@estifanos-sh/convex-auth 0.0.2 → 0.0.4

package/dist/component/account.js.map

@@ -1 +1 @@
-{"version":3,"file":"account.js","names":[],"sources":["../../src/component/account.ts"],"sourcesContent":["/**\n * `component.account.*` — provider-linked auth accounts.\n *\n * Reads collapse into one overloaded `get`; `list`\n * takes the owning `userId`.\n *\n * @module\n */\n\nimport { ConvexError, v } from \"convex/values\";\nimport { ErrorCode } from \"../shared/codes\";\n\nimport { recordSignInLimit, resetSignInLimit } from \"./limits\";\nimport { mutation, query } from \"./functions\";\nimport { vAccountDoc, vUserDoc } from \"./model\";\nimport { createSessionRows, type SessionRows } from \"./session\";\n\nconst ACCOUNT_LIST_BATCH = 128;\n\ntype AcceptedCredentialsSignIn = SessionRows & { status: \"accepted\" };\n\n/** Reserve a password attempt and load all sign-in state in one transaction. */\nexport const beginCredentialsSignIn = mutation({\n  args: {\n    provider: v.string(),\n    providerAccountId: v.string(),\n    maxAttemptsPerHour: v.number(),\n    reserveAttempt: v.boolean(),\n    includeTotp: v.boolean(),\n  },\n  returns: v.union(\n    v.object({ status: v.literal(\"invalid\") }),\n    v.object({ status: v.literal(\"limited\") }),\n    v.object({\n      status: v.literal(\"ready\"),\n      account: vAccountDoc,\n      user: vUserDoc,\n      hasTotp: v.boolean(),\n    }),\n  ),\n  handler: async (ctx, args) => {\n    const account = await ctx.db\n      .query(\"Account\")\n      .withIndex(\"provider_account_id\", (q) =>\n        q.eq(\"provider\", args.provider).eq(\"providerAccountId\", args.providerAccountId),\n      )\n      .unique();\n    if (account === null) return { status: \"invalid\" as const };\n\n    const [user, totp, limit] = await Promise.all([\n      ctx.db.get(\"User\", account.userId),\n      args.includeTotp\n        ? ctx.db\n            .query(\"TotpFactor\")\n            .withIndex(\"user_id_verified\", (q) =>\n              q.eq(\"userId\", account.userId).eq(\"verified\", true),\n            )\n            .first()\n        : Promise.resolve(null),\n      args.reserveAttempt\n        ? recordSignInLimit(ctx, {\n            identifier: account._id,\n            maxAttemptsPerHour: args.maxAttemptsPerHour,\n          })\n        : Promise.resolve({ ok: true as const, retryAfter: undefined }),\n    ]);\n    if (!limit.ok) return { status: \"limited\" as const };\n    if (user === null) return { status: \"invalid\" as const };\n    return {\n      status: \"ready\" as const,\n      account,\n      user,\n      hasTotp: totp !== null,\n    };\n  },\n});\n\n/** Refund a verified password attempt and optionally issue its session atomically. */\nexport const completeCredentialsSignIn = mutation({\n  args: {\n    accountId: v.id(\"Account\"),\n    issueSession: v.boolean(),\n    generateTokens: v.boolean(),\n    replaceSessionId: v.optional(v.id(\"Session\")),\n    sessionExpirationTime: v.number(),\n    refreshTokenExpirationTime: v.number(),\n  },\n  returns: v.union(\n    v.object({ status: v.literal(\"rejected\") }),\n    v.object({ status: v.literal(\"reset\") }),\n    v.object({\n      status: v.literal(\"accepted\"),\n      user: vUserDoc,\n      sessionId: v.id(\"Session\"),\n      refreshTokenId: v.optional(v.id(\"RefreshToken\")),\n      replacedSessionId: v.optional(v.id(\"Session\")),\n    }),\n  ),\n  handler: async (ctx, args) => {\n    const account = await ctx.db.get(\"Account\", args.accountId);\n    if (account === null) return { status: \"rejected\" as const };\n    await resetSignInLimit(ctx, account._id);\n    if (!args.issueSession) return { status: \"reset\" as const };\n\n    const created = await createSessionRows(ctx, {\n      userId: account.userId,\n      replaceSessionId: args.replaceSessionId,\n      sessionExpirationTime: args.sessionExpirationTime,\n      refreshTokenExpirationTime: args.generateTokens ? args.refreshTokenExpirationTime : undefined,\n    });\n    if (created === null) return { status: \"rejected\" as const };\n    const result: AcceptedCredentialsSignIn = {\n      status: \"accepted\" as const,\n      user: created.user,\n      sessionId: created.sessionId,\n    };\n    if (created.refreshTokenId !== undefined) result.refreshTokenId = created.refreshTokenId;\n    if (created.replacedSessionId !== undefined) {\n      result.replacedSessionId = created.replacedSessionId;\n    }\n    return result;\n  },\n});\n\n/**\n * Read an account by id, or by `{ provider, providerAccountId }` when both\n * are given. Returns `null` when no selector matches.\n */\nexport const get = query({\n  args: {\n    id: v.optional(v.id(\"Account\")),\n    provider: v.optional(v.string()),\n    providerAccountId: v.optional(v.string()),\n  },\n  returns: v.union(vAccountDoc, v.null()),\n  handler: async (ctx, args) => {\n    if (args.provider !== undefined && args.providerAccountId !== undefined) {\n      return await ctx.db\n        .query(\"Account\")\n        .withIndex(\"provider_account_id\", (q) =>\n          q.eq(\"provider\", args.provider!).eq(\"providerAccountId\", args.providerAccountId!),\n        )\n        .unique();\n    }\n    if (args.id === undefined) return null;\n    return await ctx.db.get(\"Account\", args.id);\n  },\n});\n\n/** List the accounts owned by a user. */\nexport const list = query({\n  args: { userId: v.id(\"User\") },\n  returns: v.array(vAccountDoc),\n  handler: async (ctx, { userId }) => {\n    return await ctx.db\n      .query(\"Account\")\n      .withIndex(\"user_id_provider\", (q) => q.eq(\"userId\", userId))\n      .take(ACCOUNT_LIST_BATCH);\n  },\n});\n\n/** Insert a new account. */\nexport const create = mutation({\n  args: {\n    userId: v.id(\"User\"),\n    provider: v.string(),\n    providerAccountId: v.string(),\n    secret: v.optional(v.string()),\n    extend: v.optional(v.any()),\n  },\n  returns: v.id(\"Account\"),\n  handler: async (ctx, args) => {\n    // Dedup on the (provider, providerAccountId) identity. A bare insert let two\n    // concurrent or retried provisioning ceremonies — SCIM POST retries, a\n    // passkey double-submit — create duplicate Account rows, which then made\n    // `account.get(...).unique()` throw on every future lookup (a permanent\n    // sign-in lockout / rogue credential attribution). The index-range read plus\n    // insert in this single mutation is OCC-atomic: a racing insert into the same\n    // range conflicts and retries, then observes the winner's row below.\n    const existing = await ctx.db\n      .query(\"Account\")\n      .withIndex(\"provider_account_id\", (q) =>\n        q.eq(\"provider\", args.provider).eq(\"providerAccountId\", args.providerAccountId),\n      )\n      .first();\n    if (existing !== null) {\n      if (existing.userId !== args.userId) {\n        // Already linked to a different user — reject rather than silently\n        // attribute the identity (e.g. an attacker registering a passkey\n        // credentialId that already belongs to a victim).\n        throw new ConvexError({\n          code: ErrorCode.ACCOUNT_ALREADY_LINKED,\n          message: \"This account is already linked to another user.\",\n        });\n      }\n      return existing._id;\n    }\n    return await ctx.db.insert(\"Account\", args);\n  },\n});\n\n/** Patch fields on an account. */\nexport const update = mutation({\n  args: {\n    id: v.id(\"Account\"),\n    patch: v.object({\n      userId: v.optional(v.id(\"User\")),\n      provider: v.optional(v.string()),\n      providerAccountId: v.optional(v.string()),\n      secret: v.optional(v.string()),\n      emailVerified: v.optional(v.string()),\n      phoneVerified: v.optional(v.string()),\n      extend: v.optional(v.any()),\n    }),\n  },\n  returns: v.null(),\n  handler: async (ctx, { id: accountId, patch }) => {\n    await ctx.db.patch(\"Account\", accountId, patch);\n    return null;\n  },\n});\n\n/**\n * Delete an account. When `requireOtherAccount` is set, refuses to delete the\n * user's last remaining account so they are never left with none.\n */\nconst remove = mutation({\n  args: {\n    id: v.id(\"Account\"),\n    userId: v.optional(v.id(\"User\")),\n    requireOtherAccount: v.optional(v.boolean()),\n  },\n  returns: v.null(),\n  handler: async (ctx, { id: accountId, userId, requireOtherAccount }) => {\n    const doc = await ctx.db.get(\"Account\", accountId);\n    if (doc === null || (userId !== undefined && doc.userId !== userId)) {\n      throw new ConvexError({\n        code: ErrorCode.ACCOUNT_NOT_FOUND,\n        message: \"Account not found.\",\n      });\n    }\n    if (requireOtherAccount === true) {\n      let otherFound = false;\n      for await (const sibling of ctx.db\n        .query(\"Account\")\n        .withIndex(\"user_id_provider\", (q) => q.eq(\"userId\", doc.userId))) {\n        if (sibling._id !== accountId) {\n          otherFound = true;\n          break;\n        }\n      }\n      if (!otherFound) {\n        throw new ConvexError({\n          code: ErrorCode.INVALID_PARAMETERS,\n          message: \"The provided parameters are invalid.\",\n        });\n      }\n    }\n    await ctx.db.delete(\"Account\", accountId);\n    return null;\n  },\n});\n\nexport { remove };\n"],"mappings":";;;;;;;;;;;;;;;;;AAiBA,MAAM,qBAAqB;;AAK3B,MAAa,yBAAyB,SAAS;CAC7C,MAAM;EACJ,UAAU,EAAE,QAAQ;EACpB,mBAAmB,EAAE,QAAQ;EAC7B,oBAAoB,EAAE,QAAQ;EAC9B,gBAAgB,EAAE,SAAS;EAC3B,aAAa,EAAE,SAAS;EACzB;CACD,SAAS,EAAE,MACT,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,UAAU,EAAE,CAAC,EAC1C,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,UAAU,EAAE,CAAC,EAC1C,EAAE,OAAO;EACP,QAAQ,EAAE,QAAQ,QAAQ;EAC1B,SAAS;EACT,MAAM;EACN,SAAS,EAAE,SAAS;EACrB,CAAC,CACH;CACD,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,UAAU,MAAM,IAAI,GACvB,MAAM,UAAU,CAChB,UAAU,wBAAwB,MACjC,EAAE,GAAG,YAAY,KAAK,SAAS,CAAC,GAAG,qBAAqB,KAAK,kBAAkB,CAChF,CACA,QAAQ;AACX,MAAI,YAAY,KAAM,QAAO,EAAE,QAAQ,WAAoB;EAE3D,MAAM,CAAC,MAAM,MAAM,SAAS,MAAM,QAAQ,IAAI;GAC5C,IAAI,GAAG,IAAI,QAAQ,QAAQ,OAAO;GAClC,KAAK,cACD,IAAI,GACD,MAAM,aAAa,CACnB,UAAU,qBAAqB,MAC9B,EAAE,GAAG,UAAU,QAAQ,OAAO,CAAC,GAAG,YAAY,KAAK,CACpD,CACA,OAAO,GACV,QAAQ,QAAQ,KAAK;GACzB,KAAK,iBACD,kBAAkB,KAAK;IACrB,YAAY,QAAQ;IACpB,oBAAoB,KAAK;IAC1B,CAAC,GACF,QAAQ,QAAQ;IAAE,IAAI;IAAe,YAAY;IAAW,CAAC;GAClE,CAAC;AACF,MAAI,CAAC,MAAM,GAAI,QAAO,EAAE,QAAQ,WAAoB;AACpD,MAAI,SAAS,KAAM,QAAO,EAAE,QAAQ,WAAoB;AACxD,SAAO;GACL,QAAQ;GACR;GACA;GACA,SAAS,SAAS;GACnB;;CAEJ,CAAC;;AAGF,MAAa,4BAA4B,SAAS;CAChD,MAAM;EACJ,WAAW,EAAE,GAAG,UAAU;EAC1B,cAAc,EAAE,SAAS;EACzB,gBAAgB,EAAE,SAAS;EAC3B,kBAAkB,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC;EAC7C,uBAAuB,EAAE,QAAQ;EACjC,4BAA4B,EAAE,QAAQ;EACvC;CACD,SAAS,EAAE,MACT,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,WAAW,EAAE,CAAC,EAC3C,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,QAAQ,EAAE,CAAC,EACxC,EAAE,OAAO;EACP,QAAQ,EAAE,QAAQ,WAAW;EAC7B,MAAM;EACN,WAAW,EAAE,GAAG,UAAU;EAC1B,gBAAgB,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC;EAChD,mBAAmB,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC;EAC/C,CAAC,CACH;CACD,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,UAAU,MAAM,IAAI,GAAG,IAAI,WAAW,KAAK,UAAU;AAC3D,MAAI,YAAY,KAAM,QAAO,EAAE,QAAQ,YAAqB;AAC5D,QAAM,iBAAiB,KAAK,QAAQ,IAAI;AACxC,MAAI,CAAC,KAAK,aAAc,QAAO,EAAE,QAAQ,SAAkB;EAE3D,MAAM,UAAU,MAAM,kBAAkB,KAAK;GAC3C,QAAQ,QAAQ;GAChB,kBAAkB,KAAK;GACvB,uBAAuB,KAAK;GAC5B,4BAA4B,KAAK,iBAAiB,KAAK,6BAA6B;GACrF,CAAC;AACF,MAAI,YAAY,KAAM,QAAO,EAAE,QAAQ,YAAqB;EAC5D,MAAM,SAAoC;GACxC,QAAQ;GACR,MAAM,QAAQ;GACd,WAAW,QAAQ;GACpB;AACD,MAAI,QAAQ,mBAAmB,OAAW,QAAO,iBAAiB,QAAQ;AAC1E,MAAI,QAAQ,sBAAsB,OAChC,QAAO,oBAAoB,QAAQ;AAErC,SAAO;;CAEV,CAAC;;;;;AAMF,MAAa,MAAM,MAAM;CACvB,MAAM;EACJ,IAAI,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC;EAC/B,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;EAChC,mBAAmB,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC1C;CACD,SAAS,EAAE,MAAM,aAAa,EAAE,MAAM,CAAC;CACvC,SAAS,OAAO,KAAK,SAAS;AAC5B,MAAI,KAAK,aAAa,UAAa,KAAK,sBAAsB,OAC5D,QAAO,MAAM,IAAI,GACd,MAAM,UAAU,CAChB,UAAU,wBAAwB,MACjC,EAAE,GAAG,YAAY,KAAK,SAAU,CAAC,GAAG,qBAAqB,KAAK,kBAAmB,CAClF,CACA,QAAQ;AAEb,MAAI,KAAK,OAAO,OAAW,QAAO;AAClC,SAAO,MAAM,IAAI,GAAG,IAAI,WAAW,KAAK,GAAG;;CAE9C,CAAC;;AAGF,MAAa,OAAO,MAAM;CACxB,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE;CAC9B,SAAS,EAAE,MAAM,YAAY;CAC7B,SAAS,OAAO,KAAK,EAAE,aAAa;AAClC,SAAO,MAAM,IAAI,GACd,MAAM,UAAU,CAChB,UAAU,qBAAqB,MAAM,EAAE,GAAG,UAAU,OAAO,CAAC,CAC5D,KAAK,mBAAmB;;CAE9B,CAAC;;AAGF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,QAAQ,EAAE,GAAG,OAAO;EACpB,UAAU,EAAE,QAAQ;EACpB,mBAAmB,EAAE,QAAQ;EAC7B,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC9B,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC;EAC5B;CACD,SAAS,EAAE,GAAG,UAAU;CACxB,SAAS,OAAO,KAAK,SAAS;EAQ5B,MAAM,WAAW,MAAM,IAAI,GACxB,MAAM,UAAU,CAChB,UAAU,wBAAwB,MACjC,EAAE,GAAG,YAAY,KAAK,SAAS,CAAC,GAAG,qBAAqB,KAAK,kBAAkB,CAChF,CACA,OAAO;AACV,MAAI,aAAa,MAAM;AACrB,OAAI,SAAS,WAAW,KAAK,OAI3B,OAAM,IAAI,YAAY;IACpB,MAAM,UAAU;IAChB,SAAS;IACV,CAAC;AAEJ,UAAO,SAAS;;AAElB,SAAO,MAAM,IAAI,GAAG,OAAO,WAAW,KAAK;;CAE9C,CAAC;;AAGF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,IAAI,EAAE,GAAG,UAAU;EACnB,OAAO,EAAE,OAAO;GACd,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;GAChC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;GAChC,mBAAmB,EAAE,SAAS,EAAE,QAAQ,CAAC;GACzC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;GAC9B,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC;GACrC,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC;GACrC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC;GAC5B,CAAC;EACH;CACD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,IAAI,WAAW,YAAY;AAChD,QAAM,IAAI,GAAG,MAAM,WAAW,WAAW,MAAM;AAC/C,SAAO;;CAEV,CAAC;;;;;AAMF,MAAM,SAAS,SAAS;CACtB,MAAM;EACJ,IAAI,EAAE,GAAG,UAAU;EACnB,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;EAChC,qBAAqB,EAAE,SAAS,EAAE,SAAS,CAAC;EAC7C;CACD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,IAAI,WAAW,QAAQ,0BAA0B;EACtE,MAAM,MAAM,MAAM,IAAI,GAAG,IAAI,WAAW,UAAU;AAClD,MAAI,QAAQ,QAAS,WAAW,UAAa,IAAI,WAAW,OAC1D,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS;GACV,CAAC;AAEJ,MAAI,wBAAwB,MAAM;GAChC,IAAI,aAAa;AACjB,cAAW,MAAM,WAAW,IAAI,GAC7B,MAAM,UAAU,CAChB,UAAU,qBAAqB,MAAM,EAAE,GAAG,UAAU,IAAI,OAAO,CAAC,CACjE,KAAI,QAAQ,QAAQ,WAAW;AAC7B,iBAAa;AACb;;AAGJ,OAAI,CAAC,WACH,OAAM,IAAI,YAAY;IACpB,MAAM,UAAU;IAChB,SAAS;IACV,CAAC;;AAGN,QAAM,IAAI,GAAG,OAAO,WAAW,UAAU;AACzC,SAAO;;CAEV,CAAC"}
+{"version":3,"file":"account.js","names":[],"sources":["../../src/component/account.ts"],"sourcesContent":["/**\n * `component.account.*` — provider-linked auth accounts.\n *\n * Reads collapse into one overloaded `get`; `list`\n * takes the owning `userId`.\n *\n * @module\n */\n\nimport { ConvexError, v } from \"convex/values\";\nimport { ErrorCode } from \"../shared/codes\";\n\nimport { recordSignInLimit, resetSignInLimit } from \"./limits\";\nimport { mutation, query } from \"./_generated/server\";\nimport { vAccountDoc, vUserDoc } from \"./documents\";\nimport { createSessionRows, type SessionRows, vSessionReplacement } from \"./session\";\n\n/** Maximum linked accounts returned for one user by the bounded read surface. */\nconst ACCOUNT_LIST_BATCH = 128;\n\n/** Maximum users accepted by one batched account read. */\nconst ACCOUNT_LIST_USER_BATCH = 100;\n\ntype AcceptedCredentialsSignIn = Omit<SessionRows, \"epoch\"> & { status: \"accepted\" };\n\n/** Reserve a password attempt and load all sign-in state in one transaction. */\nexport const beginCredentialsSignIn = mutation({\n  args: {\n    provider: v.string(),\n    providerAccountId: v.string(),\n    limitIdentifier: v.string(),\n    maxAttemptsPerHour: v.number(),\n    reserveAttempt: v.boolean(),\n    includeTotp: v.boolean(),\n  },\n  returns: v.union(\n    v.object({ status: v.literal(\"invalid\") }),\n    v.object({ status: v.literal(\"limited\") }),\n    v.object({\n      status: v.literal(\"ready\"),\n      account: vAccountDoc,\n      user: vUserDoc,\n      hasTotp: v.boolean(),\n    }),\n  ),\n  handler: async (ctx, args) => {\n    const limit = args.reserveAttempt\n      ? await recordSignInLimit(ctx, {\n          identifier: args.limitIdentifier,\n          maxAttemptsPerHour: args.maxAttemptsPerHour,\n        })\n      : { ok: true as const, retryAfter: undefined };\n    if (!limit.ok) return { status: \"limited\" as const };\n\n    const account = await ctx.db\n      .query(\"Account\")\n      .withIndex(\"provider_account_id\", (q) =>\n        q.eq(\"provider\", args.provider).eq(\"providerAccountId\", args.providerAccountId),\n      )\n      .unique();\n    if (account === null) return { status: \"invalid\" as const };\n\n    const [user, totp] = await Promise.all([\n      ctx.db.get(\"User\", account.userId),\n      args.includeTotp\n        ? ctx.db\n            .query(\"TotpFactor\")\n            .withIndex(\"user_id_verified\", (q) =>\n              q.eq(\"userId\", account.userId).eq(\"verified\", true),\n            )\n            .first()\n        : Promise.resolve(null),\n    ]);\n    if (user === null) return { status: \"invalid\" as const };\n    return {\n      status: \"ready\" as const,\n      account,\n      user,\n      hasTotp: totp !== null,\n    };\n  },\n});\n\n/** Refund a verified password attempt and optionally issue its session atomically. */\nexport const completeCredentialsSignIn = mutation({\n  args: {\n    accountId: v.id(\"Account\"),\n    limitIdentifier: v.string(),\n    issueSession: v.boolean(),\n    generateTokens: v.boolean(),\n    replaceSession: v.optional(vSessionReplacement),\n    sessionExpirationTime: v.number(),\n    refreshTokenExpirationTime: v.number(),\n  },\n  returns: v.union(\n    v.object({ status: v.literal(\"rejected\") }),\n    v.object({ status: v.literal(\"reset\") }),\n    v.object({\n      status: v.literal(\"accepted\"),\n      user: vUserDoc,\n      sessionId: v.id(\"Session\"),\n      sessionExpirationTime: v.number(),\n      refreshTokenId: v.optional(v.id(\"RefreshToken\")),\n      replacedSessionId: v.optional(v.id(\"Session\")),\n    }),\n  ),\n  handler: async (ctx, args) => {\n    const account = await ctx.db.get(\"Account\", args.accountId);\n    if (account === null) return { status: \"rejected\" as const };\n    await resetSignInLimit(ctx, args.limitIdentifier);\n    if (!args.issueSession) return { status: \"reset\" as const };\n\n    const created = await createSessionRows(ctx, {\n      userId: account.userId,\n      replaceSession: args.replaceSession,\n      sessionExpirationTime: args.sessionExpirationTime,\n      refreshTokenExpirationTime: args.generateTokens ? args.refreshTokenExpirationTime : undefined,\n    });\n    if (created === null) return { status: \"rejected\" as const };\n    const result: AcceptedCredentialsSignIn = {\n      status: \"accepted\" as const,\n      user: created.user,\n      sessionId: created.sessionId,\n      sessionExpirationTime: created.sessionExpirationTime,\n    };\n    if (created.refreshTokenId !== undefined) result.refreshTokenId = created.refreshTokenId;\n    if (created.replacedSessionId !== undefined) {\n      result.replacedSessionId = created.replacedSessionId;\n    }\n    return result;\n  },\n});\n\n/**\n * Read an account by id, or by `{ provider, providerAccountId }` when both\n * are given. Returns `null` when no selector matches.\n */\nexport const get = query({\n  args: {\n    id: v.optional(v.id(\"Account\")),\n    provider: v.optional(v.string()),\n    providerAccountId: v.optional(v.string()),\n  },\n  returns: v.union(vAccountDoc, v.null()),\n  handler: async (ctx, args) => {\n    if (args.provider !== undefined && args.providerAccountId !== undefined) {\n      return await ctx.db\n        .query(\"Account\")\n        .withIndex(\"provider_account_id\", (q) =>\n          q.eq(\"provider\", args.provider!).eq(\"providerAccountId\", args.providerAccountId!),\n        )\n        .unique();\n    }\n    if (args.id === undefined) return null;\n    return await ctx.db.get(\"Account\", args.id);\n  },\n});\n\n/**\n * List the accounts owned by one user, or by a bounded batch of users.\n *\n * The batch form serves one component crossing for app-owned user lists. The\n * public server facade projects these raw records into safe capability\n * summaries before exposing them to application code.\n */\nexport const list = query({\n  args: {\n    userId: v.optional(v.id(\"User\")),\n    userIds: v.optional(v.array(v.id(\"User\"))),\n    provider: v.optional(v.string()),\n  },\n  returns: v.array(vAccountDoc),\n  handler: async (ctx, args) => {\n    const userIds = args.userId === undefined ? (args.userIds ?? []) : [args.userId];\n    const uniqueUserIds = Array.from(new Set(userIds));\n    const provider = args.provider;\n    if (uniqueUserIds.length > ACCOUNT_LIST_USER_BATCH) {\n      throw new ConvexError({\n        code: ErrorCode.INVALID_PARAMETERS,\n        message: `At most ${ACCOUNT_LIST_USER_BATCH} users can be read at once.`,\n      });\n    }\n    const accounts = await Promise.all(\n      uniqueUserIds.map(async (userId) =>\n        provider === undefined\n          ? await ctx.db\n              .query(\"Account\")\n              .withIndex(\"user_id_provider\", (q) => q.eq(\"userId\", userId))\n              .take(ACCOUNT_LIST_BATCH)\n          : await ctx.db\n              .query(\"Account\")\n              .withIndex(\"user_id_provider\", (q) => q.eq(\"userId\", userId).eq(\"provider\", provider))\n              .take(ACCOUNT_LIST_BATCH),\n      ),\n    );\n    return accounts.flat();\n  },\n});\n\n/** Insert a new account. */\nexport const create = mutation({\n  args: {\n    userId: v.id(\"User\"),\n    provider: v.string(),\n    providerAccountId: v.string(),\n    secret: v.optional(v.string()),\n    extend: v.optional(v.any()),\n  },\n  returns: v.id(\"Account\"),\n  handler: async (ctx, args) => {\n    // Dedup on the (provider, providerAccountId) identity. A bare insert let two\n    // concurrent or retried provisioning ceremonies — SCIM POST retries, a\n    // passkey double-submit — create duplicate Account rows, which then made\n    // `account.get(...).unique()` throw on every future lookup (a permanent\n    // sign-in lockout / rogue credential attribution). The index-range read plus\n    // insert in this single mutation is OCC-atomic: a racing insert into the same\n    // range conflicts and retries, then observes the winner's row below.\n    const existing = await ctx.db\n      .query(\"Account\")\n      .withIndex(\"provider_account_id\", (q) =>\n        q.eq(\"provider\", args.provider).eq(\"providerAccountId\", args.providerAccountId),\n      )\n      .first();\n    if (existing !== null) {\n      if (existing.userId !== args.userId) {\n        // Already linked to a different user — reject rather than silently\n        // attribute the identity (e.g. an attacker registering a passkey\n        // credentialId that already belongs to a victim).\n        throw new ConvexError({\n          code: ErrorCode.ACCOUNT_ALREADY_LINKED,\n          message: \"This account is already linked to another user.\",\n        });\n      }\n      return existing._id;\n    }\n    return await ctx.db.insert(\"Account\", args);\n  },\n});\n\n/** Patch fields on an account. */\nexport const update = mutation({\n  args: {\n    id: v.id(\"Account\"),\n    patch: v.object({\n      userId: v.optional(v.id(\"User\")),\n      provider: v.optional(v.string()),\n      providerAccountId: v.optional(v.string()),\n      secret: v.optional(v.string()),\n      emailVerified: v.optional(v.string()),\n      phoneVerified: v.optional(v.string()),\n      extend: v.optional(v.any()),\n    }),\n  },\n  returns: v.null(),\n  handler: async (ctx, { id: accountId, patch }) => {\n    await ctx.db.patch(\"Account\", accountId, patch);\n    return null;\n  },\n});\n\n/**\n * Delete an account. When `requireOtherAccount` is set, refuses to delete the\n * user's last remaining account so they are never left with none.\n */\nconst remove = mutation({\n  args: {\n    id: v.id(\"Account\"),\n    userId: v.optional(v.id(\"User\")),\n    requireOtherAccount: v.optional(v.boolean()),\n  },\n  returns: v.null(),\n  handler: async (ctx, { id: accountId, userId, requireOtherAccount }) => {\n    const doc = await ctx.db.get(\"Account\", accountId);\n    if (doc === null || (userId !== undefined && doc.userId !== userId)) {\n      throw new ConvexError({\n        code: ErrorCode.ACCOUNT_NOT_FOUND,\n        message: \"Account not found.\",\n      });\n    }\n    if (requireOtherAccount === true) {\n      let otherFound = false;\n      for await (const sibling of ctx.db\n        .query(\"Account\")\n        .withIndex(\"user_id_provider\", (q) => q.eq(\"userId\", doc.userId))) {\n        if (sibling._id !== accountId) {\n          otherFound = true;\n          break;\n        }\n      }\n      if (!otherFound) {\n        throw new ConvexError({\n          code: ErrorCode.INVALID_PARAMETERS,\n          message: \"The provided parameters are invalid.\",\n        });\n      }\n    }\n    await ctx.db.delete(\"Account\", accountId);\n    return null;\n  },\n});\n\nexport { remove };\n"],"mappings":";;;;;;;;;;;;;;;;;AAkBA,MAAM,qBAAqB;;AAG3B,MAAM,0BAA0B;;AAKhC,MAAa,yBAAyB,SAAS;CAC7C,MAAM;EACJ,UAAU,EAAE,QAAQ;EACpB,mBAAmB,EAAE,QAAQ;EAC7B,iBAAiB,EAAE,QAAQ;EAC3B,oBAAoB,EAAE,QAAQ;EAC9B,gBAAgB,EAAE,SAAS;EAC3B,aAAa,EAAE,SAAS;EACzB;CACD,SAAS,EAAE,MACT,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,UAAU,EAAE,CAAC,EAC1C,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,UAAU,EAAE,CAAC,EAC1C,EAAE,OAAO;EACP,QAAQ,EAAE,QAAQ,QAAQ;EAC1B,SAAS;EACT,MAAM;EACN,SAAS,EAAE,SAAS;EACrB,CAAC,CACH;CACD,SAAS,OAAO,KAAK,SAAS;AAO5B,MAAI,EANU,KAAK,iBACf,MAAM,kBAAkB,KAAK;GAC3B,YAAY,KAAK;GACjB,oBAAoB,KAAK;GAC1B,CAAC,GACF;GAAE,IAAI;GAAe,YAAY;GAAW,EACrC,GAAI,QAAO,EAAE,QAAQ,WAAoB;EAEpD,MAAM,UAAU,MAAM,IAAI,GACvB,MAAM,UAAU,CAChB,UAAU,wBAAwB,MACjC,EAAE,GAAG,YAAY,KAAK,SAAS,CAAC,GAAG,qBAAqB,KAAK,kBAAkB,CAChF,CACA,QAAQ;AACX,MAAI,YAAY,KAAM,QAAO,EAAE,QAAQ,WAAoB;EAE3D,MAAM,CAAC,MAAM,QAAQ,MAAM,QAAQ,IAAI,CACrC,IAAI,GAAG,IAAI,QAAQ,QAAQ,OAAO,EAClC,KAAK,cACD,IAAI,GACD,MAAM,aAAa,CACnB,UAAU,qBAAqB,MAC9B,EAAE,GAAG,UAAU,QAAQ,OAAO,CAAC,GAAG,YAAY,KAAK,CACpD,CACA,OAAO,GACV,QAAQ,QAAQ,KAAK,CAC1B,CAAC;AACF,MAAI,SAAS,KAAM,QAAO,EAAE,QAAQ,WAAoB;AACxD,SAAO;GACL,QAAQ;GACR;GACA;GACA,SAAS,SAAS;GACnB;;CAEJ,CAAC;;AAGF,MAAa,4BAA4B,SAAS;CAChD,MAAM;EACJ,WAAW,EAAE,GAAG,UAAU;EAC1B,iBAAiB,EAAE,QAAQ;EAC3B,cAAc,EAAE,SAAS;EACzB,gBAAgB,EAAE,SAAS;EAC3B,gBAAgB,EAAE,SAAS,oBAAoB;EAC/C,uBAAuB,EAAE,QAAQ;EACjC,4BAA4B,EAAE,QAAQ;EACvC;CACD,SAAS,EAAE,MACT,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,WAAW,EAAE,CAAC,EAC3C,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,QAAQ,EAAE,CAAC,EACxC,EAAE,OAAO;EACP,QAAQ,EAAE,QAAQ,WAAW;EAC7B,MAAM;EACN,WAAW,EAAE,GAAG,UAAU;EAC1B,uBAAuB,EAAE,QAAQ;EACjC,gBAAgB,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC;EAChD,mBAAmB,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC;EAC/C,CAAC,CACH;CACD,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,UAAU,MAAM,IAAI,GAAG,IAAI,WAAW,KAAK,UAAU;AAC3D,MAAI,YAAY,KAAM,QAAO,EAAE,QAAQ,YAAqB;AAC5D,QAAM,iBAAiB,KAAK,KAAK,gBAAgB;AACjD,MAAI,CAAC,KAAK,aAAc,QAAO,EAAE,QAAQ,SAAkB;EAE3D,MAAM,UAAU,MAAM,kBAAkB,KAAK;GAC3C,QAAQ,QAAQ;GAChB,gBAAgB,KAAK;GACrB,uBAAuB,KAAK;GAC5B,4BAA4B,KAAK,iBAAiB,KAAK,6BAA6B;GACrF,CAAC;AACF,MAAI,YAAY,KAAM,QAAO,EAAE,QAAQ,YAAqB;EAC5D,MAAM,SAAoC;GACxC,QAAQ;GACR,MAAM,QAAQ;GACd,WAAW,QAAQ;GACnB,uBAAuB,QAAQ;GAChC;AACD,MAAI,QAAQ,mBAAmB,OAAW,QAAO,iBAAiB,QAAQ;AAC1E,MAAI,QAAQ,sBAAsB,OAChC,QAAO,oBAAoB,QAAQ;AAErC,SAAO;;CAEV,CAAC;;;;;AAMF,MAAa,MAAM,MAAM;CACvB,MAAM;EACJ,IAAI,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC;EAC/B,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;EAChC,mBAAmB,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC1C;CACD,SAAS,EAAE,MAAM,aAAa,EAAE,MAAM,CAAC;CACvC,SAAS,OAAO,KAAK,SAAS;AAC5B,MAAI,KAAK,aAAa,UAAa,KAAK,sBAAsB,OAC5D,QAAO,MAAM,IAAI,GACd,MAAM,UAAU,CAChB,UAAU,wBAAwB,MACjC,EAAE,GAAG,YAAY,KAAK,SAAU,CAAC,GAAG,qBAAqB,KAAK,kBAAmB,CAClF,CACA,QAAQ;AAEb,MAAI,KAAK,OAAO,OAAW,QAAO;AAClC,SAAO,MAAM,IAAI,GAAG,IAAI,WAAW,KAAK,GAAG;;CAE9C,CAAC;;;;;;;;AASF,MAAa,OAAO,MAAM;CACxB,MAAM;EACJ,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;EAChC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC;EAC1C,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;EACjC;CACD,SAAS,EAAE,MAAM,YAAY;CAC7B,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,UAAU,KAAK,WAAW,SAAa,KAAK,WAAW,EAAE,GAAI,CAAC,KAAK,OAAO;EAChF,MAAM,gBAAgB,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC;EAClD,MAAM,WAAW,KAAK;AACtB,MAAI,cAAc,SAAS,wBACzB,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS,WAAW,wBAAwB;GAC7C,CAAC;AAeJ,UAbiB,MAAM,QAAQ,IAC7B,cAAc,IAAI,OAAO,WACvB,aAAa,SACT,MAAM,IAAI,GACP,MAAM,UAAU,CAChB,UAAU,qBAAqB,MAAM,EAAE,GAAG,UAAU,OAAO,CAAC,CAC5D,KAAK,mBAAmB,GAC3B,MAAM,IAAI,GACP,MAAM,UAAU,CAChB,UAAU,qBAAqB,MAAM,EAAE,GAAG,UAAU,OAAO,CAAC,GAAG,YAAY,SAAS,CAAC,CACrF,KAAK,mBAAmB,CAChC,CACF,EACe,MAAM;;CAEzB,CAAC;;AAGF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,QAAQ,EAAE,GAAG,OAAO;EACpB,UAAU,EAAE,QAAQ;EACpB,mBAAmB,EAAE,QAAQ;EAC7B,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC9B,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC;EAC5B;CACD,SAAS,EAAE,GAAG,UAAU;CACxB,SAAS,OAAO,KAAK,SAAS;EAQ5B,MAAM,WAAW,MAAM,IAAI,GACxB,MAAM,UAAU,CAChB,UAAU,wBAAwB,MACjC,EAAE,GAAG,YAAY,KAAK,SAAS,CAAC,GAAG,qBAAqB,KAAK,kBAAkB,CAChF,CACA,OAAO;AACV,MAAI,aAAa,MAAM;AACrB,OAAI,SAAS,WAAW,KAAK,OAI3B,OAAM,IAAI,YAAY;IACpB,MAAM,UAAU;IAChB,SAAS;IACV,CAAC;AAEJ,UAAO,SAAS;;AAElB,SAAO,MAAM,IAAI,GAAG,OAAO,WAAW,KAAK;;CAE9C,CAAC;;AAGF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,IAAI,EAAE,GAAG,UAAU;EACnB,OAAO,EAAE,OAAO;GACd,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;GAChC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;GAChC,mBAAmB,EAAE,SAAS,EAAE,QAAQ,CAAC;GACzC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;GAC9B,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC;GACrC,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC;GACrC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC;GAC5B,CAAC;EACH;CACD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,IAAI,WAAW,YAAY;AAChD,QAAM,IAAI,GAAG,MAAM,WAAW,WAAW,MAAM;AAC/C,SAAO;;CAEV,CAAC;;;;;AAMF,MAAM,SAAS,SAAS;CACtB,MAAM;EACJ,IAAI,EAAE,GAAG,UAAU;EACnB,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;EAChC,qBAAqB,EAAE,SAAS,EAAE,SAAS,CAAC;EAC7C;CACD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,IAAI,WAAW,QAAQ,0BAA0B;EACtE,MAAM,MAAM,MAAM,IAAI,GAAG,IAAI,WAAW,UAAU;AAClD,MAAI,QAAQ,QAAS,WAAW,UAAa,IAAI,WAAW,OAC1D,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS;GACV,CAAC;AAEJ,MAAI,wBAAwB,MAAM;GAChC,IAAI,aAAa;AACjB,cAAW,MAAM,WAAW,IAAI,GAC7B,MAAM,UAAU,CAChB,UAAU,qBAAqB,MAAM,EAAE,GAAG,UAAU,IAAI,OAAO,CAAC,CACjE,KAAI,QAAQ,QAAQ,WAAW;AAC7B,iBAAa;AACb;;AAGJ,OAAI,CAAC,WACH,OAAM,IAAI,YAAY;IACpB,MAAM,UAAU;IAChB,SAAS;IACV,CAAC;;AAGN,QAAM,IAAI,GAAG,OAAO,WAAW,UAAU;AACzC,SAAO;;CAEV,CAAC"}

package/dist/component/batch.d.ts

@@ -0,0 +1,3 @@
+//#endregion
+export { batch_d_exports };
+//# sourceMappingURL=batch.d.ts.map

package/dist/component/batch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"batch.d.ts","names":[],"sources":["../../src/component/batch.ts"],"mappings":""}

package/dist/component/batch.js

@@ -0,0 +1,17 @@
+import { ErrorCode } from "../shared/codes.js";
+import { ConvexError } from "convex/values";
+
+//#region src/component/batch.ts
+/** Maximum IDs accepted by a single batched component read. @internal */
+const MAX_BATCH_SELECTOR_SIZE = 100;
+/** @internal Reject an oversized batch before it can start database work. */
+function assertBatchSelectorSize(ids, selector) {
+	if (ids.length > MAX_BATCH_SELECTOR_SIZE) throw new ConvexError({
+		code: ErrorCode.INVALID_PARAMETERS,
+		message: `Batch selector "${selector}" accepts at most ${MAX_BATCH_SELECTOR_SIZE} IDs.`
+	});
+}
+
+//#endregion
+export { assertBatchSelectorSize };
+//# sourceMappingURL=batch.js.map

package/dist/component/batch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"batch.js","names":[],"sources":["../../src/component/batch.ts"],"sourcesContent":["import { ConvexError } from \"convex/values\";\n\nimport { ErrorCode } from \"../shared/codes\";\n\n/** Maximum IDs accepted by a single batched component read. @internal */\nexport const MAX_BATCH_SELECTOR_SIZE = 100;\n\n/** @internal Reject an oversized batch before it can start database work. */\nexport function assertBatchSelectorSize(ids: readonly unknown[], selector: string) {\n  if (ids.length > MAX_BATCH_SELECTOR_SIZE) {\n    throw new ConvexError({\n      code: ErrorCode.INVALID_PARAMETERS,\n      message: `Batch selector \"${selector}\" accepts at most ${MAX_BATCH_SELECTOR_SIZE} IDs.`,\n    });\n  }\n}\n"],"mappings":";;;;;AAKA,MAAa,0BAA0B;;AAGvC,SAAgB,wBAAwB,KAAyB,UAAkB;AACjF,KAAI,IAAI,SAAS,wBACf,OAAM,IAAI,YAAY;EACpB,MAAM,UAAU;EAChB,SAAS,mBAAmB,SAAS,oBAAoB,wBAAwB;EAClF,CAAC"}

package/dist/component/connection/audit.d.ts

@@ -1,5 +1,5 @@
-import * as convex_values2852 from "convex/values";
-import * as convex_server207 from "convex/server";
+import * as convex_values1894 from "convex/values";
+import * as convex_server186 from "convex/server";
 
 //#region src/component/connection/audit.d.ts
 declare namespace audit_d_exports {
@@ -16,9 +16,7 @@ declare namespace audit_d_exports {
  * an allowlist). Requires exactly one of `connectionId` or `groupId` — passing
  * neither throws rather than scanning the entire audit log.
  */
-declare const list: convex_server207.RegisteredQuery<"public", {
-  connectionId?: convex_values2852.GenericId<"GroupConnection"> | undefined;
-  groupId?: convex_values2852.GenericId<"Group"> | undefined;
+declare const list: convex_server186.RegisteredQuery<"public", {
   paginationOpts: {
     id?: number;
     endCursor?: string | null;
@@ -27,19 +25,24 @@ declare const list: convex_server207.RegisteredQuery<"public", {
     numItems: number;
     cursor: string | null;
   };
+  scope: {
+    connectionId: convex_values1894.GenericId<"GroupConnection">;
+  } | {
+    groupId: convex_values1894.GenericId<"Group">;
+  };
 }, Promise<{
   page: {
-    _id: convex_values2852.GenericId<"AuthEventProjection">;
+    _id: convex_values1894.GenericId<"AuthEventProjection">;
     _creationTime: number;
     eventId: string;
-    targetKind: "user" | "connection" | "group" | "session" | "api_key" | "oauth_client" | "global";
+    targetKind: "user" | "group" | "session" | "api_key" | "connection" | "oauth_client" | "global";
     targetId: string;
     kind: "user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed";
-    category: "email" | "phone" | "password" | "oauth" | "scim" | "user" | "connection" | "session" | "account" | "passkey" | "totp" | "api_key" | "webhook" | "security";
+    category: "user" | "session" | "account" | "password" | "passkey" | "totp" | "email" | "phone" | "api_key" | "oauth" | "connection" | "scim" | "webhook" | "security";
     occurredAt: number;
-    actorType: "scim" | "user" | "api_key" | "webhook" | "oauth_client" | "system" | "anonymous";
+    actorType: "user" | "api_key" | "scim" | "webhook" | "system" | "oauth_client" | "anonymous";
     actorId: string | undefined;
-    subjectType: "email" | "phone" | "user" | "connection" | "group" | "session" | "account" | "passkey" | "totp" | "api_key" | "oauth_client" | "system" | "oauth_code" | "scim_identity" | "webhook_endpoint" | "webhook_delivery";
+    subjectType: "user" | "group" | "session" | "account" | "passkey" | "totp" | "email" | "phone" | "api_key" | "connection" | "system" | "oauth_client" | "oauth_code" | "scim_identity" | "webhook_endpoint" | "webhook_delivery";
     subjectId: string | undefined;
     outcome: "success" | "failure";
     errorCode: string | undefined;
@@ -60,24 +63,24 @@ declare const list: convex_server207.RegisteredQuery<"public", {
       refreshTokenId?: string | undefined;
       flow?: "reset" | "change" | undefined;
     } | {
-      accountId?: string | undefined;
       provider?: string | undefined;
       providerAccountId?: string | undefined;
+      accountId?: string | undefined;
     } | {
-      name?: string | undefined;
-      credentialId?: string | undefined;
       reason?: string | undefined;
       passkeyId?: string | undefined;
+      credentialId?: string | undefined;
       totpId?: string | undefined;
       keyId?: string | undefined;
+      name?: string | undefined;
       prefix?: string | undefined;
     } | {
+      userId?: string | undefined;
       email?: string | undefined;
       phone?: string | undefined;
-      userId?: string | undefined;
     } | {
-      name?: string | undefined;
       userId?: string | undefined;
+      name?: string | undefined;
       clientId?: string | undefined;
       codeId?: string | undefined;
       scopes?: string[] | undefined;
@@ -86,15 +89,14 @@ declare const list: convex_server207.RegisteredQuery<"public", {
       resource?: string | undefined;
     } | {
       userId?: string | undefined;
+      errorCode?: string | undefined;
       connectionId?: string | undefined;
-      verifiedAt?: number | undefined;
-      expiresAt?: number | undefined;
-      version?: number | undefined;
+      changed?: string[] | undefined;
       protocol?: "oidc" | "saml" | undefined;
       domain?: string | undefined;
       recordName?: string | undefined;
-      errorCode?: string | undefined;
-      changed?: string[] | undefined;
+      expiresAt?: number | undefined;
+      verifiedAt?: number | undefined;
       metadataUrl?: string | undefined;
       domains?: string[] | undefined;
       issuer?: string | undefined;
@@ -102,28 +104,29 @@ declare const list: convex_server207.RegisteredQuery<"public", {
       jwksUri?: string | undefined;
       audience?: string | string[] | undefined;
       tokenEndpointAuthMethod?: string | undefined;
+      version?: number | undefined;
     } | {
       userId?: string | undefined;
+      scimConfigId?: string | undefined;
+      resourceType?: "user" | "group" | undefined;
+      resourceId?: string | undefined;
       operation?: string | undefined;
       externalId?: string | undefined;
-      groupId?: string | undefined;
       active?: boolean | undefined;
-      resourceType?: "user" | "group" | undefined;
-      scimConfigId?: string | undefined;
-      resourceId?: string | undefined;
+      groupId?: string | undefined;
     } | {
-      status?: number | undefined;
       endpointId?: string | undefined;
       deliveryId?: string | undefined;
       sourceEventId?: string | undefined;
       sourceEventType?: "user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed" | undefined;
       attemptCount?: number | undefined;
+      status?: number | undefined;
       error?: string | undefined;
     } | undefined;
   }[];
   isDone: boolean;
-  continueCursor: convex_server207.Cursor;
-  splitCursor?: convex_server207.Cursor | null;
+  continueCursor: convex_server186.Cursor;
+  splitCursor?: convex_server186.Cursor | null;
   pageStatus?: "SplitRecommended" | "SplitRequired" | null;
 }>>;
 //#endregion

package/dist/component/connection/audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.d.ts","names":[],"sources":["../../../src/component/connection/audit.ts"],"mappings":";;;;;;;;;;;;;AA+GA;;;;;cAAa,IAAA,mBAAI,eAAA;iBAkCf,iBAAA,CAAA,SAAA"}
+{"version":3,"file":"audit.d.ts","names":[],"sources":["../../../src/component/connection/audit.ts"],"mappings":";;;;;;;;;;;;;AA8GA;;;;;cAAa,IAAA,mBAAI,eAAA;;;;;;;;;;kBA6Bf,iBAAA,CAAA,SAAA;EAAA"}

package/dist/component/connection/audit.js

@@ -1,9 +1,9 @@
-import { ErrorCode } from "../../shared/codes.js";
-import { vAuthEventProjectionDoc, vPaginated } from "../model.js";
+import { EVENT_KIND_CATEGORY } from "../../shared/event/kinds.js";
+import { vPaginated } from "../model.js";
 import schema_default from "../schema.js";
 import { query } from "../_generated/server.js";
-import "../functions.js";
-import { ConvexError, v } from "convex/values";
+import { vAuthEventProjectionDoc } from "../documents.js";
+import { v } from "convex/values";
 import { paginationOptsValidator } from "convex/server";
 import { paginator } from "convex-helpers/server/pagination";
 
@@ -83,7 +83,7 @@ const PUBLIC_DATA_KEYS = {
 };
 function publicData(kind, value) {
 	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
-	const keys = PUBLIC_DATA_KEYS[kind.startsWith("api_key.") ? "api_key" : kind.slice(0, kind.indexOf("."))] ?? [];
+	const keys = PUBLIC_DATA_KEYS[EVENT_KIND_CATEGORY[kind]] ?? [];
 	const source = value;
 	const redacted = {};
 	for (const key of keys) {
@@ -121,30 +121,23 @@ function publicProjection(doc) {
 */
 const list = query({
 	args: {
-		connectionId: v.optional(v.id("GroupConnection")),
-		groupId: v.optional(v.id("Group")),
+		scope: v.union(v.object({ connectionId: schema_default.id("GroupConnection") }), v.object({ groupId: schema_default.id("Group") })),
 		paginationOpts: paginationOptsValidator
 	},
 	returns: vPaginated(vAuthEventProjectionDoc),
-	handler: async (ctx, args) => {
-		if (args.connectionId !== void 0) {
-			const result = await paginator(ctx.db, schema_default).query("AuthEventProjection").withIndex("target_time", (idx) => idx.eq("targetKind", "connection").eq("targetId", args.connectionId)).order("desc").paginate(args.paginationOpts);
+	handler: async (ctx, { scope, paginationOpts }) => {
+		if ("connectionId" in scope) {
+			const result$1 = await paginator(ctx.db, schema_default).query("AuthEventProjection").withIndex("target_time", (idx) => idx.eq("targetKind", "connection").eq("targetId", scope.connectionId)).order("desc").paginate(paginationOpts);
 			return {
-				...result,
-				page: result.page.map(publicProjection)
+				...result$1,
+				page: result$1.page.map(publicProjection)
 			};
 		}
-		if (args.groupId !== void 0) {
-			const result = await paginator(ctx.db, schema_default).query("AuthEventProjection").withIndex("target_time", (idx) => idx.eq("targetKind", "group").eq("targetId", args.groupId)).order("desc").paginate(args.paginationOpts);
-			return {
-				...result,
-				page: result.page.map(publicProjection)
-			};
-		}
-		throw new ConvexError({
-			code: ErrorCode.INVALID_PARAMETERS,
-			message: "connection.audit.list requires either `connectionId` or `groupId` to target the query. Passing neither would walk the entire audit log."
-		});
+		const result = await paginator(ctx.db, schema_default).query("AuthEventProjection").withIndex("target_time", (idx) => idx.eq("targetKind", "group").eq("targetId", scope.groupId)).order("desc").paginate(paginationOpts);
+		return {
+			...result,
+			page: result.page.map(publicProjection)
+		};
 	}
 });
 

package/dist/component/connection/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","names":["schema"],"sources":["../../../src/component/connection/audit.ts"],"sourcesContent":["/**\n * `component.connection.audit.*` - Connection audit projections backed by auth events.\n *\n * @module\n */\n\nimport { paginationOptsValidator } from \"convex/server\";\nimport { paginator } from \"convex-helpers/server/pagination\";\nimport { ConvexError, v, type Infer } from \"convex/values\";\n\nimport { ErrorCode } from \"../../shared/codes\";\nimport type { Doc } from \"../_generated/dataModel\";\nimport { query } from \"../functions\";\nimport { vAuthEventData, vAuthEventProjectionDoc, vPaginated } from \"../model\";\nimport schema from \"../schema\";\n\nconst PUBLIC_DATA_KEYS = {\n  user: [\"type\", \"provider\", \"existingUserId\"],\n  session: [\"provider\", \"method\", \"reason\"],\n  account: [\"provider\", \"accountId\"],\n  password: [\"userId\"],\n  passkey: [\"passkeyId\"],\n  totp: [\"totpId\"],\n  email: [\"userId\"],\n  phone: [\"userId\"],\n  api_key: [\"keyId\", \"name\", \"prefix\", \"reason\"],\n  oauth: [\"clientId\", \"codeId\", \"scopes\", \"grantType\", \"resource\"],\n  connection: [\n    \"connectionId\",\n    \"protocol\",\n    \"domain\",\n    \"recordName\",\n    \"expiresAt\",\n    \"verifiedAt\",\n    \"metadataUrl\",\n    \"domains\",\n    \"version\",\n    \"errorCode\",\n    \"issuer\",\n    \"discoveryUrl\",\n    \"jwksUri\",\n    \"audience\",\n    \"tokenEndpointAuthMethod\",\n  ],\n  scim: [\n    \"scimConfigId\",\n    \"resourceType\",\n    \"resourceId\",\n    \"operation\",\n    \"externalId\",\n    \"active\",\n    \"groupId\",\n    \"userId\",\n  ],\n  webhook: [\n    \"endpointId\",\n    \"deliveryId\",\n    \"sourceEventId\",\n    \"sourceEventType\",\n    \"attemptCount\",\n    \"status\",\n    \"error\",\n  ],\n  security: [\"reason\", \"errorCode\"],\n} as const;\n\nfunction publicData(kind: string, value: unknown): Infer<typeof vAuthEventData> | undefined {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) return undefined;\n  const category = kind.startsWith(\"api_key.\")\n    ? \"api_key\"\n    : (kind.slice(0, kind.indexOf(\".\")) as keyof typeof PUBLIC_DATA_KEYS);\n  const keys = PUBLIC_DATA_KEYS[category] ?? [];\n  const source = value as Record<string, unknown>;\n  const redacted: Record<string, unknown> = {};\n  for (const key of keys) {\n    const nested = source[key];\n    if (nested !== undefined) redacted[key] = nested;\n  }\n  return Object.keys(redacted).length === 0\n    ? undefined\n    : (redacted as Infer<typeof vAuthEventData>);\n}\n\nfunction publicProjection(doc: Doc<\"AuthEventProjection\">) {\n  return {\n    _id: doc._id,\n    _creationTime: doc._creationTime,\n    eventId: doc.eventId,\n    targetKind: doc.targetKind,\n    targetId: doc.targetId,\n    kind: doc.kind,\n    category: doc.category,\n    occurredAt: doc.occurredAt,\n    actorType: doc.actorType,\n    actorId: doc.actorId,\n    subjectType: doc.subjectType,\n    subjectId: doc.subjectId,\n    outcome: doc.outcome,\n    errorCode: doc.errorCode,\n    requestId: doc.requestId,\n    ip: undefined,\n    data: publicData(doc.kind, doc.data),\n  };\n}\n\n/**\n * List audit-event projections for a connection or a group, newest first and\n * paginated. Rows are redacted to public fields (IP dropped, `data` narrowed to\n * an allowlist). Requires exactly one of `connectionId` or `groupId` — passing\n * neither throws rather than scanning the entire audit log.\n */\nexport const list = query({\n  args: {\n    connectionId: v.optional(v.id(\"GroupConnection\")),\n    groupId: v.optional(v.id(\"Group\")),\n    paginationOpts: paginationOptsValidator,\n  },\n  returns: vPaginated(vAuthEventProjectionDoc),\n  handler: async (ctx, args) => {\n    if (args.connectionId !== undefined) {\n      const result = await paginator(ctx.db, schema)\n        .query(\"AuthEventProjection\")\n        .withIndex(\"target_time\", (idx) =>\n          idx.eq(\"targetKind\", \"connection\").eq(\"targetId\", args.connectionId!),\n        )\n        .order(\"desc\")\n        .paginate(args.paginationOpts);\n      return { ...result, page: result.page.map(publicProjection) };\n    }\n    if (args.groupId !== undefined) {\n      const result = await paginator(ctx.db, schema)\n        .query(\"AuthEventProjection\")\n        .withIndex(\"target_time\", (idx) =>\n          idx.eq(\"targetKind\", \"group\").eq(\"targetId\", args.groupId!),\n        )\n        .order(\"desc\")\n        .paginate(args.paginationOpts);\n      return { ...result, page: result.page.map(publicProjection) };\n    }\n    throw new ConvexError({\n      code: ErrorCode.INVALID_PARAMETERS,\n      message:\n        \"connection.audit.list requires either `connectionId` or `groupId` to target the query. Passing neither would walk the entire audit log.\",\n    });\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;AAgBA,MAAM,mBAAmB;CACvB,MAAM;EAAC;EAAQ;EAAY;EAAiB;CAC5C,SAAS;EAAC;EAAY;EAAU;EAAS;CACzC,SAAS,CAAC,YAAY,YAAY;CAClC,UAAU,CAAC,SAAS;CACpB,SAAS,CAAC,YAAY;CACtB,MAAM,CAAC,SAAS;CAChB,OAAO,CAAC,SAAS;CACjB,OAAO,CAAC,SAAS;CACjB,SAAS;EAAC;EAAS;EAAQ;EAAU;EAAS;CAC9C,OAAO;EAAC;EAAY;EAAU;EAAU;EAAa;EAAW;CAChE,YAAY;EACV;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD;CACD,MAAM;EACJ;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD;CACD,SAAS;EACP;EACA;EACA;EACA;EACA;EACA;EACA;EACD;CACD,UAAU,CAAC,UAAU,YAAY;CAClC;AAED,SAAS,WAAW,MAAc,OAA0D;AAC1F,KAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,MAAM,CAAE,QAAO;CAIhF,MAAM,OAAO,iBAHI,KAAK,WAAW,WAAW,GACxC,YACC,KAAK,MAAM,GAAG,KAAK,QAAQ,IAAI,CAAC,KACM,EAAE;CAC7C,MAAM,SAAS;CACf,MAAM,WAAoC,EAAE;AAC5C,MAAK,MAAM,OAAO,MAAM;EACtB,MAAM,SAAS,OAAO;AACtB,MAAI,WAAW,OAAW,UAAS,OAAO;;AAE5C,QAAO,OAAO,KAAK,SAAS,CAAC,WAAW,IACpC,SACC;;AAGP,SAAS,iBAAiB,KAAiC;AACzD,QAAO;EACL,KAAK,IAAI;EACT,eAAe,IAAI;EACnB,SAAS,IAAI;EACb,YAAY,IAAI;EAChB,UAAU,IAAI;EACd,MAAM,IAAI;EACV,UAAU,IAAI;EACd,YAAY,IAAI;EAChB,WAAW,IAAI;EACf,SAAS,IAAI;EACb,aAAa,IAAI;EACjB,WAAW,IAAI;EACf,SAAS,IAAI;EACb,WAAW,IAAI;EACf,WAAW,IAAI;EACf,IAAI;EACJ,MAAM,WAAW,IAAI,MAAM,IAAI,KAAK;EACrC;;;;;;;;AASH,MAAa,OAAO,MAAM;CACxB,MAAM;EACJ,cAAc,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC;EACjD,SAAS,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;EAClC,gBAAgB;EACjB;CACD,SAAS,WAAW,wBAAwB;CAC5C,SAAS,OAAO,KAAK,SAAS;AAC5B,MAAI,KAAK,iBAAiB,QAAW;GACnC,MAAM,SAAS,MAAM,UAAU,IAAI,IAAIA,eAAO,CAC3C,MAAM,sBAAsB,CAC5B,UAAU,gBAAgB,QACzB,IAAI,GAAG,cAAc,aAAa,CAAC,GAAG,YAAY,KAAK,aAAc,CACtE,CACA,MAAM,OAAO,CACb,SAAS,KAAK,eAAe;AAChC,UAAO;IAAE,GAAG;IAAQ,MAAM,OAAO,KAAK,IAAI,iBAAiB;IAAE;;AAE/D,MAAI,KAAK,YAAY,QAAW;GAC9B,MAAM,SAAS,MAAM,UAAU,IAAI,IAAIA,eAAO,CAC3C,MAAM,sBAAsB,CAC5B,UAAU,gBAAgB,QACzB,IAAI,GAAG,cAAc,QAAQ,CAAC,GAAG,YAAY,KAAK,QAAS,CAC5D,CACA,MAAM,OAAO,CACb,SAAS,KAAK,eAAe;AAChC,UAAO;IAAE,GAAG;IAAQ,MAAM,OAAO,KAAK,IAAI,iBAAiB;IAAE;;AAE/D,QAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SACE;GACH,CAAC;;CAEL,CAAC"}
+{"version":3,"file":"audit.js","names":["schema","result"],"sources":["../../../src/component/connection/audit.ts"],"sourcesContent":["/**\n * `component.connection.audit.*` - Connection audit projections backed by auth events.\n *\n * @module\n */\n\nimport { paginationOptsValidator } from \"convex/server\";\nimport { paginator } from \"convex-helpers/server/pagination\";\nimport { v, type Infer } from \"convex/values\";\n\nimport { EVENT_KIND_CATEGORY, type AuthEventKind } from \"../../shared/event/kinds\";\nimport type { Doc } from \"../_generated/dataModel\";\nimport { vAuthEventProjectionDoc } from \"../documents\";\nimport { query } from \"../_generated/server\";\nimport { vAuthEventData, vPaginated } from \"../model\";\nimport schema from \"../schema\";\n\nconst PUBLIC_DATA_KEYS = {\n  user: [\"type\", \"provider\", \"existingUserId\"],\n  session: [\"provider\", \"method\", \"reason\"],\n  account: [\"provider\", \"accountId\"],\n  password: [\"userId\"],\n  passkey: [\"passkeyId\"],\n  totp: [\"totpId\"],\n  email: [\"userId\"],\n  phone: [\"userId\"],\n  api_key: [\"keyId\", \"name\", \"prefix\", \"reason\"],\n  oauth: [\"clientId\", \"codeId\", \"scopes\", \"grantType\", \"resource\"],\n  connection: [\n    \"connectionId\",\n    \"protocol\",\n    \"domain\",\n    \"recordName\",\n    \"expiresAt\",\n    \"verifiedAt\",\n    \"metadataUrl\",\n    \"domains\",\n    \"version\",\n    \"errorCode\",\n    \"issuer\",\n    \"discoveryUrl\",\n    \"jwksUri\",\n    \"audience\",\n    \"tokenEndpointAuthMethod\",\n  ],\n  scim: [\n    \"scimConfigId\",\n    \"resourceType\",\n    \"resourceId\",\n    \"operation\",\n    \"externalId\",\n    \"active\",\n    \"groupId\",\n    \"userId\",\n  ],\n  webhook: [\n    \"endpointId\",\n    \"deliveryId\",\n    \"sourceEventId\",\n    \"sourceEventType\",\n    \"attemptCount\",\n    \"status\",\n    \"error\",\n  ],\n  security: [\"reason\", \"errorCode\"],\n} as const;\n\nfunction publicData(kind: AuthEventKind, value: unknown): Infer<typeof vAuthEventData> | undefined {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) return undefined;\n  const category = EVENT_KIND_CATEGORY[kind];\n  const keys = PUBLIC_DATA_KEYS[category] ?? [];\n  const source = value as Record<string, unknown>;\n  const redacted: Record<string, unknown> = {};\n  for (const key of keys) {\n    const nested = source[key];\n    if (nested !== undefined) redacted[key] = nested;\n  }\n  return Object.keys(redacted).length === 0\n    ? undefined\n    : (redacted as Infer<typeof vAuthEventData>);\n}\n\nfunction publicProjection(doc: Doc<\"AuthEventProjection\">) {\n  return {\n    _id: doc._id,\n    _creationTime: doc._creationTime,\n    eventId: doc.eventId,\n    targetKind: doc.targetKind,\n    targetId: doc.targetId,\n    kind: doc.kind,\n    category: doc.category,\n    occurredAt: doc.occurredAt,\n    actorType: doc.actorType,\n    actorId: doc.actorId,\n    subjectType: doc.subjectType,\n    subjectId: doc.subjectId,\n    outcome: doc.outcome,\n    errorCode: doc.errorCode,\n    requestId: doc.requestId,\n    ip: undefined,\n    data: publicData(doc.kind, doc.data),\n  };\n}\n\n/**\n * List audit-event projections for a connection or a group, newest first and\n * paginated. Rows are redacted to public fields (IP dropped, `data` narrowed to\n * an allowlist). Requires exactly one of `connectionId` or `groupId` — passing\n * neither throws rather than scanning the entire audit log.\n */\nexport const list = query({\n  args: {\n    scope: v.union(\n      v.object({ connectionId: schema.id(\"GroupConnection\") }),\n      v.object({ groupId: schema.id(\"Group\") }),\n    ),\n    paginationOpts: paginationOptsValidator,\n  },\n  returns: vPaginated(vAuthEventProjectionDoc),\n  handler: async (ctx, { scope, paginationOpts }) => {\n    if (\"connectionId\" in scope) {\n      const result = await paginator(ctx.db, schema)\n        .query(\"AuthEventProjection\")\n        .withIndex(\"target_time\", (idx) =>\n          idx.eq(\"targetKind\", \"connection\").eq(\"targetId\", scope.connectionId),\n        )\n        .order(\"desc\")\n        .paginate(paginationOpts);\n      return { ...result, page: result.page.map(publicProjection) };\n    }\n    const result = await paginator(ctx.db, schema)\n      .query(\"AuthEventProjection\")\n      .withIndex(\"target_time\", (idx) =>\n        idx.eq(\"targetKind\", \"group\").eq(\"targetId\", scope.groupId),\n      )\n      .order(\"desc\")\n      .paginate(paginationOpts);\n    return { ...result, page: result.page.map(publicProjection) };\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;AAiBA,MAAM,mBAAmB;CACvB,MAAM;EAAC;EAAQ;EAAY;EAAiB;CAC5C,SAAS;EAAC;EAAY;EAAU;EAAS;CACzC,SAAS,CAAC,YAAY,YAAY;CAClC,UAAU,CAAC,SAAS;CACpB,SAAS,CAAC,YAAY;CACtB,MAAM,CAAC,SAAS;CAChB,OAAO,CAAC,SAAS;CACjB,OAAO,CAAC,SAAS;CACjB,SAAS;EAAC;EAAS;EAAQ;EAAU;EAAS;CAC9C,OAAO;EAAC;EAAY;EAAU;EAAU;EAAa;EAAW;CAChE,YAAY;EACV;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD;CACD,MAAM;EACJ;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD;CACD,SAAS;EACP;EACA;EACA;EACA;EACA;EACA;EACA;EACD;CACD,UAAU,CAAC,UAAU,YAAY;CAClC;AAED,SAAS,WAAW,MAAqB,OAA0D;AACjG,KAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,MAAM,CAAE,QAAO;CAEhF,MAAM,OAAO,iBADI,oBAAoB,UACM,EAAE;CAC7C,MAAM,SAAS;CACf,MAAM,WAAoC,EAAE;AAC5C,MAAK,MAAM,OAAO,MAAM;EACtB,MAAM,SAAS,OAAO;AACtB,MAAI,WAAW,OAAW,UAAS,OAAO;;AAE5C,QAAO,OAAO,KAAK,SAAS,CAAC,WAAW,IACpC,SACC;;AAGP,SAAS,iBAAiB,KAAiC;AACzD,QAAO;EACL,KAAK,IAAI;EACT,eAAe,IAAI;EACnB,SAAS,IAAI;EACb,YAAY,IAAI;EAChB,UAAU,IAAI;EACd,MAAM,IAAI;EACV,UAAU,IAAI;EACd,YAAY,IAAI;EAChB,WAAW,IAAI;EACf,SAAS,IAAI;EACb,aAAa,IAAI;EACjB,WAAW,IAAI;EACf,SAAS,IAAI;EACb,WAAW,IAAI;EACf,WAAW,IAAI;EACf,IAAI;EACJ,MAAM,WAAW,IAAI,MAAM,IAAI,KAAK;EACrC;;;;;;;;AASH,MAAa,OAAO,MAAM;CACxB,MAAM;EACJ,OAAO,EAAE,MACP,EAAE,OAAO,EAAE,cAAcA,eAAO,GAAG,kBAAkB,EAAE,CAAC,EACxD,EAAE,OAAO,EAAE,SAASA,eAAO,GAAG,QAAQ,EAAE,CAAC,CAC1C;EACD,gBAAgB;EACjB;CACD,SAAS,WAAW,wBAAwB;CAC5C,SAAS,OAAO,KAAK,EAAE,OAAO,qBAAqB;AACjD,MAAI,kBAAkB,OAAO;GAC3B,MAAMC,WAAS,MAAM,UAAU,IAAI,IAAID,eAAO,CAC3C,MAAM,sBAAsB,CAC5B,UAAU,gBAAgB,QACzB,IAAI,GAAG,cAAc,aAAa,CAAC,GAAG,YAAY,MAAM,aAAa,CACtE,CACA,MAAM,OAAO,CACb,SAAS,eAAe;AAC3B,UAAO;IAAE,GAAGC;IAAQ,MAAMA,SAAO,KAAK,IAAI,iBAAiB;IAAE;;EAE/D,MAAM,SAAS,MAAM,UAAU,IAAI,IAAID,eAAO,CAC3C,MAAM,sBAAsB,CAC5B,UAAU,gBAAgB,QACzB,IAAI,GAAG,cAAc,QAAQ,CAAC,GAAG,YAAY,MAAM,QAAQ,CAC5D,CACA,MAAM,OAAO,CACb,SAAS,eAAe;AAC3B,SAAO;GAAE,GAAG;GAAQ,MAAM,OAAO,KAAK,IAAI,iBAAiB;GAAE;;CAEhE,CAAC"}

package/dist/component/connection/cache.d.ts

@@ -1,4 +1,4 @@
-import * as convex_server210 from "convex/server";
+import * as convex_server189 from "convex/server";
 
 //#region src/component/connection/cache.d.ts
 declare namespace cache_d_exports {
@@ -27,7 +27,7 @@ declare namespace cache_d_exports {
 /**
  * Read-through fetch for OIDC discovery JSON. Cached 1h per URL.
  */
-declare const oidcDiscovery: convex_server210.RegisteredAction<"public", {
+declare const oidcDiscovery: convex_server189.RegisteredAction<"public", {
   runtimeOrigin?: string | undefined;
   externalHost?: string | undefined;
   url: string;
@@ -45,7 +45,7 @@ declare const oidcDiscovery: convex_server210.RegisteredAction<"public", {
  * Cached 2h per URL (separate from the runtime sign-in path so admin
  * dashboards don't share keys with hot-path traffic).
  */
-declare const oidcStatusDiscovery: convex_server210.RegisteredAction<"public", {
+declare const oidcStatusDiscovery: convex_server189.RegisteredAction<"public", {
   runtimeOrigin?: string | undefined;
   externalHost?: string | undefined;
   url: string;
@@ -61,19 +61,19 @@ declare const oidcStatusDiscovery: convex_server210.RegisteredAction<"public", {
 /**
  * Read-through fetch for SAML IdP metadata XML. Cached 24h per URL.
  */
-declare const samlMetadata: convex_server210.RegisteredAction<"public", {
+declare const samlMetadata: convex_server189.RegisteredAction<"public", {
   runtimeOrigin?: string | undefined;
   externalHost?: string | undefined;
   url: string;
 }, Promise<string>>;
 /** Invalidate a cached OIDC discovery entry (e.g. on `discoveryUrl` update). */
-declare const invalidateOidcDiscovery: convex_server210.RegisteredMutation<"public", {
+declare const invalidateOidcDiscovery: convex_server189.RegisteredMutation<"public", {
   runtimeOrigin?: string | undefined;
   externalHost?: string | undefined;
   url: string;
 }, Promise<null>>;
 /** Invalidate a cached SAML metadata entry (e.g. on `metadataUrl` update). */
-declare const invalidateSamlMetadata: convex_server210.RegisteredMutation<"public", {
+declare const invalidateSamlMetadata: convex_server189.RegisteredMutation<"public", {
   runtimeOrigin?: string | undefined;
   externalHost?: string | undefined;
   url: string;

package/dist/component/connection/cache.js

@@ -1,7 +1,6 @@
 import { assertSafeIdpFetchUrl, assertSafeIdpHost } from "../../shared/fetch/guard.js";
 import { components, internal } from "../_generated/api.js";
 import { action, internalAction, mutation } from "../_generated/server.js";
-import "../functions.js";
 import { v } from "convex/values";
 import { ActionCache } from "@convex-dev/action-cache";
 

package/dist/component/connection/cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"cache.js","names":[],"sources":["../../../src/component/connection/cache.ts"],"sourcesContent":["/**\n * `component.connection.cache.*` — read-through cache for external Connection\n * HTTP fetches (OIDC discovery, SAML metadata, OIDC status validation).\n *\n * Each cache wraps an `internalAction` that performs the fetch on miss.\n * The cache key is `(name, args)` where `args` is the URL (plus optional\n * proxy hints). Cache entries persist in the action-cache component's\n * tables, so concurrent / sequential requests for the same URL share\n * results.\n *\n * Direct callers go through the exposed `*Discovery`, `*Metadata`,\n * `*StatusDiscovery` actions which are thin wrappers over the cache's\n * `.fetch()` method. Server-side code at `server/connection/` invokes these via\n * `ctx.runAction(components.auth.connection.cache.X, args)`.\n *\n * To invalidate (e.g. when an admin updates `discoveryUrl` or\n * `metadataUrl`), call the matching `invalidate*` mutation.\n *\n * @module\n */\n\nimport { ActionCache } from \"@convex-dev/action-cache\";\nimport type { FunctionReference } from \"convex/server\";\nimport { v, type Infer } from \"convex/values\";\n\nimport { components, internal } from \"../_generated/api\";\nimport { action, internalAction, mutation } from \"../functions\";\nimport { assertSafeIdpFetchUrl, assertSafeIdpHost } from \"../../shared/fetch/guard\";\n\n/**\n * One isolated typed bridge across `ActionCache.fetch`'s ctx boundary. An\n * `action` handler's ctx supplies `runQuery`/`runMutation`/`runAction`, but over\n * this component's concrete DataModel, which TS treats as incompatible with the\n * action-cache's `GenericDataModel` under invariance — so the two cannot be\n * unified positively. Each caller infers the exact target from the `.fetch`\n * parameter, so results stay precisely typed.\n */\nfunction asActionCacheCtx<T>(ctx: object): T {\n  return ctx as T;\n}\n\nconst fetchUrlArgs = {\n  /** Absolute URL to fetch. */\n  url: v.string(),\n  /**\n   * Optional proxy-mode origin. When set, the request is sent to\n   * `runtimeOrigin + url.pathname + url.search` instead of `url.origin`.\n   * Used by self-hosted Convex deployments fronting an external IdP via\n   * an internal hostname.\n   */\n  runtimeOrigin: v.optional(v.string()),\n  /** Optional `Host` header value (paired with `runtimeOrigin`). */\n  externalHost: v.optional(v.string()),\n};\n\nconst vFetchUrlArgs = v.object(fetchUrlArgs);\n\nconst vOidcDiscovery = v.object({\n  issuer: v.string(),\n  authorization_endpoint: v.string(),\n  token_endpoint: v.string(),\n  jwks_uri: v.string(),\n  userinfo_endpoint: v.optional(v.string()),\n  token_endpoint_auth_methods_supported: v.optional(v.array(v.string())),\n  id_token_signing_alg_values_supported: v.optional(v.array(v.string())),\n});\n\ntype FetchUrlArgs = Infer<typeof vFetchUrlArgs>;\n\ntype OidcDiscovery = Infer<typeof vOidcDiscovery>;\n\ntype OidcDiscoveryAction = FunctionReference<\n  \"action\",\n  \"internal\",\n  FetchUrlArgs,\n  OidcDiscovery,\n  string | undefined\n>;\n\ntype TextAction = FunctionReference<\"action\", \"internal\", FetchUrlArgs, string, string | undefined>;\n\ntype RequestTarget = { url: URL; headers: Headers };\n\nconst requestOidcDiscoveryRef = internal.connection.cache\n  .requestOidcDiscovery as OidcDiscoveryAction;\nconst requestTextRef = internal.connection.cache.requestText as TextAction;\n\nfunction normalizeOidcDiscovery(data: unknown): OidcDiscovery {\n  if (typeof data !== \"object\" || data === null) {\n    throw new Error(\"OIDC discovery response is not an object.\");\n  }\n  const source = data as Record<string, unknown>;\n  if (typeof source.issuer !== \"string\") {\n    throw new Error(\"OIDC discovery is missing 'issuer'.\");\n  }\n  if (typeof source.authorization_endpoint !== \"string\") {\n    throw new Error(\"OIDC discovery is missing 'authorization_endpoint'.\");\n  }\n  if (typeof source.token_endpoint !== \"string\") {\n    throw new Error(\"OIDC discovery is missing 'token_endpoint'.\");\n  }\n  if (typeof source.jwks_uri !== \"string\") {\n    throw new Error(\"OIDC discovery is missing 'jwks_uri'.\");\n  }\n  return {\n    issuer: source.issuer,\n    authorization_endpoint: source.authorization_endpoint,\n    token_endpoint: source.token_endpoint,\n    jwks_uri: source.jwks_uri,\n    userinfo_endpoint:\n      typeof source.userinfo_endpoint === \"string\" ? source.userinfo_endpoint : undefined,\n    token_endpoint_auth_methods_supported: Array.isArray(\n      source.token_endpoint_auth_methods_supported,\n    )\n      ? source.token_endpoint_auth_methods_supported.filter(\n          (value): value is string => typeof value === \"string\",\n        )\n      : undefined,\n    id_token_signing_alg_values_supported: Array.isArray(\n      source.id_token_signing_alg_values_supported,\n    )\n      ? source.id_token_signing_alg_values_supported.filter(\n          (value): value is string => typeof value === \"string\",\n        )\n      : undefined,\n  };\n}\n\nfunction normalizeRuntimeOrigin(runtimeOrigin: string | undefined): string | undefined {\n  if (runtimeOrigin === undefined) {\n    return undefined;\n  }\n  let parsed: URL;\n  try {\n    parsed = new URL(runtimeOrigin);\n  } catch {\n    throw new Error(\"runtimeOrigin must be a valid absolute URL.\");\n  }\n  if (\n    parsed.username !== \"\" ||\n    parsed.password !== \"\" ||\n    parsed.pathname !== \"/\" ||\n    parsed.search !== \"\" ||\n    parsed.hash !== \"\"\n  ) {\n    throw new Error(\"runtimeOrigin must be an origin with no path, query, hash, or credentials.\");\n  }\n  assertSafeIdpFetchUrl(parsed.origin);\n  return parsed.origin;\n}\n\nfunction validateExternalHost(externalHost: string | undefined, runtimeOrigin: string | undefined) {\n  if (externalHost === undefined) {\n    return;\n  }\n  if (runtimeOrigin === undefined) {\n    throw new Error(\"externalHost requires runtimeOrigin.\");\n  }\n  assertSafeIdpHost(externalHost);\n}\n\nconst buildRequestUrl = (\n  url: string,\n  runtimeOrigin: string | undefined,\n  externalHost: string | undefined,\n): RequestTarget => {\n  assertSafeIdpFetchUrl(url);\n  const normalizedRuntimeOrigin = normalizeRuntimeOrigin(runtimeOrigin);\n  validateExternalHost(externalHost, normalizedRuntimeOrigin);\n  const parsed = new URL(url);\n  const rewritten =\n    normalizedRuntimeOrigin !== undefined && parsed.origin !== normalizedRuntimeOrigin\n      ? new URL(`${normalizedRuntimeOrigin}${parsed.pathname}${parsed.search}`)\n      : parsed;\n  assertSafeIdpFetchUrl(rewritten.toString());\n  const headers = new Headers();\n  if (normalizedRuntimeOrigin !== undefined && externalHost !== undefined) {\n    headers.set(\"host\", externalHost);\n  }\n  return { url: rewritten, headers };\n};\n\n/** Request an OIDC discovery URL and return the normalized fields used by auth. @internal */\nexport const requestOidcDiscovery = internalAction({\n  args: fetchUrlArgs,\n  returns: vOidcDiscovery,\n  handler: async (_ctx, { url, runtimeOrigin, externalHost }) => {\n    const req = buildRequestUrl(url, runtimeOrigin, externalHost);\n    const response = await fetch(req.url, {\n      headers: req.headers,\n      redirect: \"manual\",\n      signal: AbortSignal.timeout(10_000),\n    });\n    if (!response.ok) {\n      throw new Error(`HTTP ${response.status} fetching ${url}`);\n    }\n    return normalizeOidcDiscovery(await response.json());\n  },\n});\n\n/** Request a URL and return the response body as text. @internal */\nexport const requestText = internalAction({\n  args: fetchUrlArgs,\n  returns: v.string(),\n  handler: async (_ctx, { url, runtimeOrigin, externalHost }) => {\n    const req = buildRequestUrl(url, runtimeOrigin, externalHost);\n    const response = await fetch(req.url, {\n      headers: req.headers,\n      redirect: \"manual\",\n      signal: AbortSignal.timeout(15_000),\n    });\n    if (!response.ok) {\n      throw new Error(`HTTP ${response.status} fetching ${url}`);\n    }\n    return await response.text();\n  },\n});\n\nconst ONE_HOUR = 60 * 60 * 1000;\nconst TWO_HOURS = 2 * ONE_HOUR;\nconst ONE_DAY = 24 * ONE_HOUR;\n\nconst oidcDiscoveryCache = new ActionCache(components.connectionFetchCache, {\n  action: requestOidcDiscoveryRef,\n  name: \"oidcDiscovery\",\n  ttl: ONE_HOUR,\n});\n\nconst oidcStatusDiscoveryCache = new ActionCache(components.connectionFetchCache, {\n  action: requestOidcDiscoveryRef,\n  name: \"oidcStatusDiscovery\",\n  ttl: TWO_HOURS,\n});\n\nconst samlMetadataCache = new ActionCache(components.connectionFetchCache, {\n  action: requestTextRef,\n  name: \"samlMetadata\",\n  ttl: ONE_DAY,\n});\n\n/**\n * Read-through fetch for OIDC discovery JSON. Cached 1h per URL.\n */\nexport const oidcDiscovery = action({\n  args: fetchUrlArgs,\n  returns: vOidcDiscovery,\n  handler: async (ctx, args) => {\n    return await oidcDiscoveryCache.fetch(asActionCacheCtx(ctx), args);\n  },\n});\n\n/**\n * Read-through fetch for OIDC discovery during admin status validation.\n * Cached 2h per URL (separate from the runtime sign-in path so admin\n * dashboards don't share keys with hot-path traffic).\n */\nexport const oidcStatusDiscovery = action({\n  args: fetchUrlArgs,\n  returns: vOidcDiscovery,\n  handler: async (ctx, args) => {\n    return await oidcStatusDiscoveryCache.fetch(asActionCacheCtx(ctx), args);\n  },\n});\n\n/**\n * Read-through fetch for SAML IdP metadata XML. Cached 24h per URL.\n */\nexport const samlMetadata = action({\n  args: fetchUrlArgs,\n  returns: v.string(),\n  handler: async (ctx, args) => {\n    return await samlMetadataCache.fetch(asActionCacheCtx(ctx), args);\n  },\n});\n\n/** Invalidate a cached OIDC discovery entry (e.g. on `discoveryUrl` update). */\nexport const invalidateOidcDiscovery = mutation({\n  args: fetchUrlArgs,\n  returns: v.null(),\n  handler: async (ctx, args) => {\n    await oidcDiscoveryCache.remove(ctx, args);\n    await oidcStatusDiscoveryCache.remove(ctx, args);\n    return null;\n  },\n});\n\n/** Invalidate a cached SAML metadata entry (e.g. on `metadataUrl` update). */\nexport const invalidateSamlMetadata = mutation({\n  args: fetchUrlArgs,\n  returns: v.null(),\n  handler: async (ctx, args) => {\n    await samlMetadataCache.remove(ctx, args);\n    return null;\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,SAAS,iBAAoB,KAAgB;AAC3C,QAAO;;AAGT,MAAM,eAAe;CAEnB,KAAK,EAAE,QAAQ;CAOf,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC;CAErC,cAAc,EAAE,SAAS,EAAE,QAAQ,CAAC;CACrC;AAEqB,EAAE,OAAO,aAAa;AAE5C,MAAM,iBAAiB,EAAE,OAAO;CAC9B,QAAQ,EAAE,QAAQ;CAClB,wBAAwB,EAAE,QAAQ;CAClC,gBAAgB,EAAE,QAAQ;CAC1B,UAAU,EAAE,QAAQ;CACpB,mBAAmB,EAAE,SAAS,EAAE,QAAQ,CAAC;CACzC,uCAAuC,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;CACtE,uCAAuC,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;CACvE,CAAC;AAkBF,MAAM,0BAA0B,SAAS,WAAW,MACjD;AACH,MAAM,iBAAiB,SAAS,WAAW,MAAM;AAEjD,SAAS,uBAAuB,MAA8B;AAC5D,KAAI,OAAO,SAAS,YAAY,SAAS,KACvC,OAAM,IAAI,MAAM,4CAA4C;CAE9D,MAAM,SAAS;AACf,KAAI,OAAO,OAAO,WAAW,SAC3B,OAAM,IAAI,MAAM,sCAAsC;AAExD,KAAI,OAAO,OAAO,2BAA2B,SAC3C,OAAM,IAAI,MAAM,sDAAsD;AAExE,KAAI,OAAO,OAAO,mBAAmB,SACnC,OAAM,IAAI,MAAM,8CAA8C;AAEhE,KAAI,OAAO,OAAO,aAAa,SAC7B,OAAM,IAAI,MAAM,wCAAwC;AAE1D,QAAO;EACL,QAAQ,OAAO;EACf,wBAAwB,OAAO;EAC/B,gBAAgB,OAAO;EACvB,UAAU,OAAO;EACjB,mBACE,OAAO,OAAO,sBAAsB,WAAW,OAAO,oBAAoB;EAC5E,uCAAuC,MAAM,QAC3C,OAAO,sCACR,GACG,OAAO,sCAAsC,QAC1C,UAA2B,OAAO,UAAU,SAC9C,GACD;EACJ,uCAAuC,MAAM,QAC3C,OAAO,sCACR,GACG,OAAO,sCAAsC,QAC1C,UAA2B,OAAO,UAAU,SAC9C,GACD;EACL;;AAGH,SAAS,uBAAuB,eAAuD;AACrF,KAAI,kBAAkB,OACpB;CAEF,IAAI;AACJ,KAAI;AACF,WAAS,IAAI,IAAI,cAAc;SACzB;AACN,QAAM,IAAI,MAAM,8CAA8C;;AAEhE,KACE,OAAO,aAAa,MACpB,OAAO,aAAa,MACpB,OAAO,aAAa,OACpB,OAAO,WAAW,MAClB,OAAO,SAAS,GAEhB,OAAM,IAAI,MAAM,6EAA6E;AAE/F,uBAAsB,OAAO,OAAO;AACpC,QAAO,OAAO;;AAGhB,SAAS,qBAAqB,cAAkC,eAAmC;AACjG,KAAI,iBAAiB,OACnB;AAEF,KAAI,kBAAkB,OACpB,OAAM,IAAI,MAAM,uCAAuC;AAEzD,mBAAkB,aAAa;;AAGjC,MAAM,mBACJ,KACA,eACA,iBACkB;AAClB,uBAAsB,IAAI;CAC1B,MAAM,0BAA0B,uBAAuB,cAAc;AACrE,sBAAqB,cAAc,wBAAwB;CAC3D,MAAM,SAAS,IAAI,IAAI,IAAI;CAC3B,MAAM,YACJ,4BAA4B,UAAa,OAAO,WAAW,0BACvD,IAAI,IAAI,GAAG,0BAA0B,OAAO,WAAW,OAAO,SAAS,GACvE;AACN,uBAAsB,UAAU,UAAU,CAAC;CAC3C,MAAM,UAAU,IAAI,SAAS;AAC7B,KAAI,4BAA4B,UAAa,iBAAiB,OAC5D,SAAQ,IAAI,QAAQ,aAAa;AAEnC,QAAO;EAAE,KAAK;EAAW;EAAS;;;AAIpC,MAAa,uBAAuB,eAAe;CACjD,MAAM;CACN,SAAS;CACT,SAAS,OAAO,MAAM,EAAE,KAAK,eAAe,mBAAmB;EAC7D,MAAM,MAAM,gBAAgB,KAAK,eAAe,aAAa;EAC7D,MAAM,WAAW,MAAM,MAAM,IAAI,KAAK;GACpC,SAAS,IAAI;GACb,UAAU;GACV,QAAQ,YAAY,QAAQ,IAAO;GACpC,CAAC;AACF,MAAI,CAAC,SAAS,GACZ,OAAM,IAAI,MAAM,QAAQ,SAAS,OAAO,YAAY,MAAM;AAE5D,SAAO,uBAAuB,MAAM,SAAS,MAAM,CAAC;;CAEvD,CAAC;;AAGF,MAAa,cAAc,eAAe;CACxC,MAAM;CACN,SAAS,EAAE,QAAQ;CACnB,SAAS,OAAO,MAAM,EAAE,KAAK,eAAe,mBAAmB;EAC7D,MAAM,MAAM,gBAAgB,KAAK,eAAe,aAAa;EAC7D,MAAM,WAAW,MAAM,MAAM,IAAI,KAAK;GACpC,SAAS,IAAI;GACb,UAAU;GACV,QAAQ,YAAY,QAAQ,KAAO;GACpC,CAAC;AACF,MAAI,CAAC,SAAS,GACZ,OAAM,IAAI,MAAM,QAAQ,SAAS,OAAO,YAAY,MAAM;AAE5D,SAAO,MAAM,SAAS,MAAM;;CAE/B,CAAC;AAEF,MAAM,WAAW,OAAU;AAC3B,MAAM,YAAY,IAAI;AACtB,MAAM,UAAU,KAAK;AAErB,MAAM,qBAAqB,IAAI,YAAY,WAAW,sBAAsB;CAC1E,QAAQ;CACR,MAAM;CACN,KAAK;CACN,CAAC;AAEF,MAAM,2BAA2B,IAAI,YAAY,WAAW,sBAAsB;CAChF,QAAQ;CACR,MAAM;CACN,KAAK;CACN,CAAC;AAEF,MAAM,oBAAoB,IAAI,YAAY,WAAW,sBAAsB;CACzE,QAAQ;CACR,MAAM;CACN,KAAK;CACN,CAAC;;;;AAKF,MAAa,gBAAgB,OAAO;CAClC,MAAM;CACN,SAAS;CACT,SAAS,OAAO,KAAK,SAAS;AAC5B,SAAO,MAAM,mBAAmB,MAAM,iBAAiB,IAAI,EAAE,KAAK;;CAErE,CAAC;;;;;;AAOF,MAAa,sBAAsB,OAAO;CACxC,MAAM;CACN,SAAS;CACT,SAAS,OAAO,KAAK,SAAS;AAC5B,SAAO,MAAM,yBAAyB,MAAM,iBAAiB,IAAI,EAAE,KAAK;;CAE3E,CAAC;;;;AAKF,MAAa,eAAe,OAAO;CACjC,MAAM;CACN,SAAS,EAAE,QAAQ;CACnB,SAAS,OAAO,KAAK,SAAS;AAC5B,SAAO,MAAM,kBAAkB,MAAM,iBAAiB,IAAI,EAAE,KAAK;;CAEpE,CAAC;;AAGF,MAAa,0BAA0B,SAAS;CAC9C,MAAM;CACN,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,SAAS;AAC5B,QAAM,mBAAmB,OAAO,KAAK,KAAK;AAC1C,QAAM,yBAAyB,OAAO,KAAK,KAAK;AAChD,SAAO;;CAEV,CAAC;;AAGF,MAAa,yBAAyB,SAAS;CAC7C,MAAM;CACN,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,SAAS;AAC5B,QAAM,kBAAkB,OAAO,KAAK,KAAK;AACzC,SAAO;;CAEV,CAAC"}
+{"version":3,"file":"cache.js","names":[],"sources":["../../../src/component/connection/cache.ts"],"sourcesContent":["/**\n * `component.connection.cache.*` — read-through cache for external Connection\n * HTTP fetches (OIDC discovery, SAML metadata, OIDC status validation).\n *\n * Each cache wraps an `internalAction` that performs the fetch on miss.\n * The cache key is `(name, args)` where `args` is the URL (plus optional\n * proxy hints). Cache entries persist in the action-cache component's\n * tables, so concurrent / sequential requests for the same URL share\n * results.\n *\n * Direct callers go through the exposed `*Discovery`, `*Metadata`,\n * `*StatusDiscovery` actions which are thin wrappers over the cache's\n * `.fetch()` method. Server-side code at `server/connection/` invokes these via\n * `ctx.runAction(components.auth.connection.cache.X, args)`.\n *\n * To invalidate (e.g. when an admin updates `discoveryUrl` or\n * `metadataUrl`), call the matching `invalidate*` mutation.\n *\n * @module\n */\n\nimport { ActionCache } from \"@convex-dev/action-cache\";\nimport type { FunctionReference } from \"convex/server\";\nimport { v, type Infer } from \"convex/values\";\n\nimport { components, internal } from \"../_generated/api\";\nimport { action, internalAction, mutation } from \"../_generated/server\";\nimport { assertSafeIdpFetchUrl, assertSafeIdpHost } from \"../../shared/fetch/guard\";\n\n/**\n * One isolated typed bridge across `ActionCache.fetch`'s ctx boundary. An\n * `action` handler's ctx supplies `runQuery`/`runMutation`/`runAction`, but over\n * this component's concrete DataModel, which TS treats as incompatible with the\n * action-cache's `GenericDataModel` under invariance — so the two cannot be\n * unified positively. Each caller infers the exact target from the `.fetch`\n * parameter, so results stay precisely typed.\n */\nfunction asActionCacheCtx<T>(ctx: object): T {\n  return ctx as T;\n}\n\nconst fetchUrlArgs = {\n  /** Absolute URL to fetch. */\n  url: v.string(),\n  /**\n   * Optional proxy-mode origin. When set, the request is sent to\n   * `runtimeOrigin + url.pathname + url.search` instead of `url.origin`.\n   * Used by self-hosted Convex deployments fronting an external IdP via\n   * an internal hostname.\n   */\n  runtimeOrigin: v.optional(v.string()),\n  /** Optional `Host` header value (paired with `runtimeOrigin`). */\n  externalHost: v.optional(v.string()),\n};\n\nconst vFetchUrlArgs = v.object(fetchUrlArgs);\n\nconst vOidcDiscovery = v.object({\n  issuer: v.string(),\n  authorization_endpoint: v.string(),\n  token_endpoint: v.string(),\n  jwks_uri: v.string(),\n  userinfo_endpoint: v.optional(v.string()),\n  token_endpoint_auth_methods_supported: v.optional(v.array(v.string())),\n  id_token_signing_alg_values_supported: v.optional(v.array(v.string())),\n});\n\ntype FetchUrlArgs = Infer<typeof vFetchUrlArgs>;\n\ntype OidcDiscovery = Infer<typeof vOidcDiscovery>;\n\ntype OidcDiscoveryAction = FunctionReference<\n  \"action\",\n  \"internal\",\n  FetchUrlArgs,\n  OidcDiscovery,\n  string | undefined\n>;\n\ntype TextAction = FunctionReference<\"action\", \"internal\", FetchUrlArgs, string, string | undefined>;\n\ntype RequestTarget = { url: URL; headers: Headers };\n\nconst requestOidcDiscoveryRef = internal.connection.cache\n  .requestOidcDiscovery as OidcDiscoveryAction;\nconst requestTextRef = internal.connection.cache.requestText as TextAction;\n\nfunction normalizeOidcDiscovery(data: unknown): OidcDiscovery {\n  if (typeof data !== \"object\" || data === null) {\n    throw new Error(\"OIDC discovery response is not an object.\");\n  }\n  const source = data as Record<string, unknown>;\n  if (typeof source.issuer !== \"string\") {\n    throw new Error(\"OIDC discovery is missing 'issuer'.\");\n  }\n  if (typeof source.authorization_endpoint !== \"string\") {\n    throw new Error(\"OIDC discovery is missing 'authorization_endpoint'.\");\n  }\n  if (typeof source.token_endpoint !== \"string\") {\n    throw new Error(\"OIDC discovery is missing 'token_endpoint'.\");\n  }\n  if (typeof source.jwks_uri !== \"string\") {\n    throw new Error(\"OIDC discovery is missing 'jwks_uri'.\");\n  }\n  return {\n    issuer: source.issuer,\n    authorization_endpoint: source.authorization_endpoint,\n    token_endpoint: source.token_endpoint,\n    jwks_uri: source.jwks_uri,\n    userinfo_endpoint:\n      typeof source.userinfo_endpoint === \"string\" ? source.userinfo_endpoint : undefined,\n    token_endpoint_auth_methods_supported: Array.isArray(\n      source.token_endpoint_auth_methods_supported,\n    )\n      ? source.token_endpoint_auth_methods_supported.filter(\n          (value): value is string => typeof value === \"string\",\n        )\n      : undefined,\n    id_token_signing_alg_values_supported: Array.isArray(\n      source.id_token_signing_alg_values_supported,\n    )\n      ? source.id_token_signing_alg_values_supported.filter(\n          (value): value is string => typeof value === \"string\",\n        )\n      : undefined,\n  };\n}\n\nfunction normalizeRuntimeOrigin(runtimeOrigin: string | undefined): string | undefined {\n  if (runtimeOrigin === undefined) {\n    return undefined;\n  }\n  let parsed: URL;\n  try {\n    parsed = new URL(runtimeOrigin);\n  } catch {\n    throw new Error(\"runtimeOrigin must be a valid absolute URL.\");\n  }\n  if (\n    parsed.username !== \"\" ||\n    parsed.password !== \"\" ||\n    parsed.pathname !== \"/\" ||\n    parsed.search !== \"\" ||\n    parsed.hash !== \"\"\n  ) {\n    throw new Error(\"runtimeOrigin must be an origin with no path, query, hash, or credentials.\");\n  }\n  assertSafeIdpFetchUrl(parsed.origin);\n  return parsed.origin;\n}\n\nfunction validateExternalHost(externalHost: string | undefined, runtimeOrigin: string | undefined) {\n  if (externalHost === undefined) {\n    return;\n  }\n  if (runtimeOrigin === undefined) {\n    throw new Error(\"externalHost requires runtimeOrigin.\");\n  }\n  assertSafeIdpHost(externalHost);\n}\n\nconst buildRequestUrl = (\n  url: string,\n  runtimeOrigin: string | undefined,\n  externalHost: string | undefined,\n): RequestTarget => {\n  assertSafeIdpFetchUrl(url);\n  const normalizedRuntimeOrigin = normalizeRuntimeOrigin(runtimeOrigin);\n  validateExternalHost(externalHost, normalizedRuntimeOrigin);\n  const parsed = new URL(url);\n  const rewritten =\n    normalizedRuntimeOrigin !== undefined && parsed.origin !== normalizedRuntimeOrigin\n      ? new URL(`${normalizedRuntimeOrigin}${parsed.pathname}${parsed.search}`)\n      : parsed;\n  assertSafeIdpFetchUrl(rewritten.toString());\n  const headers = new Headers();\n  if (normalizedRuntimeOrigin !== undefined && externalHost !== undefined) {\n    headers.set(\"host\", externalHost);\n  }\n  return { url: rewritten, headers };\n};\n\n/** Request an OIDC discovery URL and return the normalized fields used by auth. @internal */\nexport const requestOidcDiscovery = internalAction({\n  args: fetchUrlArgs,\n  returns: vOidcDiscovery,\n  handler: async (_ctx, { url, runtimeOrigin, externalHost }) => {\n    const req = buildRequestUrl(url, runtimeOrigin, externalHost);\n    const response = await fetch(req.url, {\n      headers: req.headers,\n      redirect: \"manual\",\n      signal: AbortSignal.timeout(10_000),\n    });\n    if (!response.ok) {\n      throw new Error(`HTTP ${response.status} fetching ${url}`);\n    }\n    return normalizeOidcDiscovery(await response.json());\n  },\n});\n\n/** Request a URL and return the response body as text. @internal */\nexport const requestText = internalAction({\n  args: fetchUrlArgs,\n  returns: v.string(),\n  handler: async (_ctx, { url, runtimeOrigin, externalHost }) => {\n    const req = buildRequestUrl(url, runtimeOrigin, externalHost);\n    const response = await fetch(req.url, {\n      headers: req.headers,\n      redirect: \"manual\",\n      signal: AbortSignal.timeout(15_000),\n    });\n    if (!response.ok) {\n      throw new Error(`HTTP ${response.status} fetching ${url}`);\n    }\n    return await response.text();\n  },\n});\n\nconst ONE_HOUR = 60 * 60 * 1000;\nconst TWO_HOURS = 2 * ONE_HOUR;\nconst ONE_DAY = 24 * ONE_HOUR;\n\nconst oidcDiscoveryCache = new ActionCache(components.connectionFetchCache, {\n  action: requestOidcDiscoveryRef,\n  name: \"oidcDiscovery\",\n  ttl: ONE_HOUR,\n});\n\nconst oidcStatusDiscoveryCache = new ActionCache(components.connectionFetchCache, {\n  action: requestOidcDiscoveryRef,\n  name: \"oidcStatusDiscovery\",\n  ttl: TWO_HOURS,\n});\n\nconst samlMetadataCache = new ActionCache(components.connectionFetchCache, {\n  action: requestTextRef,\n  name: \"samlMetadata\",\n  ttl: ONE_DAY,\n});\n\n/**\n * Read-through fetch for OIDC discovery JSON. Cached 1h per URL.\n */\nexport const oidcDiscovery = action({\n  args: fetchUrlArgs,\n  returns: vOidcDiscovery,\n  handler: async (ctx, args) => {\n    return await oidcDiscoveryCache.fetch(asActionCacheCtx(ctx), args);\n  },\n});\n\n/**\n * Read-through fetch for OIDC discovery during admin status validation.\n * Cached 2h per URL (separate from the runtime sign-in path so admin\n * dashboards don't share keys with hot-path traffic).\n */\nexport const oidcStatusDiscovery = action({\n  args: fetchUrlArgs,\n  returns: vOidcDiscovery,\n  handler: async (ctx, args) => {\n    return await oidcStatusDiscoveryCache.fetch(asActionCacheCtx(ctx), args);\n  },\n});\n\n/**\n * Read-through fetch for SAML IdP metadata XML. Cached 24h per URL.\n */\nexport const samlMetadata = action({\n  args: fetchUrlArgs,\n  returns: v.string(),\n  handler: async (ctx, args) => {\n    return await samlMetadataCache.fetch(asActionCacheCtx(ctx), args);\n  },\n});\n\n/** Invalidate a cached OIDC discovery entry (e.g. on `discoveryUrl` update). */\nexport const invalidateOidcDiscovery = mutation({\n  args: fetchUrlArgs,\n  returns: v.null(),\n  handler: async (ctx, args) => {\n    await oidcDiscoveryCache.remove(ctx, args);\n    await oidcStatusDiscoveryCache.remove(ctx, args);\n    return null;\n  },\n});\n\n/** Invalidate a cached SAML metadata entry (e.g. on `metadataUrl` update). */\nexport const invalidateSamlMetadata = mutation({\n  args: fetchUrlArgs,\n  returns: v.null(),\n  handler: async (ctx, args) => {\n    await samlMetadataCache.remove(ctx, args);\n    return null;\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,SAAS,iBAAoB,KAAgB;AAC3C,QAAO;;AAGT,MAAM,eAAe;CAEnB,KAAK,EAAE,QAAQ;CAOf,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC;CAErC,cAAc,EAAE,SAAS,EAAE,QAAQ,CAAC;CACrC;AAEqB,EAAE,OAAO,aAAa;AAE5C,MAAM,iBAAiB,EAAE,OAAO;CAC9B,QAAQ,EAAE,QAAQ;CAClB,wBAAwB,EAAE,QAAQ;CAClC,gBAAgB,EAAE,QAAQ;CAC1B,UAAU,EAAE,QAAQ;CACpB,mBAAmB,EAAE,SAAS,EAAE,QAAQ,CAAC;CACzC,uCAAuC,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;CACtE,uCAAuC,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;CACvE,CAAC;AAkBF,MAAM,0BAA0B,SAAS,WAAW,MACjD;AACH,MAAM,iBAAiB,SAAS,WAAW,MAAM;AAEjD,SAAS,uBAAuB,MAA8B;AAC5D,KAAI,OAAO,SAAS,YAAY,SAAS,KACvC,OAAM,IAAI,MAAM,4CAA4C;CAE9D,MAAM,SAAS;AACf,KAAI,OAAO,OAAO,WAAW,SAC3B,OAAM,IAAI,MAAM,sCAAsC;AAExD,KAAI,OAAO,OAAO,2BAA2B,SAC3C,OAAM,IAAI,MAAM,sDAAsD;AAExE,KAAI,OAAO,OAAO,mBAAmB,SACnC,OAAM,IAAI,MAAM,8CAA8C;AAEhE,KAAI,OAAO,OAAO,aAAa,SAC7B,OAAM,IAAI,MAAM,wCAAwC;AAE1D,QAAO;EACL,QAAQ,OAAO;EACf,wBAAwB,OAAO;EAC/B,gBAAgB,OAAO;EACvB,UAAU,OAAO;EACjB,mBACE,OAAO,OAAO,sBAAsB,WAAW,OAAO,oBAAoB;EAC5E,uCAAuC,MAAM,QAC3C,OAAO,sCACR,GACG,OAAO,sCAAsC,QAC1C,UAA2B,OAAO,UAAU,SAC9C,GACD;EACJ,uCAAuC,MAAM,QAC3C,OAAO,sCACR,GACG,OAAO,sCAAsC,QAC1C,UAA2B,OAAO,UAAU,SAC9C,GACD;EACL;;AAGH,SAAS,uBAAuB,eAAuD;AACrF,KAAI,kBAAkB,OACpB;CAEF,IAAI;AACJ,KAAI;AACF,WAAS,IAAI,IAAI,cAAc;SACzB;AACN,QAAM,IAAI,MAAM,8CAA8C;;AAEhE,KACE,OAAO,aAAa,MACpB,OAAO,aAAa,MACpB,OAAO,aAAa,OACpB,OAAO,WAAW,MAClB,OAAO,SAAS,GAEhB,OAAM,IAAI,MAAM,6EAA6E;AAE/F,uBAAsB,OAAO,OAAO;AACpC,QAAO,OAAO;;AAGhB,SAAS,qBAAqB,cAAkC,eAAmC;AACjG,KAAI,iBAAiB,OACnB;AAEF,KAAI,kBAAkB,OACpB,OAAM,IAAI,MAAM,uCAAuC;AAEzD,mBAAkB,aAAa;;AAGjC,MAAM,mBACJ,KACA,eACA,iBACkB;AAClB,uBAAsB,IAAI;CAC1B,MAAM,0BAA0B,uBAAuB,cAAc;AACrE,sBAAqB,cAAc,wBAAwB;CAC3D,MAAM,SAAS,IAAI,IAAI,IAAI;CAC3B,MAAM,YACJ,4BAA4B,UAAa,OAAO,WAAW,0BACvD,IAAI,IAAI,GAAG,0BAA0B,OAAO,WAAW,OAAO,SAAS,GACvE;AACN,uBAAsB,UAAU,UAAU,CAAC;CAC3C,MAAM,UAAU,IAAI,SAAS;AAC7B,KAAI,4BAA4B,UAAa,iBAAiB,OAC5D,SAAQ,IAAI,QAAQ,aAAa;AAEnC,QAAO;EAAE,KAAK;EAAW;EAAS;;;AAIpC,MAAa,uBAAuB,eAAe;CACjD,MAAM;CACN,SAAS;CACT,SAAS,OAAO,MAAM,EAAE,KAAK,eAAe,mBAAmB;EAC7D,MAAM,MAAM,gBAAgB,KAAK,eAAe,aAAa;EAC7D,MAAM,WAAW,MAAM,MAAM,IAAI,KAAK;GACpC,SAAS,IAAI;GACb,UAAU;GACV,QAAQ,YAAY,QAAQ,IAAO;GACpC,CAAC;AACF,MAAI,CAAC,SAAS,GACZ,OAAM,IAAI,MAAM,QAAQ,SAAS,OAAO,YAAY,MAAM;AAE5D,SAAO,uBAAuB,MAAM,SAAS,MAAM,CAAC;;CAEvD,CAAC;;AAGF,MAAa,cAAc,eAAe;CACxC,MAAM;CACN,SAAS,EAAE,QAAQ;CACnB,SAAS,OAAO,MAAM,EAAE,KAAK,eAAe,mBAAmB;EAC7D,MAAM,MAAM,gBAAgB,KAAK,eAAe,aAAa;EAC7D,MAAM,WAAW,MAAM,MAAM,IAAI,KAAK;GACpC,SAAS,IAAI;GACb,UAAU;GACV,QAAQ,YAAY,QAAQ,KAAO;GACpC,CAAC;AACF,MAAI,CAAC,SAAS,GACZ,OAAM,IAAI,MAAM,QAAQ,SAAS,OAAO,YAAY,MAAM;AAE5D,SAAO,MAAM,SAAS,MAAM;;CAE/B,CAAC;AAEF,MAAM,WAAW,OAAU;AAC3B,MAAM,YAAY,IAAI;AACtB,MAAM,UAAU,KAAK;AAErB,MAAM,qBAAqB,IAAI,YAAY,WAAW,sBAAsB;CAC1E,QAAQ;CACR,MAAM;CACN,KAAK;CACN,CAAC;AAEF,MAAM,2BAA2B,IAAI,YAAY,WAAW,sBAAsB;CAChF,QAAQ;CACR,MAAM;CACN,KAAK;CACN,CAAC;AAEF,MAAM,oBAAoB,IAAI,YAAY,WAAW,sBAAsB;CACzE,QAAQ;CACR,MAAM;CACN,KAAK;CACN,CAAC;;;;AAKF,MAAa,gBAAgB,OAAO;CAClC,MAAM;CACN,SAAS;CACT,SAAS,OAAO,KAAK,SAAS;AAC5B,SAAO,MAAM,mBAAmB,MAAM,iBAAiB,IAAI,EAAE,KAAK;;CAErE,CAAC;;;;;;AAOF,MAAa,sBAAsB,OAAO;CACxC,MAAM;CACN,SAAS;CACT,SAAS,OAAO,KAAK,SAAS;AAC5B,SAAO,MAAM,yBAAyB,MAAM,iBAAiB,IAAI,EAAE,KAAK;;CAE3E,CAAC;;;;AAKF,MAAa,eAAe,OAAO;CACjC,MAAM;CACN,SAAS,EAAE,QAAQ;CACnB,SAAS,OAAO,KAAK,SAAS;AAC5B,SAAO,MAAM,kBAAkB,MAAM,iBAAiB,IAAI,EAAE,KAAK;;CAEpE,CAAC;;AAGF,MAAa,0BAA0B,SAAS;CAC9C,MAAM;CACN,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,SAAS;AAC5B,QAAM,mBAAmB,OAAO,KAAK,KAAK;AAC1C,QAAM,yBAAyB,OAAO,KAAK,KAAK;AAChD,SAAO;;CAEV,CAAC;;AAGF,MAAa,yBAAyB,SAAS;CAC7C,MAAM;CACN,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,SAAS;AAC5B,QAAM,kBAAkB,OAAO,KAAK,KAAK;AACzC,SAAO;;CAEV,CAAC"}

package/dist/component/connection/domain/verification.d.ts

@@ -1,5 +1,5 @@
-import * as convex_values2797 from "convex/values";
-import * as convex_server193 from "convex/server";
+import * as convex_values1833 from "convex/values";
+import * as convex_server169 from "convex/server";
 
 //#region src/component/connection/domain/verification.d.ts
 declare namespace verification_d_exports {
@@ -12,36 +12,36 @@ declare namespace verification_d_exports {
  * @module
  */
 /** Read a domain's verification record by `domainId`, or `null` if none. */
-declare const get: convex_server193.RegisteredQuery<"public", {
-  domainId: convex_values2797.GenericId<"GroupConnectionDomain">;
+declare const get: convex_server169.RegisteredQuery<"public", {
+  domainId: convex_values1833.GenericId<"GroupConnectionDomain">;
 }, Promise<{
-  _id: convex_values2797.GenericId<"GroupConnectionDomainVerification">;
+  _id: convex_values1833.GenericId<"GroupConnectionDomainVerification">;
   _creationTime: number;
-  connectionId: convex_values2797.GenericId<"GroupConnection">;
-  expiresAt: number;
-  groupId: convex_values2797.GenericId<"Group">;
-  tokenHash: string;
+  connectionId: convex_values1833.GenericId<"GroupConnection">;
   domain: string;
-  domainId: convex_values2797.GenericId<"GroupConnectionDomain">;
   recordName: string;
+  expiresAt: number;
+  groupId: convex_values1833.GenericId<"Group">;
+  tokenHash: string;
+  domainId: convex_values1833.GenericId<"GroupConnectionDomain">;
   token: string;
   requestedAt: number;
 } | null>>;
 /** Insert a verification record, or patch it when one already exists for the domain (keyed by `domainId`). */
-declare const upsert: convex_server193.RegisteredMutation<"public", {
-  connectionId: convex_values2797.GenericId<"GroupConnection">;
-  expiresAt: number;
-  groupId: convex_values2797.GenericId<"Group">;
-  tokenHash: string;
+declare const upsert: convex_server169.RegisteredMutation<"public", {
+  connectionId: convex_values1833.GenericId<"GroupConnection">;
   domain: string;
-  domainId: convex_values2797.GenericId<"GroupConnectionDomain">;
   recordName: string;
+  expiresAt: number;
+  groupId: convex_values1833.GenericId<"Group">;
+  tokenHash: string;
+  domainId: convex_values1833.GenericId<"GroupConnectionDomain">;
   token: string;
   requestedAt: number;
-}, Promise<convex_values2797.GenericId<"GroupConnectionDomainVerification">>>;
+}, Promise<convex_values1833.GenericId<"GroupConnectionDomainVerification">>>;
 /** Delete a domain's verification record, if any. */
-declare const remove: convex_server193.RegisteredMutation<"public", {
-  domainId: convex_values2797.GenericId<"GroupConnectionDomain">;
+declare const remove: convex_server169.RegisteredMutation<"public", {
+  domainId: convex_values1833.GenericId<"GroupConnectionDomain">;
 }, Promise<null>>;
 //#endregion
 export { verification_d_exports };

package/dist/component/connection/domain/verification.js

@@ -1,6 +1,5 @@
-import { vGroupConnectionDomainVerificationDoc } from "../../model.js";
 import { mutation, query } from "../../_generated/server.js";
-import "../../functions.js";
+import { vGroupConnectionDomainVerificationDoc } from "../../documents.js";
 import { v } from "convex/values";
 
 //#region src/component/connection/domain/verification.ts

package/dist/component/connection/domain/verification.js.map

@@ -1 +1 @@
-{"version":3,"file":"verification.js","names":[],"sources":["../../../../src/component/connection/domain/verification.ts"],"sourcesContent":["/**\n * `component.connection.domain.verification.*` — domain\n * ownership-proof records (sub-resource of connection.domain).\n *\n * @module\n */\n\nimport { v } from \"convex/values\";\n\nimport { mutation, query } from \"../../functions\";\nimport { vGroupConnectionDomainVerificationDoc } from \"../../model\";\n\n/** Read a domain's verification record by `domainId`, or `null` if none. */\nexport const get = query({\n  args: { domainId: v.id(\"GroupConnectionDomain\") },\n  returns: v.union(vGroupConnectionDomainVerificationDoc, v.null()),\n  handler: async (ctx, { domainId }) => {\n    return await ctx.db\n      .query(\"GroupConnectionDomainVerification\")\n      .withIndex(\"domain_id\", (idx) => idx.eq(\"domainId\", domainId))\n      .first();\n  },\n});\n\n/** Insert a verification record, or patch it when one already exists for the domain (keyed by `domainId`). */\nexport const upsert = mutation({\n  args: {\n    connectionId: v.id(\"GroupConnection\"),\n    groupId: v.id(\"Group\"),\n    domainId: v.id(\"GroupConnectionDomain\"),\n    domain: v.string(),\n    recordName: v.string(),\n    token: v.string(),\n    tokenHash: v.string(),\n    requestedAt: v.number(),\n    expiresAt: v.number(),\n  },\n  returns: v.id(\"GroupConnectionDomainVerification\"),\n  handler: async (ctx, args) => {\n    const { connectionId, ...rest } = args;\n    const existing = await ctx.db\n      .query(\"GroupConnectionDomainVerification\")\n      .withIndex(\"domain_id\", (idx) => idx.eq(\"domainId\", args.domainId))\n      .first();\n    if (existing) {\n      await ctx.db.patch(\"GroupConnectionDomainVerification\", existing._id, {\n        connectionId: connectionId,\n        ...rest,\n      });\n      return existing._id;\n    }\n    return await ctx.db.insert(\"GroupConnectionDomainVerification\", {\n      connectionId: connectionId,\n      ...rest,\n    });\n  },\n});\n\n/** Delete a domain's verification record, if any. */\nconst remove = mutation({\n  args: { domainId: v.id(\"GroupConnectionDomain\") },\n  returns: v.null(),\n  handler: async (ctx, { domainId }) => {\n    const existing = await ctx.db\n      .query(\"GroupConnectionDomainVerification\")\n      .withIndex(\"domain_id\", (idx) => idx.eq(\"domainId\", domainId))\n      .first();\n    if (existing) {\n      await ctx.db.delete(\"GroupConnectionDomainVerification\", existing._id);\n    }\n    return null;\n  },\n});\n\nexport { remove };\n"],"mappings":";;;;;;;;;;;;;AAaA,MAAa,MAAM,MAAM;CACvB,MAAM,EAAE,UAAU,EAAE,GAAG,wBAAwB,EAAE;CACjD,SAAS,EAAE,MAAM,uCAAuC,EAAE,MAAM,CAAC;CACjE,SAAS,OAAO,KAAK,EAAE,eAAe;AACpC,SAAO,MAAM,IAAI,GACd,MAAM,oCAAoC,CAC1C,UAAU,cAAc,QAAQ,IAAI,GAAG,YAAY,SAAS,CAAC,CAC7D,OAAO;;CAEb,CAAC;;AAGF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,cAAc,EAAE,GAAG,kBAAkB;EACrC,SAAS,EAAE,GAAG,QAAQ;EACtB,UAAU,EAAE,GAAG,wBAAwB;EACvC,QAAQ,EAAE,QAAQ;EAClB,YAAY,EAAE,QAAQ;EACtB,OAAO,EAAE,QAAQ;EACjB,WAAW,EAAE,QAAQ;EACrB,aAAa,EAAE,QAAQ;EACvB,WAAW,EAAE,QAAQ;EACtB;CACD,SAAS,EAAE,GAAG,oCAAoC;CAClD,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,EAAE,cAAc,GAAG,SAAS;EAClC,MAAM,WAAW,MAAM,IAAI,GACxB,MAAM,oCAAoC,CAC1C,UAAU,cAAc,QAAQ,IAAI,GAAG,YAAY,KAAK,SAAS,CAAC,CAClE,OAAO;AACV,MAAI,UAAU;AACZ,SAAM,IAAI,GAAG,MAAM,qCAAqC,SAAS,KAAK;IACtD;IACd,GAAG;IACJ,CAAC;AACF,UAAO,SAAS;;AAElB,SAAO,MAAM,IAAI,GAAG,OAAO,qCAAqC;GAChD;GACd,GAAG;GACJ,CAAC;;CAEL,CAAC;;AAGF,MAAM,SAAS,SAAS;CACtB,MAAM,EAAE,UAAU,EAAE,GAAG,wBAAwB,EAAE;CACjD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,eAAe;EACpC,MAAM,WAAW,MAAM,IAAI,GACxB,MAAM,oCAAoC,CAC1C,UAAU,cAAc,QAAQ,IAAI,GAAG,YAAY,SAAS,CAAC,CAC7D,OAAO;AACV,MAAI,SACF,OAAM,IAAI,GAAG,OAAO,qCAAqC,SAAS,IAAI;AAExE,SAAO;;CAEV,CAAC"}
+{"version":3,"file":"verification.js","names":[],"sources":["../../../../src/component/connection/domain/verification.ts"],"sourcesContent":["/**\n * `component.connection.domain.verification.*` — domain\n * ownership-proof records (sub-resource of connection.domain).\n *\n * @module\n */\n\nimport { v } from \"convex/values\";\n\nimport { mutation, query } from \"../../_generated/server\";\nimport { vGroupConnectionDomainVerificationDoc } from \"../../documents\";\n\n/** Read a domain's verification record by `domainId`, or `null` if none. */\nexport const get = query({\n  args: { domainId: v.id(\"GroupConnectionDomain\") },\n  returns: v.union(vGroupConnectionDomainVerificationDoc, v.null()),\n  handler: async (ctx, { domainId }) => {\n    return await ctx.db\n      .query(\"GroupConnectionDomainVerification\")\n      .withIndex(\"domain_id\", (idx) => idx.eq(\"domainId\", domainId))\n      .first();\n  },\n});\n\n/** Insert a verification record, or patch it when one already exists for the domain (keyed by `domainId`). */\nexport const upsert = mutation({\n  args: {\n    connectionId: v.id(\"GroupConnection\"),\n    groupId: v.id(\"Group\"),\n    domainId: v.id(\"GroupConnectionDomain\"),\n    domain: v.string(),\n    recordName: v.string(),\n    token: v.string(),\n    tokenHash: v.string(),\n    requestedAt: v.number(),\n    expiresAt: v.number(),\n  },\n  returns: v.id(\"GroupConnectionDomainVerification\"),\n  handler: async (ctx, args) => {\n    const { connectionId, ...rest } = args;\n    const existing = await ctx.db\n      .query(\"GroupConnectionDomainVerification\")\n      .withIndex(\"domain_id\", (idx) => idx.eq(\"domainId\", args.domainId))\n      .first();\n    if (existing) {\n      await ctx.db.patch(\"GroupConnectionDomainVerification\", existing._id, {\n        connectionId: connectionId,\n        ...rest,\n      });\n      return existing._id;\n    }\n    return await ctx.db.insert(\"GroupConnectionDomainVerification\", {\n      connectionId: connectionId,\n      ...rest,\n    });\n  },\n});\n\n/** Delete a domain's verification record, if any. */\nconst remove = mutation({\n  args: { domainId: v.id(\"GroupConnectionDomain\") },\n  returns: v.null(),\n  handler: async (ctx, { domainId }) => {\n    const existing = await ctx.db\n      .query(\"GroupConnectionDomainVerification\")\n      .withIndex(\"domain_id\", (idx) => idx.eq(\"domainId\", domainId))\n      .first();\n    if (existing) {\n      await ctx.db.delete(\"GroupConnectionDomainVerification\", existing._id);\n    }\n    return null;\n  },\n});\n\nexport { remove };\n"],"mappings":";;;;;;;;;;;;AAaA,MAAa,MAAM,MAAM;CACvB,MAAM,EAAE,UAAU,EAAE,GAAG,wBAAwB,EAAE;CACjD,SAAS,EAAE,MAAM,uCAAuC,EAAE,MAAM,CAAC;CACjE,SAAS,OAAO,KAAK,EAAE,eAAe;AACpC,SAAO,MAAM,IAAI,GACd,MAAM,oCAAoC,CAC1C,UAAU,cAAc,QAAQ,IAAI,GAAG,YAAY,SAAS,CAAC,CAC7D,OAAO;;CAEb,CAAC;;AAGF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,cAAc,EAAE,GAAG,kBAAkB;EACrC,SAAS,EAAE,GAAG,QAAQ;EACtB,UAAU,EAAE,GAAG,wBAAwB;EACvC,QAAQ,EAAE,QAAQ;EAClB,YAAY,EAAE,QAAQ;EACtB,OAAO,EAAE,QAAQ;EACjB,WAAW,EAAE,QAAQ;EACrB,aAAa,EAAE,QAAQ;EACvB,WAAW,EAAE,QAAQ;EACtB;CACD,SAAS,EAAE,GAAG,oCAAoC;CAClD,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,EAAE,cAAc,GAAG,SAAS;EAClC,MAAM,WAAW,MAAM,IAAI,GACxB,MAAM,oCAAoC,CAC1C,UAAU,cAAc,QAAQ,IAAI,GAAG,YAAY,KAAK,SAAS,CAAC,CAClE,OAAO;AACV,MAAI,UAAU;AACZ,SAAM,IAAI,GAAG,MAAM,qCAAqC,SAAS,KAAK;IACtD;IACd,GAAG;IACJ,CAAC;AACF,UAAO,SAAS;;AAElB,SAAO,MAAM,IAAI,GAAG,OAAO,qCAAqC;GAChD;GACd,GAAG;GACJ,CAAC;;CAEL,CAAC;;AAGF,MAAM,SAAS,SAAS;CACtB,MAAM,EAAE,UAAU,EAAE,GAAG,wBAAwB,EAAE;CACjD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,eAAe;EACpC,MAAM,WAAW,MAAM,IAAI,GACxB,MAAM,oCAAoC,CAC1C,UAAU,cAAc,QAAQ,IAAI,GAAG,YAAY,SAAS,CAAC,CAC7D,OAAO;AACV,MAAI,SACF,OAAM,IAAI,GAAG,OAAO,qCAAqC,SAAS,IAAI;AAExE,SAAO;;CAEV,CAAC"}