@robelest/convex-auth 0.0.4-preview.16 → 0.0.4-preview.18

package/dist/server/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","names":["AuthFactory"],"sources":["../../src/server/auth.ts"],"sourcesContent":["/**\n * Auth configuration helpers for Convex Auth.\n *\n * @module\n */\n\nimport type { UserIdentity } from \"convex/server\";\nimport type { GenericId } from \"convex/values\";\n\nimport type { AuthApiRefs } from \"../client/index\";\nimport { Auth as AuthFactory } from \"./factory\";\nimport { Fx } from \"./fx\";\nimport { AuthError } from \"./fx\";\nimport type { Doc } from \"./types\";\nimport type {\n  AuthAuthorizationConfig,\n  AuthGrant,\n  AuthProviderConfig,\n  AuthRoleDefinition,\n  AuthRoleId,\n  ConvexAuthConfig,\n  HasDeviceProvider,\n  HasPasskeyProvider,\n  HasSSO,\n  HasTotpProvider,\n} from \"./types\";\n\n// ============================================================================\n// Types\n// ============================================================================\n\n/**\n * Config for auth setup. Extends the standard auth config\n * minus `component` (which is passed as the first constructor argument).\n */\nexport type AuthConfig = Omit<ConvexAuthConfig, \"component\">;\n\ntype MemberApiWithAuthorization<\n  TAuthorization extends AuthAuthorizationConfig | undefined,\n> = Omit<\n  ReturnType<typeof AuthFactory>[\"auth\"][\"member\"],\n  \"create\" | \"list\" | \"update\" | \"inherit\" | \"require\"\n> & {\n  create: (\n    ctx: Parameters<\n      ReturnType<typeof AuthFactory>[\"auth\"][\"member\"][\"create\"]\n    >[0],\n    data: {\n      groupId: string;\n      userId: string;\n      roleIds?: AuthRoleId<TAuthorization>[];\n      status?: string;\n      extend?: Record<string, unknown>;\n    },\n  ) => Promise<{ ok: true; memberId: string }>;\n  list: (\n    ctx: Parameters<\n      ReturnType<typeof AuthFactory>[\"auth\"][\"member\"][\"list\"]\n    >[0],\n    opts?: {\n      where?: {\n        groupId?: string;\n        userId?: string;\n        roleId?: AuthRoleId<TAuthorization>;\n        status?: string;\n      };\n      limit?: number;\n      cursor?: string | null;\n      orderBy?: \"_creationTime\" | \"status\";\n      order?: \"asc\" | \"desc\";\n    },\n  ) => ReturnType<ReturnType<typeof AuthFactory>[\"auth\"][\"member\"][\"list\"]>;\n  update: (\n    ctx: Parameters<\n      ReturnType<typeof AuthFactory>[\"auth\"][\"member\"][\"update\"]\n    >[0],\n    memberId: string,\n    data: Record<string, unknown> & { roleIds?: AuthRoleId<TAuthorization>[] },\n  ) => Promise<{ ok: true; memberId: string }>;\n  inherit: (\n    ctx: Parameters<\n      ReturnType<typeof AuthFactory>[\"auth\"][\"member\"][\"inherit\"]\n    >[0],\n    opts: {\n      userId: string;\n      groupId: string;\n      roleIds?: AuthRoleId<TAuthorization>[];\n      grants?: AuthGrant<TAuthorization>[];\n      maxDepth?: number;\n    },\n  ) => ReturnType<ReturnType<typeof AuthFactory>[\"auth\"][\"member\"][\"inherit\"]>;\n  require: (\n    ctx: Parameters<\n      ReturnType<typeof AuthFactory>[\"auth\"][\"member\"][\"require\"]\n    >[0],\n    opts: {\n      userId: string;\n      groupId: string;\n      roleIds?: AuthRoleId<TAuthorization>[];\n      grants?: AuthGrant<TAuthorization>[];\n      maxDepth?: number;\n    },\n  ) => ReturnType<ReturnType<typeof AuthFactory>[\"auth\"][\"member\"][\"require\"]>;\n};\n\ntype AccessApiWithAuthorization<\n  TAuthorization extends AuthAuthorizationConfig | undefined,\n> = {\n  check: (\n    ctx: Parameters<\n      ReturnType<typeof AuthFactory>[\"auth\"][\"access\"][\"check\"]\n    >[0],\n    opts: {\n      userId: string;\n      groupId: string;\n      grants: AuthGrant<TAuthorization>[];\n      maxDepth?: number;\n    },\n  ) => ReturnType<ReturnType<typeof AuthFactory>[\"auth\"][\"access\"][\"check\"]>;\n  require: (\n    ctx: Parameters<\n      ReturnType<typeof AuthFactory>[\"auth\"][\"access\"][\"require\"]\n    >[0],\n    opts: {\n      userId: string;\n      groupId: string;\n      grants: AuthGrant<TAuthorization>[];\n      maxDepth?: number;\n    },\n  ) => ReturnType<ReturnType<typeof AuthFactory>[\"auth\"][\"access\"][\"require\"]>;\n};\n\n/** The base auth API surface, without conditional namespaces. */\nexport type AuthApiBase<\n  TAuthorization extends AuthAuthorizationConfig | undefined = undefined,\n> = {\n  signIn: ReturnType<typeof AuthFactory>[\"signIn\"];\n  signOut: ReturnType<typeof AuthFactory>[\"signOut\"];\n  store: ReturnType<typeof AuthFactory>[\"store\"];\n  user: ReturnType<typeof AuthFactory>[\"auth\"][\"user\"];\n  session: ReturnType<typeof AuthFactory>[\"auth\"][\"session\"];\n  provider: ReturnType<typeof AuthFactory>[\"auth\"][\"provider\"];\n  account: ReturnType<typeof AuthFactory>[\"auth\"][\"account\"];\n  group: ReturnType<typeof AuthFactory>[\"auth\"][\"group\"];\n  member: MemberApiWithAuthorization<TAuthorization>;\n  access: AccessApiWithAuthorization<TAuthorization>;\n  invite: ReturnType<typeof AuthFactory>[\"auth\"][\"invite\"];\n  key: ReturnType<typeof AuthFactory>[\"auth\"][\"key\"];\n  http: ReturnType<typeof AuthFactory>[\"auth\"][\"http\"];\n};\n\ntype InternalSsoApi = ReturnType<typeof AuthFactory>[\"auth\"][\"sso\"];\n\ntype PublicSsoAdminApi = {\n  connection: InternalSsoApi[\"connection\"] & {\n    domain: {\n      list: InternalSsoApi[\"domain\"][\"list\"];\n      validate: InternalSsoApi[\"domain\"][\"validate\"];\n      set: (\n        ctx: Parameters<InternalSsoApi[\"connection\"][\"create\"]>[0],\n        enterpriseId: string,\n        domains: Array<{\n          domain: string;\n          isPrimary?: boolean;\n        }>,\n      ) => Promise<{\n        ok: true;\n        enterpriseId: string;\n        domains: Array<{\n          domainId: string;\n          domain: string;\n          isPrimary: boolean;\n          verified: boolean;\n          verifiedAt: number | null;\n        }>;\n      }>;\n      verification: {\n        request: (\n          ctx: Parameters<InternalSsoApi[\"connection\"][\"create\"]>[0],\n          args: { enterpriseId: string; domain: string },\n        ) => Promise<{\n          ok: true;\n          enterpriseId: string;\n          domain: string;\n          requestedAt: number;\n          expiresAt: number;\n          challenge: {\n            recordType: \"TXT\";\n            recordName: string;\n            recordValue: string;\n          };\n        }>;\n        confirm: (\n          ctx: Parameters<InternalSsoApi[\"connection\"][\"create\"]>[0],\n          args: { enterpriseId: string; domain: string },\n        ) => Promise<{\n          ok: boolean;\n          enterpriseId: string;\n          domain: string;\n          verifiedAt?: number;\n          checks: Array<{ name: string; ok: boolean; message?: string }>;\n        }>;\n      };\n    };\n  };\n  oidc: Omit<InternalSsoApi[\"oidc\"], \"signIn\">;\n  saml: Omit<InternalSsoApi[\"saml\"], \"metadata\">;\n  policy: InternalSsoApi[\"policy\"];\n  audit: {\n    list: InternalSsoApi[\"audit\"][\"list\"];\n  };\n  webhook: {\n    endpoint: InternalSsoApi[\"webhook\"][\"endpoint\"];\n    delivery: {\n      list: InternalSsoApi[\"webhook\"][\"delivery\"][\"list\"];\n    };\n  };\n};\n\ntype PublicSsoClientApi = {\n  signIn: InternalSsoApi[\"oidc\"][\"signIn\"];\n  metadata: InternalSsoApi[\"saml\"][\"metadata\"];\n};\n\ntype PublicSsoApi = {\n  admin: PublicSsoAdminApi;\n  client: PublicSsoClientApi;\n};\n\ntype PublicScimApi = {\n  admin: Omit<InternalSsoApi[\"scim\"], \"getConfigByToken\" | \"identity\">;\n};\n\n/** Auth API with enterprise namespaces — present only when `new SSO()` is in providers. */\nexport type AuthApi<\n  TAuthorization extends AuthAuthorizationConfig | undefined = undefined,\n> = AuthApiBase<TAuthorization> & {\n  sso: PublicSsoApi;\n  scim: PublicScimApi;\n};\n\n/**\n * The return type of `createAuth`. Conditional namespaces:\n * - `auth.sso` and `auth.scim` — only when `new SSO()` is in providers\n * - `auth.clientApi` — typed API refs for the client SDK with capabilities\n */\nexport type ConvexAuthResult<\n  P extends AuthProviderConfig[],\n  TAuthorization extends AuthAuthorizationConfig | undefined = undefined,\n> =\n  HasSSO<P> extends true\n    ? AuthApi<TAuthorization>\n    : AuthApiBase<TAuthorization>;\n\n/**\n * Infer the typed `AuthApiRefs` for the client SDK from a `createAuth` call.\n *\n * Use this as the generic parameter for `client()` on the frontend:\n *\n * ```ts\n * // convex/auth.ts\n * export const auth = createAuth(components.auth, { providers: [...] });\n *\n * // Frontend\n * import type { auth } from \"../convex/auth\";\n * import type { InferClientApi } from \"@robelest/convex-auth/component\";\n * const c = client<InferClientApi<typeof auth>>({ convex, api: api.auth });\n * ```\n */\nexport type InferClientApi<T> =\n  T extends ConvexAuthResult<infer P>\n    ? AuthApiRefs<\n        HasPasskeyProvider<P>,\n        HasTotpProvider<P>,\n        HasDeviceProvider<P>\n      >\n    : AuthApiRefs;\n\n/** @internal */\nexport type AuthLike = Pick<AuthApiBase, \"user\">;\n\n// ============================================================================\n// Auth setup APIs\n// ============================================================================\n\n/**\n * Create an auth API object.\n *\n * When `new SSO()` is included in providers, `auth.sso` and `auth.scim`\n * are available on the returned object. Without it, those namespaces are\n * absent and accessing them is a TypeScript compile error.\n */\nexport function createAuth<\n  P extends AuthProviderConfig[],\n  TAuthorization extends AuthAuthorizationConfig | undefined = undefined,\n>(\n  component: ConvexAuthConfig[\"component\"],\n  config: Omit<AuthConfig, \"providers\" | \"authorization\"> & {\n    providers: P;\n    authorization?: TAuthorization;\n  },\n): ConvexAuthResult<P, TAuthorization> {\n  const authResult = AuthFactory({\n    ...config,\n    component,\n    providers: [...config.providers],\n  });\n  const {\n    domain: domainApi,\n    scim: scimApi,\n    connection: connectionApi,\n    audit: auditApi,\n    webhook: webhookApi,\n    oidc: oidcApi,\n    saml: samlApi,\n    ...restSso\n  } = authResult.auth.sso as InternalSsoApi;\n\n  type SetEnterpriseDomains = PublicSsoAdminApi[\"connection\"][\"domain\"][\"set\"];\n  type EnterpriseDomainInput = Array<{\n    domain: string;\n    isPrimary?: boolean;\n  }>;\n  const setEnterpriseDomains: PublicSsoAdminApi[\"connection\"][\"domain\"][\"set\"] =\n    async (\n      ctx: Parameters<SetEnterpriseDomains>[0],\n      enterpriseId: Parameters<SetEnterpriseDomains>[1],\n      domains: EnterpriseDomainInput,\n    ) => {\n      const enterprise = await connectionApi.get(ctx, enterpriseId);\n      if (enterprise === null) {\n        throw new AuthError(\n          \"INVALID_PARAMETERS\",\n          \"Enterprise not found.\",\n        ).toConvexError();\n      }\n\n      const normalized = domains.map((entry: (typeof domains)[number]) => ({\n        ...entry,\n        domain: entry.domain.trim().toLowerCase(),\n      }));\n      const deduped = new Map<string, (typeof normalized)[number]>();\n      for (const entry of normalized) {\n        if (entry.domain.length === 0) {\n          throw new AuthError(\n            \"INVALID_PARAMETERS\",\n            \"Domain must not be empty.\",\n          ).toConvexError();\n        }\n        if (deduped.has(entry.domain)) {\n          throw new AuthError(\n            \"INVALID_PARAMETERS\",\n            `Duplicate domain: ${entry.domain}`,\n          ).toConvexError();\n        }\n        deduped.set(entry.domain, entry);\n      }\n\n      const nextDomains = [...deduped.values()];\n      const primaryCount = nextDomains.filter(\n        (entry) => entry.isPrimary,\n      ).length;\n      if (primaryCount > 1) {\n        throw new AuthError(\n          \"INVALID_PARAMETERS\",\n          \"Only one primary domain may be set.\",\n        ).toConvexError();\n      }\n      if (nextDomains.length > 0 && primaryCount === 0) {\n        nextDomains[0] = { ...nextDomains[0], isPrimary: true };\n      }\n\n      const currentDomains = await domainApi.list(ctx, enterpriseId);\n      const currentByDomain = new Map<string, (typeof currentDomains)[number]>(\n        currentDomains.map((entry: (typeof currentDomains)[number]) => [\n          entry.domain.toLowerCase(),\n          entry,\n        ]),\n      );\n\n      for (const existing of currentDomains) {\n        if (!deduped.has(existing.domain.toLowerCase())) {\n          await domainApi.remove(ctx, existing._id);\n        }\n      }\n\n      for (const nextDomain of nextDomains) {\n        const current = currentByDomain.get(nextDomain.domain);\n        if (current && current.isPrimary === Boolean(nextDomain.isPrimary)) {\n          continue;\n        }\n        if (current) {\n          await domainApi.remove(ctx, current._id);\n        }\n        const domainId = await domainApi.add(ctx, {\n          enterpriseId: enterprise._id,\n          groupId: enterprise.groupId,\n          domain: nextDomain.domain,\n          isPrimary: nextDomain.isPrimary,\n        });\n        if (current?.verifiedAt !== undefined) {\n          await (ctx as any).runMutation(\n            component.public.enterpriseDomainVerify,\n            {\n              domainId,\n              verifiedAt: current.verifiedAt,\n            },\n          );\n        }\n      }\n\n      const updatedDomains = await domainApi.list(ctx, enterpriseId);\n      return {\n        ok: true as const,\n        enterpriseId,\n        domains: updatedDomains.map(\n          (domain: (typeof updatedDomains)[number]) => ({\n            domainId: domain._id,\n            domain: domain.domain,\n            isPrimary: domain.isPrimary,\n            verified: domain.verifiedAt !== undefined,\n            verifiedAt: domain.verifiedAt ?? null,\n          }),\n        ),\n      };\n    };\n\n  const publicSso: PublicSsoApi = {\n    admin: {\n      ...restSso,\n      oidc: {\n        ...oidcApi,\n      },\n      saml: {\n        ...samlApi,\n      },\n      connection: {\n        ...connectionApi,\n        domain: {\n          list: domainApi.list,\n          validate: domainApi.validate,\n          set: setEnterpriseDomains,\n          verification: {\n            request: domainApi.verification.request,\n            confirm: domainApi.verification.confirm,\n          },\n        },\n      },\n      policy: restSso.policy,\n      audit: {\n        list: auditApi.list,\n      },\n      webhook: {\n        endpoint: webhookApi.endpoint,\n        delivery: {\n          list: webhookApi.delivery.list,\n        },\n      },\n    },\n    client: {\n      signIn: oidcApi.signIn,\n      metadata: samlApi.metadata,\n    },\n  };\n\n  return {\n    signIn: authResult.signIn,\n    signOut: authResult.signOut,\n    store: authResult.store,\n    user: authResult.auth.user,\n    session: authResult.auth.session,\n    provider: authResult.auth.provider,\n    account: authResult.auth.account,\n    group: authResult.auth.group,\n    member: authResult.auth.member,\n    access: authResult.auth.access,\n    invite: authResult.auth.invite,\n    key: authResult.auth.key,\n    sso: publicSso,\n    scim: {\n      admin: {\n        configure: scimApi.configure,\n        get: scimApi.get,\n        validate: scimApi.validate,\n      },\n    },\n    http: authResult.auth.http,\n  } as unknown as ConvexAuthResult<P, TAuthorization>;\n}\n\nexport function defineRoles<\n  const TRoles extends Record<\n    string,\n    { label?: string; grants: readonly string[] }\n  >,\n>(\n  roles: TRoles,\n): {\n  [K in keyof TRoles]: {\n    id: K & string;\n    label?: TRoles[K][\"label\"];\n    grants: Array<TRoles[K][\"grants\"][number] & string>;\n  };\n} {\n  return Object.fromEntries(\n    Object.entries(roles).map(([id, role]) => [\n      id,\n      {\n        id,\n        ...(role.label ? { label: role.label } : {}),\n        grants: [...role.grants],\n      },\n    ]),\n  ) as {\n    [K in keyof TRoles]: {\n      id: K & string;\n      label?: TRoles[K][\"label\"];\n      grants: Array<TRoles[K][\"grants\"][number] & string>;\n    };\n  };\n}\n\n// ============================================================================\n// AuthCtx — ctx enrichment for customQuery / customMutation\n// ============================================================================\n\nexport type UserDoc = Doc<\"User\">;\n\nexport type AuthCtxConfig<\n  TResolve extends Record<string, unknown> = Record<string, never>,\n> = {\n  optional?: boolean;\n  resolve?: (ctx: any, user: UserDoc) => Promise<TResolve> | TResolve;\n};\n\n/** Overload: optional auth */\nexport function AuthCtx<\n  TResolve extends Record<string, unknown> = Record<string, never>,\n>(\n  auth: AuthLike,\n  config: AuthCtxConfig<TResolve> & { optional: true },\n): {\n  args: {};\n  input: (\n    ctx: any,\n    _args: any,\n    _extra?: any,\n  ) => Promise<{\n    ctx: {\n      auth: {\n        getUserIdentity: () => Promise<UserIdentity | null>;\n        userId: GenericId<\"User\"> | null;\n        user: UserDoc | null;\n      } & TResolve;\n    };\n    args: {};\n  }>;\n};\n/** Overload: required auth (default) */\nexport function AuthCtx<\n  TResolve extends Record<string, unknown> = Record<string, never>,\n>(\n  auth: AuthLike,\n  config?: AuthCtxConfig<TResolve>,\n): {\n  args: {};\n  input: (\n    ctx: any,\n    _args: any,\n    _extra?: any,\n  ) => Promise<{\n    ctx: {\n      auth: {\n        getUserIdentity: () => Promise<UserIdentity | null>;\n        userId: GenericId<\"User\">;\n        user: UserDoc;\n      } & TResolve;\n    };\n    args: {};\n  }>;\n};\n// Implementation\nexport function AuthCtx(auth: AuthLike, config?: AuthCtxConfig<any>) {\n  return {\n    args: {},\n    input: async (ctx: any, _args: any, _extra?: any) => {\n      const nativeAuth = ctx.auth;\n      const modeDispatch =\n        config?.optional === true\n          ? { mode: \"optional\" as const }\n          : { mode: \"required\" as const };\n\n      const userContext = await Fx.run(\n        Fx.match(modeDispatch, modeDispatch.mode, {\n          optional: async () => {\n            const userId = await auth.user.current(ctx);\n            if (!userId) {\n              return null;\n            }\n            const user = await auth.user.get(ctx, userId);\n            return { userId, user };\n          },\n          required: async () => {\n            const userId = await auth.user.require(ctx);\n            const user = await auth.user.get(ctx, userId);\n            return { userId, user };\n          },\n        }),\n      );\n\n      if (userContext === null) {\n        return {\n          ctx: {\n            auth: {\n              getUserIdentity: nativeAuth.getUserIdentity.bind(nativeAuth),\n              userId: null,\n              user: null,\n            },\n          },\n          args: {},\n        };\n      }\n\n      const extra = config?.resolve\n        ? await config.resolve(ctx, userContext.user)\n        : {};\n\n      return {\n        ctx: {\n          auth: {\n            getUserIdentity: nativeAuth.getUserIdentity.bind(nativeAuth),\n            userId: userContext.userId,\n            user: userContext.user,\n            ...extra,\n          },\n        },\n        args: {},\n      };\n    },\n  };\n}\n\nexport type InferAuth<\n  T extends { input: (...args: any[]) => Promise<{ ctx: { auth: any } }> },\n> = Awaited<ReturnType<T[\"input\"]>>[\"ctx\"][\"auth\"];\n"],"mappings":";;;;;;;;;;;AAoSA,SAAgB,WAId,WACA,QAIqC;CACrC,MAAM,aAAaA,KAAY;EAC7B,GAAG;EACH;EACA,WAAW,CAAC,GAAG,OAAO,UAAU;EACjC,CAAC;CACF,MAAM,EACJ,QAAQ,WACR,MAAM,SACN,YAAY,eACZ,OAAO,UACP,SAAS,YACT,MAAM,SACN,MAAM,SACN,GAAG,YACD,WAAW,KAAK;CAOpB,MAAM,uBACJ,OACE,KACA,cACA,YACG;EACH,MAAM,aAAa,MAAM,cAAc,IAAI,KAAK,aAAa;AAC7D,MAAI,eAAe,KACjB,OAAM,IAAI,UACR,sBACA,wBACD,CAAC,eAAe;EAGnB,MAAM,aAAa,QAAQ,KAAK,WAAqC;GACnE,GAAG;GACH,QAAQ,MAAM,OAAO,MAAM,CAAC,aAAa;GAC1C,EAAE;EACH,MAAM,0BAAU,IAAI,KAA0C;AAC9D,OAAK,MAAM,SAAS,YAAY;AAC9B,OAAI,MAAM,OAAO,WAAW,EAC1B,OAAM,IAAI,UACR,sBACA,4BACD,CAAC,eAAe;AAEnB,OAAI,QAAQ,IAAI,MAAM,OAAO,CAC3B,OAAM,IAAI,UACR,sBACA,qBAAqB,MAAM,SAC5B,CAAC,eAAe;AAEnB,WAAQ,IAAI,MAAM,QAAQ,MAAM;;EAGlC,MAAM,cAAc,CAAC,GAAG,QAAQ,QAAQ,CAAC;EACzC,MAAM,eAAe,YAAY,QAC9B,UAAU,MAAM,UAClB,CAAC;AACF,MAAI,eAAe,EACjB,OAAM,IAAI,UACR,sBACA,sCACD,CAAC,eAAe;AAEnB,MAAI,YAAY,SAAS,KAAK,iBAAiB,EAC7C,aAAY,KAAK;GAAE,GAAG,YAAY;GAAI,WAAW;GAAM;EAGzD,MAAM,iBAAiB,MAAM,UAAU,KAAK,KAAK,aAAa;EAC9D,MAAM,kBAAkB,IAAI,IAC1B,eAAe,KAAK,UAA2C,CAC7D,MAAM,OAAO,aAAa,EAC1B,MACD,CAAC,CACH;AAED,OAAK,MAAM,YAAY,eACrB,KAAI,CAAC,QAAQ,IAAI,SAAS,OAAO,aAAa,CAAC,CAC7C,OAAM,UAAU,OAAO,KAAK,SAAS,IAAI;AAI7C,OAAK,MAAM,cAAc,aAAa;GACpC,MAAM,UAAU,gBAAgB,IAAI,WAAW,OAAO;AACtD,OAAI,WAAW,QAAQ,cAAc,QAAQ,WAAW,UAAU,CAChE;AAEF,OAAI,QACF,OAAM,UAAU,OAAO,KAAK,QAAQ,IAAI;GAE1C,MAAM,WAAW,MAAM,UAAU,IAAI,KAAK;IACxC,cAAc,WAAW;IACzB,SAAS,WAAW;IACpB,QAAQ,WAAW;IACnB,WAAW,WAAW;IACvB,CAAC;AACF,OAAI,SAAS,eAAe,OAC1B,OAAO,IAAY,YACjB,UAAU,OAAO,wBACjB;IACE;IACA,YAAY,QAAQ;IACrB,CACF;;AAKL,SAAO;GACL,IAAI;GACJ;GACA,UAJqB,MAAM,UAAU,KAAK,KAAK,aAAa,EAIpC,KACrB,YAA6C;IAC5C,UAAU,OAAO;IACjB,QAAQ,OAAO;IACf,WAAW,OAAO;IAClB,UAAU,OAAO,eAAe;IAChC,YAAY,OAAO,cAAc;IAClC,EACF;GACF;;CAGL,MAAM,YAA0B;EAC9B,OAAO;GACL,GAAG;GACH,MAAM,EACJ,GAAG,SACJ;GACD,MAAM,EACJ,GAAG,SACJ;GACD,YAAY;IACV,GAAG;IACH,QAAQ;KACN,MAAM,UAAU;KAChB,UAAU,UAAU;KACpB,KAAK;KACL,cAAc;MACZ,SAAS,UAAU,aAAa;MAChC,SAAS,UAAU,aAAa;MACjC;KACF;IACF;GACD,QAAQ,QAAQ;GAChB,OAAO,EACL,MAAM,SAAS,MAChB;GACD,SAAS;IACP,UAAU,WAAW;IACrB,UAAU,EACR,MAAM,WAAW,SAAS,MAC3B;IACF;GACF;EACD,QAAQ;GACN,QAAQ,QAAQ;GAChB,UAAU,QAAQ;GACnB;EACF;AAED,QAAO;EACL,QAAQ,WAAW;EACnB,SAAS,WAAW;EACpB,OAAO,WAAW;EAClB,MAAM,WAAW,KAAK;EACtB,SAAS,WAAW,KAAK;EACzB,UAAU,WAAW,KAAK;EAC1B,SAAS,WAAW,KAAK;EACzB,OAAO,WAAW,KAAK;EACvB,QAAQ,WAAW,KAAK;EACxB,QAAQ,WAAW,KAAK;EACxB,QAAQ,WAAW,KAAK;EACxB,KAAK,WAAW,KAAK;EACrB,KAAK;EACL,MAAM,EACJ,OAAO;GACL,WAAW,QAAQ;GACnB,KAAK,QAAQ;GACb,UAAU,QAAQ;GACnB,EACF;EACD,MAAM,WAAW,KAAK;EACvB;;AAGH,SAAgB,YAMd,OAOA;AACA,QAAO,OAAO,YACZ,OAAO,QAAQ,MAAM,CAAC,KAAK,CAAC,IAAI,UAAU,CACxC,IACA;EACE;EACA,GAAI,KAAK,QAAQ,EAAE,OAAO,KAAK,OAAO,GAAG,EAAE;EAC3C,QAAQ,CAAC,GAAG,KAAK,OAAO;EACzB,CACF,CAAC,CACH;;AAqEH,SAAgB,QAAQ,MAAgB,QAA6B;AACnE,QAAO;EACL,MAAM,EAAE;EACR,OAAO,OAAO,KAAU,OAAY,WAAiB;GACnD,MAAM,aAAa,IAAI;GACvB,MAAM,eACJ,QAAQ,aAAa,OACjB,EAAE,MAAM,YAAqB,GAC7B,EAAE,MAAM,YAAqB;GAEnC,MAAM,cAAc,MAAM,GAAG,IAC3B,GAAG,MAAM,cAAc,aAAa,MAAM;IACxC,UAAU,YAAY;KACpB,MAAM,SAAS,MAAM,KAAK,KAAK,QAAQ,IAAI;AAC3C,SAAI,CAAC,OACH,QAAO;AAGT,YAAO;MAAE;MAAQ,MADJ,MAAM,KAAK,KAAK,IAAI,KAAK,OAAO;MACtB;;IAEzB,UAAU,YAAY;KACpB,MAAM,SAAS,MAAM,KAAK,KAAK,QAAQ,IAAI;AAE3C,YAAO;MAAE;MAAQ,MADJ,MAAM,KAAK,KAAK,IAAI,KAAK,OAAO;MACtB;;IAE1B,CAAC,CACH;AAED,OAAI,gBAAgB,KAClB,QAAO;IACL,KAAK,EACH,MAAM;KACJ,iBAAiB,WAAW,gBAAgB,KAAK,WAAW;KAC5D,QAAQ;KACR,MAAM;KACP,EACF;IACD,MAAM,EAAE;IACT;GAGH,MAAM,QAAQ,QAAQ,UAClB,MAAM,OAAO,QAAQ,KAAK,YAAY,KAAK,GAC3C,EAAE;AAEN,UAAO;IACL,KAAK,EACH,MAAM;KACJ,iBAAiB,WAAW,gBAAgB,KAAK,WAAW;KAC5D,QAAQ,YAAY;KACpB,MAAM,YAAY;KAClB,GAAG;KACJ,EACF;IACD,MAAM,EAAE;IACT;;EAEJ"}
+{"version":3,"file":"auth.js","names":["AuthFactory"],"sources":["../../src/server/auth.ts"],"sourcesContent":["/**\n * Auth configuration helpers for Convex Auth.\n *\n * @module\n */\n\nimport type { UserIdentity } from \"convex/server\";\nimport type { GenericId } from \"convex/values\";\n\nimport type { AuthApiRefs } from \"../client/index\";\nimport { Auth as AuthFactory } from \"./factory\";\nimport { Fx } from \"./fx\";\nimport { AuthError } from \"./fx\";\nimport type { Doc } from \"./types\";\nimport type {\n  AuthAuthorizationConfig,\n  AuthGrant,\n  AuthProviderConfig,\n  AuthRoleDefinition,\n  AuthRoleId,\n  ConvexAuthConfig,\n  HasDeviceProvider,\n  HasPasskeyProvider,\n  HasSSO,\n  HasTotpProvider,\n} from \"./types\";\n\n// ============================================================================\n// Types\n// ============================================================================\n\n/**\n * Config for auth setup. Extends the standard auth config\n * minus `component` (which is passed as the first constructor argument).\n */\nexport type AuthConfig = Omit<ConvexAuthConfig, \"component\">;\n\ntype MemberApiWithAuthorization<\n  TAuthorization extends AuthAuthorizationConfig | undefined,\n> = Omit<\n  ReturnType<typeof AuthFactory>[\"auth\"][\"member\"],\n  \"create\" | \"list\" | \"update\" | \"resolve\"\n> & {\n  create: (\n    ctx: Parameters<\n      ReturnType<typeof AuthFactory>[\"auth\"][\"member\"][\"create\"]\n    >[0],\n    data: {\n      groupId: string;\n      userId: string;\n      roleIds?: AuthRoleId<TAuthorization>[];\n      status?: string;\n      extend?: Record<string, unknown>;\n    },\n  ) => Promise<{ ok: true; memberId: string }>;\n  list: (\n    ctx: Parameters<\n      ReturnType<typeof AuthFactory>[\"auth\"][\"member\"][\"list\"]\n    >[0],\n    opts?: {\n      where?: {\n        groupId?: string;\n        userId?: string;\n        roleId?: AuthRoleId<TAuthorization>;\n        status?: string;\n      };\n      limit?: number;\n      cursor?: string | null;\n      orderBy?: \"_creationTime\" | \"status\";\n      order?: \"asc\" | \"desc\";\n    },\n  ) => ReturnType<ReturnType<typeof AuthFactory>[\"auth\"][\"member\"][\"list\"]>;\n  update: (\n    ctx: Parameters<\n      ReturnType<typeof AuthFactory>[\"auth\"][\"member\"][\"update\"]\n    >[0],\n    memberId: string,\n    data: Record<string, unknown> & { roleIds?: AuthRoleId<TAuthorization>[] },\n  ) => Promise<{ ok: true; memberId: string }>;\n  resolve: (\n    ctx: Parameters<\n      ReturnType<typeof AuthFactory>[\"auth\"][\"member\"][\"resolve\"]\n    >[0],\n    opts: {\n      userId: string;\n      groupId: string;\n      roleIds?: AuthRoleId<TAuthorization>[];\n      grants?: AuthGrant<TAuthorization>[];\n      maxDepth?: number;\n    },\n  ) => ReturnType<ReturnType<typeof AuthFactory>[\"auth\"][\"member\"][\"resolve\"]>;\n};\n\ntype AccessApiWithAuthorization<\n  TAuthorization extends AuthAuthorizationConfig | undefined,\n> = {\n  check: (\n    ctx: Parameters<\n      ReturnType<typeof AuthFactory>[\"auth\"][\"access\"][\"check\"]\n    >[0],\n    opts: {\n      userId: string;\n      groupId: string;\n      grants: AuthGrant<TAuthorization>[];\n      maxDepth?: number;\n    },\n  ) => ReturnType<ReturnType<typeof AuthFactory>[\"auth\"][\"access\"][\"check\"]>;\n};\n\n/** The base auth API surface, without conditional namespaces. */\nexport type AuthApiBase<\n  TAuthorization extends AuthAuthorizationConfig | undefined = undefined,\n> = {\n  signIn: ReturnType<typeof AuthFactory>[\"signIn\"];\n  signOut: ReturnType<typeof AuthFactory>[\"signOut\"];\n  store: ReturnType<typeof AuthFactory>[\"store\"];\n  user: ReturnType<typeof AuthFactory>[\"auth\"][\"user\"];\n  session: ReturnType<typeof AuthFactory>[\"auth\"][\"session\"];\n  provider: ReturnType<typeof AuthFactory>[\"auth\"][\"provider\"];\n  account: ReturnType<typeof AuthFactory>[\"auth\"][\"account\"];\n  group: ReturnType<typeof AuthFactory>[\"auth\"][\"group\"];\n  member: MemberApiWithAuthorization<TAuthorization>;\n  access: AccessApiWithAuthorization<TAuthorization>;\n  invite: ReturnType<typeof AuthFactory>[\"auth\"][\"invite\"];\n  key: ReturnType<typeof AuthFactory>[\"auth\"][\"key\"];\n  http: ReturnType<typeof AuthFactory>[\"auth\"][\"http\"];\n};\n\ntype InternalSsoApi = ReturnType<typeof AuthFactory>[\"auth\"][\"sso\"];\n\ntype PublicSsoAdminApi = {\n  connection: InternalSsoApi[\"connection\"] & {\n    domain: {\n      list: InternalSsoApi[\"domain\"][\"list\"];\n      validate: InternalSsoApi[\"domain\"][\"validate\"];\n      set: (\n        ctx: Parameters<InternalSsoApi[\"connection\"][\"create\"]>[0],\n        enterpriseId: string,\n        domains: Array<{\n          domain: string;\n          isPrimary?: boolean;\n        }>,\n      ) => Promise<{\n        ok: true;\n        enterpriseId: string;\n        domains: Array<{\n          domainId: string;\n          domain: string;\n          isPrimary: boolean;\n          verified: boolean;\n          verifiedAt: number | null;\n        }>;\n      }>;\n      verification: {\n        request: (\n          ctx: Parameters<InternalSsoApi[\"connection\"][\"create\"]>[0],\n          args: { enterpriseId: string; domain: string },\n        ) => Promise<{\n          ok: true;\n          enterpriseId: string;\n          domain: string;\n          requestedAt: number;\n          expiresAt: number;\n          challenge: {\n            recordType: \"TXT\";\n            recordName: string;\n            recordValue: string;\n          };\n        }>;\n        confirm: (\n          ctx: Parameters<InternalSsoApi[\"connection\"][\"create\"]>[0],\n          args: { enterpriseId: string; domain: string },\n        ) => Promise<{\n          ok: boolean;\n          enterpriseId: string;\n          domain: string;\n          verifiedAt?: number;\n          checks: Array<{ name: string; ok: boolean; message?: string }>;\n        }>;\n      };\n    };\n  };\n  oidc: Omit<InternalSsoApi[\"oidc\"], \"signIn\">;\n  saml: Omit<InternalSsoApi[\"saml\"], \"metadata\">;\n  policy: InternalSsoApi[\"policy\"];\n  audit: {\n    list: InternalSsoApi[\"audit\"][\"list\"];\n  };\n  webhook: {\n    endpoint: InternalSsoApi[\"webhook\"][\"endpoint\"];\n    delivery: {\n      list: InternalSsoApi[\"webhook\"][\"delivery\"][\"list\"];\n    };\n  };\n};\n\ntype PublicSsoClientApi = {\n  signIn: InternalSsoApi[\"oidc\"][\"signIn\"];\n  metadata: InternalSsoApi[\"saml\"][\"metadata\"];\n};\n\ntype PublicSsoApi = {\n  admin: PublicSsoAdminApi;\n  client: PublicSsoClientApi;\n};\n\ntype PublicScimApi = {\n  admin: Omit<InternalSsoApi[\"scim\"], \"getConfigByToken\" | \"identity\">;\n};\n\n/** Auth API with enterprise namespaces — present only when `new SSO()` is in providers. */\nexport type AuthApi<\n  TAuthorization extends AuthAuthorizationConfig | undefined = undefined,\n> = AuthApiBase<TAuthorization> & {\n  sso: PublicSsoApi;\n  scim: PublicScimApi;\n};\n\n/**\n * The return type of `createAuth`. Conditional namespaces:\n * - `auth.sso` and `auth.scim` — only when `new SSO()` is in providers\n * - `auth.clientApi` — typed API refs for the client SDK with capabilities\n */\nexport type ConvexAuthResult<\n  P extends AuthProviderConfig[],\n  TAuthorization extends AuthAuthorizationConfig | undefined = undefined,\n> =\n  HasSSO<P> extends true\n    ? AuthApi<TAuthorization>\n    : AuthApiBase<TAuthorization>;\n\n/**\n * Infer the typed `AuthApiRefs` for the client SDK from a `createAuth` call.\n *\n * Use this as the generic parameter for `client()` on the frontend:\n *\n * ```ts\n * // convex/auth.ts\n * export const auth = createAuth(components.auth, { providers: [...] });\n *\n * // Frontend\n * import type { auth } from \"../convex/auth\";\n * import type { InferClientApi } from \"@robelest/convex-auth/component\";\n * const c = client<InferClientApi<typeof auth>>({ convex, api: api.auth });\n * ```\n */\nexport type InferClientApi<T> =\n  T extends ConvexAuthResult<infer P>\n    ? AuthApiRefs<\n        HasPasskeyProvider<P>,\n        HasTotpProvider<P>,\n        HasDeviceProvider<P>\n      >\n    : AuthApiRefs;\n\n/** @internal */\nexport type AuthLike = Pick<AuthApiBase, \"user\">;\n\n// ============================================================================\n// Auth setup APIs\n// ============================================================================\n\n/**\n * Create an auth API object.\n *\n * When `new SSO()` is included in providers, `auth.sso` and `auth.scim`\n * are available on the returned object. Without it, those namespaces are\n * absent and accessing them is a TypeScript compile error.\n */\nexport function createAuth<\n  P extends AuthProviderConfig[],\n  TAuthorization extends AuthAuthorizationConfig | undefined = undefined,\n>(\n  component: ConvexAuthConfig[\"component\"],\n  config: Omit<AuthConfig, \"providers\" | \"authorization\"> & {\n    providers: P;\n    authorization?: TAuthorization;\n  },\n): ConvexAuthResult<P, TAuthorization> {\n  const authResult = AuthFactory({\n    ...config,\n    component,\n    providers: [...config.providers],\n  });\n  const {\n    domain: domainApi,\n    scim: scimApi,\n    connection: connectionApi,\n    audit: auditApi,\n    webhook: webhookApi,\n    oidc: oidcApi,\n    saml: samlApi,\n    ...restSso\n  } = authResult.auth.sso as InternalSsoApi;\n\n  type SetEnterpriseDomains = PublicSsoAdminApi[\"connection\"][\"domain\"][\"set\"];\n  type EnterpriseDomainInput = Array<{\n    domain: string;\n    isPrimary?: boolean;\n  }>;\n  const setEnterpriseDomains: PublicSsoAdminApi[\"connection\"][\"domain\"][\"set\"] =\n    async (\n      ctx: Parameters<SetEnterpriseDomains>[0],\n      enterpriseId: Parameters<SetEnterpriseDomains>[1],\n      domains: EnterpriseDomainInput,\n    ) => {\n      const enterprise = await connectionApi.get(ctx, enterpriseId);\n      if (enterprise === null) {\n        throw new AuthError(\n          \"INVALID_PARAMETERS\",\n          \"Enterprise not found.\",\n        ).toConvexError();\n      }\n\n      const normalized = domains.map((entry: (typeof domains)[number]) => ({\n        ...entry,\n        domain: entry.domain.trim().toLowerCase(),\n      }));\n      const deduped = new Map<string, (typeof normalized)[number]>();\n      for (const entry of normalized) {\n        if (entry.domain.length === 0) {\n          throw new AuthError(\n            \"INVALID_PARAMETERS\",\n            \"Domain must not be empty.\",\n          ).toConvexError();\n        }\n        if (deduped.has(entry.domain)) {\n          throw new AuthError(\n            \"INVALID_PARAMETERS\",\n            `Duplicate domain: ${entry.domain}`,\n          ).toConvexError();\n        }\n        deduped.set(entry.domain, entry);\n      }\n\n      const nextDomains = [...deduped.values()];\n      const primaryCount = nextDomains.filter(\n        (entry) => entry.isPrimary,\n      ).length;\n      if (primaryCount > 1) {\n        throw new AuthError(\n          \"INVALID_PARAMETERS\",\n          \"Only one primary domain may be set.\",\n        ).toConvexError();\n      }\n      if (nextDomains.length > 0 && primaryCount === 0) {\n        nextDomains[0] = { ...nextDomains[0], isPrimary: true };\n      }\n\n      const currentDomains = await domainApi.list(ctx, enterpriseId);\n      const currentByDomain = new Map<string, (typeof currentDomains)[number]>(\n        currentDomains.map((entry: (typeof currentDomains)[number]) => [\n          entry.domain.toLowerCase(),\n          entry,\n        ]),\n      );\n\n      for (const existing of currentDomains) {\n        if (!deduped.has(existing.domain.toLowerCase())) {\n          await domainApi.remove(ctx, existing._id);\n        }\n      }\n\n      for (const nextDomain of nextDomains) {\n        const current = currentByDomain.get(nextDomain.domain);\n        if (current && current.isPrimary === Boolean(nextDomain.isPrimary)) {\n          continue;\n        }\n        if (current) {\n          await domainApi.remove(ctx, current._id);\n        }\n        const domainId = await domainApi.add(ctx, {\n          enterpriseId: enterprise._id,\n          groupId: enterprise.groupId,\n          domain: nextDomain.domain,\n          isPrimary: nextDomain.isPrimary,\n        });\n        if (current?.verifiedAt !== undefined) {\n          await (ctx as any).runMutation(\n            component.public.enterpriseDomainVerify,\n            {\n              domainId,\n              verifiedAt: current.verifiedAt,\n            },\n          );\n        }\n      }\n\n      const updatedDomains = await domainApi.list(ctx, enterpriseId);\n      return {\n        ok: true as const,\n        enterpriseId,\n        domains: updatedDomains.map(\n          (domain: (typeof updatedDomains)[number]) => ({\n            domainId: domain._id,\n            domain: domain.domain,\n            isPrimary: domain.isPrimary,\n            verified: domain.verifiedAt !== undefined,\n            verifiedAt: domain.verifiedAt ?? null,\n          }),\n        ),\n      };\n    };\n\n  const publicSso: PublicSsoApi = {\n    admin: {\n      ...restSso,\n      oidc: {\n        ...oidcApi,\n      },\n      saml: {\n        ...samlApi,\n      },\n      connection: {\n        ...connectionApi,\n        domain: {\n          list: domainApi.list,\n          validate: domainApi.validate,\n          set: setEnterpriseDomains,\n          verification: {\n            request: domainApi.verification.request,\n            confirm: domainApi.verification.confirm,\n          },\n        },\n      },\n      policy: restSso.policy,\n      audit: {\n        list: auditApi.list,\n      },\n      webhook: {\n        endpoint: webhookApi.endpoint,\n        delivery: {\n          list: webhookApi.delivery.list,\n        },\n      },\n    },\n    client: {\n      signIn: oidcApi.signIn,\n      metadata: samlApi.metadata,\n    },\n  };\n\n  return {\n    signIn: authResult.signIn,\n    signOut: authResult.signOut,\n    store: authResult.store,\n    user: authResult.auth.user,\n    session: authResult.auth.session,\n    provider: authResult.auth.provider,\n    account: authResult.auth.account,\n    group: authResult.auth.group,\n    member: authResult.auth.member,\n    access: authResult.auth.access,\n    invite: authResult.auth.invite,\n    key: authResult.auth.key,\n    sso: publicSso,\n    scim: {\n      admin: {\n        configure: scimApi.configure,\n        get: scimApi.get,\n        validate: scimApi.validate,\n      },\n    },\n    http: authResult.auth.http,\n  } as unknown as ConvexAuthResult<P, TAuthorization>;\n}\n\n// ============================================================================\n// AuthCtx — ctx enrichment for customQuery / customMutation\n// ============================================================================\n\nexport type UserDoc = Doc<\"User\">;\n\nexport type AuthCtxConfig<\n  TResolve extends Record<string, unknown> = Record<string, never>,\n> = {\n  optional?: boolean;\n  resolve?: (ctx: any, user: UserDoc) => Promise<TResolve> | TResolve;\n};\n\n/** Overload: optional auth */\nexport function AuthCtx<\n  TResolve extends Record<string, unknown> = Record<string, never>,\n>(\n  auth: AuthLike,\n  config: AuthCtxConfig<TResolve> & { optional: true },\n): {\n  args: {};\n  input: (\n    ctx: any,\n    _args: any,\n    _extra?: any,\n  ) => Promise<{\n    ctx: {\n      auth: {\n        getUserIdentity: () => Promise<UserIdentity | null>;\n        userId: GenericId<\"User\"> | null;\n        user: UserDoc | null;\n      } & TResolve;\n    };\n    args: {};\n  }>;\n};\n/** Overload: required auth (default) */\nexport function AuthCtx<\n  TResolve extends Record<string, unknown> = Record<string, never>,\n>(\n  auth: AuthLike,\n  config?: AuthCtxConfig<TResolve>,\n): {\n  args: {};\n  input: (\n    ctx: any,\n    _args: any,\n    _extra?: any,\n  ) => Promise<{\n    ctx: {\n      auth: {\n        getUserIdentity: () => Promise<UserIdentity | null>;\n        userId: GenericId<\"User\">;\n        user: UserDoc;\n      } & TResolve;\n    };\n    args: {};\n  }>;\n};\n// Implementation\nexport function AuthCtx(auth: AuthLike, config?: AuthCtxConfig<any>) {\n  return {\n    args: {},\n    input: async (ctx: any, _args: any, _extra?: any) => {\n      const nativeAuth = ctx.auth;\n      const modeDispatch =\n        config?.optional === true\n          ? { mode: \"optional\" as const }\n          : { mode: \"required\" as const };\n\n      const userContext = await Fx.run(\n        Fx.match(modeDispatch, modeDispatch.mode, {\n          optional: async () => {\n            const userId = await auth.user.id(ctx);\n            if (!userId) {\n              return null;\n            }\n            const user = await auth.user.get(ctx, userId);\n            return { userId, user };\n          },\n          required: async () => {\n            const userId = await auth.user.id(ctx);\n            if (!userId) {\n              return null;\n            }\n            const user = await auth.user.get(ctx, userId);\n            return { userId, user };\n          },\n        }),\n      );\n\n      if (userContext === null) {\n        return {\n          ctx: {\n            auth: {\n              getUserIdentity: nativeAuth.getUserIdentity.bind(nativeAuth),\n              userId: null,\n              user: null,\n            },\n          },\n          args: {},\n        };\n      }\n\n      const extra = config?.resolve\n        ? await config.resolve(ctx, userContext.user)\n        : {};\n\n      return {\n        ctx: {\n          auth: {\n            getUserIdentity: nativeAuth.getUserIdentity.bind(nativeAuth),\n            userId: userContext.userId,\n            user: userContext.user,\n            ...extra,\n          },\n        },\n        args: {},\n      };\n    },\n  };\n}\n\nexport type InferAuth<\n  T extends { input: (...args: any[]) => Promise<{ ctx: { auth: any } }> },\n> = Awaited<ReturnType<T[\"input\"]>>[\"ctx\"][\"auth\"];\n"],"mappings":";;;;;;;;;;;AA6QA,SAAgB,WAId,WACA,QAIqC;CACrC,MAAM,aAAaA,KAAY;EAC7B,GAAG;EACH;EACA,WAAW,CAAC,GAAG,OAAO,UAAU;EACjC,CAAC;CACF,MAAM,EACJ,QAAQ,WACR,MAAM,SACN,YAAY,eACZ,OAAO,UACP,SAAS,YACT,MAAM,SACN,MAAM,SACN,GAAG,YACD,WAAW,KAAK;CAOpB,MAAM,uBACJ,OACE,KACA,cACA,YACG;EACH,MAAM,aAAa,MAAM,cAAc,IAAI,KAAK,aAAa;AAC7D,MAAI,eAAe,KACjB,OAAM,IAAI,UACR,sBACA,wBACD,CAAC,eAAe;EAGnB,MAAM,aAAa,QAAQ,KAAK,WAAqC;GACnE,GAAG;GACH,QAAQ,MAAM,OAAO,MAAM,CAAC,aAAa;GAC1C,EAAE;EACH,MAAM,0BAAU,IAAI,KAA0C;AAC9D,OAAK,MAAM,SAAS,YAAY;AAC9B,OAAI,MAAM,OAAO,WAAW,EAC1B,OAAM,IAAI,UACR,sBACA,4BACD,CAAC,eAAe;AAEnB,OAAI,QAAQ,IAAI,MAAM,OAAO,CAC3B,OAAM,IAAI,UACR,sBACA,qBAAqB,MAAM,SAC5B,CAAC,eAAe;AAEnB,WAAQ,IAAI,MAAM,QAAQ,MAAM;;EAGlC,MAAM,cAAc,CAAC,GAAG,QAAQ,QAAQ,CAAC;EACzC,MAAM,eAAe,YAAY,QAC9B,UAAU,MAAM,UAClB,CAAC;AACF,MAAI,eAAe,EACjB,OAAM,IAAI,UACR,sBACA,sCACD,CAAC,eAAe;AAEnB,MAAI,YAAY,SAAS,KAAK,iBAAiB,EAC7C,aAAY,KAAK;GAAE,GAAG,YAAY;GAAI,WAAW;GAAM;EAGzD,MAAM,iBAAiB,MAAM,UAAU,KAAK,KAAK,aAAa;EAC9D,MAAM,kBAAkB,IAAI,IAC1B,eAAe,KAAK,UAA2C,CAC7D,MAAM,OAAO,aAAa,EAC1B,MACD,CAAC,CACH;AAED,OAAK,MAAM,YAAY,eACrB,KAAI,CAAC,QAAQ,IAAI,SAAS,OAAO,aAAa,CAAC,CAC7C,OAAM,UAAU,OAAO,KAAK,SAAS,IAAI;AAI7C,OAAK,MAAM,cAAc,aAAa;GACpC,MAAM,UAAU,gBAAgB,IAAI,WAAW,OAAO;AACtD,OAAI,WAAW,QAAQ,cAAc,QAAQ,WAAW,UAAU,CAChE;AAEF,OAAI,QACF,OAAM,UAAU,OAAO,KAAK,QAAQ,IAAI;GAE1C,MAAM,WAAW,MAAM,UAAU,IAAI,KAAK;IACxC,cAAc,WAAW;IACzB,SAAS,WAAW;IACpB,QAAQ,WAAW;IACnB,WAAW,WAAW;IACvB,CAAC;AACF,OAAI,SAAS,eAAe,OAC1B,OAAO,IAAY,YACjB,UAAU,OAAO,wBACjB;IACE;IACA,YAAY,QAAQ;IACrB,CACF;;AAKL,SAAO;GACL,IAAI;GACJ;GACA,UAJqB,MAAM,UAAU,KAAK,KAAK,aAAa,EAIpC,KACrB,YAA6C;IAC5C,UAAU,OAAO;IACjB,QAAQ,OAAO;IACf,WAAW,OAAO;IAClB,UAAU,OAAO,eAAe;IAChC,YAAY,OAAO,cAAc;IAClC,EACF;GACF;;CAGL,MAAM,YAA0B;EAC9B,OAAO;GACL,GAAG;GACH,MAAM,EACJ,GAAG,SACJ;GACD,MAAM,EACJ,GAAG,SACJ;GACD,YAAY;IACV,GAAG;IACH,QAAQ;KACN,MAAM,UAAU;KAChB,UAAU,UAAU;KACpB,KAAK;KACL,cAAc;MACZ,SAAS,UAAU,aAAa;MAChC,SAAS,UAAU,aAAa;MACjC;KACF;IACF;GACD,QAAQ,QAAQ;GAChB,OAAO,EACL,MAAM,SAAS,MAChB;GACD,SAAS;IACP,UAAU,WAAW;IACrB,UAAU,EACR,MAAM,WAAW,SAAS,MAC3B;IACF;GACF;EACD,QAAQ;GACN,QAAQ,QAAQ;GAChB,UAAU,QAAQ;GACnB;EACF;AAED,QAAO;EACL,QAAQ,WAAW;EACnB,SAAS,WAAW;EACpB,OAAO,WAAW;EAClB,MAAM,WAAW,KAAK;EACtB,SAAS,WAAW,KAAK;EACzB,UAAU,WAAW,KAAK;EAC1B,SAAS,WAAW,KAAK;EACzB,OAAO,WAAW,KAAK;EACvB,QAAQ,WAAW,KAAK;EACxB,QAAQ,WAAW,KAAK;EACxB,QAAQ,WAAW,KAAK;EACxB,KAAK,WAAW,KAAK;EACrB,KAAK;EACL,MAAM,EACJ,OAAO;GACL,WAAW,QAAQ;GACnB,KAAK,QAAQ;GACb,UAAU,QAAQ;GACnB,EACF;EACD,MAAM,WAAW,KAAK;EACvB;;AA+DH,SAAgB,QAAQ,MAAgB,QAA6B;AACnE,QAAO;EACL,MAAM,EAAE;EACR,OAAO,OAAO,KAAU,OAAY,WAAiB;GACnD,MAAM,aAAa,IAAI;GACvB,MAAM,eACJ,QAAQ,aAAa,OACjB,EAAE,MAAM,YAAqB,GAC7B,EAAE,MAAM,YAAqB;GAEnC,MAAM,cAAc,MAAM,GAAG,IAC3B,GAAG,MAAM,cAAc,aAAa,MAAM;IACxC,UAAU,YAAY;KACpB,MAAM,SAAS,MAAM,KAAK,KAAK,GAAG,IAAI;AACtC,SAAI,CAAC,OACH,QAAO;AAGT,YAAO;MAAE;MAAQ,MADJ,MAAM,KAAK,KAAK,IAAI,KAAK,OAAO;MACtB;;IAEzB,UAAU,YAAY;KACpB,MAAM,SAAS,MAAM,KAAK,KAAK,GAAG,IAAI;AACtC,SAAI,CAAC,OACH,QAAO;AAGT,YAAO;MAAE;MAAQ,MADJ,MAAM,KAAK,KAAK,IAAI,KAAK,OAAO;MACtB;;IAE1B,CAAC,CACH;AAED,OAAI,gBAAgB,KAClB,QAAO;IACL,KAAK,EACH,MAAM;KACJ,iBAAiB,WAAW,gBAAgB,KAAK,WAAW;KAC5D,QAAQ;KACR,MAAM;KACP,EACF;IACD,MAAM,EAAE;IACT;GAGH,MAAM,QAAQ,QAAQ,UAClB,MAAM,OAAO,QAAQ,KAAK,YAAY,KAAK,GAC3C,EAAE;AAEN,UAAO;IACL,KAAK,EACH,MAAM;KACJ,iBAAiB,WAAW,gBAAgB,KAAK,WAAW;KAC5D,QAAQ,YAAY;KACpB,MAAM,YAAY;KAClB,GAAG;KACJ,EACF;IACD,MAAM,EAAE;IACT;;EAEJ"}

package/dist/server/domains/core.d.ts

@@ -49,12 +49,9 @@ type CoreDeps = {
  */
 declare function createCoreDomains(deps: CoreDeps): {
   user: {
-    current: (ctx: {
+    id: (ctx: {
       auth: Auth;
     } & Partial<ComponentCtx>, request?: Request) => Promise<string | null>;
-    require: (ctx: {
-      auth: Auth;
-    } & Partial<ComponentCtx>, request?: Request) => Promise<string>;
     get: (ctx: ComponentReadCtx, userId: string) => Promise<any>;
     list: (ctx: ComponentReadCtx, opts?: {
       where?: UserWhere;
@@ -86,8 +83,13 @@ declare function createCoreDomains(deps: CoreDeps): {
     delete: (ctx: ComponentCtx, userId: string, opts?: {
       cascade?: boolean;
     }) => Promise<{
+      ok: false;
+      code: "INVALID_PARAMETERS";
+      userId?: undefined;
+    } | {
       ok: true;
       userId: string;
+      code?: undefined;
     }>;
   };
   session: {
@@ -115,8 +117,17 @@ declare function createCoreDomains(deps: CoreDeps): {
       accountId: string;
     }>;
     delete: (ctx: ComponentCtx, accountId: string) => Promise<{
+      ok: false;
+      code: "ACCOUNT_NOT_FOUND";
+      accountId?: undefined;
+    } | {
+      ok: false;
+      code: "INVALID_PARAMETERS";
+      accountId?: undefined;
+    } | {
       ok: true;
       accountId: string;
+      code?: undefined;
     }>;
     listPasskeys: (ctx: ComponentReadCtx, opts: {
       userId: string;
@@ -209,8 +220,15 @@ declare function createCoreDomains(deps: CoreDeps): {
       status?: string;
       extend?: Record<string, unknown>;
     }) => Promise<{
+      ok: false;
+      code: "INVALID_ROLE_IDS";
+      invalidRoleIds: string[];
+      memberId?: undefined;
+    } | {
       ok: true;
       memberId: string;
+      code?: undefined;
+      invalidRoleIds?: undefined;
     }>;
     get: (ctx: ComponentReadCtx, memberId: string) => Promise<any>;
     getByUserAndGroup: (ctx: ComponentReadCtx, opts: {
@@ -234,56 +252,54 @@ declare function createCoreDomains(deps: CoreDeps): {
       memberId: string;
     }>;
     update: (ctx: ComponentCtx, memberId: string, data: Record<string, unknown>) => Promise<{
+      ok: false;
+      code: "INVALID_ROLE_IDS";
+      invalidRoleIds: string[];
+      memberId?: undefined;
+    } | {
       ok: true;
       memberId: string;
+      code?: undefined;
+      invalidRoleIds?: undefined;
     }>;
-    inherit: (ctx: ComponentReadCtx, opts: {
+    resolve: (ctx: ComponentReadCtx, opts: {
       userId: string;
       groupId: string;
       roleIds?: string[];
       grants?: string[];
       maxDepth?: number;
     }) => Promise<{
+      ok: false;
+      code: "INVALID_ROLE_IDS";
+      invalidRoleIds: string[];
+      requestedGroupId?: undefined;
+      matchedGroupId?: undefined;
+      membership?: undefined;
+      roleIds?: undefined;
+      grants?: undefined;
+      missingGrants?: undefined;
+      depth?: undefined;
+      isDirect?: undefined;
+      isInherited?: undefined;
+      traversedGroupIds?: undefined;
+      cycleDetected?: undefined;
+      maxDepthReached?: undefined;
+    } | {
       requestedGroupId: string;
-      matchedGroupId: string;
+      matchedGroupId: any;
       membership: any;
       roleIds: any;
       grants: string[];
       missingGrants: string[];
-      depth: number;
-      isDirect: boolean;
-      isInherited: boolean;
-      traversedGroupIds: string[];
-      cycleDetected: boolean;
-      maxDepthReached: boolean;
-    } | {
-      requestedGroupId: string;
-      matchedGroupId: null;
-      membership: null;
-      roleIds: string[];
-      grants: string[];
-      missingGrants: string[];
-      depth: null;
-      isDirect: boolean;
-      isInherited: boolean;
-      traversedGroupIds: string[];
+      depth: any;
+      isDirect: any;
+      isInherited: any;
+      traversedGroupIds: any;
       cycleDetected: boolean;
       maxDepthReached: boolean;
-    }>;
-    require: (ctx: ComponentReadCtx, opts: {
-      userId: string;
-      groupId: string;
-      roleIds?: string[];
-      grants?: string[];
-      maxDepth?: number;
-    }) => Promise<{
-      membership: any;
-      matchedGroupId: string | null;
-      roleIds: any;
-      grants: string[];
-      isDirect: boolean;
-      isInherited: boolean;
-      depth: number | null;
+      ok?: undefined;
+      code?: undefined;
+      invalidRoleIds?: undefined;
     }>;
   };
   access: {
@@ -295,29 +311,13 @@ declare function createCoreDomains(deps: CoreDeps): {
     }) => Promise<{
       ok: boolean;
       membership: any;
-      matchedGroupId: string | null;
+      matchedGroupId: any;
       roleIds: any;
       grants: string[];
       missingGrants: string[];
-      isDirect: boolean;
-      isInherited: boolean;
-      depth: number | null;
-    }>;
-    require: (ctx: ComponentReadCtx, opts: {
-      userId: string;
-      groupId: string;
-      grants: string[];
-      maxDepth?: number;
-    }) => Promise<{
-      ok: boolean;
-      membership: any;
-      matchedGroupId: string | null;
-      roleIds: any;
-      grants: string[];
-      missingGrants: string[];
-      isDirect: boolean;
-      isInherited: boolean;
-      depth: number | null;
+      isDirect: any;
+      isInherited: any;
+      depth: any;
     }>;
   };
   invite: {
@@ -329,9 +329,17 @@ declare function createCoreDomains(deps: CoreDeps): {
       expiresTime?: number;
       extend?: Record<string, unknown>;
     }) => Promise<{
+      ok: false;
+      code: "INVALID_ROLE_IDS";
+      invalidRoleIds: string[];
+      inviteId?: undefined;
+      token?: undefined;
+    } | {
       ok: true;
       inviteId: string;
       token: string;
+      code?: undefined;
+      invalidRoleIds?: undefined;
     }>;
     get: (ctx: ComponentReadCtx, inviteId: string) => Promise<any>;
     token: {
@@ -383,9 +391,13 @@ declare function createCoreDomains(deps: CoreDeps): {
       secret: string;
     }>;
     verify: (ctx: ComponentCtx, rawKey: string) => Promise<{
+      ok: true;
       userId: string;
       keyId: string;
       scopes: ScopeChecker;
+    } | {
+      ok: false;
+      code: "INVALID_API_KEY" | "API_KEY_REVOKED" | "API_KEY_EXPIRED" | "API_KEY_RATE_LIMITED";
     }>;
     list: (ctx: ComponentReadCtx, opts?: {
       where?: {
@@ -426,6 +438,9 @@ declare function createCoreDomains(deps: CoreDeps): {
       ok: true;
       keyId: string;
       secret: string;
+    } | {
+      ok: false;
+      code: "INVALID_PARAMETERS" | "API_KEY_REVOKED";
     }>;
   };
 };

package/dist/server/domains/core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core.d.ts","names":[],"sources":["../../../src/server/domains/core.ts"],"mappings":";;;;;KA0BK,YAAA,GAAe,IAAA,CAClB,gBAAA,CAAiB,gBAAA;AAAA,KAGd,gBAAA,GAAmB,IAAA,CAAK,gBAAA,CAAiB,gBAAA;AAAA,KACzC,oBAAA,GAAuB,gBAAA;EAAqB,IAAA,EAAM,IAAA;AAAA;AAAA,KAClD,kBAAA;EAAuB,EAAA;EAAY,MAAA;AAAA;AAAA,KACnC,iBAAA;EACH,QAAA;EACA,OAAA,EAAS,kBAAA;EACT,OAAA,EAAS,MAAA;EACT,kBAAA;EACA,kBAAA;AAAA;AAAA,KAEG,mBAAA;EAAwB,QAAA;EAAkB,OAAA,EAAS,kBAAA;AAAA;AAAA,KACnD,4BAAA;EACH,QAAA;EACA,OAAA;IAAW,EAAA;IAAY,MAAA;EAAA;AAAA;AAAA,KAGpB,QAAA;EACH,MAAA;EACA,OAAA;EACA,sBAAA,qBAA2C,gBAAA,EACzC,GAAA,EAAK,gBAAA,CAAiB,SAAA,GACtB,IAAA;IAAQ,MAAA,EAAQ,SAAA;IAAmB,MAAA,GAAS,SAAA;EAAA,MACzC,OAAA;EACL,gCAAA,qBAAqD,gBAAA,EACnD,GAAA,EAAK,gBAAA,CAAiB,SAAA,GACtB,IAAA,EAAM,iBAAA,KACH,OAAA;EACL,kCAAA,qBAAuD,gBAAA,EACrD,GAAA,EAAK,gBAAA,CAAiB,SAAA,GACtB,IAAA,EAAM,mBAAA,KACH,OAAA;EACL,iBAAA,qBAAsC,gBAAA,EACpC,GAAA,EAAK,gBAAA,CAAiB,SAAA,GACtB,IAAA,EAAM,4BAAA,KACH,OAAA;EACL,YAAA,2BAAuC,gBAAA,EACrC,GAAA,EAAK,gBAAA,CAAiB,SAAA;EAExB,mBAAA;EACA,iBAAA;AAAA;;AArC4C;;iBA2C9B,iBAAA,CAAkB,IAAA,EAAM,QAAA;;;MAkD3B,IAAA,EAAM,IAAA;IAAA,IAAS,OAAA,CAAQ,YAAA,GAAa,OAAA,GACjC,OAAA,KACT,OAAA;;MAwBM,IAAA,EAAM,IAAA;IAAA,IAAS,OAAA,CAAQ,YAAA,GAAa,OAAA,GACjC,OAAA,KACT,OAAA;eAOc,gBAAA,EAAgB,MAAA,aAAgB,OAAA;gBAM1C,gBAAA,EAAgB,IAAA;MAEnB,KAAA,GAAQ,SAAA;MACR,KAAA;MACA,MAAA;MACA,OAAA,GAAU,WAAA;MACV,KAAA;IAAA,MACD,OAAA;kBAIiB,oBAAA,KAAoB,OAAA;kBAQjC,YAAA,EAAY,MAAA,UACH,IAAA,EACR,MAAA,sBAAuB,OAAA;;;;0BASxB,YAAA,EAAY,IAAA;MACT,MAAA;MAAgB,OAAA;IAAA,MAAwB,OAAA;;;;;;;;;0BAqB3C,gBAAA,EAAgB,IAAA;MACb,MAAA;IAAA,MACP,OAAA;kBAcI,YAAA,EAAY,MAAA,UACH,IAAA;MACL,OAAA;IAAA,MAAmB,OAAA;;;;;;;MA+EP,IAAA,EAAM,IAAA;IAAA,MAAM,OAAA,CAAA,SAAA;mCAME,gBAAA,EAAgB,GAAA,EAC9C,gBAAA,CAAiB,SAAA,GAAU,IAAA;MACxB,MAAA,EAAQ,SAAA;MAAmB,MAAA,GAAS,SAAA;IAAA,MAAwB,OAAA;;;;;eASrD,gBAAA,EAAgB,SAAA,aAAmB,OAAA;gBAKlC,gBAAA,EAAgB,IAAA;MAAU,MAAA;IAAA,MAAgB,OAAA;EAAA;;+BAQ3B,gBAAA,EAAgB,GAAA,EAC1C,gBAAA,CAAiB,SAAA,GAAU,IAAA,EAC1B,iBAAA,KAAiB,OAAA;4BAKK,gBAAA,EAAgB,GAAA,EACvC,gBAAA,CAAiB,SAAA,GAAU,IAAA,EAC1B,mBAAA,KAAmB,OAAA;+BAQM,gBAAA,EAAgB,GAAA,EAC1C,gBAAA,CAAiB,SAAA,GAAU,IAAA,EAC1B,4BAAA,KAA4B,OAAA;;;;kBAKhB,YAAA,EAAY,SAAA,aAAmB,OAAA;;;;wBAyBzB,gBAAA,EAAgB,IAAA;MAAU,MAAA;IAAA,MAAgB,OAAA;yBAO7D,YAAA,EAAY,SAAA,UACA,IAAA,aACL,OAAA;;;;yBAQa,YAAA,EAAY,SAAA,aAAmB,OAAA;;;;qBAMnC,gBAAA,EAAgB,IAAA;MAAU,MAAA;IAAA,MAAgB,OAAA;sBAGzC,YAAA,EAAY,MAAA,aAAgB,OAAA;;;;;;+BAOnB,gBAAA,EAAgB,GAAA,EAC1C,gBAAA,CAAiB,SAAA,GAAU,cAAA,EAChB,kBAAA,EAAkB,IAAA;MAEhC,SAAA,GAAY,SAAA;MACZ,MAAA,GAAS,MAAA;IAAA,MACV,OAAA;;;;;;kBAwBI,YAAA,EAAY,IAAA;MAEf,IAAA;MACA,IAAA;MACA,IAAA;MACA,aAAA;MACA,IAAA,GAAO,KAAA;QAAQ,GAAA;QAAa,KAAA;MAAA;MAC5B,MAAA,GAAS,MAAA;IAAA,MAEV,OAAA;MAAU,EAAA;MAAU,OAAA;IAAA;eAON,gBAAA,EAAgB,OAAA,aAAiB,OAAA;gBAI3C,gBAAA,EAAgB,IAAA;MAEnB,KAAA;QACE,IAAA;QACA,IAAA;QACA,aAAA;QACA,IAAA;QACA,MAAA;QACA,OAAA,GAAU,KAAA;UAAQ,GAAA;UAAa,KAAA;QAAA;QAC/B,OAAA,GAAU,KAAA;UAAQ,GAAA;UAAa,KAAA;QAAA;MAAA;MAEjC,KAAA;MACA,MAAA;MACA,OAAA;MACA,KAAA;IAAA,MACD,OAAA;kBAWI,YAAA,EAAY,OAAA,UACF,IAAA,EACT,MAAA,sBAAuB,OAAA;;;;kBAQX,YAAA,EAAY,OAAA,aAAiB,OAAA;;;;qBAK1C,gBAAA,EAAgB,IAAA;MACb,OAAA;MAAiB,QAAA;MAAmB,WAAA;IAAA,MAAuB,OAAA;;;;;;;kBAuC9D,YAAA,EAAY,IAAA;MAEf,OAAA;MACA,MAAA;MACA,OAAA;MACA,MAAA;MACA,MAAA,GAAS,MAAA;IAAA,MAEV,OAAA;MAAU,EAAA;MAAU,QAAA;IAAA;eAQN,gBAAA,EAAgB,QAAA,aAAkB,OAAA;6BAM5C,gBAAA,EAAgB,IAAA;MACb,MAAA;MAAgB,OAAA;IAAA,MAAiB,OAAA;gBAQpC,gBAAA,EAAgB,IAAA;MAEnB,KAAA;QACE,OAAA;QACA,MAAA;QACA,MAAA;QACA,MAAA;MAAA;MAEF,KAAA;MACA,MAAA;MACA,OAAA;MACA,KAAA;IAAA,MACD,OAAA;kBAUiB,YAAA,EAAY,QAAA,aAAkB,OAAA;;;;kBAK3C,YAAA,EAAY,QAAA,UACD,IAAA,EACV,MAAA,sBAAuB,OAAA;;;;mBAiBxB,gBAAA,EAAgB,IAAA;MAEnB,MAAA;MACA,OAAA;MACA,OAAA;MACA,MAAA;MACA,QAAA;IAAA,MACD,OAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;mBA0EI,gBAAA,EAAgB,IAAA;MAEnB,MAAA;MACA,OAAA;MACA,OAAA;MACA,MAAA;MACA,QAAA;IAAA,MACD,OAAA;;;;;;;;;;;iBAuBI,gBAAA,EAAgB,IAAA;MAEnB,MAAA;MACA,OAAA;MACA,MAAA;MACA,QAAA;IAAA,MACD,OAAA;;;;;;;;;;;mBAyBI,gBAAA,EAAgB,IAAA;MAEnB,MAAA;MACA,OAAA;MACA,MAAA;MACA,QAAA;IAAA,MACD,OAAA;;;;;;;;;;;;;kBAeI,YAAA,EAAY,IAAA;MAEf,OAAA;MACA,eAAA;MACA,KAAA;MACA,OAAA;MACA,WAAA;MACA,MAAA,GAAS,MAAA;IAAA,MAEV,OAAA;MAAU,EAAA;MAAU,QAAA;MAAkB,KAAA;IAAA;eAaxB,gBAAA,EAAgB,QAAA,aAAkB,OAAA;;iBAMhC,gBAAA,EAAgB,KAAA,aAAe,OAAA;oBAQzC,YAAA,EAAY,IAAA;QACT,KAAA;QAAe,gBAAA;MAAA,MAA0B,OAAA;IAAA;gBAW9C,gBAAA,EAAgB,IAAA;MAEnB,KAAA;QACE,SAAA;QACA,OAAA;QACA,MAAA;QACA,KAAA;QACA,eAAA;QACA,MAAA;QACA,gBAAA;MAAA;MAEF,KAAA;MACA,MAAA;MACA,OAAA;MAMA,KAAA;IAAA,MACD,OAAA;kBAWI,YAAA,EAAY,QAAA,UACD,gBAAA,cACS,OAAA;;;;;kBAYP,YAAA,EAAY,QAAA,aAAkB,OAAA;;;;;;kBAQ3C,YAAA,EAAY,IAAA;MAEf,MAAA;MACA,IAAA;MACA,MAAA,EAAQ,QAAA;MACR,SAAA;QAAc,WAAA;QAAqB,QAAA;MAAA;MACnC,SAAA;MACA,QAAA,GAAW,MAAA;IAAA,MAEZ,OAAA;MAAU,EAAA;MAAU,KAAA;MAAe,MAAA;IAAA;kBAe/B,YAAA,EAAY,MAAA,aAEhB,OAAA;MAAU,MAAA;MAAgB,KAAA;MAAe,MAAA,EAAQ,YAAA;IAAA;gBA0C7C,gBAAA,EAAgB,IAAA;MAEnB,KAAA;QACE,MAAA;QACA,OAAA;QACA,IAAA;QACA,MAAA;MAAA;MAEF,KAAA;MACA,MAAA;MACA,OAAA;MAMA,KAAA;IAAA,MACD,OAAA;eAWI,gBAAA,EAAgB,KAAA,aAEpB,OAAA,CAAQ,MAAA;kBAMJ,YAAA,EAAY,KAAA,UACJ,IAAA;MAEX,IAAA;MACA,MAAA,GAAS,QAAA;MACT,SAAA;QAAc,WAAA;QAAqB,QAAA;MAAA;IAAA,MACpC,OAAA;;;;kBAKiB,YAAA,EAAY,KAAA,aAAe,OAAA;;;;kBAO3B,YAAA,EAAY,KAAA,aAAe,OAAA;;;;kBAKxC,YAAA,EAAY,KAAA,UACJ,IAAA;MACJ,IAAA;MAAe,SAAA;IAAA,MACvB,OAAA;MAAU,EAAA;MAAU,KAAA;MAAe,MAAA;IAAA;EAAA;AAAA"}
+{"version":3,"file":"core.d.ts","names":[],"sources":["../../../src/server/domains/core.ts"],"mappings":";;;;;KAyBK,YAAA,GAAe,IAAA,CAClB,gBAAA,CAAiB,gBAAA;AAAA,KAGd,gBAAA,GAAmB,IAAA,CAAK,gBAAA,CAAiB,gBAAA;AAAA,KACzC,oBAAA,GAAuB,gBAAA;EAAqB,IAAA,EAAM,IAAA;AAAA;AAAA,KAClD,kBAAA;EAAuB,EAAA;EAAY,MAAA;AAAA;AAAA,KACnC,iBAAA;EACH,QAAA;EACA,OAAA,EAAS,kBAAA;EACT,OAAA,EAAS,MAAA;EACT,kBAAA;EACA,kBAAA;AAAA;AAAA,KAEG,mBAAA;EAAwB,QAAA;EAAkB,OAAA,EAAS,kBAAA;AAAA;AAAA,KACnD,4BAAA;EACH,QAAA;EACA,OAAA;IAAW,EAAA;IAAY,MAAA;EAAA;AAAA;AAAA,KAGpB,QAAA;EACH,MAAA;EACA,OAAA;EACA,sBAAA,qBAA2C,gBAAA,EACzC,GAAA,EAAK,gBAAA,CAAiB,SAAA,GACtB,IAAA;IAAQ,MAAA,EAAQ,SAAA;IAAmB,MAAA,GAAS,SAAA;EAAA,MACzC,OAAA;EACL,gCAAA,qBAAqD,gBAAA,EACnD,GAAA,EAAK,gBAAA,CAAiB,SAAA,GACtB,IAAA,EAAM,iBAAA,KACH,OAAA;EACL,kCAAA,qBAAuD,gBAAA,EACrD,GAAA,EAAK,gBAAA,CAAiB,SAAA,GACtB,IAAA,EAAM,mBAAA,KACH,OAAA;EACL,iBAAA,qBAAsC,gBAAA,EACpC,GAAA,EAAK,gBAAA,CAAiB,SAAA,GACtB,IAAA,EAAM,4BAAA,KACH,OAAA;EACL,YAAA,2BAAuC,gBAAA,EACrC,GAAA,EAAK,gBAAA,CAAiB,SAAA;EAExB,mBAAA;EACA,iBAAA;AAAA;;AArC4C;;iBA2C9B,iBAAA,CAAkB,IAAA,EAAM,QAAA;;;MAkE3B,IAAA,EAAM,IAAA;IAAA,IAAS,OAAA,CAAQ,YAAA,GAAa,OAAA,GACjC,OAAA,KACT,OAAA;eAsBc,gBAAA,EAAgB,MAAA,aAAgB,OAAA;gBAU1C,gBAAA,EAAgB,IAAA;MAEnB,KAAA,GAAQ,SAAA;MACR,KAAA;MACA,MAAA;MACA,OAAA,GAAU,WAAA;MACV,KAAA;IAAA,MACD,OAAA;kBAIiB,oBAAA,KAAoB,OAAA;kBAMjC,YAAA,EAAY,MAAA,UACH,IAAA,EACR,MAAA,sBAAuB,OAAA;;;;0BASxB,YAAA,EAAY,IAAA;MACT,MAAA;MAAgB,OAAA;IAAA,MAAwB,OAAA;;;;;;;;;0BAqB3C,gBAAA,EAAgB,IAAA;MACb,MAAA;IAAA,MACP,OAAA;kBAcI,YAAA,EAAY,MAAA,UACH,IAAA;MACL,OAAA;IAAA,MAAmB,OAAA;;;;;;;;;;;;MA4EP,IAAA,EAAM,IAAA;IAAA,MAAM,OAAA,CAAA,SAAA;mCAME,gBAAA,EAAgB,GAAA,EAC9C,gBAAA,CAAiB,SAAA,GAAU,IAAA;MACxB,MAAA,EAAQ,SAAA;MAAmB,MAAA,GAAS,SAAA;IAAA,MAAwB,OAAA;;;;;eASrD,gBAAA,EAAgB,SAAA,aAAmB,OAAA;gBAKlC,gBAAA,EAAgB,IAAA;MAAU,MAAA;IAAA,MAAgB,OAAA;EAAA;;+BAQ3B,gBAAA,EAAgB,GAAA,EAC1C,gBAAA,CAAiB,SAAA,GAAU,IAAA,EAC1B,iBAAA,KAAiB,OAAA;4BAKK,gBAAA,EAAgB,GAAA,EACvC,gBAAA,CAAiB,SAAA,GAAU,IAAA,EAC1B,mBAAA,KAAmB,OAAA;+BAQM,gBAAA,EAAgB,GAAA,EAC1C,gBAAA,CAAiB,SAAA,GAAU,IAAA,EAC1B,4BAAA,KAA4B,OAAA;;;;kBAKhB,YAAA,EAAY,SAAA,aAAmB,OAAA;;;;;;;;;;;;;wBAmBzB,gBAAA,EAAgB,IAAA;MAAU,MAAA;IAAA,MAAgB,OAAA;yBAO7D,YAAA,EAAY,SAAA,UACA,IAAA,aACL,OAAA;;;;yBAQa,YAAA,EAAY,SAAA,aAAmB,OAAA;;;;qBAMnC,gBAAA,EAAgB,IAAA;MAAU,MAAA;IAAA,MAAgB,OAAA;sBAGzC,YAAA,EAAY,MAAA,aAAgB,OAAA;;;;;;+BAOnB,gBAAA,EAAgB,GAAA,EAC1C,gBAAA,CAAiB,SAAA,GAAU,cAAA,EAChB,kBAAA,EAAkB,IAAA;MAEhC,SAAA,GAAY,SAAA;MACZ,MAAA,GAAS,MAAA;IAAA,MACV,OAAA;;;;;;kBAwBI,YAAA,EAAY,IAAA;MAEf,IAAA;MACA,IAAA;MACA,IAAA;MACA,aAAA;MACA,IAAA,GAAO,KAAA;QAAQ,GAAA;QAAa,KAAA;MAAA;MAC5B,MAAA,GAAS,MAAA;IAAA,MAEV,OAAA;MAAU,EAAA;MAAU,OAAA;IAAA;eAON,gBAAA,EAAgB,OAAA,aAAiB,OAAA;gBAU3C,gBAAA,EAAgB,IAAA;MAEnB,KAAA;QACE,IAAA;QACA,IAAA;QACA,aAAA;QACA,IAAA;QACA,MAAA;QACA,OAAA,GAAU,KAAA;UAAQ,GAAA;UAAa,KAAA;QAAA;QAC/B,OAAA,GAAU,KAAA;UAAQ,GAAA;UAAa,KAAA;QAAA;MAAA;MAEjC,KAAA;MACA,MAAA;MACA,OAAA;MACA,KAAA;IAAA,MACD,OAAA;kBAWI,YAAA,EAAY,OAAA,UACF,IAAA,EACT,MAAA,sBAAuB,OAAA;;;;kBAQX,YAAA,EAAY,OAAA,aAAiB,OAAA;;;;qBAK1C,gBAAA,EAAgB,IAAA;MACb,OAAA;MAAiB,QAAA;MAAmB,WAAA;IAAA,MAAuB,OAAA;;;;;;;kBAuC9D,YAAA,EAAY,IAAA;MAEf,OAAA;MACA,MAAA;MACA,OAAA;MACA,MAAA;MACA,MAAA,GAAS,MAAA;IAAA,MACV,OAAA;;;;;;;;;;;eAec,gBAAA,EAAgB,QAAA,aAAkB,OAAA;6BAM5C,gBAAA,EAAgB,IAAA;MACb,MAAA;MAAgB,OAAA;IAAA,MAAiB,OAAA;gBAQpC,gBAAA,EAAgB,IAAA;MAEnB,KAAA;QACE,OAAA;QACA,MAAA;QACA,MAAA;QACA,MAAA;MAAA;MAEF,KAAA;MACA,MAAA;MACA,OAAA;MACA,KAAA;IAAA,MACD,OAAA;kBAUiB,YAAA,EAAY,QAAA,aAAkB,OAAA;;;;kBAK3C,YAAA,EAAY,QAAA,UACD,IAAA,EACV,MAAA,sBAAuB,OAAA;;;;;;;;;;;mBAwBxB,gBAAA,EAAgB,IAAA;MAEnB,MAAA;MACA,OAAA;MACA,OAAA;MACA,MAAA;MACA,QAAA;IAAA,MACD,OAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2GI,gBAAA,EAAgB,IAAA;MAEnB,MAAA;MACA,OAAA;MACA,MAAA;MACA,QAAA;IAAA,MACD,OAAA;;;;;;;;;;;;;kBAyCI,YAAA,EAAY,IAAA;MAEf,OAAA;MACA,eAAA;MACA,KAAA;MACA,OAAA;MACA,WAAA;MACA,MAAA,GAAS,MAAA;IAAA,MACV,OAAA;;;;;;;;;;;;;eAoBc,gBAAA,EAAgB,QAAA,aAAkB,OAAA;;iBAMhC,gBAAA,EAAgB,KAAA,aAAe,OAAA;oBAQzC,YAAA,EAAY,IAAA;QACT,KAAA;QAAe,gBAAA;MAAA,MAA0B,OAAA;IAAA;gBAW9C,gBAAA,EAAgB,IAAA;MAEnB,KAAA;QACE,SAAA;QACA,OAAA;QACA,MAAA;QACA,KAAA;QACA,eAAA;QACA,MAAA;QACA,gBAAA;MAAA;MAEF,KAAA;MACA,MAAA;MACA,OAAA;MAMA,KAAA;IAAA,MACD,OAAA;kBAWI,YAAA,EAAY,QAAA,UACD,gBAAA,cACS,OAAA;;;;;kBAYP,YAAA,EAAY,QAAA,aAAkB,OAAA;;;;;;kBAQ3C,YAAA,EAAY,IAAA;MAEf,MAAA;MACA,IAAA;MACA,MAAA,EAAQ,QAAA;MACR,SAAA;QAAc,WAAA;QAAqB,QAAA;MAAA;MACnC,SAAA;MACA,QAAA,GAAW,MAAA;IAAA,MAEZ,OAAA;MAAU,EAAA;MAAU,KAAA;MAAe,MAAA;IAAA;kBAe/B,YAAA,EAAY,MAAA,aAEhB,OAAA;MACG,EAAA;MAAU,MAAA;MAAgB,KAAA;MAAe,MAAA,EAAQ,YAAA;IAAA;MAEjD,EAAA;MACA,IAAA;IAAA;gBA6CC,gBAAA,EAAgB,IAAA;MAEnB,KAAA;QACE,MAAA;QACA,OAAA;QACA,IAAA;QACA,MAAA;MAAA;MAEF,KAAA;MACA,MAAA;MACA,OAAA;MAMA,KAAA;IAAA,MACD,OAAA;eAWI,gBAAA,EAAgB,KAAA,aAEpB,OAAA,CAAQ,MAAA;kBAMJ,YAAA,EAAY,KAAA,UACJ,IAAA;MAEX,IAAA;MACA,MAAA,GAAS,QAAA;MACT,SAAA;QAAc,WAAA;QAAqB,QAAA;MAAA;IAAA,MACpC,OAAA;;;;kBAKiB,YAAA,EAAY,KAAA,aAAe,OAAA;;;;kBAO3B,YAAA,EAAY,KAAA,aAAe,OAAA;;;;kBAKxC,YAAA,EAAY,KAAA,UACJ,IAAA;MACJ,IAAA;MAAe,SAAA;IAAA,MACvB,OAAA;MACG,EAAA;MAAU,KAAA;MAAe,MAAA;IAAA;MACzB,EAAA;MAAW,IAAA;IAAA;EAAA;AAAA"}