@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/component/public/enterprise/secrets.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"secrets.d.ts","names":[],"sources":["../../../../src/component/public/enterprise/secrets.ts"],"mappings":";;;;;;;;;;;AAkCA;;;;;AA8CA;;;;;AAkCA;;;;;;;;;;;cAhFa,sBAAA;;;;;;;;;;;;;;;;;;;;;;;cA8CA,mBAAA;;;;;;;;;;;;;;;;;;;cAkCA,sBAAA"}

package/dist/component/public/enterprise/secrets.js

@@ -1,118 +0,0 @@
-import { mutation, query } from "../../functions.js";
-import { vEnterpriseSecretDoc, vEnterpriseSecretKind } from "../../model.js";
-import { v } from "convex/values";
-
-//#region src/component/public/enterprise/secrets.ts
-/**
-* Create or update an encrypted secret for an enterprise.
-*
-* Stores a secret identified by the combination of `(enterpriseId, kind)`.
-* If a secret of the same kind already exists for the enterprise, it is
-* updated with the new ciphertext and timestamp. Otherwise a new secret
-* document is created. Only one secret per kind is allowed per enterprise.
-*
-* @param args.enterpriseId - The ID of the enterprise the secret belongs to.
-* @param args.groupId - The ID of the root group that owns the enterprise.
-* @param args.kind - The type of secret being stored (e.g. `"oidc_client_secret"`).
-* @param args.ciphertext - The encrypted secret value.
-* @param args.updatedAt - Epoch timestamp (ms) when the secret was last updated.
-* @returns The ID of the created or updated `EnterpriseSecret` document.
-*
-* @example
-* ```ts
-* const secretId = await ctx.runMutation(
-*   components.auth.enterprise.enterpriseSecretUpsert,
-*   {
-*     enterpriseId,
-*     groupId: orgGroupId,
-*     kind: "oidc_client_secret",
-*     ciphertext: "encrypted:aes256:...",
-*     updatedAt: Date.now(),
-*   },
-* );
-* ```
-*/
-const enterpriseSecretUpsert = mutation({
-	args: {
-		enterpriseId: v.id("Enterprise"),
-		groupId: v.id("Group"),
-		kind: vEnterpriseSecretKind,
-		ciphertext: v.string(),
-		updatedAt: v.number()
-	},
-	returns: v.id("EnterpriseSecret"),
-	handler: async (ctx, args) => {
-		const existing = await ctx.db.query("EnterpriseSecret").withIndex("enterprise_id_kind", (idx) => idx.eq("enterpriseId", args.enterpriseId).eq("kind", args.kind)).first();
-		if (existing) {
-			await ctx.db.patch(existing._id, args);
-			return existing._id;
-		}
-		return await ctx.db.insert("EnterpriseSecret", args);
-	}
-});
-/**
-* Retrieve an encrypted secret for an enterprise by kind.
-*
-* Looks up the secret using the composite `(enterpriseId, kind)` index.
-* Returns the full document including the ciphertext, or `null` if no secret
-* of that kind has been stored for the enterprise.
-*
-* @param args.enterpriseId - The ID of the enterprise whose secret to retrieve.
-* @param args.kind - The type of secret to look up (e.g. `"oidc_client_secret"`).
-* @returns The enterprise secret document, or `null` if not found.
-*
-* @example
-* ```ts
-* const secret = await ctx.runQuery(
-*   components.auth.enterprise.enterpriseSecretGet,
-*   { enterpriseId, kind: "oidc_client_secret" },
-* );
-* if (secret) {
-*   const plaintext = decrypt(secret.ciphertext);
-* }
-* ```
-*/
-const enterpriseSecretGet = query({
-	args: {
-		enterpriseId: v.id("Enterprise"),
-		kind: vEnterpriseSecretKind
-	},
-	returns: v.union(vEnterpriseSecretDoc, v.null()),
-	handler: async (ctx, { enterpriseId, kind }) => {
-		return await ctx.db.query("EnterpriseSecret").withIndex("enterprise_id_kind", (idx) => idx.eq("enterpriseId", enterpriseId).eq("kind", kind)).first();
-	}
-});
-/**
-* Delete an encrypted secret for an enterprise by kind.
-*
-* Removes the secret document matching the `(enterpriseId, kind)` pair.
-* If no such secret exists, this is a no-op.
-*
-* @param args.enterpriseId - The ID of the enterprise whose secret to delete.
-* @param args.kind - The type of secret to remove (e.g. `"oidc_client_secret"`).
-* @returns `null` on success.
-*
-* @example
-* ```ts
-* await ctx.runMutation(
-*   components.auth.enterprise.enterpriseSecretDelete,
-*   { enterpriseId, kind: "oidc_client_secret" },
-* );
-* ```
-*/
-const enterpriseSecretDelete = mutation({
-	args: {
-		enterpriseId: v.id("Enterprise"),
-		kind: vEnterpriseSecretKind
-	},
-	returns: v.null(),
-	handler: async (ctx, { enterpriseId, kind }) => {
-		const existing = await ctx.db.query("EnterpriseSecret").withIndex("enterprise_id_kind", (idx) => idx.eq("enterpriseId", enterpriseId).eq("kind", kind)).first();
-		if (existing) await ctx.db.delete(existing._id);
-		return null;
-	}
-});
-
-//#endregion
-export { enterpriseSecretDelete, enterpriseSecretGet, enterpriseSecretUpsert };
-//# sourceMappingURL=secrets.js.map

package/dist/component/public/enterprise/secrets.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"secrets.js","names":[],"sources":["../../../../src/component/public/enterprise/secrets.ts"],"sourcesContent":["import { v } from \"convex/values\";\n\nimport { mutation, query } from \"../../functions\";\nimport { vEnterpriseSecretDoc, vEnterpriseSecretKind } from \"../../model\";\n\n/**\n * Create or update an encrypted secret for an enterprise.\n *\n * Stores a secret identified by the combination of `(enterpriseId, kind)`.\n * If a secret of the same kind already exists for the enterprise, it is\n * updated with the new ciphertext and timestamp. Otherwise a new secret\n * document is created. Only one secret per kind is allowed per enterprise.\n *\n * @param args.enterpriseId - The ID of the enterprise the secret belongs to.\n * @param args.groupId - The ID of the root group that owns the enterprise.\n * @param args.kind - The type of secret being stored (e.g. `\"oidc_client_secret\"`).\n * @param args.ciphertext - The encrypted secret value.\n * @param args.updatedAt - Epoch timestamp (ms) when the secret was last updated.\n * @returns The ID of the created or updated `EnterpriseSecret` document.\n *\n * @example\n * ```ts\n * const secretId = await ctx.runMutation(\n *   components.auth.enterprise.enterpriseSecretUpsert,\n *   {\n *     enterpriseId,\n *     groupId: orgGroupId,\n *     kind: \"oidc_client_secret\",\n *     ciphertext: \"encrypted:aes256:...\",\n *     updatedAt: Date.now(),\n *   },\n * );\n * ```\n */\nexport const enterpriseSecretUpsert = mutation({\n  args: {\n    enterpriseId: v.id(\"Enterprise\"),\n    groupId: v.id(\"Group\"),\n    kind: vEnterpriseSecretKind,\n    ciphertext: v.string(),\n    updatedAt: v.number(),\n  },\n  returns: v.id(\"EnterpriseSecret\"),\n  handler: async (ctx, args) => {\n    const existing = await ctx.db\n      .query(\"EnterpriseSecret\")\n      .withIndex(\"enterprise_id_kind\", (idx) =>\n        idx.eq(\"enterpriseId\", args.enterpriseId).eq(\"kind\", args.kind),\n      )\n      .first();\n    if (existing) {\n      await ctx.db.patch(existing._id, args);\n      return existing._id;\n    }\n    return await ctx.db.insert(\"EnterpriseSecret\", args);\n  },\n});\n\n/**\n * Retrieve an encrypted secret for an enterprise by kind.\n *\n * Looks up the secret using the composite `(enterpriseId, kind)` index.\n * Returns the full document including the ciphertext, or `null` if no secret\n * of that kind has been stored for the enterprise.\n *\n * @param args.enterpriseId - The ID of the enterprise whose secret to retrieve.\n * @param args.kind - The type of secret to look up (e.g. `\"oidc_client_secret\"`).\n * @returns The enterprise secret document, or `null` if not found.\n *\n * @example\n * ```ts\n * const secret = await ctx.runQuery(\n *   components.auth.enterprise.enterpriseSecretGet,\n *   { enterpriseId, kind: \"oidc_client_secret\" },\n * );\n * if (secret) {\n *   const plaintext = decrypt(secret.ciphertext);\n * }\n * ```\n */\nexport const enterpriseSecretGet = query({\n  args: {\n    enterpriseId: v.id(\"Enterprise\"),\n    kind: vEnterpriseSecretKind,\n  },\n  returns: v.union(vEnterpriseSecretDoc, v.null()),\n  handler: async (ctx, { enterpriseId, kind }) => {\n    return await ctx.db\n      .query(\"EnterpriseSecret\")\n      .withIndex(\"enterprise_id_kind\", (idx) =>\n        idx.eq(\"enterpriseId\", enterpriseId).eq(\"kind\", kind),\n      )\n      .first();\n  },\n});\n\n/**\n * Delete an encrypted secret for an enterprise by kind.\n *\n * Removes the secret document matching the `(enterpriseId, kind)` pair.\n * If no such secret exists, this is a no-op.\n *\n * @param args.enterpriseId - The ID of the enterprise whose secret to delete.\n * @param args.kind - The type of secret to remove (e.g. `\"oidc_client_secret\"`).\n * @returns `null` on success.\n *\n * @example\n * ```ts\n * await ctx.runMutation(\n *   components.auth.enterprise.enterpriseSecretDelete,\n *   { enterpriseId, kind: \"oidc_client_secret\" },\n * );\n * ```\n */\nexport const enterpriseSecretDelete = mutation({\n  args: {\n    enterpriseId: v.id(\"Enterprise\"),\n    kind: vEnterpriseSecretKind,\n  },\n  returns: v.null(),\n  handler: async (ctx, { enterpriseId, kind }) => {\n    const existing = await ctx.db\n      .query(\"EnterpriseSecret\")\n      .withIndex(\"enterprise_id_kind\", (idx) =>\n        idx.eq(\"enterpriseId\", enterpriseId).eq(\"kind\", kind),\n      )\n      .first();\n    if (existing) {\n      await ctx.db.delete(existing._id);\n    }\n    return null;\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCA,MAAa,yBAAyB,SAAS;CAC7C,MAAM;EACJ,cAAc,EAAE,GAAG,aAAa;EAChC,SAAS,EAAE,GAAG,QAAQ;EACtB,MAAM;EACN,YAAY,EAAE,QAAQ;EACtB,WAAW,EAAE,QAAQ;EACtB;CACD,SAAS,EAAE,GAAG,mBAAmB;CACjC,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,WAAW,MAAM,IAAI,GACxB,MAAM,mBAAmB,CACzB,UAAU,uBAAuB,QAChC,IAAI,GAAG,gBAAgB,KAAK,aAAa,CAAC,GAAG,QAAQ,KAAK,KAAK,CAChE,CACA,OAAO;AACV,MAAI,UAAU;AACZ,SAAM,IAAI,GAAG,MAAM,SAAS,KAAK,KAAK;AACtC,UAAO,SAAS;;AAElB,SAAO,MAAM,IAAI,GAAG,OAAO,oBAAoB,KAAK;;CAEvD,CAAC;;;;;;;;;;;;;;;;;;;;;;;AAwBF,MAAa,sBAAsB,MAAM;CACvC,MAAM;EACJ,cAAc,EAAE,GAAG,aAAa;EAChC,MAAM;EACP;CACD,SAAS,EAAE,MAAM,sBAAsB,EAAE,MAAM,CAAC;CAChD,SAAS,OAAO,KAAK,EAAE,cAAc,WAAW;AAC9C,SAAO,MAAM,IAAI,GACd,MAAM,mBAAmB,CACzB,UAAU,uBAAuB,QAChC,IAAI,GAAG,gBAAgB,aAAa,CAAC,GAAG,QAAQ,KAAK,CACtD,CACA,OAAO;;CAEb,CAAC;;;;;;;;;;;;;;;;;;;AAoBF,MAAa,yBAAyB,SAAS;CAC7C,MAAM;EACJ,cAAc,EAAE,GAAG,aAAa;EAChC,MAAM;EACP;CACD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,cAAc,WAAW;EAC9C,MAAM,WAAW,MAAM,IAAI,GACxB,MAAM,mBAAmB,CACzB,UAAU,uBAAuB,QAChC,IAAI,GAAG,gBAAgB,aAAa,CAAC,GAAG,QAAQ,KAAK,CACtD,CACA,OAAO;AACV,MAAI,SACF,OAAM,IAAI,GAAG,OAAO,SAAS,IAAI;AAEnC,SAAO;;CAEV,CAAC"}

package/dist/component/public/enterprise/webhooks.d.ts

@@ -1,211 +0,0 @@
-declare namespace webhooks_d_exports {
-  export { enterpriseWebhookDeliveryEnqueue, enterpriseWebhookDeliveryList, enterpriseWebhookDeliveryListReady, enterpriseWebhookDeliveryPatch, enterpriseWebhookEndpointCreate, enterpriseWebhookEndpointGet, enterpriseWebhookEndpointList, enterpriseWebhookEndpointUpdate };
-}
-/**
- * Register a new webhook endpoint for an enterprise.
- *
- * Creates an `EnterpriseWebhookEndpoint` document with an initial failure
- * count of `0`. The endpoint status defaults to `"active"` when not
- * explicitly provided. Each endpoint subscribes to a set of event types
- * that determine which deliveries are sent to it.
- *
- * @param args.enterpriseId - The ID of the enterprise this endpoint belongs to.
- * @param args.groupId - The ID of the root group that owns the enterprise.
- * @param args.url - The HTTPS URL where webhook payloads will be delivered.
- * @param args.status - An optional lifecycle status (`"active"`, `"paused"`, or `"disabled"`). Defaults to `"active"`.
- * @param args.secretHash - A hash of the signing secret used to verify delivery payloads.
- * @param args.subscriptions - An array of event type strings this endpoint subscribes to (e.g. `["user.login", "scim.provision"]`).
- * @param args.createdByUserId - An optional ID of the user who created this endpoint.
- * @param args.extend - An optional arbitrary extension object for custom endpoint metadata.
- * @returns The ID of the newly created `EnterpriseWebhookEndpoint` document.
- *
- * @example
- * ```ts
- * const endpointId = await ctx.runMutation(
- *   components.auth.enterprise.enterpriseWebhookEndpointCreate,
- *   {
- *     enterpriseId,
- *     groupId: orgGroupId,
- *     url: "https://acme.com/webhooks/auth",
- *     secretHash: "sha256:whsec_...",
- *     subscriptions: ["user.login", "user.created", "scim.provision"],
- *   },
- * );
- * ```
- */
-declare const enterpriseWebhookEndpointCreate: any;
-/**
- * List all webhook endpoints registered for an enterprise.
- *
- * Returns all `EnterpriseWebhookEndpoint` documents associated with the
- * given enterprise, regardless of status.
- *
- * @param args.enterpriseId - The ID of the enterprise whose webhook endpoints to list.
- * @returns An array of webhook endpoint documents.
- *
- * @example
- * ```ts
- * const endpoints = await ctx.runQuery(
- *   components.auth.enterprise.enterpriseWebhookEndpointList,
- *   { enterpriseId },
- * );
- * for (const ep of endpoints) {
- *   console.log(ep.url, ep.status, ep.subscriptions);
- * }
- * ```
- */
-declare const enterpriseWebhookEndpointList: any;
-/**
- * Retrieve a single webhook endpoint by its document ID.
- *
- * Returns the full endpoint document if it exists, or `null` if no
- * endpoint is found with the given ID.
- *
- * @param args.endpointId - The document ID of the webhook endpoint to retrieve.
- * @returns The webhook endpoint document, or `null` if not found.
- *
- * @example
- * ```ts
- * const endpoint = await ctx.runQuery(
- *   components.auth.enterprise.enterpriseWebhookEndpointGet,
- *   { endpointId },
- * );
- * if (endpoint) {
- *   console.log(endpoint.url, endpoint.failureCount);
- * }
- * ```
- */
-declare const enterpriseWebhookEndpointGet: any;
-/**
- * Partially update (patch) an existing webhook endpoint.
- *
- * Merges the provided `data` fields into the endpoint document. Only the
- * fields present in `data` are changed; all other fields are preserved.
- * Common updates include changing the URL, rotating the secret, updating
- * subscriptions, or changing the status.
- *
- * @param args.endpointId - The document ID of the webhook endpoint to update.
- * @param args.data - An object containing the fields to update (e.g. `{ url, status, subscriptions }`).
- * @returns `null` on success.
- *
- * @example
- * ```ts
- * await ctx.runMutation(
- *   components.auth.enterprise.enterpriseWebhookEndpointUpdate,
- *   {
- *     endpointId,
- *     data: {
- *       status: "paused",
- *       subscriptions: ["user.login"],
- *     },
- *   },
- * );
- * ```
- */
-declare const enterpriseWebhookEndpointUpdate: any;
-/**
- * Enqueue a webhook delivery for a specific endpoint.
- *
- * Creates a new `EnterpriseWebhookDelivery` document with an initial status
- * of `"pending"` and an attempt count of `0`. The delivery will be picked up
- * by the delivery worker once `nextAttemptAt` is reached.
- *
- * @param args.enterpriseId - The ID of the enterprise the delivery belongs to.
- * @param args.endpointId - The ID of the webhook endpoint this delivery targets.
- * @param args.auditEventId - An optional ID of the audit event that triggered this delivery.
- * @param args.eventType - The event type string describing the payload (e.g. `"user.created"`).
- * @param args.payload - The arbitrary JSON payload to deliver to the endpoint.
- * @param args.nextAttemptAt - Epoch timestamp (ms) when the delivery should first be attempted.
- * @returns The ID of the newly created `EnterpriseWebhookDelivery` document.
- *
- * @example
- * ```ts
- * const deliveryId = await ctx.runMutation(
- *   components.auth.enterprise.enterpriseWebhookDeliveryEnqueue,
- *   {
- *     enterpriseId,
- *     endpointId,
- *     auditEventId,
- *     eventType: "user.created",
- *     payload: { userId, email: "jane@acme.com" },
- *     nextAttemptAt: Date.now(),
- *   },
- * );
- * ```
- */
-declare const enterpriseWebhookDeliveryEnqueue: any;
-/**
- * List pending webhook deliveries that are ready to be attempted.
- *
- * Queries the `status_next_attempt_at` index for deliveries with status
- * `"pending"` whose `nextAttemptAt` is at or before the provided timestamp.
- * This is used by the delivery worker to find deliveries due for processing.
- *
- * @param args.now - The current epoch timestamp (ms) used as the cutoff for `nextAttemptAt`.
- * @param args.limit - Maximum number of deliveries to return (clamped between 1 and 100, defaults to 50).
- * @returns An array of webhook delivery documents ready for dispatch.
- *
- * @example
- * ```ts
- * const ready = await ctx.runQuery(
- *   components.auth.enterprise.enterpriseWebhookDeliveryListReady,
- *   { now: Date.now(), limit: 10 },
- * );
- * for (const delivery of ready) {
- *   await dispatchWebhook(delivery);
- * }
- * ```
- */
-declare const enterpriseWebhookDeliveryListReady: any;
-/**
- * List webhook deliveries for a specific enterprise, ordered by most recent first.
- *
- * Returns deliveries in reverse chronological order, useful for displaying
- * delivery history in an admin dashboard. Includes deliveries of all statuses.
- *
- * @param args.enterpriseId - The ID of the enterprise whose deliveries to list.
- * @param args.limit - Maximum number of deliveries to return (clamped between 1 and 100, defaults to 50).
- * @returns An array of webhook delivery documents, most recent first.
- *
- * @example
- * ```ts
- * const deliveries = await ctx.runQuery(
- *   components.auth.enterprise.enterpriseWebhookDeliveryList,
- *   { enterpriseId, limit: 25 },
- * );
- * for (const d of deliveries) {
- *   console.log(d.eventType, d.status, d.attemptCount);
- * }
- * ```
- */
-declare const enterpriseWebhookDeliveryList: any;
-/**
- * Partially update (patch) an existing webhook delivery record.
- *
- * Merges the provided `data` fields into the delivery document. This is
- * typically used by the delivery worker to update the delivery status,
- * increment the attempt count, record response codes, or schedule retry
- * timestamps after a delivery attempt.
- *
- * @param args.deliveryId - The document ID of the webhook delivery to update.
- * @param args.data - An object containing the fields to update (e.g. `{ status, attemptCount, nextAttemptAt }`).
- * @returns `null` on success.
- *
- * @example
- * ```ts
- * await ctx.runMutation(
- *   components.auth.enterprise.enterpriseWebhookDeliveryPatch,
- *   {
- *     deliveryId,
- *     data: {
- *       status: "delivered",
- *       attemptCount: 1,
- *     },
- *   },
- * );
- * ```
- */
-declare const enterpriseWebhookDeliveryPatch: any;
-//#endregion
-export { enterpriseWebhookDeliveryEnqueue, enterpriseWebhookDeliveryList, enterpriseWebhookDeliveryListReady, enterpriseWebhookDeliveryPatch, enterpriseWebhookEndpointCreate, enterpriseWebhookEndpointGet, enterpriseWebhookEndpointList, enterpriseWebhookEndpointUpdate, webhooks_d_exports };
-//# sourceMappingURL=webhooks.d.ts.map

package/dist/component/public/enterprise/webhooks.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"webhooks.d.ts","names":[],"sources":["../../../../src/component/public/enterprise/webhooks.ts"],"mappings":";;;;;;;;;;;;;;;;AAyCA;;;;;AAyCA;;;;;AA+BA;;;;;AAkCA;;;;cA1Ga,+BAAA;AAiJb;;;;;AAyCA;;;;;AAkCA;;;;;AAsCA;;;;;AAjHA,cAxGa,6BAAA;;;;;;;;;;;;;;;;;;;;;cA+BA,4BAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;cAkCA,+BAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAuCA,gCAAA;;;;;;;;;;;;;;;;;;;;;;;cAyCA,kCAAA;;;;;;;;;;;;;;;;;;;;;;cAkCA,6BAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;cAsCA,8BAAA"}

package/dist/component/public/enterprise/webhooks.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"webhooks.js","names":[],"sources":["../../../../src/component/public/enterprise/webhooks.ts"],"sourcesContent":["import { v } from \"convex/values\";\n\nimport { mutation, query } from \"../../functions\";\nimport {\n  vEnterpriseWebhookDeliveryDoc,\n  vEnterpriseWebhookEndpointDoc,\n  vWebhookEndpointStatus,\n} from \"../../model\";\n\n/**\n * Register a new webhook endpoint for an enterprise.\n *\n * Creates an `EnterpriseWebhookEndpoint` document with an initial failure\n * count of `0`. The endpoint status defaults to `\"active\"` when not\n * explicitly provided. Each endpoint subscribes to a set of event types\n * that determine which deliveries are sent to it.\n *\n * @param args.enterpriseId - The ID of the enterprise this endpoint belongs to.\n * @param args.groupId - The ID of the root group that owns the enterprise.\n * @param args.url - The HTTPS URL where webhook payloads will be delivered.\n * @param args.status - An optional lifecycle status (`\"active\"`, `\"paused\"`, or `\"disabled\"`). Defaults to `\"active\"`.\n * @param args.secretHash - A hash of the signing secret used to verify delivery payloads.\n * @param args.subscriptions - An array of event type strings this endpoint subscribes to (e.g. `[\"user.login\", \"scim.provision\"]`).\n * @param args.createdByUserId - An optional ID of the user who created this endpoint.\n * @param args.extend - An optional arbitrary extension object for custom endpoint metadata.\n * @returns The ID of the newly created `EnterpriseWebhookEndpoint` document.\n *\n * @example\n * ```ts\n * const endpointId = await ctx.runMutation(\n *   components.auth.enterprise.enterpriseWebhookEndpointCreate,\n *   {\n *     enterpriseId,\n *     groupId: orgGroupId,\n *     url: \"https://acme.com/webhooks/auth\",\n *     secretHash: \"sha256:whsec_...\",\n *     subscriptions: [\"user.login\", \"user.created\", \"scim.provision\"],\n *   },\n * );\n * ```\n */\nexport const enterpriseWebhookEndpointCreate = mutation({\n  args: {\n    enterpriseId: v.id(\"Enterprise\"),\n    groupId: v.id(\"Group\"),\n    url: v.string(),\n    status: v.optional(vWebhookEndpointStatus),\n    secretHash: v.string(),\n    subscriptions: v.array(v.string()),\n    createdByUserId: v.optional(v.id(\"User\")),\n    extend: v.optional(v.any()),\n  },\n  returns: v.id(\"EnterpriseWebhookEndpoint\"),\n  handler: async (ctx, args) => {\n    return await ctx.db.insert(\"EnterpriseWebhookEndpoint\", {\n      ...args,\n      status: args.status ?? \"active\",\n      failureCount: 0,\n    });\n  },\n});\n\n/**\n * List all webhook endpoints registered for an enterprise.\n *\n * Returns all `EnterpriseWebhookEndpoint` documents associated with the\n * given enterprise, regardless of status.\n *\n * @param args.enterpriseId - The ID of the enterprise whose webhook endpoints to list.\n * @returns An array of webhook endpoint documents.\n *\n * @example\n * ```ts\n * const endpoints = await ctx.runQuery(\n *   components.auth.enterprise.enterpriseWebhookEndpointList,\n *   { enterpriseId },\n * );\n * for (const ep of endpoints) {\n *   console.log(ep.url, ep.status, ep.subscriptions);\n * }\n * ```\n */\nexport const enterpriseWebhookEndpointList = query({\n  args: { enterpriseId: v.id(\"Enterprise\") },\n  returns: v.array(vEnterpriseWebhookEndpointDoc),\n  handler: async (ctx, { enterpriseId }) => {\n    return await ctx.db\n      .query(\"EnterpriseWebhookEndpoint\")\n      .withIndex(\"enterprise_id\", (idx) => idx.eq(\"enterpriseId\", enterpriseId))\n      .collect();\n  },\n});\n\n/**\n * Retrieve a single webhook endpoint by its document ID.\n *\n * Returns the full endpoint document if it exists, or `null` if no\n * endpoint is found with the given ID.\n *\n * @param args.endpointId - The document ID of the webhook endpoint to retrieve.\n * @returns The webhook endpoint document, or `null` if not found.\n *\n * @example\n * ```ts\n * const endpoint = await ctx.runQuery(\n *   components.auth.enterprise.enterpriseWebhookEndpointGet,\n *   { endpointId },\n * );\n * if (endpoint) {\n *   console.log(endpoint.url, endpoint.failureCount);\n * }\n * ```\n */\nexport const enterpriseWebhookEndpointGet = query({\n  args: { endpointId: v.id(\"EnterpriseWebhookEndpoint\") },\n  returns: v.union(vEnterpriseWebhookEndpointDoc, v.null()),\n  handler: async (ctx, { endpointId }) => {\n    return await ctx.db.get(endpointId);\n  },\n});\n\n/**\n * Partially update (patch) an existing webhook endpoint.\n *\n * Merges the provided `data` fields into the endpoint document. Only the\n * fields present in `data` are changed; all other fields are preserved.\n * Common updates include changing the URL, rotating the secret, updating\n * subscriptions, or changing the status.\n *\n * @param args.endpointId - The document ID of the webhook endpoint to update.\n * @param args.data - An object containing the fields to update (e.g. `{ url, status, subscriptions }`).\n * @returns `null` on success.\n *\n * @example\n * ```ts\n * await ctx.runMutation(\n *   components.auth.enterprise.enterpriseWebhookEndpointUpdate,\n *   {\n *     endpointId,\n *     data: {\n *       status: \"paused\",\n *       subscriptions: [\"user.login\"],\n *     },\n *   },\n * );\n * ```\n */\nexport const enterpriseWebhookEndpointUpdate = mutation({\n  args: { endpointId: v.id(\"EnterpriseWebhookEndpoint\"), data: v.any() },\n  returns: v.null(),\n  handler: async (ctx, { endpointId, data }) => {\n    await ctx.db.patch(endpointId, data);\n    return null;\n  },\n});\n\n/**\n * Enqueue a webhook delivery for a specific endpoint.\n *\n * Creates a new `EnterpriseWebhookDelivery` document with an initial status\n * of `\"pending\"` and an attempt count of `0`. The delivery will be picked up\n * by the delivery worker once `nextAttemptAt` is reached.\n *\n * @param args.enterpriseId - The ID of the enterprise the delivery belongs to.\n * @param args.endpointId - The ID of the webhook endpoint this delivery targets.\n * @param args.auditEventId - An optional ID of the audit event that triggered this delivery.\n * @param args.eventType - The event type string describing the payload (e.g. `\"user.created\"`).\n * @param args.payload - The arbitrary JSON payload to deliver to the endpoint.\n * @param args.nextAttemptAt - Epoch timestamp (ms) when the delivery should first be attempted.\n * @returns The ID of the newly created `EnterpriseWebhookDelivery` document.\n *\n * @example\n * ```ts\n * const deliveryId = await ctx.runMutation(\n *   components.auth.enterprise.enterpriseWebhookDeliveryEnqueue,\n *   {\n *     enterpriseId,\n *     endpointId,\n *     auditEventId,\n *     eventType: \"user.created\",\n *     payload: { userId, email: \"jane@acme.com\" },\n *     nextAttemptAt: Date.now(),\n *   },\n * );\n * ```\n */\nexport const enterpriseWebhookDeliveryEnqueue = mutation({\n  args: {\n    enterpriseId: v.id(\"Enterprise\"),\n    endpointId: v.id(\"EnterpriseWebhookEndpoint\"),\n    auditEventId: v.optional(v.id(\"EnterpriseAuditEvent\")),\n    eventType: v.string(),\n    payload: v.any(),\n    nextAttemptAt: v.number(),\n  },\n  returns: v.id(\"EnterpriseWebhookDelivery\"),\n  handler: async (ctx, args) => {\n    return await ctx.db.insert(\"EnterpriseWebhookDelivery\", {\n      ...args,\n      status: \"pending\",\n      attemptCount: 0,\n    });\n  },\n});\n\n/**\n * List pending webhook deliveries that are ready to be attempted.\n *\n * Queries the `status_next_attempt_at` index for deliveries with status\n * `\"pending\"` whose `nextAttemptAt` is at or before the provided timestamp.\n * This is used by the delivery worker to find deliveries due for processing.\n *\n * @param args.now - The current epoch timestamp (ms) used as the cutoff for `nextAttemptAt`.\n * @param args.limit - Maximum number of deliveries to return (clamped between 1 and 100, defaults to 50).\n * @returns An array of webhook delivery documents ready for dispatch.\n *\n * @example\n * ```ts\n * const ready = await ctx.runQuery(\n *   components.auth.enterprise.enterpriseWebhookDeliveryListReady,\n *   { now: Date.now(), limit: 10 },\n * );\n * for (const delivery of ready) {\n *   await dispatchWebhook(delivery);\n * }\n * ```\n */\nexport const enterpriseWebhookDeliveryListReady = query({\n  args: { now: v.number(), limit: v.optional(v.number()) },\n  returns: v.array(vEnterpriseWebhookDeliveryDoc),\n  handler: async (ctx, { now, limit }) => {\n    return await ctx.db\n      .query(\"EnterpriseWebhookDelivery\")\n      .withIndex(\"status_next_attempt_at\", (idx) =>\n        idx.eq(\"status\", \"pending\").lte(\"nextAttemptAt\", now),\n      )\n      .take(Math.min(Math.max(limit ?? 50, 1), 100));\n  },\n});\n\n/**\n * List webhook deliveries for a specific enterprise, ordered by most recent first.\n *\n * Returns deliveries in reverse chronological order, useful for displaying\n * delivery history in an admin dashboard. Includes deliveries of all statuses.\n *\n * @param args.enterpriseId - The ID of the enterprise whose deliveries to list.\n * @param args.limit - Maximum number of deliveries to return (clamped between 1 and 100, defaults to 50).\n * @returns An array of webhook delivery documents, most recent first.\n *\n * @example\n * ```ts\n * const deliveries = await ctx.runQuery(\n *   components.auth.enterprise.enterpriseWebhookDeliveryList,\n *   { enterpriseId, limit: 25 },\n * );\n * for (const d of deliveries) {\n *   console.log(d.eventType, d.status, d.attemptCount);\n * }\n * ```\n */\nexport const enterpriseWebhookDeliveryList = query({\n  args: { enterpriseId: v.id(\"Enterprise\"), limit: v.optional(v.number()) },\n  returns: v.array(vEnterpriseWebhookDeliveryDoc),\n  handler: async (ctx, { enterpriseId, limit }) => {\n    return await ctx.db\n      .query(\"EnterpriseWebhookDelivery\")\n      .withIndex(\"enterprise_id\", (idx) => idx.eq(\"enterpriseId\", enterpriseId))\n      .order(\"desc\")\n      .take(Math.min(Math.max(limit ?? 50, 1), 100));\n  },\n});\n\n/**\n * Partially update (patch) an existing webhook delivery record.\n *\n * Merges the provided `data` fields into the delivery document. This is\n * typically used by the delivery worker to update the delivery status,\n * increment the attempt count, record response codes, or schedule retry\n * timestamps after a delivery attempt.\n *\n * @param args.deliveryId - The document ID of the webhook delivery to update.\n * @param args.data - An object containing the fields to update (e.g. `{ status, attemptCount, nextAttemptAt }`).\n * @returns `null` on success.\n *\n * @example\n * ```ts\n * await ctx.runMutation(\n *   components.auth.enterprise.enterpriseWebhookDeliveryPatch,\n *   {\n *     deliveryId,\n *     data: {\n *       status: \"delivered\",\n *       attemptCount: 1,\n *     },\n *   },\n * );\n * ```\n */\nexport const enterpriseWebhookDeliveryPatch = mutation({\n  args: { deliveryId: v.id(\"EnterpriseWebhookDelivery\"), data: v.any() },\n  returns: v.null(),\n  handler: async (ctx, { deliveryId, data }) => {\n    await ctx.db.patch(deliveryId, data);\n    return null;\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyCA,MAAa,kCAAkC,SAAS;CACtD,MAAM;EACJ,cAAc,EAAE,GAAG,aAAa;EAChC,SAAS,EAAE,GAAG,QAAQ;EACtB,KAAK,EAAE,QAAQ;EACf,QAAQ,EAAE,SAAS,uBAAuB;EAC1C,YAAY,EAAE,QAAQ;EACtB,eAAe,EAAE,MAAM,EAAE,QAAQ,CAAC;EAClC,iBAAiB,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;EACzC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC;EAC5B;CACD,SAAS,EAAE,GAAG,4BAA4B;CAC1C,SAAS,OAAO,KAAK,SAAS;AAC5B,SAAO,MAAM,IAAI,GAAG,OAAO,6BAA6B;GACtD,GAAG;GACH,QAAQ,KAAK,UAAU;GACvB,cAAc;GACf,CAAC;;CAEL,CAAC;;;;;;;;;;;;;;;;;;;;;AAsBF,MAAa,gCAAgC,MAAM;CACjD,MAAM,EAAE,cAAc,EAAE,GAAG,aAAa,EAAE;CAC1C,SAAS,EAAE,MAAM,8BAA8B;CAC/C,SAAS,OAAO,KAAK,EAAE,mBAAmB;AACxC,SAAO,MAAM,IAAI,GACd,MAAM,4BAA4B,CAClC,UAAU,kBAAkB,QAAQ,IAAI,GAAG,gBAAgB,aAAa,CAAC,CACzE,SAAS;;CAEf,CAAC;;;;;;;;;;;;;;;;;;;;;AAsBF,MAAa,+BAA+B,MAAM;CAChD,MAAM,EAAE,YAAY,EAAE,GAAG,4BAA4B,EAAE;CACvD,SAAS,EAAE,MAAM,+BAA+B,EAAE,MAAM,CAAC;CACzD,SAAS,OAAO,KAAK,EAAE,iBAAiB;AACtC,SAAO,MAAM,IAAI,GAAG,IAAI,WAAW;;CAEtC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BF,MAAa,kCAAkC,SAAS;CACtD,MAAM;EAAE,YAAY,EAAE,GAAG,4BAA4B;EAAE,MAAM,EAAE,KAAK;EAAE;CACtE,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,YAAY,WAAW;AAC5C,QAAM,IAAI,GAAG,MAAM,YAAY,KAAK;AACpC,SAAO;;CAEV,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCF,MAAa,mCAAmC,SAAS;CACvD,MAAM;EACJ,cAAc,EAAE,GAAG,aAAa;EAChC,YAAY,EAAE,GAAG,4BAA4B;EAC7C,cAAc,EAAE,SAAS,EAAE,GAAG,uBAAuB,CAAC;EACtD,WAAW,EAAE,QAAQ;EACrB,SAAS,EAAE,KAAK;EAChB,eAAe,EAAE,QAAQ;EAC1B;CACD,SAAS,EAAE,GAAG,4BAA4B;CAC1C,SAAS,OAAO,KAAK,SAAS;AAC5B,SAAO,MAAM,IAAI,GAAG,OAAO,6BAA6B;GACtD,GAAG;GACH,QAAQ;GACR,cAAc;GACf,CAAC;;CAEL,CAAC;;;;;;;;;;;;;;;;;;;;;;;AAwBF,MAAa,qCAAqC,MAAM;CACtD,MAAM;EAAE,KAAK,EAAE,QAAQ;EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;EAAE;CACxD,SAAS,EAAE,MAAM,8BAA8B;CAC/C,SAAS,OAAO,KAAK,EAAE,KAAK,YAAY;AACtC,SAAO,MAAM,IAAI,GACd,MAAM,4BAA4B,CAClC,UAAU,2BAA2B,QACpC,IAAI,GAAG,UAAU,UAAU,CAAC,IAAI,iBAAiB,IAAI,CACtD,CACA,KAAK,KAAK,IAAI,KAAK,IAAI,SAAS,IAAI,EAAE,EAAE,IAAI,CAAC;;CAEnD,CAAC;;;;;;;;;;;;;;;;;;;;;;AAuBF,MAAa,gCAAgC,MAAM;CACjD,MAAM;EAAE,cAAc,EAAE,GAAG,aAAa;EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;EAAE;CACzE,SAAS,EAAE,MAAM,8BAA8B;CAC/C,SAAS,OAAO,KAAK,EAAE,cAAc,YAAY;AAC/C,SAAO,MAAM,IAAI,GACd,MAAM,4BAA4B,CAClC,UAAU,kBAAkB,QAAQ,IAAI,GAAG,gBAAgB,aAAa,CAAC,CACzE,MAAM,OAAO,CACb,KAAK,KAAK,IAAI,KAAK,IAAI,SAAS,IAAI,EAAE,EAAE,IAAI,CAAC;;CAEnD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BF,MAAa,iCAAiC,SAAS;CACrD,MAAM;EAAE,YAAY,EAAE,GAAG,4BAA4B;EAAE,MAAM,EAAE,KAAK;EAAE;CACtE,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,YAAY,WAAW;AAC5C,QAAM,IAAI,GAAG,MAAM,YAAY,KAAK;AACpC,SAAO;;CAEV,CAAC"}

package/dist/component/public/factors/devices.d.ts

@@ -1,157 +0,0 @@
-declare namespace devices_d_exports {
-  export { deviceAuthorize, deviceDelete, deviceGetByCodeHash, deviceGetByUserCode, deviceInsert, deviceUpdateLastPolled };
-}
-/**
- * Insert a new device authorization record into the `DeviceCode` table.
- *
- * Creates a pending device authorization entry as part of the OAuth 2.0
- * Device Authorization Grant (RFC 8628). The record tracks the hashed device
- * code, the human-readable user code, expiry, and polling interval.
- *
- * @param deviceCodeHash - SHA-256 hash of the device code issued to the client.
- *   Only the hash is stored; the raw code is never persisted.
- * @param userCode - Short, human-readable code displayed to the end-user
- *   so they can authorize the device on a separate screen.
- * @param expiresAt - Unix timestamp (in milliseconds) after which the device
- *   authorization request is no longer valid.
- * @param interval - Minimum polling interval in seconds that the device client
- *   must wait between token requests.
- * @param status - Initial status of the device authorization (e.g. `"pending"`).
- * @returns The `_id` of the newly created `DeviceCode` document.
- *
- * @example
- * ```ts
- * const deviceCodeId = await ctx.runMutation(
- *   components.auth.factors.devices.deviceInsert,
- *   {
- *     deviceCodeHash: "a1b2c3d4e5f6...",
- *     userCode: "ABCD-1234",
- *     expiresAt: Date.now() + 10 * 60 * 1000,
- *     interval: 5,
- *     status: "pending",
- *   },
- * );
- * ```
- */
-declare const deviceInsert: any;
-/**
- * Look up a device authorization record by its hashed device code.
- *
- * Queries the `DeviceCode` table using the `device_code_hash` index.
- * This is the primary lookup used by the token endpoint when a device
- * client polls for authorization status.
- *
- * @param deviceCodeHash - SHA-256 hash of the device code to look up.
- * @returns The matching `DeviceCode` document, or `null` if no record
- *   exists for the given hash.
- *
- * @example
- * ```ts
- * const deviceCode = await ctx.runQuery(
- *   components.auth.factors.devices.deviceGetByCodeHash,
- *   { deviceCodeHash: "a1b2c3d4e5f6..." },
- * );
- * if (deviceCode && deviceCode.status === "authorized") {
- *   // Exchange for tokens
- * }
- * ```
- */
-declare const deviceGetByCodeHash: any;
-/**
- * Look up a pending device authorization by its user-facing code.
- *
- * Queries the `DeviceCode` table using the `user_code_status` compound index,
- * filtering to only `"pending"` records. This is called when an authenticated
- * user enters the code shown on the device to approve the authorization.
- *
- * @param userCode - The short, human-readable code the user typed in
- *   (e.g. `"ABCD-1234"`).
- * @returns The matching pending `DeviceCode` document, or `null` if no
- *   pending authorization exists for the given user code.
- *
- * @example
- * ```ts
- * const pending = await ctx.runQuery(
- *   components.auth.factors.devices.deviceGetByUserCode,
- *   { userCode: "ABCD-1234" },
- * );
- * if (pending === null) {
- *   throw new Error("Invalid or expired user code");
- * }
- * ```
- */
-declare const deviceGetByUserCode: any;
-/**
- * Authorize a device code by linking it to a user and session.
- *
- * Transitions the device authorization status from `"pending"` to
- * `"authorized"` and associates it with the approving user and their
- * active session. After this mutation, the next poll from the device
- * client will succeed and tokens can be issued.
- *
- * @param deviceId - The `_id` of the `DeviceCode` document to authorize.
- * @param userId - The `_id` of the `User` who approved the device request.
- * @param sessionId - The `_id` of the `Session` associated with the
- *   approving user's current login.
- * @returns `null` on success.
- *
- * @example
- * ```ts
- * await ctx.runMutation(
- *   components.auth.factors.devices.deviceAuthorize,
- *   {
- *     deviceId: pending._id,
- *     userId: currentUser._id,
- *     sessionId: currentSession._id,
- *   },
- * );
- * ```
- */
-declare const deviceAuthorize: any;
-/**
- * Update the last-polled timestamp on a device authorization record.
- *
- * Called each time the device client polls the token endpoint. The
- * timestamp is used to enforce the minimum polling interval and to
- * detect slow-polling violations per RFC 8628.
- *
- * @param deviceId - The `_id` of the `DeviceCode` document to update.
- * @param lastPolledAt - Unix timestamp (in milliseconds) of the most
- *   recent poll request from the device client.
- * @returns `null` on success.
- *
- * @example
- * ```ts
- * await ctx.runMutation(
- *   components.auth.factors.devices.deviceUpdateLastPolled,
- *   {
- *     deviceId: deviceCode._id,
- *     lastPolledAt: Date.now(),
- *   },
- * );
- * ```
- */
-declare const deviceUpdateLastPolled: any;
-/**
- * Delete a device authorization record from the `DeviceCode` table.
- *
- * Permanently removes the device code entry. This should be called after
- * the device authorization has been successfully exchanged for tokens, or
- * when the authorization has expired and needs to be cleaned up.
- *
- * @param deviceId - The `_id` of the `DeviceCode` document to delete.
- * @returns `null` on success.
- *
- * @example
- * ```ts
- * // Clean up after successful token exchange
- * await ctx.runMutation(
- *   components.auth.factors.devices.deviceDelete,
- *   { deviceId: deviceCode._id },
- * );
- * ```
- */
-declare const deviceDelete: any;
-//#endregion
-export { deviceAuthorize, deviceDelete, deviceGetByCodeHash, deviceGetByUserCode, deviceInsert, deviceUpdateLastPolled, devices_d_exports };
-//# sourceMappingURL=devices.d.ts.map

package/dist/component/public/factors/devices.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"devices.d.ts","names":[],"sources":["../../../../src/component/public/factors/devices.ts"],"mappings":";;;;;;;;;;;;;;AAqCA;;;;;AAoCA;;;;;AAoCA;;;;;AAuCA;;;;;AAwCA;cAvJa,YAAA;;;;AAmLb;;;;;;;;;;;;;;;;;;;cA/Ia,mBAAA;;;;;;;;;;;;;;;;;;;;;;;;cAoCA,mBAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;cAuCA,eAAA;;;;;;;;;;;;;;;;;;;;;;;;cAwCA,sBAAA;;;;;;;;;;;;;;;;;;;;cA4BA,YAAA"}

package/dist/component/public/factors/devices.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"devices.js","names":[],"sources":["../../../../src/component/public/factors/devices.ts"],"sourcesContent":["import { v } from \"convex/values\";\n\nimport { mutation, query } from \"../../functions\";\nimport { vDeviceCodeDoc, vDeviceStatus } from \"../../model\";\n\n/**\n * Insert a new device authorization record into the `DeviceCode` table.\n *\n * Creates a pending device authorization entry as part of the OAuth 2.0\n * Device Authorization Grant (RFC 8628). The record tracks the hashed device\n * code, the human-readable user code, expiry, and polling interval.\n *\n * @param deviceCodeHash - SHA-256 hash of the device code issued to the client.\n *   Only the hash is stored; the raw code is never persisted.\n * @param userCode - Short, human-readable code displayed to the end-user\n *   so they can authorize the device on a separate screen.\n * @param expiresAt - Unix timestamp (in milliseconds) after which the device\n *   authorization request is no longer valid.\n * @param interval - Minimum polling interval in seconds that the device client\n *   must wait between token requests.\n * @param status - Initial status of the device authorization (e.g. `\"pending\"`).\n * @returns The `_id` of the newly created `DeviceCode` document.\n *\n * @example\n * ```ts\n * const deviceCodeId = await ctx.runMutation(\n *   components.auth.factors.devices.deviceInsert,\n *   {\n *     deviceCodeHash: \"a1b2c3d4e5f6...\",\n *     userCode: \"ABCD-1234\",\n *     expiresAt: Date.now() + 10 * 60 * 1000,\n *     interval: 5,\n *     status: \"pending\",\n *   },\n * );\n * ```\n */\nexport const deviceInsert = mutation({\n  args: {\n    deviceCodeHash: v.string(),\n    userCode: v.string(),\n    expiresAt: v.number(),\n    interval: v.number(),\n    status: vDeviceStatus,\n  },\n  returns: v.id(\"DeviceCode\"),\n  handler: async (ctx, args) => {\n    return await ctx.db.insert(\"DeviceCode\", args);\n  },\n});\n\n/**\n * Look up a device authorization record by its hashed device code.\n *\n * Queries the `DeviceCode` table using the `device_code_hash` index.\n * This is the primary lookup used by the token endpoint when a device\n * client polls for authorization status.\n *\n * @param deviceCodeHash - SHA-256 hash of the device code to look up.\n * @returns The matching `DeviceCode` document, or `null` if no record\n *   exists for the given hash.\n *\n * @example\n * ```ts\n * const deviceCode = await ctx.runQuery(\n *   components.auth.factors.devices.deviceGetByCodeHash,\n *   { deviceCodeHash: \"a1b2c3d4e5f6...\" },\n * );\n * if (deviceCode && deviceCode.status === \"authorized\") {\n *   // Exchange for tokens\n * }\n * ```\n */\nexport const deviceGetByCodeHash = query({\n  args: { deviceCodeHash: v.string() },\n  returns: v.union(vDeviceCodeDoc, v.null()),\n  handler: async (ctx, { deviceCodeHash }) => {\n    return await ctx.db\n      .query(\"DeviceCode\")\n      .withIndex(\"device_code_hash\", (q) =>\n        q.eq(\"deviceCodeHash\", deviceCodeHash),\n      )\n      .first();\n  },\n});\n\n/**\n * Look up a pending device authorization by its user-facing code.\n *\n * Queries the `DeviceCode` table using the `user_code_status` compound index,\n * filtering to only `\"pending\"` records. This is called when an authenticated\n * user enters the code shown on the device to approve the authorization.\n *\n * @param userCode - The short, human-readable code the user typed in\n *   (e.g. `\"ABCD-1234\"`).\n * @returns The matching pending `DeviceCode` document, or `null` if no\n *   pending authorization exists for the given user code.\n *\n * @example\n * ```ts\n * const pending = await ctx.runQuery(\n *   components.auth.factors.devices.deviceGetByUserCode,\n *   { userCode: \"ABCD-1234\" },\n * );\n * if (pending === null) {\n *   throw new Error(\"Invalid or expired user code\");\n * }\n * ```\n */\nexport const deviceGetByUserCode = query({\n  args: { userCode: v.string() },\n  returns: v.union(vDeviceCodeDoc, v.null()),\n  handler: async (ctx, { userCode }) => {\n    return await ctx.db\n      .query(\"DeviceCode\")\n      .withIndex(\"user_code_status\", (q) =>\n        q.eq(\"userCode\", userCode).eq(\"status\", \"pending\"),\n      )\n      .first();\n  },\n});\n\n/**\n * Authorize a device code by linking it to a user and session.\n *\n * Transitions the device authorization status from `\"pending\"` to\n * `\"authorized\"` and associates it with the approving user and their\n * active session. After this mutation, the next poll from the device\n * client will succeed and tokens can be issued.\n *\n * @param deviceId - The `_id` of the `DeviceCode` document to authorize.\n * @param userId - The `_id` of the `User` who approved the device request.\n * @param sessionId - The `_id` of the `Session` associated with the\n *   approving user's current login.\n * @returns `null` on success.\n *\n * @example\n * ```ts\n * await ctx.runMutation(\n *   components.auth.factors.devices.deviceAuthorize,\n *   {\n *     deviceId: pending._id,\n *     userId: currentUser._id,\n *     sessionId: currentSession._id,\n *   },\n * );\n * ```\n */\nexport const deviceAuthorize = mutation({\n  args: {\n    deviceId: v.id(\"DeviceCode\"),\n    userId: v.id(\"User\"),\n    sessionId: v.id(\"Session\"),\n  },\n  returns: v.null(),\n  handler: async (ctx, { deviceId, userId, sessionId }) => {\n    await ctx.db.patch(\"DeviceCode\", deviceId, {\n      status: \"authorized\",\n      userId,\n      sessionId,\n    });\n    return null;\n  },\n});\n\n/**\n * Update the last-polled timestamp on a device authorization record.\n *\n * Called each time the device client polls the token endpoint. The\n * timestamp is used to enforce the minimum polling interval and to\n * detect slow-polling violations per RFC 8628.\n *\n * @param deviceId - The `_id` of the `DeviceCode` document to update.\n * @param lastPolledAt - Unix timestamp (in milliseconds) of the most\n *   recent poll request from the device client.\n * @returns `null` on success.\n *\n * @example\n * ```ts\n * await ctx.runMutation(\n *   components.auth.factors.devices.deviceUpdateLastPolled,\n *   {\n *     deviceId: deviceCode._id,\n *     lastPolledAt: Date.now(),\n *   },\n * );\n * ```\n */\nexport const deviceUpdateLastPolled = mutation({\n  args: { deviceId: v.id(\"DeviceCode\"), lastPolledAt: v.number() },\n  returns: v.null(),\n  handler: async (ctx, { deviceId, lastPolledAt }) => {\n    await ctx.db.patch(\"DeviceCode\", deviceId, { lastPolledAt });\n    return null;\n  },\n});\n\n/**\n * Delete a device authorization record from the `DeviceCode` table.\n *\n * Permanently removes the device code entry. This should be called after\n * the device authorization has been successfully exchanged for tokens, or\n * when the authorization has expired and needs to be cleaned up.\n *\n * @param deviceId - The `_id` of the `DeviceCode` document to delete.\n * @returns `null` on success.\n *\n * @example\n * ```ts\n * // Clean up after successful token exchange\n * await ctx.runMutation(\n *   components.auth.factors.devices.deviceDelete,\n *   { deviceId: deviceCode._id },\n * );\n * ```\n */\nexport const deviceDelete = mutation({\n  args: { deviceId: v.id(\"DeviceCode\") },\n  returns: v.null(),\n  handler: async (ctx, { deviceId }) => {\n    await ctx.db.delete(\"DeviceCode\", deviceId);\n    return null;\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,MAAa,eAAe,SAAS;CACnC,MAAM;EACJ,gBAAgB,EAAE,QAAQ;EAC1B,UAAU,EAAE,QAAQ;EACpB,WAAW,EAAE,QAAQ;EACrB,UAAU,EAAE,QAAQ;EACpB,QAAQ;EACT;CACD,SAAS,EAAE,GAAG,aAAa;CAC3B,SAAS,OAAO,KAAK,SAAS;AAC5B,SAAO,MAAM,IAAI,GAAG,OAAO,cAAc,KAAK;;CAEjD,CAAC;;;;;;;;;;;;;;;;;;;;;;;AAwBF,MAAa,sBAAsB,MAAM;CACvC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE;CACpC,SAAS,EAAE,MAAM,gBAAgB,EAAE,MAAM,CAAC;CAC1C,SAAS,OAAO,KAAK,EAAE,qBAAqB;AAC1C,SAAO,MAAM,IAAI,GACd,MAAM,aAAa,CACnB,UAAU,qBAAqB,MAC9B,EAAE,GAAG,kBAAkB,eAAe,CACvC,CACA,OAAO;;CAEb,CAAC;;;;;;;;;;;;;;;;;;;;;;;;AAyBF,MAAa,sBAAsB,MAAM;CACvC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE;CAC9B,SAAS,EAAE,MAAM,gBAAgB,EAAE,MAAM,CAAC;CAC1C,SAAS,OAAO,KAAK,EAAE,eAAe;AACpC,SAAO,MAAM,IAAI,GACd,MAAM,aAAa,CACnB,UAAU,qBAAqB,MAC9B,EAAE,GAAG,YAAY,SAAS,CAAC,GAAG,UAAU,UAAU,CACnD,CACA,OAAO;;CAEb,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BF,MAAa,kBAAkB,SAAS;CACtC,MAAM;EACJ,UAAU,EAAE,GAAG,aAAa;EAC5B,QAAQ,EAAE,GAAG,OAAO;EACpB,WAAW,EAAE,GAAG,UAAU;EAC3B;CACD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,UAAU,QAAQ,gBAAgB;AACvD,QAAM,IAAI,GAAG,MAAM,cAAc,UAAU;GACzC,QAAQ;GACR;GACA;GACD,CAAC;AACF,SAAO;;CAEV,CAAC;;;;;;;;;;;;;;;;;;;;;;;;AAyBF,MAAa,yBAAyB,SAAS;CAC7C,MAAM;EAAE,UAAU,EAAE,GAAG,aAAa;EAAE,cAAc,EAAE,QAAQ;EAAE;CAChE,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,UAAU,mBAAmB;AAClD,QAAM,IAAI,GAAG,MAAM,cAAc,UAAU,EAAE,cAAc,CAAC;AAC5D,SAAO;;CAEV,CAAC;;;;;;;;;;;;;;;;;;;;AAqBF,MAAa,eAAe,SAAS;CACnC,MAAM,EAAE,UAAU,EAAE,GAAG,aAAa,EAAE;CACtC,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,eAAe;AACpC,QAAM,IAAI,GAAG,OAAO,cAAc,SAAS;AAC3C,SAAO;;CAEV,CAAC"}