kitcn 0.33.5 → 0.33.7

package/dist/auth/start/index.js

@@ -1,10 +1,132 @@
+//#region src/react/identity-guard-registry.ts
+const REGISTRY_KEY = Symbol.for("kitcn.identityGuard.v2");
+const createRegistry = () => ({
+	documentIdentity: null,
+	guards: /* @__PURE__ */ new Set(),
+	settledClients: /* @__PURE__ */ new WeakSet(),
+	settlementListeners: /* @__PURE__ */ new WeakMap(),
+	storeGuards: /* @__PURE__ */ new WeakMap(),
+	tripListeners: /* @__PURE__ */ new Set(),
+	tripped: false,
+	watchedClients: /* @__PURE__ */ new WeakSet()
+});
+const isRegistry = (value) => {
+	const candidate = value;
+	return typeof candidate === "object" && candidate !== null && typeof candidate.tripped === "boolean" && (candidate.documentIdentity === null || typeof candidate.documentIdentity === "string") && candidate.tripListeners instanceof Set && candidate.guards instanceof Set && candidate.storeGuards instanceof WeakMap && candidate.settledClients instanceof WeakSet && candidate.settlementListeners instanceof WeakMap && candidate.watchedClients instanceof WeakSet;
+};
+let incompatibleStandIn;
+const pageRegistry = () => {
+	if (typeof window === "undefined") return null;
+	const scope = globalThis;
+	scope[REGISTRY_KEY] ??= createRegistry();
+	const found = scope[REGISTRY_KEY];
+	if (isRegistry(found)) return found;
+	if (!incompatibleStandIn) {
+		console.warn("[kitcn] identity guard state of another kitcn revision is on this page; guarded providers hand out no token until the page reloads.");
+		incompatibleStandIn = {
+			...createRegistry(),
+			incompatible: true
+		};
+	}
+	return incompatibleStandIn;
+};
+const isDocumentTripped = () => pageRegistry()?.tripped ?? false;
+const tripDocument = () => {
+	const registry = pageRegistry();
+	if (!registry || registry.tripped) return;
+	registry.tripped = true;
+	for (const listener of [...registry.tripListeners]) try {
+		listener();
+	} catch (error) {
+		console.error("[kitcn] identity guard trip listener threw", error);
+	}
+};
+const guardedProviderMounted = () => [...pageRegistry()?.guards ?? []].some((mounted) => mounted.guarded);
+const boundIdentities = (guard) => {
+	const registry = pageRegistry();
+	const bound = [registry?.documentIdentity ?? null];
+	if (guard?.guarded) bound.push(guard.identity, guard.baseline());
+	for (const mounted of registry?.guards ?? []) if (mounted.hasGetter) bound.push(mounted.baseline());
+	return bound.filter((identity) => identity !== null);
+};
+const identityGuardInPlay = (guard) => !!guard?.guarded || boundIdentities(guard).length > 0 || guardedProviderMounted();
+const isTokenAdmissible = (token, guard, use) => {
+	if (isDocumentTripped() || guard?.tripped) return false;
+	if (guard?.guarded && pageRegistry()?.incompatible) return false;
+	const bound = boundIdentities(guard);
+	if (!isJwt(token)) {
+		if (use === "hold") return true;
+		if (use === "restore") return bound.length === 0;
+		return !identityGuardInPlay(guard);
+	}
+	const identity = decodeTokenSubjectSessionIdentity(token);
+	return identity === null ? bound.length === 0 : bound.every((known) => known === identity);
+};
+const admitToken = (token, { announce = false, guard, use }) => {
+	if (!isTokenAdmissible(token, guard, use)) {
+		if (isJwt(token)) {
+			if (guard) guard.tripped = true;
+			tripDocument();
+		}
+		return false;
+	}
+	const identity = isJwt(token) ? decodeTokenSubjectSessionIdentity(token) : null;
+	if (identity !== null && (guard?.guarded || guardedProviderMounted())) {
+		if (guard?.guarded) guard.identity = identity;
+		const registry = pageRegistry();
+		if (registry) registry.documentIdentity ??= identity;
+	}
+	if (announce && guard?.guarded && isJwt(token)) {
+		guard.onAdmitted(token);
+		return admitToken(token, {
+			guard,
+			use
+		});
+	}
+	return !isDocumentTripped() && !guard?.tripped;
+};
+function decodeJwtClaims(token) {
+	const segments = token.split(".");
+	if (segments.length !== 3 || !segments[1]) return null;
+	try {
+		const payload = JSON.parse(atob(segments[1].replaceAll("-", "+").replaceAll("_", "/")));
+		return typeof payload === "object" && payload !== null && !Array.isArray(payload) ? payload : null;
+	} catch {
+		return null;
+	}
+}
+const isJwt = (token) => decodeJwtClaims(token) !== null;
+/**
+* The user and session a Better Auth Convex JWT speaks for (`sub` and
+* `sessionId`), or null. Other claims (name, email, updatedAt) may change
+* within one session and do not count.
+*/
+function decodeTokenSubjectSessionIdentity(token) {
+	const claims = token ? decodeJwtClaims(token) : null;
+	if (!claims || typeof claims.sub !== "string") return null;
+	const sessionId = typeof claims.sessionId === "string" ? claims.sessionId : "";
+	return `${claims.sub}|${sessionId}`;
+}
+
+//#endregion
+//#region src/auth-client/client-settlement.ts
+function settleClient(client) {
+	const registry = pageRegistry();
+	if (!registry || registry.settledClients.has(client)) return;
+	registry.settledClients.add(client);
+	for (const listener of [...registry.settlementListeners.get(client) ?? []]) listener();
+}
+
+//#endregion
 //#region src/auth-start/index.ts
 const startLoaderAuthTokens = /* @__PURE__ */ new WeakMap();
 const isStartLoaderConvexQueryClient = (target) => "convexClient" in target;
 const syncConvexAuthForStartLoader = async ({ convex, getToken }) => {
 	const authClient = isStartLoaderConvexQueryClient(convex) ? convex.convexClient : convex;
 	const serverHttpClient = isStartLoaderConvexQueryClient(convex) ? convex.serverHttpClient : void 0;
-	const token = await getToken() ?? null;
+	const loaderToken = await getToken() ?? null;
+	const admit = (candidate) => admitToken(candidate, { use: "handout" });
+	const token = loaderToken !== null && !admit(loaderToken) ? null : loaderToken;
 	if (startLoaderAuthTokens.get(convex) === token) return {
 		isAuthenticated: token !== null,
 		token
@@ -18,7 +140,17 @@ const syncConvexAuthForStartLoader = async ({ convex, getToken }) => {
 			token
 		};
 	}
-	authClient.setAuth(async () => token);
+	settleClient(authClient);
+	authClient.setAuth(async () => admit(token) ? token : null);
+	if (isDocumentTripped()) {
+		startLoaderAuthTokens.set(convex, null);
+		authClient.clearAuth();
+		serverHttpClient?.clearAuth?.();
+		return {
+			isAuthenticated: false,
+			token: null
+		};
+	}
 	serverHttpClient?.setAuth(token);
 	return {
 		isAuthenticated: true,

package/dist/crpc/index.d.ts

@@ -1,5 +1,5 @@
 import { B as dateWireCodec, F as DATE_CODEC_TAG, G as identityTransformer, H as defaultCRPCTransformer, I as DataTransformer, L as DataTransformerOptions, P as CombinedDataTransformer, R as WireCodec, U as encodeWire, V as decodeWire, W as getTransformer, a as HttpErrorCode, c as HttpQueryKey, d as HttpRouteMap, f as InferHttpInput, g as isHttpClientError, h as buildHttpQueryPrefixKey, i as HttpClientFromRouter, l as HttpQueryPrefixKey, m as buildHttpQueryKey, n as HttpClient, o as HttpMutationKey, p as InferHttpOutput, r as HttpClientError, s as HttpProcedureCall, t as HTTP_DEFAULT_STALE_TIME, u as HttpRouteInfo, z as createTaggedTransformer } from "../http-types-BhhPZtwa.js";
-import { A as HttpInputArgs, C as ReservedMutationOptions, D as VanillaMutation, E as VanillaAction, F as replaceUrlParam, M as RESERVED_KEYS, N as buildSearchParams, O as HttpClientOptions, P as executeHttpRequest, S as ReservedInfiniteQueryOptions, T as StaticQueryOptsParam, _ as IsPaginated, a as BaseInfiniteQueryOptsParam, b as PaginatedFnMeta, c as ConvexMutationKey, d as ConvexQueryMeta, f as EmptyObject, g as InfiniteQueryInput, h as FnMeta, i as BaseConvexQueryOptions, j as HttpProxyBaseOptions, k as HttpFormValue, l as ConvexQueryHookOptions, m as FUNC_REF_SYMBOL, n as BaseConvexActionOptions, o as ConvexActionKey, p as ExtractPaginatedItem, r as BaseConvexInfiniteQueryOptions, s as ConvexInfiniteQueryMeta, t as AuthType, u as ConvexQueryKey, v as Meta, w as ReservedQueryOptions, x as PaginationOpts, y as MutationVariables } from "../types-C7JkpfeY.js";
+import { A as HttpInputArgs, C as ReservedMutationOptions, D as VanillaMutation, E as VanillaAction, F as executeHttpRequest, I as replaceUrlParam, L as withAuthorizationRecheck, M as RECHECK_AUTHORIZATION, N as RESERVED_KEYS, O as HttpClientOptions, P as buildSearchParams, S as ReservedInfiniteQueryOptions, T as StaticQueryOptsParam, _ as IsPaginated, a as BaseInfiniteQueryOptsParam, b as PaginatedFnMeta, c as ConvexMutationKey, d as ConvexQueryMeta, f as EmptyObject, g as InfiniteQueryInput, h as FnMeta, i as BaseConvexQueryOptions, j as HttpProxyBaseOptions, k as HttpFormValue, l as ConvexQueryHookOptions, m as FUNC_REF_SYMBOL, n as BaseConvexActionOptions, o as ConvexActionKey, p as ExtractPaginatedItem, r as BaseConvexInfiniteQueryOptions, s as ConvexInfiniteQueryMeta, t as AuthType, u as ConvexQueryKey, v as Meta, w as ReservedQueryOptions, x as PaginationOpts, y as MutationVariables } from "../types-Bb0kwteA.js";
 import { FunctionArgs, FunctionReference } from "convex/server";
 
 //#region src/crpc/auth-error.d.ts
@@ -107,4 +107,4 @@ declare function convexAction<T extends FunctionReference<'action'>>(funcRef: T,
  */
 declare function convexInfiniteQueryOptions<T extends FunctionReference<'query'>>(funcRef: T, args: Record<string, unknown> | 'skip', opts?: BaseInfiniteQueryOptsParam<T> & Record<string, unknown>, meta?: Meta): BaseConvexInfiniteQueryOptions<T> & Record<string, unknown>;
 //#endregion
-export { AuthMutationError, AuthType, BaseConvexActionOptions, BaseConvexInfiniteQueryOptions, BaseConvexQueryOptions, BaseInfiniteQueryOptsParam, CRPCClientError, CombinedDataTransformer, ConvexActionKey, ConvexInfiniteQueryMeta, ConvexMutationKey, ConvexQueryHookOptions, ConvexQueryKey, ConvexQueryMeta, DATE_CODEC_TAG, DataTransformer, DataTransformerOptions, EmptyObject, ExtractPaginatedItem, FUNC_REF_SYMBOL, FnMeta, HTTP_DEFAULT_STALE_TIME, HttpClient, HttpClientError, HttpClientFromRouter, HttpClientOptions, HttpErrorCode, HttpFormValue, HttpInputArgs, HttpMutationKey, HttpProcedureCall, HttpProxyBaseOptions, HttpQueryKey, HttpQueryPrefixKey, HttpRouteInfo, HttpRouteMap, InferHttpInput, InferHttpOutput, InfiniteQueryInput, IsPaginated, Meta, MutationVariables, PaginatedFnMeta, PaginationOpts, RESERVED_KEYS, ReservedInfiniteQueryOptions, ReservedMutationOptions, ReservedQueryOptions, StaticQueryOptsParam, VanillaAction, VanillaMutation, WireCodec, buildHttpQueryKey, buildHttpQueryPrefixKey, buildSearchParams, convexAction, convexInfiniteQueryOptions, convexQuery, createTaggedTransformer, dateWireCodec, decodeWire, defaultCRPCTransformer, defaultIsUnauthorized, encodeWire, executeHttpRequest, getTransformer, identityTransformer, isAuthMutationError, isCRPCClientError, isCRPCError, isCRPCErrorCode, isHttpClientError, replaceUrlParam };
+export { AuthMutationError, AuthType, BaseConvexActionOptions, BaseConvexInfiniteQueryOptions, BaseConvexQueryOptions, BaseInfiniteQueryOptsParam, CRPCClientError, CombinedDataTransformer, ConvexActionKey, ConvexInfiniteQueryMeta, ConvexMutationKey, ConvexQueryHookOptions, ConvexQueryKey, ConvexQueryMeta, DATE_CODEC_TAG, DataTransformer, DataTransformerOptions, EmptyObject, ExtractPaginatedItem, FUNC_REF_SYMBOL, FnMeta, HTTP_DEFAULT_STALE_TIME, HttpClient, HttpClientError, HttpClientFromRouter, HttpClientOptions, HttpErrorCode, HttpFormValue, HttpInputArgs, HttpMutationKey, HttpProcedureCall, HttpProxyBaseOptions, HttpQueryKey, HttpQueryPrefixKey, HttpRouteInfo, HttpRouteMap, InferHttpInput, InferHttpOutput, InfiniteQueryInput, IsPaginated, Meta, MutationVariables, PaginatedFnMeta, PaginationOpts, RECHECK_AUTHORIZATION, RESERVED_KEYS, ReservedInfiniteQueryOptions, ReservedMutationOptions, ReservedQueryOptions, StaticQueryOptsParam, VanillaAction, VanillaMutation, WireCodec, buildHttpQueryKey, buildHttpQueryPrefixKey, buildSearchParams, convexAction, convexInfiniteQueryOptions, convexQuery, createTaggedTransformer, dateWireCodec, decodeWire, defaultCRPCTransformer, defaultIsUnauthorized, encodeWire, executeHttpRequest, getTransformer, identityTransformer, isAuthMutationError, isCRPCClientError, isCRPCError, isCRPCErrorCode, isHttpClientError, replaceUrlParam, withAuthorizationRecheck };

package/dist/crpc/index.js

@@ -1,6 +1,6 @@
 import { a as isCRPCErrorCode, i as isCRPCError, n as defaultIsUnauthorized, r as isCRPCClientError, t as CRPCClientError } from "../error-CLgc9khF.js";
 import { a as defaultCRPCTransformer, c as identityTransformer, i as decodeWire, n as createTaggedTransformer, o as encodeWire, r as dateWireCodec, s as getTransformer, t as DATE_CODEC_TAG } from "../transformer-C8lVwHNT.js";
-import { a as buildSearchParams, c as HTTP_DEFAULT_STALE_TIME, d as buildHttpQueryPrefixKey, f as isHttpClientError, i as RESERVED_KEYS, l as HttpClientError, n as convexInfiniteQueryOptions, o as executeHttpRequest, r as convexQuery, s as replaceUrlParam, t as convexAction, u as buildHttpQueryKey } from "../query-options-DGG93--5.js";
+import { a as RESERVED_KEYS, c as replaceUrlParam, d as HttpClientError, f as buildHttpQueryKey, i as RECHECK_AUTHORIZATION, l as withAuthorizationRecheck, m as isHttpClientError, n as convexInfiniteQueryOptions, o as buildSearchParams, p as buildHttpQueryPrefixKey, r as convexQuery, s as executeHttpRequest, t as convexAction, u as HTTP_DEFAULT_STALE_TIME } from "../query-options-YkFvau71.js";
 
 //#region src/crpc/auth-error.ts
 /**
@@ -40,4 +40,4 @@ function isAuthMutationError(error) {
 const FUNC_REF_SYMBOL = Symbol.for("convex.funcRef");
 
 //#endregion
-export { AuthMutationError, CRPCClientError, DATE_CODEC_TAG, FUNC_REF_SYMBOL, HTTP_DEFAULT_STALE_TIME, HttpClientError, RESERVED_KEYS, buildHttpQueryKey, buildHttpQueryPrefixKey, buildSearchParams, convexAction, convexInfiniteQueryOptions, convexQuery, createTaggedTransformer, dateWireCodec, decodeWire, defaultCRPCTransformer, defaultIsUnauthorized, encodeWire, executeHttpRequest, getTransformer, identityTransformer, isAuthMutationError, isCRPCClientError, isCRPCError, isCRPCErrorCode, isHttpClientError, replaceUrlParam };
+export { AuthMutationError, CRPCClientError, DATE_CODEC_TAG, FUNC_REF_SYMBOL, HTTP_DEFAULT_STALE_TIME, HttpClientError, RECHECK_AUTHORIZATION, RESERVED_KEYS, buildHttpQueryKey, buildHttpQueryPrefixKey, buildSearchParams, convexAction, convexInfiniteQueryOptions, convexQuery, createTaggedTransformer, dateWireCodec, decodeWire, defaultCRPCTransformer, defaultIsUnauthorized, encodeWire, executeHttpRequest, getTransformer, identityTransformer, isAuthMutationError, isCRPCClientError, isCRPCError, isCRPCErrorCode, isHttpClientError, replaceUrlParam, withAuthorizationRecheck };

package/dist/{generated-contract-disabled-PdNGvNYP.d.ts → generated-contract-disabled-QZXEzUnd.d.ts}

@@ -199,20 +199,20 @@ declare const createApi: <Schema extends SchemaDefinition<any, any>, DataModel e
   count: convex_server0.RegisteredQuery<"internal", {
     where?: {
       mode?: "sensitive" | "insensitive" | undefined;
+      operator?: "eq" | "ne" | "lt" | "lte" | "gt" | "gte" | "in" | "not_in" | "contains" | "starts_with" | "ends_with" | undefined;
       connector?: "AND" | "OR" | undefined;
-      operator?: "lt" | "lte" | "gt" | "gte" | "eq" | "in" | "not_in" | "ne" | "contains" | "starts_with" | "ends_with" | undefined;
-      field: string;
       value: string | number | boolean | string[] | number[] | null;
+      field: string;
     }[] | undefined;
     model: string;
   }, Promise<number | null>>;
   consumeOne: convex_server0.RegisteredMutation<"internal", {
     input: {
       where?: {
+        operator?: "eq" | "ne" | "lt" | "lte" | "gt" | "gte" | "in" | "not_in" | "contains" | "starts_with" | "ends_with" | undefined;
         connector?: "AND" | "OR" | undefined;
-        operator?: "lt" | "lte" | "gt" | "gte" | "eq" | "in" | "not_in" | "ne" | "contains" | "starts_with" | "ends_with" | undefined;
-        field: string;
         value: string | number | boolean | string[] | number[] | null;
+        field: string;
       }[] | undefined;
       model: string;
     } | {
@@ -237,10 +237,10 @@ declare const createApi: <Schema extends SchemaDefinition<any, any>, DataModel e
   deleteMany: convex_server0.RegisteredMutation<"internal", {
     input: {
       where?: {
+        operator?: "eq" | "ne" | "lt" | "lte" | "gt" | "gte" | "in" | "not_in" | "contains" | "starts_with" | "ends_with" | undefined;
         connector?: "AND" | "OR" | undefined;
-        operator?: "lt" | "lte" | "gt" | "gte" | "eq" | "in" | "not_in" | "ne" | "contains" | "starts_with" | "ends_with" | undefined;
-        field: string;
         value: string | number | boolean | string[] | number[] | null;
+        field: string;
       }[] | undefined;
       model: string;
     } | {
@@ -266,10 +266,10 @@ declare const createApi: <Schema extends SchemaDefinition<any, any>, DataModel e
   deleteOne: convex_server0.RegisteredMutation<"internal", {
     input: {
       where?: {
+        operator?: "eq" | "ne" | "lt" | "lte" | "gt" | "gte" | "in" | "not_in" | "contains" | "starts_with" | "ends_with" | undefined;
         connector?: "AND" | "OR" | undefined;
-        operator?: "lt" | "lte" | "gt" | "gte" | "eq" | "in" | "not_in" | "ne" | "contains" | "starts_with" | "ends_with" | undefined;
-        field: string;
         value: string | number | boolean | string[] | number[] | null;
+        field: string;
       }[] | undefined;
       model: string;
     } | {
@@ -278,21 +278,20 @@ declare const createApi: <Schema extends SchemaDefinition<any, any>, DataModel e
     };
   }, Promise<Record<string, unknown> | undefined>>;
   findMany: convex_server0.RegisteredQuery<"internal", {
+    limit?: number | undefined;
     join?: any;
     where?: {
       mode?: "sensitive" | "insensitive" | undefined;
+      operator?: "eq" | "ne" | "lt" | "lte" | "gt" | "gte" | "in" | "not_in" | "contains" | "starts_with" | "ends_with" | undefined;
       connector?: "AND" | "OR" | undefined;
-      operator?: "lt" | "lte" | "gt" | "gte" | "eq" | "in" | "not_in" | "ne" | "contains" | "starts_with" | "ends_with" | undefined;
-      field: string;
       value: string | number | boolean | string[] | number[] | null;
+      field: string;
     }[] | undefined;
-    limit?: number | undefined;
     offset?: number | undefined;
     sortBy?: {
-      field: string;
       direction: "asc" | "desc";
+      field: string;
     } | undefined;
-    model: string;
     paginationOpts: {
       id?: number;
       endCursor?: string | null;
@@ -301,15 +300,16 @@ declare const createApi: <Schema extends SchemaDefinition<any, any>, DataModel e
       numItems: number;
       cursor: string | null;
     };
+    model: string;
   }, Promise<PaginationResult<convex_server0.GenericDocument>>>;
   findOne: convex_server0.RegisteredQuery<"internal", {
     join?: any;
     where?: {
       mode?: "sensitive" | "insensitive" | undefined;
+      operator?: "eq" | "ne" | "lt" | "lte" | "gt" | "gte" | "in" | "not_in" | "contains" | "starts_with" | "ends_with" | undefined;
       connector?: "AND" | "OR" | undefined;
-      operator?: "lt" | "lte" | "gt" | "gte" | "eq" | "in" | "not_in" | "ne" | "contains" | "starts_with" | "ends_with" | undefined;
-      field: string;
       value: string | number | boolean | string[] | number[] | null;
+      field: string;
     }[] | undefined;
     select?: string[] | undefined;
     model: string;
@@ -317,14 +317,14 @@ declare const createApi: <Schema extends SchemaDefinition<any, any>, DataModel e
   getLatestJwks: convex_server0.RegisteredAction<"internal", {}, Promise<unknown>>;
   incrementOne: convex_server0.RegisteredMutation<"internal", {
     input: {
+      set?: Record<string, any> | undefined;
       where?: {
         mode?: "sensitive" | "insensitive" | undefined;
+        operator?: "eq" | "ne" | "lt" | "lte" | "gt" | "gte" | "in" | "not_in" | "contains" | "starts_with" | "ends_with" | undefined;
         connector?: "AND" | "OR" | undefined;
-        operator?: "lt" | "lte" | "gt" | "gte" | "eq" | "in" | "not_in" | "ne" | "contains" | "starts_with" | "ends_with" | undefined;
-        field: string;
         value: string | number | boolean | string[] | number[] | null;
+        field: string;
       }[] | undefined;
-      set?: Record<string, any> | undefined;
       model: string;
       increment: Record<string, number>;
     };
@@ -333,21 +333,21 @@ declare const createApi: <Schema extends SchemaDefinition<any, any>, DataModel e
   updateMany: convex_server0.RegisteredMutation<"internal", {
     input: {
       where?: {
+        operator?: "eq" | "ne" | "lt" | "lte" | "gt" | "gte" | "in" | "not_in" | "contains" | "starts_with" | "ends_with" | undefined;
         connector?: "AND" | "OR" | undefined;
-        operator?: "lt" | "lte" | "gt" | "gte" | "eq" | "in" | "not_in" | "ne" | "contains" | "starts_with" | "ends_with" | undefined;
-        field: string;
         value: string | number | boolean | string[] | number[] | null;
+        field: string;
       }[] | undefined;
-      model: string;
       update: {
         [x: string]: unknown;
         [x: number]: unknown;
         [x: symbol]: unknown;
       };
+      model: string;
     } | {
       where?: any[] | undefined;
-      model: string;
       update: any;
+      model: string;
     };
     paginationOpts: {
       id?: number;
@@ -368,21 +368,21 @@ declare const createApi: <Schema extends SchemaDefinition<any, any>, DataModel e
   updateOne: convex_server0.RegisteredMutation<"internal", {
     input: {
       where?: {
+        operator?: "eq" | "ne" | "lt" | "lte" | "gt" | "gte" | "in" | "not_in" | "contains" | "starts_with" | "ends_with" | undefined;
         connector?: "AND" | "OR" | undefined;
-        operator?: "lt" | "lte" | "gt" | "gte" | "eq" | "in" | "not_in" | "ne" | "contains" | "starts_with" | "ends_with" | undefined;
-        field: string;
         value: string | number | boolean | string[] | number[] | null;
+        field: string;
       }[] | undefined;
-      model: string;
       update: {
         [x: string]: unknown;
         [x: number]: unknown;
         [x: symbol]: unknown;
       };
+      model: string;
     } | {
       where?: any[] | undefined;
-      model: string;
       update: any;
+      model: string;
     };
   }, Promise<any>>;
 };

package/dist/orm/index.d.ts

@@ -1,5 +1,5 @@
 import { $n as TableName, $t as OrmLifecycleChange, An as ConvexCheckBuilder, At as UpdateSet, Bn as ConvexTextBuilder, Br as IsPrimaryKey, Bt as RelationsBuilderColumnBase, C as MigrationStep, Cn as ConvexVectorIndexConfig, Cr as not, Ct as OrderByClause, D as defineMigration, Dn as searchIndex, Dr as startsWith, Dt as ReturningAll, E as buildMigrationPlan, En as rankIndex, Er as or, Et as PredicateWhereIndexConfig, Fn as ConvexUniqueConstraintBuilderOn, Fr as ColumnBuilderTypeConfig, Ft as ExtractTablesFromSchema, Gn as Columns, Gt as TablesRelationalConfig, H as RlsMode, Hn as text, Hr as NotNull, In as ConvexUniqueConstraintConfig, Ir as ColumnBuilderWithTableName, It as ExtractTablesWithRelations, Jn as OrmSchemaExtensionTables, Jt as ConvexDeletionBuilder, Kt as defineRelations, Ln as check, Lr as ColumnDataType, Lt as ManyConfig, M as DatabaseWithQuery, Mn as ConvexForeignKeyBuilder, Mr as ColumnBuilder, Mt as VectorSearchProvider, N as OrmReader$1, Nn as ConvexForeignKeyConfig, Nr as ColumnBuilderBaseConfig, Nt as unsetToken, O as defineMigrationSet, On as uniqueIndex, Ot as ReturningResult, P as OrmWriter$1, Pn as ConvexUniqueConstraintBuilder, Pr as ColumnBuilderRuntimeConfig, Qn as OrmSchemaTriggers, Qt as DiscriminatorBuilderConfig, Rn as foreignKey, Rr as DrizzleEntity, Rt as OneConfig, S as MigrationStateMap, Sn as ConvexVectorIndexBuilderOn, Sr as ne, St as MutationRunMode, T as MigrationWriteMode, Tn as index, Tr as notInArray, Tt as PaginatedResult, U as EdgeMetadata, V as RlsContext, Vn as ConvexTextBuilderInitial, Vr as IsUnique, Vt as RelationsBuilderColumnConfig, W as extractRelationsConfig, Wn as Brand, Wt as TableRelationalConfig, Xn as OrmSchemaExtensions, Xt as ConvexTable, Yt as ConvexDeletionConfig, Zn as OrmSchemaRelations, Zt as ConvexTableWithColumns, _ as MigrationManifestEntry, _n as ConvexRankIndexBuilderOn, _r as isNotNull, _t as MutationExecutionMode, an as RlsPolicy, ar as UnaryExpression, at as BuildRelationResult, b as MigrationRunStatus, bn as ConvexSearchIndexConfig, br as lt, bt as MutationResult, cn as rlsPolicy, cr as contains, ct as DBQueryConfig, d as MigrationAppliedState, dn as rlsRole, dr as fieldRef, dt as InferInsertModel, en as OrmLifecycleOperation, er as BinaryExpression, f as MigrationDefinition, fn as ConvexAggregateIndexBuilder, fr as gt, ft as InferModelFromColumns, g as MigrationDriftIssue, gn as ConvexRankIndexBuilder, gr as isFieldReference, gt as MutationExecuteResult, h as MigrationDocContext, hn as ConvexIndexBuilderOn, hr as inArray, ht as MutationExecuteConfig, i as OrmMigrationCapability, in as discriminator, ir as LogicalExpression, it as BuildQueryResult, j as DatabaseWithMutations, jn as ConvexCheckConfig, jr as AnyColumn, jt as VectorQueryConfig, k as detectMigrationDrift, kn as vectorIndex, kr as SystemFields, kt as ReturningSelection, ln as RlsRole, lr as endsWith, lt as FilterOperators, m as MigrationDoc, mn as ConvexIndexBuilder, mr as ilike, mt as InsertValue, n as OrmCapabilities, nn as convexTable, nr as FieldReference, nt as AggregateFieldValue, on as RlsPolicyConfig, or as and, ot as CountConfig, p as MigrationDirection, pn as ConvexAggregateIndexBuilderOn, pr as gte, pt as InferSelectModel, qt as defineRelationsPart, r as OrmCapability, rn as deletion, rr as FilterExpression, rt as AggregateResult, sn as RlsPolicyToOption, sr as between, st as CountResult, t as OrmAggregateCapability, tn as TableConfig, tr as ExpressionVisitor, tt as AggregateConfig, un as RlsRoleConfig, ur as eq, ut as GetColumnData, v as MigrationMigrateOne, vn as ConvexSearchIndexBuilder, vr as isNull, vt as MutationPaginateConfig, w as MigrationTableName, wn as aggregateIndex, wr as notBetween, wt as OrderDirection, x as MigrationSet, xn as ConvexVectorIndexBuilder, xr as lte, xt as MutationReturning, y as MigrationPlan, yn as ConvexSearchIndexBuilderOn, yr as like, yt as MutationPaginatedResult, zn as unique, zr as HasDefault, zt as RelationsBuilder } from "../capabilities-Bxzoofl4.js";
-import { $ as OrmClientWithApi$1, A as ConvexDateMode, B as ConvexBytesBuilderInitial, C as ConvexNumberBuilderInitial, D as id, E as ConvexIdBuilderInitial, F as custom, G as ConvexBigIntBuilder, H as ConvexBooleanBuilder, I as json, J as CreateOrmOptions, K as ConvexBigIntBuilderInitial, L as objectOf, M as ConvexCustomBuilder, N as ConvexCustomBuilderInitial, O as ConvexDateBuilder, P as arrayOf, Q as OrmClientBase$1, R as unionOf, S as ConvexNumberBuilder, St as defineTriggers, T as ConvexIdBuilder, U as ConvexBooleanBuilderInitial, V as bytes, W as boolean, X as GenericOrmCtx$1, Y as GenericOrm$1, Z as OrmApiResult, _ as ConvexTimestampMode, _t as OrmBeforeResult, a as requireSchemaRelations, at as ScheduledMutationBatchArgs, b as ConvexTextEnumBuilderInitial, bt as OrmTriggerContext, c as TableConfigResult, ct as scheduledDeleteFactory, d as OrmNotFoundError, et as OrmFunctions, f as ConvexVectorBuilder, g as ConvexTimestampBuilderInitial, gt as defineSchemaExtension, h as ConvexTimestampBuilder, ht as SchemaExtension, i as getSchemaTriggers, it as createOrm, j as date, k as ConvexDateBuilderInitial, l as getTableColumns, m as vector, n as defineSchema, nt as OrmWriterCtx, o as asc, ot as scheduledMutationBatchFactory, p as ConvexVectorBuilderInitial, q as bigint, r as getSchemaRelations, rt as ResolveOrmSchema, s as desc, st as ScheduledDeleteArgs, t as WhereClauseResult, tt as OrmReaderCtx, u as getTableConfig, v as timestamp, vt as OrmTableTriggers, w as integer, x as textEnum, xt as OrmTriggers, y as ConvexTextEnumBuilder, yt as OrmTriggerChange, z as ConvexBytesBuilder } from "../where-clause-compiler-qH6-NCM9.js";
+import { $ as OrmClientWithApi$1, A as ConvexDateMode, B as ConvexBytesBuilderInitial, C as ConvexNumberBuilderInitial, D as id, E as ConvexIdBuilderInitial, F as custom, G as ConvexBigIntBuilder, H as ConvexBooleanBuilder, I as json, J as CreateOrmOptions, K as ConvexBigIntBuilderInitial, L as objectOf, M as ConvexCustomBuilder, N as ConvexCustomBuilderInitial, O as ConvexDateBuilder, P as arrayOf, Q as OrmClientBase$1, R as unionOf, S as ConvexNumberBuilder, St as defineTriggers, T as ConvexIdBuilder, U as ConvexBooleanBuilderInitial, V as bytes, W as boolean, X as GenericOrmCtx$1, Y as GenericOrm$1, Z as OrmApiResult, _ as ConvexTimestampMode, _t as OrmBeforeResult, a as requireSchemaRelations, at as ScheduledMutationBatchArgs, b as ConvexTextEnumBuilderInitial, bt as OrmTriggerContext, c as TableConfigResult, ct as scheduledDeleteFactory, d as OrmNotFoundError, et as OrmFunctions, f as ConvexVectorBuilder, g as ConvexTimestampBuilderInitial, gt as defineSchemaExtension, h as ConvexTimestampBuilder, ht as SchemaExtension, i as getSchemaTriggers, it as createOrm, j as date, k as ConvexDateBuilderInitial, l as getTableColumns, m as vector, n as defineSchema, nt as OrmWriterCtx, o as asc, ot as scheduledMutationBatchFactory, p as ConvexVectorBuilderInitial, q as bigint, r as getSchemaRelations, rt as ResolveOrmSchema, s as desc, st as ScheduledDeleteArgs, t as WhereClauseResult, tt as OrmReaderCtx, u as getTableConfig, v as timestamp, vt as OrmTableTriggers, w as integer, x as textEnum, xt as OrmTriggers, y as ConvexTextEnumBuilder, yt as OrmTriggerChange, z as ConvexBytesBuilder } from "../where-clause-compiler-DAqhUREe.js";
 import { i as pretendRequired, n as deprecated, r as pretend } from "../validators-0I-Ik1EN.js";
 import { a as QueryCtxWithPreferredOrmQueryTable, i as QueryCtxWithOrmQueryTable, n as LookupByIdResultByCtx, o as getByIdWithOrmQueryFallback, r as QueryCtxWithOptionalOrmQueryTable, t as DocByCtx } from "../query-context-BkNjkDCk.js";
 import { DefineSchemaOptions, GenericDatabaseReader, GenericDatabaseWriter, GenericSchema, SchemaDefinition } from "convex/server";

package/dist/orm/migrations/index.d.ts

@@ -1,3 +1,3 @@
 import { C as MigrationStep, D as defineMigration, E as buildMigrationPlan, O as defineMigrationSet, S as MigrationStateMap, T as MigrationWriteMode, _ as MigrationManifestEntry, a as MAX_STATUS_RUN_LIMIT, b as MigrationRunStatus, c as MigrationRunChunkArgs, d as MigrationAppliedState, f as MigrationDefinition, g as MigrationDriftIssue, h as MigrationDocContext, k as detectMigrationDrift, l as MigrationStatusArgs, m as MigrationDoc, o as MigrationCancelArgs, p as MigrationDirection, s as MigrationRunArgs, u as createMigrationHandlers, v as MigrationMigrateOne, w as MigrationTableName, x as MigrationSet, y as MigrationPlan } from "../../capabilities-Bxzoofl4.js";
-import { Ct as migrationCapability, dt as MIGRATION_STORAGE_TABLE_NAMES, ft as injectMigrationStorageTables, lt as MIGRATION_RUN_TABLE, mt as migrationStorageTables, pt as migrationExtension, ut as MIGRATION_STATE_TABLE } from "../../where-clause-compiler-qH6-NCM9.js";
+import { Ct as migrationCapability, dt as MIGRATION_STORAGE_TABLE_NAMES, ft as injectMigrationStorageTables, lt as MIGRATION_RUN_TABLE, mt as migrationStorageTables, pt as migrationExtension, ut as MIGRATION_STATE_TABLE } from "../../where-clause-compiler-DAqhUREe.js";
 export { MAX_STATUS_RUN_LIMIT, MIGRATION_RUN_TABLE, MIGRATION_STATE_TABLE, MIGRATION_STORAGE_TABLE_NAMES, type MigrationAppliedState, type MigrationCancelArgs, type MigrationDefinition, type MigrationDirection, type MigrationDoc, type MigrationDocContext, type MigrationDriftIssue, type MigrationManifestEntry, type MigrationMigrateOne, type MigrationPlan, type MigrationRunArgs, type MigrationRunChunkArgs, type MigrationRunStatus, type MigrationSet, type MigrationStateMap, type MigrationStatusArgs, type MigrationStep, type MigrationTableName, type MigrationWriteMode, buildMigrationPlan, createMigrationHandlers, defineMigration, defineMigrationSet, detectMigrationDrift, injectMigrationStorageTables, migrationCapability, migrationExtension, migrationStorageTables };

package/dist/{query-options-DGG93--5.js → query-options-YkFvau71.js}

@@ -86,6 +86,8 @@ function buildSearchParams(query) {
 	else if (value !== void 0 && value !== null) params.append(key, value);
 	return params;
 }
+const RECHECK_AUTHORIZATION = Symbol.for("kitcn.http.recheckAuthorization");
+const withAuthorizationRecheck = (headers, recheck) => Object.defineProperty(headers, RECHECK_AUTHORIZATION, { value: recheck });
 /**
 * Hono-style HTTP request executor.
 * Processes args in the same way as Hono's ClientRequestImpl.fetch().
@@ -124,6 +126,8 @@ async function executeHttpRequest(opts) {
 		for (const [key, value] of Object.entries(resolvedBaseHeaders)) if (value !== void 0) finalHeaders[key] = value;
 	}
 	Object.assign(finalHeaders, headerValues);
+	const recheck = resolvedBaseHeaders?.[RECHECK_AUTHORIZATION];
+	const sendHeaders = recheck && finalHeaders.Authorization === resolvedBaseHeaders?.Authorization && !recheck() ? Object.fromEntries(Object.entries(finalHeaders).filter(([key]) => key !== "Authorization")) : finalHeaders;
 	let url = opts.convexSiteUrl + path;
 	if (args.params) url = opts.convexSiteUrl + replaceUrlParam(path, args.params);
 	if (args.searchParams) {
@@ -135,7 +139,7 @@ async function executeHttpRequest(opts) {
 	const response = await (mergedClientOpts.fetch ?? opts.baseFetch ?? globalThis.fetch)(url, {
 		body: setBody ? rBody : void 0,
 		method: methodUpperCase,
-		headers: finalHeaders,
+		headers: sendHeaders,
 		...mergedClientOpts.init
 	});
 	if (!response.ok) {
@@ -276,4 +280,4 @@ function convexInfiniteQueryOptions(funcRef, args, opts = {}, meta) {
 }
 
 //#endregion
-export { buildSearchParams as a, HTTP_DEFAULT_STALE_TIME as c, buildHttpQueryPrefixKey as d, isHttpClientError as f, RESERVED_KEYS as i, HttpClientError as l, convexInfiniteQueryOptions as n, executeHttpRequest as o, convexQuery as r, replaceUrlParam as s, convexAction as t, buildHttpQueryKey as u };
+export { RESERVED_KEYS as a, replaceUrlParam as c, HttpClientError as d, buildHttpQueryKey as f, RECHECK_AUTHORIZATION as i, withAuthorizationRecheck as l, isHttpClientError as m, convexInfiniteQueryOptions as n, buildSearchParams as o, buildHttpQueryPrefixKey as p, convexQuery as r, executeHttpRequest as s, convexAction as t, HTTP_DEFAULT_STALE_TIME as u };

package/dist/react/index.d.ts

@@ -5,7 +5,8 @@ import { ReactNode } from "react";
 import * as react_jsx_runtime0 from "react/jsx-runtime";
 import { FunctionArgs, FunctionReference, FunctionReturnType } from "convex/server";
 import { DefaultError, QueryCache, QueryClient, QueryFilters, QueryFunction, QueryFunctionContext, QueryKey, SkipToken, UseMutationOptions, UseQueryOptions, UseQueryResult } from "@tanstack/react-query";
-import { ConvexHttpClient } from "convex/browser";
+import { Value } from "convex/values";
+import { ConvexHttpClient, OptimisticUpdate } from "convex/browser";
 import { z } from "zod";
 
 //#region src/crpc/auth-error.d.ts
@@ -582,11 +583,19 @@ type DecorateInfiniteQuery<T extends FunctionReference<'query'>> = {
   infiniteQueryKey: (args?: DeepPartial<InfiniteQueryInput<FunctionArgs<T>>>) => ConvexQueryKey<T>; /** Function metadata from server (auth, limit, rateLimit, role, type) */
   meta: PaginatedFnMeta;
 };
+/**
+ * Convex-native optimistic update for a cRPC mutation. It edits Convex's local
+ * query store, which the query client reads, so Convex rolls it back when the
+ * mutation fails. Args and query values are in their wire shape.
+ */
+type ConvexOptimisticUpdateOption<Args extends Record<string, Value>> = {
+  optimisticUpdate?: OptimisticUpdate<Args>;
+};
 /**
  * Decorated mutation procedure with mutationOptions and mutationKey methods.
  */
 type DecorateMutation<T extends FunctionReference<'mutation'>> = {
-  mutationOptions: (opts?: DistributiveOmit<UseMutationOptions<FunctionReturnType<T>, DefaultError, MutationVariables<T>>, ReservedMutationOptions$2>) => UseMutationOptions<FunctionReturnType<T>, DefaultError, MutationVariables<T>>; /** Get mutation key for QueryClient methods */
+  mutationOptions: (opts?: DistributiveOmit<UseMutationOptions<FunctionReturnType<T>, DefaultError, MutationVariables<T>>, ReservedMutationOptions$2> & ConvexOptimisticUpdateOption<FunctionArgs<T>>) => UseMutationOptions<FunctionReturnType<T>, DefaultError, MutationVariables<T>>; /** Get mutation key for QueryClient methods */
   mutationKey: () => ConvexMutationKey;
 };
 /**
@@ -1087,7 +1096,7 @@ declare function useConvexActionQueryOptions<Action extends FunctionReference<'a
  * }));
  * ```
  */
-declare function useConvexMutationOptions<Mutation extends FunctionReference<'mutation'>>(mutation: Mutation, options?: DistributiveOmit<UseMutationOptions<FunctionReturnType<Mutation>, DefaultError, FunctionArgs<Mutation>>, ReservedMutationOptions>, transformer?: DataTransformerOptions): UseMutationOptions<FunctionReturnType<Mutation>, DefaultError, FunctionArgs<Mutation>>;
+declare function useConvexMutationOptions<Mutation extends FunctionReference<'mutation'>>(mutation: Mutation, options?: DistributiveOmit<UseMutationOptions<FunctionReturnType<Mutation>, DefaultError, FunctionArgs<Mutation>>, ReservedMutationOptions> & ConvexOptimisticUpdateOption<FunctionArgs<Mutation>>, transformer?: DataTransformerOptions): UseMutationOptions<FunctionReturnType<Mutation>, DefaultError, FunctionArgs<Mutation>>;
 /**
  * Hook that returns action options for use with useMutation.
  * Wraps the Convex action with auth guard logic.