v360: Register hub clients with POST /register (alchemy-convex 0.40.0)

alchemy.run.ts

@@ -9,14 +9,15 @@
 //   deployment that apps/scout/.env.local selects.
 //
 // Each deployment has a client of the identity hub at https://auth.samebase.com, for Google
-// sign-in (RFC 134). IdentityHub.Client asks `POST /hub-clients` with the GitHub OIDC token of
-// the run (`id-token: write` in alchemy.yml), or on a laptop with the app's initial access token
-// that the production registration saved. The hub first reads /samebase-verification.json on the
-// callback's site (convex/http.ts), so the code with that route is pushed before the client
-// registers, and the client's variables are written after it. Each variable stays on the row that
-// owned it before: a Convex.Deployment removes a name that leaves its own `env`, after its push
-// when it has one. The push runs apps/scout/scripts/ensure-convex-auth.ts, which sets the off values
-// of the client's variables when they are missing, so the code loads before "Site" writes them.
+// sign-in (RFC 134). IdentityHub.Client registers with `POST /register` (RFC 7591), sending
+// the GitHub OIDC token of the run (`id-token: write` in alchemy.yml), or on a laptop the app's
+// initial access token that the production registration saved. The hub first reads
+// /samebase-verification.json on the callback's site (convex/http.ts), so the code with that
+// route is pushed before the client registers, and the client's variables are written after it.
+// Each variable stays on the row that owned it before: a Convex.Deployment removes a name that
+// leaves its own `env`, after its push when it has one. The push runs
+// apps/scout/scripts/ensure-convex-auth.ts, which sets the off values of the client's variables
+// when they are missing, so the code loads before "Site" writes them.
 import { execFileSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { parseEnv } from "node:util";

docs/deploy.md

@@ -42,11 +42,12 @@ Convex.
 Stage `prod` mints the account API token `scout production email sending`, with only Email
 Sending Write, and retains it when the stack is destroyed. See `EMAIL_SETUP.md`.
 
-Google sign-in runs through the identity hub at `https://auth.samebase.com`. Each deployment asks
-`POST /hub-clients` for its client with the GitHub OIDC token of the run (`id-token: write`), so
-sign-in needs no secret of its own. The hub first reads `/samebase-verification.json` on the
-callback's site (`convex/http.ts`). So the stack pushes first (`Push` in production, `Preview` on a
-pull request), then registers the client on the Convex site URL plus `/auth/hub/callback`, then
+Google sign-in runs through the identity hub at `https://auth.samebase.com`. Each deployment
+registers its client with `POST /register`, the client registration request of RFC 7591. It
+sends the GitHub OIDC token of the run (`id-token: write`), so sign-in needs no secret of its
+own. The hub first reads `/samebase-verification.json` on the callback's site
+(`convex/http.ts`). So the stack pushes first (`Push` in production, `Preview` on a pull
+request), then registers the client on the Convex site URL plus `/auth/hub/callback`, then
 `Site` writes `IDENTITY_HUB_ISSUER`, `IDENTITY_HUB_CLIENT_ID`, and `IDENTITY_HUB_CLIENT_SECRET` with
 no push. Before each push, `apps/scout/scripts/ensure-convex-auth.ts` sets the off value of each of
 the three that is missing, so the code loads before `Site` writes the client. A deploy fails

package.json

@@ -25,7 +25,7 @@
     "@alchemy.run/cloudflare": "2.0.0-beta.85",
     "@alchemy.run/github": "2.0.0-beta.85",
     "@effect/platform-node": "4.1.2",
-    "@samebase/alchemy-convex": "0.39.1",
+    "@samebase/alchemy-convex": "0.40.0",
     "@types/node": "^24.19.2",
     "alchemy": "2.0.0-beta.85",
     "effect": "4.1.2",