@samebase/identity-broker 0.8.0 → 0.9.1

package/dist/component/schema.d.ts

@@ -35,7 +35,7 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     scope: string;
     state?: string;
     status: "pending";
-    txnCookieHash?: string;
+    txnCookieHash: string;
 } | {
     appId: string;
     clientId: string;
@@ -50,7 +50,7 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     scope: string;
     state?: string;
     status: "upstream";
-    txnCookieHash?: string;
+    txnCookieHash: string;
     upstreamCodeVerifier: string;
     upstreamNonce?: string;
     upstreamStateHash: string;
@@ -68,7 +68,7 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     scope: string;
     state?: string;
     status: "claimed";
-    txnCookieHash?: string;
+    txnCookieHash: string;
 } | {
     appId: string;
     clientId: string;
@@ -89,7 +89,7 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     scope: string;
     state?: string;
     status: "emailSent";
-    txnCookieHash?: string;
+    txnCookieHash: string;
 } | {
     appId: string;
     authTime: number;
@@ -112,7 +112,7 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     scope: string;
     state?: string;
     status: "completed";
-    txnCookieHash?: string;
+    txnCookieHash: string;
 }, [import("convex/values").VObject<{
     appId: string;
     clientId: string;
@@ -126,7 +126,7 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     scope: string;
     state?: string;
     status: "pending";
-    txnCookieHash?: string;
+    txnCookieHash: string;
 }, {
     requestId: import("convex/values").VString<string, "required">;
     appId: import("convex/values").VString<string, "required">;
@@ -139,11 +139,11 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
     freshLogin: import("convex/values").VBoolean<boolean, "required">;
     /**
-     * SHA-256 hex of the request's transaction cookie, set with the chooser page. `/continue`, the
-     * connector callback, and the email steps need the cookie, so only the browser that saw the
-     * chooser can move the request on. Absent when /authorize skipped the chooser.
+     * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue`, the connector
+     * callback, and the email steps need the cookie, so only the browser that started the request can
+     * move it on.
      */
-    txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
+    txnCookieHash: import("convex/values").VString<string, "required">;
     createdAt: import("convex/values").VFloat64<number, "required">;
     expiresAt: import("convex/values").VFloat64<number, "required">;
     status: import("convex/values").VLiteral<"pending", "required">;
@@ -161,7 +161,7 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     scope: string;
     state?: string;
     status: "upstream";
-    txnCookieHash?: string;
+    txnCookieHash: string;
     upstreamCodeVerifier: string;
     upstreamNonce?: string;
     upstreamStateHash: string;
@@ -177,11 +177,11 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
     freshLogin: import("convex/values").VBoolean<boolean, "required">;
     /**
-     * SHA-256 hex of the request's transaction cookie, set with the chooser page. `/continue`, the
-     * connector callback, and the email steps need the cookie, so only the browser that saw the
-     * chooser can move the request on. Absent when /authorize skipped the chooser.
+     * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue`, the connector
+     * callback, and the email steps need the cookie, so only the browser that started the request can
+     * move it on.
      */
-    txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
+    txnCookieHash: import("convex/values").VString<string, "required">;
     createdAt: import("convex/values").VFloat64<number, "required">;
     expiresAt: import("convex/values").VFloat64<number, "required">;
     status: import("convex/values").VLiteral<"upstream", "required">;
@@ -203,7 +203,7 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     scope: string;
     state?: string;
     status: "claimed";
-    txnCookieHash?: string;
+    txnCookieHash: string;
 }, {
     requestId: import("convex/values").VString<string, "required">;
     appId: import("convex/values").VString<string, "required">;
@@ -216,11 +216,11 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
     freshLogin: import("convex/values").VBoolean<boolean, "required">;
     /**
-     * SHA-256 hex of the request's transaction cookie, set with the chooser page. `/continue`, the
-     * connector callback, and the email steps need the cookie, so only the browser that saw the
-     * chooser can move the request on. Absent when /authorize skipped the chooser.
+     * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue`, the connector
+     * callback, and the email steps need the cookie, so only the browser that started the request can
+     * move it on.
      */
-    txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
+    txnCookieHash: import("convex/values").VString<string, "required">;
     createdAt: import("convex/values").VFloat64<number, "required">;
     expiresAt: import("convex/values").VFloat64<number, "required">;
     status: import("convex/values").VLiteral<"claimed", "required">;
@@ -245,7 +245,7 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     scope: string;
     state?: string;
     status: "emailSent";
-    txnCookieHash?: string;
+    txnCookieHash: string;
 }, {
     requestId: import("convex/values").VString<string, "required">;
     appId: import("convex/values").VString<string, "required">;
@@ -258,11 +258,11 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
     freshLogin: import("convex/values").VBoolean<boolean, "required">;
     /**
-     * SHA-256 hex of the request's transaction cookie, set with the chooser page. `/continue`, the
-     * connector callback, and the email steps need the cookie, so only the browser that saw the
-     * chooser can move the request on. Absent when /authorize skipped the chooser.
+     * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue`, the connector
+     * callback, and the email steps need the cookie, so only the browser that started the request can
+     * move it on.
      */
-    txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
+    txnCookieHash: import("convex/values").VString<string, "required">;
     createdAt: import("convex/values").VFloat64<number, "required">;
     expiresAt: import("convex/values").VFloat64<number, "required">;
     status: import("convex/values").VLiteral<"emailSent", "required">;
@@ -297,7 +297,7 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     scope: string;
     state?: string;
     status: "completed";
-    txnCookieHash?: string;
+    txnCookieHash: string;
 }, {
     requestId: import("convex/values").VString<string, "required">;
     appId: import("convex/values").VString<string, "required">;
@@ -310,11 +310,11 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
     freshLogin: import("convex/values").VBoolean<boolean, "required">;
     /**
-     * SHA-256 hex of the request's transaction cookie, set with the chooser page. `/continue`, the
-     * connector callback, and the email steps need the cookie, so only the browser that saw the
-     * chooser can move the request on. Absent when /authorize skipped the chooser.
+     * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue`, the connector
+     * callback, and the email steps need the cookie, so only the browser that started the request can
+     * move it on.
      */
-    txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
+    txnCookieHash: import("convex/values").VString<string, "required">;
     createdAt: import("convex/values").VFloat64<number, "required">;
     expiresAt: import("convex/values").VFloat64<number, "required">;
     status: import("convex/values").VLiteral<"completed", "required">;
@@ -392,7 +392,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
         scope: string;
         state?: string;
         status: "pending";
-        txnCookieHash?: string;
+        txnCookieHash: string;
     } | {
         appId: string;
         clientId: string;
@@ -407,7 +407,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
         scope: string;
         state?: string;
         status: "upstream";
-        txnCookieHash?: string;
+        txnCookieHash: string;
         upstreamCodeVerifier: string;
         upstreamNonce?: string;
         upstreamStateHash: string;
@@ -425,7 +425,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
         scope: string;
         state?: string;
         status: "claimed";
-        txnCookieHash?: string;
+        txnCookieHash: string;
     } | {
         appId: string;
         clientId: string;
@@ -446,7 +446,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
         scope: string;
         state?: string;
         status: "emailSent";
-        txnCookieHash?: string;
+        txnCookieHash: string;
     } | {
         appId: string;
         authTime: number;
@@ -469,7 +469,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
         scope: string;
         state?: string;
         status: "completed";
-        txnCookieHash?: string;
+        txnCookieHash: string;
     }, [import("convex/values").VObject<{
         appId: string;
         clientId: string;
@@ -483,7 +483,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
         scope: string;
         state?: string;
         status: "pending";
-        txnCookieHash?: string;
+        txnCookieHash: string;
     }, {
         requestId: import("convex/values").VString<string, "required">;
         appId: import("convex/values").VString<string, "required">;
@@ -496,11 +496,11 @@ declare const _default: import("convex/server").SchemaDefinition<{
         /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
         freshLogin: import("convex/values").VBoolean<boolean, "required">;
         /**
-         * SHA-256 hex of the request's transaction cookie, set with the chooser page. `/continue`, the
-         * connector callback, and the email steps need the cookie, so only the browser that saw the
-         * chooser can move the request on. Absent when /authorize skipped the chooser.
+         * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue`, the connector
+         * callback, and the email steps need the cookie, so only the browser that started the request can
+         * move it on.
          */
-        txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
+        txnCookieHash: import("convex/values").VString<string, "required">;
         createdAt: import("convex/values").VFloat64<number, "required">;
         expiresAt: import("convex/values").VFloat64<number, "required">;
         status: import("convex/values").VLiteral<"pending", "required">;
@@ -518,7 +518,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
         scope: string;
         state?: string;
         status: "upstream";
-        txnCookieHash?: string;
+        txnCookieHash: string;
         upstreamCodeVerifier: string;
         upstreamNonce?: string;
         upstreamStateHash: string;
@@ -534,11 +534,11 @@ declare const _default: import("convex/server").SchemaDefinition<{
         /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
         freshLogin: import("convex/values").VBoolean<boolean, "required">;
         /**
-         * SHA-256 hex of the request's transaction cookie, set with the chooser page. `/continue`, the
-         * connector callback, and the email steps need the cookie, so only the browser that saw the
-         * chooser can move the request on. Absent when /authorize skipped the chooser.
+         * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue`, the connector
+         * callback, and the email steps need the cookie, so only the browser that started the request can
+         * move it on.
          */
-        txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
+        txnCookieHash: import("convex/values").VString<string, "required">;
         createdAt: import("convex/values").VFloat64<number, "required">;
         expiresAt: import("convex/values").VFloat64<number, "required">;
         status: import("convex/values").VLiteral<"upstream", "required">;
@@ -560,7 +560,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
         scope: string;
         state?: string;
         status: "claimed";
-        txnCookieHash?: string;
+        txnCookieHash: string;
     }, {
         requestId: import("convex/values").VString<string, "required">;
         appId: import("convex/values").VString<string, "required">;
@@ -573,11 +573,11 @@ declare const _default: import("convex/server").SchemaDefinition<{
         /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
         freshLogin: import("convex/values").VBoolean<boolean, "required">;
         /**
-         * SHA-256 hex of the request's transaction cookie, set with the chooser page. `/continue`, the
-         * connector callback, and the email steps need the cookie, so only the browser that saw the
-         * chooser can move the request on. Absent when /authorize skipped the chooser.
+         * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue`, the connector
+         * callback, and the email steps need the cookie, so only the browser that started the request can
+         * move it on.
          */
-        txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
+        txnCookieHash: import("convex/values").VString<string, "required">;
         createdAt: import("convex/values").VFloat64<number, "required">;
         expiresAt: import("convex/values").VFloat64<number, "required">;
         status: import("convex/values").VLiteral<"claimed", "required">;
@@ -602,7 +602,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
         scope: string;
         state?: string;
         status: "emailSent";
-        txnCookieHash?: string;
+        txnCookieHash: string;
     }, {
         requestId: import("convex/values").VString<string, "required">;
         appId: import("convex/values").VString<string, "required">;
@@ -615,11 +615,11 @@ declare const _default: import("convex/server").SchemaDefinition<{
         /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
         freshLogin: import("convex/values").VBoolean<boolean, "required">;
         /**
-         * SHA-256 hex of the request's transaction cookie, set with the chooser page. `/continue`, the
-         * connector callback, and the email steps need the cookie, so only the browser that saw the
-         * chooser can move the request on. Absent when /authorize skipped the chooser.
+         * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue`, the connector
+         * callback, and the email steps need the cookie, so only the browser that started the request can
+         * move it on.
          */
-        txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
+        txnCookieHash: import("convex/values").VString<string, "required">;
         createdAt: import("convex/values").VFloat64<number, "required">;
         expiresAt: import("convex/values").VFloat64<number, "required">;
         status: import("convex/values").VLiteral<"emailSent", "required">;
@@ -654,7 +654,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
         scope: string;
         state?: string;
         status: "completed";
-        txnCookieHash?: string;
+        txnCookieHash: string;
     }, {
         requestId: import("convex/values").VString<string, "required">;
         appId: import("convex/values").VString<string, "required">;
@@ -667,11 +667,11 @@ declare const _default: import("convex/server").SchemaDefinition<{
         /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
         freshLogin: import("convex/values").VBoolean<boolean, "required">;
         /**
-         * SHA-256 hex of the request's transaction cookie, set with the chooser page. `/continue`, the
-         * connector callback, and the email steps need the cookie, so only the browser that saw the
-         * chooser can move the request on. Absent when /authorize skipped the chooser.
+         * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue`, the connector
+         * callback, and the email steps need the cookie, so only the browser that started the request can
+         * move it on.
          */
-        txnCookieHash: import("convex/values").VString<string | undefined, "optional">;
+        txnCookieHash: import("convex/values").VString<string, "required">;
         createdAt: import("convex/values").VFloat64<number, "required">;
         expiresAt: import("convex/values").VFloat64<number, "required">;
         status: import("convex/values").VLiteral<"completed", "required">;

package/dist/component/schema.js

@@ -31,11 +31,11 @@ const authRequestFields = {
     /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
     freshLogin: boolean(),
     /**
-     * SHA-256 hex of the request's transaction cookie, set with the chooser page. `/continue`, the
-     * connector callback, and the email steps need the cookie, so only the browser that saw the
-     * chooser can move the request on. Absent when /authorize skipped the chooser.
+     * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue`, the connector
+     * callback, and the email steps need the cookie, so only the browser that started the request can
+     * move it on.
      */
-    txnCookieHash: optional(string()),
+    txnCookieHash: string(),
     createdAt: number(),
     expiresAt: number(),
 };

package/dist/component/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/component/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,CAAC,EAAE,MAAM,eAAe,CAAC;AAElC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;AAE/E,8FAA8F;AAC9F,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAC3C,OAAO,CAAC,oBAAoB,CAAC,EAC7B,OAAO,CAAC,qBAAqB,CAAC,CAC/B,CAAC;AAEF,0CAA0C;AAC1C,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAClC,OAAO,CAAC,YAAY,CAAC,EACrB,OAAO,CAAC,aAAa,CAAC,EACtB,OAAO,CAAC,SAAS,CAAC,CACnB,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;IACtC,SAAS,EAAE,MAAM,EAAE;IACnB,UAAU,EAAE,MAAM,EAAE;IACpB,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAClC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CAC5B,CAAC,CAAC;AAEH,4FAA4F;AAC5F,MAAM,iBAAiB,GAAG;IACxB,SAAS,EAAE,MAAM,EAAE;IACnB,KAAK,EAAE,MAAM,EAAE;IACf,QAAQ,EAAE,MAAM,EAAE;IAClB,WAAW,EAAE,MAAM,EAAE;IACrB,KAAK,EAAE,MAAM,EAAE;IACf,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzB,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,EAAE;IACvB,yFAAyF;IACzF,UAAU,EAAE,OAAO,EAAE;IACrB;;;;OAIG;IACH,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACjC,SAAS,EAAE,MAAM,EAAE;IACnB,SAAS,EAAE,MAAM,EAAE;CACpB,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK;AAC/B,iEAAiE;AACjE,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,iBAAiB,EAAE,CAAC;AAC5D,+FAA+F;AAC/F,MAAM,CAAC;IACL,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC;IAC3B,GAAG,iBAAiB;IACpB,SAAS,EAAE,MAAM,EAAE;IACnB,iBAAiB,EAAE,MAAM,EAAE;IAC3B,oBAAoB,EAAE,MAAM,EAAE;IAC9B,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CAClC,CAAC;AACF,kGAAkG;AAClG,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,iBAAiB,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;AACjF,8FAA8F;AAC9F,MAAM,CAAC;IACL,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC;IAC5B,GAAG,iBAAiB;IACpB,SAAS,EAAE,MAAM,EAAE;IACnB,KAAK,EAAE,MAAM,EAAE;IACf,aAAa,EAAE,MAAM,EAAE;IACvB,kBAAkB,EAAE,MAAM,EAAE;IAC5B,kEAAkE;IAClE,aAAa,EAAE,MAAM,EAAE;IACvB,mCAAmC;IACnC,UAAU,EAAE,MAAM,EAAE;IACpB,eAAe,EAAE,MAAM,EAAE;CAC1B,CAAC;AACF,iGAAiG;AACjG,MAAM,CAAC;IACL,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC;IAC5B,GAAG,iBAAiB;IACpB,QAAQ,EAAE,iBAAiB;IAC3B,QAAQ,EAAE,MAAM,EAAE;CACnB,CAAC,CACH,CAAC;AAEF,eAAe,YAAY,CAAC;IAC1B,IAAI,EAAE,WAAW,CAAC;QAChB,KAAK,EAAE,MAAM,EAAE;QACf,IAAI,EAAE,MAAM,EAAE;QACd,UAAU,EAAE,OAAO,EAAE;QACrB,yEAAyE;QACzE,oBAAoB,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/C,SAAS,EAAE,MAAM,EAAE;KACpB,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC;IAEhC,OAAO,EAAE,WAAW,CAAC;QACnB,QAAQ,EAAE,MAAM,EAAE;QAClB,KAAK,EAAE,MAAM,EAAE;QACf,UAAU,EAAE,MAAM,EAAE;QACpB,uBAAuB,EAAE,wBAAwB;QACjD,WAAW,EAAE,MAAM,EAAE;QACrB,cAAc,EAAE,eAAe;QAC/B,UAAU,EAAE,MAAM,EAAE;QACpB,eAAe,EAAE,MAAM,EAAE;QACzB,SAAS,EAAE,MAAM,EAAE;QACnB,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;KACjC,CAAC;SACC,KAAK,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,CAAC;SACnC,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC;SAC7B,KAAK,CAAC,oBAAoB,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAElD,YAAY,EAAE,WAAW,CAAC,YAAY,CAAC;SACpC,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;SACrC,KAAK,CAAC,wBAAwB,EAAE,CAAC,mBAAmB,CAAC,CAAC;SACtD,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;IAExC,kBAAkB,EAAE,WAAW,CAAC;QAC9B,QAAQ,EAAE,MAAM,EAAE;QAClB,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC;QACnC,QAAQ,EAAE,MAAM,EAAE;QAClB,SAAS,EAAE,MAAM,EAAE;QACnB,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;KAC3B,CAAC;SACC,KAAK,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,CAAC;SACnC,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;IAExC,gGAAgG;IAChG,UAAU,EAAE,WAAW,CAAC;QACtB,4CAA4C;QAC5C,SAAS,EAAE,MAAM,EAAE;QACnB,EAAE,EAAE,MAAM,EAAE;KACb,CAAC;SACC,KAAK,CAAC,sBAAsB,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;SAClD,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAEzB,OAAO,EAAE,WAAW,CAAC;QACnB,KAAK,EAAE,MAAM,EAAE;QACf,QAAQ,EAAE,MAAM,EAAE;QAClB,SAAS,EAAE,MAAM,EAAE;QACnB,GAAG,EAAE,MAAM,EAAE;QACb,EAAE,EAAE,MAAM,EAAE;KACb,CAAC;SACC,KAAK,CAAC,kBAAkB,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;SAC1C,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;CAC1B,CAAC,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/component/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,CAAC,EAAE,MAAM,eAAe,CAAC;AAElC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;AAE/E,8FAA8F;AAC9F,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAC3C,OAAO,CAAC,oBAAoB,CAAC,EAC7B,OAAO,CAAC,qBAAqB,CAAC,CAC/B,CAAC;AAEF,0CAA0C;AAC1C,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAClC,OAAO,CAAC,YAAY,CAAC,EACrB,OAAO,CAAC,aAAa,CAAC,EACtB,OAAO,CAAC,SAAS,CAAC,CACnB,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;IACtC,SAAS,EAAE,MAAM,EAAE;IACnB,UAAU,EAAE,MAAM,EAAE;IACpB,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAClC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CAC5B,CAAC,CAAC;AAEH,4FAA4F;AAC5F,MAAM,iBAAiB,GAAG;IACxB,SAAS,EAAE,MAAM,EAAE;IACnB,KAAK,EAAE,MAAM,EAAE;IACf,QAAQ,EAAE,MAAM,EAAE;IAClB,WAAW,EAAE,MAAM,EAAE;IACrB,KAAK,EAAE,MAAM,EAAE;IACf,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzB,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,EAAE;IACvB,yFAAyF;IACzF,UAAU,EAAE,OAAO,EAAE;IACrB;;;;OAIG;IACH,aAAa,EAAE,MAAM,EAAE;IACvB,SAAS,EAAE,MAAM,EAAE;IACnB,SAAS,EAAE,MAAM,EAAE;CACpB,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK;AAC/B,iEAAiE;AACjE,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,iBAAiB,EAAE,CAAC;AAC5D,+FAA+F;AAC/F,MAAM,CAAC;IACL,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC;IAC3B,GAAG,iBAAiB;IACpB,SAAS,EAAE,MAAM,EAAE;IACnB,iBAAiB,EAAE,MAAM,EAAE;IAC3B,oBAAoB,EAAE,MAAM,EAAE;IAC9B,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CAClC,CAAC;AACF,kGAAkG;AAClG,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,iBAAiB,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;AACjF,8FAA8F;AAC9F,MAAM,CAAC;IACL,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC;IAC5B,GAAG,iBAAiB;IACpB,SAAS,EAAE,MAAM,EAAE;IACnB,KAAK,EAAE,MAAM,EAAE;IACf,aAAa,EAAE,MAAM,EAAE;IACvB,kBAAkB,EAAE,MAAM,EAAE;IAC5B,kEAAkE;IAClE,aAAa,EAAE,MAAM,EAAE;IACvB,mCAAmC;IACnC,UAAU,EAAE,MAAM,EAAE;IACpB,eAAe,EAAE,MAAM,EAAE;CAC1B,CAAC;AACF,iGAAiG;AACjG,MAAM,CAAC;IACL,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC;IAC5B,GAAG,iBAAiB;IACpB,QAAQ,EAAE,iBAAiB;IAC3B,QAAQ,EAAE,MAAM,EAAE;CACnB,CAAC,CACH,CAAC;AAEF,eAAe,YAAY,CAAC;IAC1B,IAAI,EAAE,WAAW,CAAC;QAChB,KAAK,EAAE,MAAM,EAAE;QACf,IAAI,EAAE,MAAM,EAAE;QACd,UAAU,EAAE,OAAO,EAAE;QACrB,yEAAyE;QACzE,oBAAoB,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/C,SAAS,EAAE,MAAM,EAAE;KACpB,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC;IAEhC,OAAO,EAAE,WAAW,CAAC;QACnB,QAAQ,EAAE,MAAM,EAAE;QAClB,KAAK,EAAE,MAAM,EAAE;QACf,UAAU,EAAE,MAAM,EAAE;QACpB,uBAAuB,EAAE,wBAAwB;QACjD,WAAW,EAAE,MAAM,EAAE;QACrB,cAAc,EAAE,eAAe;QAC/B,UAAU,EAAE,MAAM,EAAE;QACpB,eAAe,EAAE,MAAM,EAAE;QACzB,SAAS,EAAE,MAAM,EAAE;QACnB,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;KACjC,CAAC;SACC,KAAK,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,CAAC;SACnC,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC;SAC7B,KAAK,CAAC,oBAAoB,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAElD,YAAY,EAAE,WAAW,CAAC,YAAY,CAAC;SACpC,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;SACrC,KAAK,CAAC,wBAAwB,EAAE,CAAC,mBAAmB,CAAC,CAAC;SACtD,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;IAExC,kBAAkB,EAAE,WAAW,CAAC;QAC9B,QAAQ,EAAE,MAAM,EAAE;QAClB,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC;QACnC,QAAQ,EAAE,MAAM,EAAE;QAClB,SAAS,EAAE,MAAM,EAAE;QACnB,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;KAC3B,CAAC;SACC,KAAK,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,CAAC;SACnC,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;IAExC,gGAAgG;IAChG,UAAU,EAAE,WAAW,CAAC;QACtB,4CAA4C;QAC5C,SAAS,EAAE,MAAM,EAAE;QACnB,EAAE,EAAE,MAAM,EAAE;KACb,CAAC;SACC,KAAK,CAAC,sBAAsB,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;SAClD,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAEzB,OAAO,EAAE,WAAW,CAAC;QACnB,KAAK,EAAE,MAAM,EAAE;QACf,QAAQ,EAAE,MAAM,EAAE;QAClB,SAAS,EAAE,MAAM,EAAE;QACnB,GAAG,EAAE,MAAM,EAAE;QACb,EAAE,EAAE,MAAM,EAAE;KACb,CAAC;SACC,KAAK,CAAC,kBAAkB,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;SAC1C,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;CAC1B,CAAC,CAAC"}

package/dist/component/signIns.js

@@ -1,4 +1,5 @@
 import { v } from "convex/values";
+// oxlint-disable-next-line samebase/no-raw-public-convex-function-builders -- Component entrypoints are internal to the host; host functions enforce access.
 import { mutation } from "./_generated/server";
 const { number, string } = v;
 /** One audit row per issued id_token: no email, no name, no token. Also marks the client as used. */

package/dist/component/signIns.js.map

@@ -1 +1 @@
-{"version":3,"file":"signIns.js","sourceRoot":"","sources":["../../src/component/signIns.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,eAAe,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE/C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;AAE7B,qGAAqG;AACrG,MAAM,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAC;IAC7B,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE;IAC/F,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE;IACjB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,EAAE,EAAE,IAAI,CAAC,EAAE;SACZ,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,EAAE;aACxB,KAAK,CAAC,SAAS,CAAC;aAChB,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;aACjE,MAAM,EAAE,CAAC;QACZ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"signIns.js","sourceRoot":"","sources":["../../src/component/signIns.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,eAAe,CAAC;AAClC,6JAA6J;AAC7J,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE/C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;AAE7B,qGAAqG;AACrG,MAAM,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAC;IAC7B,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE;IAC/F,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE;IACjB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,EAAE,EAAE,IAAI,CAAC,EAAE;SACZ,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,EAAE;aACxB,KAAK,CAAC,SAAS,CAAC;aAChB,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;aACjE,MAAM,EAAE,CAAC;QACZ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC,CAAC"}

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@samebase/identity-broker",
-  "version": "0.8.0",
+  "version": "0.9.1",
   "description": "An OpenID Provider for Convex that holds a team's upstream sign-in connections once and keeps no user accounts.",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/samebase/identity-broker.git",
+    "url": "git+https://github.com/samebase/samebase.git",
     "directory": "packages/identity-broker"
   },
   "bin": {
@@ -37,7 +37,7 @@
   },
   "devDependencies": {
     "@types/node": "24.19.2",
-    "convex": "1.47.0",
+    "convex": "1.48.0",
     "convex-test": "0.0.61",
     "openid-client": "6.8.8",
     "typescript": "7.0.2",
@@ -46,9 +46,15 @@
   "peerDependencies": {
     "convex": "^1.47.0"
   },
+  "engines": {
+    "node": ">=24.11.0"
+  },
   "scripts": {
     "build": "tsc --build ./tsconfig.build.json --force",
     "codegen": "convex codegen --component-dir ./src/component",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --noEmit",
+    "lint": "pnpm --dir ../.. exec vp lint --tsconfig packages/identity-broker/tsconfig.json --report-unused-disable-directives packages/identity-broker/src",
+    "test": "pnpm --dir ../.. exec vp test run --project identity-broker",
+    "check": "pnpm run typecheck && pnpm run lint && pnpm run test"
   }
 }

package/dist/component/crypto.d.ts

@@ -1,2 +0,0 @@
-/** SHA-256 of `input`, base64url without padding: the PKCE S256 transform of RFC 7636. */
-export declare function sha256Base64Url(input: string): Promise<string>;

package/dist/component/crypto.js

@@ -1,9 +0,0 @@
-/** SHA-256 of `input`, base64url without padding: the PKCE S256 transform of RFC 7636. */
-export async function sha256Base64Url(input) {
-    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(input));
-    return btoa(String.fromCharCode(...new Uint8Array(digest)))
-        .replace(/\+/g, "-")
-        .replace(/\//g, "_")
-        .replace(/=+$/, "");
-}
-//# sourceMappingURL=crypto.js.map

package/dist/component/crypto.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/component/crypto.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa;IACjD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtF,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;SACxD,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC"}