convex 1.43.0 → 1.45.0-alpha.0

package/dist/cjs/cli/login.js

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -15,6 +17,14 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var login_exports = {};
 __export(login_exports, {
@@ -22,6 +32,7 @@ __export(login_exports, {
 });
 module.exports = __toCommonJS(login_exports);
 var import_extra_typings = require("@commander-js/extra-typings");
+var dotenv = __toESM(require("dotenv"), 1);
 var import_context = require("../bundler/context.js");
 var import_log = require("../bundler/log.js");
 var import_login = require("./lib/login.js");
@@ -35,26 +46,59 @@ var import_deploymentSelection = require("./lib/deploymentSelection.js");
 var import_deployment = require("./lib/deployment.js");
 var import_globalConfig = require("./lib/utils/globalConfig.js");
 var import_api = require("./lib/api.js");
+function deployKeyEnvFile(ctx, envVarName, value) {
+  for (const file of [import_utils.ENV_VAR_FILE_PATH, ".env"]) {
+    if (!ctx.fs.exists(file)) {
+      continue;
+    }
+    if (dotenv.parse(ctx.fs.readUtf8File(file))[envVarName] === value) {
+      return file;
+    }
+  }
+  return null;
+}
+async function reportDeployKeyInWorkingDirectory(ctx, auth) {
+  if (auth === null || auth.kind === "accessToken" || auth.kind === "previewDeployKey") {
+    return;
+  }
+  const key = auth.kind === "projectKey" ? auth.projectKey : auth.deploymentKey;
+  const envVarName = process.env[import_utils.CONVEX_DEPLOY_KEY_ENV_VAR_NAME] ? import_utils.CONVEX_DEPLOY_KEY_ENV_VAR_NAME : import_utils.CONVEX_DEPLOYMENT_TOKEN_ENV_VAR_NAME;
+  const envFile = deployKeyEnvFile(ctx, envVarName, key);
+  const source = envFile ?? "shell environment";
+  const secret = key.slice(key.indexOf("|") + 1);
+  if (await (0, import_login.isAuthorizedHeader)(ctx, `Bearer ${secret}`)) {
+    (0, import_log.logMessage)(`Working Directory: Valid ${envVarName} in ${source}`);
+    return;
+  }
+  (0, import_log.logWarning)(`Working Directory: Invalid ${envVarName} in ${source}`);
+}
 const loginStatus = new import_extra_typings.Command("status").description("Check login status and list accessible teams").allowExcessArguments(false).action(async () => {
   const ctx = await (0, import_context.oneoffContext)({
     url: void 0,
     adminKey: void 0,
     envFile: void 0
   });
+  const auth = ctx.bigBrainAuth();
   const globalConfig = (0, import_globalConfig.readGlobalConfig)(ctx);
-  const hasToken = globalConfig?.accessToken !== null;
-  if (hasToken) {
-    (0, import_log.logMessage)(`Convex account token found in: ${(0, import_globalConfig.globalConfigPath)()}`);
-  } else {
-    (0, import_log.logMessage)("No token found locally");
+  if (globalConfig === null) {
+    (0, import_log.logMessage)(`No Convex account token found in: ${(0, import_globalConfig.globalConfigPath)()}`);
+    (0, import_log.logMessage)("Status: Not logged in");
+    await reportDeployKeyInWorkingDirectory(ctx, auth);
     return;
   }
-  const isLoggedIn = await (0, import_login.checkAuthorization)(ctx, false);
-  if (!isLoggedIn) {
+  (0, import_log.logMessage)(`Convex account token found in: ${(0, import_globalConfig.globalConfigPath)()}`);
+  const accessToken = globalConfig.accessToken;
+  if (!await (0, import_login.isAuthorizedHeader)(ctx, `Bearer ${accessToken}`)) {
     (0, import_log.logMessage)("Status: Not logged in");
+    await reportDeployKeyInWorkingDirectory(ctx, auth);
     return;
   }
   (0, import_log.logMessage)("Status: Logged in");
+  ctx._updateBigBrainAuth({
+    kind: "accessToken",
+    header: `Bearer ${accessToken}`,
+    accessToken
+  });
   const teams = await (0, import_api.getTeamsForUser)(ctx);
   (0, import_log.logMessage)(
     `Teams: ${teams.length} team${teams.length === 1 ? "" : "s"} accessible`
@@ -62,6 +106,7 @@ const loginStatus = new import_extra_typings.Command("status").description("Chec
   for (const team of teams) {
     (0, import_log.logMessage)(`  - ${team.name} (${team.slug})`);
   }
+  await reportDeployKeyInWorkingDirectory(ctx, auth);
 });
 const login = new import_extra_typings.Command("login").description("Login to Convex").allowExcessArguments(false).option(
   "--device-name <name>",

package/dist/cjs/cli/login.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/cli/login.ts"],
-  "sourcesContent": ["import { Command, Option } from \"@commander-js/extra-typings\";\nimport { Context, oneoffContext } from \"../bundler/context.js\";\nimport { logFinishedStep, logMessage } from \"../bundler/log.js\";\nimport { checkAuthorization, performLogin } from \"./lib/login.js\";\nimport {\n  loadProjectLocalConfig,\n  loadUuidForAnonymousUser,\n} from \"./lib/localDeployment/filePaths.js\";\nimport {\n  handleLinkToProject,\n  listLegacyAnonymousDeployments,\n} from \"./lib/localDeployment/anonymous.js\";\nimport {\n  DASHBOARD_HOST,\n  deploymentDashboardUrlPage,\n  teamDashboardUrl,\n} from \"./lib/dashboard.js\";\nimport { promptSearch, promptYesNo } from \"./lib/utils/prompts.js\";\nimport { validateOrSelectTeam } from \"./lib/utils/utils.js\";\nimport {\n  selectProject,\n  updateEnvAndConfigForDeploymentSelection,\n} from \"./configure.js\";\nimport {\n  getDeploymentSelection,\n  shouldAllowAnonymousDevelopment,\n} from \"./lib/deploymentSelection.js\";\nimport {\n  isAnonymousDeployment,\n  removeAnonymousPrefix,\n} from \"./lib/deployment.js\";\nimport {\n  readGlobalConfig,\n  globalConfigPath,\n} from \"./lib/utils/globalConfig.js\";\nimport { getTeamsForUser } from \"./lib/api.js\";\n\nconst loginStatus = new Command(\"status\")\n  .description(\"Check login status and list accessible teams\")\n  .allowExcessArguments(false)\n  .action(async () => {\n    const ctx = await oneoffContext({\n      url: undefined,\n      adminKey: undefined,\n      envFile: undefined,\n    });\n\n    const globalConfig = readGlobalConfig(ctx);\n    const hasToken = globalConfig?.accessToken !== null;\n\n    if (hasToken) {\n      logMessage(`Convex account token found in: ${globalConfigPath()}`);\n    } else {\n      logMessage(\"No token found locally\");\n      return;\n    }\n\n    const isLoggedIn = await checkAuthorization(ctx, false);\n\n    if (!isLoggedIn) {\n      logMessage(\"Status: Not logged in\");\n      return;\n    }\n\n    logMessage(\"Status: Logged in\");\n    const teams = await getTeamsForUser(ctx);\n    logMessage(\n      `Teams: ${teams.length} team${teams.length === 1 ? \"\" : \"s\"} accessible`,\n    );\n    for (const team of teams) {\n      logMessage(`  - ${team.name} (${team.slug})`);\n    }\n  });\n\nexport const login = new Command(\"login\")\n  .description(\"Login to Convex\")\n  .allowExcessArguments(false)\n  .option(\n    \"--device-name <name>\",\n    \"Provide a name for the device being authorized\",\n  )\n  .option(\n    \"-f, --force\",\n    \"Proceed with login even if a valid access token already exists for this device\",\n  )\n  .option(\n    \"--no-open\",\n    \"Don't automatically open the login link in the default browser\",\n  )\n  .addOption(\n    new Option(\n      \"--login-flow <mode>\",\n      `How to log in; defaults to guessing based on the environment.`,\n    )\n      .choices([\"paste\", \"auto\", \"poll\"] as const)\n      .default(\"auto\" as const),\n  )\n  .addOption(new Option(\"--link-deployments\").hideHelp())\n  // These options are hidden from the help/usage message, but allow overriding settings for testing.\n  // Change the auth credentials with the auth provider\n  .addOption(new Option(\"--override-auth-url <url>\").hideHelp())\n  .addOption(new Option(\"--override-auth-client <id>\").hideHelp())\n  .addOption(new Option(\"--override-auth-username <username>\").hideHelp())\n  .addOption(new Option(\"--override-auth-password <password>\").hideHelp())\n  // Skip the auth provider login and directly use this access token\n  .addOption(new Option(\"--override-access-token <token>\").hideHelp())\n  // Automatically accept opt ins without prompting\n  .addOption(new Option(\"--accept-opt-ins\").hideHelp())\n  // Dump the access token from the auth provider and skip authorization with Convex\n  .addOption(new Option(\"--dump-access-token\").hideHelp())\n  // Hidden option for tests to check if the user is logged in.\n  .addOption(new Option(\"--check-login\").hideHelp())\n  // Redirect to Vercel SSO integration URL\n  .addOption(\n    new Option(\n      \"--vercel\",\n      \"Redirect to Vercel SSO integration for login\",\n    ).hideHelp(),\n  )\n  // Override the Vercel URL slug (defaults to 'convex')\n  .addOption(new Option(\"--vercel-override <slug>\").hideHelp())\n  .addCommand(loginStatus)\n  .addHelpCommand(false)\n  .action(async (options, cmd: Command) => {\n    const ctx = await oneoffContext({\n      url: undefined,\n      adminKey: undefined,\n      envFile: undefined,\n    });\n    if (\n      !options.force &&\n      (await checkAuthorization(ctx, !!options.acceptOptIns))\n    ) {\n      logFinishedStep(\n        \"This device has previously been authorized and is ready for use with Convex.\",\n      );\n      await handleLinkingDeployments(ctx, {\n        interactive: !!options.linkDeployments,\n      });\n      return;\n    }\n    if (!options.force && options.checkLogin) {\n      const isLoggedIn = await checkAuthorization(ctx, !!options.acceptOptIns);\n      if (!isLoggedIn) {\n        return ctx.crash({\n          exitCode: 1,\n          errorType: \"fatal\",\n          errForSentry: \"You are not logged in.\",\n          printedMessage: \"You are not logged in.\",\n        });\n      }\n    }\n    if (!!options.overrideAuthUsername !== !!options.overrideAuthPassword) {\n      cmd.error(\n        \"If overriding credentials, both username and password must be provided\",\n      );\n    }\n\n    const uuid = loadUuidForAnonymousUser(ctx);\n    await performLogin(ctx, {\n      ...options,\n      anonymousId: uuid,\n      vercel: options.vercel,\n      vercelOverride: options.vercelOverride,\n    });\n\n    await handleLinkingDeployments(ctx, {\n      interactive: !!options.linkDeployments,\n    });\n  });\n\nasync function handleLinkingDeployments(\n  ctx: Context,\n  args: {\n    interactive: boolean;\n  },\n) {\n  if (!shouldAllowAnonymousDevelopment()) {\n    return;\n  }\n\n  // Check for project-local anonymous deployment first - this takes priority\n  const projectLocal = loadProjectLocalConfig(ctx);\n  if (\n    projectLocal !== null &&\n    isAnonymousDeployment(projectLocal.deploymentName)\n  ) {\n    const shouldLink = await promptYesNo(ctx, {\n      message: `Would you like to link your existing deployment to your account? (\"${projectLocal.deploymentName}\")`,\n      default: true,\n    });\n    if (!shouldLink) {\n      logMessage(\n        \"Not linking your existing deployment. If you want to link it later, run `npx convex login --link-deployments`.\",\n      );\n      logMessage(\n        `Visit ${DASHBOARD_HOST} or run \\`npx convex dev\\` to get started with your new account.`,\n      );\n      return;\n    }\n\n    const { dashboardUrl } = await linkSingleDeployment(\n      ctx,\n      projectLocal.deploymentName,\n      projectLocal.deploymentName,\n    );\n    logFinishedStep(`Visit ${dashboardUrl} to get started.`);\n    return;\n  }\n\n  // No project-local deployment - check for legacy deployments\n  const legacyDeployments = listLegacyAnonymousDeployments(ctx);\n  if (legacyDeployments.length === 0) {\n    if (args.interactive) {\n      logMessage(\n        \"It doesn't look like you have any deployments to link. You can run `npx convex dev` to set up a new project or select an existing one.\",\n      );\n    }\n    return;\n  }\n\n  // Get the currently configured deployment (if any) for env var updates\n  const deploymentSelection = await getDeploymentSelection(ctx, {\n    url: undefined,\n    adminKey: undefined,\n    envFile: undefined,\n  });\n  const configuredDeployment =\n    deploymentSelection.kind === \"anonymous\"\n      ? deploymentSelection.deploymentName\n      : null;\n\n  if (!args.interactive) {\n    // Non-interactive: link all legacy deployments automatically\n    const message = getMessage(legacyDeployments.map((d) => d.deploymentName));\n    const createProjects = await promptYesNo(ctx, {\n      message,\n      default: true,\n    });\n    if (!createProjects) {\n      logMessage(\n        \"Not linking your existing deployments. If you want to link them later, run `npx convex login --link-deployments`.\",\n      );\n      logMessage(\n        `Visit ${DASHBOARD_HOST} or run \\`npx convex dev\\` to get started with your new account.`,\n      );\n      return;\n    }\n\n    const {\n      team: { slug: teamSlug },\n    } = await validateOrSelectTeam(\n      ctx,\n      undefined,\n      \"Choose a team for your deployments:\",\n    );\n    let dashboardUrl = teamDashboardUrl(teamSlug);\n    for (const deployment of legacyDeployments) {\n      const result = await linkSingleDeployment(\n        ctx,\n        deployment.deploymentName,\n        configuredDeployment,\n        { teamSlug, projectSlug: null },\n      );\n      if (deployment.deploymentName === configuredDeployment) {\n        dashboardUrl = result.dashboardUrl;\n      }\n    }\n    logFinishedStep(\n      `Successfully linked your deployments! Visit ${dashboardUrl} to get started.`,\n    );\n    return;\n  }\n\n  // Interactive mode: let user choose which legacy deployments to link\n  while (true) {\n    const currentLegacyDeployments = listLegacyAnonymousDeployments(ctx);\n    if (currentLegacyDeployments.length === 0) {\n      logMessage(\"All deployments have been linked.\");\n      break;\n    }\n    logMessage(\n      getDeploymentListMessage(\n        currentLegacyDeployments.map((d) => d.deploymentName),\n      ),\n    );\n    const deploymentToLink = await promptSearch(ctx, {\n      message: \"Which deployment would you like to link to your account?\",\n      choices: currentLegacyDeployments.map((d) => ({\n        name: d.deploymentName,\n        value: d.deploymentName,\n      })),\n    });\n\n    await linkSingleDeployment(ctx, deploymentToLink, configuredDeployment);\n\n    const shouldContinue = await promptYesNo(ctx, {\n      message: \"Would you like to link another deployment?\",\n      default: true,\n    });\n    if (!shouldContinue) {\n      break;\n    }\n  }\n}\n\n/**\n * Link a single deployment to a project, prompting for team and project selection.\n * Updates env vars if this is the currently configured deployment.\n */\nasync function linkSingleDeployment(\n  ctx: Context,\n  deploymentName: string,\n  configuredDeployment: string | null,\n  options?: {\n    teamSlug?: string;\n    projectSlug?: string | null;\n  },\n): Promise<{ dashboardUrl: string }> {\n  const { team } = await validateOrSelectTeam(\n    ctx,\n    options?.teamSlug,\n    \"Choose a team for your deployment:\",\n  );\n\n  const projectSlug =\n    options?.projectSlug ??\n    (\n      await selectProject(ctx, \"ask\", {\n        team: team.slug,\n        devDeployment: \"local\",\n        defaultProjectName: removeAnonymousPrefix(deploymentName),\n      })\n    ).projectSlug;\n\n  const linkedDeployment = await handleLinkToProject(ctx, {\n    deploymentName,\n    teamSlug: team.slug,\n    teamId: team.id,\n    projectSlug,\n  });\n\n  if (deploymentName === configuredDeployment) {\n    await updateEnvAndConfigForDeploymentSelection(\n      ctx,\n      {\n        url: linkedDeployment.deploymentUrl,\n        deploymentName: linkedDeployment.deploymentName,\n        teamSlug: team.slug,\n        projectSlug: linkedDeployment.projectSlug,\n        deploymentType: \"local\",\n      },\n      configuredDeployment,\n    );\n  }\n\n  return {\n    dashboardUrl: deploymentDashboardUrlPage(\n      linkedDeployment.deploymentName,\n      \"\",\n    ),\n  };\n}\n\nfunction getDeploymentListMessage(anonymousDeploymentNames: string[]) {\n  let message = `You have ${anonymousDeploymentNames.length} existing deployments.`;\n  message += `\\n\\nDeployments:`;\n  for (const deploymentName of anonymousDeploymentNames) {\n    message += `\\n- ${deploymentName}`;\n  }\n  return message;\n}\n\nfunction getMessage(anonymousDeploymentNames: string[]) {\n  if (anonymousDeploymentNames.length === 1) {\n    return `Would you like to link your existing deployment to your account? (\"${anonymousDeploymentNames[0]}\")`;\n  }\n  let message = `You have ${anonymousDeploymentNames.length} existing deployments. Would you like to link them to your account?`;\n  message += `\\n\\nDeployments:`;\n  for (const deploymentName of anonymousDeploymentNames) {\n    message += `\\n- ${deploymentName}`;\n  }\n  message += `\\n\\nYou can alternatively run \\`npx convex login --link-deployments\\` to interactively choose which deployments to add.`;\n  return message;\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,2BAAgC;AAChC,qBAAuC;AACvC,iBAA4C;AAC5C,mBAAiD;AACjD,uBAGO;AACP,uBAGO;AACP,uBAIO;AACP,qBAA0C;AAC1C,mBAAqC;AACrC,uBAGO;AACP,iCAGO;AACP,wBAGO;AACP,0BAGO;AACP,iBAAgC;AAEhC,MAAM,cAAc,IAAI,6BAAQ,QAAQ,EACrC,YAAY,8CAA8C,EAC1D,qBAAqB,KAAK,EAC1B,OAAO,YAAY;AAClB,QAAM,MAAM,UAAM,8BAAc;AAAA,IAC9B,KAAK;AAAA,IACL,UAAU;AAAA,IACV,SAAS;AAAA,EACX,CAAC;AAED,QAAM,mBAAe,sCAAiB,GAAG;AACzC,QAAM,WAAW,cAAc,gBAAgB;AAE/C,MAAI,UAAU;AACZ,+BAAW,sCAAkC,sCAAiB,CAAC,EAAE;AAAA,EACnE,OAAO;AACL,+BAAW,wBAAwB;AACnC;AAAA,EACF;AAEA,QAAM,aAAa,UAAM,iCAAmB,KAAK,KAAK;AAEtD,MAAI,CAAC,YAAY;AACf,+BAAW,uBAAuB;AAClC;AAAA,EACF;AAEA,6BAAW,mBAAmB;AAC9B,QAAM,QAAQ,UAAM,4BAAgB,GAAG;AACvC;AAAA,IACE,UAAU,MAAM,MAAM,QAAQ,MAAM,WAAW,IAAI,KAAK,GAAG;AAAA,EAC7D;AACA,aAAW,QAAQ,OAAO;AACxB,+BAAW,OAAO,KAAK,IAAI,KAAK,KAAK,IAAI,GAAG;AAAA,EAC9C;AACF,CAAC;AAEI,MAAM,QAAQ,IAAI,6BAAQ,OAAO,EACrC,YAAY,iBAAiB,EAC7B,qBAAqB,KAAK,EAC1B;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC,IAAI;AAAA,IACF;AAAA,IACA;AAAA,EACF,EACG,QAAQ,CAAC,SAAS,QAAQ,MAAM,CAAU,EAC1C,QAAQ,MAAe;AAC5B,EACC,UAAU,IAAI,4BAAO,oBAAoB,EAAE,SAAS,CAAC,EAGrD,UAAU,IAAI,4BAAO,2BAA2B,EAAE,SAAS,CAAC,EAC5D,UAAU,IAAI,4BAAO,6BAA6B,EAAE,SAAS,CAAC,EAC9D,UAAU,IAAI,4BAAO,qCAAqC,EAAE,SAAS,CAAC,EACtE,UAAU,IAAI,4BAAO,qCAAqC,EAAE,SAAS,CAAC,EAEtE,UAAU,IAAI,4BAAO,iCAAiC,EAAE,SAAS,CAAC,EAElE,UAAU,IAAI,4BAAO,kBAAkB,EAAE,SAAS,CAAC,EAEnD,UAAU,IAAI,4BAAO,qBAAqB,EAAE,SAAS,CAAC,EAEtD,UAAU,IAAI,4BAAO,eAAe,EAAE,SAAS,CAAC,EAEhD;AAAA,EACC,IAAI;AAAA,IACF;AAAA,IACA;AAAA,EACF,EAAE,SAAS;AACb,EAEC,UAAU,IAAI,4BAAO,0BAA0B,EAAE,SAAS,CAAC,EAC3D,WAAW,WAAW,EACtB,eAAe,KAAK,EACpB,OAAO,OAAO,SAAS,QAAiB;AACvC,QAAM,MAAM,UAAM,8BAAc;AAAA,IAC9B,KAAK;AAAA,IACL,UAAU;AAAA,IACV,SAAS;AAAA,EACX,CAAC;AACD,MACE,CAAC,QAAQ,SACR,UAAM,iCAAmB,KAAK,CAAC,CAAC,QAAQ,YAAY,GACrD;AACA;AAAA,MACE;AAAA,IACF;AACA,UAAM,yBAAyB,KAAK;AAAA,MAClC,aAAa,CAAC,CAAC,QAAQ;AAAA,IACzB,CAAC;AACD;AAAA,EACF;AACA,MAAI,CAAC,QAAQ,SAAS,QAAQ,YAAY;AACxC,UAAM,aAAa,UAAM,iCAAmB,KAAK,CAAC,CAAC,QAAQ,YAAY;AACvE,QAAI,CAAC,YAAY;AACf,aAAO,IAAI,MAAM;AAAA,QACf,UAAU;AAAA,QACV,WAAW;AAAA,QACX,cAAc;AAAA,QACd,gBAAgB;AAAA,MAClB,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI,CAAC,CAAC,QAAQ,yBAAyB,CAAC,CAAC,QAAQ,sBAAsB;AACrE,QAAI;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,WAAO,2CAAyB,GAAG;AACzC,YAAM,2BAAa,KAAK;AAAA,IACtB,GAAG;AAAA,IACH,aAAa;AAAA,IACb,QAAQ,QAAQ;AAAA,IAChB,gBAAgB,QAAQ;AAAA,EAC1B,CAAC;AAED,QAAM,yBAAyB,KAAK;AAAA,IAClC,aAAa,CAAC,CAAC,QAAQ;AAAA,EACzB,CAAC;AACH,CAAC;AAEH,eAAe,yBACb,KACA,MAGA;AACA,MAAI,KAAC,4DAAgC,GAAG;AACtC;AAAA,EACF;AAGA,QAAM,mBAAe,yCAAuB,GAAG;AAC/C,MACE,iBAAiB,YACjB,yCAAsB,aAAa,cAAc,GACjD;AACA,UAAM,aAAa,UAAM,4BAAY,KAAK;AAAA,MACxC,SAAS,sEAAsE,aAAa,cAAc;AAAA,MAC1G,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAAC,YAAY;AACf;AAAA,QACE;AAAA,MACF;AACA;AAAA,QACE,SAAS,+BAAc;AAAA,MACzB;AACA;AAAA,IACF;AAEA,UAAM,EAAE,aAAa,IAAI,MAAM;AAAA,MAC7B;AAAA,MACA,aAAa;AAAA,MACb,aAAa;AAAA,IACf;AACA,oCAAgB,SAAS,YAAY,kBAAkB;AACvD;AAAA,EACF;AAGA,QAAM,wBAAoB,iDAA+B,GAAG;AAC5D,MAAI,kBAAkB,WAAW,GAAG;AAClC,QAAI,KAAK,aAAa;AACpB;AAAA,QACE;AAAA,MACF;AAAA,IACF;AACA;AAAA,EACF;AAGA,QAAM,sBAAsB,UAAM,mDAAuB,KAAK;AAAA,IAC5D,KAAK;AAAA,IACL,UAAU;AAAA,IACV,SAAS;AAAA,EACX,CAAC;AACD,QAAM,uBACJ,oBAAoB,SAAS,cACzB,oBAAoB,iBACpB;AAEN,MAAI,CAAC,KAAK,aAAa;AAErB,UAAM,UAAU,WAAW,kBAAkB,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC;AACzE,UAAM,iBAAiB,UAAM,4BAAY,KAAK;AAAA,MAC5C;AAAA,MACA,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAAC,gBAAgB;AACnB;AAAA,QACE;AAAA,MACF;AACA;AAAA,QACE,SAAS,+BAAc;AAAA,MACzB;AACA;AAAA,IACF;AAEA,UAAM;AAAA,MACJ,MAAM,EAAE,MAAM,SAAS;AAAA,IACzB,IAAI,UAAM;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,mBAAe,mCAAiB,QAAQ;AAC5C,eAAW,cAAc,mBAAmB;AAC1C,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA,QACA,WAAW;AAAA,QACX;AAAA,QACA,EAAE,UAAU,aAAa,KAAK;AAAA,MAChC;AACA,UAAI,WAAW,mBAAmB,sBAAsB;AACtD,uBAAe,OAAO;AAAA,MACxB;AAAA,IACF;AACA;AAAA,MACE,+CAA+C,YAAY;AAAA,IAC7D;AACA;AAAA,EACF;AAGA,SAAO,MAAM;AACX,UAAM,+BAA2B,iDAA+B,GAAG;AACnE,QAAI,yBAAyB,WAAW,GAAG;AACzC,iCAAW,mCAAmC;AAC9C;AAAA,IACF;AACA;AAAA,MACE;AAAA,QACE,yBAAyB,IAAI,CAAC,MAAM,EAAE,cAAc;AAAA,MACtD;AAAA,IACF;AACA,UAAM,mBAAmB,UAAM,6BAAa,KAAK;AAAA,MAC/C,SAAS;AAAA,MACT,SAAS,yBAAyB,IAAI,CAAC,OAAO;AAAA,QAC5C,MAAM,EAAE;AAAA,QACR,OAAO,EAAE;AAAA,MACX,EAAE;AAAA,IACJ,CAAC;AAED,UAAM,qBAAqB,KAAK,kBAAkB,oBAAoB;AAEtE,UAAM,iBAAiB,UAAM,4BAAY,KAAK;AAAA,MAC5C,SAAS;AAAA,MACT,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAAC,gBAAgB;AACnB;AAAA,IACF;AAAA,EACF;AACF;AAMA,eAAe,qBACb,KACA,gBACA,sBACA,SAImC;AACnC,QAAM,EAAE,KAAK,IAAI,UAAM;AAAA,IACrB;AAAA,IACA,SAAS;AAAA,IACT;AAAA,EACF;AAEA,QAAM,cACJ,SAAS,gBAEP,UAAM,gCAAc,KAAK,OAAO;AAAA,IAC9B,MAAM,KAAK;AAAA,IACX,eAAe;AAAA,IACf,wBAAoB,yCAAsB,cAAc;AAAA,EAC1D,CAAC,GACD;AAEJ,QAAM,mBAAmB,UAAM,sCAAoB,KAAK;AAAA,IACtD;AAAA,IACA,UAAU,KAAK;AAAA,IACf,QAAQ,KAAK;AAAA,IACb;AAAA,EACF,CAAC;AAED,MAAI,mBAAmB,sBAAsB;AAC3C,cAAM;AAAA,MACJ;AAAA,MACA;AAAA,QACE,KAAK,iBAAiB;AAAA,QACtB,gBAAgB,iBAAiB;AAAA,QACjC,UAAU,KAAK;AAAA,QACf,aAAa,iBAAiB;AAAA,QAC9B,gBAAgB;AAAA,MAClB;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,kBAAc;AAAA,MACZ,iBAAiB;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,yBAAyB,0BAAoC;AACpE,MAAI,UAAU,YAAY,yBAAyB,MAAM;AACzD,aAAW;AAAA;AAAA;AACX,aAAW,kBAAkB,0BAA0B;AACrD,eAAW;AAAA,IAAO,cAAc;AAAA,EAClC;AACA,SAAO;AACT;AAEA,SAAS,WAAW,0BAAoC;AACtD,MAAI,yBAAyB,WAAW,GAAG;AACzC,WAAO,sEAAsE,yBAAyB,CAAC,CAAC;AAAA,EAC1G;AACA,MAAI,UAAU,YAAY,yBAAyB,MAAM;AACzD,aAAW;AAAA;AAAA;AACX,aAAW,kBAAkB,0BAA0B;AACrD,eAAW;AAAA,IAAO,cAAc;AAAA,EAClC;AACA,aAAW;AAAA;AAAA;AACX,SAAO;AACT;",
+  "sourcesContent": ["import { Command, Option } from \"@commander-js/extra-typings\";\nimport * as dotenv from \"dotenv\";\nimport { BigBrainAuth, Context, oneoffContext } from \"../bundler/context.js\";\nimport { logFinishedStep, logMessage, logWarning } from \"../bundler/log.js\";\nimport {\n  checkAuthorization,\n  isAuthorizedHeader,\n  performLogin,\n} from \"./lib/login.js\";\nimport {\n  loadProjectLocalConfig,\n  loadUuidForAnonymousUser,\n} from \"./lib/localDeployment/filePaths.js\";\nimport {\n  handleLinkToProject,\n  listLegacyAnonymousDeployments,\n} from \"./lib/localDeployment/anonymous.js\";\nimport {\n  DASHBOARD_HOST,\n  deploymentDashboardUrlPage,\n  teamDashboardUrl,\n} from \"./lib/dashboard.js\";\nimport { promptSearch, promptYesNo } from \"./lib/utils/prompts.js\";\nimport {\n  CONVEX_DEPLOY_KEY_ENV_VAR_NAME,\n  CONVEX_DEPLOYMENT_TOKEN_ENV_VAR_NAME,\n  ENV_VAR_FILE_PATH,\n  validateOrSelectTeam,\n} from \"./lib/utils/utils.js\";\nimport {\n  selectProject,\n  updateEnvAndConfigForDeploymentSelection,\n} from \"./configure.js\";\nimport {\n  getDeploymentSelection,\n  shouldAllowAnonymousDevelopment,\n} from \"./lib/deploymentSelection.js\";\nimport {\n  isAnonymousDeployment,\n  removeAnonymousPrefix,\n} from \"./lib/deployment.js\";\nimport {\n  readGlobalConfig,\n  globalConfigPath,\n} from \"./lib/utils/globalConfig.js\";\nimport { getTeamsForUser } from \"./lib/api.js\";\n\n/**\n * The env file a deploy key came from, or null if it came from the shell.\n * `dotenv` doesn't overwrite variables that are already set, so a value from\n * the shell outranks these files -- match on the value to tell them apart.\n */\nfunction deployKeyEnvFile(\n  ctx: Context,\n  envVarName: string,\n  value: string,\n): string | null {\n  for (const file of [ENV_VAR_FILE_PATH, \".env\"]) {\n    if (!ctx.fs.exists(file)) {\n      continue;\n    }\n    if (dotenv.parse(ctx.fs.readUtf8File(file))[envVarName] === value) {\n      return file;\n    }\n  }\n  return null;\n}\n\n/**\n * A project or deployment key in the environment outranks the account token for\n * commands run from this directory, and an expired one makes the CLI look\n * logged out, so report it separately from the account.\n */\nasync function reportDeployKeyInWorkingDirectory(\n  ctx: Context,\n  auth: BigBrainAuth | null,\n) {\n  // A preview deploy key is only used when there's no account token at all.\n  if (\n    auth === null ||\n    auth.kind === \"accessToken\" ||\n    auth.kind === \"previewDeployKey\"\n  ) {\n    return;\n  }\n  const key = auth.kind === \"projectKey\" ? auth.projectKey : auth.deploymentKey;\n  const envVarName = process.env[CONVEX_DEPLOY_KEY_ENV_VAR_NAME]\n    ? CONVEX_DEPLOY_KEY_ENV_VAR_NAME\n    : CONVEX_DEPLOYMENT_TOKEN_ENV_VAR_NAME;\n  const envFile = deployKeyEnvFile(ctx, envVarName, key);\n  const source = envFile ?? \"shell environment\";\n  // Big Brain only strips a `project:`/`team:` prefix itself, so a deployment\n  // key authorizes only without its `dev:`/`prod:` prefix. Split on the first\n  // `|` like the server does, so a secret containing one survives.\n  const secret = key.slice(key.indexOf(\"|\") + 1);\n  if (await isAuthorizedHeader(ctx, `Bearer ${secret}`)) {\n    logMessage(`Working Directory: Valid ${envVarName} in ${source}`);\n    return;\n  }\n  logWarning(`Working Directory: Invalid ${envVarName} in ${source}`);\n}\n\nconst loginStatus = new Command(\"status\")\n  .description(\"Check login status and list accessible teams\")\n  .allowExcessArguments(false)\n  .action(async () => {\n    const ctx = await oneoffContext({\n      url: undefined,\n      adminKey: undefined,\n      envFile: undefined,\n    });\n\n    // `_updateBigBrainAuth` below replaces any deploy key in `ctx` with the\n    // account token, so read the deploy key first.\n    const auth = ctx.bigBrainAuth();\n\n    const globalConfig = readGlobalConfig(ctx);\n    if (globalConfig === null) {\n      logMessage(`No Convex account token found in: ${globalConfigPath()}`);\n      logMessage(\"Status: Not logged in\");\n      await reportDeployKeyInWorkingDirectory(ctx, auth);\n      return;\n    }\n    logMessage(`Convex account token found in: ${globalConfigPath()}`);\n\n    const accessToken = globalConfig.accessToken;\n    if (!(await isAuthorizedHeader(ctx, `Bearer ${accessToken}`))) {\n      logMessage(\"Status: Not logged in\");\n      await reportDeployKeyInWorkingDirectory(ctx, auth);\n      return;\n    }\n\n    logMessage(\"Status: Logged in\");\n    // Describe the account, even if a deploy key outranks it for other commands.\n    ctx._updateBigBrainAuth({\n      kind: \"accessToken\",\n      header: `Bearer ${accessToken}`,\n      accessToken,\n    });\n    const teams = await getTeamsForUser(ctx);\n    logMessage(\n      `Teams: ${teams.length} team${teams.length === 1 ? \"\" : \"s\"} accessible`,\n    );\n    for (const team of teams) {\n      logMessage(`  - ${team.name} (${team.slug})`);\n    }\n    await reportDeployKeyInWorkingDirectory(ctx, auth);\n  });\n\nexport const login = new Command(\"login\")\n  .description(\"Login to Convex\")\n  .allowExcessArguments(false)\n  .option(\n    \"--device-name <name>\",\n    \"Provide a name for the device being authorized\",\n  )\n  .option(\n    \"-f, --force\",\n    \"Proceed with login even if a valid access token already exists for this device\",\n  )\n  .option(\n    \"--no-open\",\n    \"Don't automatically open the login link in the default browser\",\n  )\n  .addOption(\n    new Option(\n      \"--login-flow <mode>\",\n      `How to log in; defaults to guessing based on the environment.`,\n    )\n      .choices([\"paste\", \"auto\", \"poll\"] as const)\n      .default(\"auto\" as const),\n  )\n  .addOption(new Option(\"--link-deployments\").hideHelp())\n  // These options are hidden from the help/usage message, but allow overriding settings for testing.\n  // Change the auth credentials with the auth provider\n  .addOption(new Option(\"--override-auth-url <url>\").hideHelp())\n  .addOption(new Option(\"--override-auth-client <id>\").hideHelp())\n  .addOption(new Option(\"--override-auth-username <username>\").hideHelp())\n  .addOption(new Option(\"--override-auth-password <password>\").hideHelp())\n  // Skip the auth provider login and directly use this access token\n  .addOption(new Option(\"--override-access-token <token>\").hideHelp())\n  // Automatically accept opt ins without prompting\n  .addOption(new Option(\"--accept-opt-ins\").hideHelp())\n  // Dump the access token from the auth provider and skip authorization with Convex\n  .addOption(new Option(\"--dump-access-token\").hideHelp())\n  // Hidden option for tests to check if the user is logged in.\n  .addOption(new Option(\"--check-login\").hideHelp())\n  // Redirect to Vercel SSO integration URL\n  .addOption(\n    new Option(\n      \"--vercel\",\n      \"Redirect to Vercel SSO integration for login\",\n    ).hideHelp(),\n  )\n  // Override the Vercel URL slug (defaults to 'convex')\n  .addOption(new Option(\"--vercel-override <slug>\").hideHelp())\n  .addCommand(loginStatus)\n  .addHelpCommand(false)\n  .action(async (options, cmd: Command) => {\n    const ctx = await oneoffContext({\n      url: undefined,\n      adminKey: undefined,\n      envFile: undefined,\n    });\n    if (\n      !options.force &&\n      (await checkAuthorization(ctx, !!options.acceptOptIns))\n    ) {\n      logFinishedStep(\n        \"This device has previously been authorized and is ready for use with Convex.\",\n      );\n      await handleLinkingDeployments(ctx, {\n        interactive: !!options.linkDeployments,\n      });\n      return;\n    }\n    if (!options.force && options.checkLogin) {\n      const isLoggedIn = await checkAuthorization(ctx, !!options.acceptOptIns);\n      if (!isLoggedIn) {\n        return ctx.crash({\n          exitCode: 1,\n          errorType: \"fatal\",\n          errForSentry: \"You are not logged in.\",\n          printedMessage: \"You are not logged in.\",\n        });\n      }\n    }\n    if (!!options.overrideAuthUsername !== !!options.overrideAuthPassword) {\n      cmd.error(\n        \"If overriding credentials, both username and password must be provided\",\n      );\n    }\n\n    const uuid = loadUuidForAnonymousUser(ctx);\n    await performLogin(ctx, {\n      ...options,\n      anonymousId: uuid,\n      vercel: options.vercel,\n      vercelOverride: options.vercelOverride,\n    });\n\n    await handleLinkingDeployments(ctx, {\n      interactive: !!options.linkDeployments,\n    });\n  });\n\nasync function handleLinkingDeployments(\n  ctx: Context,\n  args: {\n    interactive: boolean;\n  },\n) {\n  if (!shouldAllowAnonymousDevelopment()) {\n    return;\n  }\n\n  // Check for project-local anonymous deployment first - this takes priority\n  const projectLocal = loadProjectLocalConfig(ctx);\n  if (\n    projectLocal !== null &&\n    isAnonymousDeployment(projectLocal.deploymentName)\n  ) {\n    const shouldLink = await promptYesNo(ctx, {\n      message: `Would you like to link your existing deployment to your account? (\"${projectLocal.deploymentName}\")`,\n      default: true,\n    });\n    if (!shouldLink) {\n      logMessage(\n        \"Not linking your existing deployment. If you want to link it later, run `npx convex login --link-deployments`.\",\n      );\n      logMessage(\n        `Visit ${DASHBOARD_HOST} or run \\`npx convex dev\\` to get started with your new account.`,\n      );\n      return;\n    }\n\n    const { dashboardUrl } = await linkSingleDeployment(\n      ctx,\n      projectLocal.deploymentName,\n      projectLocal.deploymentName,\n    );\n    logFinishedStep(`Visit ${dashboardUrl} to get started.`);\n    return;\n  }\n\n  // No project-local deployment - check for legacy deployments\n  const legacyDeployments = listLegacyAnonymousDeployments(ctx);\n  if (legacyDeployments.length === 0) {\n    if (args.interactive) {\n      logMessage(\n        \"It doesn't look like you have any deployments to link. You can run `npx convex dev` to set up a new project or select an existing one.\",\n      );\n    }\n    return;\n  }\n\n  // Get the currently configured deployment (if any) for env var updates\n  const deploymentSelection = await getDeploymentSelection(ctx, {\n    url: undefined,\n    adminKey: undefined,\n    envFile: undefined,\n  });\n  const configuredDeployment =\n    deploymentSelection.kind === \"anonymous\"\n      ? deploymentSelection.deploymentName\n      : null;\n\n  if (!args.interactive) {\n    // Non-interactive: link all legacy deployments automatically\n    const message = getMessage(legacyDeployments.map((d) => d.deploymentName));\n    const createProjects = await promptYesNo(ctx, {\n      message,\n      default: true,\n    });\n    if (!createProjects) {\n      logMessage(\n        \"Not linking your existing deployments. If you want to link them later, run `npx convex login --link-deployments`.\",\n      );\n      logMessage(\n        `Visit ${DASHBOARD_HOST} or run \\`npx convex dev\\` to get started with your new account.`,\n      );\n      return;\n    }\n\n    const {\n      team: { slug: teamSlug },\n    } = await validateOrSelectTeam(\n      ctx,\n      undefined,\n      \"Choose a team for your deployments:\",\n    );\n    let dashboardUrl = teamDashboardUrl(teamSlug);\n    for (const deployment of legacyDeployments) {\n      const result = await linkSingleDeployment(\n        ctx,\n        deployment.deploymentName,\n        configuredDeployment,\n        { teamSlug, projectSlug: null },\n      );\n      if (deployment.deploymentName === configuredDeployment) {\n        dashboardUrl = result.dashboardUrl;\n      }\n    }\n    logFinishedStep(\n      `Successfully linked your deployments! Visit ${dashboardUrl} to get started.`,\n    );\n    return;\n  }\n\n  // Interactive mode: let user choose which legacy deployments to link\n  while (true) {\n    const currentLegacyDeployments = listLegacyAnonymousDeployments(ctx);\n    if (currentLegacyDeployments.length === 0) {\n      logMessage(\"All deployments have been linked.\");\n      break;\n    }\n    logMessage(\n      getDeploymentListMessage(\n        currentLegacyDeployments.map((d) => d.deploymentName),\n      ),\n    );\n    const deploymentToLink = await promptSearch(ctx, {\n      message: \"Which deployment would you like to link to your account?\",\n      choices: currentLegacyDeployments.map((d) => ({\n        name: d.deploymentName,\n        value: d.deploymentName,\n      })),\n    });\n\n    await linkSingleDeployment(ctx, deploymentToLink, configuredDeployment);\n\n    const shouldContinue = await promptYesNo(ctx, {\n      message: \"Would you like to link another deployment?\",\n      default: true,\n    });\n    if (!shouldContinue) {\n      break;\n    }\n  }\n}\n\n/**\n * Link a single deployment to a project, prompting for team and project selection.\n * Updates env vars if this is the currently configured deployment.\n */\nasync function linkSingleDeployment(\n  ctx: Context,\n  deploymentName: string,\n  configuredDeployment: string | null,\n  options?: {\n    teamSlug?: string;\n    projectSlug?: string | null;\n  },\n): Promise<{ dashboardUrl: string }> {\n  const { team } = await validateOrSelectTeam(\n    ctx,\n    options?.teamSlug,\n    \"Choose a team for your deployment:\",\n  );\n\n  const projectSlug =\n    options?.projectSlug ??\n    (\n      await selectProject(ctx, \"ask\", {\n        team: team.slug,\n        devDeployment: \"local\",\n        defaultProjectName: removeAnonymousPrefix(deploymentName),\n      })\n    ).projectSlug;\n\n  const linkedDeployment = await handleLinkToProject(ctx, {\n    deploymentName,\n    teamSlug: team.slug,\n    teamId: team.id,\n    projectSlug,\n  });\n\n  if (deploymentName === configuredDeployment) {\n    await updateEnvAndConfigForDeploymentSelection(\n      ctx,\n      {\n        url: linkedDeployment.deploymentUrl,\n        deploymentName: linkedDeployment.deploymentName,\n        teamSlug: team.slug,\n        projectSlug: linkedDeployment.projectSlug,\n        deploymentType: \"local\",\n      },\n      configuredDeployment,\n    );\n  }\n\n  return {\n    dashboardUrl: deploymentDashboardUrlPage(\n      linkedDeployment.deploymentName,\n      \"\",\n    ),\n  };\n}\n\nfunction getDeploymentListMessage(anonymousDeploymentNames: string[]) {\n  let message = `You have ${anonymousDeploymentNames.length} existing deployments.`;\n  message += `\\n\\nDeployments:`;\n  for (const deploymentName of anonymousDeploymentNames) {\n    message += `\\n- ${deploymentName}`;\n  }\n  return message;\n}\n\nfunction getMessage(anonymousDeploymentNames: string[]) {\n  if (anonymousDeploymentNames.length === 1) {\n    return `Would you like to link your existing deployment to your account? (\"${anonymousDeploymentNames[0]}\")`;\n  }\n  let message = `You have ${anonymousDeploymentNames.length} existing deployments. Would you like to link them to your account?`;\n  message += `\\n\\nDeployments:`;\n  for (const deploymentName of anonymousDeploymentNames) {\n    message += `\\n- ${deploymentName}`;\n  }\n  message += `\\n\\nYou can alternatively run \\`npx convex login --link-deployments\\` to interactively choose which deployments to add.`;\n  return message;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,2BAAgC;AAChC,aAAwB;AACxB,qBAAqD;AACrD,iBAAwD;AACxD,mBAIO;AACP,uBAGO;AACP,uBAGO;AACP,uBAIO;AACP,qBAA0C;AAC1C,mBAKO;AACP,uBAGO;AACP,iCAGO;AACP,wBAGO;AACP,0BAGO;AACP,iBAAgC;AAOhC,SAAS,iBACP,KACA,YACA,OACe;AACf,aAAW,QAAQ,CAAC,gCAAmB,MAAM,GAAG;AAC9C,QAAI,CAAC,IAAI,GAAG,OAAO,IAAI,GAAG;AACxB;AAAA,IACF;AACA,QAAI,OAAO,MAAM,IAAI,GAAG,aAAa,IAAI,CAAC,EAAE,UAAU,MAAM,OAAO;AACjE,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAOA,eAAe,kCACb,KACA,MACA;AAEA,MACE,SAAS,QACT,KAAK,SAAS,iBACd,KAAK,SAAS,oBACd;AACA;AAAA,EACF;AACA,QAAM,MAAM,KAAK,SAAS,eAAe,KAAK,aAAa,KAAK;AAChE,QAAM,aAAa,QAAQ,IAAI,2CAA8B,IACzD,8CACA;AACJ,QAAM,UAAU,iBAAiB,KAAK,YAAY,GAAG;AACrD,QAAM,SAAS,WAAW;AAI1B,QAAM,SAAS,IAAI,MAAM,IAAI,QAAQ,GAAG,IAAI,CAAC;AAC7C,MAAI,UAAM,iCAAmB,KAAK,UAAU,MAAM,EAAE,GAAG;AACrD,+BAAW,4BAA4B,UAAU,OAAO,MAAM,EAAE;AAChE;AAAA,EACF;AACA,6BAAW,8BAA8B,UAAU,OAAO,MAAM,EAAE;AACpE;AAEA,MAAM,cAAc,IAAI,6BAAQ,QAAQ,EACrC,YAAY,8CAA8C,EAC1D,qBAAqB,KAAK,EAC1B,OAAO,YAAY;AAClB,QAAM,MAAM,UAAM,8BAAc;AAAA,IAC9B,KAAK;AAAA,IACL,UAAU;AAAA,IACV,SAAS;AAAA,EACX,CAAC;AAID,QAAM,OAAO,IAAI,aAAa;AAE9B,QAAM,mBAAe,sCAAiB,GAAG;AACzC,MAAI,iBAAiB,MAAM;AACzB,+BAAW,yCAAqC,sCAAiB,CAAC,EAAE;AACpE,+BAAW,uBAAuB;AAClC,UAAM,kCAAkC,KAAK,IAAI;AACjD;AAAA,EACF;AACA,6BAAW,sCAAkC,sCAAiB,CAAC,EAAE;AAEjE,QAAM,cAAc,aAAa;AACjC,MAAI,CAAE,UAAM,iCAAmB,KAAK,UAAU,WAAW,EAAE,GAAI;AAC7D,+BAAW,uBAAuB;AAClC,UAAM,kCAAkC,KAAK,IAAI;AACjD;AAAA,EACF;AAEA,6BAAW,mBAAmB;AAE9B,MAAI,oBAAoB;AAAA,IACtB,MAAM;AAAA,IACN,QAAQ,UAAU,WAAW;AAAA,IAC7B;AAAA,EACF,CAAC;AACD,QAAM,QAAQ,UAAM,4BAAgB,GAAG;AACvC;AAAA,IACE,UAAU,MAAM,MAAM,QAAQ,MAAM,WAAW,IAAI,KAAK,GAAG;AAAA,EAC7D;AACA,aAAW,QAAQ,OAAO;AACxB,+BAAW,OAAO,KAAK,IAAI,KAAK,KAAK,IAAI,GAAG;AAAA,EAC9C;AACA,QAAM,kCAAkC,KAAK,IAAI;AACnD,CAAC;AAEI,MAAM,QAAQ,IAAI,6BAAQ,OAAO,EACrC,YAAY,iBAAiB,EAC7B,qBAAqB,KAAK,EAC1B;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC,IAAI;AAAA,IACF;AAAA,IACA;AAAA,EACF,EACG,QAAQ,CAAC,SAAS,QAAQ,MAAM,CAAU,EAC1C,QAAQ,MAAe;AAC5B,EACC,UAAU,IAAI,4BAAO,oBAAoB,EAAE,SAAS,CAAC,EAGrD,UAAU,IAAI,4BAAO,2BAA2B,EAAE,SAAS,CAAC,EAC5D,UAAU,IAAI,4BAAO,6BAA6B,EAAE,SAAS,CAAC,EAC9D,UAAU,IAAI,4BAAO,qCAAqC,EAAE,SAAS,CAAC,EACtE,UAAU,IAAI,4BAAO,qCAAqC,EAAE,SAAS,CAAC,EAEtE,UAAU,IAAI,4BAAO,iCAAiC,EAAE,SAAS,CAAC,EAElE,UAAU,IAAI,4BAAO,kBAAkB,EAAE,SAAS,CAAC,EAEnD,UAAU,IAAI,4BAAO,qBAAqB,EAAE,SAAS,CAAC,EAEtD,UAAU,IAAI,4BAAO,eAAe,EAAE,SAAS,CAAC,EAEhD;AAAA,EACC,IAAI;AAAA,IACF;AAAA,IACA;AAAA,EACF,EAAE,SAAS;AACb,EAEC,UAAU,IAAI,4BAAO,0BAA0B,EAAE,SAAS,CAAC,EAC3D,WAAW,WAAW,EACtB,eAAe,KAAK,EACpB,OAAO,OAAO,SAAS,QAAiB;AACvC,QAAM,MAAM,UAAM,8BAAc;AAAA,IAC9B,KAAK;AAAA,IACL,UAAU;AAAA,IACV,SAAS;AAAA,EACX,CAAC;AACD,MACE,CAAC,QAAQ,SACR,UAAM,iCAAmB,KAAK,CAAC,CAAC,QAAQ,YAAY,GACrD;AACA;AAAA,MACE;AAAA,IACF;AACA,UAAM,yBAAyB,KAAK;AAAA,MAClC,aAAa,CAAC,CAAC,QAAQ;AAAA,IACzB,CAAC;AACD;AAAA,EACF;AACA,MAAI,CAAC,QAAQ,SAAS,QAAQ,YAAY;AACxC,UAAM,aAAa,UAAM,iCAAmB,KAAK,CAAC,CAAC,QAAQ,YAAY;AACvE,QAAI,CAAC,YAAY;AACf,aAAO,IAAI,MAAM;AAAA,QACf,UAAU;AAAA,QACV,WAAW;AAAA,QACX,cAAc;AAAA,QACd,gBAAgB;AAAA,MAClB,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI,CAAC,CAAC,QAAQ,yBAAyB,CAAC,CAAC,QAAQ,sBAAsB;AACrE,QAAI;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,WAAO,2CAAyB,GAAG;AACzC,YAAM,2BAAa,KAAK;AAAA,IACtB,GAAG;AAAA,IACH,aAAa;AAAA,IACb,QAAQ,QAAQ;AAAA,IAChB,gBAAgB,QAAQ;AAAA,EAC1B,CAAC;AAED,QAAM,yBAAyB,KAAK;AAAA,IAClC,aAAa,CAAC,CAAC,QAAQ;AAAA,EACzB,CAAC;AACH,CAAC;AAEH,eAAe,yBACb,KACA,MAGA;AACA,MAAI,KAAC,4DAAgC,GAAG;AACtC;AAAA,EACF;AAGA,QAAM,mBAAe,yCAAuB,GAAG;AAC/C,MACE,iBAAiB,YACjB,yCAAsB,aAAa,cAAc,GACjD;AACA,UAAM,aAAa,UAAM,4BAAY,KAAK;AAAA,MACxC,SAAS,sEAAsE,aAAa,cAAc;AAAA,MAC1G,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAAC,YAAY;AACf;AAAA,QACE;AAAA,MACF;AACA;AAAA,QACE,SAAS,+BAAc;AAAA,MACzB;AACA;AAAA,IACF;AAEA,UAAM,EAAE,aAAa,IAAI,MAAM;AAAA,MAC7B;AAAA,MACA,aAAa;AAAA,MACb,aAAa;AAAA,IACf;AACA,oCAAgB,SAAS,YAAY,kBAAkB;AACvD;AAAA,EACF;AAGA,QAAM,wBAAoB,iDAA+B,GAAG;AAC5D,MAAI,kBAAkB,WAAW,GAAG;AAClC,QAAI,KAAK,aAAa;AACpB;AAAA,QACE;AAAA,MACF;AAAA,IACF;AACA;AAAA,EACF;AAGA,QAAM,sBAAsB,UAAM,mDAAuB,KAAK;AAAA,IAC5D,KAAK;AAAA,IACL,UAAU;AAAA,IACV,SAAS;AAAA,EACX,CAAC;AACD,QAAM,uBACJ,oBAAoB,SAAS,cACzB,oBAAoB,iBACpB;AAEN,MAAI,CAAC,KAAK,aAAa;AAErB,UAAM,UAAU,WAAW,kBAAkB,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC;AACzE,UAAM,iBAAiB,UAAM,4BAAY,KAAK;AAAA,MAC5C;AAAA,MACA,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAAC,gBAAgB;AACnB;AAAA,QACE;AAAA,MACF;AACA;AAAA,QACE,SAAS,+BAAc;AAAA,MACzB;AACA;AAAA,IACF;AAEA,UAAM;AAAA,MACJ,MAAM,EAAE,MAAM,SAAS;AAAA,IACzB,IAAI,UAAM;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,mBAAe,mCAAiB,QAAQ;AAC5C,eAAW,cAAc,mBAAmB;AAC1C,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA,QACA,WAAW;AAAA,QACX;AAAA,QACA,EAAE,UAAU,aAAa,KAAK;AAAA,MAChC;AACA,UAAI,WAAW,mBAAmB,sBAAsB;AACtD,uBAAe,OAAO;AAAA,MACxB;AAAA,IACF;AACA;AAAA,MACE,+CAA+C,YAAY;AAAA,IAC7D;AACA;AAAA,EACF;AAGA,SAAO,MAAM;AACX,UAAM,+BAA2B,iDAA+B,GAAG;AACnE,QAAI,yBAAyB,WAAW,GAAG;AACzC,iCAAW,mCAAmC;AAC9C;AAAA,IACF;AACA;AAAA,MACE;AAAA,QACE,yBAAyB,IAAI,CAAC,MAAM,EAAE,cAAc;AAAA,MACtD;AAAA,IACF;AACA,UAAM,mBAAmB,UAAM,6BAAa,KAAK;AAAA,MAC/C,SAAS;AAAA,MACT,SAAS,yBAAyB,IAAI,CAAC,OAAO;AAAA,QAC5C,MAAM,EAAE;AAAA,QACR,OAAO,EAAE;AAAA,MACX,EAAE;AAAA,IACJ,CAAC;AAED,UAAM,qBAAqB,KAAK,kBAAkB,oBAAoB;AAEtE,UAAM,iBAAiB,UAAM,4BAAY,KAAK;AAAA,MAC5C,SAAS;AAAA,MACT,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAAC,gBAAgB;AACnB;AAAA,IACF;AAAA,EACF;AACF;AAMA,eAAe,qBACb,KACA,gBACA,sBACA,SAImC;AACnC,QAAM,EAAE,KAAK,IAAI,UAAM;AAAA,IACrB;AAAA,IACA,SAAS;AAAA,IACT;AAAA,EACF;AAEA,QAAM,cACJ,SAAS,gBAEP,UAAM,gCAAc,KAAK,OAAO;AAAA,IAC9B,MAAM,KAAK;AAAA,IACX,eAAe;AAAA,IACf,wBAAoB,yCAAsB,cAAc;AAAA,EAC1D,CAAC,GACD;AAEJ,QAAM,mBAAmB,UAAM,sCAAoB,KAAK;AAAA,IACtD;AAAA,IACA,UAAU,KAAK;AAAA,IACf,QAAQ,KAAK;AAAA,IACb;AAAA,EACF,CAAC;AAED,MAAI,mBAAmB,sBAAsB;AAC3C,cAAM;AAAA,MACJ;AAAA,MACA;AAAA,QACE,KAAK,iBAAiB;AAAA,QACtB,gBAAgB,iBAAiB;AAAA,QACjC,UAAU,KAAK;AAAA,QACf,aAAa,iBAAiB;AAAA,QAC9B,gBAAgB;AAAA,MAClB;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,kBAAc;AAAA,MACZ,iBAAiB;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,yBAAyB,0BAAoC;AACpE,MAAI,UAAU,YAAY,yBAAyB,MAAM;AACzD,aAAW;AAAA;AAAA;AACX,aAAW,kBAAkB,0BAA0B;AACrD,eAAW;AAAA,IAAO,cAAc;AAAA,EAClC;AACA,SAAO;AACT;AAEA,SAAS,WAAW,0BAAoC;AACtD,MAAI,yBAAyB,WAAW,GAAG;AACzC,WAAO,sEAAsE,yBAAyB,CAAC,CAAC;AAAA,EAC1G;AACA,MAAI,UAAU,YAAY,yBAAyB,MAAM;AACzD,aAAW;AAAA;AAAA;AACX,aAAW,kBAAkB,0BAA0B;AACrD,eAAW;AAAA,IAAO,cAAc;AAAA,EAClC;AACA,aAAW;AAAA;AAAA;AACX,SAAO;AACT;",
   "names": []
 }

package/dist/cjs/cli/mcp.js

@@ -18,16 +18,16 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var mcp_exports = {};
 __export(mcp_exports, {
+  makeServer: () => makeServer,
   mcp: () => mcp
 });
 module.exports = __toCommonJS(mcp_exports);
 var import_extra_typings = require("@commander-js/extra-typings");
 var import_context = require("../bundler/context.js");
-var import_server = require("@modelcontextprotocol/sdk/server/index.js");
-var import_stdio = require("@modelcontextprotocol/sdk/server/stdio.js");
+var import_server = require("@modelcontextprotocol/server");
+var import_stdio = require("@modelcontextprotocol/server/stdio");
 var import_command = require("./lib/command.js");
 var import_login = require("./lib/login.js");
-var import_types = require("@modelcontextprotocol/sdk/types.js");
 var import_requestContext = require("./lib/mcp/requestContext.js");
 var import_tools = require("./lib/mcp/tools/index.js");
 var import_mutex = require("./lib/utils/mutex.js");
@@ -100,69 +100,66 @@ function makeServer(options) {
       }
     }
   );
-  server.setRequestHandler(
-    import_types.CallToolRequestSchema,
-    async (request) => {
-      const ctx = new import_requestContext.RequestContext(options);
-      await (0, import_deploymentSelection.initializeBigBrainAuth)(ctx, options);
-      try {
-        const authorized = await (0, import_login.checkAuthorization)(ctx, false);
-        if (!authorized) {
-          await ctx.crash({
-            exitCode: 1,
-            errorType: "fatal",
-            printedMessage: "Not Authorized: Run `npx convex dev` to login to your Convex project."
-          });
-        }
-        if (!request.params.arguments) {
-          await ctx.crash({
-            exitCode: 1,
-            errorType: "fatal",
-            printedMessage: "No arguments provided"
-          });
-        }
-        const convexTool = enabledToolsByName[request.params.name];
-        if (!convexTool) {
-          await ctx.crash({
-            exitCode: 1,
-            errorType: "fatal",
-            printedMessage: `Tool ${request.params.name} not found`
-          });
-        }
-        const input = convexTool.inputSchema.parse(request.params.arguments);
-        const result = await mutex.runExclusive(async () => {
-          return await convexTool.handler(ctx, input);
+  server.setRequestHandler("tools/call", async (request) => {
+    const ctx = new import_requestContext.RequestContext(options);
+    await (0, import_deploymentSelection.initializeBigBrainAuth)(ctx, options);
+    try {
+      const authorized = await (0, import_login.checkAuthorization)(ctx, false);
+      if (!authorized) {
+        await ctx.crash({
+          exitCode: 1,
+          errorType: "fatal",
+          printedMessage: "Not Authorized: Run `npx convex dev` to login to your Convex project."
         });
-        return {
-          content: [
-            {
-              type: "text",
-              text: JSON.stringify(result)
-            }
-          ]
-        };
-      } catch (error) {
-        let message;
-        if (error instanceof import_requestContext.RequestCrash) {
-          message = error.printedMessage;
-        } else if (error instanceof Error) {
-          message = error.message;
-        } else {
-          message = String(error);
-        }
-        return {
-          content: [
-            {
-              type: "text",
-              text: JSON.stringify({ error: message })
-            }
-          ],
-          isError: true
-        };
       }
+      if (!request.params.arguments) {
+        await ctx.crash({
+          exitCode: 1,
+          errorType: "fatal",
+          printedMessage: "No arguments provided"
+        });
+      }
+      const convexTool = enabledToolsByName[request.params.name];
+      if (!convexTool) {
+        await ctx.crash({
+          exitCode: 1,
+          errorType: "fatal",
+          printedMessage: `Tool ${request.params.name} not found`
+        });
+      }
+      const input = convexTool.inputSchema.parse(request.params.arguments);
+      const result = await mutex.runExclusive(async () => {
+        return await convexTool.handler(ctx, input);
+      });
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify(result)
+          }
+        ]
+      };
+    } catch (error) {
+      let message;
+      if (error instanceof import_requestContext.RequestCrash) {
+        message = error.printedMessage;
+      } else if (error instanceof Error) {
+        message = error.message;
+      } else {
+        message = String(error);
+      }
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({ error: message })
+          }
+        ],
+        isError: true
+      };
     }
-  );
-  server.setRequestHandler(import_types.ListToolsRequestSchema, async () => {
+  });
+  server.setRequestHandler("tools/list", async () => {
     return {
       tools: Object.values(enabledToolsByName).map(import_tools.mcpTool)
     };

package/dist/cjs/cli/mcp.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/cli/mcp.ts"],
-  "sourcesContent": ["import { Command, Option } from \"@commander-js/extra-typings\";\nimport { oneoffContext } from \"../bundler/context.js\";\nimport { Server } from \"@modelcontextprotocol/sdk/server/index.js\";\nimport { StdioServerTransport } from \"@modelcontextprotocol/sdk/server/stdio.js\";\nimport { actionDescription } from \"./lib/command.js\";\nimport { checkAuthorization } from \"./lib/login.js\";\nimport {\n  CallToolRequest,\n  CallToolRequestSchema,\n  ListToolsRequestSchema,\n} from \"@modelcontextprotocol/sdk/types.js\";\nimport {\n  McpOptions,\n  RequestContext,\n  RequestCrash,\n} from \"./lib/mcp/requestContext.js\";\nimport { mcpTool, convexTools, ConvexTool } from \"./lib/mcp/tools/index.js\";\nimport { Mutex } from \"./lib/utils/mutex.js\";\nimport { initializeBigBrainAuth } from \"./lib/deploymentSelection.js\";\n\nconst allToolNames = convexTools.map((t) => t.name).sort();\n\nexport const mcp = new Command(\"mcp\")\n  .summary(\"Manage the Model Context Protocol server for Convex [BETA]\")\n  .description(\n    \"Commands to initialize and run a Model Context Protocol server for Convex that can be used with AI tools.\\n\" +\n      \"This server exposes your Convex codebase to AI tools in a structured way.\",\n  )\n  .allowExcessArguments(false);\n\nmcp\n  .command(\"start\")\n  .summary(\"Start the MCP server\")\n  .description(\n    \"Start the Model Context Protocol server for Convex that can be used with AI tools.\",\n  )\n  .option(\n    \"--project-dir <project-dir>\",\n    \"Run the MCP server for a single project. By default, the MCP server can run for multiple projects, and each tool call specifies its project directory.\",\n  )\n  .option(\n    \"--disable-tools <tool-names>\",\n    `Comma separated list of tool names to disable (options: ${allToolNames.join(\", \")})`,\n  )\n  .option(\n    \"--cautiously-allow-production-pii\",\n    \"Allow read-only tools (data, logs, queries) on production deployments. These tools may expose PII. Defaults to false.\",\n    false,\n  )\n  .option(\n    \"--dangerously-enable-production-deployments\",\n    \"DANGEROUSLY allow the MCP server to access production deployments, including mutating tools. Defaults to false.\",\n    false,\n  )\n  // Deprecated option, we swapped the default. no-op.\n  .addOption(\n    new Option(\"--disable-production-deployments\")\n      .conflicts(\"--dangerously-enable-production-deployments\")\n      .hideHelp(),\n  )\n  .addDeploymentSelectionOptions(actionDescription(\"Run the MCP server on\"))\n  .action(async (options) => {\n    const ctx = await oneoffContext(options);\n    try {\n      const server = makeServer(options);\n      const transport = new StdioServerTransport();\n      await server.connect(transport);\n      // Keep the process running\n      await new Promise(() => {});\n    } catch (error: any) {\n      await ctx.crash({\n        exitCode: 1,\n        errorType: \"fatal\",\n        errForSentry: `Failed to start MCP server: ${error}`,\n        printedMessage: `Failed to start MCP server: ${error}`,\n      });\n    }\n  });\n\nfunction makeServer(options: McpOptions) {\n  const disabledToolNames = new Set<string>();\n  for (const toolName of options.disableTools?.split(\",\") ?? []) {\n    const name = toolName.trim();\n    if (!allToolNames.includes(name)) {\n      // eslint-disable-next-line no-restricted-syntax\n      throw new Error(\n        `Disabled tool ${name} not found (valid tools: ${allToolNames.join(\", \")})`,\n      );\n    }\n    disabledToolNames.add(name);\n  }\n\n  const enabledToolsByName: Record<string, ConvexTool<any, any>> = {};\n  for (const tool of convexTools) {\n    if (!disabledToolNames.has(tool.name)) {\n      enabledToolsByName[tool.name] = tool;\n    }\n  }\n\n  const mutex = new Mutex();\n  const server = new Server(\n    {\n      name: \"Convex MCP Server\",\n      version: \"0.0.1\",\n    },\n    {\n      capabilities: {\n        tools: {},\n      },\n    },\n  );\n  server.setRequestHandler(\n    CallToolRequestSchema,\n    async (request: CallToolRequest) => {\n      const ctx = new RequestContext(options);\n      await initializeBigBrainAuth(ctx, options);\n      try {\n        const authorized = await checkAuthorization(ctx, false);\n        if (!authorized) {\n          await ctx.crash({\n            exitCode: 1,\n            errorType: \"fatal\",\n            printedMessage:\n              \"Not Authorized: Run `npx convex dev` to login to your Convex project.\",\n          });\n        }\n        if (!request.params.arguments) {\n          await ctx.crash({\n            exitCode: 1,\n            errorType: \"fatal\",\n            printedMessage: \"No arguments provided\",\n          });\n        }\n        const convexTool = enabledToolsByName[request.params.name];\n        if (!convexTool) {\n          await ctx.crash({\n            exitCode: 1,\n            errorType: \"fatal\",\n            printedMessage: `Tool ${request.params.name} not found`,\n          });\n        }\n        const input = convexTool.inputSchema.parse(request.params.arguments);\n\n        // Serialize tool handlers since they're mutating the current working directory.\n        const result = await mutex.runExclusive(async () => {\n          return await convexTool.handler(ctx, input);\n        });\n        return {\n          content: [\n            {\n              type: \"text\",\n              text: JSON.stringify(result),\n            },\n          ],\n        };\n      } catch (error: any) {\n        let message: string;\n        if (error instanceof RequestCrash) {\n          message = error.printedMessage;\n        } else if (error instanceof Error) {\n          message = error.message;\n        } else {\n          message = String(error);\n        }\n        return {\n          content: [\n            {\n              type: \"text\",\n              text: JSON.stringify({ error: message }),\n            },\n          ],\n          isError: true,\n        };\n      }\n    },\n  );\n  server.setRequestHandler(ListToolsRequestSchema, async () => {\n    return {\n      tools: Object.values(enabledToolsByName).map(mcpTool),\n    };\n  });\n  return server;\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,2BAAgC;AAChC,qBAA8B;AAC9B,oBAAuB;AACvB,mBAAqC;AACrC,qBAAkC;AAClC,mBAAmC;AACnC,mBAIO;AACP,4BAIO;AACP,mBAAiD;AACjD,mBAAsB;AACtB,iCAAuC;AAEvC,MAAM,eAAe,yBAAY,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK;AAElD,MAAM,MAAM,IAAI,6BAAQ,KAAK,EACjC,QAAQ,4DAA4D,EACpE;AAAA,EACC;AAEF,EACC,qBAAqB,KAAK;AAE7B,IACG,QAAQ,OAAO,EACf,QAAQ,sBAAsB,EAC9B;AAAA,EACC;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA,2DAA2D,aAAa,KAAK,IAAI,CAAC;AACpF,EACC;AAAA,EACC;AAAA,EACA;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AAAA,EACA;AACF,EAEC;AAAA,EACC,IAAI,4BAAO,kCAAkC,EAC1C,UAAU,6CAA6C,EACvD,SAAS;AACd,EACC,kCAA8B,kCAAkB,uBAAuB,CAAC,EACxE,OAAO,OAAO,YAAY;AACzB,QAAM,MAAM,UAAM,8BAAc,OAAO;AACvC,MAAI;AACF,UAAM,SAAS,WAAW,OAAO;AACjC,UAAM,YAAY,IAAI,kCAAqB;AAC3C,UAAM,OAAO,QAAQ,SAAS;AAE9B,UAAM,IAAI,QAAQ,MAAM;AAAA,IAAC,CAAC;AAAA,EAC5B,SAAS,OAAY;AACnB,UAAM,IAAI,MAAM;AAAA,MACd,UAAU;AAAA,MACV,WAAW;AAAA,MACX,cAAc,+BAA+B,KAAK;AAAA,MAClD,gBAAgB,+BAA+B,KAAK;AAAA,IACtD,CAAC;AAAA,EACH;AACF,CAAC;AAEH,SAAS,WAAW,SAAqB;AACvC,QAAM,oBAAoB,oBAAI,IAAY;AAC1C,aAAW,YAAY,QAAQ,cAAc,MAAM,GAAG,KAAK,CAAC,GAAG;AAC7D,UAAM,OAAO,SAAS,KAAK;AAC3B,QAAI,CAAC,aAAa,SAAS,IAAI,GAAG;AAEhC,YAAM,IAAI;AAAA,QACR,iBAAiB,IAAI,4BAA4B,aAAa,KAAK,IAAI,CAAC;AAAA,MAC1E;AAAA,IACF;AACA,sBAAkB,IAAI,IAAI;AAAA,EAC5B;AAEA,QAAM,qBAA2D,CAAC;AAClE,aAAW,QAAQ,0BAAa;AAC9B,QAAI,CAAC,kBAAkB,IAAI,KAAK,IAAI,GAAG;AACrC,yBAAmB,KAAK,IAAI,IAAI;AAAA,IAClC;AAAA,EACF;AAEA,QAAM,QAAQ,IAAI,mBAAM;AACxB,QAAM,SAAS,IAAI;AAAA,IACjB;AAAA,MACE,MAAM;AAAA,MACN,SAAS;AAAA,IACX;AAAA,IACA;AAAA,MACE,cAAc;AAAA,QACZ,OAAO,CAAC;AAAA,MACV;AAAA,IACF;AAAA,EACF;AACA,SAAO;AAAA,IACL;AAAA,IACA,OAAO,YAA6B;AAClC,YAAM,MAAM,IAAI,qCAAe,OAAO;AACtC,gBAAM,mDAAuB,KAAK,OAAO;AACzC,UAAI;AACF,cAAM,aAAa,UAAM,iCAAmB,KAAK,KAAK;AACtD,YAAI,CAAC,YAAY;AACf,gBAAM,IAAI,MAAM;AAAA,YACd,UAAU;AAAA,YACV,WAAW;AAAA,YACX,gBACE;AAAA,UACJ,CAAC;AAAA,QACH;AACA,YAAI,CAAC,QAAQ,OAAO,WAAW;AAC7B,gBAAM,IAAI,MAAM;AAAA,YACd,UAAU;AAAA,YACV,WAAW;AAAA,YACX,gBAAgB;AAAA,UAClB,CAAC;AAAA,QACH;AACA,cAAM,aAAa,mBAAmB,QAAQ,OAAO,IAAI;AACzD,YAAI,CAAC,YAAY;AACf,gBAAM,IAAI,MAAM;AAAA,YACd,UAAU;AAAA,YACV,WAAW;AAAA,YACX,gBAAgB,QAAQ,QAAQ,OAAO,IAAI;AAAA,UAC7C,CAAC;AAAA,QACH;AACA,cAAM,QAAQ,WAAW,YAAY,MAAM,QAAQ,OAAO,SAAS;AAGnE,cAAM,SAAS,MAAM,MAAM,aAAa,YAAY;AAClD,iBAAO,MAAM,WAAW,QAAQ,KAAK,KAAK;AAAA,QAC5C,CAAC;AACD,eAAO;AAAA,UACL,SAAS;AAAA,YACP;AAAA,cACE,MAAM;AAAA,cACN,MAAM,KAAK,UAAU,MAAM;AAAA,YAC7B;AAAA,UACF;AAAA,QACF;AAAA,MACF,SAAS,OAAY;AACnB,YAAI;AACJ,YAAI,iBAAiB,oCAAc;AACjC,oBAAU,MAAM;AAAA,QAClB,WAAW,iBAAiB,OAAO;AACjC,oBAAU,MAAM;AAAA,QAClB,OAAO;AACL,oBAAU,OAAO,KAAK;AAAA,QACxB;AACA,eAAO;AAAA,UACL,SAAS;AAAA,YACP;AAAA,cACE,MAAM;AAAA,cACN,MAAM,KAAK,UAAU,EAAE,OAAO,QAAQ,CAAC;AAAA,YACzC;AAAA,UACF;AAAA,UACA,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO,kBAAkB,qCAAwB,YAAY;AAC3D,WAAO;AAAA,MACL,OAAO,OAAO,OAAO,kBAAkB,EAAE,IAAI,oBAAO;AAAA,IACtD;AAAA,EACF,CAAC;AACD,SAAO;AACT;",
+  "sourcesContent": ["import { Command, Option } from \"@commander-js/extra-typings\";\nimport { oneoffContext } from \"../bundler/context.js\";\nimport { CallToolRequest, Server } from \"@modelcontextprotocol/server\";\nimport { StdioServerTransport } from \"@modelcontextprotocol/server/stdio\";\nimport { actionDescription } from \"./lib/command.js\";\nimport { checkAuthorization } from \"./lib/login.js\";\nimport {\n  McpOptions,\n  RequestContext,\n  RequestCrash,\n} from \"./lib/mcp/requestContext.js\";\nimport { mcpTool, convexTools, ConvexTool } from \"./lib/mcp/tools/index.js\";\nimport { Mutex } from \"./lib/utils/mutex.js\";\nimport { initializeBigBrainAuth } from \"./lib/deploymentSelection.js\";\n\nconst allToolNames = convexTools.map((t) => t.name).sort();\n\nexport const mcp = new Command(\"mcp\")\n  .summary(\"Manage the Model Context Protocol server for Convex [BETA]\")\n  .description(\n    \"Commands to initialize and run a Model Context Protocol server for Convex that can be used with AI tools.\\n\" +\n      \"This server exposes your Convex codebase to AI tools in a structured way.\",\n  )\n  .allowExcessArguments(false);\n\nmcp\n  .command(\"start\")\n  .summary(\"Start the MCP server\")\n  .description(\n    \"Start the Model Context Protocol server for Convex that can be used with AI tools.\",\n  )\n  .option(\n    \"--project-dir <project-dir>\",\n    \"Run the MCP server for a single project. By default, the MCP server can run for multiple projects, and each tool call specifies its project directory.\",\n  )\n  .option(\n    \"--disable-tools <tool-names>\",\n    `Comma separated list of tool names to disable (options: ${allToolNames.join(\", \")})`,\n  )\n  .option(\n    \"--cautiously-allow-production-pii\",\n    \"Allow read-only tools (data, logs, queries) on production deployments. These tools may expose PII. Defaults to false.\",\n    false,\n  )\n  .option(\n    \"--dangerously-enable-production-deployments\",\n    \"DANGEROUSLY allow the MCP server to access production deployments, including mutating tools. Defaults to false.\",\n    false,\n  )\n  // Deprecated option, we swapped the default. no-op.\n  .addOption(\n    new Option(\"--disable-production-deployments\")\n      .conflicts(\"--dangerously-enable-production-deployments\")\n      .hideHelp(),\n  )\n  .addDeploymentSelectionOptions(actionDescription(\"Run the MCP server on\"))\n  .action(async (options) => {\n    const ctx = await oneoffContext(options);\n    try {\n      const server = makeServer(options);\n      const transport = new StdioServerTransport();\n      await server.connect(transport);\n      // Keep the process running\n      await new Promise(() => {});\n    } catch (error: any) {\n      await ctx.crash({\n        exitCode: 1,\n        errorType: \"fatal\",\n        errForSentry: `Failed to start MCP server: ${error}`,\n        printedMessage: `Failed to start MCP server: ${error}`,\n      });\n    }\n  });\n\nexport function makeServer(options: McpOptions) {\n  const disabledToolNames = new Set<string>();\n  for (const toolName of options.disableTools?.split(\",\") ?? []) {\n    const name = toolName.trim();\n    if (!allToolNames.includes(name)) {\n      // eslint-disable-next-line no-restricted-syntax\n      throw new Error(\n        `Disabled tool ${name} not found (valid tools: ${allToolNames.join(\", \")})`,\n      );\n    }\n    disabledToolNames.add(name);\n  }\n\n  const enabledToolsByName: Record<string, ConvexTool<any, any>> = {};\n  for (const tool of convexTools) {\n    if (!disabledToolNames.has(tool.name)) {\n      enabledToolsByName[tool.name] = tool;\n    }\n  }\n\n  const mutex = new Mutex();\n  const server = new Server(\n    {\n      name: \"Convex MCP Server\",\n      version: \"0.0.1\",\n    },\n    {\n      capabilities: {\n        tools: {},\n      },\n    },\n  );\n  server.setRequestHandler(\"tools/call\", async (request: CallToolRequest) => {\n    const ctx = new RequestContext(options);\n    await initializeBigBrainAuth(ctx, options);\n    try {\n      const authorized = await checkAuthorization(ctx, false);\n      if (!authorized) {\n        await ctx.crash({\n          exitCode: 1,\n          errorType: \"fatal\",\n          printedMessage:\n            \"Not Authorized: Run `npx convex dev` to login to your Convex project.\",\n        });\n      }\n      if (!request.params.arguments) {\n        await ctx.crash({\n          exitCode: 1,\n          errorType: \"fatal\",\n          printedMessage: \"No arguments provided\",\n        });\n      }\n      const convexTool = enabledToolsByName[request.params.name];\n      if (!convexTool) {\n        await ctx.crash({\n          exitCode: 1,\n          errorType: \"fatal\",\n          printedMessage: `Tool ${request.params.name} not found`,\n        });\n      }\n      const input = convexTool.inputSchema.parse(request.params.arguments);\n\n      // Serialize tool handlers since they're mutating the current working directory.\n      const result = await mutex.runExclusive(async () => {\n        return await convexTool.handler(ctx, input);\n      });\n      return {\n        content: [\n          {\n            type: \"text\",\n            text: JSON.stringify(result),\n          },\n        ],\n      };\n    } catch (error: any) {\n      let message: string;\n      if (error instanceof RequestCrash) {\n        message = error.printedMessage;\n      } else if (error instanceof Error) {\n        message = error.message;\n      } else {\n        message = String(error);\n      }\n      return {\n        content: [\n          {\n            type: \"text\",\n            text: JSON.stringify({ error: message }),\n          },\n        ],\n        isError: true,\n      };\n    }\n  });\n  server.setRequestHandler(\"tools/list\", async () => {\n    return {\n      tools: Object.values(enabledToolsByName).map(mcpTool),\n    };\n  });\n  return server;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,2BAAgC;AAChC,qBAA8B;AAC9B,oBAAwC;AACxC,mBAAqC;AACrC,qBAAkC;AAClC,mBAAmC;AACnC,4BAIO;AACP,mBAAiD;AACjD,mBAAsB;AACtB,iCAAuC;AAEvC,MAAM,eAAe,yBAAY,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK;AAElD,MAAM,MAAM,IAAI,6BAAQ,KAAK,EACjC,QAAQ,4DAA4D,EACpE;AAAA,EACC;AAEF,EACC,qBAAqB,KAAK;AAE7B,IACG,QAAQ,OAAO,EACf,QAAQ,sBAAsB,EAC9B;AAAA,EACC;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA,2DAA2D,aAAa,KAAK,IAAI,CAAC;AACpF,EACC;AAAA,EACC;AAAA,EACA;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AAAA,EACA;AACF,EAEC;AAAA,EACC,IAAI,4BAAO,kCAAkC,EAC1C,UAAU,6CAA6C,EACvD,SAAS;AACd,EACC,kCAA8B,kCAAkB,uBAAuB,CAAC,EACxE,OAAO,OAAO,YAAY;AACzB,QAAM,MAAM,UAAM,8BAAc,OAAO;AACvC,MAAI;AACF,UAAM,SAAS,WAAW,OAAO;AACjC,UAAM,YAAY,IAAI,kCAAqB;AAC3C,UAAM,OAAO,QAAQ,SAAS;AAE9B,UAAM,IAAI,QAAQ,MAAM;AAAA,IAAC,CAAC;AAAA,EAC5B,SAAS,OAAY;AACnB,UAAM,IAAI,MAAM;AAAA,MACd,UAAU;AAAA,MACV,WAAW;AAAA,MACX,cAAc,+BAA+B,KAAK;AAAA,MAClD,gBAAgB,+BAA+B,KAAK;AAAA,IACtD,CAAC;AAAA,EACH;AACF,CAAC;AAEI,SAAS,WAAW,SAAqB;AAC9C,QAAM,oBAAoB,oBAAI,IAAY;AAC1C,aAAW,YAAY,QAAQ,cAAc,MAAM,GAAG,KAAK,CAAC,GAAG;AAC7D,UAAM,OAAO,SAAS,KAAK;AAC3B,QAAI,CAAC,aAAa,SAAS,IAAI,GAAG;AAEhC,YAAM,IAAI;AAAA,QACR,iBAAiB,IAAI,4BAA4B,aAAa,KAAK,IAAI,CAAC;AAAA,MAC1E;AAAA,IACF;AACA,sBAAkB,IAAI,IAAI;AAAA,EAC5B;AAEA,QAAM,qBAA2D,CAAC;AAClE,aAAW,QAAQ,0BAAa;AAC9B,QAAI,CAAC,kBAAkB,IAAI,KAAK,IAAI,GAAG;AACrC,yBAAmB,KAAK,IAAI,IAAI;AAAA,IAClC;AAAA,EACF;AAEA,QAAM,QAAQ,IAAI,mBAAM;AACxB,QAAM,SAAS,IAAI;AAAA,IACjB;AAAA,MACE,MAAM;AAAA,MACN,SAAS;AAAA,IACX;AAAA,IACA;AAAA,MACE,cAAc;AAAA,QACZ,OAAO,CAAC;AAAA,MACV;AAAA,IACF;AAAA,EACF;AACA,SAAO,kBAAkB,cAAc,OAAO,YAA6B;AACzE,UAAM,MAAM,IAAI,qCAAe,OAAO;AACtC,cAAM,mDAAuB,KAAK,OAAO;AACzC,QAAI;AACF,YAAM,aAAa,UAAM,iCAAmB,KAAK,KAAK;AACtD,UAAI,CAAC,YAAY;AACf,cAAM,IAAI,MAAM;AAAA,UACd,UAAU;AAAA,UACV,WAAW;AAAA,UACX,gBACE;AAAA,QACJ,CAAC;AAAA,MACH;AACA,UAAI,CAAC,QAAQ,OAAO,WAAW;AAC7B,cAAM,IAAI,MAAM;AAAA,UACd,UAAU;AAAA,UACV,WAAW;AAAA,UACX,gBAAgB;AAAA,QAClB,CAAC;AAAA,MACH;AACA,YAAM,aAAa,mBAAmB,QAAQ,OAAO,IAAI;AACzD,UAAI,CAAC,YAAY;AACf,cAAM,IAAI,MAAM;AAAA,UACd,UAAU;AAAA,UACV,WAAW;AAAA,UACX,gBAAgB,QAAQ,QAAQ,OAAO,IAAI;AAAA,QAC7C,CAAC;AAAA,MACH;AACA,YAAM,QAAQ,WAAW,YAAY,MAAM,QAAQ,OAAO,SAAS;AAGnE,YAAM,SAAS,MAAM,MAAM,aAAa,YAAY;AAClD,eAAO,MAAM,WAAW,QAAQ,KAAK,KAAK;AAAA,MAC5C,CAAC;AACD,aAAO;AAAA,QACL,SAAS;AAAA,UACP;AAAA,YACE,MAAM;AAAA,YACN,MAAM,KAAK,UAAU,MAAM;AAAA,UAC7B;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAY;AACnB,UAAI;AACJ,UAAI,iBAAiB,oCAAc;AACjC,kBAAU,MAAM;AAAA,MAClB,WAAW,iBAAiB,OAAO;AACjC,kBAAU,MAAM;AAAA,MAClB,OAAO;AACL,kBAAU,OAAO,KAAK;AAAA,MACxB;AACA,aAAO;AAAA,QACL,SAAS;AAAA,UACP;AAAA,YACE,MAAM;AAAA,YACN,MAAM,KAAK,UAAU,EAAE,OAAO,QAAQ,CAAC;AAAA,UACzC;AAAA,QACF;AAAA,QACA,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF,CAAC;AACD,SAAO,kBAAkB,cAAc,YAAY;AACjD,WAAO;AAAA,MACL,OAAO,OAAO,OAAO,kBAAkB,EAAE,IAAI,oBAAO;AAAA,IACtD;AAAA,EACF,CAAC;AACD,SAAO;AACT;",
   "names": []
 }

package/dist/cjs/index.js

@@ -21,5 +21,5 @@ __export(index_exports, {
   version: () => version
 });
 module.exports = __toCommonJS(index_exports);
-const version = "1.43.0";
+const version = "1.45.0-alpha.0";
 //# sourceMappingURL=index.js.map

package/dist/cjs/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/index.ts"],
-  "sourcesContent": ["export const version = \"1.43.0\";\n"],
+  "sourcesContent": ["export const version = \"1.45.0-alpha.0\";"],
   "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAO,MAAM,UAAU;",
   "names": []
 }

package/dist/cjs/react/ConvexAuthState.js

@@ -65,39 +65,37 @@ function ConvexProviderWithAuth({
     setIsRefreshing(false);
   }
   const isAuthenticated = authProviderAuthenticated && (isConvexAuthenticated ?? false);
-  return /* @__PURE__ */ import_react.default.createElement(
-    ConvexAuthContext.Provider,
-    {
-      value: {
-        isLoading: isConvexAuthenticated === null,
-        isAuthenticated,
-        isRefreshing: isRefreshing && isAuthenticated
-      }
-    },
-    /* @__PURE__ */ import_react.default.createElement(
-      ConvexAuthStateFirstEffect,
-      {
-        authProviderAuthenticated,
-        fetchAccessToken,
-        authProviderLoading,
-        client,
-        setIsConvexAuthenticated,
-        setIsRefreshing
-      }
-    ),
-    /* @__PURE__ */ import_react.default.createElement(import_client2.ConvexProvider, { client }, children),
-    /* @__PURE__ */ import_react.default.createElement(
-      ConvexAuthStateLastEffect,
-      {
-        authProviderAuthenticated,
-        fetchAccessToken,
-        authProviderLoading,
-        client,
-        setIsConvexAuthenticated,
-        setIsRefreshing
-      }
-    )
+  const isLoading = isConvexAuthenticated === null;
+  const isRefreshingWhileAuthenticated = isRefreshing && isAuthenticated;
+  const authState = (0, import_react.useMemo)(
+    () => ({
+      isLoading,
+      isAuthenticated,
+      isRefreshing: isRefreshingWhileAuthenticated
+    }),
+    [isLoading, isAuthenticated, isRefreshingWhileAuthenticated]
   );
+  return /* @__PURE__ */ import_react.default.createElement(ConvexAuthContext.Provider, { value: authState }, /* @__PURE__ */ import_react.default.createElement(
+    ConvexAuthStateFirstEffect,
+    {
+      authProviderAuthenticated,
+      fetchAccessToken,
+      authProviderLoading,
+      client,
+      setIsConvexAuthenticated,
+      setIsRefreshing
+    }
+  ), /* @__PURE__ */ import_react.default.createElement(import_client2.ConvexProvider, { client }, children), /* @__PURE__ */ import_react.default.createElement(
+    ConvexAuthStateLastEffect,
+    {
+      authProviderAuthenticated,
+      fetchAccessToken,
+      authProviderLoading,
+      client,
+      setIsConvexAuthenticated,
+      setIsRefreshing
+    }
+  ));
 }
 function ConvexAuthStateFirstEffect({
   authProviderAuthenticated,

package/dist/cjs/react/ConvexAuthState.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/react/ConvexAuthState.tsx"],
-  "sourcesContent": ["import React, {\n  createContext,\n  ReactNode,\n  useContext,\n  useEffect,\n  useState,\n} from \"react\";\nimport { AuthTokenFetcher } from \"../browser/sync/client.js\";\nimport { ConvexProvider } from \"./client.js\";\n\n// Until we can import from our own entry points (requires TypeScript 4.7),\n// just describe the interface enough to help users pass the right type.\ntype IConvexReactClient = {\n  setAuth(\n    fetchToken: AuthTokenFetcher,\n    onChange: (isAuthenticated: boolean) => void,\n    onRefreshChange?: (isRefreshing: boolean) => void,\n  ): void;\n  clearAuth(): void;\n};\n\n/**\n * Type representing the state of an auth integration with Convex.\n *\n * - `isLoading`: the client is still resolving the initial auth state and\n *   waiting for the server to confirm the current token.\n * - `isAuthenticated`: the server has confirmed the current token.\n * - `isRefreshing`: the server rejected a previously-confirmed token and the\n *   socket is paused while a replacement is fetched. Only ever `true` when\n *   `isAuthenticated` is also `true`. Routine background token rotation does\n *   not trigger this state.\n *\n * @public\n */\nexport type ConvexAuthState = {\n  isLoading: boolean;\n  isAuthenticated: boolean;\n  isRefreshing: boolean;\n};\n\nconst ConvexAuthContext = createContext<ConvexAuthState>(undefined as any);\n\n/**\n * Get the {@link ConvexAuthState} within a React component.\n *\n * This relies on a Convex auth integration provider being above in the React\n * component tree. See {@link ConvexAuthState} for the meaning of each field.\n *\n * @returns The current {@link ConvexAuthState}.\n *\n * @public\n */\nexport function useConvexAuth(): {\n  isLoading: boolean;\n  isAuthenticated: boolean;\n  isRefreshing: boolean;\n} {\n  const authContext = useContext(ConvexAuthContext);\n  if (authContext === undefined) {\n    throw new Error(\n      \"Could not find `ConvexProviderWithAuth` (or `ConvexProviderWithClerk` \" +\n        \"or `ConvexProviderWithAuth0`) \" +\n        \"as an ancestor component. This component may be missing, or you \" +\n        \"might have two instances of the `convex/react` module loaded in your \" +\n        \"project.\",\n    );\n  }\n  return authContext;\n}\n\n/**\n * A replacement for {@link ConvexProvider} which additionally provides\n * {@link ConvexAuthState} to descendants of this component.\n *\n * Use this to integrate any auth provider with Convex. The `useAuth` prop\n * should be a React hook that returns the provider's authentication state\n * and a function to fetch a JWT access token.\n *\n * If the `useAuth` prop function updates causing a rerender then auth state\n * will transition to loading and the `fetchAccessToken()` function called again.\n *\n * See [Custom Auth Integration](https://docs.convex.dev/auth/advanced/custom-auth) for more information.\n *\n * @public\n */\nexport function ConvexProviderWithAuth({\n  children,\n  client,\n  useAuth,\n}: {\n  children?: ReactNode;\n  client: IConvexReactClient;\n  useAuth: () => {\n    isLoading: boolean;\n    isAuthenticated: boolean;\n    fetchAccessToken: (args: {\n      forceRefreshToken: boolean;\n    }) => Promise<string | null>;\n  };\n}) {\n  const {\n    isLoading: authProviderLoading,\n    isAuthenticated: authProviderAuthenticated,\n    fetchAccessToken,\n  } = useAuth();\n  const [isConvexAuthenticated, setIsConvexAuthenticated] = useState<\n    boolean | null\n  >(null);\n  const [isRefreshing, setIsRefreshing] = useState<boolean>(false);\n\n  // If the useAuth went back to the authProviderLoading state (which is unusual but possible)\n  // reset the Convex auth state to null so that we can correctly\n  // transition the state from \"loading\" to \"authenticated\"\n  // without going through \"unauthenticated\".\n  if (authProviderLoading && isConvexAuthenticated !== null) {\n    setIsConvexAuthenticated(null);\n    setIsRefreshing(false);\n  }\n\n  // If the useAuth goes to not authenticated then isConvexAuthenticated should reflect that.\n  if (\n    !authProviderLoading &&\n    !authProviderAuthenticated &&\n    isConvexAuthenticated !== false\n  ) {\n    setIsConvexAuthenticated(false);\n    setIsRefreshing(false);\n  }\n\n  const isAuthenticated =\n    authProviderAuthenticated && (isConvexAuthenticated ?? false);\n\n  return (\n    <ConvexAuthContext.Provider\n      value={{\n        isLoading: isConvexAuthenticated === null,\n        isAuthenticated,\n        isRefreshing: isRefreshing && isAuthenticated,\n      }}\n    >\n      <ConvexAuthStateFirstEffect\n        authProviderAuthenticated={authProviderAuthenticated}\n        fetchAccessToken={fetchAccessToken}\n        authProviderLoading={authProviderLoading}\n        client={client}\n        setIsConvexAuthenticated={setIsConvexAuthenticated}\n        setIsRefreshing={setIsRefreshing}\n      />\n      <ConvexProvider client={client as any}>{children}</ConvexProvider>\n      <ConvexAuthStateLastEffect\n        authProviderAuthenticated={authProviderAuthenticated}\n        fetchAccessToken={fetchAccessToken}\n        authProviderLoading={authProviderLoading}\n        client={client}\n        setIsConvexAuthenticated={setIsConvexAuthenticated}\n        setIsRefreshing={setIsRefreshing}\n      />\n    </ConvexAuthContext.Provider>\n  );\n}\n\n// First child ensures we `setAuth` before\n// other child components subscribe to queries via `useEffect`.\nfunction ConvexAuthStateFirstEffect({\n  authProviderAuthenticated,\n  fetchAccessToken,\n  authProviderLoading,\n  client,\n  setIsConvexAuthenticated,\n  setIsRefreshing,\n}: {\n  authProviderAuthenticated: boolean;\n  fetchAccessToken: (args: {\n    forceRefreshToken: boolean;\n  }) => Promise<string | null>;\n  authProviderLoading: boolean;\n  client: IConvexReactClient;\n  setIsConvexAuthenticated: React.Dispatch<\n    React.SetStateAction<boolean | null>\n  >;\n  setIsRefreshing: React.Dispatch<React.SetStateAction<boolean>>;\n}) {\n  useEffect(() => {\n    let isThisEffectRelevant = true;\n    if (authProviderAuthenticated) {\n      client.setAuth(\n        fetchAccessToken,\n        (backendReportsIsAuthenticated) => {\n          if (isThisEffectRelevant) {\n            setIsConvexAuthenticated(() => backendReportsIsAuthenticated);\n          }\n        },\n        (isRefreshing) => {\n          if (isThisEffectRelevant) {\n            setIsRefreshing(isRefreshing);\n          }\n        },\n      );\n      return () => {\n        isThisEffectRelevant = false;\n\n        // If unmounting or something changed before we finished fetching the token\n        // we shouldn't transition to a loaded state.\n        setIsConvexAuthenticated((isConvexAuthenticated: boolean | null) =>\n          isConvexAuthenticated ? false : null,\n        );\n        setIsRefreshing(false);\n      };\n    }\n  }, [\n    authProviderAuthenticated,\n    fetchAccessToken,\n    authProviderLoading,\n    client,\n    setIsConvexAuthenticated,\n    setIsRefreshing,\n  ]);\n  return null;\n}\n\n// Last child ensures we `clearAuth` last,\n// so that queries from unmounted sibling components\n// unsubscribe first and don't rerun without auth on the server\nfunction ConvexAuthStateLastEffect({\n  authProviderAuthenticated,\n  fetchAccessToken,\n  authProviderLoading,\n  client,\n  setIsConvexAuthenticated,\n  setIsRefreshing,\n}: {\n  authProviderAuthenticated: boolean;\n  fetchAccessToken: (args: {\n    forceRefreshToken: boolean;\n  }) => Promise<string | null>;\n  authProviderLoading: boolean;\n  client: IConvexReactClient;\n  setIsConvexAuthenticated: React.Dispatch<\n    React.SetStateAction<boolean | null>\n  >;\n  setIsRefreshing: React.Dispatch<React.SetStateAction<boolean>>;\n}) {\n  useEffect(() => {\n    // If rendered with authProviderAuthenticated=true then clear that auth on in cleanup.\n    if (authProviderAuthenticated) {\n      return () => {\n        client.clearAuth();\n        // Set state back to loading in case this is a transition from one\n        // fetchToken function to another which signals a new auth context,\n        // e.g. a new orgId from Clerk. Auth context changes like this\n        // return isAuthenticated: true from useAuth() but if\n        // useAuth reports isAuthenticated: false on the next render\n        // then this null value will be overridden to false.\n        setIsConvexAuthenticated(() => null);\n        setIsRefreshing(false);\n      };\n    }\n  }, [\n    authProviderAuthenticated,\n    fetchAccessToken,\n    authProviderLoading,\n    client,\n    setIsConvexAuthenticated,\n    setIsRefreshing,\n  ]);\n  return null;\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBAMO;AAEP,IAAAA,iBAA+B;AAgC/B,MAAM,wBAAoB,4BAA+B,MAAgB;AAYlE,SAAS,gBAId;AACA,QAAM,kBAAc,yBAAW,iBAAiB;AAChD,MAAI,gBAAgB,QAAW;AAC7B,UAAM,IAAI;AAAA,MACR;AAAA,IAKF;AAAA,EACF;AACA,SAAO;AACT;AAiBO,SAAS,uBAAuB;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AACF,GAUG;AACD,QAAM;AAAA,IACJ,WAAW;AAAA,IACX,iBAAiB;AAAA,IACjB;AAAA,EACF,IAAI,QAAQ;AACZ,QAAM,CAAC,uBAAuB,wBAAwB,QAAI,uBAExD,IAAI;AACN,QAAM,CAAC,cAAc,eAAe,QAAI,uBAAkB,KAAK;AAM/D,MAAI,uBAAuB,0BAA0B,MAAM;AACzD,6BAAyB,IAAI;AAC7B,oBAAgB,KAAK;AAAA,EACvB;AAGA,MACE,CAAC,uBACD,CAAC,6BACD,0BAA0B,OAC1B;AACA,6BAAyB,KAAK;AAC9B,oBAAgB,KAAK;AAAA,EACvB;AAEA,QAAM,kBACJ,8BAA8B,yBAAyB;AAEzD,SACE,6BAAAC,QAAA;AAAA,IAAC,kBAAkB;AAAA,IAAlB;AAAA,MACC,OAAO;AAAA,QACL,WAAW,0BAA0B;AAAA,QACrC;AAAA,QACA,cAAc,gBAAgB;AAAA,MAChC;AAAA;AAAA,IAEA,6BAAAA,QAAA;AAAA,MAAC;AAAA;AAAA,QACC;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA;AAAA,IACF;AAAA,IACA,6BAAAA,QAAA,cAAC,iCAAe,UAAwB,QAAS;AAAA,IACjD,6BAAAA,QAAA;AAAA,MAAC;AAAA;AAAA,QACC;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA;AAAA,IACF;AAAA,EACF;AAEJ;AAIA,SAAS,2BAA2B;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAWG;AACD,8BAAU,MAAM;AACd,QAAI,uBAAuB;AAC3B,QAAI,2BAA2B;AAC7B,aAAO;AAAA,QACL;AAAA,QACA,CAAC,kCAAkC;AACjC,cAAI,sBAAsB;AACxB,qCAAyB,MAAM,6BAA6B;AAAA,UAC9D;AAAA,QACF;AAAA,QACA,CAAC,iBAAiB;AAChB,cAAI,sBAAsB;AACxB,4BAAgB,YAAY;AAAA,UAC9B;AAAA,QACF;AAAA,MACF;AACA,aAAO,MAAM;AACX,+BAAuB;AAIvB;AAAA,UAAyB,CAAC,0BACxB,wBAAwB,QAAQ;AAAA,QAClC;AACA,wBAAgB,KAAK;AAAA,MACvB;AAAA,IACF;AAAA,EACF,GAAG;AAAA,IACD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,SAAO;AACT;AAKA,SAAS,0BAA0B;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAWG;AACD,8BAAU,MAAM;AAEd,QAAI,2BAA2B;AAC7B,aAAO,MAAM;AACX,eAAO,UAAU;AAOjB,iCAAyB,MAAM,IAAI;AACnC,wBAAgB,KAAK;AAAA,MACvB;AAAA,IACF;AAAA,EACF,GAAG;AAAA,IACD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,SAAO;AACT;",
+  "sourcesContent": ["import React, {\n  createContext,\n  ReactNode,\n  useContext,\n  useEffect,\n  useMemo,\n  useState,\n} from \"react\";\nimport { AuthTokenFetcher } from \"../browser/sync/client.js\";\nimport { ConvexProvider } from \"./client.js\";\n\n// Until we can import from our own entry points (requires TypeScript 4.7),\n// just describe the interface enough to help users pass the right type.\ntype IConvexReactClient = {\n  setAuth(\n    fetchToken: AuthTokenFetcher,\n    onChange: (isAuthenticated: boolean) => void,\n    onRefreshChange?: (isRefreshing: boolean) => void,\n  ): void;\n  clearAuth(): void;\n};\n\n/**\n * Type representing the state of an auth integration with Convex.\n *\n * - `isLoading`: the client is still resolving the initial auth state and\n *   waiting for the server to confirm the current token.\n * - `isAuthenticated`: the server has confirmed the current token.\n * - `isRefreshing`: the server rejected a previously-confirmed token and the\n *   socket is paused while a replacement is fetched. Only ever `true` when\n *   `isAuthenticated` is also `true`. Routine background token rotation does\n *   not trigger this state.\n *\n * @public\n */\nexport type ConvexAuthState = {\n  isLoading: boolean;\n  isAuthenticated: boolean;\n  isRefreshing: boolean;\n};\n\nconst ConvexAuthContext = createContext<ConvexAuthState>(undefined as any);\n\n/**\n * Get the {@link ConvexAuthState} within a React component.\n *\n * This relies on a Convex auth integration provider being above in the React\n * component tree. See {@link ConvexAuthState} for the meaning of each field.\n *\n * @returns The current {@link ConvexAuthState}.\n *\n * @public\n */\nexport function useConvexAuth(): {\n  isLoading: boolean;\n  isAuthenticated: boolean;\n  isRefreshing: boolean;\n} {\n  const authContext = useContext(ConvexAuthContext);\n  if (authContext === undefined) {\n    throw new Error(\n      \"Could not find `ConvexProviderWithAuth` (or `ConvexProviderWithClerk` \" +\n        \"or `ConvexProviderWithAuth0`) \" +\n        \"as an ancestor component. This component may be missing, or you \" +\n        \"might have two instances of the `convex/react` module loaded in your \" +\n        \"project.\",\n    );\n  }\n  return authContext;\n}\n\n/**\n * A replacement for {@link ConvexProvider} which additionally provides\n * {@link ConvexAuthState} to descendants of this component.\n *\n * Use this to integrate any auth provider with Convex. The `useAuth` prop\n * should be a React hook that returns the provider's authentication state\n * and a function to fetch a JWT access token.\n *\n * If the `useAuth` prop function updates causing a rerender then auth state\n * will transition to loading and the `fetchAccessToken()` function called again.\n *\n * See [Custom Auth Integration](https://docs.convex.dev/auth/advanced/custom-auth) for more information.\n *\n * @public\n */\nexport function ConvexProviderWithAuth({\n  children,\n  client,\n  useAuth,\n}: {\n  children?: ReactNode;\n  client: IConvexReactClient;\n  useAuth: () => {\n    isLoading: boolean;\n    isAuthenticated: boolean;\n    fetchAccessToken: (args: {\n      forceRefreshToken: boolean;\n    }) => Promise<string | null>;\n  };\n}) {\n  const {\n    isLoading: authProviderLoading,\n    isAuthenticated: authProviderAuthenticated,\n    fetchAccessToken,\n  } = useAuth();\n  const [isConvexAuthenticated, setIsConvexAuthenticated] = useState<\n    boolean | null\n  >(null);\n  const [isRefreshing, setIsRefreshing] = useState<boolean>(false);\n\n  // If the useAuth went back to the authProviderLoading state (which is unusual but possible)\n  // reset the Convex auth state to null so that we can correctly\n  // transition the state from \"loading\" to \"authenticated\"\n  // without going through \"unauthenticated\".\n  if (authProviderLoading && isConvexAuthenticated !== null) {\n    setIsConvexAuthenticated(null);\n    setIsRefreshing(false);\n  }\n\n  // If the useAuth goes to not authenticated then isConvexAuthenticated should reflect that.\n  if (\n    !authProviderLoading &&\n    !authProviderAuthenticated &&\n    isConvexAuthenticated !== false\n  ) {\n    setIsConvexAuthenticated(false);\n    setIsRefreshing(false);\n  }\n\n  const isAuthenticated =\n    authProviderAuthenticated && (isConvexAuthenticated ?? false);\n  const isLoading = isConvexAuthenticated === null;\n  const isRefreshingWhileAuthenticated = isRefreshing && isAuthenticated;\n\n  // Stabilize the context value's identity so `useConvexAuth()` consumers\n  // only re-render when the derived auth state actually changes.\n  const authState = useMemo<ConvexAuthState>(\n    () => ({\n      isLoading,\n      isAuthenticated,\n      isRefreshing: isRefreshingWhileAuthenticated,\n    }),\n    [isLoading, isAuthenticated, isRefreshingWhileAuthenticated],\n  );\n\n  return (\n    <ConvexAuthContext.Provider value={authState}>\n      <ConvexAuthStateFirstEffect\n        authProviderAuthenticated={authProviderAuthenticated}\n        fetchAccessToken={fetchAccessToken}\n        authProviderLoading={authProviderLoading}\n        client={client}\n        setIsConvexAuthenticated={setIsConvexAuthenticated}\n        setIsRefreshing={setIsRefreshing}\n      />\n      <ConvexProvider client={client as any}>{children}</ConvexProvider>\n      <ConvexAuthStateLastEffect\n        authProviderAuthenticated={authProviderAuthenticated}\n        fetchAccessToken={fetchAccessToken}\n        authProviderLoading={authProviderLoading}\n        client={client}\n        setIsConvexAuthenticated={setIsConvexAuthenticated}\n        setIsRefreshing={setIsRefreshing}\n      />\n    </ConvexAuthContext.Provider>\n  );\n}\n\n// First child ensures we `setAuth` before\n// other child components subscribe to queries via `useEffect`.\nfunction ConvexAuthStateFirstEffect({\n  authProviderAuthenticated,\n  fetchAccessToken,\n  authProviderLoading,\n  client,\n  setIsConvexAuthenticated,\n  setIsRefreshing,\n}: {\n  authProviderAuthenticated: boolean;\n  fetchAccessToken: (args: {\n    forceRefreshToken: boolean;\n  }) => Promise<string | null>;\n  authProviderLoading: boolean;\n  client: IConvexReactClient;\n  setIsConvexAuthenticated: React.Dispatch<\n    React.SetStateAction<boolean | null>\n  >;\n  setIsRefreshing: React.Dispatch<React.SetStateAction<boolean>>;\n}) {\n  useEffect(() => {\n    let isThisEffectRelevant = true;\n    if (authProviderAuthenticated) {\n      client.setAuth(\n        fetchAccessToken,\n        (backendReportsIsAuthenticated) => {\n          if (isThisEffectRelevant) {\n            setIsConvexAuthenticated(() => backendReportsIsAuthenticated);\n          }\n        },\n        (isRefreshing) => {\n          if (isThisEffectRelevant) {\n            setIsRefreshing(isRefreshing);\n          }\n        },\n      );\n      return () => {\n        isThisEffectRelevant = false;\n\n        // If unmounting or something changed before we finished fetching the token\n        // we shouldn't transition to a loaded state.\n        setIsConvexAuthenticated((isConvexAuthenticated: boolean | null) =>\n          isConvexAuthenticated ? false : null,\n        );\n        setIsRefreshing(false);\n      };\n    }\n  }, [\n    authProviderAuthenticated,\n    fetchAccessToken,\n    authProviderLoading,\n    client,\n    setIsConvexAuthenticated,\n    setIsRefreshing,\n  ]);\n  return null;\n}\n\n// Last child ensures we `clearAuth` last,\n// so that queries from unmounted sibling components\n// unsubscribe first and don't rerun without auth on the server\nfunction ConvexAuthStateLastEffect({\n  authProviderAuthenticated,\n  fetchAccessToken,\n  authProviderLoading,\n  client,\n  setIsConvexAuthenticated,\n  setIsRefreshing,\n}: {\n  authProviderAuthenticated: boolean;\n  fetchAccessToken: (args: {\n    forceRefreshToken: boolean;\n  }) => Promise<string | null>;\n  authProviderLoading: boolean;\n  client: IConvexReactClient;\n  setIsConvexAuthenticated: React.Dispatch<\n    React.SetStateAction<boolean | null>\n  >;\n  setIsRefreshing: React.Dispatch<React.SetStateAction<boolean>>;\n}) {\n  useEffect(() => {\n    // If rendered with authProviderAuthenticated=true then clear that auth on in cleanup.\n    if (authProviderAuthenticated) {\n      return () => {\n        client.clearAuth();\n        // Set state back to loading in case this is a transition from one\n        // fetchToken function to another which signals a new auth context,\n        // e.g. a new orgId from Clerk. Auth context changes like this\n        // return isAuthenticated: true from useAuth() but if\n        // useAuth reports isAuthenticated: false on the next render\n        // then this null value will be overridden to false.\n        setIsConvexAuthenticated(() => null);\n        setIsRefreshing(false);\n      };\n    }\n  }, [\n    authProviderAuthenticated,\n    fetchAccessToken,\n    authProviderLoading,\n    client,\n    setIsConvexAuthenticated,\n    setIsRefreshing,\n  ]);\n  return null;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBAOO;AAEP,IAAAA,iBAA+B;AAgC/B,MAAM,wBAAoB,4BAA+B,MAAgB;AAYlE,SAAS,gBAId;AACA,QAAM,kBAAc,yBAAW,iBAAiB;AAChD,MAAI,gBAAgB,QAAW;AAC7B,UAAM,IAAI;AAAA,MACR;AAAA,IAKF;AAAA,EACF;AACA,SAAO;AACT;AAiBO,SAAS,uBAAuB;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AACF,GAUG;AACD,QAAM;AAAA,IACJ,WAAW;AAAA,IACX,iBAAiB;AAAA,IACjB;AAAA,EACF,IAAI,QAAQ;AACZ,QAAM,CAAC,uBAAuB,wBAAwB,QAAI,uBAExD,IAAI;AACN,QAAM,CAAC,cAAc,eAAe,QAAI,uBAAkB,KAAK;AAM/D,MAAI,uBAAuB,0BAA0B,MAAM;AACzD,6BAAyB,IAAI;AAC7B,oBAAgB,KAAK;AAAA,EACvB;AAGA,MACE,CAAC,uBACD,CAAC,6BACD,0BAA0B,OAC1B;AACA,6BAAyB,KAAK;AAC9B,oBAAgB,KAAK;AAAA,EACvB;AAEA,QAAM,kBACJ,8BAA8B,yBAAyB;AACzD,QAAM,YAAY,0BAA0B;AAC5C,QAAM,iCAAiC,gBAAgB;AAIvD,QAAM,gBAAY;AAAA,IAChB,OAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,cAAc;AAAA,IAChB;AAAA,IACA,CAAC,WAAW,iBAAiB,8BAA8B;AAAA,EAC7D;AAEA,SACE,6BAAAC,QAAA,cAAC,kBAAkB,UAAlB,EAA2B,OAAO,aACjC,6BAAAA,QAAA;AAAA,IAAC;AAAA;AAAA,MACC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA;AAAA,EACF,GACA,6BAAAA,QAAA,cAAC,iCAAe,UAAwB,QAAS,GACjD,6BAAAA,QAAA;AAAA,IAAC;AAAA;AAAA,MACC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA;AAAA,EACF,CACF;AAEJ;AAIA,SAAS,2BAA2B;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAWG;AACD,8BAAU,MAAM;AACd,QAAI,uBAAuB;AAC3B,QAAI,2BAA2B;AAC7B,aAAO;AAAA,QACL;AAAA,QACA,CAAC,kCAAkC;AACjC,cAAI,sBAAsB;AACxB,qCAAyB,MAAM,6BAA6B;AAAA,UAC9D;AAAA,QACF;AAAA,QACA,CAAC,iBAAiB;AAChB,cAAI,sBAAsB;AACxB,4BAAgB,YAAY;AAAA,UAC9B;AAAA,QACF;AAAA,MACF;AACA,aAAO,MAAM;AACX,+BAAuB;AAIvB;AAAA,UAAyB,CAAC,0BACxB,wBAAwB,QAAQ;AAAA,QAClC;AACA,wBAAgB,KAAK;AAAA,MACvB;AAAA,IACF;AAAA,EACF,GAAG;AAAA,IACD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,SAAO;AACT;AAKA,SAAS,0BAA0B;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAWG;AACD,8BAAU,MAAM;AAEd,QAAI,2BAA2B;AAC7B,aAAO,MAAM;AACX,eAAO,UAAU;AAOjB,iCAAyB,MAAM,IAAI;AACnC,wBAAgB,KAAK;AAAA,MACvB;AAAA,IACF;AAAA,EACF,GAAG;AAAA,IACD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,SAAO;AACT;",
   "names": ["import_client", "React"]
 }

package/dist/cjs/server/impl/actions_impl.js

@@ -18,6 +18,7 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var actions_impl_exports = {};
 __export(actions_impl_exports, {
+  getServiceToken: () => getServiceToken,
   setupActionCalls: () => setupActionCalls
 });
 module.exports = __toCommonJS(actions_impl_exports);
@@ -26,6 +27,7 @@ var import__ = require("../../index.js");
 var import_syscall = require("./syscall.js");
 var import_common = require("../../common/index.js");
 var import_paths = require("../components/paths.js");
+var import_validate = require("./validate.js");
 function syscallArgs(requestId, functionReference, args) {
   const address = (0, import_paths.getFunctionAddress)(functionReference);
   return {
@@ -60,4 +62,14 @@ function setupActionCalls(requestId) {
     }
   };
 }
+async function getServiceToken(service) {
+  (0, import_validate.validateArg)(service, 1, "getServiceToken", "service");
+  if (service !== "ai-gateway") {
+    throw new Error(`Unsupported service "${String(service)}"`);
+  }
+  return await (0, import_syscall.performAsyncSyscall)("1.0/createServiceToken", {
+    service,
+    version: import__.version
+  });
+}
 //# sourceMappingURL=actions_impl.js.map

package/dist/cjs/server/impl/actions_impl.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/server/impl/actions_impl.ts"],
-  "sourcesContent": ["import { convexToJson, jsonToConvex, Value } from \"../../values/index.js\";\nimport { version } from \"../../index.js\";\nimport { performAsyncSyscall } from \"./syscall.js\";\nimport { parseArgs } from \"../../common/index.js\";\nimport { FunctionReference } from \"../../server/api.js\";\nimport { getFunctionAddress } from \"../components/paths.js\";\n\nfunction syscallArgs(\n  requestId: string,\n  functionReference: any,\n  args?: Record<string, Value>,\n) {\n  const address = getFunctionAddress(functionReference);\n  return {\n    ...address,\n    args: convexToJson(parseArgs(args)),\n    version,\n    requestId,\n  };\n}\n\nexport function setupActionCalls(requestId: string) {\n  return {\n    runQuery: async (\n      query: FunctionReference<\"query\", \"public\" | \"internal\">,\n      args?: Record<string, Value>,\n    ): Promise<any> => {\n      const result = await performAsyncSyscall(\n        \"1.0/actions/query\",\n        syscallArgs(requestId, query, args),\n      );\n      return jsonToConvex(result);\n    },\n    runMutation: async (\n      mutation: FunctionReference<\"mutation\", \"public\" | \"internal\">,\n      args?: Record<string, Value>,\n    ): Promise<any> => {\n      const result = await performAsyncSyscall(\n        \"1.0/actions/mutation\",\n        syscallArgs(requestId, mutation, args),\n      );\n      return jsonToConvex(result);\n    },\n    runAction: async (\n      action: FunctionReference<\"action\", \"public\" | \"internal\">,\n      args?: Record<string, Value>,\n    ): Promise<any> => {\n      const result = await performAsyncSyscall(\n        \"1.0/actions/action\",\n        syscallArgs(requestId, action, args),\n      );\n      return jsonToConvex(result);\n    },\n  };\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAAkD;AAClD,eAAwB;AACxB,qBAAoC;AACpC,oBAA0B;AAE1B,mBAAmC;AAEnC,SAAS,YACP,WACA,mBACA,MACA;AACA,QAAM,cAAU,iCAAmB,iBAAiB;AACpD,SAAO;AAAA,IACL,GAAG;AAAA,IACH,UAAM,gCAAa,yBAAU,IAAI,CAAC;AAAA,IAClC;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,iBAAiB,WAAmB;AAClD,SAAO;AAAA,IACL,UAAU,OACR,OACA,SACiB;AACjB,YAAM,SAAS,UAAM;AAAA,QACnB;AAAA,QACA,YAAY,WAAW,OAAO,IAAI;AAAA,MACpC;AACA,iBAAO,4BAAa,MAAM;AAAA,IAC5B;AAAA,IACA,aAAa,OACX,UACA,SACiB;AACjB,YAAM,SAAS,UAAM;AAAA,QACnB;AAAA,QACA,YAAY,WAAW,UAAU,IAAI;AAAA,MACvC;AACA,iBAAO,4BAAa,MAAM;AAAA,IAC5B;AAAA,IACA,WAAW,OACT,QACA,SACiB;AACjB,YAAM,SAAS,UAAM;AAAA,QACnB;AAAA,QACA,YAAY,WAAW,QAAQ,IAAI;AAAA,MACrC;AACA,iBAAO,4BAAa,MAAM;AAAA,IAC5B;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { convexToJson, jsonToConvex, Value } from \"../../values/index.js\";\nimport { version } from \"../../index.js\";\nimport { performAsyncSyscall } from \"./syscall.js\";\nimport { parseArgs } from \"../../common/index.js\";\nimport { FunctionReference } from \"../../server/api.js\";\nimport { getFunctionAddress } from \"../components/paths.js\";\nimport { validateArg } from \"./validate.js\";\n\nfunction syscallArgs(\n  requestId: string,\n  functionReference: any,\n  args?: Record<string, Value>,\n) {\n  const address = getFunctionAddress(functionReference);\n  return {\n    ...address,\n    args: convexToJson(parseArgs(args)),\n    version,\n    requestId,\n  };\n}\n\nexport function setupActionCalls(requestId: string) {\n  return {\n    runQuery: async (\n      query: FunctionReference<\"query\", \"public\" | \"internal\">,\n      args?: Record<string, Value>,\n    ): Promise<any> => {\n      const result = await performAsyncSyscall(\n        \"1.0/actions/query\",\n        syscallArgs(requestId, query, args),\n      );\n      return jsonToConvex(result);\n    },\n    runMutation: async (\n      mutation: FunctionReference<\"mutation\", \"public\" | \"internal\">,\n      args?: Record<string, Value>,\n    ): Promise<any> => {\n      const result = await performAsyncSyscall(\n        \"1.0/actions/mutation\",\n        syscallArgs(requestId, mutation, args),\n      );\n      return jsonToConvex(result);\n    },\n    runAction: async (\n      action: FunctionReference<\"action\", \"public\" | \"internal\">,\n      args?: Record<string, Value>,\n    ): Promise<any> => {\n      const result = await performAsyncSyscall(\n        \"1.0/actions/action\",\n        syscallArgs(requestId, action, args),\n      );\n      return jsonToConvex(result);\n    },\n  };\n}\n\n/**\n * Get a short-lived credential for calling a Convex-managed service.\n *\n * This function can only be called while an action is running. The credential\n * is scoped to the current deployment and should be sent as a bearer token.\n * Repeated calls in the same action reuse one token; a failed mint is not\n * cached, so a later call retries.\n *\n * @param service - The service the credential may access.\n * @internal\n */\nexport async function getServiceToken(service: \"ai-gateway\"): Promise<string> {\n  validateArg(service, 1, \"getServiceToken\", \"service\");\n  if (service !== \"ai-gateway\") {\n    throw new Error(`Unsupported service \"${String(service)}\"`);\n  }\n  return await performAsyncSyscall(\"1.0/createServiceToken\", {\n    service,\n    version,\n  });\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAAkD;AAClD,eAAwB;AACxB,qBAAoC;AACpC,oBAA0B;AAE1B,mBAAmC;AACnC,sBAA4B;AAE5B,SAAS,YACP,WACA,mBACA,MACA;AACA,QAAM,cAAU,iCAAmB,iBAAiB;AACpD,SAAO;AAAA,IACL,GAAG;AAAA,IACH,UAAM,gCAAa,yBAAU,IAAI,CAAC;AAAA,IAClC;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,iBAAiB,WAAmB;AAClD,SAAO;AAAA,IACL,UAAU,OACR,OACA,SACiB;AACjB,YAAM,SAAS,UAAM;AAAA,QACnB;AAAA,QACA,YAAY,WAAW,OAAO,IAAI;AAAA,MACpC;AACA,iBAAO,4BAAa,MAAM;AAAA,IAC5B;AAAA,IACA,aAAa,OACX,UACA,SACiB;AACjB,YAAM,SAAS,UAAM;AAAA,QACnB;AAAA,QACA,YAAY,WAAW,UAAU,IAAI;AAAA,MACvC;AACA,iBAAO,4BAAa,MAAM;AAAA,IAC5B;AAAA,IACA,WAAW,OACT,QACA,SACiB;AACjB,YAAM,SAAS,UAAM;AAAA,QACnB;AAAA,QACA,YAAY,WAAW,QAAQ,IAAI;AAAA,MACrC;AACA,iBAAO,4BAAa,MAAM;AAAA,IAC5B;AAAA,EACF;AACF;AAaA,eAAsB,gBAAgB,SAAwC;AAC5E,mCAAY,SAAS,GAAG,mBAAmB,SAAS;AACpD,MAAI,YAAY,cAAc;AAC5B,UAAM,IAAI,MAAM,wBAAwB,OAAO,OAAO,CAAC,GAAG;AAAA,EAC5D;AACA,SAAO,UAAM,oCAAoB,0BAA0B;AAAA,IACzD;AAAA,IACA;AAAA,EACF,CAAC;AACH;",
   "names": []
 }