Identity

How a principal authenticates: a provider's stable subject bound to a Member (an operator) or a Person (an end user), with the asserted email and the kinds of factor used. Credential material lives in the auth store, never here.


Pack	System
Version	v1 (latest)
URN	`urn:postware:system:identity`
Identity	`provider + subject`
Status categories	`active`, `disabled`

Fields

Field	Type	Req	Notes
`principal`	Ref<Member \| Person>	yes	operator or end user
`provider`	string	yes	builtin, or the issuer URL of an external provider
`subject`	string	yes	the provider's stable id (OIDC sub)
`email`	string	no	the address this login asserts; never a key
`email_verified`	bool	yes	default `false`
`factors`	enum(magic_link\|password\|passkey\|totp\|sms\|oauth\|saml\|api_key)[]	yes	the kinds of credential used; device and enrolment details live in the auth store; default `[]`
`claims`	object	no	mapped provider claims; never tokens; ``; confidential
`status`	Status(active\|disabled)	yes	default `map[category:active]`
`last_seen_at`	datetime	no	touched at most once an hour; drives the monthly active user count