@estifanos-sh/convex-auth 0.0.2 → 0.0.4

package/dist/component/connection/domain.d.ts

@@ -1,5 +1,5 @@
-import * as convex_values2785 from "convex/values";
-import * as convex_server189 from "convex/server";
+import * as convex_values1821 from "convex/values";
+import * as convex_server165 from "convex/server";
 
 //#region src/component/connection/domain.d.ts
 declare namespace domain_d_exports {
@@ -15,17 +15,17 @@ declare namespace domain_d_exports {
  * @module
  */
 /** List the domains attached to a connection (`limit` clamped to 1..500, default 100). */
-declare const list: convex_server189.RegisteredQuery<"public", {
+declare const list: convex_server165.RegisteredQuery<"public", {
   limit?: number | undefined;
-  connectionId: convex_values2785.GenericId<"GroupConnection">;
+  connectionId: convex_values1821.GenericId<"GroupConnection">;
 }, Promise<{
-  _id: convex_values2785.GenericId<"GroupConnectionDomain">;
+  _id: convex_values1821.GenericId<"GroupConnectionDomain">;
   _creationTime: number;
   verifiedAt?: number | undefined;
-  isPrimary: boolean;
-  connectionId: convex_values2785.GenericId<"GroupConnection">;
-  groupId: convex_values2785.GenericId<"Group">;
+  connectionId: convex_values1821.GenericId<"GroupConnection">;
   domain: string;
+  groupId: convex_values1821.GenericId<"Group">;
+  isPrimary: boolean;
 }[]>>;
 /**
  * Attach a domain to a connection. Idempotent on `(connectionId, domain)`:
@@ -33,31 +33,31 @@ declare const list: convex_server189.RegisteredQuery<"public", {
  * domain already belongs to a different connection. Setting `isPrimary` demotes
  * any current primary; the first domain on a connection becomes primary by default.
  */
-declare const create: convex_server189.RegisteredMutation<"public", {
+declare const create: convex_server165.RegisteredMutation<"public", {
   isPrimary?: boolean | undefined;
-  connectionId: convex_values2785.GenericId<"GroupConnection">;
-  groupId: convex_values2785.GenericId<"Group">;
+  connectionId: convex_values1821.GenericId<"GroupConnection">;
   domain: string;
-}, Promise<convex_values2785.GenericId<"GroupConnectionDomain">>>;
+  groupId: convex_values1821.GenericId<"Group">;
+}, Promise<convex_values1821.GenericId<"GroupConnectionDomain">>>;
 /** Delete a domain and its dependent verification record, if any. */
-declare const remove: convex_server189.RegisteredMutation<"public", {
-  id: convex_values2785.GenericId<"GroupConnectionDomain">;
+declare const remove: convex_server165.RegisteredMutation<"public", {
+  id: convex_values1821.GenericId<"GroupConnectionDomain">;
 }, Promise<null>>;
 /**
  * Mark a domain verified at `verifiedAt` and clear its pending verification
  * record. Returns the updated domain doc.
  */
-declare const verify: convex_server189.RegisteredMutation<"public", {
-  id: convex_values2785.GenericId<"GroupConnectionDomain">;
+declare const verify: convex_server165.RegisteredMutation<"public", {
+  id: convex_values1821.GenericId<"GroupConnectionDomain">;
   verifiedAt: number;
 }, Promise<{
-  _id: convex_values2785.GenericId<"GroupConnectionDomain">;
+  _id: convex_values1821.GenericId<"GroupConnectionDomain">;
   _creationTime: number;
   verifiedAt?: number | undefined;
-  isPrimary: boolean;
-  connectionId: convex_values2785.GenericId<"GroupConnection">;
-  groupId: convex_values2785.GenericId<"Group">;
+  connectionId: convex_values1821.GenericId<"GroupConnection">;
   domain: string;
+  groupId: convex_values1821.GenericId<"Group">;
+  isPrimary: boolean;
 }>>;
 //#endregion
 export { domain_d_exports };

package/dist/component/connection/domain.js

@@ -1,7 +1,6 @@
 import { ErrorCode } from "../../shared/codes.js";
-import { vGroupConnectionDomainDoc } from "../model.js";
 import { mutation, query } from "../_generated/server.js";
-import "../functions.js";
+import { vGroupConnectionDomainDoc } from "../documents.js";
 import { ConvexError, v } from "convex/values";
 
 //#region src/component/connection/domain.ts

package/dist/component/connection/domain.js.map

@@ -1 +1 @@
-{"version":3,"file":"domain.js","names":[],"sources":["../../../src/component/connection/domain.ts"],"sourcesContent":["/**\n * `component.connection.domain.*` — domains linked to an Connection\n * connection (sub-resource of connection).\n *\n * `verify` is a kept domain verb (ownership-proof\n * workflow); ownership-record CRUD nests under `domain.verification`.\n *\n * @module\n */\n\nimport { ConvexError, v } from \"convex/values\";\nimport { ErrorCode } from \"../../shared/codes\";\n\nimport { mutation, query } from \"../functions\";\nimport { vGroupConnectionDomainDoc } from \"../model\";\n\nconst CONNECTION_DOMAIN_BATCH = 500;\n\n/** List the domains attached to a connection (`limit` clamped to 1..500, default 100). */\nexport const list = query({\n  args: {\n    connectionId: v.id(\"GroupConnection\"),\n    limit: v.optional(v.number()),\n  },\n  returns: v.array(vGroupConnectionDomainDoc),\n  handler: async (ctx, { connectionId, limit }) => {\n    const bounded = Math.min(Math.max(limit ?? 100, 1), 500);\n    return await ctx.db\n      .query(\"GroupConnectionDomain\")\n      .withIndex(\"connection_id\", (idx) => idx.eq(\"connectionId\", connectionId))\n      .take(bounded);\n  },\n});\n\n/**\n * Attach a domain to a connection. Idempotent on `(connectionId, domain)`:\n * re-attaching patches the existing row instead of inserting. Throws if the\n * domain already belongs to a different connection. Setting `isPrimary` demotes\n * any current primary; the first domain on a connection becomes primary by default.\n */\nexport const create = mutation({\n  args: {\n    connectionId: v.id(\"GroupConnection\"),\n    groupId: v.id(\"Group\"),\n    domain: v.string(),\n    isPrimary: v.optional(v.boolean()),\n  },\n  returns: v.id(\"GroupConnectionDomain\"),\n  handler: async (ctx, args) => {\n    const { connectionId, ...rest } = args;\n    const existingByDomain = await ctx.db\n      .query(\"GroupConnectionDomain\")\n      .withIndex(\"domain\", (idx) => idx.eq(\"domain\", args.domain))\n      .first();\n    if (existingByDomain && existingByDomain.connectionId !== connectionId) {\n      throw new ConvexError({\n        code: ErrorCode.GROUP_CONNECTION_DOMAIN_TAKEN,\n        message: \"That domain is already attached to another connection.\",\n      });\n    }\n\n    const existingForConnection = await ctx.db\n      .query(\"GroupConnectionDomain\")\n      .withIndex(\"connection_id\", (q) => q.eq(\"connectionId\", connectionId))\n      .take(CONNECTION_DOMAIN_BATCH + 1);\n    if (existingForConnection.length > CONNECTION_DOMAIN_BATCH) {\n      throw new ConvexError({\n        code: ErrorCode.CASCADE_TOO_LARGE,\n        message: `Connection has more than ${CONNECTION_DOMAIN_BATCH} domains; update is not safe in one mutation.`,\n      });\n    }\n\n    for (const row of existingForConnection) {\n      if (row.domain === args.domain) {\n        if (args.isPrimary === true) {\n          for (const other of existingForConnection) {\n            if (other._id !== row._id && other.isPrimary) {\n              await ctx.db.patch(\"GroupConnectionDomain\", other._id, { isPrimary: false });\n            }\n          }\n        }\n        await ctx.db.patch(\"GroupConnectionDomain\", row._id, {\n          isPrimary: args.isPrimary ?? row.isPrimary,\n        });\n        return row._id;\n      }\n    }\n\n    if (args.isPrimary === true) {\n      for (const row of existingForConnection) {\n        if (row.isPrimary) {\n          await ctx.db.patch(\"GroupConnectionDomain\", row._id, { isPrimary: false });\n        }\n      }\n    }\n\n    return await ctx.db.insert(\"GroupConnectionDomain\", {\n      connectionId: connectionId,\n      ...rest,\n      isPrimary: args.isPrimary ?? existingForConnection.length === 0,\n    });\n  },\n});\n\n/** Delete a domain and its dependent verification record, if any. */\nconst remove = mutation({\n  args: { id: v.id(\"GroupConnectionDomain\") },\n  returns: v.null(),\n  handler: async (ctx, { id: domainId }) => {\n    const verification = await ctx.db\n      .query(\"GroupConnectionDomainVerification\")\n      .withIndex(\"domain_id\", (idx) => idx.eq(\"domainId\", domainId))\n      .first();\n    if (verification) {\n      await ctx.db.delete(\"GroupConnectionDomainVerification\", verification._id);\n    }\n    await ctx.db.delete(\"GroupConnectionDomain\", domainId);\n    return null;\n  },\n});\n\nexport { remove };\n\n/**\n * Mark a domain verified at `verifiedAt` and clear its pending verification\n * record. Returns the updated domain doc.\n */\nexport const verify = mutation({\n  args: {\n    id: v.id(\"GroupConnectionDomain\"),\n    verifiedAt: v.number(),\n  },\n  returns: vGroupConnectionDomainDoc,\n  handler: async (ctx, { id: domainId, verifiedAt }) => {\n    await ctx.db.patch(\"GroupConnectionDomain\", domainId, { verifiedAt });\n    const domain = await ctx.db.get(\"GroupConnectionDomain\", domainId);\n    if (!domain) {\n      throw new ConvexError({\n        code: ErrorCode.INVALID_PARAMETERS,\n        message: \"Group Connection domain not found.\",\n      });\n    }\n    const verification = await ctx.db\n      .query(\"GroupConnectionDomainVerification\")\n      .withIndex(\"domain_id\", (idx) => idx.eq(\"domainId\", domainId))\n      .first();\n    if (verification) {\n      await ctx.db.delete(\"GroupConnectionDomainVerification\", verification._id);\n    }\n    return domain;\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;AAgBA,MAAM,0BAA0B;;AAGhC,MAAa,OAAO,MAAM;CACxB,MAAM;EACJ,cAAc,EAAE,GAAG,kBAAkB;EACrC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC9B;CACD,SAAS,EAAE,MAAM,0BAA0B;CAC3C,SAAS,OAAO,KAAK,EAAE,cAAc,YAAY;EAC/C,MAAM,UAAU,KAAK,IAAI,KAAK,IAAI,SAAS,KAAK,EAAE,EAAE,IAAI;AACxD,SAAO,MAAM,IAAI,GACd,MAAM,wBAAwB,CAC9B,UAAU,kBAAkB,QAAQ,IAAI,GAAG,gBAAgB,aAAa,CAAC,CACzE,KAAK,QAAQ;;CAEnB,CAAC;;;;;;;AAQF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,cAAc,EAAE,GAAG,kBAAkB;EACrC,SAAS,EAAE,GAAG,QAAQ;EACtB,QAAQ,EAAE,QAAQ;EAClB,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC;EACnC;CACD,SAAS,EAAE,GAAG,wBAAwB;CACtC,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,EAAE,cAAc,GAAG,SAAS;EAClC,MAAM,mBAAmB,MAAM,IAAI,GAChC,MAAM,wBAAwB,CAC9B,UAAU,WAAW,QAAQ,IAAI,GAAG,UAAU,KAAK,OAAO,CAAC,CAC3D,OAAO;AACV,MAAI,oBAAoB,iBAAiB,iBAAiB,aACxD,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS;GACV,CAAC;EAGJ,MAAM,wBAAwB,MAAM,IAAI,GACrC,MAAM,wBAAwB,CAC9B,UAAU,kBAAkB,MAAM,EAAE,GAAG,gBAAgB,aAAa,CAAC,CACrE,KAAK,0BAA0B,EAAE;AACpC,MAAI,sBAAsB,SAAS,wBACjC,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS,4BAA4B,wBAAwB;GAC9D,CAAC;AAGJ,OAAK,MAAM,OAAO,sBAChB,KAAI,IAAI,WAAW,KAAK,QAAQ;AAC9B,OAAI,KAAK,cAAc,MACrB;SAAK,MAAM,SAAS,sBAClB,KAAI,MAAM,QAAQ,IAAI,OAAO,MAAM,UACjC,OAAM,IAAI,GAAG,MAAM,yBAAyB,MAAM,KAAK,EAAE,WAAW,OAAO,CAAC;;AAIlF,SAAM,IAAI,GAAG,MAAM,yBAAyB,IAAI,KAAK,EACnD,WAAW,KAAK,aAAa,IAAI,WAClC,CAAC;AACF,UAAO,IAAI;;AAIf,MAAI,KAAK,cAAc,MACrB;QAAK,MAAM,OAAO,sBAChB,KAAI,IAAI,UACN,OAAM,IAAI,GAAG,MAAM,yBAAyB,IAAI,KAAK,EAAE,WAAW,OAAO,CAAC;;AAKhF,SAAO,MAAM,IAAI,GAAG,OAAO,yBAAyB;GACpC;GACd,GAAG;GACH,WAAW,KAAK,aAAa,sBAAsB,WAAW;GAC/D,CAAC;;CAEL,CAAC;;AAGF,MAAM,SAAS,SAAS;CACtB,MAAM,EAAE,IAAI,EAAE,GAAG,wBAAwB,EAAE;CAC3C,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,IAAI,eAAe;EACxC,MAAM,eAAe,MAAM,IAAI,GAC5B,MAAM,oCAAoC,CAC1C,UAAU,cAAc,QAAQ,IAAI,GAAG,YAAY,SAAS,CAAC,CAC7D,OAAO;AACV,MAAI,aACF,OAAM,IAAI,GAAG,OAAO,qCAAqC,aAAa,IAAI;AAE5E,QAAM,IAAI,GAAG,OAAO,yBAAyB,SAAS;AACtD,SAAO;;CAEV,CAAC;;;;;AAQF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,IAAI,EAAE,GAAG,wBAAwB;EACjC,YAAY,EAAE,QAAQ;EACvB;CACD,SAAS;CACT,SAAS,OAAO,KAAK,EAAE,IAAI,UAAU,iBAAiB;AACpD,QAAM,IAAI,GAAG,MAAM,yBAAyB,UAAU,EAAE,YAAY,CAAC;EACrE,MAAM,SAAS,MAAM,IAAI,GAAG,IAAI,yBAAyB,SAAS;AAClE,MAAI,CAAC,OACH,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS;GACV,CAAC;EAEJ,MAAM,eAAe,MAAM,IAAI,GAC5B,MAAM,oCAAoC,CAC1C,UAAU,cAAc,QAAQ,IAAI,GAAG,YAAY,SAAS,CAAC,CAC7D,OAAO;AACV,MAAI,aACF,OAAM,IAAI,GAAG,OAAO,qCAAqC,aAAa,IAAI;AAE5E,SAAO;;CAEV,CAAC"}
+{"version":3,"file":"domain.js","names":[],"sources":["../../../src/component/connection/domain.ts"],"sourcesContent":["/**\n * `component.connection.domain.*` — domains linked to an Connection\n * connection (sub-resource of connection).\n *\n * `verify` is a kept domain verb (ownership-proof\n * workflow); ownership-record CRUD nests under `domain.verification`.\n *\n * @module\n */\n\nimport { ConvexError, v } from \"convex/values\";\nimport { ErrorCode } from \"../../shared/codes\";\n\nimport { mutation, query } from \"../_generated/server\";\nimport { vGroupConnectionDomainDoc } from \"../documents\";\n\nconst CONNECTION_DOMAIN_BATCH = 500;\n\n/** List the domains attached to a connection (`limit` clamped to 1..500, default 100). */\nexport const list = query({\n  args: {\n    connectionId: v.id(\"GroupConnection\"),\n    limit: v.optional(v.number()),\n  },\n  returns: v.array(vGroupConnectionDomainDoc),\n  handler: async (ctx, { connectionId, limit }) => {\n    const bounded = Math.min(Math.max(limit ?? 100, 1), 500);\n    return await ctx.db\n      .query(\"GroupConnectionDomain\")\n      .withIndex(\"connection_id\", (idx) => idx.eq(\"connectionId\", connectionId))\n      .take(bounded);\n  },\n});\n\n/**\n * Attach a domain to a connection. Idempotent on `(connectionId, domain)`:\n * re-attaching patches the existing row instead of inserting. Throws if the\n * domain already belongs to a different connection. Setting `isPrimary` demotes\n * any current primary; the first domain on a connection becomes primary by default.\n */\nexport const create = mutation({\n  args: {\n    connectionId: v.id(\"GroupConnection\"),\n    groupId: v.id(\"Group\"),\n    domain: v.string(),\n    isPrimary: v.optional(v.boolean()),\n  },\n  returns: v.id(\"GroupConnectionDomain\"),\n  handler: async (ctx, args) => {\n    const { connectionId, ...rest } = args;\n    const existingByDomain = await ctx.db\n      .query(\"GroupConnectionDomain\")\n      .withIndex(\"domain\", (idx) => idx.eq(\"domain\", args.domain))\n      .first();\n    if (existingByDomain && existingByDomain.connectionId !== connectionId) {\n      throw new ConvexError({\n        code: ErrorCode.GROUP_CONNECTION_DOMAIN_TAKEN,\n        message: \"That domain is already attached to another connection.\",\n      });\n    }\n\n    const existingForConnection = await ctx.db\n      .query(\"GroupConnectionDomain\")\n      .withIndex(\"connection_id\", (q) => q.eq(\"connectionId\", connectionId))\n      .take(CONNECTION_DOMAIN_BATCH + 1);\n    if (existingForConnection.length > CONNECTION_DOMAIN_BATCH) {\n      throw new ConvexError({\n        code: ErrorCode.CASCADE_TOO_LARGE,\n        message: `Connection has more than ${CONNECTION_DOMAIN_BATCH} domains; update is not safe in one mutation.`,\n      });\n    }\n\n    for (const row of existingForConnection) {\n      if (row.domain === args.domain) {\n        if (args.isPrimary === true) {\n          for (const other of existingForConnection) {\n            if (other._id !== row._id && other.isPrimary) {\n              await ctx.db.patch(\"GroupConnectionDomain\", other._id, { isPrimary: false });\n            }\n          }\n        }\n        await ctx.db.patch(\"GroupConnectionDomain\", row._id, {\n          isPrimary: args.isPrimary ?? row.isPrimary,\n        });\n        return row._id;\n      }\n    }\n\n    if (args.isPrimary === true) {\n      for (const row of existingForConnection) {\n        if (row.isPrimary) {\n          await ctx.db.patch(\"GroupConnectionDomain\", row._id, { isPrimary: false });\n        }\n      }\n    }\n\n    return await ctx.db.insert(\"GroupConnectionDomain\", {\n      connectionId: connectionId,\n      ...rest,\n      isPrimary: args.isPrimary ?? existingForConnection.length === 0,\n    });\n  },\n});\n\n/** Delete a domain and its dependent verification record, if any. */\nconst remove = mutation({\n  args: { id: v.id(\"GroupConnectionDomain\") },\n  returns: v.null(),\n  handler: async (ctx, { id: domainId }) => {\n    const verification = await ctx.db\n      .query(\"GroupConnectionDomainVerification\")\n      .withIndex(\"domain_id\", (idx) => idx.eq(\"domainId\", domainId))\n      .first();\n    if (verification) {\n      await ctx.db.delete(\"GroupConnectionDomainVerification\", verification._id);\n    }\n    await ctx.db.delete(\"GroupConnectionDomain\", domainId);\n    return null;\n  },\n});\n\nexport { remove };\n\n/**\n * Mark a domain verified at `verifiedAt` and clear its pending verification\n * record. Returns the updated domain doc.\n */\nexport const verify = mutation({\n  args: {\n    id: v.id(\"GroupConnectionDomain\"),\n    verifiedAt: v.number(),\n  },\n  returns: vGroupConnectionDomainDoc,\n  handler: async (ctx, { id: domainId, verifiedAt }) => {\n    await ctx.db.patch(\"GroupConnectionDomain\", domainId, { verifiedAt });\n    const domain = await ctx.db.get(\"GroupConnectionDomain\", domainId);\n    if (!domain) {\n      throw new ConvexError({\n        code: ErrorCode.INVALID_PARAMETERS,\n        message: \"Group Connection domain not found.\",\n      });\n    }\n    const verification = await ctx.db\n      .query(\"GroupConnectionDomainVerification\")\n      .withIndex(\"domain_id\", (idx) => idx.eq(\"domainId\", domainId))\n      .first();\n    if (verification) {\n      await ctx.db.delete(\"GroupConnectionDomainVerification\", verification._id);\n    }\n    return domain;\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;AAgBA,MAAM,0BAA0B;;AAGhC,MAAa,OAAO,MAAM;CACxB,MAAM;EACJ,cAAc,EAAE,GAAG,kBAAkB;EACrC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC9B;CACD,SAAS,EAAE,MAAM,0BAA0B;CAC3C,SAAS,OAAO,KAAK,EAAE,cAAc,YAAY;EAC/C,MAAM,UAAU,KAAK,IAAI,KAAK,IAAI,SAAS,KAAK,EAAE,EAAE,IAAI;AACxD,SAAO,MAAM,IAAI,GACd,MAAM,wBAAwB,CAC9B,UAAU,kBAAkB,QAAQ,IAAI,GAAG,gBAAgB,aAAa,CAAC,CACzE,KAAK,QAAQ;;CAEnB,CAAC;;;;;;;AAQF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,cAAc,EAAE,GAAG,kBAAkB;EACrC,SAAS,EAAE,GAAG,QAAQ;EACtB,QAAQ,EAAE,QAAQ;EAClB,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC;EACnC;CACD,SAAS,EAAE,GAAG,wBAAwB;CACtC,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,EAAE,cAAc,GAAG,SAAS;EAClC,MAAM,mBAAmB,MAAM,IAAI,GAChC,MAAM,wBAAwB,CAC9B,UAAU,WAAW,QAAQ,IAAI,GAAG,UAAU,KAAK,OAAO,CAAC,CAC3D,OAAO;AACV,MAAI,oBAAoB,iBAAiB,iBAAiB,aACxD,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS;GACV,CAAC;EAGJ,MAAM,wBAAwB,MAAM,IAAI,GACrC,MAAM,wBAAwB,CAC9B,UAAU,kBAAkB,MAAM,EAAE,GAAG,gBAAgB,aAAa,CAAC,CACrE,KAAK,0BAA0B,EAAE;AACpC,MAAI,sBAAsB,SAAS,wBACjC,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS,4BAA4B,wBAAwB;GAC9D,CAAC;AAGJ,OAAK,MAAM,OAAO,sBAChB,KAAI,IAAI,WAAW,KAAK,QAAQ;AAC9B,OAAI,KAAK,cAAc,MACrB;SAAK,MAAM,SAAS,sBAClB,KAAI,MAAM,QAAQ,IAAI,OAAO,MAAM,UACjC,OAAM,IAAI,GAAG,MAAM,yBAAyB,MAAM,KAAK,EAAE,WAAW,OAAO,CAAC;;AAIlF,SAAM,IAAI,GAAG,MAAM,yBAAyB,IAAI,KAAK,EACnD,WAAW,KAAK,aAAa,IAAI,WAClC,CAAC;AACF,UAAO,IAAI;;AAIf,MAAI,KAAK,cAAc,MACrB;QAAK,MAAM,OAAO,sBAChB,KAAI,IAAI,UACN,OAAM,IAAI,GAAG,MAAM,yBAAyB,IAAI,KAAK,EAAE,WAAW,OAAO,CAAC;;AAKhF,SAAO,MAAM,IAAI,GAAG,OAAO,yBAAyB;GACpC;GACd,GAAG;GACH,WAAW,KAAK,aAAa,sBAAsB,WAAW;GAC/D,CAAC;;CAEL,CAAC;;AAGF,MAAM,SAAS,SAAS;CACtB,MAAM,EAAE,IAAI,EAAE,GAAG,wBAAwB,EAAE;CAC3C,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,IAAI,eAAe;EACxC,MAAM,eAAe,MAAM,IAAI,GAC5B,MAAM,oCAAoC,CAC1C,UAAU,cAAc,QAAQ,IAAI,GAAG,YAAY,SAAS,CAAC,CAC7D,OAAO;AACV,MAAI,aACF,OAAM,IAAI,GAAG,OAAO,qCAAqC,aAAa,IAAI;AAE5E,QAAM,IAAI,GAAG,OAAO,yBAAyB,SAAS;AACtD,SAAO;;CAEV,CAAC;;;;;AAQF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,IAAI,EAAE,GAAG,wBAAwB;EACjC,YAAY,EAAE,QAAQ;EACvB;CACD,SAAS;CACT,SAAS,OAAO,KAAK,EAAE,IAAI,UAAU,iBAAiB;AACpD,QAAM,IAAI,GAAG,MAAM,yBAAyB,UAAU,EAAE,YAAY,CAAC;EACrE,MAAM,SAAS,MAAM,IAAI,GAAG,IAAI,yBAAyB,SAAS;AAClE,MAAI,CAAC,OACH,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS;GACV,CAAC;EAEJ,MAAM,eAAe,MAAM,IAAI,GAC5B,MAAM,oCAAoC,CAC1C,UAAU,cAAc,QAAQ,IAAI,GAAG,YAAY,SAAS,CAAC,CAC7D,OAAO;AACV,MAAI,aACF,OAAM,IAAI,GAAG,OAAO,qCAAqC,aAAa,IAAI;AAE5E,SAAO;;CAEV,CAAC"}

package/dist/component/connection/saml/assertion.d.ts

@@ -1,5 +1,5 @@
-import * as convex_values2784 from "convex/values";
-import * as convex_server188 from "convex/server";
+import * as convex_values1820 from "convex/values";
+import * as convex_server164 from "convex/server";
 
 //#region src/component/connection/saml/assertion.d.ts
 declare namespace assertion_d_exports {
@@ -21,8 +21,8 @@ declare namespace assertion_d_exports {
  * first sighting (the row is inserted); returns `false` if the assertion ID was
  * already recorded, signalling a replay the caller must reject.
  */
-declare const accept: convex_server188.RegisteredMutation<"public", {
-  connectionId: convex_values2784.GenericId<"GroupConnection">;
+declare const accept: convex_server164.RegisteredMutation<"public", {
+  connectionId: convex_values1820.GenericId<"GroupConnection">;
   expiresAt: number;
   assertionId: string;
 }, Promise<boolean>>;

package/dist/component/connection/saml/assertion.js

@@ -1,5 +1,4 @@
 import { mutation } from "../../_generated/server.js";
-import "../../functions.js";
 import { v } from "convex/values";
 
 //#region src/component/connection/saml/assertion.ts

package/dist/component/connection/saml/assertion.js.map

@@ -1 +1 @@
-{"version":3,"file":"assertion.js","names":[],"sources":["../../../../src/component/connection/saml/assertion.ts"],"sourcesContent":["/**\n * `component.connection.saml.assertion.*` — bounded replay cache of SAML\n * assertion IDs already accepted (sub-resource of connection).\n *\n * `accept` is an atomic insert-or-reject gate: it catches IdP-initiated\n * responses that carry no `InResponseTo` by rejecting an assertion ID that was\n * already seen for the connection. Rows are bounded by the assertion's\n * `NotOnOrAfter` and pruned by `expiresAt`.\n *\n * @module\n */\n\nimport { v } from \"convex/values\";\n\nimport { mutation } from \"../../functions\";\n\n/**\n * Atomically accept a SAML assertion ID for a connection. Returns `true` on\n * first sighting (the row is inserted); returns `false` if the assertion ID was\n * already recorded, signalling a replay the caller must reject.\n */\nexport const accept = mutation({\n  args: {\n    connectionId: v.id(\"GroupConnection\"),\n    assertionId: v.string(),\n    expiresAt: v.number(),\n  },\n  returns: v.boolean(),\n  handler: async (ctx, { connectionId, assertionId, expiresAt }) => {\n    const existing = await ctx.db\n      .query(\"SamlSeenAssertion\")\n      .withIndex(\"connection_id_assertion_id\", (idx) =>\n        idx.eq(\"connectionId\", connectionId).eq(\"assertionId\", assertionId),\n      )\n      .first();\n    if (existing !== null) {\n      return false;\n    }\n    await ctx.db.insert(\"SamlSeenAssertion\", { connectionId, assertionId, expiresAt });\n    return true;\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAqBA,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,cAAc,EAAE,GAAG,kBAAkB;EACrC,aAAa,EAAE,QAAQ;EACvB,WAAW,EAAE,QAAQ;EACtB;CACD,SAAS,EAAE,SAAS;CACpB,SAAS,OAAO,KAAK,EAAE,cAAc,aAAa,gBAAgB;AAOhE,MANiB,MAAM,IAAI,GACxB,MAAM,oBAAoB,CAC1B,UAAU,+BAA+B,QACxC,IAAI,GAAG,gBAAgB,aAAa,CAAC,GAAG,eAAe,YAAY,CACpE,CACA,OAAO,KACO,KACf,QAAO;AAET,QAAM,IAAI,GAAG,OAAO,qBAAqB;GAAE;GAAc;GAAa;GAAW,CAAC;AAClF,SAAO;;CAEV,CAAC"}
+{"version":3,"file":"assertion.js","names":[],"sources":["../../../../src/component/connection/saml/assertion.ts"],"sourcesContent":["/**\n * `component.connection.saml.assertion.*` — bounded replay cache of SAML\n * assertion IDs already accepted (sub-resource of connection).\n *\n * `accept` is an atomic insert-or-reject gate: it catches IdP-initiated\n * responses that carry no `InResponseTo` by rejecting an assertion ID that was\n * already seen for the connection. Rows are bounded by the assertion's\n * `NotOnOrAfter` and pruned by `expiresAt`.\n *\n * @module\n */\n\nimport { v } from \"convex/values\";\n\nimport { mutation } from \"../../_generated/server\";\n\n/**\n * Atomically accept a SAML assertion ID for a connection. Returns `true` on\n * first sighting (the row is inserted); returns `false` if the assertion ID was\n * already recorded, signalling a replay the caller must reject.\n */\nexport const accept = mutation({\n  args: {\n    connectionId: v.id(\"GroupConnection\"),\n    assertionId: v.string(),\n    expiresAt: v.number(),\n  },\n  returns: v.boolean(),\n  handler: async (ctx, { connectionId, assertionId, expiresAt }) => {\n    const existing = await ctx.db\n      .query(\"SamlSeenAssertion\")\n      .withIndex(\"connection_id_assertion_id\", (idx) =>\n        idx.eq(\"connectionId\", connectionId).eq(\"assertionId\", assertionId),\n      )\n      .first();\n    if (existing !== null) {\n      return false;\n    }\n    await ctx.db.insert(\"SamlSeenAssertion\", { connectionId, assertionId, expiresAt });\n    return true;\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAqBA,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,cAAc,EAAE,GAAG,kBAAkB;EACrC,aAAa,EAAE,QAAQ;EACvB,WAAW,EAAE,QAAQ;EACtB;CACD,SAAS,EAAE,SAAS;CACpB,SAAS,OAAO,KAAK,EAAE,cAAc,aAAa,gBAAgB;AAOhE,MANiB,MAAM,IAAI,GACxB,MAAM,oBAAoB,CAC1B,UAAU,+BAA+B,QACxC,IAAI,GAAG,gBAAgB,aAAa,CAAC,GAAG,eAAe,YAAY,CACpE,CACA,OAAO,KACO,KACf,QAAO;AAET,QAAM,IAAI,GAAG,OAAO,qBAAqB;GAAE;GAAc;GAAa;GAAW,CAAC;AAClF,SAAO;;CAEV,CAAC"}

package/dist/component/connection/saml/request.d.ts

@@ -1,5 +1,5 @@
-import * as convex_values2781 from "convex/values";
-import * as convex_server186 from "convex/server";
+import * as convex_values1817 from "convex/values";
+import * as convex_server162 from "convex/server";
 
 //#region src/component/connection/saml/request.d.ts
 declare namespace request_d_exports {
@@ -17,12 +17,11 @@ declare namespace request_d_exports {
  * @module
  */
 /** Persist a pending SAML AuthnRequest ID so the ACS handler can accept it once. */
-declare const create: convex_server186.RegisteredMutation<"public", {
-  connectionId: convex_values2781.GenericId<"GroupConnection">;
-  createdAt: number;
-  expiresAt: number;
+declare const create: convex_server162.RegisteredMutation<"public", {
   requestId: string;
-}, Promise<convex_values2781.GenericId<"SamlLoginRequest">>>;
+  connectionId: convex_values1817.GenericId<"GroupConnection">;
+  expiresAt: number;
+}, Promise<convex_values1817.GenericId<"SamlLoginRequest">>>;
 /**
  * Atomically accept a pending SAML AuthnRequest by its `requestId`. Returns
  * `true` only when a matching, unaccepted, unexpired row existed and was
@@ -37,8 +36,8 @@ declare const create: convex_server186.RegisteredMutation<"public", {
  * connection can still accept it (a wrong-connection probe cannot burn a
  * legitimate pending request).
  */
-declare const accept: convex_server186.RegisteredMutation<"public", {
-  connectionId?: convex_values2781.GenericId<"GroupConnection"> | undefined;
+declare const accept: convex_server162.RegisteredMutation<"public", {
+  connectionId?: convex_values1817.GenericId<"GroupConnection"> | undefined;
   requestId: string;
   now: number;
 }, Promise<boolean>>;

package/dist/component/connection/saml/request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request.d.ts","names":[],"sources":["../../../../src/component/connection/saml/request.ts"],"mappings":";;;;;;;;;;;;;;;;AAiBA;;;cAAa,MAAA,mBAAM,kBAAA;gBAWjB,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;;AAgBF;;;;cAAa,MAAA,mBAAM,kBAAA;iBAqBjB,iBAAA,CAAA,SAAA"}
+{"version":3,"file":"request.d.ts","names":[],"sources":["../../../../src/component/connection/saml/request.ts"],"mappings":";;;;;;;;;;;;;;;;AAiBA;;;cAAa,MAAA,mBAAM,kBAAA;;gBAUjB,iBAAA,CAAA,SAAA;;;;;;;;;;;;;AAgBF;;;;cAAa,MAAA,mBAAM,kBAAA;iBAqBjB,iBAAA,CAAA,SAAA"}

package/dist/component/connection/saml/request.js

@@ -1,5 +1,4 @@
 import { mutation } from "../../_generated/server.js";
-import "../../functions.js";
 import { v } from "convex/values";
 
 //#region src/component/connection/saml/request.ts
@@ -19,7 +18,6 @@ const create = mutation({
 	args: {
 		connectionId: v.id("GroupConnection"),
 		requestId: v.string(),
-		createdAt: v.number(),
 		expiresAt: v.number()
 	},
 	returns: v.id("SamlLoginRequest"),

package/dist/component/connection/saml/request.js.map

@@ -1 +1 @@
-{"version":3,"file":"request.js","names":[],"sources":["../../../../src/component/connection/saml/request.ts"],"sourcesContent":["/**\n * `component.connection.saml.request.*` — pending SAML AuthnRequest IDs\n * (sub-resource of connection) enabling server-side replay prevention.\n *\n * A row is persisted when the SP generates a sign-in request and accepted\n * single-use at the ACS handler. Because `accept` is one atomic\n * read-check-write mutation, a captured SAMLResponse/RelayState pair cannot be\n * replayed - the second accept fails.\n *\n * @module\n */\n\nimport { v } from \"convex/values\";\n\nimport { mutation } from \"../../functions\";\n\n/** Persist a pending SAML AuthnRequest ID so the ACS handler can accept it once. */\nexport const create = mutation({\n  args: {\n    connectionId: v.id(\"GroupConnection\"),\n    requestId: v.string(),\n    createdAt: v.number(),\n    expiresAt: v.number(),\n  },\n  returns: v.id(\"SamlLoginRequest\"),\n  handler: async (ctx, args) => {\n    return await ctx.db.insert(\"SamlLoginRequest\", args);\n  },\n});\n\n/**\n * Atomically accept a pending SAML AuthnRequest by its `requestId`. Returns\n * `true` only when a matching, unaccepted, unexpired row existed and was\n * stamped `acceptedAt`; a replayed, expired, or unknown request returns\n * `false`.\n *\n * When `connectionId` is supplied, the pending request must also belong to that\n * connection. This is defense-in-depth for multi-tenant setups: a `SAMLResponse`\n * captured under one connection carries an `InResponseTo` that must not be\n * consumable while processing a *different* connection's ACS callback. A\n * mismatch returns `false` *without* consuming the row, so the owning\n * connection can still accept it (a wrong-connection probe cannot burn a\n * legitimate pending request).\n */\nexport const accept = mutation({\n  args: {\n    requestId: v.string(),\n    now: v.number(),\n    connectionId: v.optional(v.id(\"GroupConnection\")),\n  },\n  returns: v.boolean(),\n  handler: async (ctx, { requestId, now, connectionId }) => {\n    const row = await ctx.db\n      .query(\"SamlLoginRequest\")\n      .withIndex(\"request_id\", (idx) => idx.eq(\"requestId\", requestId))\n      .first();\n    if (row === null || row.acceptedAt !== undefined || row.expiresAt <= now) {\n      return false;\n    }\n    if (connectionId !== undefined && row.connectionId !== connectionId) {\n      return false;\n    }\n    await ctx.db.patch(\"SamlLoginRequest\", row._id, { acceptedAt: now });\n    return true;\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;AAiBA,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,cAAc,EAAE,GAAG,kBAAkB;EACrC,WAAW,EAAE,QAAQ;EACrB,WAAW,EAAE,QAAQ;EACrB,WAAW,EAAE,QAAQ;EACtB;CACD,SAAS,EAAE,GAAG,mBAAmB;CACjC,SAAS,OAAO,KAAK,SAAS;AAC5B,SAAO,MAAM,IAAI,GAAG,OAAO,oBAAoB,KAAK;;CAEvD,CAAC;;;;;;;;;;;;;;;AAgBF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,WAAW,EAAE,QAAQ;EACrB,KAAK,EAAE,QAAQ;EACf,cAAc,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC;EAClD;CACD,SAAS,EAAE,SAAS;CACpB,SAAS,OAAO,KAAK,EAAE,WAAW,KAAK,mBAAmB;EACxD,MAAM,MAAM,MAAM,IAAI,GACnB,MAAM,mBAAmB,CACzB,UAAU,eAAe,QAAQ,IAAI,GAAG,aAAa,UAAU,CAAC,CAChE,OAAO;AACV,MAAI,QAAQ,QAAQ,IAAI,eAAe,UAAa,IAAI,aAAa,IACnE,QAAO;AAET,MAAI,iBAAiB,UAAa,IAAI,iBAAiB,aACrD,QAAO;AAET,QAAM,IAAI,GAAG,MAAM,oBAAoB,IAAI,KAAK,EAAE,YAAY,KAAK,CAAC;AACpE,SAAO;;CAEV,CAAC"}
+{"version":3,"file":"request.js","names":[],"sources":["../../../../src/component/connection/saml/request.ts"],"sourcesContent":["/**\n * `component.connection.saml.request.*` — pending SAML AuthnRequest IDs\n * (sub-resource of connection) enabling server-side replay prevention.\n *\n * A row is persisted when the SP generates a sign-in request and accepted\n * single-use at the ACS handler. Because `accept` is one atomic\n * read-check-write mutation, a captured SAMLResponse/RelayState pair cannot be\n * replayed - the second accept fails.\n *\n * @module\n */\n\nimport { v } from \"convex/values\";\n\nimport { mutation } from \"../../_generated/server\";\n\n/** Persist a pending SAML AuthnRequest ID so the ACS handler can accept it once. */\nexport const create = mutation({\n  args: {\n    connectionId: v.id(\"GroupConnection\"),\n    requestId: v.string(),\n    expiresAt: v.number(),\n  },\n  returns: v.id(\"SamlLoginRequest\"),\n  handler: async (ctx, args) => {\n    return await ctx.db.insert(\"SamlLoginRequest\", args);\n  },\n});\n\n/**\n * Atomically accept a pending SAML AuthnRequest by its `requestId`. Returns\n * `true` only when a matching, unaccepted, unexpired row existed and was\n * stamped `acceptedAt`; a replayed, expired, or unknown request returns\n * `false`.\n *\n * When `connectionId` is supplied, the pending request must also belong to that\n * connection. This is defense-in-depth for multi-tenant setups: a `SAMLResponse`\n * captured under one connection carries an `InResponseTo` that must not be\n * consumable while processing a *different* connection's ACS callback. A\n * mismatch returns `false` *without* consuming the row, so the owning\n * connection can still accept it (a wrong-connection probe cannot burn a\n * legitimate pending request).\n */\nexport const accept = mutation({\n  args: {\n    requestId: v.string(),\n    now: v.number(),\n    connectionId: v.optional(v.id(\"GroupConnection\")),\n  },\n  returns: v.boolean(),\n  handler: async (ctx, { requestId, now, connectionId }) => {\n    const row = await ctx.db\n      .query(\"SamlLoginRequest\")\n      .withIndex(\"request_id\", (idx) => idx.eq(\"requestId\", requestId))\n      .first();\n    if (row === null || row.acceptedAt !== undefined || row.expiresAt <= now) {\n      return false;\n    }\n    if (connectionId !== undefined && row.connectionId !== connectionId) {\n      return false;\n    }\n    await ctx.db.patch(\"SamlLoginRequest\", row._id, { acceptedAt: now });\n    return true;\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;AAiBA,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,cAAc,EAAE,GAAG,kBAAkB;EACrC,WAAW,EAAE,QAAQ;EACrB,WAAW,EAAE,QAAQ;EACtB;CACD,SAAS,EAAE,GAAG,mBAAmB;CACjC,SAAS,OAAO,KAAK,SAAS;AAC5B,SAAO,MAAM,IAAI,GAAG,OAAO,oBAAoB,KAAK;;CAEvD,CAAC;;;;;;;;;;;;;;;AAgBF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,WAAW,EAAE,QAAQ;EACrB,KAAK,EAAE,QAAQ;EACf,cAAc,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC;EAClD;CACD,SAAS,EAAE,SAAS;CACpB,SAAS,OAAO,KAAK,EAAE,WAAW,KAAK,mBAAmB;EACxD,MAAM,MAAM,MAAM,IAAI,GACnB,MAAM,mBAAmB,CACzB,UAAU,eAAe,QAAQ,IAAI,GAAG,aAAa,UAAU,CAAC,CAChE,OAAO;AACV,MAAI,QAAQ,QAAQ,IAAI,eAAe,UAAa,IAAI,aAAa,IACnE,QAAO;AAET,MAAI,iBAAiB,UAAa,IAAI,iBAAiB,aACrD,QAAO;AAET,QAAM,IAAI,GAAG,MAAM,oBAAoB,IAAI,KAAK,EAAE,YAAY,KAAK,CAAC;AACpE,SAAO;;CAEV,CAAC"}

package/dist/component/connection/scim/config.d.ts

@@ -1,5 +1,5 @@
-import * as convex_values2815 from "convex/values";
-import * as convex_server199 from "convex/server";
+import * as convex_values1851 from "convex/values";
+import * as convex_server175 from "convex/server";
 
 //#region src/component/connection/scim/config.d.ts
 declare namespace config_d_exports {
@@ -18,30 +18,30 @@ declare namespace config_d_exports {
  * Read a SCIM config. Overloaded: lookup by `{ tokenHash }` (bearer-token
  * resolution) or by `{ connectionId }`. Returns `null` when nothing matches.
  */
-declare const get: convex_server199.RegisteredQuery<"public", {
-  connectionId?: convex_values2815.GenericId<"GroupConnection"> | undefined;
+declare const get: convex_server175.RegisteredQuery<"public", {
+  connectionId?: convex_values1851.GenericId<"GroupConnection"> | undefined;
   tokenHash?: string | undefined;
 }, Promise<{
-  _id: convex_values2815.GenericId<"GroupConnectionScimConfig">;
+  _id: convex_values1851.GenericId<"GroupConnectionScimConfig">;
   _creationTime: number;
   extend?: any;
   lastRotatedAt?: number | undefined;
-  connectionId: convex_values2815.GenericId<"GroupConnection">;
-  status: "draft" | "active" | "disabled";
-  groupId: convex_values2815.GenericId<"Group">;
+  connectionId: convex_values1851.GenericId<"GroupConnection">;
+  groupId: convex_values1851.GenericId<"Group">;
+  status: "active" | "draft" | "disabled";
   tokenHash: string;
   basePath: string;
 } | null>>;
 /** Insert a SCIM config, or patch it when one already exists for the connection (keyed by `connectionId`). */
-declare const upsert: convex_server199.RegisteredMutation<"public", {
+declare const upsert: convex_server175.RegisteredMutation<"public", {
   extend?: any;
   lastRotatedAt?: number | undefined;
-  connectionId: convex_values2815.GenericId<"GroupConnection">;
-  status: "draft" | "active" | "disabled";
-  groupId: convex_values2815.GenericId<"Group">;
+  connectionId: convex_values1851.GenericId<"GroupConnection">;
+  groupId: convex_values1851.GenericId<"Group">;
+  status: "active" | "draft" | "disabled";
   tokenHash: string;
   basePath: string;
-}, Promise<convex_values2815.GenericId<"GroupConnectionScimConfig">>>;
+}, Promise<convex_values1851.GenericId<"GroupConnectionScimConfig">>>;
 //#endregion
 export { config_d_exports };
 //# sourceMappingURL=config.d.ts.map

package/dist/component/connection/scim/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","names":[],"sources":["../../../../src/component/connection/scim/config.ts"],"mappings":";;;;;;;;;;;;;;;;AAmBA;;;;AAAA,cAAa,GAAA,mBAAG,eAAA;iBAmBd,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;cAGW,MAAA,mBAAM,kBAAA;;;gBAsBjB,iBAAA,CAAA,SAAA"}
+{"version":3,"file":"config.d.ts","names":[],"sources":["../../../../src/component/connection/scim/config.ts"],"mappings":";;;;;;;;;;;;;;;;AAoBA;;;;AAAA,cAAa,GAAA,mBAAG,eAAA;iBAmBd,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;cAGW,MAAA,mBAAM,kBAAA;;;gBAsBjB,iBAAA,CAAA,SAAA"}

package/dist/component/connection/scim/config.js

@@ -1,6 +1,6 @@
-import { vGroupConnectionScimConfigDoc, vScimStatus } from "../../model.js";
+import { vScimStatus } from "../../model.js";
 import { mutation, query } from "../../_generated/server.js";
-import "../../functions.js";
+import { vGroupConnectionScimConfigDoc } from "../../documents.js";
 import { v } from "convex/values";
 
 //#region src/component/connection/scim/config.ts

package/dist/component/connection/scim/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","names":[],"sources":["../../../../src/component/connection/scim/config.ts"],"sourcesContent":["/**\n * `component.connection.scim.config.*` — SCIM provisioning config\n * for an Connection connection (sub-resource of connection).\n *\n * Reads collapse into one overloaded `get`\n * (`{ connectionId }` or `{ tokenHash }`).\n *\n * @module\n */\n\nimport { v } from \"convex/values\";\n\nimport { mutation, query } from \"../../functions\";\nimport { vGroupConnectionScimConfigDoc, vScimStatus } from \"../../model\";\n\n/**\n * Read a SCIM config. Overloaded: lookup by `{ tokenHash }` (bearer-token\n * resolution) or by `{ connectionId }`. Returns `null` when nothing matches.\n */\nexport const get = query({\n  args: {\n    connectionId: v.optional(v.id(\"GroupConnection\")),\n    tokenHash: v.optional(v.string()),\n  },\n  returns: v.union(vGroupConnectionScimConfigDoc, v.null()),\n  handler: async (ctx, args) => {\n    if (args.tokenHash !== undefined) {\n      return await ctx.db\n        .query(\"GroupConnectionScimConfig\")\n        .withIndex(\"token_hash\", (idx) => idx.eq(\"tokenHash\", args.tokenHash!))\n        .first();\n    }\n    if (args.connectionId === undefined) return null;\n    return await ctx.db\n      .query(\"GroupConnectionScimConfig\")\n      .withIndex(\"group_connection_id\", (idx) => idx.eq(\"connectionId\", args.connectionId!))\n      .first();\n  },\n});\n\n/** Insert a SCIM config, or patch it when one already exists for the connection (keyed by `connectionId`). */\nexport const upsert = mutation({\n  args: {\n    connectionId: v.id(\"GroupConnection\"),\n    groupId: v.id(\"Group\"),\n    status: vScimStatus,\n    basePath: v.string(),\n    tokenHash: v.string(),\n    lastRotatedAt: v.optional(v.number()),\n    extend: v.optional(v.any()),\n  },\n  returns: v.id(\"GroupConnectionScimConfig\"),\n  handler: async (ctx, args) => {\n    const existing = await ctx.db\n      .query(\"GroupConnectionScimConfig\")\n      .withIndex(\"group_connection_id\", (idx) => idx.eq(\"connectionId\", args.connectionId))\n      .first();\n    if (existing) {\n      await ctx.db.patch(\"GroupConnectionScimConfig\", existing._id, args);\n      return existing._id;\n    }\n    return await ctx.db.insert(\"GroupConnectionScimConfig\", args);\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAmBA,MAAa,MAAM,MAAM;CACvB,MAAM;EACJ,cAAc,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC;EACjD,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC;EAClC;CACD,SAAS,EAAE,MAAM,+BAA+B,EAAE,MAAM,CAAC;CACzD,SAAS,OAAO,KAAK,SAAS;AAC5B,MAAI,KAAK,cAAc,OACrB,QAAO,MAAM,IAAI,GACd,MAAM,4BAA4B,CAClC,UAAU,eAAe,QAAQ,IAAI,GAAG,aAAa,KAAK,UAAW,CAAC,CACtE,OAAO;AAEZ,MAAI,KAAK,iBAAiB,OAAW,QAAO;AAC5C,SAAO,MAAM,IAAI,GACd,MAAM,4BAA4B,CAClC,UAAU,wBAAwB,QAAQ,IAAI,GAAG,gBAAgB,KAAK,aAAc,CAAC,CACrF,OAAO;;CAEb,CAAC;;AAGF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,cAAc,EAAE,GAAG,kBAAkB;EACrC,SAAS,EAAE,GAAG,QAAQ;EACtB,QAAQ;EACR,UAAU,EAAE,QAAQ;EACpB,WAAW,EAAE,QAAQ;EACrB,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC;EACrC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC;EAC5B;CACD,SAAS,EAAE,GAAG,4BAA4B;CAC1C,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,WAAW,MAAM,IAAI,GACxB,MAAM,4BAA4B,CAClC,UAAU,wBAAwB,QAAQ,IAAI,GAAG,gBAAgB,KAAK,aAAa,CAAC,CACpF,OAAO;AACV,MAAI,UAAU;AACZ,SAAM,IAAI,GAAG,MAAM,6BAA6B,SAAS,KAAK,KAAK;AACnE,UAAO,SAAS;;AAElB,SAAO,MAAM,IAAI,GAAG,OAAO,6BAA6B,KAAK;;CAEhE,CAAC"}
+{"version":3,"file":"config.js","names":[],"sources":["../../../../src/component/connection/scim/config.ts"],"sourcesContent":["/**\n * `component.connection.scim.config.*` — SCIM provisioning config\n * for an Connection connection (sub-resource of connection).\n *\n * Reads collapse into one overloaded `get`\n * (`{ connectionId }` or `{ tokenHash }`).\n *\n * @module\n */\n\nimport { v } from \"convex/values\";\n\nimport { mutation, query } from \"../../_generated/server\";\nimport { vGroupConnectionScimConfigDoc } from \"../../documents\";\nimport { vScimStatus } from \"../../model\";\n\n/**\n * Read a SCIM config. Overloaded: lookup by `{ tokenHash }` (bearer-token\n * resolution) or by `{ connectionId }`. Returns `null` when nothing matches.\n */\nexport const get = query({\n  args: {\n    connectionId: v.optional(v.id(\"GroupConnection\")),\n    tokenHash: v.optional(v.string()),\n  },\n  returns: v.union(vGroupConnectionScimConfigDoc, v.null()),\n  handler: async (ctx, args) => {\n    if (args.tokenHash !== undefined) {\n      return await ctx.db\n        .query(\"GroupConnectionScimConfig\")\n        .withIndex(\"token_hash\", (idx) => idx.eq(\"tokenHash\", args.tokenHash!))\n        .first();\n    }\n    if (args.connectionId === undefined) return null;\n    return await ctx.db\n      .query(\"GroupConnectionScimConfig\")\n      .withIndex(\"group_connection_id\", (idx) => idx.eq(\"connectionId\", args.connectionId!))\n      .first();\n  },\n});\n\n/** Insert a SCIM config, or patch it when one already exists for the connection (keyed by `connectionId`). */\nexport const upsert = mutation({\n  args: {\n    connectionId: v.id(\"GroupConnection\"),\n    groupId: v.id(\"Group\"),\n    status: vScimStatus,\n    basePath: v.string(),\n    tokenHash: v.string(),\n    lastRotatedAt: v.optional(v.number()),\n    extend: v.optional(v.any()),\n  },\n  returns: v.id(\"GroupConnectionScimConfig\"),\n  handler: async (ctx, args) => {\n    const existing = await ctx.db\n      .query(\"GroupConnectionScimConfig\")\n      .withIndex(\"group_connection_id\", (idx) => idx.eq(\"connectionId\", args.connectionId))\n      .first();\n    if (existing) {\n      await ctx.db.patch(\"GroupConnectionScimConfig\", existing._id, args);\n      return existing._id;\n    }\n    return await ctx.db.insert(\"GroupConnectionScimConfig\", args);\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAoBA,MAAa,MAAM,MAAM;CACvB,MAAM;EACJ,cAAc,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC;EACjD,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC;EAClC;CACD,SAAS,EAAE,MAAM,+BAA+B,EAAE,MAAM,CAAC;CACzD,SAAS,OAAO,KAAK,SAAS;AAC5B,MAAI,KAAK,cAAc,OACrB,QAAO,MAAM,IAAI,GACd,MAAM,4BAA4B,CAClC,UAAU,eAAe,QAAQ,IAAI,GAAG,aAAa,KAAK,UAAW,CAAC,CACtE,OAAO;AAEZ,MAAI,KAAK,iBAAiB,OAAW,QAAO;AAC5C,SAAO,MAAM,IAAI,GACd,MAAM,4BAA4B,CAClC,UAAU,wBAAwB,QAAQ,IAAI,GAAG,gBAAgB,KAAK,aAAc,CAAC,CACrF,OAAO;;CAEb,CAAC;;AAGF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,cAAc,EAAE,GAAG,kBAAkB;EACrC,SAAS,EAAE,GAAG,QAAQ;EACtB,QAAQ;EACR,UAAU,EAAE,QAAQ;EACpB,WAAW,EAAE,QAAQ;EACrB,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC;EACrC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC;EAC5B;CACD,SAAS,EAAE,GAAG,4BAA4B;CAC1C,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,WAAW,MAAM,IAAI,GACxB,MAAM,4BAA4B,CAClC,UAAU,wBAAwB,QAAQ,IAAI,GAAG,gBAAgB,KAAK,aAAa,CAAC,CACpF,OAAO;AACV,MAAI,UAAU;AACZ,SAAM,IAAI,GAAG,MAAM,6BAA6B,SAAS,KAAK,KAAK;AACnE,UAAO,SAAS;;AAElB,SAAO,MAAM,IAAI,GAAG,OAAO,6BAA6B,KAAK;;CAEhE,CAAC"}

package/dist/component/connection/scim/identity.d.ts

@@ -1,9 +1,9 @@
-import * as convex_values2822 from "convex/values";
-import * as convex_server201 from "convex/server";
+import * as convex_values1858 from "convex/values";
+import * as convex_server177 from "convex/server";
 
 //#region src/component/connection/scim/identity.d.ts
 declare namespace identity_d_exports {
-  export { get, list, provision, remove, upsert };
+  export { get, list, provision, provisionGroup, revoke, revokeGroup, update, updateGroup };
 }
 /**
  * `component.connection.scim.identity.*` — SCIM-provisioned
@@ -17,45 +17,45 @@ declare namespace identity_d_exports {
 /**
  * Read SCIM identities, overloaded by the args supplied. With
  * `{ connectionId, userIds }` it batch-resolves and returns an array aligned to
- * the input order (`null` per missing user). Otherwise it resolves a single
+ * the input order (`null` per missing user; max 100 IDs). Otherwise it resolves a single
  * identity by `(connectionId, resourceType, externalId)`, `(connectionId,
  * userId)`, `userId`, or `mappedGroupId`. Returns `null` when nothing matches.
  */
-declare const get: convex_server201.RegisteredQuery<"public", {
-  userId?: convex_values2822.GenericId<"User"> | undefined;
-  connectionId?: convex_values2822.GenericId<"GroupConnection"> | undefined;
-  externalId?: string | undefined;
+declare const get: convex_server177.RegisteredQuery<"public", {
+  userId?: convex_values1858.GenericId<"User"> | undefined;
+  connectionId?: convex_values1858.GenericId<"GroupConnection"> | undefined;
   resourceType?: "user" | "group" | undefined;
-  mappedGroupId?: convex_values2822.GenericId<"Group"> | undefined;
-  userIds?: convex_values2822.GenericId<"User">[] | undefined;
+  externalId?: string | undefined;
+  mappedGroupId?: convex_values1858.GenericId<"Group"> | undefined;
+  userIds?: convex_values1858.GenericId<"User">[] | undefined;
 }, Promise<{
-  _id: convex_values2822.GenericId<"GroupConnectionScimIdentity">;
+  _id: convex_values1858.GenericId<"GroupConnectionScimIdentity">;
   _creationTime: number;
-  userId?: convex_values2822.GenericId<"User"> | undefined;
+  userId?: convex_values1858.GenericId<"User"> | undefined;
+  externalId?: string | undefined;
   active?: boolean | undefined;
-  mappedGroupId?: convex_values2822.GenericId<"Group"> | undefined;
+  mappedGroupId?: convex_values1858.GenericId<"Group"> | undefined;
   lastProvisionedAt?: number | undefined;
   raw?: any;
-  connectionId: convex_values2822.GenericId<"GroupConnection">;
-  externalId: string;
-  groupId: convex_values2822.GenericId<"Group">;
+  connectionId: convex_values1858.GenericId<"GroupConnection">;
   resourceType: "user" | "group";
+  groupId: convex_values1858.GenericId<"Group">;
 } | ({
-  _id: convex_values2822.GenericId<"GroupConnectionScimIdentity">;
+  _id: convex_values1858.GenericId<"GroupConnectionScimIdentity">;
   _creationTime: number;
-  userId?: convex_values2822.GenericId<"User"> | undefined;
+  userId?: convex_values1858.GenericId<"User"> | undefined;
+  externalId?: string | undefined;
   active?: boolean | undefined;
-  mappedGroupId?: convex_values2822.GenericId<"Group"> | undefined;
+  mappedGroupId?: convex_values1858.GenericId<"Group"> | undefined;
   lastProvisionedAt?: number | undefined;
   raw?: any;
-  connectionId: convex_values2822.GenericId<"GroupConnection">;
-  externalId: string;
-  groupId: convex_values2822.GenericId<"Group">;
+  connectionId: convex_values1858.GenericId<"GroupConnection">;
   resourceType: "user" | "group";
+  groupId: convex_values1858.GenericId<"Group">;
 } | null)[] | null>>;
 /** List a connection's SCIM identities, paginated. */
-declare const list: convex_server201.RegisteredQuery<"public", {
-  connectionId: convex_values2822.GenericId<"GroupConnection">;
+declare const list: convex_server177.RegisteredQuery<"public", {
+  connectionId: convex_values1858.GenericId<"GroupConnection">;
   paginationOpts: {
     id?: number;
     endCursor?: string | null;
@@ -64,67 +64,128 @@ declare const list: convex_server201.RegisteredQuery<"public", {
     numItems: number;
     cursor: string | null;
   };
-}, Promise<convex_server201.PaginationResult<{
-  _id: convex_values2822.GenericId<"GroupConnectionScimIdentity">;
+}, Promise<convex_server177.PaginationResult<{
+  _id: convex_values1858.GenericId<"GroupConnectionScimIdentity">;
   _creationTime: number;
-  userId?: convex_values2822.GenericId<"User"> | undefined;
+  userId?: convex_values1858.GenericId<"User"> | undefined;
+  externalId?: string | undefined;
   active?: boolean | undefined;
-  mappedGroupId?: convex_values2822.GenericId<"Group"> | undefined;
+  mappedGroupId?: convex_values1858.GenericId<"Group"> | undefined;
   lastProvisionedAt?: number | undefined;
   raw?: any;
-  connectionId: convex_values2822.GenericId<"GroupConnection">;
-  externalId: string;
-  groupId: convex_values2822.GenericId<"Group">;
+  connectionId: convex_values1858.GenericId<"GroupConnection">;
   resourceType: "user" | "group";
+  groupId: convex_values1858.GenericId<"Group">;
 }>>>;
-/** Insert a SCIM identity, or patch it when it already exists (keyed by `(connectionId, resourceType, externalId)`). */
-declare const upsert: convex_server201.RegisteredMutation<"public", {
-  userId?: convex_values2822.GenericId<"User"> | undefined;
-  active?: boolean | undefined;
-  mappedGroupId?: convex_values2822.GenericId<"Group"> | undefined;
-  lastProvisionedAt?: number | undefined;
-  raw?: any;
-  connectionId: convex_values2822.GenericId<"GroupConnection">;
-  externalId: string;
-  groupId: convex_values2822.GenericId<"Group">;
-  resourceType: "user" | "group";
-}, Promise<convex_values2822.GenericId<"GroupConnectionScimIdentity">>>;
 /**
- * Atomically provision or resolve a SCIM user by both of its durable natural
- * keys: the connection-scoped SCIM external id and the provider Account id.
- * A concurrent retry cannot commit a losing User because the identity and
- * Account index reads participate in the same OCC transaction as the inserts.
- * Existing ownership is preserved; conflicting owners are rejected.
+ * Atomically provision a directory-managed user, account, SCIM identity, and
+ * membership. Group and provider ownership are derived from the connection.
  */
-declare const provision: convex_server201.RegisteredMutation<"public", {
+declare const provision: convex_server177.RegisteredMutation<"public", {
+  externalId?: string | undefined;
   active?: boolean | undefined;
   lastProvisionedAt?: number | undefined;
   raw?: any;
-  provider: string;
-  connectionId: convex_values2822.GenericId<"GroupConnection">;
-  externalId: string;
-  groupId: convex_values2822.GenericId<"Group">;
+  connectionId: convex_values1858.GenericId<"GroupConnection">;
+  roleIds: string[];
   userData: {
-    name?: string | undefined;
     email?: string | undefined;
-    image?: string | undefined;
     phone?: string | undefined;
+    extend?: any;
+    name?: string | undefined;
     firstName?: string | undefined;
     lastName?: string | undefined;
+    image?: string | undefined;
     emailVerificationTime?: number | undefined;
     phoneVerificationTime?: number | undefined;
     isAnonymous?: boolean | undefined;
-    lastActiveGroup?: convex_values2822.GenericId<"Group"> | undefined;
-    extend?: any;
+    lastActiveGroup?: convex_values1858.GenericId<"Group"> | undefined;
   };
+  profileUpdate: "never" | "missing" | "always";
 }, Promise<{
-  userId: convex_values2822.GenericId<"User">;
+  userId: convex_values1858.GenericId<"User">;
   created: boolean;
 }>>;
-/** Delete a SCIM identity by id. */
-declare const remove: convex_server201.RegisteredMutation<"public", {
-  id: convex_values2822.GenericId<"GroupConnectionScimIdentity">;
+/** Atomically update a directory-managed user and its connection membership. */
+declare const update: convex_server177.RegisteredMutation<"public", {
+  externalId?: string | undefined;
+  lastProvisionedAt?: number | undefined;
+  raw?: any;
+  userId: convex_values1858.GenericId<"User">;
+  connectionId: convex_values1858.GenericId<"GroupConnection">;
+  active: boolean;
+  roleIds: string[];
+  userData: {
+    email?: string | undefined;
+    phone?: string | undefined;
+    extend?: any;
+    name?: string | undefined;
+    firstName?: string | undefined;
+    lastName?: string | undefined;
+    image?: string | undefined;
+    emailVerificationTime?: number | undefined;
+    phoneVerificationTime?: number | undefined;
+    isAnonymous?: boolean | undefined;
+    lastActiveGroup?: convex_values1858.GenericId<"Group"> | undefined;
+  };
+  profileUpdate: "never" | "missing" | "always";
 }, Promise<null>>;
+/** Atomically revoke a directory-managed user's membership, sessions, and identity. */
+declare const revoke: convex_server177.RegisteredMutation<"public", {
+  userId: convex_values1858.GenericId<"User">;
+  connectionId: convex_values1858.GenericId<"GroupConnection">;
+  mode: "soft" | "hard";
+}, Promise<{
+  epoch: number;
+  cleanedSessions: number;
+  cleanupPending: boolean;
+}>>;
+/**
+ * Provision a SCIM group and one bounded page of its authoritative membership.
+ * Repeat with `continueCursor` until `isDone` is true.
+ */
+declare const provisionGroup: convex_server177.RegisteredMutation<"public", {
+  externalId?: string | undefined;
+  raw?: any;
+  cursor?: string | undefined;
+  name: string;
+  connectionId: convex_values1858.GenericId<"GroupConnection">;
+  roleIds: string[];
+  memberIds: convex_values1858.GenericId<"User">[];
+}, Promise<{
+  isDone: boolean;
+  continueCursor: string;
+  groupId: convex_values1858.GenericId<"Group">;
+  created: boolean;
+}>>;
+/**
+ * Update a SCIM group and one bounded page of its authoritative membership.
+ * Repeat with `continueCursor` until `isDone` is true.
+ */
+declare const updateGroup: convex_server177.RegisteredMutation<"public", {
+  name?: string | undefined;
+  raw?: any;
+  cursor?: string | undefined;
+  connectionId: convex_values1858.GenericId<"GroupConnection">;
+  groupId: convex_values1858.GenericId<"Group">;
+  roleIds: string[];
+  memberIds: convex_values1858.GenericId<"User">[];
+}, Promise<{
+  isDone: boolean;
+  continueCursor: string;
+}>>;
+/**
+ * Revoke a SCIM group in bounded membership pages. The identity and group are
+ * removed only when the final page returns `isDone`.
+ */
+declare const revokeGroup: convex_server177.RegisteredMutation<"public", {
+  cursor?: string | undefined;
+  connectionId: convex_values1858.GenericId<"GroupConnection">;
+  groupId: convex_values1858.GenericId<"Group">;
+}, Promise<{
+  isDone: boolean;
+  continueCursor: string;
+}>>;
 //#endregion
 export { identity_d_exports };
 //# sourceMappingURL=identity.d.ts.map

package/dist/component/connection/scim/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","names":[],"sources":["../../../../src/component/connection/scim/identity.ts"],"mappings":";;;;;;;;;;;;;;;;;;;AAoCA;;;;cAAa,GAAA,mBAAG,eAAA;WAqEd,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAGW,IAAA,mBAAI,eAAA;gBAYf,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;cAGW,MAAA,mBAAM,kBAAA;WA6BjB,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;cASW,SAAA,mBAAS,kBAAA;;;;;gBAmFpB,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;cAGI,MAAA,mBAAM,kBAAA;MAOV,iBAAA,CAAA,SAAA;AAAA"}
+{"version":3,"file":"identity.d.ts","names":[],"sources":["../../../../src/component/connection/scim/identity.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA8DA;cAAa,GAAA,mBAAG,eAAA;WAsEd,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAGW,IAAA,mBAAI,eAAA;gBAYf,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;cA6BW,SAAA,mBAAS,kBAAA;;;;;gBAsHpB,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;cAGW,MAAA,mBAAM,kBAAA;;;;UA0IjB,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;cAGW,MAAA,mBAAM,kBAAA;UAsEjB,iBAAA,CAAA,SAAA;;;;;;;;;;;;cAwFW,cAAA,mBAAc,kBAAA;;;;;gBAmFzB,iBAAA,CAAA,SAAA;;;;;;;;;;;;;cAMW,WAAA,mBAAW,kBAAA;;;;gBAmDtB,iBAAA,CAAA,SAAA;;;;;;;;;;;;cAMW,WAAA,mBAAW,kBAAA;;gBA0CtB,iBAAA,CAAA,SAAA"}