@usehercules/convex 0.0.0

package/dist/shared/sync.js

@@ -0,0 +1,18 @@
+// Access Control projection sync — v3 wire contract.
+//
+// This module is the consumer-side entry point for the signed projection sync
+// channel. The wire shapes themselves live in `./projection-protocol` (the zod
+// mirror of the producer's source of truth); this file re-exports them and adds
+// the non-wire pieces the HTTP handler and the Convex component need:
+//   • ACCESS_CONTROL_SYNC_PATH — the webhook route the producer posts to.
+//   • SyncResponse — the mutation's response contract (mapped to HTTP statuses
+//     by client/http.ts and consumed by the producer's reconciler).
+//
+// There is NO v2 compatibility: the old per-scope `scopes[].entities` + composite
+// `changes` wire schema is gone. v3 carries a deployment-wide catalog + users at
+// the top level and per-scope runtime state, with typed discriminated change
+// identities (see projection-protocol.ts).
+export const ACCESS_CONTROL_SYNC_PATH = "/_hercules/access-control/sync";
+// ── v3 wire schema + types (re-exported from the protocol mirror) ────────────
+export { accessProjectionSyncPayloadSchema, accessProjectionSnapshotSchema, accessProjectionEventSchema, accessProjectionEffectSchema, accessProjectionApplicabilitySchema, accessProjectionWildcardModeSchema, accessProjectionPermissionClassificationSchema, accessProjectionScopeKindSchema, accessProjectionScopeStatusSchema, accessProjectionAccountEntryModeSchema, accessProjectionPrincipalStatusSchema, projectionUserSchema, projectionCatalogRoleSchema, projectionCatalogPermissionSchema, projectionCatalogRolePermissionSchema, projectionCatalogSchema, projectionScopeMetadataSchema, projectionPrincipalSchema, projectionPrincipalMembershipSchema, projectionScopeTenantRoleSchema, projectionScopeRolePermissionOverrideSchema, projectionScopeRoleBindingSchema, projectionScopePermissionBindingSchema, projectionScopeSchema, projectionScopeDeltaSchema, projectionCatalogDeltaSchema, projectionUserDeltaSchema, } from "./projection-protocol";
+//# sourceMappingURL=sync.js.map

package/dist/shared/sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.js","sourceRoot":"","sources":["../../src/shared/sync.ts"],"names":[],"mappings":"AAAA,qDAAqD;AACrD,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,gFAAgF;AAChF,sEAAsE;AACtE,0EAA0E;AAC1E,+EAA+E;AAC/E,oEAAoE;AACpE,EAAE;AACF,kFAAkF;AAClF,iFAAiF;AACjF,6EAA6E;AAC7E,2CAA2C;AAE3C,MAAM,CAAC,MAAM,wBAAwB,GAAG,gCAAgC,CAAC;AAEzE,gFAAgF;AAChF,OAAO,EACL,iCAAiC,EACjC,8BAA8B,EAC9B,2BAA2B,EAC3B,4BAA4B,EAC5B,mCAAmC,EACnC,kCAAkC,EAClC,8CAA8C,EAC9C,+BAA+B,EAC/B,iCAAiC,EACjC,sCAAsC,EACtC,qCAAqC,EACrC,oBAAoB,EACpB,2BAA2B,EAC3B,iCAAiC,EACjC,qCAAqC,EACrC,uBAAuB,EACvB,6BAA6B,EAC7B,yBAAyB,EACzB,mCAAmC,EACnC,+BAA+B,EAC/B,2CAA2C,EAC3C,gCAAgC,EAChC,sCAAsC,EACtC,qBAAqB,EACrB,0BAA0B,EAC1B,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC"}

package/dist/shared/token.d.ts

@@ -0,0 +1,5 @@
+export declare function parseTokenIdentifier(tokenIdentifier: string): {
+    issuer: string;
+    subject: string;
+} | null;
+//# sourceMappingURL=token.d.ts.map

package/dist/shared/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../src/shared/token.ts"],"names":[],"mappings":"AAQA,wBAAgB,oBAAoB,CAAC,eAAe,EAAE,MAAM;;;SAS3D"}

package/dist/shared/token.js

@@ -0,0 +1,19 @@
+// Canonical Convex `tokenIdentifier` parser, shared by the component-side
+// authorization paths (effective.ts, checks.ts, queries.ts).
+//
+// Convex composes a verified identity's `tokenIdentifier` as `${issuer}|${subject}`.
+// This split is security-load-bearing: the evaluator resolves a caller to a
+// principal by `subject` and fences on `issuer`, so every consumer MUST agree on
+// the exact parse. Keep it in one place so the issuer/subject boundary cannot
+// drift between call sites.
+export function parseTokenIdentifier(tokenIdentifier) {
+    const separatorIndex = tokenIdentifier.lastIndexOf("|");
+    if (separatorIndex <= 0 || separatorIndex === tokenIdentifier.length - 1) {
+        return null;
+    }
+    return {
+        issuer: tokenIdentifier.slice(0, separatorIndex),
+        subject: tokenIdentifier.slice(separatorIndex + 1),
+    };
+}
+//# sourceMappingURL=token.js.map

package/dist/shared/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/shared/token.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,6DAA6D;AAC7D,EAAE;AACF,qFAAqF;AACrF,4EAA4E;AAC5E,iFAAiF;AACjF,8EAA8E;AAC9E,4BAA4B;AAC5B,MAAM,UAAU,oBAAoB,CAAC,eAAuB;IAC1D,MAAM,cAAc,GAAG,eAAe,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,cAAc,IAAI,CAAC,IAAI,cAAc,KAAK,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC;QAChD,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC;KACnD,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,89 @@
+{
+  "name": "@usehercules/convex",
+  "version": "0.0.0",
+  "description": "Convex Access Control utilities for Hercules applications",
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/client/index.d.ts",
+      "default": "./dist/client/index.js"
+    },
+    "./access-admin": {
+      "types": "./dist/client/access-admin.d.ts",
+      "default": "./dist/client/access-admin.js"
+    },
+    "./access-admin.js": {
+      "types": "./dist/client/access-admin.d.ts",
+      "default": "./dist/client/access-admin.js"
+    },
+    "./http": {
+      "types": "./dist/client/http.d.ts",
+      "default": "./dist/client/http.js"
+    },
+    "./checker": {
+      "types": "./dist/checker/index.d.ts",
+      "default": "./dist/checker/index.js"
+    },
+    "./convex.config.js": {
+      "types": "./dist/component/convex.config.d.ts",
+      "default": "./dist/component/convex.config.js"
+    },
+    "./convex.config": {
+      "types": "./dist/component/convex.config.d.ts",
+      "default": "./dist/component/convex.config.js"
+    },
+    "./_generated/component.js": {
+      "types": "./dist/_generated/component.d.ts",
+      "default": "./dist/_generated/component.js"
+    },
+    "./_generated/component": {
+      "types": "./dist/_generated/component.d.ts",
+      "default": "./dist/_generated/component.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "bin": {
+    "hercules-convex-access-check": "./dist/checker/cli.js"
+  },
+  "author": "Hercules Team",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/withzeusai/hercules-js.git",
+    "directory": "packages/convex"
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@usehercules/sdk": "^1.14.5",
+    "convex-helpers": "0.1.119",
+    "standardwebhooks": "^1.0.0",
+    "tslib": "^2.8.1",
+    "typescript": "^5.9.3",
+    "zod": "^4.3.6"
+  },
+  "peerDependencies": {
+    "convex": "^1.34.0"
+  },
+  "devDependencies": {
+    "@edge-runtime/vm": "^5.0.0",
+    "@types/node": "^24.10.15",
+    "convex": "^1.34.1",
+    "convex-test": "^0.0.53",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.0"
+  },
+  "main": "./dist/client/index.js",
+  "module": "./dist/client/index.js",
+  "types": "./dist/client/index.d.ts",
+  "scripts": {
+    "build": "tsc --project ./tsconfig.build.json",
+    "dev": "tsc --project ./tsconfig.build.json --watch",
+    "test": "vitest --run"
+  }
+}