@robelest/convex-auth 0.0.4-preview.21 → 0.0.4-preview.23

package/dist/server/mounts.js

@@ -1,4 +1,5 @@
 import { enterpriseConnectionWhereValidator, enterpriseDomainInputValidator, enterpriseDomainVerificationInputValidator, enterprisePolicyPatchValidator, enterpriseSamlAttributeMappingValidator, enterpriseSamlSpValidator, enterpriseStatusValidator } from "./enterprise/validators.js";
+import { Cv } from "@robelest/fx/convex";
 import { actionGeneric, mutationGeneric, queryGeneric } from "convex/server";
 import { ConvexError, v } from "convex/values";
 
@@ -51,28 +52,23 @@ function createMountedAdminAuthorizer(auth, options) {
 	const requireUserId = requireSignedInUser(auth);
 	return async (ctx, permission, target = {}) => {
 		const userId = await requireUserId(ctx);
-		if (userId === null) return {
-			ok: false,
-			code: "NOT_SIGNED_IN"
-		};
-		if (!options?.admin?.authorized) return {
-			ok: false,
-			code: "FORBIDDEN"
-		};
+		if (userId === null) throw Cv.error({
+			code: "NOT_SIGNED_IN",
+			message: "You must be signed in to perform this action."
+		});
+		if (!options?.admin?.authorized) throw Cv.error({
+			code: "FORBIDDEN",
+			message: "Access denied."
+		});
 		const resolved = await resolveMountedEnterpriseTarget(auth, ctx, target);
-		const authResult = await options.admin.authorized(ctx, {
+		await options.admin.authorized(ctx, {
 			userId,
 			permission,
 			enterpriseId: resolved.enterpriseId,
 			groupId: resolved.groupId,
 			resolvedGroupId: resolved.resolvedGroupId
 		});
-		if (authResult && !authResult.ok) return {
-			ok: false,
-			code: "FORBIDDEN"
-		};
 		return {
-			ok: true,
 			userId,
 			...resolved
 		};
@@ -126,12 +122,7 @@ function sso(auth, options) {
 						domain: v.optional(v.string())
 					},
 					handler: async (ctx, args) => {
-						const authResult = await authorize(ctx, "sso.connection.create", { groupId: args.groupId });
-						if (!authResult.ok) return {
-							ok: false,
-							code: authResult.code
-						};
-						const { userId } = authResult;
+						const { userId } = await authorize(ctx, "sso.connection.create", { groupId: args.groupId });
 						const createsGroup = args.groupId === void 0;
 						const groupId = args.groupId ?? (await auth.group.create(ctx, {
 							name: args.name?.trim() || args.slug?.trim() || "Enterprise",
@@ -163,21 +154,21 @@ function sso(auth, options) {
 				get: queryGeneric({
 					args: { enterpriseId: v.string() },
 					handler: async (ctx, args) => {
-						if (!(await authorize(ctx, "sso.connection.read", { enterpriseId: args.enterpriseId })).ok) return null;
+						await authorize(ctx, "sso.connection.read", { enterpriseId: args.enterpriseId });
 						return await auth.sso.admin.connection.get(ctx, args.enterpriseId);
 					}
 				}),
 				getByGroup: queryGeneric({
 					args: { groupId: v.string() },
 					handler: async (ctx, args) => {
-						if (!(await authorize(ctx, "sso.connection.read", { groupId: args.groupId })).ok) return null;
+						await authorize(ctx, "sso.connection.read", { groupId: args.groupId });
 						return await auth.sso.admin.connection.getByGroup(ctx, args.groupId);
 					}
 				}),
 				getByDomain: queryGeneric({
 					args: { domain: v.string() },
 					handler: async (ctx, args) => {
-						if (!(await authorize(ctx, "sso.connection.read", { domain: args.domain })).ok) return null;
+						await authorize(ctx, "sso.connection.read", { domain: args.domain });
 						return await auth.sso.admin.connection.getByDomain(ctx, args.domain);
 					}
 				}),
@@ -190,7 +181,7 @@ function sso(auth, options) {
 						order: v.optional(v.union(v.literal("asc"), v.literal("desc")))
 					},
 					handler: async (ctx, args) => {
-						if (!(await authorize(ctx, "sso.connection.read", { groupId: args.where?.groupId })).ok) return null;
+						await authorize(ctx, "sso.connection.read", { groupId: args.where?.groupId });
 						return await auth.sso.admin.connection.list(ctx, args);
 					}
 				}),
@@ -204,33 +195,22 @@ function sso(auth, options) {
 						})
 					},
 					handler: async (ctx, args) => {
-						const _auth = await authorize(ctx, "sso.connection.manage", { enterpriseId: args.enterpriseId });
-						if (!_auth.ok) return {
-							ok: false,
-							code: _auth.code
-						};
+						await authorize(ctx, "sso.connection.manage", { enterpriseId: args.enterpriseId });
 						await auth.sso.admin.connection.update(ctx, args.enterpriseId, args.data);
-						return {
-							ok: true,
-							enterpriseId: args.enterpriseId
-						};
+						return { enterpriseId: args.enterpriseId };
 					}
 				}),
 				delete: mutationGeneric({
 					args: { enterpriseId: v.string() },
 					handler: async (ctx, args) => {
-						const _auth = await authorize(ctx, "sso.connection.manage", { enterpriseId: args.enterpriseId });
-						if (!_auth.ok) return {
-							ok: false,
-							code: _auth.code
-						};
+						await authorize(ctx, "sso.connection.manage", { enterpriseId: args.enterpriseId });
 						return await auth.sso.admin.connection.delete(ctx, args.enterpriseId);
 					}
 				}),
 				status: queryGeneric({
 					args: { enterpriseId: v.string() },
 					handler: async (ctx, args) => {
-						if (!(await authorize(ctx, "sso.connection.read", { enterpriseId: args.enterpriseId })).ok) return null;
+						await authorize(ctx, "sso.connection.read", { enterpriseId: args.enterpriseId });
 						return await auth.sso.admin.connection.status(ctx, args.enterpriseId);
 					}
 				}),
@@ -238,14 +218,14 @@ function sso(auth, options) {
 					list: queryGeneric({
 						args: { enterpriseId: v.string() },
 						handler: async (ctx, args) => {
-							if (!(await authorize(ctx, "sso.connection.read", { enterpriseId: args.enterpriseId })).ok) return null;
+							await authorize(ctx, "sso.connection.read", { enterpriseId: args.enterpriseId });
 							return await auth.sso.admin.connection.domain.list(ctx, args.enterpriseId);
 						}
 					}),
 					validate: queryGeneric({
 						args: { enterpriseId: v.string() },
 						handler: async (ctx, args) => {
-							if (!(await authorize(ctx, "sso.domain.manage", { enterpriseId: args.enterpriseId })).ok) return null;
+							await authorize(ctx, "sso.domain.manage", { enterpriseId: args.enterpriseId });
 							return await auth.sso.admin.connection.domain.validate(ctx, args.enterpriseId);
 						}
 					}),
@@ -255,11 +235,7 @@ function sso(auth, options) {
 							domains: v.array(enterpriseDomainInputValidator)
 						},
 						handler: async (ctx, args) => {
-							const _auth = await authorize(ctx, "sso.domain.manage", { enterpriseId: args.enterpriseId });
-							if (!_auth.ok) return {
-								ok: false,
-								code: _auth.code
-							};
+							await authorize(ctx, "sso.domain.manage", { enterpriseId: args.enterpriseId });
 							return await auth.sso.admin.connection.domain.set(ctx, args.enterpriseId, args.domains);
 						}
 					}),
@@ -267,22 +243,14 @@ function sso(auth, options) {
 						request: mutationGeneric({
 							args: enterpriseDomainVerificationInputValidator,
 							handler: async (ctx, args) => {
-								const _auth = await authorize(ctx, "sso.domain.manage", { enterpriseId: args.enterpriseId });
-								if (!_auth.ok) return {
-									ok: false,
-									code: _auth.code
-								};
+								await authorize(ctx, "sso.domain.manage", { enterpriseId: args.enterpriseId });
 								return await auth.sso.admin.connection.domain.verification.request(ctx, args);
 							}
 						}),
 						confirm: actionGeneric({
 							args: enterpriseDomainVerificationInputValidator,
 							handler: async (ctx, args) => {
-								const _auth = await authorize(ctx, "sso.domain.manage", { enterpriseId: args.enterpriseId });
-								if (!_auth.ok) return {
-									ok: false,
-									code: _auth.code
-								};
+								await authorize(ctx, "sso.domain.manage", { enterpriseId: args.enterpriseId });
 								return await auth.sso.admin.connection.domain.verification.confirm(ctx, args);
 							}
 						})
@@ -304,29 +272,21 @@ function sso(auth, options) {
 						extraFields: v.optional(v.record(v.string(), v.string()))
 					},
 					handler: async (ctx, args) => {
-						const _auth = await authorize(ctx, "sso.protocol.manage", { enterpriseId: args.enterpriseId });
-						if (!_auth.ok) return {
-							ok: false,
-							code: _auth.code
-						};
+						await authorize(ctx, "sso.protocol.manage", { enterpriseId: args.enterpriseId });
 						return await auth.sso.admin.oidc.configure(ctx, args);
 					}
 				}),
 				get: queryGeneric({
 					args: { enterpriseId: v.string() },
 					handler: async (ctx, args) => {
-						if (!(await authorize(ctx, "sso.connection.read", { enterpriseId: args.enterpriseId })).ok) return null;
+						await authorize(ctx, "sso.connection.read", { enterpriseId: args.enterpriseId });
 						return await auth.sso.admin.oidc.get(ctx, args.enterpriseId);
 					}
 				}),
 				validate: actionGeneric({
 					args: { enterpriseId: v.string() },
 					handler: async (ctx, args) => {
-						const _auth = await authorize(ctx, "sso.protocol.manage", { enterpriseId: args.enterpriseId });
-						if (!_auth.ok) return {
-							ok: false,
-							code: _auth.code
-						};
+						await authorize(ctx, "sso.protocol.manage", { enterpriseId: args.enterpriseId });
 						return await auth.sso.admin.oidc.validate(ctx, args.enterpriseId);
 					}
 				})
@@ -343,18 +303,14 @@ function sso(auth, options) {
 						sp: v.optional(enterpriseSamlSpValidator)
 					},
 					handler: async (ctx, args) => {
-						const _auth = await authorize(ctx, "sso.protocol.manage", { enterpriseId: args.enterpriseId });
-						if (!_auth.ok) return {
-							ok: false,
-							code: _auth.code
-						};
+						await authorize(ctx, "sso.protocol.manage", { enterpriseId: args.enterpriseId });
 						return await auth.sso.admin.saml.configure(ctx, args);
 					}
 				}),
 				validate: queryGeneric({
 					args: { enterpriseId: v.string() },
 					handler: async (ctx, args) => {
-						if (!(await authorize(ctx, "sso.protocol.manage", { enterpriseId: args.enterpriseId })).ok) return null;
+						await authorize(ctx, "sso.protocol.manage", { enterpriseId: args.enterpriseId });
 						return await auth.sso.admin.saml.validate(ctx, args.enterpriseId);
 					}
 				})
@@ -363,7 +319,7 @@ function sso(auth, options) {
 				get: queryGeneric({
 					args: { enterpriseId: v.string() },
 					handler: async (ctx, args) => {
-						if (!(await authorize(ctx, "sso.connection.read", { enterpriseId: args.enterpriseId })).ok) return null;
+						await authorize(ctx, "sso.connection.read", { enterpriseId: args.enterpriseId });
 						return await auth.sso.admin.policy.get(ctx, args.enterpriseId);
 					}
 				}),
@@ -373,18 +329,14 @@ function sso(auth, options) {
 						patch: enterprisePolicyPatchValidator
 					},
 					handler: async (ctx, args) => {
-						const _auth = await authorize(ctx, "sso.policy.manage", { enterpriseId: args.enterpriseId });
-						if (!_auth.ok) return {
-							ok: false,
-							code: _auth.code
-						};
+						await authorize(ctx, "sso.policy.manage", { enterpriseId: args.enterpriseId });
 						return await auth.sso.admin.policy.update(ctx, args.enterpriseId, args.patch);
 					}
 				}),
 				validate: queryGeneric({
 					args: { enterpriseId: v.string() },
 					handler: async (ctx, args) => {
-						if (!(await authorize(ctx, "sso.policy.manage", { enterpriseId: args.enterpriseId })).ok) return null;
+						await authorize(ctx, "sso.policy.manage", { enterpriseId: args.enterpriseId });
 						return await auth.sso.admin.policy.validate(ctx, args.enterpriseId);
 					}
 				})
@@ -396,10 +348,10 @@ function sso(auth, options) {
 					limit: v.optional(v.number())
 				},
 				handler: async (ctx, args) => {
-					if (!(await authorize(ctx, "sso.audit.read", {
+					await authorize(ctx, "sso.audit.read", {
 						enterpriseId: args.enterpriseId,
 						groupId: args.groupId
-					})).ok) return null;
+					});
 					return await auth.sso.admin.audit.list(ctx, args);
 				}
 			}) },
@@ -410,7 +362,7 @@ function sso(auth, options) {
 						limit: v.optional(v.number())
 					},
 					handler: async (ctx, args) => {
-						if (!(await authorize(ctx, "sso.webhook.manage", { enterpriseId: args.enterpriseId })).ok) return null;
+						await authorize(ctx, "sso.webhook.manage", { enterpriseId: args.enterpriseId });
 						return await auth.sso.admin.webhook.delivery.list(ctx, args);
 					}
 				}) },
@@ -424,12 +376,7 @@ function sso(auth, options) {
 							createdByUserId: v.optional(v.string())
 						},
 						handler: async (ctx, args) => {
-							const authResult = await authorize(ctx, "sso.webhook.manage", { enterpriseId: args.enterpriseId });
-							if (!authResult.ok) return {
-								ok: false,
-								code: authResult.code
-							};
-							const { userId } = authResult;
+							const { userId } = await authorize(ctx, "sso.webhook.manage", { enterpriseId: args.enterpriseId });
 							return {
 								_id: (await auth.sso.admin.webhook.endpoint.create(ctx, {
 									...args,
@@ -447,7 +394,7 @@ function sso(auth, options) {
 					list: queryGeneric({
 						args: { enterpriseId: v.string() },
 						handler: async (ctx, args) => {
-							if (!(await authorize(ctx, "sso.webhook.manage", { enterpriseId: args.enterpriseId })).ok) return null;
+							await authorize(ctx, "sso.webhook.manage", { enterpriseId: args.enterpriseId });
 							return (await auth.sso.admin.webhook.endpoint.list(ctx, args.enterpriseId)).map((endpoint) => {
 								const { secretHash: _secretHash, ...rest } = endpoint;
 								return rest;
@@ -458,18 +405,14 @@ function sso(auth, options) {
 						args: { endpointId: v.string() },
 						handler: async (ctx, args) => {
 							const endpoint = await auth.sso.admin.webhook.endpoint.get(ctx, args.endpointId);
-							if (!endpoint) return {
-								ok: false,
-								code: "INVALID_PARAMETERS"
-							};
-							const _auth = await authorize(ctx, "sso.webhook.manage", {
+							if (!endpoint) throw Cv.error({
+								code: "INVALID_PARAMETERS",
+								message: "Webhook endpoint not found."
+							});
+							await authorize(ctx, "sso.webhook.manage", {
 								enterpriseId: endpoint.enterpriseId,
 								groupId: endpoint.groupId
 							});
-							if (!_auth.ok) return {
-								ok: false,
-								code: _auth.code
-							};
 							return await auth.sso.admin.webhook.endpoint.disable(ctx, args.endpointId);
 						}
 					})
@@ -541,25 +484,21 @@ function scim(auth, options) {
 				status: v.optional(enterpriseStatusValidator)
 			},
 			handler: async (ctx, args) => {
-				const _auth = await authorize(ctx, "scim.manage", { enterpriseId: args.enterpriseId });
-				if (!_auth.ok) return {
-					ok: false,
-					code: _auth.code
-				};
+				await authorize(ctx, "scim.manage", { enterpriseId: args.enterpriseId });
 				return await auth.scim.admin.configure(ctx, args);
 			}
 		}),
 		get: queryGeneric({
 			args: { enterpriseId: v.string() },
 			handler: async (ctx, args) => {
-				if (!(await authorize(ctx, "scim.manage", { enterpriseId: args.enterpriseId })).ok) return null;
+				await authorize(ctx, "scim.manage", { enterpriseId: args.enterpriseId });
 				return await auth.scim.admin.get(ctx, args.enterpriseId);
 			}
 		}),
 		validate: queryGeneric({
 			args: { enterpriseId: v.string() },
 			handler: async (ctx, args) => {
-				if (!(await authorize(ctx, "scim.manage", { enterpriseId: args.enterpriseId })).ok) return null;
+				await authorize(ctx, "scim.manage", { enterpriseId: args.enterpriseId });
 				return await auth.scim.admin.validate(ctx, args.enterpriseId);
 			}
 		})

package/dist/server/mounts.js.map

@@ -1 +1 @@
-{"version":3,"file":"mounts.js","names":[],"sources":["../../src/server/mounts.ts"],"sourcesContent":["import { actionGeneric, mutationGeneric, queryGeneric } from \"convex/server\";\nimport { ConvexError, v } from \"convex/values\";\n\nimport type { AuthApi } from \"./auth\";\nimport {\n  enterpriseConnectionWhereValidator,\n  enterpriseDomainInputValidator,\n  enterpriseDomainVerificationInputValidator,\n  enterprisePolicyPatchValidator,\n  enterpriseSamlAttributeMappingValidator,\n  enterpriseSamlSpValidator,\n  enterpriseStatusValidator,\n} from \"./enterprise/validators\";\nimport type { AuthAuthorizationConfig, AuthRoleId } from \"./types\";\n\n/**\n * Permission identifiers used by mounted enterprise admin APIs.\n *\n * These permission strings are passed to your {@link EnterpriseAuthorizer}\n * callback so app code can decide whether the current user may perform a\n * specific SSO or SCIM management operation.\n *\n * @example\n * ```ts\n * const authorized: EnterpriseAuthorizer = async (ctx, input) => {\n *   if (input.permission === \"sso.connection.create\") {\n *     // Only org admins may create SSO connections\n *   }\n * };\n * ```\n */\nexport type EnterpriseAdminPermission =\n  | \"sso.connection.create\"\n  | \"sso.connection.read\"\n  | \"sso.connection.manage\"\n  | \"sso.domain.manage\"\n  | \"sso.protocol.manage\"\n  | \"sso.policy.manage\"\n  | \"sso.audit.read\"\n  | \"sso.webhook.manage\"\n  | \"scim.manage\";\n\n/**\n * Input passed to an {@link EnterpriseAuthorizer}.\n *\n * Contains the acting user, the requested permission, and the resolved\n * enterprise/group scope for the operation being authorized.\n */\nexport type EnterpriseAdminAuthorizationInput = {\n  /** The signed-in user's ID performing the admin action. */\n  userId: string;\n  /** The {@link EnterpriseAdminPermission} being requested. */\n  permission: EnterpriseAdminPermission;\n  /** Enterprise document ID, if the operation targets a specific enterprise. */\n  enterpriseId?: string;\n  /** Group document ID, if explicitly provided by the caller. */\n  groupId?: string;\n  /** Resolved group ID from the enterprise record, or `null` when no enterprise context. */\n  resolvedGroupId: string | null;\n};\n\n/**\n * App-defined authorization hook for mounted enterprise admin APIs.\n *\n * Return `void` (or resolve) to allow the operation, or `{ ok: false }` to deny it.\n *\n * @param ctx - Convex context with `ctx.auth` for identity checks.\n * @param input - The {@link EnterpriseAdminAuthorizationInput} describing who is doing what.\n * @returns `void` to allow, `{ ok: false }` to deny.\n *\n * @example\n * ```ts\n * import { EnterpriseAuthorizer } from \"@robelest/convex-auth/server\";\n *\n * const authorized: EnterpriseAuthorizer = async (ctx, input) => {\n *   const identity = await ctx.auth.getUserIdentity();\n *   if (!identity) return { ok: false };\n *   // Allow all admin ops for the org owner\n * };\n * ```\n */\nexport type EnterpriseAuthorizer = (\n  ctx: { auth: import(\"convex/server\").Auth },\n  input: EnterpriseAdminAuthorizationInput,\n) => Promise<void | { ok: false }>;\n\ntype RoleRef<TRoleId extends string> = { id: TRoleId };\n\ntype MountedEnterpriseOptions<TRoleId extends string = string> = {\n  admin?: {\n    authorized?: EnterpriseAuthorizer;\n    roles?: Array<TRoleId | RoleRef<TRoleId>>;\n  };\n};\n\n/**\n * Configuration for {@link enterprise}, {@link sso}, and {@link scim}\n * mounted admin APIs.\n *\n * @typeParam TRoleId - Role IDs that may be assigned to enterprise creators.\n *\n * @example\n * ```ts\n * import { enterprise, EnterpriseMountOptions } from \"@robelest/convex-auth/server\";\n *\n * const options: EnterpriseMountOptions = {\n *   admin: {\n *     authorized: async (ctx, input) => {\n *       // Verify the user has permission for `input.permission`\n *     },\n *     roles: [\"admin\", \"owner\"],\n *   },\n * };\n * ```\n */\nexport type EnterpriseMountOptions<TRoleId extends string = string> = {\n  admin: {\n    authorized: EnterpriseAuthorizer;\n    roles?: Array<TRoleId | RoleRef<TRoleId>>;\n  };\n};\n\ntype MountedEnterpriseTarget = {\n  enterpriseId?: string;\n  groupId?: string;\n  domain?: string;\n};\n\nfunction requireSignedInUser(auth: Pick<AuthApi, \"user\">) {\n  return async (ctx: {\n    auth: import(\"convex/server\").Auth;\n  }): Promise<string | null> => {\n    return await auth.user.id(ctx as never);\n  };\n}\n\nfunction normalizeCreatorRoleIds<TRoleId extends string>(\n  roles?: Array<TRoleId | RoleRef<TRoleId>>,\n) {\n  return roles?.map((role) => (typeof role === \"string\" ? role : role.id));\n}\n\nasync function resolveMountedEnterpriseTarget(\n  auth: Pick<AuthApi, \"sso\">,\n  ctx: { auth: import(\"convex/server\").Auth },\n  target: MountedEnterpriseTarget,\n) {\n  if (target.groupId !== undefined) {\n    return {\n      enterpriseId: target.enterpriseId,\n      groupId: target.groupId,\n      resolvedGroupId: target.groupId,\n    };\n  }\n\n  if (target.enterpriseId !== undefined) {\n    const enterprise = await auth.sso.admin.connection.get(\n      ctx as never,\n      target.enterpriseId,\n    );\n    if (enterprise === null) {\n      throw new ConvexError({\n        code: \"INVALID_PARAMETERS\",\n        message: \"Enterprise not found.\",\n      });\n    }\n    return {\n      enterpriseId: enterprise._id,\n      groupId: enterprise.groupId,\n      resolvedGroupId: enterprise.groupId,\n    };\n  }\n\n  if (target.domain !== undefined) {\n    const resolved = await auth.sso.admin.connection.getByDomain(\n      ctx as never,\n      target.domain,\n    );\n    if (resolved?.enterprise === undefined) {\n      throw new ConvexError({\n        code: \"INVALID_PARAMETERS\",\n        message: \"Enterprise not found.\",\n      });\n    }\n    return {\n      enterpriseId: resolved.enterprise._id,\n      groupId: resolved.enterprise.groupId,\n      resolvedGroupId: resolved.enterprise.groupId,\n    };\n  }\n\n  return {\n    enterpriseId: undefined,\n    groupId: undefined,\n    resolvedGroupId: null,\n  };\n}\n\nfunction createMountedAdminAuthorizer(\n  auth: Pick<AuthApi, \"sso\" | \"user\">,\n  options?: MountedEnterpriseOptions,\n) {\n  const requireUserId = requireSignedInUser(auth);\n\n  return async (\n    ctx: { auth: import(\"convex/server\").Auth },\n    permission: EnterpriseAdminPermission,\n    target: MountedEnterpriseTarget = {},\n  ) => {\n    const userId = await requireUserId(ctx);\n    if (userId === null) {\n      return { ok: false as const, code: \"NOT_SIGNED_IN\" as const };\n    }\n    if (!options?.admin?.authorized) {\n      return { ok: false as const, code: \"FORBIDDEN\" as const };\n    }\n    const resolved = await resolveMountedEnterpriseTarget(auth, ctx, target);\n    const authResult = await options.admin.authorized(ctx, {\n      userId,\n      permission,\n      enterpriseId: resolved.enterpriseId,\n      groupId: resolved.groupId,\n      resolvedGroupId: resolved.resolvedGroupId,\n    });\n    if (authResult && !authResult.ok) {\n      return { ok: false as const, code: \"FORBIDDEN\" as const };\n    }\n    return { ok: true as const, userId, ...resolved };\n  };\n}\n\n/**\n * Build optional public SSO management actions that apps can mount under\n * `convex/auth/sso/**` when they want client-callable enterprise APIs.\n *\n * `admin` is for tenant-admin control-plane operations and should be mounted\n * with an explicit authorization policy. `client` is for end-user sign-in\n * helpers and does not require tenant-admin authorization.\n *\n * @param auth - Auth API subset providing `group`, `member`, `sso`, and `user` namespaces.\n * @param options - Optional admin authorization config. See {@link EnterpriseMountOptions}.\n * @typeParam TAuthorization - Optional authorization config for typed role IDs.\n * @returns An object with `admin` (connection CRUD, OIDC/SAML protocol config, policy,\n *   audit, webhooks, domain management) and `client` (signIn, metadata) namespaces.\n *\n * @example\n * ```ts\n * // convex/auth/sso.ts\n * import { sso } from \"@robelest/convex-auth/server\";\n * import { auth } from \"../auth\";\n *\n * const mounted = sso(auth, {\n *   admin: {\n *     authorized: async (ctx, input) => { /* check permissions *\\/ },\n *   },\n * });\n *\n * export const createConnection = mounted.admin.connection.create;\n * export const signIn = mounted.client.signIn;\n * ```\n *\n * @see {@link scim}\n * @see {@link enterprise}\n */\nexport function sso<\n  TAuthorization extends AuthAuthorizationConfig | undefined = undefined,\n>(\n  auth: Pick<AuthApi<TAuthorization>, \"group\" | \"member\" | \"sso\" | \"user\">,\n  options?: MountedEnterpriseOptions<AuthRoleId<TAuthorization>>,\n) {\n  const authorize = createMountedAdminAuthorizer(auth, options);\n  const adminRoleIds = normalizeCreatorRoleIds(options?.admin?.roles);\n\n  return {\n    admin: {\n      connection: {\n        create: mutationGeneric({\n          args: {\n            groupId: v.optional(v.string()),\n            name: v.optional(v.string()),\n            slug: v.optional(v.string()),\n            status: v.optional(enterpriseStatusValidator),\n            domain: v.optional(v.string()),\n          },\n          handler: async (ctx, args) => {\n            const authResult = await authorize(ctx, \"sso.connection.create\", {\n              groupId: args.groupId,\n            });\n            if (!authResult.ok)\n              return { ok: false as const, code: authResult.code };\n            const { userId } = authResult;\n            const createsGroup = args.groupId === undefined;\n            const groupId =\n              args.groupId ??\n              (\n                await auth.group.create(ctx as never, {\n                  name: args.name?.trim() || args.slug?.trim() || \"Enterprise\",\n                  slug: args.slug,\n                  type: \"enterprise\",\n                })\n              ).groupId;\n            if (createsGroup) {\n              await auth.member.create(ctx as never, {\n                groupId,\n                userId,\n                roleIds: adminRoleIds,\n              });\n            }\n            const created = await auth.sso.admin.connection.create(\n              ctx as never,\n              {\n                groupId,\n                name: args.name,\n                slug: args.slug,\n                status: args.status,\n              },\n            );\n            if (args.domain) {\n              await auth.sso.admin.connection.domain.set(\n                ctx as never,\n                created.enterpriseId,\n                [{ domain: args.domain, isPrimary: true }],\n              );\n            }\n            return {\n              ...created,\n              groupId,\n              createdGroup: createsGroup,\n            };\n          },\n        }),\n        get: queryGeneric({\n          args: { enterpriseId: v.string() },\n          handler: async (ctx, args) => {\n            const _auth = await authorize(ctx, \"sso.connection.read\", {\n              enterpriseId: args.enterpriseId,\n            });\n            if (!_auth.ok) return null;\n            return await auth.sso.admin.connection.get(\n              ctx as never,\n              args.enterpriseId,\n            );\n          },\n        }),\n        getByGroup: queryGeneric({\n          args: { groupId: v.string() },\n          handler: async (ctx, args) => {\n            const _auth = await authorize(ctx, \"sso.connection.read\", {\n              groupId: args.groupId,\n            });\n            if (!_auth.ok) return null;\n            return await auth.sso.admin.connection.getByGroup(\n              ctx as never,\n              args.groupId,\n            );\n          },\n        }),\n        getByDomain: queryGeneric({\n          args: { domain: v.string() },\n          handler: async (ctx, args) => {\n            const _auth = await authorize(ctx, \"sso.connection.read\", {\n              domain: args.domain,\n            });\n            if (!_auth.ok) return null;\n            return await auth.sso.admin.connection.getByDomain(\n              ctx as never,\n              args.domain,\n            );\n          },\n        }),\n        list: queryGeneric({\n          args: {\n            where: v.optional(enterpriseConnectionWhereValidator),\n            limit: v.optional(v.number()),\n            cursor: v.optional(v.union(v.string(), v.null())),\n            orderBy: v.optional(v.string()),\n            order: v.optional(v.union(v.literal(\"asc\"), v.literal(\"desc\"))),\n          },\n          handler: async (ctx, args) => {\n            const _auth = await authorize(ctx, \"sso.connection.read\", {\n              groupId: args.where?.groupId,\n            });\n            if (!_auth.ok) return null;\n            return await auth.sso.admin.connection.list(\n              ctx as never,\n              args as never,\n            );\n          },\n        }),\n        update: mutationGeneric({\n          args: {\n            enterpriseId: v.string(),\n            data: v.object({\n              name: v.optional(v.string()),\n              slug: v.optional(v.string()),\n              status: v.optional(enterpriseStatusValidator),\n            }),\n          },\n          handler: async (ctx, args) => {\n            const _auth = await authorize(ctx, \"sso.connection.manage\", {\n              enterpriseId: args.enterpriseId,\n            });\n            if (!_auth.ok) return { ok: false as const, code: _auth.code };\n            await auth.sso.admin.connection.update(\n              ctx as never,\n              args.enterpriseId,\n              args.data,\n            );\n            return { ok: true as const, enterpriseId: args.enterpriseId };\n          },\n        }),\n        delete: mutationGeneric({\n          args: { enterpriseId: v.string() },\n          handler: async (ctx, args) => {\n            const _auth = await authorize(ctx, \"sso.connection.manage\", {\n              enterpriseId: args.enterpriseId,\n            });\n            if (!_auth.ok) return { ok: false as const, code: _auth.code };\n            return await auth.sso.admin.connection.delete(\n              ctx as never,\n              args.enterpriseId,\n            );\n          },\n        }),\n        status: queryGeneric({\n          args: { enterpriseId: v.string() },\n          handler: async (ctx, args) => {\n            const _auth = await authorize(ctx, \"sso.connection.read\", {\n              enterpriseId: args.enterpriseId,\n            });\n            if (!_auth.ok) return null;\n            return await auth.sso.admin.connection.status(\n              ctx as never,\n              args.enterpriseId,\n            );\n          },\n        }),\n        domain: {\n          list: queryGeneric({\n            args: { enterpriseId: v.string() },\n            handler: async (ctx, args) => {\n              const _auth = await authorize(ctx, \"sso.connection.read\", {\n                enterpriseId: args.enterpriseId,\n              });\n              if (!_auth.ok) return null;\n              return await auth.sso.admin.connection.domain.list(\n                ctx as never,\n                args.enterpriseId,\n              );\n            },\n          }),\n          validate: queryGeneric({\n            args: { enterpriseId: v.string() },\n            handler: async (ctx, args) => {\n              const _auth = await authorize(ctx, \"sso.domain.manage\", {\n                enterpriseId: args.enterpriseId,\n              });\n              if (!_auth.ok) return null;\n              return await auth.sso.admin.connection.domain.validate(\n                ctx as never,\n                args.enterpriseId,\n              );\n            },\n          }),\n          set: mutationGeneric({\n            args: {\n              enterpriseId: v.string(),\n              domains: v.array(enterpriseDomainInputValidator),\n            },\n            handler: async (ctx, args) => {\n              const _auth = await authorize(ctx, \"sso.domain.manage\", {\n                enterpriseId: args.enterpriseId,\n              });\n              if (!_auth.ok) return { ok: false as const, code: _auth.code };\n              return await auth.sso.admin.connection.domain.set(\n                ctx as never,\n                args.enterpriseId,\n                args.domains,\n              );\n            },\n          }),\n          verification: {\n            request: mutationGeneric({\n              args: enterpriseDomainVerificationInputValidator,\n              handler: async (ctx, args) => {\n                const _auth = await authorize(ctx, \"sso.domain.manage\", {\n                  enterpriseId: args.enterpriseId,\n                });\n                if (!_auth.ok) return { ok: false as const, code: _auth.code };\n                return await auth.sso.admin.connection.domain.verification.request(\n                  ctx as never,\n                  args,\n                );\n              },\n            }),\n            confirm: actionGeneric({\n              args: enterpriseDomainVerificationInputValidator,\n              handler: async (ctx, args) => {\n                const _auth = await authorize(ctx, \"sso.domain.manage\", {\n                  enterpriseId: args.enterpriseId,\n                });\n                if (!_auth.ok) return { ok: false as const, code: _auth.code };\n                return await auth.sso.admin.connection.domain.verification.confirm(\n                  ctx as never,\n                  args,\n                );\n              },\n            }),\n          },\n        },\n      },\n      oidc: {\n        configure: mutationGeneric({\n          args: {\n            enterpriseId: v.string(),\n            issuer: v.optional(v.string()),\n            discoveryUrl: v.optional(v.string()),\n            clientId: v.string(),\n            clientSecret: v.optional(v.string()),\n            scopes: v.optional(v.array(v.string())),\n            authorizationParams: v.optional(v.record(v.string(), v.string())),\n            clockToleranceSeconds: v.optional(v.number()),\n            strictIssuer: v.optional(v.boolean()),\n            extraFields: v.optional(v.record(v.string(), v.string())),\n          },\n          handler: async (ctx, args) => {\n            const _auth = await authorize(ctx, \"sso.protocol.manage\", {\n              enterpriseId: args.enterpriseId,\n            });\n            if (!_auth.ok) return { ok: false as const, code: _auth.code };\n            return await auth.sso.admin.oidc.configure(ctx as never, args);\n          },\n        }),\n        get: queryGeneric({\n          args: { enterpriseId: v.string() },\n          handler: async (ctx, args) => {\n            const _auth = await authorize(ctx, \"sso.connection.read\", {\n              enterpriseId: args.enterpriseId,\n            });\n            if (!_auth.ok) return null;\n            return await auth.sso.admin.oidc.get(\n              ctx as never,\n              args.enterpriseId,\n            );\n          },\n        }),\n        validate: actionGeneric({\n          args: { enterpriseId: v.string() },\n          handler: async (ctx, args) => {\n            const _auth = await authorize(ctx, \"sso.protocol.manage\", {\n              enterpriseId: args.enterpriseId,\n            });\n            if (!_auth.ok) return { ok: false as const, code: _auth.code };\n            return await auth.sso.admin.oidc.validate(\n              ctx as never,\n              args.enterpriseId,\n            );\n          },\n        }),\n      },\n      saml: {\n        configure: actionGeneric({\n          args: {\n            enterpriseId: v.string(),\n            metadataXml: v.optional(v.string()),\n            metadataUrl: v.optional(v.string()),\n            domains: v.optional(v.array(v.string())),\n            signAuthnRequests: v.optional(v.boolean()),\n            attributeMapping: v.optional(\n              enterpriseSamlAttributeMappingValidator,\n            ),\n            sp: v.optional(enterpriseSamlSpValidator),\n          },\n          handler: async (ctx, args) => {\n            const _auth = await authorize(ctx, \"sso.protocol.manage\", {\n              enterpriseId: args.enterpriseId,\n            });\n            if (!_auth.ok) return { ok: false as const, code: _auth.code };\n            return await auth.sso.admin.saml.configure(ctx as never, args);\n          },\n        }),\n        validate: queryGeneric({\n          args: { enterpriseId: v.string() },\n          handler: async (ctx, args) => {\n            const _auth = await authorize(ctx, \"sso.protocol.manage\", {\n              enterpriseId: args.enterpriseId,\n            });\n            if (!_auth.ok) return null;\n            return await auth.sso.admin.saml.validate(\n              ctx as never,\n              args.enterpriseId,\n            );\n          },\n        }),\n      },\n      policy: {\n        get: queryGeneric({\n          args: { enterpriseId: v.string() },\n          handler: async (ctx, args) => {\n            const _auth = await authorize(ctx, \"sso.connection.read\", {\n              enterpriseId: args.enterpriseId,\n            });\n            if (!_auth.ok) return null;\n            return await auth.sso.admin.policy.get(\n              ctx as never,\n              args.enterpriseId,\n            );\n          },\n        }),\n        update: mutationGeneric({\n          args: {\n            enterpriseId: v.string(),\n            patch: enterprisePolicyPatchValidator,\n          },\n          handler: async (ctx, args) => {\n            const _auth = await authorize(ctx, \"sso.policy.manage\", {\n              enterpriseId: args.enterpriseId,\n            });\n            if (!_auth.ok) return { ok: false as const, code: _auth.code };\n            return await auth.sso.admin.policy.update(\n              ctx as never,\n              args.enterpriseId,\n              args.patch,\n            );\n          },\n        }),\n        validate: queryGeneric({\n          args: { enterpriseId: v.string() },\n          handler: async (ctx, args) => {\n            const _auth = await authorize(ctx, \"sso.policy.manage\", {\n              enterpriseId: args.enterpriseId,\n            });\n            if (!_auth.ok) return null;\n            return await auth.sso.admin.policy.validate(\n              ctx as never,\n              args.enterpriseId,\n            );\n          },\n        }),\n      },\n      audit: {\n        list: queryGeneric({\n          args: {\n            enterpriseId: v.optional(v.string()),\n            groupId: v.optional(v.string()),\n            limit: v.optional(v.number()),\n          },\n          handler: async (ctx, args) => {\n            const _auth = await authorize(ctx, \"sso.audit.read\", {\n              enterpriseId: args.enterpriseId,\n              groupId: args.groupId,\n            });\n            if (!_auth.ok) return null;\n            return await auth.sso.admin.audit.list(ctx as never, args);\n          },\n        }),\n      },\n      webhook: {\n        delivery: {\n          list: queryGeneric({\n            args: {\n              enterpriseId: v.string(),\n              limit: v.optional(v.number()),\n            },\n            handler: async (ctx, args) => {\n              const _auth = await authorize(ctx, \"sso.webhook.manage\", {\n                enterpriseId: args.enterpriseId,\n              });\n              if (!_auth.ok) return null;\n              return await (auth.sso.admin.webhook as any).delivery.list(\n                ctx as never,\n                args,\n              );\n            },\n          }),\n        },\n        endpoint: {\n          create: mutationGeneric({\n            args: {\n              enterpriseId: v.string(),\n              url: v.string(),\n              secret: v.string(),\n              subscriptions: v.array(v.string()),\n              createdByUserId: v.optional(v.string()),\n            },\n            handler: async (ctx, args) => {\n              const authResult = await authorize(ctx, \"sso.webhook.manage\", {\n                enterpriseId: args.enterpriseId,\n              });\n              if (!authResult.ok)\n                return { ok: false as const, code: authResult.code };\n              const { userId } = authResult;\n              const result = await auth.sso.admin.webhook.endpoint.create(\n                ctx as never,\n                {\n                  ...args,\n                  createdByUserId: args.createdByUserId ?? userId,\n                },\n              );\n              return {\n                _id: result.endpointId,\n                enterpriseId: args.enterpriseId,\n                url: args.url,\n                subscriptions: args.subscriptions,\n                createdByUserId: args.createdByUserId ?? userId,\n                status: \"active\",\n                failureCount: 0,\n              };\n            },\n          }),\n          list: queryGeneric({\n            args: { enterpriseId: v.string() },\n            handler: async (ctx, args) => {\n              const _auth = await authorize(ctx, \"sso.webhook.manage\", {\n                enterpriseId: args.enterpriseId,\n              });\n              if (!_auth.ok) return null;\n              const endpoints = await auth.sso.admin.webhook.endpoint.list(\n                ctx as never,\n                args.enterpriseId,\n              );\n              return endpoints.map((endpoint: Record<string, unknown>) => {\n                const { secretHash: _secretHash, ...rest } = endpoint;\n                return rest;\n              });\n            },\n          }),\n          disable: mutationGeneric({\n            args: { endpointId: v.string() },\n            handler: async (ctx, args) => {\n              const endpoint = await auth.sso.admin.webhook.endpoint.get(\n                ctx as never,\n                args.endpointId,\n              );\n              if (!endpoint) {\n                return {\n                  ok: false as const,\n                  code: \"INVALID_PARAMETERS\" as const,\n                };\n              }\n              const _auth = await authorize(ctx, \"sso.webhook.manage\", {\n                enterpriseId: endpoint.enterpriseId,\n                groupId: endpoint.groupId,\n              });\n              if (!_auth.ok) return { ok: false as const, code: _auth.code };\n              return await auth.sso.admin.webhook.endpoint.disable(\n                ctx as never,\n                args.endpointId,\n              );\n            },\n          }),\n        },\n      },\n    },\n    client: {\n      signIn: queryGeneric({\n        args: {\n          enterpriseId: v.optional(v.string()),\n          email: v.optional(v.string()),\n          domain: v.optional(v.string()),\n          redirectTo: v.optional(v.string()),\n        },\n        handler: async (ctx, args) => {\n          return await auth.sso.client.signIn(ctx as never, args);\n        },\n      }),\n      metadata: queryGeneric({\n        args: {\n          enterpriseId: v.string(),\n          entityId: v.optional(v.string()),\n          acsUrl: v.optional(v.string()),\n          sloUrl: v.optional(v.string()),\n        },\n        handler: async (ctx, args) => {\n          return await auth.sso.client.metadata(ctx as never, args);\n        },\n      }),\n    },\n  };\n}\n\n/**\n * Build optional public SCIM management actions that apps can mount under\n * `convex/auth/scim/**` when they want client-callable enterprise admin APIs.\n *\n * @param auth - Auth API subset providing `scim`, `sso`, and `user` namespaces.\n * @param options - Optional admin authorization config. See {@link EnterpriseMountOptions}.\n * @typeParam TAuthorization - Optional authorization config for typed role IDs.\n * @returns An object with `admin.configure`, `admin.get`, and `admin.validate` actions.\n *\n * @example\n * ```ts\n * // convex/auth/scim.ts\n * import { scim } from \"@robelest/convex-auth/server\";\n * import { auth } from \"../auth\";\n *\n * const mounted = scim(auth, {\n *   admin: {\n *     authorized: async (ctx, input) => { /* check permissions *\\/ },\n *   },\n * });\n *\n * export const configure = mounted.admin.configure;\n * export const get = mounted.admin.get;\n * export const validate = mounted.admin.validate;\n * ```\n *\n * @see {@link sso}\n * @see {@link enterprise}\n */\nexport function scim<\n  TAuthorization extends AuthAuthorizationConfig | undefined = undefined,\n>(\n  auth: Pick<AuthApi<TAuthorization>, \"scim\" | \"sso\" | \"user\">,\n  options?: MountedEnterpriseOptions<AuthRoleId<TAuthorization>>,\n) {\n  const authorize = createMountedAdminAuthorizer(auth, options);\n\n  return {\n    admin: {\n      configure: mutationGeneric({\n        args: {\n          enterpriseId: v.string(),\n          basePath: v.optional(v.string()),\n          status: v.optional(enterpriseStatusValidator),\n        },\n        handler: async (ctx, args) => {\n          const _auth = await authorize(ctx, \"scim.manage\", {\n            enterpriseId: args.enterpriseId,\n          });\n          if (!_auth.ok) return { ok: false as const, code: _auth.code };\n          return await auth.scim.admin.configure(ctx as never, args);\n        },\n      }),\n      get: queryGeneric({\n        args: { enterpriseId: v.string() },\n        handler: async (ctx, args) => {\n          const _auth = await authorize(ctx, \"scim.manage\", {\n            enterpriseId: args.enterpriseId,\n          });\n          if (!_auth.ok) return null;\n          return await auth.scim.admin.get(ctx as never, args.enterpriseId);\n        },\n      }),\n      validate: queryGeneric({\n        args: { enterpriseId: v.string() },\n        handler: async (ctx, args) => {\n          const _auth = await authorize(ctx, \"scim.manage\", {\n            enterpriseId: args.enterpriseId,\n          });\n          if (!_auth.ok) return null;\n          return await auth.scim.admin.validate(\n            ctx as never,\n            args.enterpriseId,\n          );\n        },\n      }),\n    },\n  };\n}\n\n/**\n * Build a flat mounted enterprise API surface for app-owned Convex exports.\n *\n * Combines {@link sso} and {@link scim} into a single flat object with\n * all SSO connection, protocol, policy, audit, webhook, and SCIM\n * management functions plus end-user sign-in helpers. The `authorized`\n * callback is required for all admin operations.\n *\n * @param auth - Auth API subset providing `group`, `member`, `scim`, `sso`, and `user` namespaces.\n * @param options - Required {@link EnterpriseMountOptions} with an `admin.authorized` callback.\n * @typeParam TAuthorization - Optional authorization config for typed role IDs.\n * @returns A flat object with all enterprise management functions (e.g. `createConnection`,\n *   `configureOidc`, `configureScim`, `signIn`, etc.).\n *\n * @example\n * ```ts\n * // convex/auth/enterprise.ts\n * import { enterprise } from \"@robelest/convex-auth/server\";\n * import { auth } from \"../auth\";\n *\n * const api = enterprise(auth, {\n *   admin: {\n *     authorized: async (ctx, input) => { /* check permissions *\\/ },\n *     roles: [\"admin\"],\n *   },\n * });\n *\n * export const createConnection = api.createConnection;\n * export const configureOidc = api.configureOidc;\n * export const signIn = api.signIn;\n * ```\n *\n * @see {@link sso}\n * @see {@link scim}\n */\nexport function enterprise<\n  TAuthorization extends AuthAuthorizationConfig | undefined = undefined,\n>(\n  auth: Pick<\n    AuthApi<TAuthorization>,\n    \"group\" | \"member\" | \"scim\" | \"sso\" | \"user\"\n  >,\n  options: EnterpriseMountOptions<AuthRoleId<TAuthorization>>,\n) {\n  const mountedSso = sso(auth, {\n    admin: options.admin,\n  });\n  const mountedScim = scim(auth, {\n    admin: { authorized: options.admin.authorized },\n  });\n\n  return {\n    createConnection: mountedSso.admin.connection.create,\n    getConnection: mountedSso.admin.connection.get,\n    getConnectionByGroup: mountedSso.admin.connection.getByGroup,\n    getConnectionByDomain: mountedSso.admin.connection.getByDomain,\n    listConnections: mountedSso.admin.connection.list,\n    updateConnection: mountedSso.admin.connection.update,\n    deleteConnection: mountedSso.admin.connection.delete,\n    getConnectionStatus: mountedSso.admin.connection.status,\n    listDomains: mountedSso.admin.connection.domain.list,\n    validateDomains: mountedSso.admin.connection.domain.validate,\n    setDomains: mountedSso.admin.connection.domain.set,\n    requestDomainVerification:\n      mountedSso.admin.connection.domain.verification.request,\n    confirmDomainVerification:\n      mountedSso.admin.connection.domain.verification.confirm,\n    configureOidc: mountedSso.admin.oidc.configure,\n    getOidc: mountedSso.admin.oidc.get,\n    validateOidc: mountedSso.admin.oidc.validate,\n    configureSaml: mountedSso.admin.saml.configure,\n    validateSaml: mountedSso.admin.saml.validate,\n    getPolicy: mountedSso.admin.policy.get,\n    updatePolicy: mountedSso.admin.policy.update,\n    validatePolicy: mountedSso.admin.policy.validate,\n    listAudit: mountedSso.admin.audit.list,\n    createWebhookEndpoint: mountedSso.admin.webhook.endpoint.create,\n    listWebhookEndpoints: mountedSso.admin.webhook.endpoint.list,\n    listWebhookDeliveries: mountedSso.admin.webhook.delivery.list,\n    disableWebhookEndpoint: mountedSso.admin.webhook.endpoint.disable,\n    configureScim: mountedScim.admin.configure,\n    getScim: mountedScim.admin.get,\n    validateScim: mountedScim.admin.validate,\n    signIn: mountedSso.client.signIn,\n    metadata: mountedSso.client.metadata,\n  };\n}\n"],"mappings":";;;;;AAgIA,SAAS,oBAAoB,MAA6B;AACxD,QAAO,OAAO,QAEgB;AAC5B,SAAO,MAAM,KAAK,KAAK,GAAG,IAAa;;;AAI3C,SAAS,wBACP,OACA;AACA,QAAO,OAAO,KAAK,SAAU,OAAO,SAAS,WAAW,OAAO,KAAK,GAAI;;AAG1E,eAAe,+BACb,MACA,KACA,QACA;AACA,KAAI,OAAO,YAAY,OACrB,QAAO;EACL,cAAc,OAAO;EACrB,SAAS,OAAO;EAChB,iBAAiB,OAAO;EACzB;AAGH,KAAI,OAAO,iBAAiB,QAAW;EACrC,MAAM,aAAa,MAAM,KAAK,IAAI,MAAM,WAAW,IACjD,KACA,OAAO,aACR;AACD,MAAI,eAAe,KACjB,OAAM,IAAI,YAAY;GACpB,MAAM;GACN,SAAS;GACV,CAAC;AAEJ,SAAO;GACL,cAAc,WAAW;GACzB,SAAS,WAAW;GACpB,iBAAiB,WAAW;GAC7B;;AAGH,KAAI,OAAO,WAAW,QAAW;EAC/B,MAAM,WAAW,MAAM,KAAK,IAAI,MAAM,WAAW,YAC/C,KACA,OAAO,OACR;AACD,MAAI,UAAU,eAAe,OAC3B,OAAM,IAAI,YAAY;GACpB,MAAM;GACN,SAAS;GACV,CAAC;AAEJ,SAAO;GACL,cAAc,SAAS,WAAW;GAClC,SAAS,SAAS,WAAW;GAC7B,iBAAiB,SAAS,WAAW;GACtC;;AAGH,QAAO;EACL,cAAc;EACd,SAAS;EACT,iBAAiB;EAClB;;AAGH,SAAS,6BACP,MACA,SACA;CACA,MAAM,gBAAgB,oBAAoB,KAAK;AAE/C,QAAO,OACL,KACA,YACA,SAAkC,EAAE,KACjC;EACH,MAAM,SAAS,MAAM,cAAc,IAAI;AACvC,MAAI,WAAW,KACb,QAAO;GAAE,IAAI;GAAgB,MAAM;GAA0B;AAE/D,MAAI,CAAC,SAAS,OAAO,WACnB,QAAO;GAAE,IAAI;GAAgB,MAAM;GAAsB;EAE3D,MAAM,WAAW,MAAM,+BAA+B,MAAM,KAAK,OAAO;EACxE,MAAM,aAAa,MAAM,QAAQ,MAAM,WAAW,KAAK;GACrD;GACA;GACA,cAAc,SAAS;GACvB,SAAS,SAAS;GAClB,iBAAiB,SAAS;GAC3B,CAAC;AACF,MAAI,cAAc,CAAC,WAAW,GAC5B,QAAO;GAAE,IAAI;GAAgB,MAAM;GAAsB;AAE3D,SAAO;GAAE,IAAI;GAAe;GAAQ,GAAG;GAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCrD,SAAgB,IAGd,MACA,SACA;CACA,MAAM,YAAY,6BAA6B,MAAM,QAAQ;CAC7D,MAAM,eAAe,wBAAwB,SAAS,OAAO,MAAM;AAEnE,QAAO;EACL,OAAO;GACL,YAAY;IACV,QAAQ,gBAAgB;KACtB,MAAM;MACJ,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC;MAC/B,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;MAC5B,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;MAC5B,QAAQ,EAAE,SAAS,0BAA0B;MAC7C,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;MAC/B;KACD,SAAS,OAAO,KAAK,SAAS;MAC5B,MAAM,aAAa,MAAM,UAAU,KAAK,yBAAyB,EAC/D,SAAS,KAAK,SACf,CAAC;AACF,UAAI,CAAC,WAAW,GACd,QAAO;OAAE,IAAI;OAAgB,MAAM,WAAW;OAAM;MACtD,MAAM,EAAE,WAAW;MACnB,MAAM,eAAe,KAAK,YAAY;MACtC,MAAM,UACJ,KAAK,YAEH,MAAM,KAAK,MAAM,OAAO,KAAc;OACpC,MAAM,KAAK,MAAM,MAAM,IAAI,KAAK,MAAM,MAAM,IAAI;OAChD,MAAM,KAAK;OACX,MAAM;OACP,CAAC,EACF;AACJ,UAAI,aACF,OAAM,KAAK,OAAO,OAAO,KAAc;OACrC;OACA;OACA,SAAS;OACV,CAAC;MAEJ,MAAM,UAAU,MAAM,KAAK,IAAI,MAAM,WAAW,OAC9C,KACA;OACE;OACA,MAAM,KAAK;OACX,MAAM,KAAK;OACX,QAAQ,KAAK;OACd,CACF;AACD,UAAI,KAAK,OACP,OAAM,KAAK,IAAI,MAAM,WAAW,OAAO,IACrC,KACA,QAAQ,cACR,CAAC;OAAE,QAAQ,KAAK;OAAQ,WAAW;OAAM,CAAC,CAC3C;AAEH,aAAO;OACL,GAAG;OACH;OACA,cAAc;OACf;;KAEJ,CAAC;IACF,KAAK,aAAa;KAChB,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE;KAClC,SAAS,OAAO,KAAK,SAAS;AAI5B,UAAI,EAHU,MAAM,UAAU,KAAK,uBAAuB,EACxD,cAAc,KAAK,cACpB,CAAC,EACS,GAAI,QAAO;AACtB,aAAO,MAAM,KAAK,IAAI,MAAM,WAAW,IACrC,KACA,KAAK,aACN;;KAEJ,CAAC;IACF,YAAY,aAAa;KACvB,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE;KAC7B,SAAS,OAAO,KAAK,SAAS;AAI5B,UAAI,EAHU,MAAM,UAAU,KAAK,uBAAuB,EACxD,SAAS,KAAK,SACf,CAAC,EACS,GAAI,QAAO;AACtB,aAAO,MAAM,KAAK,IAAI,MAAM,WAAW,WACrC,KACA,KAAK,QACN;;KAEJ,CAAC;IACF,aAAa,aAAa;KACxB,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE;KAC5B,SAAS,OAAO,KAAK,SAAS;AAI5B,UAAI,EAHU,MAAM,UAAU,KAAK,uBAAuB,EACxD,QAAQ,KAAK,QACd,CAAC,EACS,GAAI,QAAO;AACtB,aAAO,MAAM,KAAK,IAAI,MAAM,WAAW,YACrC,KACA,KAAK,OACN;;KAEJ,CAAC;IACF,MAAM,aAAa;KACjB,MAAM;MACJ,OAAO,EAAE,SAAS,mCAAmC;MACrD,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;MAC7B,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;MACjD,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC;MAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,MAAM,EAAE,EAAE,QAAQ,OAAO,CAAC,CAAC;MAChE;KACD,SAAS,OAAO,KAAK,SAAS;AAI5B,UAAI,EAHU,MAAM,UAAU,KAAK,uBAAuB,EACxD,SAAS,KAAK,OAAO,SACtB,CAAC,EACS,GAAI,QAAO;AACtB,aAAO,MAAM,KAAK,IAAI,MAAM,WAAW,KACrC,KACA,KACD;;KAEJ,CAAC;IACF,QAAQ,gBAAgB;KACtB,MAAM;MACJ,cAAc,EAAE,QAAQ;MACxB,MAAM,EAAE,OAAO;OACb,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;OAC5B,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;OAC5B,QAAQ,EAAE,SAAS,0BAA0B;OAC9C,CAAC;MACH;KACD,SAAS,OAAO,KAAK,SAAS;MAC5B,MAAM,QAAQ,MAAM,UAAU,KAAK,yBAAyB,EAC1D,cAAc,KAAK,cACpB,CAAC;AACF,UAAI,CAAC,MAAM,GAAI,QAAO;OAAE,IAAI;OAAgB,MAAM,MAAM;OAAM;AAC9D,YAAM,KAAK,IAAI,MAAM,WAAW,OAC9B,KACA,KAAK,cACL,KAAK,KACN;AACD,aAAO;OAAE,IAAI;OAAe,cAAc,KAAK;OAAc;;KAEhE,CAAC;IACF,QAAQ,gBAAgB;KACtB,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE;KAClC,SAAS,OAAO,KAAK,SAAS;MAC5B,MAAM,QAAQ,MAAM,UAAU,KAAK,yBAAyB,EAC1D,cAAc,KAAK,cACpB,CAAC;AACF,UAAI,CAAC,MAAM,GAAI,QAAO;OAAE,IAAI;OAAgB,MAAM,MAAM;OAAM;AAC9D,aAAO,MAAM,KAAK,IAAI,MAAM,WAAW,OACrC,KACA,KAAK,aACN;;KAEJ,CAAC;IACF,QAAQ,aAAa;KACnB,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE;KAClC,SAAS,OAAO,KAAK,SAAS;AAI5B,UAAI,EAHU,MAAM,UAAU,KAAK,uBAAuB,EACxD,cAAc,KAAK,cACpB,CAAC,EACS,GAAI,QAAO;AACtB,aAAO,MAAM,KAAK,IAAI,MAAM,WAAW,OACrC,KACA,KAAK,aACN;;KAEJ,CAAC;IACF,QAAQ;KACN,MAAM,aAAa;MACjB,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE;MAClC,SAAS,OAAO,KAAK,SAAS;AAI5B,WAAI,EAHU,MAAM,UAAU,KAAK,uBAAuB,EACxD,cAAc,KAAK,cACpB,CAAC,EACS,GAAI,QAAO;AACtB,cAAO,MAAM,KAAK,IAAI,MAAM,WAAW,OAAO,KAC5C,KACA,KAAK,aACN;;MAEJ,CAAC;KACF,UAAU,aAAa;MACrB,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE;MAClC,SAAS,OAAO,KAAK,SAAS;AAI5B,WAAI,EAHU,MAAM,UAAU,KAAK,qBAAqB,EACtD,cAAc,KAAK,cACpB,CAAC,EACS,GAAI,QAAO;AACtB,cAAO,MAAM,KAAK,IAAI,MAAM,WAAW,OAAO,SAC5C,KACA,KAAK,aACN;;MAEJ,CAAC;KACF,KAAK,gBAAgB;MACnB,MAAM;OACJ,cAAc,EAAE,QAAQ;OACxB,SAAS,EAAE,MAAM,+BAA+B;OACjD;MACD,SAAS,OAAO,KAAK,SAAS;OAC5B,MAAM,QAAQ,MAAM,UAAU,KAAK,qBAAqB,EACtD,cAAc,KAAK,cACpB,CAAC;AACF,WAAI,CAAC,MAAM,GAAI,QAAO;QAAE,IAAI;QAAgB,MAAM,MAAM;QAAM;AAC9D,cAAO,MAAM,KAAK,IAAI,MAAM,WAAW,OAAO,IAC5C,KACA,KAAK,cACL,KAAK,QACN;;MAEJ,CAAC;KACF,cAAc;MACZ,SAAS,gBAAgB;OACvB,MAAM;OACN,SAAS,OAAO,KAAK,SAAS;QAC5B,MAAM,QAAQ,MAAM,UAAU,KAAK,qBAAqB,EACtD,cAAc,KAAK,cACpB,CAAC;AACF,YAAI,CAAC,MAAM,GAAI,QAAO;SAAE,IAAI;SAAgB,MAAM,MAAM;SAAM;AAC9D,eAAO,MAAM,KAAK,IAAI,MAAM,WAAW,OAAO,aAAa,QACzD,KACA,KACD;;OAEJ,CAAC;MACF,SAAS,cAAc;OACrB,MAAM;OACN,SAAS,OAAO,KAAK,SAAS;QAC5B,MAAM,QAAQ,MAAM,UAAU,KAAK,qBAAqB,EACtD,cAAc,KAAK,cACpB,CAAC;AACF,YAAI,CAAC,MAAM,GAAI,QAAO;SAAE,IAAI;SAAgB,MAAM,MAAM;SAAM;AAC9D,eAAO,MAAM,KAAK,IAAI,MAAM,WAAW,OAAO,aAAa,QACzD,KACA,KACD;;OAEJ,CAAC;MACH;KACF;IACF;GACD,MAAM;IACJ,WAAW,gBAAgB;KACzB,MAAM;MACJ,cAAc,EAAE,QAAQ;MACxB,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;MAC9B,cAAc,EAAE,SAAS,EAAE,QAAQ,CAAC;MACpC,UAAU,EAAE,QAAQ;MACpB,cAAc,EAAE,SAAS,EAAE,QAAQ,CAAC;MACpC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;MACvC,qBAAqB,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;MACjE,uBAAuB,EAAE,SAAS,EAAE,QAAQ,CAAC;MAC7C,cAAc,EAAE,SAAS,EAAE,SAAS,CAAC;MACrC,aAAa,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;MAC1D;KACD,SAAS,OAAO,KAAK,SAAS;MAC5B,MAAM,QAAQ,MAAM,UAAU,KAAK,uBAAuB,EACxD,cAAc,KAAK,cACpB,CAAC;AACF,UAAI,CAAC,MAAM,GAAI,QAAO;OAAE,IAAI;OAAgB,MAAM,MAAM;OAAM;AAC9D,aAAO,MAAM,KAAK,IAAI,MAAM,KAAK,UAAU,KAAc,KAAK;;KAEjE,CAAC;IACF,KAAK,aAAa;KAChB,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE;KAClC,SAAS,OAAO,KAAK,SAAS;AAI5B,UAAI,EAHU,MAAM,UAAU,KAAK,uBAAuB,EACxD,cAAc,KAAK,cACpB,CAAC,EACS,GAAI,QAAO;AACtB,aAAO,MAAM,KAAK,IAAI,MAAM,KAAK,IAC/B,KACA,KAAK,aACN;;KAEJ,CAAC;IACF,UAAU,cAAc;KACtB,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE;KAClC,SAAS,OAAO,KAAK,SAAS;MAC5B,MAAM,QAAQ,MAAM,UAAU,KAAK,uBAAuB,EACxD,cAAc,KAAK,cACpB,CAAC;AACF,UAAI,CAAC,MAAM,GAAI,QAAO;OAAE,IAAI;OAAgB,MAAM,MAAM;OAAM;AAC9D,aAAO,MAAM,KAAK,IAAI,MAAM,KAAK,SAC/B,KACA,KAAK,aACN;;KAEJ,CAAC;IACH;GACD,MAAM;IACJ,WAAW,cAAc;KACvB,MAAM;MACJ,cAAc,EAAE,QAAQ;MACxB,aAAa,EAAE,SAAS,EAAE,QAAQ,CAAC;MACnC,aAAa,EAAE,SAAS,EAAE,QAAQ,CAAC;MACnC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;MACxC,mBAAmB,EAAE,SAAS,EAAE,SAAS,CAAC;MAC1C,kBAAkB,EAAE,SAClB,wCACD;MACD,IAAI,EAAE,SAAS,0BAA0B;MAC1C;KACD,SAAS,OAAO,KAAK,SAAS;MAC5B,MAAM,QAAQ,MAAM,UAAU,KAAK,uBAAuB,EACxD,cAAc,KAAK,cACpB,CAAC;AACF,UAAI,CAAC,MAAM,GAAI,QAAO;OAAE,IAAI;OAAgB,MAAM,MAAM;OAAM;AAC9D,aAAO,MAAM,KAAK,IAAI,MAAM,KAAK,UAAU,KAAc,KAAK;;KAEjE,CAAC;IACF,UAAU,aAAa;KACrB,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE;KAClC,SAAS,OAAO,KAAK,SAAS;AAI5B,UAAI,EAHU,MAAM,UAAU,KAAK,uBAAuB,EACxD,cAAc,KAAK,cACpB,CAAC,EACS,GAAI,QAAO;AACtB,aAAO,MAAM,KAAK,IAAI,MAAM,KAAK,SAC/B,KACA,KAAK,aACN;;KAEJ,CAAC;IACH;GACD,QAAQ;IACN,KAAK,aAAa;KAChB,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE;KAClC,SAAS,OAAO,KAAK,SAAS;AAI5B,UAAI,EAHU,MAAM,UAAU,KAAK,uBAAuB,EACxD,cAAc,KAAK,cACpB,CAAC,EACS,GAAI,QAAO;AACtB,aAAO,MAAM,KAAK,IAAI,MAAM,OAAO,IACjC,KACA,KAAK,aACN;;KAEJ,CAAC;IACF,QAAQ,gBAAgB;KACtB,MAAM;MACJ,cAAc,EAAE,QAAQ;MACxB,OAAO;MACR;KACD,SAAS,OAAO,KAAK,SAAS;MAC5B,MAAM,QAAQ,MAAM,UAAU,KAAK,qBAAqB,EACtD,cAAc,KAAK,cACpB,CAAC;AACF,UAAI,CAAC,MAAM,GAAI,QAAO;OAAE,IAAI;OAAgB,MAAM,MAAM;OAAM;AAC9D,aAAO,MAAM,KAAK,IAAI,MAAM,OAAO,OACjC,KACA,KAAK,cACL,KAAK,MACN;;KAEJ,CAAC;IACF,UAAU,aAAa;KACrB,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE;KAClC,SAAS,OAAO,KAAK,SAAS;AAI5B,UAAI,EAHU,MAAM,UAAU,KAAK,qBAAqB,EACtD,cAAc,KAAK,cACpB,CAAC,EACS,GAAI,QAAO;AACtB,aAAO,MAAM,KAAK,IAAI,MAAM,OAAO,SACjC,KACA,KAAK,aACN;;KAEJ,CAAC;IACH;GACD,OAAO,EACL,MAAM,aAAa;IACjB,MAAM;KACJ,cAAc,EAAE,SAAS,EAAE,QAAQ,CAAC;KACpC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC;KAC/B,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;KAC9B;IACD,SAAS,OAAO,KAAK,SAAS;AAK5B,SAAI,EAJU,MAAM,UAAU,KAAK,kBAAkB;MACnD,cAAc,KAAK;MACnB,SAAS,KAAK;MACf,CAAC,EACS,GAAI,QAAO;AACtB,YAAO,MAAM,KAAK,IAAI,MAAM,MAAM,KAAK,KAAc,KAAK;;IAE7D,CAAC,EACH;GACD,SAAS;IACP,UAAU,EACR,MAAM,aAAa;KACjB,MAAM;MACJ,cAAc,EAAE,QAAQ;MACxB,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;MAC9B;KACD,SAAS,OAAO,KAAK,SAAS;AAI5B,UAAI,EAHU,MAAM,UAAU,KAAK,sBAAsB,EACvD,cAAc,KAAK,cACpB,CAAC,EACS,GAAI,QAAO;AACtB,aAAO,MAAO,KAAK,IAAI,MAAM,QAAgB,SAAS,KACpD,KACA,KACD;;KAEJ,CAAC,EACH;IACD,UAAU;KACR,QAAQ,gBAAgB;MACtB,MAAM;OACJ,cAAc,EAAE,QAAQ;OACxB,KAAK,EAAE,QAAQ;OACf,QAAQ,EAAE,QAAQ;OAClB,eAAe,EAAE,MAAM,EAAE,QAAQ,CAAC;OAClC,iBAAiB,EAAE,SAAS,EAAE,QAAQ,CAAC;OACxC;MACD,SAAS,OAAO,KAAK,SAAS;OAC5B,MAAM,aAAa,MAAM,UAAU,KAAK,sBAAsB,EAC5D,cAAc,KAAK,cACpB,CAAC;AACF,WAAI,CAAC,WAAW,GACd,QAAO;QAAE,IAAI;QAAgB,MAAM,WAAW;QAAM;OACtD,MAAM,EAAE,WAAW;AAQnB,cAAO;QACL,MARa,MAAM,KAAK,IAAI,MAAM,QAAQ,SAAS,OACnD,KACA;SACE,GAAG;SACH,iBAAiB,KAAK,mBAAmB;SAC1C,CACF,EAEa;QACZ,cAAc,KAAK;QACnB,KAAK,KAAK;QACV,eAAe,KAAK;QACpB,iBAAiB,KAAK,mBAAmB;QACzC,QAAQ;QACR,cAAc;QACf;;MAEJ,CAAC;KACF,MAAM,aAAa;MACjB,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE;MAClC,SAAS,OAAO,KAAK,SAAS;AAI5B,WAAI,EAHU,MAAM,UAAU,KAAK,sBAAsB,EACvD,cAAc,KAAK,cACpB,CAAC,EACS,GAAI,QAAO;AAKtB,eAJkB,MAAM,KAAK,IAAI,MAAM,QAAQ,SAAS,KACtD,KACA,KAAK,aACN,EACgB,KAAK,aAAsC;QAC1D,MAAM,EAAE,YAAY,aAAa,GAAG,SAAS;AAC7C,eAAO;SACP;;MAEL,CAAC;KACF,SAAS,gBAAgB;MACvB,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE;MAChC,SAAS,OAAO,KAAK,SAAS;OAC5B,MAAM,WAAW,MAAM,KAAK,IAAI,MAAM,QAAQ,SAAS,IACrD,KACA,KAAK,WACN;AACD,WAAI,CAAC,SACH,QAAO;QACL,IAAI;QACJ,MAAM;QACP;OAEH,MAAM,QAAQ,MAAM,UAAU,KAAK,sBAAsB;QACvD,cAAc,SAAS;QACvB,SAAS,SAAS;QACnB,CAAC;AACF,WAAI,CAAC,MAAM,GAAI,QAAO;QAAE,IAAI;QAAgB,MAAM,MAAM;QAAM;AAC9D,cAAO,MAAM,KAAK,IAAI,MAAM,QAAQ,SAAS,QAC3C,KACA,KAAK,WACN;;MAEJ,CAAC;KACH;IACF;GACF;EACD,QAAQ;GACN,QAAQ,aAAa;IACnB,MAAM;KACJ,cAAc,EAAE,SAAS,EAAE,QAAQ,CAAC;KACpC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;KAC7B,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;KAC9B,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC;KACnC;IACD,SAAS,OAAO,KAAK,SAAS;AAC5B,YAAO,MAAM,KAAK,IAAI,OAAO,OAAO,KAAc,KAAK;;IAE1D,CAAC;GACF,UAAU,aAAa;IACrB,MAAM;KACJ,cAAc,EAAE,QAAQ;KACxB,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;KAChC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;KAC9B,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;KAC/B;IACD,SAAS,OAAO,KAAK,SAAS;AAC5B,YAAO,MAAM,KAAK,IAAI,OAAO,SAAS,KAAc,KAAK;;IAE5D,CAAC;GACH;EACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCH,SAAgB,KAGd,MACA,SACA;CACA,MAAM,YAAY,6BAA6B,MAAM,QAAQ;AAE7D,QAAO,EACL,OAAO;EACL,WAAW,gBAAgB;GACzB,MAAM;IACJ,cAAc,EAAE,QAAQ;IACxB,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;IAChC,QAAQ,EAAE,SAAS,0BAA0B;IAC9C;GACD,SAAS,OAAO,KAAK,SAAS;IAC5B,MAAM,QAAQ,MAAM,UAAU,KAAK,eAAe,EAChD,cAAc,KAAK,cACpB,CAAC;AACF,QAAI,CAAC,MAAM,GAAI,QAAO;KAAE,IAAI;KAAgB,MAAM,MAAM;KAAM;AAC9D,WAAO,MAAM,KAAK,KAAK,MAAM,UAAU,KAAc,KAAK;;GAE7D,CAAC;EACF,KAAK,aAAa;GAChB,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE;GAClC,SAAS,OAAO,KAAK,SAAS;AAI5B,QAAI,EAHU,MAAM,UAAU,KAAK,eAAe,EAChD,cAAc,KAAK,cACpB,CAAC,EACS,GAAI,QAAO;AACtB,WAAO,MAAM,KAAK,KAAK,MAAM,IAAI,KAAc,KAAK,aAAa;;GAEpE,CAAC;EACF,UAAU,aAAa;GACrB,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE;GAClC,SAAS,OAAO,KAAK,SAAS;AAI5B,QAAI,EAHU,MAAM,UAAU,KAAK,eAAe,EAChD,cAAc,KAAK,cACpB,CAAC,EACS,GAAI,QAAO;AACtB,WAAO,MAAM,KAAK,KAAK,MAAM,SAC3B,KACA,KAAK,aACN;;GAEJ,CAAC;EACH,EACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCH,SAAgB,WAGd,MAIA,SACA;CACA,MAAM,aAAa,IAAI,MAAM,EAC3B,OAAO,QAAQ,OAChB,CAAC;CACF,MAAM,cAAc,KAAK,MAAM,EAC7B,OAAO,EAAE,YAAY,QAAQ,MAAM,YAAY,EAChD,CAAC;AAEF,QAAO;EACL,kBAAkB,WAAW,MAAM,WAAW;EAC9C,eAAe,WAAW,MAAM,WAAW;EAC3C,sBAAsB,WAAW,MAAM,WAAW;EAClD,uBAAuB,WAAW,MAAM,WAAW;EACnD,iBAAiB,WAAW,MAAM,WAAW;EAC7C,kBAAkB,WAAW,MAAM,WAAW;EAC9C,kBAAkB,WAAW,MAAM,WAAW;EAC9C,qBAAqB,WAAW,MAAM,WAAW;EACjD,aAAa,WAAW,MAAM,WAAW,OAAO;EAChD,iBAAiB,WAAW,MAAM,WAAW,OAAO;EACpD,YAAY,WAAW,MAAM,WAAW,OAAO;EAC/C,2BACE,WAAW,MAAM,WAAW,OAAO,aAAa;EAClD,2BACE,WAAW,MAAM,WAAW,OAAO,aAAa;EAClD,eAAe,WAAW,MAAM,KAAK;EACrC,SAAS,WAAW,MAAM,KAAK;EAC/B,cAAc,WAAW,MAAM,KAAK;EACpC,eAAe,WAAW,MAAM,KAAK;EACrC,cAAc,WAAW,MAAM,KAAK;EACpC,WAAW,WAAW,MAAM,OAAO;EACnC,cAAc,WAAW,MAAM,OAAO;EACtC,gBAAgB,WAAW,MAAM,OAAO;EACxC,WAAW,WAAW,MAAM,MAAM;EAClC,uBAAuB,WAAW,MAAM,QAAQ,SAAS;EACzD,sBAAsB,WAAW,MAAM,QAAQ,SAAS;EACxD,uBAAuB,WAAW,MAAM,QAAQ,SAAS;EACzD,wBAAwB,WAAW,MAAM,QAAQ,SAAS;EAC1D,eAAe,YAAY,MAAM;EACjC,SAAS,YAAY,MAAM;EAC3B,cAAc,YAAY,MAAM;EAChC,QAAQ,WAAW,OAAO;EAC1B,UAAU,WAAW,OAAO;EAC7B"}
+{"version":3,"file":"mounts.js","names":[],"sources":["../../src/server/mounts.ts"],"sourcesContent":["import { Cv } from \"@robelest/fx/convex\";\nimport { actionGeneric, mutationGeneric, queryGeneric } from \"convex/server\";\nimport { ConvexError, v } from \"convex/values\";\n\nimport type { AuthApi } from \"./auth\";\nimport {\n  enterpriseConnectionWhereValidator,\n  enterpriseDomainInputValidator,\n  enterpriseDomainVerificationInputValidator,\n  enterprisePolicyPatchValidator,\n  enterpriseSamlAttributeMappingValidator,\n  enterpriseSamlSpValidator,\n  enterpriseStatusValidator,\n} from \"./enterprise/validators\";\nimport type { AuthAuthorizationConfig, AuthRoleId } from \"./types\";\n\n/**\n * Permission identifiers used by mounted enterprise admin APIs.\n *\n * These permission strings are passed to your {@link EnterpriseAuthorizer}\n * callback so app code can decide whether the current user may perform a\n * specific SSO or SCIM management operation.\n *\n * @example\n * ```ts\n * const authorized: EnterpriseAuthorizer = async (ctx, input) => {\n *   if (input.permission === \"sso.connection.create\") {\n *     // Only org admins may create SSO connections\n *   }\n * };\n * ```\n */\nexport type EnterpriseAdminPermission =\n  | \"sso.connection.create\"\n  | \"sso.connection.read\"\n  | \"sso.connection.manage\"\n  | \"sso.domain.manage\"\n  | \"sso.protocol.manage\"\n  | \"sso.policy.manage\"\n  | \"sso.audit.read\"\n  | \"sso.webhook.manage\"\n  | \"scim.manage\";\n\n/**\n * Input passed to an {@link EnterpriseAuthorizer}.\n *\n * Contains the acting user, the requested permission, and the resolved\n * enterprise/group scope for the operation being authorized.\n */\nexport type EnterpriseAdminAuthorizationInput = {\n  /** The signed-in user's ID performing the admin action. */\n  userId: string;\n  /** The {@link EnterpriseAdminPermission} being requested. */\n  permission: EnterpriseAdminPermission;\n  /** Enterprise document ID, if the operation targets a specific enterprise. */\n  enterpriseId?: string;\n  /** Group document ID, if explicitly provided by the caller. */\n  groupId?: string;\n  /** Resolved group ID from the enterprise record, or `null` when no enterprise context. */\n  resolvedGroupId: string | null;\n};\n\n/**\n * App-defined authorization hook for mounted enterprise admin APIs.\n *\n * Return `void` (or resolve) to allow the operation, or throw to deny it.\n *\n * @param ctx - Convex context with `ctx.auth` for identity checks.\n * @param input - The {@link EnterpriseAdminAuthorizationInput} describing who is doing what.\n * @returns `void` to allow; throw to deny.\n *\n * @example\n * ```ts\n * import { EnterpriseAuthorizer } from \"@robelest/convex-auth/server\";\n *\n * const authorized: EnterpriseAuthorizer = async (ctx, input) => {\n *   const identity = await ctx.auth.getUserIdentity();\n *   if (!identity) throw new Error(\"Forbidden\");\n *   // Allow all admin ops for the org owner\n * };\n * ```\n */\nexport type EnterpriseAuthorizer = (\n  ctx: { auth: import(\"convex/server\").Auth },\n  input: EnterpriseAdminAuthorizationInput,\n) => Promise<void>;\n\ntype RoleRef<TRoleId extends string> = { id: TRoleId };\n\ntype MountedEnterpriseOptions<TRoleId extends string = string> = {\n  admin?: {\n    authorized?: EnterpriseAuthorizer;\n    roles?: Array<TRoleId | RoleRef<TRoleId>>;\n  };\n};\n\n/**\n * Configuration for {@link enterprise}, {@link sso}, and {@link scim}\n * mounted admin APIs.\n *\n * @typeParam TRoleId - Role IDs that may be assigned to enterprise creators.\n *\n * @example\n * ```ts\n * import { enterprise, EnterpriseMountOptions } from \"@robelest/convex-auth/server\";\n *\n * const options: EnterpriseMountOptions = {\n *   admin: {\n *     authorized: async (ctx, input) => {\n *       // Verify the user has permission for `input.permission`\n *     },\n *     roles: [\"admin\", \"owner\"],\n *   },\n * };\n * ```\n */\nexport type EnterpriseMountOptions<TRoleId extends string = string> = {\n  admin: {\n    authorized: EnterpriseAuthorizer;\n    roles?: Array<TRoleId | RoleRef<TRoleId>>;\n  };\n};\n\ntype MountedEnterpriseTarget = {\n  enterpriseId?: string;\n  groupId?: string;\n  domain?: string;\n};\n\nfunction requireSignedInUser(auth: Pick<AuthApi, \"user\">) {\n  return async (ctx: {\n    auth: import(\"convex/server\").Auth;\n  }): Promise<string | null> => {\n    return await auth.user.id(ctx as never);\n  };\n}\n\nfunction normalizeCreatorRoleIds<TRoleId extends string>(\n  roles?: Array<TRoleId | RoleRef<TRoleId>>,\n) {\n  return roles?.map((role) => (typeof role === \"string\" ? role : role.id));\n}\n\nasync function resolveMountedEnterpriseTarget(\n  auth: Pick<AuthApi, \"sso\">,\n  ctx: { auth: import(\"convex/server\").Auth },\n  target: MountedEnterpriseTarget,\n) {\n  if (target.groupId !== undefined) {\n    return {\n      enterpriseId: target.enterpriseId,\n      groupId: target.groupId,\n      resolvedGroupId: target.groupId,\n    };\n  }\n\n  if (target.enterpriseId !== undefined) {\n    const enterprise = await auth.sso.admin.connection.get(\n      ctx as never,\n      target.enterpriseId,\n    );\n    if (enterprise === null) {\n      throw new ConvexError({\n        code: \"INVALID_PARAMETERS\",\n        message: \"Enterprise not found.\",\n      });\n    }\n    return {\n      enterpriseId: enterprise._id,\n      groupId: enterprise.groupId,\n      resolvedGroupId: enterprise.groupId,\n    };\n  }\n\n  if (target.domain !== undefined) {\n    const resolved = await auth.sso.admin.connection.getByDomain(\n      ctx as never,\n      target.domain,\n    );\n    if (resolved?.enterprise === undefined) {\n      throw new ConvexError({\n        code: \"INVALID_PARAMETERS\",\n        message: \"Enterprise not found.\",\n      });\n    }\n    return {\n      enterpriseId: resolved.enterprise._id,\n      groupId: resolved.enterprise.groupId,\n      resolvedGroupId: resolved.enterprise.groupId,\n    };\n  }\n\n  return {\n    enterpriseId: undefined,\n    groupId: undefined,\n    resolvedGroupId: null,\n  };\n}\n\nfunction createMountedAdminAuthorizer(\n  auth: Pick<AuthApi, \"sso\" | \"user\">,\n  options?: MountedEnterpriseOptions,\n) {\n  const requireUserId = requireSignedInUser(auth);\n\n  return async (\n    ctx: { auth: import(\"convex/server\").Auth },\n    permission: EnterpriseAdminPermission,\n    target: MountedEnterpriseTarget = {},\n  ) => {\n    const userId = await requireUserId(ctx);\n    if (userId === null) {\n      throw Cv.error({\n        code: \"NOT_SIGNED_IN\",\n        message: \"You must be signed in to perform this action.\",\n      });\n    }\n    if (!options?.admin?.authorized) {\n      throw Cv.error({\n        code: \"FORBIDDEN\",\n        message: \"Access denied.\",\n      });\n    }\n    const resolved = await resolveMountedEnterpriseTarget(auth, ctx, target);\n    await options.admin.authorized(ctx, {\n      userId,\n      permission,\n      enterpriseId: resolved.enterpriseId,\n      groupId: resolved.groupId,\n      resolvedGroupId: resolved.resolvedGroupId,\n    });\n    return { userId, ...resolved };\n  };\n}\n\n/**\n * Build optional public SSO management actions that apps can mount under\n * `convex/auth/sso/**` when they want client-callable enterprise APIs.\n *\n * `admin` is for tenant-admin control-plane operations and should be mounted\n * with an explicit authorization policy. `client` is for end-user sign-in\n * helpers and does not require tenant-admin authorization.\n *\n * @param auth - Auth API subset providing `group`, `member`, `sso`, and `user` namespaces.\n * @param options - Optional admin authorization config. See {@link EnterpriseMountOptions}.\n * @typeParam TAuthorization - Optional authorization config for typed role IDs.\n * @returns An object with `admin` (connection CRUD, OIDC/SAML protocol config, policy,\n *   audit, webhooks, domain management) and `client` (signIn, metadata) namespaces.\n *\n * @example\n * ```ts\n * // convex/auth/sso.ts\n * import { sso } from \"@robelest/convex-auth/server\";\n * import { auth } from \"../auth\";\n *\n * const mounted = sso(auth, {\n *   admin: {\n *     authorized: async (ctx, input) => { /* check permissions *\\/ },\n *   },\n * });\n *\n * export const createConnection = mounted.admin.connection.create;\n * export const signIn = mounted.client.signIn;\n * ```\n *\n * @see {@link scim}\n * @see {@link enterprise}\n */\nexport function sso<\n  TAuthorization extends AuthAuthorizationConfig | undefined = undefined,\n>(\n  auth: Pick<AuthApi<TAuthorization>, \"group\" | \"member\" | \"sso\" | \"user\">,\n  options?: MountedEnterpriseOptions<AuthRoleId<TAuthorization>>,\n) {\n  const authorize = createMountedAdminAuthorizer(auth, options);\n  const adminRoleIds = normalizeCreatorRoleIds(options?.admin?.roles);\n\n  return {\n    admin: {\n      connection: {\n        create: mutationGeneric({\n          args: {\n            groupId: v.optional(v.string()),\n            name: v.optional(v.string()),\n            slug: v.optional(v.string()),\n            status: v.optional(enterpriseStatusValidator),\n            domain: v.optional(v.string()),\n          },\n          handler: async (ctx, args) => {\n            const authResult = await authorize(ctx, \"sso.connection.create\", {\n              groupId: args.groupId,\n            });\n            const { userId } = authResult;\n            const createsGroup = args.groupId === undefined;\n            const groupId =\n              args.groupId ??\n              (\n                await auth.group.create(ctx as never, {\n                  name: args.name?.trim() || args.slug?.trim() || \"Enterprise\",\n                  slug: args.slug,\n                  type: \"enterprise\",\n                })\n              ).groupId;\n            if (createsGroup) {\n              await auth.member.create(ctx as never, {\n                groupId,\n                userId,\n                roleIds: adminRoleIds,\n              });\n            }\n            const created = await auth.sso.admin.connection.create(\n              ctx as never,\n              {\n                groupId,\n                name: args.name,\n                slug: args.slug,\n                status: args.status,\n              },\n            );\n            if (args.domain) {\n              await auth.sso.admin.connection.domain.set(\n                ctx as never,\n                created.enterpriseId,\n                [{ domain: args.domain, isPrimary: true }],\n              );\n            }\n            return {\n              ...created,\n              groupId,\n              createdGroup: createsGroup,\n            };\n          },\n        }),\n        get: queryGeneric({\n          args: { enterpriseId: v.string() },\n          handler: async (ctx, args) => {\n            await authorize(ctx, \"sso.connection.read\", {\n              enterpriseId: args.enterpriseId,\n            });\n            return await auth.sso.admin.connection.get(\n              ctx as never,\n              args.enterpriseId,\n            );\n          },\n        }),\n        getByGroup: queryGeneric({\n          args: { groupId: v.string() },\n          handler: async (ctx, args) => {\n            await authorize(ctx, \"sso.connection.read\", {\n              groupId: args.groupId,\n            });\n            return await auth.sso.admin.connection.getByGroup(\n              ctx as never,\n              args.groupId,\n            );\n          },\n        }),\n        getByDomain: queryGeneric({\n          args: { domain: v.string() },\n          handler: async (ctx, args) => {\n            await authorize(ctx, \"sso.connection.read\", {\n              domain: args.domain,\n            });\n            return await auth.sso.admin.connection.getByDomain(\n              ctx as never,\n              args.domain,\n            );\n          },\n        }),\n        list: queryGeneric({\n          args: {\n            where: v.optional(enterpriseConnectionWhereValidator),\n            limit: v.optional(v.number()),\n            cursor: v.optional(v.union(v.string(), v.null())),\n            orderBy: v.optional(v.string()),\n            order: v.optional(v.union(v.literal(\"asc\"), v.literal(\"desc\"))),\n          },\n          handler: async (ctx, args) => {\n            await authorize(ctx, \"sso.connection.read\", {\n              groupId: args.where?.groupId,\n            });\n            return await auth.sso.admin.connection.list(\n              ctx as never,\n              args as never,\n            );\n          },\n        }),\n        update: mutationGeneric({\n          args: {\n            enterpriseId: v.string(),\n            data: v.object({\n              name: v.optional(v.string()),\n              slug: v.optional(v.string()),\n              status: v.optional(enterpriseStatusValidator),\n            }),\n          },\n          handler: async (ctx, args) => {\n            await authorize(ctx, \"sso.connection.manage\", {\n              enterpriseId: args.enterpriseId,\n            });\n            await auth.sso.admin.connection.update(\n              ctx as never,\n              args.enterpriseId,\n              args.data,\n            );\n            return { enterpriseId: args.enterpriseId };\n          },\n        }),\n        delete: mutationGeneric({\n          args: { enterpriseId: v.string() },\n          handler: async (ctx, args) => {\n            await authorize(ctx, \"sso.connection.manage\", {\n              enterpriseId: args.enterpriseId,\n            });\n            return await auth.sso.admin.connection.delete(\n              ctx as never,\n              args.enterpriseId,\n            );\n          },\n        }),\n        status: queryGeneric({\n          args: { enterpriseId: v.string() },\n          handler: async (ctx, args) => {\n            await authorize(ctx, \"sso.connection.read\", {\n              enterpriseId: args.enterpriseId,\n            });\n            return await auth.sso.admin.connection.status(\n              ctx as never,\n              args.enterpriseId,\n            );\n          },\n        }),\n        domain: {\n          list: queryGeneric({\n            args: { enterpriseId: v.string() },\n            handler: async (ctx, args) => {\n              await authorize(ctx, \"sso.connection.read\", {\n                enterpriseId: args.enterpriseId,\n              });\n              return await auth.sso.admin.connection.domain.list(\n                ctx as never,\n                args.enterpriseId,\n              );\n            },\n          }),\n          validate: queryGeneric({\n            args: { enterpriseId: v.string() },\n            handler: async (ctx, args) => {\n              await authorize(ctx, \"sso.domain.manage\", {\n                enterpriseId: args.enterpriseId,\n              });\n              return await auth.sso.admin.connection.domain.validate(\n                ctx as never,\n                args.enterpriseId,\n              );\n            },\n          }),\n          set: mutationGeneric({\n            args: {\n              enterpriseId: v.string(),\n              domains: v.array(enterpriseDomainInputValidator),\n            },\n            handler: async (ctx, args) => {\n              await authorize(ctx, \"sso.domain.manage\", {\n                enterpriseId: args.enterpriseId,\n              });\n              return await auth.sso.admin.connection.domain.set(\n                ctx as never,\n                args.enterpriseId,\n                args.domains,\n              );\n            },\n          }),\n          verification: {\n            request: mutationGeneric({\n              args: enterpriseDomainVerificationInputValidator,\n              handler: async (ctx, args) => {\n                await authorize(ctx, \"sso.domain.manage\", {\n                  enterpriseId: args.enterpriseId,\n                });\n                return await auth.sso.admin.connection.domain.verification.request(\n                  ctx as never,\n                  args,\n                );\n              },\n            }),\n            confirm: actionGeneric({\n              args: enterpriseDomainVerificationInputValidator,\n              handler: async (ctx, args) => {\n                await authorize(ctx, \"sso.domain.manage\", {\n                  enterpriseId: args.enterpriseId,\n                });\n                return await auth.sso.admin.connection.domain.verification.confirm(\n                  ctx as never,\n                  args,\n                );\n              },\n            }),\n          },\n        },\n      },\n      oidc: {\n        configure: mutationGeneric({\n          args: {\n            enterpriseId: v.string(),\n            issuer: v.optional(v.string()),\n            discoveryUrl: v.optional(v.string()),\n            clientId: v.string(),\n            clientSecret: v.optional(v.string()),\n            scopes: v.optional(v.array(v.string())),\n            authorizationParams: v.optional(v.record(v.string(), v.string())),\n            clockToleranceSeconds: v.optional(v.number()),\n            strictIssuer: v.optional(v.boolean()),\n            extraFields: v.optional(v.record(v.string(), v.string())),\n          },\n          handler: async (ctx, args) => {\n            await authorize(ctx, \"sso.protocol.manage\", {\n              enterpriseId: args.enterpriseId,\n            });\n            return await auth.sso.admin.oidc.configure(ctx as never, args);\n          },\n        }),\n        get: queryGeneric({\n          args: { enterpriseId: v.string() },\n          handler: async (ctx, args) => {\n            await authorize(ctx, \"sso.connection.read\", {\n              enterpriseId: args.enterpriseId,\n            });\n            return await auth.sso.admin.oidc.get(\n              ctx as never,\n              args.enterpriseId,\n            );\n          },\n        }),\n        validate: actionGeneric({\n          args: { enterpriseId: v.string() },\n          handler: async (ctx, args) => {\n            await authorize(ctx, \"sso.protocol.manage\", {\n              enterpriseId: args.enterpriseId,\n            });\n            return await auth.sso.admin.oidc.validate(\n              ctx as never,\n              args.enterpriseId,\n            );\n          },\n        }),\n      },\n      saml: {\n        configure: actionGeneric({\n          args: {\n            enterpriseId: v.string(),\n            metadataXml: v.optional(v.string()),\n            metadataUrl: v.optional(v.string()),\n            domains: v.optional(v.array(v.string())),\n            signAuthnRequests: v.optional(v.boolean()),\n            attributeMapping: v.optional(\n              enterpriseSamlAttributeMappingValidator,\n            ),\n            sp: v.optional(enterpriseSamlSpValidator),\n          },\n          handler: async (ctx, args) => {\n            await authorize(ctx, \"sso.protocol.manage\", {\n              enterpriseId: args.enterpriseId,\n            });\n            return await auth.sso.admin.saml.configure(ctx as never, args);\n          },\n        }),\n        validate: queryGeneric({\n          args: { enterpriseId: v.string() },\n          handler: async (ctx, args) => {\n            await authorize(ctx, \"sso.protocol.manage\", {\n              enterpriseId: args.enterpriseId,\n            });\n            return await auth.sso.admin.saml.validate(\n              ctx as never,\n              args.enterpriseId,\n            );\n          },\n        }),\n      },\n      policy: {\n        get: queryGeneric({\n          args: { enterpriseId: v.string() },\n          handler: async (ctx, args) => {\n            await authorize(ctx, \"sso.connection.read\", {\n              enterpriseId: args.enterpriseId,\n            });\n            return await auth.sso.admin.policy.get(\n              ctx as never,\n              args.enterpriseId,\n            );\n          },\n        }),\n        update: mutationGeneric({\n          args: {\n            enterpriseId: v.string(),\n            patch: enterprisePolicyPatchValidator,\n          },\n          handler: async (ctx, args) => {\n            await authorize(ctx, \"sso.policy.manage\", {\n              enterpriseId: args.enterpriseId,\n            });\n            return await auth.sso.admin.policy.update(\n              ctx as never,\n              args.enterpriseId,\n              args.patch,\n            );\n          },\n        }),\n        validate: queryGeneric({\n          args: { enterpriseId: v.string() },\n          handler: async (ctx, args) => {\n            await authorize(ctx, \"sso.policy.manage\", {\n              enterpriseId: args.enterpriseId,\n            });\n            return await auth.sso.admin.policy.validate(\n              ctx as never,\n              args.enterpriseId,\n            );\n          },\n        }),\n      },\n      audit: {\n        list: queryGeneric({\n          args: {\n            enterpriseId: v.optional(v.string()),\n            groupId: v.optional(v.string()),\n            limit: v.optional(v.number()),\n          },\n          handler: async (ctx, args) => {\n            await authorize(ctx, \"sso.audit.read\", {\n              enterpriseId: args.enterpriseId,\n              groupId: args.groupId,\n            });\n            return await auth.sso.admin.audit.list(ctx as never, args);\n          },\n        }),\n      },\n      webhook: {\n        delivery: {\n          list: queryGeneric({\n            args: {\n              enterpriseId: v.string(),\n              limit: v.optional(v.number()),\n            },\n            handler: async (ctx, args) => {\n              await authorize(ctx, \"sso.webhook.manage\", {\n                enterpriseId: args.enterpriseId,\n              });\n              return await (auth.sso.admin.webhook as any).delivery.list(\n                ctx as never,\n                args,\n              );\n            },\n          }),\n        },\n        endpoint: {\n          create: mutationGeneric({\n            args: {\n              enterpriseId: v.string(),\n              url: v.string(),\n              secret: v.string(),\n              subscriptions: v.array(v.string()),\n              createdByUserId: v.optional(v.string()),\n            },\n            handler: async (ctx, args) => {\n              const authResult = await authorize(ctx, \"sso.webhook.manage\", {\n                enterpriseId: args.enterpriseId,\n              });\n              const { userId } = authResult;\n              const result = await auth.sso.admin.webhook.endpoint.create(\n                ctx as never,\n                {\n                  ...args,\n                  createdByUserId: args.createdByUserId ?? userId,\n                },\n              );\n              return {\n                _id: result.endpointId,\n                enterpriseId: args.enterpriseId,\n                url: args.url,\n                subscriptions: args.subscriptions,\n                createdByUserId: args.createdByUserId ?? userId,\n                status: \"active\",\n                failureCount: 0,\n              };\n            },\n          }),\n          list: queryGeneric({\n            args: { enterpriseId: v.string() },\n            handler: async (ctx, args) => {\n              await authorize(ctx, \"sso.webhook.manage\", {\n                enterpriseId: args.enterpriseId,\n              });\n              const endpoints = await auth.sso.admin.webhook.endpoint.list(\n                ctx as never,\n                args.enterpriseId,\n              );\n              return endpoints.map((endpoint: Record<string, unknown>) => {\n                const { secretHash: _secretHash, ...rest } = endpoint;\n                return rest;\n              });\n            },\n          }),\n          disable: mutationGeneric({\n            args: { endpointId: v.string() },\n            handler: async (ctx, args) => {\n              const endpoint = await auth.sso.admin.webhook.endpoint.get(\n                ctx as never,\n                args.endpointId,\n              );\n              if (!endpoint) {\n                throw Cv.error({\n                  code: \"INVALID_PARAMETERS\",\n                  message: \"Webhook endpoint not found.\",\n                });\n              }\n              await authorize(ctx, \"sso.webhook.manage\", {\n                enterpriseId: endpoint.enterpriseId,\n                groupId: endpoint.groupId,\n              });\n              return await auth.sso.admin.webhook.endpoint.disable(\n                ctx as never,\n                args.endpointId,\n              );\n            },\n          }),\n        },\n      },\n    },\n    client: {\n      signIn: queryGeneric({\n        args: {\n          enterpriseId: v.optional(v.string()),\n          email: v.optional(v.string()),\n          domain: v.optional(v.string()),\n          redirectTo: v.optional(v.string()),\n        },\n        handler: async (ctx, args) => {\n          return await auth.sso.client.signIn(ctx as never, args);\n        },\n      }),\n      metadata: queryGeneric({\n        args: {\n          enterpriseId: v.string(),\n          entityId: v.optional(v.string()),\n          acsUrl: v.optional(v.string()),\n          sloUrl: v.optional(v.string()),\n        },\n        handler: async (ctx, args) => {\n          return await auth.sso.client.metadata(ctx as never, args);\n        },\n      }),\n    },\n  };\n}\n\n/**\n * Build optional public SCIM management actions that apps can mount under\n * `convex/auth/scim/**` when they want client-callable enterprise admin APIs.\n *\n * @param auth - Auth API subset providing `scim`, `sso`, and `user` namespaces.\n * @param options - Optional admin authorization config. See {@link EnterpriseMountOptions}.\n * @typeParam TAuthorization - Optional authorization config for typed role IDs.\n * @returns An object with `admin.configure`, `admin.get`, and `admin.validate` actions.\n *\n * @example\n * ```ts\n * // convex/auth/scim.ts\n * import { scim } from \"@robelest/convex-auth/server\";\n * import { auth } from \"../auth\";\n *\n * const mounted = scim(auth, {\n *   admin: {\n *     authorized: async (ctx, input) => { /* check permissions *\\/ },\n *   },\n * });\n *\n * export const configure = mounted.admin.configure;\n * export const get = mounted.admin.get;\n * export const validate = mounted.admin.validate;\n * ```\n *\n * @see {@link sso}\n * @see {@link enterprise}\n */\nexport function scim<\n  TAuthorization extends AuthAuthorizationConfig | undefined = undefined,\n>(\n  auth: Pick<AuthApi<TAuthorization>, \"scim\" | \"sso\" | \"user\">,\n  options?: MountedEnterpriseOptions<AuthRoleId<TAuthorization>>,\n) {\n  const authorize = createMountedAdminAuthorizer(auth, options);\n\n  return {\n    admin: {\n      configure: mutationGeneric({\n        args: {\n          enterpriseId: v.string(),\n          basePath: v.optional(v.string()),\n          status: v.optional(enterpriseStatusValidator),\n        },\n        handler: async (ctx, args) => {\n          await authorize(ctx, \"scim.manage\", {\n            enterpriseId: args.enterpriseId,\n          });\n          return await auth.scim.admin.configure(ctx as never, args);\n        },\n      }),\n      get: queryGeneric({\n        args: { enterpriseId: v.string() },\n        handler: async (ctx, args) => {\n          await authorize(ctx, \"scim.manage\", {\n            enterpriseId: args.enterpriseId,\n          });\n          return await auth.scim.admin.get(ctx as never, args.enterpriseId);\n        },\n      }),\n      validate: queryGeneric({\n        args: { enterpriseId: v.string() },\n        handler: async (ctx, args) => {\n          await authorize(ctx, \"scim.manage\", {\n            enterpriseId: args.enterpriseId,\n          });\n          return await auth.scim.admin.validate(\n            ctx as never,\n            args.enterpriseId,\n          );\n        },\n      }),\n    },\n  };\n}\n\n/**\n * Build a flat mounted enterprise API surface for app-owned Convex exports.\n *\n * Combines {@link sso} and {@link scim} into a single flat object with\n * all SSO connection, protocol, policy, audit, webhook, and SCIM\n * management functions plus end-user sign-in helpers. The `authorized`\n * callback is required for all admin operations.\n *\n * @param auth - Auth API subset providing `group`, `member`, `scim`, `sso`, and `user` namespaces.\n * @param options - Required {@link EnterpriseMountOptions} with an `admin.authorized` callback.\n * @typeParam TAuthorization - Optional authorization config for typed role IDs.\n * @returns A flat object with all enterprise management functions (e.g. `createConnection`,\n *   `configureOidc`, `configureScim`, `signIn`, etc.).\n *\n * @example\n * ```ts\n * // convex/auth/enterprise.ts\n * import { enterprise } from \"@robelest/convex-auth/server\";\n * import { auth } from \"../auth\";\n *\n * const api = enterprise(auth, {\n *   admin: {\n *     authorized: async (ctx, input) => { /* check permissions *\\/ },\n *     roles: [\"admin\"],\n *   },\n * });\n *\n * export const createConnection = api.createConnection;\n * export const configureOidc = api.configureOidc;\n * export const signIn = api.signIn;\n * ```\n *\n * @see {@link sso}\n * @see {@link scim}\n */\nexport function enterprise<\n  TAuthorization extends AuthAuthorizationConfig | undefined = undefined,\n>(\n  auth: Pick<\n    AuthApi<TAuthorization>,\n    \"group\" | \"member\" | \"scim\" | \"sso\" | \"user\"\n  >,\n  options: EnterpriseMountOptions<AuthRoleId<TAuthorization>>,\n) {\n  const mountedSso = sso(auth, {\n    admin: options.admin,\n  });\n  const mountedScim = scim(auth, {\n    admin: { authorized: options.admin.authorized },\n  });\n\n  return {\n    createConnection: mountedSso.admin.connection.create,\n    getConnection: mountedSso.admin.connection.get,\n    getConnectionByGroup: mountedSso.admin.connection.getByGroup,\n    getConnectionByDomain: mountedSso.admin.connection.getByDomain,\n    listConnections: mountedSso.admin.connection.list,\n    updateConnection: mountedSso.admin.connection.update,\n    deleteConnection: mountedSso.admin.connection.delete,\n    getConnectionStatus: mountedSso.admin.connection.status,\n    listDomains: mountedSso.admin.connection.domain.list,\n    validateDomains: mountedSso.admin.connection.domain.validate,\n    setDomains: mountedSso.admin.connection.domain.set,\n    requestDomainVerification:\n      mountedSso.admin.connection.domain.verification.request,\n    confirmDomainVerification:\n      mountedSso.admin.connection.domain.verification.confirm,\n    configureOidc: mountedSso.admin.oidc.configure,\n    getOidc: mountedSso.admin.oidc.get,\n    validateOidc: mountedSso.admin.oidc.validate,\n    configureSaml: mountedSso.admin.saml.configure,\n    validateSaml: mountedSso.admin.saml.validate,\n    getPolicy: mountedSso.admin.policy.get,\n    updatePolicy: mountedSso.admin.policy.update,\n    validatePolicy: mountedSso.admin.policy.validate,\n    listAudit: mountedSso.admin.audit.list,\n    createWebhookEndpoint: mountedSso.admin.webhook.endpoint.create,\n    listWebhookEndpoints: mountedSso.admin.webhook.endpoint.list,\n    listWebhookDeliveries: mountedSso.admin.webhook.delivery.list,\n    disableWebhookEndpoint: mountedSso.admin.webhook.endpoint.disable,\n    configureScim: mountedScim.admin.configure,\n    getScim: mountedScim.admin.get,\n    validateScim: mountedScim.admin.validate,\n    signIn: mountedSso.client.signIn,\n    metadata: mountedSso.client.metadata,\n  };\n}\n"],"mappings":";;;;;;AAiIA,SAAS,oBAAoB,MAA6B;AACxD,QAAO,OAAO,QAEgB;AAC5B,SAAO,MAAM,KAAK,KAAK,GAAG,IAAa;;;AAI3C,SAAS,wBACP,OACA;AACA,QAAO,OAAO,KAAK,SAAU,OAAO,SAAS,WAAW,OAAO,KAAK,GAAI;;AAG1E,eAAe,+BACb,MACA,KACA,QACA;AACA,KAAI,OAAO,YAAY,OACrB,QAAO;EACL,cAAc,OAAO;EACrB,SAAS,OAAO;EAChB,iBAAiB,OAAO;EACzB;AAGH,KAAI,OAAO,iBAAiB,QAAW;EACrC,MAAM,aAAa,MAAM,KAAK,IAAI,MAAM,WAAW,IACjD,KACA,OAAO,aACR;AACD,MAAI,eAAe,KACjB,OAAM,IAAI,YAAY;GACpB,MAAM;GACN,SAAS;GACV,CAAC;AAEJ,SAAO;GACL,cAAc,WAAW;GACzB,SAAS,WAAW;GACpB,iBAAiB,WAAW;GAC7B;;AAGH,KAAI,OAAO,WAAW,QAAW;EAC/B,MAAM,WAAW,MAAM,KAAK,IAAI,MAAM,WAAW,YAC/C,KACA,OAAO,OACR;AACD,MAAI,UAAU,eAAe,OAC3B,OAAM,IAAI,YAAY;GACpB,MAAM;GACN,SAAS;GACV,CAAC;AAEJ,SAAO;GACL,cAAc,SAAS,WAAW;GAClC,SAAS,SAAS,WAAW;GAC7B,iBAAiB,SAAS,WAAW;GACtC;;AAGH,QAAO;EACL,cAAc;EACd,SAAS;EACT,iBAAiB;EAClB;;AAGH,SAAS,6BACP,MACA,SACA;CACA,MAAM,gBAAgB,oBAAoB,KAAK;AAE/C,QAAO,OACL,KACA,YACA,SAAkC,EAAE,KACjC;EACH,MAAM,SAAS,MAAM,cAAc,IAAI;AACvC,MAAI,WAAW,KACb,OAAM,GAAG,MAAM;GACb,MAAM;GACN,SAAS;GACV,CAAC;AAEJ,MAAI,CAAC,SAAS,OAAO,WACnB,OAAM,GAAG,MAAM;GACb,MAAM;GACN,SAAS;GACV,CAAC;EAEJ,MAAM,WAAW,MAAM,+BAA+B,MAAM,KAAK,OAAO;AACxE,QAAM,QAAQ,MAAM,WAAW,KAAK;GAClC;GACA;GACA,cAAc,SAAS;GACvB,SAAS,SAAS;GAClB,iBAAiB,SAAS;GAC3B,CAAC;AACF,SAAO;GAAE;GAAQ,GAAG;GAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqClC,SAAgB,IAGd,MACA,SACA;CACA,MAAM,YAAY,6BAA6B,MAAM,QAAQ;CAC7D,MAAM,eAAe,wBAAwB,SAAS,OAAO,MAAM;AAEnE,QAAO;EACL,OAAO;GACL,YAAY;IACV,QAAQ,gBAAgB;KACtB,MAAM;MACJ,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC;MAC/B,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;MAC5B,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;MAC5B,QAAQ,EAAE,SAAS,0BAA0B;MAC7C,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;MAC/B;KACD,SAAS,OAAO,KAAK,SAAS;MAI5B,MAAM,EAAE,WAHW,MAAM,UAAU,KAAK,yBAAyB,EAC/D,SAAS,KAAK,SACf,CAAC;MAEF,MAAM,eAAe,KAAK,YAAY;MACtC,MAAM,UACJ,KAAK,YAEH,MAAM,KAAK,MAAM,OAAO,KAAc;OACpC,MAAM,KAAK,MAAM,MAAM,IAAI,KAAK,MAAM,MAAM,IAAI;OAChD,MAAM,KAAK;OACX,MAAM;OACP,CAAC,EACF;AACJ,UAAI,aACF,OAAM,KAAK,OAAO,OAAO,KAAc;OACrC;OACA;OACA,SAAS;OACV,CAAC;MAEJ,MAAM,UAAU,MAAM,KAAK,IAAI,MAAM,WAAW,OAC9C,KACA;OACE;OACA,MAAM,KAAK;OACX,MAAM,KAAK;OACX,QAAQ,KAAK;OACd,CACF;AACD,UAAI,KAAK,OACP,OAAM,KAAK,IAAI,MAAM,WAAW,OAAO,IACrC,KACA,QAAQ,cACR,CAAC;OAAE,QAAQ,KAAK;OAAQ,WAAW;OAAM,CAAC,CAC3C;AAEH,aAAO;OACL,GAAG;OACH;OACA,cAAc;OACf;;KAEJ,CAAC;IACF,KAAK,aAAa;KAChB,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE;KAClC,SAAS,OAAO,KAAK,SAAS;AAC5B,YAAM,UAAU,KAAK,uBAAuB,EAC1C,cAAc,KAAK,cACpB,CAAC;AACF,aAAO,MAAM,KAAK,IAAI,MAAM,WAAW,IACrC,KACA,KAAK,aACN;;KAEJ,CAAC;IACF,YAAY,aAAa;KACvB,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE;KAC7B,SAAS,OAAO,KAAK,SAAS;AAC5B,YAAM,UAAU,KAAK,uBAAuB,EAC1C,SAAS,KAAK,SACf,CAAC;AACF,aAAO,MAAM,KAAK,IAAI,MAAM,WAAW,WACrC,KACA,KAAK,QACN;;KAEJ,CAAC;IACF,aAAa,aAAa;KACxB,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE;KAC5B,SAAS,OAAO,KAAK,SAAS;AAC5B,YAAM,UAAU,KAAK,uBAAuB,EAC1C,QAAQ,KAAK,QACd,CAAC;AACF,aAAO,MAAM,KAAK,IAAI,MAAM,WAAW,YACrC,KACA,KAAK,OACN;;KAEJ,CAAC;IACF,MAAM,aAAa;KACjB,MAAM;MACJ,OAAO,EAAE,SAAS,mCAAmC;MACrD,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;MAC7B,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;MACjD,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC;MAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,MAAM,EAAE,EAAE,QAAQ,OAAO,CAAC,CAAC;MAChE;KACD,SAAS,OAAO,KAAK,SAAS;AAC5B,YAAM,UAAU,KAAK,uBAAuB,EAC1C,SAAS,KAAK,OAAO,SACtB,CAAC;AACF,aAAO,MAAM,KAAK,IAAI,MAAM,WAAW,KACrC,KACA,KACD;;KAEJ,CAAC;IACF,QAAQ,gBAAgB;KACtB,MAAM;MACJ,cAAc,EAAE,QAAQ;MACxB,MAAM,EAAE,OAAO;OACb,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;OAC5B,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;OAC5B,QAAQ,EAAE,SAAS,0BAA0B;OAC9C,CAAC;MACH;KACD,SAAS,OAAO,KAAK,SAAS;AAC5B,YAAM,UAAU,KAAK,yBAAyB,EAC5C,cAAc,KAAK,cACpB,CAAC;AACF,YAAM,KAAK,IAAI,MAAM,WAAW,OAC9B,KACA,KAAK,cACL,KAAK,KACN;AACD,aAAO,EAAE,cAAc,KAAK,cAAc;;KAE7C,CAAC;IACF,QAAQ,gBAAgB;KACtB,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE;KAClC,SAAS,OAAO,KAAK,SAAS;AAC5B,YAAM,UAAU,KAAK,yBAAyB,EAC5C,cAAc,KAAK,cACpB,CAAC;AACF,aAAO,MAAM,KAAK,IAAI,MAAM,WAAW,OACrC,KACA,KAAK,aACN;;KAEJ,CAAC;IACF,QAAQ,aAAa;KACnB,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE;KAClC,SAAS,OAAO,KAAK,SAAS;AAC5B,YAAM,UAAU,KAAK,uBAAuB,EAC1C,cAAc,KAAK,cACpB,CAAC;AACF,aAAO,MAAM,KAAK,IAAI,MAAM,WAAW,OACrC,KACA,KAAK,aACN;;KAEJ,CAAC;IACF,QAAQ;KACN,MAAM,aAAa;MACjB,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE;MAClC,SAAS,OAAO,KAAK,SAAS;AAC5B,aAAM,UAAU,KAAK,uBAAuB,EAC1C,cAAc,KAAK,cACpB,CAAC;AACF,cAAO,MAAM,KAAK,IAAI,MAAM,WAAW,OAAO,KAC5C,KACA,KAAK,aACN;;MAEJ,CAAC;KACF,UAAU,aAAa;MACrB,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE;MAClC,SAAS,OAAO,KAAK,SAAS;AAC5B,aAAM,UAAU,KAAK,qBAAqB,EACxC,cAAc,KAAK,cACpB,CAAC;AACF,cAAO,MAAM,KAAK,IAAI,MAAM,WAAW,OAAO,SAC5C,KACA,KAAK,aACN;;MAEJ,CAAC;KACF,KAAK,gBAAgB;MACnB,MAAM;OACJ,cAAc,EAAE,QAAQ;OACxB,SAAS,EAAE,MAAM,+BAA+B;OACjD;MACD,SAAS,OAAO,KAAK,SAAS;AAC5B,aAAM,UAAU,KAAK,qBAAqB,EACxC,cAAc,KAAK,cACpB,CAAC;AACF,cAAO,MAAM,KAAK,IAAI,MAAM,WAAW,OAAO,IAC5C,KACA,KAAK,cACL,KAAK,QACN;;MAEJ,CAAC;KACF,cAAc;MACZ,SAAS,gBAAgB;OACvB,MAAM;OACN,SAAS,OAAO,KAAK,SAAS;AAC5B,cAAM,UAAU,KAAK,qBAAqB,EACxC,cAAc,KAAK,cACpB,CAAC;AACF,eAAO,MAAM,KAAK,IAAI,MAAM,WAAW,OAAO,aAAa,QACzD,KACA,KACD;;OAEJ,CAAC;MACF,SAAS,cAAc;OACrB,MAAM;OACN,SAAS,OAAO,KAAK,SAAS;AAC5B,cAAM,UAAU,KAAK,qBAAqB,EACxC,cAAc,KAAK,cACpB,CAAC;AACF,eAAO,MAAM,KAAK,IAAI,MAAM,WAAW,OAAO,aAAa,QACzD,KACA,KACD;;OAEJ,CAAC;MACH;KACF;IACF;GACD,MAAM;IACJ,WAAW,gBAAgB;KACzB,MAAM;MACJ,cAAc,EAAE,QAAQ;MACxB,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;MAC9B,cAAc,EAAE,SAAS,EAAE,QAAQ,CAAC;MACpC,UAAU,EAAE,QAAQ;MACpB,cAAc,EAAE,SAAS,EAAE,QAAQ,CAAC;MACpC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;MACvC,qBAAqB,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;MACjE,uBAAuB,EAAE,SAAS,EAAE,QAAQ,CAAC;MAC7C,cAAc,EAAE,SAAS,EAAE,SAAS,CAAC;MACrC,aAAa,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;MAC1D;KACD,SAAS,OAAO,KAAK,SAAS;AAC5B,YAAM,UAAU,KAAK,uBAAuB,EAC1C,cAAc,KAAK,cACpB,CAAC;AACF,aAAO,MAAM,KAAK,IAAI,MAAM,KAAK,UAAU,KAAc,KAAK;;KAEjE,CAAC;IACF,KAAK,aAAa;KAChB,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE;KAClC,SAAS,OAAO,KAAK,SAAS;AAC5B,YAAM,UAAU,KAAK,uBAAuB,EAC1C,cAAc,KAAK,cACpB,CAAC;AACF,aAAO,MAAM,KAAK,IAAI,MAAM,KAAK,IAC/B,KACA,KAAK,aACN;;KAEJ,CAAC;IACF,UAAU,cAAc;KACtB,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE;KAClC,SAAS,OAAO,KAAK,SAAS;AAC5B,YAAM,UAAU,KAAK,uBAAuB,EAC1C,cAAc,KAAK,cACpB,CAAC;AACF,aAAO,MAAM,KAAK,IAAI,MAAM,KAAK,SAC/B,KACA,KAAK,aACN;;KAEJ,CAAC;IACH;GACD,MAAM;IACJ,WAAW,cAAc;KACvB,MAAM;MACJ,cAAc,EAAE,QAAQ;MACxB,aAAa,EAAE,SAAS,EAAE,QAAQ,CAAC;MACnC,aAAa,EAAE,SAAS,EAAE,QAAQ,CAAC;MACnC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;MACxC,mBAAmB,EAAE,SAAS,EAAE,SAAS,CAAC;MAC1C,kBAAkB,EAAE,SAClB,wCACD;MACD,IAAI,EAAE,SAAS,0BAA0B;MAC1C;KACD,SAAS,OAAO,KAAK,SAAS;AAC5B,YAAM,UAAU,KAAK,uBAAuB,EAC1C,cAAc,KAAK,cACpB,CAAC;AACF,aAAO,MAAM,KAAK,IAAI,MAAM,KAAK,UAAU,KAAc,KAAK;;KAEjE,CAAC;IACF,UAAU,aAAa;KACrB,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE;KAClC,SAAS,OAAO,KAAK,SAAS;AAC5B,YAAM,UAAU,KAAK,uBAAuB,EAC1C,cAAc,KAAK,cACpB,CAAC;AACF,aAAO,MAAM,KAAK,IAAI,MAAM,KAAK,SAC/B,KACA,KAAK,aACN;;KAEJ,CAAC;IACH;GACD,QAAQ;IACN,KAAK,aAAa;KAChB,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE;KAClC,SAAS,OAAO,KAAK,SAAS;AAC5B,YAAM,UAAU,KAAK,uBAAuB,EAC1C,cAAc,KAAK,cACpB,CAAC;AACF,aAAO,MAAM,KAAK,IAAI,MAAM,OAAO,IACjC,KACA,KAAK,aACN;;KAEJ,CAAC;IACF,QAAQ,gBAAgB;KACtB,MAAM;MACJ,cAAc,EAAE,QAAQ;MACxB,OAAO;MACR;KACD,SAAS,OAAO,KAAK,SAAS;AAC5B,YAAM,UAAU,KAAK,qBAAqB,EACxC,cAAc,KAAK,cACpB,CAAC;AACF,aAAO,MAAM,KAAK,IAAI,MAAM,OAAO,OACjC,KACA,KAAK,cACL,KAAK,MACN;;KAEJ,CAAC;IACF,UAAU,aAAa;KACrB,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE;KAClC,SAAS,OAAO,KAAK,SAAS;AAC5B,YAAM,UAAU,KAAK,qBAAqB,EACxC,cAAc,KAAK,cACpB,CAAC;AACF,aAAO,MAAM,KAAK,IAAI,MAAM,OAAO,SACjC,KACA,KAAK,aACN;;KAEJ,CAAC;IACH;GACD,OAAO,EACL,MAAM,aAAa;IACjB,MAAM;KACJ,cAAc,EAAE,SAAS,EAAE,QAAQ,CAAC;KACpC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC;KAC/B,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;KAC9B;IACD,SAAS,OAAO,KAAK,SAAS;AAC5B,WAAM,UAAU,KAAK,kBAAkB;MACrC,cAAc,KAAK;MACnB,SAAS,KAAK;MACf,CAAC;AACF,YAAO,MAAM,KAAK,IAAI,MAAM,MAAM,KAAK,KAAc,KAAK;;IAE7D,CAAC,EACH;GACD,SAAS;IACP,UAAU,EACR,MAAM,aAAa;KACjB,MAAM;MACJ,cAAc,EAAE,QAAQ;MACxB,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;MAC9B;KACD,SAAS,OAAO,KAAK,SAAS;AAC5B,YAAM,UAAU,KAAK,sBAAsB,EACzC,cAAc,KAAK,cACpB,CAAC;AACF,aAAO,MAAO,KAAK,IAAI,MAAM,QAAgB,SAAS,KACpD,KACA,KACD;;KAEJ,CAAC,EACH;IACD,UAAU;KACR,QAAQ,gBAAgB;MACtB,MAAM;OACJ,cAAc,EAAE,QAAQ;OACxB,KAAK,EAAE,QAAQ;OACf,QAAQ,EAAE,QAAQ;OAClB,eAAe,EAAE,MAAM,EAAE,QAAQ,CAAC;OAClC,iBAAiB,EAAE,SAAS,EAAE,QAAQ,CAAC;OACxC;MACD,SAAS,OAAO,KAAK,SAAS;OAI5B,MAAM,EAAE,WAHW,MAAM,UAAU,KAAK,sBAAsB,EAC5D,cAAc,KAAK,cACpB,CAAC;AASF,cAAO;QACL,MARa,MAAM,KAAK,IAAI,MAAM,QAAQ,SAAS,OACnD,KACA;SACE,GAAG;SACH,iBAAiB,KAAK,mBAAmB;SAC1C,CACF,EAEa;QACZ,cAAc,KAAK;QACnB,KAAK,KAAK;QACV,eAAe,KAAK;QACpB,iBAAiB,KAAK,mBAAmB;QACzC,QAAQ;QACR,cAAc;QACf;;MAEJ,CAAC;KACF,MAAM,aAAa;MACjB,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE;MAClC,SAAS,OAAO,KAAK,SAAS;AAC5B,aAAM,UAAU,KAAK,sBAAsB,EACzC,cAAc,KAAK,cACpB,CAAC;AAKF,eAJkB,MAAM,KAAK,IAAI,MAAM,QAAQ,SAAS,KACtD,KACA,KAAK,aACN,EACgB,KAAK,aAAsC;QAC1D,MAAM,EAAE,YAAY,aAAa,GAAG,SAAS;AAC7C,eAAO;SACP;;MAEL,CAAC;KACF,SAAS,gBAAgB;MACvB,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE;MAChC,SAAS,OAAO,KAAK,SAAS;OAC5B,MAAM,WAAW,MAAM,KAAK,IAAI,MAAM,QAAQ,SAAS,IACrD,KACA,KAAK,WACN;AACD,WAAI,CAAC,SACH,OAAM,GAAG,MAAM;QACb,MAAM;QACN,SAAS;QACV,CAAC;AAEJ,aAAM,UAAU,KAAK,sBAAsB;QACzC,cAAc,SAAS;QACvB,SAAS,SAAS;QACnB,CAAC;AACF,cAAO,MAAM,KAAK,IAAI,MAAM,QAAQ,SAAS,QAC3C,KACA,KAAK,WACN;;MAEJ,CAAC;KACH;IACF;GACF;EACD,QAAQ;GACN,QAAQ,aAAa;IACnB,MAAM;KACJ,cAAc,EAAE,SAAS,EAAE,QAAQ,CAAC;KACpC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;KAC7B,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;KAC9B,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC;KACnC;IACD,SAAS,OAAO,KAAK,SAAS;AAC5B,YAAO,MAAM,KAAK,IAAI,OAAO,OAAO,KAAc,KAAK;;IAE1D,CAAC;GACF,UAAU,aAAa;IACrB,MAAM;KACJ,cAAc,EAAE,QAAQ;KACxB,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;KAChC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;KAC9B,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;KAC/B;IACD,SAAS,OAAO,KAAK,SAAS;AAC5B,YAAO,MAAM,KAAK,IAAI,OAAO,SAAS,KAAc,KAAK;;IAE5D,CAAC;GACH;EACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCH,SAAgB,KAGd,MACA,SACA;CACA,MAAM,YAAY,6BAA6B,MAAM,QAAQ;AAE7D,QAAO,EACL,OAAO;EACL,WAAW,gBAAgB;GACzB,MAAM;IACJ,cAAc,EAAE,QAAQ;IACxB,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;IAChC,QAAQ,EAAE,SAAS,0BAA0B;IAC9C;GACD,SAAS,OAAO,KAAK,SAAS;AAC5B,UAAM,UAAU,KAAK,eAAe,EAClC,cAAc,KAAK,cACpB,CAAC;AACF,WAAO,MAAM,KAAK,KAAK,MAAM,UAAU,KAAc,KAAK;;GAE7D,CAAC;EACF,KAAK,aAAa;GAChB,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE;GAClC,SAAS,OAAO,KAAK,SAAS;AAC5B,UAAM,UAAU,KAAK,eAAe,EAClC,cAAc,KAAK,cACpB,CAAC;AACF,WAAO,MAAM,KAAK,KAAK,MAAM,IAAI,KAAc,KAAK,aAAa;;GAEpE,CAAC;EACF,UAAU,aAAa;GACrB,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE;GAClC,SAAS,OAAO,KAAK,SAAS;AAC5B,UAAM,UAAU,KAAK,eAAe,EAClC,cAAc,KAAK,cACpB,CAAC;AACF,WAAO,MAAM,KAAK,KAAK,MAAM,SAC3B,KACA,KAAK,aACN;;GAEJ,CAAC;EACH,EACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCH,SAAgB,WAGd,MAIA,SACA;CACA,MAAM,aAAa,IAAI,MAAM,EAC3B,OAAO,QAAQ,OAChB,CAAC;CACF,MAAM,cAAc,KAAK,MAAM,EAC7B,OAAO,EAAE,YAAY,QAAQ,MAAM,YAAY,EAChD,CAAC;AAEF,QAAO;EACL,kBAAkB,WAAW,MAAM,WAAW;EAC9C,eAAe,WAAW,MAAM,WAAW;EAC3C,sBAAsB,WAAW,MAAM,WAAW;EAClD,uBAAuB,WAAW,MAAM,WAAW;EACnD,iBAAiB,WAAW,MAAM,WAAW;EAC7C,kBAAkB,WAAW,MAAM,WAAW;EAC9C,kBAAkB,WAAW,MAAM,WAAW;EAC9C,qBAAqB,WAAW,MAAM,WAAW;EACjD,aAAa,WAAW,MAAM,WAAW,OAAO;EAChD,iBAAiB,WAAW,MAAM,WAAW,OAAO;EACpD,YAAY,WAAW,MAAM,WAAW,OAAO;EAC/C,2BACE,WAAW,MAAM,WAAW,OAAO,aAAa;EAClD,2BACE,WAAW,MAAM,WAAW,OAAO,aAAa;EAClD,eAAe,WAAW,MAAM,KAAK;EACrC,SAAS,WAAW,MAAM,KAAK;EAC/B,cAAc,WAAW,MAAM,KAAK;EACpC,eAAe,WAAW,MAAM,KAAK;EACrC,cAAc,WAAW,MAAM,KAAK;EACpC,WAAW,WAAW,MAAM,OAAO;EACnC,cAAc,WAAW,MAAM,OAAO;EACtC,gBAAgB,WAAW,MAAM,OAAO;EACxC,WAAW,WAAW,MAAM,MAAM;EAClC,uBAAuB,WAAW,MAAM,QAAQ,SAAS;EACzD,sBAAsB,WAAW,MAAM,QAAQ,SAAS;EACxD,uBAAuB,WAAW,MAAM,QAAQ,SAAS;EACzD,wBAAwB,WAAW,MAAM,QAAQ,SAAS;EAC1D,eAAe,YAAY,MAAM;EACjC,SAAS,YAAY,MAAM;EAC3B,cAAc,YAAY,MAAM;EAChC,QAAQ,WAAW,OAAO;EAC1B,UAAU,WAAW,OAAO;EAC7B"}

package/dist/server/mutations/account.d.ts

@@ -1,29 +1,28 @@
 import { MutationCtx } from "../types.js";
-import { AuthError } from "../authError.js";
 import { Config, GetProviderOrThrowFunc } from "../crypto.js";
 import { Fx } from "@robelest/fx";
 import { GenericActionCtx, GenericDataModel } from "convex/server";
-import * as convex_values3 from "convex/values";
-import { Infer } from "convex/values";
+import * as convex_values92 from "convex/values";
+import { ConvexError, Infer } from "convex/values";
 
 //#region src/server/mutations/account.d.ts
-declare const modifyAccountArgs: convex_values3.VObject<{
+declare const modifyAccountArgs: convex_values92.VObject<{
   provider: string;
   account: {
     id: string;
     secret: string;
   };
 }, {
-  provider: convex_values3.VString<string, "required">;
-  account: convex_values3.VObject<{
+  provider: convex_values92.VString<string, "required">;
+  account: convex_values92.VObject<{
     id: string;
     secret: string;
   }, {
-    id: convex_values3.VString<string, "required">;
-    secret: convex_values3.VString<string, "required">;
+    id: convex_values92.VString<string, "required">;
+    secret: convex_values92.VString<string, "required">;
   }, "required", "id" | "secret">;
 }, "required", "provider" | "account" | "account.id" | "account.secret">;
-declare function modifyAccountImpl(ctx: MutationCtx, args: Infer<typeof modifyAccountArgs>, getProviderOrThrow: GetProviderOrThrowFunc, config: Config): Fx<void, AuthError>;
+declare function modifyAccountImpl(ctx: MutationCtx, args: Infer<typeof modifyAccountArgs>, getProviderOrThrow: GetProviderOrThrowFunc, config: Config): Fx<void, ConvexError<any>>;
 declare const callModifyAccount: <DataModel extends GenericDataModel>(ctx: GenericActionCtx<DataModel>, args: Infer<typeof modifyAccountArgs>) => Promise<void>;
 //#endregion
 export { callModifyAccount, modifyAccountArgs, modifyAccountImpl };

package/dist/server/mutations/account.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account.d.ts","names":[],"sources":["../../../src/server/mutations/account.ts"],"mappings":";;;;;;;;;cAYa,iBAAA,iBAAiB,OAAA;;;;;;;YAG5B,cAAA,CAAA,OAAA;;;;;;;;;iBAEc,iBAAA,CACd,GAAA,EAAK,WAAA,EACL,IAAA,EAAM,KAAA,QAAa,iBAAA,GACnB,kBAAA,EAAoB,sBAAA,EACpB,MAAA,EAAQ,MAAA,GACP,EAAA,OAAS,SAAA;AAAA,cA2CC,iBAAA,qBAA6C,gBAAA,EACxD,GAAA,EAAK,gBAAA,CAAiB,SAAA,GACtB,IAAA,EAAM,KAAA,QAAa,iBAAA,MAClB,OAAA"}
+{"version":3,"file":"account.d.ts","names":[],"sources":["../../../src/server/mutations/account.ts"],"mappings":";;;;;;;;cAYa,iBAAA,kBAAiB,OAAA;;;;;;;YAG5B,eAAA,CAAA,OAAA;;;;;;;;;iBAEc,iBAAA,CACd,GAAA,EAAK,WAAA,EACL,IAAA,EAAM,KAAA,QAAa,iBAAA,GACnB,kBAAA,EAAoB,sBAAA,EACpB,MAAA,EAAQ,MAAA,GACP,EAAA,OAAS,WAAA;AAAA,cA6BC,iBAAA,qBAA6C,gBAAA,EACxD,GAAA,EAAK,gBAAA,CAAiB,SAAA,GACtB,IAAA,EAAM,KAAA,QAAa,iBAAA,MAClB,OAAA"}