@samebase/identity-broker 0.1.0 → 0.3.0

package/README.md

@@ -18,6 +18,9 @@ registers each deployment as a client at deploy time and never touches GitHub or
   your own action. `github()`, `google()` and `email()` are included.
 - A hub is a small Convex app that mounts the component. Fork
   [samebase/identity-hub](https://github.com/samebase/identity-hub) for one.
+- `@samebase/alchemy-identity-hub`: an Alchemy v2 resource, `IdentityHub.Client`, that registers a
+  deployment as a client at deploy time. See
+  [packages/alchemy-identity-hub](https://github.com/samebase/identity-broker/tree/main/packages/alchemy-identity-hub).
 
 ## Mount it
 
@@ -62,12 +65,23 @@ export default http;
 ```ts
 // convex/identityBroker.ts: administration for `npx convex run`
 import { broker } from "./http";
-export const { createApp, mintRegistrationToken, deleteApp, listApps, listClients, cleanup } =
-  broker.admin();
+export const {
+  createApp,
+  mintRegistrationToken,
+  listRegistrationTokens,
+  revokeRegistrationToken,
+  setAllowedCallbackHosts,
+  deleteClient,
+  deleteApp,
+  listApps,
+  listClients,
+  cleanup,
+} = broker.admin();
 ```
 
 Keys: `npx identity-broker keys` prints the value for `IDENTITY_BROKER_KEYS`; `keys --rotate`
-advances it.
+advances it, and `keys --rotate --no-overlap` replaces a compromised key at once. Back up the key
+set: its salt makes every `sub`. `parseKeySet` checks a value before a deploy.
 
 ## Register an app's deployments
 

package/dist/cli/index.js

@@ -1,7 +1,10 @@
 #!/usr/bin/env node
-import { createKeySet, parseKeySet, rotateKeySet } from "../client/keys.js";
-const USAGE = `identity-broker keys            print a new key set for IDENTITY_BROKER_KEYS
-identity-broker keys --rotate   read the current key set on stdin, print the rotated one`;
+import { createKeySet, parseKeySet, rotateKeySet, rotateKeySetWithoutOverlap, } from "../client/keys.js";
+const USAGE = `identity-broker keys                         print a new key set for IDENTITY_BROKER_KEYS
+identity-broker keys --rotate                read the current key set on stdin, print the rotated
+                                             one; the retired public key stays for 14 days
+identity-broker keys --rotate --no-overlap   the same after a key compromise: retired keys are
+                                             dropped at once; the salt is kept`;
 async function readStdin() {
     const chunks = [];
     for await (const chunk of process.stdin) {
@@ -14,8 +17,18 @@ async function main(argv) {
         console.error(USAGE);
         return 2;
     }
-    if (argv.includes("--rotate")) {
-        const rotated = await rotateKeySet(parseKeySet(await readStdin()));
+    const rotate = argv.includes("--rotate");
+    const noOverlap = argv.includes("--no-overlap");
+    // Without --rotate, --no-overlap would print a new key set with a new salt: every sub changes.
+    if (noOverlap && !rotate) {
+        console.error(USAGE);
+        return 2;
+    }
+    if (rotate) {
+        const current = parseKeySet(await readStdin());
+        const rotated = noOverlap
+            ? await rotateKeySetWithoutOverlap(current)
+            : await rotateKeySet(current);
         process.stdout.write(`${JSON.stringify(rotated)}\n`);
         return 0;
     }

package/dist/cli/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE5E,MAAM,KAAK,GAAG;yFAC2E,CAAC;AAE1F,KAAK,UAAU,SAAS;IACtB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAc;IAChC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,CAAC;QACnE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC;IAClE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,OAAO,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA,OAAO,EACL,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAE3B,MAAM,KAAK,GAAG;;;;+EAIiE,CAAC;AAEhF,KAAK,UAAU,SAAS;IACtB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAc;IAChC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAChD,+FAA+F;IAC/F,IAAI,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,SAAS;YACvB,CAAC,CAAC,MAAM,0BAA0B,CAAC,OAAO,CAAC;YAC3C,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC;IAClE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,OAAO,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/client/connectors/google.d.ts

@@ -1,5 +1,9 @@
 import type { OidcConnector } from "./types.js";
-/** Google as an OIDC connector: discovery, id_token claims, `prompt=login` for fresh logins. */
+/**
+ * Google as an OIDC connector: discovery and id_token claims. Google documents no `login` value
+ * for `prompt`, only `none`, `consent`, and `select_account`, so a fresh login through it answers
+ * `login_required`.
+ */
 export declare function google(credentials: {
     clientId: () => string;
     clientSecret: () => string;

package/dist/client/connectors/google.js

@@ -1,4 +1,8 @@
-/** Google as an OIDC connector: discovery, id_token claims, `prompt=login` for fresh logins. */
+/**
+ * Google as an OIDC connector: discovery and id_token claims. Google documents no `login` value
+ * for `prompt`, only `none`, `consent`, and `select_account`, so a fresh login through it answers
+ * `login_required`.
+ */
 export function google(credentials) {
     return {
         kind: "oidc",
@@ -6,6 +10,7 @@ export function google(credentials) {
         label: "Google",
         issuer: "https://accounts.google.com",
         scopes: ["openid", "email", "profile"],
+        promptLogin: false,
         clientId: credentials.clientId,
         clientSecret: credentials.clientSecret,
     };

package/dist/client/connectors/google.js.map

@@ -1 +1 @@
-{"version":3,"file":"google.js","sourceRoot":"","sources":["../../../src/client/connectors/google.ts"],"names":[],"mappings":"AAEA,gGAAgG;AAChG,MAAM,UAAU,MAAM,CAAC,WAItB;IACC,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,WAAW,CAAC,IAAI,IAAI,QAAQ;QAClC,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,6BAA6B;QACrC,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;QACtC,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,YAAY,EAAE,WAAW,CAAC,YAAY;KACvC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"google.js","sourceRoot":"","sources":["../../../src/client/connectors/google.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,WAItB;IACC,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,WAAW,CAAC,IAAI,IAAI,QAAQ;QAClC,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,6BAA6B;QACrC,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;QACtC,WAAW,EAAE,KAAK;QAClB,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,YAAY,EAAE,WAAW,CAAC,YAAY;KACvC,CAAC;AACJ,CAAC"}

package/dist/client/connectors/types.d.ts

@@ -30,6 +30,11 @@ export type OidcConnector = Credentials & {
     label: string;
     issuer: string;
     scopes: string[];
+    /**
+     * The provider documents `prompt=login`, so a fresh login (`prompt=login` or `max_age`) is sent
+     * upstream as that. Without it, a fresh login answers `login_required`.
+     */
+    promptLogin: boolean;
 };
 /** The host action that delivers a code. The broker never sees how. */
 export type SendEmailCode = FunctionReference<"action", "internal", {

package/dist/client/html.d.ts

@@ -1,5 +1,5 @@
 /** The few pages the broker renders itself. Plain HTML, one stylesheet, no script. */
-export declare function page(title: string, body: string): Response;
+export declare function page(title: string, body: string, status?: number): Response;
 /**
  * The connector choice. A third-party app gets the consent wording and a deny link; a first-party
  * app only sees the buttons.
@@ -7,6 +7,8 @@ export declare function page(title: string, body: string): Response;
 export declare function chooserPage(args: {
     appName: string;
     firstParty: boolean;
+    /** The granted scopes: the consent names only what they release. */
+    scopes: string[];
     connectors: Array<{
         name: string;
         label: string;
@@ -19,6 +21,7 @@ export declare function emailAddressPage(args: {
     action: string;
     requestId: string;
     error?: string;
+    status?: number;
 }): Response;
 export declare function emailCodePage(args: {
     appName: string;
@@ -26,5 +29,6 @@ export declare function emailCodePage(args: {
     requestId: string;
     email: string;
     error?: string;
+    status?: number;
 }): Response;
 export declare function errorPage(title: string, message: string, status?: number): Response;

package/dist/client/html.js

@@ -20,7 +20,7 @@ const STYLE = `
   .error { color: #b00020; }
   .muted { color: #555; }
 `;
-export function page(title, body) {
+export function page(title, body, status = 200) {
     const html = `<!doctype html>
 <html lang="en">
 <head>
@@ -33,11 +33,14 @@ export function page(title, body) {
 <body><main>${body}</main></body>
 </html>`;
     return new Response(html, {
-        status: 200,
+        status,
         headers: {
             "Content-Type": "text/html; charset=utf-8",
             "Cache-Control": "no-store",
             "Referrer-Policy": "no-referrer",
+            // No page of the broker may be framed: the chooser doubles as consent.
+            "Content-Security-Policy": "frame-ancestors 'none'",
+            "X-Frame-Options": "DENY",
         },
     });
 }
@@ -49,9 +52,17 @@ export function chooserPage(args) {
     const buttons = args.connectors
         .map((connector) => `<a class="button" href="${escape(connector.href)}">Continue with ${escape(connector.label)}</a>`)
         .join("\n");
+    const released = [
+        "a stable id",
+        ...(args.scopes.includes("profile") ? ["your name and picture"] : []),
+        ...(args.scopes.includes("email") ? ["your verified email address"] : []),
+    ];
+    const list = released.length <= 2
+        ? released.join(" and ")
+        : `${released.slice(0, -1).join(", ")}, and ${released.slice(-1).join("")}`;
     const consent = args.firstParty
         ? ""
-        : `<p class="muted">${escape(args.appName)} will receive your identity from the provider you choose: a stable id, your name, and your verified email address.</p>`;
+        : `<p class="muted">${escape(args.appName)} will receive your identity from the provider you choose: ${list}.</p>`;
     const deny = args.firstParty
         ? ""
         : `<p><a href="${escape(args.denyHref)}">Cancel and return to ${escape(args.appName)}</a></p>`;
@@ -65,7 +76,7 @@ export function emailAddressPage(args) {
 <input type="hidden" name="step" value="send">
 <input type="email" name="email" required autocomplete="email" autofocus placeholder="you@example.com">
 <button type="submit">Send code</button>
-</form>`);
+</form>`, args.status);
 }
 export function emailCodePage(args) {
     const error = args.error === undefined ? "" : `<p class="error">${escape(args.error)}</p>`;
@@ -75,10 +86,9 @@ export function emailCodePage(args) {
 <input type="hidden" name="step" value="verify">
 <input type="text" name="code" inputmode="numeric" pattern="[0-9]{6}" required autocomplete="one-time-code" autofocus placeholder="000000">
 <button type="submit">Continue</button>
-</form>`);
+</form>`, args.status);
 }
 export function errorPage(title, message, status = 400) {
-    const response = page(title, `<h1>${escape(title)}</h1><p>${escape(message)}</p>`);
-    return new Response(response.body, { status, headers: response.headers });
+    return page(title, `<h1>${escape(title)}</h1><p>${escape(message)}</p>`, status);
 }
 //# sourceMappingURL=html.js.map

package/dist/client/html.js.map

@@ -1 +1 @@
-{"version":3,"file":"html.js","sourceRoot":"","sources":["../../src/client/html.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,KAAK,GAAG;;;;;;;;;;;;;CAab,CAAC;AAEF,MAAM,UAAU,IAAI,CAAC,KAAa,EAAE,IAAY;IAC9C,MAAM,IAAI,GAAG;;;;;;SAMN,MAAM,CAAC,KAAK,CAAC;SACb,KAAK;;cAEA,IAAI;QACV,CAAC;IACP,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,eAAe,EAAE,UAAU;YAC3B,iBAAiB,EAAE,aAAa;SACjC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAK3B;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU;SAC5B,GAAG,CACF,CAAC,SAAS,EAAE,EAAE,CACZ,2BAA2B,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CACpG;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU;QAC7B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,oBAAoB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,wHAAwH,CAAC;IACrK,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU;QAC1B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,eAAe,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,0BAA0B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;IACjG,OAAO,IAAI,CACT,cAAc,IAAI,CAAC,OAAO,EAAE,EAC5B,kBAAkB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,OAAO,qBAAqB,OAAO,SAAS,IAAI,EAAE,CACjG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAKhC;IACC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;IAC3F,OAAO,IAAI,CACT,cAAc,IAAI,CAAC,OAAO,EAAE,EAC5B,kBAAkB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,wEAAwE,KAAK;8BACzF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;6CACJ,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;;;;QAI3D,CACL,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAM7B;IACC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;IAC3F,OAAO,IAAI,CACT,cAAc,IAAI,CAAC,OAAO,EAAE,EAC5B,gEAAgE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK;8BACrE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;6CACJ,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;;;;QAI3D,CACL,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,OAAe,EAAE,MAAM,GAAG,GAAG;IACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,MAAM,CAAC,KAAK,CAAC,WAAW,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnF,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;AAC5E,CAAC"}
+{"version":3,"file":"html.js","sourceRoot":"","sources":["../../src/client/html.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,KAAK,GAAG;;;;;;;;;;;;;CAab,CAAC;AAEF,MAAM,UAAU,IAAI,CAAC,KAAa,EAAE,IAAY,EAAE,MAAM,GAAG,GAAG;IAC5D,MAAM,IAAI,GAAG;;;;;;SAMN,MAAM,CAAC,KAAK,CAAC;SACb,KAAK;;cAEA,IAAI;QACV,CAAC;IACP,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,eAAe,EAAE,UAAU;YAC3B,iBAAiB,EAAE,aAAa;YAChC,uEAAuE;YACvE,yBAAyB,EAAE,wBAAwB;YACnD,iBAAiB,EAAE,MAAM;SAC1B;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAO3B;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU;SAC5B,GAAG,CACF,CAAC,SAAS,EAAE,EAAE,CACZ,2BAA2B,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CACpG;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,QAAQ,GAAG;QACf,aAAa;QACb,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAC;IACF,MAAM,IAAI,GACR,QAAQ,CAAC,MAAM,IAAI,CAAC;QAClB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;QACxB,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;IAChF,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU;QAC7B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,oBAAoB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,6DAA6D,IAAI,OAAO,CAAC;IACrH,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU;QAC1B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,eAAe,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,0BAA0B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;IACjG,OAAO,IAAI,CACT,cAAc,IAAI,CAAC,OAAO,EAAE,EAC5B,kBAAkB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,OAAO,qBAAqB,OAAO,SAAS,IAAI,EAAE,CACjG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAMhC;IACC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;IAC3F,OAAO,IAAI,CACT,cAAc,IAAI,CAAC,OAAO,EAAE,EAC5B,kBAAkB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,wEAAwE,KAAK;8BACzF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;6CACJ,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;;;;QAI3D,EACJ,IAAI,CAAC,MAAM,CACZ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAO7B;IACC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;IAC3F,OAAO,IAAI,CACT,cAAc,IAAI,CAAC,OAAO,EAAE,EAC5B,gEAAgE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK;8BACrE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;6CACJ,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;;;;QAI3D,EACJ,IAAI,CAAC,MAAM,CACZ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,OAAe,EAAE,MAAM,GAAG,GAAG;IACpE,OAAO,IAAI,CAAC,KAAK,EAAE,OAAO,MAAM,CAAC,KAAK,CAAC,WAAW,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACnF,CAAC"}

package/dist/client/index.d.ts

@@ -5,7 +5,7 @@ export type { Connector, EmailConnector, OauthConnector, OidcConnector, SendEmai
 export { github } from "./connectors/github.js";
 export { google } from "./connectors/google.js";
 export { email } from "./connectors/email.js";
-export { createKeySet, rotateKeySet, type KeySet } from "./keys.js";
+export { createKeySet, parseKeySet, rotateKeySet, type KeySet } from "./keys.js";
 export type IdentityBrokerConfig = {
     /** `components.identityBroker` of the host app. */
     component: ComponentApi;
@@ -44,6 +44,19 @@ export declare function defineIdentityBroker(config: IdentityBrokerConfig): {
             allowedCallbackHosts: string[];
             appId: string;
         }, Promise<null>>;
+        listRegistrationTokens: import("convex/server").RegisteredQuery<"internal", {
+            appId: string;
+        }, Promise<{
+            createdAt: number;
+            expiresAt: number;
+            tokenHash: string;
+        }[]>>;
+        revokeRegistrationToken: import("convex/server").RegisteredMutation<"internal", {
+            tokenHash: string;
+        }, Promise<null>>;
+        deleteClient: import("convex/server").RegisteredMutation<"internal", {
+            clientId: string;
+        }, Promise<null>>;
         deleteApp: import("convex/server").RegisteredMutation<"internal", {
             appId: string;
         }, Promise<null>>;
@@ -71,7 +84,9 @@ export declare function defineIdentityBroker(config: IdentityBrokerConfig): {
         cleanup: import("convex/server").RegisteredMutation<"internal", {}, Promise<{
             authRequests: number;
             authorizationCodes: number;
+            emailSends: number;
             previewClients: number;
+            registrationTokens: number;
             signIns: number;
         }>>;
     };