@samebase/identity-broker 0.0.0-stage → 0.2.0

package/dist/component/schema.d.ts

@@ -0,0 +1,749 @@
+/** How a client authenticates at the token endpoint. Public clients are not supported yet. */
+export declare const vTokenEndpointAuthMethod: import("convex/values").VUnion<"client_secret_basic" | "client_secret_post", [import("convex/values").VLiteral<"client_secret_post", "required">, import("convex/values").VLiteral<"client_secret_basic", "required">], "required", never>;
+/** The deployment a client stands for. Preview clients are pruned; the others are deleted by hand. */
+export declare const vDeploymentType: import("convex/values").VUnion<"development" | "preview" | "production", [import("convex/values").VLiteral<"production", "required">, import("convex/values").VLiteral<"development", "required">, import("convex/values").VLiteral<"preview", "required">], "required", never>;
+/**
+ * What a connector attested about the user. `upstreamId` is the connector's own stable id for the
+ * account (the GitHub user id, the OIDC `sub`, the canonical email address). The pairwise subject
+ * is derived from it on the host, where the salt lives.
+ */
+export declare const vUpstreamIdentity: import("convex/values").VObject<{
+    connector: string;
+    email?: string;
+    emailVerified?: boolean;
+    name?: string;
+    picture?: string;
+    upstreamId: string;
+}, {
+    connector: import("convex/values").VString<string, "required">;
+    upstreamId: import("convex/values").VString<string, "required">;
+    email: import("convex/values").VString<string | undefined, "optional">;
+    emailVerified: import("convex/values").VBoolean<boolean | undefined, "optional">;
+    name: import("convex/values").VString<string | undefined, "optional">;
+    picture: import("convex/values").VString<string | undefined, "optional">;
+}, "required", "connector" | "email" | "emailVerified" | "name" | "picture" | "upstreamId">;
+export declare const vAuthRequest: import("convex/values").VUnion<{
+    appId: string;
+    clientId: string;
+    codeChallenge: string;
+    createdAt: number;
+    expiresAt: number;
+    freshLogin: boolean;
+    nonce?: string;
+    redirectUri: string;
+    requestId: string;
+    scope: string;
+    state?: string;
+    status: "pending";
+    txnCookieHash?: string;
+} | {
+    appId: string;
+    clientId: string;
+    codeChallenge: string;
+    connector: string;
+    createdAt: number;
+    expiresAt: number;
+    freshLogin: boolean;
+    nonce?: string;
+    redirectUri: string;
+    requestId: string;
+    scope: string;
+    state?: string;
+    status: "upstream";
+    txnCookieHash?: string;
+    upstreamCodeVerifier: string;
+    upstreamNonce?: string;
+    upstreamStateHash: string;
+} | {
+    appId: string;
+    clientId: string;
+    codeChallenge: string;
+    connector: string;
+    createdAt: number;
+    expiresAt: number;
+    freshLogin: boolean;
+    nonce?: string;
+    redirectUri: string;
+    requestId: string;
+    scope: string;
+    state?: string;
+    status: "claimed";
+    txnCookieHash?: string;
+} | {
+    appId: string;
+    clientId: string;
+    codeChallenge: string;
+    connector: string;
+    createdAt: number;
+    email: string;
+    emailAttempts: number;
+    emailCodeExpiresAt: number;
+    emailCodeHash: string;
+    emailLastSentAt: number;
+    emailSends: number;
+    expiresAt: number;
+    freshLogin: boolean;
+    nonce?: string;
+    redirectUri: string;
+    requestId: string;
+    scope: string;
+    state?: string;
+    status: "emailSent";
+    txnCookieHash?: string;
+} | {
+    appId: string;
+    authTime: number;
+    clientId: string;
+    codeChallenge: string;
+    createdAt: number;
+    expiresAt: number;
+    freshLogin: boolean;
+    identity: {
+        connector: string;
+        email?: string;
+        emailVerified?: boolean;
+        name?: string;
+        picture?: string;
+        upstreamId: string;
+    };
+    nonce?: string;
+    redirectUri: string;
+    requestId: string;
+    scope: string;
+    state?: string;
+    status: "completed";
+    txnCookieHash?: string;
+}, [import("convex/values").VObject<{
+    appId: string;
+    clientId: string;
+    codeChallenge: string;
+    createdAt: number;
+    expiresAt: number;
+    freshLogin: boolean;
+    nonce?: string;
+    redirectUri: string;
+    requestId: string;
+    scope: string;
+    state?: string;
+    status: "pending";
+    txnCookieHash?: string;
+}, {
+    requestId: import("convex/values").VString<string, "required">;
+    appId: import("convex/values").VString<string, "required">;
+    clientId: import("convex/values").VString<string, "required">;
+    redirectUri: import("convex/values").VString<string, "required">;
+    scope: import("convex/values").VString<string, "required">;
+    state: import("convex/values").VString<string | undefined, "optional">;
+    nonce: import("convex/values").VString<string | undefined, "optional">;
+    codeChallenge: import("convex/values").VString<string, "required">;
+    /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
+    freshLogin: import("convex/values").VBoolean<boolean, "required">;
+    /**
+     * SHA-256 hex of the `broker_txn` cookie set with the chooser page: `/continue` needs the cookie,
+     * so only the browser that saw the chooser can continue. Absent when /authorize skipped the chooser.
+     */
+    txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
+    createdAt: import("convex/values").VFloat64<number, "required">;
+    expiresAt: import("convex/values").VFloat64<number, "required">;
+    status: import("convex/values").VLiteral<"pending", "required">;
+}, "required", "appId" | "clientId" | "codeChallenge" | "createdAt" | "expiresAt" | "freshLogin" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash">, import("convex/values").VObject<{
+    appId: string;
+    clientId: string;
+    codeChallenge: string;
+    connector: string;
+    createdAt: number;
+    expiresAt: number;
+    freshLogin: boolean;
+    nonce?: string;
+    redirectUri: string;
+    requestId: string;
+    scope: string;
+    state?: string;
+    status: "upstream";
+    txnCookieHash?: string;
+    upstreamCodeVerifier: string;
+    upstreamNonce?: string;
+    upstreamStateHash: string;
+}, {
+    requestId: import("convex/values").VString<string, "required">;
+    appId: import("convex/values").VString<string, "required">;
+    clientId: import("convex/values").VString<string, "required">;
+    redirectUri: import("convex/values").VString<string, "required">;
+    scope: import("convex/values").VString<string, "required">;
+    state: import("convex/values").VString<string | undefined, "optional">;
+    nonce: import("convex/values").VString<string | undefined, "optional">;
+    codeChallenge: import("convex/values").VString<string, "required">;
+    /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
+    freshLogin: import("convex/values").VBoolean<boolean, "required">;
+    /**
+     * SHA-256 hex of the `broker_txn` cookie set with the chooser page: `/continue` needs the cookie,
+     * so only the browser that saw the chooser can continue. Absent when /authorize skipped the chooser.
+     */
+    txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
+    createdAt: import("convex/values").VFloat64<number, "required">;
+    expiresAt: import("convex/values").VFloat64<number, "required">;
+    status: import("convex/values").VLiteral<"upstream", "required">;
+    connector: import("convex/values").VString<string, "required">;
+    upstreamStateHash: import("convex/values").VString<string, "required">;
+    upstreamCodeVerifier: import("convex/values").VString<string, "required">;
+    upstreamNonce: import("convex/values").VString<string | undefined, "optional">;
+}, "required", "appId" | "clientId" | "codeChallenge" | "connector" | "createdAt" | "expiresAt" | "freshLogin" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash" | "upstreamCodeVerifier" | "upstreamNonce" | "upstreamStateHash">, import("convex/values").VObject<{
+    appId: string;
+    clientId: string;
+    codeChallenge: string;
+    connector: string;
+    createdAt: number;
+    expiresAt: number;
+    freshLogin: boolean;
+    nonce?: string;
+    redirectUri: string;
+    requestId: string;
+    scope: string;
+    state?: string;
+    status: "claimed";
+    txnCookieHash?: string;
+}, {
+    requestId: import("convex/values").VString<string, "required">;
+    appId: import("convex/values").VString<string, "required">;
+    clientId: import("convex/values").VString<string, "required">;
+    redirectUri: import("convex/values").VString<string, "required">;
+    scope: import("convex/values").VString<string, "required">;
+    state: import("convex/values").VString<string | undefined, "optional">;
+    nonce: import("convex/values").VString<string | undefined, "optional">;
+    codeChallenge: import("convex/values").VString<string, "required">;
+    /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
+    freshLogin: import("convex/values").VBoolean<boolean, "required">;
+    /**
+     * SHA-256 hex of the `broker_txn` cookie set with the chooser page: `/continue` needs the cookie,
+     * so only the browser that saw the chooser can continue. Absent when /authorize skipped the chooser.
+     */
+    txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
+    createdAt: import("convex/values").VFloat64<number, "required">;
+    expiresAt: import("convex/values").VFloat64<number, "required">;
+    status: import("convex/values").VLiteral<"claimed", "required">;
+    connector: import("convex/values").VString<string, "required">;
+}, "required", "appId" | "clientId" | "codeChallenge" | "connector" | "createdAt" | "expiresAt" | "freshLogin" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash">, import("convex/values").VObject<{
+    appId: string;
+    clientId: string;
+    codeChallenge: string;
+    connector: string;
+    createdAt: number;
+    email: string;
+    emailAttempts: number;
+    emailCodeExpiresAt: number;
+    emailCodeHash: string;
+    emailLastSentAt: number;
+    emailSends: number;
+    expiresAt: number;
+    freshLogin: boolean;
+    nonce?: string;
+    redirectUri: string;
+    requestId: string;
+    scope: string;
+    state?: string;
+    status: "emailSent";
+    txnCookieHash?: string;
+}, {
+    requestId: import("convex/values").VString<string, "required">;
+    appId: import("convex/values").VString<string, "required">;
+    clientId: import("convex/values").VString<string, "required">;
+    redirectUri: import("convex/values").VString<string, "required">;
+    scope: import("convex/values").VString<string, "required">;
+    state: import("convex/values").VString<string | undefined, "optional">;
+    nonce: import("convex/values").VString<string | undefined, "optional">;
+    codeChallenge: import("convex/values").VString<string, "required">;
+    /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
+    freshLogin: import("convex/values").VBoolean<boolean, "required">;
+    /**
+     * SHA-256 hex of the `broker_txn` cookie set with the chooser page: `/continue` needs the cookie,
+     * so only the browser that saw the chooser can continue. Absent when /authorize skipped the chooser.
+     */
+    txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
+    createdAt: import("convex/values").VFloat64<number, "required">;
+    expiresAt: import("convex/values").VFloat64<number, "required">;
+    status: import("convex/values").VLiteral<"emailSent", "required">;
+    connector: import("convex/values").VString<string, "required">;
+    email: import("convex/values").VString<string, "required">;
+    emailCodeHash: import("convex/values").VString<string, "required">;
+    emailCodeExpiresAt: import("convex/values").VFloat64<number, "required">;
+    /** Wrong codes typed, across every code sent for this request. */
+    emailAttempts: import("convex/values").VFloat64<number, "required">;
+    /** Codes sent for this request. */
+    emailSends: import("convex/values").VFloat64<number, "required">;
+    emailLastSentAt: import("convex/values").VFloat64<number, "required">;
+}, "required", "appId" | "clientId" | "codeChallenge" | "connector" | "createdAt" | "email" | "emailAttempts" | "emailCodeExpiresAt" | "emailCodeHash" | "emailLastSentAt" | "emailSends" | "expiresAt" | "freshLogin" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash">, import("convex/values").VObject<{
+    appId: string;
+    authTime: number;
+    clientId: string;
+    codeChallenge: string;
+    createdAt: number;
+    expiresAt: number;
+    freshLogin: boolean;
+    identity: {
+        connector: string;
+        email?: string;
+        emailVerified?: boolean;
+        name?: string;
+        picture?: string;
+        upstreamId: string;
+    };
+    nonce?: string;
+    redirectUri: string;
+    requestId: string;
+    scope: string;
+    state?: string;
+    status: "completed";
+    txnCookieHash?: string;
+}, {
+    requestId: import("convex/values").VString<string, "required">;
+    appId: import("convex/values").VString<string, "required">;
+    clientId: import("convex/values").VString<string, "required">;
+    redirectUri: import("convex/values").VString<string, "required">;
+    scope: import("convex/values").VString<string, "required">;
+    state: import("convex/values").VString<string | undefined, "optional">;
+    nonce: import("convex/values").VString<string | undefined, "optional">;
+    codeChallenge: import("convex/values").VString<string, "required">;
+    /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
+    freshLogin: import("convex/values").VBoolean<boolean, "required">;
+    /**
+     * SHA-256 hex of the `broker_txn` cookie set with the chooser page: `/continue` needs the cookie,
+     * so only the browser that saw the chooser can continue. Absent when /authorize skipped the chooser.
+     */
+    txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
+    createdAt: import("convex/values").VFloat64<number, "required">;
+    expiresAt: import("convex/values").VFloat64<number, "required">;
+    status: import("convex/values").VLiteral<"completed", "required">;
+    identity: import("convex/values").VObject<{
+        connector: string;
+        email?: string;
+        emailVerified?: boolean;
+        name?: string;
+        picture?: string;
+        upstreamId: string;
+    }, {
+        connector: import("convex/values").VString<string, "required">;
+        upstreamId: import("convex/values").VString<string, "required">;
+        email: import("convex/values").VString<string | undefined, "optional">;
+        emailVerified: import("convex/values").VBoolean<boolean | undefined, "optional">;
+        name: import("convex/values").VString<string | undefined, "optional">;
+        picture: import("convex/values").VString<string | undefined, "optional">;
+    }, "required", "connector" | "email" | "emailVerified" | "name" | "picture" | "upstreamId">;
+    authTime: import("convex/values").VFloat64<number, "required">;
+}, "required", "appId" | "authTime" | "clientId" | "codeChallenge" | "createdAt" | "expiresAt" | "freshLogin" | "identity" | "identity.connector" | "identity.email" | "identity.emailVerified" | "identity.name" | "identity.picture" | "identity.upstreamId" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash">], "required", "appId" | "authTime" | "clientId" | "codeChallenge" | "connector" | "createdAt" | "email" | "emailAttempts" | "emailCodeExpiresAt" | "emailCodeHash" | "emailLastSentAt" | "emailSends" | "expiresAt" | "freshLogin" | "identity" | "identity.connector" | "identity.email" | "identity.emailVerified" | "identity.name" | "identity.picture" | "identity.upstreamId" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash" | "upstreamCodeVerifier" | "upstreamNonce" | "upstreamStateHash">;
+declare const _default: import("convex/server").SchemaDefinition<{
+    apps: import("convex/server").TableDefinition<import("convex/values").VObject<{
+        allowedCallbackHosts: string[];
+        appId: string;
+        createdAt: number;
+        firstParty: boolean;
+        name: string;
+    }, {
+        appId: import("convex/values").VString<string, "required">;
+        name: import("convex/values").VString<string, "required">;
+        firstParty: import("convex/values").VBoolean<boolean, "required">;
+        /** Exact hosts or `*.suffix` patterns a client callback may use, e.g. `*.convex.site`. */
+        allowedCallbackHosts: import("convex/values").VArray<string[], import("convex/values").VString<string, "required">, "required">;
+        createdAt: import("convex/values").VFloat64<number, "required">;
+    }, "required", "allowedCallbackHosts" | "appId" | "createdAt" | "firstParty" | "name">, {
+        by_app_id: ["appId", "_creationTime"];
+    }, {}, {}>;
+    registrationTokens: import("convex/server").TableDefinition<import("convex/values").VObject<{
+        appId: string;
+        createdAt: number;
+        expiresAt: number;
+        tokenHash: string;
+    }, {
+        tokenHash: import("convex/values").VString<string, "required">;
+        appId: import("convex/values").VString<string, "required">;
+        expiresAt: import("convex/values").VFloat64<number, "required">;
+        createdAt: import("convex/values").VFloat64<number, "required">;
+    }, "required", "appId" | "createdAt" | "expiresAt" | "tokenHash">, {
+        by_app_id: ["appId", "_creationTime"];
+        by_expires_at: ["expiresAt", "_creationTime"];
+        by_token_hash: ["tokenHash", "_creationTime"];
+    }, {}, {}>;
+    clients: import("convex/server").TableDefinition<import("convex/values").VObject<{
+        appId: string;
+        clientId: string;
+        clientName: string;
+        createdAt: number;
+        deploymentType: "development" | "preview" | "production";
+        lastSignInAt?: number;
+        redirectUri: string;
+        secretHash: string;
+        softwareVersion: string;
+        tokenEndpointAuthMethod: "client_secret_basic" | "client_secret_post";
+    }, {
+        clientId: import("convex/values").VString<string, "required">;
+        appId: import("convex/values").VString<string, "required">;
+        secretHash: import("convex/values").VString<string, "required">;
+        tokenEndpointAuthMethod: import("convex/values").VUnion<"client_secret_basic" | "client_secret_post", [import("convex/values").VLiteral<"client_secret_post", "required">, import("convex/values").VLiteral<"client_secret_basic", "required">], "required", never>;
+        redirectUri: import("convex/values").VString<string, "required">;
+        deploymentType: import("convex/values").VUnion<"development" | "preview" | "production", [import("convex/values").VLiteral<"production", "required">, import("convex/values").VLiteral<"development", "required">, import("convex/values").VLiteral<"preview", "required">], "required", never>;
+        clientName: import("convex/values").VString<string, "required">;
+        softwareVersion: import("convex/values").VString<string, "required">;
+        createdAt: import("convex/values").VFloat64<number, "required">;
+        lastSignInAt: import("convex/values").VFloat64<number | undefined, "optional">;
+    }, "required", "appId" | "clientId" | "clientName" | "createdAt" | "deploymentType" | "lastSignInAt" | "redirectUri" | "secretHash" | "softwareVersion" | "tokenEndpointAuthMethod">, {
+        by_app_id: ["appId", "_creationTime"];
+        by_client_id: ["clientId", "_creationTime"];
+        by_deployment_type: ["deploymentType", "_creationTime"];
+    }, {}, {}>;
+    authRequests: import("convex/server").TableDefinition<import("convex/values").VUnion<{
+        appId: string;
+        clientId: string;
+        codeChallenge: string;
+        createdAt: number;
+        expiresAt: number;
+        freshLogin: boolean;
+        nonce?: string;
+        redirectUri: string;
+        requestId: string;
+        scope: string;
+        state?: string;
+        status: "pending";
+        txnCookieHash?: string;
+    } | {
+        appId: string;
+        clientId: string;
+        codeChallenge: string;
+        connector: string;
+        createdAt: number;
+        expiresAt: number;
+        freshLogin: boolean;
+        nonce?: string;
+        redirectUri: string;
+        requestId: string;
+        scope: string;
+        state?: string;
+        status: "upstream";
+        txnCookieHash?: string;
+        upstreamCodeVerifier: string;
+        upstreamNonce?: string;
+        upstreamStateHash: string;
+    } | {
+        appId: string;
+        clientId: string;
+        codeChallenge: string;
+        connector: string;
+        createdAt: number;
+        expiresAt: number;
+        freshLogin: boolean;
+        nonce?: string;
+        redirectUri: string;
+        requestId: string;
+        scope: string;
+        state?: string;
+        status: "claimed";
+        txnCookieHash?: string;
+    } | {
+        appId: string;
+        clientId: string;
+        codeChallenge: string;
+        connector: string;
+        createdAt: number;
+        email: string;
+        emailAttempts: number;
+        emailCodeExpiresAt: number;
+        emailCodeHash: string;
+        emailLastSentAt: number;
+        emailSends: number;
+        expiresAt: number;
+        freshLogin: boolean;
+        nonce?: string;
+        redirectUri: string;
+        requestId: string;
+        scope: string;
+        state?: string;
+        status: "emailSent";
+        txnCookieHash?: string;
+    } | {
+        appId: string;
+        authTime: number;
+        clientId: string;
+        codeChallenge: string;
+        createdAt: number;
+        expiresAt: number;
+        freshLogin: boolean;
+        identity: {
+            connector: string;
+            email?: string;
+            emailVerified?: boolean;
+            name?: string;
+            picture?: string;
+            upstreamId: string;
+        };
+        nonce?: string;
+        redirectUri: string;
+        requestId: string;
+        scope: string;
+        state?: string;
+        status: "completed";
+        txnCookieHash?: string;
+    }, [import("convex/values").VObject<{
+        appId: string;
+        clientId: string;
+        codeChallenge: string;
+        createdAt: number;
+        expiresAt: number;
+        freshLogin: boolean;
+        nonce?: string;
+        redirectUri: string;
+        requestId: string;
+        scope: string;
+        state?: string;
+        status: "pending";
+        txnCookieHash?: string;
+    }, {
+        requestId: import("convex/values").VString<string, "required">;
+        appId: import("convex/values").VString<string, "required">;
+        clientId: import("convex/values").VString<string, "required">;
+        redirectUri: import("convex/values").VString<string, "required">;
+        scope: import("convex/values").VString<string, "required">;
+        state: import("convex/values").VString<string | undefined, "optional">;
+        nonce: import("convex/values").VString<string | undefined, "optional">;
+        codeChallenge: import("convex/values").VString<string, "required">;
+        /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
+        freshLogin: import("convex/values").VBoolean<boolean, "required">;
+        /**
+         * SHA-256 hex of the `broker_txn` cookie set with the chooser page: `/continue` needs the cookie,
+         * so only the browser that saw the chooser can continue. Absent when /authorize skipped the chooser.
+         */
+        txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
+        createdAt: import("convex/values").VFloat64<number, "required">;
+        expiresAt: import("convex/values").VFloat64<number, "required">;
+        status: import("convex/values").VLiteral<"pending", "required">;
+    }, "required", "appId" | "clientId" | "codeChallenge" | "createdAt" | "expiresAt" | "freshLogin" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash">, import("convex/values").VObject<{
+        appId: string;
+        clientId: string;
+        codeChallenge: string;
+        connector: string;
+        createdAt: number;
+        expiresAt: number;
+        freshLogin: boolean;
+        nonce?: string;
+        redirectUri: string;
+        requestId: string;
+        scope: string;
+        state?: string;
+        status: "upstream";
+        txnCookieHash?: string;
+        upstreamCodeVerifier: string;
+        upstreamNonce?: string;
+        upstreamStateHash: string;
+    }, {
+        requestId: import("convex/values").VString<string, "required">;
+        appId: import("convex/values").VString<string, "required">;
+        clientId: import("convex/values").VString<string, "required">;
+        redirectUri: import("convex/values").VString<string, "required">;
+        scope: import("convex/values").VString<string, "required">;
+        state: import("convex/values").VString<string | undefined, "optional">;
+        nonce: import("convex/values").VString<string | undefined, "optional">;
+        codeChallenge: import("convex/values").VString<string, "required">;
+        /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
+        freshLogin: import("convex/values").VBoolean<boolean, "required">;
+        /**
+         * SHA-256 hex of the `broker_txn` cookie set with the chooser page: `/continue` needs the cookie,
+         * so only the browser that saw the chooser can continue. Absent when /authorize skipped the chooser.
+         */
+        txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
+        createdAt: import("convex/values").VFloat64<number, "required">;
+        expiresAt: import("convex/values").VFloat64<number, "required">;
+        status: import("convex/values").VLiteral<"upstream", "required">;
+        connector: import("convex/values").VString<string, "required">;
+        upstreamStateHash: import("convex/values").VString<string, "required">;
+        upstreamCodeVerifier: import("convex/values").VString<string, "required">;
+        upstreamNonce: import("convex/values").VString<string | undefined, "optional">;
+    }, "required", "appId" | "clientId" | "codeChallenge" | "connector" | "createdAt" | "expiresAt" | "freshLogin" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash" | "upstreamCodeVerifier" | "upstreamNonce" | "upstreamStateHash">, import("convex/values").VObject<{
+        appId: string;
+        clientId: string;
+        codeChallenge: string;
+        connector: string;
+        createdAt: number;
+        expiresAt: number;
+        freshLogin: boolean;
+        nonce?: string;
+        redirectUri: string;
+        requestId: string;
+        scope: string;
+        state?: string;
+        status: "claimed";
+        txnCookieHash?: string;
+    }, {
+        requestId: import("convex/values").VString<string, "required">;
+        appId: import("convex/values").VString<string, "required">;
+        clientId: import("convex/values").VString<string, "required">;
+        redirectUri: import("convex/values").VString<string, "required">;
+        scope: import("convex/values").VString<string, "required">;
+        state: import("convex/values").VString<string | undefined, "optional">;
+        nonce: import("convex/values").VString<string | undefined, "optional">;
+        codeChallenge: import("convex/values").VString<string, "required">;
+        /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
+        freshLogin: import("convex/values").VBoolean<boolean, "required">;
+        /**
+         * SHA-256 hex of the `broker_txn` cookie set with the chooser page: `/continue` needs the cookie,
+         * so only the browser that saw the chooser can continue. Absent when /authorize skipped the chooser.
+         */
+        txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
+        createdAt: import("convex/values").VFloat64<number, "required">;
+        expiresAt: import("convex/values").VFloat64<number, "required">;
+        status: import("convex/values").VLiteral<"claimed", "required">;
+        connector: import("convex/values").VString<string, "required">;
+    }, "required", "appId" | "clientId" | "codeChallenge" | "connector" | "createdAt" | "expiresAt" | "freshLogin" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash">, import("convex/values").VObject<{
+        appId: string;
+        clientId: string;
+        codeChallenge: string;
+        connector: string;
+        createdAt: number;
+        email: string;
+        emailAttempts: number;
+        emailCodeExpiresAt: number;
+        emailCodeHash: string;
+        emailLastSentAt: number;
+        emailSends: number;
+        expiresAt: number;
+        freshLogin: boolean;
+        nonce?: string;
+        redirectUri: string;
+        requestId: string;
+        scope: string;
+        state?: string;
+        status: "emailSent";
+        txnCookieHash?: string;
+    }, {
+        requestId: import("convex/values").VString<string, "required">;
+        appId: import("convex/values").VString<string, "required">;
+        clientId: import("convex/values").VString<string, "required">;
+        redirectUri: import("convex/values").VString<string, "required">;
+        scope: import("convex/values").VString<string, "required">;
+        state: import("convex/values").VString<string | undefined, "optional">;
+        nonce: import("convex/values").VString<string | undefined, "optional">;
+        codeChallenge: import("convex/values").VString<string, "required">;
+        /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
+        freshLogin: import("convex/values").VBoolean<boolean, "required">;
+        /**
+         * SHA-256 hex of the `broker_txn` cookie set with the chooser page: `/continue` needs the cookie,
+         * so only the browser that saw the chooser can continue. Absent when /authorize skipped the chooser.
+         */
+        txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
+        createdAt: import("convex/values").VFloat64<number, "required">;
+        expiresAt: import("convex/values").VFloat64<number, "required">;
+        status: import("convex/values").VLiteral<"emailSent", "required">;
+        connector: import("convex/values").VString<string, "required">;
+        email: import("convex/values").VString<string, "required">;
+        emailCodeHash: import("convex/values").VString<string, "required">;
+        emailCodeExpiresAt: import("convex/values").VFloat64<number, "required">;
+        /** Wrong codes typed, across every code sent for this request. */
+        emailAttempts: import("convex/values").VFloat64<number, "required">;
+        /** Codes sent for this request. */
+        emailSends: import("convex/values").VFloat64<number, "required">;
+        emailLastSentAt: import("convex/values").VFloat64<number, "required">;
+    }, "required", "appId" | "clientId" | "codeChallenge" | "connector" | "createdAt" | "email" | "emailAttempts" | "emailCodeExpiresAt" | "emailCodeHash" | "emailLastSentAt" | "emailSends" | "expiresAt" | "freshLogin" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash">, import("convex/values").VObject<{
+        appId: string;
+        authTime: number;
+        clientId: string;
+        codeChallenge: string;
+        createdAt: number;
+        expiresAt: number;
+        freshLogin: boolean;
+        identity: {
+            connector: string;
+            email?: string;
+            emailVerified?: boolean;
+            name?: string;
+            picture?: string;
+            upstreamId: string;
+        };
+        nonce?: string;
+        redirectUri: string;
+        requestId: string;
+        scope: string;
+        state?: string;
+        status: "completed";
+        txnCookieHash?: string;
+    }, {
+        requestId: import("convex/values").VString<string, "required">;
+        appId: import("convex/values").VString<string, "required">;
+        clientId: import("convex/values").VString<string, "required">;
+        redirectUri: import("convex/values").VString<string, "required">;
+        scope: import("convex/values").VString<string, "required">;
+        state: import("convex/values").VString<string | undefined, "optional">;
+        nonce: import("convex/values").VString<string | undefined, "optional">;
+        codeChallenge: import("convex/values").VString<string, "required">;
+        /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
+        freshLogin: import("convex/values").VBoolean<boolean, "required">;
+        /**
+         * SHA-256 hex of the `broker_txn` cookie set with the chooser page: `/continue` needs the cookie,
+         * so only the browser that saw the chooser can continue. Absent when /authorize skipped the chooser.
+         */
+        txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
+        createdAt: import("convex/values").VFloat64<number, "required">;
+        expiresAt: import("convex/values").VFloat64<number, "required">;
+        status: import("convex/values").VLiteral<"completed", "required">;
+        identity: import("convex/values").VObject<{
+            connector: string;
+            email?: string;
+            emailVerified?: boolean;
+            name?: string;
+            picture?: string;
+            upstreamId: string;
+        }, {
+            connector: import("convex/values").VString<string, "required">;
+            upstreamId: import("convex/values").VString<string, "required">;
+            email: import("convex/values").VString<string | undefined, "optional">;
+            emailVerified: import("convex/values").VBoolean<boolean | undefined, "optional">;
+            name: import("convex/values").VString<string | undefined, "optional">;
+            picture: import("convex/values").VString<string | undefined, "optional">;
+        }, "required", "connector" | "email" | "emailVerified" | "name" | "picture" | "upstreamId">;
+        authTime: import("convex/values").VFloat64<number, "required">;
+    }, "required", "appId" | "authTime" | "clientId" | "codeChallenge" | "createdAt" | "expiresAt" | "freshLogin" | "identity" | "identity.connector" | "identity.email" | "identity.emailVerified" | "identity.name" | "identity.picture" | "identity.upstreamId" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash">], "required", "appId" | "authTime" | "clientId" | "codeChallenge" | "connector" | "createdAt" | "email" | "emailAttempts" | "emailCodeExpiresAt" | "emailCodeHash" | "emailLastSentAt" | "emailSends" | "expiresAt" | "freshLogin" | "identity" | "identity.connector" | "identity.email" | "identity.emailVerified" | "identity.name" | "identity.picture" | "identity.upstreamId" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash" | "upstreamCodeVerifier" | "upstreamNonce" | "upstreamStateHash">, {
+        by_expires_at: ["expiresAt", "_creationTime"];
+        by_request_id: ["requestId", "_creationTime"];
+        by_upstream_state_hash: ["upstreamStateHash", "_creationTime"];
+    }, {}, {}>;
+    authorizationCodes: import("convex/server").TableDefinition<import("convex/values").VObject<{
+        authRequestId: import("convex/values").GenericId<"authRequests">;
+        clientId: string;
+        codeHash: string;
+        expiresAt: number;
+        usedAt?: number;
+    }, {
+        codeHash: import("convex/values").VString<string, "required">;
+        authRequestId: import("convex/values").VId<import("convex/values").GenericId<"authRequests">, "required">;
+        clientId: import("convex/values").VString<string, "required">;
+        expiresAt: import("convex/values").VFloat64<number, "required">;
+        usedAt: import("convex/values").VFloat64<number | undefined, "optional">;
+    }, "required", "authRequestId" | "clientId" | "codeHash" | "expiresAt" | "usedAt">, {
+        by_code_hash: ["codeHash", "_creationTime"];
+        by_expires_at: ["expiresAt", "_creationTime"];
+    }, {}, {}>;
+    /** One row per email code sent, kept for the rolling send window; no address, only its hash. */
+    emailSends: import("convex/server").TableDefinition<import("convex/values").VObject<{
+        at: number;
+        emailHash: string;
+    }, {
+        /** SHA-256 hex of the canonical address. */
+        emailHash: import("convex/values").VString<string, "required">;
+        at: import("convex/values").VFloat64<number, "required">;
+    }, "required", "at" | "emailHash">, {
+        by_at: ["at", "_creationTime"];
+        by_email_hash_and_at: ["emailHash", "at", "_creationTime"];
+    }, {}, {}>;
+    signIns: import("convex/server").TableDefinition<import("convex/values").VObject<{
+        appId: string;
+        at: number;
+        clientId: string;
+        connector: string;
+        sub: string;
+    }, {
+        appId: import("convex/values").VString<string, "required">;
+        clientId: import("convex/values").VString<string, "required">;
+        connector: import("convex/values").VString<string, "required">;
+        sub: import("convex/values").VString<string, "required">;
+        at: import("convex/values").VFloat64<number, "required">;
+    }, "required", "appId" | "at" | "clientId" | "connector" | "sub">, {
+        by_app_id_and_at: ["appId", "at", "_creationTime"];
+        by_at: ["at", "_creationTime"];
+    }, {}, {}>;
+}, true>;
+export default _default;