@robelest/convex-auth 0.0.4-preview.2 → 0.0.4-preview.21

package/dist/component/public.js

@@ -1,1230 +1,22 @@
-import { mutation, query } from "./functions.js";
-import { ConvexError, v } from "convex/values";
+import { accountDelete, accountGet, accountGetById, accountInsert, accountListByUser, accountPatch } from "./public/identity/accounts.js";
+import { deviceAuthorize, deviceDelete, deviceGetByCodeHash, deviceGetByUserCode, deviceInsert, deviceUpdateLastPolled } from "./public/factors/devices.js";
+import { enterpriseAuditEventCreate, enterpriseAuditEventList } from "./public/enterprise/audit.js";
+import { enterpriseCreate, enterpriseDelete, enterpriseGet, enterpriseGetByDomain, enterpriseGetByGroup, enterpriseList, enterpriseUpdate } from "./public/enterprise/core.js";
+import { enterpriseDomainAdd, enterpriseDomainDelete, enterpriseDomainList, enterpriseDomainVerificationDelete, enterpriseDomainVerificationGet, enterpriseDomainVerificationUpsert, enterpriseDomainVerify } from "./public/enterprise/domains.js";
+import { enterpriseScimConfigGetByEnterprise, enterpriseScimConfigGetByTokenHash, enterpriseScimConfigUpsert, enterpriseScimIdentityDelete, enterpriseScimIdentityGet, enterpriseScimIdentityGetByEnterpriseAndUser, enterpriseScimIdentityGetByMappedGroup, enterpriseScimIdentityGetByUser, enterpriseScimIdentityListByEnterprise, enterpriseScimIdentityUpsert } from "./public/enterprise/scim.js";
+import { enterpriseSecretDelete, enterpriseSecretGet, enterpriseSecretUpsert } from "./public/enterprise/secrets.js";
+import { enterpriseWebhookDeliveryEnqueue, enterpriseWebhookDeliveryList, enterpriseWebhookDeliveryListReady, enterpriseWebhookDeliveryPatch, enterpriseWebhookEndpointCreate, enterpriseWebhookEndpointGet, enterpriseWebhookEndpointList, enterpriseWebhookEndpointUpdate } from "./public/enterprise/webhooks.js";
+import { groupCreate, groupDelete, groupGet, groupList, groupUpdate } from "./public/groups/core.js";
+import { inviteAccept, inviteAcceptByToken, inviteCreate, inviteGet, inviteGetByTokenHash, inviteList, inviteRevoke } from "./public/groups/invites.js";
+import { memberAdd, memberGet, memberGetByGroupAndUser, memberList, memberRemove, memberResolve, memberUpdate } from "./public/groups/members.js";
+import { keyDelete, keyGetByHashedKey, keyGetById, keyInsert, keyList, keyPatch } from "./public/security/keys.js";
+import { passkeyDelete, passkeyGetByCredentialId, passkeyInsert, passkeyListByUserId, passkeyUpdateCounter, passkeyUpdateMeta } from "./public/factors/passkeys.js";
+import { rateLimitCreate, rateLimitDelete, rateLimitGet, rateLimitPatch } from "./public/security/limits.js";
+import { refreshTokenCreate, refreshTokenDeleteAll, refreshTokenGetActive, refreshTokenGetById, refreshTokenGetChildren, refreshTokenListBySession, refreshTokenPatch } from "./public/identity/tokens.js";
+import { sessionCreate, sessionDelete, sessionGetById, sessionList, sessionListByUser } from "./public/identity/sessions.js";
+import { totpDelete, totpGetById, totpGetVerifiedByUserId, totpInsert, totpListByUserId, totpMarkVerified, totpUpdateLastUsed } from "./public/factors/totp.js";
+import { userDelete, userFindByVerifiedEmail, userFindByVerifiedPhone, userGetById, userInsert, userList, userPatch, userUpsert } from "./public/identity/users.js";
+import { verificationCodeCreate, verificationCodeDelete, verificationCodeGetByAccountId, verificationCodeGetByCode } from "./public/identity/codes.js";
+import { verifierCreate, verifierDelete, verifierGetById, verifierGetBySignature, verifierPatch } from "./public/identity/verifiers.js";
 
-//#region src/component/public.ts
-/** Validator for a single `{ key, value }` tag pair. */
-const vTag = v.object({
-	key: v.string(),
-	value: v.string()
-});
-/** Normalize a single tag: trim + lowercase key and value. */
-function normalizeTag(tag) {
-	return {
-		key: tag.key.trim().toLowerCase(),
-		value: tag.value.trim().toLowerCase()
-	};
-}
-/**
-* Normalize and deduplicate an array of tags.
-* Deduplication is based on the normalized `key\0value` composite.
-*/
-function normalizeTags(tags) {
-	const seen = /* @__PURE__ */ new Set();
-	const result = [];
-	for (const raw of tags) {
-		const t = normalizeTag(raw);
-		const composite = `${t.key}\0${t.value}`;
-		if (!seen.has(composite)) {
-			seen.add(composite);
-			result.push(t);
-		}
-	}
-	return result;
-}
-/**
-* List users with optional filtering, sorting, and pagination.
-*
-* Returns `{ items, nextCursor }` — pass `nextCursor` back as `cursor`
-* for the next page, or `null` when exhausted.
-*/
-const userList = query({
-	args: {
-		where: v.optional(v.object({
-			email: v.optional(v.string()),
-			phone: v.optional(v.string()),
-			isAnonymous: v.optional(v.boolean()),
-			name: v.optional(v.string())
-		})),
-		limit: v.optional(v.number()),
-		cursor: v.optional(v.union(v.string(), v.null())),
-		orderBy: v.optional(v.union(v.literal("_creationTime"), v.literal("name"), v.literal("email"), v.literal("phone"))),
-		order: v.optional(v.union(v.literal("asc"), v.literal("desc")))
-	},
-	handler: async (ctx, args) => {
-		const where = args.where ?? {};
-		const limit = Math.min(Math.max(args.limit ?? 50, 1), 100);
-		const order = args.order ?? "desc";
-		let q;
-		if (where.email !== void 0) q = ctx.db.query("user").withIndex("email", (idx) => idx.eq("email", where.email));
-		else if (where.phone !== void 0) q = ctx.db.query("user").withIndex("phone", (idx) => idx.eq("phone", where.phone));
-		else q = ctx.db.query("user");
-		if (where.isAnonymous !== void 0) q = q.filter((f) => f.eq(f.field("isAnonymous"), where.isAnonymous));
-		if (where.name !== void 0) q = q.filter((f) => f.eq(f.field("name"), where.name));
-		if (where.email !== void 0 && where.phone !== void 0) q = q.filter((f) => f.eq(f.field("phone"), where.phone));
-		q = q.order(order);
-		const all = await q.collect();
-		let startIdx = 0;
-		if (args.cursor) {
-			const cursorIdx = all.findIndex((doc) => doc._id === args.cursor);
-			if (cursorIdx !== -1) startIdx = cursorIdx + 1;
-		}
-		const page = all.slice(startIdx, startIdx + limit + 1);
-		const hasMore = page.length > limit;
-		const items = hasMore ? page.slice(0, limit) : page;
-		return {
-			items,
-			nextCursor: hasMore ? items[items.length - 1]._id : null
-		};
-	}
-});
-/** Retrieve a user by their document ID. */
-const userGetById = query({
-	args: { userId: v.id("user") },
-	handler: async (ctx, { userId }) => {
-		return await ctx.db.get(userId);
-	}
-});
-/**
-* Find a user by their verified email address. Returns `null` if no user
-* has this email verified, or if multiple users share the same verified email
-* (ambiguous — should not happen in normal operation).
-*/
-const userFindByVerifiedEmail = query({
-	args: { email: v.string() },
-	handler: async (ctx, { email }) => {
-		const users = await ctx.db.query("user").withIndex("email", (q) => q.eq("email", email)).filter((q) => q.neq(q.field("emailVerificationTime"), void 0)).take(2);
-		return users.length === 1 ? users[0] : null;
-	}
-});
-/**
-* Find a user by their verified phone number. Returns `null` if no user
-* has this phone verified, or if multiple users share the same verified phone
-* (ambiguous — should not happen in normal operation).
-*/
-const userFindByVerifiedPhone = query({
-	args: { phone: v.string() },
-	handler: async (ctx, { phone }) => {
-		const users = await ctx.db.query("user").withIndex("phone", (q) => q.eq("phone", phone)).filter((q) => q.neq(q.field("phoneVerificationTime"), void 0)).take(2);
-		return users.length === 1 ? users[0] : null;
-	}
-});
-/** Insert a new user document. */
-const userInsert = mutation({
-	args: { data: v.any() },
-	handler: async (ctx, { data }) => {
-		return await ctx.db.insert("user", data);
-	}
-});
-/** Insert a new user or update an existing one. */
-const userUpsert = mutation({
-	args: {
-		userId: v.optional(v.id("user")),
-		data: v.any()
-	},
-	handler: async (ctx, { userId, data }) => {
-		if (userId !== void 0) {
-			await ctx.db.patch(userId, data);
-			return userId;
-		}
-		return await ctx.db.insert("user", data);
-	}
-});
-/** Patch an existing user document with partial data. */
-const userPatch = mutation({
-	args: {
-		userId: v.id("user"),
-		data: v.any()
-	},
-	handler: async (ctx, { userId, data }) => {
-		await ctx.db.patch(userId, data);
-	}
-});
-/** List all accounts for a user. */
-const accountListByUser = query({
-	args: { userId: v.id("user") },
-	handler: async (ctx, { userId }) => {
-		return await ctx.db.query("account").withIndex("userIdAndProvider", (q) => q.eq("userId", userId)).collect();
-	}
-});
-/** Look up an account by provider and provider-specific account ID. */
-const accountGet = query({
-	args: {
-		provider: v.string(),
-		providerAccountId: v.string()
-	},
-	handler: async (ctx, { provider, providerAccountId }) => {
-		return await ctx.db.query("account").withIndex("providerAndAccountId", (q) => q.eq("provider", provider).eq("providerAccountId", providerAccountId)).unique();
-	}
-});
-/** Retrieve an account by its document ID. */
-const accountGetById = query({
-	args: { accountId: v.id("account") },
-	handler: async (ctx, { accountId }) => {
-		return await ctx.db.get(accountId);
-	}
-});
-/** Create a new account linking a user to an auth provider. */
-const accountInsert = mutation({
-	args: {
-		userId: v.id("user"),
-		provider: v.string(),
-		providerAccountId: v.string(),
-		secret: v.optional(v.string())
-	},
-	handler: async (ctx, args) => {
-		return await ctx.db.insert("account", args);
-	}
-});
-/** Patch an existing account document with partial data. */
-const accountPatch = mutation({
-	args: {
-		accountId: v.id("account"),
-		data: v.any()
-	},
-	handler: async (ctx, { accountId, data }) => {
-		await ctx.db.patch(accountId, data);
-	}
-});
-/** Delete an account document. */
-const accountDelete = mutation({
-	args: { accountId: v.id("account") },
-	handler: async (ctx, { accountId }) => {
-		await ctx.db.delete(accountId);
-	}
-});
-/**
-* List sessions with optional filtering and pagination.
-*
-* Returns `{ items, nextCursor }`.
-*/
-const sessionList = query({
-	args: {
-		where: v.optional(v.object({ userId: v.optional(v.id("user")) })),
-		limit: v.optional(v.number()),
-		cursor: v.optional(v.union(v.string(), v.null())),
-		order: v.optional(v.union(v.literal("asc"), v.literal("desc")))
-	},
-	handler: async (ctx, args) => {
-		const where = args.where ?? {};
-		const limit = Math.min(Math.max(args.limit ?? 50, 1), 100);
-		const order = args.order ?? "desc";
-		let q;
-		if (where.userId !== void 0) q = ctx.db.query("session").withIndex("userId", (idx) => idx.eq("userId", where.userId));
-		else q = ctx.db.query("session");
-		q = q.order(order);
-		const all = await q.collect();
-		let startIdx = 0;
-		if (args.cursor) {
-			const cursorIdx = all.findIndex((doc) => doc._id === args.cursor);
-			if (cursorIdx !== -1) startIdx = cursorIdx + 1;
-		}
-		const page = all.slice(startIdx, startIdx + limit + 1);
-		const hasMore = page.length > limit;
-		const items = hasMore ? page.slice(0, limit) : page;
-		return {
-			items,
-			nextCursor: hasMore ? items[items.length - 1]._id : null
-		};
-	}
-});
-/** Create a new session for a user with an expiration time. */
-const sessionCreate = mutation({
-	args: {
-		userId: v.id("user"),
-		expirationTime: v.number()
-	},
-	handler: async (ctx, { userId, expirationTime }) => {
-		return await ctx.db.insert("session", {
-			userId,
-			expirationTime
-		});
-	}
-});
-/** Retrieve a session by its document ID. */
-const sessionGetById = query({
-	args: { sessionId: v.id("session") },
-	handler: async (ctx, { sessionId }) => {
-		return await ctx.db.get(sessionId);
-	}
-});
-/** Delete a session. No-op if the session does not exist. */
-const sessionDelete = mutation({
-	args: { sessionId: v.id("session") },
-	handler: async (ctx, { sessionId }) => {
-		if (await ctx.db.get(sessionId) !== null) await ctx.db.delete(sessionId);
-	}
-});
-/** List all sessions for a user. */
-const sessionListByUser = query({
-	args: { userId: v.id("user") },
-	handler: async (ctx, { userId }) => {
-		return await ctx.db.query("session").withIndex("userId", (q) => q.eq("userId", userId)).collect();
-	}
-});
-/** Create a new PKCE verifier, optionally linked to a session. */
-const verifierCreate = mutation({
-	args: { sessionId: v.optional(v.id("session")) },
-	handler: async (ctx, { sessionId }) => {
-		return await ctx.db.insert("verifier", { sessionId });
-	}
-});
-/** Retrieve a verifier by its document ID. */
-const verifierGetById = query({
-	args: { verifierId: v.id("verifier") },
-	handler: async (ctx, { verifierId }) => {
-		return await ctx.db.get(verifierId);
-	}
-});
-/** Look up a verifier by its cryptographic signature. */
-const verifierGetBySignature = query({
-	args: { signature: v.string() },
-	handler: async (ctx, { signature }) => {
-		return await ctx.db.query("verifier").withIndex("signature", (q) => q.eq("signature", signature)).unique();
-	}
-});
-/** Patch a verifier document with partial data. */
-const verifierPatch = mutation({
-	args: {
-		verifierId: v.id("verifier"),
-		data: v.any()
-	},
-	handler: async (ctx, { verifierId, data }) => {
-		await ctx.db.patch(verifierId, data);
-	}
-});
-/** Delete a verifier document. */
-const verifierDelete = mutation({
-	args: { verifierId: v.id("verifier") },
-	handler: async (ctx, { verifierId }) => {
-		await ctx.db.delete(verifierId);
-	}
-});
-/** Find a verification code by its associated account ID. */
-const verificationCodeGetByAccountId = query({
-	args: { accountId: v.id("account") },
-	handler: async (ctx, { accountId }) => {
-		return await ctx.db.query("verification").withIndex("accountId", (q) => q.eq("accountId", accountId)).unique();
-	}
-});
-/** Find a verification code by its code string. */
-const verificationCodeGetByCode = query({
-	args: { code: v.string() },
-	handler: async (ctx, { code }) => {
-		return await ctx.db.query("verification").withIndex("code", (q) => q.eq("code", code)).unique();
-	}
-});
-/** Create a new verification code for OTP, magic link, or OAuth flows. */
-const verificationCodeCreate = mutation({
-	args: {
-		accountId: v.id("account"),
-		provider: v.string(),
-		code: v.string(),
-		expirationTime: v.number(),
-		verifier: v.optional(v.string()),
-		emailVerified: v.optional(v.string()),
-		phoneVerified: v.optional(v.string())
-	},
-	handler: async (ctx, args) => {
-		return await ctx.db.insert("verification", args);
-	}
-});
-/** Delete a verification code document. */
-const verificationCodeDelete = mutation({
-	args: { verificationCodeId: v.id("verification") },
-	handler: async (ctx, { verificationCodeId }) => {
-		await ctx.db.delete(verificationCodeId);
-	}
-});
-/** Create a new refresh token for a session. */
-const refreshTokenCreate = mutation({
-	args: {
-		sessionId: v.id("session"),
-		expirationTime: v.number(),
-		parentRefreshTokenId: v.optional(v.id("token"))
-	},
-	handler: async (ctx, args) => {
-		return await ctx.db.insert("token", args);
-	}
-});
-/** Retrieve a refresh token by its document ID. */
-const refreshTokenGetById = query({
-	args: { refreshTokenId: v.id("token") },
-	handler: async (ctx, { refreshTokenId }) => {
-		return await ctx.db.get(refreshTokenId);
-	}
-});
-/** Patch a refresh token document with partial data. */
-const refreshTokenPatch = mutation({
-	args: {
-		refreshTokenId: v.id("token"),
-		data: v.any()
-	},
-	handler: async (ctx, { refreshTokenId, data }) => {
-		await ctx.db.patch(refreshTokenId, data);
-	}
-});
-/** Get child tokens that were created by exchanging a specific parent token. */
-const refreshTokenGetChildren = query({
-	args: {
-		sessionId: v.id("session"),
-		parentRefreshTokenId: v.id("token")
-	},
-	handler: async (ctx, { sessionId, parentRefreshTokenId }) => {
-		return await ctx.db.query("token").withIndex("sessionIdAndParentRefreshTokenId", (q) => q.eq("sessionId", sessionId).eq("parentRefreshTokenId", parentRefreshTokenId)).collect();
-	}
-});
-/** List all refresh tokens for a session. */
-const refreshTokenListBySession = query({
-	args: { sessionId: v.id("session") },
-	handler: async (ctx, { sessionId }) => {
-		return await ctx.db.query("token").withIndex("sessionIdAndParentRefreshTokenId", (q) => q.eq("sessionId", sessionId)).collect();
-	}
-});
-/** Delete all refresh tokens for a session. */
-const refreshTokenDeleteAll = mutation({
-	args: { sessionId: v.id("session") },
-	handler: async (ctx, { sessionId }) => {
-		const tokens = await ctx.db.query("token").withIndex("sessionIdAndParentRefreshTokenId", (q) => q.eq("sessionId", sessionId)).collect();
-		await Promise.all(tokens.map((token) => ctx.db.delete(token._id)));
-	}
-});
-/** Get the active (unused) refresh token for a session. */
-const refreshTokenGetActive = query({
-	args: { sessionId: v.id("session") },
-	handler: async (ctx, { sessionId }) => {
-		return await ctx.db.query("token").withIndex("sessionId", (q) => q.eq("sessionId", sessionId)).filter((q) => q.eq(q.field("firstUsedTime"), void 0)).order("desc").first();
-	}
-});
-/** Store a new passkey credential for a user. */
-const passkeyInsert = mutation({
-	args: {
-		userId: v.id("user"),
-		credentialId: v.string(),
-		publicKey: v.bytes(),
-		algorithm: v.number(),
-		counter: v.number(),
-		transports: v.optional(v.array(v.string())),
-		deviceType: v.string(),
-		backedUp: v.boolean(),
-		name: v.optional(v.string()),
-		createdAt: v.number()
-	},
-	handler: async (ctx, args) => {
-		return await ctx.db.insert("passkey", args);
-	}
-});
-/** Look up a passkey by its credential ID. */
-const passkeyGetByCredentialId = query({
-	args: { credentialId: v.string() },
-	handler: async (ctx, { credentialId }) => {
-		return await ctx.db.query("passkey").withIndex("credentialId", (q) => q.eq("credentialId", credentialId)).unique();
-	}
-});
-/** List all passkeys for a user. */
-const passkeyListByUserId = query({
-	args: { userId: v.id("user") },
-	handler: async (ctx, { userId }) => {
-		return await ctx.db.query("passkey").withIndex("userId", (q) => q.eq("userId", userId)).collect();
-	}
-});
-/** Update a passkey's counter and last used timestamp after authentication. */
-const passkeyUpdateCounter = mutation({
-	args: {
-		passkeyId: v.id("passkey"),
-		counter: v.number(),
-		lastUsedAt: v.number()
-	},
-	handler: async (ctx, { passkeyId, counter, lastUsedAt }) => {
-		await ctx.db.patch(passkeyId, {
-			counter,
-			lastUsedAt
-		});
-	}
-});
-/** Update a passkey's metadata (name). */
-const passkeyUpdateMeta = mutation({
-	args: {
-		passkeyId: v.id("passkey"),
-		data: v.any()
-	},
-	handler: async (ctx, { passkeyId, data }) => {
-		await ctx.db.patch(passkeyId, data);
-	}
-});
-/** Delete a passkey credential. */
-const passkeyDelete = mutation({
-	args: { passkeyId: v.id("passkey") },
-	handler: async (ctx, { passkeyId }) => {
-		await ctx.db.delete(passkeyId);
-	}
-});
-/** Store a new TOTP enrollment for a user. */
-const totpInsert = mutation({
-	args: {
-		userId: v.id("user"),
-		secret: v.bytes(),
-		digits: v.number(),
-		period: v.number(),
-		verified: v.boolean(),
-		name: v.optional(v.string()),
-		createdAt: v.number()
-	},
-	handler: async (ctx, args) => {
-		return await ctx.db.insert("totp", args);
-	}
-});
-/** Get a verified TOTP enrollment for a user (returns first match). */
-const totpGetVerifiedByUserId = query({
-	args: { userId: v.id("user") },
-	handler: async (ctx, { userId }) => {
-		return await ctx.db.query("totp").withIndex("userId", (q) => q.eq("userId", userId)).filter((q) => q.eq(q.field("verified"), true)).first();
-	}
-});
-/** List all TOTP enrollments for a user. */
-const totpListByUserId = query({
-	args: { userId: v.id("user") },
-	handler: async (ctx, { userId }) => {
-		return await ctx.db.query("totp").withIndex("userId", (q) => q.eq("userId", userId)).collect();
-	}
-});
-/** Get a TOTP enrollment by its ID. */
-const totpGetById = query({
-	args: { totpId: v.id("totp") },
-	handler: async (ctx, { totpId }) => {
-		return await ctx.db.get(totpId);
-	}
-});
-/** Mark a TOTP enrollment as verified (setup complete). */
-const totpMarkVerified = mutation({
-	args: {
-		totpId: v.id("totp"),
-		lastUsedAt: v.number()
-	},
-	handler: async (ctx, { totpId, lastUsedAt }) => {
-		await ctx.db.patch(totpId, {
-			verified: true,
-			lastUsedAt
-		});
-	}
-});
-/** Update a TOTP enrollment's last used timestamp. */
-const totpUpdateLastUsed = mutation({
-	args: {
-		totpId: v.id("totp"),
-		lastUsedAt: v.number()
-	},
-	handler: async (ctx, { totpId, lastUsedAt }) => {
-		await ctx.db.patch(totpId, { lastUsedAt });
-	}
-});
-/** Delete a TOTP enrollment. */
-const totpDelete = mutation({
-	args: { totpId: v.id("totp") },
-	handler: async (ctx, { totpId }) => {
-		await ctx.db.delete(totpId);
-	}
-});
-/** Look up a rate limit entry by its identifier. */
-const rateLimitGet = query({
-	args: { identifier: v.string() },
-	handler: async (ctx, { identifier }) => {
-		return await ctx.db.query("limit").withIndex("identifier", (q) => q.eq("identifier", identifier)).unique();
-	}
-});
-/** Create a new rate limit entry. */
-const rateLimitCreate = mutation({
-	args: {
-		identifier: v.string(),
-		attemptsLeft: v.number(),
-		lastAttemptTime: v.number()
-	},
-	handler: async (ctx, args) => {
-		return await ctx.db.insert("limit", args);
-	}
-});
-/** Patch a rate limit entry with partial data. */
-const rateLimitPatch = mutation({
-	args: {
-		rateLimitId: v.id("limit"),
-		data: v.any()
-	},
-	handler: async (ctx, { rateLimitId, data }) => {
-		await ctx.db.patch(rateLimitId, data);
-	}
-});
-/** Delete a rate limit entry. */
-const rateLimitDelete = mutation({
-	args: { rateLimitId: v.id("limit") },
-	handler: async (ctx, { rateLimitId }) => {
-		await ctx.db.delete(rateLimitId);
-	}
-});
-/**
-* Create a new group. Groups are hierarchical — set `parentGroupId` to nest
-* under an existing group, or omit it to create a root-level group.
-*
-* @returns The ID of the newly created group.
-*/
-const groupCreate = mutation({
-	args: {
-		name: v.string(),
-		slug: v.optional(v.string()),
-		type: v.optional(v.string()),
-		parentGroupId: v.optional(v.id("group")),
-		tags: v.optional(v.array(vTag)),
-		extend: v.optional(v.any())
-	},
-	handler: async (ctx, args) => {
-		const { tags: rawTags, ...rest } = args;
-		const normalizedTags = rawTags ? normalizeTags(rawTags) : void 0;
-		const groupId = await ctx.db.insert("group", {
-			...rest,
-			tags: normalizedTags
-		});
-		if (normalizedTags) for (const tag of normalizedTags) await ctx.db.insert("groupTag", {
-			groupId,
-			key: tag.key,
-			value: tag.value
-		});
-		return groupId;
-	}
-});
-/** Retrieve a group by its document ID. Returns `null` if not found. */
-const groupGet = query({
-	args: { groupId: v.id("group") },
-	handler: async (ctx, { groupId }) => {
-		return await ctx.db.get(groupId);
-	}
-});
-/**
-* List groups with optional filtering, sorting, and pagination.
-*
-* Returns `{ items, nextCursor }`. Empty `where` returns **all** groups.
-*/
-const groupList = query({
-	args: {
-		where: v.optional(v.object({
-			slug: v.optional(v.string()),
-			type: v.optional(v.string()),
-			parentGroupId: v.optional(v.id("group")),
-			name: v.optional(v.string()),
-			isRoot: v.optional(v.boolean()),
-			tagsAll: v.optional(v.array(vTag)),
-			tagsAny: v.optional(v.array(vTag))
-		})),
-		limit: v.optional(v.number()),
-		cursor: v.optional(v.union(v.string(), v.null())),
-		orderBy: v.optional(v.union(v.literal("_creationTime"), v.literal("name"), v.literal("slug"), v.literal("type"))),
-		order: v.optional(v.union(v.literal("asc"), v.literal("desc")))
-	},
-	handler: async (ctx, args) => {
-		const where = args.where ?? {};
-		const limit = Math.min(Math.max(args.limit ?? 50, 1), 100);
-		const order = args.order ?? "desc";
-		let tagFilteredIds = null;
-		if (where.tagsAll && where.tagsAll.length > 0) {
-			let allSet = null;
-			for (const rawTag of where.tagsAll) {
-				const t = normalizeTag(rawTag);
-				const rows = await ctx.db.query("groupTag").withIndex("by_key_value", (idx) => idx.eq("key", t.key).eq("value", t.value)).collect();
-				const ids = new Set(rows.map((r) => r.groupId));
-				if (allSet === null) allSet = ids;
-				else for (const id of allSet) if (!ids.has(id)) allSet.delete(id);
-				if (allSet.size === 0) break;
-			}
-			tagFilteredIds = allSet ?? /* @__PURE__ */ new Set();
-		}
-		if (where.tagsAny && where.tagsAny.length > 0) {
-			const anySet = /* @__PURE__ */ new Set();
-			for (const rawTag of where.tagsAny) {
-				const t = normalizeTag(rawTag);
-				const rows = await ctx.db.query("groupTag").withIndex("by_key_value", (idx) => idx.eq("key", t.key).eq("value", t.value)).collect();
-				for (const r of rows) anySet.add(r.groupId);
-			}
-			if (tagFilteredIds !== null) {
-				for (const id of tagFilteredIds) if (!anySet.has(id)) tagFilteredIds.delete(id);
-			} else tagFilteredIds = anySet;
-		}
-		let q;
-		if (where.type !== void 0 && where.parentGroupId !== void 0) q = ctx.db.query("group").withIndex("typeAndParentGroupId", (idx) => idx.eq("type", where.type).eq("parentGroupId", where.parentGroupId));
-		else if (where.slug !== void 0) q = ctx.db.query("group").withIndex("slug", (idx) => idx.eq("slug", where.slug));
-		else if (where.type !== void 0) q = ctx.db.query("group").withIndex("type", (idx) => idx.eq("type", where.type));
-		else if (where.parentGroupId !== void 0) q = ctx.db.query("group").withIndex("parentGroupId", (idx) => idx.eq("parentGroupId", where.parentGroupId));
-		else q = ctx.db.query("group");
-		if (where.name !== void 0) q = q.filter((f) => f.eq(f.field("name"), where.name));
-		if (where.isRoot === true) q = q.filter((f) => f.eq(f.field("parentGroupId"), void 0));
-		else if (where.isRoot === false) q = q.filter((f) => f.neq(f.field("parentGroupId"), void 0));
-		if (where.slug !== void 0 && where.type !== void 0) q = q.filter((f) => f.eq(f.field("slug"), where.slug));
-		q = q.order(order);
-		let all = await q.collect();
-		if (tagFilteredIds !== null) all = all.filter((doc) => tagFilteredIds.has(doc._id));
-		let startIdx = 0;
-		if (args.cursor) {
-			const cursorIdx = all.findIndex((doc) => doc._id === args.cursor);
-			if (cursorIdx !== -1) startIdx = cursorIdx + 1;
-		}
-		const page = all.slice(startIdx, startIdx + limit + 1);
-		const hasMore = page.length > limit;
-		const items = hasMore ? page.slice(0, limit) : page;
-		return {
-			items,
-			nextCursor: hasMore ? items[items.length - 1]._id : null
-		};
-	}
-});
-/** Update a group's fields (name, slug, tags, extend, parentGroupId). */
-const groupUpdate = mutation({
-	args: {
-		groupId: v.id("group"),
-		data: v.any()
-	},
-	handler: async (ctx, { groupId, data }) => {
-		if (data.tags !== void 0) {
-			const normalizedTags = Array.isArray(data.tags) ? normalizeTags(data.tags) : [];
-			const existingTags = await ctx.db.query("groupTag").withIndex("by_group", (idx) => idx.eq("groupId", groupId)).collect();
-			for (const existing of existingTags) await ctx.db.delete(existing._id);
-			for (const tag of normalizedTags) await ctx.db.insert("groupTag", {
-				groupId,
-				key: tag.key,
-				value: tag.value
-			});
-			await ctx.db.patch(groupId, {
-				...data,
-				tags: normalizedTags.length > 0 ? normalizedTags : void 0
-			});
-		} else await ctx.db.patch(groupId, data);
-	}
-});
-/**
-* Delete a group and all of its descendants. This cascades to:
-* - All child groups (recursively)
-* - All members of this group and its descendants
-* - All invites for this group and its descendants
-*/
-const groupDelete = mutation({
-	args: { groupId: v.id("group") },
-	handler: async (ctx, { groupId }) => {
-		const deleteGroup = async (id) => {
-			const children = await ctx.db.query("group").withIndex("parentGroupId", (q) => q.eq("parentGroupId", id)).collect();
-			for (const child of children) await deleteGroup(child._id);
-			const members = await ctx.db.query("member").withIndex("groupId", (q) => q.eq("groupId", id)).collect();
-			for (const member of members) await ctx.db.delete(member._id);
-			const invites = await ctx.db.query("invite").withIndex("groupId", (q) => q.eq("groupId", id)).collect();
-			for (const invite of invites) await ctx.db.delete(invite._id);
-			const tags = await ctx.db.query("groupTag").withIndex("by_group", (q) => q.eq("groupId", id)).collect();
-			for (const tag of tags) await ctx.db.delete(tag._id);
-			await ctx.db.delete(id);
-		};
-		await deleteGroup(groupId);
-	}
-});
-/**
-* Add a user as a member of a group.
-*
-* The `role` field is an application-defined string (e.g. "owner", "admin",
-* "member", "viewer"). The auth component stores it but does not enforce
-* access control — your application defines what each role means.
-*
-* Throws `ConvexError` with code `DUPLICATE_MEMBERSHIP` when the user is
-* already a member of the target group.
-*
-* @returns The ID of the new member record.
-*/
-const memberAdd = mutation({
-	args: {
-		groupId: v.id("group"),
-		userId: v.id("user"),
-		role: v.optional(v.string()),
-		status: v.optional(v.string()),
-		extend: v.optional(v.any())
-	},
-	handler: async (ctx, args) => {
-		const existingMembership = await ctx.db.query("member").withIndex("groupIdAndUserId", (q) => q.eq("groupId", args.groupId).eq("userId", args.userId)).unique();
-		if (existingMembership !== null) throw new ConvexError({
-			code: "DUPLICATE_MEMBERSHIP",
-			message: "User is already a member of this group",
-			groupId: args.groupId,
-			userId: args.userId,
-			existingMemberId: existingMembership._id
-		});
-		return await ctx.db.insert("member", args);
-	}
-});
-/** Retrieve a member record by its document ID. Returns `null` if not found. */
-const memberGet = query({
-	args: { memberId: v.id("member") },
-	handler: async (ctx, { memberId }) => {
-		return await ctx.db.get(memberId);
-	}
-});
-/**
-* List members with optional filtering, sorting, and pagination.
-*
-* Returns `{ items, nextCursor }`. Supports filtering by `groupId`,
-* `userId`, `role`, and `status`.
-*/
-const memberList = query({
-	args: {
-		where: v.optional(v.object({
-			groupId: v.optional(v.id("group")),
-			userId: v.optional(v.id("user")),
-			role: v.optional(v.string()),
-			status: v.optional(v.string())
-		})),
-		limit: v.optional(v.number()),
-		cursor: v.optional(v.union(v.string(), v.null())),
-		orderBy: v.optional(v.union(v.literal("_creationTime"), v.literal("role"), v.literal("status"))),
-		order: v.optional(v.union(v.literal("asc"), v.literal("desc")))
-	},
-	handler: async (ctx, args) => {
-		const where = args.where ?? {};
-		const limit = Math.min(Math.max(args.limit ?? 50, 1), 100);
-		const order = args.order ?? "desc";
-		let q;
-		if (where.groupId !== void 0 && where.userId !== void 0) q = ctx.db.query("member").withIndex("groupIdAndUserId", (idx) => idx.eq("groupId", where.groupId).eq("userId", where.userId));
-		else if (where.groupId !== void 0) q = ctx.db.query("member").withIndex("groupId", (idx) => idx.eq("groupId", where.groupId));
-		else if (where.userId !== void 0) q = ctx.db.query("member").withIndex("userId", (idx) => idx.eq("userId", where.userId));
-		else q = ctx.db.query("member");
-		if (where.role !== void 0) q = q.filter((f) => f.eq(f.field("role"), where.role));
-		if (where.status !== void 0) q = q.filter((f) => f.eq(f.field("status"), where.status));
-		q = q.order(order);
-		const all = await q.collect();
-		let startIdx = 0;
-		if (args.cursor) {
-			const cursorIdx = all.findIndex((doc) => doc._id === args.cursor);
-			if (cursorIdx !== -1) startIdx = cursorIdx + 1;
-		}
-		const page = all.slice(startIdx, startIdx + limit + 1);
-		const hasMore = page.length > limit;
-		const items = hasMore ? page.slice(0, limit) : page;
-		return {
-			items,
-			nextCursor: hasMore ? items[items.length - 1]._id : null
-		};
-	}
-});
-/**
-* @deprecated Use `memberList` with `where: { userId }` instead.
-* Kept for backward compatibility with generated component types.
-*/
-const memberListByUser = query({
-	args: { userId: v.id("user") },
-	handler: async (ctx, { userId }) => {
-		return await ctx.db.query("member").withIndex("userId", (q) => q.eq("userId", userId)).collect();
-	}
-});
-/**
-* Look up a specific user's membership in a specific group.
-* Returns `null` if the user is not a member of the group.
-*/
-const memberGetByGroupAndUser = query({
-	args: {
-		groupId: v.id("group"),
-		userId: v.id("user")
-	},
-	handler: async (ctx, { groupId, userId }) => {
-		return await ctx.db.query("member").withIndex("groupIdAndUserId", (q) => q.eq("groupId", groupId).eq("userId", userId)).unique();
-	}
-});
-/** Remove a member from a group by deleting the member record. */
-const memberRemove = mutation({
-	args: { memberId: v.id("member") },
-	handler: async (ctx, { memberId }) => {
-		await ctx.db.delete(memberId);
-	}
-});
-/**
-* Update a member record's fields (role, status, extend).
-*
-* Common usage: `memberUpdate({ memberId, data: { role: "admin" } })`
-*/
-const memberUpdate = mutation({
-	args: {
-		memberId: v.id("member"),
-		data: v.any()
-	},
-	handler: async (ctx, { memberId, data }) => {
-		await ctx.db.patch(memberId, data);
-	}
-});
-/**
-* Create a new platform-level invitation. Optionally set `groupId` to tie
-* the invite to a specific group. The invitation is sent to an email address
-* and includes a hashed token for secure acceptance.
-*
-* Throws `ConvexError` with code `DUPLICATE_INVITE` when a pending invite
-* already exists for the same email and scope:
-* - group invite: same `email` + same `groupId`
-* - platform invite: same `email` with no `groupId`
-*
-* @returns The ID of the new invite record.
-*/
-const inviteCreate = mutation({
-	args: {
-		groupId: v.optional(v.id("group")),
-		invitedByUserId: v.optional(v.id("user")),
-		email: v.optional(v.string()),
-		tokenHash: v.string(),
-		role: v.optional(v.string()),
-		status: v.union(v.literal("pending"), v.literal("accepted"), v.literal("revoked"), v.literal("expired")),
-		expiresTime: v.optional(v.number()),
-		extend: v.optional(v.any())
-	},
-	handler: async (ctx, args) => {
-		if (args.email !== void 0) if (args.groupId !== void 0) {
-			const existingGroupInvite = await ctx.db.query("invite").withIndex("groupIdAndStatus", (q) => q.eq("groupId", args.groupId).eq("status", "pending")).filter((q) => q.eq(q.field("email"), args.email)).first();
-			if (existingGroupInvite !== null) throw new ConvexError({
-				code: "DUPLICATE_INVITE",
-				message: "A pending invite already exists for this email in this group",
-				email: args.email,
-				groupId: args.groupId,
-				existingInviteId: existingGroupInvite._id
-			});
-		} else {
-			const existingPlatformInvite = await ctx.db.query("invite").withIndex("emailAndStatus", (q) => q.eq("email", args.email).eq("status", "pending")).filter((q) => q.eq(q.field("groupId"), void 0)).first();
-			if (existingPlatformInvite !== null) throw new ConvexError({
-				code: "DUPLICATE_INVITE",
-				message: "A pending platform invite already exists for this email",
-				email: args.email,
-				existingInviteId: existingPlatformInvite._id
-			});
-		}
-		return await ctx.db.insert("invite", args);
-	}
-});
-/** Retrieve an invite by its document ID. Returns `null` if not found. */
-const inviteGet = query({
-	args: { inviteId: v.id("invite") },
-	handler: async (ctx, { inviteId }) => {
-		return await ctx.db.get(inviteId);
-	}
-});
-/**
-* List invites with optional filtering, sorting, and pagination.
-*
-* Returns `{ items, nextCursor }`. Supports filtering by `groupId`,
-* `status`, `email`, `invitedByUserId`, `role`, `acceptedByUserId`, and `tokenHash`.
-*/
-const inviteList = query({
-	args: {
-		where: v.optional(v.object({
-			tokenHash: v.optional(v.string()),
-			groupId: v.optional(v.id("group")),
-			status: v.optional(v.union(v.literal("pending"), v.literal("accepted"), v.literal("revoked"), v.literal("expired"))),
-			email: v.optional(v.string()),
-			invitedByUserId: v.optional(v.id("user")),
-			role: v.optional(v.string()),
-			acceptedByUserId: v.optional(v.id("user"))
-		})),
-		limit: v.optional(v.number()),
-		cursor: v.optional(v.union(v.string(), v.null())),
-		orderBy: v.optional(v.union(v.literal("_creationTime"), v.literal("status"), v.literal("email"), v.literal("expiresTime"), v.literal("acceptedTime"))),
-		order: v.optional(v.union(v.literal("asc"), v.literal("desc")))
-	},
-	handler: async (ctx, args) => {
-		const where = args.where ?? {};
-		const limit = Math.min(Math.max(args.limit ?? 50, 1), 100);
-		const order = args.order ?? "desc";
-		let q;
-		if (where.tokenHash !== void 0) q = ctx.db.query("invite").withIndex("tokenHash", (idx) => idx.eq("tokenHash", where.tokenHash));
-		else if (where.role !== void 0 && where.status !== void 0 && where.acceptedByUserId !== void 0) q = ctx.db.query("invite").withIndex("roleAndStatusAndAcceptedByUserId", (idx) => idx.eq("role", where.role).eq("status", where.status).eq("acceptedByUserId", where.acceptedByUserId));
-		else if (where.groupId !== void 0 && where.status !== void 0) q = ctx.db.query("invite").withIndex("groupIdAndStatus", (idx) => idx.eq("groupId", where.groupId).eq("status", where.status));
-		else if (where.email !== void 0 && where.status !== void 0) q = ctx.db.query("invite").withIndex("emailAndStatus", (idx) => idx.eq("email", where.email).eq("status", where.status));
-		else if (where.invitedByUserId !== void 0 && where.status !== void 0) q = ctx.db.query("invite").withIndex("invitedByUserIdAndStatus", (idx) => idx.eq("invitedByUserId", where.invitedByUserId).eq("status", where.status));
-		else if (where.groupId !== void 0) q = ctx.db.query("invite").withIndex("groupId", (idx) => idx.eq("groupId", where.groupId));
-		else if (where.status !== void 0) q = ctx.db.query("invite").withIndex("status", (idx) => idx.eq("status", where.status));
-		else q = ctx.db.query("invite");
-		if (where.groupId !== void 0) q = q.filter((f) => f.eq(f.field("groupId"), where.groupId));
-		if (where.status !== void 0) q = q.filter((f) => f.eq(f.field("status"), where.status));
-		if (where.email !== void 0) q = q.filter((f) => f.eq(f.field("email"), where.email));
-		if (where.invitedByUserId !== void 0) q = q.filter((f) => f.eq(f.field("invitedByUserId"), where.invitedByUserId));
-		if (where.role !== void 0) q = q.filter((f) => f.eq(f.field("role"), where.role));
-		if (where.acceptedByUserId !== void 0) q = q.filter((f) => f.eq(f.field("acceptedByUserId"), where.acceptedByUserId));
-		if (where.tokenHash !== void 0) q = q.filter((f) => f.eq(f.field("tokenHash"), where.tokenHash));
-		q = q.order(order);
-		const all = await q.collect();
-		let startIdx = 0;
-		if (args.cursor) {
-			const cursorIdx = all.findIndex((doc) => doc._id === args.cursor);
-			if (cursorIdx !== -1) startIdx = cursorIdx + 1;
-		}
-		const page = all.slice(startIdx, startIdx + limit + 1);
-		const hasMore = page.length > limit;
-		const items = hasMore ? page.slice(0, limit) : page;
-		return {
-			items,
-			nextCursor: hasMore ? items[items.length - 1]._id : null
-		};
-	}
-});
-/**
-* Accept a pending invitation.
-*
-* Marks the invite as "accepted" and records the acceptance timestamp.
-* Throws a structured `ConvexError` when the invite doesn't exist or is not
-* currently pending.
-*
-* The caller is responsible for creating the corresponding member record.
-*/
-const inviteAccept = mutation({
-	args: {
-		inviteId: v.id("invite"),
-		acceptedByUserId: v.optional(v.id("user"))
-	},
-	handler: async (ctx, { inviteId, acceptedByUserId }) => {
-		const invite = await ctx.db.get(inviteId);
-		if (invite === null) throw new ConvexError({
-			code: "INVITE_NOT_FOUND",
-			message: "Invite not found",
-			inviteId
-		});
-		if (invite.status !== "pending") throw new ConvexError({
-			code: "INVITE_NOT_PENDING",
-			message: `Cannot accept invite with status "${invite.status}"`,
-			inviteId,
-			currentStatus: invite.status
-		});
-		await ctx.db.patch(inviteId, {
-			status: "accepted",
-			acceptedTime: Date.now(),
-			...acceptedByUserId ? { acceptedByUserId } : {}
-		});
-	}
-});
-/**
-* Revoke a pending invitation.
-*
-* Marks the invite as "revoked". Throws a structured `ConvexError` when the
-* invite doesn't exist or is not currently pending.
-*/
-const inviteRevoke = mutation({
-	args: { inviteId: v.id("invite") },
-	handler: async (ctx, { inviteId }) => {
-		const invite = await ctx.db.get(inviteId);
-		if (invite === null) throw new ConvexError({
-			code: "INVITE_NOT_FOUND",
-			message: "Invite not found",
-			inviteId
-		});
-		if (invite.status !== "pending") throw new ConvexError({
-			code: "INVITE_NOT_PENDING",
-			message: `Cannot revoke invite with status "${invite.status}"`,
-			inviteId,
-			currentStatus: invite.status
-		});
-		await ctx.db.patch(inviteId, { status: "revoked" });
-	}
-});
-/**
-* Insert a new API key record.
-*
-* The caller is responsible for hashing the raw key before passing it here —
-* this function only stores the hash and metadata.
-*/
-const keyInsert = mutation({
-	args: {
-		userId: v.id("user"),
-		prefix: v.string(),
-		hashedKey: v.string(),
-		name: v.string(),
-		scopes: v.array(v.object({
-			resource: v.string(),
-			actions: v.array(v.string())
-		})),
-		rateLimit: v.optional(v.object({
-			maxRequests: v.number(),
-			windowMs: v.number()
-		})),
-		expiresAt: v.optional(v.number())
-	},
-	handler: async (ctx, args) => {
-		return await ctx.db.insert("key", {
-			...args,
-			createdAt: Date.now(),
-			revoked: false
-		});
-	}
-});
-/**
-* Look up an API key by its SHA-256 hash.
-*
-* Used during Bearer token verification. Returns the full key record
-* (including rate limit state) or `null` if not found.
-*/
-const keyGetByHashedKey = query({
-	args: { hashedKey: v.string() },
-	handler: async (ctx, { hashedKey }) => {
-		return await ctx.db.query("key").withIndex("hashedKey", (q) => q.eq("hashedKey", hashedKey)).first();
-	}
-});
-/**
-* @deprecated Use `keyList` with `where: { userId }` instead.
-* Kept for backward compatibility with generated component types.
-*/
-const keyListByUserId = query({
-	args: { userId: v.id("user") },
-	handler: async (ctx, { userId }) => {
-		return await ctx.db.query("key").withIndex("userId", (q) => q.eq("userId", userId)).collect();
-	}
-});
-/**
-* List API keys with optional filtering, sorting, and pagination.
-*
-* Returns `{ items, nextCursor }`. Supports filtering by `userId`,
-* `revoked`, `name`, and `prefix`.
-*/
-const keyList = query({
-	args: {
-		where: v.optional(v.object({
-			userId: v.optional(v.id("user")),
-			revoked: v.optional(v.boolean()),
-			name: v.optional(v.string()),
-			prefix: v.optional(v.string())
-		})),
-		limit: v.optional(v.number()),
-		cursor: v.optional(v.union(v.string(), v.null())),
-		orderBy: v.optional(v.union(v.literal("_creationTime"), v.literal("name"), v.literal("lastUsedAt"), v.literal("expiresAt"), v.literal("revoked"))),
-		order: v.optional(v.union(v.literal("asc"), v.literal("desc")))
-	},
-	handler: async (ctx, args) => {
-		const where = args.where ?? {};
-		const limit = Math.min(Math.max(args.limit ?? 50, 1), 100);
-		const order = args.order ?? "desc";
-		let q;
-		if (where.userId !== void 0) q = ctx.db.query("key").withIndex("userId", (idx) => idx.eq("userId", where.userId));
-		else q = ctx.db.query("key");
-		if (where.revoked !== void 0) q = q.filter((f) => f.eq(f.field("revoked"), where.revoked));
-		if (where.name !== void 0) q = q.filter((f) => f.eq(f.field("name"), where.name));
-		if (where.prefix !== void 0) q = q.filter((f) => f.eq(f.field("prefix"), where.prefix));
-		q = q.order(order);
-		const all = await q.collect();
-		let startIdx = 0;
-		if (args.cursor) {
-			const cursorIdx = all.findIndex((doc) => doc._id === args.cursor);
-			if (cursorIdx !== -1) startIdx = cursorIdx + 1;
-		}
-		const page = all.slice(startIdx, startIdx + limit + 1);
-		const hasMore = page.length > limit;
-		const items = hasMore ? page.slice(0, limit) : page;
-		return {
-			items,
-			nextCursor: hasMore ? items[items.length - 1]._id : null
-		};
-	}
-});
-/** Get a single API key by document ID. */
-const keyGetById = query({
-	args: { keyId: v.id("key") },
-	handler: async (ctx, { keyId }) => {
-		return await ctx.db.get(keyId);
-	}
-});
-/**
-* Patch an API key record. Used for updating name, scopes, rate limit config,
-* revocation, and lastUsedAt / rate limit state tracking.
-*/
-const keyPatch = mutation({
-	args: {
-		keyId: v.id("key"),
-		data: v.object({
-			name: v.optional(v.string()),
-			scopes: v.optional(v.array(v.object({
-				resource: v.string(),
-				actions: v.array(v.string())
-			}))),
-			rateLimit: v.optional(v.object({
-				maxRequests: v.number(),
-				windowMs: v.number()
-			})),
-			rateLimitState: v.optional(v.object({
-				attemptsLeft: v.number(),
-				lastAttemptTime: v.number()
-			})),
-			revoked: v.optional(v.boolean()),
-			lastUsedAt: v.optional(v.number())
-		})
-	},
-	handler: async (ctx, { keyId, data }) => {
-		if (await ctx.db.get(keyId) === null) throw new ConvexError({
-			code: "KEY_NOT_FOUND",
-			message: "API key not found",
-			keyId
-		});
-		await ctx.db.patch(keyId, data);
-	}
-});
-/** Hard delete an API key record. */
-const keyDelete = mutation({
-	args: { keyId: v.id("key") },
-	handler: async (ctx, { keyId }) => {
-		if (await ctx.db.get(keyId) === null) throw new ConvexError({
-			code: "KEY_NOT_FOUND",
-			message: "API key not found",
-			keyId
-		});
-		await ctx.db.delete(keyId);
-	}
-});
-/** Insert a new device authorization record. */
-const deviceInsert = mutation({
-	args: {
-		deviceCodeHash: v.string(),
-		userCode: v.string(),
-		expiresAt: v.number(),
-		interval: v.number(),
-		status: v.union(v.literal("pending"), v.literal("authorized"), v.literal("denied"))
-	},
-	handler: async (ctx, args) => {
-		return await ctx.db.insert("device", args);
-	}
-});
-/** Look up a device authorization by its hashed device code. */
-const deviceGetByCodeHash = query({
-	args: { deviceCodeHash: v.string() },
-	handler: async (ctx, { deviceCodeHash }) => {
-		return await ctx.db.query("device").withIndex("deviceCodeHash", (q) => q.eq("deviceCodeHash", deviceCodeHash)).first();
-	}
-});
-/** Look up a pending device authorization by its user code. */
-const deviceGetByUserCode = query({
-	args: { userCode: v.string() },
-	handler: async (ctx, { userCode }) => {
-		return await ctx.db.query("device").withIndex("userCode", (q) => q.eq("userCode", userCode).eq("status", "pending")).first();
-	}
-});
-/** Authorize a device code — link it to a user and session. */
-const deviceAuthorize = mutation({
-	args: {
-		deviceId: v.id("device"),
-		userId: v.id("user"),
-		sessionId: v.id("session")
-	},
-	handler: async (ctx, { deviceId, userId, sessionId }) => {
-		await ctx.db.patch(deviceId, {
-			status: "authorized",
-			userId,
-			sessionId
-		});
-	}
-});
-/** Update the last-polled timestamp on a device authorization record. */
-const deviceUpdateLastPolled = mutation({
-	args: {
-		deviceId: v.id("device"),
-		lastPolledAt: v.number()
-	},
-	handler: async (ctx, { deviceId, lastPolledAt }) => {
-		await ctx.db.patch(deviceId, { lastPolledAt });
-	}
-});
-/** Delete a device authorization record (cleanup after use or expiry). */
-const deviceDelete = mutation({
-	args: { deviceId: v.id("device") },
-	handler: async (ctx, { deviceId }) => {
-		await ctx.db.delete(deviceId);
-	}
-});
-
-//#endregion
-export { accountDelete, accountGet, accountGetById, accountInsert, accountListByUser, accountPatch, deviceAuthorize, deviceDelete, deviceGetByCodeHash, deviceGetByUserCode, deviceInsert, deviceUpdateLastPolled, groupCreate, groupDelete, groupGet, groupList, groupUpdate, inviteAccept, inviteCreate, inviteGet, inviteList, inviteRevoke, keyDelete, keyGetByHashedKey, keyGetById, keyInsert, keyList, keyListByUserId, keyPatch, memberAdd, memberGet, memberGetByGroupAndUser, memberList, memberListByUser, memberRemove, memberUpdate, passkeyDelete, passkeyGetByCredentialId, passkeyInsert, passkeyListByUserId, passkeyUpdateCounter, passkeyUpdateMeta, rateLimitCreate, rateLimitDelete, rateLimitGet, rateLimitPatch, refreshTokenCreate, refreshTokenDeleteAll, refreshTokenGetActive, refreshTokenGetById, refreshTokenGetChildren, refreshTokenListBySession, refreshTokenPatch, sessionCreate, sessionDelete, sessionGetById, sessionList, sessionListByUser, totpDelete, totpGetById, totpGetVerifiedByUserId, totpInsert, totpListByUserId, totpMarkVerified, totpUpdateLastUsed, userFindByVerifiedEmail, userFindByVerifiedPhone, userGetById, userInsert, userList, userPatch, userUpsert, verificationCodeCreate, verificationCodeDelete, verificationCodeGetByAccountId, verificationCodeGetByCode, verifierCreate, verifierDelete, verifierGetById, verifierGetBySignature, verifierPatch };
-//# sourceMappingURL=public.js.map
+export { accountDelete, accountGet, accountGetById, accountInsert, accountListByUser, accountPatch, deviceAuthorize, deviceDelete, deviceGetByCodeHash, deviceGetByUserCode, deviceInsert, deviceUpdateLastPolled, enterpriseAuditEventCreate, enterpriseAuditEventList, enterpriseCreate, enterpriseDelete, enterpriseDomainAdd, enterpriseDomainDelete, enterpriseDomainList, enterpriseDomainVerificationDelete, enterpriseDomainVerificationGet, enterpriseDomainVerificationUpsert, enterpriseDomainVerify, enterpriseGet, enterpriseGetByDomain, enterpriseGetByGroup, enterpriseList, enterpriseScimConfigGetByEnterprise, enterpriseScimConfigGetByTokenHash, enterpriseScimConfigUpsert, enterpriseScimIdentityDelete, enterpriseScimIdentityGet, enterpriseScimIdentityGetByEnterpriseAndUser, enterpriseScimIdentityGetByMappedGroup, enterpriseScimIdentityGetByUser, enterpriseScimIdentityListByEnterprise, enterpriseScimIdentityUpsert, enterpriseSecretDelete, enterpriseSecretGet, enterpriseSecretUpsert, enterpriseUpdate, enterpriseWebhookDeliveryEnqueue, enterpriseWebhookDeliveryList, enterpriseWebhookDeliveryListReady, enterpriseWebhookDeliveryPatch, enterpriseWebhookEndpointCreate, enterpriseWebhookEndpointGet, enterpriseWebhookEndpointList, enterpriseWebhookEndpointUpdate, groupCreate, groupDelete, groupGet, groupList, groupUpdate, inviteAccept, inviteAcceptByToken, inviteCreate, inviteGet, inviteGetByTokenHash, inviteList, inviteRevoke, keyDelete, keyGetByHashedKey, keyGetById, keyInsert, keyList, keyPatch, memberAdd, memberGet, memberGetByGroupAndUser, memberList, memberRemove, memberResolve, memberUpdate, passkeyDelete, passkeyGetByCredentialId, passkeyInsert, passkeyListByUserId, passkeyUpdateCounter, passkeyUpdateMeta, rateLimitCreate, rateLimitDelete, rateLimitGet, rateLimitPatch, refreshTokenCreate, refreshTokenDeleteAll, refreshTokenGetActive, refreshTokenGetById, refreshTokenGetChildren, refreshTokenListBySession, refreshTokenPatch, sessionCreate, sessionDelete, sessionGetById, sessionList, sessionListByUser, totpDelete, totpGetById, totpGetVerifiedByUserId, totpInsert, totpListByUserId, totpMarkVerified, totpUpdateLastUsed, userDelete, userFindByVerifiedEmail, userFindByVerifiedPhone, userGetById, userInsert, userList, userPatch, userUpsert, verificationCodeCreate, verificationCodeDelete, verificationCodeGetByAccountId, verificationCodeGetByCode, verifierCreate, verifierDelete, verifierGetById, verifierGetBySignature, verifierPatch };