc\"` (default `\"desc\"`).\n     * @returns Convex `PaginationResult` — `{ page, isDone, continueCursor }`.\n     *\n     * @example\n     * ```ts\n     * const { page, continueCursor } = await auth.user.list(ctx, {\n     *   where: { email: \"alice@example.com\" },\n     *   paginationOpts: { numItems: 10, cursor: null },\n     * });\n     * ```\n     */\n    list: async (\n      ctx: ComponentReadCtx,\n      opts: {\n        where?: UserWhere;\n        paginationOpts: { numItems: number; cursor: string | null };\n        orderBy?: UserOrderBy;\n        order?: \"asc\" | \"desc\";\n      },\n    ) => {\n      return (await ctx.runQuery(config.component.user.list, {\n        where: opts.where,\n        paginationOpts: opts.paginationOpts,\n        orderBy: opts.orderBy,\n        order: opts.order,\n      })) as Paginated<Doc<\"User\">>;\n    },\n    /**\n     * Convenience method: resolve the current session user and fetch their\n     * full document in one call. Returns `null` if unauthenticated.\n     *\n     * @param ctx - Convex query or mutation context with `auth` for session lookup.\n     * @returns The authenticated user's document, or `null` if unauthenticated.\n     *\n     * @example\n     * ```ts\n     * const viewer = await auth.user.viewer(ctx);\n     * if (!viewer) throw new Error(\"Not signed in\");\n     * console.log(viewer.name, viewer.email);\n     * ```\n     */\n    viewer: async (ctx: ComponentAuthReadCtx): Promise<UserDocLike> => {\n      const userId = await getSessionUserId(ctx);\n      if (userId === null) return null;\n      return await userGet(ctx, { id: userId });\n    },\n    /**\n     * Provider-agnostic management of the emails a user owns. Singular\n     * `email` namespace (consistent with `auth.member`);\n     * the collection is exposed via `.list`.\n     *\n     * - `list(ctx)` — every `UserEmail` the user owns (provenance incl.).\n     * - `create(ctx, { email })` — record an **unverified** address. Does not\n     *   verify (verification stays proof-driven via sign-in flows) and\n     *   does not become primary.\n     * - `remove(ctx, { email })` — delete an address. Throws if it is the\n     *   primary, the only verified email, or a connection-managed row.\n     * - `promote(ctx, { email })` — promote a **verified** address to primary\n     *   (syncs the denormalized `User.email`).\n     * - `primary.get(ctx)` — read the current primary `UserEmail | null`.\n     *\n     * `userId` defaults to the current session user everywhere.\n     */\n    email: {\n      list: async (\n        ctx: ComponentAuthReadCtx,\n        opts?: { userId?: string },\n      ): Promise<Doc<\"UserEmail\">[]> => {\n        const userId = opts?.userId ?? (await getSessionUserId(ctx));\n        if (userId === null || userId === undefined) return [];\n        return (await ctx.runQuery(config.component.user.email.list, {\n          userId,\n        })) as Doc<\"UserEmail\">[];\n      },\n      create: async (\n        ctx: ComponentCtx & { auth: Auth },\n        args: { email: string; userId?: string },\n      ): Promise<{ email: string }> => {\n        const userId = args.userId ?? (await getSessionUserId(ctx));\n        if (userId === null || userId === undefined) {\n          throw new ConvexError({\n            code: ErrorCode.NOT_SIGNED_IN,\n            message: \"Authentication required.\",\n          });\n        }\n        const addr = args.email.toLowerCase();\n        await ctx.runMutation(config.component.user.email.upsert, {\n          userId,\n          email: addr,\n          verified: false,\n          isPrimary: false,\n          source: \"password\",\n        });\n        return { email: addr };\n      },\n      remove: async (\n        ctx: ComponentCtx & { auth: Auth },\n        args: { email: string; userId?: string },\n      ): Promise<{ email: string }> => {\n        const userId = args.userId ?? (await getSessionUserId(ctx));\n        if (userId === null || userId === undefined) {\n          throw new ConvexError({\n            code: ErrorCode.NOT_SIGNED_IN,\n            message: \"Authentication required.\",\n          });\n        }\n        const addr = args.email.toLowerCase();\n        await ctx.runMutation(config.component.user.email.remove, {\n          userId,\n          email: addr,\n        });\n        return { email: addr };\n      },\n      promote: (ctx: ComponentCtx & { auth: Auth }, args: { email: string; userId?: string }) =>\n        emailPrimary(\n          ctx,\n          args.email,\n          args.userId === undefined ? undefined : { userId: args.userId },\n        ),\n      primary: {\n        get: (ctx: ComponentAuthReadCtx, opts?: { userId?: string }) => emailPrimary(ctx, opts),\n      },\n    },\n    /**\n     * Patch a user document. Accepts any fields defined on the User schema\n     * (e.g. `name`, `image`, `email`, `extend`).\n     *\n     * @param ctx - Convex mutation context.\n     * @param opts.id - The user's document ID.\n     * @param opts.patch - Fields to merge into the user document.\n     * @returns `null`.\n     *\n     * @example\n     * ```ts\n     * await auth.user.update(ctx, {\n     *   id: userId,\n     *   patch: {\n     *     name: \"Alice Smith\",\n     *     image: \"https://example.com/avatar.png\",\n     *   },\n     * });\n     * ```\n     */\n    update: async (ctx: ComponentCtx, opts: { id: string; patch: Record<string, unknown> }) => {\n      await ctx.runMutation(config.component.user.update, {\n        id: opts.id,\n        patch: opts.patch,\n      });\n      invalidateCtxCache(ctx, `user:${opts.id}`);\n      return null;\n    },\n    /**\n     * Delete a user and all associated data.\n     *\n     * Deletes the user's sessions, accounts, API keys, group memberships,\n     * passkey credentials, TOTP factors, refresh tokens, and owned emails.\n     *\n     * @param ctx - Convex mutation context.\n     * @param opts.id - The user's document ID.\n     * @returns `null`.\n     * @throws `CASCADE_TOO_LARGE` when cleanup exceeds a safe transaction bound.\n     */\n    remove: async (ctx: ComponentCtx, opts: { id: string }) => {\n      await ctx.runMutation(config.component.user.remove, { id: opts.id });\n      invalidateCtxCache(ctx);\n      return null;\n    },\n  };\n\n  return user;\n}\n"],"mappings":";;;;;;AA0BA,SAAgB,iBAAiB,MAAgB;CAC/C,MAAM,EAAE,WAAW;CAOnB,eAAe,QACb,KACA,MAC2C;AAC3C,MAAI,QAAQ,KACV,QAAQ,MAAM,OAAO,KAAK,QAAQ,KAAK,YACrC,IAAI,SAAS,OAAO,UAAU,KAAK,KAAK,EACtC,IAAI,KAAK,IACV,CAAC,CACH;EAEH,MAAM,UAAU,KAAK;AACrB,MAAI,QAAQ,WAAW,EAAG,QAAO,EAAE;EACnC,MAAM,SAAS,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC;EAC3C,MAAM,UAAoB,EAAE;AAC5B,OAAK,MAAM,MAAM,OACf,KAAI,CAAC,YAAY,KAAK,QAAQ,KAAK,CACjC,SAAQ,KAAK,GAAG;AAGpB,MAAI,QAAQ,SAAS,GAAG;GACtB,MAAM,OAAQ,MAAM,IAAI,SAAS,OAAO,UAAU,KAAK,KAAK,EAC1D,KAAK,SACN,CAAC;AACF,QAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK,GAAG;IAC1C,MAAM,KAAK,QAAQ;IACnB,MAAM,QAAQ,KAAK,MAAM;AACzB,IAAK,OAAO,KAAK,QAAQ,YAAY,QAAQ,QAAQ,MAAM,CAAC;;;AAGhE,SAAQ,MAAM,QAAQ,IACpB,QAAQ,KAAK,OACX,OAAO,KAAK,QAAQ,YAAY,IAAI,SAAS,OAAO,UAAU,KAAK,KAAK,EAAE,IAAI,CAAC,CAAC,CACjF,CACF;;CAYH,eAAe,aACb,KACA,aACA,WACwD;EACxD,MAAM,UAAU,OAAO,gBAAgB;EAEvC,MAAM,UADQ,UAAU,YAAY,cACf,UAAW,MAAM,iBAAiB,IAAI;AAC3D,MAAI,WAAW,QAAQ,WAAW,QAAW;AAC3C,OAAI,QACF,OAAM,IAAI,YAAY;IACpB,MAAM,UAAU;IAChB,SAAS;IACV,CAAC;AAEJ,UAAO;;AAET,MAAI,SAAS;AACX,SAAO,IAAqB,YAAY,OAAO,UAAU,KAAK,MAAM,SAAS;IAC3E;IACA,OAAQ,YAAuB,aAAa;IAC7C,CAAC;AACF,UAAO,EAAE,OAAQ,YAAuB,aAAa,EAAE;;AAKzD,UAHc,MAAM,IAAI,SAAS,OAAO,UAAU,KAAK,MAAM,MAAM,EACjE,QACD,CAAC,EACU,MAAM,MAAM,EAAE,UAAU,IAAI;;AAqN1C,QAlNa;EAcX,KAAK;EAaL,IAAI,OAAO,QAA8B;AACvC,UAAQ,MAAM,iBAAiB,IAAI;;EAwBrC,MAAM,OACJ,KACA,SAMG;AACH,UAAQ,MAAM,IAAI,SAAS,OAAO,UAAU,KAAK,MAAM;IACrD,OAAO,KAAK;IACZ,gBAAgB,KAAK;IACrB,SAAS,KAAK;IACd,OAAO,KAAK;IACb,CAAC;;EAgBJ,QAAQ,OAAO,QAAoD;GACjE,MAAM,SAAS,MAAM,iBAAiB,IAAI;AAC1C,OAAI,WAAW,KAAM,QAAO;AAC5B,UAAO,MAAM,QAAQ,KAAK,EAAE,IAAI,QAAQ,CAAC;;EAmB3C,OAAO;GACL,MAAM,OACJ,KACA,SACgC;IAChC,MAAM,SAAS,MAAM,UAAW,MAAM,iBAAiB,IAAI;AAC3D,QAAI,WAAW,QAAQ,WAAW,OAAW,QAAO,EAAE;AACtD,WAAQ,MAAM,IAAI,SAAS,OAAO,UAAU,KAAK,MAAM,MAAM,EAC3D,QACD,CAAC;;GAEJ,QAAQ,OACN,KACA,SAC+B;IAC/B,MAAM,SAAS,KAAK,UAAW,MAAM,iBAAiB,IAAI;AAC1D,QAAI,WAAW,QAAQ,WAAW,OAChC,OAAM,IAAI,YAAY;KACpB,MAAM,UAAU;KAChB,SAAS;KACV,CAAC;IAEJ,MAAM,OAAO,KAAK,MAAM,aAAa;AACrC,UAAM,IAAI,YAAY,OAAO,UAAU,KAAK,MAAM,QAAQ;KACxD;KACA,OAAO;KACP,UAAU;KACV,WAAW;KACX,QAAQ;KACT,CAAC;AACF,WAAO,EAAE,OAAO,MAAM;;GAExB,QAAQ,OACN,KACA,SAC+B;IAC/B,MAAM,SAAS,KAAK,UAAW,MAAM,iBAAiB,IAAI;AAC1D,QAAI,WAAW,QAAQ,WAAW,OAChC,OAAM,IAAI,YAAY;KACpB,MAAM,UAAU;KAChB,SAAS;KACV,CAAC;IAEJ,MAAM,OAAO,KAAK,MAAM,aAAa;AACrC,UAAM,IAAI,YAAY,OAAO,UAAU,KAAK,MAAM,QAAQ;KACxD;KACA,OAAO;KACR,CAAC;AACF,WAAO,EAAE,OAAO,MAAM;;GAExB,UAAU,KAAoC,SAC5C,aACE,KACA,KAAK,OACL,KAAK,WAAW,SAAY,SAAY,EAAE,QAAQ,KAAK,QAAQ,CAChE;GACH,SAAS,EACP,MAAM,KAA2B,SAA+B,aAAa,KAAK,KAAK,EACxF;GACF;EAqBD,QAAQ,OAAO,KAAmB,SAAyD;AACzF,SAAM,IAAI,YAAY,OAAO,UAAU,KAAK,QAAQ;IAClD,IAAI,KAAK;IACT,OAAO,KAAK;IACb,CAAC;AACF,sBAAmB,KAAK,QAAQ,KAAK,KAAK;AAC1C,UAAO;;EAaT,QAAQ,OAAO,KAAmB,SAAyB;AACzD,SAAM,IAAI,YAAY,OAAO,UAAU,KAAK,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC;AACpE,sBAAmB,IAAI;AACvB,UAAO;;EAEV"}
+{"version":3,"file":"user.js","names":[],"sources":["../../../src/server/domains/user.ts"],"sourcesContent":["import { Auth } from \"convex/server\";\nimport { ConvexError, GenericId } from \"convex/values\";\n\nimport { ErrorCode } from \"../../shared/codes\";\nimport type { ComponentCtx, ComponentReadCtx } from \"../component/context\";\nimport { configDefaults } from \"../config\";\nimport { getSessionUserId } from \"../context\";\nimport { cached, ctxCacheHas, invalidateCtxCache } from \"../cache/context\";\nimport type { Doc, UserOrderBy, UserWhere } from \"../types\";\n\ntype ComponentAuthReadCtx = ComponentReadCtx & { auth: Auth };\ntype UserDocLike = Doc<\"User\"> | null;\n\n/** Convex-native `PaginationResult<T>` shape returned by the `*List` component queries. */\ntype Paginated<T> = {\n  page: T[];\n  isDone: boolean;\n  continueCursor: string;\n  splitCursor?: string | null;\n  pageStatus?: \"SplitRecommended\" | \"SplitRequired\" | null;\n};\n\nexport type UserDeps = {\n  config: ReturnType<typeof configDefaults>;\n};\n\nexport function createUserDomain(deps: UserDeps) {\n  const { config } = deps;\n\n  function userGet(ctx: ComponentReadCtx, opts: { id: GenericId<\"User\"> }): Promise<UserDocLike>;\n  function userGet(\n    ctx: ComponentReadCtx,\n    opts: { ids: readonly GenericId<\"User\">[] },\n  ): Promise<Array<UserDocLike>>;\n  async function userGet(\n    ctx: ComponentReadCtx,\n    opts: { id: GenericId<\"User\"> } | { ids: readonly GenericId<\"User\">[] },\n  ): Promise<UserDocLike | Array<UserDocLike>> {\n    if (\"id\" in opts) {\n      return (await cached(ctx, `user:${opts.id}`, () =>\n        ctx.runQuery(config.component.user.get, {\n          id: opts.id,\n        }),\n      )) as UserDocLike;\n    }\n    const userIds = opts.ids;\n    if (userIds.length === 0) return [];\n    const unique = Array.from(new Set(userIds));\n    const toFetch: GenericId<\"User\">[] = [];\n    for (const id of unique) {\n      if (!ctxCacheHas(ctx, `user:${id}`)) {\n        toFetch.push(id);\n      }\n    }\n    if (toFetch.length > 0) {\n      const docs = (await ctx.runQuery(config.component.user.get, {\n        ids: toFetch,\n      })) as Array<UserDocLike>;\n      for (let i = 0; i < toFetch.length; i += 1) {\n        const id = toFetch[i]!;\n        const value = docs[i] ?? null;\n        void cached(ctx, `user:${id}`, () => Promise.resolve(value));\n      }\n    }\n    return (await Promise.all(\n      userIds.map((id) =>\n        cached(ctx, `user:${id}`, () => ctx.runQuery(config.component.user.get, { id })),\n      ),\n    )) as Array<UserDocLike>;\n  }\n\n  async function emailPrimary(\n    ctx: ComponentAuthReadCtx,\n    opts?: { userId?: string },\n  ): Promise<Doc<\"UserEmail\"> | null>;\n  async function emailPrimary(\n    ctx: ComponentCtx & { auth: Auth },\n    email: string,\n    opts?: { userId?: string },\n  ): Promise<{ email: string }>;\n  async function emailPrimary(\n    ctx: ComponentAuthReadCtx | (ComponentCtx & { auth: Auth }),\n    emailOrOpts?: string | { userId?: string },\n    maybeOpts?: { userId?: string },\n  ): Promise<(Doc<\"UserEmail\"> | null) | { email: string }> {\n    const setting = typeof emailOrOpts === \"string\";\n    const opts = (setting ? maybeOpts : emailOrOpts) as { userId?: string } | undefined;\n    const userId = opts?.userId ?? (await getSessionUserId(ctx));\n    if (userId === null || userId === undefined) {\n      if (setting) {\n        throw new ConvexError({\n          code: ErrorCode.NOT_SIGNED_IN,\n          message: \"Authentication required.\",\n        });\n      }\n      return null;\n    }\n    if (setting) {\n      await (ctx as ComponentCtx).runMutation(config.component.user.email.promote, {\n        userId,\n        email: (emailOrOpts as string).toLowerCase(),\n      });\n      return { email: (emailOrOpts as string).toLowerCase() };\n    }\n    const rows = (await ctx.runQuery(config.component.user.email.list, {\n      userId,\n    })) as Doc<\"UserEmail\">[];\n    return rows.find((r) => r.isPrimary) ?? null;\n  }\n\n  const user = {\n    /**\n     * Fetch a user document by ID, or a batch of user documents by IDs.\n     *\n     * @example Single\n     * ```ts\n     * const user = await auth.user.get(ctx, { id: userId });\n     * ```\n     *\n     * @example Batched\n     * ```ts\n     * const users = await auth.user.get(ctx, { ids: memberIds });\n     * ```\n     */\n    get: userGet,\n    /**\n     * The current session's user id, or `null` when unauthenticated.\n     *\n     * Pairs with {@link viewer} which fetches the full document; use `id`\n     * when you only need the id (no DB read for the user row).\n     *\n     * @example\n     * ```ts\n     * const userId = await auth.user.id(ctx);\n     * if (userId === null) return null;\n     * ```\n     */\n    id: async (ctx: ComponentAuthReadCtx) => {\n      return (await getSessionUserId(ctx)) as GenericId<\"User\"> | null;\n    },\n    /**\n     * List users with optional filtering, pagination, and ordering.\n     *\n     * Supports filtering by `email`, `phone`, `name`, and `isAnonymous`.\n     * Results are paginated — pass `continueCursor` from a previous response\n     * into the next `paginationOpts.cursor`.\n     *\n     * @param ctx - Convex query or mutation context.\n     * @param opts.where - Filter criteria (all optional, combined with AND).\n     * @param opts.paginationOpts - Convex pagination options.\n     * @param opts.orderBy - Sort field: `\"_creationTime\"` (default), `\"email\"`, etc.\n     * @param opts.order - Sort direction: `\"asc\"` or `\"desc\"` (default `\"desc\"`).\n     * @returns Convex `PaginationResult` — `{ page, isDone, continueCursor }`.\n     *\n     * @example\n     * ```ts\n     * const { page, continueCursor } = await auth.user.list(ctx, {\n     *   where: { email: \"alice@example.com\" },\n     *   paginationOpts: { numItems: 10, cursor: null },\n     * });\n     * ```\n     */\n    list: async (\n      ctx: ComponentReadCtx,\n      opts: {\n        where?: UserWhere;\n        paginationOpts: { numItems: number; cursor: string | null };\n        orderBy?: UserOrderBy;\n        order?: \"asc\" | \"desc\";\n      },\n    ) => {\n      return (await ctx.runQuery(config.component.user.list, {\n        where: opts.where,\n        paginationOpts: opts.paginationOpts,\n        orderBy: opts.orderBy,\n        order: opts.order,\n      })) as Paginated<Doc<\"User\">>;\n    },\n    /**\n     * Convenience method: resolve the current session user and fetch their\n     * full document in one call. Returns `null` if unauthenticated.\n     *\n     * @param ctx - Convex query or mutation context with `auth` for session lookup.\n     * @returns The authenticated user's document, or `null` if unauthenticated.\n     *\n     * @example\n     * ```ts\n     * const viewer = await auth.user.viewer(ctx);\n     * if (!viewer) throw new Error(\"Not signed in\");\n     * console.log(viewer.name, viewer.email);\n     * ```\n     */\n    viewer: async (ctx: ComponentAuthReadCtx): Promise<UserDocLike> => {\n      const userId = await getSessionUserId(ctx);\n      if (userId === null) return null;\n      return await userGet(ctx, { id: userId });\n    },\n    /**\n     * Provider-agnostic management of the emails a user owns. Singular\n     * `email` namespace (consistent with `auth.member`);\n     * the collection is exposed via `.list`.\n     *\n     * - `list(ctx)` — every `UserEmail` the user owns (provenance incl.).\n     * - `create(ctx, { email })` — record an **unverified** address. Does not\n     *   verify (verification stays proof-driven via sign-in flows) and\n     *   does not become primary.\n     * - `remove(ctx, { email })` — delete an address. Throws if it is the\n     *   primary, the only verified email, or a connection-managed row.\n     * - `promote(ctx, { email })` — promote a **verified** address to primary\n     *   (syncs the denormalized `User.email`).\n     * - `primary.get(ctx)` — read the current primary `UserEmail | null`.\n     *\n     * `userId` defaults to the current session user everywhere.\n     */\n    email: {\n      list: async (\n        ctx: ComponentAuthReadCtx,\n        opts?: { userId?: string },\n      ): Promise<Doc<\"UserEmail\">[]> => {\n        const userId = opts?.userId ?? (await getSessionUserId(ctx));\n        if (userId === null || userId === undefined) return [];\n        return (await ctx.runQuery(config.component.user.email.list, {\n          userId,\n        })) as Doc<\"UserEmail\">[];\n      },\n      create: async (\n        ctx: ComponentCtx & { auth: Auth },\n        args: { email: string; userId?: string },\n      ): Promise<{ email: string }> => {\n        const userId = args.userId ?? (await getSessionUserId(ctx));\n        if (userId === null || userId === undefined) {\n          throw new ConvexError({\n            code: ErrorCode.NOT_SIGNED_IN,\n            message: \"Authentication required.\",\n          });\n        }\n        const addr = args.email.toLowerCase();\n        await ctx.runMutation(config.component.user.email.upsert, {\n          userId,\n          email: addr,\n          verified: false,\n          isPrimary: false,\n          source: \"password\",\n        });\n        return { email: addr };\n      },\n      remove: async (\n        ctx: ComponentCtx & { auth: Auth },\n        args: { email: string; userId?: string },\n      ): Promise<{ email: string }> => {\n        const userId = args.userId ?? (await getSessionUserId(ctx));\n        if (userId === null || userId === undefined) {\n          throw new ConvexError({\n            code: ErrorCode.NOT_SIGNED_IN,\n            message: \"Authentication required.\",\n          });\n        }\n        const addr = args.email.toLowerCase();\n        await ctx.runMutation(config.component.user.email.remove, {\n          userId,\n          email: addr,\n        });\n        return { email: addr };\n      },\n      promote: (ctx: ComponentCtx & { auth: Auth }, args: { email: string; userId?: string }) =>\n        emailPrimary(\n          ctx,\n          args.email,\n          args.userId === undefined ? undefined : { userId: args.userId },\n        ),\n      primary: {\n        get: (ctx: ComponentAuthReadCtx, opts?: { userId?: string }) => emailPrimary(ctx, opts),\n      },\n    },\n    /**\n     * Patch a user document. Accepts any fields defined on the User schema\n     * (e.g. `name`, `image`, `email`, `extend`).\n     *\n     * @param ctx - Convex mutation context.\n     * @param opts.id - The user's document ID.\n     * @param opts.patch - Fields to merge into the user document.\n     * @returns `null`.\n     *\n     * @example\n     * ```ts\n     * await auth.user.update(ctx, {\n     *   id: userId,\n     *   patch: {\n     *     name: \"Alice Smith\",\n     *     image: \"https://example.com/avatar.png\",\n     *   },\n     * });\n     * ```\n     */\n    update: async (\n      ctx: ComponentCtx,\n      opts: { id: GenericId<\"User\">; patch: Record<string, unknown> },\n    ) => {\n      await ctx.runMutation(config.component.user.update, {\n        id: opts.id,\n        patch: opts.patch,\n      });\n      invalidateCtxCache(ctx, `user:${opts.id}`);\n      return null;\n    },\n    /**\n     * Delete a user and all associated data.\n     *\n     * Deletes the user's sessions, accounts, API keys, group memberships,\n     * passkey credentials, TOTP factors, refresh tokens, and owned emails.\n     *\n     * @param ctx - Convex mutation context.\n     * @param opts.id - The user's document ID.\n     * @returns `null`.\n     * @throws `CASCADE_TOO_LARGE` when cleanup exceeds a safe transaction bound.\n     */\n    remove: async (ctx: ComponentCtx, opts: { id: GenericId<\"User\"> }) => {\n      await ctx.runMutation(config.component.user.remove, { id: opts.id });\n      invalidateCtxCache(ctx);\n      return null;\n    },\n  };\n\n  return user;\n}\n"],"mappings":";;;;;;AA0BA,SAAgB,iBAAiB,MAAgB;CAC/C,MAAM,EAAE,WAAW;CAOnB,eAAe,QACb,KACA,MAC2C;AAC3C,MAAI,QAAQ,KACV,QAAQ,MAAM,OAAO,KAAK,QAAQ,KAAK,YACrC,IAAI,SAAS,OAAO,UAAU,KAAK,KAAK,EACtC,IAAI,KAAK,IACV,CAAC,CACH;EAEH,MAAM,UAAU,KAAK;AACrB,MAAI,QAAQ,WAAW,EAAG,QAAO,EAAE;EACnC,MAAM,SAAS,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC;EAC3C,MAAM,UAA+B,EAAE;AACvC,OAAK,MAAM,MAAM,OACf,KAAI,CAAC,YAAY,KAAK,QAAQ,KAAK,CACjC,SAAQ,KAAK,GAAG;AAGpB,MAAI,QAAQ,SAAS,GAAG;GACtB,MAAM,OAAQ,MAAM,IAAI,SAAS,OAAO,UAAU,KAAK,KAAK,EAC1D,KAAK,SACN,CAAC;AACF,QAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK,GAAG;IAC1C,MAAM,KAAK,QAAQ;IACnB,MAAM,QAAQ,KAAK,MAAM;AACzB,IAAK,OAAO,KAAK,QAAQ,YAAY,QAAQ,QAAQ,MAAM,CAAC;;;AAGhE,SAAQ,MAAM,QAAQ,IACpB,QAAQ,KAAK,OACX,OAAO,KAAK,QAAQ,YAAY,IAAI,SAAS,OAAO,UAAU,KAAK,KAAK,EAAE,IAAI,CAAC,CAAC,CACjF,CACF;;CAYH,eAAe,aACb,KACA,aACA,WACwD;EACxD,MAAM,UAAU,OAAO,gBAAgB;EAEvC,MAAM,UADQ,UAAU,YAAY,cACf,UAAW,MAAM,iBAAiB,IAAI;AAC3D,MAAI,WAAW,QAAQ,WAAW,QAAW;AAC3C,OAAI,QACF,OAAM,IAAI,YAAY;IACpB,MAAM,UAAU;IAChB,SAAS;IACV,CAAC;AAEJ,UAAO;;AAET,MAAI,SAAS;AACX,SAAO,IAAqB,YAAY,OAAO,UAAU,KAAK,MAAM,SAAS;IAC3E;IACA,OAAQ,YAAuB,aAAa;IAC7C,CAAC;AACF,UAAO,EAAE,OAAQ,YAAuB,aAAa,EAAE;;AAKzD,UAHc,MAAM,IAAI,SAAS,OAAO,UAAU,KAAK,MAAM,MAAM,EACjE,QACD,CAAC,EACU,MAAM,MAAM,EAAE,UAAU,IAAI;;AAwN1C,QArNa;EAcX,KAAK;EAaL,IAAI,OAAO,QAA8B;AACvC,UAAQ,MAAM,iBAAiB,IAAI;;EAwBrC,MAAM,OACJ,KACA,SAMG;AACH,UAAQ,MAAM,IAAI,SAAS,OAAO,UAAU,KAAK,MAAM;IACrD,OAAO,KAAK;IACZ,gBAAgB,KAAK;IACrB,SAAS,KAAK;IACd,OAAO,KAAK;IACb,CAAC;;EAgBJ,QAAQ,OAAO,QAAoD;GACjE,MAAM,SAAS,MAAM,iBAAiB,IAAI;AAC1C,OAAI,WAAW,KAAM,QAAO;AAC5B,UAAO,MAAM,QAAQ,KAAK,EAAE,IAAI,QAAQ,CAAC;;EAmB3C,OAAO;GACL,MAAM,OACJ,KACA,SACgC;IAChC,MAAM,SAAS,MAAM,UAAW,MAAM,iBAAiB,IAAI;AAC3D,QAAI,WAAW,QAAQ,WAAW,OAAW,QAAO,EAAE;AACtD,WAAQ,MAAM,IAAI,SAAS,OAAO,UAAU,KAAK,MAAM,MAAM,EAC3D,QACD,CAAC;;GAEJ,QAAQ,OACN,KACA,SAC+B;IAC/B,MAAM,SAAS,KAAK,UAAW,MAAM,iBAAiB,IAAI;AAC1D,QAAI,WAAW,QAAQ,WAAW,OAChC,OAAM,IAAI,YAAY;KACpB,MAAM,UAAU;KAChB,SAAS;KACV,CAAC;IAEJ,MAAM,OAAO,KAAK,MAAM,aAAa;AACrC,UAAM,IAAI,YAAY,OAAO,UAAU,KAAK,MAAM,QAAQ;KACxD;KACA,OAAO;KACP,UAAU;KACV,WAAW;KACX,QAAQ;KACT,CAAC;AACF,WAAO,EAAE,OAAO,MAAM;;GAExB,QAAQ,OACN,KACA,SAC+B;IAC/B,MAAM,SAAS,KAAK,UAAW,MAAM,iBAAiB,IAAI;AAC1D,QAAI,WAAW,QAAQ,WAAW,OAChC,OAAM,IAAI,YAAY;KACpB,MAAM,UAAU;KAChB,SAAS;KACV,CAAC;IAEJ,MAAM,OAAO,KAAK,MAAM,aAAa;AACrC,UAAM,IAAI,YAAY,OAAO,UAAU,KAAK,MAAM,QAAQ;KACxD;KACA,OAAO;KACR,CAAC;AACF,WAAO,EAAE,OAAO,MAAM;;GAExB,UAAU,KAAoC,SAC5C,aACE,KACA,KAAK,OACL,KAAK,WAAW,SAAY,SAAY,EAAE,QAAQ,KAAK,QAAQ,CAChE;GACH,SAAS,EACP,MAAM,KAA2B,SAA+B,aAAa,KAAK,KAAK,EACxF;GACF;EAqBD,QAAQ,OACN,KACA,SACG;AACH,SAAM,IAAI,YAAY,OAAO,UAAU,KAAK,QAAQ;IAClD,IAAI,KAAK;IACT,OAAO,KAAK;IACb,CAAC;AACF,sBAAmB,KAAK,QAAQ,KAAK,KAAK;AAC1C,UAAO;;EAaT,QAAQ,OAAO,KAAmB,SAAoC;AACpE,SAAM,IAAI,YAAY,OAAO,UAAU,KAAK,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC;AACpE,sBAAmB,IAAI;AACvB,UAAO;;EAEV"}

package/dist/server/env.js

@@ -1,28 +1,8 @@
 import { ErrorCode } from "../shared/codes.js";
 import { AuthKeyringError, parseAuthKeyring } from "../shared/keyring.js";
-import { ConvexError, v } from "convex/values";
+import { ConvexError } from "convex/values";
 
 //#region src/server/env.ts
-const vOptionalBooleanString = v.optional(v.union(v.literal("true"), v.literal("false")));
-/**
-* Convex app environment variables used by Convex Auth.
-*
-* Pass this to `defineApp({ env: authEnv })` to get Convex deployment-time
-* validation and generated `env` typing in the parent app.
-*/
-const authEnv = {
-	ANDROID_APP_LINKS: v.optional(v.string()),
-	APP_URL: v.optional(v.string()),
-	AUTH_KEYS: v.optional(v.string()),
-	AUTH_LOG_LEVEL: v.optional(v.union(v.literal("DEBUG"), v.literal("INFO"), v.literal("WARN"), v.literal("ERROR"))),
-	AUTH_LOG_SECRETS: vOptionalBooleanString,
-	CHANGE_PASSWORD_URL: v.optional(v.string()),
-	CONVEX_SITE_URL: v.optional(v.string()),
-	IOS_APP_IDS: v.optional(v.string()),
-	IOS_APPLINK_PATHS: v.optional(v.string()),
-	SECURITY_CONTACT: v.optional(v.string()),
-	SECURITY_TXT_EXPIRES_DAYS: v.optional(v.string())
-};
 function readRawEnv(name) {
 	const value = typeof process === "undefined" ? void 0 : process.env?.[name];
 	return typeof value === "string" && value.length > 0 ? value : void 0;
@@ -84,5 +64,5 @@ function requireEnv(name) {
 }
 
 //#endregion
-export { authEnv, envBoolean, envOptionalNumber, envOptionalString, readConfigSync, requireAuthKey, requireEnv };
+export { envBoolean, envOptionalNumber, envOptionalString, readConfigSync, requireAuthKey, requireEnv };
 //# sourceMappingURL=env.js.map

package/dist/server/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","names":[],"sources":["../../src/server/env.ts"],"sourcesContent":["import type { EnvFromDefinition } from \"convex/server\";\nimport { ConvexError, v } from \"convex/values\";\n\nimport { ErrorCode } from \"../shared/codes\";\nimport { AuthKeyringError, parseAuthKeyring, type AuthKeyring } from \"../shared/keyring\";\n\nconst vOptionalBooleanString = v.optional(v.union(v.literal(\"true\"), v.literal(\"false\")));\n\n/**\n * Convex app environment variables used by Convex Auth.\n *\n * Pass this to `defineApp({ env: authEnv })` to get Convex deployment-time\n * validation and generated `env` typing in the parent app.\n */\nexport const authEnv = {\n  ANDROID_APP_LINKS: v.optional(v.string()),\n  APP_URL: v.optional(v.string()),\n  AUTH_KEYS: v.optional(v.string()),\n  AUTH_LOG_LEVEL: v.optional(\n    v.union(v.literal(\"DEBUG\"), v.literal(\"INFO\"), v.literal(\"WARN\"), v.literal(\"ERROR\")),\n  ),\n  AUTH_LOG_SECRETS: vOptionalBooleanString,\n  CHANGE_PASSWORD_URL: v.optional(v.string()),\n  CONVEX_SITE_URL: v.optional(v.string()),\n  IOS_APP_IDS: v.optional(v.string()),\n  IOS_APPLINK_PATHS: v.optional(v.string()),\n  SECURITY_CONTACT: v.optional(v.string()),\n  SECURITY_TXT_EXPIRES_DAYS: v.optional(v.string()),\n} as const;\n\n/** Inferred type of the validated auth environment from {@link authEnv}. */\nexport type AuthEnv = EnvFromDefinition<typeof authEnv>;\n\nfunction readRawEnv(name: string): string | undefined {\n  const value = typeof process === \"undefined\" ? undefined : process.env?.[name];\n  return typeof value === \"string\" && value.length > 0 ? value : undefined;\n}\n\n/** Env vars whose absence points the user at the setup wizard rather than a bare miss. */\nconst SETUP_WIZARD_ENV = new Set([\"AUTH_KEYS\"]);\n\nfunction missingEnvMessage(name: string) {\n  return SETUP_WIZARD_ENV.has(name)\n    ? `Missing environment variable \\`${name}\\`. Run the convex-auth setup wizard to generate and configure auth keys.`\n    : `Missing environment variable \\`${name}\\``;\n}\n\n/** @internal */\nexport const readConfigSync = <A>(value: A) => value;\n\n/** @internal */\nexport const envString = (name: string) => {\n  const value = readRawEnv(name);\n  if (value === undefined) {\n    throw new Error(missingEnvMessage(name));\n  }\n  return value;\n};\n\n/** @internal */\nexport const envOptionalString = (name: string) => readRawEnv(name);\n\n/** @internal */\nexport const envOptionalNumber = (name: string) => {\n  const value = readRawEnv(name);\n  if (value === undefined) {\n    return undefined;\n  }\n  const parsed = Number(value);\n  if (!Number.isFinite(parsed)) {\n    throw new Error(`Invalid numeric environment variable \\`${name}\\``);\n  }\n  return parsed;\n};\n\n/** @internal */\nexport const envBoolean = (name: string) => {\n  const value = readRawEnv(name);\n  if (value === undefined) {\n    return undefined;\n  }\n  if (value === \"true\") {\n    return true;\n  }\n  if (value === \"false\") {\n    return false;\n  }\n  throw new Error(`Invalid boolean environment variable \\`${name}\\``);\n};\n\ntype AuthKeyPurpose = Exclude<keyof AuthKeyring, \"version\">;\n\n/** @internal */\nexport function requireAuthKey<Purpose extends AuthKeyPurpose>(\n  purpose: Purpose,\n): AuthKeyring[Purpose] {\n  try {\n    const value = readRawEnv(\"AUTH_KEYS\");\n    if (value === undefined) {\n      throw new Error(missingEnvMessage(\"AUTH_KEYS\"));\n    }\n    return parseAuthKeyring(value)[purpose];\n  } catch (error) {\n    throw new ConvexError({\n      code: ErrorCode.MISSING_ENV_VAR,\n      message: error instanceof AuthKeyringError ? error.message : missingEnvMessage(\"AUTH_KEYS\"),\n    });\n  }\n}\n\n/** @internal */\nexport function requireEnv(name: string) {\n  try {\n    return readConfigSync(envString(name));\n  } catch (error) {\n    throw new ConvexError({\n      code: ErrorCode.MISSING_ENV_VAR,\n      message: error instanceof AuthKeyringError ? error.message : missingEnvMessage(name),\n    });\n  }\n}\n"],"mappings":";;;;;AAMA,MAAM,yBAAyB,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,OAAO,EAAE,EAAE,QAAQ,QAAQ,CAAC,CAAC;;;;;;;AAQzF,MAAa,UAAU;CACrB,mBAAmB,EAAE,SAAS,EAAE,QAAQ,CAAC;CACzC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC;CAC/B,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC;CACjC,gBAAgB,EAAE,SAChB,EAAE,MAAM,EAAE,QAAQ,QAAQ,EAAE,EAAE,QAAQ,OAAO,EAAE,EAAE,QAAQ,OAAO,EAAE,EAAE,QAAQ,QAAQ,CAAC,CACtF;CACD,kBAAkB;CAClB,qBAAqB,EAAE,SAAS,EAAE,QAAQ,CAAC;CAC3C,iBAAiB,EAAE,SAAS,EAAE,QAAQ,CAAC;CACvC,aAAa,EAAE,SAAS,EAAE,QAAQ,CAAC;CACnC,mBAAmB,EAAE,SAAS,EAAE,QAAQ,CAAC;CACzC,kBAAkB,EAAE,SAAS,EAAE,QAAQ,CAAC;CACxC,2BAA2B,EAAE,SAAS,EAAE,QAAQ,CAAC;CAClD;AAKD,SAAS,WAAW,MAAkC;CACpD,MAAM,QAAQ,OAAO,YAAY,cAAc,SAAY,QAAQ,MAAM;AACzE,QAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ;;;AAIjE,MAAM,mBAAmB,IAAI,IAAI,CAAC,YAAY,CAAC;AAE/C,SAAS,kBAAkB,MAAc;AACvC,QAAO,iBAAiB,IAAI,KAAK,GAC7B,kCAAkC,KAAK,6EACvC,kCAAkC,KAAK;;;AAI7C,MAAa,kBAAqB,UAAa;;AAG/C,MAAa,aAAa,SAAiB;CACzC,MAAM,QAAQ,WAAW,KAAK;AAC9B,KAAI,UAAU,OACZ,OAAM,IAAI,MAAM,kBAAkB,KAAK,CAAC;AAE1C,QAAO;;;AAIT,MAAa,qBAAqB,SAAiB,WAAW,KAAK;;AAGnE,MAAa,qBAAqB,SAAiB;CACjD,MAAM,QAAQ,WAAW,KAAK;AAC9B,KAAI,UAAU,OACZ;CAEF,MAAM,SAAS,OAAO,MAAM;AAC5B,KAAI,CAAC,OAAO,SAAS,OAAO,CAC1B,OAAM,IAAI,MAAM,0CAA0C,KAAK,IAAI;AAErE,QAAO;;;AAIT,MAAa,cAAc,SAAiB;CAC1C,MAAM,QAAQ,WAAW,KAAK;AAC9B,KAAI,UAAU,OACZ;AAEF,KAAI,UAAU,OACZ,QAAO;AAET,KAAI,UAAU,QACZ,QAAO;AAET,OAAM,IAAI,MAAM,0CAA0C,KAAK,IAAI;;;AAMrE,SAAgB,eACd,SACsB;AACtB,KAAI;EACF,MAAM,QAAQ,WAAW,YAAY;AACrC,MAAI,UAAU,OACZ,OAAM,IAAI,MAAM,kBAAkB,YAAY,CAAC;AAEjD,SAAO,iBAAiB,MAAM,CAAC;UACxB,OAAO;AACd,QAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS,iBAAiB,mBAAmB,MAAM,UAAU,kBAAkB,YAAY;GAC5F,CAAC;;;;AAKN,SAAgB,WAAW,MAAc;AACvC,KAAI;AACF,SAAO,eAAe,UAAU,KAAK,CAAC;UAC/B,OAAO;AACd,QAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS,iBAAiB,mBAAmB,MAAM,UAAU,kBAAkB,KAAK;GACrF,CAAC"}
+{"version":3,"file":"env.js","names":[],"sources":["../../src/server/env.ts"],"sourcesContent":["import { ConvexError } from \"convex/values\";\n\nimport { ErrorCode } from \"../shared/codes\";\nimport { AuthKeyringError, parseAuthKeyring, type AuthKeyring } from \"../shared/keyring\";\n\nfunction readRawEnv(name: string): string | undefined {\n  const value = typeof process === \"undefined\" ? undefined : process.env?.[name];\n  return typeof value === \"string\" && value.length > 0 ? value : undefined;\n}\n\n/** Env vars whose absence points the user at the setup wizard rather than a bare miss. */\nconst SETUP_WIZARD_ENV = new Set([\"AUTH_KEYS\"]);\n\nfunction missingEnvMessage(name: string) {\n  return SETUP_WIZARD_ENV.has(name)\n    ? `Missing environment variable \\`${name}\\`. Run the convex-auth setup wizard to generate and configure auth keys.`\n    : `Missing environment variable \\`${name}\\``;\n}\n\n/** @internal */\nexport const readConfigSync = <A>(value: A) => value;\n\n/** @internal */\nexport const envString = (name: string) => {\n  const value = readRawEnv(name);\n  if (value === undefined) {\n    throw new Error(missingEnvMessage(name));\n  }\n  return value;\n};\n\n/** @internal */\nexport const envOptionalString = (name: string) => readRawEnv(name);\n\n/** @internal */\nexport const envOptionalNumber = (name: string) => {\n  const value = readRawEnv(name);\n  if (value === undefined) {\n    return undefined;\n  }\n  const parsed = Number(value);\n  if (!Number.isFinite(parsed)) {\n    throw new Error(`Invalid numeric environment variable \\`${name}\\``);\n  }\n  return parsed;\n};\n\n/** @internal */\nexport const envBoolean = (name: string) => {\n  const value = readRawEnv(name);\n  if (value === undefined) {\n    return undefined;\n  }\n  if (value === \"true\") {\n    return true;\n  }\n  if (value === \"false\") {\n    return false;\n  }\n  throw new Error(`Invalid boolean environment variable \\`${name}\\``);\n};\n\ntype AuthKeyPurpose = Exclude<keyof AuthKeyring, \"version\">;\n\n/** @internal */\nexport function requireAuthKey<Purpose extends AuthKeyPurpose>(\n  purpose: Purpose,\n): AuthKeyring[Purpose] {\n  try {\n    const value = readRawEnv(\"AUTH_KEYS\");\n    if (value === undefined) {\n      throw new Error(missingEnvMessage(\"AUTH_KEYS\"));\n    }\n    return parseAuthKeyring(value)[purpose];\n  } catch (error) {\n    throw new ConvexError({\n      code: ErrorCode.MISSING_ENV_VAR,\n      message: error instanceof AuthKeyringError ? error.message : missingEnvMessage(\"AUTH_KEYS\"),\n    });\n  }\n}\n\n/** @internal */\nexport function requireEnv(name: string) {\n  try {\n    return readConfigSync(envString(name));\n  } catch (error) {\n    throw new ConvexError({\n      code: ErrorCode.MISSING_ENV_VAR,\n      message: error instanceof AuthKeyringError ? error.message : missingEnvMessage(name),\n    });\n  }\n}\n"],"mappings":";;;;;AAKA,SAAS,WAAW,MAAkC;CACpD,MAAM,QAAQ,OAAO,YAAY,cAAc,SAAY,QAAQ,MAAM;AACzE,QAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ;;;AAIjE,MAAM,mBAAmB,IAAI,IAAI,CAAC,YAAY,CAAC;AAE/C,SAAS,kBAAkB,MAAc;AACvC,QAAO,iBAAiB,IAAI,KAAK,GAC7B,kCAAkC,KAAK,6EACvC,kCAAkC,KAAK;;;AAI7C,MAAa,kBAAqB,UAAa;;AAG/C,MAAa,aAAa,SAAiB;CACzC,MAAM,QAAQ,WAAW,KAAK;AAC9B,KAAI,UAAU,OACZ,OAAM,IAAI,MAAM,kBAAkB,KAAK,CAAC;AAE1C,QAAO;;;AAIT,MAAa,qBAAqB,SAAiB,WAAW,KAAK;;AAGnE,MAAa,qBAAqB,SAAiB;CACjD,MAAM,QAAQ,WAAW,KAAK;AAC9B,KAAI,UAAU,OACZ;CAEF,MAAM,SAAS,OAAO,MAAM;AAC5B,KAAI,CAAC,OAAO,SAAS,OAAO,CAC1B,OAAM,IAAI,MAAM,0CAA0C,KAAK,IAAI;AAErE,QAAO;;;AAIT,MAAa,cAAc,SAAiB;CAC1C,MAAM,QAAQ,WAAW,KAAK;AAC9B,KAAI,UAAU,OACZ;AAEF,KAAI,UAAU,OACZ,QAAO;AAET,KAAI,UAAU,QACZ,QAAO;AAET,OAAM,IAAI,MAAM,0CAA0C,KAAK,IAAI;;;AAMrE,SAAgB,eACd,SACsB;AACtB,KAAI;EACF,MAAM,QAAQ,WAAW,YAAY;AACrC,MAAI,UAAU,OACZ,OAAM,IAAI,MAAM,kBAAkB,YAAY,CAAC;AAEjD,SAAO,iBAAiB,MAAM,CAAC;UACxB,OAAO;AACd,QAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS,iBAAiB,mBAAmB,MAAM,UAAU,kBAAkB,YAAY;GAC5F,CAAC;;;;AAKN,SAAgB,WAAW,MAAc;AACvC,KAAI;AACF,SAAO,eAAe,UAAU,KAAK,CAAC;UAC/B,OAAO;AACd,QAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS,iBAAiB,mBAAmB,MAAM,UAAU,kBAAkB,KAAK;GACrF,CAAC"}

package/dist/server/events.d.ts

@@ -415,7 +415,6 @@ type AuthEventWhere = AuthEventWhereInput;
 type ExactAuthEventHandlerMap<T> = T & { [K in Exclude<keyof T, keyof AuthEventHandlerMap>]: never } & { [K in keyof T & keyof AuthEventHandlerMap]: T[K] extends object ? T[K] & { [N in Exclude<keyof T[K], keyof NonNullable<AuthEventHandlerMap[K]>>]: never } : T[K] };
 type EmitAuthEventInput<K extends AuthEventKind = AuthEventKind> = {
   eventId?: string;
-  category?: AuthEventCategory;
   occurredAt?: number;
   kind: K;
   actor: AuthEventActor;
@@ -543,6 +542,7 @@ declare function createAuthEventDomain(config: EventConfig): {
     subjectType: "user" | "session" | "account" | "passkey" | "totp" | "email" | "phone" | "api_key" | "oauth_client" | "oauth_code" | "group" | "connection" | "scim_identity" | "webhook_endpoint" | "webhook_delivery" | "system";
     targetId: string;
     targetKind: "user" | "session" | "group" | "connection" | "oauth_client" | "api_key" | "global";
+    userAgent?: string;
   } | null>;
   list: (ctx: AuthEventCtx, args: {
     where: AuthEventWhereInput;
@@ -643,6 +643,7 @@ declare function createAuthEventDomain(config: EventConfig): {
       subjectType: "user" | "session" | "account" | "passkey" | "totp" | "email" | "phone" | "api_key" | "oauth_client" | "oauth_code" | "group" | "connection" | "scim_identity" | "webhook_endpoint" | "webhook_delivery" | "system";
       targetId: string;
       targetKind: "user" | "session" | "group" | "connection" | "oauth_client" | "api_key" | "global";
+      userAgent?: string;
     }>;
     pageStatus?: "SplitRecommended" | "SplitRequired" | null;
     splitCursor?: string | null;
@@ -746,6 +747,7 @@ declare function createAuthEventDomain(config: EventConfig): {
       subjectType: "user" | "session" | "account" | "passkey" | "totp" | "email" | "phone" | "api_key" | "oauth_client" | "oauth_code" | "group" | "connection" | "scim_identity" | "webhook_endpoint" | "webhook_delivery" | "system";
       targetId: string;
       targetKind: "user" | "session" | "group" | "connection" | "oauth_client" | "api_key" | "global";
+      userAgent?: string;
     }>;
   }>;
 };

package/dist/server/events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"events.d.ts","names":[],"sources":["../../src/server/events.ts"],"mappings":";;;;;;;KAoBK,SAAA,MAAe,CAAA,GAAI,WAAA,CAAY,CAAA;AAAA,KAQxB,eAAA;EAAA,CAAqB,GAAA;AAAA;AAAA,KACrB,mBAAA,GAAsB,eAAA;AAAA,KACtB,UAAA,GAAa,eAAA;AAAA,KACb,UAAA,GAAa,eAAA;AAAA,KACb,iBAAA,GAAoB,eAAA;AAAA,KAC3B,YAAA,GAAe,YAAA;AAAA,KAGR,gBAAA;AAAA,KACA,mBAAA;AAAA,KASA,kBAAA;AAAA,KASA,oBAAA;AAAA,KAkBA,YAAA,WAAuB,aAAA,GAAgB,aAAA;EAAA,SACxC,EAAA,EAAI,CAAA;EAAA,SACJ,eAAA,EAAiB,CAAA;AAAA;AAAA,KAGvB,cAAA,WAAyB,mBAAA,IAAuB,CAAA,kBACjD,SAAA,WACA,CAAA,qBACE,SAAA,cACA,CAAA,mBACE,SAAA,YACA,CAAA,wBACE,SAAA,sBACA,CAAA,0BACE,SAAA,2BACA,CAAA,qBACE,SAAA,aACA,CAAA;AAAA,KAIF,eAAA,WACA,mBAAA,GAAsB,mBAAA,sBACZ,cAAA,CAAe,CAAA;EAAA,SAE1B,IAAA,EAAM,CAAA;EAAA,SACN,EAAA,EAAI,EAAA;EAAA,SACJ,gBAAA,EAAkB,CAAA;AAAA;AAAA,KAGjB,oBAAA,WAA+B,mBAAA,GAAsB,mBAAA;EAAA,SACtD,IAAA,EAAM,CAAA;EAAA,SACN,EAAA;AAAA;AAAA,KAGC,cAAA,WAAyB,kBAAA,GAAqB,kBAAA;EACxD,IAAA,EAAM,CAAA;EACN,EAAA;AAAA;AAAA,KAGU,gBAAA,WAA2B,oBAAA,GAAuB,oBAAA;EAC5D,IAAA,EAAM,CAAA;EACN,EAAA;AAAA;AAAA,KAGU,gBAAA;EACV,SAAA;EACA,EAAA;EACA,SAAA;AAAA;AAAA,KAGU,mBAAA;EACV,cAAA;IAAkB,IAAA;IAAc,QAAA;IAAkB,OAAA,GAAU,mBAAA;EAAA;EAC5D,cAAA;IACE,cAAA;IACA,IAAA;IACA,QAAA;IACA,OAAA,GAAU,mBAAA;EAAA;EAEZ,mBAAA;IAAuB,QAAA;IAAkB,MAAA;EAAA;EACzC,oBAAA;EACA,qBAAA;IAAyB,MAAA;IAAgB,MAAA;EAAA;EACzC,2BAAA;IAA+B,SAAA;EAAA;EAC/B,gCAAA;IAAoC,MAAA;IAAiB,cAAA;EAAA;EACrD,gBAAA;IAAoB,QAAA;IAAkB,iBAAA;EAAA;EACtC,kBAAA;IAAsB,SAAA;IAAmB,QAAA;EAAA;EACzC,kBAAA;IAAsB,MAAA;IAAiB,IAAA;EAAA;EACvC,eAAA;IAAmB,SAAA;IAAmB,YAAA;EAAA;EACtC,iBAAA;IAAqB,SAAA;EAAA;EACrB,eAAA;IAAmB,MAAA;EAAA;EACnB,cAAA;IAAkB,MAAA;EAAA;EAClB,gBAAA;IAAoB,MAAA;IAAgB,KAAA;EAAA;EACpC,gBAAA;IAAoB,MAAA;IAAgB,KAAA;EAAA;EACpC,iBAAA;IAAqB,KAAA;IAAe,IAAA;IAAe,MAAA;EAAA;EACnD,iBAAA;IAAqB,KAAA;IAAe,MAAA;EAAA;EACpC,sBAAA;IAA0B,QAAA;IAAkB,IAAA;IAAe,MAAA;EAAA;EAC3D,sBAAA;IAA0B,QAAA;EAAA;EAC1B,oBAAA;IACE,QAAA;IACA,MAAA;IACA,MAAA;IACA,WAAA;EAAA;EAEF,qBAAA;IACE,QAAA;IACA,MAAA;IACA,SAAA;IACA,QAAA;EAAA;EAEF,uBAAA;IACE,QAAA;IACA,MAAA;IACA,SAAA;IACA,QAAA;EAAA;EAEF,8BAAA;IAAkC,QAAA;IAAkB,MAAA;EAAA;EACpD,uBAAA;IAA2B,QAAA;IAAkB,MAAA;EAAA;EAC7C,oBAAA;IAAwB,YAAA;IAAsB,QAAA;IAA4B,MAAA;EAAA;EAC1E,oBAAA;IAAwB,YAAA;IAAsB,OAAA;EAAA;EAC9C,oBAAA;IAAwB,YAAA;EAAA;EACxB,4BAAA;IACE,YAAA;IACA,QAAA;IACA,MAAA;EAAA;EAEF,yBAAA;IACE,YAAA;IACA,QAAA;IACA,SAAA;EAAA;EAEF,0CAAA;IACE,YAAA;IACA,MAAA;IACA,UAAA;IACA,SAAA;EAAA;EAEF,4BAAA;IAAgC,YAAA;IAAsB,MAAA;IAAgB,UAAA;EAAA;EACtE,2BAAA;IAA+B,OAAA;EAAA;EAC/B,qBAAA;IAAyB,YAAA;IAAsB,WAAA;IAAsB,OAAA;EAAA;EACrE,2BAAA;IAA+B,YAAA;IAAsB,WAAA;EAAA;EACrD,qBAAA;IACE,YAAA;IACA,MAAA;IACA,YAAA;IACA,OAAA;IACA,QAAA;IACA,uBAAA;EAAA;EAEF,qBAAA;IAAyB,YAAA;EAAA;EACzB,sBAAA;IACE,YAAA;IACA,UAAA;IACA,SAAA;EAAA;EAEF,kCAAA;IAAsC,MAAA;IAAiB,UAAA;IAAqB,MAAA;EAAA;EAC5E,8BAAA;IAAkC,MAAA;IAAiB,UAAA;IAAqB,MAAA;EAAA;EACxE,kCAAA;IAAsC,MAAA;IAAiB,UAAA;EAAA;EACvD,kCAAA;IAAsC,MAAA;IAAiB,UAAA;EAAA;EACvD,mCAAA;IAAuC,OAAA;IAAkB,UAAA;EAAA;EACzD,+BAAA;IAAmC,OAAA;IAAkB,UAAA;EAAA;EACrD,mCAAA;IAAuC,OAAA;IAAkB,UAAA;EAAA;EACzD,mCAAA;IAAuC,OAAA;IAAkB,UAAA;EAAA;EACzD,0BAAA;IAA8B,UAAA;EAAA;EAC9B,2BAAA;IAA+B,UAAA;EAAA;EAC/B,0BAAA;IACE,UAAA;IACA,UAAA;IACA,aAAA;IACA,eAAA,EAAiB,aAAA;EAAA;EAEnB,4BAAA;IACE,UAAA;IACA,UAAA;IACA,aAAA;IACA,eAAA,EAAiB,aAAA;IACjB,YAAA;EAAA;EAEF,4BAAA;IACE,UAAA;IACA,UAAA;IACA,aAAA;IACA,eAAA,EAAiB,aAAA;IACjB,MAAA;EAAA;EAEF,yBAAA;IACE,UAAA;IACA,UAAA;IACA,aAAA;IACA,eAAA,EAAiB,aAAA;IACjB,MAAA;IACA,KAAA;EAAA;AAAA,IAEA,OAAA;AAAA,KAEC,SAAA,WAAoB,aAAA,kBAA+B,mBAAA,CAAoB,OAAA,EAAS,CAAA;AAAA,KAEhF,cAAA,WAAyB,aAAA,kBAA+B,CAAA,SAAU,aAAA,GACnE,SAAA,CAAU,CAAA,EAAG,OAAA;EACT,IAAA;AAAA;EACA,IAAA,EAAM,SAAA,CAAU,CAAA,EAAG,OAAA;AAAA;AAAA,KAGtB,aAAA,WAAwB,aAAA,GAAgB,aAAA;EAC3C,OAAA;EACA,IAAA,EAAM,CAAA;EACN,QAAA,EAAU,iBAAA;EACV,UAAA;EACA,KAAA,EAAO,cAAA;EACP,OAAA,EAAS,gBAAA;EACT,OAAA,EAAS,oBAAA;EACT,OAAA,GAAU,gBAAA;EACV,OAAA,EAAS,gBAAA;EACT,SAAA;AAAA;AAAA,KAGU,SAAA,WACA,aAAA,GAAgB,aAAA,kBAExB,CAAA,SAAU,aAAA,GAAgB,aAAA,CAAc,CAAA,IAAK,cAAA,CAAe,CAAA,EAAG,OAAA;AAAA,KAE9D,oBAAA;EACH,MAAA,GAAS,eAAA;EACT,IAAA,GAAO,aAAA;EACP,QAAA,GAAW,iBAAA;EACX,OAAA,GAAU,gBAAA;EACV,KAAA,GAAQ,cAAA;EACR,OAAA,GAAU,gBAAA;EACV,SAAA;EACA,aAAA;EACA,YAAA;EACA,aAAA;EACA,YAAA;AAAA;AAAA,KAGG,gBAAA,WAA2B,aAAA,mBAC9B,GAAA,EAAK,YAAA,EACL,KAAA,EAAO,SAAA,CAAU,CAAA,EAAG,OAAA,MACjB,SAAA;AAAA,KAEO,mBAAA;EACV,IAAA;IACE,OAAA,GAAU,gBAAA,iBAAiC,OAAA;IAC3C,OAAA,GAAU,gBAAA,iBAAiC,OAAA;EAAA;EAE7C,OAAA;IACE,QAAA,GAAW,gBAAA,sBAAsC,OAAA;IACjD,SAAA,GAAY,gBAAA,uBAAuC,OAAA;IACnD,WAAA,GAAc,gBAAA,wBAAwC,OAAA;IACtD,gBAAA,GAAmB,gBAAA,8BAA8C,OAAA;IACjE,oBAAA,GAAuB,gBAAA,mCAAmD,OAAA;EAAA;EAE5E,OAAA;IACE,MAAA,GAAS,gBAAA,mBAAmC,OAAA;IAC5C,QAAA,GAAW,gBAAA,qBAAqC,OAAA;EAAA;EAElD,QAAA;IACE,OAAA,GAAU,gBAAA,qBAAqC,OAAA;EAAA;EAEjD,OAAA;IACE,KAAA,GAAQ,gBAAA,kBAAkC,OAAA;IAC1C,OAAA,GAAU,gBAAA,oBAAoC,OAAA;EAAA;EAEhD,IAAA;IACE,QAAA,GAAW,gBAAA,kBAAkC,OAAA;IAC7C,OAAA,GAAU,gBAAA,iBAAiC,OAAA;EAAA;EAE7C,KAAA;IACE,QAAA,GAAW,gBAAA,mBAAmC,OAAA;EAAA;EAEhD,KAAA;IACE,QAAA,GAAW,gBAAA,mBAAmC,OAAA;EAAA;EAEhD,MAAA;IACE,OAAA,GAAU,gBAAA,oBAAoC,OAAA;IAC9C,OAAA,GAAU,gBAAA,oBAAoC,OAAA;EAAA;EAEhD,KAAA;IACE,aAAA,GAAgB,gBAAA,yBAAyC,OAAA;IACzD,aAAA,GAAgB,gBAAA,yBAAyC,OAAA;IACzD,WAAA,GAAc,gBAAA,uBAAuC,OAAA;IACrD,YAAA,GAAe,gBAAA,wBAAwC,OAAA;IACvD,cAAA,GAAiB,gBAAA,0BAA0C,OAAA;IAC3D,oBAAA,GAAuB,gBAAA,iCAAiD,OAAA;IACxE,cAAA,GAAiB,gBAAA,0BAA0C,OAAA;EAAA;EAE7D,UAAA;IACE,iBAAA,GAAoB,gBAAA,uBAAuC,OAAA;IAC3D,iBAAA,GAAoB,gBAAA,uBAAuC,OAAA;IAC3D,iBAAA,GAAoB,gBAAA,uBAAuC,OAAA;IAC3D,cAAA,GAAiB,gBAAA,+BAA+C,OAAA;IAChE,WAAA,GAAc,gBAAA,4BAA4C,OAAA;IAC1D,2BAAA,GAA8B,gBAAA,6CAE5B,OAAA;IAEF,cAAA,GAAiB,gBAAA,+BAA+C,OAAA;IAChE,aAAA,GAAgB,gBAAA,8BAA8C,OAAA;IAC9D,OAAA,GAAU,gBAAA,wBAAwC,OAAA;IAClD,aAAA,GAAgB,gBAAA,8BAA8C,OAAA;IAC9D,OAAA,GAAU,gBAAA,wBAAwC,OAAA;EAAA;EAEpD,IAAA;IACE,GAAA,GAAM,gBAAA,wBAAwC,OAAA;IAC9C,IAAA,GAAO,gBAAA,yBAAyC,OAAA;IAChD,eAAA,GAAkB,gBAAA,qCAAqD,OAAA;IACvE,WAAA,GAAc,gBAAA,iCAAiD,OAAA;IAC/D,eAAA,GAAkB,gBAAA,qCAAqD,OAAA;IACvE,eAAA,GAAkB,gBAAA,qCAAqD,OAAA;IACvE,gBAAA,GAAmB,gBAAA,sCAAsD,OAAA;IACzE,YAAA,GAAe,gBAAA,kCAAkD,OAAA;IACjE,gBAAA,GAAmB,gBAAA,sCAAsD,OAAA;IACzE,gBAAA,GAAmB,gBAAA,sCAAsD,OAAA;EAAA;EAE3E,OAAA;IACE,eAAA,GAAkB,gBAAA,6BAA6C,OAAA;IAC/D,gBAAA,GAAmB,gBAAA,8BAA8C,OAAA;EAAA;AAAA;AAAA,KAIhE,mBAAA,SAA4B,IAAA,CAC/B,oBAAA;;;;;;KASG,gBAAA,WAA2B,mBAAA,IAAuB,CAAA,kBACnD,YAAA,GACA,WAAA,CAAY,oBAAA,CAAqB,CAAA;AAAA,cAmB/B,qBAAA;EAAA,iBACa,KAAA;EAlKf;;;;;EAyKF,EAAA,WAAa,mBAAA,CAAA,CAAqB,KAAA,EAAO,CAAA,EAAG,KAAA,EAAO,gBAAA,CAAiB,CAAA;EAKpE,EAAA,CAAG,KAAA,gBAAqB,KAAA;EAKxB,GAAA,CAAI,KAAA,gBAAqB,KAAA;EAKzB,EAAA,CAAG,KAAA,gBAAqB,KAAA;EAKxB,GAAA,CAAI,KAAA,gBAAqB,KAAA;EAKzB,KAAA,CAAA,GAAS,oBAAA;AAAA;AAAA,KAKC,0BAAA,GAA6B,IAAA,CACvC,qBAAA;AAAA,KAIU,mBAAA,IAAuB,CAAA,EAAG,0BAAA,KAA+B,0BAAA;AAAA,KAEzD,cAAA,GAAiB,mBAAA;AAAA,KAExB,wBAAA,MAA8B,CAAA,WAC3B,OAAA,OAAc,CAAA,QAAS,mBAAA,4BAEjB,CAAA,SAAU,mBAAA,GAAsB,CAAA,CAAE,CAAA,mBAC1C,CAAA,CAAE,CAAA,YACM,OAAA,OAAc,CAAA,CAAE,CAAA,SAAU,WAAA,CAAY,mBAAA,CAAoB,CAAA,gBAElE,CAAA,CAAE,CAAA;AAAA,KAoCI,kBAAA,WAA6B,aAAA,GAAgB,aAAA;EACvD,OAAA;EACA,QAAA,GAAW,iBAAA;EACX,UAAA;EACA,IAAA,EAAM,CAAA;EACN,KAAA,EAAO,cAAA;EACP,OAAA,EAAS,gBAAA;EACT,OAAA,EAAS,oBAAA;EACT,OAAA,GAAU,gBAAA;EACV,OAAA,EAAS,gBAAA;EACT,SAAA;EACA,IAAA,GAAO,SAAA,CAAU,CAAA;AAAA;AAAA,KAGd,WAAA;EACH,SAAA,EAAW,gBAAA;EACX,MAAA,GAAS,mBAAA;AAAA;;;;;;;;;;;;;;;;;;;iBA2LK,qBAAA,CAAsB,MAAA,EAAQ,WAAA;aAEzB,YAAA,EAAY,IAAA;IAAU,EAAA;EAAA,MAAY,OAAA;;;;;;;;gBA8J+zhC,MAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAA4gC,KAAA;;;0BAAmG,KAAA;gBAAgD,KAAA;;;;gBAAgJ,KAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA3J1pkC,YAAA,EAAY,IAAA;IAEf,KAAA,EAAO,mBAAA;IACP,KAAA;IACA,cAAA,EAAgB,iBAAA;EAAA,MACjB,OAAA;;;;;;;;;;;kBAsJ6l5C,MAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAglC,KAAA;;;4BAA2G,KAAA;kBAAkD,KAAA;;;;kBAAwJ,KAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAhJ987C,aAAA,EAAa,GAAA,EAAO,YAAA,EAAY,IAAA,EAAQ,kBAAA,CAAmB,CAAA,MAAE,OAAA;;;;;;;;;;;;;;;kBAgJo/wB,MAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAglC,KAAA;;;4BAA2G,KAAA;kBAAkD,KAAA;;;;kBAAwJ,KAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAnIp8zB,UAAA;EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBAgFE,SAAA,aAAiB,eAAA,SAAA,SAAA;IAAA,uBACd,SAAA,gBAAoB,eAAA,YAAA,SAAA;IAAA,qBACtB,SAAA,cAAkB,eAAA,UAAA,SAAA;IAAA,0BACb,SAAA,wBAA4B,eAAA,eAAA,SAAA;IAAA,2BAC3B,SAAA,6BAAiC,eAAA,0BAAA,SAAA;IAAA,sBACtC,SAAA,eAAmB,eAAA,YAAA,SAAA;IAAA;;;mCAIZ,cAAA;IAAA,uBACR,cAAA;IAAA,gCACS,cAAA;IAAA,iCACC,cAAA;IAAA,sCACK,cAAA;IAAA,kCACJ,cAAA;IAAA,0BACR,cAAA;EAAA;EAAA;mCAGK,gBAAA;IAAA,kCACG,gBAAA;IAAA,kCACA,gBAAA;IAAA,kCACA,gBAAA;IAAA,+BACH,gBAAA;IAAA,gCACC,gBAAA;IAAA,gCACA,gBAAA;IAAA,iCACC,gBAAA;IAAA,sCACK,gBAAA;IAAA,oCAIF,gBAAA;IAAA,gCACJ,gBAAA;IAAA,qCACK,gBAAA;IAAA,uCACE,gBAAA;IAAA,0CAIG,gBAAA;IAAA,0CAIA,gBAAA;IAAA,uBAInB,gBAAA;EAAA;EAAA,6BAEI,QAAA,EAAY,wBAAA,CAAyB,CAAA,IAAK,mBAAA,KAAmB,CAAA,WAjZ7E,OAAA,OAAA,CAAA,QAAA,mBAAA,kCAAA,CAAA,SAAA,mBAAA,OAAA,CAAA,CAAA,GAAA,mBAAA,CAAA,CAAA,GAAA,YAIM,OAAA,OAAA,CAAA,CAAA,GAAA,SAAA,WAAA,CAAA,mBAAA,KAAA,GAAA,gBAAA,CAAA,CAAA,GAAA,MAAA,mBAAA;EAAA,yBA8YQ,CAAA,EAAG,0BAAA,KAA+B,0BAAA,KAA0B,oBAAA;AAAA"}
+{"version":3,"file":"events.d.ts","names":[],"sources":["../../src/server/events.ts"],"mappings":";;;;;;;KAoBK,SAAA,MAAe,CAAA,GAAI,WAAA,CAAY,CAAA;AAAA,KAQxB,eAAA;EAAA,CAAqB,GAAA;AAAA;AAAA,KACrB,mBAAA,GAAsB,eAAA;AAAA,KACtB,UAAA,GAAa,eAAA;AAAA,KACb,UAAA,GAAa,eAAA;AAAA,KACb,iBAAA,GAAoB,eAAA;AAAA,KAC3B,YAAA,GAAe,YAAA;AAAA,KAGR,gBAAA;AAAA,KACA,mBAAA;AAAA,KASA,kBAAA;AAAA,KASA,oBAAA;AAAA,KAkBA,YAAA,WAAuB,aAAA,GAAgB,aAAA;EAAA,SACxC,EAAA,EAAI,CAAA;EAAA,SACJ,eAAA,EAAiB,CAAA;AAAA;AAAA,KAGvB,cAAA,WAAyB,mBAAA,IAAuB,CAAA,kBACjD,SAAA,WACA,CAAA,qBACE,SAAA,cACA,CAAA,mBACE,SAAA,YACA,CAAA,wBACE,SAAA,sBACA,CAAA,0BACE,SAAA,2BACA,CAAA,qBACE,SAAA,aACA,CAAA;AAAA,KAIF,eAAA,WACA,mBAAA,GAAsB,mBAAA,sBACZ,cAAA,CAAe,CAAA;EAAA,SAE1B,IAAA,EAAM,CAAA;EAAA,SACN,EAAA,EAAI,EAAA;EAAA,SACJ,gBAAA,EAAkB,CAAA;AAAA;AAAA,KAGjB,oBAAA,WAA+B,mBAAA,GAAsB,mBAAA;EAAA,SACtD,IAAA,EAAM,CAAA;EAAA,SACN,EAAA;AAAA;AAAA,KAGC,cAAA,WAAyB,kBAAA,GAAqB,kBAAA;EACxD,IAAA,EAAM,CAAA;EACN,EAAA;AAAA;AAAA,KAGU,gBAAA,WAA2B,oBAAA,GAAuB,oBAAA;EAC5D,IAAA,EAAM,CAAA;EACN,EAAA;AAAA;AAAA,KAGU,gBAAA;EACV,SAAA;EACA,EAAA;EACA,SAAA;AAAA;AAAA,KAGU,mBAAA;EACV,cAAA;IAAkB,IAAA;IAAc,QAAA;IAAkB,OAAA,GAAU,mBAAA;EAAA;EAC5D,cAAA;IACE,cAAA;IACA,IAAA;IACA,QAAA;IACA,OAAA,GAAU,mBAAA;EAAA;EAEZ,mBAAA;IAAuB,QAAA;IAAkB,MAAA;EAAA;EACzC,oBAAA;EACA,qBAAA;IAAyB,MAAA;IAAgB,MAAA;EAAA;EACzC,2BAAA;IAA+B,SAAA;EAAA;EAC/B,gCAAA;IAAoC,MAAA;IAAiB,cAAA;EAAA;EACrD,gBAAA;IAAoB,QAAA;IAAkB,iBAAA;EAAA;EACtC,kBAAA;IAAsB,SAAA;IAAmB,QAAA;EAAA;EACzC,kBAAA;IAAsB,MAAA;IAAiB,IAAA;EAAA;EACvC,eAAA;IAAmB,SAAA;IAAmB,YAAA;EAAA;EACtC,iBAAA;IAAqB,SAAA;EAAA;EACrB,eAAA;IAAmB,MAAA;EAAA;EACnB,cAAA;IAAkB,MAAA;EAAA;EAClB,gBAAA;IAAoB,MAAA;IAAgB,KAAA;EAAA;EACpC,gBAAA;IAAoB,MAAA;IAAgB,KAAA;EAAA;EACpC,iBAAA;IAAqB,KAAA;IAAe,IAAA;IAAe,MAAA;EAAA;EACnD,iBAAA;IAAqB,KAAA;IAAe,MAAA;EAAA;EACpC,sBAAA;IAA0B,QAAA;IAAkB,IAAA;IAAe,MAAA;EAAA;EAC3D,sBAAA;IAA0B,QAAA;EAAA;EAC1B,oBAAA;IACE,QAAA;IACA,MAAA;IACA,MAAA;IACA,WAAA;EAAA;EAEF,qBAAA;IACE,QAAA;IACA,MAAA;IACA,SAAA;IACA,QAAA;EAAA;EAEF,uBAAA;IACE,QAAA;IACA,MAAA;IACA,SAAA;IACA,QAAA;EAAA;EAEF,8BAAA;IAAkC,QAAA;IAAkB,MAAA;EAAA;EACpD,uBAAA;IAA2B,QAAA;IAAkB,MAAA;EAAA;EAC7C,oBAAA;IAAwB,YAAA;IAAsB,QAAA;IAA4B,MAAA;EAAA;EAC1E,oBAAA;IAAwB,YAAA;IAAsB,OAAA;EAAA;EAC9C,oBAAA;IAAwB,YAAA;EAAA;EACxB,4BAAA;IACE,YAAA;IACA,QAAA;IACA,MAAA;EAAA;EAEF,yBAAA;IACE,YAAA;IACA,QAAA;IACA,SAAA;EAAA;EAEF,0CAAA;IACE,YAAA;IACA,MAAA;IACA,UAAA;IACA,SAAA;EAAA;EAEF,4BAAA;IAAgC,YAAA;IAAsB,MAAA;IAAgB,UAAA;EAAA;EACtE,2BAAA;IAA+B,OAAA;EAAA;EAC/B,qBAAA;IAAyB,YAAA;IAAsB,WAAA;IAAsB,OAAA;EAAA;EACrE,2BAAA;IAA+B,YAAA;IAAsB,WAAA;EAAA;EACrD,qBAAA;IACE,YAAA;IACA,MAAA;IACA,YAAA;IACA,OAAA;IACA,QAAA;IACA,uBAAA;EAAA;EAEF,qBAAA;IAAyB,YAAA;EAAA;EACzB,sBAAA;IACE,YAAA;IACA,UAAA;IACA,SAAA;EAAA;EAEF,kCAAA;IAAsC,MAAA;IAAiB,UAAA;IAAqB,MAAA;EAAA;EAC5E,8BAAA;IAAkC,MAAA;IAAiB,UAAA;IAAqB,MAAA;EAAA;EACxE,kCAAA;IAAsC,MAAA;IAAiB,UAAA;EAAA;EACvD,kCAAA;IAAsC,MAAA;IAAiB,UAAA;EAAA;EACvD,mCAAA;IAAuC,OAAA;IAAkB,UAAA;EAAA;EACzD,+BAAA;IAAmC,OAAA;IAAkB,UAAA;EAAA;EACrD,mCAAA;IAAuC,OAAA;IAAkB,UAAA;EAAA;EACzD,mCAAA;IAAuC,OAAA;IAAkB,UAAA;EAAA;EACzD,0BAAA;IAA8B,UAAA;EAAA;EAC9B,2BAAA;IAA+B,UAAA;EAAA;EAC/B,0BAAA;IACE,UAAA;IACA,UAAA;IACA,aAAA;IACA,eAAA,EAAiB,aAAA;EAAA;EAEnB,4BAAA;IACE,UAAA;IACA,UAAA;IACA,aAAA;IACA,eAAA,EAAiB,aAAA;IACjB,YAAA;EAAA;EAEF,4BAAA;IACE,UAAA;IACA,UAAA;IACA,aAAA;IACA,eAAA,EAAiB,aAAA;IACjB,MAAA;EAAA;EAEF,yBAAA;IACE,UAAA;IACA,UAAA;IACA,aAAA;IACA,eAAA,EAAiB,aAAA;IACjB,MAAA;IACA,KAAA;EAAA;AAAA,IAEA,OAAA;AAAA,KAEC,SAAA,WAAoB,aAAA,kBAA+B,mBAAA,CAAoB,OAAA,EAAS,CAAA;AAAA,KAEhF,cAAA,WAAyB,aAAA,kBAA+B,CAAA,SAAU,aAAA,GACnE,SAAA,CAAU,CAAA,EAAG,OAAA;EACT,IAAA;AAAA;EACA,IAAA,EAAM,SAAA,CAAU,CAAA,EAAG,OAAA;AAAA;AAAA,KAGtB,aAAA,WAAwB,aAAA,GAAgB,aAAA;EAC3C,OAAA;EACA,IAAA,EAAM,CAAA;EACN,QAAA,EAAU,iBAAA;EACV,UAAA;EACA,KAAA,EAAO,cAAA;EACP,OAAA,EAAS,gBAAA;EACT,OAAA,EAAS,oBAAA;EACT,OAAA,GAAU,gBAAA;EACV,OAAA,EAAS,gBAAA;EACT,SAAA;AAAA;AAAA,KAGU,SAAA,WACA,aAAA,GAAgB,aAAA,kBAExB,CAAA,SAAU,aAAA,GAAgB,aAAA,CAAc,CAAA,IAAK,cAAA,CAAe,CAAA,EAAG,OAAA;AAAA,KAE9D,oBAAA;EACH,MAAA,GAAS,eAAA;EACT,IAAA,GAAO,aAAA;EACP,QAAA,GAAW,iBAAA;EACX,OAAA,GAAU,gBAAA;EACV,KAAA,GAAQ,cAAA;EACR,OAAA,GAAU,gBAAA;EACV,SAAA;EACA,aAAA;EACA,YAAA;EACA,aAAA;EACA,YAAA;AAAA;AAAA,KAGG,gBAAA,WAA2B,aAAA,mBAC9B,GAAA,EAAK,YAAA,EACL,KAAA,EAAO,SAAA,CAAU,CAAA,EAAG,OAAA,MACjB,SAAA;AAAA,KAEO,mBAAA;EACV,IAAA;IACE,OAAA,GAAU,gBAAA,iBAAiC,OAAA;IAC3C,OAAA,GAAU,gBAAA,iBAAiC,OAAA;EAAA;EAE7C,OAAA;IACE,QAAA,GAAW,gBAAA,sBAAsC,OAAA;IACjD,SAAA,GAAY,gBAAA,uBAAuC,OAAA;IACnD,WAAA,GAAc,gBAAA,wBAAwC,OAAA;IACtD,gBAAA,GAAmB,gBAAA,8BAA8C,OAAA;IACjE,oBAAA,GAAuB,gBAAA,mCAAmD,OAAA;EAAA;EAE5E,OAAA;IACE,MAAA,GAAS,gBAAA,mBAAmC,OAAA;IAC5C,QAAA,GAAW,gBAAA,qBAAqC,OAAA;EAAA;EAElD,QAAA;IACE,OAAA,GAAU,gBAAA,qBAAqC,OAAA;EAAA;EAEjD,OAAA;IACE,KAAA,GAAQ,gBAAA,kBAAkC,OAAA;IAC1C,OAAA,GAAU,gBAAA,oBAAoC,OAAA;EAAA;EAEhD,IAAA;IACE,QAAA,GAAW,gBAAA,kBAAkC,OAAA;IAC7C,OAAA,GAAU,gBAAA,iBAAiC,OAAA;EAAA;EAE7C,KAAA;IACE,QAAA,GAAW,gBAAA,mBAAmC,OAAA;EAAA;EAEhD,KAAA;IACE,QAAA,GAAW,gBAAA,mBAAmC,OAAA;EAAA;EAEhD,MAAA;IACE,OAAA,GAAU,gBAAA,oBAAoC,OAAA;IAC9C,OAAA,GAAU,gBAAA,oBAAoC,OAAA;EAAA;EAEhD,KAAA;IACE,aAAA,GAAgB,gBAAA,yBAAyC,OAAA;IACzD,aAAA,GAAgB,gBAAA,yBAAyC,OAAA;IACzD,WAAA,GAAc,gBAAA,uBAAuC,OAAA;IACrD,YAAA,GAAe,gBAAA,wBAAwC,OAAA;IACvD,cAAA,GAAiB,gBAAA,0BAA0C,OAAA;IAC3D,oBAAA,GAAuB,gBAAA,iCAAiD,OAAA;IACxE,cAAA,GAAiB,gBAAA,0BAA0C,OAAA;EAAA;EAE7D,UAAA;IACE,iBAAA,GAAoB,gBAAA,uBAAuC,OAAA;IAC3D,iBAAA,GAAoB,gBAAA,uBAAuC,OAAA;IAC3D,iBAAA,GAAoB,gBAAA,uBAAuC,OAAA;IAC3D,cAAA,GAAiB,gBAAA,+BAA+C,OAAA;IAChE,WAAA,GAAc,gBAAA,4BAA4C,OAAA;IAC1D,2BAAA,GAA8B,gBAAA,6CAE5B,OAAA;IAEF,cAAA,GAAiB,gBAAA,+BAA+C,OAAA;IAChE,aAAA,GAAgB,gBAAA,8BAA8C,OAAA;IAC9D,OAAA,GAAU,gBAAA,wBAAwC,OAAA;IAClD,aAAA,GAAgB,gBAAA,8BAA8C,OAAA;IAC9D,OAAA,GAAU,gBAAA,wBAAwC,OAAA;EAAA;EAEpD,IAAA;IACE,GAAA,GAAM,gBAAA,wBAAwC,OAAA;IAC9C,IAAA,GAAO,gBAAA,yBAAyC,OAAA;IAChD,eAAA,GAAkB,gBAAA,qCAAqD,OAAA;IACvE,WAAA,GAAc,gBAAA,iCAAiD,OAAA;IAC/D,eAAA,GAAkB,gBAAA,qCAAqD,OAAA;IACvE,eAAA,GAAkB,gBAAA,qCAAqD,OAAA;IACvE,gBAAA,GAAmB,gBAAA,sCAAsD,OAAA;IACzE,YAAA,GAAe,gBAAA,kCAAkD,OAAA;IACjE,gBAAA,GAAmB,gBAAA,sCAAsD,OAAA;IACzE,gBAAA,GAAmB,gBAAA,sCAAsD,OAAA;EAAA;EAE3E,OAAA;IACE,eAAA,GAAkB,gBAAA,6BAA6C,OAAA;IAC/D,gBAAA,GAAmB,gBAAA,8BAA8C,OAAA;EAAA;AAAA;AAAA,KAIhE,mBAAA,SAA4B,IAAA,CAC/B,oBAAA;;;;;;KASG,gBAAA,WAA2B,mBAAA,IAAuB,CAAA,kBACnD,YAAA,GACA,WAAA,CAAY,oBAAA,CAAqB,CAAA;AAAA,cAmB/B,qBAAA;EAAA,iBACa,KAAA;EAlKf;;;;;EAyKF,EAAA,WAAa,mBAAA,CAAA,CAAqB,KAAA,EAAO,CAAA,EAAG,KAAA,EAAO,gBAAA,CAAiB,CAAA;EAKpE,EAAA,CAAG,KAAA,gBAAqB,KAAA;EAKxB,GAAA,CAAI,KAAA,gBAAqB,KAAA;EAKzB,EAAA,CAAG,KAAA,gBAAqB,KAAA;EAKxB,GAAA,CAAI,KAAA,gBAAqB,KAAA;EAKzB,KAAA,CAAA,GAAS,oBAAA;AAAA;AAAA,KAKC,0BAAA,GAA6B,IAAA,CACvC,qBAAA;AAAA,KAIU,mBAAA,IAAuB,CAAA,EAAG,0BAAA,KAA+B,0BAAA;AAAA,KAEzD,cAAA,GAAiB,mBAAA;AAAA,KAExB,wBAAA,MAA8B,CAAA,WAC3B,OAAA,OAAc,CAAA,QAAS,mBAAA,4BAEjB,CAAA,SAAU,mBAAA,GAAsB,CAAA,CAAE,CAAA,mBAC1C,CAAA,CAAE,CAAA,YACM,OAAA,OAAc,CAAA,CAAE,CAAA,SAAU,WAAA,CAAY,mBAAA,CAAoB,CAAA,gBAElE,CAAA,CAAE,CAAA;AAAA,KAoCI,kBAAA,WAA6B,aAAA,GAAgB,aAAA;EACvD,OAAA;EACA,UAAA;EACA,IAAA,EAAM,CAAA;EACN,KAAA,EAAO,cAAA;EACP,OAAA,EAAS,gBAAA;EACT,OAAA,EAAS,oBAAA;EACT,OAAA,GAAU,gBAAA;EACV,OAAA,EAAS,gBAAA;EACT,SAAA;EACA,IAAA,GAAO,SAAA,CAAU,CAAA;AAAA;AAAA,KAGd,WAAA;EACH,SAAA,EAAW,gBAAA;EACX,MAAA,GAAS,mBAAA;AAAA;;;;;;;;;;;;;;;;;;;iBA2LK,qBAAA,CAAsB,MAAA,EAAQ,WAAA;aAEzB,YAAA,EAAY,IAAA;IAAU,EAAA;EAAA,MAAY,OAAA;;;;;;;;gBA8JuqpC,MAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAA4gC,KAAA;;;0BAAmG,KAAA;gBAAgD,KAAA;;;;gBAAgJ,KAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA3JlgsC,YAAA,EAAY,IAAA;IAEf,KAAA,EAAO,mBAAA;IACP,KAAA;IACA,cAAA,EAAgB,iBAAA;EAAA,MACjB,OAAA;;;;;;;;;;;kBAsJi+gD,MAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAglC,KAAA;;;4BAA2G,KAAA;kBAAkD,KAAA;;;;kBAAwJ,KAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAhJl1jD,aAAA,EAAa,GAAA,EAAO,YAAA,EAAY,IAAA,EAAQ,kBAAA,CAAmB,CAAA,MAAE,OAAA;;;;;;;;;;;;;;;kBAgJ8z4B,MAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAglC,KAAA;;;4BAA2G,KAAA;kBAAkD,KAAA;;;;kBAAwJ,KAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAnI9w7B,UAAA;EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBAgFE,SAAA,aAAiB,eAAA,SAAA,SAAA;IAAA,uBACd,SAAA,gBAAoB,eAAA,YAAA,SAAA;IAAA,qBACtB,SAAA,cAAkB,eAAA,UAAA,SAAA;IAAA,0BACb,SAAA,wBAA4B,eAAA,eAAA,SAAA;IAAA,2BAC3B,SAAA,6BAAiC,eAAA,0BAAA,SAAA;IAAA,sBACtC,SAAA,eAAmB,eAAA,YAAA,SAAA;IAAA;;;mCAIZ,cAAA;IAAA,uBACR,cAAA;IAAA,gCACS,cAAA;IAAA,iCACC,cAAA;IAAA,sCACK,cAAA;IAAA,kCACJ,cAAA;IAAA,0BACR,cAAA;EAAA;EAAA;mCAGK,gBAAA;IAAA,kCACG,gBAAA;IAAA,kCACA,gBAAA;IAAA,kCACA,gBAAA;IAAA,+BACH,gBAAA;IAAA,gCACC,gBAAA;IAAA,gCACA,gBAAA;IAAA,iCACC,gBAAA;IAAA,sCACK,gBAAA;IAAA,oCAIF,gBAAA;IAAA,gCACJ,gBAAA;IAAA,qCACK,gBAAA;IAAA,uCACE,gBAAA;IAAA,0CAIG,gBAAA;IAAA,0CAIA,gBAAA;IAAA,uBAInB,gBAAA;EAAA;EAAA,6BAEI,QAAA,EAAY,wBAAA,CAAyB,CAAA,IAAK,mBAAA,KAAmB,CAAA,WAhZ7E,OAAA,OAAA,CAAA,QAAA,mBAAA,kCAAA,CAAA,SAAA,mBAAA,OAAA,CAAA,CAAA,GAAA,mBAAA,CAAA,CAAA,GAAA,YAIM,OAAA,OAAA,CAAA,CAAA,GAAA,SAAA,WAAA,CAAA,mBAAA,KAAA,GAAA,gBAAA,CAAA,CAAA,GAAA,MAAA,mBAAA;EAAA,yBA6YQ,CAAA,EAAG,0BAAA,KAA+B,0BAAA,KAA0B,oBAAA;AAAA"}

package/dist/server/events.js

@@ -95,15 +95,15 @@ function computeAuthEvent(input) {
 	return finalizeAuthEvent({
 		...input,
 		eventId: input.eventId ?? eventId(input),
-		category: input.category ?? categoryForKind(input.kind),
+		category: categoryForKind(input.kind),
 		occurredAt: input.occurredAt ?? Date.now()
 	});
 }
 function appendArgs(event) {
+	const { category: _, ...input } = event;
 	return {
-		event,
-		targets: event.targets,
-		idempotencyKey: event.eventId
+		event: input,
+		targets: event.targets
 	};
 }
 const EVENT_HANDLER_SELECTORS = {
@@ -191,8 +191,8 @@ async function emitAuthEvent(ctx, config, input) {
 *
 * Scheduled writes are recorded by the caller's mutation commit but execute in
 * a separate function, keeping projection fan-out off the
-* authentication critical path. Configured handlers preserve their existing
-* synchronous, exactly-once behavior by falling back to {@link emitAuthEvent}.
+* authentication critical path. Configured handlers preserve synchronous,
+* exactly-once delivery through {@link emitAuthEvent}.
 *
 * @internal
 */

package/dist/server/events.js.map

@@ -1 +1 @@
-{"version":3,"file":"events.js","names":[],"sources":["../../src/server/events.ts"],"sourcesContent":["/**\n * Typed auth event refs, handlers, filters, and server facade helpers.\n *\n * @module\n */\n\nimport type { GenericActionCtx, GenericDataModel, PaginationOptions } from \"convex/server\";\nimport type { GenericId } from \"convex/values\";\n\nimport {\n  EVENT_KIND_CATEGORY,\n  type AuthEventCategory,\n  type AuthEventKind,\n} from \"../shared/event/kinds\";\nimport type { AuthComponentApi } from \"./component/api\";\nimport type { ComponentCtx } from \"./component/context\";\nimport { generateRandomString } from \"./random\";\n\nexport type { AuthEventCategory, AuthEventKind };\n\ntype Awaitable<T> = T | PromiseLike<T>;\nexport type AuthEventJson =\n  | null\n  | boolean\n  | number\n  | string\n  | AuthEventJson[]\n  | { [key: string]: AuthEventJson };\nexport type AuthEventObject = { [key: string]: unknown };\nexport type AuthProfileSnapshot = AuthEventObject;\nexport type OidcClaims = AuthEventObject;\nexport type SamlClaims = AuthEventObject;\nexport type ScimRawAttributes = AuthEventObject;\ntype AuthEventCtx = ComponentCtx;\ntype QueuedAuthEventCtx = AuthEventCtx & Pick<GenericActionCtx<GenericDataModel>, \"scheduler\">;\n\nexport type AuthEventOutcome = \"success\" | \"failure\";\nexport type AuthEventTargetKind =\n  | \"user\"\n  | \"session\"\n  | \"group\"\n  | \"connection\"\n  | \"oauth_client\"\n  | \"api_key\"\n  | \"global\";\n\nexport type AuthEventActorType =\n  | \"user\"\n  | \"system\"\n  | \"scim\"\n  | \"api_key\"\n  | \"oauth_client\"\n  | \"webhook\"\n  | \"anonymous\";\n\nexport type AuthEventSubjectType =\n  | \"user\"\n  | \"session\"\n  | \"account\"\n  | \"passkey\"\n  | \"totp\"\n  | \"email\"\n  | \"phone\"\n  | \"api_key\"\n  | \"oauth_client\"\n  | \"oauth_code\"\n  | \"group\"\n  | \"connection\"\n  | \"scim_identity\"\n  | \"webhook_endpoint\"\n  | \"webhook_delivery\"\n  | \"system\";\n\nexport type AuthEventRef<K extends AuthEventKind = AuthEventKind> = {\n  readonly id: K;\n  readonly __authEventKind: K;\n};\n\ntype ScopeIdForKind<K extends AuthEventTargetKind> = K extends \"user\"\n  ? GenericId<\"User\">\n  : K extends \"session\"\n    ? GenericId<\"Session\">\n    : K extends \"group\"\n      ? GenericId<\"Group\">\n      : K extends \"connection\"\n        ? GenericId<\"GroupConnection\">\n        : K extends \"oauth_client\"\n          ? GenericId<\"OAuthClient\"> | string\n          : K extends \"api_key\"\n            ? GenericId<\"ApiKey\">\n            : K extends \"global\"\n              ? \"security\"\n              : string;\n\nexport type AuthEventTarget<\n  K extends AuthEventTargetKind = AuthEventTargetKind,\n  Id extends string = ScopeIdForKind<K>,\n> = {\n  readonly kind: K;\n  readonly id: Id;\n  readonly __authEventScope: K;\n};\n\nexport type AuthEventTargetScope<K extends AuthEventTargetKind = AuthEventTargetKind> = {\n  readonly kind: K;\n  readonly id: string;\n};\n\nexport type AuthEventActor<T extends AuthEventActorType = AuthEventActorType> = {\n  type: T;\n  id?: string;\n};\n\nexport type AuthEventSubject<T extends AuthEventSubjectType = AuthEventSubjectType> = {\n  type: T;\n  id?: string;\n};\n\nexport type AuthEventRequest = {\n  requestId?: string;\n  ip?: string;\n  userAgent?: string;\n};\n\nexport type AuthEventDataByKind<TExtend = {}> = {\n  \"user.created\": { type: string; provider: string; profile?: AuthProfileSnapshot };\n  \"user.updated\": {\n    existingUserId?: string;\n    type?: string;\n    provider?: string;\n    profile?: AuthProfileSnapshot;\n  };\n  \"session.signed_in\": { provider: string; method?: string };\n  \"session.signed_out\": undefined;\n  \"session.invalidated\": { userId: string; reason?: string };\n  \"session.refresh_exchanged\": { sessionId?: string };\n  \"session.refresh_reuse_detected\": { userId?: string; refreshTokenId?: string };\n  \"account.linked\": { provider: string; providerAccountId?: string };\n  \"account.unlinked\": { accountId: string; provider: string };\n  \"password.changed\": { userId?: string; flow?: \"reset\" | \"change\" };\n  \"passkey.added\": { passkeyId: string; credentialId?: string };\n  \"passkey.removed\": { passkeyId: string };\n  \"totp.enrolled\": { totpId: string };\n  \"totp.removed\": { totpId: string };\n  \"email.verified\": { userId: string; email: string };\n  \"phone.verified\": { userId: string; phone: string };\n  \"api_key.created\": { keyId: string; name?: string; prefix?: string };\n  \"api_key.revoked\": { keyId: string; reason?: string };\n  \"oauth.client.created\": { clientId: string; name?: string; scopes?: string[] };\n  \"oauth.client.revoked\": { clientId: string };\n  \"oauth.code.created\": {\n    clientId: string;\n    codeId?: string;\n    scopes?: string[];\n    redirectUri?: string;\n  };\n  \"oauth.token.created\": {\n    clientId: string;\n    scopes?: string[];\n    grantType?: string;\n    resource?: string;\n  };\n  \"oauth.token.exchanged\": {\n    clientId: string;\n    scopes?: string[];\n    grantType?: string;\n    resource?: string;\n  };\n  \"oauth.refresh.reuse_detected\": { clientId: string; userId?: string };\n  \"oauth.refresh.revoked\": { clientId: string; userId?: string };\n  \"connection.created\": { connectionId: string; protocol?: \"oidc\" | \"saml\"; domain?: string };\n  \"connection.updated\": { connectionId: string; changed?: string[] };\n  \"connection.removed\": { connectionId: string };\n  \"connection.login.succeeded\": {\n    connectionId: string;\n    protocol: \"oidc\" | \"saml\";\n    userId?: string;\n  };\n  \"connection.login.failed\": {\n    connectionId?: string;\n    protocol?: \"oidc\" | \"saml\";\n    errorCode?: string;\n  };\n  \"connection.domain.verification_requested\": {\n    connectionId: string;\n    domain: string;\n    recordName?: string;\n    expiresAt?: number;\n  };\n  \"connection.domain.verified\": { connectionId: string; domain: string; verifiedAt?: number };\n  \"connection.policy.updated\": { version: number };\n  \"connection.saml.set\": { connectionId: string; metadataUrl?: string; domains?: string[] };\n  \"connection.saml.refreshed\": { connectionId: string; metadataUrl?: string };\n  \"connection.oidc.set\": {\n    connectionId: string;\n    issuer?: string;\n    discoveryUrl?: string;\n    jwksUri?: string;\n    audience?: string | string[];\n    tokenEndpointAuthMethod?: string;\n  };\n  \"connection.scim.set\": { scimConfigId: string };\n  \"connection.scim.read\": {\n    resourceType?: \"user\" | \"group\";\n    resourceId?: string;\n    operation?: string;\n  };\n  \"connection.scim.user.provisioned\": { userId?: string; externalId?: string; active?: boolean };\n  \"connection.scim.user.updated\": { userId?: string; externalId?: string; active?: boolean };\n  \"connection.scim.user.deactivated\": { userId?: string; externalId?: string };\n  \"connection.scim.user.reactivated\": { userId?: string; externalId?: string };\n  \"connection.scim.group.provisioned\": { groupId?: string; externalId?: string };\n  \"connection.scim.group.updated\": { groupId?: string; externalId?: string };\n  \"connection.scim.group.deactivated\": { groupId?: string; externalId?: string };\n  \"connection.scim.group.reactivated\": { groupId?: string; externalId?: string };\n  \"webhook.endpoint.created\": { endpointId?: string };\n  \"webhook.endpoint.disabled\": { endpointId?: string };\n  \"webhook.delivery.created\": {\n    deliveryId: string;\n    endpointId: string;\n    sourceEventId: string;\n    sourceEventType: AuthEventKind;\n  };\n  \"webhook.delivery.attempted\": {\n    deliveryId: string;\n    endpointId: string;\n    sourceEventId: string;\n    sourceEventType: AuthEventKind;\n    attemptCount: number;\n  };\n  \"webhook.delivery.succeeded\": {\n    deliveryId: string;\n    endpointId: string;\n    sourceEventId: string;\n    sourceEventType: AuthEventKind;\n    status: number;\n  };\n  \"webhook.delivery.failed\": {\n    deliveryId: string;\n    endpointId: string;\n    sourceEventId: string;\n    sourceEventType: AuthEventKind;\n    status?: number;\n    error?: string;\n  };\n} & TExtend;\n\ntype EventData<K extends AuthEventKind, TExtend = {}> = AuthEventDataByKind<TExtend>[K];\n\ntype EventDataField<K extends AuthEventKind, TExtend = {}> = K extends AuthEventKind\n  ? EventData<K, TExtend> extends undefined\n    ? { data?: undefined }\n    : { data: EventData<K, TExtend> }\n  : never;\n\ntype AuthEventBase<K extends AuthEventKind = AuthEventKind> = {\n  eventId: string;\n  kind: K;\n  category: AuthEventCategory;\n  occurredAt: number;\n  actor: AuthEventActor;\n  subject: AuthEventSubject;\n  targets: AuthEventTargetScope[];\n  request?: AuthEventRequest;\n  outcome: AuthEventOutcome;\n  errorCode?: string;\n};\n\nexport type AuthEvent<\n  K extends AuthEventKind = AuthEventKind,\n  TExtend = {},\n> = K extends AuthEventKind ? AuthEventBase<K> & EventDataField<K, TExtend> : never;\n\ntype AuthEventWhereFilter = {\n  target?: AuthEventTarget;\n  kind?: AuthEventKind;\n  category?: AuthEventCategory;\n  outcome?: AuthEventOutcome;\n  actor?: AuthEventActor;\n  subject?: AuthEventSubject;\n  requestId?: string;\n  occurredAtGte?: number;\n  occurredAtGt?: number;\n  occurredAtLte?: number;\n  occurredAtLt?: number;\n};\n\ntype AuthEventHandler<K extends AuthEventKind, TExtend = {}> = (\n  ctx: AuthEventCtx,\n  event: AuthEvent<K, TExtend>,\n) => Awaitable<void>;\n\nexport type AuthEventHandlerMap<TExtend = {}> = {\n  user?: {\n    created?: AuthEventHandler<\"user.created\", TExtend>;\n    updated?: AuthEventHandler<\"user.updated\", TExtend>;\n  };\n  session?: {\n    signedIn?: AuthEventHandler<\"session.signed_in\", TExtend>;\n    signedOut?: AuthEventHandler<\"session.signed_out\", TExtend>;\n    invalidated?: AuthEventHandler<\"session.invalidated\", TExtend>;\n    refreshExchanged?: AuthEventHandler<\"session.refresh_exchanged\", TExtend>;\n    refreshReuseDetected?: AuthEventHandler<\"session.refresh_reuse_detected\", TExtend>;\n  };\n  account?: {\n    linked?: AuthEventHandler<\"account.linked\", TExtend>;\n    unlinked?: AuthEventHandler<\"account.unlinked\", TExtend>;\n  };\n  password?: {\n    changed?: AuthEventHandler<\"password.changed\", TExtend>;\n  };\n  passkey?: {\n    added?: AuthEventHandler<\"passkey.added\", TExtend>;\n    removed?: AuthEventHandler<\"passkey.removed\", TExtend>;\n  };\n  totp?: {\n    enrolled?: AuthEventHandler<\"totp.enrolled\", TExtend>;\n    removed?: AuthEventHandler<\"totp.removed\", TExtend>;\n  };\n  email?: {\n    verified?: AuthEventHandler<\"email.verified\", TExtend>;\n  };\n  phone?: {\n    verified?: AuthEventHandler<\"phone.verified\", TExtend>;\n  };\n  apiKey?: {\n    created?: AuthEventHandler<\"api_key.created\", TExtend>;\n    revoked?: AuthEventHandler<\"api_key.revoked\", TExtend>;\n  };\n  oauth?: {\n    clientCreated?: AuthEventHandler<\"oauth.client.created\", TExtend>;\n    clientRevoked?: AuthEventHandler<\"oauth.client.revoked\", TExtend>;\n    codeCreated?: AuthEventHandler<\"oauth.code.created\", TExtend>;\n    tokenCreated?: AuthEventHandler<\"oauth.token.created\", TExtend>;\n    tokenExchanged?: AuthEventHandler<\"oauth.token.exchanged\", TExtend>;\n    refreshReuseDetected?: AuthEventHandler<\"oauth.refresh.reuse_detected\", TExtend>;\n    refreshRevoked?: AuthEventHandler<\"oauth.refresh.revoked\", TExtend>;\n  };\n  connection?: {\n    connectionCreated?: AuthEventHandler<\"connection.created\", TExtend>;\n    connectionUpdated?: AuthEventHandler<\"connection.updated\", TExtend>;\n    connectionRemoved?: AuthEventHandler<\"connection.removed\", TExtend>;\n    loginSucceeded?: AuthEventHandler<\"connection.login.succeeded\", TExtend>;\n    loginFailed?: AuthEventHandler<\"connection.login.failed\", TExtend>;\n    domainVerificationRequested?: AuthEventHandler<\n      \"connection.domain.verification_requested\",\n      TExtend\n    >;\n    domainVerified?: AuthEventHandler<\"connection.domain.verified\", TExtend>;\n    policyUpdated?: AuthEventHandler<\"connection.policy.updated\", TExtend>;\n    samlSet?: AuthEventHandler<\"connection.saml.set\", TExtend>;\n    samlRefreshed?: AuthEventHandler<\"connection.saml.refreshed\", TExtend>;\n    oidcSet?: AuthEventHandler<\"connection.oidc.set\", TExtend>;\n  };\n  scim?: {\n    set?: AuthEventHandler<\"connection.scim.set\", TExtend>;\n    read?: AuthEventHandler<\"connection.scim.read\", TExtend>;\n    userProvisioned?: AuthEventHandler<\"connection.scim.user.provisioned\", TExtend>;\n    userUpdated?: AuthEventHandler<\"connection.scim.user.updated\", TExtend>;\n    userDeactivated?: AuthEventHandler<\"connection.scim.user.deactivated\", TExtend>;\n    userReactivated?: AuthEventHandler<\"connection.scim.user.reactivated\", TExtend>;\n    groupProvisioned?: AuthEventHandler<\"connection.scim.group.provisioned\", TExtend>;\n    groupUpdated?: AuthEventHandler<\"connection.scim.group.updated\", TExtend>;\n    groupDeactivated?: AuthEventHandler<\"connection.scim.group.deactivated\", TExtend>;\n    groupReactivated?: AuthEventHandler<\"connection.scim.group.reactivated\", TExtend>;\n  };\n  webhook?: {\n    endpointCreated?: AuthEventHandler<\"webhook.endpoint.created\", TExtend>;\n    endpointDisabled?: AuthEventHandler<\"webhook.endpoint.disabled\", TExtend>;\n  };\n};\n\ntype AuthEventWhereField = keyof Pick<\n  AuthEventWhereFilter,\n  \"target\" | \"kind\" | \"category\" | \"outcome\" | \"actor\" | \"subject\" | \"requestId\"\n>;\n\n/**\n * Value {@link AuthEventWhereBuilder.eq} accepts for a field. Equals the stored\n * filter type for every field except `kind`, which takes an {@link AuthEventRef}\n * and is stored as its underlying `AuthEventKind` id.\n */\ntype AuthEventEqValue<F extends AuthEventWhereField> = F extends \"kind\"\n  ? AuthEventRef\n  : NonNullable<AuthEventWhereFilter[F]>;\n\n/**\n * Per-field setters mapping the caller-supplied {@link AuthEventEqValue} to the\n * value stored in {@link AuthEventWhereFilter} — isolating the single `kind`\n * ref→id transform; every other field is identity.\n */\nconst authEventEqSetters: {\n  [F in AuthEventWhereField]: (value: AuthEventEqValue<F>) => NonNullable<AuthEventWhereFilter[F]>;\n} = {\n  target: (value) => value,\n  kind: (value) => value.id,\n  category: (value) => value,\n  outcome: (value) => value,\n  actor: (value) => value,\n  subject: (value) => value,\n  requestId: (value) => value,\n};\n\nclass AuthEventWhereBuilder {\n  private readonly where: AuthEventWhereFilter = {};\n\n  /**\n   * Constrain the query to events whose `field` equals `value`. For `kind`, pass\n   * an {@link AuthEventRef} (e.g. `authEvents.session.signedIn`); other fields\n   * take their literal value.\n   */\n  eq<F extends AuthEventWhereField>(field: F, value: AuthEventEqValue<F>): this {\n    this.where[field] = authEventEqSetters[field](value);\n    return this;\n  }\n\n  gt(field: \"occurredAt\", value: number): this {\n    this.where.occurredAtGt = value;\n    return this;\n  }\n\n  gte(field: \"occurredAt\", value: number): this {\n    this.where.occurredAtGte = value;\n    return this;\n  }\n\n  lt(field: \"occurredAt\", value: number): this {\n    this.where.occurredAtLt = value;\n    return this;\n  }\n\n  lte(field: \"occurredAt\", value: number): this {\n    this.where.occurredAtLte = value;\n    return this;\n  }\n\n  build(): AuthEventWhereFilter {\n    return { ...this.where };\n  }\n}\n\nexport type AuthEventWhereBuilderShape = Pick<\n  AuthEventWhereBuilder,\n  \"eq\" | \"gt\" | \"gte\" | \"lt\" | \"lte\"\n>;\n\nexport type AuthEventWhereInput = (q: AuthEventWhereBuilderShape) => AuthEventWhereBuilderShape;\n\nexport type AuthEventWhere = AuthEventWhereInput;\n\ntype ExactAuthEventHandlerMap<T> = T & {\n  [K in Exclude<keyof T, keyof AuthEventHandlerMap>]: never;\n} & {\n  [K in keyof T & keyof AuthEventHandlerMap]: T[K] extends object\n    ? T[K] & {\n        [N in Exclude<keyof T[K], keyof NonNullable<AuthEventHandlerMap[K]>>]: never;\n      }\n    : T[K];\n};\n\nfunction eventRef<const K extends AuthEventKind>(id: K): AuthEventRef<K> {\n  return { id, __authEventKind: id };\n}\n\nfunction targetRef<const K extends AuthEventTargetKind>(\n  kind: K,\n  id: ScopeIdForKind<K>,\n): AuthEventTarget<K> {\n  return { kind, id, __authEventScope: kind };\n}\n\nfunction compileWhere(where: AuthEventWhereInput): AuthEventWhereFilter {\n  const builder = new AuthEventWhereBuilder();\n  where(builder);\n  return builder.build();\n}\n\nfunction categoryForKind(kind: AuthEventKind): AuthEventCategory {\n  return EVENT_KIND_CATEGORY[kind];\n}\n\n/**\n * Generate a unique event id.\n *\n * Every emit is a distinct audit record, so the id is unique by construction.\n * The projection dedup only collapses identical\n * caller-supplied keys (e.g. webhook delivery attempts), never distinct emits.\n */\nfunction eventId(event: { kind: AuthEventKind; subject: AuthEventSubject }): string {\n  const suffix = generateRandomString(16, \"abcdefghijklmnopqrstuvwxyz0123456789\");\n  return `${event.kind}:${event.subject.type}:${event.subject.id ?? \"none\"}:${Date.now()}:${suffix}`;\n}\n\nexport type EmitAuthEventInput<K extends AuthEventKind = AuthEventKind> = {\n  eventId?: string;\n  category?: AuthEventCategory;\n  occurredAt?: number;\n  kind: K;\n  actor: AuthEventActor;\n  subject: AuthEventSubject;\n  targets: AuthEventTargetScope[];\n  request?: AuthEventRequest;\n  outcome: AuthEventOutcome;\n  errorCode?: string;\n  data?: EventData<K>;\n};\n\ntype EventConfig = {\n  component: AuthComponentApi;\n  events?: AuthEventHandlerMap;\n};\n\n/** The emit input plus the fields {@link emitAuthEvent} computes when omitted. */\ntype AuthEventComputed<K extends AuthEventKind> = EmitAuthEventInput<K> & {\n  eventId: string;\n  category: AuthEventCategory;\n  occurredAt: number;\n};\n\n/**\n * View a fully-computed event as the kind-correlated {@link AuthEvent}.\n *\n * `AuthEvent<K>` is a distributive conditional that correlates `data` to `kind`;\n * TypeScript cannot construct it positively from the structurally wider computed\n * object. The value is correct by construction and the component re-validates it\n * against `vAuthEvent` on append, so this is the single narrow boundary\n * assertion — a typed target, never `any`.\n */\nfunction finalizeAuthEvent<K extends AuthEventKind>(computed: AuthEventComputed<K>): AuthEvent<K> {\n  return computed as AuthEvent<K>;\n}\n\nfunction computeAuthEvent<K extends AuthEventKind>(input: EmitAuthEventInput<K>): AuthEvent<K> {\n  return finalizeAuthEvent<K>({\n    ...input,\n    eventId: input.eventId ?? eventId(input),\n    category: input.category ?? categoryForKind(input.kind),\n    occurredAt: input.occurredAt ?? Date.now(),\n  });\n}\n\nfunction appendArgs(event: AuthEvent) {\n  return {\n    event,\n    targets: event.targets,\n    idempotencyKey: event.eventId,\n  };\n}\n\ntype AuthEventHandlerSelector<K extends AuthEventKind> = (\n  handlers: AuthEventHandlerMap,\n) => AuthEventHandler<K> | undefined;\n\n/**\n * Single source of truth mapping every {@link AuthEventKind} to the selector\n * that resolves its user-supplied handler from an {@link AuthEventHandlerMap}.\n *\n * Typed as `Record<AuthEventKind, …>` (via `EventHandlerSelectorTable`) so the\n * compiler enforces exactly one entry per kind: a missing kind fails to\n * typecheck rather than silently resolving to no handler. Each selector returns\n * the handler typed to its own kind, so the resolved value is invoked against\n * the matching event with no widening. Kinds with no slot in\n * `AuthEventHandlerMap` map to a selector that returns `undefined`.\n */\ntype EventHandlerSelectorTable = {\n  [K in AuthEventKind]: AuthEventHandlerSelector<K>;\n};\n\nconst EVENT_HANDLER_SELECTORS: EventHandlerSelectorTable = {\n  \"user.created\": (h) => h.user?.created,\n  \"user.updated\": (h) => h.user?.updated,\n  \"session.signed_in\": (h) => h.session?.signedIn,\n  \"session.signed_out\": (h) => h.session?.signedOut,\n  \"session.invalidated\": (h) => h.session?.invalidated,\n  \"session.refresh_exchanged\": (h) => h.session?.refreshExchanged,\n  \"session.refresh_reuse_detected\": (h) => h.session?.refreshReuseDetected,\n  \"account.linked\": (h) => h.account?.linked,\n  \"account.unlinked\": (h) => h.account?.unlinked,\n  \"password.changed\": (h) => h.password?.changed,\n  \"passkey.added\": (h) => h.passkey?.added,\n  \"passkey.removed\": (h) => h.passkey?.removed,\n  \"totp.enrolled\": (h) => h.totp?.enrolled,\n  \"totp.removed\": (h) => h.totp?.removed,\n  \"email.verified\": (h) => h.email?.verified,\n  \"phone.verified\": (h) => h.phone?.verified,\n  \"api_key.created\": (h) => h.apiKey?.created,\n  \"api_key.revoked\": (h) => h.apiKey?.revoked,\n  \"oauth.client.created\": (h) => h.oauth?.clientCreated,\n  \"oauth.client.revoked\": (h) => h.oauth?.clientRevoked,\n  \"oauth.code.created\": (h) => h.oauth?.codeCreated,\n  \"oauth.token.created\": (h) => h.oauth?.tokenCreated,\n  \"oauth.token.exchanged\": (h) => h.oauth?.tokenExchanged,\n  \"oauth.refresh.reuse_detected\": (h) => h.oauth?.refreshReuseDetected,\n  \"oauth.refresh.revoked\": (h) => h.oauth?.refreshRevoked,\n  \"connection.created\": (h) => h.connection?.connectionCreated,\n  \"connection.updated\": (h) => h.connection?.connectionUpdated,\n  \"connection.removed\": (h) => h.connection?.connectionRemoved,\n  \"connection.login.succeeded\": (h) => h.connection?.loginSucceeded,\n  \"connection.login.failed\": (h) => h.connection?.loginFailed,\n  \"connection.domain.verification_requested\": (h) => h.connection?.domainVerificationRequested,\n  \"connection.domain.verified\": (h) => h.connection?.domainVerified,\n  \"connection.policy.updated\": (h) => h.connection?.policyUpdated,\n  \"connection.saml.set\": (h) => h.connection?.samlSet,\n  \"connection.saml.refreshed\": (h) => h.connection?.samlRefreshed,\n  \"connection.oidc.set\": (h) => h.connection?.oidcSet,\n  \"connection.scim.set\": (h) => h.scim?.set,\n  \"connection.scim.read\": (h) => h.scim?.read,\n  \"connection.scim.user.provisioned\": (h) => h.scim?.userProvisioned,\n  \"connection.scim.user.updated\": (h) => h.scim?.userUpdated,\n  \"connection.scim.user.deactivated\": (h) => h.scim?.userDeactivated,\n  \"connection.scim.user.reactivated\": (h) => h.scim?.userReactivated,\n  \"connection.scim.group.provisioned\": (h) => h.scim?.groupProvisioned,\n  \"connection.scim.group.updated\": (h) => h.scim?.groupUpdated,\n  \"connection.scim.group.deactivated\": (h) => h.scim?.groupDeactivated,\n  \"connection.scim.group.reactivated\": (h) => h.scim?.groupReactivated,\n  \"webhook.endpoint.created\": (h) => h.webhook?.endpointCreated,\n  \"webhook.endpoint.disabled\": (h) => h.webhook?.endpointDisabled,\n  \"webhook.delivery.created\": () => undefined,\n  \"webhook.delivery.attempted\": () => undefined,\n  \"webhook.delivery.succeeded\": () => undefined,\n  \"webhook.delivery.failed\": () => undefined,\n};\n\nfunction selectEventHandler<K extends AuthEventKind>(\n  handlers: AuthEventHandlerMap,\n  kind: K,\n): AuthEventHandler<K> | undefined {\n  return EVENT_HANDLER_SELECTORS[kind](handlers);\n}\n\nasync function runEventHandler(\n  ctx: AuthEventCtx,\n  handlers: AuthEventHandlerMap | undefined,\n  event: AuthEvent,\n) {\n  if (!handlers) return;\n  const handler = selectEventHandler(handlers, event.kind);\n  await handler?.(ctx, event);\n}\n\n/**\n * Append an auth event to the durable projection log and run any matching handler.\n *\n * Fills in `eventId`, `category`, and `occurredAt` when omitted, then writes\n * via the component `event.append` mutation. The configured handler for the\n * event kind runs only when the append created a new record (idempotency).\n *\n * @param ctx - Convex mutation or action context.\n * @param config - Component reference plus optional event handler map.\n * @param input - The event to emit.\n * @returns The append result from the component mutation.\n */\nexport async function emitAuthEvent<K extends AuthEventKind>(\n  ctx: AuthEventCtx,\n  config: EventConfig,\n  input: EmitAuthEventInput<K>,\n) {\n  const event = computeAuthEvent(input);\n  const result = await ctx.runMutation(config.component.event.append, appendArgs(event));\n  if (result.created) {\n    await runEventHandler(ctx, config.events, event);\n  }\n  return result;\n}\n\n/**\n * Persist an internal auth event after the request completes when no matching\n * application handler needs the idempotency result synchronously.\n *\n * Scheduled writes are recorded by the caller's mutation commit but execute in\n * a separate function, keeping projection fan-out off the\n * authentication critical path. Configured handlers preserve their existing\n * synchronous, exactly-once behavior by falling back to {@link emitAuthEvent}.\n *\n * @internal\n */\nexport async function queueAuthEvent<K extends AuthEventKind>(\n  ctx: QueuedAuthEventCtx,\n  config: EventConfig,\n  input: EmitAuthEventInput<K>,\n): Promise<void> {\n  const handler = config.events ? selectEventHandler(config.events, input.kind) : undefined;\n  if (handler !== undefined) {\n    await emitAuthEvent(ctx, config, input);\n    return;\n  }\n  const event = computeAuthEvent(input);\n  await ctx.scheduler.runAfter(0, config.component.event.append, appendArgs(event));\n}\n\n/**\n * Build the `auth.event` namespace for reading and emitting auth events.\n *\n * @param config - Component reference plus optional event handler map.\n * @returns An object with `get`, `list`, and `emit` helpers.\n */\nexport function createAuthEventDomain(config: EventConfig) {\n  return {\n    get: async (ctx: AuthEventCtx, args: { id: string }) =>\n      await ctx.runQuery(config.component.event.get, args),\n    list: async (\n      ctx: AuthEventCtx,\n      args: {\n        where: AuthEventWhereInput;\n        order?: \"asc\" | \"desc\";\n        paginationOpts: PaginationOptions;\n      },\n    ) =>\n      await ctx.runQuery(config.component.event.list, {\n        ...args,\n        where: compileWhere(args.where),\n      }),\n    emit: async <K extends AuthEventKind>(ctx: AuthEventCtx, args: EmitAuthEventInput<K>) =>\n      await emitAuthEvent(ctx, config, args),\n  };\n}\n\n/**\n * Typed registry of auth event refs and builders.\n *\n * Provides `eventRef`-typed kinds (e.g. `authEvents.session.signedIn`) plus\n * `target`, `actor`, and `subject` constructors, an exact-checked `handlers`\n * helper, and a `where` filter builder for {@link createAuthEventDomain}'s\n * `list`.\n */\nexport const authEvents = {\n  user: {\n    created: eventRef(\"user.created\"),\n    updated: eventRef(\"user.updated\"),\n  },\n  session: {\n    signedIn: eventRef(\"session.signed_in\"),\n    signedOut: eventRef(\"session.signed_out\"),\n    invalidated: eventRef(\"session.invalidated\"),\n    refreshExchanged: eventRef(\"session.refresh_exchanged\"),\n    refreshReuseDetected: eventRef(\"session.refresh_reuse_detected\"),\n  },\n  account: {\n    linked: eventRef(\"account.linked\"),\n    unlinked: eventRef(\"account.unlinked\"),\n  },\n  password: {\n    changed: eventRef(\"password.changed\"),\n  },\n  passkey: {\n    added: eventRef(\"passkey.added\"),\n    removed: eventRef(\"passkey.removed\"),\n  },\n  totp: {\n    enrolled: eventRef(\"totp.enrolled\"),\n    removed: eventRef(\"totp.removed\"),\n  },\n  email: {\n    verified: eventRef(\"email.verified\"),\n  },\n  phone: {\n    verified: eventRef(\"phone.verified\"),\n  },\n  apiKey: {\n    created: eventRef(\"api_key.created\"),\n    revoked: eventRef(\"api_key.revoked\"),\n  },\n  oauth: {\n    clientCreated: eventRef(\"oauth.client.created\"),\n    clientRevoked: eventRef(\"oauth.client.revoked\"),\n    codeCreated: eventRef(\"oauth.code.created\"),\n    tokenCreated: eventRef(\"oauth.token.created\"),\n    tokenExchanged: eventRef(\"oauth.token.exchanged\"),\n    refreshReuseDetected: eventRef(\"oauth.refresh.reuse_detected\"),\n    refreshRevoked: eventRef(\"oauth.refresh.revoked\"),\n  },\n  connection: {\n    connectionCreated: eventRef(\"connection.created\"),\n    connectionUpdated: eventRef(\"connection.updated\"),\n    connectionRemoved: eventRef(\"connection.removed\"),\n    loginSucceeded: eventRef(\"connection.login.succeeded\"),\n    loginFailed: eventRef(\"connection.login.failed\"),\n    domainVerificationRequested: eventRef(\"connection.domain.verification_requested\"),\n    domainVerified: eventRef(\"connection.domain.verified\"),\n    policyUpdated: eventRef(\"connection.policy.updated\"),\n    samlSet: eventRef(\"connection.saml.set\"),\n    samlRefreshed: eventRef(\"connection.saml.refreshed\"),\n    oidcSet: eventRef(\"connection.oidc.set\"),\n  },\n  scim: {\n    set: eventRef(\"connection.scim.set\"),\n    read: eventRef(\"connection.scim.read\"),\n    userProvisioned: eventRef(\"connection.scim.user.provisioned\"),\n    userUpdated: eventRef(\"connection.scim.user.updated\"),\n    userDeactivated: eventRef(\"connection.scim.user.deactivated\"),\n    userReactivated: eventRef(\"connection.scim.user.reactivated\"),\n    groupProvisioned: eventRef(\"connection.scim.group.provisioned\"),\n    groupUpdated: eventRef(\"connection.scim.group.updated\"),\n    groupDeactivated: eventRef(\"connection.scim.group.deactivated\"),\n    groupReactivated: eventRef(\"connection.scim.group.reactivated\"),\n  },\n  webhook: {\n    endpointCreated: eventRef(\"webhook.endpoint.created\"),\n    endpointDisabled: eventRef(\"webhook.endpoint.disabled\"),\n    deliveryCreated: eventRef(\"webhook.delivery.created\"),\n    deliveryAttempted: eventRef(\"webhook.delivery.attempted\"),\n    deliverySucceeded: eventRef(\"webhook.delivery.succeeded\"),\n    deliveryFailed: eventRef(\"webhook.delivery.failed\"),\n  },\n  target: {\n    user: (id: GenericId<\"User\">) => targetRef(\"user\", id),\n    session: (id: GenericId<\"Session\">) => targetRef(\"session\", id),\n    group: (id: GenericId<\"Group\">) => targetRef(\"group\", id),\n    connection: (id: GenericId<\"GroupConnection\">) => targetRef(\"connection\", id),\n    oauthClient: (id: GenericId<\"OAuthClient\"> | string) => targetRef(\"oauth_client\", id),\n    apiKey: (id: GenericId<\"ApiKey\">) => targetRef(\"api_key\", id),\n    security: () => targetRef(\"global\", \"security\"),\n  },\n  actor: {\n    user: (id: string): AuthEventActor<\"user\"> => ({ type: \"user\", id }),\n    system: (): AuthEventActor<\"system\"> => ({ type: \"system\" }),\n    scim: (id?: string): AuthEventActor<\"scim\"> => ({ type: \"scim\", id }),\n    apiKey: (id: string): AuthEventActor<\"api_key\"> => ({ type: \"api_key\", id }),\n    oauthClient: (id: string): AuthEventActor<\"oauth_client\"> => ({ type: \"oauth_client\", id }),\n    webhook: (id: string): AuthEventActor<\"webhook\"> => ({ type: \"webhook\", id }),\n    anonymous: (): AuthEventActor<\"anonymous\"> => ({ type: \"anonymous\" }),\n  },\n  subject: {\n    user: (id: string): AuthEventSubject<\"user\"> => ({ type: \"user\", id }),\n    session: (id: string): AuthEventSubject<\"session\"> => ({ type: \"session\", id }),\n    account: (id: string): AuthEventSubject<\"account\"> => ({ type: \"account\", id }),\n    passkey: (id: string): AuthEventSubject<\"passkey\"> => ({ type: \"passkey\", id }),\n    totp: (id: string): AuthEventSubject<\"totp\"> => ({ type: \"totp\", id }),\n    email: (id: string): AuthEventSubject<\"email\"> => ({ type: \"email\", id }),\n    phone: (id: string): AuthEventSubject<\"phone\"> => ({ type: \"phone\", id }),\n    apiKey: (id: string): AuthEventSubject<\"api_key\"> => ({ type: \"api_key\", id }),\n    oauthClient: (id: string): AuthEventSubject<\"oauth_client\"> => ({\n      type: \"oauth_client\",\n      id,\n    }),\n    oauthCode: (id: string): AuthEventSubject<\"oauth_code\"> => ({ type: \"oauth_code\", id }),\n    group: (id: string): AuthEventSubject<\"group\"> => ({ type: \"group\", id }),\n    connection: (id: string): AuthEventSubject<\"connection\"> => ({ type: \"connection\", id }),\n    scimIdentity: (id: string): AuthEventSubject<\"scim_identity\"> => ({\n      type: \"scim_identity\",\n      id,\n    }),\n    webhookEndpoint: (id: string): AuthEventSubject<\"webhook_endpoint\"> => ({\n      type: \"webhook_endpoint\",\n      id,\n    }),\n    webhookDelivery: (id: string): AuthEventSubject<\"webhook_delivery\"> => ({\n      type: \"webhook_delivery\",\n      id,\n    }),\n    system: (): AuthEventSubject<\"system\"> => ({ type: \"system\" }),\n  },\n  handlers: <const T>(handlers: ExactAuthEventHandlerMap<T> & AuthEventHandlerMap) => handlers,\n  where: (build: (q: AuthEventWhereBuilderShape) => AuthEventWhereBuilderShape) =>\n    compileWhere(build),\n} as const;\n"],"mappings":";;;;;;;;;AAuYA,MAAM,qBAEF;CACF,SAAS,UAAU;CACnB,OAAO,UAAU,MAAM;CACvB,WAAW,UAAU;CACrB,UAAU,UAAU;CACpB,QAAQ,UAAU;CAClB,UAAU,UAAU;CACpB,YAAY,UAAU;CACvB;AAED,IAAM,wBAAN,MAA4B;CAC1B,AAAiB,QAA8B,EAAE;;;;;;CAOjD,GAAkC,OAAU,OAAkC;AAC5E,OAAK,MAAM,SAAS,mBAAmB,OAAO,MAAM;AACpD,SAAO;;CAGT,GAAG,OAAqB,OAAqB;AAC3C,OAAK,MAAM,eAAe;AAC1B,SAAO;;CAGT,IAAI,OAAqB,OAAqB;AAC5C,OAAK,MAAM,gBAAgB;AAC3B,SAAO;;CAGT,GAAG,OAAqB,OAAqB;AAC3C,OAAK,MAAM,eAAe;AAC1B,SAAO;;CAGT,IAAI,OAAqB,OAAqB;AAC5C,OAAK,MAAM,gBAAgB;AAC3B,SAAO;;CAGT,QAA8B;AAC5B,SAAO,EAAE,GAAG,KAAK,OAAO;;;AAuB5B,SAAS,SAAwC,IAAwB;AACvE,QAAO;EAAE;EAAI,iBAAiB;EAAI;;AAGpC,SAAS,UACP,MACA,IACoB;AACpB,QAAO;EAAE;EAAM;EAAI,kBAAkB;EAAM;;AAG7C,SAAS,aAAa,OAAkD;CACtE,MAAM,UAAU,IAAI,uBAAuB;AAC3C,OAAM,QAAQ;AACd,QAAO,QAAQ,OAAO;;AAGxB,SAAS,gBAAgB,MAAwC;AAC/D,QAAO,oBAAoB;;;;;;;;;AAU7B,SAAS,QAAQ,OAAmE;CAClF,MAAM,SAAS,qBAAqB,IAAI,uCAAuC;AAC/E,QAAO,GAAG,MAAM,KAAK,GAAG,MAAM,QAAQ,KAAK,GAAG,MAAM,QAAQ,MAAM,OAAO,GAAG,KAAK,KAAK,CAAC,GAAG;;;;;;;;;;;AAsC5F,SAAS,kBAA2C,UAA8C;AAChG,QAAO;;AAGT,SAAS,iBAA0C,OAA4C;AAC7F,QAAO,kBAAqB;EAC1B,GAAG;EACH,SAAS,MAAM,WAAW,QAAQ,MAAM;EACxC,UAAU,MAAM,YAAY,gBAAgB,MAAM,KAAK;EACvD,YAAY,MAAM,cAAc,KAAK,KAAK;EAC3C,CAAC;;AAGJ,SAAS,WAAW,OAAkB;AACpC,QAAO;EACL;EACA,SAAS,MAAM;EACf,gBAAgB,MAAM;EACvB;;AAsBH,MAAM,0BAAqD;CACzD,iBAAiB,MAAM,EAAE,MAAM;CAC/B,iBAAiB,MAAM,EAAE,MAAM;CAC/B,sBAAsB,MAAM,EAAE,SAAS;CACvC,uBAAuB,MAAM,EAAE,SAAS;CACxC,wBAAwB,MAAM,EAAE,SAAS;CACzC,8BAA8B,MAAM,EAAE,SAAS;CAC/C,mCAAmC,MAAM,EAAE,SAAS;CACpD,mBAAmB,MAAM,EAAE,SAAS;CACpC,qBAAqB,MAAM,EAAE,SAAS;CACtC,qBAAqB,MAAM,EAAE,UAAU;CACvC,kBAAkB,MAAM,EAAE,SAAS;CACnC,oBAAoB,MAAM,EAAE,SAAS;CACrC,kBAAkB,MAAM,EAAE,MAAM;CAChC,iBAAiB,MAAM,EAAE,MAAM;CAC/B,mBAAmB,MAAM,EAAE,OAAO;CAClC,mBAAmB,MAAM,EAAE,OAAO;CAClC,oBAAoB,MAAM,EAAE,QAAQ;CACpC,oBAAoB,MAAM,EAAE,QAAQ;CACpC,yBAAyB,MAAM,EAAE,OAAO;CACxC,yBAAyB,MAAM,EAAE,OAAO;CACxC,uBAAuB,MAAM,EAAE,OAAO;CACtC,wBAAwB,MAAM,EAAE,OAAO;CACvC,0BAA0B,MAAM,EAAE,OAAO;CACzC,iCAAiC,MAAM,EAAE,OAAO;CAChD,0BAA0B,MAAM,EAAE,OAAO;CACzC,uBAAuB,MAAM,EAAE,YAAY;CAC3C,uBAAuB,MAAM,EAAE,YAAY;CAC3C,uBAAuB,MAAM,EAAE,YAAY;CAC3C,+BAA+B,MAAM,EAAE,YAAY;CACnD,4BAA4B,MAAM,EAAE,YAAY;CAChD,6CAA6C,MAAM,EAAE,YAAY;CACjE,+BAA+B,MAAM,EAAE,YAAY;CACnD,8BAA8B,MAAM,EAAE,YAAY;CAClD,wBAAwB,MAAM,EAAE,YAAY;CAC5C,8BAA8B,MAAM,EAAE,YAAY;CAClD,wBAAwB,MAAM,EAAE,YAAY;CAC5C,wBAAwB,MAAM,EAAE,MAAM;CACtC,yBAAyB,MAAM,EAAE,MAAM;CACvC,qCAAqC,MAAM,EAAE,MAAM;CACnD,iCAAiC,MAAM,EAAE,MAAM;CAC/C,qCAAqC,MAAM,EAAE,MAAM;CACnD,qCAAqC,MAAM,EAAE,MAAM;CACnD,sCAAsC,MAAM,EAAE,MAAM;CACpD,kCAAkC,MAAM,EAAE,MAAM;CAChD,sCAAsC,MAAM,EAAE,MAAM;CACpD,sCAAsC,MAAM,EAAE,MAAM;CACpD,6BAA6B,MAAM,EAAE,SAAS;CAC9C,8BAA8B,MAAM,EAAE,SAAS;CAC/C,kCAAkC;CAClC,oCAAoC;CACpC,oCAAoC;CACpC,iCAAiC;CAClC;AAED,SAAS,mBACP,UACA,MACiC;AACjC,QAAO,wBAAwB,MAAM,SAAS;;AAGhD,eAAe,gBACb,KACA,UACA,OACA;AACA,KAAI,CAAC,SAAU;AAEf,OADgB,mBAAmB,UAAU,MAAM,KAAK,GACxC,KAAK,MAAM;;;;;;;;;;;;;;AAe7B,eAAsB,cACpB,KACA,QACA,OACA;CACA,MAAM,QAAQ,iBAAiB,MAAM;CACrC,MAAM,SAAS,MAAM,IAAI,YAAY,OAAO,UAAU,MAAM,QAAQ,WAAW,MAAM,CAAC;AACtF,KAAI,OAAO,QACT,OAAM,gBAAgB,KAAK,OAAO,QAAQ,MAAM;AAElD,QAAO;;;;;;;;;;;;;AAcT,eAAsB,eACpB,KACA,QACA,OACe;AAEf,MADgB,OAAO,SAAS,mBAAmB,OAAO,QAAQ,MAAM,KAAK,GAAG,YAChE,QAAW;AACzB,QAAM,cAAc,KAAK,QAAQ,MAAM;AACvC;;CAEF,MAAM,QAAQ,iBAAiB,MAAM;AACrC,OAAM,IAAI,UAAU,SAAS,GAAG,OAAO,UAAU,MAAM,QAAQ,WAAW,MAAM,CAAC;;;;;;;;AASnF,SAAgB,sBAAsB,QAAqB;AACzD,QAAO;EACL,KAAK,OAAO,KAAmB,SAC7B,MAAM,IAAI,SAAS,OAAO,UAAU,MAAM,KAAK,KAAK;EACtD,MAAM,OACJ,KACA,SAMA,MAAM,IAAI,SAAS,OAAO,UAAU,MAAM,MAAM;GAC9C,GAAG;GACH,OAAO,aAAa,KAAK,MAAM;GAChC,CAAC;EACJ,MAAM,OAAgC,KAAmB,SACvD,MAAM,cAAc,KAAK,QAAQ,KAAK;EACzC;;;;;;;;;;AAWH,MAAa,aAAa;CACxB,MAAM;EACJ,SAAS,SAAS,eAAe;EACjC,SAAS,SAAS,eAAe;EAClC;CACD,SAAS;EACP,UAAU,SAAS,oBAAoB;EACvC,WAAW,SAAS,qBAAqB;EACzC,aAAa,SAAS,sBAAsB;EAC5C,kBAAkB,SAAS,4BAA4B;EACvD,sBAAsB,SAAS,iCAAiC;EACjE;CACD,SAAS;EACP,QAAQ,SAAS,iBAAiB;EAClC,UAAU,SAAS,mBAAmB;EACvC;CACD,UAAU,EACR,SAAS,SAAS,mBAAmB,EACtC;CACD,SAAS;EACP,OAAO,SAAS,gBAAgB;EAChC,SAAS,SAAS,kBAAkB;EACrC;CACD,MAAM;EACJ,UAAU,SAAS,gBAAgB;EACnC,SAAS,SAAS,eAAe;EAClC;CACD,OAAO,EACL,UAAU,SAAS,iBAAiB,EACrC;CACD,OAAO,EACL,UAAU,SAAS,iBAAiB,EACrC;CACD,QAAQ;EACN,SAAS,SAAS,kBAAkB;EACpC,SAAS,SAAS,kBAAkB;EACrC;CACD,OAAO;EACL,eAAe,SAAS,uBAAuB;EAC/C,eAAe,SAAS,uBAAuB;EAC/C,aAAa,SAAS,qBAAqB;EAC3C,cAAc,SAAS,sBAAsB;EAC7C,gBAAgB,SAAS,wBAAwB;EACjD,sBAAsB,SAAS,+BAA+B;EAC9D,gBAAgB,SAAS,wBAAwB;EAClD;CACD,YAAY;EACV,mBAAmB,SAAS,qBAAqB;EACjD,mBAAmB,SAAS,qBAAqB;EACjD,mBAAmB,SAAS,qBAAqB;EACjD,gBAAgB,SAAS,6BAA6B;EACtD,aAAa,SAAS,0BAA0B;EAChD,6BAA6B,SAAS,2CAA2C;EACjF,gBAAgB,SAAS,6BAA6B;EACtD,eAAe,SAAS,4BAA4B;EACpD,SAAS,SAAS,sBAAsB;EACxC,eAAe,SAAS,4BAA4B;EACpD,SAAS,SAAS,sBAAsB;EACzC;CACD,MAAM;EACJ,KAAK,SAAS,sBAAsB;EACpC,MAAM,SAAS,uBAAuB;EACtC,iBAAiB,SAAS,mCAAmC;EAC7D,aAAa,SAAS,+BAA+B;EACrD,iBAAiB,SAAS,mCAAmC;EAC7D,iBAAiB,SAAS,mCAAmC;EAC7D,kBAAkB,SAAS,oCAAoC;EAC/D,cAAc,SAAS,gCAAgC;EACvD,kBAAkB,SAAS,oCAAoC;EAC/D,kBAAkB,SAAS,oCAAoC;EAChE;CACD,SAAS;EACP,iBAAiB,SAAS,2BAA2B;EACrD,kBAAkB,SAAS,4BAA4B;EACvD,iBAAiB,SAAS,2BAA2B;EACrD,mBAAmB,SAAS,6BAA6B;EACzD,mBAAmB,SAAS,6BAA6B;EACzD,gBAAgB,SAAS,0BAA0B;EACpD;CACD,QAAQ;EACN,OAAO,OAA0B,UAAU,QAAQ,GAAG;EACtD,UAAU,OAA6B,UAAU,WAAW,GAAG;EAC/D,QAAQ,OAA2B,UAAU,SAAS,GAAG;EACzD,aAAa,OAAqC,UAAU,cAAc,GAAG;EAC7E,cAAc,OAA0C,UAAU,gBAAgB,GAAG;EACrF,SAAS,OAA4B,UAAU,WAAW,GAAG;EAC7D,gBAAgB,UAAU,UAAU,WAAW;EAChD;CACD,OAAO;EACL,OAAO,QAAwC;GAAE,MAAM;GAAQ;GAAI;EACnE,eAAyC,EAAE,MAAM,UAAU;EAC3D,OAAO,QAAyC;GAAE,MAAM;GAAQ;GAAI;EACpE,SAAS,QAA2C;GAAE,MAAM;GAAW;GAAI;EAC3E,cAAc,QAAgD;GAAE,MAAM;GAAgB;GAAI;EAC1F,UAAU,QAA2C;GAAE,MAAM;GAAW;GAAI;EAC5E,kBAA+C,EAAE,MAAM,aAAa;EACrE;CACD,SAAS;EACP,OAAO,QAA0C;GAAE,MAAM;GAAQ;GAAI;EACrE,UAAU,QAA6C;GAAE,MAAM;GAAW;GAAI;EAC9E,UAAU,QAA6C;GAAE,MAAM;GAAW;GAAI;EAC9E,UAAU,QAA6C;GAAE,MAAM;GAAW;GAAI;EAC9E,OAAO,QAA0C;GAAE,MAAM;GAAQ;GAAI;EACrE,QAAQ,QAA2C;GAAE,MAAM;GAAS;GAAI;EACxE,QAAQ,QAA2C;GAAE,MAAM;GAAS;GAAI;EACxE,SAAS,QAA6C;GAAE,MAAM;GAAW;GAAI;EAC7E,cAAc,QAAkD;GAC9D,MAAM;GACN;GACD;EACD,YAAY,QAAgD;GAAE,MAAM;GAAc;GAAI;EACtF,QAAQ,QAA2C;GAAE,MAAM;GAAS;GAAI;EACxE,aAAa,QAAgD;GAAE,MAAM;GAAc;GAAI;EACvF,eAAe,QAAmD;GAChE,MAAM;GACN;GACD;EACD,kBAAkB,QAAsD;GACtE,MAAM;GACN;GACD;EACD,kBAAkB,QAAsD;GACtE,MAAM;GACN;GACD;EACD,eAA2C,EAAE,MAAM,UAAU;EAC9D;CACD,WAAoB,aAAgE;CACpF,QAAQ,UACN,aAAa,MAAM;CACtB"}
+{"version":3,"file":"events.js","names":[],"sources":["../../src/server/events.ts"],"sourcesContent":["/**\n * Typed auth event refs, handlers, filters, and server facade helpers.\n *\n * @module\n */\n\nimport type { GenericActionCtx, GenericDataModel, PaginationOptions } from \"convex/server\";\nimport type { GenericId } from \"convex/values\";\n\nimport {\n  EVENT_KIND_CATEGORY,\n  type AuthEventCategory,\n  type AuthEventKind,\n} from \"../shared/event/kinds\";\nimport type { AuthComponentApi } from \"./component/api\";\nimport type { ComponentCtx } from \"./component/context\";\nimport { generateRandomString } from \"./random\";\n\nexport type { AuthEventCategory, AuthEventKind };\n\ntype Awaitable<T> = T | PromiseLike<T>;\nexport type AuthEventJson =\n  | null\n  | boolean\n  | number\n  | string\n  | AuthEventJson[]\n  | { [key: string]: AuthEventJson };\nexport type AuthEventObject = { [key: string]: unknown };\nexport type AuthProfileSnapshot = AuthEventObject;\nexport type OidcClaims = AuthEventObject;\nexport type SamlClaims = AuthEventObject;\nexport type ScimRawAttributes = AuthEventObject;\ntype AuthEventCtx = ComponentCtx;\ntype QueuedAuthEventCtx = AuthEventCtx & Pick<GenericActionCtx<GenericDataModel>, \"scheduler\">;\n\nexport type AuthEventOutcome = \"success\" | \"failure\";\nexport type AuthEventTargetKind =\n  | \"user\"\n  | \"session\"\n  | \"group\"\n  | \"connection\"\n  | \"oauth_client\"\n  | \"api_key\"\n  | \"global\";\n\nexport type AuthEventActorType =\n  | \"user\"\n  | \"system\"\n  | \"scim\"\n  | \"api_key\"\n  | \"oauth_client\"\n  | \"webhook\"\n  | \"anonymous\";\n\nexport type AuthEventSubjectType =\n  | \"user\"\n  | \"session\"\n  | \"account\"\n  | \"passkey\"\n  | \"totp\"\n  | \"email\"\n  | \"phone\"\n  | \"api_key\"\n  | \"oauth_client\"\n  | \"oauth_code\"\n  | \"group\"\n  | \"connection\"\n  | \"scim_identity\"\n  | \"webhook_endpoint\"\n  | \"webhook_delivery\"\n  | \"system\";\n\nexport type AuthEventRef<K extends AuthEventKind = AuthEventKind> = {\n  readonly id: K;\n  readonly __authEventKind: K;\n};\n\ntype ScopeIdForKind<K extends AuthEventTargetKind> = K extends \"user\"\n  ? GenericId<\"User\">\n  : K extends \"session\"\n    ? GenericId<\"Session\">\n    : K extends \"group\"\n      ? GenericId<\"Group\">\n      : K extends \"connection\"\n        ? GenericId<\"GroupConnection\">\n        : K extends \"oauth_client\"\n          ? GenericId<\"OAuthClient\"> | string\n          : K extends \"api_key\"\n            ? GenericId<\"ApiKey\">\n            : K extends \"global\"\n              ? \"security\"\n              : string;\n\nexport type AuthEventTarget<\n  K extends AuthEventTargetKind = AuthEventTargetKind,\n  Id extends string = ScopeIdForKind<K>,\n> = {\n  readonly kind: K;\n  readonly id: Id;\n  readonly __authEventScope: K;\n};\n\nexport type AuthEventTargetScope<K extends AuthEventTargetKind = AuthEventTargetKind> = {\n  readonly kind: K;\n  readonly id: string;\n};\n\nexport type AuthEventActor<T extends AuthEventActorType = AuthEventActorType> = {\n  type: T;\n  id?: string;\n};\n\nexport type AuthEventSubject<T extends AuthEventSubjectType = AuthEventSubjectType> = {\n  type: T;\n  id?: string;\n};\n\nexport type AuthEventRequest = {\n  requestId?: string;\n  ip?: string;\n  userAgent?: string;\n};\n\nexport type AuthEventDataByKind<TExtend = {}> = {\n  \"user.created\": { type: string; provider: string; profile?: AuthProfileSnapshot };\n  \"user.updated\": {\n    existingUserId?: string;\n    type?: string;\n    provider?: string;\n    profile?: AuthProfileSnapshot;\n  };\n  \"session.signed_in\": { provider: string; method?: string };\n  \"session.signed_out\": undefined;\n  \"session.invalidated\": { userId: string; reason?: string };\n  \"session.refresh_exchanged\": { sessionId?: string };\n  \"session.refresh_reuse_detected\": { userId?: string; refreshTokenId?: string };\n  \"account.linked\": { provider: string; providerAccountId?: string };\n  \"account.unlinked\": { accountId: string; provider: string };\n  \"password.changed\": { userId?: string; flow?: \"reset\" | \"change\" };\n  \"passkey.added\": { passkeyId: string; credentialId?: string };\n  \"passkey.removed\": { passkeyId: string };\n  \"totp.enrolled\": { totpId: string };\n  \"totp.removed\": { totpId: string };\n  \"email.verified\": { userId: string; email: string };\n  \"phone.verified\": { userId: string; phone: string };\n  \"api_key.created\": { keyId: string; name?: string; prefix?: string };\n  \"api_key.revoked\": { keyId: string; reason?: string };\n  \"oauth.client.created\": { clientId: string; name?: string; scopes?: string[] };\n  \"oauth.client.revoked\": { clientId: string };\n  \"oauth.code.created\": {\n    clientId: string;\n    codeId?: string;\n    scopes?: string[];\n    redirectUri?: string;\n  };\n  \"oauth.token.created\": {\n    clientId: string;\n    scopes?: string[];\n    grantType?: string;\n    resource?: string;\n  };\n  \"oauth.token.exchanged\": {\n    clientId: string;\n    scopes?: string[];\n    grantType?: string;\n    resource?: string;\n  };\n  \"oauth.refresh.reuse_detected\": { clientId: string; userId?: string };\n  \"oauth.refresh.revoked\": { clientId: string; userId?: string };\n  \"connection.created\": { connectionId: string; protocol?: \"oidc\" | \"saml\"; domain?: string };\n  \"connection.updated\": { connectionId: string; changed?: string[] };\n  \"connection.removed\": { connectionId: string };\n  \"connection.login.succeeded\": {\n    connectionId: string;\n    protocol: \"oidc\" | \"saml\";\n    userId?: string;\n  };\n  \"connection.login.failed\": {\n    connectionId?: string;\n    protocol?: \"oidc\" | \"saml\";\n    errorCode?: string;\n  };\n  \"connection.domain.verification_requested\": {\n    connectionId: string;\n    domain: string;\n    recordName?: string;\n    expiresAt?: number;\n  };\n  \"connection.domain.verified\": { connectionId: string; domain: string; verifiedAt?: number };\n  \"connection.policy.updated\": { version: number };\n  \"connection.saml.set\": { connectionId: string; metadataUrl?: string; domains?: string[] };\n  \"connection.saml.refreshed\": { connectionId: string; metadataUrl?: string };\n  \"connection.oidc.set\": {\n    connectionId: string;\n    issuer?: string;\n    discoveryUrl?: string;\n    jwksUri?: string;\n    audience?: string | string[];\n    tokenEndpointAuthMethod?: string;\n  };\n  \"connection.scim.set\": { scimConfigId: string };\n  \"connection.scim.read\": {\n    resourceType?: \"user\" | \"group\";\n    resourceId?: string;\n    operation?: string;\n  };\n  \"connection.scim.user.provisioned\": { userId?: string; externalId?: string; active?: boolean };\n  \"connection.scim.user.updated\": { userId?: string; externalId?: string; active?: boolean };\n  \"connection.scim.user.deactivated\": { userId?: string; externalId?: string };\n  \"connection.scim.user.reactivated\": { userId?: string; externalId?: string };\n  \"connection.scim.group.provisioned\": { groupId?: string; externalId?: string };\n  \"connection.scim.group.updated\": { groupId?: string; externalId?: string };\n  \"connection.scim.group.deactivated\": { groupId?: string; externalId?: string };\n  \"connection.scim.group.reactivated\": { groupId?: string; externalId?: string };\n  \"webhook.endpoint.created\": { endpointId?: string };\n  \"webhook.endpoint.disabled\": { endpointId?: string };\n  \"webhook.delivery.created\": {\n    deliveryId: string;\n    endpointId: string;\n    sourceEventId: string;\n    sourceEventType: AuthEventKind;\n  };\n  \"webhook.delivery.attempted\": {\n    deliveryId: string;\n    endpointId: string;\n    sourceEventId: string;\n    sourceEventType: AuthEventKind;\n    attemptCount: number;\n  };\n  \"webhook.delivery.succeeded\": {\n    deliveryId: string;\n    endpointId: string;\n    sourceEventId: string;\n    sourceEventType: AuthEventKind;\n    status: number;\n  };\n  \"webhook.delivery.failed\": {\n    deliveryId: string;\n    endpointId: string;\n    sourceEventId: string;\n    sourceEventType: AuthEventKind;\n    status?: number;\n    error?: string;\n  };\n} & TExtend;\n\ntype EventData<K extends AuthEventKind, TExtend = {}> = AuthEventDataByKind<TExtend>[K];\n\ntype EventDataField<K extends AuthEventKind, TExtend = {}> = K extends AuthEventKind\n  ? EventData<K, TExtend> extends undefined\n    ? { data?: undefined }\n    : { data: EventData<K, TExtend> }\n  : never;\n\ntype AuthEventBase<K extends AuthEventKind = AuthEventKind> = {\n  eventId: string;\n  kind: K;\n  category: AuthEventCategory;\n  occurredAt: number;\n  actor: AuthEventActor;\n  subject: AuthEventSubject;\n  targets: AuthEventTargetScope[];\n  request?: AuthEventRequest;\n  outcome: AuthEventOutcome;\n  errorCode?: string;\n};\n\nexport type AuthEvent<\n  K extends AuthEventKind = AuthEventKind,\n  TExtend = {},\n> = K extends AuthEventKind ? AuthEventBase<K> & EventDataField<K, TExtend> : never;\n\ntype AuthEventWhereFilter = {\n  target?: AuthEventTarget;\n  kind?: AuthEventKind;\n  category?: AuthEventCategory;\n  outcome?: AuthEventOutcome;\n  actor?: AuthEventActor;\n  subject?: AuthEventSubject;\n  requestId?: string;\n  occurredAtGte?: number;\n  occurredAtGt?: number;\n  occurredAtLte?: number;\n  occurredAtLt?: number;\n};\n\ntype AuthEventHandler<K extends AuthEventKind, TExtend = {}> = (\n  ctx: AuthEventCtx,\n  event: AuthEvent<K, TExtend>,\n) => Awaitable<void>;\n\nexport type AuthEventHandlerMap<TExtend = {}> = {\n  user?: {\n    created?: AuthEventHandler<\"user.created\", TExtend>;\n    updated?: AuthEventHandler<\"user.updated\", TExtend>;\n  };\n  session?: {\n    signedIn?: AuthEventHandler<\"session.signed_in\", TExtend>;\n    signedOut?: AuthEventHandler<\"session.signed_out\", TExtend>;\n    invalidated?: AuthEventHandler<\"session.invalidated\", TExtend>;\n    refreshExchanged?: AuthEventHandler<\"session.refresh_exchanged\", TExtend>;\n    refreshReuseDetected?: AuthEventHandler<\"session.refresh_reuse_detected\", TExtend>;\n  };\n  account?: {\n    linked?: AuthEventHandler<\"account.linked\", TExtend>;\n    unlinked?: AuthEventHandler<\"account.unlinked\", TExtend>;\n  };\n  password?: {\n    changed?: AuthEventHandler<\"password.changed\", TExtend>;\n  };\n  passkey?: {\n    added?: AuthEventHandler<\"passkey.added\", TExtend>;\n    removed?: AuthEventHandler<\"passkey.removed\", TExtend>;\n  };\n  totp?: {\n    enrolled?: AuthEventHandler<\"totp.enrolled\", TExtend>;\n    removed?: AuthEventHandler<\"totp.removed\", TExtend>;\n  };\n  email?: {\n    verified?: AuthEventHandler<\"email.verified\", TExtend>;\n  };\n  phone?: {\n    verified?: AuthEventHandler<\"phone.verified\", TExtend>;\n  };\n  apiKey?: {\n    created?: AuthEventHandler<\"api_key.created\", TExtend>;\n    revoked?: AuthEventHandler<\"api_key.revoked\", TExtend>;\n  };\n  oauth?: {\n    clientCreated?: AuthEventHandler<\"oauth.client.created\", TExtend>;\n    clientRevoked?: AuthEventHandler<\"oauth.client.revoked\", TExtend>;\n    codeCreated?: AuthEventHandler<\"oauth.code.created\", TExtend>;\n    tokenCreated?: AuthEventHandler<\"oauth.token.created\", TExtend>;\n    tokenExchanged?: AuthEventHandler<\"oauth.token.exchanged\", TExtend>;\n    refreshReuseDetected?: AuthEventHandler<\"oauth.refresh.reuse_detected\", TExtend>;\n    refreshRevoked?: AuthEventHandler<\"oauth.refresh.revoked\", TExtend>;\n  };\n  connection?: {\n    connectionCreated?: AuthEventHandler<\"connection.created\", TExtend>;\n    connectionUpdated?: AuthEventHandler<\"connection.updated\", TExtend>;\n    connectionRemoved?: AuthEventHandler<\"connection.removed\", TExtend>;\n    loginSucceeded?: AuthEventHandler<\"connection.login.succeeded\", TExtend>;\n    loginFailed?: AuthEventHandler<\"connection.login.failed\", TExtend>;\n    domainVerificationRequested?: AuthEventHandler<\n      \"connection.domain.verification_requested\",\n      TExtend\n    >;\n    domainVerified?: AuthEventHandler<\"connection.domain.verified\", TExtend>;\n    policyUpdated?: AuthEventHandler<\"connection.policy.updated\", TExtend>;\n    samlSet?: AuthEventHandler<\"connection.saml.set\", TExtend>;\n    samlRefreshed?: AuthEventHandler<\"connection.saml.refreshed\", TExtend>;\n    oidcSet?: AuthEventHandler<\"connection.oidc.set\", TExtend>;\n  };\n  scim?: {\n    set?: AuthEventHandler<\"connection.scim.set\", TExtend>;\n    read?: AuthEventHandler<\"connection.scim.read\", TExtend>;\n    userProvisioned?: AuthEventHandler<\"connection.scim.user.provisioned\", TExtend>;\n    userUpdated?: AuthEventHandler<\"connection.scim.user.updated\", TExtend>;\n    userDeactivated?: AuthEventHandler<\"connection.scim.user.deactivated\", TExtend>;\n    userReactivated?: AuthEventHandler<\"connection.scim.user.reactivated\", TExtend>;\n    groupProvisioned?: AuthEventHandler<\"connection.scim.group.provisioned\", TExtend>;\n    groupUpdated?: AuthEventHandler<\"connection.scim.group.updated\", TExtend>;\n    groupDeactivated?: AuthEventHandler<\"connection.scim.group.deactivated\", TExtend>;\n    groupReactivated?: AuthEventHandler<\"connection.scim.group.reactivated\", TExtend>;\n  };\n  webhook?: {\n    endpointCreated?: AuthEventHandler<\"webhook.endpoint.created\", TExtend>;\n    endpointDisabled?: AuthEventHandler<\"webhook.endpoint.disabled\", TExtend>;\n  };\n};\n\ntype AuthEventWhereField = keyof Pick<\n  AuthEventWhereFilter,\n  \"target\" | \"kind\" | \"category\" | \"outcome\" | \"actor\" | \"subject\" | \"requestId\"\n>;\n\n/**\n * Value {@link AuthEventWhereBuilder.eq} accepts for a field. Equals the stored\n * filter type for every field except `kind`, which takes an {@link AuthEventRef}\n * and is stored as its underlying `AuthEventKind` id.\n */\ntype AuthEventEqValue<F extends AuthEventWhereField> = F extends \"kind\"\n  ? AuthEventRef\n  : NonNullable<AuthEventWhereFilter[F]>;\n\n/**\n * Per-field setters mapping the caller-supplied {@link AuthEventEqValue} to the\n * value stored in {@link AuthEventWhereFilter} — isolating the single `kind`\n * ref→id transform; every other field is identity.\n */\nconst authEventEqSetters: {\n  [F in AuthEventWhereField]: (value: AuthEventEqValue<F>) => NonNullable<AuthEventWhereFilter[F]>;\n} = {\n  target: (value) => value,\n  kind: (value) => value.id,\n  category: (value) => value,\n  outcome: (value) => value,\n  actor: (value) => value,\n  subject: (value) => value,\n  requestId: (value) => value,\n};\n\nclass AuthEventWhereBuilder {\n  private readonly where: AuthEventWhereFilter = {};\n\n  /**\n   * Constrain the query to events whose `field` equals `value`. For `kind`, pass\n   * an {@link AuthEventRef} (e.g. `authEvents.session.signedIn`); other fields\n   * take their literal value.\n   */\n  eq<F extends AuthEventWhereField>(field: F, value: AuthEventEqValue<F>): this {\n    this.where[field] = authEventEqSetters[field](value);\n    return this;\n  }\n\n  gt(field: \"occurredAt\", value: number): this {\n    this.where.occurredAtGt = value;\n    return this;\n  }\n\n  gte(field: \"occurredAt\", value: number): this {\n    this.where.occurredAtGte = value;\n    return this;\n  }\n\n  lt(field: \"occurredAt\", value: number): this {\n    this.where.occurredAtLt = value;\n    return this;\n  }\n\n  lte(field: \"occurredAt\", value: number): this {\n    this.where.occurredAtLte = value;\n    return this;\n  }\n\n  build(): AuthEventWhereFilter {\n    return { ...this.where };\n  }\n}\n\nexport type AuthEventWhereBuilderShape = Pick<\n  AuthEventWhereBuilder,\n  \"eq\" | \"gt\" | \"gte\" | \"lt\" | \"lte\"\n>;\n\nexport type AuthEventWhereInput = (q: AuthEventWhereBuilderShape) => AuthEventWhereBuilderShape;\n\nexport type AuthEventWhere = AuthEventWhereInput;\n\ntype ExactAuthEventHandlerMap<T> = T & {\n  [K in Exclude<keyof T, keyof AuthEventHandlerMap>]: never;\n} & {\n  [K in keyof T & keyof AuthEventHandlerMap]: T[K] extends object\n    ? T[K] & {\n        [N in Exclude<keyof T[K], keyof NonNullable<AuthEventHandlerMap[K]>>]: never;\n      }\n    : T[K];\n};\n\nfunction eventRef<const K extends AuthEventKind>(id: K): AuthEventRef<K> {\n  return { id, __authEventKind: id };\n}\n\nfunction targetRef<const K extends AuthEventTargetKind>(\n  kind: K,\n  id: ScopeIdForKind<K>,\n): AuthEventTarget<K> {\n  return { kind, id, __authEventScope: kind };\n}\n\nfunction compileWhere(where: AuthEventWhereInput): AuthEventWhereFilter {\n  const builder = new AuthEventWhereBuilder();\n  where(builder);\n  return builder.build();\n}\n\nfunction categoryForKind(kind: AuthEventKind): AuthEventCategory {\n  return EVENT_KIND_CATEGORY[kind];\n}\n\n/**\n * Generate a unique event id.\n *\n * Every emit is a distinct audit record, so the id is unique by construction.\n * The projection dedup only collapses identical\n * caller-supplied keys (e.g. webhook delivery attempts), never distinct emits.\n */\nfunction eventId(event: { kind: AuthEventKind; subject: AuthEventSubject }): string {\n  const suffix = generateRandomString(16, \"abcdefghijklmnopqrstuvwxyz0123456789\");\n  return `${event.kind}:${event.subject.type}:${event.subject.id ?? \"none\"}:${Date.now()}:${suffix}`;\n}\n\nexport type EmitAuthEventInput<K extends AuthEventKind = AuthEventKind> = {\n  eventId?: string;\n  occurredAt?: number;\n  kind: K;\n  actor: AuthEventActor;\n  subject: AuthEventSubject;\n  targets: AuthEventTargetScope[];\n  request?: AuthEventRequest;\n  outcome: AuthEventOutcome;\n  errorCode?: string;\n  data?: EventData<K>;\n};\n\ntype EventConfig = {\n  component: AuthComponentApi;\n  events?: AuthEventHandlerMap;\n};\n\n/** The emit input plus the fields {@link emitAuthEvent} computes when omitted. */\ntype AuthEventComputed<K extends AuthEventKind> = EmitAuthEventInput<K> & {\n  eventId: string;\n  category: AuthEventCategory;\n  occurredAt: number;\n};\n\n/**\n * View a fully-computed event as the kind-correlated {@link AuthEvent}.\n *\n * `AuthEvent<K>` is a distributive conditional that correlates `data` to `kind`;\n * TypeScript cannot construct it positively from the structurally wider computed\n * object. The value is correct by construction and the component re-validates it\n * against `vAuthEvent` on append, so this is the single narrow boundary\n * assertion — a typed target, never `any`.\n */\nfunction finalizeAuthEvent<K extends AuthEventKind>(computed: AuthEventComputed<K>): AuthEvent<K> {\n  return computed as AuthEvent<K>;\n}\n\nfunction computeAuthEvent<K extends AuthEventKind>(input: EmitAuthEventInput<K>): AuthEvent<K> {\n  return finalizeAuthEvent<K>({\n    ...input,\n    eventId: input.eventId ?? eventId(input),\n    category: categoryForKind(input.kind),\n    occurredAt: input.occurredAt ?? Date.now(),\n  });\n}\n\nfunction appendArgs(event: AuthEvent) {\n  const { category: _, ...input } = event;\n  return {\n    event: input,\n    targets: event.targets,\n  };\n}\n\ntype AuthEventHandlerSelector<K extends AuthEventKind> = (\n  handlers: AuthEventHandlerMap,\n) => AuthEventHandler<K> | undefined;\n\n/**\n * Single source of truth mapping every {@link AuthEventKind} to the selector\n * that resolves its user-supplied handler from an {@link AuthEventHandlerMap}.\n *\n * Typed as `Record<AuthEventKind, …>` (via `EventHandlerSelectorTable`) so the\n * compiler enforces exactly one entry per kind: a missing kind fails to\n * typecheck rather than silently resolving to no handler. Each selector returns\n * the handler typed to its own kind, so the resolved value is invoked against\n * the matching event with no widening. Kinds with no slot in\n * `AuthEventHandlerMap` map to a selector that returns `undefined`.\n */\ntype EventHandlerSelectorTable = {\n  [K in AuthEventKind]: AuthEventHandlerSelector<K>;\n};\n\nconst EVENT_HANDLER_SELECTORS: EventHandlerSelectorTable = {\n  \"user.created\": (h) => h.user?.created,\n  \"user.updated\": (h) => h.user?.updated,\n  \"session.signed_in\": (h) => h.session?.signedIn,\n  \"session.signed_out\": (h) => h.session?.signedOut,\n  \"session.invalidated\": (h) => h.session?.invalidated,\n  \"session.refresh_exchanged\": (h) => h.session?.refreshExchanged,\n  \"session.refresh_reuse_detected\": (h) => h.session?.refreshReuseDetected,\n  \"account.linked\": (h) => h.account?.linked,\n  \"account.unlinked\": (h) => h.account?.unlinked,\n  \"password.changed\": (h) => h.password?.changed,\n  \"passkey.added\": (h) => h.passkey?.added,\n  \"passkey.removed\": (h) => h.passkey?.removed,\n  \"totp.enrolled\": (h) => h.totp?.enrolled,\n  \"totp.removed\": (h) => h.totp?.removed,\n  \"email.verified\": (h) => h.email?.verified,\n  \"phone.verified\": (h) => h.phone?.verified,\n  \"api_key.created\": (h) => h.apiKey?.created,\n  \"api_key.revoked\": (h) => h.apiKey?.revoked,\n  \"oauth.client.created\": (h) => h.oauth?.clientCreated,\n  \"oauth.client.revoked\": (h) => h.oauth?.clientRevoked,\n  \"oauth.code.created\": (h) => h.oauth?.codeCreated,\n  \"oauth.token.created\": (h) => h.oauth?.tokenCreated,\n  \"oauth.token.exchanged\": (h) => h.oauth?.tokenExchanged,\n  \"oauth.refresh.reuse_detected\": (h) => h.oauth?.refreshReuseDetected,\n  \"oauth.refresh.revoked\": (h) => h.oauth?.refreshRevoked,\n  \"connection.created\": (h) => h.connection?.connectionCreated,\n  \"connection.updated\": (h) => h.connection?.connectionUpdated,\n  \"connection.removed\": (h) => h.connection?.connectionRemoved,\n  \"connection.login.succeeded\": (h) => h.connection?.loginSucceeded,\n  \"connection.login.failed\": (h) => h.connection?.loginFailed,\n  \"connection.domain.verification_requested\": (h) => h.connection?.domainVerificationRequested,\n  \"connection.domain.verified\": (h) => h.connection?.domainVerified,\n  \"connection.policy.updated\": (h) => h.connection?.policyUpdated,\n  \"connection.saml.set\": (h) => h.connection?.samlSet,\n  \"connection.saml.refreshed\": (h) => h.connection?.samlRefreshed,\n  \"connection.oidc.set\": (h) => h.connection?.oidcSet,\n  \"connection.scim.set\": (h) => h.scim?.set,\n  \"connection.scim.read\": (h) => h.scim?.read,\n  \"connection.scim.user.provisioned\": (h) => h.scim?.userProvisioned,\n  \"connection.scim.user.updated\": (h) => h.scim?.userUpdated,\n  \"connection.scim.user.deactivated\": (h) => h.scim?.userDeactivated,\n  \"connection.scim.user.reactivated\": (h) => h.scim?.userReactivated,\n  \"connection.scim.group.provisioned\": (h) => h.scim?.groupProvisioned,\n  \"connection.scim.group.updated\": (h) => h.scim?.groupUpdated,\n  \"connection.scim.group.deactivated\": (h) => h.scim?.groupDeactivated,\n  \"connection.scim.group.reactivated\": (h) => h.scim?.groupReactivated,\n  \"webhook.endpoint.created\": (h) => h.webhook?.endpointCreated,\n  \"webhook.endpoint.disabled\": (h) => h.webhook?.endpointDisabled,\n  \"webhook.delivery.created\": () => undefined,\n  \"webhook.delivery.attempted\": () => undefined,\n  \"webhook.delivery.succeeded\": () => undefined,\n  \"webhook.delivery.failed\": () => undefined,\n};\n\nfunction selectEventHandler<K extends AuthEventKind>(\n  handlers: AuthEventHandlerMap,\n  kind: K,\n): AuthEventHandler<K> | undefined {\n  return EVENT_HANDLER_SELECTORS[kind](handlers);\n}\n\nasync function runEventHandler(\n  ctx: AuthEventCtx,\n  handlers: AuthEventHandlerMap | undefined,\n  event: AuthEvent,\n) {\n  if (!handlers) return;\n  const handler = selectEventHandler(handlers, event.kind);\n  await handler?.(ctx, event);\n}\n\n/**\n * Append an auth event to the durable projection log and run any matching handler.\n *\n * Fills in `eventId`, `category`, and `occurredAt` when omitted, then writes\n * via the component `event.append` mutation. The configured handler for the\n * event kind runs only when the append created a new record (idempotency).\n *\n * @param ctx - Convex mutation or action context.\n * @param config - Component reference plus optional event handler map.\n * @param input - The event to emit.\n * @returns The append result from the component mutation.\n */\nexport async function emitAuthEvent<K extends AuthEventKind>(\n  ctx: AuthEventCtx,\n  config: EventConfig,\n  input: EmitAuthEventInput<K>,\n) {\n  const event = computeAuthEvent(input);\n  const result = await ctx.runMutation(config.component.event.append, appendArgs(event));\n  if (result.created) {\n    await runEventHandler(ctx, config.events, event);\n  }\n  return result;\n}\n\n/**\n * Persist an internal auth event after the request completes when no matching\n * application handler needs the idempotency result synchronously.\n *\n * Scheduled writes are recorded by the caller's mutation commit but execute in\n * a separate function, keeping projection fan-out off the\n * authentication critical path. Configured handlers preserve synchronous,\n * exactly-once delivery through {@link emitAuthEvent}.\n *\n * @internal\n */\nexport async function queueAuthEvent<K extends AuthEventKind>(\n  ctx: QueuedAuthEventCtx,\n  config: EventConfig,\n  input: EmitAuthEventInput<K>,\n): Promise<void> {\n  const handler = config.events ? selectEventHandler(config.events, input.kind) : undefined;\n  if (handler !== undefined) {\n    await emitAuthEvent(ctx, config, input);\n    return;\n  }\n  const event = computeAuthEvent(input);\n  await ctx.scheduler.runAfter(0, config.component.event.append, appendArgs(event));\n}\n\n/**\n * Build the `auth.event` namespace for reading and emitting auth events.\n *\n * @param config - Component reference plus optional event handler map.\n * @returns An object with `get`, `list`, and `emit` helpers.\n */\nexport function createAuthEventDomain(config: EventConfig) {\n  return {\n    get: async (ctx: AuthEventCtx, args: { id: string }) =>\n      await ctx.runQuery(config.component.event.get, args),\n    list: async (\n      ctx: AuthEventCtx,\n      args: {\n        where: AuthEventWhereInput;\n        order?: \"asc\" | \"desc\";\n        paginationOpts: PaginationOptions;\n      },\n    ) =>\n      await ctx.runQuery(config.component.event.list, {\n        ...args,\n        where: compileWhere(args.where),\n      }),\n    emit: async <K extends AuthEventKind>(ctx: AuthEventCtx, args: EmitAuthEventInput<K>) =>\n      await emitAuthEvent(ctx, config, args),\n  };\n}\n\n/**\n * Typed registry of auth event refs and builders.\n *\n * Provides `eventRef`-typed kinds (e.g. `authEvents.session.signedIn`) plus\n * `target`, `actor`, and `subject` constructors, an exact-checked `handlers`\n * helper, and a `where` filter builder for {@link createAuthEventDomain}'s\n * `list`.\n */\nexport const authEvents = {\n  user: {\n    created: eventRef(\"user.created\"),\n    updated: eventRef(\"user.updated\"),\n  },\n  session: {\n    signedIn: eventRef(\"session.signed_in\"),\n    signedOut: eventRef(\"session.signed_out\"),\n    invalidated: eventRef(\"session.invalidated\"),\n    refreshExchanged: eventRef(\"session.refresh_exchanged\"),\n    refreshReuseDetected: eventRef(\"session.refresh_reuse_detected\"),\n  },\n  account: {\n    linked: eventRef(\"account.linked\"),\n    unlinked: eventRef(\"account.unlinked\"),\n  },\n  password: {\n    changed: eventRef(\"password.changed\"),\n  },\n  passkey: {\n    added: eventRef(\"passkey.added\"),\n    removed: eventRef(\"passkey.removed\"),\n  },\n  totp: {\n    enrolled: eventRef(\"totp.enrolled\"),\n    removed: eventRef(\"totp.removed\"),\n  },\n  email: {\n    verified: eventRef(\"email.verified\"),\n  },\n  phone: {\n    verified: eventRef(\"phone.verified\"),\n  },\n  apiKey: {\n    created: eventRef(\"api_key.created\"),\n    revoked: eventRef(\"api_key.revoked\"),\n  },\n  oauth: {\n    clientCreated: eventRef(\"oauth.client.created\"),\n    clientRevoked: eventRef(\"oauth.client.revoked\"),\n    codeCreated: eventRef(\"oauth.code.created\"),\n    tokenCreated: eventRef(\"oauth.token.created\"),\n    tokenExchanged: eventRef(\"oauth.token.exchanged\"),\n    refreshReuseDetected: eventRef(\"oauth.refresh.reuse_detected\"),\n    refreshRevoked: eventRef(\"oauth.refresh.revoked\"),\n  },\n  connection: {\n    connectionCreated: eventRef(\"connection.created\"),\n    connectionUpdated: eventRef(\"connection.updated\"),\n    connectionRemoved: eventRef(\"connection.removed\"),\n    loginSucceeded: eventRef(\"connection.login.succeeded\"),\n    loginFailed: eventRef(\"connection.login.failed\"),\n    domainVerificationRequested: eventRef(\"connection.domain.verification_requested\"),\n    domainVerified: eventRef(\"connection.domain.verified\"),\n    policyUpdated: eventRef(\"connection.policy.updated\"),\n    samlSet: eventRef(\"connection.saml.set\"),\n    samlRefreshed: eventRef(\"connection.saml.refreshed\"),\n    oidcSet: eventRef(\"connection.oidc.set\"),\n  },\n  scim: {\n    set: eventRef(\"connection.scim.set\"),\n    read: eventRef(\"connection.scim.read\"),\n    userProvisioned: eventRef(\"connection.scim.user.provisioned\"),\n    userUpdated: eventRef(\"connection.scim.user.updated\"),\n    userDeactivated: eventRef(\"connection.scim.user.deactivated\"),\n    userReactivated: eventRef(\"connection.scim.user.reactivated\"),\n    groupProvisioned: eventRef(\"connection.scim.group.provisioned\"),\n    groupUpdated: eventRef(\"connection.scim.group.updated\"),\n    groupDeactivated: eventRef(\"connection.scim.group.deactivated\"),\n    groupReactivated: eventRef(\"connection.scim.group.reactivated\"),\n  },\n  webhook: {\n    endpointCreated: eventRef(\"webhook.endpoint.created\"),\n    endpointDisabled: eventRef(\"webhook.endpoint.disabled\"),\n    deliveryCreated: eventRef(\"webhook.delivery.created\"),\n    deliveryAttempted: eventRef(\"webhook.delivery.attempted\"),\n    deliverySucceeded: eventRef(\"webhook.delivery.succeeded\"),\n    deliveryFailed: eventRef(\"webhook.delivery.failed\"),\n  },\n  target: {\n    user: (id: GenericId<\"User\">) => targetRef(\"user\", id),\n    session: (id: GenericId<\"Session\">) => targetRef(\"session\", id),\n    group: (id: GenericId<\"Group\">) => targetRef(\"group\", id),\n    connection: (id: GenericId<\"GroupConnection\">) => targetRef(\"connection\", id),\n    oauthClient: (id: GenericId<\"OAuthClient\"> | string) => targetRef(\"oauth_client\", id),\n    apiKey: (id: GenericId<\"ApiKey\">) => targetRef(\"api_key\", id),\n    security: () => targetRef(\"global\", \"security\"),\n  },\n  actor: {\n    user: (id: string): AuthEventActor<\"user\"> => ({ type: \"user\", id }),\n    system: (): AuthEventActor<\"system\"> => ({ type: \"system\" }),\n    scim: (id?: string): AuthEventActor<\"scim\"> => ({ type: \"scim\", id }),\n    apiKey: (id: string): AuthEventActor<\"api_key\"> => ({ type: \"api_key\", id }),\n    oauthClient: (id: string): AuthEventActor<\"oauth_client\"> => ({ type: \"oauth_client\", id }),\n    webhook: (id: string): AuthEventActor<\"webhook\"> => ({ type: \"webhook\", id }),\n    anonymous: (): AuthEventActor<\"anonymous\"> => ({ type: \"anonymous\" }),\n  },\n  subject: {\n    user: (id: string): AuthEventSubject<\"user\"> => ({ type: \"user\", id }),\n    session: (id: string): AuthEventSubject<\"session\"> => ({ type: \"session\", id }),\n    account: (id: string): AuthEventSubject<\"account\"> => ({ type: \"account\", id }),\n    passkey: (id: string): AuthEventSubject<\"passkey\"> => ({ type: \"passkey\", id }),\n    totp: (id: string): AuthEventSubject<\"totp\"> => ({ type: \"totp\", id }),\n    email: (id: string): AuthEventSubject<\"email\"> => ({ type: \"email\", id }),\n    phone: (id: string): AuthEventSubject<\"phone\"> => ({ type: \"phone\", id }),\n    apiKey: (id: string): AuthEventSubject<\"api_key\"> => ({ type: \"api_key\", id }),\n    oauthClient: (id: string): AuthEventSubject<\"oauth_client\"> => ({\n      type: \"oauth_client\",\n      id,\n    }),\n    oauthCode: (id: string): AuthEventSubject<\"oauth_code\"> => ({ type: \"oauth_code\", id }),\n    group: (id: string): AuthEventSubject<\"group\"> => ({ type: \"group\", id }),\n    connection: (id: string): AuthEventSubject<\"connection\"> => ({ type: \"connection\", id }),\n    scimIdentity: (id: string): AuthEventSubject<\"scim_identity\"> => ({\n      type: \"scim_identity\",\n      id,\n    }),\n    webhookEndpoint: (id: string): AuthEventSubject<\"webhook_endpoint\"> => ({\n      type: \"webhook_endpoint\",\n      id,\n    }),\n    webhookDelivery: (id: string): AuthEventSubject<\"webhook_delivery\"> => ({\n      type: \"webhook_delivery\",\n      id,\n    }),\n    system: (): AuthEventSubject<\"system\"> => ({ type: \"system\" }),\n  },\n  handlers: <const T>(handlers: ExactAuthEventHandlerMap<T> & AuthEventHandlerMap) => handlers,\n  where: (build: (q: AuthEventWhereBuilderShape) => AuthEventWhereBuilderShape) =>\n    compileWhere(build),\n} as const;\n"],"mappings":";;;;;;;;;AAuYA,MAAM,qBAEF;CACF,SAAS,UAAU;CACnB,OAAO,UAAU,MAAM;CACvB,WAAW,UAAU;CACrB,UAAU,UAAU;CACpB,QAAQ,UAAU;CAClB,UAAU,UAAU;CACpB,YAAY,UAAU;CACvB;AAED,IAAM,wBAAN,MAA4B;CAC1B,AAAiB,QAA8B,EAAE;;;;;;CAOjD,GAAkC,OAAU,OAAkC;AAC5E,OAAK,MAAM,SAAS,mBAAmB,OAAO,MAAM;AACpD,SAAO;;CAGT,GAAG,OAAqB,OAAqB;AAC3C,OAAK,MAAM,eAAe;AAC1B,SAAO;;CAGT,IAAI,OAAqB,OAAqB;AAC5C,OAAK,MAAM,gBAAgB;AAC3B,SAAO;;CAGT,GAAG,OAAqB,OAAqB;AAC3C,OAAK,MAAM,eAAe;AAC1B,SAAO;;CAGT,IAAI,OAAqB,OAAqB;AAC5C,OAAK,MAAM,gBAAgB;AAC3B,SAAO;;CAGT,QAA8B;AAC5B,SAAO,EAAE,GAAG,KAAK,OAAO;;;AAuB5B,SAAS,SAAwC,IAAwB;AACvE,QAAO;EAAE;EAAI,iBAAiB;EAAI;;AAGpC,SAAS,UACP,MACA,IACoB;AACpB,QAAO;EAAE;EAAM;EAAI,kBAAkB;EAAM;;AAG7C,SAAS,aAAa,OAAkD;CACtE,MAAM,UAAU,IAAI,uBAAuB;AAC3C,OAAM,QAAQ;AACd,QAAO,QAAQ,OAAO;;AAGxB,SAAS,gBAAgB,MAAwC;AAC/D,QAAO,oBAAoB;;;;;;;;;AAU7B,SAAS,QAAQ,OAAmE;CAClF,MAAM,SAAS,qBAAqB,IAAI,uCAAuC;AAC/E,QAAO,GAAG,MAAM,KAAK,GAAG,MAAM,QAAQ,KAAK,GAAG,MAAM,QAAQ,MAAM,OAAO,GAAG,KAAK,KAAK,CAAC,GAAG;;;;;;;;;;;AAqC5F,SAAS,kBAA2C,UAA8C;AAChG,QAAO;;AAGT,SAAS,iBAA0C,OAA4C;AAC7F,QAAO,kBAAqB;EAC1B,GAAG;EACH,SAAS,MAAM,WAAW,QAAQ,MAAM;EACxC,UAAU,gBAAgB,MAAM,KAAK;EACrC,YAAY,MAAM,cAAc,KAAK,KAAK;EAC3C,CAAC;;AAGJ,SAAS,WAAW,OAAkB;CACpC,MAAM,EAAE,UAAU,GAAG,GAAG,UAAU;AAClC,QAAO;EACL,OAAO;EACP,SAAS,MAAM;EAChB;;AAsBH,MAAM,0BAAqD;CACzD,iBAAiB,MAAM,EAAE,MAAM;CAC/B,iBAAiB,MAAM,EAAE,MAAM;CAC/B,sBAAsB,MAAM,EAAE,SAAS;CACvC,uBAAuB,MAAM,EAAE,SAAS;CACxC,wBAAwB,MAAM,EAAE,SAAS;CACzC,8BAA8B,MAAM,EAAE,SAAS;CAC/C,mCAAmC,MAAM,EAAE,SAAS;CACpD,mBAAmB,MAAM,EAAE,SAAS;CACpC,qBAAqB,MAAM,EAAE,SAAS;CACtC,qBAAqB,MAAM,EAAE,UAAU;CACvC,kBAAkB,MAAM,EAAE,SAAS;CACnC,oBAAoB,MAAM,EAAE,SAAS;CACrC,kBAAkB,MAAM,EAAE,MAAM;CAChC,iBAAiB,MAAM,EAAE,MAAM;CAC/B,mBAAmB,MAAM,EAAE,OAAO;CAClC,mBAAmB,MAAM,EAAE,OAAO;CAClC,oBAAoB,MAAM,EAAE,QAAQ;CACpC,oBAAoB,MAAM,EAAE,QAAQ;CACpC,yBAAyB,MAAM,EAAE,OAAO;CACxC,yBAAyB,MAAM,EAAE,OAAO;CACxC,uBAAuB,MAAM,EAAE,OAAO;CACtC,wBAAwB,MAAM,EAAE,OAAO;CACvC,0BAA0B,MAAM,EAAE,OAAO;CACzC,iCAAiC,MAAM,EAAE,OAAO;CAChD,0BAA0B,MAAM,EAAE,OAAO;CACzC,uBAAuB,MAAM,EAAE,YAAY;CAC3C,uBAAuB,MAAM,EAAE,YAAY;CAC3C,uBAAuB,MAAM,EAAE,YAAY;CAC3C,+BAA+B,MAAM,EAAE,YAAY;CACnD,4BAA4B,MAAM,EAAE,YAAY;CAChD,6CAA6C,MAAM,EAAE,YAAY;CACjE,+BAA+B,MAAM,EAAE,YAAY;CACnD,8BAA8B,MAAM,EAAE,YAAY;CAClD,wBAAwB,MAAM,EAAE,YAAY;CAC5C,8BAA8B,MAAM,EAAE,YAAY;CAClD,wBAAwB,MAAM,EAAE,YAAY;CAC5C,wBAAwB,MAAM,EAAE,MAAM;CACtC,yBAAyB,MAAM,EAAE,MAAM;CACvC,qCAAqC,MAAM,EAAE,MAAM;CACnD,iCAAiC,MAAM,EAAE,MAAM;CAC/C,qCAAqC,MAAM,EAAE,MAAM;CACnD,qCAAqC,MAAM,EAAE,MAAM;CACnD,sCAAsC,MAAM,EAAE,MAAM;CACpD,kCAAkC,MAAM,EAAE,MAAM;CAChD,sCAAsC,MAAM,EAAE,MAAM;CACpD,sCAAsC,MAAM,EAAE,MAAM;CACpD,6BAA6B,MAAM,EAAE,SAAS;CAC9C,8BAA8B,MAAM,EAAE,SAAS;CAC/C,kCAAkC;CAClC,oCAAoC;CACpC,oCAAoC;CACpC,iCAAiC;CAClC;AAED,SAAS,mBACP,UACA,MACiC;AACjC,QAAO,wBAAwB,MAAM,SAAS;;AAGhD,eAAe,gBACb,KACA,UACA,OACA;AACA,KAAI,CAAC,SAAU;AAEf,OADgB,mBAAmB,UAAU,MAAM,KAAK,GACxC,KAAK,MAAM;;;;;;;;;;;;;;AAe7B,eAAsB,cACpB,KACA,QACA,OACA;CACA,MAAM,QAAQ,iBAAiB,MAAM;CACrC,MAAM,SAAS,MAAM,IAAI,YAAY,OAAO,UAAU,MAAM,QAAQ,WAAW,MAAM,CAAC;AACtF,KAAI,OAAO,QACT,OAAM,gBAAgB,KAAK,OAAO,QAAQ,MAAM;AAElD,QAAO;;;;;;;;;;;;;AAcT,eAAsB,eACpB,KACA,QACA,OACe;AAEf,MADgB,OAAO,SAAS,mBAAmB,OAAO,QAAQ,MAAM,KAAK,GAAG,YAChE,QAAW;AACzB,QAAM,cAAc,KAAK,QAAQ,MAAM;AACvC;;CAEF,MAAM,QAAQ,iBAAiB,MAAM;AACrC,OAAM,IAAI,UAAU,SAAS,GAAG,OAAO,UAAU,MAAM,QAAQ,WAAW,MAAM,CAAC;;;;;;;;AASnF,SAAgB,sBAAsB,QAAqB;AACzD,QAAO;EACL,KAAK,OAAO,KAAmB,SAC7B,MAAM,IAAI,SAAS,OAAO,UAAU,MAAM,KAAK,KAAK;EACtD,MAAM,OACJ,KACA,SAMA,MAAM,IAAI,SAAS,OAAO,UAAU,MAAM,MAAM;GAC9C,GAAG;GACH,OAAO,aAAa,KAAK,MAAM;GAChC,CAAC;EACJ,MAAM,OAAgC,KAAmB,SACvD,MAAM,cAAc,KAAK,QAAQ,KAAK;EACzC;;;;;;;;;;AAWH,MAAa,aAAa;CACxB,MAAM;EACJ,SAAS,SAAS,eAAe;EACjC,SAAS,SAAS,eAAe;EAClC;CACD,SAAS;EACP,UAAU,SAAS,oBAAoB;EACvC,WAAW,SAAS,qBAAqB;EACzC,aAAa,SAAS,sBAAsB;EAC5C,kBAAkB,SAAS,4BAA4B;EACvD,sBAAsB,SAAS,iCAAiC;EACjE;CACD,SAAS;EACP,QAAQ,SAAS,iBAAiB;EAClC,UAAU,SAAS,mBAAmB;EACvC;CACD,UAAU,EACR,SAAS,SAAS,mBAAmB,EACtC;CACD,SAAS;EACP,OAAO,SAAS,gBAAgB;EAChC,SAAS,SAAS,kBAAkB;EACrC;CACD,MAAM;EACJ,UAAU,SAAS,gBAAgB;EACnC,SAAS,SAAS,eAAe;EAClC;CACD,OAAO,EACL,UAAU,SAAS,iBAAiB,EACrC;CACD,OAAO,EACL,UAAU,SAAS,iBAAiB,EACrC;CACD,QAAQ;EACN,SAAS,SAAS,kBAAkB;EACpC,SAAS,SAAS,kBAAkB;EACrC;CACD,OAAO;EACL,eAAe,SAAS,uBAAuB;EAC/C,eAAe,SAAS,uBAAuB;EAC/C,aAAa,SAAS,qBAAqB;EAC3C,cAAc,SAAS,sBAAsB;EAC7C,gBAAgB,SAAS,wBAAwB;EACjD,sBAAsB,SAAS,+BAA+B;EAC9D,gBAAgB,SAAS,wBAAwB;EAClD;CACD,YAAY;EACV,mBAAmB,SAAS,qBAAqB;EACjD,mBAAmB,SAAS,qBAAqB;EACjD,mBAAmB,SAAS,qBAAqB;EACjD,gBAAgB,SAAS,6BAA6B;EACtD,aAAa,SAAS,0BAA0B;EAChD,6BAA6B,SAAS,2CAA2C;EACjF,gBAAgB,SAAS,6BAA6B;EACtD,eAAe,SAAS,4BAA4B;EACpD,SAAS,SAAS,sBAAsB;EACxC,eAAe,SAAS,4BAA4B;EACpD,SAAS,SAAS,sBAAsB;EACzC;CACD,MAAM;EACJ,KAAK,SAAS,sBAAsB;EACpC,MAAM,SAAS,uBAAuB;EACtC,iBAAiB,SAAS,mCAAmC;EAC7D,aAAa,SAAS,+BAA+B;EACrD,iBAAiB,SAAS,mCAAmC;EAC7D,iBAAiB,SAAS,mCAAmC;EAC7D,kBAAkB,SAAS,oCAAoC;EAC/D,cAAc,SAAS,gCAAgC;EACvD,kBAAkB,SAAS,oCAAoC;EAC/D,kBAAkB,SAAS,oCAAoC;EAChE;CACD,SAAS;EACP,iBAAiB,SAAS,2BAA2B;EACrD,kBAAkB,SAAS,4BAA4B;EACvD,iBAAiB,SAAS,2BAA2B;EACrD,mBAAmB,SAAS,6BAA6B;EACzD,mBAAmB,SAAS,6BAA6B;EACzD,gBAAgB,SAAS,0BAA0B;EACpD;CACD,QAAQ;EACN,OAAO,OAA0B,UAAU,QAAQ,GAAG;EACtD,UAAU,OAA6B,UAAU,WAAW,GAAG;EAC/D,QAAQ,OAA2B,UAAU,SAAS,GAAG;EACzD,aAAa,OAAqC,UAAU,cAAc,GAAG;EAC7E,cAAc,OAA0C,UAAU,gBAAgB,GAAG;EACrF,SAAS,OAA4B,UAAU,WAAW,GAAG;EAC7D,gBAAgB,UAAU,UAAU,WAAW;EAChD;CACD,OAAO;EACL,OAAO,QAAwC;GAAE,MAAM;GAAQ;GAAI;EACnE,eAAyC,EAAE,MAAM,UAAU;EAC3D,OAAO,QAAyC;GAAE,MAAM;GAAQ;GAAI;EACpE,SAAS,QAA2C;GAAE,MAAM;GAAW;GAAI;EAC3E,cAAc,QAAgD;GAAE,MAAM;GAAgB;GAAI;EAC1F,UAAU,QAA2C;GAAE,MAAM;GAAW;GAAI;EAC5E,kBAA+C,EAAE,MAAM,aAAa;EACrE;CACD,SAAS;EACP,OAAO,QAA0C;GAAE,MAAM;GAAQ;GAAI;EACrE,UAAU,QAA6C;GAAE,MAAM;GAAW;GAAI;EAC9E,UAAU,QAA6C;GAAE,MAAM;GAAW;GAAI;EAC9E,UAAU,QAA6C;GAAE,MAAM;GAAW;GAAI;EAC9E,OAAO,QAA0C;GAAE,MAAM;GAAQ;GAAI;EACrE,QAAQ,QAA2C;GAAE,MAAM;GAAS;GAAI;EACxE,QAAQ,QAA2C;GAAE,MAAM;GAAS;GAAI;EACxE,SAAS,QAA6C;GAAE,MAAM;GAAW;GAAI;EAC7E,cAAc,QAAkD;GAC9D,MAAM;GACN;GACD;EACD,YAAY,QAAgD;GAAE,MAAM;GAAc;GAAI;EACtF,QAAQ,QAA2C;GAAE,MAAM;GAAS;GAAI;EACxE,aAAa,QAAgD;GAAE,MAAM;GAAc;GAAI;EACvF,eAAe,QAAmD;GAChE,MAAM;GACN;GACD;EACD,kBAAkB,QAAsD;GACtE,MAAM;GACN;GACD;EACD,kBAAkB,QAAsD;GACtE,MAAM;GACN;GACD;EACD,eAA2C,EAAE,MAAM,UAAU;EAC9D;CACD,WAAoB,aAAgE;CACpF,QAAQ,UACN,aAAa,MAAM;CACtB"}

package/dist/server/facade.d.ts

@@ -15,11 +15,6 @@ type AuthIdentityCtx = {
   };
 };
 type AuthQueryCtx = ComponentReadCtx;
-type CustomFunctionInputResult<TAuth extends object> = Promise<{
-  ctx: {
-    auth: TAuth;
-  };
-}>;
 type AuthContextBase = {
   getUserIdentity: () => Promise<UserIdentity | null>;
 };
@@ -50,33 +45,6 @@ interface AuthContextFactory {
 interface OptionalAuthContextFactory {
   <TResolve extends object = Record<string, never>>(config?: AuthContextConfig<TResolve>): AuthContextCustomization<OptionalAuthContextState & TResolve>;
 }
-/**
- * Extract the resolved `auth` context type from an `auth.ctx()` customization.
- *
- * Use this to type function parameters or variables that receive the
- * enriched auth context produced by `auth.ctx()`. The inferred type includes
- * `userId`, `user`, `groupId`, `role`, `grants`, `getUserIdentity`, and any
- * additional fields added by the `resolve` callback. This is the generic
- * utility for reusing the enriched auth shape without manually duplicating
- * conditional auth types.
- *
- * @typeParam T - An `auth.ctx()` return value (must have an `input` method
- *   that returns `{ ctx: { auth: ... } }`).
- *
- * @example
- * ```ts
- * const authCtx = auth.ctx({
- *   resolve: async (ctx, user) => ({ orgId: user.orgId }),
- * });
- * type Auth = InferAuth<typeof authCtx>;
- * // Auth = { userId: Id<"User">; user: UserDoc; getUserIdentity: ...; orgId: string }
- * ```
- *
- * @see {@link defineAuth}
- */
-type InferAuth<T extends {
-  input: (...args: never[]) => CustomFunctionInputResult<object>;
-}> = Awaited<ReturnType<T["input"]>>["ctx"]["auth"];
 //#endregion
-export { AuthConfig, type AuthContextFactory, type AuthContextResolver, InferAuth, type OptionalAuthContextFactory, type OptionalAuthContextResolver };
+export { AuthConfig, type AuthContextFactory, type AuthContextResolver, type OptionalAuthContextFactory, type OptionalAuthContextResolver };
 //# sourceMappingURL=facade.d.ts.map

package/dist/server/facade.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"facade.d.ts","names":[],"sources":["../../src/server/facade.ts"],"mappings":";;;;;;;;;;KA+BY,UAAA,iBAA2B,IAAA,CACK,gBAAA,CAAP,OAAA;AAAA,KAIhC,eAAA;EACH,IAAA;IACE,eAAA,QAAuB,OAAA,CAAQ,YAAA;EAAA;AAAA;AAAA,KAI9B,YAAA,GAAe,gBAAA;AAAA,KAEf,yBAAA,yBAAkD,OAAA;EACrD,GAAA;IAAO,IAAA,EAAM,KAAA;EAAA;AAAA;AAAA,KAGV,eAAA;EACH,eAAA,QAAuB,OAAA,CAAQ,YAAA;AAAA;AAAA,KAG5B,wBAAA,GAA2B,eAAA,GAAkB,WAAA;AAAA,KAE7C,wBAAA,GAA2B,eAAA,GAAkB,mBAAA;AAAA,KAE7C,mBAAA,aAAgC,WAAA,GAAc,QAAA;AAAA,KAE9C,2BAAA,aAAwC,mBAAA,GAAsB,QAAA;AAAA,KAE9D,eAAA,GAAkB,eAAA,GAAkB,YAAA;AAAA,KAEpC,uBAAA,kCAAyD,iBAAA,CAC5D,QAAA,EACA,IAAA,GAAO,eAAA;AAAA,UAGC,mBAAA;EAAA,iCACyB,MAAA,iBAC/B,GAAA,EAAK,IAAA,EACL,MAAA,GAAS,uBAAA,CAAwB,QAAA,EAAU,IAAA,IAC1C,OAAA,CAAQ,mBAAA,CAAoB,QAAA;AAAA;AAAA,UAGvB,2BAAA;EAAA,iCACyB,MAAA,iBAC/B,GAAA,EAAK,IAAA,EACL,MAAA,GAAS,uBAAA,CAAwB,QAAA,EAAU,IAAA,IAC1C,OAAA,CAAQ,2BAAA,CAA4B,QAAA;AAAA;AAAA,KAGpC,wBAAA;EACH,IAAA;EACA,KAAA,GACE,GAAA,EAAK,eAAA,EACL,KAAA,EAAO,MAAA,iBACP,MAAA,eACG,OAAA;IACH,GAAA;MACE,IAAA,EAAM,KAAA;IAAA;IAER,IAAA;EAAA;AAAA;AAAA,UAIM,kBAAA;EAAA,2BACmB,MAAA,iBACzB,MAAA,GAAS,iBAAA,CAAkB,QAAA,IAC1B,wBAAA,CAAyB,wBAAA,GAA2B,QAAA;AAAA;AAAA,UAG/C,0BAAA;EAAA,2BACmB,MAAA,iBACzB,MAAA,GAAS,iBAAA,CAAkB,QAAA,IAC1B,wBAAA,CAAyB,wBAAA,GAA2B,QAAA;AAAA;;AApDI;;;;;AAEQ;;;;;;;;;AAEV;;;;;;;;;KA2E/C,SAAA;EAER,KAAA,MAAW,IAAA,cAAkB,yBAAA;AAAA,KAE7B,OAAA,CAAQ,UAAA,CAAW,CAAA"}
+{"version":3,"file":"facade.d.ts","names":[],"sources":["../../src/server/facade.ts"],"mappings":";;;;;;;;;;KA+BY,UAAA,iBAA2B,IAAA,CACK,gBAAA,CAAP,OAAA;AAAA,KAIhC,eAAA;EACH,IAAA;IACE,eAAA,QAAuB,OAAA,CAAQ,YAAA;EAAA;AAAA;AAAA,KAI9B,YAAA,GAAe,gBAAA;AAAA,KAEf,eAAA;EACH,eAAA,QAAuB,OAAA,CAAQ,YAAA;AAAA;AAAA,KAG5B,wBAAA,GAA2B,eAAA,GAAkB,WAAA;AAAA,KAE7C,wBAAA,GAA2B,eAAA,GAAkB,mBAAA;AAAA,KAE7C,mBAAA,aAAgC,WAAA,GAAc,QAAA;AAAA,KAE9C,2BAAA,aAAwC,mBAAA,GAAsB,QAAA;AAAA,KAE9D,eAAA,GAAkB,eAAA,GAAkB,YAAA;AAAA,KAEpC,uBAAA,kCAAyD,iBAAA,CAC5D,QAAA,EACA,IAAA,GAAO,eAAA;AAAA,UAGC,mBAAA;EAAA,iCACyB,MAAA,iBAC/B,GAAA,EAAK,IAAA,EACL,MAAA,GAAS,uBAAA,CAAwB,QAAA,EAAU,IAAA,IAC1C,OAAA,CAAQ,mBAAA,CAAoB,QAAA;AAAA;AAAA,UAGvB,2BAAA;EAAA,iCACyB,MAAA,iBAC/B,GAAA,EAAK,IAAA,EACL,MAAA,GAAS,uBAAA,CAAwB,QAAA,EAAU,IAAA,IAC1C,OAAA,CAAQ,2BAAA,CAA4B,QAAA;AAAA;AAAA,KAGpC,wBAAA;EACH,IAAA;EACA,KAAA,GACE,GAAA,EAAK,eAAA,EACL,KAAA,EAAO,MAAA,iBACP,MAAA,eACG,OAAA;IACH,GAAA;MACE,IAAA,EAAM,KAAA;IAAA;IAER,IAAA;EAAA;AAAA;AAAA,UAIM,kBAAA;EAAA,2BACmB,MAAA,iBACzB,MAAA,GAAS,iBAAA,CAAkB,QAAA,IAC1B,wBAAA,CAAyB,wBAAA,GAA2B,QAAA;AAAA;AAAA,UAG/C,0BAAA;EAAA,2BACmB,MAAA,iBACzB,MAAA,GAAS,iBAAA,CAAkB,QAAA,IAC1B,wBAAA,CAAyB,wBAAA,GAA2B,QAAA;AAAA"}

package/dist/server/facade.js

@@ -86,8 +86,7 @@ function createAuthContextCustomization(auth, config, optional) {
 	};
 }
 /**
-* Build the shared public auth context facade used by both `defineAuth()` and
-* `createAuthContext()`.
+* Build the auth context facade attached to a configured `defineAuth()` result.
 *
 * @internal
 */

package/dist/server/facade.js.map

@@ -1 +1 @@
-{"version":3,"file":"facade.js","names":["getResolvedAuthContext"],"sources":["../../src/server/facade.ts"],"sourcesContent":["/**\n * Lightweight auth context resolution — no dependency on `./runtime`.\n *\n * This module contains the pure auth context helpers that `core/index.ts`\n * and other lightweight consumers can import without pulling in the\n * heavyweight provider / OAuth / crypto machinery from `./runtime`.\n *\n * @module\n */\n\nimport type { UserIdentity } from \"convex/server\";\nimport { ConvexError } from \"convex/values\";\n\nimport { ErrorCode } from \"../shared/codes\";\nimport type { ComponentReadCtx } from \"./component/context\";\nimport {\n  createUnauthenticatedAuthContext,\n  getAuthContext as getResolvedAuthContext,\n  type AuthContext,\n  type AuthContextConfig,\n  type AuthLike,\n  type OptionalAuthContext,\n  type UserDoc,\n} from \"./context\";\n\nexport type { AuthContext, AuthContextConfig, OptionalAuthContext, UserDoc };\n\n/**\n * Config for auth setup. Extends the standard auth config\n * minus `component` (which is passed as the first constructor argument).\n */\nexport type AuthConfig<TExtend = {}> = Omit<\n  import(\"./types\").ConvexAuthConfig<TExtend>,\n  \"component\"\n>;\n\ntype AuthIdentityCtx = {\n  auth: {\n    getUserIdentity: () => Promise<UserIdentity | null>;\n  };\n};\n\ntype AuthQueryCtx = ComponentReadCtx;\n\ntype CustomFunctionInputResult<TAuth extends object> = Promise<{\n  ctx: { auth: TAuth };\n}>;\n\ntype AuthContextBase = {\n  getUserIdentity: () => Promise<UserIdentity | null>;\n};\n\ntype RequiredAuthContextState = AuthContextBase & AuthContext;\n\ntype OptionalAuthContextState = AuthContextBase & OptionalAuthContext;\n\ntype ResolvedAuthContext<TResolve> = AuthContext & TResolve;\n\ntype ResolvedOptionalAuthContext<TResolve> = OptionalAuthContext & TResolve;\n\ntype AuthResolverCtx = AuthIdentityCtx & AuthQueryCtx;\n\ntype PublicAuthContextConfig<TResolve extends object, TCtx> = AuthContextConfig<\n  TResolve,\n  TCtx & AuthResolverCtx\n>;\n\ninterface AuthContextResolver {\n  <TCtx, TResolve extends object = Record<string, never>>(\n    ctx: TCtx,\n    config?: PublicAuthContextConfig<TResolve, TCtx>,\n  ): Promise<ResolvedAuthContext<TResolve>>;\n}\n\ninterface OptionalAuthContextResolver {\n  <TCtx, TResolve extends object = Record<string, never>>(\n    ctx: TCtx,\n    config?: PublicAuthContextConfig<TResolve, TCtx>,\n  ): Promise<ResolvedOptionalAuthContext<TResolve>>;\n}\n\ntype AuthContextCustomization<TAuth> = {\n  args: {};\n  input: (\n    ctx: AuthResolverCtx,\n    _args: Record<string, never>,\n    _extra?: unknown,\n  ) => Promise<{\n    ctx: {\n      auth: TAuth;\n    };\n    args: {};\n  }>;\n};\n\ninterface AuthContextFactory {\n  <TResolve extends object = Record<string, never>>(\n    config?: AuthContextConfig<TResolve>,\n  ): AuthContextCustomization<RequiredAuthContextState & TResolve>;\n}\n\ninterface OptionalAuthContextFactory {\n  <TResolve extends object = Record<string, never>>(\n    config?: AuthContextConfig<TResolve>,\n  ): AuthContextCustomization<OptionalAuthContextState & TResolve>;\n}\n\n/**\n * Extract the resolved `auth` context type from an `auth.ctx()` customization.\n *\n * Use this to type function parameters or variables that receive the\n * enriched auth context produced by `auth.ctx()`. The inferred type includes\n * `userId`, `user`, `groupId`, `role`, `grants`, `getUserIdentity`, and any\n * additional fields added by the `resolve` callback. This is the generic\n * utility for reusing the enriched auth shape without manually duplicating\n * conditional auth types.\n *\n * @typeParam T - An `auth.ctx()` return value (must have an `input` method\n *   that returns `{ ctx: { auth: ... } }`).\n *\n * @example\n * ```ts\n * const authCtx = auth.ctx({\n *   resolve: async (ctx, user) => ({ orgId: user.orgId }),\n * });\n * type Auth = InferAuth<typeof authCtx>;\n * // Auth = { userId: Id<\"User\">; user: UserDoc; getUserIdentity: ...; orgId: string }\n * ```\n *\n * @see {@link defineAuth}\n */\nexport type InferAuth<\n  T extends {\n    input: (...args: never[]) => CustomFunctionInputResult<object>;\n  },\n> = Awaited<ReturnType<T[\"input\"]>>[\"ctx\"][\"auth\"];\n\ntype AuthContextFacade = {\n  context: AuthContextResolver & { optional: OptionalAuthContextResolver };\n  ctx: AuthContextFactory & { optional: OptionalAuthContextFactory };\n};\n\nexport type {\n  AuthContextFacade,\n  AuthContextResolver,\n  AuthContextFactory,\n  OptionalAuthContextResolver,\n  OptionalAuthContextFactory,\n};\n\nasync function resolveConfiguredAuthContext<\n  TCtx extends AuthIdentityCtx & AuthQueryCtx,\n  TResolve extends object = Record<string, never>,\n>(\n  auth: AuthLike,\n  ctx: TCtx,\n  _config?: AuthContextConfig<TResolve, TCtx>,\n): Promise<AuthContext | null> {\n  return await getResolvedAuthContext(auth, ctx);\n}\n\nfunction createNotSignedInError() {\n  return new ConvexError({\n    code: ErrorCode.NOT_SIGNED_IN,\n    message: \"Authentication required.\",\n  });\n}\n\n/** @internal */\nexport function assertAuthResolverContext<TCtx>(ctx: TCtx): asserts ctx is TCtx & AuthResolverCtx {\n  const candidate = ctx as {\n    auth?: { getUserIdentity?: unknown };\n    runQuery?: unknown;\n  } | null;\n\n  if (\n    candidate === null ||\n    typeof candidate !== \"object\" ||\n    candidate.auth === undefined ||\n    candidate.auth === null ||\n    typeof candidate.auth !== \"object\" ||\n    typeof candidate.auth.getUserIdentity !== \"function\" ||\n    typeof candidate.runQuery !== \"function\"\n  ) {\n    throw new TypeError(\n      \"auth.context(ctx) requires a Convex function context with auth.getUserIdentity() and runQuery().\",\n    );\n  }\n}\n\n/**\n * Resolve the public auth context for a Convex handler context.\n *\n * Enforce the `require` / `active` builder options against a resolved\n * context. Reuses `ctx.auth.assert` for grants so behavior is identical\n * to an inline call.\n *\n * @internal\n */\nfunction enforceAuthRequirements(\n  resolved: AuthContext,\n  config?: { assert?: string | readonly string[]; active?: true },\n) {\n  if (config?.active === true && resolved.groupId === null) {\n    throw new ConvexError({\n      code: ErrorCode.NO_ACTIVE_GROUP,\n      message: \"An active group is required.\",\n    });\n  }\n  if (config?.assert !== undefined) {\n    resolved.assert(config.assert);\n  }\n}\n\n/**\n * This low-level helper underpins `auth.context(...)` and\n * `auth.context.optional(...)`.\n */\nasync function createPublicAuthContext<\n  TCtx extends AuthIdentityCtx & AuthQueryCtx,\n  TResolve extends object = Record<string, never>,\n>(\n  auth: AuthLike,\n  ctx: TCtx,\n  config: AuthContextConfig<TResolve, TCtx> | undefined,\n  optional: boolean,\n) {\n  const resolved = await resolveConfiguredAuthContext(auth, ctx, config);\n\n  if (resolved === null) {\n    if (!optional) {\n      throw createNotSignedInError();\n    }\n    return createUnauthenticatedAuthContext();\n  }\n\n  enforceAuthRequirements(resolved, config);\n\n  const extra = config?.resolve ? await config.resolve(ctx, resolved.user, resolved) : {};\n\n  return {\n    ...resolved,\n    ...extra,\n  };\n}\n\n/**\n * Create a convex-helpers customization that injects `ctx.auth`.\n *\n * This low-level helper underpins `auth.ctx(...)` and `auth.ctx.optional(...)`.\n */\nfunction createAuthContextCustomization<\n  TResolve extends object = Record<string, never>,\n  TCtx extends AuthIdentityCtx & {\n    runQuery: ComponentReadCtx[\"runQuery\"];\n  } = AuthIdentityCtx & ComponentReadCtx,\n>(auth: AuthLike, config: AuthContextConfig<TResolve, TCtx> | undefined, optional: boolean) {\n  return {\n    args: {},\n    input: async (ctx: TCtx, _args: Record<string, never>, _extra?: unknown) => {\n      const nativeAuth = ctx.auth;\n      const getUserIdentity = nativeAuth.getUserIdentity.bind(nativeAuth);\n      const resolved = await resolveConfiguredAuthContext(auth, ctx, config);\n\n      if (resolved === null) {\n        if (!optional) {\n          throw createNotSignedInError();\n        }\n        return {\n          ctx: {\n            auth: {\n              getUserIdentity,\n              ...createUnauthenticatedAuthContext(),\n            },\n          },\n          args: {},\n        };\n      }\n\n      enforceAuthRequirements(resolved, config);\n\n      const extra = config?.resolve ? await config.resolve(ctx, resolved.user, resolved) : {};\n\n      return {\n        ctx: {\n          auth: {\n            getUserIdentity,\n            ...resolved,\n            ...extra,\n          },\n        },\n        args: {},\n      };\n    },\n  };\n}\n\n/**\n * Build the shared public auth context facade used by both `defineAuth()` and\n * `createAuthContext()`.\n *\n * @internal\n */\nexport function createAuthContextFacade(auth: AuthLike): AuthContextFacade {\n  const context = ((ctx: AuthResolverCtx, config?: AuthContextConfig<any, AuthResolverCtx>) => {\n    assertAuthResolverContext(ctx);\n    return createPublicAuthContext(auth, ctx, config, false);\n  }) as AuthContextFacade[\"context\"];\n\n  context.optional = ((ctx: AuthResolverCtx, config?: AuthContextConfig<any, AuthResolverCtx>) => {\n    assertAuthResolverContext(ctx);\n    return createPublicAuthContext(auth, ctx, config, true);\n  }) as OptionalAuthContextResolver;\n\n  const ctxFactory = ((config?: AuthContextConfig<any, AuthResolverCtx>) =>\n    createAuthContextCustomization(auth, config, false)) as AuthContextFacade[\"ctx\"];\n\n  ctxFactory.optional = ((config?: AuthContextConfig<any, AuthResolverCtx>) =>\n    createAuthContextCustomization(auth, config, true)) as OptionalAuthContextFactory;\n\n  return {\n    context,\n    ctx: ctxFactory,\n  };\n}\n"],"mappings":";;;;;AAsJA,eAAe,6BAIb,MACA,KACA,SAC6B;AAC7B,QAAO,MAAMA,eAAuB,MAAM,IAAI;;AAGhD,SAAS,yBAAyB;AAChC,QAAO,IAAI,YAAY;EACrB,MAAM,UAAU;EAChB,SAAS;EACV,CAAC;;;AAIJ,SAAgB,0BAAgC,KAAkD;CAChG,MAAM,YAAY;AAKlB,KACE,cAAc,QACd,OAAO,cAAc,YACrB,UAAU,SAAS,UACnB,UAAU,SAAS,QACnB,OAAO,UAAU,SAAS,YAC1B,OAAO,UAAU,KAAK,oBAAoB,cAC1C,OAAO,UAAU,aAAa,WAE9B,OAAM,IAAI,UACR,mGACD;;;;;;;;;;;AAaL,SAAS,wBACP,UACA,QACA;AACA,KAAI,QAAQ,WAAW,QAAQ,SAAS,YAAY,KAClD,OAAM,IAAI,YAAY;EACpB,MAAM,UAAU;EAChB,SAAS;EACV,CAAC;AAEJ,KAAI,QAAQ,WAAW,OACrB,UAAS,OAAO,OAAO,OAAO;;;;;;AAQlC,eAAe,wBAIb,MACA,KACA,QACA,UACA;CACA,MAAM,WAAW,MAAM,6BAA6B,MAAM,KAAK,OAAO;AAEtE,KAAI,aAAa,MAAM;AACrB,MAAI,CAAC,SACH,OAAM,wBAAwB;AAEhC,SAAO,kCAAkC;;AAG3C,yBAAwB,UAAU,OAAO;CAEzC,MAAM,QAAQ,QAAQ,UAAU,MAAM,OAAO,QAAQ,KAAK,SAAS,MAAM,SAAS,GAAG,EAAE;AAEvF,QAAO;EACL,GAAG;EACH,GAAG;EACJ;;;;;;;AAQH,SAAS,+BAKP,MAAgB,QAAuD,UAAmB;AAC1F,QAAO;EACL,MAAM,EAAE;EACR,OAAO,OAAO,KAAW,OAA8B,WAAqB;GAC1E,MAAM,aAAa,IAAI;GACvB,MAAM,kBAAkB,WAAW,gBAAgB,KAAK,WAAW;GACnE,MAAM,WAAW,MAAM,6BAA6B,MAAM,KAAK,OAAO;AAEtE,OAAI,aAAa,MAAM;AACrB,QAAI,CAAC,SACH,OAAM,wBAAwB;AAEhC,WAAO;KACL,KAAK,EACH,MAAM;MACJ;MACA,GAAG,kCAAkC;MACtC,EACF;KACD,MAAM,EAAE;KACT;;AAGH,2BAAwB,UAAU,OAAO;GAEzC,MAAM,QAAQ,QAAQ,UAAU,MAAM,OAAO,QAAQ,KAAK,SAAS,MAAM,SAAS,GAAG,EAAE;AAEvF,UAAO;IACL,KAAK,EACH,MAAM;KACJ;KACA,GAAG;KACH,GAAG;KACJ,EACF;IACD,MAAM,EAAE;IACT;;EAEJ;;;;;;;;AASH,SAAgB,wBAAwB,MAAmC;CACzE,MAAM,YAAY,KAAsB,WAAqD;AAC3F,4BAA0B,IAAI;AAC9B,SAAO,wBAAwB,MAAM,KAAK,QAAQ,MAAM;;AAG1D,SAAQ,aAAa,KAAsB,WAAqD;AAC9F,4BAA0B,IAAI;AAC9B,SAAO,wBAAwB,MAAM,KAAK,QAAQ,KAAK;;CAGzD,MAAM,eAAe,WACnB,+BAA+B,MAAM,QAAQ,MAAM;AAErD,YAAW,aAAa,WACtB,+BAA+B,MAAM,QAAQ,KAAK;AAEpD,QAAO;EACL;EACA,KAAK;EACN"}
+{"version":3,"file":"facade.js","names":["getResolvedAuthContext"],"sources":["../../src/server/facade.ts"],"sourcesContent":["/**\n * Lightweight auth context resolution — no dependency on `./runtime`.\n *\n * This module contains the pure auth context helpers that `core/index.ts`\n * and other lightweight consumers can import without pulling in the\n * heavyweight provider / OAuth / crypto machinery from `./runtime`.\n *\n * @module\n */\n\nimport type { UserIdentity } from \"convex/server\";\nimport { ConvexError } from \"convex/values\";\n\nimport { ErrorCode } from \"../shared/codes\";\nimport type { ComponentReadCtx } from \"./component/context\";\nimport {\n  createUnauthenticatedAuthContext,\n  getAuthContext as getResolvedAuthContext,\n  type AuthContext,\n  type AuthContextConfig,\n  type AuthLike,\n  type OptionalAuthContext,\n  type UserDoc,\n} from \"./context\";\n\nexport type { AuthContext, AuthContextConfig, OptionalAuthContext, UserDoc };\n\n/**\n * Config for auth setup. Extends the standard auth config\n * minus `component` (which is passed as the first constructor argument).\n */\nexport type AuthConfig<TExtend = {}> = Omit<\n  import(\"./types\").ConvexAuthConfig<TExtend>,\n  \"component\"\n>;\n\ntype AuthIdentityCtx = {\n  auth: {\n    getUserIdentity: () => Promise<UserIdentity | null>;\n  };\n};\n\ntype AuthQueryCtx = ComponentReadCtx;\n\ntype AuthContextBase = {\n  getUserIdentity: () => Promise<UserIdentity | null>;\n};\n\ntype RequiredAuthContextState = AuthContextBase & AuthContext;\n\ntype OptionalAuthContextState = AuthContextBase & OptionalAuthContext;\n\ntype ResolvedAuthContext<TResolve> = AuthContext & TResolve;\n\ntype ResolvedOptionalAuthContext<TResolve> = OptionalAuthContext & TResolve;\n\ntype AuthResolverCtx = AuthIdentityCtx & AuthQueryCtx;\n\ntype PublicAuthContextConfig<TResolve extends object, TCtx> = AuthContextConfig<\n  TResolve,\n  TCtx & AuthResolverCtx\n>;\n\ninterface AuthContextResolver {\n  <TCtx, TResolve extends object = Record<string, never>>(\n    ctx: TCtx,\n    config?: PublicAuthContextConfig<TResolve, TCtx>,\n  ): Promise<ResolvedAuthContext<TResolve>>;\n}\n\ninterface OptionalAuthContextResolver {\n  <TCtx, TResolve extends object = Record<string, never>>(\n    ctx: TCtx,\n    config?: PublicAuthContextConfig<TResolve, TCtx>,\n  ): Promise<ResolvedOptionalAuthContext<TResolve>>;\n}\n\ntype AuthContextCustomization<TAuth> = {\n  args: {};\n  input: (\n    ctx: AuthResolverCtx,\n    _args: Record<string, never>,\n    _extra?: unknown,\n  ) => Promise<{\n    ctx: {\n      auth: TAuth;\n    };\n    args: {};\n  }>;\n};\n\ninterface AuthContextFactory {\n  <TResolve extends object = Record<string, never>>(\n    config?: AuthContextConfig<TResolve>,\n  ): AuthContextCustomization<RequiredAuthContextState & TResolve>;\n}\n\ninterface OptionalAuthContextFactory {\n  <TResolve extends object = Record<string, never>>(\n    config?: AuthContextConfig<TResolve>,\n  ): AuthContextCustomization<OptionalAuthContextState & TResolve>;\n}\n\ntype AuthContextFacade = {\n  context: AuthContextResolver & { optional: OptionalAuthContextResolver };\n  ctx: AuthContextFactory & { optional: OptionalAuthContextFactory };\n};\n\nexport type {\n  AuthContextFacade,\n  AuthContextResolver,\n  AuthContextFactory,\n  OptionalAuthContextResolver,\n  OptionalAuthContextFactory,\n};\n\nasync function resolveConfiguredAuthContext<\n  TCtx extends AuthIdentityCtx & AuthQueryCtx,\n  TResolve extends object = Record<string, never>,\n>(\n  auth: AuthLike,\n  ctx: TCtx,\n  _config?: AuthContextConfig<TResolve, TCtx>,\n): Promise<AuthContext | null> {\n  return await getResolvedAuthContext(auth, ctx);\n}\n\nfunction createNotSignedInError() {\n  return new ConvexError({\n    code: ErrorCode.NOT_SIGNED_IN,\n    message: \"Authentication required.\",\n  });\n}\n\n/** @internal */\nexport function assertAuthResolverContext<TCtx>(ctx: TCtx): asserts ctx is TCtx & AuthResolverCtx {\n  const candidate = ctx as {\n    auth?: { getUserIdentity?: unknown };\n    runQuery?: unknown;\n  } | null;\n\n  if (\n    candidate === null ||\n    typeof candidate !== \"object\" ||\n    candidate.auth === undefined ||\n    candidate.auth === null ||\n    typeof candidate.auth !== \"object\" ||\n    typeof candidate.auth.getUserIdentity !== \"function\" ||\n    typeof candidate.runQuery !== \"function\"\n  ) {\n    throw new TypeError(\n      \"auth.context(ctx) requires a Convex function context with auth.getUserIdentity() and runQuery().\",\n    );\n  }\n}\n\n/**\n * Resolve the public auth context for a Convex handler context.\n *\n * Enforce the `require` / `active` builder options against a resolved\n * context. Reuses `ctx.auth.assert` for grants so behavior is identical\n * to an inline call.\n *\n * @internal\n */\nfunction enforceAuthRequirements(\n  resolved: AuthContext,\n  config?: { assert?: string | readonly string[]; active?: true },\n) {\n  if (config?.active === true && resolved.groupId === null) {\n    throw new ConvexError({\n      code: ErrorCode.NO_ACTIVE_GROUP,\n      message: \"An active group is required.\",\n    });\n  }\n  if (config?.assert !== undefined) {\n    resolved.assert(config.assert);\n  }\n}\n\n/**\n * This low-level helper underpins `auth.context(...)` and\n * `auth.context.optional(...)`.\n */\nasync function createPublicAuthContext<\n  TCtx extends AuthIdentityCtx & AuthQueryCtx,\n  TResolve extends object = Record<string, never>,\n>(\n  auth: AuthLike,\n  ctx: TCtx,\n  config: AuthContextConfig<TResolve, TCtx> | undefined,\n  optional: boolean,\n) {\n  const resolved = await resolveConfiguredAuthContext(auth, ctx, config);\n\n  if (resolved === null) {\n    if (!optional) {\n      throw createNotSignedInError();\n    }\n    return createUnauthenticatedAuthContext();\n  }\n\n  enforceAuthRequirements(resolved, config);\n\n  const extra = config?.resolve ? await config.resolve(ctx, resolved.user, resolved) : {};\n\n  return {\n    ...resolved,\n    ...extra,\n  };\n}\n\n/**\n * Create a convex-helpers customization that injects `ctx.auth`.\n *\n * This low-level helper underpins `auth.ctx(...)` and `auth.ctx.optional(...)`.\n */\nfunction createAuthContextCustomization<\n  TResolve extends object = Record<string, never>,\n  TCtx extends AuthIdentityCtx & {\n    runQuery: ComponentReadCtx[\"runQuery\"];\n  } = AuthIdentityCtx & ComponentReadCtx,\n>(auth: AuthLike, config: AuthContextConfig<TResolve, TCtx> | undefined, optional: boolean) {\n  return {\n    args: {},\n    input: async (ctx: TCtx, _args: Record<string, never>, _extra?: unknown) => {\n      const nativeAuth = ctx.auth;\n      const getUserIdentity = nativeAuth.getUserIdentity.bind(nativeAuth);\n      const resolved = await resolveConfiguredAuthContext(auth, ctx, config);\n\n      if (resolved === null) {\n        if (!optional) {\n          throw createNotSignedInError();\n        }\n        return {\n          ctx: {\n            auth: {\n              getUserIdentity,\n              ...createUnauthenticatedAuthContext(),\n            },\n          },\n          args: {},\n        };\n      }\n\n      enforceAuthRequirements(resolved, config);\n\n      const extra = config?.resolve ? await config.resolve(ctx, resolved.user, resolved) : {};\n\n      return {\n        ctx: {\n          auth: {\n            getUserIdentity,\n            ...resolved,\n            ...extra,\n          },\n        },\n        args: {},\n      };\n    },\n  };\n}\n\n/**\n * Build the auth context facade attached to a configured `defineAuth()` result.\n *\n * @internal\n */\nexport function createAuthContextFacade(auth: AuthLike): AuthContextFacade {\n  const context = ((ctx: AuthResolverCtx, config?: AuthContextConfig<any, AuthResolverCtx>) => {\n    assertAuthResolverContext(ctx);\n    return createPublicAuthContext(auth, ctx, config, false);\n  }) as AuthContextFacade[\"context\"];\n\n  context.optional = ((ctx: AuthResolverCtx, config?: AuthContextConfig<any, AuthResolverCtx>) => {\n    assertAuthResolverContext(ctx);\n    return createPublicAuthContext(auth, ctx, config, true);\n  }) as OptionalAuthContextResolver;\n\n  const ctxFactory = ((config?: AuthContextConfig<any, AuthResolverCtx>) =>\n    createAuthContextCustomization(auth, config, false)) as AuthContextFacade[\"ctx\"];\n\n  ctxFactory.optional = ((config?: AuthContextConfig<any, AuthResolverCtx>) =>\n    createAuthContextCustomization(auth, config, true)) as OptionalAuthContextFactory;\n\n  return {\n    context,\n    ctx: ctxFactory,\n  };\n}\n"],"mappings":";;;;;AAoHA,eAAe,6BAIb,MACA,KACA,SAC6B;AAC7B,QAAO,MAAMA,eAAuB,MAAM,IAAI;;AAGhD,SAAS,yBAAyB;AAChC,QAAO,IAAI,YAAY;EACrB,MAAM,UAAU;EAChB,SAAS;EACV,CAAC;;;AAIJ,SAAgB,0BAAgC,KAAkD;CAChG,MAAM,YAAY;AAKlB,KACE,cAAc,QACd,OAAO,cAAc,YACrB,UAAU,SAAS,UACnB,UAAU,SAAS,QACnB,OAAO,UAAU,SAAS,YAC1B,OAAO,UAAU,KAAK,oBAAoB,cAC1C,OAAO,UAAU,aAAa,WAE9B,OAAM,IAAI,UACR,mGACD;;;;;;;;;;;AAaL,SAAS,wBACP,UACA,QACA;AACA,KAAI,QAAQ,WAAW,QAAQ,SAAS,YAAY,KAClD,OAAM,IAAI,YAAY;EACpB,MAAM,UAAU;EAChB,SAAS;EACV,CAAC;AAEJ,KAAI,QAAQ,WAAW,OACrB,UAAS,OAAO,OAAO,OAAO;;;;;;AAQlC,eAAe,wBAIb,MACA,KACA,QACA,UACA;CACA,MAAM,WAAW,MAAM,6BAA6B,MAAM,KAAK,OAAO;AAEtE,KAAI,aAAa,MAAM;AACrB,MAAI,CAAC,SACH,OAAM,wBAAwB;AAEhC,SAAO,kCAAkC;;AAG3C,yBAAwB,UAAU,OAAO;CAEzC,MAAM,QAAQ,QAAQ,UAAU,MAAM,OAAO,QAAQ,KAAK,SAAS,MAAM,SAAS,GAAG,EAAE;AAEvF,QAAO;EACL,GAAG;EACH,GAAG;EACJ;;;;;;;AAQH,SAAS,+BAKP,MAAgB,QAAuD,UAAmB;AAC1F,QAAO;EACL,MAAM,EAAE;EACR,OAAO,OAAO,KAAW,OAA8B,WAAqB;GAC1E,MAAM,aAAa,IAAI;GACvB,MAAM,kBAAkB,WAAW,gBAAgB,KAAK,WAAW;GACnE,MAAM,WAAW,MAAM,6BAA6B,MAAM,KAAK,OAAO;AAEtE,OAAI,aAAa,MAAM;AACrB,QAAI,CAAC,SACH,OAAM,wBAAwB;AAEhC,WAAO;KACL,KAAK,EACH,MAAM;MACJ;MACA,GAAG,kCAAkC;MACtC,EACF;KACD,MAAM,EAAE;KACT;;AAGH,2BAAwB,UAAU,OAAO;GAEzC,MAAM,QAAQ,QAAQ,UAAU,MAAM,OAAO,QAAQ,KAAK,SAAS,MAAM,SAAS,GAAG,EAAE;AAEvF,UAAO;IACL,KAAK,EACH,MAAM;KACJ;KACA,GAAG;KACH,GAAG;KACJ,EACF;IACD,MAAM,EAAE;IACT;;EAEJ;;;;;;;AAQH,SAAgB,wBAAwB,MAAmC;CACzE,MAAM,YAAY,KAAsB,WAAqD;AAC3F,4BAA0B,IAAI;AAC9B,SAAO,wBAAwB,MAAM,KAAK,QAAQ,MAAM;;AAG1D,SAAQ,aAAa,KAAsB,WAAqD;AAC9F,4BAA0B,IAAI;AAC9B,SAAO,wBAAwB,MAAM,KAAK,QAAQ,KAAK;;CAGzD,MAAM,eAAe,WACnB,+BAA+B,MAAM,QAAQ,MAAM;AAErD,YAAW,aAAa,WACtB,+BAA+B,MAAM,QAAQ,KAAK;AAEpD,QAAO;EACL;EACA,KAAK;EACN"}

package/dist/server/http.d.ts

@@ -2,6 +2,7 @@ import { ComponentReadCtx } from "./component/context.js";
 import { HttpKeyContext } from "./types.js";
 import { AuthContext, OptionalAuthContext, UserDoc } from "./context.js";
 import "./auth.js";
+import { GenericId } from "convex/values";
 import { GenericActionCtx, GenericDataModel, HttpRouter, UserIdentity } from "convex/server";
 
 //#region src/server/http.d.ts

package/dist/server/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","names":[],"sources":["../../src/server/http.ts"],"mappings":";;;;;;;KA+BK,eAAA;EACH,IAAA;IACE,eAAA,QAAuB,OAAA,CAAQ,YAAA;EAAA;AAAA;AAAA,KAG9B,cAAA,GAAiB,eAAA,GAAkB,gBAAA;;;;;;;AAHO;;;;;AAsD/C;;;;;;;;KAAY,eAAA,IACP,WAAA;EAAA,oEAEC,MAAA,aAEA;EAAA,GAAA;EACA,KAAA;AAAA,MAED,WAAA;EAIC,oDAFA,MAAA,SAGA;EADA,GAAA,EAAK,cAAA;EACL,KAAA;AAAA,MAED,WAAA;EACC,MAAA;EACA,GAAA;EACA,KAAA;IAAS,QAAA;IAAkB,MAAA;EAAA;AAAA;;;;;;;;KAUrB,uBAAA,IACP,mBAAA;EAOc,6CALb,MAAA,QA0B2B;EAxB3B,GAAA;EACA,KAAA;AAAA,KAEF,eAAA;;;;;;;;;;;;;;;;;;;;KAqBQ,qBAAA,kBACO,MAAA,oBAA0B,MAAA,8BAC9B,cAAA,GAAiB,cAAA;EAAjB;;;;;EAOb,OAAA,IAAW,GAAA,EAAK,IAAA,EAAM,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,eAAA,KAAoB,OAAA,CAAQ,QAAA,IAAY,QAAA;EAA7D;;;;;;;EAQtB,WAAA,IACE,GAAA,EAAK,IAAA,EACL,QAAA,QAAgB,OAAA,CAAQ,eAAA,aACrB,OAAA,CAAQ,eAAA,uBAAsC,eAAA;EAFjD;;;;;;;;EAWF,QAAA;AAAA;;;;;;;;;;UAoJe,mBAAA;EAAA,kBAEI,MAAA,oBAA0B,MAAA,8BAC9B,cAAA,GAAiB,cAAA,EAE9B,GAAA,EAAK,IAAA,EACL,OAAA,EAAS,OAAA,EACT,MAAA,GAAS,qBAAA,CAAsB,QAAA,EAAU,IAAA,IACxC,OAAA,CAAQ,eAAA,GAAkB,QAAA;AAAA;;;;UAMd,2BAAA;EAAA,kBAEI,MAAA,oBAA0B,MAAA,8BAC9B,cAAA,GAAiB,cAAA,EAE9B,GAAA,EAAK,IAAA,EACL,OAAA,EAAS,OAAA,EACT,MAAA,GAAS,qBAAA,CAAsB,QAAA,EAAU,IAAA,IACxC,OAAA,CAAQ,uBAAA,GAA0B,QAAA;AAAA"}
+{"version":3,"file":"http.d.ts","names":[],"sources":["../../src/server/http.ts"],"mappings":";;;;;;;;KAiCK,eAAA;EACH,IAAA;IACE,eAAA,QAAuB,OAAA,CAAQ,YAAA;EAAA;AAAA;AAAA,KAG9B,cAAA,GAAiB,eAAA,GAAkB,gBAAA;;;;;;AAHO;;;;;AAyC/C;;;;;;;;;KAAY,eAAA,IACP,WAAA;EAEC,oEAAA,MAAA,aAGA;EADA,GAAA;EACA,KAAA;AAAA,MAED,WAAA;EAIM,oDAFL,MAAA,SAKD;EAHC,GAAA,EAAK,cAAA;EACL,KAAA;AAAA,MAED,WAAA;EACC,MAAA;EACA,GAAA;EACA,KAAA;IAAS,QAAA;IAAkB,MAAA;EAAA;AAAA;;;;;;;;KAUrB,uBAAA,IACP,mBAAA;EA4BO,6CA1BN,MAAA,QA0B2B;EAxB3B,GAAA;EACA,KAAA;AAAA,KAEF,eAAA;;;;;;;;;;;;;;;;;;;;KAqBQ,qBAAA,kBACO,MAAA,oBAA0B,MAAA,8BAC9B,cAAA,GAAiB,cAAA;EAAA;;;;;EAO9B,OAAA,IAAW,GAAA,EAAK,IAAA,EAAM,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,eAAA,KAAoB,OAAA,CAAQ,QAAA,IAAY,QAAA;EAAxC;;;;;;;EAQ3C,WAAA,IACE,GAAA,EAAK,IAAA,EACL,QAAA,QAAgB,OAAA,CAAQ,eAAA,aACrB,OAAA,CAAQ,eAAA,uBAAsC,eAAA;EADjC;;;;;;;;EAUlB,QAAA;AAAA;;;;;;;;;;UAmJe,mBAAA;EAAA,kBAEI,MAAA,oBAA0B,MAAA,8BAC9B,cAAA,GAAiB,cAAA,EAE9B,GAAA,EAAK,IAAA,EACL,OAAA,EAAS,OAAA,EACT,MAAA,GAAS,qBAAA,CAAsB,QAAA,EAAU,IAAA,IACxC,OAAA,CAAQ,eAAA,GAAkB,QAAA;AAAA;;;;UAMd,2BAAA;EAAA,kBAEI,MAAA,oBAA0B,MAAA,8BAC9B,cAAA,GAAiB,cAAA,EAE9B,GAAA,EAAK,IAAA,EACL,OAAA,EAAS,OAAA,EACT,MAAA,GAAS,qBAAA,CAAsB,QAAA,EAAU,IAAA,IACxC,OAAA,CAAQ,uBAAA,GAA0B,QAAA;AAAA"}