@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/component/public/security/limits.d.ts

@@ -1,114 +0,0 @@
-declare namespace limits_d_exports {
-  export { rateLimitCreate, rateLimitDelete, rateLimitGet, rateLimitPatch };
-}
-/**
- * Look up a rate limit entry by its string identifier.
- *
- * Queries the `RateLimit` table using the `by_identifier` unique index.
- * Returns the rate limit state with camelCase field names (`attemptsLeft`,
- * `lastAttemptTime`) mapped from the snake_case storage format. Used to
- * check whether an action should be allowed or throttled.
- *
- * @param identifier - Unique string identifying the rate limit bucket
- *   (e.g. `"login:user@example.com"` or `"api:sk_live_abc123"`).
- * @returns The rate limit state object (including `attemptsLeft` and
- *   `lastAttemptTime`), or `null` if no entry exists for the identifier.
- *
- * @example
- * ```ts
- * const limit = await ctx.runQuery(
- *   components.auth.security.limits.rateLimitGet,
- *   { identifier: `login:${email}` },
- * );
- * if (limit !== null && limit.attemptsLeft <= 0) {
- *   throw new Error("Too many login attempts. Please try again later.");
- * }
- * ```
- */
-declare const rateLimitGet: any;
-/**
- * Create a new rate limit entry in the `RateLimit` table.
- *
- * Initializes a rate limit bucket for a given identifier. The entry
- * tracks remaining attempts and the timestamp of the last attempt,
- * storing them in snake_case format internally. Call this when the
- * first rate-limited action occurs for an identifier that does not
- * yet have an entry.
- *
- * @param identifier - Unique string identifying the rate limit bucket
- *   (e.g. `"login:user@example.com"` or `"otp:+15551234567"`).
- * @param attemptsLeft - Number of remaining attempts before the action
- *   is throttled.
- * @param lastAttemptTime - Unix timestamp (in milliseconds) of the
- *   initial attempt.
- * @returns The `_id` of the newly created `RateLimit` document.
- *
- * @example
- * ```ts
- * const rateLimitId = await ctx.runMutation(
- *   components.auth.security.limits.rateLimitCreate,
- *   {
- *     identifier: `login:${email}`,
- *     attemptsLeft: 4, // 5 max minus this attempt
- *     lastAttemptTime: Date.now(),
- *   },
- * );
- * ```
- */
-declare const rateLimitCreate: any;
-/**
- * Patch a rate limit entry with partial data.
- *
- * Updates an existing `RateLimit` document with the provided fields.
- * Automatically maps camelCase field names (`attemptsLeft`,
- * `lastAttemptTime`) to the snake_case storage format before writing.
- * Typically called to decrement remaining attempts or to reset the
- * bucket after a cooldown window has elapsed.
- *
- * @param rateLimitId - The `_id` of the `RateLimit` document to update.
- * @param data - An object containing the fields to patch. Supports
- *   camelCase names which are transparently converted:
- *   - `attemptsLeft` -- Updated number of remaining attempts.
- *   - `lastAttemptTime` -- Updated timestamp of the most recent attempt.
- * @returns `null` on success.
- *
- * @example
- * ```ts
- * // Decrement attempts after a failed login
- * await ctx.runMutation(
- *   components.auth.security.limits.rateLimitPatch,
- *   {
- *     rateLimitId: limit._id,
- *     data: {
- *       attemptsLeft: limit.attemptsLeft - 1,
- *       lastAttemptTime: Date.now(),
- *     },
- *   },
- * );
- * ```
- */
-declare const rateLimitPatch: any;
-/**
- * Delete a rate limit entry from the `RateLimit` table.
- *
- * Permanently removes the rate limit bucket. This effectively resets
- * rate limiting for the associated identifier, allowing the next
- * action to proceed without throttling. Useful for administrative
- * resets or cleanup of expired buckets.
- *
- * @param rateLimitId - The `_id` of the `RateLimit` document to delete.
- * @returns `null` on success.
- *
- * @example
- * ```ts
- * // Admin resets a user's login rate limit
- * await ctx.runMutation(
- *   components.auth.security.limits.rateLimitDelete,
- *   { rateLimitId: limit._id },
- * );
- * ```
- */
-declare const rateLimitDelete: any;
-//#endregion
-export { limits_d_exports, rateLimitCreate, rateLimitDelete, rateLimitGet, rateLimitPatch };
-//# sourceMappingURL=limits.d.ts.map

package/dist/component/public/security/limits.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"limits.d.ts","names":[],"sources":["../../../../src/component/public/security/limits.ts"],"mappings":";;;;;;;;;;;;AA6BA;;;;;AAgDA;;;;;AA+CA;;;;;cA/Fa,YAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAgDA,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA+CA,cAAA;;;;;;;;;;;;;;;;;;;;;cAsCA,eAAA"}

package/dist/component/public/security/limits.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"limits.js","names":[],"sources":["../../../../src/component/public/security/limits.ts"],"sourcesContent":["import { v } from \"convex/values\";\n\nimport { mutation, query } from \"../../functions\";\nimport { vRateLimitResult } from \"../../model\";\n\n/**\n * Look up a rate limit entry by its string identifier.\n *\n * Queries the `RateLimit` table using the `by_identifier` unique index.\n * Returns the rate limit state with camelCase field names (`attemptsLeft`,\n * `lastAttemptTime`) mapped from the snake_case storage format. Used to\n * check whether an action should be allowed or throttled.\n *\n * @param identifier - Unique string identifying the rate limit bucket\n *   (e.g. `\"login:user@example.com\"` or `\"api:sk_live_abc123\"`).\n * @returns The rate limit state object (including `attemptsLeft` and\n *   `lastAttemptTime`), or `null` if no entry exists for the identifier.\n *\n * @example\n * ```ts\n * const limit = await ctx.runQuery(\n *   components.auth.security.limits.rateLimitGet,\n *   { identifier: `login:${email}` },\n * );\n * if (limit !== null && limit.attemptsLeft <= 0) {\n *   throw new Error(\"Too many login attempts. Please try again later.\");\n * }\n * ```\n */\nexport const rateLimitGet = query({\n  args: { identifier: v.string() },\n  returns: v.union(vRateLimitResult, v.null()),\n  handler: async (ctx, { identifier }) => {\n    const row = await ctx.db\n      .query(\"RateLimit\")\n      .withIndex(\"by_identifier\", (q) => q.eq(\"identifier\", identifier))\n      .unique();\n    if (row === null) {\n      return null;\n    }\n    return {\n      ...row,\n      attemptsLeft: row.attempts_left,\n      lastAttemptTime: row.last_attempt_time,\n    };\n  },\n});\n\n/**\n * Create a new rate limit entry in the `RateLimit` table.\n *\n * Initializes a rate limit bucket for a given identifier. The entry\n * tracks remaining attempts and the timestamp of the last attempt,\n * storing them in snake_case format internally. Call this when the\n * first rate-limited action occurs for an identifier that does not\n * yet have an entry.\n *\n * @param identifier - Unique string identifying the rate limit bucket\n *   (e.g. `\"login:user@example.com\"` or `\"otp:+15551234567\"`).\n * @param attemptsLeft - Number of remaining attempts before the action\n *   is throttled.\n * @param lastAttemptTime - Unix timestamp (in milliseconds) of the\n *   initial attempt.\n * @returns The `_id` of the newly created `RateLimit` document.\n *\n * @example\n * ```ts\n * const rateLimitId = await ctx.runMutation(\n *   components.auth.security.limits.rateLimitCreate,\n *   {\n *     identifier: `login:${email}`,\n *     attemptsLeft: 4, // 5 max minus this attempt\n *     lastAttemptTime: Date.now(),\n *   },\n * );\n * ```\n */\nexport const rateLimitCreate = mutation({\n  args: {\n    identifier: v.string(),\n    attemptsLeft: v.number(),\n    lastAttemptTime: v.number(),\n  },\n  returns: v.id(\"RateLimit\"),\n  handler: async (ctx, { identifier, attemptsLeft, lastAttemptTime }) => {\n    return await ctx.db.insert(\"RateLimit\", {\n      identifier,\n      attempts_left: attemptsLeft,\n      last_attempt_time: lastAttemptTime,\n    });\n  },\n});\n\n/**\n * Patch a rate limit entry with partial data.\n *\n * Updates an existing `RateLimit` document with the provided fields.\n * Automatically maps camelCase field names (`attemptsLeft`,\n * `lastAttemptTime`) to the snake_case storage format before writing.\n * Typically called to decrement remaining attempts or to reset the\n * bucket after a cooldown window has elapsed.\n *\n * @param rateLimitId - The `_id` of the `RateLimit` document to update.\n * @param data - An object containing the fields to patch. Supports\n *   camelCase names which are transparently converted:\n *   - `attemptsLeft` -- Updated number of remaining attempts.\n *   - `lastAttemptTime` -- Updated timestamp of the most recent attempt.\n * @returns `null` on success.\n *\n * @example\n * ```ts\n * // Decrement attempts after a failed login\n * await ctx.runMutation(\n *   components.auth.security.limits.rateLimitPatch,\n *   {\n *     rateLimitId: limit._id,\n *     data: {\n *       attemptsLeft: limit.attemptsLeft - 1,\n *       lastAttemptTime: Date.now(),\n *     },\n *   },\n * );\n * ```\n */\nexport const rateLimitPatch = mutation({\n  args: { rateLimitId: v.id(\"RateLimit\"), data: v.any() },\n  returns: v.null(),\n  handler: async (ctx, { rateLimitId, data }) => {\n    const nextData: Record<string, unknown> = { ...data };\n    if (nextData.attemptsLeft !== undefined) {\n      nextData.attempts_left = nextData.attemptsLeft;\n      delete nextData.attemptsLeft;\n    }\n    if (nextData.lastAttemptTime !== undefined) {\n      nextData.last_attempt_time = nextData.lastAttemptTime;\n      delete nextData.lastAttemptTime;\n    }\n    await ctx.db.patch(\"RateLimit\", rateLimitId, nextData);\n    return null;\n  },\n});\n\n/**\n * Delete a rate limit entry from the `RateLimit` table.\n *\n * Permanently removes the rate limit bucket. This effectively resets\n * rate limiting for the associated identifier, allowing the next\n * action to proceed without throttling. Useful for administrative\n * resets or cleanup of expired buckets.\n *\n * @param rateLimitId - The `_id` of the `RateLimit` document to delete.\n * @returns `null` on success.\n *\n * @example\n * ```ts\n * // Admin resets a user's login rate limit\n * await ctx.runMutation(\n *   components.auth.security.limits.rateLimitDelete,\n *   { rateLimitId: limit._id },\n * );\n * ```\n */\nexport const rateLimitDelete = mutation({\n  args: { rateLimitId: v.id(\"RateLimit\") },\n  returns: v.null(),\n  handler: async (ctx, { rateLimitId }) => {\n    await ctx.db.delete(\"RateLimit\", rateLimitId);\n    return null;\n  },\n});\n\n// ============================================================================\n// Device Authorization (RFC 8628)\n// ============================================================================\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,MAAa,eAAe,MAAM;CAChC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE;CAChC,SAAS,EAAE,MAAM,kBAAkB,EAAE,MAAM,CAAC;CAC5C,SAAS,OAAO,KAAK,EAAE,iBAAiB;EACtC,MAAM,MAAM,MAAM,IAAI,GACnB,MAAM,YAAY,CAClB,UAAU,kBAAkB,MAAM,EAAE,GAAG,cAAc,WAAW,CAAC,CACjE,QAAQ;AACX,MAAI,QAAQ,KACV,QAAO;AAET,SAAO;GACL,GAAG;GACH,cAAc,IAAI;GAClB,iBAAiB,IAAI;GACtB;;CAEJ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BF,MAAa,kBAAkB,SAAS;CACtC,MAAM;EACJ,YAAY,EAAE,QAAQ;EACtB,cAAc,EAAE,QAAQ;EACxB,iBAAiB,EAAE,QAAQ;EAC5B;CACD,SAAS,EAAE,GAAG,YAAY;CAC1B,SAAS,OAAO,KAAK,EAAE,YAAY,cAAc,sBAAsB;AACrE,SAAO,MAAM,IAAI,GAAG,OAAO,aAAa;GACtC;GACA,eAAe;GACf,mBAAmB;GACpB,CAAC;;CAEL,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiCF,MAAa,iBAAiB,SAAS;CACrC,MAAM;EAAE,aAAa,EAAE,GAAG,YAAY;EAAE,MAAM,EAAE,KAAK;EAAE;CACvD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,aAAa,WAAW;EAC7C,MAAM,WAAoC,EAAE,GAAG,MAAM;AACrD,MAAI,SAAS,iBAAiB,QAAW;AACvC,YAAS,gBAAgB,SAAS;AAClC,UAAO,SAAS;;AAElB,MAAI,SAAS,oBAAoB,QAAW;AAC1C,YAAS,oBAAoB,SAAS;AACtC,UAAO,SAAS;;AAElB,QAAM,IAAI,GAAG,MAAM,aAAa,aAAa,SAAS;AACtD,SAAO;;CAEV,CAAC;;;;;;;;;;;;;;;;;;;;;AAsBF,MAAa,kBAAkB,SAAS;CACtC,MAAM,EAAE,aAAa,EAAE,GAAG,YAAY,EAAE;CACxC,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,kBAAkB;AACvC,QAAM,IAAI,GAAG,OAAO,aAAa,YAAY;AAC7C,SAAO;;CAEV,CAAC"}

package/dist/component/public.d.ts

@@ -1,28 +0,0 @@
-import { accountDelete, accountGet, accountGetById, accountInsert, accountListByUser, accountPatch } from "./public/identity/accounts.js";
-import { deviceAuthorize, deviceDelete, deviceGetByCodeHash, deviceGetByUserCode, deviceInsert, deviceUpdateLastPolled } from "./public/factors/devices.js";
-import { enterpriseAuditEventCreate, enterpriseAuditEventList } from "./public/enterprise/audit.js";
-import { enterpriseCreate, enterpriseDelete, enterpriseGet, enterpriseGetByDomain, enterpriseGetByGroup, enterpriseList, enterpriseUpdate } from "./public/enterprise/core.js";
-import { enterpriseDomainAdd, enterpriseDomainDelete, enterpriseDomainList, enterpriseDomainVerificationDelete, enterpriseDomainVerificationGet, enterpriseDomainVerificationUpsert, enterpriseDomainVerify } from "./public/enterprise/domains.js";
-import { enterpriseScimConfigGetByEnterprise, enterpriseScimConfigGetByTokenHash, enterpriseScimConfigUpsert, enterpriseScimIdentityDelete, enterpriseScimIdentityGet, enterpriseScimIdentityGetByEnterpriseAndUser, enterpriseScimIdentityGetByMappedGroup, enterpriseScimIdentityGetByUser, enterpriseScimIdentityListByEnterprise, enterpriseScimIdentityUpsert } from "./public/enterprise/scim.js";
-import { enterpriseSecretDelete, enterpriseSecretGet, enterpriseSecretUpsert } from "./public/enterprise/secrets.js";
-import { enterpriseWebhookDeliveryEnqueue, enterpriseWebhookDeliveryList, enterpriseWebhookDeliveryListReady, enterpriseWebhookDeliveryPatch, enterpriseWebhookEndpointCreate, enterpriseWebhookEndpointGet, enterpriseWebhookEndpointList, enterpriseWebhookEndpointUpdate } from "./public/enterprise/webhooks.js";
-import { groupCreate, groupDelete, groupGet, groupList, groupUpdate } from "./public/groups/core.js";
-import { inviteAccept, inviteAcceptByToken, inviteCreate, inviteGet, inviteGetByTokenHash, inviteList, inviteRevoke } from "./public/groups/invites.js";
-import { memberAdd, memberGet, memberGetByGroupAndUser, memberList, memberRemove, memberResolve, memberUpdate } from "./public/groups/members.js";
-import { keyDelete, keyGetByHashedKey, keyGetById, keyInsert, keyList, keyPatch } from "./public/security/keys.js";
-import { passkeyDelete, passkeyGetByCredentialId, passkeyInsert, passkeyListByUserId, passkeyUpdateCounter, passkeyUpdateMeta } from "./public/factors/passkeys.js";
-import { rateLimitCreate, rateLimitDelete, rateLimitGet, rateLimitPatch } from "./public/security/limits.js";
-import { refreshTokenCreate, refreshTokenDeleteAll, refreshTokenGetActive, refreshTokenGetById, refreshTokenGetChildren, refreshTokenListBySession, refreshTokenPatch } from "./public/identity/tokens.js";
-import { sessionCreate, sessionDelete, sessionGetById, sessionList, sessionListByUser } from "./public/identity/sessions.js";
-import { totpDelete, totpGetById, totpGetVerifiedByUserId, totpInsert, totpListByUserId, totpMarkVerified, totpUpdateLastUsed } from "./public/factors/totp.js";
-import { userDelete, userFindByVerifiedEmail, userFindByVerifiedPhone, userGetById, userInsert, userList, userPatch, userUpsert } from "./public/identity/users.js";
-import { verificationCodeCreate, verificationCodeDelete, verificationCodeGetByAccountId, verificationCodeGetByCode } from "./public/identity/codes.js";
-import { verifierCreate, verifierDelete, verifierGetById, verifierGetBySignature, verifierPatch } from "./public/identity/verifiers.js";
-
-//#region src/component/public.d.ts
-declare namespace public_d_exports {
-  export { accountDelete, accountGet, accountGetById, accountInsert, accountListByUser, accountPatch, deviceAuthorize, deviceDelete, deviceGetByCodeHash, deviceGetByUserCode, deviceInsert, deviceUpdateLastPolled, enterpriseAuditEventCreate, enterpriseAuditEventList, enterpriseCreate, enterpriseDelete, enterpriseDomainAdd, enterpriseDomainDelete, enterpriseDomainList, enterpriseDomainVerificationDelete, enterpriseDomainVerificationGet, enterpriseDomainVerificationUpsert, enterpriseDomainVerify, enterpriseGet, enterpriseGetByDomain, enterpriseGetByGroup, enterpriseList, enterpriseScimConfigGetByEnterprise, enterpriseScimConfigGetByTokenHash, enterpriseScimConfigUpsert, enterpriseScimIdentityDelete, enterpriseScimIdentityGet, enterpriseScimIdentityGetByEnterpriseAndUser, enterpriseScimIdentityGetByMappedGroup, enterpriseScimIdentityGetByUser, enterpriseScimIdentityListByEnterprise, enterpriseScimIdentityUpsert, enterpriseSecretDelete, enterpriseSecretGet, enterpriseSecretUpsert, enterpriseUpdate, enterpriseWebhookDeliveryEnqueue, enterpriseWebhookDeliveryList, enterpriseWebhookDeliveryListReady, enterpriseWebhookDeliveryPatch, enterpriseWebhookEndpointCreate, enterpriseWebhookEndpointGet, enterpriseWebhookEndpointList, enterpriseWebhookEndpointUpdate, groupCreate, groupDelete, groupGet, groupList, groupUpdate, inviteAccept, inviteAcceptByToken, inviteCreate, inviteGet, inviteGetByTokenHash, inviteList, inviteRevoke, keyDelete, keyGetByHashedKey, keyGetById, keyInsert, keyList, keyPatch, memberAdd, memberGet, memberGetByGroupAndUser, memberList, memberRemove, memberResolve, memberUpdate, passkeyDelete, passkeyGetByCredentialId, passkeyInsert, passkeyListByUserId, passkeyUpdateCounter, passkeyUpdateMeta, rateLimitCreate, rateLimitDelete, rateLimitGet, rateLimitPatch, refreshTokenCreate, refreshTokenDeleteAll, refreshTokenGetActive, refreshTokenGetById, refreshTokenGetChildren, refreshTokenListBySession, refreshTokenPatch, sessionCreate, sessionDelete, sessionGetById, sessionList, sessionListByUser, totpDelete, totpGetById, totpGetVerifiedByUserId, totpInsert, totpListByUserId, totpMarkVerified, totpUpdateLastUsed, userDelete, userFindByVerifiedEmail, userFindByVerifiedPhone, userGetById, userInsert, userList, userPatch, userUpsert, verificationCodeCreate, verificationCodeDelete, verificationCodeGetByAccountId, verificationCodeGetByCode, verifierCreate, verifierDelete, verifierGetById, verifierGetBySignature, verifierPatch };
-}
-//#endregion
-export { accountDelete, accountGet, accountGetById, accountInsert, accountListByUser, accountPatch, deviceAuthorize, deviceDelete, deviceGetByCodeHash, deviceGetByUserCode, deviceInsert, deviceUpdateLastPolled, enterpriseAuditEventCreate, enterpriseAuditEventList, enterpriseCreate, enterpriseDelete, enterpriseDomainAdd, enterpriseDomainDelete, enterpriseDomainList, enterpriseDomainVerificationDelete, enterpriseDomainVerificationGet, enterpriseDomainVerificationUpsert, enterpriseDomainVerify, enterpriseGet, enterpriseGetByDomain, enterpriseGetByGroup, enterpriseList, enterpriseScimConfigGetByEnterprise, enterpriseScimConfigGetByTokenHash, enterpriseScimConfigUpsert, enterpriseScimIdentityDelete, enterpriseScimIdentityGet, enterpriseScimIdentityGetByEnterpriseAndUser, enterpriseScimIdentityGetByMappedGroup, enterpriseScimIdentityGetByUser, enterpriseScimIdentityListByEnterprise, enterpriseScimIdentityUpsert, enterpriseSecretDelete, enterpriseSecretGet, enterpriseSecretUpsert, enterpriseUpdate, enterpriseWebhookDeliveryEnqueue, enterpriseWebhookDeliveryList, enterpriseWebhookDeliveryListReady, enterpriseWebhookDeliveryPatch, enterpriseWebhookEndpointCreate, enterpriseWebhookEndpointGet, enterpriseWebhookEndpointList, enterpriseWebhookEndpointUpdate, groupCreate, groupDelete, groupGet, groupList, groupUpdate, inviteAccept, inviteAcceptByToken, inviteCreate, inviteGet, inviteGetByTokenHash, inviteList, inviteRevoke, keyDelete, keyGetByHashedKey, keyGetById, keyInsert, keyList, keyPatch, memberAdd, memberGet, memberGetByGroupAndUser, memberList, memberRemove, memberResolve, memberUpdate, passkeyDelete, passkeyGetByCredentialId, passkeyInsert, passkeyListByUserId, passkeyUpdateCounter, passkeyUpdateMeta, public_d_exports, rateLimitCreate, rateLimitDelete, rateLimitGet, rateLimitPatch, refreshTokenCreate, refreshTokenDeleteAll, refreshTokenGetActive, refreshTokenGetById, refreshTokenGetChildren, refreshTokenListBySession, refreshTokenPatch, sessionCreate, sessionDelete, sessionGetById, sessionList, sessionListByUser, totpDelete, totpGetById, totpGetVerifiedByUserId, totpInsert, totpListByUserId, totpMarkVerified, totpUpdateLastUsed, userDelete, userFindByVerifiedEmail, userFindByVerifiedPhone, userGetById, userInsert, userList, userPatch, userUpsert, verificationCodeCreate, verificationCodeDelete, verificationCodeGetByAccountId, verificationCodeGetByCode, verifierCreate, verifierDelete, verifierGetById, verifierGetBySignature, verifierPatch };
-//# sourceMappingURL=public.d.ts.map

package/dist/component/public.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"public.d.ts","names":[],"sources":["../../src/component/public.ts"],"mappings":""}

package/dist/component/schema.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"schema.d.ts","names":[],"sources":["../../src/component/schema.ts"],"mappings":""}

package/dist/component/schema.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"schema.js","names":[],"sources":["../../src/component/schema.ts"],"sourcesContent":["import { defineSchema, defineTable } from \"convex/server\";\nimport { v } from \"convex/values\";\n\nimport {\n  vApiKeyRateLimit,\n  vApiKeyRateLimitState,\n  vApiKeyScope,\n  vAuditActorType,\n  vAuditStatus,\n  vDeviceStatus,\n  vEnterprisePolicy,\n  vEnterpriseSecretKind,\n  vEnterpriseStatus,\n  vInviteStatus,\n  vScimResourceType,\n  vScimStatus,\n  vTag,\n  vWebhookDeliveryStatus,\n  vWebhookEndpointStatus,\n} from \"./model\";\n\n/**\n * Schema for the auth component.\n *\n * Contains tables for core authentication (users, sessions, accounts, tokens,\n * verification codes, PKCE verifiers, rate limits) and hierarchical group\n * management (groups, members, invites).\n */\nexport default defineSchema({\n  /**\n   * Authenticated users. A user may have multiple linked accounts\n   * and multiple concurrent sessions.\n   */\n  User: defineTable({\n    name: v.optional(v.string()),\n    image: v.optional(v.string()),\n    email: v.optional(v.string()),\n    emailVerificationTime: v.optional(v.number()),\n    phone: v.optional(v.string()),\n    phoneVerificationTime: v.optional(v.number()),\n    isAnonymous: v.optional(v.boolean()),\n    extend: v.optional(v.any()),\n  })\n    .index(\"email\", [\"email\"])\n    .index(\"email_verified\", [\"email\", \"emailVerificationTime\"])\n    .index(\"phone\", [\"phone\"])\n    .index(\"phone_verified\", [\"phone\", \"phoneVerificationTime\"]),\n\n  /**\n   * Active sessions. A single user can have multiple concurrent sessions\n   * across different devices or browsers. Sessions expire after a\n   * configurable duration.\n   */\n  Session: defineTable({\n    userId: v.id(\"User\"),\n    expirationTime: v.number(),\n  }).index(\"user_id\", [\"userId\"]),\n\n  /**\n   * Authentication accounts. Each account links a user to a single\n   * authentication provider (e.g. Google OAuth, email/password).\n   * A user can have multiple accounts linked.\n   */\n  Account: defineTable({\n    userId: v.id(\"User\"),\n    provider: v.string(),\n    providerAccountId: v.string(),\n    secret: v.optional(v.string()),\n    emailVerified: v.optional(v.string()),\n    phoneVerified: v.optional(v.string()),\n    extend: v.optional(v.any()),\n  })\n    .index(\"user_id_provider\", [\"userId\", \"provider\"])\n    .index(\"provider_account_id\", [\"provider\", \"providerAccountId\"]),\n\n  /**\n   * Refresh tokens for session continuity. Tokens are single-use and form\n   * a chain — each token references the one it was exchanged from.\n   *\n   * The active refresh token is the most recently created token that has not\n   * been used yet. A 10-second reuse window allows for concurrent requests.\n   * Any invalid use of a token invalidates the entire chain.\n   */\n  RefreshToken: defineTable({\n    sessionId: v.id(\"Session\"),\n    expirationTime: v.number(),\n    firstUsedTime: v.optional(v.number()),\n    parentRefreshTokenId: v.optional(v.id(\"RefreshToken\")),\n  })\n    .index(\"session_id\", [\"sessionId\"])\n    .index(\"session_id_first_used\", [\"sessionId\", \"firstUsedTime\"])\n    .index(\"session_id_parent_refresh_token_id\", [\n      \"sessionId\",\n      \"parentRefreshTokenId\",\n    ]),\n\n  /**\n   * Verification codes for OTP tokens, magic link tokens, and OAuth codes.\n   */\n  VerificationCode: defineTable({\n    accountId: v.id(\"Account\"),\n    provider: v.string(),\n    code: v.string(),\n    expirationTime: v.number(),\n    verifier: v.optional(v.string()),\n    emailVerified: v.optional(v.string()),\n    phoneVerified: v.optional(v.string()),\n  })\n    .index(\"account_id\", [\"accountId\"])\n    .index(\"code\", [\"code\"]),\n\n  /**\n   * PKCE verifiers for OAuth flows. Stores the cryptographic verifier\n   * used to prove the authorization request originated from this client.\n   */\n  AuthVerifier: defineTable({\n    sessionId: v.optional(v.id(\"Session\")),\n    signature: v.optional(v.string()),\n  }).index(\"signature\", [\"signature\"]),\n\n  /**\n   * WebAuthn passkey credentials. Each credential links a user to a\n   * registered authenticator (Touch ID, Face ID, security key, etc.).\n   * A user can have multiple passkeys across different devices.\n   */\n  Passkey: defineTable({\n    userId: v.id(\"User\"),\n    /** Base64url-encoded credential ID from the authenticator. */\n    credentialId: v.string(),\n    /** Public key bytes (SEC1 uncompressed for EC, SPKI for RSA). */\n    publicKey: v.bytes(),\n    /** COSE algorithm identifier (-7 for ES256, -257 for RS256, -8 for EdDSA). */\n    algorithm: v.number(),\n    /** Signature counter for clone detection. Many authenticators return 0. */\n    counter: v.number(),\n    /** Authenticator transport hints (e.g. \"internal\", \"hybrid\", \"usb\", \"ble\", \"nfc\"). */\n    transports: v.optional(v.array(v.string())),\n    /** Whether this is a single-device or multi-device (synced) credential. */\n    deviceType: v.string(),\n    /** Whether the credential is backed up (synced passkey). */\n    backedUp: v.boolean(),\n    /** User-assigned friendly name (e.g. \"MacBook Touch ID\"). */\n    name: v.optional(v.string()),\n    createdAt: v.number(),\n    lastUsedAt: v.optional(v.number()),\n  })\n    .index(\"user_id\", [\"userId\"])\n    .index(\"credential_id\", [\"credentialId\"]),\n\n  /**\n   * TOTP two-factor authentication secrets. Each record links a user to\n   * an authenticator app. A user can have multiple TOTP enrollments\n   * (e.g. different authenticator apps) but typically has one.\n   *\n   * The `verified` flag indicates whether the user has completed setup\n   * by successfully entering a code from their authenticator app.\n   * Unverified enrollments are in-progress setup that can be discarded.\n   */\n  TotpFactor: defineTable({\n    userId: v.id(\"User\"),\n    /** Raw TOTP secret key bytes. */\n    secret: v.bytes(),\n    /** Number of digits in each code (typically 6). */\n    digits: v.number(),\n    /** Time period in seconds for code rotation (typically 30). */\n    period: v.number(),\n    /** Whether setup has been confirmed with a valid code. */\n    verified: v.boolean(),\n    /** User-assigned friendly name (e.g. \"Google Authenticator\"). */\n    name: v.optional(v.string()),\n    createdAt: v.number(),\n    lastUsedAt: v.optional(v.number()),\n  })\n    .index(\"user_id\", [\"userId\"])\n    .index(\"user_id_verified\", [\"userId\", \"verified\"]),\n\n  /**\n   * Device authorization codes (RFC 8628). Each record tracks a pending\n   * device auth session — the device polls with `deviceCode` while the\n   * user authorizes via `userCode` on a secondary device.\n   */\n  DeviceCode: defineTable({\n    /** High-entropy code used by the device for polling. Stored as SHA-256 hash. */\n    deviceCodeHash: v.string(),\n    /** Short human-readable code the user enters (e.g. \"WDJB-MJHT\"). */\n    userCode: v.string(),\n    /** Expiration timestamp (ms since epoch). */\n    expiresAt: v.number(),\n    /** Minimum polling interval in seconds. */\n    interval: v.number(),\n    /** Current status of this device authorization session. */\n    status: vDeviceStatus,\n    /** Set when the user authorizes — links to the authorizing user. */\n    userId: v.optional(v.id(\"User\")),\n    /** Set when the user authorizes — the session created for the device. */\n    sessionId: v.optional(v.id(\"Session\")),\n    /** Timestamp of the last poll request (for slow_down enforcement). */\n    lastPolledAt: v.optional(v.number()),\n  })\n    .index(\"device_code_hash\", [\"deviceCodeHash\"])\n    .index(\"user_code_status\", [\"userCode\", \"status\"]),\n\n  /**\n   * Rate limit tracking for OTP and password sign-in attempts.\n   */\n  RateLimit: defineTable({\n    identifier: v.string(),\n    last_attempt_time: v.number(),\n    attempts_left: v.number(),\n  }).index(\"by_identifier\", [\"identifier\"]),\n\n  /**\n   * Hierarchical groups. A group with no `parentGroupId` is a root group.\n   * Groups can nest arbitrarily deep via `parentGroupId` for modeling\n   * organizations, teams, departments, or any tree structure.\n   */\n  Group: defineTable({\n    name: v.string(),\n    slug: v.optional(v.string()),\n    type: v.optional(v.string()),\n    parentGroupId: v.optional(v.id(\"Group\")),\n    /** Denormalized root group ID. Self-referencing for root groups. */\n    rootGroupId: v.optional(v.id(\"Group\")),\n    /** Denormalized flag: `true` when `parentGroupId` is absent. */\n    isRoot: v.optional(v.boolean()),\n    /** Faceted classification tags. Normalized at write time (trimmed, lowercased). */\n    tags: v.optional(v.array(vTag)),\n    extend: v.optional(v.any()),\n  })\n    .index(\"slug\", [\"slug\"])\n    .index(\"parent_group_id\", [\"parentGroupId\"])\n    .index(\"root_group_id\", [\"rootGroupId\"])\n    .index(\"is_root\", [\"isRoot\"])\n    .index(\"type\", [\"type\"])\n    .index(\"type_parent_group_id\", [\"type\", \"parentGroupId\"]),\n\n  /**\n   * Denormalized group-tag index table for efficient tag-based filtering.\n   * Each row maps one `(key, value)` pair to a group. Kept in sync by\n   * `groupCreate`, `groupUpdate`, and `groupDelete`.\n   */\n  GroupTag: defineTable({\n    group_id: v.id(\"Group\"),\n    key: v.string(),\n    value: v.string(),\n  })\n    .index(\"by_group\", [\"group_id\"])\n    .index(\"by_key_value\", [\"key\", \"value\"])\n    .index(\"by_key\", [\"key\"]),\n\n  /**\n   * Group membership. Links a user to a group with an application-defined\n   * role (e.g. \"owner\", \"admin\", \"member\", \"viewer\"). A user can be a\n   * member of multiple groups with different roles in each.\n   */\n  GroupMember: defineTable({\n    groupId: v.id(\"Group\"),\n    userId: v.id(\"User\"),\n    role: v.optional(v.string()),\n    roleIds: v.optional(v.array(v.string())),\n    status: v.optional(v.string()),\n    extend: v.optional(v.any()),\n  })\n    .index(\"group_id\", [\"groupId\"])\n    .index(\"group_id_user_id\", [\"groupId\", \"userId\"])\n    .index(\"group_id_status\", [\"groupId\", \"status\"])\n    .index(\"user_id\", [\"userId\"]),\n\n  /**\n   * Invitations. Tracks pending, accepted, revoked, and expired\n   * invitations. Optionally scoped to a group via `groupId`, or\n   * platform-level when `groupId` is omitted.\n   *\n   * `email` and `invitedByUserId` are optional to support CLI-generated\n   * invite links where neither is known upfront.\n   */\n  GroupInvite: defineTable({\n    groupId: v.optional(v.id(\"Group\")),\n    invitedByUserId: v.optional(v.id(\"User\")),\n    email: v.optional(v.string()),\n    tokenHash: v.string(),\n    role: v.optional(v.string()),\n    roleIds: v.optional(v.array(v.string())),\n    status: vInviteStatus,\n    expiresTime: v.optional(v.number()),\n    acceptedByUserId: v.optional(v.id(\"User\")),\n    acceptedTime: v.optional(v.number()),\n    extend: v.optional(v.any()),\n  })\n    .index(\"token_hash\", [\"tokenHash\"])\n    .index(\"status\", [\"status\"])\n    .index(\"email_status\", [\"email\", \"status\"])\n    .index(\"invited_by_user_id_status\", [\"invitedByUserId\", \"status\"])\n    .index(\"group_id\", [\"groupId\"])\n    .index(\"group_id_status\", [\"groupId\", \"status\"]),\n\n  /**\n   * Enterprise configuration attached to a root group/organization.\n   *\n   * The `config` payload intentionally stays flexible so the headless enterprise\n   * SDK can evolve without forcing schema churn for every protocol-specific\n   * field addition.\n   */\n  Enterprise: defineTable({\n    groupId: v.id(\"Group\"),\n    slug: v.optional(v.string()),\n    name: v.optional(v.string()),\n    status: vEnterpriseStatus,\n    policy: v.optional(vEnterprisePolicy),\n    config: v.optional(v.any()),\n    extend: v.optional(v.any()),\n  })\n    .index(\"group_id\", [\"groupId\"])\n    .index(\"slug\", [\"slug\"])\n    .index(\"status\", [\"status\"]),\n\n  /**\n   * Verified or pending domains linked to an enterprise record.\n   */\n  EnterpriseDomain: defineTable({\n    enterpriseId: v.id(\"Enterprise\"),\n    groupId: v.id(\"Group\"),\n    domain: v.string(),\n    isPrimary: v.boolean(),\n    verifiedAt: v.optional(v.number()),\n  })\n    .index(\"enterprise_id\", [\"enterpriseId\"])\n    .index(\"group_id\", [\"groupId\"])\n    .index(\"domain\", [\"domain\"]),\n\n  /**\n   * Pending DNS TXT verification challenges for enterprise domains.\n   */\n  EnterpriseDomainVerification: defineTable({\n    enterpriseId: v.id(\"Enterprise\"),\n    groupId: v.id(\"Group\"),\n    domainId: v.id(\"EnterpriseDomain\"),\n    domain: v.string(),\n    recordName: v.string(),\n    token: v.string(),\n    tokenHash: v.string(),\n    requestedAt: v.number(),\n    expiresAt: v.number(),\n  })\n    .index(\"enterprise_id\", [\"enterpriseId\"])\n    .index(\"domain_id\", [\"domainId\"])\n    .index(\"token_hash\", [\"tokenHash\"]),\n\n  /**\n   * Encrypted enterprise secrets stored separately from protocol config.\n   */\n  EnterpriseSecret: defineTable({\n    enterpriseId: v.id(\"Enterprise\"),\n    groupId: v.id(\"Group\"),\n    kind: vEnterpriseSecretKind,\n    ciphertext: v.string(),\n    updatedAt: v.number(),\n  })\n    .index(\"enterprise_id\", [\"enterpriseId\"])\n    .index(\"enterprise_id_kind\", [\"enterpriseId\", \"kind\"])\n    .index(\"group_id\", [\"groupId\"]),\n\n  /**\n   * SCIM configuration for an enterprise tenant.\n   */\n  EnterpriseScimConfig: defineTable({\n    enterpriseId: v.id(\"Enterprise\"),\n    groupId: v.id(\"Group\"),\n    status: vScimStatus,\n    basePath: v.string(),\n    tokenHash: v.string(),\n    lastRotatedAt: v.optional(v.number()),\n    extend: v.optional(v.any()),\n  })\n    .index(\"enterprise_id\", [\"enterpriseId\"])\n    .index(\"group_id\", [\"groupId\"])\n    .index(\"token_hash\", [\"tokenHash\"])\n    .index(\"status\", [\"status\"]),\n\n  /**\n   * External SCIM identities mapped into local users/groups.\n   */\n  EnterpriseScimIdentity: defineTable({\n    enterpriseId: v.id(\"Enterprise\"),\n    groupId: v.id(\"Group\"),\n    resourceType: vScimResourceType,\n    externalId: v.string(),\n    userId: v.optional(v.id(\"User\")),\n    mappedGroupId: v.optional(v.id(\"Group\")),\n    lastProvisionedAt: v.optional(v.number()),\n    active: v.optional(v.boolean()),\n    raw: v.optional(v.any()),\n  })\n    .index(\"enterprise_id\", [\"enterpriseId\"])\n    .index(\"group_id\", [\"groupId\"])\n    .index(\"enterprise_id_resource_type_external_id\", [\n      \"enterpriseId\",\n      \"resourceType\",\n      \"externalId\",\n    ])\n    .index(\"enterprise_id_user_id\", [\"enterpriseId\", \"userId\"])\n    .index(\"user_id\", [\"userId\"])\n    .index(\"mapped_group_id\", [\"mappedGroupId\"]),\n\n  /**\n   * Immutable audit trail for enterprise operations.\n   */\n  EnterpriseAuditEvent: defineTable({\n    enterpriseId: v.id(\"Enterprise\"),\n    groupId: v.id(\"Group\"),\n    eventType: v.string(),\n    actorType: vAuditActorType,\n    actorId: v.optional(v.string()),\n    subjectType: v.string(),\n    subjectId: v.optional(v.string()),\n    status: vAuditStatus,\n    occurredAt: v.number(),\n    requestId: v.optional(v.string()),\n    ip: v.optional(v.string()),\n    metadata: v.optional(v.any()),\n  })\n    .index(\"enterprise_id_occurred_at\", [\"enterpriseId\", \"occurredAt\"])\n    .index(\"group_id_occurred_at\", [\"groupId\", \"occurredAt\"])\n    .index(\"event_type_occurred_at\", [\"eventType\", \"occurredAt\"]),\n\n  /**\n   * Webhook endpoints subscribed to enterprise audit and lifecycle events.\n   */\n  EnterpriseWebhookEndpoint: defineTable({\n    enterpriseId: v.id(\"Enterprise\"),\n    groupId: v.id(\"Group\"),\n    url: v.string(),\n    status: vWebhookEndpointStatus,\n    secretHash: v.string(),\n    subscriptions: v.array(v.string()),\n    createdByUserId: v.optional(v.id(\"User\")),\n    lastSuccessAt: v.optional(v.number()),\n    lastFailureAt: v.optional(v.number()),\n    failureCount: v.number(),\n    extend: v.optional(v.any()),\n  })\n    .index(\"enterprise_id\", [\"enterpriseId\"])\n    .index(\"group_id\", [\"groupId\"])\n    .index(\"status\", [\"status\"]),\n\n  /**\n   * Delivery queue for outbound enterprise webhooks.\n   */\n  EnterpriseWebhookDelivery: defineTable({\n    enterpriseId: v.id(\"Enterprise\"),\n    endpointId: v.id(\"EnterpriseWebhookEndpoint\"),\n    auditEventId: v.optional(v.id(\"EnterpriseAuditEvent\")),\n    eventType: v.string(),\n    status: vWebhookDeliveryStatus,\n    attemptCount: v.number(),\n    nextAttemptAt: v.number(),\n    lastAttemptAt: v.optional(v.number()),\n    lastResponseStatus: v.optional(v.number()),\n    lastError: v.optional(v.string()),\n    payload: v.any(),\n  })\n    .index(\"enterprise_id\", [\"enterpriseId\"])\n    .index(\"status_next_attempt_at\", [\"status\", \"nextAttemptAt\"])\n    .index(\"endpoint_id_status\", [\"endpointId\", \"status\"])\n    .index(\"audit_event_id\", [\"auditEventId\"]),\n\n  /**\n   * API keys for programmatic access. Each key links a user to a set of\n   * scoped permissions and optional per-key rate limiting.\n   *\n   * The raw key is never stored — only a SHA-256 hash. A short prefix\n   * (e.g. \"sk_abc1...\") is kept for display in admin interfaces.\n   *\n   * Keys support:\n   * - **Scoped permissions**: resource:action pairs (e.g. users:read)\n   * - **Per-key rate limiting**: token-bucket with configurable window\n   * - **Expiration**: optional TTL\n   * - **Soft revocation**: `revoked` flag preserves audit trail\n   */\n  ApiKey: defineTable({\n    userId: v.id(\"User\"),\n    /** First chars of the key for display (e.g. \"sk_abc1...\"). */\n    prefix: v.string(),\n    /** SHA-256 hex hash of the full raw key. */\n    hashedKey: v.string(),\n    /** User-assigned name (e.g. \"CI Pipeline\", \"Production API\"). */\n    name: v.string(),\n    /** Scoped permissions: [{ resource: \"users\", actions: [\"read\", \"list\"] }]. */\n    scopes: v.array(vApiKeyScope),\n    /** Optional per-key rate limit configuration. */\n    rateLimit: v.optional(vApiKeyRateLimit),\n    /** Rate limit state tracking (token-bucket). */\n    rateLimitState: v.optional(vApiKeyRateLimitState),\n    /** Expiration timestamp. Null/undefined = never expires. */\n    expiresAt: v.optional(v.number()),\n    lastUsedAt: v.optional(v.number()),\n    createdAt: v.number(),\n    /** Soft-revoke flag. Revoked keys are kept for audit trail. */\n    revoked: v.boolean(),\n    /** Arbitrary app-specific metadata attached to the key. */\n    metadata: v.optional(v.any()),\n  })\n    .index(\"user_id\", [\"userId\"])\n    .index(\"hashed_key\", [\"hashedKey\"]),\n});\n"],"mappings":";;;;;;;;;;;;AA4BA,qBAAe,aAAa;CAK1B,MAAM,YAAY;EAChB,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC5B,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC7B,uBAAuB,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC7C,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC7B,uBAAuB,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC7C,aAAa,EAAE,SAAS,EAAE,SAAS,CAAC;EACpC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC;EAC5B,CAAC,CACC,MAAM,SAAS,CAAC,QAAQ,CAAC,CACzB,MAAM,kBAAkB,CAAC,SAAS,wBAAwB,CAAC,CAC3D,MAAM,SAAS,CAAC,QAAQ,CAAC,CACzB,MAAM,kBAAkB,CAAC,SAAS,wBAAwB,CAAC;CAO9D,SAAS,YAAY;EACnB,QAAQ,EAAE,GAAG,OAAO;EACpB,gBAAgB,EAAE,QAAQ;EAC3B,CAAC,CAAC,MAAM,WAAW,CAAC,SAAS,CAAC;CAO/B,SAAS,YAAY;EACnB,QAAQ,EAAE,GAAG,OAAO;EACpB,UAAU,EAAE,QAAQ;EACpB,mBAAmB,EAAE,QAAQ;EAC7B,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC9B,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC;EACrC,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC;EACrC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC;EAC5B,CAAC,CACC,MAAM,oBAAoB,CAAC,UAAU,WAAW,CAAC,CACjD,MAAM,uBAAuB,CAAC,YAAY,oBAAoB,CAAC;CAUlE,cAAc,YAAY;EACxB,WAAW,EAAE,GAAG,UAAU;EAC1B,gBAAgB,EAAE,QAAQ;EAC1B,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC;EACrC,sBAAsB,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC;EACvD,CAAC,CACC,MAAM,cAAc,CAAC,YAAY,CAAC,CAClC,MAAM,yBAAyB,CAAC,aAAa,gBAAgB,CAAC,CAC9D,MAAM,sCAAsC,CAC3C,aACA,uBACD,CAAC;CAKJ,kBAAkB,YAAY;EAC5B,WAAW,EAAE,GAAG,UAAU;EAC1B,UAAU,EAAE,QAAQ;EACpB,MAAM,EAAE,QAAQ;EAChB,gBAAgB,EAAE,QAAQ;EAC1B,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;EAChC,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC;EACrC,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC;EACtC,CAAC,CACC,MAAM,cAAc,CAAC,YAAY,CAAC,CAClC,MAAM,QAAQ,CAAC,OAAO,CAAC;CAM1B,cAAc,YAAY;EACxB,WAAW,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC;EACtC,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC;EAClC,CAAC,CAAC,MAAM,aAAa,CAAC,YAAY,CAAC;CAOpC,SAAS,YAAY;EACnB,QAAQ,EAAE,GAAG,OAAO;EAEpB,cAAc,EAAE,QAAQ;EAExB,WAAW,EAAE,OAAO;EAEpB,WAAW,EAAE,QAAQ;EAErB,SAAS,EAAE,QAAQ;EAEnB,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;EAE3C,YAAY,EAAE,QAAQ;EAEtB,UAAU,EAAE,SAAS;EAErB,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC5B,WAAW,EAAE,QAAQ;EACrB,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC;EACnC,CAAC,CACC,MAAM,WAAW,CAAC,SAAS,CAAC,CAC5B,MAAM,iBAAiB,CAAC,eAAe,CAAC;CAW3C,YAAY,YAAY;EACtB,QAAQ,EAAE,GAAG,OAAO;EAEpB,QAAQ,EAAE,OAAO;EAEjB,QAAQ,EAAE,QAAQ;EAElB,QAAQ,EAAE,QAAQ;EAElB,UAAU,EAAE,SAAS;EAErB,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC5B,WAAW,EAAE,QAAQ;EACrB,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC;EACnC,CAAC,CACC,MAAM,WAAW,CAAC,SAAS,CAAC,CAC5B,MAAM,oBAAoB,CAAC,UAAU,WAAW,CAAC;CAOpD,YAAY,YAAY;EAEtB,gBAAgB,EAAE,QAAQ;EAE1B,UAAU,EAAE,QAAQ;EAEpB,WAAW,EAAE,QAAQ;EAErB,UAAU,EAAE,QAAQ;EAEpB,QAAQ;EAER,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;EAEhC,WAAW,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC;EAEtC,cAAc,EAAE,SAAS,EAAE,QAAQ,CAAC;EACrC,CAAC,CACC,MAAM,oBAAoB,CAAC,iBAAiB,CAAC,CAC7C,MAAM,oBAAoB,CAAC,YAAY,SAAS,CAAC;CAKpD,WAAW,YAAY;EACrB,YAAY,EAAE,QAAQ;EACtB,mBAAmB,EAAE,QAAQ;EAC7B,eAAe,EAAE,QAAQ;EAC1B,CAAC,CAAC,MAAM,iBAAiB,CAAC,aAAa,CAAC;CAOzC,OAAO,YAAY;EACjB,MAAM,EAAE,QAAQ;EAChB,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC5B,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC5B,eAAe,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;EAExC,aAAa,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;EAEtC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC;EAE/B,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,CAAC;EAC/B,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC;EAC5B,CAAC,CACC,MAAM,QAAQ,CAAC,OAAO,CAAC,CACvB,MAAM,mBAAmB,CAAC,gBAAgB,CAAC,CAC3C,MAAM,iBAAiB,CAAC,cAAc,CAAC,CACvC,MAAM,WAAW,CAAC,SAAS,CAAC,CAC5B,MAAM,QAAQ,CAAC,OAAO,CAAC,CACvB,MAAM,wBAAwB,CAAC,QAAQ,gBAAgB,CAAC;CAO3D,UAAU,YAAY;EACpB,UAAU,EAAE,GAAG,QAAQ;EACvB,KAAK,EAAE,QAAQ;EACf,OAAO,EAAE,QAAQ;EAClB,CAAC,CACC,MAAM,YAAY,CAAC,WAAW,CAAC,CAC/B,MAAM,gBAAgB,CAAC,OAAO,QAAQ,CAAC,CACvC,MAAM,UAAU,CAAC,MAAM,CAAC;CAO3B,aAAa,YAAY;EACvB,SAAS,EAAE,GAAG,QAAQ;EACtB,QAAQ,EAAE,GAAG,OAAO;EACpB,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC5B,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;EACxC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC9B,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC;EAC5B,CAAC,CACC,MAAM,YAAY,CAAC,UAAU,CAAC,CAC9B,MAAM,oBAAoB,CAAC,WAAW,SAAS,CAAC,CAChD,MAAM,mBAAmB,CAAC,WAAW,SAAS,CAAC,CAC/C,MAAM,WAAW,CAAC,SAAS,CAAC;CAU/B,aAAa,YAAY;EACvB,SAAS,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;EAClC,iBAAiB,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;EACzC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC7B,WAAW,EAAE,QAAQ;EACrB,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC5B,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;EACxC,QAAQ;EACR,aAAa,EAAE,SAAS,EAAE,QAAQ,CAAC;EACnC,kBAAkB,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;EAC1C,cAAc,EAAE,SAAS,EAAE,QAAQ,CAAC;EACpC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC;EAC5B,CAAC,CACC,MAAM,cAAc,CAAC,YAAY,CAAC,CAClC,MAAM,UAAU,CAAC,SAAS,CAAC,CAC3B,MAAM,gBAAgB,CAAC,SAAS,SAAS,CAAC,CAC1C,MAAM,6BAA6B,CAAC,mBAAmB,SAAS,CAAC,CACjE,MAAM,YAAY,CAAC,UAAU,CAAC,CAC9B,MAAM,mBAAmB,CAAC,WAAW,SAAS,CAAC;CASlD,YAAY,YAAY;EACtB,SAAS,EAAE,GAAG,QAAQ;EACtB,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC5B,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC5B,QAAQ;EACR,QAAQ,EAAE,SAAS,kBAAkB;EACrC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC;EAC3B,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC;EAC5B,CAAC,CACC,MAAM,YAAY,CAAC,UAAU,CAAC,CAC9B,MAAM,QAAQ,CAAC,OAAO,CAAC,CACvB,MAAM,UAAU,CAAC,SAAS,CAAC;CAK9B,kBAAkB,YAAY;EAC5B,cAAc,EAAE,GAAG,aAAa;EAChC,SAAS,EAAE,GAAG,QAAQ;EACtB,QAAQ,EAAE,QAAQ;EAClB,WAAW,EAAE,SAAS;EACtB,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC;EACnC,CAAC,CACC,MAAM,iBAAiB,CAAC,eAAe,CAAC,CACxC,MAAM,YAAY,CAAC,UAAU,CAAC,CAC9B,MAAM,UAAU,CAAC,SAAS,CAAC;CAK9B,8BAA8B,YAAY;EACxC,cAAc,EAAE,GAAG,aAAa;EAChC,SAAS,EAAE,GAAG,QAAQ;EACtB,UAAU,EAAE,GAAG,mBAAmB;EAClC,QAAQ,EAAE,QAAQ;EAClB,YAAY,EAAE,QAAQ;EACtB,OAAO,EAAE,QAAQ;EACjB,WAAW,EAAE,QAAQ;EACrB,aAAa,EAAE,QAAQ;EACvB,WAAW,EAAE,QAAQ;EACtB,CAAC,CACC,MAAM,iBAAiB,CAAC,eAAe,CAAC,CACxC,MAAM,aAAa,CAAC,WAAW,CAAC,CAChC,MAAM,cAAc,CAAC,YAAY,CAAC;CAKrC,kBAAkB,YAAY;EAC5B,cAAc,EAAE,GAAG,aAAa;EAChC,SAAS,EAAE,GAAG,QAAQ;EACtB,MAAM;EACN,YAAY,EAAE,QAAQ;EACtB,WAAW,EAAE,QAAQ;EACtB,CAAC,CACC,MAAM,iBAAiB,CAAC,eAAe,CAAC,CACxC,MAAM,sBAAsB,CAAC,gBAAgB,OAAO,CAAC,CACrD,MAAM,YAAY,CAAC,UAAU,CAAC;CAKjC,sBAAsB,YAAY;EAChC,cAAc,EAAE,GAAG,aAAa;EAChC,SAAS,EAAE,GAAG,QAAQ;EACtB,QAAQ;EACR,UAAU,EAAE,QAAQ;EACpB,WAAW,EAAE,QAAQ;EACrB,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC;EACrC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC;EAC5B,CAAC,CACC,MAAM,iBAAiB,CAAC,eAAe,CAAC,CACxC,MAAM,YAAY,CAAC,UAAU,CAAC,CAC9B,MAAM,cAAc,CAAC,YAAY,CAAC,CAClC,MAAM,UAAU,CAAC,SAAS,CAAC;CAK9B,wBAAwB,YAAY;EAClC,cAAc,EAAE,GAAG,aAAa;EAChC,SAAS,EAAE,GAAG,QAAQ;EACtB,cAAc;EACd,YAAY,EAAE,QAAQ;EACtB,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;EAChC,eAAe,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;EACxC,mBAAmB,EAAE,SAAS,EAAE,QAAQ,CAAC;EACzC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC;EAC/B,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC;EACzB,CAAC,CACC,MAAM,iBAAiB,CAAC,eAAe,CAAC,CACxC,MAAM,YAAY,CAAC,UAAU,CAAC,CAC9B,MAAM,2CAA2C;EAChD;EACA;EACA;EACD,CAAC,CACD,MAAM,yBAAyB,CAAC,gBAAgB,SAAS,CAAC,CAC1D,MAAM,WAAW,CAAC,SAAS,CAAC,CAC5B,MAAM,mBAAmB,CAAC,gBAAgB,CAAC;CAK9C,sBAAsB,YAAY;EAChC,cAAc,EAAE,GAAG,aAAa;EAChC,SAAS,EAAE,GAAG,QAAQ;EACtB,WAAW,EAAE,QAAQ;EACrB,WAAW;EACX,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC/B,aAAa,EAAE,QAAQ;EACvB,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC;EACjC,QAAQ;EACR,YAAY,EAAE,QAAQ;EACtB,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC;EACjC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC1B,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC;EAC9B,CAAC,CACC,MAAM,6BAA6B,CAAC,gBAAgB,aAAa,CAAC,CAClE,MAAM,wBAAwB,CAAC,WAAW,aAAa,CAAC,CACxD,MAAM,0BAA0B,CAAC,aAAa,aAAa,CAAC;CAK/D,2BAA2B,YAAY;EACrC,cAAc,EAAE,GAAG,aAAa;EAChC,SAAS,EAAE,GAAG,QAAQ;EACtB,KAAK,EAAE,QAAQ;EACf,QAAQ;EACR,YAAY,EAAE,QAAQ;EACtB,eAAe,EAAE,MAAM,EAAE,QAAQ,CAAC;EAClC,iBAAiB,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;EACzC,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC;EACrC,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC;EACrC,cAAc,EAAE,QAAQ;EACxB,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC;EAC5B,CAAC,CACC,MAAM,iBAAiB,CAAC,eAAe,CAAC,CACxC,MAAM,YAAY,CAAC,UAAU,CAAC,CAC9B,MAAM,UAAU,CAAC,SAAS,CAAC;CAK9B,2BAA2B,YAAY;EACrC,cAAc,EAAE,GAAG,aAAa;EAChC,YAAY,EAAE,GAAG,4BAA4B;EAC7C,cAAc,EAAE,SAAS,EAAE,GAAG,uBAAuB,CAAC;EACtD,WAAW,EAAE,QAAQ;EACrB,QAAQ;EACR,cAAc,EAAE,QAAQ;EACxB,eAAe,EAAE,QAAQ;EACzB,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC;EACrC,oBAAoB,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC1C,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC;EACjC,SAAS,EAAE,KAAK;EACjB,CAAC,CACC,MAAM,iBAAiB,CAAC,eAAe,CAAC,CACxC,MAAM,0BAA0B,CAAC,UAAU,gBAAgB,CAAC,CAC5D,MAAM,sBAAsB,CAAC,cAAc,SAAS,CAAC,CACrD,MAAM,kBAAkB,CAAC,eAAe,CAAC;CAe5C,QAAQ,YAAY;EAClB,QAAQ,EAAE,GAAG,OAAO;EAEpB,QAAQ,EAAE,QAAQ;EAElB,WAAW,EAAE,QAAQ;EAErB,MAAM,EAAE,QAAQ;EAEhB,QAAQ,EAAE,MAAM,aAAa;EAE7B,WAAW,EAAE,SAAS,iBAAiB;EAEvC,gBAAgB,EAAE,SAAS,sBAAsB;EAEjD,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC;EACjC,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC;EAClC,WAAW,EAAE,QAAQ;EAErB,SAAS,EAAE,SAAS;EAEpB,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC;EAC9B,CAAC,CACC,MAAM,WAAW,CAAC,SAAS,CAAC,CAC5B,MAAM,cAAc,CAAC,YAAY,CAAC;CACtC,CAAC"}