@samebase/identity-broker 0.9.3 → 0.10.0

package/dist/component/schema.d.ts

@@ -4,8 +4,8 @@ export declare const vTokenEndpointAuthMethod: import("convex/values").VUnion<"c
 export declare const vDeploymentType: import("convex/values").VUnion<"development" | "preview" | "production", [import("convex/values").VLiteral<"production", "required">, import("convex/values").VLiteral<"development", "required">, import("convex/values").VLiteral<"preview", "required">], "required", never>;
 /**
  * What a connector attested about the user. `upstreamId` is the connector's own stable id for the
- * account (the GitHub user id, the OIDC `sub`, the canonical email address). The pairwise subject
- * is derived from it on the host, where the salt lives.
+ * account (the GitHub user id, the OIDC `sub`). The pairwise subject is derived from it on the host,
+ * where the salt lives.
  */
 export declare const vUpstreamIdentity: import("convex/values").VObject<{
     connector: string;
@@ -69,27 +69,6 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     state?: string;
     status: "claimed";
     txnCookieHash: string;
-} | {
-    appId: string;
-    clientId: string;
-    codeChallenge: string;
-    connector: string;
-    createdAt: number;
-    email: string;
-    emailAttempts: number;
-    emailCodeExpiresAt: number;
-    emailCodeHash: string;
-    emailLastSentAt: number;
-    emailSends: number;
-    expiresAt: number;
-    freshLogin: boolean;
-    nonce?: string;
-    redirectUri: string;
-    requestId: string;
-    scope: string;
-    state?: string;
-    status: "emailSent";
-    txnCookieHash: string;
 } | {
     appId: string;
     authTime: number;
@@ -139,9 +118,8 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
     freshLogin: import("convex/values").VBoolean<boolean, "required">;
     /**
-     * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue`, the connector
-     * callback, and the email steps need the cookie, so only the browser that started the request can
-     * move it on.
+     * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue` and the
+     * connector callback need the cookie, so only the browser that started the request can move it on.
      */
     txnCookieHash: import("convex/values").VString<string, "required">;
     createdAt: import("convex/values").VFloat64<number, "required">;
@@ -177,9 +155,8 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
     freshLogin: import("convex/values").VBoolean<boolean, "required">;
     /**
-     * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue`, the connector
-     * callback, and the email steps need the cookie, so only the browser that started the request can
-     * move it on.
+     * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue` and the
+     * connector callback need the cookie, so only the browser that started the request can move it on.
      */
     txnCookieHash: import("convex/values").VString<string, "required">;
     createdAt: import("convex/values").VFloat64<number, "required">;
@@ -216,9 +193,8 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
     freshLogin: import("convex/values").VBoolean<boolean, "required">;
     /**
-     * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue`, the connector
-     * callback, and the email steps need the cookie, so only the browser that started the request can
-     * move it on.
+     * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue` and the
+     * connector callback need the cookie, so only the browser that started the request can move it on.
      */
     txnCookieHash: import("convex/values").VString<string, "required">;
     createdAt: import("convex/values").VFloat64<number, "required">;
@@ -226,56 +202,6 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     status: import("convex/values").VLiteral<"claimed", "required">;
     connector: import("convex/values").VString<string, "required">;
 }, "required", "appId" | "clientId" | "codeChallenge" | "connector" | "createdAt" | "expiresAt" | "freshLogin" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash">, import("convex/values").VObject<{
-    appId: string;
-    clientId: string;
-    codeChallenge: string;
-    connector: string;
-    createdAt: number;
-    email: string;
-    emailAttempts: number;
-    emailCodeExpiresAt: number;
-    emailCodeHash: string;
-    emailLastSentAt: number;
-    emailSends: number;
-    expiresAt: number;
-    freshLogin: boolean;
-    nonce?: string;
-    redirectUri: string;
-    requestId: string;
-    scope: string;
-    state?: string;
-    status: "emailSent";
-    txnCookieHash: string;
-}, {
-    requestId: import("convex/values").VString<string, "required">;
-    appId: import("convex/values").VString<string, "required">;
-    clientId: import("convex/values").VString<string, "required">;
-    redirectUri: import("convex/values").VString<string, "required">;
-    scope: import("convex/values").VString<string, "required">;
-    state: import("convex/values").VString<string | undefined, "optional">;
-    nonce: import("convex/values").VString<string | undefined, "optional">;
-    codeChallenge: import("convex/values").VString<string, "required">;
-    /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
-    freshLogin: import("convex/values").VBoolean<boolean, "required">;
-    /**
-     * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue`, the connector
-     * callback, and the email steps need the cookie, so only the browser that started the request can
-     * move it on.
-     */
-    txnCookieHash: import("convex/values").VString<string, "required">;
-    createdAt: import("convex/values").VFloat64<number, "required">;
-    expiresAt: import("convex/values").VFloat64<number, "required">;
-    status: import("convex/values").VLiteral<"emailSent", "required">;
-    connector: import("convex/values").VString<string, "required">;
-    email: import("convex/values").VString<string, "required">;
-    emailCodeHash: import("convex/values").VString<string, "required">;
-    emailCodeExpiresAt: import("convex/values").VFloat64<number, "required">;
-    /** Wrong codes typed, across every code sent for this request. */
-    emailAttempts: import("convex/values").VFloat64<number, "required">;
-    /** Codes sent for this request. */
-    emailSends: import("convex/values").VFloat64<number, "required">;
-    emailLastSentAt: import("convex/values").VFloat64<number, "required">;
-}, "required", "appId" | "clientId" | "codeChallenge" | "connector" | "createdAt" | "email" | "emailAttempts" | "emailCodeExpiresAt" | "emailCodeHash" | "emailLastSentAt" | "emailSends" | "expiresAt" | "freshLogin" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash">, import("convex/values").VObject<{
     appId: string;
     authTime: number;
     clientId: string;
@@ -310,9 +236,8 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
     /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
     freshLogin: import("convex/values").VBoolean<boolean, "required">;
     /**
-     * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue`, the connector
-     * callback, and the email steps need the cookie, so only the browser that started the request can
-     * move it on.
+     * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue` and the
+     * connector callback need the cookie, so only the browser that started the request can move it on.
      */
     txnCookieHash: import("convex/values").VString<string, "required">;
     createdAt: import("convex/values").VFloat64<number, "required">;
@@ -334,7 +259,7 @@ export declare const vAuthRequest: import("convex/values").VUnion<{
         picture: import("convex/values").VString<string | undefined, "optional">;
     }, "required", "connector" | "email" | "emailVerified" | "name" | "picture" | "upstreamId">;
     authTime: import("convex/values").VFloat64<number, "required">;
-}, "required", "appId" | "authTime" | "clientId" | "codeChallenge" | "createdAt" | "expiresAt" | "freshLogin" | "identity" | "identity.connector" | "identity.email" | "identity.emailVerified" | "identity.name" | "identity.picture" | "identity.upstreamId" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash">], "required", "appId" | "authTime" | "clientId" | "codeChallenge" | "connector" | "createdAt" | "email" | "emailAttempts" | "emailCodeExpiresAt" | "emailCodeHash" | "emailLastSentAt" | "emailSends" | "expiresAt" | "freshLogin" | "identity" | "identity.connector" | "identity.email" | "identity.emailVerified" | "identity.name" | "identity.picture" | "identity.upstreamId" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash" | "upstreamCodeVerifier" | "upstreamNonce" | "upstreamStateHash">;
+}, "required", "appId" | "authTime" | "clientId" | "codeChallenge" | "createdAt" | "expiresAt" | "freshLogin" | "identity" | "identity.connector" | "identity.email" | "identity.emailVerified" | "identity.name" | "identity.picture" | "identity.upstreamId" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash">], "required", "appId" | "authTime" | "clientId" | "codeChallenge" | "connector" | "createdAt" | "expiresAt" | "freshLogin" | "identity" | "identity.connector" | "identity.email" | "identity.emailVerified" | "identity.name" | "identity.picture" | "identity.upstreamId" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash" | "upstreamCodeVerifier" | "upstreamNonce" | "upstreamStateHash">;
 declare const _default: import("convex/server").SchemaDefinition<{
     apps: import("convex/server").TableDefinition<import("convex/values").VObject<{
         allowedCallbackHosts?: string[];
@@ -426,27 +351,6 @@ declare const _default: import("convex/server").SchemaDefinition<{
         state?: string;
         status: "claimed";
         txnCookieHash: string;
-    } | {
-        appId: string;
-        clientId: string;
-        codeChallenge: string;
-        connector: string;
-        createdAt: number;
-        email: string;
-        emailAttempts: number;
-        emailCodeExpiresAt: number;
-        emailCodeHash: string;
-        emailLastSentAt: number;
-        emailSends: number;
-        expiresAt: number;
-        freshLogin: boolean;
-        nonce?: string;
-        redirectUri: string;
-        requestId: string;
-        scope: string;
-        state?: string;
-        status: "emailSent";
-        txnCookieHash: string;
     } | {
         appId: string;
         authTime: number;
@@ -496,9 +400,8 @@ declare const _default: import("convex/server").SchemaDefinition<{
         /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
         freshLogin: import("convex/values").VBoolean<boolean, "required">;
         /**
-         * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue`, the connector
-         * callback, and the email steps need the cookie, so only the browser that started the request can
-         * move it on.
+         * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue` and the
+         * connector callback need the cookie, so only the browser that started the request can move it on.
          */
         txnCookieHash: import("convex/values").VString<string, "required">;
         createdAt: import("convex/values").VFloat64<number, "required">;
@@ -534,9 +437,8 @@ declare const _default: import("convex/server").SchemaDefinition<{
         /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
         freshLogin: import("convex/values").VBoolean<boolean, "required">;
         /**
-         * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue`, the connector
-         * callback, and the email steps need the cookie, so only the browser that started the request can
-         * move it on.
+         * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue` and the
+         * connector callback need the cookie, so only the browser that started the request can move it on.
          */
         txnCookieHash: import("convex/values").VString<string, "required">;
         createdAt: import("convex/values").VFloat64<number, "required">;
@@ -573,9 +475,8 @@ declare const _default: import("convex/server").SchemaDefinition<{
         /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
         freshLogin: import("convex/values").VBoolean<boolean, "required">;
         /**
-         * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue`, the connector
-         * callback, and the email steps need the cookie, so only the browser that started the request can
-         * move it on.
+         * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue` and the
+         * connector callback need the cookie, so only the browser that started the request can move it on.
          */
         txnCookieHash: import("convex/values").VString<string, "required">;
         createdAt: import("convex/values").VFloat64<number, "required">;
@@ -583,56 +484,6 @@ declare const _default: import("convex/server").SchemaDefinition<{
         status: import("convex/values").VLiteral<"claimed", "required">;
         connector: import("convex/values").VString<string, "required">;
     }, "required", "appId" | "clientId" | "codeChallenge" | "connector" | "createdAt" | "expiresAt" | "freshLogin" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash">, import("convex/values").VObject<{
-        appId: string;
-        clientId: string;
-        codeChallenge: string;
-        connector: string;
-        createdAt: number;
-        email: string;
-        emailAttempts: number;
-        emailCodeExpiresAt: number;
-        emailCodeHash: string;
-        emailLastSentAt: number;
-        emailSends: number;
-        expiresAt: number;
-        freshLogin: boolean;
-        nonce?: string;
-        redirectUri: string;
-        requestId: string;
-        scope: string;
-        state?: string;
-        status: "emailSent";
-        txnCookieHash: string;
-    }, {
-        requestId: import("convex/values").VString<string, "required">;
-        appId: import("convex/values").VString<string, "required">;
-        clientId: import("convex/values").VString<string, "required">;
-        redirectUri: import("convex/values").VString<string, "required">;
-        scope: import("convex/values").VString<string, "required">;
-        state: import("convex/values").VString<string | undefined, "optional">;
-        nonce: import("convex/values").VString<string | undefined, "optional">;
-        codeChallenge: import("convex/values").VString<string, "required">;
-        /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
-        freshLogin: import("convex/values").VBoolean<boolean, "required">;
-        /**
-         * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue`, the connector
-         * callback, and the email steps need the cookie, so only the browser that started the request can
-         * move it on.
-         */
-        txnCookieHash: import("convex/values").VString<string, "required">;
-        createdAt: import("convex/values").VFloat64<number, "required">;
-        expiresAt: import("convex/values").VFloat64<number, "required">;
-        status: import("convex/values").VLiteral<"emailSent", "required">;
-        connector: import("convex/values").VString<string, "required">;
-        email: import("convex/values").VString<string, "required">;
-        emailCodeHash: import("convex/values").VString<string, "required">;
-        emailCodeExpiresAt: import("convex/values").VFloat64<number, "required">;
-        /** Wrong codes typed, across every code sent for this request. */
-        emailAttempts: import("convex/values").VFloat64<number, "required">;
-        /** Codes sent for this request. */
-        emailSends: import("convex/values").VFloat64<number, "required">;
-        emailLastSentAt: import("convex/values").VFloat64<number, "required">;
-    }, "required", "appId" | "clientId" | "codeChallenge" | "connector" | "createdAt" | "email" | "emailAttempts" | "emailCodeExpiresAt" | "emailCodeHash" | "emailLastSentAt" | "emailSends" | "expiresAt" | "freshLogin" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash">, import("convex/values").VObject<{
         appId: string;
         authTime: number;
         clientId: string;
@@ -667,9 +518,8 @@ declare const _default: import("convex/server").SchemaDefinition<{
         /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
         freshLogin: import("convex/values").VBoolean<boolean, "required">;
         /**
-         * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue`, the connector
-         * callback, and the email steps need the cookie, so only the browser that started the request can
-         * move it on.
+         * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue` and the
+         * connector callback need the cookie, so only the browser that started the request can move it on.
          */
         txnCookieHash: import("convex/values").VString<string, "required">;
         createdAt: import("convex/values").VFloat64<number, "required">;
@@ -691,7 +541,7 @@ declare const _default: import("convex/server").SchemaDefinition<{
             picture: import("convex/values").VString<string | undefined, "optional">;
         }, "required", "connector" | "email" | "emailVerified" | "name" | "picture" | "upstreamId">;
         authTime: import("convex/values").VFloat64<number, "required">;
-    }, "required", "appId" | "authTime" | "clientId" | "codeChallenge" | "createdAt" | "expiresAt" | "freshLogin" | "identity" | "identity.connector" | "identity.email" | "identity.emailVerified" | "identity.name" | "identity.picture" | "identity.upstreamId" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash">], "required", "appId" | "authTime" | "clientId" | "codeChallenge" | "connector" | "createdAt" | "email" | "emailAttempts" | "emailCodeExpiresAt" | "emailCodeHash" | "emailLastSentAt" | "emailSends" | "expiresAt" | "freshLogin" | "identity" | "identity.connector" | "identity.email" | "identity.emailVerified" | "identity.name" | "identity.picture" | "identity.upstreamId" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash" | "upstreamCodeVerifier" | "upstreamNonce" | "upstreamStateHash">, {
+    }, "required", "appId" | "authTime" | "clientId" | "codeChallenge" | "createdAt" | "expiresAt" | "freshLogin" | "identity" | "identity.connector" | "identity.email" | "identity.emailVerified" | "identity.name" | "identity.picture" | "identity.upstreamId" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash">], "required", "appId" | "authTime" | "clientId" | "codeChallenge" | "connector" | "createdAt" | "expiresAt" | "freshLogin" | "identity" | "identity.connector" | "identity.email" | "identity.emailVerified" | "identity.name" | "identity.picture" | "identity.upstreamId" | "nonce" | "redirectUri" | "requestId" | "scope" | "state" | "status" | "txnCookieHash" | "upstreamCodeVerifier" | "upstreamNonce" | "upstreamStateHash">, {
         by_expires_at: ["expiresAt", "_creationTime"];
         by_request_id: ["requestId", "_creationTime"];
         by_upstream_state_hash: ["upstreamStateHash", "_creationTime"];
@@ -712,18 +562,6 @@ declare const _default: import("convex/server").SchemaDefinition<{
         by_code_hash: ["codeHash", "_creationTime"];
         by_expires_at: ["expiresAt", "_creationTime"];
     }, {}, {}>;
-    /** One row per email code sent, kept for the rolling send window; no address, only its hash. */
-    emailSends: import("convex/server").TableDefinition<import("convex/values").VObject<{
-        at: number;
-        emailHash: string;
-    }, {
-        /** SHA-256 hex of the canonical address. */
-        emailHash: import("convex/values").VString<string, "required">;
-        at: import("convex/values").VFloat64<number, "required">;
-    }, "required", "at" | "emailHash">, {
-        by_at: ["at", "_creationTime"];
-        by_email_hash_and_at: ["emailHash", "at", "_creationTime"];
-    }, {}, {}>;
     signIns: import("convex/server").TableDefinition<import("convex/values").VObject<{
         appId: string;
         at: number;

package/dist/component/schema.js

@@ -7,8 +7,8 @@ export const vTokenEndpointAuthMethod = union(literal("client_secret_post"), lit
 export const vDeploymentType = union(literal("production"), literal("development"), literal("preview"));
 /**
  * What a connector attested about the user. `upstreamId` is the connector's own stable id for the
- * account (the GitHub user id, the OIDC `sub`, the canonical email address). The pairwise subject
- * is derived from it on the host, where the salt lives.
+ * account (the GitHub user id, the OIDC `sub`). The pairwise subject is derived from it on the host,
+ * where the salt lives.
  */
 export const vUpstreamIdentity = object({
     connector: string(),
@@ -31,9 +31,8 @@ const authRequestFields = {
     /** `prompt=login` or `max_age` was sent: the connector must reauthenticate or refuse. */
     freshLogin: boolean(),
     /**
-     * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue`, the connector
-     * callback, and the email steps need the cookie, so only the browser that started the request can
-     * move it on.
+     * SHA-256 hex of the request's transaction cookie, set by `/authorize`. `/continue` and the
+     * connector callback need the cookie, so only the browser that started the request can move it on.
      */
     txnCookieHash: string(),
     createdAt: number(),
@@ -53,20 +52,6 @@ object({
 }), 
 // The connector callback arrived and the code exchange is running; a replay finds this and stops.
 object({ status: literal("claimed"), ...authRequestFields, connector: string() }), 
-// An email code was sent; the user types it. A resend replaces the code and keeps the counts.
-object({
-    status: literal("emailSent"),
-    ...authRequestFields,
-    connector: string(),
-    email: string(),
-    emailCodeHash: string(),
-    emailCodeExpiresAt: number(),
-    /** Wrong codes typed, across every code sent for this request. */
-    emailAttempts: number(),
-    /** Codes sent for this request. */
-    emailSends: number(),
-    emailLastSentAt: number(),
-}), 
 // The connector attested the identity; the authorization code points here until it is exchanged.
 object({
     status: literal("completed"),
@@ -111,14 +96,6 @@ export default defineSchema({
     })
         .index("by_code_hash", ["codeHash"])
         .index("by_expires_at", ["expiresAt"]),
-    /** One row per email code sent, kept for the rolling send window; no address, only its hash. */
-    emailSends: defineTable({
-        /** SHA-256 hex of the canonical address. */
-        emailHash: string(),
-        at: number(),
-    })
-        .index("by_email_hash_and_at", ["emailHash", "at"])
-        .index("by_at", ["at"]),
     signIns: defineTable({
         appId: string(),
         clientId: string(),

package/dist/component/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/component/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,CAAC,EAAE,MAAM,eAAe,CAAC;AAElC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;AAE/E,8FAA8F;AAC9F,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAC3C,OAAO,CAAC,oBAAoB,CAAC,EAC7B,OAAO,CAAC,qBAAqB,CAAC,CAC/B,CAAC;AAEF,0CAA0C;AAC1C,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAClC,OAAO,CAAC,YAAY,CAAC,EACrB,OAAO,CAAC,aAAa,CAAC,EACtB,OAAO,CAAC,SAAS,CAAC,CACnB,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;IACtC,SAAS,EAAE,MAAM,EAAE;IACnB,UAAU,EAAE,MAAM,EAAE;IACpB,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAClC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CAC5B,CAAC,CAAC;AAEH,4FAA4F;AAC5F,MAAM,iBAAiB,GAAG;IACxB,SAAS,EAAE,MAAM,EAAE;IACnB,KAAK,EAAE,MAAM,EAAE;IACf,QAAQ,EAAE,MAAM,EAAE;IAClB,WAAW,EAAE,MAAM,EAAE;IACrB,KAAK,EAAE,MAAM,EAAE;IACf,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzB,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,EAAE;IACvB,yFAAyF;IACzF,UAAU,EAAE,OAAO,EAAE;IACrB;;;;OAIG;IACH,aAAa,EAAE,MAAM,EAAE;IACvB,SAAS,EAAE,MAAM,EAAE;IACnB,SAAS,EAAE,MAAM,EAAE;CACpB,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK;AAC/B,iEAAiE;AACjE,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,iBAAiB,EAAE,CAAC;AAC5D,+FAA+F;AAC/F,MAAM,CAAC;IACL,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC;IAC3B,GAAG,iBAAiB;IACpB,SAAS,EAAE,MAAM,EAAE;IACnB,iBAAiB,EAAE,MAAM,EAAE;IAC3B,oBAAoB,EAAE,MAAM,EAAE;IAC9B,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CAClC,CAAC;AACF,kGAAkG;AAClG,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,iBAAiB,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;AACjF,8FAA8F;AAC9F,MAAM,CAAC;IACL,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC;IAC5B,GAAG,iBAAiB;IACpB,SAAS,EAAE,MAAM,EAAE;IACnB,KAAK,EAAE,MAAM,EAAE;IACf,aAAa,EAAE,MAAM,EAAE;IACvB,kBAAkB,EAAE,MAAM,EAAE;IAC5B,kEAAkE;IAClE,aAAa,EAAE,MAAM,EAAE;IACvB,mCAAmC;IACnC,UAAU,EAAE,MAAM,EAAE;IACpB,eAAe,EAAE,MAAM,EAAE;CAC1B,CAAC;AACF,iGAAiG;AACjG,MAAM,CAAC;IACL,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC;IAC5B,GAAG,iBAAiB;IACpB,QAAQ,EAAE,iBAAiB;IAC3B,QAAQ,EAAE,MAAM,EAAE;CACnB,CAAC,CACH,CAAC;AAEF,eAAe,YAAY,CAAC;IAC1B,IAAI,EAAE,WAAW,CAAC;QAChB,KAAK,EAAE,MAAM,EAAE;QACf,IAAI,EAAE,MAAM,EAAE;QACd,UAAU,EAAE,OAAO,EAAE;QACrB,yEAAyE;QACzE,oBAAoB,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/C,SAAS,EAAE,MAAM,EAAE;KACpB,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC;IAEhC,OAAO,EAAE,WAAW,CAAC;QACnB,QAAQ,EAAE,MAAM,EAAE;QAClB,KAAK,EAAE,MAAM,EAAE;QACf,UAAU,EAAE,MAAM,EAAE;QACpB,uBAAuB,EAAE,wBAAwB;QACjD,WAAW,EAAE,MAAM,EAAE;QACrB,cAAc,EAAE,eAAe;QAC/B,UAAU,EAAE,MAAM,EAAE;QACpB,eAAe,EAAE,MAAM,EAAE;QACzB,SAAS,EAAE,MAAM,EAAE;QACnB,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;KACjC,CAAC;SACC,KAAK,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,CAAC;SACnC,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC;SAC7B,KAAK,CAAC,oBAAoB,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAElD,YAAY,EAAE,WAAW,CAAC,YAAY,CAAC;SACpC,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;SACrC,KAAK,CAAC,wBAAwB,EAAE,CAAC,mBAAmB,CAAC,CAAC;SACtD,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;IAExC,kBAAkB,EAAE,WAAW,CAAC;QAC9B,QAAQ,EAAE,MAAM,EAAE;QAClB,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC;QACnC,QAAQ,EAAE,MAAM,EAAE;QAClB,SAAS,EAAE,MAAM,EAAE;QACnB,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;KAC3B,CAAC;SACC,KAAK,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,CAAC;SACnC,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;IAExC,gGAAgG;IAChG,UAAU,EAAE,WAAW,CAAC;QACtB,4CAA4C;QAC5C,SAAS,EAAE,MAAM,EAAE;QACnB,EAAE,EAAE,MAAM,EAAE;KACb,CAAC;SACC,KAAK,CAAC,sBAAsB,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;SAClD,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAEzB,OAAO,EAAE,WAAW,CAAC;QACnB,KAAK,EAAE,MAAM,EAAE;QACf,QAAQ,EAAE,MAAM,EAAE;QAClB,SAAS,EAAE,MAAM,EAAE;QACnB,GAAG,EAAE,MAAM,EAAE;QACb,EAAE,EAAE,MAAM,EAAE;KACb,CAAC;SACC,KAAK,CAAC,kBAAkB,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;SAC1C,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;CAC1B,CAAC,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/component/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,CAAC,EAAE,MAAM,eAAe,CAAC;AAElC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;AAE/E,8FAA8F;AAC9F,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAC3C,OAAO,CAAC,oBAAoB,CAAC,EAC7B,OAAO,CAAC,qBAAqB,CAAC,CAC/B,CAAC;AAEF,0CAA0C;AAC1C,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAClC,OAAO,CAAC,YAAY,CAAC,EACrB,OAAO,CAAC,aAAa,CAAC,EACtB,OAAO,CAAC,SAAS,CAAC,CACnB,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;IACtC,SAAS,EAAE,MAAM,EAAE;IACnB,UAAU,EAAE,MAAM,EAAE;IACpB,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAClC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CAC5B,CAAC,CAAC;AAEH,4FAA4F;AAC5F,MAAM,iBAAiB,GAAG;IACxB,SAAS,EAAE,MAAM,EAAE;IACnB,KAAK,EAAE,MAAM,EAAE;IACf,QAAQ,EAAE,MAAM,EAAE;IAClB,WAAW,EAAE,MAAM,EAAE;IACrB,KAAK,EAAE,MAAM,EAAE;IACf,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzB,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,EAAE;IACvB,yFAAyF;IACzF,UAAU,EAAE,OAAO,EAAE;IACrB;;;OAGG;IACH,aAAa,EAAE,MAAM,EAAE;IACvB,SAAS,EAAE,MAAM,EAAE;IACnB,SAAS,EAAE,MAAM,EAAE;CACpB,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK;AAC/B,iEAAiE;AACjE,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,iBAAiB,EAAE,CAAC;AAC5D,+FAA+F;AAC/F,MAAM,CAAC;IACL,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC;IAC3B,GAAG,iBAAiB;IACpB,SAAS,EAAE,MAAM,EAAE;IACnB,iBAAiB,EAAE,MAAM,EAAE;IAC3B,oBAAoB,EAAE,MAAM,EAAE;IAC9B,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CAClC,CAAC;AACF,kGAAkG;AAClG,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,iBAAiB,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;AACjF,iGAAiG;AACjG,MAAM,CAAC;IACL,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC;IAC5B,GAAG,iBAAiB;IACpB,QAAQ,EAAE,iBAAiB;IAC3B,QAAQ,EAAE,MAAM,EAAE;CACnB,CAAC,CACH,CAAC;AAEF,eAAe,YAAY,CAAC;IAC1B,IAAI,EAAE,WAAW,CAAC;QAChB,KAAK,EAAE,MAAM,EAAE;QACf,IAAI,EAAE,MAAM,EAAE;QACd,UAAU,EAAE,OAAO,EAAE;QACrB,yEAAyE;QACzE,oBAAoB,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/C,SAAS,EAAE,MAAM,EAAE;KACpB,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC;IAEhC,OAAO,EAAE,WAAW,CAAC;QACnB,QAAQ,EAAE,MAAM,EAAE;QAClB,KAAK,EAAE,MAAM,EAAE;QACf,UAAU,EAAE,MAAM,EAAE;QACpB,uBAAuB,EAAE,wBAAwB;QACjD,WAAW,EAAE,MAAM,EAAE;QACrB,cAAc,EAAE,eAAe;QAC/B,UAAU,EAAE,MAAM,EAAE;QACpB,eAAe,EAAE,MAAM,EAAE;QACzB,SAAS,EAAE,MAAM,EAAE;QACnB,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;KACjC,CAAC;SACC,KAAK,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,CAAC;SACnC,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC;SAC7B,KAAK,CAAC,oBAAoB,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAElD,YAAY,EAAE,WAAW,CAAC,YAAY,CAAC;SACpC,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;SACrC,KAAK,CAAC,wBAAwB,EAAE,CAAC,mBAAmB,CAAC,CAAC;SACtD,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;IAExC,kBAAkB,EAAE,WAAW,CAAC;QAC9B,QAAQ,EAAE,MAAM,EAAE;QAClB,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC;QACnC,QAAQ,EAAE,MAAM,EAAE;QAClB,SAAS,EAAE,MAAM,EAAE;QACnB,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;KAC3B,CAAC;SACC,KAAK,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,CAAC;SACnC,KAAK,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,CAAC;IAExC,OAAO,EAAE,WAAW,CAAC;QACnB,KAAK,EAAE,MAAM,EAAE;QACf,QAAQ,EAAE,MAAM,EAAE;QAClB,SAAS,EAAE,MAAM,EAAE;QACnB,GAAG,EAAE,MAAM,EAAE;QACb,EAAE,EAAE,MAAM,EAAE;KACb,CAAC;SACC,KAAK,CAAC,kBAAkB,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;SAC1C,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;CAC1B,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@samebase/identity-broker",
-  "version": "0.9.3",
+  "version": "0.10.0",
   "description": "An OpenID Provider for Convex that holds a team's upstream sign-in connections once and keeps no user accounts.",
   "license": "Apache-2.0",
   "repository": {

package/dist/client/connectors/email.d.ts

@@ -1,6 +0,0 @@
-import type { EmailConnector, SendEmailCode } from "./types.js";
-/** A six-digit code sent by the host's action. The canonical address is the identity. */
-export declare function email(options: {
-    send: SendEmailCode;
-    name?: string;
-}): EmailConnector;

package/dist/client/connectors/email.js

@@ -1,5 +0,0 @@
-/** A six-digit code sent by the host's action. The canonical address is the identity. */
-export function email(options) {
-    return { kind: "email", name: options.name ?? "email", label: "Email", send: options.send };
-}
-//# sourceMappingURL=email.js.map

package/dist/client/connectors/email.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"email.js","sourceRoot":"","sources":["../../../src/client/connectors/email.ts"],"names":[],"mappings":"AAEA,yFAAyF;AACzF,MAAM,UAAU,KAAK,CAAC,OAA+C;IACnE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;AAC9F,CAAC"}