@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/component/server/auth.js

@@ -1,254 +0,0 @@
-import { createUnauthenticatedAuthContext, getAuthContext } from "./context.js";
-import { Auth } from "./runtime.js";
-import { Cv } from "@robelest/fx/convex";
-
-//#region src/server/auth.ts
-/**
-* Auth configuration helpers for Convex Auth.
-*
-* @module
-*/
-/**
-* Create an auth API object.
-*
-* When `new SSO()` is included in providers, `auth.sso` and `auth.scim`
-* are available on the returned object. Without it, those namespaces are
-* absent and accessing them is a TypeScript compile error.
-*
-* @param component - The installed auth component reference from
-*   `components.auth` in your Convex app definition.
-* @param config - Auth configuration including `providers` and optional
-*   `authorization`. All fields from {@link AuthConfig} are accepted
-*   except `component` (passed as the first argument).
-* @returns A {@link ConvexAuthResult} object — either {@link AuthApi}
-*   (with `sso`/`scim`) or {@link AuthApiBase}, depending on whether
-*   an SSO provider is present.
-*
-* @example
-* ```ts
-* export const auth = createAuth(components.auth, {
-*   providers: [password(), google()],
-*   authorization: { roles },
-* });
-* ```
-*
-* @see {@link AuthContextConfig}
-*/
-async function resolveConfiguredAuthContext(auth, ctx, config) {
-	const fallback = () => getAuthContext(auth, ctx);
-	const authOverride = config?.authResolve ? await config.authResolve(ctx, fallback) : void 0;
-	return authOverride === void 0 ? await fallback() : authOverride;
-}
-function createNotSignedInError() {
-	return Cv.error({
-		code: "NOT_SIGNED_IN",
-		message: "Authentication required."
-	});
-}
-async function createPublicAuthContext(auth, ctx, config) {
-	const resolved = await resolveConfiguredAuthContext(auth, ctx, config);
-	if (resolved === null) {
-		if (config?.optional !== true) throw createNotSignedInError();
-		return createUnauthenticatedAuthContext();
-	}
-	const extra = config?.resolve ? await config.resolve(ctx, resolved.user, resolved) : {};
-	return {
-		...resolved,
-		...extra
-	};
-}
-function createAuth(component, config) {
-	const authResult = Auth({
-		...config,
-		component,
-		providers: [...config.providers]
-	});
-	const { domain: domainApi, scim: scimApi, connection: connectionApi, audit: auditApi, webhook: webhookApi, oidc: oidcApi, saml: samlApi, ...restSso } = authResult.auth.sso;
-	const setEnterpriseDomains = async (ctx, enterpriseId, domains) => {
-		const enterprise = await connectionApi.get(ctx, enterpriseId);
-		if (enterprise === null) throw Cv.error({
-			code: "INVALID_PARAMETERS",
-			message: "Enterprise not found."
-		});
-		const normalized = domains.map((entry) => ({
-			...entry,
-			domain: entry.domain.trim().toLowerCase()
-		}));
-		const deduped = /* @__PURE__ */ new Map();
-		for (const entry of normalized) {
-			if (entry.domain.length === 0) throw Cv.error({
-				code: "INVALID_PARAMETERS",
-				message: "Domain must not be empty."
-			});
-			if (deduped.has(entry.domain)) throw Cv.error({
-				code: "INVALID_PARAMETERS",
-				message: `Duplicate domain: ${entry.domain}`
-			});
-			deduped.set(entry.domain, entry);
-		}
-		const nextDomains = [...deduped.values()];
-		const primaryCount = nextDomains.filter((entry) => entry.isPrimary).length;
-		if (primaryCount > 1) throw Cv.error({
-			code: "INVALID_PARAMETERS",
-			message: "Only one primary domain may be set."
-		});
-		if (nextDomains.length > 0 && primaryCount === 0) nextDomains[0] = {
-			...nextDomains[0],
-			isPrimary: true
-		};
-		const currentDomains = await domainApi.list(ctx, enterpriseId);
-		const currentByDomain = new Map(currentDomains.map((entry) => [entry.domain.toLowerCase(), entry]));
-		for (const existing of currentDomains) if (!deduped.has(existing.domain.toLowerCase())) await domainApi.remove(ctx, existing._id);
-		for (const nextDomain of nextDomains) {
-			const current = currentByDomain.get(nextDomain.domain);
-			if (current && current.isPrimary === Boolean(nextDomain.isPrimary)) continue;
-			if (current) await domainApi.remove(ctx, current._id);
-			const domainId = await domainApi.add(ctx, {
-				enterpriseId: enterprise._id,
-				groupId: enterprise.groupId,
-				domain: nextDomain.domain,
-				isPrimary: nextDomain.isPrimary
-			});
-			if (current?.verifiedAt !== void 0) await ctx.runMutation(component.public.enterpriseDomainVerify, {
-				domainId,
-				verifiedAt: current.verifiedAt
-			});
-		}
-		return {
-			enterpriseId,
-			domains: (await domainApi.list(ctx, enterpriseId)).map((domain) => ({
-				domainId: domain._id,
-				domain: domain.domain,
-				isPrimary: domain.isPrimary,
-				verified: domain.verifiedAt !== void 0,
-				verifiedAt: domain.verifiedAt ?? null
-			}))
-		};
-	};
-	const publicSso = {
-		admin: {
-			...restSso,
-			oidc: { ...oidcApi },
-			saml: { ...samlApi },
-			connection: {
-				...connectionApi,
-				domain: {
-					list: domainApi.list,
-					validate: domainApi.validate,
-					set: setEnterpriseDomains,
-					verification: {
-						request: domainApi.verification.request,
-						confirm: domainApi.verification.confirm
-					}
-				}
-			},
-			policy: restSso.policy,
-			audit: { list: auditApi.list },
-			webhook: {
-				endpoint: webhookApi.endpoint,
-				delivery: { list: webhookApi.delivery.list }
-			}
-		},
-		client: {
-			signIn: oidcApi.signIn,
-			metadata: samlApi.metadata
-		}
-	};
-	return {
-		signIn: authResult.signIn,
-		signOut: authResult.signOut,
-		store: authResult.store,
-		user: authResult.auth.user,
-		session: authResult.auth.session,
-		provider: authResult.auth.provider,
-		account: authResult.auth.account,
-		group: authResult.auth.group,
-		member: authResult.auth.member,
-		invite: authResult.auth.invite,
-		key: authResult.auth.key,
-		sso: publicSso,
-		scim: { admin: {
-			configure: scimApi.configure,
-			get: scimApi.get,
-			validate: scimApi.validate
-		} },
-		http: authResult.auth.http,
-		context: ((ctx, config$1) => createPublicAuthContext(authResult.auth, ctx, config$1)),
-		ctx: ((config$1) => createAuthContextCustomization(authResult.auth, config$1))
-	};
-}
-/**
-* Create a context enrichment for `customQuery` / `customMutation` — optional auth.
-*
-* When `optional: true` is set, unauthenticated requests are allowed.
-* The enriched `ctx.auth` will have `userId: null`, `user: null`,
-* `groupId: null`, `role: null`, and `grants: []` for unauthenticated callers.
-*
-* @param config - Configuration with `optional: true` and an optional
-*   `resolve` callback for attaching extra fields to the auth context.
-* @returns An object with `args` and `input` compatible with Convex
-*   custom function builders.
-*
-* @example
-* ```ts
-* const authCtx = auth.ctx({
-*   optional: true,
-*   resolve: async (_ctx, user) => ({ plan: user.extend?.plan ?? null }),
-* });
-* ```
-*
-* @see {@link createAuth}
-*/
-/**
-* Create a context enrichment for `customQuery` / `customMutation` — required auth (default).
-*
-* When `optional` is omitted or `false`, unauthenticated requests throw a
-* structured `ConvexError` before your handler runs.
-*
-* @param config - Optional configuration with a `resolve` callback
-*   for attaching extra fields to the auth context.
-* @returns An object with `args` and `input` compatible with Convex
-*   custom function builders.
-*
-* @example
-* ```ts
-* const authCtx = auth.ctx({
-*   resolve: async (_ctx, user) => ({ email: user.email }),
-* });
-* ```
-*
-* @see {@link createAuth}
-*/
-function createAuthContextCustomization(auth, config) {
-	return {
-		args: {},
-		input: async (ctx, _args, _extra) => {
-			const nativeAuth = ctx.auth;
-			const getUserIdentity = nativeAuth.getUserIdentity.bind(nativeAuth);
-			const resolved = await resolveConfiguredAuthContext(auth, ctx, config);
-			if (resolved === null) {
-				if (config?.optional !== true) throw createNotSignedInError();
-				return {
-					ctx: { auth: {
-						getUserIdentity,
-						...createUnauthenticatedAuthContext()
-					} },
-					args: {}
-				};
-			}
-			const extra = config?.resolve ? await config.resolve(ctx, resolved.user, resolved) : {};
-			return {
-				ctx: { auth: {
-					getUserIdentity,
-					...resolved,
-					...extra
-				} },
-				args: {}
-			};
-		}
-	};
-}
-
-//#endregion
-export { createAuth };
-//# sourceMappingURL=auth.js.map

package/dist/component/server/auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.js","names":["getResolvedAuthContext","AuthFactory","config"],"sources":["../../../src/server/auth.ts"],"sourcesContent":["/**\n * Auth configuration helpers for Convex Auth.\n *\n * @module\n */\n\nimport { Cv } from \"@robelest/fx/convex\";\nimport type { UserIdentity } from \"convex/server\";\nimport type { GenericId } from \"convex/values\";\n\nimport type { AuthApiRefs } from \"../client/index\";\nimport {\n  createUnauthenticatedAuthContext,\n  getAuthContext as getResolvedAuthContext,\n} from \"./context\";\nimport { Auth as AuthFactory } from \"./runtime\";\nimport type { Doc } from \"./types\";\nimport type {\n  AuthAuthorizationConfig,\n  AuthGrant,\n  AuthProviderConfig,\n  AuthRoleDefinition,\n  AuthRoleId,\n  ConvexAuthConfig,\n  HasDeviceProvider,\n  HasPasskeyProvider,\n  HasSSO,\n  HasTotpProvider,\n} from \"./types\";\n\n// ============================================================================\n// Types\n// ============================================================================\n\n/**\n * Config for auth setup. Extends the standard auth config\n * minus `component` (which is passed as the first constructor argument).\n */\nexport type AuthConfig = Omit<ConvexAuthConfig, \"component\">;\n\n/** Canonical user document type exposed by Convex Auth. */\nexport type UserDoc = Doc<\"User\">;\n\ntype MemberApiWithAuthorization<\n  TAuthorization extends AuthAuthorizationConfig | undefined,\n> = Omit<\n  ReturnType<typeof AuthFactory>[\"auth\"][\"member\"],\n  \"create\" | \"list\" | \"update\" | \"inspect\" | \"require\"\n> & {\n  create: (\n    ctx: Parameters<\n      ReturnType<typeof AuthFactory>[\"auth\"][\"member\"][\"create\"]\n    >[0],\n    data: {\n      groupId: string;\n      userId: string;\n      roleIds?: AuthRoleId<TAuthorization>[];\n      status?: string;\n      extend?: Record<string, unknown>;\n    },\n  ) => Promise<{ memberId: string }>;\n  list: (\n    ctx: Parameters<\n      ReturnType<typeof AuthFactory>[\"auth\"][\"member\"][\"list\"]\n    >[0],\n    opts?: {\n      where?: {\n        groupId?: string;\n        userId?: string;\n        roleId?: AuthRoleId<TAuthorization>;\n        status?: string;\n      };\n      limit?: number;\n      cursor?: string | null;\n      orderBy?: \"_creationTime\" | \"status\";\n      order?: \"asc\" | \"desc\";\n    },\n  ) => ReturnType<ReturnType<typeof AuthFactory>[\"auth\"][\"member\"][\"list\"]>;\n  update: (\n    ctx: Parameters<\n      ReturnType<typeof AuthFactory>[\"auth\"][\"member\"][\"update\"]\n    >[0],\n    memberId: string,\n    data: Record<string, unknown> & { roleIds?: AuthRoleId<TAuthorization>[] },\n  ) => Promise<{ memberId: string }>;\n  inspect: (\n    ctx: Parameters<\n      ReturnType<typeof AuthFactory>[\"auth\"][\"member\"][\"inspect\"]\n    >[0],\n    opts: {\n      userId: string;\n      groupId: string;\n      ancestry?: boolean;\n      maxDepth?: number;\n    },\n  ) => ReturnType<ReturnType<typeof AuthFactory>[\"auth\"][\"member\"][\"inspect\"]>;\n  require: (\n    ctx: Parameters<\n      ReturnType<typeof AuthFactory>[\"auth\"][\"member\"][\"require\"]\n    >[0],\n    opts: {\n      userId: string;\n      groupId: string;\n      ancestry?: boolean;\n      roleIds?: AuthRoleId<TAuthorization>[];\n      grants?: AuthGrant<TAuthorization>[];\n      maxDepth?: number;\n    },\n  ) => ReturnType<ReturnType<typeof AuthFactory>[\"auth\"][\"member\"][\"require\"]>;\n};\n\n/**\n * The base auth API surface returned by {@link createAuth}.\n *\n * Provides core namespaces — `signIn`, `signOut`, `user`, `session`,\n * `member`, `invite`, `group`, `key`, and `http` — that are\n * always available regardless of which providers are configured.\n * Enterprise namespaces (`sso`, `scim`) are added conditionally by\n * {@link AuthApi} when an SSO provider is present.\n *\n * Use this type when you want to describe code that only depends on the\n * standard auth surface and should not assume enterprise features exist.\n *\n * @typeParam TAuthorization - The authorization config, used to narrow\n *   role IDs and grant strings on the `member` API.\n */\nexport type AuthApiBase<\n  TAuthorization extends AuthAuthorizationConfig | undefined = undefined,\n> = {\n  signIn: ReturnType<typeof AuthFactory>[\"signIn\"];\n  signOut: ReturnType<typeof AuthFactory>[\"signOut\"];\n  store: ReturnType<typeof AuthFactory>[\"store\"];\n  user: ReturnType<typeof AuthFactory>[\"auth\"][\"user\"];\n  session: ReturnType<typeof AuthFactory>[\"auth\"][\"session\"];\n  provider: ReturnType<typeof AuthFactory>[\"auth\"][\"provider\"];\n  account: ReturnType<typeof AuthFactory>[\"auth\"][\"account\"];\n  group: ReturnType<typeof AuthFactory>[\"auth\"][\"group\"];\n  member: MemberApiWithAuthorization<TAuthorization>;\n  invite: ReturnType<typeof AuthFactory>[\"auth\"][\"invite\"];\n  key: ReturnType<typeof AuthFactory>[\"auth\"][\"key\"];\n  http: ReturnType<typeof AuthFactory>[\"auth\"][\"http\"];\n  /**\n   * Resolve the current request's auth context. Framework-agnostic — use\n   * this in fluent-convex middleware, custom wrappers, or anywhere you\n   * need the current `{ userId, user, groupId, role, grants }` object.\n   *\n   * Throws a structured `ConvexError` when unauthenticated by default.\n   * Pass `{ optional: true }` to get a null-shaped auth object instead.\n   *\n   * @param ctx - Convex query, mutation, or action context.\n   * @param config - Optional auth resolution config. Supports `optional`,\n   *   `resolve`, and `authResolve`.\n   * @returns The current auth context.\n   *\n   * @example fluent-convex middleware\n   * ```ts\n   * const withAuth = convex.createMiddleware(async (ctx, next) => {\n   *   return next({ ...ctx, auth: await auth.context(ctx) });\n   * });\n   * ```\n   *\n   * @example Direct usage in a handler\n    * ```ts\n    * const authContext = await auth.context(ctx);\n    * const { userId, grants } = authContext;\n    * ```\n    *\n    * @example Optional usage\n    * ```ts\n    * const authContext = await auth.context(ctx, { optional: true });\n    * if (authContext.userId === null) {\n    *   return null;\n    * }\n    * ```\n    */\n  context: AuthContextResolver;\n  /**\n   * Context enrichment for convex-helpers `customQuery` / `customMutation` /\n   * `customAction`.\n   *\n   * Resolves the current user's identity, active group, membership role,\n   * and grants, then attaches them to `ctx.auth`. Returns a `Customization`\n   * object compatible with convex-helpers' custom function builders.\n   *\n   * `ctx.auth` is the current request auth context.\n   * By default this throws when unauthenticated so handlers can assume\n   * `ctx.auth.userId` and `ctx.auth.user` exist.\n   *\n   * @returns A convex-helpers `Customization` object.\n   *\n   * @example One-time setup in `convex/functions.ts`\n   * ```ts\n   * import { query, mutation, action } from \"./_generated/server\";\n   * import { customQuery, customMutation, customAction } from \"convex-helpers/server/customFunctions\";\n   * import { auth } from \"./auth\";\n   *\n   * export const authQuery = customQuery(query, auth.ctx());\n   * export const authMutation = customMutation(mutation, auth.ctx());\n   * export const authAction = customAction(action, auth.ctx());\n   * ```\n   *\n   * @example Per-function usage\n   * ```ts\n   * import { authQuery } from \"./functions\";\n   *\n   * export const list = authQuery({\n   *   args: { workspaceId: v.string() },\n   *   handler: async (ctx, args) => {\n   *     const { userId, groupId, grants } = ctx.auth;\n   *     // business logic\n   *   },\n   * });\n   * ```\n   */\n  ctx: AuthContextFactory;\n};\n\n/**\n * Current request auth context injected into `ctx.auth` by `auth.ctx()`. This\n * is the authenticated auth shape returned by {@link createAuth().context}.\n * Optional context builders may still surface nullable fields when\n * `optional: true` is used.\n *\n * - `groupId` is `null` when the user has no active group set.\n * - `role` is `null` when no active group or no membership is resolved.\n * - `grants` is `[]` when no active group or no membership is resolved.\n *\n * @example\n * ```ts\n * import type { AuthContext } from \"@robelest/convex-auth/server\";\n *\n * const mockAuth: AuthContext = {\n *   userId: \"user123\" as Id<\"User\">,\n *   user: { _id: \"user123\", email: \"test@example.com\" },\n *   groupId: \"group456\",\n *   role: \"admin\",\n *   grants: [\"read\", \"write\"],\n * };\n * ```\n */\nexport type AuthContext = {\n  /** The authenticated user's document ID. */\n  userId: GenericId<\"User\">;\n  /** The authenticated user's full document. */\n  user: UserDoc;\n  /** The user's active group ID, or `null` if none set. */\n  groupId: string | null;\n  /** The user's primary role in the active group, or `null`. */\n  role: string | null;\n  /** Resolved grant strings from the user's role definitions. */\n  grants: string[];\n};\n\n/**\n * Nullable auth context returned by `auth.context(ctx, { optional: true })`\n * and injected by `auth.ctx({ optional: true })`.\n *\n * Use this when callers may be unauthenticated but you still want a stable\n * auth-shaped object.\n *\n * - `userId` and `user` are `null` when unauthenticated.\n * - `groupId` and `role` are `null` when no active group is resolved.\n * - `grants` is `[]` when no membership is resolved.\n *\n * @example\n * ```ts\n * const authContext = await auth.context(ctx, { optional: true });\n * if (authContext.userId === null) {\n *   return null;\n * }\n * ```\n */\nexport type OptionalAuthContext = {\n  /** The authenticated user's document ID, or `null` when unauthenticated. */\n  userId: GenericId<\"User\"> | null;\n  /** The authenticated user's full document, or `null` when unauthenticated. */\n  user: UserDoc | null;\n  /** The user's active group ID, or `null` if none is set. */\n  groupId: string | null;\n  /** The user's primary role in the active group, or `null`. */\n  role: string | null;\n  /** Resolved grant strings for the active membership, or `[]`. */\n  grants: string[];\n};\n\ntype AuthContextBase = {\n  getUserIdentity: () => Promise<UserIdentity | null>;\n};\n\ntype RequiredAuthContextState = AuthContextBase & AuthContext;\n\ntype OptionalAuthContextState = AuthContextBase & OptionalAuthContext;\n\ntype ResolvedAuthContext<TResolve> = AuthContext & TResolve;\n\ntype ResolvedOptionalAuthContext<TResolve> = OptionalAuthContext & TResolve;\n\ntype AuthContextResolver = {\n  <TResolve extends Record<string, unknown> = Record<string, never>>(\n    ctx: any,\n    config: AuthContextConfig<TResolve> & { optional: true },\n  ): Promise<ResolvedOptionalAuthContext<TResolve>>;\n  <TResolve extends Record<string, unknown> = Record<string, never>>(\n    ctx: any,\n    config?: AuthContextConfig<TResolve>,\n  ): Promise<ResolvedAuthContext<TResolve>>;\n};\n\ntype AuthContextCustomization<TAuth> = {\n  args: {};\n  input: (\n    ctx: any,\n    _args: any,\n    _extra?: any,\n  ) => Promise<{\n    ctx: {\n      auth: TAuth;\n    };\n    args: {};\n  }>;\n};\n\ntype AuthContextFactory = {\n  <TResolve extends Record<string, unknown> = Record<string, never>>(\n    config: AuthContextConfig<TResolve> & { optional: true },\n  ): AuthContextCustomization<OptionalAuthContextState & TResolve>;\n  <TResolve extends Record<string, unknown> = Record<string, never>>(\n    config?: AuthContextConfig<TResolve>,\n  ): AuthContextCustomization<RequiredAuthContextState & TResolve>;\n};\n\ntype InternalSsoApi = ReturnType<typeof AuthFactory>[\"auth\"][\"sso\"];\n\ntype PublicSsoAdminApi = {\n  connection: InternalSsoApi[\"connection\"] & {\n    domain: {\n      list: InternalSsoApi[\"domain\"][\"list\"];\n      validate: InternalSsoApi[\"domain\"][\"validate\"];\n      set: (\n        ctx: Parameters<InternalSsoApi[\"connection\"][\"create\"]>[0],\n        enterpriseId: string,\n        domains: Array<{\n          domain: string;\n          isPrimary?: boolean;\n        }>,\n      ) => Promise<{\n        enterpriseId: string;\n        domains: Array<{\n          domainId: string;\n          domain: string;\n          isPrimary: boolean;\n          verified: boolean;\n          verifiedAt: number | null;\n        }>;\n      }>;\n      verification: {\n        request: (\n          ctx: Parameters<InternalSsoApi[\"connection\"][\"create\"]>[0],\n          args: { enterpriseId: string; domain: string },\n        ) => Promise<{\n          enterpriseId: string;\n          domain: string;\n          requestedAt: number;\n          expiresAt: number;\n          challenge: {\n            recordType: \"TXT\";\n            recordName: string;\n            recordValue: string;\n          };\n        }>;\n        confirm: (\n          ctx: Parameters<InternalSsoApi[\"connection\"][\"create\"]>[0],\n          args: { enterpriseId: string; domain: string },\n        ) => Promise<{\n          enterpriseId: string;\n          domain: string;\n          verifiedAt?: number;\n          checks: Array<{ name: string; ok: boolean; message?: string }>;\n        }>;\n      };\n    };\n  };\n  oidc: Omit<InternalSsoApi[\"oidc\"], \"signIn\">;\n  saml: Omit<InternalSsoApi[\"saml\"], \"metadata\">;\n  policy: InternalSsoApi[\"policy\"];\n  audit: {\n    list: InternalSsoApi[\"audit\"][\"list\"];\n  };\n  webhook: {\n    endpoint: InternalSsoApi[\"webhook\"][\"endpoint\"];\n    delivery: {\n      list: InternalSsoApi[\"webhook\"][\"delivery\"][\"list\"];\n    };\n  };\n};\n\ntype PublicSsoClientApi = {\n  signIn: InternalSsoApi[\"oidc\"][\"signIn\"];\n  metadata: InternalSsoApi[\"saml\"][\"metadata\"];\n};\n\ntype PublicSsoApi = {\n  admin: PublicSsoAdminApi;\n  client: PublicSsoClientApi;\n};\n\ntype PublicScimApi = {\n  admin: Omit<InternalSsoApi[\"scim\"], \"getConfigByToken\" | \"identity\">;\n};\n\n/**\n * Extended auth API that includes enterprise SSO and SCIM namespaces.\n *\n * This type is the union of {@link AuthApiBase} plus `sso` (SSO connection\n * management, OIDC/SAML, domain verification, policies, audit, webhooks)\n * and `scim` (SCIM provisioning configuration). It is returned by\n * {@link createAuth} only when `new SSO()` is included in the providers\n * array; otherwise the narrower {@link AuthApiBase} is returned instead.\n * Attempting to access `auth.sso` or `auth.scim` without an SSO provider\n * produces a compile-time error because the return type narrows back to\n * {@link AuthApiBase}.\n *\n * @typeParam TAuthorization - The authorization config, forwarded to\n *   {@link AuthApiBase} for typed role IDs and grant strings.\n */\nexport type AuthApi<\n  TAuthorization extends AuthAuthorizationConfig | undefined = undefined,\n> = AuthApiBase<TAuthorization> & {\n  sso: PublicSsoApi;\n  scim: PublicScimApi;\n};\n\n/**\n * The return type of {@link createAuth}.\n *\n * Resolves to {@link AuthApi} (with `sso` and `scim` namespaces) when\n * `new SSO()` is present in the providers array, or to the narrower\n * {@link AuthApiBase} otherwise. This conditional type ensures that\n * enterprise-only APIs are only accessible when the SSO provider is\n * configured, producing a compile-time error if you try to access\n * `auth.sso` without it.\n * This lets application code keep a single `createAuth()` call while still\n * getting provider-aware typing on the resulting API object.\n *\n * @typeParam P - The tuple of provider configs passed to `createAuth`.\n * @typeParam TAuthorization - Optional authorization config for typed roles/grants.\n */\nexport type ConvexAuthResult<\n  P extends AuthProviderConfig[],\n  TAuthorization extends AuthAuthorizationConfig | undefined = undefined,\n> =\n  HasSSO<P> extends true\n    ? AuthApi<TAuthorization>\n    : AuthApiBase<TAuthorization>;\n\n/**\n * Infer the typed `AuthApiRefs` for the client SDK from a `createAuth` call.\n *\n * Use this as the generic parameter for `client()` on the frontend:\n *\n * ```ts\n * // convex/auth.ts\n * export const auth = createAuth(components.auth, { providers: [...] });\n *\n * // Frontend\n * import type { auth } from \"../convex/auth\";\n * import type { InferClientApi } from \"@robelest/convex-auth/server\";\n * const c = client<InferClientApi<typeof auth>>({ convex, api: api.auth });\n * ```\n *\n * @typeParam T - A ConvexAuthResult to extract the client API from.\n */\nexport type InferClientApi<T> =\n  T extends ConvexAuthResult<infer P>\n    ? AuthApiRefs<\n        HasPasskeyProvider<P>,\n        HasTotpProvider<P>,\n        HasDeviceProvider<P>\n      >\n    : AuthApiRefs;\n\n/** @internal */\nexport type AuthLike = Pick<AuthApiBase, \"user\" | \"member\">;\n\n// ============================================================================\n// Auth setup APIs\n// ============================================================================\n\n/**\n * Create an auth API object.\n *\n * When `new SSO()` is included in providers, `auth.sso` and `auth.scim`\n * are available on the returned object. Without it, those namespaces are\n * absent and accessing them is a TypeScript compile error.\n *\n * @param component - The installed auth component reference from\n *   `components.auth` in your Convex app definition.\n * @param config - Auth configuration including `providers` and optional\n *   `authorization`. All fields from {@link AuthConfig} are accepted\n *   except `component` (passed as the first argument).\n * @returns A {@link ConvexAuthResult} object — either {@link AuthApi}\n *   (with `sso`/`scim`) or {@link AuthApiBase}, depending on whether\n *   an SSO provider is present.\n *\n * @example\n * ```ts\n * export const auth = createAuth(components.auth, {\n *   providers: [password(), google()],\n *   authorization: { roles },\n * });\n * ```\n *\n * @see {@link AuthContextConfig}\n */\n\n// ---------------------------------------------------------------------------\n// Function builders — shared auth resolution logic\n// ---------------------------------------------------------------------------\n\nasync function resolveConfiguredAuthContext(\n  auth: AuthLike,\n  ctx: any,\n  config?: AuthContextConfig<any>,\n): Promise<AuthContext | null> {\n  const fallback = () => getResolvedAuthContext(auth, ctx);\n  const authOverride = config?.authResolve\n    ? await config.authResolve(ctx, fallback)\n    : undefined;\n  return authOverride === undefined ? await fallback() : authOverride;\n}\n\nfunction createNotSignedInError() {\n  return Cv.error({\n    code: \"NOT_SIGNED_IN\",\n    message: \"Authentication required.\",\n  });\n}\n\nasync function createPublicAuthContext(\n  auth: AuthLike,\n  ctx: any,\n  config?: AuthContextConfig<any>,\n) {\n  const resolved = await resolveConfiguredAuthContext(auth, ctx, config);\n\n  if (resolved === null) {\n    if (config?.optional !== true) {\n      throw createNotSignedInError();\n    }\n    return createUnauthenticatedAuthContext();\n  }\n\n  const extra = config?.resolve\n    ? await config.resolve(ctx, resolved.user, resolved)\n    : {};\n\n  return {\n    ...resolved,\n    ...extra,\n  };\n}\n\nexport function createAuth<\n  P extends AuthProviderConfig[],\n  TAuthorization extends AuthAuthorizationConfig | undefined = undefined,\n>(\n  component: ConvexAuthConfig[\"component\"],\n  config: Omit<AuthConfig, \"providers\" | \"authorization\"> & {\n    providers: P;\n    authorization?: TAuthorization;\n  },\n): ConvexAuthResult<P, TAuthorization> {\n  const authResult = AuthFactory({\n    ...config,\n    component,\n    providers: [...config.providers],\n  });\n  const {\n    domain: domainApi,\n    scim: scimApi,\n    connection: connectionApi,\n    audit: auditApi,\n    webhook: webhookApi,\n    oidc: oidcApi,\n    saml: samlApi,\n    ...restSso\n  } = authResult.auth.sso as InternalSsoApi;\n\n  type SetEnterpriseDomains = PublicSsoAdminApi[\"connection\"][\"domain\"][\"set\"];\n  type EnterpriseDomainInput = Array<{\n    domain: string;\n    isPrimary?: boolean;\n  }>;\n  const setEnterpriseDomains: PublicSsoAdminApi[\"connection\"][\"domain\"][\"set\"] =\n    async (\n      ctx: Parameters<SetEnterpriseDomains>[0],\n      enterpriseId: Parameters<SetEnterpriseDomains>[1],\n      domains: EnterpriseDomainInput,\n    ) => {\n      const enterprise = await connectionApi.get(ctx, enterpriseId);\n      if (enterprise === null) {\n        throw Cv.error({\n          code: \"INVALID_PARAMETERS\",\n          message: \"Enterprise not found.\",\n        });\n      }\n\n      const normalized = domains.map((entry: (typeof domains)[number]) => ({\n        ...entry,\n        domain: entry.domain.trim().toLowerCase(),\n      }));\n      const deduped = new Map<string, (typeof normalized)[number]>();\n      for (const entry of normalized) {\n        if (entry.domain.length === 0) {\n          throw Cv.error({\n            code: \"INVALID_PARAMETERS\",\n            message: \"Domain must not be empty.\",\n          });\n        }\n        if (deduped.has(entry.domain)) {\n          throw Cv.error({\n            code: \"INVALID_PARAMETERS\",\n            message: `Duplicate domain: ${entry.domain}`,\n          });\n        }\n        deduped.set(entry.domain, entry);\n      }\n\n      const nextDomains = [...deduped.values()];\n      const primaryCount = nextDomains.filter(\n        (entry) => entry.isPrimary,\n      ).length;\n      if (primaryCount > 1) {\n        throw Cv.error({\n          code: \"INVALID_PARAMETERS\",\n          message: \"Only one primary domain may be set.\",\n        });\n      }\n      if (nextDomains.length > 0 && primaryCount === 0) {\n        nextDomains[0] = { ...nextDomains[0], isPrimary: true };\n      }\n\n      const currentDomains = await domainApi.list(ctx, enterpriseId);\n      const currentByDomain = new Map<string, (typeof currentDomains)[number]>(\n        currentDomains.map((entry: (typeof currentDomains)[number]) => [\n          entry.domain.toLowerCase(),\n          entry,\n        ]),\n      );\n\n      for (const existing of currentDomains) {\n        if (!deduped.has(existing.domain.toLowerCase())) {\n          await domainApi.remove(ctx, existing._id);\n        }\n      }\n\n      for (const nextDomain of nextDomains) {\n        const current = currentByDomain.get(nextDomain.domain);\n        if (current && current.isPrimary === Boolean(nextDomain.isPrimary)) {\n          continue;\n        }\n        if (current) {\n          await domainApi.remove(ctx, current._id);\n        }\n        const domainId = await domainApi.add(ctx, {\n          enterpriseId: enterprise._id,\n          groupId: enterprise.groupId,\n          domain: nextDomain.domain,\n          isPrimary: nextDomain.isPrimary,\n        });\n        if (current?.verifiedAt !== undefined) {\n          await (ctx as any).runMutation(\n            component.public.enterpriseDomainVerify,\n            {\n              domainId,\n              verifiedAt: current.verifiedAt,\n            },\n          );\n        }\n      }\n\n      const updatedDomains = await domainApi.list(ctx, enterpriseId);\n      return {\n        enterpriseId,\n        domains: updatedDomains.map(\n          (domain: (typeof updatedDomains)[number]) => ({\n            domainId: domain._id,\n            domain: domain.domain,\n            isPrimary: domain.isPrimary,\n            verified: domain.verifiedAt !== undefined,\n            verifiedAt: domain.verifiedAt ?? null,\n          }),\n        ),\n      };\n    };\n\n  const publicSso: PublicSsoApi = {\n    admin: {\n      ...restSso,\n      oidc: {\n        ...oidcApi,\n      },\n      saml: {\n        ...samlApi,\n      },\n      connection: {\n        ...connectionApi,\n        domain: {\n          list: domainApi.list,\n          validate: domainApi.validate,\n          set: setEnterpriseDomains,\n          verification: {\n            request: domainApi.verification.request,\n            confirm: domainApi.verification.confirm,\n          },\n        },\n      },\n      policy: restSso.policy,\n      audit: {\n        list: auditApi.list,\n      },\n      webhook: {\n        endpoint: webhookApi.endpoint,\n        delivery: {\n          list: webhookApi.delivery.list,\n        },\n      },\n    },\n    client: {\n      signIn: oidcApi.signIn,\n      metadata: samlApi.metadata,\n    },\n  };\n\n  return {\n    signIn: authResult.signIn,\n    signOut: authResult.signOut,\n    store: authResult.store,\n    user: authResult.auth.user,\n    session: authResult.auth.session,\n    provider: authResult.auth.provider,\n    account: authResult.auth.account,\n    group: authResult.auth.group,\n    member: authResult.auth.member,\n    invite: authResult.auth.invite,\n    key: authResult.auth.key,\n    sso: publicSso,\n    scim: {\n      admin: {\n        configure: scimApi.configure,\n        get: scimApi.get,\n        validate: scimApi.validate,\n      },\n    },\n    http: authResult.auth.http,\n\n    context: ((ctx: any, config?: AuthContextConfig<any>) =>\n      createPublicAuthContext(authResult.auth, ctx, config)) as AuthContextResolver,\n\n    ctx: ((config?: AuthContextConfig<any>) =>\n      createAuthContextCustomization(authResult.auth, config)) as AuthContextFactory,\n  } as unknown as ConvexAuthResult<P, TAuthorization>;\n}\n\n// ============================================================================\n// auth.ctx() — ctx enrichment for customQuery / customMutation\n// ============================================================================\n\n/**\n * Configuration for {@link createAuth().ctx} context enrichment.\n *\n * The same config shape is also used by {@link createAuth().context}.\n *\n * @typeParam TResolve - Extra fields returned from `resolve()` and merged into\n *   the resulting `ctx.auth` object.\n *\n * @example\n * ```ts\n * const authContext = await auth.context(ctx, {\n *   resolve: async (_ctx, user, authState) => ({\n *     email: user.email,\n *     canWrite: authState.grants.includes(\"posts.write\"),\n *   }),\n * });\n * ```\n */\nexport type AuthContextConfig<\n  TResolve extends Record<string, unknown> = Record<string, never>,\n> = {\n  /**\n   * Allow unauthenticated callers and return a null-shaped auth object instead\n   * of throwing `NOT_SIGNED_IN`.\n   */\n  optional?: boolean;\n  /**\n   * Attach additional derived fields to the auth context after the base auth\n   * context is resolved.\n   *\n   * This callback runs only when a user is authenticated.\n   */\n  resolve?: (\n    ctx: any,\n    user: UserDoc,\n    auth: AuthContext,\n  ) => Promise<TResolve> | TResolve;\n  /**\n   * Override or wrap the base auth resolution used by {@link createAuth().ctx}.\n   *\n   * Return `undefined` to fall back to the built-in resolver,\n   * `null` for an explicit unauthenticated state, or an\n   * {@link AuthContext} object to provide a pre-resolved auth state.\n   * This is useful for tests, proxy auth, impersonation flows, or any\n   * environment that needs to inject auth without depending on the standard\n   * Convex auth tables.\n   *\n   * @param ctx - The Convex function context.\n   * @param fallback - The built-in auth resolver used by {@link createAuth().ctx}.\n   * @returns Resolved auth state, `null`, or `undefined` to use the fallback.\n   *\n   * @example\n   * ```ts\n   * const authCtx = auth.ctx({\n   *   authResolve: async (ctx, fallback) => {\n   *     const injected = getInjectedAuth(ctx);\n   *     return injected ?? (await fallback());\n   *   },\n   * });\n   * ```\n   */\n  authResolve?: (\n    ctx: any,\n    fallback: () => Promise<AuthContext | null>,\n  ) => Promise<AuthContext | null | undefined> | AuthContext | null | undefined;\n};\n\n/**\n * Create a context enrichment for `customQuery` / `customMutation` — optional auth.\n *\n * When `optional: true` is set, unauthenticated requests are allowed.\n * The enriched `ctx.auth` will have `userId: null`, `user: null`,\n * `groupId: null`, `role: null`, and `grants: []` for unauthenticated callers.\n *\n * @param config - Configuration with `optional: true` and an optional\n *   `resolve` callback for attaching extra fields to the auth context.\n * @returns An object with `args` and `input` compatible with Convex\n *   custom function builders.\n *\n * @example\n * ```ts\n    * const authCtx = auth.ctx({\n    *   optional: true,\n    *   resolve: async (_ctx, user) => ({ plan: user.extend?.plan ?? null }),\n    * });\n    * ```\n *\n * @see {@link createAuth}\n */\n\n/**\n * Create a context enrichment for `customQuery` / `customMutation` — required auth (default).\n *\n * When `optional` is omitted or `false`, unauthenticated requests throw a\n * structured `ConvexError` before your handler runs.\n *\n * @param config - Optional configuration with a `resolve` callback\n *   for attaching extra fields to the auth context.\n * @returns An object with `args` and `input` compatible with Convex\n *   custom function builders.\n *\n * @example\n * ```ts\n    * const authCtx = auth.ctx({\n    *   resolve: async (_ctx, user) => ({ email: user.email }),\n    * });\n    * ```\n *\n * @see {@link createAuth}\n */\nfunction createAuthContextCustomization(\n  auth: AuthLike,\n  config?: AuthContextConfig<any>,\n) {\n  return {\n    args: {},\n    input: async (ctx: any, _args: any, _extra?: any) => {\n      const nativeAuth = ctx.auth;\n      const getUserIdentity = nativeAuth.getUserIdentity.bind(nativeAuth);\n      const resolved = await resolveConfiguredAuthContext(auth, ctx, config);\n\n      if (resolved === null) {\n        if (config?.optional !== true) {\n          throw createNotSignedInError();\n        }\n        return {\n          ctx: {\n            auth: {\n              getUserIdentity,\n              ...createUnauthenticatedAuthContext(),\n            },\n          },\n          args: {},\n        };\n      }\n\n      const extra = config?.resolve\n        ? await config.resolve(ctx, resolved.user, resolved)\n        : {};\n\n      return {\n        ctx: {\n          auth: {\n            getUserIdentity,\n            ...resolved,\n            ...extra,\n          },\n        },\n        args: {},\n      };\n    },\n  };\n}\n\n/**\n * Extract the resolved `auth` context type from an `auth.ctx()` customization.\n *\n * Use this to type function parameters or variables that receive the\n * enriched auth context produced by `auth.ctx()`. The inferred type includes\n * `userId`, `user`, `groupId`, `role`, `grants`, `getUserIdentity`, and any\n * additional fields added by the `resolve` callback. This is the generic\n * utility for reusing the enriched auth shape without manually duplicating\n * conditional auth types.\n *\n * @typeParam T - An `auth.ctx()` return value (must have an `input` method\n *   that returns `{ ctx: { auth: ... } }`).\n *\n * @example\n * ```ts\n * const authCtx = auth.ctx({\n *   resolve: async (ctx, user) => ({ orgId: user.orgId }),\n * });\n * type Auth = InferAuth<typeof authCtx>;\n * // Auth = { userId: Id<\"User\">; user: UserDoc; getUserIdentity: ...; orgId: string }\n * ```\n *\n * @see {@link createAuth}\n */\nexport type InferAuth<\n  T extends { input: (...args: any[]) => Promise<{ ctx: { auth: any } }> },\n> = Awaited<ReturnType<T[\"input\"]>>[\"ctx\"][\"auth\"];\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAugBA,eAAe,6BACb,MACA,KACA,QAC6B;CAC7B,MAAM,iBAAiBA,eAAuB,MAAM,IAAI;CACxD,MAAM,eAAe,QAAQ,cACzB,MAAM,OAAO,YAAY,KAAK,SAAS,GACvC;AACJ,QAAO,iBAAiB,SAAY,MAAM,UAAU,GAAG;;AAGzD,SAAS,yBAAyB;AAChC,QAAO,GAAG,MAAM;EACd,MAAM;EACN,SAAS;EACV,CAAC;;AAGJ,eAAe,wBACb,MACA,KACA,QACA;CACA,MAAM,WAAW,MAAM,6BAA6B,MAAM,KAAK,OAAO;AAEtE,KAAI,aAAa,MAAM;AACrB,MAAI,QAAQ,aAAa,KACvB,OAAM,wBAAwB;AAEhC,SAAO,kCAAkC;;CAG3C,MAAM,QAAQ,QAAQ,UAClB,MAAM,OAAO,QAAQ,KAAK,SAAS,MAAM,SAAS,GAClD,EAAE;AAEN,QAAO;EACL,GAAG;EACH,GAAG;EACJ;;AAGH,SAAgB,WAId,WACA,QAIqC;CACrC,MAAM,aAAaC,KAAY;EAC7B,GAAG;EACH;EACA,WAAW,CAAC,GAAG,OAAO,UAAU;EACjC,CAAC;CACF,MAAM,EACJ,QAAQ,WACR,MAAM,SACN,YAAY,eACZ,OAAO,UACP,SAAS,YACT,MAAM,SACN,MAAM,SACN,GAAG,YACD,WAAW,KAAK;CAOpB,MAAM,uBACJ,OACE,KACA,cACA,YACG;EACH,MAAM,aAAa,MAAM,cAAc,IAAI,KAAK,aAAa;AAC7D,MAAI,eAAe,KACjB,OAAM,GAAG,MAAM;GACb,MAAM;GACN,SAAS;GACV,CAAC;EAGJ,MAAM,aAAa,QAAQ,KAAK,WAAqC;GACnE,GAAG;GACH,QAAQ,MAAM,OAAO,MAAM,CAAC,aAAa;GAC1C,EAAE;EACH,MAAM,0BAAU,IAAI,KAA0C;AAC9D,OAAK,MAAM,SAAS,YAAY;AAC9B,OAAI,MAAM,OAAO,WAAW,EAC1B,OAAM,GAAG,MAAM;IACb,MAAM;IACN,SAAS;IACV,CAAC;AAEJ,OAAI,QAAQ,IAAI,MAAM,OAAO,CAC3B,OAAM,GAAG,MAAM;IACb,MAAM;IACN,SAAS,qBAAqB,MAAM;IACrC,CAAC;AAEJ,WAAQ,IAAI,MAAM,QAAQ,MAAM;;EAGlC,MAAM,cAAc,CAAC,GAAG,QAAQ,QAAQ,CAAC;EACzC,MAAM,eAAe,YAAY,QAC9B,UAAU,MAAM,UAClB,CAAC;AACF,MAAI,eAAe,EACjB,OAAM,GAAG,MAAM;GACb,MAAM;GACN,SAAS;GACV,CAAC;AAEJ,MAAI,YAAY,SAAS,KAAK,iBAAiB,EAC7C,aAAY,KAAK;GAAE,GAAG,YAAY;GAAI,WAAW;GAAM;EAGzD,MAAM,iBAAiB,MAAM,UAAU,KAAK,KAAK,aAAa;EAC9D,MAAM,kBAAkB,IAAI,IAC1B,eAAe,KAAK,UAA2C,CAC7D,MAAM,OAAO,aAAa,EAC1B,MACD,CAAC,CACH;AAED,OAAK,MAAM,YAAY,eACrB,KAAI,CAAC,QAAQ,IAAI,SAAS,OAAO,aAAa,CAAC,CAC7C,OAAM,UAAU,OAAO,KAAK,SAAS,IAAI;AAI7C,OAAK,MAAM,cAAc,aAAa;GACpC,MAAM,UAAU,gBAAgB,IAAI,WAAW,OAAO;AACtD,OAAI,WAAW,QAAQ,cAAc,QAAQ,WAAW,UAAU,CAChE;AAEF,OAAI,QACF,OAAM,UAAU,OAAO,KAAK,QAAQ,IAAI;GAE1C,MAAM,WAAW,MAAM,UAAU,IAAI,KAAK;IACxC,cAAc,WAAW;IACzB,SAAS,WAAW;IACpB,QAAQ,WAAW;IACnB,WAAW,WAAW;IACvB,CAAC;AACF,OAAI,SAAS,eAAe,OAC1B,OAAO,IAAY,YACjB,UAAU,OAAO,wBACjB;IACE;IACA,YAAY,QAAQ;IACrB,CACF;;AAKL,SAAO;GACL;GACA,UAHqB,MAAM,UAAU,KAAK,KAAK,aAAa,EAGpC,KACrB,YAA6C;IAC5C,UAAU,OAAO;IACjB,QAAQ,OAAO;IACf,WAAW,OAAO;IAClB,UAAU,OAAO,eAAe;IAChC,YAAY,OAAO,cAAc;IAClC,EACF;GACF;;CAGL,MAAM,YAA0B;EAC9B,OAAO;GACL,GAAG;GACH,MAAM,EACJ,GAAG,SACJ;GACD,MAAM,EACJ,GAAG,SACJ;GACD,YAAY;IACV,GAAG;IACH,QAAQ;KACN,MAAM,UAAU;KAChB,UAAU,UAAU;KACpB,KAAK;KACL,cAAc;MACZ,SAAS,UAAU,aAAa;MAChC,SAAS,UAAU,aAAa;MACjC;KACF;IACF;GACD,QAAQ,QAAQ;GAChB,OAAO,EACL,MAAM,SAAS,MAChB;GACD,SAAS;IACP,UAAU,WAAW;IACrB,UAAU,EACR,MAAM,WAAW,SAAS,MAC3B;IACF;GACF;EACD,QAAQ;GACN,QAAQ,QAAQ;GAChB,UAAU,QAAQ;GACnB;EACF;AAED,QAAO;EACL,QAAQ,WAAW;EACnB,SAAS,WAAW;EACpB,OAAO,WAAW;EAClB,MAAM,WAAW,KAAK;EACtB,SAAS,WAAW,KAAK;EACzB,UAAU,WAAW,KAAK;EAC1B,SAAS,WAAW,KAAK;EACzB,OAAO,WAAW,KAAK;EACvB,QAAQ,WAAW,KAAK;EACxB,QAAQ,WAAW,KAAK;EACxB,KAAK,WAAW,KAAK;EACrB,KAAK;EACL,MAAM,EACJ,OAAO;GACL,WAAW,QAAQ;GACnB,KAAK,QAAQ;GACb,UAAU,QAAQ;GACnB,EACF;EACD,MAAM,WAAW,KAAK;EAEtB,WAAW,KAAU,aACnB,wBAAwB,WAAW,MAAM,KAAKC,SAAO;EAEvD,OAAO,aACL,+BAA+B,WAAW,MAAMA,SAAO;EAC1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqHH,SAAS,+BACP,MACA,QACA;AACA,QAAO;EACL,MAAM,EAAE;EACR,OAAO,OAAO,KAAU,OAAY,WAAiB;GACnD,MAAM,aAAa,IAAI;GACvB,MAAM,kBAAkB,WAAW,gBAAgB,KAAK,WAAW;GACnE,MAAM,WAAW,MAAM,6BAA6B,MAAM,KAAK,OAAO;AAEtE,OAAI,aAAa,MAAM;AACrB,QAAI,QAAQ,aAAa,KACvB,OAAM,wBAAwB;AAEhC,WAAO;KACL,KAAK,EACH,MAAM;MACJ;MACA,GAAG,kCAAkC;MACtC,EACF;KACD,MAAM,EAAE;KACT;;GAGH,MAAM,QAAQ,QAAQ,UAClB,MAAM,OAAO,QAAQ,KAAK,SAAS,MAAM,SAAS,GAClD,EAAE;AAEN,UAAO;IACL,KAAK,EACH,MAAM;KACJ;KACA,GAAG;KACH,GAAG;KACJ,EACF;IACD,MAAM,EAAE;IACT;;EAEJ"}

package/dist/component/server/config.js

@@ -1,121 +0,0 @@
-import { isOAuthProvider } from "../providers/oauth.js";
-
-//#region src/server/config.ts
-/** Check if something is a new-style class provider with `_toMaterialized()`. */
-function isClassProvider(provider) {
-	return typeof provider === "object" && provider !== null && typeof provider._toMaterialized === "function";
-}
-/**
-* Resolve raw provider configs into materialized form and apply defaults.
-*
-* @internal
-*/
-/** @internal */
-function configDefaults(config_) {
-	const config = materializeAndDefaultProviders(config_);
-	const extraProviders = config.providers.filter((p) => p.type === "credentials").map((p) => p.extraProviders).flat().filter((p) => p !== void 0);
-	return {
-		...config,
-		authorization: normalizeAuthorizationConfig(config.authorization),
-		extraProviders: materializeProviders(extraProviders)
-	};
-}
-/**
-* Materialize a single provider config into its runtime form.
-*
-* @internal
-*/
-/** @internal */
-function materializeProvider(provider) {
-	const config = {
-		providers: [provider],
-		component: {}
-	};
-	materializeAndDefaultProviders(config);
-	return config.providers[0];
-}
-/**
-* List available provider IDs for error messages.
-*
-* @internal
-*/
-/** @internal */
-function listAvailableProviders(config, allowExtraProviders) {
-	const availableProviders = config.providers.concat(allowExtraProviders ? config.extraProviders : []).map((provider) => `\`${provider.id}\``);
-	return availableProviders.length > 0 ? availableProviders.join(", ") : "no providers have been configured";
-}
-function materializeProviders(providers) {
-	const config = {
-		providers,
-		component: {}
-	};
-	materializeAndDefaultProviders(config);
-	return config.providers;
-}
-function decodeProviderMaterializationDispatch(raw) {
-	if (isOAuthProvider(raw)) return {
-		tag: "oauth",
-		raw
-	};
-	if (isClassProvider(raw)) return {
-		tag: "class",
-		raw
-	};
-	return {
-		tag: "factoryOrObject",
-		raw
-	};
-}
-function matchProviderMaterializationDispatch(dispatch, handlers) {
-	return handlers[dispatch.tag](dispatch);
-}
-function materializeProviderConfig(raw) {
-	return matchProviderMaterializationDispatch(decodeProviderMaterializationDispatch(raw), {
-		oauth: (d) => materializeOAuthProvider(d.raw),
-		class: (d) => d.raw._toMaterialized(),
-		factoryOrObject: (d) => {
-			const resolved = typeof d.raw === "function" ? d.raw() : d.raw;
-			return resolved.options ? {
-				...resolved,
-				...resolved.options
-			} : resolved;
-		}
-	});
-}
-function materializeAndDefaultProviders(config_) {
-	const allProviders = [];
-	for (const raw of config_.providers) allProviders.push(materializeProviderConfig(raw));
-	const config = {
-		...config_,
-		providers: allProviders
-	};
-	config.providers.forEach((provider) => {
-		if (provider.type === "phone") {
-			const ID = provider.id.toUpperCase().replace(/-/g, "_");
-			provider.apiKey ??= process.env[`AUTH_${ID}_KEY`];
-		}
-	});
-	return config;
-}
-function normalizeAuthorizationConfig(authorization) {
-	return { roles: Object.fromEntries(Object.entries(authorization?.roles ?? {}).map(([roleId, role]) => [roleId, {
-		...role.label ? { label: role.label } : {},
-		grants: Array.from(new Set(role.grants)).sort()
-	}])) };
-}
-/**
-* Materialize an Arctic-based `OAuthProviderInstance` into the runtime config.
-*/
-function materializeOAuthProvider(instance) {
-	return {
-		id: instance.id,
-		type: "oauth",
-		provider: instance.provider,
-		scopes: instance.scopes,
-		profile: instance.profile
-	};
-}
-
-//#endregion
-export { configDefaults, listAvailableProviders, materializeProvider };
-//# sourceMappingURL=config.js.map

package/dist/component/server/config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"config.js","names":[],"sources":["../../../src/server/config.ts"],"sourcesContent":["import {\n  isOAuthProvider,\n  type OAuthProviderInstance,\n} from \"../providers/oauth\";\nimport {\n  AuthAuthorizationConfig,\n  AuthProviderConfig,\n  AuthProviderMaterializedConfig,\n  ConvexAuthConfig,\n  OAuthMaterializedConfig,\n} from \"./types\";\n\n// ============================================================================\n// Provider class detection\n// ============================================================================\n\n/** Check if something is a new-style class provider with `_toMaterialized()`. */\nfunction isClassProvider(\n  provider: any,\n): provider is { _toMaterialized(): AuthProviderMaterializedConfig } {\n  return (\n    typeof provider === \"object\" &&\n    provider !== null &&\n    typeof provider._toMaterialized === \"function\"\n  );\n}\n\n// ============================================================================\n// Public API\n// ============================================================================\n\n/**\n * Resolve raw provider configs into materialized form and apply defaults.\n *\n * @internal\n */\n/** @internal */\nexport function configDefaults(config_: ConvexAuthConfig) {\n  const config = materializeAndDefaultProviders(config_);\n  // Collect extra providers from credentials providers\n  const extraProviders = config.providers\n    .filter((p) => p.type === \"credentials\")\n    .map((p) => p.extraProviders)\n    .flat()\n    .filter((p) => p !== undefined);\n  return {\n    ...config,\n    authorization: normalizeAuthorizationConfig(config.authorization),\n    extraProviders: materializeProviders(extraProviders),\n  };\n}\n\n/**\n * Materialize a single provider config into its runtime form.\n *\n * @internal\n */\n/** @internal */\nexport function materializeProvider(provider: AuthProviderConfig) {\n  const config = { providers: [provider], component: {} as any };\n  materializeAndDefaultProviders(config);\n  return config.providers[0] as AuthProviderMaterializedConfig;\n}\n\n/**\n * List available provider IDs for error messages.\n *\n * @internal\n */\n/** @internal */\nexport function listAvailableProviders(\n  config: ReturnType<typeof configDefaults>,\n  allowExtraProviders: boolean,\n) {\n  const availableProviders = config.providers\n    .concat(allowExtraProviders ? config.extraProviders : [])\n    .map((provider) => `\\`${provider.id}\\``);\n  return availableProviders.length > 0\n    ? availableProviders.join(\", \")\n    : \"no providers have been configured\";\n}\n\n// ============================================================================\n// Internal helpers\n// ============================================================================\n\nfunction materializeProviders(providers: AuthProviderConfig[]) {\n  const config = { providers, component: {} as any };\n  materializeAndDefaultProviders(config);\n  return config.providers as AuthProviderMaterializedConfig[];\n}\n\ntype ProviderMaterializationDispatch =\n  | { tag: \"oauth\"; raw: OAuthProviderInstance }\n  | {\n      tag: \"class\";\n      raw: { _toMaterialized(): AuthProviderMaterializedConfig };\n    }\n  | { tag: \"factoryOrObject\"; raw: AuthProviderConfig };\n\ntype ProviderMaterializationHandlers<T> = {\n  oauth: (\n    dispatch: Extract<ProviderMaterializationDispatch, { tag: \"oauth\" }>,\n  ) => T;\n  class: (\n    dispatch: Extract<ProviderMaterializationDispatch, { tag: \"class\" }>,\n  ) => T;\n  factoryOrObject: (\n    dispatch: Extract<\n      ProviderMaterializationDispatch,\n      { tag: \"factoryOrObject\" }\n    >,\n  ) => T;\n};\n\nfunction decodeProviderMaterializationDispatch(\n  raw: AuthProviderConfig,\n): ProviderMaterializationDispatch {\n  if (isOAuthProvider(raw)) {\n    return { tag: \"oauth\", raw };\n  }\n  if (isClassProvider(raw)) {\n    return { tag: \"class\", raw };\n  }\n  return { tag: \"factoryOrObject\", raw };\n}\n\nfunction matchProviderMaterializationDispatch<T>(\n  dispatch: ProviderMaterializationDispatch,\n  handlers: ProviderMaterializationHandlers<T>,\n): T {\n  return (\n    handlers[dispatch.tag] as (dispatch: ProviderMaterializationDispatch) => T\n  )(dispatch);\n}\n\nfunction materializeProviderConfig(raw: AuthProviderConfig) {\n  const dispatch = decodeProviderMaterializationDispatch(raw);\n  return matchProviderMaterializationDispatch(dispatch, {\n    oauth: (d) => materializeOAuthProvider(d.raw),\n    class: (d) => d.raw._toMaterialized(),\n    factoryOrObject: (d) => {\n      const resolved = typeof d.raw === \"function\" ? d.raw() : (d.raw as any);\n      const merged = resolved.options\n        ? { ...resolved, ...resolved.options }\n        : resolved;\n      return merged as AuthProviderMaterializedConfig;\n    },\n  });\n}\n\nfunction materializeAndDefaultProviders(config_: ConvexAuthConfig) {\n  const allProviders: AuthProviderMaterializedConfig[] = [];\n\n  for (const raw of config_.providers) {\n    allProviders.push(materializeProviderConfig(raw));\n  }\n\n  const config = { ...config_, providers: allProviders };\n\n  // Set phone provider API key from env\n  config.providers.forEach((provider) => {\n    if (provider.type === \"phone\") {\n      const ID = provider.id.toUpperCase().replace(/-/g, \"_\");\n      provider.apiKey ??= process.env[`AUTH_${ID}_KEY`];\n    }\n  });\n\n  return config;\n}\n\nfunction normalizeAuthorizationConfig(\n  authorization: ConvexAuthConfig[\"authorization\"],\n): AuthAuthorizationConfig {\n  const roles = Object.fromEntries(\n    Object.entries(authorization?.roles ?? {}).map(([roleId, role]) => [\n      roleId,\n      {\n        ...(role.label ? { label: role.label } : {}),\n        grants: Array.from(new Set(role.grants)).sort(),\n      },\n    ]),\n  );\n  return { roles };\n}\n\n/**\n * Materialize an Arctic-based `OAuthProviderInstance` into the runtime config.\n */\nfunction materializeOAuthProvider(\n  instance: OAuthProviderInstance,\n): OAuthMaterializedConfig {\n  return {\n    id: instance.id,\n    type: \"oauth\",\n    provider: instance.provider,\n    scopes: instance.scopes,\n    profile: instance.profile,\n  };\n}\n"],"mappings":";;;;AAiBA,SAAS,gBACP,UACmE;AACnE,QACE,OAAO,aAAa,YACpB,aAAa,QACb,OAAO,SAAS,oBAAoB;;;;;;;;AAcxC,SAAgB,eAAe,SAA2B;CACxD,MAAM,SAAS,+BAA+B,QAAQ;CAEtD,MAAM,iBAAiB,OAAO,UAC3B,QAAQ,MAAM,EAAE,SAAS,cAAc,CACvC,KAAK,MAAM,EAAE,eAAe,CAC5B,MAAM,CACN,QAAQ,MAAM,MAAM,OAAU;AACjC,QAAO;EACL,GAAG;EACH,eAAe,6BAA6B,OAAO,cAAc;EACjE,gBAAgB,qBAAqB,eAAe;EACrD;;;;;;;;AASH,SAAgB,oBAAoB,UAA8B;CAChE,MAAM,SAAS;EAAE,WAAW,CAAC,SAAS;EAAE,WAAW,EAAE;EAAS;AAC9D,gCAA+B,OAAO;AACtC,QAAO,OAAO,UAAU;;;;;;;;AAS1B,SAAgB,uBACd,QACA,qBACA;CACA,MAAM,qBAAqB,OAAO,UAC/B,OAAO,sBAAsB,OAAO,iBAAiB,EAAE,CAAC,CACxD,KAAK,aAAa,KAAK,SAAS,GAAG,IAAI;AAC1C,QAAO,mBAAmB,SAAS,IAC/B,mBAAmB,KAAK,KAAK,GAC7B;;AAON,SAAS,qBAAqB,WAAiC;CAC7D,MAAM,SAAS;EAAE;EAAW,WAAW,EAAE;EAAS;AAClD,gCAA+B,OAAO;AACtC,QAAO,OAAO;;AA0BhB,SAAS,sCACP,KACiC;AACjC,KAAI,gBAAgB,IAAI,CACtB,QAAO;EAAE,KAAK;EAAS;EAAK;AAE9B,KAAI,gBAAgB,IAAI,CACtB,QAAO;EAAE,KAAK;EAAS;EAAK;AAE9B,QAAO;EAAE,KAAK;EAAmB;EAAK;;AAGxC,SAAS,qCACP,UACA,UACG;AACH,QACE,SAAS,SAAS,KAClB,SAAS;;AAGb,SAAS,0BAA0B,KAAyB;AAE1D,QAAO,qCADU,sCAAsC,IAAI,EACL;EACpD,QAAQ,MAAM,yBAAyB,EAAE,IAAI;EAC7C,QAAQ,MAAM,EAAE,IAAI,iBAAiB;EACrC,kBAAkB,MAAM;GACtB,MAAM,WAAW,OAAO,EAAE,QAAQ,aAAa,EAAE,KAAK,GAAI,EAAE;AAI5D,UAHe,SAAS,UACpB;IAAE,GAAG;IAAU,GAAG,SAAS;IAAS,GACpC;;EAGP,CAAC;;AAGJ,SAAS,+BAA+B,SAA2B;CACjE,MAAM,eAAiD,EAAE;AAEzD,MAAK,MAAM,OAAO,QAAQ,UACxB,cAAa,KAAK,0BAA0B,IAAI,CAAC;CAGnD,MAAM,SAAS;EAAE,GAAG;EAAS,WAAW;EAAc;AAGtD,QAAO,UAAU,SAAS,aAAa;AACrC,MAAI,SAAS,SAAS,SAAS;GAC7B,MAAM,KAAK,SAAS,GAAG,aAAa,CAAC,QAAQ,MAAM,IAAI;AACvD,YAAS,WAAW,QAAQ,IAAI,QAAQ,GAAG;;GAE7C;AAEF,QAAO;;AAGT,SAAS,6BACP,eACyB;AAUzB,QAAO,EAAE,OATK,OAAO,YACnB,OAAO,QAAQ,eAAe,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,UAAU,CACjE,QACA;EACE,GAAI,KAAK,QAAQ,EAAE,OAAO,KAAK,OAAO,GAAG,EAAE;EAC3C,QAAQ,MAAM,KAAK,IAAI,IAAI,KAAK,OAAO,CAAC,CAAC,MAAM;EAChD,CACF,CAAC,CACH,EACe;;;;;AAMlB,SAAS,yBACP,UACyB;AACzB,QAAO;EACL,IAAI,SAAS;EACb,MAAM;EACN,UAAU,SAAS;EACnB,QAAQ,SAAS;EACjB,SAAS,SAAS;EACnB"}

package/dist/component/server/context.js

@@ -1,53 +0,0 @@
-import { userIdFromIdentitySubject } from "./identity.js";
-
-//#region src/server/context.ts
-/** @internal */
-async function getSessionUserId(ctx) {
-	const identity = await ctx.auth.getUserIdentity();
-	if (identity === null) return null;
-	return userIdFromIdentitySubject(identity.subject);
-}
-/** @internal */
-async function getAuthContextForUser(auth, ctx, userId) {
-	const user = await auth.user.get(ctx, userId);
-	const groupId = await auth.user.getActiveGroup(ctx, { userId });
-	let role = null;
-	let grants = [];
-	if (groupId) {
-		const resolved = await auth.member.inspect(ctx, {
-			userId,
-			groupId
-		});
-		if (resolved.membership) {
-			role = resolved.roleIds[0] ?? null;
-			grants = resolved.grants;
-		}
-	}
-	return {
-		userId,
-		user,
-		groupId,
-		role,
-		grants
-	};
-}
-/** @internal */
-async function getAuthContext(auth, ctx) {
-	const userId = await getSessionUserId(ctx);
-	if (userId === null) return null;
-	return await getAuthContextForUser(auth, ctx, userId);
-}
-/** @internal */
-function createUnauthenticatedAuthContext() {
-	return {
-		userId: null,
-		user: null,
-		groupId: null,
-		role: null,
-		grants: []
-	};
-}
-
-//#endregion
-export { createUnauthenticatedAuthContext, getAuthContext, getAuthContextForUser, getSessionUserId };
-//# sourceMappingURL=context.js.map

package/dist/component/server/context.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"context.js","names":[],"sources":["../../../src/server/context.ts"],"sourcesContent":["import type { UserIdentity } from \"convex/server\";\n\nimport { userIdFromIdentitySubject } from \"./identity\";\nimport type { AuthContext, AuthLike, OptionalAuthContext, UserDoc } from \"./auth\";\n\ntype AuthIdentityCtx = {\n  auth: {\n    getUserIdentity: () => Promise<UserIdentity | null>;\n  };\n};\n\ntype AuthContextResolverLike = {\n  user: {\n    get: (ctx: any, userId: string) => Promise<UserDoc>;\n    getActiveGroup: (\n      ctx: any,\n      args: { userId: string },\n    ) => Promise<string | null>;\n  };\n  member: {\n    inspect: (\n      ctx: any,\n      args: { userId: string; groupId: string },\n    ) => Promise<{\n      membership: unknown;\n      roleIds: string[];\n      grants: string[];\n    }>;\n  };\n};\n\n/** @internal */\nexport async function getSessionUserId(\n  ctx: AuthIdentityCtx,\n): Promise<string | null> {\n  const identity = await ctx.auth.getUserIdentity();\n  if (identity === null) {\n    return null;\n  }\n  return userIdFromIdentitySubject(identity.subject);\n}\n\n/** @internal */\nexport async function getAuthContextForUser(\n  auth: AuthContextResolverLike,\n  ctx: any,\n  userId: string,\n): Promise<AuthContext> {\n  const user = await auth.user.get(ctx, userId);\n  const groupId = await auth.user.getActiveGroup(ctx, { userId });\n  let role: string | null = null;\n  let grants: string[] = [];\n  if (groupId) {\n    const resolved = await auth.member.inspect(ctx, { userId, groupId });\n    if (resolved.membership) {\n      role = resolved.roleIds[0] ?? null;\n      grants = resolved.grants;\n    }\n  }\n  return {\n    userId: userId as AuthContext[\"userId\"],\n    user,\n    groupId,\n    role,\n    grants,\n  };\n}\n\n/** @internal */\nexport async function getAuthContext(\n  auth: AuthLike,\n  ctx: AuthIdentityCtx & Record<string, unknown>,\n): Promise<AuthContext | null> {\n  const userId = await getSessionUserId(ctx);\n  if (userId === null) {\n    return null;\n  }\n  return await getAuthContextForUser(auth, ctx, userId);\n}\n\n/** @internal */\nexport function createUnauthenticatedAuthContext(): OptionalAuthContext {\n  return {\n    userId: null,\n    user: null,\n    groupId: null,\n    role: null,\n    grants: [],\n  };\n}\n"],"mappings":";;;;AAgCA,eAAsB,iBACpB,KACwB;CACxB,MAAM,WAAW,MAAM,IAAI,KAAK,iBAAiB;AACjD,KAAI,aAAa,KACf,QAAO;AAET,QAAO,0BAA0B,SAAS,QAAQ;;;AAIpD,eAAsB,sBACpB,MACA,KACA,QACsB;CACtB,MAAM,OAAO,MAAM,KAAK,KAAK,IAAI,KAAK,OAAO;CAC7C,MAAM,UAAU,MAAM,KAAK,KAAK,eAAe,KAAK,EAAE,QAAQ,CAAC;CAC/D,IAAI,OAAsB;CAC1B,IAAI,SAAmB,EAAE;AACzB,KAAI,SAAS;EACX,MAAM,WAAW,MAAM,KAAK,OAAO,QAAQ,KAAK;GAAE;GAAQ;GAAS,CAAC;AACpE,MAAI,SAAS,YAAY;AACvB,UAAO,SAAS,QAAQ,MAAM;AAC9B,YAAS,SAAS;;;AAGtB,QAAO;EACG;EACR;EACA;EACA;EACA;EACD;;;AAIH,eAAsB,eACpB,MACA,KAC6B;CAC7B,MAAM,SAAS,MAAM,iBAAiB,IAAI;AAC1C,KAAI,WAAW,KACb,QAAO;AAET,QAAO,MAAM,sBAAsB,MAAM,KAAK,OAAO;;;AAIvD,SAAgB,mCAAwD;AACtE,QAAO;EACL,QAAQ;EACR,MAAM;EACN,SAAS;EACT,MAAM;EACN,QAAQ,EAAE;EACX"}

package/dist/component/server/cookies.js

@@ -1,47 +0,0 @@
-import { isLocalHost } from "./utils.js";
-
-//#region src/server/cookies.ts
-/** @internal */
-const SHARED_COOKIE_OPTIONS = {
-	httpOnly: true,
-	sameSite: "none",
-	secure: true,
-	path: "/",
-	partitioned: true
-};
-const REDIRECT_MAX_AGE = 900;
-/** @internal */
-function redirectToParamCookie(providerId, redirectTo) {
-	return {
-		name: redirectToParamCookieName(providerId),
-		value: redirectTo,
-		options: {
-			...SHARED_COOKIE_OPTIONS,
-			maxAge: REDIRECT_MAX_AGE
-		}
-	};
-}
-/** @internal */
-function useRedirectToParam(providerId, cookies) {
-	const cookieName = redirectToParamCookieName(providerId);
-	const redirectTo = cookies[cookieName];
-	if (redirectTo === void 0) return null;
-	return {
-		redirectTo,
-		updatedCookie: {
-			name: cookieName,
-			value: "",
-			options: {
-				...SHARED_COOKIE_OPTIONS,
-				maxAge: 0
-			}
-		}
-	};
-}
-function redirectToParamCookieName(providerId) {
-	return (!isLocalHost(process.env.CONVEX_SITE_URL) ? "__Host-" : "") + providerId + "RedirectTo";
-}
-
-//#endregion
-export { SHARED_COOKIE_OPTIONS, redirectToParamCookie, useRedirectToParam };
-//# sourceMappingURL=cookies.js.map

package/dist/component/server/cookies.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cookies.js","names":[],"sources":["../../../src/server/cookies.ts"],"sourcesContent":["import { isLocalHost } from \"./utils\";\n\n/** @internal */\nexport const SHARED_COOKIE_OPTIONS = {\n  httpOnly: true,\n  sameSite: \"none\" as const,\n  secure: true,\n  path: \"/\",\n  partitioned: true,\n};\n\nconst REDIRECT_MAX_AGE = 60 * 15; // 15 minutes in seconds\n/** @internal */\nexport function redirectToParamCookie(providerId: string, redirectTo: string) {\n  return {\n    name: redirectToParamCookieName(providerId),\n    value: redirectTo,\n    options: { ...SHARED_COOKIE_OPTIONS, maxAge: REDIRECT_MAX_AGE },\n  };\n}\n\n/** @internal */\nexport function useRedirectToParam(\n  providerId: string,\n  cookies: Record<string, string | undefined>,\n) {\n  const cookieName = redirectToParamCookieName(providerId);\n  const redirectTo = cookies[cookieName];\n  if (redirectTo === undefined) {\n    return null;\n  }\n\n  // Clear the cookie\n  const updatedCookie = {\n    name: cookieName,\n    value: \"\",\n    options: { ...SHARED_COOKIE_OPTIONS, maxAge: 0 },\n  };\n\n  return { redirectTo, updatedCookie };\n}\n\nfunction redirectToParamCookieName(providerId: string) {\n  return (\n    (!isLocalHost(process.env.CONVEX_SITE_URL) ? \"__Host-\" : \"\") +\n    providerId +\n    \"RedirectTo\"\n  );\n}\n"],"mappings":";;;;AAGA,MAAa,wBAAwB;CACnC,UAAU;CACV,UAAU;CACV,QAAQ;CACR,MAAM;CACN,aAAa;CACd;AAED,MAAM,mBAAmB;;AAEzB,SAAgB,sBAAsB,YAAoB,YAAoB;AAC5E,QAAO;EACL,MAAM,0BAA0B,WAAW;EAC3C,OAAO;EACP,SAAS;GAAE,GAAG;GAAuB,QAAQ;GAAkB;EAChE;;;AAIH,SAAgB,mBACd,YACA,SACA;CACA,MAAM,aAAa,0BAA0B,WAAW;CACxD,MAAM,aAAa,QAAQ;AAC3B,KAAI,eAAe,OACjB,QAAO;AAUT,QAAO;EAAE;EAAY,eANC;GACpB,MAAM;GACN,OAAO;GACP,SAAS;IAAE,GAAG;IAAuB,QAAQ;IAAG;GACjD;EAEmC;;AAGtC,SAAS,0BAA0B,YAAoB;AACrD,SACG,CAAC,YAAY,QAAQ,IAAI,gBAAgB,GAAG,YAAY,MACzD,aACA"}