@robelest/convex-auth 0.0.4-preview.2 → 0.0.4-preview.21

package/dist/component/server/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","names":[],"sources":["../../../src/server/types.ts"],"mappings":";;;;;;;;KAoBY,SAAA,MAAe,CAAA,GAAI,WAAA,CAAY,CAAA;;;AAA3C;KAKY,gBAAA;EALS;;;;;;EAYnB,SAAA,EAAW,kBAAA;EAZc;;;;;AAK3B;EAcE,SAAA,EAAW,gBAAA;;;;EAIX,OAAA;IA2FQ;;;;;IArFN,eAAA;IA4Ka;;;;;IAtKb,kBAAA;EAAA;EAqNc;;;EAhNhB,GAAA;IAmOc;;;;;IA7NZ,UAAA;EAAA;EAXA;;;EAgBF,MAAA;IAQE;;;;;;;IAAA,uBAAA;EAAA;EAyGM;;;;;;EAjGR,OAAA,GAAU,YAAA;EAyHJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2FR;;;;;;;;;;;EArKE,KAAA,GAAQ,cAAA;EA+Ka;;;;;;;EAvKrB,SAAA;IA+JE;;;;;;;;;;;;;;;;;;;;;AAiBJ;;;;;;;;;;;;;;;IA3II,QAAA,IAAY,MAAA;MAiMT;;;MA7LD,UAAA;IAAA,MACI,OAAA;IAuIR;;;;;;;;;;;IA3HE,kBAAA,IACE,GAAA,EAAK,kBAAA,CAAmB,YAAA,GACxB,IAAA;MA+IS;;;;MA1IP,cAAA,EAAgB,SAAA;MA6IT;;;;MAxIP,IAAA;MA2ID;;;;MAtIC,QAAA,EAAU,8BAAA;MAyJhB;;;;;;;MAjJM,OAAA,EAAS,MAAA;QACP,KAAA;QACA,KAAA;QACA,aAAA;QACA,aAAA;MAAA;MA2JE;;;MAtJJ,UAAA;IAAA,MAEC,OAAA,CAAQ,SAAA;IAsJY;;;;;;;;;;;;;;IAvIzB,yBAAA,IACE,GAAA,EAAK,kBAAA,CAAmB,YAAA,GACxB,IAAA;MA2IW;;;MAvIT,MAAA,EAAQ,SAAA;MAwIuB;;;;MAnI/B,cAAA,EAAgB,SAAA;MAuJjB;;;;MAlJC,IAAA;MAkLK;;;;MA7KL,QAAA,EAAU,8BAAA;MA+KQ;;;;;;;MAvKlB,OAAA,EAAS,MAAA;QACP,KAAA;QACA,KAAA;QACA,aAAA;QACA,aAAA;MAAA;MA6HM;;;MAxHR,UAAA;IAAA,MAEC,OAAA;EAAA;AAAA;;;;;;;;;KAYG,kBAAA,GAAkB,qBAAA,GAE1B,uBAAA,GACA,uBAAA,QACK,IAAA,UAAc,uBAAA,IACnB,WAAA,QACK,IAAA,UAAc,WAAA,IACnB,WAAA,QACK,IAAA,UAAc,WAAA,IACnB,qBAAA,QACK,IAAA,UAAc,qBAAA,IACnB,kBAAA,QACK,IAAA,UAAc,kBAAA,IACnB,oBAAA,QACK,IAAA,UAAc,oBAAA;;;;UAKN,WAAA,mBACG,gBAAA,GAAmB,gBAAA;EA4HrC;EAzHA,EAAA;EAyHyB;EAvHzB,IAAA;EAuHkC;EArHlC,IAAA;EA2HyB;EAzHzB,IAAA;EA0HkB;EAxHlB,MAAA;EAyH2B;;;;;;EAlH3B,uBAAA,GACE,MAAA;IACE,UAAA;IACA,GAAA;IACA,OAAA,EAAS,IAAA;IACT,QAAA,EAAU,WAAA;IACV,KAAA;IACA,OAAA,EAAS,OAAA;EAAA,GAEX,GAAA,GAAM,gBAAA,CAAiB,YAAA,MACpB,SAAA;EAwG+B;AAKtC;;;;EAvGE,yBAAA,SAAkC,SAAA;EAwGlC;;;;EAnGA,mBAAA,IAAuB,UAAA;EA0Ga;;;;;;;EAlGpC,SAAA;EA2GE;;;EAvGA,MAAA,EAAQ,MAAA,SAAe,KAAA,eACvB,OAAA,EAAS,UAAA,CAAW,SAAA,iBACjB,OAAA;EA6GH;EA3GF,OAAA,EAAS,eAAA,CAAgB,SAAA;AAAA;;;AAsH3B;KAhHY,eAAA,mBACQ,gBAAA,GAAmB,gBAAA,IACnC,IAAA,CAAK,OAAA,CAAQ,WAAA,CAAY,SAAA;;;;;UAMZ,WAAA,mBACG,gBAAA,GAAmB,gBAAA;EAErC,EAAA;EACA,IAAA;EA6GE;;;EAzGF,MAAA;EAsH2B;;;EAlH3B,uBAAA,GACE,MAAA;IACE,UAAA;IACA,GAAA;IACA,OAAA,EAAS,IAAA;IACT,QAAA,EAAU,WAAA;IACV,KAAA;EAAA,GAEF,GAAA,EAAK,8BAAA,CAA+B,SAAA,MACjC,OAAA;EAgIK;;;EA5HV,MAAA;EAgIM;AAIR;;;;;;;EA3HE,yBAAA,SAAkC,OAAA;EA8HzB;;;;;EAxHT,mBAAA,IAAuB,UAAA;EA+HvB;;;AAIF;;;;EA3HE,SAAA;EA6HA;;;EAzHE,MAAA,EAAQ,MAAA,SAAe,KAAA,eACvB,OAAA,EAAS,UAAA,CAAW,SAAA,iBACjB,OAAA;EACL,OAAA,EAAS,eAAA,CAAgB,SAAA;AAAA;;;;KAMf,eAAA,mBACQ,gBAAA,GAAmB,gBAAA,IACnC,IAAA,CAAK,OAAA,CAAQ,WAAA,CAAY,SAAA;;;;KAKjB,uBAAA,GAA0B,qBAAA;EACpC,IAAA;EACA,EAAA;AAAA;;;;UAMe,qBAAA;EACf,EAAA;EACA,IAAA;EACA,OAAA;IAiHU,iEA/GR,MAAA,WA+G8B;IA7G9B,IAAA,WA+GsB;IA7GtB,MAAA,sBA6Ga;IA3Gb,WAAA,sBA0GF;IAxGE,gBAAA,6CAyGF;IAvGE,WAAA,6CAuGsB;IArGtB,uBAAA,kCAqG2B;IAnG3B,UAAA,aAuGgC;IArGhC,qBAAA;EAAA;AAAA;;;;UAOa,kBAAA;EACf,EAAA;EACA,IAAA;EACA,OAAA;IAiG2B,+DA/FzB,MAAA,UAmGQ;IAjGR,MAAA,UAmGW;IAjGX,MAAA;EAAA;AAAA;;;;;;UAaa,YAAA;EACf,EAAA;EACA,IAAA;EACA,KAAA;EACA,KAAA;EAiGkC;EAAA,CA/FjC,GAAA;AAAA;;KAiBS,sBAAA;EA0DN,iEAxDJ,EAAA,UAyDI;EAvDJ,MAAA;AAAA;;KAIU,qBAAA;EACV,QAAA;EACA,OAAA,EAAS,sBAAA;EACT,OAAA,EAAS,MAAA;IACP,KAAA;IACA,KAAA;IACA,aAAA;IACA,aAAA;EAAA;EAEF,kBAAA;EACA,kBAAA;AAAA;;KAIU,uBAAA;EACV,QAAA;EACA,OAAA,EAAS,sBAAA;AAAA;;KAIC,qBAAA;EACV,QAAA;EACA,OAAA;IACE,EAAA;IACA,MAAA;EAAA;AAAA;;KAKQ,0BAAA;EACV,MAAA,EAAQ,SAAA;EACR,MAAA,GAAS,SAAA;AAAA;;KAIC,sBAAA;EACV,SAAA,GAAY,SAAA;EACZ,MAAA,GAAS,MAAA,SAAe,KAAA;AAAA;;KAId,wBAAA;EACV,MAAA,EAAQ,SAAA;EACR,SAAA,EAAW,SAAA;AAAA;;KAID,iBAAA;EACV,OAAA;IACE,MAAA,GACE,GAAA,EAAK,gBAAA,OACL,IAAA,EAAM,qBAAA,KACH,OAAA;MACH,OAAA,EAAS,UAAA,CAAW,gBAAA;MACpB,IAAA,EAAM,UAAA,CAAW,gBAAA;IAAA;IAEnB,GAAA,GACE,GAAA,EAAK,gBAAA,OACL,IAAA,EAAM,uBAAA,KACH,OAAA;MACH,OAAA,EAAS,UAAA,CAAW,gBAAA;MACpB,IAAA,EAAM,UAAA,CAAW,gBAAA;IAAA;IAEnB,MAAA,GACE,GAAA,EAAK,gBAAA,OACL,IAAA,EAAM,qBAAA,KACH,OAAA;EAAA;EAEP,OAAA;IACE,OAAA,GACE,GAAA;MAAO,IAAA,EAAM,gBAAA,CAAiB,gBAAA;IAAA,MAC3B,OAAA,CAAQ,SAAA;IACb,UAAA,GACE,GAAA,EAAK,gBAAA,OACL,IAAA,EAAM,0BAAA,KACH,OAAA;EAAA;EAEP,QAAA;IACE,MAAA,GACE,GAAA,EAAK,gBAAA,OACL,QAAA,EAAU,kBAAA,EACV,IAAA,EAAM,sBAAA,KACH,OAAA,CAAQ,wBAAA;EAAA;AAAA;;;;;KAQL,8BAAA,mBAAiD,gBAAA,IAC3D,gBAAA,CAAiB,SAAA;EACf,IAAA,EAAM,gBAAA,CAAiB,SAAA;IACrB,MAAA,EAAQ,4BAAA;EAAA,IACN,iBAAA;AAAA;AASR;;;;;;AAAA,KAAY,4BAAA;EACV,SAAA,EAAW,8BAAA;AAAA,IACT,IAAA,CACF,gBAAA;;;;;;AAUF;UAAiB,uBAAA;EAAA,SACN,EAAA;EAAA,SACA,IAAA;EAM6D;EAAA,SAJ7D,QAAA;EAI4D;EAAA,SAF5D,MAAA;EALA;EAAA,SAOA,OAAA,IAAW,MAAA,EARkB,OAAA,CAQO,YAAA,KAAiB,OAAA,CAAQ,YAAA;EAJ7D;;;;EAAA,SASA,iCAAA;AAAA;;;;;AASX;;UAAiB,oBAAA;EACf,EAAA;EACA,IAAA;EAAA;EAEA,OAAA;EAEA;EAAA,cAAA;EAIA;EAFA,SAAA;EASe;EAPf,QAAA;EAaU;;;;;;EANV,eAAA;AAAA;;;;KAMU,8BAAA,GACR,uBAAA,GACA,WAAA,GACA,WAAA,GACA,uBAAA,GACA,qBAAA,GACA,kBAAA,GACA,oBAAA;;;;UASa,YAAA;EAXb;EAaF,IAAA;EAXE;EAaF,EAAA;EAbsB;EAetB,OAAA;EAN2B;EAQ3B,IAAA;AAAA;;;;;;;UASe,cAAA;EAAc;EAE7B,IAAA;EAoBO;;;;;;;;;;;;;;AAiBT;;;;EAlBE,IAAA,GACE,GAAA,EAAK,gBAAA,OACL,MAAA,EAAQ,YAAA,KACL,OAAA;AAAA;;;;;;;;;UAeU,QAAA;EACf,QAAA;EACA,OAAA;AAAA;;;;;;;;;;;AA0DF;UA5CiB,YAAA;;EAEf,GAAA,CAAI,QAAA,UAAkB,MAAA;EA4CtB;EA1CA,MAAA,EAAQ,QAAA;AAAA;;;;;;;;;;;;;AA6LV;;;;UA1KiB,YAAA;EA4Kf;;;;EAvKA,MAAA,GAAS,MAAA;EA6KC;;;;EAxKV,gBAAA;IAAqB,WAAA;IAAqB,QAAA;EAAA;EAsMpB;;;EAlMtB,MAAA;AAAA;;;;AAyMF;UAlMiB,SAAA;;EAEf,GAAA;EAkMA;EAhMA,MAAA;EAoMA;EAlMA,MAAA;EAkMO;EAhMP,IAAA;EAyM0B;EAvM1B,MAAA,EAAQ,QAAA;EAyMO;EAvMf,SAAA;IAAc,WAAA;IAAqB,QAAA;EAAA;EA4MrB;EA1Md,SAAA;EA4Mc;EA1Md,UAAA;EA4MiB;EA1MjB,SAAA;EA4MiB;EA1MjB,OAAA;AAAA;;KAiIU,SAAA;EACV,KAAA;EACA,KAAA;EACA,WAAA;EACA,IAAA;AAAA;;KAIU,WAAA;;;;;;;;;;;;;;;;;;UAuBK,cAAA;EACf,GAAA;IAyDqB,kDAvDnB,MAAA,UAwDyB;IAtDzB,KAAA,UAuD2B;IArD3B,MAAA,EAAQ,YAAA;EAAA;AAAA;;;;UAOK,UAAA;EAkDI;EAhDnB,MAAA;EAiDkB;EA/ClB,OAAA;EAgDmB;EA9CnB,OAAA;AAAA;;;;;;;KASU,gBAAA;EACV,MAAA;IACE,WAAA,EAAa,iBAAA;IACb,QAAA,EAAU,iBAAA;IACV,uBAAA,EAAyB,iBAAA;IACzB,uBAAA,EAAyB,iBAAA;IACzB,UAAA,EAAY,iBAAA;IACZ,UAAA,EAAY,iBAAA;IACZ,SAAA,EAAW,iBAAA;IACX,UAAA,EAAY,iBAAA;IACZ,cAAA,EAAgB,iBAAA;IAChB,aAAA,EAAe,iBAAA;IACf,YAAA,EAAc,iBAAA;IACd,aAAA,EAAe,iBAAA;IACf,aAAA,EAAe,iBAAA;IACf,cAAA,EAAgB,iBAAA;IAChB,aAAA,EAAe,iBAAA;IACf,iBAAA,EAAmB,iBAAA;IACnB,cAAA,EAAgB,iBAAA;IAChB,eAAA,EAAiB,iBAAA;IACjB,sBAAA,EAAwB,iBAAA;IACxB,aAAA,EAAe,iBAAA;IACf,cAAA,EAAgB,iBAAA;IAChB,8BAAA,EAAgC,iBAAA;IAChC,yBAAA,EAA2B,iBAAA;IAC3B,sBAAA,EAAwB,iBAAA;IACxB,sBAAA,EAAwB,iBAAA;IACxB,kBAAA,EAAoB,iBAAA;IACpB,mBAAA,EAAqB,iBAAA;IACrB,iBAAA,EAAmB,iBAAA;IACnB,uBAAA,EAAyB,iBAAA;IACzB,yBAAA,EAA2B,iBAAA;IAC3B,qBAAA,EAAuB,iBAAA;IACvB,qBAAA,EAAuB,iBAAA;IACvB,YAAA,EAAc,iBAAA;IACd,eAAA,EAAiB,iBAAA;IACjB,cAAA,EAAgB,iBAAA;IAChB,eAAA,EAAiB,iBAAA;IACjB,WAAA,EAAa,iBAAA;IACb,QAAA,EAAU,iBAAA;IACV,SAAA,EAAW,iBAAA;IACX,WAAA,EAAa,iBAAA;IACb,WAAA,EAAa,iBAAA;IACb,SAAA,EAAW,iBAAA;IACX,SAAA,EAAW,iBAAA;IACX,UAAA,EAAY,iBAAA;IACZ,gBAAA,EAAkB,iBAAA;IAClB,uBAAA,EAAyB,iBAAA;IACzB,YAAA,EAAc,iBAAA;IACd,YAAA,EAAc,iBAAA;IACd,YAAA,EAAc,iBAAA;IACd,SAAA,EAAW,iBAAA;IACX,UAAA,EAAY,iBAAA;IACZ,YAAA,EAAc,iBAAA;IACd,YAAA,EAAc,iBAAA;IACd,SAAA,EAAW,iBAAA;IACX,iBAAA,EAAmB,iBAAA;IACnB,UAAA,EAAY,iBAAA;IACZ,OAAA,EAAS,iBAAA;IACT,eAAA,EAAiB,iBAAA;IACjB,QAAA,EAAU,iBAAA;IACV,SAAA,EAAW,iBAAA;IACX,aAAA,EAAe,iBAAA;IACf,wBAAA,EAA0B,iBAAA;IAC1B,mBAAA,EAAqB,iBAAA;IACrB,oBAAA,EAAsB,iBAAA;IACtB,iBAAA,EAAmB,iBAAA;IACnB,aAAA,EAAe,iBAAA;IACf,UAAA,EAAY,iBAAA;IACZ,uBAAA,EAAyB,iBAAA;IACzB,gBAAA,EAAkB,iBAAA;IAClB,WAAA,EAAa,iBAAA;IACb,gBAAA,EAAkB,iBAAA;IAClB,kBAAA,EAAoB,iBAAA;IACpB,UAAA,EAAY,iBAAA;IACZ,YAAA,EAAc,iBAAA;IACd,mBAAA,EAAqB,iBAAA;IACrB,mBAAA,EAAqB,iBAAA;IACrB,eAAA,EAAiB,iBAAA;IACjB,sBAAA,EAAwB,iBAAA;IACxB,YAAA,EAAc,iBAAA;EAAA;AAAA;;;;KAWN,UAAA,mBACQ,gBAAA,oBACA,qBAAA,CAAsB,SAAA,KACtC,cAAA,CAAe,SAAA,EAAW,SAAA;EAC5B,GAAA,EAAK,SAAA,CAAU,SAAA;EACf,aAAA;AAAA;;;;KAMU,2BAAA,WACV,MAAA,SAAe,eAAA,+CACX,iBAAA,UAA2B,UAAA,EAAY,IAAA,EAAM,iBAAA,CAAkB,MAAA,KAC/D,MAAA,SAAe,kBAAA,+CAKb,iBAAA,aAEE,UAAA,EACA,IAAA,EACA,iBAAA,CAAkB,MAAA,KAEpB,MAAA,SAAe,gBAAA,+CAKb,iBAAA,WAEE,UAAA,EACA,IAAA,EACA,iBAAA,CAAkB,MAAA;AAAA,KAIzB,iBAAA,MAAuB,eAAA,CAAgB,OAAA,CAAQ,CAAA;AAAA,KAE/C,eAAA,MAAqB,CAAA,uBAAwB,CAAA"}
+{"version":3,"file":"types.d.ts","names":[],"sources":["../../../src/server/types.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;KAqCY,SAAA,MAAe,CAAA,GAAI,WAAA,CAAY,CAAA;;;;;;AAA3C;;;KAUY,kBAAA;EAV+B,+DAYzC,EAAA,WAZwC;EAcxC,KAAA,WAdoB;EAgBpB,MAAA;AAAA;;;;AANF;;;;;KAiBY,uBAAA;EACV,KAAA,EAAO,MAAA,SAAe,kBAAA;AAAA;;AADxB;;;;;;;;;KAcY,UAAA,wBACa,uBAAA,gBACrB,cAAA;EAAyB,KAAA,uBAA4B,MAAA;AAAA,UAC/C,MAAA;;;;;;;;;;;KAaE,SAAA,wBACa,uBAAA,gBACrB,cAAA;EACF,KAAA,uBAA4B,MAAA;IAAiB,MAAA;EAAA;AAAA,IAE3C,MAAA,OAAa,MAAA;AALjB;;;AAAA,KAWY,gBAAA;EATR;;;;;;EAgBF,SAAA,EAAW,kBAAA;EAjBY;;;;;;EAwBvB,SAAA,EAAW,gBAAA;EApBI;;;EAwBf,OAAA;IAlB0B;;;;;;;IA0BxB,eAAA;IAqHc;;;;;;;IA7Gd,kBAAA;EAAA;EA4Ka;;;EAvKf,GAAA;IAwLe;;;;;;;IAhLb,UAAA;EAAA;EAAA;;;EAKF,MAAA;IAyDE;;;;;;;;;IA/CA,wBAAA;EAAA;EAiFI;;;;;;;EAxEN,SAAA;IAyFM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiFR;;;;;;IApII,QAAA,IAAY,MAAA;MAwIoB;;;MApI9B,UAAA;IAAA,MACI,OAAA;IAyIN;;;;;;;;;;;IA7HA,kBAAA,IACE,GAAA,EAAK,kBAAA,CAAmB,YAAA,GACxB,IAAA;MAuIiB;;;;MAlIf,cAAA,EAAgB,SAAA;MAmIH;;;;MA9Hb,IAAA;MA8Ha;;;;MAzHb,QAAA,EAAU,8BAAA;MA8GT;;;;;;;MAtGD,OAAA,EAAS,MAAA;QACP,KAAA;QACA,KAAA;QACA,aAAA;QACA,aAAA;MAAA;MA0Ga;;;MArGf,UAAA;IAAA,MAEC,OAAA,CAAQ,SAAA;IAsGI;;AAMrB;;;;;AAWA;;;;;AAQA;;IAhHI,yBAAA,IACE,GAAA,EAAK,kBAAA,CAAmB,YAAA,GACxB,IAAA;MA8GmC;;AASzC;MAnHQ,MAAA,EAAQ,SAAA;MAmHyB;;;AAWzC;MAzHQ,cAAA,EAAgB,SAAA;MAyHa;;;AAUrC;MA9HQ,IAAA;MA8HyB;;;;MAzHzB,QAAA,EAAU,8BAAA;MA0IN;;;;;;;MAlIJ,OAAA,EAAS,MAAA;QACP,KAAA;QACA,KAAA;QACA,aAAA;QACA,aAAA;MAAA;MAuHJ;;;MAlHE,UAAA;IAAA,MAEC,OAAA;EAAA;EAsHL;;;EAjHF,aAAA;IACE,KAAA,EAAO,MAAA;MAGH,KAAA;MACA,MAAA;IAAA;EAAA;AAAA;;;;;;;;;KAcI,kBAAA,GAAkB,qBAAA,GACwB,QAAA,GACV,OAAA,GACF,IAAA,GACN,SAAA,GACU,MAAA,GACN,GAAA,GACN,KAAA,GACI,KAAA,GAElC,uBAAA,GACA,uBAAA,QACK,IAAA,UAAc,uBAAA,IACnB,WAAA,QACK,IAAA,UAAc,WAAA,IACnB,WAAA,QACK,IAAA,UAAc,WAAA,IACnB,qBAAA,QACK,IAAA,UAAc,qBAAA,IACnB,kBAAA,QACK,IAAA,UAAc,kBAAA,IACnB,oBAAA,QACK,IAAA,UAAc,oBAAA,IACnB,iBAAA;;;;;UAMa,iBAAA;EACf,EAAA;EACA,IAAA;AAAA;;;;;;;KASU,8BAAA;;;;;;AA8FZ;KAtFY,6BAAA;;;;;;;;KASA,6BAAA;;;;;;;KAWA,yBAAA;;;;;;;;;UAUK,gBAAA;EACf,OAAA;EACA,QAAA;IACE,cAAA;MACE,IAAA,EAAM,8BAAA;MACN,IAAA,EAAM,8BAAA;IAAA;EAAA;EAGV,YAAA;IACE,SAAA;MACE,IAAA,EAAM,6BAAA;IAAA;IAER,GAAA;MACE,IAAA,EAAM,6BAAA;MACN,cAAA;IAAA;IAEF,WAAA;MACE,IAAA,EAAM,yBAAA;IAAA;EAAA;EAGV,MAAA,GAAS,MAAA;AAAA;;;;;;;UASM,qBAAA;EACf,QAAA;IACE,cAAA;MACE,IAAA,GAAO,8BAAA;MACP,IAAA,GAAO,8BAAA;IAAA;EAAA;EAGX,YAAA;IACE,SAAA;MACE,IAAA,GAAO,6BAAA;IAAA;IAET,GAAA;MACE,IAAA,GAAO,6BAAA;MACP,cAAA;IAAA;IAEF,WAAA;MACE,IAAA,GAAO,yBAAA;IAAA;EAAA;EAGX,MAAA,GAAS,MAAA;AAAA;;;;;;UAQM,WAAA,mBACG,gBAAA,GAAmB,gBAAA;EAuED;EApEpC,EAAA;EA4E0B;EA1E1B,IAAA;EA2EkB;EAzElB,IAAA;EAwFa;EAtFb,IAAA;EA0FsC;;;;;EApFtC,MAAA;EAqHsB;;;;;;EA9GtB,uBAAA,GACE,MAAA;IACE,UAAA;IACA,GAAA;IACA,OAAA,EAAS,IAAA;IACT,QAAA,EAAU,WAAA;IACV,KAAA;IACA,OAAA,EAAS,OAAA;EAAA,GAEX,GAAA,GAAM,gBAAA,CAAiB,YAAA,MACpB,SAAA;EA6DD;;;;;EAvDJ,yBAAA,SAAkC,SAAA;EA2D9B;;;;EAtDJ,mBAAA,IAAuB,UAAA;EAyDlB;;;;;;;EAjDL,SAAA;EAgFyB;;;EA5EvB,MAAA,EAAQ,MAAA,SAAe,KAAA,eACvB,OAAA,EAAS,UAAA,CAAW,SAAA,iBACjB,OAAA;EA2EH;EAzEF,OAAA,EAAS,eAAA,CAAgB,SAAA;AAAA;;;;;AAqF3B;;;KA3EY,eAAA,mBACQ,gBAAA,GAAmB,gBAAA,IACnC,IAAA,CAAK,OAAA,CAAQ,WAAA,CAAY,SAAA;;;;;;;UAQZ,WAAA,mBACG,gBAAA,GAAmB,gBAAA;EAErC,EAAA;EACA,IAAA;EA8DqC;;;EA1DrC,MAAA;EA2D2B;;;EAvD3B,uBAAA,GACE,MAAA;IACE,UAAA;IACA,GAAA;IACA,OAAA,EAAS,IAAA;IACT,QAAA,EAAU,WAAA;IACV,KAAA;EAAA,GAEF,GAAA,EAAK,8BAAA,CAA+B,SAAA,MACjC,OAAA;EAqDH;;AAMJ;EAvDE,MAAA;;;;;;;;;EASA,yBAAA,SAAkC,OAAA;EAmEhC;;;;;EA7DF,mBAAA,IAAuB,UAAA;EAiFA;AAOzB;;;;;;EAhFE,SAAA;EAqFE;;;EAjFA,MAAA,EAAQ,MAAA,SAAe,KAAA,eACvB,OAAA,EAAS,UAAA,CAAW,SAAA,iBACjB,OAAA;EACL,OAAA,EAAS,eAAA,CAAgB,SAAA;AAAA;;;;;;;;KAUf,eAAA,mBACQ,gBAAA,GAAmB,gBAAA,IACnC,IAAA,CAAK,OAAA,CAAQ,WAAA,CAAY,SAAA;;;AAoH7B;KA/GY,uBAAA,GAA0B,iBAAA;EACpC,IAAA;EACA,EAAA;AAAA;AAqHF;;;AAAA,UA/GiB,qBAAA;EACf,EAAA;EACA,IAAA;EACA,OAAA;IA+GA,iEA7GE,MAAA,WA8GA;IA5GA,IAAA,WA8GA;IA5GA,MAAA;IA+GF;;;;AAKF;IA9GI,WAAA;IAgHO;;;;;IA1GP,gBAAA;IA0G6B;AAIjC;;;;IAxGI,WAAA,6CA0GF;IAxGE,uBAAA;IA0GA;;;AAKJ;;IAzGI,UAAA;IA2GgB;;;;;IArGhB,qBAAA;EAAA;AAAA;;;;UAOa,kBAAA;EACf,EAAA;EACA,IAAA;EACA,OAAA;IAgGA,+DA9FE,MAAA;IA+FF;;;;;IAzFE,MAAA;IA6FgC;;;;;IAvFhC,MAAA;EAAA;AAAA;;AA6FJ;;;;UAhFiB,YAAA;EACf,EAAA;EACA,IAAA;EACA,KAAA;EACA,KAAA;EAgFA;EAAA,CA9EC,GAAA;AAAA;;KAmBS,sBAAA;EAiEA,iEA/DV,EAAA;EAEA,MAAA;AAAA;;KAIU,qBAAA;EACV,QAAA;EACA,OAAA,EAAS,sBAAA;EACT,OAAA,EAAS,MAAA;IACP,KAAA;IACA,KAAA;IACA,aAAA;IACA,aAAA;EAAA;EAEF,kBAAA;EACA,kBAAA;AAAA;;KAIU,uBAAA;EACV,QAAA;EACA,OAAA,EAAS,sBAAA;AAAA;;KAIC,qBAAA;EACV,QAAA;EACA,OAAA;IACE,EAAA;IACA,MAAA;EAAA;AAAA;;KAKQ,0BAAA;EACV,MAAA,EAAQ,SAAA;EACR,MAAA,GAAS,SAAA;AAAA;;KAIC,sBAAA;EACV,SAAA,GAAY,SAAA;EACZ,MAAA,GAAS,MAAA,SAAe,KAAA;AAAA;;KAId,wBAAA;EACV,MAAA,EAAQ,SAAA;EACR,SAAA,EAAW,SAAA;AAAA;;KAID,qBAAA;EACV,MAAA,EAAQ,SAAA;EACR,OAAA,EAAS,SAAA;EACT,QAAA;EACA,OAAA;EACA,MAAA;EACA,QAAA;AAAA;;KAIU,uBAAA;EACV,EAAA;EACA,UAAA,EAAY,UAAA,CAAW,gBAAA;EACvB,cAAA,EAAgB,SAAA;EAChB,OAAA;EACA,MAAA;EACA,aAAA;EACA,KAAA;EACA,QAAA;EACA,WAAA;EACA,iBAAA,EAAmB,SAAA;EACnB,IAAA;EACA,cAAA;AAAA;;;;;;;;;;;;;;;;;;;KAqBU,iBAAA;EAeG,iFAbb,OAAA;IACE,MAAA,GACE,GAAA,EAAK,gBAAA,OACL,IAAA,EAAM,qBAAA,KACH,OAAA;MACH,EAAA;MACA,OAAA,EAAS,UAAA,CAAW,gBAAA;MACpB,IAAA,EAAM,UAAA,CAAW,gBAAA;IAAA;IAEnB,GAAA,GACE,GAAA,EAAK,gBAAA,OACL,IAAA,EAAM,uBAAA,KACH,OAAA;MACH,OAAA,EAAS,UAAA,CAAW,gBAAA;MACpB,IAAA,EAAM,UAAA,CAAW,gBAAA;IAAA;IAEnB,MAAA,GACE,GAAA,EAAK,gBAAA,OACL,IAAA,EAAM,qBAAA,KACH,OAAA;MAAU,EAAA;MAAU,SAAA,EAAW,SAAA;IAAA;EAAA;EAEtC,OAAA;IACE,OAAA,GAAU,GAAA;MACR,IAAA,EAAM,gBAAA,CAAiB,gBAAA;IAAA,MACnB,OAAA,CAAQ,SAAA;IACd,UAAA,GACE,GAAA,EAAK,gBAAA,OACL,IAAA,EAAM,0BAAA,KACH,OAAA;MACH,EAAA;MACA,MAAA,EAAQ,SAAA;MACR,MAAA,EAAQ,SAAA;IAAA;EAAA;EAGZ,MAAA;IACE,OAAA,GACE,GAAA,EAAK,gBAAA,OACL,IAAA,EAAM,qBAAA,KACH,OAAA,CAAQ,uBAAA;EAAA;EAEf,QAAA;IACE,MAAA,GACE,GAAA,EAAK,gBAAA,OACL,QAAA,EAAU,kBAAA,EACV,IAAA,EAAM,sBAAA,KACH,OAAA,CAAQ,wBAAA;EAAA;AAAA;;;;;;;KAUL,8BAAA,mBAAiD,gBAAA,IAC3D,gBAAA,CAAiB,SAAA;EACf,IAAA,EAAM,gBAAA,CAAiB,SAAA;IACrB,MAAA,EAAQ,4BAAA;EAAA,IACN,iBAAA;AAAA;;;;;;;KASI,4BAAA;EACV,SAAA,EAAW,8BAAA;AAAA,IACT,IAAA,CACF,gBAAA;;;;;;;UA6Be,uBAAA;EAhCuB;;;;EAAA,SAqC7B,EAAA;EAnCH;;;;EAAA,SAwCG,IAAA;EAvCT;;;AA6BF;EA7BE,SA4CS,QAAA;;;;;WAKA,MAAA;EAOG;;;;EAAA,SAFH,OAAA,IACP,MAAA,EA1BoC,OAAA,CA0BX,YAAA,KACtB,OAAA,CAAQ,YAAA;EAFJ;;;;EAAA,SAOA,cAAA;AAAA;;;AASX;;;;UAAiB,oBAAA;EACf,EAAA;EACA,IAAA;EAIA;EAFA,OAAA;EAMA;EAJA,cAAA;EAWe;EATf,SAAA;EAeU;EAbV,QAAA;;;;;;;EAOA,eAAA;AAAA;;;;KAMU,8BAAA,GACR,uBAAA,GACA,WAAA,GACA,WAAA,GACA,uBAAA,GACA,qBAAA,GACA,kBAAA,GACA,oBAAA,GACA,iBAAA;;;;;;;KAQQ,MAAA,WAAiB,kBAAA,MAAkB,GAAA,SACN,CAAA;;;;;;;;;UAuBxB,QAAA;EACf,QAAA;EACA,OAAA;AAAA;;AAFF;;;;;AAgBA;;;;;UAAiB,YAAA;EAEO;EAAtB,GAAA,CAAI,QAAA,UAAkB,MAAA;EAEd;EAAR,MAAA,EAAQ,QAAA;AAAA;AAOV;;;;AAAA,UAAiB,SAAA;EAIf;EAFA,GAAA;EAMA;EAJA,MAAA;EAMQ;EAJR,MAAA;EAMc;EAJd,IAAA;EAMA;EAJA,MAAA,EAAQ,QAAA;EAQR;EANA,SAAA;IAAc,WAAA;IAAqB,QAAA;EAAA;EAUlB;EARjB,SAAA;EA6K6B;EA3K7B,UAAA;EAkLsB;EAhLtB,SAAA;EA4KE;EA1KF,OAAA;EA8KE;EA5KF,QAAA,GAAW,MAAA;AAAA;;;;;;;;;;;;;;;;;;UAqKI,cAAA;EACf,GAAA;sDAEE,MAAA;IAEA,KAAA;IAEA,MAAA,EAAQ,YAAA;EAAA;AAAA;;;;UAOK,UAAA;;EAEf,MAAA;;EAEA,OAAA;;EAEA,OAAA;AAAA;;;;KA8OU,UAAA,mBACQ,gBAAA,oBACA,qBAAA,CAAsB,SAAA,KACtC,cAAA,CAAe,SAAA,EAAW,SAAA;EAC5B,GAAA,EAAK,SAAA,CAAU,SAAA;EACf,aAAA;AAAA;;KAwCU,aAAA,GAAgB,6BAAA,QAAqC,QAAA;;KAYrD,GAAA,WAAc,qBAAA,CAAsB,aAAA,KAAkB,UAAA,CAChE,aAAA,EACA,CAAA;;KAIU,MAAA;EAAW,KAAA;EAAe,YAAA;AAAA;;KAG1B,WAAA;EACV,MAAA,EAAQ,SAAA;EACR,SAAA,EAAW,SAAA;EACX,MAAA,EAAQ,MAAA;AAAA"}

package/dist/component/server/{implementation/types.js → types.js}

@@ -1,4 +1,4 @@
-//#region src/server/implementation/types.ts
+//#region src/server/types.ts
 async function queryUserById(ctx, userId) {
 	return await ctx.runQuery(ctx.auth.config.component.public.userGetById, { userId });
 }

package/dist/component/server/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","names":[],"sources":["../../../src/server/types.ts"],"sourcesContent":["import {\n  AnyDataModel,\n  DataModelFromSchemaDefinition,\n  DocumentByName,\n  FunctionReference,\n  GenericActionCtx,\n  GenericDataModel,\n  GenericMutationCtx,\n  GenericQueryCtx,\n  RegisteredAction,\n  RegisteredMutation,\n  RegisteredQuery,\n  TableNamesInDataModel,\n} from \"convex/server\";\nimport type { Infer } from \"convex/values\";\nimport { GenericId, Value } from \"convex/values\";\n\nimport {\n  vApiKeyDoc,\n  vAuthVerifierDoc,\n  vDeviceCodeDoc,\n  vPasskeyDoc,\n  vTotpFactorDoc,\n  vUserDoc,\n} from \"../component/model\";\nimport schema from \"../component/schema\";\nimport type { CredentialsConfig } from \"../providers/credentials\";\n\n// ============================================================================\n// Utility types\n// ============================================================================\n\n/**\n * A value that is either `T` or a `PromiseLike<T>`.\n *\n * @typeParam T - The underlying value type.\n */\nexport type Awaitable<T> = T | PromiseLike<T>;\n\n/**\n * A single role definition within the authorization config.\n *\n * Each role has an optional human-readable label and a list of grant strings\n * that members with this role receive.\n *\n * @see {@link AuthAuthorizationConfig}\n */\nexport type AuthRoleDefinition = {\n  /** Optional stable identifier (defaults to the record key). */\n  id?: string;\n  /** Human-readable label for admin UIs. */\n  label?: string;\n  /** Permission grant strings conferred by this role. */\n  grants: string[];\n};\n\n/**\n * Authorization configuration mapping role IDs to {@link AuthRoleDefinition}s.\n *\n * Passed as `authorization.roles` in {@link ConvexAuthConfig}.\n *\n * @see {@link AuthRoleDefinition}\n * @see {@link ConvexAuthConfig}\n */\nexport type AuthAuthorizationConfig = {\n  roles: Record<string, AuthRoleDefinition>;\n};\n\n/**\n * Extracts the union of role ID strings from an authorization config.\n *\n * When `TAuthorization` is defined, this resolves to the literal key union\n * of the `roles` record. Otherwise falls back to `string`.\n *\n * @typeParam TAuthorization - The authorization config type, or `undefined`.\n *\n * @see {@link AuthGrant}\n */\nexport type AuthRoleId<\n  TAuthorization extends AuthAuthorizationConfig | undefined,\n> = TAuthorization extends { roles: infer TRoles extends Record<string, any> }\n  ? keyof TRoles & string\n  : string;\n\n/**\n * Extracts the union of grant strings from all roles in an authorization config.\n *\n * When `TAuthorization` is defined, this resolves to the literal union\n * of all `grants` array elements across every role. Otherwise falls back to `string`.\n *\n * @typeParam TAuthorization - The authorization config type, or `undefined`.\n *\n * @see {@link AuthRoleId}\n */\nexport type AuthGrant<\n  TAuthorization extends AuthAuthorizationConfig | undefined,\n> = TAuthorization extends {\n  roles: infer TRoles extends Record<string, { grants: readonly any[] }>;\n}\n  ? TRoles[keyof TRoles][\"grants\"][number] & string\n  : string;\n\n/**\n * The config for the Convex Auth library, passed to `createAuth`.\n */\nexport type ConvexAuthConfig = {\n  /**\n   * A list of authentication provider configs.\n   *\n   * You can import existing configs from\n   * `@robelest/convex-auth/providers/<provider-name>`\n   */\n  providers: AuthProviderConfig[];\n  /**\n   * Auth component reference from `components.auth`.\n   *\n   * Core auth storage operations are executed through\n   * the component API boundary.\n   */\n  component: AuthComponentApi;\n  /**\n   * Session configuration.\n   */\n  session?: {\n    /**\n     * How long can a user session last without the user reauthenticating.\n     *\n     * Defaults to 30 days.\n     *\n     * @defaultValue 2_592_000_000\n     */\n    totalDurationMs?: number;\n    /**\n     * How long can a user session last without the user being active.\n     *\n     * Defaults to 30 days.\n     *\n     * @defaultValue 2_592_000_000\n     */\n    inactiveDurationMs?: number;\n  };\n  /**\n   * JWT configuration.\n   */\n  jwt?: {\n    /**\n     * How long is the JWT valid for after it is signed initially.\n     *\n     * Defaults to 1 hour.\n     *\n     * @defaultValue 3_600_000\n     */\n    durationMs?: number;\n  };\n  /**\n   * Sign-in configuration.\n   */\n  signIn?: {\n    /**\n     * How many times can the user fail to provide the correct credentials\n     * (password, OTP) per hour.\n     *\n     * Defaults to 10 times per hour (that is 10 failed attempts, and then\n     * allow another one every 6 minutes).\n     *\n     * @defaultValue 10\n     */\n    maxFailedAttemptsPerHour?: number;\n  };\n  /**\n   * Lifecycle callbacks for customizing sign-in behavior.\n   *\n   * Use `redirect` to control post-OAuth redirect URLs, and\n   * `createOrUpdateUser` or `afterUserCreatedOrUpdated` to\n   * customize account linking and user document creation.\n   */\n  callbacks?: {\n    /**\n     * Control which URLs are allowed as a destination after OAuth sign-in\n     * and for magic links:\n     *\n     * ```ts\n     * import { createAuth } from \"@robelest/convex-auth/component\";\n     * import { components } from \"./_generated/api\";\n     *\n     * const auth = createAuth(components.auth, {\n     *   providers: [google],\n     *   callbacks: {\n     *     async redirect({ redirectTo }) {\n     *       // Check that redirectTo is valid\n     *       // and return the relative or absolute URL\n     *       // to redirect to.\n     *     },\n     *   },\n     * });\n     * ```\n     *\n     * Convex Auth performs redirect only during OAuth sign-in. By default,\n     * it redirects back to the URL specified via the `SITE_URL` environment\n     * variable. Similarly magic links link to `SITE_URL`.\n     *\n     * You can customize that behavior by providing a `redirectTo` param\n     * to the `signIn` function:\n     *\n     * ```ts\n     * signIn(\"google\", { redirectTo: \"/dashboard\" })\n     * ```\n     *\n     * You can even redirect to a different site.\n     *\n     * This callback, if specified, is then called with the provided\n     * `redirectTo` param. Otherwise, only query params, relative paths\n     * and URLs starting with `SITE_URL` are allowed.\n     */\n    redirect?: (params: {\n      /**\n       * The param value passed to the `signIn` function.\n       */\n      redirectTo: string;\n    }) => Promise<string>;\n    /**\n     * Completely control account linking via this callback.\n     *\n     * This callback is called during the sign-in process,\n     * before account creation and token generation.\n     * If specified, this callback is responsible for creating\n     * or updating the user document.\n     *\n     * For \"credentials\" providers, the callback is only called\n     * when `createAccount` is called.\n     */\n    createOrUpdateUser?: (\n      ctx: GenericMutationCtx<AnyDataModel>,\n      args: {\n        /**\n         * If this is a sign-in to an existing account,\n         * this is the existing user ID linked to that account.\n         */\n        existingUserId: GenericId<\"User\"> | null;\n        /**\n         * The provider type or \"verification\" if this callback is called\n         * after an email or phone token verification.\n         */\n        type: \"oauth\" | \"credentials\" | \"email\" | \"phone\" | \"verification\";\n        /**\n         * The provider used for the sign-in, or the provider\n         * tied to the account which is having the email or phone verified.\n         */\n        provider: AuthProviderMaterializedConfig;\n        /**\n         * - The profile returned by the OAuth provider's `profile` method.\n         * - The profile passed to `createAccount` from a ConvexCredentials\n         * config.\n         * - The email address to which an email will be sent.\n         * - The phone number to which a text will be sent.\n         */\n        profile: Record<string, unknown> & {\n          email?: string;\n          phone?: string;\n          emailVerified?: boolean;\n          phoneVerified?: boolean;\n        };\n        /**\n         * The `shouldLink` argument passed to `createAccount`.\n         */\n        shouldLink?: boolean;\n      },\n    ) => Promise<GenericId<\"User\">>;\n    /**\n     * Perform additional writes after a user is created.\n     *\n     * This callback is called during the sign-in process,\n     * after the user is created or updated,\n     * before account creation and token generation.\n     *\n     * **This callback is only called if `createOrUpdateUser`\n     * is not specified.** If `createOrUpdateUser` is specified,\n     * you can perform any additional writes in that callback.\n     *\n     * For \"credentials\" providers, the callback is only called\n     * when `createAccount` is called.\n     */\n    afterUserCreatedOrUpdated?: (\n      ctx: GenericMutationCtx<AnyDataModel>,\n      args: {\n        /**\n         * The ID of the user that is being signed in.\n         */\n        userId: GenericId<\"User\">;\n        /**\n         * If this is a sign-in to an existing account,\n         * this is the existing user ID linked to that account.\n         */\n        existingUserId: GenericId<\"User\"> | null;\n        /**\n         * The provider type or \"verification\" if this callback is called\n         * after an email or phone token verification.\n         */\n        type: \"oauth\" | \"credentials\" | \"email\" | \"phone\" | \"verification\";\n        /**\n         * The provider used for the sign-in, or the provider\n         * tied to the account which is having the email or phone verified.\n         */\n        provider: AuthProviderMaterializedConfig;\n        /**\n         * - The profile returned by the OAuth provider's `profile` method.\n         * - The profile passed to `createAccount` from a ConvexCredentials\n         * config.\n         * - The email address to which an email will be sent.\n         * - The phone number to which a text will be sent.\n         */\n        profile: Record<string, unknown> & {\n          email?: string;\n          phone?: string;\n          emailVerified?: boolean;\n          phoneVerified?: boolean;\n        };\n        /**\n         * The `shouldLink` argument passed to `createAccount`.\n         */\n        shouldLink?: boolean;\n      },\n    ) => Promise<void>;\n  };\n  /**\n   * Application-defined role and grant model used by membership access checks.\n   */\n  authorization?: {\n    roles: Record<\n      string,\n      {\n        label?: string;\n        grants: string[];\n      }\n    >;\n  };\n};\n\n/**\n * Union of all supported auth provider config types.\n *\n * Includes Arctic-based OAuth providers (via the `OAuth()` factory),\n * plus library-native providers: credentials, email, phone, passkey\n * (WebAuthn), and TOTP (2FA). Each can be passed as a config object\n * or a factory function.\n */\nexport type AuthProviderConfig =\n  | import(\"../providers/oauth\").OAuthProviderInstance\n  | import(\"../providers/password\").Password\n  | import(\"../providers/passkey\").Passkey\n  | import(\"../providers/totp\").Totp\n  | import(\"../providers/anonymous\").Anonymous\n  | import(\"../providers/device\").Device\n  | import(\"../providers/sso\").SSO\n  | import(\"../providers/email\").Email\n  | import(\"../providers/phone\").Phone\n  | OAuthMaterializedConfig\n  | ConvexCredentialsConfig\n  | ((...args: any) => ConvexCredentialsConfig)\n  | EmailConfig\n  | ((...args: any) => EmailConfig)\n  | PhoneConfig\n  | ((...args: any) => PhoneConfig)\n  | PasskeyProviderConfig\n  | ((...args: any) => PasskeyProviderConfig)\n  | TotpProviderConfig\n  | ((...args: any) => TotpProviderConfig)\n  | DeviceProviderConfig\n  | ((...args: any) => DeviceProviderConfig)\n  | SSOProviderConfig;\n\n/**\n * Minimal config stored for the SSO provider at runtime.\n * No options — enterprise configuration is entirely per-tenant runtime state.\n */\nexport interface SSOProviderConfig {\n  id: string;\n  type: \"sso\";\n}\n\n/**\n * Account linking strategy for enterprise SSO sign-in.\n *\n * - `\"verifiedEmail\"` — link accounts when the IdP-provided email matches a verified email on an existing user.\n * - `\"none\"` — never auto-link; always create a new account.\n */\nexport type EnterpriseAccountLinkingPolicy = \"verifiedEmail\" | \"none\";\n\n/**\n * Policy for reusing existing users during SCIM provisioning.\n *\n * - `\"externalId\"` — match by the SCIM `externalId` to reuse a previously provisioned user.\n * - `\"none\"` — always create a new user for each SCIM provision request.\n */\nexport type EnterpriseScimReuseUserPolicy = \"externalId\" | \"none\";\n\n/**\n * Just-in-time provisioning mode for enterprise SSO.\n *\n * - `\"off\"` — no JIT provisioning; users must be pre-provisioned.\n * - `\"createUser\"` — create a user record on first SSO sign-in.\n * - `\"createUserAndMembership\"` — create a user and add them to the enterprise group on first SSO sign-in.\n */\nexport type EnterpriseJitProvisioningMode =\n  | \"off\"\n  | \"createUser\"\n  | \"createUserAndMembership\";\n\n/**\n * Deprovisioning strategy when a SCIM user is deleted.\n *\n * - `\"soft\"` — mark the user as inactive but preserve the record.\n * - `\"hard\"` — permanently delete the user and associated data.\n */\nexport type EnterpriseDeprovisionMode = \"soft\" | \"hard\";\n\n/**\n * Effective enterprise policy document stored for an SSO/SCIM tenant.\n *\n * Controls account linking, JIT provisioning, SCIM reuse behavior,\n * deprovisioning, and any app-defined extension metadata.\n *\n * @see {@link EnterprisePolicyPatch}\n */\nexport interface EnterprisePolicy {\n  version: 1;\n  identity: {\n    accountLinking: {\n      oidc: EnterpriseAccountLinkingPolicy;\n      saml: EnterpriseAccountLinkingPolicy;\n    };\n  };\n  provisioning: {\n    scimReuse: {\n      user: EnterpriseScimReuseUserPolicy;\n    };\n    jit: {\n      mode: EnterpriseJitProvisioningMode;\n      defaultRoleIds: string[];\n    };\n    deprovision: {\n      mode: EnterpriseDeprovisionMode;\n    };\n  };\n  extend?: Record<string, unknown>;\n}\n\n/**\n * Partial update payload for {@link EnterprisePolicy}.\n *\n * Use this when patching only selected enterprise policy sections without\n * replacing the entire stored policy document.\n */\nexport interface EnterprisePolicyPatch {\n  identity?: {\n    accountLinking?: {\n      oidc?: EnterpriseAccountLinkingPolicy;\n      saml?: EnterpriseAccountLinkingPolicy;\n    };\n  };\n  provisioning?: {\n    scimReuse?: {\n      user?: EnterpriseScimReuseUserPolicy;\n    };\n    jit?: {\n      mode?: EnterpriseJitProvisioningMode;\n      defaultRoleIds?: string[];\n    };\n    deprovision?: {\n      mode?: EnterpriseDeprovisionMode;\n    };\n  };\n  extend?: Record<string, unknown>;\n}\n\n/**\n * Email provider config for magic link / OTP sign-in.\n *\n * @typeParam DataModel - The Convex data model for typed action contexts.\n */\nexport interface EmailConfig<\n  DataModel extends GenericDataModel = GenericDataModel,\n> {\n  /** Provider identifier (e.g. `\"email\"`, `\"resend\"`). */\n  id: string;\n  /** Discriminant for provider type routing. */\n  type: \"email\";\n  /** Display name for this provider. */\n  name?: string;\n  /** Sender address (e.g. `\"My App <noreply@example.com>\"`). */\n  from?: string;\n  /**\n   * Token expiration in seconds. Defaults to 86 400 (24 hours).\n   *\n   * @defaultValue 86400\n   */\n  maxAge?: number;\n  /**\n   * Send the verification token to the user.\n   *\n   * Accepts an optional Convex action context as the second argument,\n   * enabling use with Convex components like `@convex-dev/resend`.\n   */\n  sendVerificationRequest: (\n    params: {\n      identifier: string;\n      url: string;\n      expires: Date;\n      provider: EmailConfig;\n      token: string;\n      request: Request;\n    },\n    ctx?: GenericActionCtx<AnyDataModel>,\n  ) => Awaitable<void>;\n  /**\n   * Override to generate a custom verification token.\n   * Tokens shorter than 24 characters are treated as OTPs and\n   * require the original email to be re-submitted for verification.\n   */\n  generateVerificationToken?: () => Awaitable<string>;\n  /**\n   * Normalize the email address before storage / lookup.\n   * Defaults to lowercasing and trimming whitespace.\n   */\n  normalizeIdentifier?: (identifier: string) => string;\n  /**\n   * Before the token is verified, check other\n   * provided parameters.\n   *\n   * Used to make sure that OTPs are accompanied\n   * with the correct email address.\n   */\n  authorize?: (\n    /**\n     * The values passed to the `signIn` function.\n     */\n    params: Record<string, Value | undefined>,\n    account: GenericDoc<DataModel, \"Account\">,\n  ) => Promise<void>;\n  /** Raw user options before merging with defaults. */\n  options: EmailUserConfig<DataModel>;\n}\n\n/**\n * User-facing configuration shape accepted by the email provider.\n *\n * Equivalent to `Partial<EmailConfig>` without internal runtime-only fields.\n *\n * @typeParam DataModel - The Convex data model.\n */\nexport type EmailUserConfig<\n  DataModel extends GenericDataModel = GenericDataModel,\n> = Omit<Partial<EmailConfig<DataModel>>, \"options\" | \"type\">;\n\n/**\n * Same as email provider config, but verifies\n * phone number instead of the email address.\n *\n * @typeParam DataModel - The Convex data model for typed action contexts.\n */\nexport interface PhoneConfig<\n  DataModel extends GenericDataModel = GenericDataModel,\n> {\n  id: string;\n  type: \"phone\";\n  /**\n   * Token expiration in seconds.\n   */\n  maxAge: number;\n  /**\n   * Send the phone number verification request.\n   */\n  sendVerificationRequest: (\n    params: {\n      identifier: string;\n      url: string;\n      expires: Date;\n      provider: PhoneConfig;\n      token: string;\n    },\n    ctx: GenericActionCtxWithAuthConfig<DataModel>,\n  ) => Promise<void>;\n  /**\n   * Defaults to `process.env.AUTH_<PROVIDER_ID>_KEY`.\n   */\n  apiKey?: string;\n  /**\n   * Override this to generate a custom token.\n   * Note that the tokens are assumed to be cryptographically secure.\n   * Any tokens shorter than 24 characters are assumed to not\n   * be secure enough on their own, and require providing\n   * the original `phone` used in the initial `signIn` call.\n   * @returns\n   */\n  generateVerificationToken?: () => Promise<string>;\n  /**\n   * Normalize the phone number.\n   * @param identifier Passed as `phone` in params of `signIn`.\n   * @returns The phone number used in `sendVerificationRequest`.\n   */\n  normalizeIdentifier?: (identifier: string) => string;\n  /**\n   * Before the token is verified, check other\n   * provided parameters.\n   *\n   * Used to make sure tha OTPs are accompanied\n   * with the correct phone number.\n   */\n  authorize?: (\n    /**\n     * The values passed to the `signIn` function.\n     */\n    params: Record<string, Value | undefined>,\n    account: GenericDoc<DataModel, \"Account\">,\n  ) => Promise<void>;\n  options: PhoneUserConfig<DataModel>;\n}\n\n/**\n * User-facing configuration shape accepted by the phone provider.\n *\n * Equivalent to `Partial<PhoneConfig>` without internal runtime-only fields.\n *\n * @typeParam DataModel - The Convex data model.\n */\nexport type PhoneUserConfig<\n  DataModel extends GenericDataModel = GenericDataModel,\n> = Omit<Partial<PhoneConfig<DataModel>>, \"options\" | \"type\">;\n\n/**\n * Credentials provider config used by Convex Auth.\n */\nexport type ConvexCredentialsConfig = CredentialsConfig<any> & {\n  type: \"credentials\";\n  id: string;\n};\n\n/**\n * Configuration for the passkey (WebAuthn) provider.\n */\nexport interface PasskeyProviderConfig {\n  id: string;\n  type: \"passkey\";\n  options: {\n    /** Relying Party display name. Defaults to SITE_URL hostname. */\n    rpName?: string;\n    /** Relying Party ID (hostname). Defaults to SITE_URL hostname. */\n    rpId?: string;\n    /** Allowed origins for credential verification. Defaults to SITE_URL. */\n    origin?: string | string[];\n    /**\n     * Attestation conveyance preference. Defaults to \"none\".\n     *\n     * @defaultValue \"none\"\n     */\n    attestation?: \"none\" | \"direct\";\n    /**\n     * User verification requirement. Defaults to \"required\".\n     *\n     * @defaultValue \"required\"\n     */\n    userVerification?: \"required\" | \"preferred\" | \"discouraged\";\n    /**\n     * Resident key (discoverable credential) preference. Defaults to \"preferred\".\n     *\n     * @defaultValue \"preferred\"\n     */\n    residentKey?: \"required\" | \"preferred\" | \"discouraged\";\n    /** Restrict to platform or cross-platform authenticators. */\n    authenticatorAttachment?: \"platform\" | \"cross-platform\";\n    /**\n     * Supported COSE algorithms. Defaults to [-7 (ES256), -257 (RS256)].\n     *\n     * @defaultValue [-7, -257]\n     */\n    algorithms?: number[];\n    /**\n     * Challenge expiration in ms. Defaults to 300_000 (5 minutes).\n     *\n     * @defaultValue 300_000\n     */\n    challengeExpirationMs?: number;\n  };\n}\n\n/**\n * Configuration for the TOTP two-factor authentication provider.\n */\nexport interface TotpProviderConfig {\n  id: string;\n  type: \"totp\";\n  options: {\n    /** Issuer name shown in authenticator apps (e.g. \"My App\"). */\n    issuer: string;\n    /**\n     * Number of digits in each code (default: 6).\n     *\n     * @defaultValue 6\n     */\n    digits: number;\n    /**\n     * Time period in seconds for code rotation (default: 30).\n     *\n     * @defaultValue 30\n     */\n    period: number;\n  };\n}\n\n// ============================================================================\n// OAuth types (Arctic-based)\n// ============================================================================\n\n/**\n * Normalized user profile returned by an OAuth provider.\n *\n * `id` is the provider-specific account identifier (e.g. GitHub user ID).\n */\nexport interface OAuthProfile {\n  id: string;\n  name?: string;\n  email?: string;\n  image?: string;\n  /** Additional claims from the ID token or userinfo endpoint. */\n  [key: string]: unknown;\n}\n\n/**\n * Internal config shape for an OAuth provider after normalization.\n *\n * This is what the OAuth flow code receives — it maps to the user-facing\n * `OAuthConfig` from `@robelest/convex-auth/providers`.\n *\n * @internal\n */\nexport interface OAuthProviderConfig {\n  /** OAuth scopes to request. */\n  scopes?: string[];\n  /** User-provided profile extraction callback. */\n  profile?: (tokens: import(\"arctic\").OAuth2Tokens) => Promise<OAuthProfile>;\n}\n\n/** Credentials identifying a provider account (e.g. email + hashed password). */\nexport type AuthAccountCredentials = {\n  /** Provider-specific account identifier (e.g. email address). */\n  id: string;\n  /** Optional secret (e.g. hashed password). */\n  secret?: string;\n};\n\n/** Arguments for `auth.account.create()`. */\nexport type AuthCreateAccountArgs = {\n  provider: string;\n  account: AuthAccountCredentials;\n  profile: Record<string, unknown> & {\n    email?: string;\n    phone?: string;\n    emailVerified?: boolean;\n    phoneVerified?: boolean;\n  };\n  shouldLinkViaEmail?: boolean;\n  shouldLinkViaPhone?: boolean;\n};\n\n/** Arguments for `auth.account.get()`. */\nexport type AuthRetrieveAccountArgs = {\n  provider: string;\n  account: AuthAccountCredentials;\n};\n\n/** Arguments for `auth.account.update()`. */\nexport type AuthUpdateAccountArgs = {\n  provider: string;\n  account: {\n    id: string;\n    secret: string;\n  };\n};\n\n/** Arguments for `auth.session.invalidate()`. */\nexport type AuthInvalidateSessionsArgs = {\n  userId: GenericId<\"User\">;\n  except?: GenericId<\"Session\">[];\n};\n\n/** Arguments for `auth.provider.signIn()`. */\nexport type AuthProviderSignInArgs = {\n  accountId?: GenericId<\"Account\">;\n  params?: Record<string, Value | undefined>;\n};\n\n/** Return type of `auth.provider.signIn()` — user and session IDs, or `null` on failure. */\nexport type AuthProviderSignInResult = {\n  userId: GenericId<\"User\">;\n  sessionId: GenericId<\"Session\">;\n} | null;\n\n/** Arguments for `auth.member.resolve()`. */\nexport type AuthMemberResolveArgs = {\n  userId: GenericId<\"User\">;\n  groupId: GenericId<\"Group\">;\n  ancestry?: boolean;\n  roleIds?: string[];\n  grants?: string[];\n  maxDepth?: number;\n};\n\n/** Result of `auth.member.resolve()` — membership check with role and grant details. */\nexport type AuthMemberResolveResult = {\n  ok: boolean;\n  membership: GenericDoc<GenericDataModel, \"GroupMember\"> | null;\n  matchedGroupId: GenericId<\"Group\"> | null;\n  roleIds: string[];\n  grants: string[];\n  missingGrants: string[];\n  depth: number | null;\n  isDirect: boolean;\n  isInherited: boolean;\n  traversedGroupIds: GenericId<\"Group\">[];\n  code?: \"INVALID_ROLE_IDS\";\n  invalidRoleIds?: string[];\n};\n\n/**\n * Server-side auth helper methods injected into `ctx.auth` within provider actions.\n *\n * Provides programmatic access to account management, session lifecycle,\n * membership resolution, and provider sign-in from within Convex actions\n * that use {@link GenericActionCtxWithAuthConfig}.\n *\n * @see {@link GenericActionCtxWithAuthConfig}\n *\n * @example\n * ```ts\n * // Inside a credentials provider's authorize callback:\n * const { account, user } = await ctx.auth.account.get(ctx, {\n *   provider: \"password\",\n *   account: { id: email },\n * });\n * ```\n */\nexport type AuthServerHelpers = {\n  /** Account management: create, retrieve, and update provider-linked accounts. */\n  account: {\n    create: (\n      ctx: GenericActionCtx<any>,\n      args: AuthCreateAccountArgs,\n    ) => Promise<{\n      ok: true;\n      account: GenericDoc<GenericDataModel, \"Account\">;\n      user: GenericDoc<GenericDataModel, \"User\">;\n    }>;\n    get: (\n      ctx: GenericActionCtx<any>,\n      args: AuthRetrieveAccountArgs,\n    ) => Promise<{\n      account: GenericDoc<GenericDataModel, \"Account\">;\n      user: GenericDoc<GenericDataModel, \"User\">;\n    }>;\n    update: (\n      ctx: GenericActionCtx<any>,\n      args: AuthUpdateAccountArgs,\n    ) => Promise<{ ok: true; accountId: GenericId<\"Account\"> }>;\n  };\n  session: {\n    current: (ctx: {\n      auth: GenericActionCtx<GenericDataModel>[\"auth\"];\n    }) => Promise<GenericId<\"Session\"> | null>;\n    invalidate: (\n      ctx: GenericActionCtx<any>,\n      args: AuthInvalidateSessionsArgs,\n    ) => Promise<{\n      ok: true;\n      userId: GenericId<\"User\">;\n      except: GenericId<\"Session\">[];\n    }>;\n  };\n  member: {\n    resolve: (\n      ctx: GenericActionCtx<any>,\n      args: AuthMemberResolveArgs,\n    ) => Promise<AuthMemberResolveResult>;\n  };\n  provider: {\n    signIn: (\n      ctx: GenericActionCtx<any>,\n      provider: AuthProviderConfig,\n      args: AuthProviderSignInArgs,\n    ) => Promise<AuthProviderSignInResult>;\n  };\n};\n\n/**\n * Your `ActionCtx` enriched with `ctx.auth.config` field with\n * the config passed to `createAuth`.\n *\n * @typeParam DataModel - The Convex data model.\n */\nexport type GenericActionCtxWithAuthConfig<DataModel extends GenericDataModel> =\n  GenericActionCtx<DataModel> & {\n    auth: GenericActionCtx<DataModel>[\"auth\"] & {\n      config: ConvexAuthMaterializedConfig;\n    } & AuthServerHelpers;\n  };\n\n/**\n * The config for the Convex Auth library, passed to `createAuth`,\n * with defaults and initialized providers.\n *\n * See {@link ConvexAuthConfig}\n */\nexport type ConvexAuthMaterializedConfig = {\n  providers: AuthProviderMaterializedConfig[];\n} & Pick<\n  ConvexAuthConfig,\n  \"component\" | \"session\" | \"jwt\" | \"signIn\" | \"callbacks\" | \"authorization\"\n>;\n\n/**\n * Maps SAML assertion attribute names to user profile fields.\n *\n * Use this to tell the SSO flow which SAML attributes correspond to\n * the user's subject identifier, email, and display name fields.\n */\nexport interface SAMLAttributeMapping {\n  /** SAML attribute for the unique subject identifier (NameID). */\n  subject?: string;\n  /** SAML attribute for the user's email address. */\n  email?: string;\n  /** SAML attribute for the user's full display name. */\n  name?: string;\n  /** SAML attribute for the user's first / given name. */\n  firstName?: string;\n  /** SAML attribute for the user's last / family name. */\n  lastName?: string;\n}\n\n/**\n * Materialized OAuth provider config (Arctic-based).\n *\n * Carries the Arctic provider instance along with scopes and profile config.\n  * Produced by materializing an `OAuthProviderInstance` during `configDefaults`.\n */\nexport interface OAuthMaterializedConfig {\n  /**\n   * Provider identifier (e.g. `\"google\"`, `\"github\"`).\n   * @readonly\n   */\n  readonly id: string;\n  /**\n   * Discriminant for provider type routing.\n   * @readonly\n   */\n  readonly type: \"oauth\";\n  /**\n   * The Arctic provider instance.\n   * @readonly\n   */\n  readonly provider: any;\n  /**\n   * OAuth scopes to request.\n   * @readonly\n   */\n  readonly scopes: string[];\n  /**\n   * User-provided profile extraction callback.\n   * @readonly\n   */\n  readonly profile?: (\n    tokens: import(\"arctic\").OAuth2Tokens,\n  ) => Promise<OAuthProfile>;\n  /**\n   * Account-linking policy for OAuth identities. Defaults to verified email linking.\n   * @readonly\n   */\n  readonly accountLinking?: \"verifiedEmail\" | \"none\";\n}\n\n/**\n * Device authorization provider config (RFC 8628).\n *\n * Enables input-constrained devices (CLIs, TVs, IoT) to authenticate\n * by displaying a short code that the user enters on a secondary device.\n */\nexport interface DeviceProviderConfig {\n  id: string;\n  type: \"device\";\n  /** User code character set. Default: `\"BCDFGHJKLMNPQRSTVWXZ\"` (base-20, no vowels). */\n  charset: string;\n  /** User code length. Default: 8. */\n  userCodeLength: number;\n  /** Device code + user code lifetime in seconds. Default: 900 (15 min). */\n  expiresIn: number;\n  /** Minimum polling interval in seconds. Default: 5. */\n  interval: number;\n  /**\n   * Base URL for the verification page (e.g. `\"http://localhost:3000/device\"`).\n   *\n   * This is where users go to enter the device code. If not provided,\n   * falls back to `SITE_URL + \"/device\"`.\n   */\n  verificationUri?: string;\n}\n\n/**\n * Materialized auth provider config — the fully resolved form stored at runtime.\n */\nexport type AuthProviderMaterializedConfig =\n  | OAuthMaterializedConfig\n  | EmailConfig\n  | PhoneConfig\n  | ConvexCredentialsConfig\n  | PasskeyProviderConfig\n  | TotpProviderConfig\n  | DeviceProviderConfig\n  | SSOProviderConfig;\n\n/**\n * Resolves to `true` when the providers list includes `SSO`, otherwise `false`.\n *\n * Used to make `auth.sso` conditionally present on the `createAuth`\n * return type — it only appears when `new SSO()` is in the providers array.\n */\nexport type HasSSO<P extends AuthProviderConfig[]> =\n  import(\"../providers/sso\").SSO extends P[number] ? true : false;\n\nexport type HasPasskeyProvider<P extends AuthProviderConfig[]> =\n  import(\"../providers/passkey\").Passkey extends P[number] ? true : false;\n\nexport type HasTotpProvider<P extends AuthProviderConfig[]> =\n  import(\"../providers/totp\").Totp extends P[number] ? true : false;\n\nexport type HasDeviceProvider<P extends AuthProviderConfig[]> =\n  import(\"../providers/device\").Device extends P[number] ? true : false;\n\n// ============================================================================\n// API Key types\n// ============================================================================\n\n/**\n * A single scope entry stored per API key.\n * Uses a resource:action pattern for structured permissions.\n *\n * ```ts\n * { resource: \"users\", actions: [\"read\", \"list\"] }\n * ```\n */\nexport interface KeyScope {\n  resource: string;\n  actions: string[];\n}\n\n/**\n * Result of scope verification. Provides a `.can()` helper\n * for checking if a key has a specific permission.\n *\n * ```ts\n * const result = await auth.key.verify(ctx, rawKey);\n * if (result.scopes.can(\"users\", \"read\")) {\n *   // authorized\n * }\n * ```\n */\nexport interface ScopeChecker {\n  /** Check if the key has permission for a given resource:action. */\n  can(resource: string, action: string): boolean;\n  /** The raw scope entries from the key. */\n  scopes: KeyScope[];\n}\n\n/**\n * An API key record as returned by `auth.key.list()` and `auth.key.get()`.\n * Never includes the raw key material — only the display prefix.\n */\nexport interface KeyRecord {\n  /** Document ID. */\n  _id: string;\n  /** Owner user ID. */\n  userId: string;\n  /** Display prefix (e.g. `\"sk_abc1\"`). Safe to show in UIs. */\n  prefix: string;\n  /** Human-readable name (e.g. \"CI Pipeline\"). */\n  name: string;\n  /** Resource:action permissions granted to this key. */\n  scopes: KeyScope[];\n  /** Per-key rate limit, if configured. */\n  rateLimit?: { maxRequests: number; windowMs: number };\n  /** Expiration timestamp (ms since epoch), or `undefined` for no expiry. */\n  expiresAt?: number;\n  /** Timestamp of last successful verification, or `undefined` if never used. */\n  lastUsedAt?: number;\n  /** Creation timestamp (ms since epoch). */\n  createdAt: number;\n  /** `true` when the key has been revoked (soft-deleted). */\n  revoked: boolean;\n  /** Arbitrary app-specific metadata attached to the key. */\n  metadata?: Record<string, unknown>;\n}\n\n// ============================================================================\n// Unified List API types\n// ============================================================================\n\n/**\n * Options for paginated list queries. Every entity list method uses this\n * same shape with entity-specific `TWhere` and `TOrderBy` type parameters.\n *\n * @typeParam TWhere - The type of the optional filter object.\n * @typeParam TOrderBy - The union of sortable field names.\n *\n * ```ts\n * const result = await auth.group.list(ctx, {\n *   where: { type: \"team\" },\n *   limit: 20,\n *   orderBy: \"name\",\n *   order: \"asc\",\n * });\n * ```\n */\nexport type ListOptions<\n  TWhere extends Record<string, unknown>,\n  TOrderBy extends string,\n> = {\n  /** Serializable filter — only known fields for the entity. */\n  where?: TWhere;\n  /** Maximum number of items to return. Defaults to 50, max 100. */\n  limit?: number;\n  /** Opaque cursor from a previous `ListResult.nextCursor`. */\n  cursor?: string | null;\n  /** Field to sort by. Defaults to `\"_creationTime\"`. */\n  orderBy?: TOrderBy;\n  /** Sort direction. Defaults to `\"desc\"`. */\n  order?: \"asc\" | \"desc\";\n};\n\n/**\n * Paginated list result returned by every entity list method.\n *\n * @typeParam T - The type of items in the result array.\n */\nexport type ListResult<T> = {\n  /** The page of items. */\n  items: T[];\n  /** Opaque cursor for the next page, or `null` when exhausted. */\n  nextCursor: string | null;\n};\n\n// -- Per-entity Where / OrderBy types --\n\n/**\n * A single key/value tag for group classification.\n *\n * Tags are normalized at write time: both `key` and `value` are\n * trimmed and lowercased. Filtering is strict exact-match only.\n */\nexport type GroupTag = {\n  key: string;\n  value: string;\n};\n\n/** Filter fields for `auth.group.list()`. All optional. */\nexport type GroupWhere = {\n  slug?: string;\n  type?: string;\n  parentGroupId?: string;\n  name?: string;\n  /** When `true`, return only root groups (no parent). When `false`, only non-root. */\n  isRoot?: boolean;\n  /**\n   * Return only groups that have **all** of the specified tags.\n   * Each tag is matched exactly on normalized `(key, value)`.\n   */\n  tagsAll?: GroupTag[];\n  /**\n   * Return only groups that have **at least one** of the specified tags.\n   * Each tag is matched exactly on normalized `(key, value)`.\n   */\n  tagsAny?: GroupTag[];\n};\n\n/** Sortable fields for `auth.group.list()`. */\nexport type GroupOrderBy = \"_creationTime\" | \"name\" | \"slug\" | \"type\";\n\n/** Filter fields for `auth.member.list()`. All optional. */\nexport type MemberWhere = {\n  groupId?: string;\n  userId?: string;\n  roleId?: string;\n  status?: string;\n};\n\n/** Sortable fields for `auth.member.list()`. */\nexport type MemberOrderBy = \"_creationTime\" | \"status\";\n\n/** Filter fields for `auth.invite.list()`. All optional. */\nexport type InviteWhere = {\n  tokenHash?: string;\n  groupId?: string;\n  status?: \"pending\" | \"accepted\" | \"revoked\" | \"expired\";\n  email?: string;\n  invitedByUserId?: string;\n  roleId?: string;\n  acceptedByUserId?: string;\n};\n\n/** Sortable fields for `auth.invite.list()`. */\nexport type InviteOrderBy =\n  | \"_creationTime\"\n  | \"status\"\n  | \"email\"\n  | \"expiresTime\"\n  | \"acceptedTime\";\n\n/** Filter fields for `auth.key.list()`. All optional. */\nexport type KeyWhere = {\n  userId?: string;\n  revoked?: boolean;\n  name?: string;\n  prefix?: string;\n};\n\n/** Sortable fields for `auth.key.list()`. */\nexport type KeyOrderBy =\n  | \"_creationTime\"\n  | \"name\"\n  | \"lastUsedAt\"\n  | \"expiresAt\"\n  | \"revoked\";\n\n/** Filter fields for `auth.user.list()`. All optional. */\nexport type UserWhere = {\n  email?: string;\n  phone?: string;\n  isAnonymous?: boolean;\n  name?: string;\n};\n\n/** Sortable fields for `auth.user.list()`. */\nexport type UserOrderBy = \"_creationTime\" | \"name\" | \"email\" | \"phone\";\n\n// ============================================================================\n// HTTP Bearer Auth types\n// ============================================================================\n\n/**\n * Context injected into `auth.http.action()` and `auth.http.route()` handlers.\n *\n * The handler's `ctx` receives these fields after Bearer token verification:\n *\n * ```ts\n * auth.http.route(http, {\n *   path: \"/api/data\",\n *   method: \"GET\",\n *   handler: async (ctx, request) => {\n *     ctx.key.userId;               // owner of the API key\n *     ctx.key.keyId;                // the key document ID\n *     ctx.key.scopes.can(\"data\", \"read\"); // scope check\n *   },\n * });\n * ```\n */\nexport interface HttpKeyContext {\n  key: {\n    /** The user ID that owns the verified API key. */\n    userId: string;\n    /** The API key document ID. */\n    keyId: string;\n    /** Scope checker for the verified key's permissions. */\n    scopes: ScopeChecker;\n  };\n}\n\n/**\n * CORS configuration for Bearer-authenticated HTTP endpoints.\n */\nexport interface CorsConfig {\n  /** Allowed origin(s). Defaults to `\"*\"`. */\n  origin?: string;\n  /** Allowed HTTP methods. Defaults to `\"GET,POST,PUT,PATCH,DELETE,OPTIONS\"`. */\n  methods?: string;\n  /** Allowed request headers. Defaults to `\"Content-Type,Authorization\"`. */\n  headers?: string;\n}\n\n/**\n * Component function references required by core auth runtime.\n *\n * @internal Consumers should not depend on this shape — it may change\n * between minor versions. Pass `components.auth` directly to `createAuth`.\n */\nexport type AuthComponentApi = {\n  public: {\n    userGetById: FunctionReference<\"query\", \"internal\">;\n    userList: FunctionReference<\"query\", \"internal\">;\n    userFindByVerifiedEmail: FunctionReference<\"query\", \"internal\">;\n    userFindByVerifiedPhone: FunctionReference<\"query\", \"internal\">;\n    userInsert: FunctionReference<\"mutation\", \"internal\">;\n    userUpsert: FunctionReference<\"mutation\", \"internal\">;\n    userPatch: FunctionReference<\"mutation\", \"internal\">;\n    userDelete: FunctionReference<\"mutation\", \"internal\">;\n    accountGet: FunctionReference<\"query\", \"internal\">;\n    accountGetById: FunctionReference<\"query\", \"internal\">;\n    accountInsert: FunctionReference<\"mutation\", \"internal\">;\n    accountListByUser: FunctionReference<\"query\", \"internal\">;\n    accountPatch: FunctionReference<\"mutation\", \"internal\">;\n    accountDelete: FunctionReference<\"mutation\", \"internal\">;\n    sessionCreate: FunctionReference<\"mutation\", \"internal\">;\n    sessionGetById: FunctionReference<\"query\", \"internal\">;\n    sessionDelete: FunctionReference<\"mutation\", \"internal\">;\n    sessionListByUser: FunctionReference<\"query\", \"internal\">;\n    verifierCreate: FunctionReference<\"mutation\", \"internal\">;\n    verifierGetById: FunctionReference<\"query\", \"internal\">;\n    verifierGetBySignature: FunctionReference<\"query\", \"internal\">;\n    verifierPatch: FunctionReference<\"mutation\", \"internal\">;\n    verifierDelete: FunctionReference<\"mutation\", \"internal\">;\n    verificationCodeGetByAccountId: FunctionReference<\"query\", \"internal\">;\n    verificationCodeGetByCode: FunctionReference<\"query\", \"internal\">;\n    verificationCodeCreate: FunctionReference<\"mutation\", \"internal\">;\n    verificationCodeDelete: FunctionReference<\"mutation\", \"internal\">;\n    refreshTokenCreate: FunctionReference<\"mutation\", \"internal\">;\n    refreshTokenGetById: FunctionReference<\"query\", \"internal\">;\n    refreshTokenPatch: FunctionReference<\"mutation\", \"internal\">;\n    refreshTokenGetChildren: FunctionReference<\"query\", \"internal\">;\n    refreshTokenListBySession: FunctionReference<\"query\", \"internal\">;\n    refreshTokenDeleteAll: FunctionReference<\"mutation\", \"internal\">;\n    refreshTokenGetActive: FunctionReference<\"query\", \"internal\">;\n    rateLimitGet: FunctionReference<\"query\", \"internal\">;\n    rateLimitCreate: FunctionReference<\"mutation\", \"internal\">;\n    rateLimitPatch: FunctionReference<\"mutation\", \"internal\">;\n    rateLimitDelete: FunctionReference<\"mutation\", \"internal\">;\n    groupCreate: FunctionReference<\"mutation\", \"internal\">;\n    groupGet: FunctionReference<\"query\", \"internal\">;\n    groupList: FunctionReference<\"query\", \"internal\">;\n    groupUpdate: FunctionReference<\"mutation\", \"internal\">;\n    groupDelete: FunctionReference<\"mutation\", \"internal\">;\n    memberAdd: FunctionReference<\"mutation\", \"internal\">;\n    memberGet: FunctionReference<\"query\", \"internal\">;\n    memberList: FunctionReference<\"query\", \"internal\">;\n    memberGetByGroupAndUser: FunctionReference<\"query\", \"internal\">;\n    memberRemove: FunctionReference<\"mutation\", \"internal\">;\n    memberUpdate: FunctionReference<\"mutation\", \"internal\">;\n    inviteCreate: FunctionReference<\"mutation\", \"internal\">;\n    inviteGet: FunctionReference<\"query\", \"internal\">;\n    inviteGetByTokenHash: FunctionReference<\"query\", \"internal\">;\n    inviteList: FunctionReference<\"query\", \"internal\">;\n    inviteAccept: FunctionReference<\"mutation\", \"internal\">;\n    inviteAcceptByToken: FunctionReference<\"mutation\", \"internal\">;\n    inviteRevoke: FunctionReference<\"mutation\", \"internal\">;\n    keyInsert: FunctionReference<\"mutation\", \"internal\">;\n    keyGetByHashedKey: FunctionReference<\"query\", \"internal\">;\n    keyGetById: FunctionReference<\"query\", \"internal\">;\n    keyList: FunctionReference<\"query\", \"internal\">;\n    keyPatch: FunctionReference<\"mutation\", \"internal\">;\n    keyDelete: FunctionReference<\"mutation\", \"internal\">;\n    passkeyInsert: FunctionReference<\"mutation\", \"internal\">;\n    passkeyGetByCredentialId: FunctionReference<\"query\", \"internal\">;\n    passkeyListByUserId: FunctionReference<\"query\", \"internal\">;\n    passkeyUpdateCounter: FunctionReference<\"mutation\", \"internal\">;\n    passkeyUpdateMeta: FunctionReference<\"mutation\", \"internal\">;\n    passkeyDelete: FunctionReference<\"mutation\", \"internal\">;\n    totpInsert: FunctionReference<\"mutation\", \"internal\", any, any>;\n    totpGetVerifiedByUserId: FunctionReference<\"query\", \"internal\", any, any>;\n    totpListByUserId: FunctionReference<\"query\", \"internal\", any, any>;\n    totpGetById: FunctionReference<\"query\", \"internal\", any, any>;\n    totpMarkVerified: FunctionReference<\"mutation\", \"internal\", any, any>;\n    totpUpdateLastUsed: FunctionReference<\"mutation\", \"internal\", any, any>;\n    totpDelete: FunctionReference<\"mutation\", \"internal\", any, any>;\n    deviceInsert: FunctionReference<\"mutation\", \"internal\", any, any>;\n    deviceGetByCodeHash: FunctionReference<\"query\", \"internal\", any, any>;\n    deviceGetByUserCode: FunctionReference<\"query\", \"internal\", any, any>;\n    deviceAuthorize: FunctionReference<\"mutation\", \"internal\", any, any>;\n    deviceUpdateLastPolled: FunctionReference<\"mutation\", \"internal\", any, any>;\n    deviceDelete: FunctionReference<\"mutation\", \"internal\", any, any>;\n    enterpriseCreate: FunctionReference<\"mutation\", \"internal\", any, any>;\n    enterpriseGet: FunctionReference<\"query\", \"internal\", any, any>;\n    enterpriseGetByGroup: FunctionReference<\"query\", \"internal\", any, any>;\n    enterpriseGetByDomain: FunctionReference<\"query\", \"internal\", any, any>;\n    enterpriseList: FunctionReference<\"query\", \"internal\", any, any>;\n    enterpriseUpdate: FunctionReference<\"mutation\", \"internal\", any, any>;\n    enterpriseDelete: FunctionReference<\"mutation\", \"internal\", any, any>;\n    enterpriseDomainAdd: FunctionReference<\"mutation\", \"internal\", any, any>;\n    enterpriseDomainList: FunctionReference<\"query\", \"internal\", any, any>;\n    enterpriseDomainDelete: FunctionReference<\"mutation\", \"internal\", any, any>;\n    enterpriseDomainVerificationGet: FunctionReference<\n      \"query\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseDomainVerificationUpsert: FunctionReference<\n      \"mutation\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseDomainVerificationDelete: FunctionReference<\n      \"mutation\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseDomainVerify: FunctionReference<\"mutation\", \"internal\", any, any>;\n    enterpriseSecretUpsert: FunctionReference<\"mutation\", \"internal\", any, any>;\n    enterpriseSecretGet: FunctionReference<\"query\", \"internal\", any, any>;\n    enterpriseSecretDelete: FunctionReference<\"mutation\", \"internal\", any, any>;\n    enterpriseScimConfigUpsert: FunctionReference<\n      \"mutation\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseScimConfigGetByEnterprise: FunctionReference<\n      \"query\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseScimConfigGetByTokenHash: FunctionReference<\n      \"query\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseScimIdentityGet: FunctionReference<\"query\", \"internal\", any, any>;\n    enterpriseScimIdentityGetByUser: FunctionReference<\n      \"query\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseScimIdentityGetByEnterpriseAndUser: FunctionReference<\n      \"query\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseScimIdentityGetByMappedGroup: FunctionReference<\n      \"query\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseScimIdentityListByEnterprise: FunctionReference<\n      \"query\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseScimIdentityUpsert: FunctionReference<\n      \"mutation\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseScimIdentityDelete: FunctionReference<\n      \"mutation\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseAuditEventCreate: FunctionReference<\n      \"mutation\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseAuditEventList: FunctionReference<\"query\", \"internal\", any, any>;\n    enterpriseWebhookEndpointCreate: FunctionReference<\n      \"mutation\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseWebhookEndpointList: FunctionReference<\n      \"query\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseWebhookEndpointGet: FunctionReference<\n      \"query\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseWebhookEndpointUpdate: FunctionReference<\n      \"mutation\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseWebhookDeliveryEnqueue: FunctionReference<\n      \"mutation\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseWebhookDeliveryListReady: FunctionReference<\n      \"query\",\n      \"internal\",\n      any,\n      any\n    >;\n    enterpriseWebhookDeliveryPatch: FunctionReference<\n      \"mutation\",\n      \"internal\",\n      any,\n      any\n    >;\n  };\n};\n\n// ============================================================================\n// Convex document types (merged from convex_types)\n// ============================================================================\n\n/**\n * Convex document from a given table.\n */\nexport type GenericDoc<\n  DataModel extends GenericDataModel,\n  TableName extends TableNamesInDataModel<DataModel>,\n> = DocumentByName<DataModel, TableName> & {\n  _id: GenericId<TableName>;\n  _creationTime: number;\n};\n\n/**\n * @internal\n */\nexport type FunctionReferenceFromExport<Export> =\n  Export extends RegisteredQuery<infer Visibility, infer Args, infer Output>\n    ? FunctionReference<\"query\", Visibility, Args, ConvertReturnType<Output>>\n    : Export extends RegisteredMutation<\n          infer Visibility,\n          infer Args,\n          infer Output\n        >\n      ? FunctionReference<\n          \"mutation\",\n          Visibility,\n          Args,\n          ConvertReturnType<Output>\n        >\n      : Export extends RegisteredAction<\n            infer Visibility,\n            infer Args,\n            infer Output\n          >\n        ? FunctionReference<\n            \"action\",\n            Visibility,\n            Args,\n            ConvertReturnType<Output>\n          >\n        : never;\n\ntype ConvertReturnType<T> = UndefinedToNull<Awaited<T>>;\n\ntype UndefinedToNull<T> = T extends void ? null : T;\n\n// Internal server data-model types (merged from former internalTypes.ts)\n\n/** Data model derived from the component schema. */\nexport type AuthDataModel = DataModelFromSchemaDefinition<typeof schema>;\n\n/** Action context typed to the auth component's data model. */\nexport type ActionCtx = GenericActionCtx<AuthDataModel>;\n\n/** Mutation context typed to the auth component's data model. */\nexport type MutationCtx = GenericMutationCtx<AuthDataModel>;\n\n/** Query context typed to the auth component's data model. */\nexport type QueryCtx = GenericQueryCtx<AuthDataModel>;\n\n/** A document from any table in the auth component schema. */\nexport type Doc<T extends TableNamesInDataModel<AuthDataModel>> = GenericDoc<\n  AuthDataModel,\n  T\n>;\n\n/** A pair of JWT access token and refresh token. */\nexport type Tokens = { token: string; refreshToken: string };\n\n/** Session information returned after authentication. */\nexport type SessionInfo = {\n  userId: GenericId<\"User\">;\n  sessionId: GenericId<\"Session\">;\n  tokens: Tokens | null;\n};\n\n/** Session information with guaranteed non-null tokens. */\nexport type SessionInfoWithTokens = {\n  userId: GenericId<\"User\">;\n  sessionId: GenericId<\"Session\">;\n  tokens: Tokens;\n};\n\n// ---------------------------------------------------------------------------\n// Cross-component document shapes\n// ---------------------------------------------------------------------------\n// These mirror the component schema tables. They exist so that server-side\n// code can work with typed results from cross-component queries/mutations\n// instead of casting to `any` at every field access.\n\nexport type TotpDoc = Infer<typeof vTotpFactorDoc>;\n\nexport type PasskeyDoc = Infer<typeof vPasskeyDoc>;\n\nexport type VerifierDoc = Infer<typeof vAuthVerifierDoc>;\n\n/**\n * Cross-component user document shape inferred from the component validator.\n *\n * Used by internal typed wrappers (`queryUserById`, etc.) so server code stays\n * aligned with the component runtime contract. Not intended for consumer use —\n * consumers should use `UserDoc` (exported from\n * `@robelest/convex-auth/component`).\n *\n * @internal\n */\nexport type CrossComponentUserDoc = Infer<typeof vUserDoc>;\n\nexport type KeyDoc = Infer<typeof vApiKeyDoc>;\n\n// ---------------------------------------------------------------------------\n// Cross-component wrapper context\n// ---------------------------------------------------------------------------\n// Structural type accepted by all wrappers below.  Works for both action and\n// mutation contexts — the only capabilities we need are runQuery / runMutation\n// and access to the component API via `auth.config.component`.\n\n/** @internal */\nexport type ComponentCallCtx = {\n  runQuery: GenericActionCtx<AuthDataModel>[\"runQuery\"];\n  runMutation: GenericActionCtx<AuthDataModel>[\"runMutation\"];\n  auth: { config: { component: AuthComponentApi } };\n};\n\n// ---------------------------------------------------------------------------\n// Typed wrappers for cross-component calls\n// ---------------------------------------------------------------------------\n// Each wrapper encapsulates the single `as any` cast at the component\n// boundary so that callers get full type safety on both args and return\n// values.\n\n// -- User queries --\n\nexport async function queryUserById(\n  ctx: ComponentCallCtx,\n  userId: string,\n): Promise<CrossComponentUserDoc | null> {\n  return (await ctx.runQuery(ctx.auth.config.component.public.userGetById, {\n    userId,\n  })) as CrossComponentUserDoc | null;\n}\n\nexport async function queryUserByVerifiedEmail(\n  ctx: ComponentCallCtx,\n  email: string,\n): Promise<CrossComponentUserDoc | null> {\n  return (await ctx.runQuery(\n    ctx.auth.config.component.public.userFindByVerifiedEmail,\n    { email },\n  )) as CrossComponentUserDoc | null;\n}\n\n// -- Verifier queries / mutations --\n\nexport async function queryVerifierById(\n  ctx: ComponentCallCtx,\n  verifierId: string,\n): Promise<VerifierDoc | null> {\n  return (await ctx.runQuery(ctx.auth.config.component.public.verifierGetById, {\n    verifierId,\n  })) as VerifierDoc | null;\n}\n\nexport async function mutateVerifierDelete(\n  ctx: ComponentCallCtx,\n  verifierId: string,\n): Promise<void> {\n  await ctx.runMutation(ctx.auth.config.component.public.verifierDelete, {\n    verifierId,\n  });\n}\n\n// -- TOTP queries / mutations --\n\nexport async function queryTotpById(\n  ctx: ComponentCallCtx,\n  totpId: string,\n): Promise<TotpDoc | null> {\n  return (await ctx.runQuery(ctx.auth.config.component.public.totpGetById, {\n    totpId,\n  })) as TotpDoc | null;\n}\n\nexport async function queryTotpVerifiedByUserId(\n  ctx: ComponentCallCtx,\n  userId: string,\n): Promise<TotpDoc | null> {\n  return (await ctx.runQuery(\n    ctx.auth.config.component.public.totpGetVerifiedByUserId,\n    { userId },\n  )) as TotpDoc | null;\n}\n\nexport async function mutateTotpInsert(\n  ctx: ComponentCallCtx,\n  args: {\n    userId: string;\n    secret: ArrayBuffer;\n    digits: number;\n    period: number;\n    verified: boolean;\n    name?: string;\n    createdAt: number;\n  },\n): Promise<string> {\n  return (await ctx.runMutation(\n    ctx.auth.config.component.public.totpInsert,\n    args,\n  )) as string;\n}\n\nexport async function mutateTotpMarkVerified(\n  ctx: ComponentCallCtx,\n  totpId: string,\n  lastUsedAt: number,\n): Promise<void> {\n  await ctx.runMutation(ctx.auth.config.component.public.totpMarkVerified, {\n    totpId,\n    lastUsedAt,\n  });\n}\n\nexport async function mutateTotpUpdateLastUsed(\n  ctx: ComponentCallCtx,\n  totpId: string,\n  lastUsedAt: number,\n): Promise<void> {\n  await ctx.runMutation(ctx.auth.config.component.public.totpUpdateLastUsed, {\n    totpId,\n    lastUsedAt,\n  });\n}\n\n// -- Passkey queries / mutations --\n\nexport async function queryPasskeysByUserId(\n  ctx: ComponentCallCtx,\n  userId: string,\n): Promise<PasskeyDoc[]> {\n  return (await ctx.runQuery(\n    ctx.auth.config.component.public.passkeyListByUserId,\n    { userId },\n  )) as PasskeyDoc[];\n}\n\nexport async function queryPasskeyByCredentialId(\n  ctx: ComponentCallCtx,\n  credentialId: string,\n): Promise<PasskeyDoc | null> {\n  return (await ctx.runQuery(\n    ctx.auth.config.component.public.passkeyGetByCredentialId,\n    { credentialId },\n  )) as PasskeyDoc | null;\n}\n\nexport async function mutatePasskeyInsert(\n  ctx: ComponentCallCtx,\n  args: {\n    userId: string;\n    credentialId: string;\n    publicKey: ArrayBuffer | ArrayBufferLike;\n    algorithm: number;\n    counter: number;\n    transports?: string[];\n    deviceType: string;\n    backedUp: boolean;\n    name?: string;\n    createdAt: number;\n  },\n): Promise<string> {\n  return (await ctx.runMutation(\n    ctx.auth.config.component.public.passkeyInsert,\n    args,\n  )) as string;\n}\n\nexport async function mutatePasskeyUpdateCounter(\n  ctx: ComponentCallCtx,\n  passkeyId: string,\n  counter: number,\n  lastUsedAt: number,\n): Promise<void> {\n  await ctx.runMutation(ctx.auth.config.component.public.passkeyUpdateCounter, {\n    passkeyId,\n    counter,\n    lastUsedAt,\n  });\n}\n\n// -- Key queries / mutations --\n\nexport async function mutateKeyInsert(\n  ctx: ComponentCallCtx,\n  args: {\n    userId: string;\n    prefix: string;\n    hashedKey: string;\n    name: string;\n    scopes: Array<{ resource: string; actions: string[] }>;\n    rateLimit?: { maxRequests: number; windowMs: number };\n    expiresAt?: number;\n  },\n): Promise<string> {\n  return (await ctx.runMutation(\n    ctx.auth.config.component.public.keyInsert,\n    args,\n  )) as string;\n}\n\nexport async function queryKeysByUserId(\n  ctx: ComponentCallCtx,\n  userId: string,\n): Promise<KeyDoc[]> {\n  const items: KeyDoc[] = [];\n  let cursor: string | null = null;\n  do {\n    const page = (await ctx.runQuery(ctx.auth.config.component.public.keyList, {\n      where: { userId },\n      limit: 100,\n      cursor,\n    })) as {\n      items: KeyDoc[];\n      nextCursor: string | null;\n    };\n    items.push(...page.items);\n    cursor = page.nextCursor;\n  } while (cursor !== null);\n  return items;\n}\n\nexport async function queryKeyById(\n  ctx: ComponentCallCtx,\n  keyId: string,\n): Promise<KeyDoc | null> {\n  return (await ctx.runQuery(ctx.auth.config.component.public.keyGetById, {\n    keyId,\n  })) as KeyDoc | null;\n}\n\nexport async function mutateKeyPatch(\n  ctx: ComponentCallCtx,\n  keyId: string,\n  data: Record<string, unknown>,\n): Promise<void> {\n  await ctx.runMutation(ctx.auth.config.component.public.keyPatch, {\n    keyId,\n    data,\n  });\n}\n\nexport async function mutateKeyDelete(\n  ctx: ComponentCallCtx,\n  keyId: string,\n): Promise<void> {\n  await ctx.runMutation(ctx.auth.config.component.public.keyDelete, { keyId });\n}\n\n// -- Device authorization queries / mutations --\n\nexport type DeviceDoc = Infer<typeof vDeviceCodeDoc>;\n\nexport async function mutateDeviceInsert(\n  ctx: ComponentCallCtx,\n  args: {\n    deviceCodeHash: string;\n    userCode: string;\n    expiresAt: number;\n    interval: number;\n    status: \"pending\" | \"authorized\" | \"denied\";\n  },\n): Promise<string> {\n  return (await ctx.runMutation(\n    ctx.auth.config.component.public.deviceInsert,\n    args,\n  )) as string;\n}\n\nexport async function queryDeviceByCodeHash(\n  ctx: ComponentCallCtx,\n  deviceCodeHash: string,\n): Promise<DeviceDoc | null> {\n  return (await ctx.runQuery(\n    ctx.auth.config.component.public.deviceGetByCodeHash,\n    { deviceCodeHash },\n  )) as DeviceDoc | null;\n}\n\nexport async function queryDeviceByUserCode(\n  ctx: ComponentCallCtx,\n  userCode: string,\n): Promise<DeviceDoc | null> {\n  return (await ctx.runQuery(\n    ctx.auth.config.component.public.deviceGetByUserCode,\n    { userCode },\n  )) as DeviceDoc | null;\n}\n\nexport async function mutateDeviceAuthorize(\n  ctx: ComponentCallCtx,\n  deviceId: string,\n  userId: string,\n  sessionId: string,\n): Promise<void> {\n  await ctx.runMutation(ctx.auth.config.component.public.deviceAuthorize, {\n    deviceId,\n    userId,\n    sessionId,\n  });\n}\n\nexport async function mutateDeviceUpdateLastPolled(\n  ctx: ComponentCallCtx,\n  deviceId: string,\n  lastPolledAt: number,\n): Promise<void> {\n  await ctx.runMutation(\n    ctx.auth.config.component.public.deviceUpdateLastPolled,\n    { deviceId, lastPolledAt },\n  );\n}\n\nexport async function mutateDeviceDelete(\n  ctx: ComponentCallCtx,\n  deviceId: string,\n): Promise<void> {\n  await ctx.runMutation(ctx.auth.config.component.public.deviceDelete, {\n    deviceId,\n  });\n}\n"],"mappings":";AAgnDA,eAAsB,cACpB,KACA,QACuC;AACvC,QAAQ,MAAM,IAAI,SAAS,IAAI,KAAK,OAAO,UAAU,OAAO,aAAa,EACvE,QACD,CAAC;;AAGJ,eAAsB,yBACpB,KACA,OACuC;AACvC,QAAQ,MAAM,IAAI,SAChB,IAAI,KAAK,OAAO,UAAU,OAAO,yBACjC,EAAE,OAAO,CACV;;AAKH,eAAsB,kBACpB,KACA,YAC6B;AAC7B,QAAQ,MAAM,IAAI,SAAS,IAAI,KAAK,OAAO,UAAU,OAAO,iBAAiB,EAC3E,YACD,CAAC;;AAGJ,eAAsB,qBACpB,KACA,YACe;AACf,OAAM,IAAI,YAAY,IAAI,KAAK,OAAO,UAAU,OAAO,gBAAgB,EACrE,YACD,CAAC;;AAKJ,eAAsB,cACpB,KACA,QACyB;AACzB,QAAQ,MAAM,IAAI,SAAS,IAAI,KAAK,OAAO,UAAU,OAAO,aAAa,EACvE,QACD,CAAC;;AAGJ,eAAsB,0BACpB,KACA,QACyB;AACzB,QAAQ,MAAM,IAAI,SAChB,IAAI,KAAK,OAAO,UAAU,OAAO,yBACjC,EAAE,QAAQ,CACX;;AAGH,eAAsB,iBACpB,KACA,MASiB;AACjB,QAAQ,MAAM,IAAI,YAChB,IAAI,KAAK,OAAO,UAAU,OAAO,YACjC,KACD;;AAGH,eAAsB,uBACpB,KACA,QACA,YACe;AACf,OAAM,IAAI,YAAY,IAAI,KAAK,OAAO,UAAU,OAAO,kBAAkB;EACvE;EACA;EACD,CAAC;;AAGJ,eAAsB,yBACpB,KACA,QACA,YACe;AACf,OAAM,IAAI,YAAY,IAAI,KAAK,OAAO,UAAU,OAAO,oBAAoB;EACzE;EACA;EACD,CAAC;;AAKJ,eAAsB,sBACpB,KACA,QACuB;AACvB,QAAQ,MAAM,IAAI,SAChB,IAAI,KAAK,OAAO,UAAU,OAAO,qBACjC,EAAE,QAAQ,CACX;;AAGH,eAAsB,2BACpB,KACA,cAC4B;AAC5B,QAAQ,MAAM,IAAI,SAChB,IAAI,KAAK,OAAO,UAAU,OAAO,0BACjC,EAAE,cAAc,CACjB;;AAGH,eAAsB,oBACpB,KACA,MAYiB;AACjB,QAAQ,MAAM,IAAI,YAChB,IAAI,KAAK,OAAO,UAAU,OAAO,eACjC,KACD;;AAGH,eAAsB,2BACpB,KACA,WACA,SACA,YACe;AACf,OAAM,IAAI,YAAY,IAAI,KAAK,OAAO,UAAU,OAAO,sBAAsB;EAC3E;EACA;EACA;EACD,CAAC;;AA2EJ,eAAsB,mBACpB,KACA,MAOiB;AACjB,QAAQ,MAAM,IAAI,YAChB,IAAI,KAAK,OAAO,UAAU,OAAO,cACjC,KACD;;AAGH,eAAsB,sBACpB,KACA,gBAC2B;AAC3B,QAAQ,MAAM,IAAI,SAChB,IAAI,KAAK,OAAO,UAAU,OAAO,qBACjC,EAAE,gBAAgB,CACnB;;AAGH,eAAsB,sBACpB,KACA,UAC2B;AAC3B,QAAQ,MAAM,IAAI,SAChB,IAAI,KAAK,OAAO,UAAU,OAAO,qBACjC,EAAE,UAAU,CACb;;AAGH,eAAsB,sBACpB,KACA,UACA,QACA,WACe;AACf,OAAM,IAAI,YAAY,IAAI,KAAK,OAAO,UAAU,OAAO,iBAAiB;EACtE;EACA;EACA;EACD,CAAC;;AAGJ,eAAsB,6BACpB,KACA,UACA,cACe;AACf,OAAM,IAAI,YACR,IAAI,KAAK,OAAO,UAAU,OAAO,wBACjC;EAAE;EAAU;EAAc,CAC3B;;AAGH,eAAsB,mBACpB,KACA,UACe;AACf,OAAM,IAAI,YAAY,IAAI,KAAK,OAAO,UAAU,OAAO,cAAc,EACnE,UACD,CAAC"}

package/dist/component/server/{implementation/users.js → users.js}

@@ -1,16 +1,26 @@
-import { throwAuthError } from "../errors.js";
+import { AuthError } from "./authError.js";
 import { LOG_LEVELS, logWithLevel } from "./utils.js";
 import { authDb } from "./db.js";
+import { Fx } from "@robelest/fx";
 
-//#region src/server/implementation/users.ts
-async function upsertUserAndAccount(ctx, sessionId, account, args, config) {
-	const userId = await defaultCreateOrUpdateUser(ctx, sessionId, "existingAccount" in account ? account.existingAccount : null, args, config);
+//#region src/server/users.ts
+function mergeExtend(existing, incoming) {
+	if (!incoming) return;
+	const existingRecord = typeof existing === "object" && existing !== null && !Array.isArray(existing) ? existing : void 0;
+	return existingRecord ? {
+		...existingRecord,
+		...incoming
+	} : incoming;
+}
+/** @internal */
+async function upsertUserAndAccount(ctx, sessionId, account, args, config, opts) {
+	const userId = await defaultCreateOrUpdateUser(ctx, sessionId, "existingAccount" in account ? account.existingAccount : null, args, config, opts?.existingUserId ?? null);
 	return {
 		userId,
 		accountId: await createOrUpdateAccount(ctx, userId, account, args, config)
 	};
 }
-async function defaultCreateOrUpdateUser(ctx, existingSessionId, existingAccount, args, config) {
+async function defaultCreateOrUpdateUser(ctx, existingSessionId, existingAccount, args, config, existingUserIdOverride) {
 	logWithLevel(LOG_LEVELS.DEBUG, "defaultCreateOrUpdateUser args:", {
 		existingAccountId: existingAccount?._id,
 		existingSessionId,
@@ -25,28 +35,38 @@ async function defaultCreateOrUpdateUser(ctx, existingSessionId, existingAccount
 			...args
 		});
 	}
-	const { provider, profile: { emailVerified: profileEmailVerified, phoneVerified: profilePhoneVerified, ...profile } } = args;
-	const emailVerified = profileEmailVerified ?? (provider.type === "oauth" && provider.allowDangerousEmailAccountLinking !== false);
+	const { provider, profile: { id: _profileId, emailVerified: profileEmailVerified, phoneVerified: profilePhoneVerified, ...profile } } = args;
+	const emailVerified = profileEmailVerified ?? (provider.type === "oauth" && provider.accountLinking !== "none");
 	const phoneVerified = profilePhoneVerified ?? false;
 	const shouldLinkViaEmail = args.shouldLinkViaEmail || emailVerified || provider.type === "email";
 	const shouldLinkViaPhone = args.shouldLinkViaPhone || phoneVerified || provider.type === "phone";
-	let userId = existingUserId;
+	let userId = existingUserId ?? existingUserIdOverride;
 	if (existingUserId === null) {
 		const existingUserWithVerifiedEmailId = typeof profile.email === "string" && shouldLinkViaEmail ? (await uniqueUserWithVerifiedEmail(ctx, profile.email, config))?._id ?? null : null;
 		const existingUserWithVerifiedPhoneId = typeof profile.phone === "string" && shouldLinkViaPhone ? (await uniqueUserWithVerifiedPhone(ctx, profile.phone, config))?._id ?? null : null;
-		if (existingUserWithVerifiedEmailId !== null && existingUserWithVerifiedPhoneId !== null) {
-			logWithLevel(LOG_LEVELS.DEBUG, `Found existing email and phone verified users, so not linking: email: ${existingUserWithVerifiedEmailId}, phone: ${existingUserWithVerifiedPhoneId}`);
-			userId = null;
-		} else if (existingUserWithVerifiedEmailId !== null) {
-			logWithLevel(LOG_LEVELS.DEBUG, `Found existing email verified user, linking: ${existingUserWithVerifiedEmailId}`);
-			userId = existingUserWithVerifiedEmailId;
-		} else if (existingUserWithVerifiedPhoneId !== null) {
-			logWithLevel(LOG_LEVELS.DEBUG, `Found existing phone verified user, linking: ${existingUserWithVerifiedPhoneId}`);
-			userId = existingUserWithVerifiedPhoneId;
-		} else {
-			logWithLevel(LOG_LEVELS.DEBUG, "No existing verified users found, creating new user");
-			userId = null;
-		}
+		const linkDispatch = {
+			tag: existingUserWithVerifiedEmailId !== null && existingUserWithVerifiedPhoneId !== null ? "both" : existingUserWithVerifiedEmailId !== null ? "email" : existingUserWithVerifiedPhoneId !== null ? "phone" : "none",
+			existingUserWithVerifiedEmailId,
+			existingUserWithVerifiedPhoneId
+		};
+		userId = await Fx.run({
+			both: () => Fx.sync(() => {
+				logWithLevel(LOG_LEVELS.DEBUG, `Found existing email and phone verified users, so not linking: email: ${linkDispatch.existingUserWithVerifiedEmailId}, phone: ${linkDispatch.existingUserWithVerifiedPhoneId}`);
+				return null;
+			}),
+			email: () => Fx.sync(() => {
+				logWithLevel(LOG_LEVELS.DEBUG, `Found existing email verified user, linking: ${linkDispatch.existingUserWithVerifiedEmailId}`);
+				return linkDispatch.existingUserWithVerifiedEmailId;
+			}),
+			phone: () => Fx.sync(() => {
+				logWithLevel(LOG_LEVELS.DEBUG, `Found existing phone verified user, linking: ${linkDispatch.existingUserWithVerifiedPhoneId}`);
+				return linkDispatch.existingUserWithVerifiedPhoneId;
+			}),
+			none: () => Fx.sync(() => {
+				logWithLevel(LOG_LEVELS.DEBUG, "No existing verified users found, creating new user");
+				return null;
+			})
+		}[linkDispatch.tag]());
 	}
 	const userData = {
 		...emailVerified ? { emailVerificationTime: Date.now() } : null,
@@ -54,11 +74,10 @@ async function defaultCreateOrUpdateUser(ctx, existingSessionId, existingAccount
 		...profile
 	};
 	const existingOrLinkedUserId = userId;
-	if (userId !== null) try {
-		await db.users.patch(userId, userData);
-	} catch (error) {
-		throwAuthError("USER_UPDATE_FAILED", `Could not update user document with ID \`${userId}\`, either the user has been deleted but their account has not, or the profile data doesn't match the \`users\` table schema: ${error.message}`);
-	}
+	if (userId !== null) await Fx.run(Fx.from({
+		ok: () => db.users.patch(userId, userData),
+		err: (error) => new AuthError("USER_UPDATE_FAILED", `Could not update user document with ID \`${userId}\`, either the user has been deleted but their account has not, or the profile data doesn't match the \`users\` table schema: ${error.message}`)
+	}).pipe(Fx.recover((e) => Fx.fatal(e.toConvexError()))));
 	else userId = await db.users.insert(userData);
 	const afterUserCreatedOrUpdated = config.callbacks?.afterUserCreatedOrUpdated;
 	if (afterUserCreatedOrUpdated !== void 0) {
@@ -79,23 +98,23 @@ async function uniqueUserWithVerifiedPhone(ctx, phone, config) {
 }
 async function createOrUpdateAccount(ctx, userId, account, args, config) {
 	const db = authDb(ctx, config);
+	const mergedExtend = "existingAccount" in account ? mergeExtend(account.existingAccount.extend, args.accountExtend) : args.accountExtend;
 	const accountId = "existingAccount" in account ? account.existingAccount._id : await db.accounts.create({
 		userId,
 		provider: args.provider.id,
 		providerAccountId: account.providerAccountId,
-		secret: account.secret
+		secret: account.secret,
+		extend: mergedExtend
 	});
 	if ("existingAccount" in account && account.existingAccount.userId !== userId) await db.accounts.patch(accountId, { userId });
-	if (args.profile.emailVerified) await db.accounts.patch(accountId, { emailVerified: args.profile.email });
-	if (args.profile.phoneVerified) await db.accounts.patch(accountId, { phoneVerified: args.profile.phone });
+	const accountPatchData = {};
+	if (mergedExtend) accountPatchData.extend = mergedExtend;
+	if (args.profile.emailVerified) accountPatchData.emailVerified = args.profile.email;
+	if (args.profile.phoneVerified) accountPatchData.phoneVerified = args.profile.phone;
+	if (Object.keys(accountPatchData).length > 0) await db.accounts.patch(accountId, accountPatchData);
 	return accountId;
 }
-async function getAccountOrThrow(ctx, existingAccountId, config) {
-	const existingAccount = await authDb(ctx, config).accounts.getById(existingAccountId);
-	if (existingAccount === null) throwAuthError("ACCOUNT_NOT_FOUND", `Expected an account to exist for ID "${existingAccountId}"`);
-	return existingAccount;
-}
 
 //#endregion
-export { getAccountOrThrow, upsertUserAndAccount };
+export { upsertUserAndAccount };
 //# sourceMappingURL=users.js.map

package/dist/component/server/users.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.js","names":[],"sources":["../../../src/server/users.ts"],"sourcesContent":["import { Fx } from \"@robelest/fx\";\nimport { GenericId } from \"convex/values\";\n\nimport { authDb } from \"./db\";\nimport { AuthError } from \"./authError\";\nimport { Doc, MutationCtx } from \"./types\";\nimport { AuthProviderMaterializedConfig, ConvexAuthConfig } from \"./types\";\nimport { LOG_LEVELS, logWithLevel } from \"./utils\";\n\ntype CreateOrUpdateUserArgs = {\n  type: \"oauth\" | \"credentials\" | \"email\" | \"phone\" | \"verification\";\n  provider: AuthProviderMaterializedConfig;\n  profile: Record<string, unknown> & {\n    email?: string;\n    phone?: string;\n    emailVerified?: boolean;\n    phoneVerified?: boolean;\n  };\n  accountExtend?: Record<string, unknown>;\n  shouldLinkViaEmail?: boolean;\n  shouldLinkViaPhone?: boolean;\n};\n\nfunction mergeExtend(\n  existing: unknown,\n  incoming: Record<string, unknown> | undefined,\n) {\n  if (!incoming) {\n    return undefined;\n  }\n  const existingRecord =\n    typeof existing === \"object\" &&\n    existing !== null &&\n    !Array.isArray(existing)\n      ? (existing as Record<string, unknown>)\n      : undefined;\n  return existingRecord ? { ...existingRecord, ...incoming } : incoming;\n}\n\n/** @internal */\nexport async function upsertUserAndAccount(\n  ctx: MutationCtx,\n  sessionId: GenericId<\"Session\"> | null,\n  account:\n    | { existingAccount: Doc<\"Account\"> }\n    | {\n        providerAccountId: string;\n        secret?: string;\n      },\n  args: CreateOrUpdateUserArgs,\n  config: ConvexAuthConfig,\n  opts?: { existingUserId?: GenericId<\"User\"> },\n): Promise<{\n  userId: GenericId<\"User\">;\n  accountId: GenericId<\"Account\">;\n}> {\n  const userId = await defaultCreateOrUpdateUser(\n    ctx,\n    sessionId,\n    \"existingAccount\" in account ? account.existingAccount : null,\n    args,\n    config,\n    opts?.existingUserId ?? null,\n  );\n  const accountId = await createOrUpdateAccount(\n    ctx,\n    userId,\n    account,\n    args,\n    config,\n  );\n  return { userId, accountId };\n}\n\nasync function defaultCreateOrUpdateUser(\n  ctx: MutationCtx,\n  existingSessionId: GenericId<\"Session\"> | null,\n  existingAccount: Doc<\"Account\"> | null,\n  args: CreateOrUpdateUserArgs,\n  config: ConvexAuthConfig,\n  existingUserIdOverride: GenericId<\"User\"> | null,\n) {\n  logWithLevel(LOG_LEVELS.DEBUG, \"defaultCreateOrUpdateUser args:\", {\n    existingAccountId: existingAccount?._id,\n    existingSessionId,\n    args,\n  });\n  const existingUserId = existingAccount?.userId ?? null;\n  const db = authDb(ctx, config);\n  if (config.callbacks?.createOrUpdateUser !== undefined) {\n    logWithLevel(LOG_LEVELS.DEBUG, \"Using custom createOrUpdateUser callback\");\n    return await config.callbacks.createOrUpdateUser(ctx, {\n      existingUserId,\n      ...args,\n    });\n  }\n\n  const {\n    provider,\n    profile: {\n      id: _profileId,\n      emailVerified: profileEmailVerified,\n      phoneVerified: profilePhoneVerified,\n      ...profile\n    },\n  } = args;\n  const emailVerified =\n    profileEmailVerified ??\n    (provider.type === \"oauth\" && provider.accountLinking !== \"none\");\n  const phoneVerified = profilePhoneVerified ?? false;\n  const shouldLinkViaEmail =\n    args.shouldLinkViaEmail || emailVerified || provider.type === \"email\";\n  const shouldLinkViaPhone =\n    args.shouldLinkViaPhone || phoneVerified || provider.type === \"phone\";\n\n  let userId = existingUserId ?? existingUserIdOverride;\n  if (existingUserId === null) {\n    const existingUserWithVerifiedEmailId =\n      typeof profile.email === \"string\" && shouldLinkViaEmail\n        ? ((await uniqueUserWithVerifiedEmail(ctx, profile.email, config))\n            ?._id ?? null)\n        : null;\n\n    const existingUserWithVerifiedPhoneId =\n      typeof profile.phone === \"string\" && shouldLinkViaPhone\n        ? ((await uniqueUserWithVerifiedPhone(ctx, profile.phone, config))\n            ?._id ?? null)\n        : null;\n    const linkDispatch = {\n      tag:\n        existingUserWithVerifiedEmailId !== null &&\n        existingUserWithVerifiedPhoneId !== null\n          ? \"both\"\n          : existingUserWithVerifiedEmailId !== null\n            ? \"email\"\n            : existingUserWithVerifiedPhoneId !== null\n              ? \"phone\"\n              : \"none\",\n      existingUserWithVerifiedEmailId,\n      existingUserWithVerifiedPhoneId,\n    } as const;\n\n    const linkHandlers = {\n      both: () =>\n        Fx.sync(() => {\n          logWithLevel(\n            LOG_LEVELS.DEBUG,\n            `Found existing email and phone verified users, so not linking: email: ${linkDispatch.existingUserWithVerifiedEmailId}, phone: ${linkDispatch.existingUserWithVerifiedPhoneId}`,\n          );\n          return null;\n        }),\n      email: () =>\n        Fx.sync(() => {\n          logWithLevel(\n            LOG_LEVELS.DEBUG,\n            `Found existing email verified user, linking: ${linkDispatch.existingUserWithVerifiedEmailId}`,\n          );\n          return linkDispatch.existingUserWithVerifiedEmailId;\n        }),\n      phone: () =>\n        Fx.sync(() => {\n          logWithLevel(\n            LOG_LEVELS.DEBUG,\n            `Found existing phone verified user, linking: ${linkDispatch.existingUserWithVerifiedPhoneId}`,\n          );\n          return linkDispatch.existingUserWithVerifiedPhoneId;\n        }),\n      none: () =>\n        Fx.sync(() => {\n          logWithLevel(\n            LOG_LEVELS.DEBUG,\n            \"No existing verified users found, creating new user\",\n          );\n          return null;\n        }),\n    } as const;\n\n    userId = await Fx.run(linkHandlers[linkDispatch.tag]());\n  }\n  const userData = {\n    ...(emailVerified ? { emailVerificationTime: Date.now() } : null),\n    ...(phoneVerified ? { phoneVerificationTime: Date.now() } : null),\n    ...profile,\n  };\n  const existingOrLinkedUserId = userId;\n  if (userId !== null) {\n    await Fx.run(\n      Fx.from({\n        ok: () => db.users.patch(userId!, userData),\n        err: (error) =>\n          new AuthError(\n            \"USER_UPDATE_FAILED\",\n            `Could not update user document with ID \\`${userId}\\`, ` +\n              `either the user has been deleted but their account has not, ` +\n              `or the profile data doesn't match the \\`users\\` table schema: ` +\n              `${(error as Error).message}`,\n          ),\n      }).pipe(Fx.recover((e) => Fx.fatal(e.toConvexError()))),\n    );\n  } else {\n    userId = (await db.users.insert(userData)) as GenericId<\"User\">;\n  }\n  const afterUserCreatedOrUpdated = config.callbacks?.afterUserCreatedOrUpdated;\n  if (afterUserCreatedOrUpdated !== undefined) {\n    logWithLevel(\n      LOG_LEVELS.DEBUG,\n      \"Calling custom afterUserCreatedOrUpdated callback\",\n    );\n    await afterUserCreatedOrUpdated(ctx, {\n      userId,\n      existingUserId: existingOrLinkedUserId,\n      ...args,\n    });\n  } else {\n    logWithLevel(\n      LOG_LEVELS.DEBUG,\n      \"No custom afterUserCreatedOrUpdated callback, skipping\",\n    );\n  }\n  return userId;\n}\n\nasync function uniqueUserWithVerifiedEmail(\n  ctx: MutationCtx,\n  email: string,\n  config: ConvexAuthConfig,\n) {\n  const db = authDb(ctx, config);\n  return (await db.users.findByVerifiedEmail(email)) as Doc<\"User\"> | null;\n}\n\nasync function uniqueUserWithVerifiedPhone(\n  ctx: MutationCtx,\n  phone: string,\n  config: ConvexAuthConfig,\n) {\n  const db = authDb(ctx, config);\n  return (await db.users.findByVerifiedPhone(phone)) as Doc<\"User\"> | null;\n}\n\nasync function createOrUpdateAccount(\n  ctx: MutationCtx,\n  userId: GenericId<\"User\">,\n  account:\n    | { existingAccount: Doc<\"Account\"> }\n    | {\n        providerAccountId: string;\n        secret?: string;\n      },\n  args: CreateOrUpdateUserArgs,\n  config: ConvexAuthConfig,\n) {\n  const db = authDb(ctx, config);\n  const mergedExtend =\n    \"existingAccount\" in account\n      ? mergeExtend(account.existingAccount.extend, args.accountExtend)\n      : args.accountExtend;\n  const accountId =\n    \"existingAccount\" in account\n      ? account.existingAccount._id\n      : ((await db.accounts.create({\n          userId,\n          provider: args.provider.id,\n          providerAccountId: account.providerAccountId,\n          secret: account.secret,\n          extend: mergedExtend,\n        })) as GenericId<\"Account\">);\n  // This is never used with the default `createOrUpdateUser` implementation,\n  // but it is used for manual linking via custom `createOrUpdateUser`:\n  if (\n    \"existingAccount\" in account &&\n    account.existingAccount.userId !== userId\n  ) {\n    await db.accounts.patch(accountId, { userId });\n  }\n  const accountPatchData: Record<string, unknown> = {};\n  if (mergedExtend) {\n    accountPatchData.extend = mergedExtend;\n  }\n  if (args.profile.emailVerified) {\n    accountPatchData.emailVerified = args.profile.email;\n  }\n  if (args.profile.phoneVerified) {\n    accountPatchData.phoneVerified = args.profile.phone;\n  }\n  if (Object.keys(accountPatchData).length > 0) {\n    await db.accounts.patch(accountId, accountPatchData);\n  }\n  return accountId;\n}\n"],"mappings":";;;;;;AAuBA,SAAS,YACP,UACA,UACA;AACA,KAAI,CAAC,SACH;CAEF,MAAM,iBACJ,OAAO,aAAa,YACpB,aAAa,QACb,CAAC,MAAM,QAAQ,SAAS,GACnB,WACD;AACN,QAAO,iBAAiB;EAAE,GAAG;EAAgB,GAAG;EAAU,GAAG;;;AAI/D,eAAsB,qBACpB,KACA,WACA,SAMA,MACA,QACA,MAIC;CACD,MAAM,SAAS,MAAM,0BACnB,KACA,WACA,qBAAqB,UAAU,QAAQ,kBAAkB,MACzD,MACA,QACA,MAAM,kBAAkB,KACzB;AAQD,QAAO;EAAE;EAAQ,WAPC,MAAM,sBACtB,KACA,QACA,SACA,MACA,OACD;EAC2B;;AAG9B,eAAe,0BACb,KACA,mBACA,iBACA,MACA,QACA,wBACA;AACA,cAAa,WAAW,OAAO,mCAAmC;EAChE,mBAAmB,iBAAiB;EACpC;EACA;EACD,CAAC;CACF,MAAM,iBAAiB,iBAAiB,UAAU;CAClD,MAAM,KAAK,OAAO,KAAK,OAAO;AAC9B,KAAI,OAAO,WAAW,uBAAuB,QAAW;AACtD,eAAa,WAAW,OAAO,2CAA2C;AAC1E,SAAO,MAAM,OAAO,UAAU,mBAAmB,KAAK;GACpD;GACA,GAAG;GACJ,CAAC;;CAGJ,MAAM,EACJ,UACA,SAAS,EACP,IAAI,YACJ,eAAe,sBACf,eAAe,sBACf,GAAG,cAEH;CACJ,MAAM,gBACJ,yBACC,SAAS,SAAS,WAAW,SAAS,mBAAmB;CAC5D,MAAM,gBAAgB,wBAAwB;CAC9C,MAAM,qBACJ,KAAK,sBAAsB,iBAAiB,SAAS,SAAS;CAChE,MAAM,qBACJ,KAAK,sBAAsB,iBAAiB,SAAS,SAAS;CAEhE,IAAI,SAAS,kBAAkB;AAC/B,KAAI,mBAAmB,MAAM;EAC3B,MAAM,kCACJ,OAAO,QAAQ,UAAU,YAAY,sBAC/B,MAAM,4BAA4B,KAAK,QAAQ,OAAO,OAAO,GAC3D,OAAO,OACX;EAEN,MAAM,kCACJ,OAAO,QAAQ,UAAU,YAAY,sBAC/B,MAAM,4BAA4B,KAAK,QAAQ,OAAO,OAAO,GAC3D,OAAO,OACX;EACN,MAAM,eAAe;GACnB,KACE,oCAAoC,QACpC,oCAAoC,OAChC,SACA,oCAAoC,OAClC,UACA,oCAAoC,OAClC,UACA;GACV;GACA;GACD;AAqCD,WAAS,MAAM,GAAG,IAnCG;GACnB,YACE,GAAG,WAAW;AACZ,iBACE,WAAW,OACX,yEAAyE,aAAa,gCAAgC,WAAW,aAAa,kCAC/I;AACD,WAAO;KACP;GACJ,aACE,GAAG,WAAW;AACZ,iBACE,WAAW,OACX,gDAAgD,aAAa,kCAC9D;AACD,WAAO,aAAa;KACpB;GACJ,aACE,GAAG,WAAW;AACZ,iBACE,WAAW,OACX,gDAAgD,aAAa,kCAC9D;AACD,WAAO,aAAa;KACpB;GACJ,YACE,GAAG,WAAW;AACZ,iBACE,WAAW,OACX,sDACD;AACD,WAAO;KACP;GACL,CAEkC,aAAa,MAAM,CAAC;;CAEzD,MAAM,WAAW;EACf,GAAI,gBAAgB,EAAE,uBAAuB,KAAK,KAAK,EAAE,GAAG;EAC5D,GAAI,gBAAgB,EAAE,uBAAuB,KAAK,KAAK,EAAE,GAAG;EAC5D,GAAG;EACJ;CACD,MAAM,yBAAyB;AAC/B,KAAI,WAAW,KACb,OAAM,GAAG,IACP,GAAG,KAAK;EACN,UAAU,GAAG,MAAM,MAAM,QAAS,SAAS;EAC3C,MAAM,UACJ,IAAI,UACF,sBACA,4CAA4C,OAAO,gIAG7C,MAAgB,UACvB;EACJ,CAAC,CAAC,KAAK,GAAG,SAAS,MAAM,GAAG,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,CACxD;KAED,UAAU,MAAM,GAAG,MAAM,OAAO,SAAS;CAE3C,MAAM,4BAA4B,OAAO,WAAW;AACpD,KAAI,8BAA8B,QAAW;AAC3C,eACE,WAAW,OACX,oDACD;AACD,QAAM,0BAA0B,KAAK;GACnC;GACA,gBAAgB;GAChB,GAAG;GACJ,CAAC;OAEF,cACE,WAAW,OACX,yDACD;AAEH,QAAO;;AAGT,eAAe,4BACb,KACA,OACA,QACA;AAEA,QAAQ,MADG,OAAO,KAAK,OAAO,CACb,MAAM,oBAAoB,MAAM;;AAGnD,eAAe,4BACb,KACA,OACA,QACA;AAEA,QAAQ,MADG,OAAO,KAAK,OAAO,CACb,MAAM,oBAAoB,MAAM;;AAGnD,eAAe,sBACb,KACA,QACA,SAMA,MACA,QACA;CACA,MAAM,KAAK,OAAO,KAAK,OAAO;CAC9B,MAAM,eACJ,qBAAqB,UACjB,YAAY,QAAQ,gBAAgB,QAAQ,KAAK,cAAc,GAC/D,KAAK;CACX,MAAM,YACJ,qBAAqB,UACjB,QAAQ,gBAAgB,MACtB,MAAM,GAAG,SAAS,OAAO;EACzB;EACA,UAAU,KAAK,SAAS;EACxB,mBAAmB,QAAQ;EAC3B,QAAQ,QAAQ;EAChB,QAAQ;EACT,CAAC;AAGR,KACE,qBAAqB,WACrB,QAAQ,gBAAgB,WAAW,OAEnC,OAAM,GAAG,SAAS,MAAM,WAAW,EAAE,QAAQ,CAAC;CAEhD,MAAM,mBAA4C,EAAE;AACpD,KAAI,aACF,kBAAiB,SAAS;AAE5B,KAAI,KAAK,QAAQ,cACf,kBAAiB,gBAAgB,KAAK,QAAQ;AAEhD,KAAI,KAAK,QAAQ,cACf,kBAAiB,gBAAgB,KAAK,QAAQ;AAEhD,KAAI,OAAO,KAAK,iBAAiB,CAAC,SAAS,EACzC,OAAM,GAAG,SAAS,MAAM,WAAW,iBAAiB;AAEtD,QAAO"}

package/dist/component/server/utils.js

@@ -1,15 +1,121 @@
-import { throwAuthError } from "./errors.js";
+import { AuthError } from "./authError.js";
+import { generateRandomString } from "@oslojs/crypto/random";
+import { sha256 } from "@oslojs/crypto/sha2";
+import { decodeBase64urlIgnorePadding, encodeBase64urlNoPadding, encodeHexLowerCase } from "@oslojs/encoding";
 
 //#region src/server/utils.ts
+/**
+* Require an environment variable to be set, throwing at config time if missing.
+*
+* Uses `AuthError.toConvexError()` directly since this is a synchronous guard
+* called inline in many expressions — not suitable for Fx pipeline wrapping.
+*/
+/** @internal */
 function requireEnv(name) {
 	const value = process.env[name];
-	if (value === void 0) throwAuthError("MISSING_ENV_VAR", `Missing environment variable \`${name}\``, { variable: name });
+	if (value === void 0) throw new AuthError("MISSING_ENV_VAR", `Missing environment variable \`${name}\``, { variable: name }).toConvexError();
 	return value;
 }
+/** @internal */
 function isLocalHost(host) {
-	return /(localhost|127\.0\.0\.1):\d+/.test(host ?? "");
+	if (host === void 0) return false;
+	const raw = host.includes("://") ? host : `http://${host}`;
+	let url;
+	try {
+		url = new URL(raw);
+	} catch {
+		return false;
+	}
+	return url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "::1";
+}
+/** @internal */
+const TOKEN_SUB_CLAIM_DIVIDER = "|";
+/** @internal */
+const REFRESH_TOKEN_DIVIDER = "|";
+/** @internal */
+async function sha256$1(input) {
+	return encodeHexLowerCase(sha256(new TextEncoder().encode(input)));
+}
+/** @internal */
+function generateRandomString$1(length, alphabet) {
+	return generateRandomString({ read(bytes) {
+		crypto.getRandomValues(bytes);
+	} }, alphabet, length);
+}
+/** @internal */
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+/** @internal */
+function logError(error) {
+	logWithLevel(LOG_LEVELS.ERROR, error instanceof Error ? error.message + "\n" + error.stack?.replace("\\n", "\n") : error);
+}
+/** @internal */
+const LOG_LEVELS = {
+	ERROR: "ERROR",
+	WARN: "WARN",
+	INFO: "INFO",
+	DEBUG: "DEBUG"
+};
+/** @internal */
+function logWithLevel(level, ...args) {
+	const configuredLogLevel = LOG_LEVELS[process.env.AUTH_LOG_LEVEL ?? "INFO"] ?? "INFO";
+	switch (level) {
+		case "ERROR":
+			console.error(...args);
+			break;
+		case "WARN":
+			if (configuredLogLevel !== "ERROR") console.warn(...args);
+			break;
+		case "INFO":
+			if (configuredLogLevel === "INFO" || configuredLogLevel === "DEBUG") console.info(...args);
+			break;
+		case "DEBUG":
+			if (configuredLogLevel === "DEBUG") console.debug(...args);
+			break;
+	}
+}
+const UNREDACTED_LENGTH = 5;
+/** @internal */
+function maybeRedact(value) {
+	if (value === "") return "";
+	if (process.env.AUTH_LOG_SECRETS !== "true") {
+		if (value.length < UNREDACTED_LENGTH * 2) return "<redacted>";
+		return value.substring(0, UNREDACTED_LENGTH) + "<redacted>" + value.substring(value.length - UNREDACTED_LENGTH);
+	} else return value;
+}
+const SECRET_KEY_ENV = "AUTH_SECRET_ENCRYPTION_KEY";
+const SECRET_IV_LENGTH = 12;
+function toArrayBuffer(bytes) {
+	return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+}
+async function getSecretCryptoKey() {
+	const material = requireEnv(SECRET_KEY_ENV);
+	const rawKey = sha256(new TextEncoder().encode(material));
+	return await crypto.subtle.importKey("raw", toArrayBuffer(rawKey), { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+}
+/** @internal */
+async function encryptSecret(value) {
+	const key = await getSecretCryptoKey();
+	const iv = crypto.getRandomValues(new Uint8Array(SECRET_IV_LENGTH));
+	const encrypted = await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv: toArrayBuffer(iv)
+	}, key, toArrayBuffer(new TextEncoder().encode(value)));
+	return `${encodeBase64urlNoPadding(iv)}.${encodeBase64urlNoPadding(new Uint8Array(encrypted))}`;
+}
+/** @internal */
+async function decryptSecret(ciphertext) {
+	const [ivEncoded, payloadEncoded] = ciphertext.split(".");
+	if (!ivEncoded || !payloadEncoded) throw new AuthError("INVALID_PARAMETERS", "Stored enterprise secret is malformed.").toConvexError();
+	const key = await getSecretCryptoKey();
+	const decrypted = await crypto.subtle.decrypt({
+		name: "AES-GCM",
+		iv: toArrayBuffer(decodeBase64urlIgnorePadding(ivEncoded))
+	}, key, toArrayBuffer(decodeBase64urlIgnorePadding(payloadEncoded)));
+	return new TextDecoder().decode(decrypted);
 }
 
 //#endregion
-export { isLocalHost, requireEnv };
+export { LOG_LEVELS, REFRESH_TOKEN_DIVIDER, TOKEN_SUB_CLAIM_DIVIDER, decryptSecret, encryptSecret, errorMessage, generateRandomString$1 as generateRandomString, isLocalHost, logError, logWithLevel, maybeRedact, requireEnv, sha256$1 as sha256 };
 //# sourceMappingURL=utils.js.map

package/dist/component/server/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","names":[],"sources":["../../../src/server/utils.ts"],"sourcesContent":["import { throwAuthError } from \"./errors\";\n\nexport function requireEnv(name: string) {\n  const value = process.env[name];\n  if (value === undefined) {\n    throwAuthError(\"MISSING_ENV_VAR\", `Missing environment variable \\`${name}\\``, { variable: name });\n  }\n  return value;\n}\n\nexport function isLocalHost(host?: string) {\n  return /(localhost|127\\.0\\.0\\.1):\\d+/.test(\n  host ?? \"\");\n}"],"mappings":";;;AAEA,SAAgB,WAAW,MAAc;CACvC,MAAM,QAAQ,QAAQ,IAAI;AAC1B,KAAI,UAAU,OACZ,gBAAe,mBAAmB,kCAAkC,KAAK,KAAK,EAAE,UAAU,MAAM,CAAC;AAEnG,QAAO;;AAGT,SAAgB,YAAY,MAAe;AACzC,QAAO,+BAA+B,KACtC,QAAQ,GAAG"}
+{"version":3,"file":"utils.js","names":["sha256","rawSha256","generateRandomString","osloGenerateRandomString"],"sources":["../../../src/server/utils.ts"],"sourcesContent":["import {\n  RandomReader,\n  generateRandomString as osloGenerateRandomString,\n} from \"@oslojs/crypto/random\";\nimport { sha256 as rawSha256 } from \"@oslojs/crypto/sha2\";\nimport {\n  decodeBase64urlIgnorePadding,\n  encodeBase64urlNoPadding,\n  encodeHexLowerCase,\n} from \"@oslojs/encoding\";\n\nimport { AuthError } from \"./authError\";\n\n/**\n * Require an environment variable to be set, throwing at config time if missing.\n *\n * Uses `AuthError.toConvexError()` directly since this is a synchronous guard\n * called inline in many expressions — not suitable for Fx pipeline wrapping.\n */\n/** @internal */\nexport function requireEnv(name: string) {\n  const value = process.env[name];\n  if (value === undefined) {\n    throw new AuthError(\n      \"MISSING_ENV_VAR\",\n      `Missing environment variable \\`${name}\\``,\n      { variable: name },\n    ).toConvexError();\n  }\n  return value;\n}\n\n/** @internal */\nexport function isLocalHost(host?: string) {\n  if (host === undefined) {\n    return false;\n  }\n  const raw = host.includes(\"://\") ? host : `http://${host}`;\n  let url: URL;\n  try {\n    url = new URL(raw);\n  } catch {\n    return false;\n  }\n  return (\n    url.hostname === \"localhost\" ||\n    url.hostname === \"127.0.0.1\" ||\n    url.hostname === \"::1\"\n  );\n}\n\n// Internal server utilities (merged from former internalUtils.ts)\n\n/** @internal */\nexport const TOKEN_SUB_CLAIM_DIVIDER = \"|\";\n/** @internal */\nexport const REFRESH_TOKEN_DIVIDER = \"|\";\n\n/** @internal */\nexport async function sha256(input: string) {\n  return encodeHexLowerCase(rawSha256(new TextEncoder().encode(input)));\n}\n\n/** @internal */\nexport function generateRandomString(length: number, alphabet: string) {\n  const random: RandomReader = {\n    read(bytes) {\n      crypto.getRandomValues(bytes as Uint8Array<ArrayBuffer>);\n    },\n  };\n\n  return osloGenerateRandomString(random, alphabet, length);\n}\n\n/** @internal */\nexport function errorMessage(error: unknown) {\n  return error instanceof Error ? error.message : String(error);\n}\n\n/** @internal */\nexport function logError(error: unknown) {\n  logWithLevel(\n    LOG_LEVELS.ERROR,\n    error instanceof Error\n      ? error.message + \"\\n\" + error.stack?.replace(\"\\\\n\", \"\\n\")\n      : error,\n  );\n}\n\n/** @internal */\nexport const LOG_LEVELS = {\n  ERROR: \"ERROR\",\n  WARN: \"WARN\",\n  INFO: \"INFO\",\n  DEBUG: \"DEBUG\",\n} as const;\ntype LogLevel = keyof typeof LOG_LEVELS;\n\n/** @internal */\nexport function logWithLevel(level: LogLevel, ...args: unknown[]) {\n  const configuredLogLevel =\n    LOG_LEVELS[\n      (process.env.AUTH_LOG_LEVEL as LogLevel | undefined) ?? \"INFO\"\n    ] ?? \"INFO\";\n  switch (level) {\n    case \"ERROR\":\n      console.error(...args);\n      break;\n    case \"WARN\":\n      if (configuredLogLevel !== \"ERROR\") {\n        console.warn(...args);\n      }\n      break;\n    case \"INFO\":\n      if (configuredLogLevel === \"INFO\" || configuredLogLevel === \"DEBUG\") {\n        console.info(...args);\n      }\n      break;\n    case \"DEBUG\":\n      if (configuredLogLevel === \"DEBUG\") {\n        console.debug(...args);\n      }\n      break;\n  }\n}\n\nconst UNREDACTED_LENGTH = 5;\n/** @internal */\nexport function maybeRedact(value: string) {\n  if (value === \"\") {\n    return \"\";\n  }\n  const shouldRedact = process.env.AUTH_LOG_SECRETS !== \"true\";\n  if (shouldRedact) {\n    if (value.length < UNREDACTED_LENGTH * 2) {\n      return \"<redacted>\";\n    }\n    return (\n      value.substring(0, UNREDACTED_LENGTH) +\n      \"<redacted>\" +\n      value.substring(value.length - UNREDACTED_LENGTH)\n    );\n  } else {\n    return value;\n  }\n}\n\nconst SECRET_KEY_ENV = \"AUTH_SECRET_ENCRYPTION_KEY\";\nconst SECRET_IV_LENGTH = 12;\n\nfunction toArrayBuffer(bytes: Uint8Array) {\n  return bytes.buffer.slice(\n    bytes.byteOffset,\n    bytes.byteOffset + bytes.byteLength,\n  ) as ArrayBuffer;\n}\n\nasync function getSecretCryptoKey() {\n  const material = requireEnv(SECRET_KEY_ENV);\n  const rawKey = rawSha256(new TextEncoder().encode(material));\n  return await crypto.subtle.importKey(\n    \"raw\",\n    toArrayBuffer(rawKey),\n    { name: \"AES-GCM\" },\n    false,\n    [\"encrypt\", \"decrypt\"],\n  );\n}\n\n/** @internal */\nexport async function encryptSecret(value: string) {\n  const key = await getSecretCryptoKey();\n  const iv = crypto.getRandomValues(new Uint8Array(SECRET_IV_LENGTH));\n  const encrypted = await crypto.subtle.encrypt(\n    { name: \"AES-GCM\", iv: toArrayBuffer(iv) },\n    key,\n    toArrayBuffer(new TextEncoder().encode(value)),\n  );\n  return `${encodeBase64urlNoPadding(iv)}.${encodeBase64urlNoPadding(new Uint8Array(encrypted))}`;\n}\n\n/** @internal */\nexport async function decryptSecret(ciphertext: string) {\n  const [ivEncoded, payloadEncoded] = ciphertext.split(\".\");\n  if (!ivEncoded || !payloadEncoded) {\n    throw new AuthError(\n      \"INVALID_PARAMETERS\",\n      \"Stored enterprise secret is malformed.\",\n    ).toConvexError();\n  }\n  const key = await getSecretCryptoKey();\n  const decrypted = await crypto.subtle.decrypt(\n    {\n      name: \"AES-GCM\",\n      iv: toArrayBuffer(decodeBase64urlIgnorePadding(ivEncoded)),\n    },\n    key,\n    toArrayBuffer(decodeBase64urlIgnorePadding(payloadEncoded)),\n  );\n  return new TextDecoder().decode(decrypted);\n}\n"],"mappings":";;;;;;;;;;;;;AAoBA,SAAgB,WAAW,MAAc;CACvC,MAAM,QAAQ,QAAQ,IAAI;AAC1B,KAAI,UAAU,OACZ,OAAM,IAAI,UACR,mBACA,kCAAkC,KAAK,KACvC,EAAE,UAAU,MAAM,CACnB,CAAC,eAAe;AAEnB,QAAO;;;AAIT,SAAgB,YAAY,MAAe;AACzC,KAAI,SAAS,OACX,QAAO;CAET,MAAM,MAAM,KAAK,SAAS,MAAM,GAAG,OAAO,UAAU;CACpD,IAAI;AACJ,KAAI;AACF,QAAM,IAAI,IAAI,IAAI;SACZ;AACN,SAAO;;AAET,QACE,IAAI,aAAa,eACjB,IAAI,aAAa,eACjB,IAAI,aAAa;;;AAOrB,MAAa,0BAA0B;;AAEvC,MAAa,wBAAwB;;AAGrC,eAAsBA,SAAO,OAAe;AAC1C,QAAO,mBAAmBC,OAAU,IAAI,aAAa,CAAC,OAAO,MAAM,CAAC,CAAC;;;AAIvE,SAAgBC,uBAAqB,QAAgB,UAAkB;AAOrE,QAAOC,qBANsB,EAC3B,KAAK,OAAO;AACV,SAAO,gBAAgB,MAAiC;IAE3D,EAEuC,UAAU,OAAO;;;AAI3D,SAAgB,aAAa,OAAgB;AAC3C,QAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;;;AAI/D,SAAgB,SAAS,OAAgB;AACvC,cACE,WAAW,OACX,iBAAiB,QACb,MAAM,UAAU,OAAO,MAAM,OAAO,QAAQ,OAAO,KAAK,GACxD,MACL;;;AAIH,MAAa,aAAa;CACxB,OAAO;CACP,MAAM;CACN,MAAM;CACN,OAAO;CACR;;AAID,SAAgB,aAAa,OAAiB,GAAG,MAAiB;CAChE,MAAM,qBACJ,WACG,QAAQ,IAAI,kBAA2C,WACrD;AACP,SAAQ,OAAR;EACE,KAAK;AACH,WAAQ,MAAM,GAAG,KAAK;AACtB;EACF,KAAK;AACH,OAAI,uBAAuB,QACzB,SAAQ,KAAK,GAAG,KAAK;AAEvB;EACF,KAAK;AACH,OAAI,uBAAuB,UAAU,uBAAuB,QAC1D,SAAQ,KAAK,GAAG,KAAK;AAEvB;EACF,KAAK;AACH,OAAI,uBAAuB,QACzB,SAAQ,MAAM,GAAG,KAAK;AAExB;;;AAIN,MAAM,oBAAoB;;AAE1B,SAAgB,YAAY,OAAe;AACzC,KAAI,UAAU,GACZ,QAAO;AAGT,KADqB,QAAQ,IAAI,qBAAqB,QACpC;AAChB,MAAI,MAAM,SAAS,oBAAoB,EACrC,QAAO;AAET,SACE,MAAM,UAAU,GAAG,kBAAkB,GACrC,eACA,MAAM,UAAU,MAAM,SAAS,kBAAkB;OAGnD,QAAO;;AAIX,MAAM,iBAAiB;AACvB,MAAM,mBAAmB;AAEzB,SAAS,cAAc,OAAmB;AACxC,QAAO,MAAM,OAAO,MAClB,MAAM,YACN,MAAM,aAAa,MAAM,WAC1B;;AAGH,eAAe,qBAAqB;CAClC,MAAM,WAAW,WAAW,eAAe;CAC3C,MAAM,SAASF,OAAU,IAAI,aAAa,CAAC,OAAO,SAAS,CAAC;AAC5D,QAAO,MAAM,OAAO,OAAO,UACzB,OACA,cAAc,OAAO,EACrB,EAAE,MAAM,WAAW,EACnB,OACA,CAAC,WAAW,UAAU,CACvB;;;AAIH,eAAsB,cAAc,OAAe;CACjD,MAAM,MAAM,MAAM,oBAAoB;CACtC,MAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,iBAAiB,CAAC;CACnE,MAAM,YAAY,MAAM,OAAO,OAAO,QACpC;EAAE,MAAM;EAAW,IAAI,cAAc,GAAG;EAAE,EAC1C,KACA,cAAc,IAAI,aAAa,CAAC,OAAO,MAAM,CAAC,CAC/C;AACD,QAAO,GAAG,yBAAyB,GAAG,CAAC,GAAG,yBAAyB,IAAI,WAAW,UAAU,CAAC;;;AAI/F,eAAsB,cAAc,YAAoB;CACtD,MAAM,CAAC,WAAW,kBAAkB,WAAW,MAAM,IAAI;AACzD,KAAI,CAAC,aAAa,CAAC,eACjB,OAAM,IAAI,UACR,sBACA,yCACD,CAAC,eAAe;CAEnB,MAAM,MAAM,MAAM,oBAAoB;CACtC,MAAM,YAAY,MAAM,OAAO,OAAO,QACpC;EACE,MAAM;EACN,IAAI,cAAc,6BAA6B,UAAU,CAAC;EAC3D,EACD,KACA,cAAc,6BAA6B,eAAe,CAAC,CAC5D;AACD,QAAO,IAAI,aAAa,CAAC,OAAO,UAAU"}