@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/component/public/factors/passkeys.d.ts

@@ -1,175 +0,0 @@
-declare namespace passkeys_d_exports {
-  export { passkeyDelete, passkeyGetByCredentialId, passkeyInsert, passkeyListByUserId, passkeyUpdateCounter, passkeyUpdateMeta };
-}
-/**
- * Store a new WebAuthn passkey credential for a user.
- *
- * Persists the public key material and metadata returned by the browser's
- * `navigator.credentials.create()` call after a successful registration
- * ceremony. Each passkey is tied to a single user.
- *
- * @param userId - The `_id` of the `User` who owns this passkey.
- * @param credentialId - Base64url-encoded credential identifier assigned
- *   by the authenticator; used to look up the key during authentication.
- * @param publicKey - Raw public key bytes (COSE format) for signature
- *   verification.
- * @param algorithm - COSE algorithm identifier (e.g. `-7` for ES256,
- *   `-257` for RS256).
- * @param counter - Signature counter reported by the authenticator at
- *   registration time; used to detect cloned credentials.
- * @param transports - Optional list of transport hints (e.g.
- *   `["usb", "ble", "nfc", "internal"]`) to help the browser select
- *   the correct authenticator.
- * @param deviceType - Authenticator attachment type (e.g.
- *   `"singleDevice"` or `"multiDevice"`).
- * @param backedUp - Whether the credential is backed up (synced) by the
- *   authenticator platform.
- * @param name - Optional human-readable label for the passkey
- *   (e.g. `"MacBook Pro Touch ID"`).
- * @param createdAt - Unix timestamp (in milliseconds) when the passkey
- *   was registered.
- * @returns The `_id` of the newly created `Passkey` document.
- *
- * @example
- * ```ts
- * const passkeyId = await ctx.runMutation(
- *   components.auth.factors.passkeys.passkeyInsert,
- *   {
- *     userId: user._id,
- *     credentialId: "dGVzdC1jcmVkZW50aWFs",
- *     publicKey: publicKeyBytes,
- *     algorithm: -7,
- *     counter: 0,
- *     transports: ["internal"],
- *     deviceType: "multiDevice",
- *     backedUp: true,
- *     name: "MacBook Pro Touch ID",
- *     createdAt: Date.now(),
- *   },
- * );
- * ```
- */
-declare const passkeyInsert: any;
-/**
- * Look up a passkey by its credential ID.
- *
- * Queries the `Passkey` table using the `credential_id` unique index.
- * This is the primary lookup during a WebAuthn authentication ceremony:
- * the authenticator provides a credential ID, and this function retrieves
- * the corresponding public key and counter for signature verification.
- *
- * @param credentialId - Base64url-encoded credential identifier to search for.
- * @returns The matching `Passkey` document, or `null` if no passkey exists
- *   with the given credential ID.
- *
- * @example
- * ```ts
- * const passkey = await ctx.runQuery(
- *   components.auth.factors.passkeys.passkeyGetByCredentialId,
- *   { credentialId: "dGVzdC1jcmVkZW50aWFs" },
- * );
- * if (passkey === null) {
- *   throw new Error("Unknown credential");
- * }
- * ```
- */
-declare const passkeyGetByCredentialId: any;
-/**
- * List all passkeys registered to a user.
- *
- * Retrieves every `Passkey` document associated with the given user via
- * the `user_id` index. Useful for displaying a user's registered
- * authenticators in a settings page, or for building the
- * `allowCredentials` list during a WebAuthn authentication ceremony.
- *
- * @param userId - The `_id` of the `User` whose passkeys to retrieve.
- * @returns An array of `Passkey` documents. Returns an empty array if the
- *   user has no registered passkeys.
- *
- * @example
- * ```ts
- * const passkeys = await ctx.runQuery(
- *   components.auth.factors.passkeys.passkeyListByUserId,
- *   { userId: user._id },
- * );
- * // Display each passkey's name and creation date
- * for (const pk of passkeys) {
- *   console.log(pk.name, new Date(pk.createdAt));
- * }
- * ```
- */
-declare const passkeyListByUserId: any;
-/**
- * Update a passkey's signature counter and last-used timestamp after
- * a successful authentication.
- *
- * After verifying a WebAuthn assertion, the relying party must persist
- * the new counter value reported by the authenticator. A counter that
- * does not increase may indicate a cloned credential.
- *
- * @param passkeyId - The `_id` of the `Passkey` document to update.
- * @param counter - The new signature counter value returned by the
- *   authenticator in the assertion response.
- * @param lastUsedAt - Unix timestamp (in milliseconds) recording when
- *   this passkey was most recently used to authenticate.
- * @returns `null` on success.
- *
- * @example
- * ```ts
- * await ctx.runMutation(
- *   components.auth.factors.passkeys.passkeyUpdateCounter,
- *   {
- *     passkeyId: passkey._id,
- *     counter: assertionResponse.counter,
- *     lastUsedAt: Date.now(),
- *   },
- * );
- * ```
- */
-declare const passkeyUpdateCounter: any;
-/**
- * Update a passkey's metadata fields.
- *
- * Performs a partial patch on the `Passkey` document. Typically used to
- * rename a passkey (e.g. from `"Security Key"` to `"YubiKey 5C"`), but
- * can update any mutable fields via the `data` argument.
- *
- * @param passkeyId - The `_id` of the `Passkey` document to update.
- * @param data - An object containing the fields to patch. Commonly
- *   includes `{ name: "New Label" }`, but accepts any valid passkey fields.
- * @returns `null` on success.
- *
- * @example
- * ```ts
- * await ctx.runMutation(
- *   components.auth.factors.passkeys.passkeyUpdateMeta,
- *   {
- *     passkeyId: passkey._id,
- *     data: { name: "YubiKey 5C NFC" },
- *   },
- * );
- * ```
- */
-declare const passkeyUpdateMeta: any;
-/**
- * Delete a passkey credential from the `Passkey` table.
- *
- * Permanently removes the passkey record. After deletion the credential
- * can no longer be used for authentication. Typically called from a
- * user's security settings when they want to unregister an authenticator.
- *
- * @param passkeyId - The `_id` of the `Passkey` document to delete.
- * @returns `null` on success.
- *
- * @example
- * ```ts
- * await ctx.runMutation(
- *   components.auth.factors.passkeys.passkeyDelete,
- *   { passkeyId: passkey._id },
- * );
- * ```
- */
-declare const passkeyDelete: any;
-//#endregion
-export { passkeyDelete, passkeyGetByCredentialId, passkeyInsert, passkeyListByUserId, passkeyUpdateCounter, passkeyUpdateMeta, passkeys_d_exports };
-//# sourceMappingURL=passkeys.d.ts.map

package/dist/component/public/factors/passkeys.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"passkeys.d.ts","names":[],"sources":["../../../../src/component/public/factors/passkeys.ts"],"mappings":";;;;;;;;;;;;;;AAqDA;;;;;AA0CA;;;;;AAmCA;;;;;AAsCA;;;;;AAoCA;;;;;AA2BA;;;;;;;;;;;;cAlLa,aAAA;;;;;;;;;;;;;;;;;;;;;;;;cA0CA,wBAAA;;;;;;;;;;;;;;;;;;;;;;;;;cAmCA,mBAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAsCA,oBAAA;;;;;;;;;;;;;;;;;;;;;;;;cAoCA,iBAAA;;;;;;;;;;;;;;;;;;;cA2BA,aAAA"}

package/dist/component/public/factors/passkeys.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"passkeys.js","names":[],"sources":["../../../../src/component/public/factors/passkeys.ts"],"sourcesContent":["import { v } from \"convex/values\";\n\nimport { mutation, query } from \"../../functions\";\nimport { vPasskeyDoc } from \"../../model\";\n\n/**\n * Store a new WebAuthn passkey credential for a user.\n *\n * Persists the public key material and metadata returned by the browser's\n * `navigator.credentials.create()` call after a successful registration\n * ceremony. Each passkey is tied to a single user.\n *\n * @param userId - The `_id` of the `User` who owns this passkey.\n * @param credentialId - Base64url-encoded credential identifier assigned\n *   by the authenticator; used to look up the key during authentication.\n * @param publicKey - Raw public key bytes (COSE format) for signature\n *   verification.\n * @param algorithm - COSE algorithm identifier (e.g. `-7` for ES256,\n *   `-257` for RS256).\n * @param counter - Signature counter reported by the authenticator at\n *   registration time; used to detect cloned credentials.\n * @param transports - Optional list of transport hints (e.g.\n *   `[\"usb\", \"ble\", \"nfc\", \"internal\"]`) to help the browser select\n *   the correct authenticator.\n * @param deviceType - Authenticator attachment type (e.g.\n *   `\"singleDevice\"` or `\"multiDevice\"`).\n * @param backedUp - Whether the credential is backed up (synced) by the\n *   authenticator platform.\n * @param name - Optional human-readable label for the passkey\n *   (e.g. `\"MacBook Pro Touch ID\"`).\n * @param createdAt - Unix timestamp (in milliseconds) when the passkey\n *   was registered.\n * @returns The `_id` of the newly created `Passkey` document.\n *\n * @example\n * ```ts\n * const passkeyId = await ctx.runMutation(\n *   components.auth.factors.passkeys.passkeyInsert,\n *   {\n *     userId: user._id,\n *     credentialId: \"dGVzdC1jcmVkZW50aWFs\",\n *     publicKey: publicKeyBytes,\n *     algorithm: -7,\n *     counter: 0,\n *     transports: [\"internal\"],\n *     deviceType: \"multiDevice\",\n *     backedUp: true,\n *     name: \"MacBook Pro Touch ID\",\n *     createdAt: Date.now(),\n *   },\n * );\n * ```\n */\nexport const passkeyInsert = mutation({\n  args: {\n    userId: v.id(\"User\"),\n    credentialId: v.string(),\n    publicKey: v.bytes(),\n    algorithm: v.number(),\n    counter: v.number(),\n    transports: v.optional(v.array(v.string())),\n    deviceType: v.string(),\n    backedUp: v.boolean(),\n    name: v.optional(v.string()),\n    createdAt: v.number(),\n  },\n  returns: v.id(\"Passkey\"),\n  handler: async (ctx, args) => {\n    return await ctx.db.insert(\"Passkey\", args);\n  },\n});\n\n/**\n * Look up a passkey by its credential ID.\n *\n * Queries the `Passkey` table using the `credential_id` unique index.\n * This is the primary lookup during a WebAuthn authentication ceremony:\n * the authenticator provides a credential ID, and this function retrieves\n * the corresponding public key and counter for signature verification.\n *\n * @param credentialId - Base64url-encoded credential identifier to search for.\n * @returns The matching `Passkey` document, or `null` if no passkey exists\n *   with the given credential ID.\n *\n * @example\n * ```ts\n * const passkey = await ctx.runQuery(\n *   components.auth.factors.passkeys.passkeyGetByCredentialId,\n *   { credentialId: \"dGVzdC1jcmVkZW50aWFs\" },\n * );\n * if (passkey === null) {\n *   throw new Error(\"Unknown credential\");\n * }\n * ```\n */\nexport const passkeyGetByCredentialId = query({\n  args: { credentialId: v.string() },\n  returns: v.union(vPasskeyDoc, v.null()),\n  handler: async (ctx, { credentialId }) => {\n    return await ctx.db\n      .query(\"Passkey\")\n      .withIndex(\"credential_id\", (q) => q.eq(\"credentialId\", credentialId))\n      .unique();\n  },\n});\n\n/**\n * List all passkeys registered to a user.\n *\n * Retrieves every `Passkey` document associated with the given user via\n * the `user_id` index. Useful for displaying a user's registered\n * authenticators in a settings page, or for building the\n * `allowCredentials` list during a WebAuthn authentication ceremony.\n *\n * @param userId - The `_id` of the `User` whose passkeys to retrieve.\n * @returns An array of `Passkey` documents. Returns an empty array if the\n *   user has no registered passkeys.\n *\n * @example\n * ```ts\n * const passkeys = await ctx.runQuery(\n *   components.auth.factors.passkeys.passkeyListByUserId,\n *   { userId: user._id },\n * );\n * // Display each passkey's name and creation date\n * for (const pk of passkeys) {\n *   console.log(pk.name, new Date(pk.createdAt));\n * }\n * ```\n */\nexport const passkeyListByUserId = query({\n  args: { userId: v.id(\"User\") },\n  returns: v.array(vPasskeyDoc),\n  handler: async (ctx, { userId }) => {\n    return await ctx.db\n      .query(\"Passkey\")\n      .withIndex(\"user_id\", (q) => q.eq(\"userId\", userId))\n      .collect();\n  },\n});\n\n/**\n * Update a passkey's signature counter and last-used timestamp after\n * a successful authentication.\n *\n * After verifying a WebAuthn assertion, the relying party must persist\n * the new counter value reported by the authenticator. A counter that\n * does not increase may indicate a cloned credential.\n *\n * @param passkeyId - The `_id` of the `Passkey` document to update.\n * @param counter - The new signature counter value returned by the\n *   authenticator in the assertion response.\n * @param lastUsedAt - Unix timestamp (in milliseconds) recording when\n *   this passkey was most recently used to authenticate.\n * @returns `null` on success.\n *\n * @example\n * ```ts\n * await ctx.runMutation(\n *   components.auth.factors.passkeys.passkeyUpdateCounter,\n *   {\n *     passkeyId: passkey._id,\n *     counter: assertionResponse.counter,\n *     lastUsedAt: Date.now(),\n *   },\n * );\n * ```\n */\nexport const passkeyUpdateCounter = mutation({\n  args: {\n    passkeyId: v.id(\"Passkey\"),\n    counter: v.number(),\n    lastUsedAt: v.number(),\n  },\n  returns: v.null(),\n  handler: async (ctx, { passkeyId, counter, lastUsedAt }) => {\n    await ctx.db.patch(\"Passkey\", passkeyId, { counter, lastUsedAt });\n    return null;\n  },\n});\n\n/**\n * Update a passkey's metadata fields.\n *\n * Performs a partial patch on the `Passkey` document. Typically used to\n * rename a passkey (e.g. from `\"Security Key\"` to `\"YubiKey 5C\"`), but\n * can update any mutable fields via the `data` argument.\n *\n * @param passkeyId - The `_id` of the `Passkey` document to update.\n * @param data - An object containing the fields to patch. Commonly\n *   includes `{ name: \"New Label\" }`, but accepts any valid passkey fields.\n * @returns `null` on success.\n *\n * @example\n * ```ts\n * await ctx.runMutation(\n *   components.auth.factors.passkeys.passkeyUpdateMeta,\n *   {\n *     passkeyId: passkey._id,\n *     data: { name: \"YubiKey 5C NFC\" },\n *   },\n * );\n * ```\n */\nexport const passkeyUpdateMeta = mutation({\n  args: { passkeyId: v.id(\"Passkey\"), data: v.any() },\n  returns: v.null(),\n  handler: async (ctx, { passkeyId, data }) => {\n    await ctx.db.patch(\"Passkey\", passkeyId, data);\n    return null;\n  },\n});\n\n/**\n * Delete a passkey credential from the `Passkey` table.\n *\n * Permanently removes the passkey record. After deletion the credential\n * can no longer be used for authentication. Typically called from a\n * user's security settings when they want to unregister an authenticator.\n *\n * @param passkeyId - The `_id` of the `Passkey` document to delete.\n * @returns `null` on success.\n *\n * @example\n * ```ts\n * await ctx.runMutation(\n *   components.auth.factors.passkeys.passkeyDelete,\n *   { passkeyId: passkey._id },\n * );\n * ```\n */\nexport const passkeyDelete = mutation({\n  args: { passkeyId: v.id(\"Passkey\") },\n  returns: v.null(),\n  handler: async (ctx, { passkeyId }) => {\n    await ctx.db.delete(\"Passkey\", passkeyId);\n    return null;\n  },\n});\n\n// ============================================================================\n// TOTP Two-Factor Authentication\n// ============================================================================\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqDA,MAAa,gBAAgB,SAAS;CACpC,MAAM;EACJ,QAAQ,EAAE,GAAG,OAAO;EACpB,cAAc,EAAE,QAAQ;EACxB,WAAW,EAAE,OAAO;EACpB,WAAW,EAAE,QAAQ;EACrB,SAAS,EAAE,QAAQ;EACnB,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;EAC3C,YAAY,EAAE,QAAQ;EACtB,UAAU,EAAE,SAAS;EACrB,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC5B,WAAW,EAAE,QAAQ;EACtB;CACD,SAAS,EAAE,GAAG,UAAU;CACxB,SAAS,OAAO,KAAK,SAAS;AAC5B,SAAO,MAAM,IAAI,GAAG,OAAO,WAAW,KAAK;;CAE9C,CAAC;;;;;;;;;;;;;;;;;;;;;;;;AAyBF,MAAa,2BAA2B,MAAM;CAC5C,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE;CAClC,SAAS,EAAE,MAAM,aAAa,EAAE,MAAM,CAAC;CACvC,SAAS,OAAO,KAAK,EAAE,mBAAmB;AACxC,SAAO,MAAM,IAAI,GACd,MAAM,UAAU,CAChB,UAAU,kBAAkB,MAAM,EAAE,GAAG,gBAAgB,aAAa,CAAC,CACrE,QAAQ;;CAEd,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;AA0BF,MAAa,sBAAsB,MAAM;CACvC,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE;CAC9B,SAAS,EAAE,MAAM,YAAY;CAC7B,SAAS,OAAO,KAAK,EAAE,aAAa;AAClC,SAAO,MAAM,IAAI,GACd,MAAM,UAAU,CAChB,UAAU,YAAY,MAAM,EAAE,GAAG,UAAU,OAAO,CAAC,CACnD,SAAS;;CAEf,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BF,MAAa,uBAAuB,SAAS;CAC3C,MAAM;EACJ,WAAW,EAAE,GAAG,UAAU;EAC1B,SAAS,EAAE,QAAQ;EACnB,YAAY,EAAE,QAAQ;EACvB;CACD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,WAAW,SAAS,iBAAiB;AAC1D,QAAM,IAAI,GAAG,MAAM,WAAW,WAAW;GAAE;GAAS;GAAY,CAAC;AACjE,SAAO;;CAEV,CAAC;;;;;;;;;;;;;;;;;;;;;;;;AAyBF,MAAa,oBAAoB,SAAS;CACxC,MAAM;EAAE,WAAW,EAAE,GAAG,UAAU;EAAE,MAAM,EAAE,KAAK;EAAE;CACnD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,WAAW,WAAW;AAC3C,QAAM,IAAI,GAAG,MAAM,WAAW,WAAW,KAAK;AAC9C,SAAO;;CAEV,CAAC;;;;;;;;;;;;;;;;;;;AAoBF,MAAa,gBAAgB,SAAS;CACpC,MAAM,EAAE,WAAW,EAAE,GAAG,UAAU,EAAE;CACpC,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,gBAAgB;AACrC,QAAM,IAAI,GAAG,OAAO,WAAW,UAAU;AACzC,SAAO;;CAEV,CAAC"}

package/dist/component/public/factors/totp.d.ts

@@ -1,189 +0,0 @@
-declare namespace totp_d_exports {
-  export { totpDelete, totpGetById, totpGetVerifiedByUserId, totpInsert, totpListByUserId, totpMarkVerified, totpUpdateLastUsed };
-}
-/**
- * Store a new TOTP (Time-based One-Time Password) enrollment for a user.
- *
- * Creates a `TotpFactor` record containing the shared secret and OTP
- * parameters. The enrollment starts in an unverified state until the
- * user confirms it by submitting a valid code generated from the secret.
- *
- * @param userId - The `_id` of the `User` enrolling in TOTP-based 2FA.
- * @param secret - The shared secret key as raw bytes, typically 20 bytes
- *   of cryptographically random data.
- * @param digits - Number of digits in the generated OTP code (usually `6`).
- * @param period - Time step in seconds for code generation (usually `30`).
- * @param verified - Whether the enrollment has been verified. Set to
- *   `false` during initial setup; set to `true` after the user submits
- *   a valid code.
- * @param name - Optional human-readable label for the TOTP factor
- *   (e.g. `"Google Authenticator"`).
- * @param createdAt - Unix timestamp (in milliseconds) when the enrollment
- *   was created.
- * @returns The `_id` of the newly created `TotpFactor` document.
- *
- * @example
- * ```ts
- * const totpId = await ctx.runMutation(
- *   components.auth.factors.totp.totpInsert,
- *   {
- *     userId: user._id,
- *     secret: crypto.getRandomValues(new Uint8Array(20)),
- *     digits: 6,
- *     period: 30,
- *     verified: false,
- *     name: "Authenticator App",
- *     createdAt: Date.now(),
- *   },
- * );
- * ```
- */
-declare const totpInsert: any;
-/**
- * Get a verified TOTP enrollment for a user.
- *
- * Queries the `TotpFactor` table using the `user_id_verified` compound
- * index to find the first enrollment that has been successfully verified.
- * This is the primary lookup during a TOTP authentication challenge --
- * only verified enrollments should be used to validate codes.
- *
- * @param userId - The `_id` of the `User` whose verified TOTP enrollment
- *   to retrieve.
- * @returns The first verified `TotpFactor` document for the user, or
- *   `null` if the user has no verified TOTP enrollment.
- *
- * @example
- * ```ts
- * const totp = await ctx.runQuery(
- *   components.auth.factors.totp.totpGetVerifiedByUserId,
- *   { userId: user._id },
- * );
- * if (totp === null) {
- *   // User does not have TOTP 2FA enabled
- * }
- * ```
- */
-declare const totpGetVerifiedByUserId: any;
-/**
- * List all TOTP enrollments for a user, both verified and unverified.
- *
- * Retrieves every `TotpFactor` document associated with the given user
- * via the `user_id` index. Useful for displaying enrolled authenticator
- * apps in a security settings page, including pending (unverified)
- * enrollments that the user has not yet confirmed.
- *
- * @param userId - The `_id` of the `User` whose TOTP enrollments to
- *   retrieve.
- * @returns An array of `TotpFactor` documents. Returns an empty array if
- *   the user has no TOTP enrollments.
- *
- * @example
- * ```ts
- * const factors = await ctx.runQuery(
- *   components.auth.factors.totp.totpListByUserId,
- *   { userId: user._id },
- * );
- * const verified = factors.filter((f) => f.verified);
- * const pending = factors.filter((f) => !f.verified);
- * ```
- */
-declare const totpListByUserId: any;
-/**
- * Get a single TOTP enrollment by its document ID.
- *
- * Performs a direct document lookup on the `TotpFactor` table. This is
- * used when you already have the enrollment's `_id` (e.g. from a
- * previous list query) and need to fetch its full details, including
- * the secret and verification status.
- *
- * @param totpId - The `_id` of the `TotpFactor` document to retrieve.
- * @returns The `TotpFactor` document, or `null` if no enrollment exists
- *   with the given ID.
- *
- * @example
- * ```ts
- * const totp = await ctx.runQuery(
- *   components.auth.factors.totp.totpGetById,
- *   { totpId: enrollmentId },
- * );
- * if (totp !== null && !totp.verified) {
- *   // Enrollment is still pending confirmation
- * }
- * ```
- */
-declare const totpGetById: any;
-/**
- * Mark a TOTP enrollment as verified, completing the setup process.
- *
- * Called after the user successfully submits a valid TOTP code during
- * enrollment. This transitions the factor from a pending state to an
- * active, verified state, enabling it for future authentication
- * challenges.
- *
- * @param totpId - The `_id` of the `TotpFactor` document to mark as
- *   verified.
- * @param lastUsedAt - Unix timestamp (in milliseconds) recording when
- *   the verification code was successfully validated.
- * @returns `null` on success.
- *
- * @example
- * ```ts
- * // After validating the user's TOTP code during setup
- * await ctx.runMutation(
- *   components.auth.factors.totp.totpMarkVerified,
- *   {
- *     totpId: enrollment._id,
- *     lastUsedAt: Date.now(),
- *   },
- * );
- * ```
- */
-declare const totpMarkVerified: any;
-/**
- * Update a TOTP enrollment's last-used timestamp.
- *
- * Called after each successful TOTP code validation during sign-in.
- * Tracking the last-used time helps detect stale enrollments and can
- * be surfaced in security settings for user awareness.
- *
- * @param totpId - The `_id` of the `TotpFactor` document to update.
- * @param lastUsedAt - Unix timestamp (in milliseconds) recording when
- *   the TOTP code was most recently validated.
- * @returns `null` on success.
- *
- * @example
- * ```ts
- * await ctx.runMutation(
- *   components.auth.factors.totp.totpUpdateLastUsed,
- *   {
- *     totpId: totp._id,
- *     lastUsedAt: Date.now(),
- *   },
- * );
- * ```
- */
-declare const totpUpdateLastUsed: any;
-/**
- * Delete a TOTP enrollment from the `TotpFactor` table.
- *
- * Permanently removes the TOTP factor record, including its shared
- * secret. After deletion the user can no longer use this factor for
- * two-factor authentication. Typically called when a user disables
- * TOTP 2FA or wants to re-enroll with a new secret.
- *
- * @param totpId - The `_id` of the `TotpFactor` document to delete.
- * @returns `null` on success.
- *
- * @example
- * ```ts
- * // User disables TOTP 2FA
- * await ctx.runMutation(
- *   components.auth.factors.totp.totpDelete,
- *   { totpId: totp._id },
- * );
- * ```
- */
-declare const totpDelete: any;
-//#endregion
-export { totpDelete, totpGetById, totpGetVerifiedByUserId, totpInsert, totpListByUserId, totpMarkVerified, totpUpdateLastUsed, totp_d_exports };
-//# sourceMappingURL=totp.d.ts.map

package/dist/component/public/factors/totp.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"totp.d.ts","names":[],"sources":["../../../../src/component/public/factors/totp.ts"],"mappings":";;;;;;;;;;;;;;;AA0CA;;;;;AAwCA;;;;;AAoCA;;;;;AAkCA;;;;;AAkCA;;;;;cAhJa,UAAA;;;;;AA6Mb;;;;;;;;;;;;;;;;;;;;cArKa,uBAAA;;;;;;;;;;;;;;;;;;;;;;;;cAoCA,gBAAA;;;;;;;;;;;;;;;;;;;;;;;;cAkCA,WAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;cAkCA,gBAAA;;;;;;;;;;;;;;;;;;;;;;;;cAgCA,kBAAA;;;;;;;;;;;;;;;;;;;;;cA6BA,UAAA"}

package/dist/component/public/factors/totp.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"totp.js","names":[],"sources":["../../../../src/component/public/factors/totp.ts"],"sourcesContent":["import { v } from \"convex/values\";\n\nimport { mutation, query } from \"../../functions\";\nimport { vTotpFactorDoc } from \"../../model\";\n\n/**\n * Store a new TOTP (Time-based One-Time Password) enrollment for a user.\n *\n * Creates a `TotpFactor` record containing the shared secret and OTP\n * parameters. The enrollment starts in an unverified state until the\n * user confirms it by submitting a valid code generated from the secret.\n *\n * @param userId - The `_id` of the `User` enrolling in TOTP-based 2FA.\n * @param secret - The shared secret key as raw bytes, typically 20 bytes\n *   of cryptographically random data.\n * @param digits - Number of digits in the generated OTP code (usually `6`).\n * @param period - Time step in seconds for code generation (usually `30`).\n * @param verified - Whether the enrollment has been verified. Set to\n *   `false` during initial setup; set to `true` after the user submits\n *   a valid code.\n * @param name - Optional human-readable label for the TOTP factor\n *   (e.g. `\"Google Authenticator\"`).\n * @param createdAt - Unix timestamp (in milliseconds) when the enrollment\n *   was created.\n * @returns The `_id` of the newly created `TotpFactor` document.\n *\n * @example\n * ```ts\n * const totpId = await ctx.runMutation(\n *   components.auth.factors.totp.totpInsert,\n *   {\n *     userId: user._id,\n *     secret: crypto.getRandomValues(new Uint8Array(20)),\n *     digits: 6,\n *     period: 30,\n *     verified: false,\n *     name: \"Authenticator App\",\n *     createdAt: Date.now(),\n *   },\n * );\n * ```\n */\nexport const totpInsert = mutation({\n  args: {\n    userId: v.id(\"User\"),\n    secret: v.bytes(),\n    digits: v.number(),\n    period: v.number(),\n    verified: v.boolean(),\n    name: v.optional(v.string()),\n    createdAt: v.number(),\n  },\n  returns: v.id(\"TotpFactor\"),\n  handler: async (ctx, args) => {\n    return await ctx.db.insert(\"TotpFactor\", args);\n  },\n});\n\n/**\n * Get a verified TOTP enrollment for a user.\n *\n * Queries the `TotpFactor` table using the `user_id_verified` compound\n * index to find the first enrollment that has been successfully verified.\n * This is the primary lookup during a TOTP authentication challenge --\n * only verified enrollments should be used to validate codes.\n *\n * @param userId - The `_id` of the `User` whose verified TOTP enrollment\n *   to retrieve.\n * @returns The first verified `TotpFactor` document for the user, or\n *   `null` if the user has no verified TOTP enrollment.\n *\n * @example\n * ```ts\n * const totp = await ctx.runQuery(\n *   components.auth.factors.totp.totpGetVerifiedByUserId,\n *   { userId: user._id },\n * );\n * if (totp === null) {\n *   // User does not have TOTP 2FA enabled\n * }\n * ```\n */\nexport const totpGetVerifiedByUserId = query({\n  args: { userId: v.id(\"User\") },\n  returns: v.union(vTotpFactorDoc, v.null()),\n  handler: async (ctx, { userId }) => {\n    return await ctx.db\n      .query(\"TotpFactor\")\n      .withIndex(\"user_id_verified\", (q) =>\n        q.eq(\"userId\", userId).eq(\"verified\", true),\n      )\n      .first();\n  },\n});\n\n/**\n * List all TOTP enrollments for a user, both verified and unverified.\n *\n * Retrieves every `TotpFactor` document associated with the given user\n * via the `user_id` index. Useful for displaying enrolled authenticator\n * apps in a security settings page, including pending (unverified)\n * enrollments that the user has not yet confirmed.\n *\n * @param userId - The `_id` of the `User` whose TOTP enrollments to\n *   retrieve.\n * @returns An array of `TotpFactor` documents. Returns an empty array if\n *   the user has no TOTP enrollments.\n *\n * @example\n * ```ts\n * const factors = await ctx.runQuery(\n *   components.auth.factors.totp.totpListByUserId,\n *   { userId: user._id },\n * );\n * const verified = factors.filter((f) => f.verified);\n * const pending = factors.filter((f) => !f.verified);\n * ```\n */\nexport const totpListByUserId = query({\n  args: { userId: v.id(\"User\") },\n  returns: v.array(vTotpFactorDoc),\n  handler: async (ctx, { userId }) => {\n    return await ctx.db\n      .query(\"TotpFactor\")\n      .withIndex(\"user_id\", (q) => q.eq(\"userId\", userId))\n      .collect();\n  },\n});\n\n/**\n * Get a single TOTP enrollment by its document ID.\n *\n * Performs a direct document lookup on the `TotpFactor` table. This is\n * used when you already have the enrollment's `_id` (e.g. from a\n * previous list query) and need to fetch its full details, including\n * the secret and verification status.\n *\n * @param totpId - The `_id` of the `TotpFactor` document to retrieve.\n * @returns The `TotpFactor` document, or `null` if no enrollment exists\n *   with the given ID.\n *\n * @example\n * ```ts\n * const totp = await ctx.runQuery(\n *   components.auth.factors.totp.totpGetById,\n *   { totpId: enrollmentId },\n * );\n * if (totp !== null && !totp.verified) {\n *   // Enrollment is still pending confirmation\n * }\n * ```\n */\nexport const totpGetById = query({\n  args: { totpId: v.id(\"TotpFactor\") },\n  returns: v.union(vTotpFactorDoc, v.null()),\n  handler: async (ctx, { totpId }) => {\n    return await ctx.db.get(\"TotpFactor\", totpId);\n  },\n});\n\n/**\n * Mark a TOTP enrollment as verified, completing the setup process.\n *\n * Called after the user successfully submits a valid TOTP code during\n * enrollment. This transitions the factor from a pending state to an\n * active, verified state, enabling it for future authentication\n * challenges.\n *\n * @param totpId - The `_id` of the `TotpFactor` document to mark as\n *   verified.\n * @param lastUsedAt - Unix timestamp (in milliseconds) recording when\n *   the verification code was successfully validated.\n * @returns `null` on success.\n *\n * @example\n * ```ts\n * // After validating the user's TOTP code during setup\n * await ctx.runMutation(\n *   components.auth.factors.totp.totpMarkVerified,\n *   {\n *     totpId: enrollment._id,\n *     lastUsedAt: Date.now(),\n *   },\n * );\n * ```\n */\nexport const totpMarkVerified = mutation({\n  args: { totpId: v.id(\"TotpFactor\"), lastUsedAt: v.number() },\n  returns: v.null(),\n  handler: async (ctx, { totpId, lastUsedAt }) => {\n    await ctx.db.patch(\"TotpFactor\", totpId, { verified: true, lastUsedAt });\n    return null;\n  },\n});\n\n/**\n * Update a TOTP enrollment's last-used timestamp.\n *\n * Called after each successful TOTP code validation during sign-in.\n * Tracking the last-used time helps detect stale enrollments and can\n * be surfaced in security settings for user awareness.\n *\n * @param totpId - The `_id` of the `TotpFactor` document to update.\n * @param lastUsedAt - Unix timestamp (in milliseconds) recording when\n *   the TOTP code was most recently validated.\n * @returns `null` on success.\n *\n * @example\n * ```ts\n * await ctx.runMutation(\n *   components.auth.factors.totp.totpUpdateLastUsed,\n *   {\n *     totpId: totp._id,\n *     lastUsedAt: Date.now(),\n *   },\n * );\n * ```\n */\nexport const totpUpdateLastUsed = mutation({\n  args: { totpId: v.id(\"TotpFactor\"), lastUsedAt: v.number() },\n  returns: v.null(),\n  handler: async (ctx, { totpId, lastUsedAt }) => {\n    await ctx.db.patch(\"TotpFactor\", totpId, { lastUsedAt });\n    return null;\n  },\n});\n\n/**\n * Delete a TOTP enrollment from the `TotpFactor` table.\n *\n * Permanently removes the TOTP factor record, including its shared\n * secret. After deletion the user can no longer use this factor for\n * two-factor authentication. Typically called when a user disables\n * TOTP 2FA or wants to re-enroll with a new secret.\n *\n * @param totpId - The `_id` of the `TotpFactor` document to delete.\n * @returns `null` on success.\n *\n * @example\n * ```ts\n * // User disables TOTP 2FA\n * await ctx.runMutation(\n *   components.auth.factors.totp.totpDelete,\n *   { totpId: totp._id },\n * );\n * ```\n */\nexport const totpDelete = mutation({\n  args: { totpId: v.id(\"TotpFactor\") },\n  returns: v.null(),\n  handler: async (ctx, { totpId }) => {\n    await ctx.db.delete(\"TotpFactor\", totpId);\n    return null;\n  },\n});\n\n// ============================================================================\n// Rate Limits\n// ============================================================================\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0CA,MAAa,aAAa,SAAS;CACjC,MAAM;EACJ,QAAQ,EAAE,GAAG,OAAO;EACpB,QAAQ,EAAE,OAAO;EACjB,QAAQ,EAAE,QAAQ;EAClB,QAAQ,EAAE,QAAQ;EAClB,UAAU,EAAE,SAAS;EACrB,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC5B,WAAW,EAAE,QAAQ;EACtB;CACD,SAAS,EAAE,GAAG,aAAa;CAC3B,SAAS,OAAO,KAAK,SAAS;AAC5B,SAAO,MAAM,IAAI,GAAG,OAAO,cAAc,KAAK;;CAEjD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;AA0BF,MAAa,0BAA0B,MAAM;CAC3C,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE;CAC9B,SAAS,EAAE,MAAM,gBAAgB,EAAE,MAAM,CAAC;CAC1C,SAAS,OAAO,KAAK,EAAE,aAAa;AAClC,SAAO,MAAM,IAAI,GACd,MAAM,aAAa,CACnB,UAAU,qBAAqB,MAC9B,EAAE,GAAG,UAAU,OAAO,CAAC,GAAG,YAAY,KAAK,CAC5C,CACA,OAAO;;CAEb,CAAC;;;;;;;;;;;;;;;;;;;;;;;;AAyBF,MAAa,mBAAmB,MAAM;CACpC,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE;CAC9B,SAAS,EAAE,MAAM,eAAe;CAChC,SAAS,OAAO,KAAK,EAAE,aAAa;AAClC,SAAO,MAAM,IAAI,GACd,MAAM,aAAa,CACnB,UAAU,YAAY,MAAM,EAAE,GAAG,UAAU,OAAO,CAAC,CACnD,SAAS;;CAEf,CAAC;;;;;;;;;;;;;;;;;;;;;;;;AAyBF,MAAa,cAAc,MAAM;CAC/B,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,EAAE;CACpC,SAAS,EAAE,MAAM,gBAAgB,EAAE,MAAM,CAAC;CAC1C,SAAS,OAAO,KAAK,EAAE,aAAa;AAClC,SAAO,MAAM,IAAI,GAAG,IAAI,cAAc,OAAO;;CAEhD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BF,MAAa,mBAAmB,SAAS;CACvC,MAAM;EAAE,QAAQ,EAAE,GAAG,aAAa;EAAE,YAAY,EAAE,QAAQ;EAAE;CAC5D,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,QAAQ,iBAAiB;AAC9C,QAAM,IAAI,GAAG,MAAM,cAAc,QAAQ;GAAE,UAAU;GAAM;GAAY,CAAC;AACxE,SAAO;;CAEV,CAAC;;;;;;;;;;;;;;;;;;;;;;;;AAyBF,MAAa,qBAAqB,SAAS;CACzC,MAAM;EAAE,QAAQ,EAAE,GAAG,aAAa;EAAE,YAAY,EAAE,QAAQ;EAAE;CAC5D,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,QAAQ,iBAAiB;AAC9C,QAAM,IAAI,GAAG,MAAM,cAAc,QAAQ,EAAE,YAAY,CAAC;AACxD,SAAO;;CAEV,CAAC;;;;;;;;;;;;;;;;;;;;;AAsBF,MAAa,aAAa,SAAS;CACjC,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,EAAE;CACpC,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,aAAa;AAClC,QAAM,IAAI,GAAG,OAAO,cAAc,OAAO;AACzC,SAAO;;CAEV,CAAC"}

package/dist/component/public/groups/core.d.ts

@@ -1,137 +0,0 @@
-declare namespace core_d_exports {
-  export { groupCreate, groupDelete, groupGet, groupList, groupUpdate };
-}
-/**
- * Create a new group. Groups are hierarchical — set `parentGroupId` to nest
- * under an existing group, or omit it to create a root-level group.
- *
- * Root groups self-reference their own ID as `rootGroupId`. Child groups
- * inherit `rootGroupId` from their parent chain. Tags are normalized
- * (trimmed and lowercased) and deduplicated before storage, and companion
- * `GroupTag` rows are created for indexed lookups.
- *
- * @param args.name - The display name for the group.
- * @param args.slug - An optional URL-friendly identifier for the group (e.g. `"engineering"`).
- * @param args.type - An optional application-defined group type (e.g. `"organization"`, `"team"`).
- * @param args.parentGroupId - The ID of an existing group to nest under. Omit to create a root-level group.
- * @param args.tags - An optional array of `{ key, value }` tag pairs to attach to the group for filtering.
- * @param args.extend - An optional arbitrary payload for application-specific metadata.
- * @returns The `Id<"Group">` of the newly created group document.
- *
- * @example
- * ```ts
- * const groupId = await ctx.runMutation(components.auth.groups.groupCreate, {
- *   name: "Acme Corp",
- *   slug: "acme-corp",
- *   type: "organization",
- *   tags: [{ key: "plan", value: "enterprise" }],
- * });
- * ```
- */
-declare const groupCreate: any;
-/**
- * Retrieve a group by its document ID.
- *
- * Performs a direct lookup in the `Group` table and returns the full group
- * document, or `null` if no group exists with the given ID.
- *
- * @param args.groupId - The `Id<"Group">` of the group to retrieve.
- * @returns The group document (including `name`, `slug`, `type`, `tags`, hierarchy fields, etc.) or `null` if not found.
- *
- * @example
- * ```ts
- * const group = await ctx.runQuery(components.auth.groups.groupGet, {
- *   groupId: existingGroupId,
- * });
- * if (group !== null) {
- *   console.log(group.name, group.slug);
- * }
- * ```
- */
-declare const groupGet: any;
-/**
- * List groups with optional filtering, sorting, and pagination.
- *
- * Returns `{ items, nextCursor }`. Empty `where` returns **all** groups.
- * The query engine selects the best database index based on the combination
- * of filter fields provided. Tag filters (`tagsAll`, `tagsAny`) are resolved
- * via the `GroupTag` companion table and intersected/unioned with index results.
- *
- * @param args.where - Optional filter criteria for narrowing results.
- * @param args.where.slug - Match groups with this exact slug.
- * @param args.where.type - Match groups with this exact type.
- * @param args.where.parentGroupId - Match groups that are direct children of the specified parent group.
- * @param args.where.name - Match groups with this exact name.
- * @param args.where.isRoot - When `true`, return only root-level groups; when `false`, only child groups.
- * @param args.where.tagsAll - An array of `{ key, value }` pairs; only groups that have **all** of these tags are returned.
- * @param args.where.tagsAny - An array of `{ key, value }` pairs; groups that have **at least one** of these tags are returned.
- * @param args.limit - Maximum number of items per page (clamped to 1..100, defaults to 50).
- * @param args.cursor - An opaque cursor string from a previous response's `nextCursor` to fetch the next page, or `null` to start from the beginning.
- * @param args.orderBy - The field to sort by: `"_creationTime"`, `"name"`, `"slug"`, or `"type"`.
- * @param args.order - Sort direction: `"asc"` or `"desc"` (defaults to `"desc"`).
- * @returns An object `{ items, nextCursor }` where `items` is an array of group documents and `nextCursor` is `null` when there are no more pages.
- *
- * @example
- * ```ts
- * const { items, nextCursor } = await ctx.runQuery(
- *   components.auth.groups.groupList,
- *   {
- *     where: { type: "team", isRoot: false },
- *     limit: 20,
- *     order: "asc",
- *   },
- * );
- * ```
- */
-declare const groupList: any;
-/**
- * Update a group's mutable fields such as `name`, `slug`, `tags`, `extend`,
- * and `parentGroupId`.
- *
- * When `parentGroupId` is changed the mutation automatically recomputes
- * `isRoot` and `rootGroupId` for the target group **and** cascades the new
- * `rootGroupId` to all descendant groups. When `tags` are provided they are
- * normalized, deduplicated, and the companion `GroupTag` rows are fully
- * replaced (delete-then-insert).
- *
- * @param args.groupId - The `Id<"Group">` of the group to update.
- * @param args.data - A partial object of fields to patch. Supported keys include `name`, `slug`, `type`, `parentGroupId`, `tags`, and `extend`.
- * @returns `null` on success.
- *
- * @example
- * ```ts
- * await ctx.runMutation(components.auth.groups.groupUpdate, {
- *   groupId: existingGroupId,
- *   data: {
- *     name: "Acme Corp (renamed)",
- *     tags: [{ key: "plan", value: "pro" }],
- *   },
- * });
- * ```
- */
-declare const groupUpdate: any;
-/**
- * Delete a group and all of its descendants. This cascades to:
- * - All child groups (recursively)
- * - All members of this group and its descendants
- * - All invites for this group and its descendants
- * - All companion `GroupTag` rows for this group and its descendants
- *
- * The deletion walks the group tree depth-first, removing leaves before
- * parents, so referential integrity is maintained throughout.
- *
- * @param args.groupId - The `Id<"Group">` of the group to delete. All children are deleted recursively.
- * @returns `null` on success.
- *
- * @example
- * ```ts
- * // Delete an organization and everything nested under it
- * await ctx.runMutation(components.auth.groups.groupDelete, {
- *   groupId: organizationGroupId,
- * });
- * ```
- */
-declare const groupDelete: any;
-//#endregion
-export { core_d_exports, groupCreate, groupDelete, groupGet, groupList, groupUpdate };
-//# sourceMappingURL=core.d.ts.map

package/dist/component/public/groups/core.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"core.d.ts","names":[],"sources":["../../../../src/component/public/groups/core.ts"],"mappings":";;;;;;;;;;;;;AAuDA;;;;;AA+DA;;;;;AA0CA;;;;;AAsLA;;cA/Ra,WAAA;;;AAyXb;;;;;;;;;;;;;;;;;cA1Ta,QAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA0CA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;cAsLA,WAAA;;;;;;;;;;;;;;;;;;;;;;cA0FA,WAAA"}

package/dist/component/public/groups/core.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"core.js","names":[],"sources":["../../../../src/component/public/groups/core.ts"],"sourcesContent":["import { v } from \"convex/values\";\n\nimport type { Id } from \"../../_generated/dataModel\";\nimport { mutation, query } from \"../../functions\";\nimport { vGroupDoc, vPaginated, vTag } from \"../../model\";\n\ntype TagPair = { key: string; value: string };\n\nfunction normalizeTag(tag: TagPair): TagPair {\n  return {\n    key: tag.key.trim().toLowerCase(),\n    value: tag.value.trim().toLowerCase(),\n  };\n}\n\nfunction normalizeTags(tags: TagPair[]): TagPair[] {\n  const seen = new Set<string>();\n  const result: TagPair[] = [];\n  for (const raw of tags) {\n    const t = normalizeTag(raw);\n    const composite = `${t.key}\\0${t.value}`;\n    if (!seen.has(composite)) {\n      seen.add(composite);\n      result.push(t);\n    }\n  }\n  return result;\n}\n/**\n * Create a new group. Groups are hierarchical — set `parentGroupId` to nest\n * under an existing group, or omit it to create a root-level group.\n *\n * Root groups self-reference their own ID as `rootGroupId`. Child groups\n * inherit `rootGroupId` from their parent chain. Tags are normalized\n * (trimmed and lowercased) and deduplicated before storage, and companion\n * `GroupTag` rows are created for indexed lookups.\n *\n * @param args.name - The display name for the group.\n * @param args.slug - An optional URL-friendly identifier for the group (e.g. `\"engineering\"`).\n * @param args.type - An optional application-defined group type (e.g. `\"organization\"`, `\"team\"`).\n * @param args.parentGroupId - The ID of an existing group to nest under. Omit to create a root-level group.\n * @param args.tags - An optional array of `{ key, value }` tag pairs to attach to the group for filtering.\n * @param args.extend - An optional arbitrary payload for application-specific metadata.\n * @returns The `Id<\"Group\">` of the newly created group document.\n *\n * @example\n * ```ts\n * const groupId = await ctx.runMutation(components.auth.groups.groupCreate, {\n *   name: \"Acme Corp\",\n *   slug: \"acme-corp\",\n *   type: \"organization\",\n *   tags: [{ key: \"plan\", value: \"enterprise\" }],\n * });\n * ```\n */\nexport const groupCreate = mutation({\n  args: {\n    name: v.string(),\n    slug: v.optional(v.string()),\n    type: v.optional(v.string()),\n    parentGroupId: v.optional(v.id(\"Group\")),\n    tags: v.optional(v.array(vTag)),\n    extend: v.optional(v.any()),\n  },\n  returns: v.id(\"Group\"),\n  handler: async (ctx, args) => {\n    const { tags: rawTags, ...rest } = args;\n    const normalizedTags = rawTags ? normalizeTags(rawTags) : undefined;\n    const isRoot = !args.parentGroupId;\n    // Compute rootGroupId: root groups self-reference, children inherit from parent\n    let rootGroupId: Id<\"Group\"> | undefined;\n    if (!isRoot && args.parentGroupId) {\n      const parent = await ctx.db.get(args.parentGroupId);\n      rootGroupId = parent?.rootGroupId ?? args.parentGroupId;\n    }\n    const groupId = await ctx.db.insert(\"Group\", {\n      ...rest,\n      tags: normalizedTags,\n      isRoot,\n      rootGroupId: isRoot ? undefined : rootGroupId,\n    });\n    // Self-reference for root groups (need the ID after insert)\n    if (isRoot) {\n      await ctx.db.patch(groupId, { rootGroupId: groupId });\n    }\n    // Sync companion group_tag rows\n    if (normalizedTags) {\n      for (const tag of normalizedTags) {\n        await ctx.db.insert(\"GroupTag\", {\n          group_id: groupId,\n          key: tag.key,\n          value: tag.value,\n        });\n      }\n    }\n    return groupId;\n  },\n});\n\n/**\n * Retrieve a group by its document ID.\n *\n * Performs a direct lookup in the `Group` table and returns the full group\n * document, or `null` if no group exists with the given ID.\n *\n * @param args.groupId - The `Id<\"Group\">` of the group to retrieve.\n * @returns The group document (including `name`, `slug`, `type`, `tags`, hierarchy fields, etc.) or `null` if not found.\n *\n * @example\n * ```ts\n * const group = await ctx.runQuery(components.auth.groups.groupGet, {\n *   groupId: existingGroupId,\n * });\n * if (group !== null) {\n *   console.log(group.name, group.slug);\n * }\n * ```\n */\nexport const groupGet = query({\n  args: { groupId: v.id(\"Group\") },\n  returns: v.union(vGroupDoc, v.null()),\n  handler: async (ctx, { groupId }) => {\n    return await ctx.db.get(\"Group\", groupId);\n  },\n});\n\n/**\n * List groups with optional filtering, sorting, and pagination.\n *\n * Returns `{ items, nextCursor }`. Empty `where` returns **all** groups.\n * The query engine selects the best database index based on the combination\n * of filter fields provided. Tag filters (`tagsAll`, `tagsAny`) are resolved\n * via the `GroupTag` companion table and intersected/unioned with index results.\n *\n * @param args.where - Optional filter criteria for narrowing results.\n * @param args.where.slug - Match groups with this exact slug.\n * @param args.where.type - Match groups with this exact type.\n * @param args.where.parentGroupId - Match groups that are direct children of the specified parent group.\n * @param args.where.name - Match groups with this exact name.\n * @param args.where.isRoot - When `true`, return only root-level groups; when `false`, only child groups.\n * @param args.where.tagsAll - An array of `{ key, value }` pairs; only groups that have **all** of these tags are returned.\n * @param args.where.tagsAny - An array of `{ key, value }` pairs; groups that have **at least one** of these tags are returned.\n * @param args.limit - Maximum number of items per page (clamped to 1..100, defaults to 50).\n * @param args.cursor - An opaque cursor string from a previous response's `nextCursor` to fetch the next page, or `null` to start from the beginning.\n * @param args.orderBy - The field to sort by: `\"_creationTime\"`, `\"name\"`, `\"slug\"`, or `\"type\"`.\n * @param args.order - Sort direction: `\"asc\"` or `\"desc\"` (defaults to `\"desc\"`).\n * @returns An object `{ items, nextCursor }` where `items` is an array of group documents and `nextCursor` is `null` when there are no more pages.\n *\n * @example\n * ```ts\n * const { items, nextCursor } = await ctx.runQuery(\n *   components.auth.groups.groupList,\n *   {\n *     where: { type: \"team\", isRoot: false },\n *     limit: 20,\n *     order: \"asc\",\n *   },\n * );\n * ```\n */\nexport const groupList = query({\n  args: {\n    where: v.optional(\n      v.object({\n        slug: v.optional(v.string()),\n        type: v.optional(v.string()),\n        parentGroupId: v.optional(v.id(\"Group\")),\n        name: v.optional(v.string()),\n        isRoot: v.optional(v.boolean()),\n        tagsAll: v.optional(v.array(vTag)),\n        tagsAny: v.optional(v.array(vTag)),\n      }),\n    ),\n    limit: v.optional(v.number()),\n    cursor: v.optional(v.union(v.string(), v.null())),\n    orderBy: v.optional(\n      v.union(\n        v.literal(\"_creationTime\"),\n        v.literal(\"name\"),\n        v.literal(\"slug\"),\n        v.literal(\"type\"),\n      ),\n    ),\n    order: v.optional(v.union(v.literal(\"asc\"), v.literal(\"desc\"))),\n  },\n  returns: vPaginated(vGroupDoc),\n  handler: async (ctx, args) => {\n    const where = args.where ?? {};\n    const limit = Math.min(Math.max(args.limit ?? 50, 1), 100);\n    const order = args.order ?? \"desc\";\n\n    // ---- Resolve tag filters into a Set<Id<\"Group\">> ----\n    let tagFilteredIds: Set<string> | null = null;\n\n    if (where.tagsAll && where.tagsAll.length > 0) {\n      // Intersect: group must have ALL specified tags\n      let allSet: Set<string> | null = null;\n      for (const rawTag of where.tagsAll) {\n        const t = normalizeTag(rawTag);\n        const rows = await ctx.db\n          .query(\"GroupTag\")\n          .withIndex(\"by_key_value\", (idx) =>\n            idx.eq(\"key\", t.key).eq(\"value\", t.value),\n          )\n          .collect();\n        const ids = new Set(rows.map((r) => r.group_id as string));\n        if (allSet === null) {\n          allSet = ids;\n        } else {\n          // Intersect\n          for (const id of allSet) {\n            if (!ids.has(id)) allSet.delete(id);\n          }\n        }\n        // Short-circuit: empty intersection\n        if (allSet.size === 0) break;\n      }\n      tagFilteredIds = allSet ?? new Set();\n    }\n\n    if (where.tagsAny && where.tagsAny.length > 0) {\n      // Union: group must have at least one of the specified tags\n      const anySet = new Set<string>();\n      for (const rawTag of where.tagsAny) {\n        const t = normalizeTag(rawTag);\n        const rows = await ctx.db\n          .query(\"GroupTag\")\n          .withIndex(\"by_key_value\", (idx) =>\n            idx.eq(\"key\", t.key).eq(\"value\", t.value),\n          )\n          .collect();\n        for (const r of rows) {\n          anySet.add(r.group_id as string);\n        }\n      }\n      if (tagFilteredIds !== null) {\n        // AND with tagsAll result\n        for (const id of tagFilteredIds) {\n          if (!anySet.has(id)) tagFilteredIds.delete(id);\n        }\n      } else {\n        tagFilteredIds = anySet;\n      }\n    }\n\n    // ---- Pick best index based on non-tag where fields ----\n    let q;\n    if (where.type !== undefined && where.parentGroupId !== undefined) {\n      q = ctx.db\n        .query(\"Group\")\n        .withIndex(\"type_parent_group_id\", (idx) =>\n          idx.eq(\"type\", where.type!).eq(\"parentGroupId\", where.parentGroupId!),\n        );\n    } else if (where.slug !== undefined) {\n      q = ctx.db\n        .query(\"Group\")\n        .withIndex(\"slug\", (idx) => idx.eq(\"slug\", where.slug!));\n    } else if (where.type !== undefined) {\n      q = ctx.db\n        .query(\"Group\")\n        .withIndex(\"type\", (idx) => idx.eq(\"type\", where.type!));\n    } else if (where.parentGroupId !== undefined) {\n      q = ctx.db\n        .query(\"Group\")\n        .withIndex(\"parent_group_id\", (idx) =>\n          idx.eq(\"parentGroupId\", where.parentGroupId!),\n        );\n    } else if (where.isRoot !== undefined) {\n      q = ctx.db\n        .query(\"Group\")\n        .withIndex(\"is_root\", (idx) => idx.eq(\"isRoot\", where.isRoot!));\n    } else {\n      q = ctx.db.query(\"Group\");\n    }\n\n    // Apply remaining non-tag filters not covered by index\n    if (where.name !== undefined) {\n      q = q.filter((f) => f.eq(f.field(\"name\"), where.name!));\n    }\n    // isRoot filter when not already used as primary index\n    if (\n      where.isRoot !== undefined &&\n      where.parentGroupId === undefined &&\n      (where.type !== undefined || where.slug !== undefined)\n    ) {\n      q = q.filter((f) => f.eq(f.field(\"isRoot\"), where.isRoot!));\n    }\n    // slug filter when not used as index\n    if (where.slug !== undefined && where.type !== undefined) {\n      q = q.filter((f) => f.eq(f.field(\"slug\"), where.slug!));\n    }\n\n    q = q.order(order);\n\n    let all = await q.collect();\n\n    // Apply tag filter (intersect with resolved groupIds)\n    if (tagFilteredIds !== null) {\n      all = all.filter((doc) => tagFilteredIds!.has(doc._id as string));\n    }\n\n    // Cursor-based pagination\n    let startIdx = 0;\n    if (args.cursor) {\n      const cursorIdx = all.findIndex((doc) => doc._id === args.cursor);\n      if (cursorIdx !== -1) {\n        startIdx = cursorIdx + 1;\n      }\n    }\n    const page = all.slice(startIdx, startIdx + limit + 1);\n    const hasMore = page.length > limit;\n    const items = hasMore ? page.slice(0, limit) : page;\n    const nextCursor = hasMore ? items[items.length - 1]._id : null;\n    return { items, nextCursor };\n  },\n});\n\n/**\n * Update a group's mutable fields such as `name`, `slug`, `tags`, `extend`,\n * and `parentGroupId`.\n *\n * When `parentGroupId` is changed the mutation automatically recomputes\n * `isRoot` and `rootGroupId` for the target group **and** cascades the new\n * `rootGroupId` to all descendant groups. When `tags` are provided they are\n * normalized, deduplicated, and the companion `GroupTag` rows are fully\n * replaced (delete-then-insert).\n *\n * @param args.groupId - The `Id<\"Group\">` of the group to update.\n * @param args.data - A partial object of fields to patch. Supported keys include `name`, `slug`, `type`, `parentGroupId`, `tags`, and `extend`.\n * @returns `null` on success.\n *\n * @example\n * ```ts\n * await ctx.runMutation(components.auth.groups.groupUpdate, {\n *   groupId: existingGroupId,\n *   data: {\n *     name: \"Acme Corp (renamed)\",\n *     tags: [{ key: \"plan\", value: \"pro\" }],\n *   },\n * });\n * ```\n */\nexport const groupUpdate = mutation({\n  args: { groupId: v.id(\"Group\"), data: v.any() },\n  returns: v.null(),\n  handler: async (ctx, { groupId, data }) => {\n    // If parentGroupId is changing, recompute rootGroupId + isRoot for this group and descendants\n    if (data.parentGroupId !== undefined) {\n      const oldGroup = await ctx.db.get(\"Group\", groupId);\n      const oldRootGroupId = oldGroup?.rootGroupId;\n      const newParentGroupId = data.parentGroupId as Id<\"Group\"> | undefined;\n      const newIsRoot = !newParentGroupId;\n      let newRootGroupId: Id<\"Group\">;\n      if (newIsRoot) {\n        newRootGroupId = groupId;\n      } else {\n        const parent = await ctx.db.get(\"Group\", newParentGroupId!);\n        newRootGroupId = parent?.rootGroupId ?? newParentGroupId!;\n      }\n      data.isRoot = newIsRoot;\n      data.rootGroupId = newRootGroupId;\n      // Cascade to descendants if rootGroupId changed\n      if (oldRootGroupId && oldRootGroupId !== newRootGroupId) {\n        const descendants = await ctx.db\n          .query(\"Group\")\n          .withIndex(\"root_group_id\", (q) =>\n            q.eq(\"rootGroupId\", oldRootGroupId),\n          )\n          .collect();\n        for (const desc of descendants) {\n          if (desc._id !== groupId) {\n            await ctx.db.patch(\"Group\", desc._id, {\n              rootGroupId: newRootGroupId,\n            });\n          }\n        }\n      }\n    }\n    // If tags are being updated, normalize and replace the full tag set\n    if (data.tags !== undefined) {\n      const normalizedTags: TagPair[] = Array.isArray(data.tags)\n        ? normalizeTags(data.tags as TagPair[])\n        : [];\n      // Delete existing group_tag rows for this group\n      const existingTags = await ctx.db\n        .query(\"GroupTag\")\n        .withIndex(\"by_group\", (idx) => idx.eq(\"group_id\", groupId))\n        .collect();\n      for (const existing of existingTags) {\n        await ctx.db.delete(\"GroupTag\", existing._id);\n      }\n      // Insert new normalized group_tag rows\n      for (const tag of normalizedTags) {\n        await ctx.db.insert(\"GroupTag\", {\n          group_id: groupId,\n          key: tag.key,\n          value: tag.value,\n        });\n      }\n      // Patch group with normalized tags (empty array = clear all)\n      await ctx.db.patch(\"Group\", groupId, {\n        ...data,\n        tags: normalizedTags.length > 0 ? normalizedTags : undefined,\n      });\n    } else {\n      await ctx.db.patch(\"Group\", groupId, data);\n    }\n    return null;\n  },\n});\n\n/**\n * Delete a group and all of its descendants. This cascades to:\n * - All child groups (recursively)\n * - All members of this group and its descendants\n * - All invites for this group and its descendants\n * - All companion `GroupTag` rows for this group and its descendants\n *\n * The deletion walks the group tree depth-first, removing leaves before\n * parents, so referential integrity is maintained throughout.\n *\n * @param args.groupId - The `Id<\"Group\">` of the group to delete. All children are deleted recursively.\n * @returns `null` on success.\n *\n * @example\n * ```ts\n * // Delete an organization and everything nested under it\n * await ctx.runMutation(components.auth.groups.groupDelete, {\n *   groupId: organizationGroupId,\n * });\n * ```\n */\nexport const groupDelete = mutation({\n  args: { groupId: v.id(\"Group\") },\n  returns: v.null(),\n  handler: async (ctx, { groupId }) => {\n    const deleteGroup = async (id: typeof groupId) => {\n      const children = await ctx.db\n        .query(\"Group\")\n        .withIndex(\"parent_group_id\", (q) => q.eq(\"parentGroupId\", id))\n        .collect();\n      for (const child of children) {\n        await deleteGroup(child._id);\n      }\n\n      const members = await ctx.db\n        .query(\"GroupMember\")\n        .withIndex(\"group_id\", (q) => q.eq(\"groupId\", id))\n        .collect();\n      for (const member of members) {\n        await ctx.db.delete(\"GroupMember\", member._id);\n      }\n\n      const invites = await ctx.db\n        .query(\"GroupInvite\")\n        .withIndex(\"group_id\", (q) => q.eq(\"groupId\", id))\n        .collect();\n      for (const invite of invites) {\n        await ctx.db.delete(\"GroupInvite\", invite._id);\n      }\n\n      // Delete companion group_tag rows\n      const tags = await ctx.db\n        .query(\"GroupTag\")\n        .withIndex(\"by_group\", (q) => q.eq(\"group_id\", id))\n        .collect();\n      for (const tag of tags) {\n        await ctx.db.delete(\"GroupTag\", tag._id);\n      }\n\n      await ctx.db.delete(\"Group\", id);\n    };\n\n    await deleteGroup(groupId);\n    return null;\n  },\n});\n\n// ============================================================================\n// Members\n// ============================================================================\n"],"mappings":";;;;;AAQA,SAAS,aAAa,KAAuB;AAC3C,QAAO;EACL,KAAK,IAAI,IAAI,MAAM,CAAC,aAAa;EACjC,OAAO,IAAI,MAAM,MAAM,CAAC,aAAa;EACtC;;AAGH,SAAS,cAAc,MAA4B;CACjD,MAAM,uBAAO,IAAI,KAAa;CAC9B,MAAM,SAAoB,EAAE;AAC5B,MAAK,MAAM,OAAO,MAAM;EACtB,MAAM,IAAI,aAAa,IAAI;EAC3B,MAAM,YAAY,GAAG,EAAE,IAAI,IAAI,EAAE;AACjC,MAAI,CAAC,KAAK,IAAI,UAAU,EAAE;AACxB,QAAK,IAAI,UAAU;AACnB,UAAO,KAAK,EAAE;;;AAGlB,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BT,MAAa,cAAc,SAAS;CAClC,MAAM;EACJ,MAAM,EAAE,QAAQ;EAChB,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC5B,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC5B,eAAe,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;EACxC,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,CAAC;EAC/B,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC;EAC5B;CACD,SAAS,EAAE,GAAG,QAAQ;CACtB,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,EAAE,MAAM,SAAS,GAAG,SAAS;EACnC,MAAM,iBAAiB,UAAU,cAAc,QAAQ,GAAG;EAC1D,MAAM,SAAS,CAAC,KAAK;EAErB,IAAI;AACJ,MAAI,CAAC,UAAU,KAAK,cAElB,gBADe,MAAM,IAAI,GAAG,IAAI,KAAK,cAAc,GAC7B,eAAe,KAAK;EAE5C,MAAM,UAAU,MAAM,IAAI,GAAG,OAAO,SAAS;GAC3C,GAAG;GACH,MAAM;GACN;GACA,aAAa,SAAS,SAAY;GACnC,CAAC;AAEF,MAAI,OACF,OAAM,IAAI,GAAG,MAAM,SAAS,EAAE,aAAa,SAAS,CAAC;AAGvD,MAAI,eACF,MAAK,MAAM,OAAO,eAChB,OAAM,IAAI,GAAG,OAAO,YAAY;GAC9B,UAAU;GACV,KAAK,IAAI;GACT,OAAO,IAAI;GACZ,CAAC;AAGN,SAAO;;CAEV,CAAC;;;;;;;;;;;;;;;;;;;;AAqBF,MAAa,WAAW,MAAM;CAC5B,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE;CAChC,SAAS,EAAE,MAAM,WAAW,EAAE,MAAM,CAAC;CACrC,SAAS,OAAO,KAAK,EAAE,cAAc;AACnC,SAAO,MAAM,IAAI,GAAG,IAAI,SAAS,QAAQ;;CAE5C,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCF,MAAa,YAAY,MAAM;CAC7B,MAAM;EACJ,OAAO,EAAE,SACP,EAAE,OAAO;GACP,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;GAC5B,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;GAC5B,eAAe,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;GACxC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;GAC5B,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC;GAC/B,SAAS,EAAE,SAAS,EAAE,MAAM,KAAK,CAAC;GAClC,SAAS,EAAE,SAAS,EAAE,MAAM,KAAK,CAAC;GACnC,CAAC,CACH;EACD,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC7B,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;EACjD,SAAS,EAAE,SACT,EAAE,MACA,EAAE,QAAQ,gBAAgB,EAC1B,EAAE,QAAQ,OAAO,EACjB,EAAE,QAAQ,OAAO,EACjB,EAAE,QAAQ,OAAO,CAClB,CACF;EACD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,MAAM,EAAE,EAAE,QAAQ,OAAO,CAAC,CAAC;EAChE;CACD,SAAS,WAAW,UAAU;CAC9B,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,QAAQ,KAAK,SAAS,EAAE;EAC9B,MAAM,QAAQ,KAAK,IAAI,KAAK,IAAI,KAAK,SAAS,IAAI,EAAE,EAAE,IAAI;EAC1D,MAAM,QAAQ,KAAK,SAAS;EAG5B,IAAI,iBAAqC;AAEzC,MAAI,MAAM,WAAW,MAAM,QAAQ,SAAS,GAAG;GAE7C,IAAI,SAA6B;AACjC,QAAK,MAAM,UAAU,MAAM,SAAS;IAClC,MAAM,IAAI,aAAa,OAAO;IAC9B,MAAM,OAAO,MAAM,IAAI,GACpB,MAAM,WAAW,CACjB,UAAU,iBAAiB,QAC1B,IAAI,GAAG,OAAO,EAAE,IAAI,CAAC,GAAG,SAAS,EAAE,MAAM,CAC1C,CACA,SAAS;IACZ,MAAM,MAAM,IAAI,IAAI,KAAK,KAAK,MAAM,EAAE,SAAmB,CAAC;AAC1D,QAAI,WAAW,KACb,UAAS;QAGT,MAAK,MAAM,MAAM,OACf,KAAI,CAAC,IAAI,IAAI,GAAG,CAAE,QAAO,OAAO,GAAG;AAIvC,QAAI,OAAO,SAAS,EAAG;;AAEzB,oBAAiB,0BAAU,IAAI,KAAK;;AAGtC,MAAI,MAAM,WAAW,MAAM,QAAQ,SAAS,GAAG;GAE7C,MAAM,yBAAS,IAAI,KAAa;AAChC,QAAK,MAAM,UAAU,MAAM,SAAS;IAClC,MAAM,IAAI,aAAa,OAAO;IAC9B,MAAM,OAAO,MAAM,IAAI,GACpB,MAAM,WAAW,CACjB,UAAU,iBAAiB,QAC1B,IAAI,GAAG,OAAO,EAAE,IAAI,CAAC,GAAG,SAAS,EAAE,MAAM,CAC1C,CACA,SAAS;AACZ,SAAK,MAAM,KAAK,KACd,QAAO,IAAI,EAAE,SAAmB;;AAGpC,OAAI,mBAAmB,MAErB;SAAK,MAAM,MAAM,eACf,KAAI,CAAC,OAAO,IAAI,GAAG,CAAE,gBAAe,OAAO,GAAG;SAGhD,kBAAiB;;EAKrB,IAAI;AACJ,MAAI,MAAM,SAAS,UAAa,MAAM,kBAAkB,OACtD,KAAI,IAAI,GACL,MAAM,QAAQ,CACd,UAAU,yBAAyB,QAClC,IAAI,GAAG,QAAQ,MAAM,KAAM,CAAC,GAAG,iBAAiB,MAAM,cAAe,CACtE;WACM,MAAM,SAAS,OACxB,KAAI,IAAI,GACL,MAAM,QAAQ,CACd,UAAU,SAAS,QAAQ,IAAI,GAAG,QAAQ,MAAM,KAAM,CAAC;WACjD,MAAM,SAAS,OACxB,KAAI,IAAI,GACL,MAAM,QAAQ,CACd,UAAU,SAAS,QAAQ,IAAI,GAAG,QAAQ,MAAM,KAAM,CAAC;WACjD,MAAM,kBAAkB,OACjC,KAAI,IAAI,GACL,MAAM,QAAQ,CACd,UAAU,oBAAoB,QAC7B,IAAI,GAAG,iBAAiB,MAAM,cAAe,CAC9C;WACM,MAAM,WAAW,OAC1B,KAAI,IAAI,GACL,MAAM,QAAQ,CACd,UAAU,YAAY,QAAQ,IAAI,GAAG,UAAU,MAAM,OAAQ,CAAC;MAEjE,KAAI,IAAI,GAAG,MAAM,QAAQ;AAI3B,MAAI,MAAM,SAAS,OACjB,KAAI,EAAE,QAAQ,MAAM,EAAE,GAAG,EAAE,MAAM,OAAO,EAAE,MAAM,KAAM,CAAC;AAGzD,MACE,MAAM,WAAW,UACjB,MAAM,kBAAkB,WACvB,MAAM,SAAS,UAAa,MAAM,SAAS,QAE5C,KAAI,EAAE,QAAQ,MAAM,EAAE,GAAG,EAAE,MAAM,SAAS,EAAE,MAAM,OAAQ,CAAC;AAG7D,MAAI,MAAM,SAAS,UAAa,MAAM,SAAS,OAC7C,KAAI,EAAE,QAAQ,MAAM,EAAE,GAAG,EAAE,MAAM,OAAO,EAAE,MAAM,KAAM,CAAC;AAGzD,MAAI,EAAE,MAAM,MAAM;EAElB,IAAI,MAAM,MAAM,EAAE,SAAS;AAG3B,MAAI,mBAAmB,KACrB,OAAM,IAAI,QAAQ,QAAQ,eAAgB,IAAI,IAAI,IAAc,CAAC;EAInE,IAAI,WAAW;AACf,MAAI,KAAK,QAAQ;GACf,MAAM,YAAY,IAAI,WAAW,QAAQ,IAAI,QAAQ,KAAK,OAAO;AACjE,OAAI,cAAc,GAChB,YAAW,YAAY;;EAG3B,MAAM,OAAO,IAAI,MAAM,UAAU,WAAW,QAAQ,EAAE;EACtD,MAAM,UAAU,KAAK,SAAS;EAC9B,MAAM,QAAQ,UAAU,KAAK,MAAM,GAAG,MAAM,GAAG;AAE/C,SAAO;GAAE;GAAO,YADG,UAAU,MAAM,MAAM,SAAS,GAAG,MAAM;GAC/B;;CAE/B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BF,MAAa,cAAc,SAAS;CAClC,MAAM;EAAE,SAAS,EAAE,GAAG,QAAQ;EAAE,MAAM,EAAE,KAAK;EAAE;CAC/C,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,SAAS,WAAW;AAEzC,MAAI,KAAK,kBAAkB,QAAW;GAEpC,MAAM,kBADW,MAAM,IAAI,GAAG,IAAI,SAAS,QAAQ,GAClB;GACjC,MAAM,mBAAmB,KAAK;GAC9B,MAAM,YAAY,CAAC;GACnB,IAAI;AACJ,OAAI,UACF,kBAAiB;OAGjB,mBADe,MAAM,IAAI,GAAG,IAAI,SAAS,iBAAkB,GAClC,eAAe;AAE1C,QAAK,SAAS;AACd,QAAK,cAAc;AAEnB,OAAI,kBAAkB,mBAAmB,gBAAgB;IACvD,MAAM,cAAc,MAAM,IAAI,GAC3B,MAAM,QAAQ,CACd,UAAU,kBAAkB,MAC3B,EAAE,GAAG,eAAe,eAAe,CACpC,CACA,SAAS;AACZ,SAAK,MAAM,QAAQ,YACjB,KAAI,KAAK,QAAQ,QACf,OAAM,IAAI,GAAG,MAAM,SAAS,KAAK,KAAK,EACpC,aAAa,gBACd,CAAC;;;AAMV,MAAI,KAAK,SAAS,QAAW;GAC3B,MAAM,iBAA4B,MAAM,QAAQ,KAAK,KAAK,GACtD,cAAc,KAAK,KAAkB,GACrC,EAAE;GAEN,MAAM,eAAe,MAAM,IAAI,GAC5B,MAAM,WAAW,CACjB,UAAU,aAAa,QAAQ,IAAI,GAAG,YAAY,QAAQ,CAAC,CAC3D,SAAS;AACZ,QAAK,MAAM,YAAY,aACrB,OAAM,IAAI,GAAG,OAAO,YAAY,SAAS,IAAI;AAG/C,QAAK,MAAM,OAAO,eAChB,OAAM,IAAI,GAAG,OAAO,YAAY;IAC9B,UAAU;IACV,KAAK,IAAI;IACT,OAAO,IAAI;IACZ,CAAC;AAGJ,SAAM,IAAI,GAAG,MAAM,SAAS,SAAS;IACnC,GAAG;IACH,MAAM,eAAe,SAAS,IAAI,iBAAiB;IACpD,CAAC;QAEF,OAAM,IAAI,GAAG,MAAM,SAAS,SAAS,KAAK;AAE5C,SAAO;;CAEV,CAAC;;;;;;;;;;;;;;;;;;;;;;AAuBF,MAAa,cAAc,SAAS;CAClC,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE;CAChC,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,cAAc;EACnC,MAAM,cAAc,OAAO,OAAuB;GAChD,MAAM,WAAW,MAAM,IAAI,GACxB,MAAM,QAAQ,CACd,UAAU,oBAAoB,MAAM,EAAE,GAAG,iBAAiB,GAAG,CAAC,CAC9D,SAAS;AACZ,QAAK,MAAM,SAAS,SAClB,OAAM,YAAY,MAAM,IAAI;GAG9B,MAAM,UAAU,MAAM,IAAI,GACvB,MAAM,cAAc,CACpB,UAAU,aAAa,MAAM,EAAE,GAAG,WAAW,GAAG,CAAC,CACjD,SAAS;AACZ,QAAK,MAAM,UAAU,QACnB,OAAM,IAAI,GAAG,OAAO,eAAe,OAAO,IAAI;GAGhD,MAAM,UAAU,MAAM,IAAI,GACvB,MAAM,cAAc,CACpB,UAAU,aAAa,MAAM,EAAE,GAAG,WAAW,GAAG,CAAC,CACjD,SAAS;AACZ,QAAK,MAAM,UAAU,QACnB,OAAM,IAAI,GAAG,OAAO,eAAe,OAAO,IAAI;GAIhD,MAAM,OAAO,MAAM,IAAI,GACpB,MAAM,WAAW,CACjB,UAAU,aAAa,MAAM,EAAE,GAAG,YAAY,GAAG,CAAC,CAClD,SAAS;AACZ,QAAK,MAAM,OAAO,KAChB,OAAM,IAAI,GAAG,OAAO,YAAY,IAAI,IAAI;AAG1C,SAAM,IAAI,GAAG,OAAO,SAAS,GAAG;;AAGlC,QAAM,YAAY,QAAQ;AAC1B,SAAO;;CAEV,CAAC"}