@estifanos-sh/convex-auth 0.0.9 → 0.0.10

package/dist/bin.js

@@ -6509,10 +6509,10 @@ async function runSetup(options) {
 	await configureAppUrl(config, options.appUrl);
 	await configureKeys(config);
 	await modifyTsConfig(config);
-	await configureConvexConfig(config);
-	await initializeAuth(config);
-	await initializeHttp(config);
-	await initializeAuthConfig(config);
+	for (const file of SCAFFOLDED_FILES) await scaffoldFile({
+		config,
+		...file
+	});
 	if (options.variables !== void 0) await configureOtherVariables(config, options.variables);
 	else printFinalSuccessMessage(config);
 	gt("Done! Happy building.");
@@ -6835,9 +6835,17 @@ function addCompilerOption(tsconfig, existingValue, pattern, optionAndValue) {
 	if (existingValue === void 0) return tsconfig.replace(compilerOptionsPattern, `$1${optionAndValue},$2`);
 	else return tsconfig.replace(pattern, optionAndValue);
 }
-async function configureConvexConfig(config) {
-	logStep(config, "Configure convex config file");
-	const sourceTemplate = `\
+/**
+* `sourceTemplate` does double duty: `$$` markers are stripped to produce the
+* file that gets written, and become `.*` wildcards in the "already set up?"
+* match. Editing a template changes both.
+*/
+const SCAFFOLDED_FILES = [
+	{
+		step: "Configure convex config file",
+		basename: "convex.config",
+		guidance: "registers the auth component",
+		sourceTemplate: `\
 import { defineApp } from "convex/server";
 import auth from "@estifanos-sh/convex-auth/convex.config";
 
@@ -6846,30 +6854,13 @@ const app = defineApp();
 app.use(auth);
 
 export default app;
-`;
-	const source = templateToSource(sourceTemplate);
-	const convexConfigPath = path.join(config.convexFolderPath, "convex.config");
-	const existingConfigPath = existingNonEmptySourcePath(convexConfigPath);
-	if (existingConfigPath !== null) if (doesAlreadyMatchTemplate(readFileSync(existingConfigPath, "utf8"), sourceTemplate)) O.success(`${existingConfigPath} is already set up.`);
-	else {
-		O.info(`You already have ${existingConfigPath}. Make sure it registers the auth component:`);
-		O.message(indent(`\n${source}\n`));
-		const ready = await ot({ message: "Ready to continue?" });
-		handleCancel(ready);
-		if (!ready) {
-			pt("Setup cancelled.");
-			process$1.exit(1);
-		}
-	}
-	else {
-		const newConfigPath = config.usesTypeScript ? `${convexConfigPath}.ts` : `${convexConfigPath}.js`;
-		writeFileSync(newConfigPath, source);
-		O.success(`Created ${newConfigPath}`);
-	}
-}
-async function initializeAuth(config) {
-	logStep(config, "Initialize auth file");
-	const sourceTemplate = `\
+`
+	},
+	{
+		step: "Initialize auth file",
+		basename: "auth",
+		guidance: "initializes auth with defineAuth",
+		sourceTemplate: `\
 import { defineAuth } from "@estifanos-sh/convex-auth/server";
 import { components } from "./_generated/api";
 
@@ -6879,57 +6870,23 @@ const auth = defineAuth(components.auth, {$$
 
 export { auth };
 export const { signIn, signOut, store } = auth;
-`;
-	const source = templateToSource(sourceTemplate);
-	const authPath = path.join(config.convexFolderPath, "auth");
-	const existingAuthPath = existingNonEmptySourcePath(authPath);
-	if (existingAuthPath !== null) if (doesAlreadyMatchTemplate(readFileSync(existingAuthPath, "utf8"), sourceTemplate)) O.success(`${existingAuthPath} is already set up.`);
-	else {
-		O.info(`You already have ${existingAuthPath}. Make sure it initializes auth with defineAuth:`);
-		O.message(indent(`\n${source}\n`));
-		const ready = await ot({ message: "Ready to continue?" });
-		handleCancel(ready);
-		if (!ready) {
-			pt("Setup cancelled.");
-			process$1.exit(1);
-		}
-	}
-	else {
-		const newAuthPath = config.usesTypeScript ? `${authPath}.ts` : `${authPath}.js`;
-		writeFileSync(newAuthPath, source);
-		O.success(`Created ${newAuthPath}`);
-	}
-}
-async function initializeHttp(config) {
-	logStep(config, "Initialize HTTP auth routes");
-	const sourceTemplate = `\
+`
+	},
+	{
+		step: "Initialize HTTP auth routes",
+		basename: "http",
+		guidance: "mounts Convex Auth protocol routes",
+		sourceTemplate: `\
 import { auth } from "./auth";
 
 export default auth.http();
-`;
-	const source = templateToSource(sourceTemplate);
-	const httpPath = path.join(config.convexFolderPath, "http");
-	const existingPath = existingNonEmptySourcePath(httpPath);
-	if (existingPath !== null) if (doesAlreadyMatchTemplate(readFileSync(existingPath, "utf8"), sourceTemplate)) O.success(`${existingPath} is already set up.`);
-	else {
-		O.info(`You already have ${existingPath}. Make sure it mounts Convex Auth protocol routes:`);
-		O.message(indent(`\n${source}\n`));
-		const ready = await ot({ message: "Ready to continue?" });
-		handleCancel(ready);
-		if (!ready) {
-			pt("Setup cancelled.");
-			process$1.exit(1);
-		}
-	}
-	else {
-		const newPath = config.usesTypeScript ? `${httpPath}.ts` : `${httpPath}.js`;
-		writeFileSync(newPath, source);
-		O.success(`Created ${newPath}`);
-	}
-}
-async function initializeAuthConfig(config) {
-	logStep(config, "Initialize auth.config file");
-	const sourceTemplate = `\
+`
+	},
+	{
+		step: "Initialize auth.config file",
+		basename: "auth.config",
+		guidance: "trusts env.CONVEX_SITE_URL as the Convex auth issuer",
+		sourceTemplate: `\
 import { env } from "./_generated/server";$$
 $$
 export default {$$
@@ -6940,13 +6897,17 @@ export default {$$
     },$$
   ],$$
 };
-`;
+`
+	}
+];
+async function scaffoldFile({ config, step, basename, sourceTemplate, guidance }) {
+	logStep(config, step);
 	const source = templateToSource(sourceTemplate);
-	const authConfigPath = path.join(config.convexFolderPath, "auth.config");
-	const existingPath = existingNonEmptySourcePath(authConfigPath);
+	const targetPath = path.join(config.convexFolderPath, basename);
+	const existingPath = existingNonEmptySourcePath(targetPath);
 	if (existingPath !== null) if (doesAlreadyMatchTemplate(readFileSync(existingPath, "utf8"), sourceTemplate)) O.success(`${existingPath} is already set up.`);
 	else {
-		O.info(`You already have ${existingPath}. Make sure it trusts env.CONVEX_SITE_URL as the Convex auth issuer:`);
+		O.info(`You already have ${existingPath}. Make sure it ${guidance}:`);
 		O.message(indent(`\n${source}\n`));
 		const ready = await ot({ message: "Ready to continue?" });
 		handleCancel(ready);
@@ -6956,7 +6917,7 @@ export default {$$
 		}
 	}
 	else {
-		const newPath = config.usesTypeScript ? `${authConfigPath}.ts` : `${authConfigPath}.js`;
+		const newPath = config.usesTypeScript ? `${targetPath}.ts` : `${targetPath}.js`;
 		writeFileSync(newPath, source);
 		O.success(`Created ${newPath}`);
 	}

package/dist/client/factors/device.js

@@ -1,4 +1,5 @@
 import { ErrorCode } from "../../shared/codes.js";
+import { convexError } from "../../shared/errors.js";
 import { ConvexError } from "convex/values";
 
 //#region src/client/factors/device.ts
@@ -73,10 +74,7 @@ function createDeviceClient(deps) {
 					return;
 				}
 			}
-			throw new ConvexError({
-				code: ErrorCode.DEVICE_CODE_EXPIRED,
-				message: "Device code expired before authorization was completed."
-			});
+			throw convexError(ErrorCode.DEVICE_CODE_EXPIRED, "Device code expired before authorization was completed.");
 		},
 		verify: async (opts) => {
 			const params = {
@@ -86,10 +84,7 @@ function createDeviceClient(deps) {
 			try {
 				await requestDeviceSignIn(params);
 			} catch (error) {
-				throw new ConvexError({
-					code: ErrorCode.DEVICE_AUTHORIZATION_FAILED,
-					message: error instanceof Error ? error.message : "Invalid or expired code."
-				});
+				throw convexError(ErrorCode.DEVICE_AUTHORIZATION_FAILED, error instanceof Error ? error.message : "Invalid or expired code.");
 			}
 		}
 	};

package/dist/client/factors/device.js.map

@@ -1 +1 @@
-{"version":3,"file":"device.js","names":[],"sources":["../../../src/client/factors/device.ts"],"sourcesContent":["import { ConvexError } from \"convex/values\";\n\nimport type { DeviceClient, DevicePollParams, FactorDeps, SignInActionResult } from \"../core/types\";\nimport type { AuthTokens } from \"../../shared/results\";\nimport type { AuthParameters } from \"../../shared/results\";\nimport { ErrorCode } from \"../../shared/codes\";\n\nfunction isSignedInResult(\n  result: SignInActionResult,\n): result is Extract<SignInActionResult, { kind: \"signedIn\" }> {\n  return result.kind === \"signedIn\";\n}\n\n/** @internal */\nexport function createDeviceClient(deps: FactorDeps): DeviceClient {\n  const { proxy, convex, requireApiRefs, proxyFetch, setTokenAndMaybeWait } = deps;\n\n  const requestDeviceSignIn = async (params: AuthParameters): Promise<SignInActionResult> => {\n    return (\n      proxy\n        ? await proxyFetch({\n            action: \"auth:signIn\",\n            args: { request: { provider: \"device\", params } },\n          })\n        : await convex.action(requireApiRefs().signIn, {\n            request: { provider: \"device\", params },\n          })\n    ) as SignInActionResult;\n  };\n\n  return {\n    poll: async (opts: DevicePollParams): Promise<void> => {\n      const { code, signal } = opts;\n      const MAX_POLL_DURATION_MS = 30 * 60 * 1000;\n      const SLOW_DOWN_INCREMENT_MS = 5 * 1000;\n      let currentIntervalMs = code.interval * 1000;\n      const startedAt = Date.now();\n      const expiresAt = Math.min(\n        startedAt + code.expiresIn * 1000,\n        startedAt + MAX_POLL_DURATION_MS,\n      );\n\n      while (Date.now() < expiresAt) {\n        if (signal?.aborted) return;\n        await new Promise((resolve) => setTimeout(resolve, currentIntervalMs));\n        if (signal?.aborted) return;\n\n        const params: AuthParameters = {\n          flow: \"poll\",\n          deviceCode: code.deviceCode,\n        };\n\n        let pollResult: SignInActionResult | null;\n        try {\n          pollResult = await requestDeviceSignIn(params);\n        } catch (error) {\n          if (error instanceof ConvexError) {\n            const errorCode = (error.data as { code?: unknown } | undefined)?.code;\n            if (errorCode === \"DEVICE_AUTHORIZATION_PENDING\") {\n              continue;\n            }\n            if (errorCode === \"DEVICE_SLOW_DOWN\") {\n              currentIntervalMs += SLOW_DOWN_INCREMENT_MS;\n              continue;\n            }\n          }\n          throw error;\n        }\n\n        if (pollResult === null) {\n          continue;\n        }\n\n        if (isSignedInResult(pollResult) && pollResult.session) {\n          if (proxy) {\n            await setTokenAndMaybeWait({\n              shouldStore: false,\n              tokens: pollResult.session === null ? null : { token: pollResult.session.token },\n              waitForHandshake: true,\n              context: { provider: \"device\", flow: \"poll\" },\n            });\n          } else {\n            await setTokenAndMaybeWait({\n              shouldStore: true,\n              tokens: (pollResult.session as AuthTokens | null) ?? null,\n              waitForHandshake: true,\n              context: { provider: \"device\", flow: \"poll\" },\n            });\n          }\n          return;\n        }\n      }\n\n      throw new ConvexError({\n        code: ErrorCode.DEVICE_CODE_EXPIRED,\n        message: \"Device code expired before authorization was completed.\",\n      });\n    },\n\n    verify: async (opts: { code: string }): Promise<void> => {\n      const params: AuthParameters = {\n        flow: \"verify\",\n        userCode: opts.code,\n      };\n\n      try {\n        await requestDeviceSignIn(params);\n      } catch (error) {\n        throw new ConvexError({\n          code: ErrorCode.DEVICE_AUTHORIZATION_FAILED,\n          message: error instanceof Error ? error.message : \"Invalid or expired code.\",\n        });\n      }\n    },\n  };\n}\n"],"mappings":";;;;AAOA,SAAS,iBACP,QAC6D;AAC7D,QAAO,OAAO,SAAS;;;AAIzB,SAAgB,mBAAmB,MAAgC;CACjE,MAAM,EAAE,OAAO,QAAQ,gBAAgB,YAAY,yBAAyB;CAE5E,MAAM,sBAAsB,OAAO,WAAwD;AACzF,SACE,QACI,MAAM,WAAW;GACf,QAAQ;GACR,MAAM,EAAE,SAAS;IAAE,UAAU;IAAU;IAAQ,EAAE;GAClD,CAAC,GACF,MAAM,OAAO,OAAO,gBAAgB,CAAC,QAAQ,EAC3C,SAAS;GAAE,UAAU;GAAU;GAAQ,EACxC,CAAC;;AAIV,QAAO;EACL,MAAM,OAAO,SAA0C;GACrD,MAAM,EAAE,MAAM,WAAW;GACzB,MAAM,uBAAuB,OAAU;GACvC,MAAM,yBAAyB,IAAI;GACnC,IAAI,oBAAoB,KAAK,WAAW;GACxC,MAAM,YAAY,KAAK,KAAK;GAC5B,MAAM,YAAY,KAAK,IACrB,YAAY,KAAK,YAAY,KAC7B,YAAY,qBACb;AAED,UAAO,KAAK,KAAK,GAAG,WAAW;AAC7B,QAAI,QAAQ,QAAS;AACrB,UAAM,IAAI,SAAS,YAAY,WAAW,SAAS,kBAAkB,CAAC;AACtE,QAAI,QAAQ,QAAS;IAErB,MAAM,SAAyB;KAC7B,MAAM;KACN,YAAY,KAAK;KAClB;IAED,IAAI;AACJ,QAAI;AACF,kBAAa,MAAM,oBAAoB,OAAO;aACvC,OAAO;AACd,SAAI,iBAAiB,aAAa;MAChC,MAAM,YAAa,MAAM,MAAyC;AAClE,UAAI,cAAc,+BAChB;AAEF,UAAI,cAAc,oBAAoB;AACpC,4BAAqB;AACrB;;;AAGJ,WAAM;;AAGR,QAAI,eAAe,KACjB;AAGF,QAAI,iBAAiB,WAAW,IAAI,WAAW,SAAS;AACtD,SAAI,MACF,OAAM,qBAAqB;MACzB,aAAa;MACb,QAAQ,WAAW,YAAY,OAAO,OAAO,EAAE,OAAO,WAAW,QAAQ,OAAO;MAChF,kBAAkB;MAClB,SAAS;OAAE,UAAU;OAAU,MAAM;OAAQ;MAC9C,CAAC;SAEF,OAAM,qBAAqB;MACzB,aAAa;MACb,QAAS,WAAW,WAAiC;MACrD,kBAAkB;MAClB,SAAS;OAAE,UAAU;OAAU,MAAM;OAAQ;MAC9C,CAAC;AAEJ;;;AAIJ,SAAM,IAAI,YAAY;IACpB,MAAM,UAAU;IAChB,SAAS;IACV,CAAC;;EAGJ,QAAQ,OAAO,SAA0C;GACvD,MAAM,SAAyB;IAC7B,MAAM;IACN,UAAU,KAAK;IAChB;AAED,OAAI;AACF,UAAM,oBAAoB,OAAO;YAC1B,OAAO;AACd,UAAM,IAAI,YAAY;KACpB,MAAM,UAAU;KAChB,SAAS,iBAAiB,QAAQ,MAAM,UAAU;KACnD,CAAC;;;EAGP"}
+{"version":3,"file":"device.js","names":[],"sources":["../../../src/client/factors/device.ts"],"sourcesContent":["import { ConvexError } from \"convex/values\";\n\nimport type { DeviceClient, DevicePollParams, FactorDeps, SignInActionResult } from \"../core/types\";\nimport type { AuthTokens } from \"../../shared/results\";\nimport type { AuthParameters } from \"../../shared/results\";\nimport { ErrorCode } from \"../../shared/codes\";\nimport { convexError } from \"../../shared/errors\";\n\nfunction isSignedInResult(\n  result: SignInActionResult,\n): result is Extract<SignInActionResult, { kind: \"signedIn\" }> {\n  return result.kind === \"signedIn\";\n}\n\n/** @internal */\nexport function createDeviceClient(deps: FactorDeps): DeviceClient {\n  const { proxy, convex, requireApiRefs, proxyFetch, setTokenAndMaybeWait } = deps;\n\n  const requestDeviceSignIn = async (params: AuthParameters): Promise<SignInActionResult> => {\n    return (\n      proxy\n        ? await proxyFetch({\n            action: \"auth:signIn\",\n            args: { request: { provider: \"device\", params } },\n          })\n        : await convex.action(requireApiRefs().signIn, {\n            request: { provider: \"device\", params },\n          })\n    ) as SignInActionResult;\n  };\n\n  return {\n    poll: async (opts: DevicePollParams): Promise<void> => {\n      const { code, signal } = opts;\n      const MAX_POLL_DURATION_MS = 30 * 60 * 1000;\n      const SLOW_DOWN_INCREMENT_MS = 5 * 1000;\n      let currentIntervalMs = code.interval * 1000;\n      const startedAt = Date.now();\n      const expiresAt = Math.min(\n        startedAt + code.expiresIn * 1000,\n        startedAt + MAX_POLL_DURATION_MS,\n      );\n\n      while (Date.now() < expiresAt) {\n        if (signal?.aborted) return;\n        await new Promise((resolve) => setTimeout(resolve, currentIntervalMs));\n        if (signal?.aborted) return;\n\n        const params: AuthParameters = {\n          flow: \"poll\",\n          deviceCode: code.deviceCode,\n        };\n\n        let pollResult: SignInActionResult | null;\n        try {\n          pollResult = await requestDeviceSignIn(params);\n        } catch (error) {\n          if (error instanceof ConvexError) {\n            const errorCode = (error.data as { code?: unknown } | undefined)?.code;\n            if (errorCode === \"DEVICE_AUTHORIZATION_PENDING\") {\n              continue;\n            }\n            if (errorCode === \"DEVICE_SLOW_DOWN\") {\n              currentIntervalMs += SLOW_DOWN_INCREMENT_MS;\n              continue;\n            }\n          }\n          throw error;\n        }\n\n        if (pollResult === null) {\n          continue;\n        }\n\n        if (isSignedInResult(pollResult) && pollResult.session) {\n          if (proxy) {\n            await setTokenAndMaybeWait({\n              shouldStore: false,\n              tokens: pollResult.session === null ? null : { token: pollResult.session.token },\n              waitForHandshake: true,\n              context: { provider: \"device\", flow: \"poll\" },\n            });\n          } else {\n            await setTokenAndMaybeWait({\n              shouldStore: true,\n              tokens: (pollResult.session as AuthTokens | null) ?? null,\n              waitForHandshake: true,\n              context: { provider: \"device\", flow: \"poll\" },\n            });\n          }\n          return;\n        }\n      }\n\n      throw convexError(\n        ErrorCode.DEVICE_CODE_EXPIRED,\n        \"Device code expired before authorization was completed.\",\n      );\n    },\n\n    verify: async (opts: { code: string }): Promise<void> => {\n      const params: AuthParameters = {\n        flow: \"verify\",\n        userCode: opts.code,\n      };\n\n      try {\n        await requestDeviceSignIn(params);\n      } catch (error) {\n        throw convexError(\n          ErrorCode.DEVICE_AUTHORIZATION_FAILED,\n          error instanceof Error ? error.message : \"Invalid or expired code.\",\n        );\n      }\n    },\n  };\n}\n"],"mappings":";;;;;AAQA,SAAS,iBACP,QAC6D;AAC7D,QAAO,OAAO,SAAS;;;AAIzB,SAAgB,mBAAmB,MAAgC;CACjE,MAAM,EAAE,OAAO,QAAQ,gBAAgB,YAAY,yBAAyB;CAE5E,MAAM,sBAAsB,OAAO,WAAwD;AACzF,SACE,QACI,MAAM,WAAW;GACf,QAAQ;GACR,MAAM,EAAE,SAAS;IAAE,UAAU;IAAU;IAAQ,EAAE;GAClD,CAAC,GACF,MAAM,OAAO,OAAO,gBAAgB,CAAC,QAAQ,EAC3C,SAAS;GAAE,UAAU;GAAU;GAAQ,EACxC,CAAC;;AAIV,QAAO;EACL,MAAM,OAAO,SAA0C;GACrD,MAAM,EAAE,MAAM,WAAW;GACzB,MAAM,uBAAuB,OAAU;GACvC,MAAM,yBAAyB,IAAI;GACnC,IAAI,oBAAoB,KAAK,WAAW;GACxC,MAAM,YAAY,KAAK,KAAK;GAC5B,MAAM,YAAY,KAAK,IACrB,YAAY,KAAK,YAAY,KAC7B,YAAY,qBACb;AAED,UAAO,KAAK,KAAK,GAAG,WAAW;AAC7B,QAAI,QAAQ,QAAS;AACrB,UAAM,IAAI,SAAS,YAAY,WAAW,SAAS,kBAAkB,CAAC;AACtE,QAAI,QAAQ,QAAS;IAErB,MAAM,SAAyB;KAC7B,MAAM;KACN,YAAY,KAAK;KAClB;IAED,IAAI;AACJ,QAAI;AACF,kBAAa,MAAM,oBAAoB,OAAO;aACvC,OAAO;AACd,SAAI,iBAAiB,aAAa;MAChC,MAAM,YAAa,MAAM,MAAyC;AAClE,UAAI,cAAc,+BAChB;AAEF,UAAI,cAAc,oBAAoB;AACpC,4BAAqB;AACrB;;;AAGJ,WAAM;;AAGR,QAAI,eAAe,KACjB;AAGF,QAAI,iBAAiB,WAAW,IAAI,WAAW,SAAS;AACtD,SAAI,MACF,OAAM,qBAAqB;MACzB,aAAa;MACb,QAAQ,WAAW,YAAY,OAAO,OAAO,EAAE,OAAO,WAAW,QAAQ,OAAO;MAChF,kBAAkB;MAClB,SAAS;OAAE,UAAU;OAAU,MAAM;OAAQ;MAC9C,CAAC;SAEF,OAAM,qBAAqB;MACzB,aAAa;MACb,QAAS,WAAW,WAAiC;MACrD,kBAAkB;MAClB,SAAS;OAAE,UAAU;OAAU,MAAM;OAAQ;MAC9C,CAAC;AAEJ;;;AAIJ,SAAM,YACJ,UAAU,qBACV,0DACD;;EAGH,QAAQ,OAAO,SAA0C;GACvD,MAAM,SAAyB;IAC7B,MAAM;IACN,UAAU,KAAK;IAChB;AAED,OAAI;AACF,UAAM,oBAAoB,OAAO;YAC1B,OAAO;AACd,UAAM,YACJ,UAAU,6BACV,iBAAiB,QAAQ,MAAM,UAAU,2BAC1C;;;EAGN"}

package/dist/component/account.d.ts

@@ -1,6 +1,6 @@
 import { SessionRows } from "./session.js";
-import * as convex_values2496 from "convex/values";
-import * as convex_server96 from "convex/server";
+import * as convex_values2499 from "convex/values";
+import * as convex_server89 from "convex/server";
 
 //#region src/component/account.d.ts
 declare namespace account_d_exports {
@@ -10,7 +10,7 @@ type AcceptedCredentialsSignIn = Omit<SessionRows, "epoch"> & {
   status: "accepted";
 };
 /** Reserve a password attempt and load all sign-in state in one transaction. */
-declare const beginCredentialsSignIn: convex_server96.RegisteredMutation<"public", {
+declare const beginCredentialsSignIn: convex_server89.RegisteredMutation<"public", {
   provider: string;
   providerAccountId: string;
   limitIdentifier: string;
@@ -30,43 +30,43 @@ declare const beginCredentialsSignIn: convex_server96.RegisteredMutation<"public
 } | {
   status: "ready";
   account: {
-    _id: convex_values2496.GenericId<"Account">;
+    _id: convex_values2499.GenericId<"Account">;
     _creationTime: number;
     extend?: any;
     secret?: string | undefined;
     emailVerified?: string | undefined;
     phoneVerified?: string | undefined;
-    userId: convex_values2496.GenericId<"User">;
+    userId: convex_values2499.GenericId<"User">;
     provider: string;
     providerAccountId: string;
   };
   user: {
-    _id: convex_values2496.GenericId<"User">;
+    _id: convex_values2499.GenericId<"User">;
     _creationTime: number;
     email?: string | undefined;
-    phone?: string | undefined;
     extend?: any;
     name?: string | undefined;
+    image?: string | undefined;
+    phone?: string | undefined;
     firstName?: string | undefined;
     lastName?: string | undefined;
-    image?: string | undefined;
     emailVerificationTime?: number | undefined;
     phoneVerificationTime?: number | undefined;
     isAnonymous?: boolean | undefined;
-    lastActiveGroup?: convex_values2496.GenericId<"Group"> | undefined;
+    lastActiveGroup?: convex_values2499.GenericId<"Group"> | undefined;
     sessionEpoch: number;
   };
   hasTotp: boolean;
 }>>;
 /** Refund a verified password attempt and optionally issue its session atomically. */
-declare const completeCredentialsSignIn: convex_server96.RegisteredMutation<"public", {
+declare const completeCredentialsSignIn: convex_server89.RegisteredMutation<"public", {
   replaceSession?: {
-    sessionId: convex_values2496.GenericId<"Session">;
-    authenticatedUserId: convex_values2496.GenericId<"User">;
+    sessionId: convex_values2499.GenericId<"Session">;
+    authenticatedUserId: convex_values2499.GenericId<"User">;
   } | undefined;
   sessionExpirationTime: number;
   refreshTokenExpirationTime: number;
-  accountId: convex_values2496.GenericId<"Account">;
+  accountId: convex_values2499.GenericId<"Account">;
   limitIdentifier: string;
   issueSession: boolean;
   generateTokens: boolean;
@@ -79,18 +79,18 @@ declare const completeCredentialsSignIn: convex_server96.RegisteredMutation<"pub
  * Read an account by id, or by `{ provider, providerAccountId }` when both
  * are given. Returns `null` when no selector matches.
  */
-declare const get: convex_server96.RegisteredQuery<"public", {
-  id?: convex_values2496.GenericId<"Account"> | undefined;
+declare const get: convex_server89.RegisteredQuery<"public", {
+  id?: convex_values2499.GenericId<"Account"> | undefined;
   provider?: string | undefined;
   providerAccountId?: string | undefined;
 }, Promise<{
-  _id: convex_values2496.GenericId<"Account">;
+  _id: convex_values2499.GenericId<"Account">;
   _creationTime: number;
   extend?: any;
   secret?: string | undefined;
   emailVerified?: string | undefined;
   phoneVerified?: string | undefined;
-  userId: convex_values2496.GenericId<"User">;
+  userId: convex_values2499.GenericId<"User">;
   provider: string;
   providerAccountId: string;
 } | null>>;
@@ -101,39 +101,39 @@ declare const get: convex_server96.RegisteredQuery<"public", {
  * public server facade projects these raw records into safe capability
  * summaries before exposing them to application code.
  */
-declare const list: convex_server96.RegisteredQuery<"public", {
-  userId?: convex_values2496.GenericId<"User"> | undefined;
+declare const list: convex_server89.RegisteredQuery<"public", {
+  userId?: convex_values2499.GenericId<"User"> | undefined;
   provider?: string | undefined;
-  userIds?: convex_values2496.GenericId<"User">[] | undefined;
+  userIds?: convex_values2499.GenericId<"User">[] | undefined;
 }, Promise<{
-  _id: convex_values2496.GenericId<"Account">;
+  _id: convex_values2499.GenericId<"Account">;
   _creationTime: number;
   extend?: any;
   secret?: string | undefined;
   emailVerified?: string | undefined;
   phoneVerified?: string | undefined;
-  userId: convex_values2496.GenericId<"User">;
+  userId: convex_values2499.GenericId<"User">;
   provider: string;
   providerAccountId: string;
 }[]>>;
 /** Insert a new account. */
-declare const create: convex_server96.RegisteredMutation<"public", {
+declare const create: convex_server89.RegisteredMutation<"public", {
   extend?: any;
   secret?: string | undefined;
-  userId: convex_values2496.GenericId<"User">;
+  userId: convex_values2499.GenericId<"User">;
   provider: string;
   providerAccountId: string;
-}, Promise<convex_values2496.GenericId<"Account">>>;
+}, Promise<convex_values2499.GenericId<"Account">>>;
 /** Patch fields on an account. */
-declare const update: convex_server96.RegisteredMutation<"public", {
-  id: convex_values2496.GenericId<"Account">;
+declare const update: convex_server89.RegisteredMutation<"public", {
+  id: convex_values2499.GenericId<"Account">;
   patch: {
-    userId?: convex_values2496.GenericId<"User"> | undefined;
     extend?: any;
-    provider?: string | undefined;
-    providerAccountId?: string | undefined;
     secret?: string | undefined;
     emailVerified?: string | undefined;
+    userId?: convex_values2499.GenericId<"User"> | undefined;
+    provider?: string | undefined;
+    providerAccountId?: string | undefined;
     phoneVerified?: string | undefined;
   };
 }, Promise<null>>;
@@ -141,10 +141,10 @@ declare const update: convex_server96.RegisteredMutation<"public", {
  * Delete an account. When `requireOtherAccount` is set, refuses to delete the
  * user's last remaining account so they are never left with none.
  */
-declare const remove: convex_server96.RegisteredMutation<"public", {
-  userId?: convex_values2496.GenericId<"User"> | undefined;
+declare const remove: convex_server89.RegisteredMutation<"public", {
+  userId?: convex_values2499.GenericId<"User"> | undefined;
   requireOtherAccount?: boolean | undefined;
-  id: convex_values2496.GenericId<"Account">;
+  id: convex_values2499.GenericId<"Account">;
 }, Promise<null>>;
 //#endregion
 export { account_d_exports };

package/dist/component/account.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account.d.ts","names":[],"sources":["../../src/component/account.ts"],"mappings":";;;;;;;;KAuBK,yBAAA,GAA4B,IAAA,CAAK,WAAA;EAA0B,MAAA;AAAA;;cAGnD,sBAAA,kBAAsB,kBAAA;;;;;;;;;;;;;;;;;;;;SAuDjC,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAGW,yBAAA,kBAAyB,kBAAA;;eA+CpC,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;cAMW,GAAA,kBAAG,eAAA;OAmBd,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;cASW,IAAA,kBAAI,eAAA;WAgCf,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;;cAGW,MAAA,kBAAM,kBAAA;;;UAqCjB,iBAAA,CAAA,SAAA;;;;;cAGW,MAAA,kBAAM,kBAAA;MAkBjB,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;AA7FF;cAmGM,MAAA,kBAAM,kBAAA;WAmCV,iBAAA,CAAA,SAAA"}
+{"version":3,"file":"account.d.ts","names":[],"sources":["../../src/component/account.ts"],"mappings":";;;;;;;;KAwBK,yBAAA,GAA4B,IAAA,CAAK,WAAA;EAA0B,MAAA;AAAA;;cAGnD,sBAAA,kBAAsB,kBAAA;;;;;;;;;;;;;;;;;;;;SAuDjC,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAGW,yBAAA,kBAAyB,kBAAA;;eA+CpC,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;cAMW,GAAA,kBAAG,eAAA;OAmBd,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;cASW,IAAA,kBAAI,eAAA;WAgCf,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;;cAGW,MAAA,kBAAM,kBAAA;;;UAqCjB,iBAAA,CAAA,SAAA;;;;;cAGW,MAAA,kBAAM,kBAAA;MAkBjB,iBAAA,CAAA,SAAA;;;;;;;;;;;;;;AA7FF;cAmGM,MAAA,kBAAM,kBAAA;WA6BV,iBAAA,CAAA,SAAA"}

package/dist/component/account.js

@@ -1,9 +1,10 @@
 import { ErrorCode } from "../shared/codes.js";
+import { convexError } from "../shared/errors.js";
 import { mutation, query } from "./_generated/server.js";
 import { recordSignInLimit, resetSignInLimit } from "./limits.js";
 import { vAccountDoc, vUserDoc } from "./documents.js";
 import { createSessionRows, vSessionReplacement } from "./session.js";
-import { ConvexError, v } from "convex/values";
+import { v } from "convex/values";
 
 //#region src/component/account.ts
 /**
@@ -131,10 +132,7 @@ const list = query({
 		const userIds = args.userId === void 0 ? args.userIds ?? [] : [args.userId];
 		const uniqueUserIds = Array.from(new Set(userIds));
 		const provider = args.provider;
-		if (uniqueUserIds.length > ACCOUNT_LIST_USER_BATCH) throw new ConvexError({
-			code: ErrorCode.INVALID_PARAMETERS,
-			message: `At most ${ACCOUNT_LIST_USER_BATCH} users can be read at once.`
-		});
+		if (uniqueUserIds.length > ACCOUNT_LIST_USER_BATCH) throw convexError(ErrorCode.INVALID_PARAMETERS, `At most ${ACCOUNT_LIST_USER_BATCH} users can be read at once.`);
 		return (await Promise.all(uniqueUserIds.map(async (userId) => provider === void 0 ? await ctx.db.query("Account").withIndex("user_id_provider", (q) => q.eq("userId", userId)).take(ACCOUNT_LIST_BATCH) : await ctx.db.query("Account").withIndex("user_id_provider", (q) => q.eq("userId", userId).eq("provider", provider)).take(ACCOUNT_LIST_BATCH)))).flat();
 	}
 });
@@ -151,10 +149,7 @@ const create = mutation({
 	handler: async (ctx, args) => {
 		const existing = await ctx.db.query("Account").withIndex("provider_account_id", (q) => q.eq("provider", args.provider).eq("providerAccountId", args.providerAccountId)).first();
 		if (existing !== null) {
-			if (existing.userId !== args.userId) throw new ConvexError({
-				code: ErrorCode.ACCOUNT_ALREADY_LINKED,
-				message: "This account is already linked to another user."
-			});
+			if (existing.userId !== args.userId) throw convexError(ErrorCode.ACCOUNT_ALREADY_LINKED, "This account is already linked to another user.");
 			return existing._id;
 		}
 		return await ctx.db.insert("Account", args);
@@ -193,20 +188,14 @@ const remove = mutation({
 	returns: v.null(),
 	handler: async (ctx, { id: accountId, userId, requireOtherAccount }) => {
 		const doc = await ctx.db.get("Account", accountId);
-		if (doc === null || userId !== void 0 && doc.userId !== userId) throw new ConvexError({
-			code: ErrorCode.ACCOUNT_NOT_FOUND,
-			message: "Account not found."
-		});
+		if (doc === null || userId !== void 0 && doc.userId !== userId) throw convexError(ErrorCode.ACCOUNT_NOT_FOUND, "Account not found.");
 		if (requireOtherAccount === true) {
 			let otherFound = false;
 			for await (const sibling of ctx.db.query("Account").withIndex("user_id_provider", (q) => q.eq("userId", doc.userId))) if (sibling._id !== accountId) {
 				otherFound = true;
 				break;
 			}
-			if (!otherFound) throw new ConvexError({
-				code: ErrorCode.INVALID_PARAMETERS,
-				message: "The provided parameters are invalid."
-			});
+			if (!otherFound) throw convexError(ErrorCode.INVALID_PARAMETERS, "The provided parameters are invalid.");
 		}
 		await ctx.db.delete("Account", accountId);
 		return null;

package/dist/component/account.js.map

@@ -1 +1 @@
-{"version":3,"file":"account.js","names":[],"sources":["../../src/component/account.ts"],"sourcesContent":["/**\n * `component.account.*` — provider-linked auth accounts.\n *\n * Reads collapse into one overloaded `get`; `list`\n * takes the owning `userId`.\n *\n * @module\n */\n\nimport { ConvexError, v } from \"convex/values\";\nimport { ErrorCode } from \"../shared/codes\";\n\nimport { recordSignInLimit, resetSignInLimit } from \"./limits\";\nimport { mutation, query } from \"./_generated/server\";\nimport { vAccountDoc, vUserDoc } from \"./documents\";\nimport { createSessionRows, type SessionRows, vSessionReplacement } from \"./session\";\n\n/** Maximum linked accounts returned for one user by the bounded read surface. */\nconst ACCOUNT_LIST_BATCH = 128;\n\n/** Maximum users accepted by one batched account read. */\nconst ACCOUNT_LIST_USER_BATCH = 100;\n\ntype AcceptedCredentialsSignIn = Omit<SessionRows, \"epoch\"> & { status: \"accepted\" };\n\n/** Reserve a password attempt and load all sign-in state in one transaction. */\nexport const beginCredentialsSignIn = mutation({\n  args: {\n    provider: v.string(),\n    providerAccountId: v.string(),\n    limitIdentifier: v.string(),\n    maxAttemptsPerHour: v.number(),\n    reserveAttempt: v.boolean(),\n    includeTotp: v.boolean(),\n  },\n  returns: v.union(\n    v.object({ status: v.literal(\"invalid\") }),\n    v.object({ status: v.literal(\"limited\") }),\n    v.object({\n      status: v.literal(\"ready\"),\n      account: vAccountDoc,\n      user: vUserDoc,\n      hasTotp: v.boolean(),\n    }),\n  ),\n  handler: async (ctx, args) => {\n    const limit = args.reserveAttempt\n      ? await recordSignInLimit(ctx, {\n          identifier: args.limitIdentifier,\n          maxAttemptsPerHour: args.maxAttemptsPerHour,\n        })\n      : { ok: true as const, retryAfter: undefined };\n    if (!limit.ok) return { status: \"limited\" as const };\n\n    const account = await ctx.db\n      .query(\"Account\")\n      .withIndex(\"provider_account_id\", (q) =>\n        q.eq(\"provider\", args.provider).eq(\"providerAccountId\", args.providerAccountId),\n      )\n      .unique();\n    if (account === null) return { status: \"invalid\" as const };\n\n    const [user, totp] = await Promise.all([\n      ctx.db.get(\"User\", account.userId),\n      args.includeTotp\n        ? ctx.db\n            .query(\"TotpFactor\")\n            .withIndex(\"user_id_verified\", (q) =>\n              q.eq(\"userId\", account.userId).eq(\"verified\", true),\n            )\n            .first()\n        : Promise.resolve(null),\n    ]);\n    if (user === null) return { status: \"invalid\" as const };\n    return {\n      status: \"ready\" as const,\n      account,\n      user,\n      hasTotp: totp !== null,\n    };\n  },\n});\n\n/** Refund a verified password attempt and optionally issue its session atomically. */\nexport const completeCredentialsSignIn = mutation({\n  args: {\n    accountId: v.id(\"Account\"),\n    limitIdentifier: v.string(),\n    issueSession: v.boolean(),\n    generateTokens: v.boolean(),\n    replaceSession: v.optional(vSessionReplacement),\n    sessionExpirationTime: v.number(),\n    refreshTokenExpirationTime: v.number(),\n  },\n  returns: v.union(\n    v.object({ status: v.literal(\"rejected\") }),\n    v.object({ status: v.literal(\"reset\") }),\n    v.object({\n      status: v.literal(\"accepted\"),\n      user: vUserDoc,\n      sessionId: v.id(\"Session\"),\n      sessionExpirationTime: v.number(),\n      refreshTokenId: v.optional(v.id(\"RefreshToken\")),\n      replacedSessionId: v.optional(v.id(\"Session\")),\n    }),\n  ),\n  handler: async (ctx, args) => {\n    const account = await ctx.db.get(\"Account\", args.accountId);\n    if (account === null) return { status: \"rejected\" as const };\n    await resetSignInLimit(ctx, args.limitIdentifier);\n    if (!args.issueSession) return { status: \"reset\" as const };\n\n    const created = await createSessionRows(ctx, {\n      userId: account.userId,\n      replaceSession: args.replaceSession,\n      sessionExpirationTime: args.sessionExpirationTime,\n      refreshTokenExpirationTime: args.generateTokens ? args.refreshTokenExpirationTime : undefined,\n    });\n    if (created === null) return { status: \"rejected\" as const };\n    const result: AcceptedCredentialsSignIn = {\n      status: \"accepted\" as const,\n      user: created.user,\n      sessionId: created.sessionId,\n      sessionExpirationTime: created.sessionExpirationTime,\n    };\n    if (created.refreshTokenId !== undefined) result.refreshTokenId = created.refreshTokenId;\n    if (created.replacedSessionId !== undefined) {\n      result.replacedSessionId = created.replacedSessionId;\n    }\n    return result;\n  },\n});\n\n/**\n * Read an account by id, or by `{ provider, providerAccountId }` when both\n * are given. Returns `null` when no selector matches.\n */\nexport const get = query({\n  args: {\n    id: v.optional(v.id(\"Account\")),\n    provider: v.optional(v.string()),\n    providerAccountId: v.optional(v.string()),\n  },\n  returns: v.union(vAccountDoc, v.null()),\n  handler: async (ctx, args) => {\n    if (args.provider !== undefined && args.providerAccountId !== undefined) {\n      return await ctx.db\n        .query(\"Account\")\n        .withIndex(\"provider_account_id\", (q) =>\n          q.eq(\"provider\", args.provider!).eq(\"providerAccountId\", args.providerAccountId!),\n        )\n        .unique();\n    }\n    if (args.id === undefined) return null;\n    return await ctx.db.get(\"Account\", args.id);\n  },\n});\n\n/**\n * List the accounts owned by one user, or by a bounded batch of users.\n *\n * The batch form serves one component crossing for app-owned user lists. The\n * public server facade projects these raw records into safe capability\n * summaries before exposing them to application code.\n */\nexport const list = query({\n  args: {\n    userId: v.optional(v.id(\"User\")),\n    userIds: v.optional(v.array(v.id(\"User\"))),\n    provider: v.optional(v.string()),\n  },\n  returns: v.array(vAccountDoc),\n  handler: async (ctx, args) => {\n    const userIds = args.userId === undefined ? (args.userIds ?? []) : [args.userId];\n    const uniqueUserIds = Array.from(new Set(userIds));\n    const provider = args.provider;\n    if (uniqueUserIds.length > ACCOUNT_LIST_USER_BATCH) {\n      throw new ConvexError({\n        code: ErrorCode.INVALID_PARAMETERS,\n        message: `At most ${ACCOUNT_LIST_USER_BATCH} users can be read at once.`,\n      });\n    }\n    const accounts = await Promise.all(\n      uniqueUserIds.map(async (userId) =>\n        provider === undefined\n          ? await ctx.db\n              .query(\"Account\")\n              .withIndex(\"user_id_provider\", (q) => q.eq(\"userId\", userId))\n              .take(ACCOUNT_LIST_BATCH)\n          : await ctx.db\n              .query(\"Account\")\n              .withIndex(\"user_id_provider\", (q) => q.eq(\"userId\", userId).eq(\"provider\", provider))\n              .take(ACCOUNT_LIST_BATCH),\n      ),\n    );\n    return accounts.flat();\n  },\n});\n\n/** Insert a new account. */\nexport const create = mutation({\n  args: {\n    userId: v.id(\"User\"),\n    provider: v.string(),\n    providerAccountId: v.string(),\n    secret: v.optional(v.string()),\n    extend: v.optional(v.any()),\n  },\n  returns: v.id(\"Account\"),\n  handler: async (ctx, args) => {\n    // Dedup on the (provider, providerAccountId) identity. A bare insert let two\n    // concurrent or retried provisioning ceremonies — SCIM POST retries, a\n    // passkey double-submit — create duplicate Account rows, which then made\n    // `account.get(...).unique()` throw on every future lookup (a permanent\n    // sign-in lockout / rogue credential attribution). The index-range read plus\n    // insert in this single mutation is OCC-atomic: a racing insert into the same\n    // range conflicts and retries, then observes the winner's row below.\n    const existing = await ctx.db\n      .query(\"Account\")\n      .withIndex(\"provider_account_id\", (q) =>\n        q.eq(\"provider\", args.provider).eq(\"providerAccountId\", args.providerAccountId),\n      )\n      .first();\n    if (existing !== null) {\n      if (existing.userId !== args.userId) {\n        // Already linked to a different user — reject rather than silently\n        // attribute the identity (e.g. an attacker registering a passkey\n        // credentialId that already belongs to a victim).\n        throw new ConvexError({\n          code: ErrorCode.ACCOUNT_ALREADY_LINKED,\n          message: \"This account is already linked to another user.\",\n        });\n      }\n      return existing._id;\n    }\n    return await ctx.db.insert(\"Account\", args);\n  },\n});\n\n/** Patch fields on an account. */\nexport const update = mutation({\n  args: {\n    id: v.id(\"Account\"),\n    patch: v.object({\n      userId: v.optional(v.id(\"User\")),\n      provider: v.optional(v.string()),\n      providerAccountId: v.optional(v.string()),\n      secret: v.optional(v.string()),\n      emailVerified: v.optional(v.string()),\n      phoneVerified: v.optional(v.string()),\n      extend: v.optional(v.any()),\n    }),\n  },\n  returns: v.null(),\n  handler: async (ctx, { id: accountId, patch }) => {\n    await ctx.db.patch(\"Account\", accountId, patch);\n    return null;\n  },\n});\n\n/**\n * Delete an account. When `requireOtherAccount` is set, refuses to delete the\n * user's last remaining account so they are never left with none.\n */\nconst remove = mutation({\n  args: {\n    id: v.id(\"Account\"),\n    userId: v.optional(v.id(\"User\")),\n    requireOtherAccount: v.optional(v.boolean()),\n  },\n  returns: v.null(),\n  handler: async (ctx, { id: accountId, userId, requireOtherAccount }) => {\n    const doc = await ctx.db.get(\"Account\", accountId);\n    if (doc === null || (userId !== undefined && doc.userId !== userId)) {\n      throw new ConvexError({\n        code: ErrorCode.ACCOUNT_NOT_FOUND,\n        message: \"Account not found.\",\n      });\n    }\n    if (requireOtherAccount === true) {\n      let otherFound = false;\n      for await (const sibling of ctx.db\n        .query(\"Account\")\n        .withIndex(\"user_id_provider\", (q) => q.eq(\"userId\", doc.userId))) {\n        if (sibling._id !== accountId) {\n          otherFound = true;\n          break;\n        }\n      }\n      if (!otherFound) {\n        throw new ConvexError({\n          code: ErrorCode.INVALID_PARAMETERS,\n          message: \"The provided parameters are invalid.\",\n        });\n      }\n    }\n    await ctx.db.delete(\"Account\", accountId);\n    return null;\n  },\n});\n\nexport { remove };\n"],"mappings":";;;;;;;;;;;;;;;;;AAkBA,MAAM,qBAAqB;;AAG3B,MAAM,0BAA0B;;AAKhC,MAAa,yBAAyB,SAAS;CAC7C,MAAM;EACJ,UAAU,EAAE,QAAQ;EACpB,mBAAmB,EAAE,QAAQ;EAC7B,iBAAiB,EAAE,QAAQ;EAC3B,oBAAoB,EAAE,QAAQ;EAC9B,gBAAgB,EAAE,SAAS;EAC3B,aAAa,EAAE,SAAS;EACzB;CACD,SAAS,EAAE,MACT,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,UAAU,EAAE,CAAC,EAC1C,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,UAAU,EAAE,CAAC,EAC1C,EAAE,OAAO;EACP,QAAQ,EAAE,QAAQ,QAAQ;EAC1B,SAAS;EACT,MAAM;EACN,SAAS,EAAE,SAAS;EACrB,CAAC,CACH;CACD,SAAS,OAAO,KAAK,SAAS;AAO5B,MAAI,EANU,KAAK,iBACf,MAAM,kBAAkB,KAAK;GAC3B,YAAY,KAAK;GACjB,oBAAoB,KAAK;GAC1B,CAAC,GACF;GAAE,IAAI;GAAe,YAAY;GAAW,EACrC,GAAI,QAAO,EAAE,QAAQ,WAAoB;EAEpD,MAAM,UAAU,MAAM,IAAI,GACvB,MAAM,UAAU,CAChB,UAAU,wBAAwB,MACjC,EAAE,GAAG,YAAY,KAAK,SAAS,CAAC,GAAG,qBAAqB,KAAK,kBAAkB,CAChF,CACA,QAAQ;AACX,MAAI,YAAY,KAAM,QAAO,EAAE,QAAQ,WAAoB;EAE3D,MAAM,CAAC,MAAM,QAAQ,MAAM,QAAQ,IAAI,CACrC,IAAI,GAAG,IAAI,QAAQ,QAAQ,OAAO,EAClC,KAAK,cACD,IAAI,GACD,MAAM,aAAa,CACnB,UAAU,qBAAqB,MAC9B,EAAE,GAAG,UAAU,QAAQ,OAAO,CAAC,GAAG,YAAY,KAAK,CACpD,CACA,OAAO,GACV,QAAQ,QAAQ,KAAK,CAC1B,CAAC;AACF,MAAI,SAAS,KAAM,QAAO,EAAE,QAAQ,WAAoB;AACxD,SAAO;GACL,QAAQ;GACR;GACA;GACA,SAAS,SAAS;GACnB;;CAEJ,CAAC;;AAGF,MAAa,4BAA4B,SAAS;CAChD,MAAM;EACJ,WAAW,EAAE,GAAG,UAAU;EAC1B,iBAAiB,EAAE,QAAQ;EAC3B,cAAc,EAAE,SAAS;EACzB,gBAAgB,EAAE,SAAS;EAC3B,gBAAgB,EAAE,SAAS,oBAAoB;EAC/C,uBAAuB,EAAE,QAAQ;EACjC,4BAA4B,EAAE,QAAQ;EACvC;CACD,SAAS,EAAE,MACT,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,WAAW,EAAE,CAAC,EAC3C,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,QAAQ,EAAE,CAAC,EACxC,EAAE,OAAO;EACP,QAAQ,EAAE,QAAQ,WAAW;EAC7B,MAAM;EACN,WAAW,EAAE,GAAG,UAAU;EAC1B,uBAAuB,EAAE,QAAQ;EACjC,gBAAgB,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC;EAChD,mBAAmB,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC;EAC/C,CAAC,CACH;CACD,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,UAAU,MAAM,IAAI,GAAG,IAAI,WAAW,KAAK,UAAU;AAC3D,MAAI,YAAY,KAAM,QAAO,EAAE,QAAQ,YAAqB;AAC5D,QAAM,iBAAiB,KAAK,KAAK,gBAAgB;AACjD,MAAI,CAAC,KAAK,aAAc,QAAO,EAAE,QAAQ,SAAkB;EAE3D,MAAM,UAAU,MAAM,kBAAkB,KAAK;GAC3C,QAAQ,QAAQ;GAChB,gBAAgB,KAAK;GACrB,uBAAuB,KAAK;GAC5B,4BAA4B,KAAK,iBAAiB,KAAK,6BAA6B;GACrF,CAAC;AACF,MAAI,YAAY,KAAM,QAAO,EAAE,QAAQ,YAAqB;EAC5D,MAAM,SAAoC;GACxC,QAAQ;GACR,MAAM,QAAQ;GACd,WAAW,QAAQ;GACnB,uBAAuB,QAAQ;GAChC;AACD,MAAI,QAAQ,mBAAmB,OAAW,QAAO,iBAAiB,QAAQ;AAC1E,MAAI,QAAQ,sBAAsB,OAChC,QAAO,oBAAoB,QAAQ;AAErC,SAAO;;CAEV,CAAC;;;;;AAMF,MAAa,MAAM,MAAM;CACvB,MAAM;EACJ,IAAI,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC;EAC/B,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;EAChC,mBAAmB,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC1C;CACD,SAAS,EAAE,MAAM,aAAa,EAAE,MAAM,CAAC;CACvC,SAAS,OAAO,KAAK,SAAS;AAC5B,MAAI,KAAK,aAAa,UAAa,KAAK,sBAAsB,OAC5D,QAAO,MAAM,IAAI,GACd,MAAM,UAAU,CAChB,UAAU,wBAAwB,MACjC,EAAE,GAAG,YAAY,KAAK,SAAU,CAAC,GAAG,qBAAqB,KAAK,kBAAmB,CAClF,CACA,QAAQ;AAEb,MAAI,KAAK,OAAO,OAAW,QAAO;AAClC,SAAO,MAAM,IAAI,GAAG,IAAI,WAAW,KAAK,GAAG;;CAE9C,CAAC;;;;;;;;AASF,MAAa,OAAO,MAAM;CACxB,MAAM;EACJ,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;EAChC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC;EAC1C,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;EACjC;CACD,SAAS,EAAE,MAAM,YAAY;CAC7B,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,UAAU,KAAK,WAAW,SAAa,KAAK,WAAW,EAAE,GAAI,CAAC,KAAK,OAAO;EAChF,MAAM,gBAAgB,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC;EAClD,MAAM,WAAW,KAAK;AACtB,MAAI,cAAc,SAAS,wBACzB,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS,WAAW,wBAAwB;GAC7C,CAAC;AAeJ,UAbiB,MAAM,QAAQ,IAC7B,cAAc,IAAI,OAAO,WACvB,aAAa,SACT,MAAM,IAAI,GACP,MAAM,UAAU,CAChB,UAAU,qBAAqB,MAAM,EAAE,GAAG,UAAU,OAAO,CAAC,CAC5D,KAAK,mBAAmB,GAC3B,MAAM,IAAI,GACP,MAAM,UAAU,CAChB,UAAU,qBAAqB,MAAM,EAAE,GAAG,UAAU,OAAO,CAAC,GAAG,YAAY,SAAS,CAAC,CACrF,KAAK,mBAAmB,CAChC,CACF,EACe,MAAM;;CAEzB,CAAC;;AAGF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,QAAQ,EAAE,GAAG,OAAO;EACpB,UAAU,EAAE,QAAQ;EACpB,mBAAmB,EAAE,QAAQ;EAC7B,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC9B,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC;EAC5B;CACD,SAAS,EAAE,GAAG,UAAU;CACxB,SAAS,OAAO,KAAK,SAAS;EAQ5B,MAAM,WAAW,MAAM,IAAI,GACxB,MAAM,UAAU,CAChB,UAAU,wBAAwB,MACjC,EAAE,GAAG,YAAY,KAAK,SAAS,CAAC,GAAG,qBAAqB,KAAK,kBAAkB,CAChF,CACA,OAAO;AACV,MAAI,aAAa,MAAM;AACrB,OAAI,SAAS,WAAW,KAAK,OAI3B,OAAM,IAAI,YAAY;IACpB,MAAM,UAAU;IAChB,SAAS;IACV,CAAC;AAEJ,UAAO,SAAS;;AAElB,SAAO,MAAM,IAAI,GAAG,OAAO,WAAW,KAAK;;CAE9C,CAAC;;AAGF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,IAAI,EAAE,GAAG,UAAU;EACnB,OAAO,EAAE,OAAO;GACd,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;GAChC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;GAChC,mBAAmB,EAAE,SAAS,EAAE,QAAQ,CAAC;GACzC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;GAC9B,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC;GACrC,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC;GACrC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC;GAC5B,CAAC;EACH;CACD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,IAAI,WAAW,YAAY;AAChD,QAAM,IAAI,GAAG,MAAM,WAAW,WAAW,MAAM;AAC/C,SAAO;;CAEV,CAAC;;;;;AAMF,MAAM,SAAS,SAAS;CACtB,MAAM;EACJ,IAAI,EAAE,GAAG,UAAU;EACnB,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;EAChC,qBAAqB,EAAE,SAAS,EAAE,SAAS,CAAC;EAC7C;CACD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,IAAI,WAAW,QAAQ,0BAA0B;EACtE,MAAM,MAAM,MAAM,IAAI,GAAG,IAAI,WAAW,UAAU;AAClD,MAAI,QAAQ,QAAS,WAAW,UAAa,IAAI,WAAW,OAC1D,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS;GACV,CAAC;AAEJ,MAAI,wBAAwB,MAAM;GAChC,IAAI,aAAa;AACjB,cAAW,MAAM,WAAW,IAAI,GAC7B,MAAM,UAAU,CAChB,UAAU,qBAAqB,MAAM,EAAE,GAAG,UAAU,IAAI,OAAO,CAAC,CACjE,KAAI,QAAQ,QAAQ,WAAW;AAC7B,iBAAa;AACb;;AAGJ,OAAI,CAAC,WACH,OAAM,IAAI,YAAY;IACpB,MAAM,UAAU;IAChB,SAAS;IACV,CAAC;;AAGN,QAAM,IAAI,GAAG,OAAO,WAAW,UAAU;AACzC,SAAO;;CAEV,CAAC"}
+{"version":3,"file":"account.js","names":[],"sources":["../../src/component/account.ts"],"sourcesContent":["/**\n * `component.account.*` — provider-linked auth accounts.\n *\n * Reads collapse into one overloaded `get`; `list`\n * takes the owning `userId`.\n *\n * @module\n */\n\nimport { v } from \"convex/values\";\nimport { ErrorCode } from \"../shared/codes\";\nimport { convexError } from \"../shared/errors\";\n\nimport { recordSignInLimit, resetSignInLimit } from \"./limits\";\nimport { mutation, query } from \"./_generated/server\";\nimport { vAccountDoc, vUserDoc } from \"./documents\";\nimport { createSessionRows, type SessionRows, vSessionReplacement } from \"./session\";\n\n/** Maximum linked accounts returned for one user by the bounded read surface. */\nconst ACCOUNT_LIST_BATCH = 128;\n\n/** Maximum users accepted by one batched account read. */\nconst ACCOUNT_LIST_USER_BATCH = 100;\n\ntype AcceptedCredentialsSignIn = Omit<SessionRows, \"epoch\"> & { status: \"accepted\" };\n\n/** Reserve a password attempt and load all sign-in state in one transaction. */\nexport const beginCredentialsSignIn = mutation({\n  args: {\n    provider: v.string(),\n    providerAccountId: v.string(),\n    limitIdentifier: v.string(),\n    maxAttemptsPerHour: v.number(),\n    reserveAttempt: v.boolean(),\n    includeTotp: v.boolean(),\n  },\n  returns: v.union(\n    v.object({ status: v.literal(\"invalid\") }),\n    v.object({ status: v.literal(\"limited\") }),\n    v.object({\n      status: v.literal(\"ready\"),\n      account: vAccountDoc,\n      user: vUserDoc,\n      hasTotp: v.boolean(),\n    }),\n  ),\n  handler: async (ctx, args) => {\n    const limit = args.reserveAttempt\n      ? await recordSignInLimit(ctx, {\n          identifier: args.limitIdentifier,\n          maxAttemptsPerHour: args.maxAttemptsPerHour,\n        })\n      : { ok: true as const, retryAfter: undefined };\n    if (!limit.ok) return { status: \"limited\" as const };\n\n    const account = await ctx.db\n      .query(\"Account\")\n      .withIndex(\"provider_account_id\", (q) =>\n        q.eq(\"provider\", args.provider).eq(\"providerAccountId\", args.providerAccountId),\n      )\n      .unique();\n    if (account === null) return { status: \"invalid\" as const };\n\n    const [user, totp] = await Promise.all([\n      ctx.db.get(\"User\", account.userId),\n      args.includeTotp\n        ? ctx.db\n            .query(\"TotpFactor\")\n            .withIndex(\"user_id_verified\", (q) =>\n              q.eq(\"userId\", account.userId).eq(\"verified\", true),\n            )\n            .first()\n        : Promise.resolve(null),\n    ]);\n    if (user === null) return { status: \"invalid\" as const };\n    return {\n      status: \"ready\" as const,\n      account,\n      user,\n      hasTotp: totp !== null,\n    };\n  },\n});\n\n/** Refund a verified password attempt and optionally issue its session atomically. */\nexport const completeCredentialsSignIn = mutation({\n  args: {\n    accountId: v.id(\"Account\"),\n    limitIdentifier: v.string(),\n    issueSession: v.boolean(),\n    generateTokens: v.boolean(),\n    replaceSession: v.optional(vSessionReplacement),\n    sessionExpirationTime: v.number(),\n    refreshTokenExpirationTime: v.number(),\n  },\n  returns: v.union(\n    v.object({ status: v.literal(\"rejected\") }),\n    v.object({ status: v.literal(\"reset\") }),\n    v.object({\n      status: v.literal(\"accepted\"),\n      user: vUserDoc,\n      sessionId: v.id(\"Session\"),\n      sessionExpirationTime: v.number(),\n      refreshTokenId: v.optional(v.id(\"RefreshToken\")),\n      replacedSessionId: v.optional(v.id(\"Session\")),\n    }),\n  ),\n  handler: async (ctx, args) => {\n    const account = await ctx.db.get(\"Account\", args.accountId);\n    if (account === null) return { status: \"rejected\" as const };\n    await resetSignInLimit(ctx, args.limitIdentifier);\n    if (!args.issueSession) return { status: \"reset\" as const };\n\n    const created = await createSessionRows(ctx, {\n      userId: account.userId,\n      replaceSession: args.replaceSession,\n      sessionExpirationTime: args.sessionExpirationTime,\n      refreshTokenExpirationTime: args.generateTokens ? args.refreshTokenExpirationTime : undefined,\n    });\n    if (created === null) return { status: \"rejected\" as const };\n    const result: AcceptedCredentialsSignIn = {\n      status: \"accepted\" as const,\n      user: created.user,\n      sessionId: created.sessionId,\n      sessionExpirationTime: created.sessionExpirationTime,\n    };\n    if (created.refreshTokenId !== undefined) result.refreshTokenId = created.refreshTokenId;\n    if (created.replacedSessionId !== undefined) {\n      result.replacedSessionId = created.replacedSessionId;\n    }\n    return result;\n  },\n});\n\n/**\n * Read an account by id, or by `{ provider, providerAccountId }` when both\n * are given. Returns `null` when no selector matches.\n */\nexport const get = query({\n  args: {\n    id: v.optional(v.id(\"Account\")),\n    provider: v.optional(v.string()),\n    providerAccountId: v.optional(v.string()),\n  },\n  returns: v.union(vAccountDoc, v.null()),\n  handler: async (ctx, args) => {\n    if (args.provider !== undefined && args.providerAccountId !== undefined) {\n      return await ctx.db\n        .query(\"Account\")\n        .withIndex(\"provider_account_id\", (q) =>\n          q.eq(\"provider\", args.provider!).eq(\"providerAccountId\", args.providerAccountId!),\n        )\n        .unique();\n    }\n    if (args.id === undefined) return null;\n    return await ctx.db.get(\"Account\", args.id);\n  },\n});\n\n/**\n * List the accounts owned by one user, or by a bounded batch of users.\n *\n * The batch form serves one component crossing for app-owned user lists. The\n * public server facade projects these raw records into safe capability\n * summaries before exposing them to application code.\n */\nexport const list = query({\n  args: {\n    userId: v.optional(v.id(\"User\")),\n    userIds: v.optional(v.array(v.id(\"User\"))),\n    provider: v.optional(v.string()),\n  },\n  returns: v.array(vAccountDoc),\n  handler: async (ctx, args) => {\n    const userIds = args.userId === undefined ? (args.userIds ?? []) : [args.userId];\n    const uniqueUserIds = Array.from(new Set(userIds));\n    const provider = args.provider;\n    if (uniqueUserIds.length > ACCOUNT_LIST_USER_BATCH) {\n      throw convexError(\n        ErrorCode.INVALID_PARAMETERS,\n        `At most ${ACCOUNT_LIST_USER_BATCH} users can be read at once.`,\n      );\n    }\n    const accounts = await Promise.all(\n      uniqueUserIds.map(async (userId) =>\n        provider === undefined\n          ? await ctx.db\n              .query(\"Account\")\n              .withIndex(\"user_id_provider\", (q) => q.eq(\"userId\", userId))\n              .take(ACCOUNT_LIST_BATCH)\n          : await ctx.db\n              .query(\"Account\")\n              .withIndex(\"user_id_provider\", (q) => q.eq(\"userId\", userId).eq(\"provider\", provider))\n              .take(ACCOUNT_LIST_BATCH),\n      ),\n    );\n    return accounts.flat();\n  },\n});\n\n/** Insert a new account. */\nexport const create = mutation({\n  args: {\n    userId: v.id(\"User\"),\n    provider: v.string(),\n    providerAccountId: v.string(),\n    secret: v.optional(v.string()),\n    extend: v.optional(v.any()),\n  },\n  returns: v.id(\"Account\"),\n  handler: async (ctx, args) => {\n    // Dedup on the (provider, providerAccountId) identity. A bare insert let two\n    // concurrent or retried provisioning ceremonies — SCIM POST retries, a\n    // passkey double-submit — create duplicate Account rows, which then made\n    // `account.get(...).unique()` throw on every future lookup (a permanent\n    // sign-in lockout / rogue credential attribution). The index-range read plus\n    // insert in this single mutation is OCC-atomic: a racing insert into the same\n    // range conflicts and retries, then observes the winner's row below.\n    const existing = await ctx.db\n      .query(\"Account\")\n      .withIndex(\"provider_account_id\", (q) =>\n        q.eq(\"provider\", args.provider).eq(\"providerAccountId\", args.providerAccountId),\n      )\n      .first();\n    if (existing !== null) {\n      if (existing.userId !== args.userId) {\n        // Already linked to a different user — reject rather than silently\n        // attribute the identity (e.g. an attacker registering a passkey\n        // credentialId that already belongs to a victim).\n        throw convexError(\n          ErrorCode.ACCOUNT_ALREADY_LINKED,\n          \"This account is already linked to another user.\",\n        );\n      }\n      return existing._id;\n    }\n    return await ctx.db.insert(\"Account\", args);\n  },\n});\n\n/** Patch fields on an account. */\nexport const update = mutation({\n  args: {\n    id: v.id(\"Account\"),\n    patch: v.object({\n      userId: v.optional(v.id(\"User\")),\n      provider: v.optional(v.string()),\n      providerAccountId: v.optional(v.string()),\n      secret: v.optional(v.string()),\n      emailVerified: v.optional(v.string()),\n      phoneVerified: v.optional(v.string()),\n      extend: v.optional(v.any()),\n    }),\n  },\n  returns: v.null(),\n  handler: async (ctx, { id: accountId, patch }) => {\n    await ctx.db.patch(\"Account\", accountId, patch);\n    return null;\n  },\n});\n\n/**\n * Delete an account. When `requireOtherAccount` is set, refuses to delete the\n * user's last remaining account so they are never left with none.\n */\nconst remove = mutation({\n  args: {\n    id: v.id(\"Account\"),\n    userId: v.optional(v.id(\"User\")),\n    requireOtherAccount: v.optional(v.boolean()),\n  },\n  returns: v.null(),\n  handler: async (ctx, { id: accountId, userId, requireOtherAccount }) => {\n    const doc = await ctx.db.get(\"Account\", accountId);\n    if (doc === null || (userId !== undefined && doc.userId !== userId)) {\n      throw convexError(ErrorCode.ACCOUNT_NOT_FOUND, \"Account not found.\");\n    }\n    if (requireOtherAccount === true) {\n      let otherFound = false;\n      for await (const sibling of ctx.db\n        .query(\"Account\")\n        .withIndex(\"user_id_provider\", (q) => q.eq(\"userId\", doc.userId))) {\n        if (sibling._id !== accountId) {\n          otherFound = true;\n          break;\n        }\n      }\n      if (!otherFound) {\n        throw convexError(ErrorCode.INVALID_PARAMETERS, \"The provided parameters are invalid.\");\n      }\n    }\n    await ctx.db.delete(\"Account\", accountId);\n    return null;\n  },\n});\n\nexport { remove };\n"],"mappings":";;;;;;;;;;;;;;;;;;AAmBA,MAAM,qBAAqB;;AAG3B,MAAM,0BAA0B;;AAKhC,MAAa,yBAAyB,SAAS;CAC7C,MAAM;EACJ,UAAU,EAAE,QAAQ;EACpB,mBAAmB,EAAE,QAAQ;EAC7B,iBAAiB,EAAE,QAAQ;EAC3B,oBAAoB,EAAE,QAAQ;EAC9B,gBAAgB,EAAE,SAAS;EAC3B,aAAa,EAAE,SAAS;EACzB;CACD,SAAS,EAAE,MACT,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,UAAU,EAAE,CAAC,EAC1C,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,UAAU,EAAE,CAAC,EAC1C,EAAE,OAAO;EACP,QAAQ,EAAE,QAAQ,QAAQ;EAC1B,SAAS;EACT,MAAM;EACN,SAAS,EAAE,SAAS;EACrB,CAAC,CACH;CACD,SAAS,OAAO,KAAK,SAAS;AAO5B,MAAI,EANU,KAAK,iBACf,MAAM,kBAAkB,KAAK;GAC3B,YAAY,KAAK;GACjB,oBAAoB,KAAK;GAC1B,CAAC,GACF;GAAE,IAAI;GAAe,YAAY;GAAW,EACrC,GAAI,QAAO,EAAE,QAAQ,WAAoB;EAEpD,MAAM,UAAU,MAAM,IAAI,GACvB,MAAM,UAAU,CAChB,UAAU,wBAAwB,MACjC,EAAE,GAAG,YAAY,KAAK,SAAS,CAAC,GAAG,qBAAqB,KAAK,kBAAkB,CAChF,CACA,QAAQ;AACX,MAAI,YAAY,KAAM,QAAO,EAAE,QAAQ,WAAoB;EAE3D,MAAM,CAAC,MAAM,QAAQ,MAAM,QAAQ,IAAI,CACrC,IAAI,GAAG,IAAI,QAAQ,QAAQ,OAAO,EAClC,KAAK,cACD,IAAI,GACD,MAAM,aAAa,CACnB,UAAU,qBAAqB,MAC9B,EAAE,GAAG,UAAU,QAAQ,OAAO,CAAC,GAAG,YAAY,KAAK,CACpD,CACA,OAAO,GACV,QAAQ,QAAQ,KAAK,CAC1B,CAAC;AACF,MAAI,SAAS,KAAM,QAAO,EAAE,QAAQ,WAAoB;AACxD,SAAO;GACL,QAAQ;GACR;GACA;GACA,SAAS,SAAS;GACnB;;CAEJ,CAAC;;AAGF,MAAa,4BAA4B,SAAS;CAChD,MAAM;EACJ,WAAW,EAAE,GAAG,UAAU;EAC1B,iBAAiB,EAAE,QAAQ;EAC3B,cAAc,EAAE,SAAS;EACzB,gBAAgB,EAAE,SAAS;EAC3B,gBAAgB,EAAE,SAAS,oBAAoB;EAC/C,uBAAuB,EAAE,QAAQ;EACjC,4BAA4B,EAAE,QAAQ;EACvC;CACD,SAAS,EAAE,MACT,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,WAAW,EAAE,CAAC,EAC3C,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,QAAQ,EAAE,CAAC,EACxC,EAAE,OAAO;EACP,QAAQ,EAAE,QAAQ,WAAW;EAC7B,MAAM;EACN,WAAW,EAAE,GAAG,UAAU;EAC1B,uBAAuB,EAAE,QAAQ;EACjC,gBAAgB,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC;EAChD,mBAAmB,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC;EAC/C,CAAC,CACH;CACD,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,UAAU,MAAM,IAAI,GAAG,IAAI,WAAW,KAAK,UAAU;AAC3D,MAAI,YAAY,KAAM,QAAO,EAAE,QAAQ,YAAqB;AAC5D,QAAM,iBAAiB,KAAK,KAAK,gBAAgB;AACjD,MAAI,CAAC,KAAK,aAAc,QAAO,EAAE,QAAQ,SAAkB;EAE3D,MAAM,UAAU,MAAM,kBAAkB,KAAK;GAC3C,QAAQ,QAAQ;GAChB,gBAAgB,KAAK;GACrB,uBAAuB,KAAK;GAC5B,4BAA4B,KAAK,iBAAiB,KAAK,6BAA6B;GACrF,CAAC;AACF,MAAI,YAAY,KAAM,QAAO,EAAE,QAAQ,YAAqB;EAC5D,MAAM,SAAoC;GACxC,QAAQ;GACR,MAAM,QAAQ;GACd,WAAW,QAAQ;GACnB,uBAAuB,QAAQ;GAChC;AACD,MAAI,QAAQ,mBAAmB,OAAW,QAAO,iBAAiB,QAAQ;AAC1E,MAAI,QAAQ,sBAAsB,OAChC,QAAO,oBAAoB,QAAQ;AAErC,SAAO;;CAEV,CAAC;;;;;AAMF,MAAa,MAAM,MAAM;CACvB,MAAM;EACJ,IAAI,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC;EAC/B,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;EAChC,mBAAmB,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC1C;CACD,SAAS,EAAE,MAAM,aAAa,EAAE,MAAM,CAAC;CACvC,SAAS,OAAO,KAAK,SAAS;AAC5B,MAAI,KAAK,aAAa,UAAa,KAAK,sBAAsB,OAC5D,QAAO,MAAM,IAAI,GACd,MAAM,UAAU,CAChB,UAAU,wBAAwB,MACjC,EAAE,GAAG,YAAY,KAAK,SAAU,CAAC,GAAG,qBAAqB,KAAK,kBAAmB,CAClF,CACA,QAAQ;AAEb,MAAI,KAAK,OAAO,OAAW,QAAO;AAClC,SAAO,MAAM,IAAI,GAAG,IAAI,WAAW,KAAK,GAAG;;CAE9C,CAAC;;;;;;;;AASF,MAAa,OAAO,MAAM;CACxB,MAAM;EACJ,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;EAChC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC;EAC1C,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;EACjC;CACD,SAAS,EAAE,MAAM,YAAY;CAC7B,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,UAAU,KAAK,WAAW,SAAa,KAAK,WAAW,EAAE,GAAI,CAAC,KAAK,OAAO;EAChF,MAAM,gBAAgB,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC;EAClD,MAAM,WAAW,KAAK;AACtB,MAAI,cAAc,SAAS,wBACzB,OAAM,YACJ,UAAU,oBACV,WAAW,wBAAwB,6BACpC;AAeH,UAbiB,MAAM,QAAQ,IAC7B,cAAc,IAAI,OAAO,WACvB,aAAa,SACT,MAAM,IAAI,GACP,MAAM,UAAU,CAChB,UAAU,qBAAqB,MAAM,EAAE,GAAG,UAAU,OAAO,CAAC,CAC5D,KAAK,mBAAmB,GAC3B,MAAM,IAAI,GACP,MAAM,UAAU,CAChB,UAAU,qBAAqB,MAAM,EAAE,GAAG,UAAU,OAAO,CAAC,GAAG,YAAY,SAAS,CAAC,CACrF,KAAK,mBAAmB,CAChC,CACF,EACe,MAAM;;CAEzB,CAAC;;AAGF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,QAAQ,EAAE,GAAG,OAAO;EACpB,UAAU,EAAE,QAAQ;EACpB,mBAAmB,EAAE,QAAQ;EAC7B,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC9B,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC;EAC5B;CACD,SAAS,EAAE,GAAG,UAAU;CACxB,SAAS,OAAO,KAAK,SAAS;EAQ5B,MAAM,WAAW,MAAM,IAAI,GACxB,MAAM,UAAU,CAChB,UAAU,wBAAwB,MACjC,EAAE,GAAG,YAAY,KAAK,SAAS,CAAC,GAAG,qBAAqB,KAAK,kBAAkB,CAChF,CACA,OAAO;AACV,MAAI,aAAa,MAAM;AACrB,OAAI,SAAS,WAAW,KAAK,OAI3B,OAAM,YACJ,UAAU,wBACV,kDACD;AAEH,UAAO,SAAS;;AAElB,SAAO,MAAM,IAAI,GAAG,OAAO,WAAW,KAAK;;CAE9C,CAAC;;AAGF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,IAAI,EAAE,GAAG,UAAU;EACnB,OAAO,EAAE,OAAO;GACd,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;GAChC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;GAChC,mBAAmB,EAAE,SAAS,EAAE,QAAQ,CAAC;GACzC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;GAC9B,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC;GACrC,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC;GACrC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC;GAC5B,CAAC;EACH;CACD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,IAAI,WAAW,YAAY;AAChD,QAAM,IAAI,GAAG,MAAM,WAAW,WAAW,MAAM;AAC/C,SAAO;;CAEV,CAAC;;;;;AAMF,MAAM,SAAS,SAAS;CACtB,MAAM;EACJ,IAAI,EAAE,GAAG,UAAU;EACnB,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;EAChC,qBAAqB,EAAE,SAAS,EAAE,SAAS,CAAC;EAC7C;CACD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,IAAI,WAAW,QAAQ,0BAA0B;EACtE,MAAM,MAAM,MAAM,IAAI,GAAG,IAAI,WAAW,UAAU;AAClD,MAAI,QAAQ,QAAS,WAAW,UAAa,IAAI,WAAW,OAC1D,OAAM,YAAY,UAAU,mBAAmB,qBAAqB;AAEtE,MAAI,wBAAwB,MAAM;GAChC,IAAI,aAAa;AACjB,cAAW,MAAM,WAAW,IAAI,GAC7B,MAAM,UAAU,CAChB,UAAU,qBAAqB,MAAM,EAAE,GAAG,UAAU,IAAI,OAAO,CAAC,CACjE,KAAI,QAAQ,QAAQ,WAAW;AAC7B,iBAAa;AACb;;AAGJ,OAAI,CAAC,WACH,OAAM,YAAY,UAAU,oBAAoB,uCAAuC;;AAG3F,QAAM,IAAI,GAAG,OAAO,WAAW,UAAU;AACzC,SAAO;;CAEV,CAAC"}

package/dist/component/batch.js

@@ -1,15 +1,12 @@
 import { ErrorCode } from "../shared/codes.js";
-import { ConvexError } from "convex/values";
+import { convexError } from "../shared/errors.js";
 
 //#region src/component/batch.ts
 /** Maximum IDs accepted by a single batched component read. @internal */
 const MAX_BATCH_SELECTOR_SIZE = 100;
 /** @internal Reject an oversized batch before it can start database work. */
 function assertBatchSelectorSize(ids, selector) {
-	if (ids.length > MAX_BATCH_SELECTOR_SIZE) throw new ConvexError({
-		code: ErrorCode.INVALID_PARAMETERS,
-		message: `Batch selector "${selector}" accepts at most ${MAX_BATCH_SELECTOR_SIZE} IDs.`
-	});
+	if (ids.length > MAX_BATCH_SELECTOR_SIZE) throw convexError(ErrorCode.INVALID_PARAMETERS, `Batch selector "${selector}" accepts at most ${MAX_BATCH_SELECTOR_SIZE} IDs.`);
 }
 
 //#endregion

package/dist/component/batch.js.map

@@ -1 +1 @@
-{"version":3,"file":"batch.js","names":[],"sources":["../../src/component/batch.ts"],"sourcesContent":["import { ConvexError } from \"convex/values\";\n\nimport { ErrorCode } from \"../shared/codes\";\n\n/** Maximum IDs accepted by a single batched component read. @internal */\nexport const MAX_BATCH_SELECTOR_SIZE = 100;\n\n/** @internal Reject an oversized batch before it can start database work. */\nexport function assertBatchSelectorSize(ids: readonly unknown[], selector: string) {\n  if (ids.length > MAX_BATCH_SELECTOR_SIZE) {\n    throw new ConvexError({\n      code: ErrorCode.INVALID_PARAMETERS,\n      message: `Batch selector \"${selector}\" accepts at most ${MAX_BATCH_SELECTOR_SIZE} IDs.`,\n    });\n  }\n}\n"],"mappings":";;;;;AAKA,MAAa,0BAA0B;;AAGvC,SAAgB,wBAAwB,KAAyB,UAAkB;AACjF,KAAI,IAAI,SAAS,wBACf,OAAM,IAAI,YAAY;EACpB,MAAM,UAAU;EAChB,SAAS,mBAAmB,SAAS,oBAAoB,wBAAwB;EAClF,CAAC"}
+{"version":3,"file":"batch.js","names":[],"sources":["../../src/component/batch.ts"],"sourcesContent":["import { ErrorCode } from \"../shared/codes\";\nimport { convexError } from \"../shared/errors\";\n\n/** Maximum IDs accepted by a single batched component read. @internal */\nexport const MAX_BATCH_SELECTOR_SIZE = 100;\n\n/** @internal Reject an oversized batch before it can start database work. */\nexport function assertBatchSelectorSize(ids: readonly unknown[], selector: string) {\n  if (ids.length > MAX_BATCH_SELECTOR_SIZE) {\n    throw convexError(\n      ErrorCode.INVALID_PARAMETERS,\n      `Batch selector \"${selector}\" accepts at most ${MAX_BATCH_SELECTOR_SIZE} IDs.`,\n    );\n  }\n}\n"],"mappings":";;;;;AAIA,MAAa,0BAA0B;;AAGvC,SAAgB,wBAAwB,KAAyB,UAAkB;AACjF,KAAI,IAAI,SAAS,wBACf,OAAM,YACJ,UAAU,oBACV,mBAAmB,SAAS,oBAAoB,wBAAwB,OACzE"}