@auth0/auth0-server-js 1.9.0 → 1.10.0

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { AuthorizationDetails, ExchangeProfileOptions, DiscoveryCacheOptions, TelemetryConfig, AuthClient, ListAuthenticatorsOptions, AuthenticatorResponse, EnrollAuthenticatorOptions, EnrollmentResponse, ChallengeOptions, ChallengeResponse, MfaVerifyOptions, PasskeySignupChallengeOptions, PasskeySignupChallengeResponse, PasskeyLoginChallengeOptions, PasskeyLoginChallengeResponse, GetTokenByPasskeyOptions, TokenResponse } from '@auth0/auth0-auth-js';
-export { ActClaim, AuthenticatorResponse, AuthenticatorType, ChallengeOptions, ChallengeResponse, DiscoveryCacheOptions, EnrollAuthenticatorOptions, EnrollEmailOptions, EnrollOobOptions, EnrollOtpOptions, EnrollmentResponse, ListAuthenticatorsOptions, MfaChallengeError, MfaEnrollmentError, MfaFactorType, MfaListAuthenticatorsError, MfaRequirements, MfaVerifyError, MfaVerifyOobOptions, MfaVerifyOptions, MfaVerifyOtpOptions, MfaVerifyRecoveryCodeOptions, MissingClientAuthError, OobChannel, OobEnrollmentResponse, OrganizationValidationError, OtpEnrollmentResponse, PasskeyChallengeError, PasskeyLoginChallengeOptions as PasskeyChallengeOptions, PasskeyLoginChallengeResponse as PasskeyChallengeResponse, PasskeyCreationOptions, PasskeyCredentialResponse, PasskeyGetTokenError, GetTokenByPasskeyOptions as PasskeyGetTokenOptions, PasskeyRegisterError, PasskeySignupChallengeOptions as PasskeyRegisterOptions, PasskeySignupChallengeResponse as PasskeyRegisterResponse, PasskeyRequestOptions, TelemetryConfig, TokenExchangeError, TokenResponse, isMfaRequiredError } from '@auth0/auth0-auth-js';
+import { AuthorizationDetails, ExchangeProfileOptions, DiscoveryCacheOptions, TelemetryConfig, AuthClient, ListAuthenticatorsOptions, AuthenticatorResponse, EnrollAuthenticatorOptions, EnrollmentResponse, ChallengeOptions, ChallengeResponse, MfaVerifyOptions, PasskeySignupChallengeOptions, PasskeySignupChallengeResponse, PasskeyLoginChallengeOptions, PasskeyLoginChallengeResponse, GetTokenByPasskeyOptions, SignUpOptions, SignUpResult, ChangePasswordOptions, TokenResponse } from '@auth0/auth0-auth-js';
+export { ActClaim, AuthenticatorResponse, AuthenticatorType, ChallengeOptions, ChallengeResponse, ChangePasswordError, ChangePasswordOptions, DiscoveryCacheOptions, EnrollAuthenticatorOptions, EnrollEmailOptions, EnrollOobOptions, EnrollOtpOptions, EnrollmentResponse, ListAuthenticatorsOptions, MfaChallengeError, MfaEnrollmentError, MfaFactorType, MfaListAuthenticatorsError, MfaRequirements, MfaVerifyError, MfaVerifyOobOptions, MfaVerifyOptions, MfaVerifyOtpOptions, MfaVerifyRecoveryCodeOptions, MissingClientAuthError, OobChannel, OobEnrollmentResponse, OrganizationValidationError, OtpEnrollmentResponse, PasskeyChallengeError, PasskeyLoginChallengeOptions as PasskeyChallengeOptions, PasskeyLoginChallengeResponse as PasskeyChallengeResponse, PasskeyCreationOptions, PasskeyCredentialResponse, PasskeyGetTokenError, GetTokenByPasskeyOptions as PasskeyGetTokenOptions, PasskeyRegisterError, PasskeySignupChallengeOptions as PasskeyRegisterOptions, PasskeySignupChallengeResponse as PasskeyRegisterResponse, PasskeyRequestOptions, SignUpError, SignUpOptions, SignUpResult, TelemetryConfig, TokenExchangeError, TokenResponse, TokenRevocationError, isMfaRequiredError } from '@auth0/auth0-auth-js';
 import { JWTPayload } from 'jose';
 
 /**
@@ -330,6 +330,13 @@ interface GetAccessTokenOptions {
      */
     scope?: string;
 }
+interface RevokeRefreshTokenOptions {
+    /**
+     * Explicitly provide a refresh token to revoke.
+     * If omitted, the token stored in the current session is used.
+     */
+    token?: string;
+}
 interface LogoutOptions {
     returnTo: string;
 }
@@ -602,6 +609,59 @@ declare class ServerPasskeyClient<TStoreOptions = unknown> {
     getToken(options: GetTokenByPasskeyOptions, storeOptions?: TStoreOptions): Promise<PasskeyGetTokenResult>;
 }
 
+/**
+ * @internal
+ * Options for constructing a ServerDatabaseClient.
+ *
+ * Like the passkey client, the database client resolves the domain per call so
+ * it keeps working in resolver (multi-tenant) mode. It therefore receives the
+ * parent client's `resolveDomain` and `getAuthClient` helpers instead of a
+ * fixed domain/authClient. Unlike the MFA/passkey clients, it never touches the
+ * state store — signup and change-password write no session.
+ */
+interface ServerDatabaseClientOptions<TStoreOptions = unknown> {
+    resolveDomain: (storeOptions?: TStoreOptions) => Promise<string>;
+    getAuthClient: (domain: string) => AuthClient;
+}
+
+declare class ServerDatabaseClient<TStoreOptions = unknown> {
+    #private;
+    /**
+     * @internal
+     */
+    constructor(options: ServerDatabaseClientOptions<TStoreOptions>);
+    /**
+     * Registers a new user in a database connection.
+     *
+     * Delegates to the underlying `AuthClient.database.signUp` without any session
+     * state modification. The caller is responsible for handling the returned user
+     * data as needed.
+     *
+     * @param options The signup options (email, password, connection, etc.).
+     * @param storeOptions Optional options used to resolve the domain (resolver mode).
+     *
+     * @throws {SignUpError} If there was an issue signing the user up.
+     *
+     * @returns A promise resolving to the created user result with a normalized `id` field.
+     */
+    signUp(options: SignUpOptions, storeOptions?: TStoreOptions): Promise<SignUpResult>;
+    /**
+     * Requests a password-change email for a database connection user.
+     *
+     * Delegates to the underlying `AuthClient.database.changePassword` without any
+     * session state modification. The caller is responsible for informing the user
+     * of the sent email as needed.
+     *
+     * @param options The password change options (email, connection, organization, etc.).
+     * @param storeOptions Optional options used to resolve the domain (resolver mode).
+     *
+     * @throws {ChangePasswordError} If there was an issue requesting the password change.
+     *
+     * @returns A promise resolving to the server's plain-text confirmation message.
+     */
+    changePassword(options: ChangePasswordOptions, storeOptions?: TStoreOptions): Promise<string>;
+}
+
 declare class ServerClient<TStoreOptions = unknown> {
     #private;
     /**
@@ -639,6 +699,19 @@ declare class ServerClient<TStoreOptions = unknown> {
      * and `getToken()` so the credential is exchanged against the tenant that issued it.
      */
     get passkey(): ServerPasskeyClient<TStoreOptions>;
+    /**
+     * The database client for self-service sign-up and password-change requests
+     * against an Auth0 database connection.
+     *
+     * Provides `signUp()` to register a user and `changePassword()` to request a
+     * password-reset email. Both are pure passthrough operations to the Auth0
+     * Authentication API — they never read or write the session/state store.
+     *
+     * Like `passkey`, this property is available in both static and resolver
+     * (multi-tenant) domain modes. In resolver mode, pass `storeOptions` so the
+     * request resolves the intended tenant.
+     */
+    get database(): ServerDatabaseClient<TStoreOptions>;
     constructor(options: ServerClientOptions<TStoreOptions>);
     /**
      * Starts the interactive login process, and returns a URL to redirect the user-agent to to request authorization at Auth0.
@@ -850,6 +923,22 @@ declare class ServerClient<TStoreOptions = unknown> {
      * @returns The Connection Token Set, containing the access token for the connection, as well as additional information.
      */
     getAccessTokenForConnection(options: AccessTokenForConnectionOptions, storeOptions?: TStoreOptions): Promise<ConnectionTokenSet>;
+    /**
+     * Revokes the refresh token stored in the current session, or an explicitly supplied token.
+     *
+     * In resolver mode, revocation only occurs when the session domain matches the domain resolved
+     * for the current request. If the domains differ (or the session has no stored domain), the call
+     * returns without revoking to avoid sending a token to the wrong tenant. This guard applies even
+     * when a token is passed explicitly via `options.token`.
+     *
+     * @param options Optionally supply a token to revoke instead of reading from the session.
+     * @param storeOptions Optional options passed to the StateStore.
+     *
+     * @throws {MissingRequiredArgumentError} If `options.token` is an empty string.
+     * @throws {MissingSessionError} If no refresh token is found in the session and none was provided.
+     * @throws {TokenRevocationError} If the revocation request fails.
+     */
+    revokeRefreshToken(options?: RevokeRefreshTokenOptions, storeOptions?: TStoreOptions): Promise<void>;
     /**
      * Logs the user out and returns a URL to redirect the user-agent to after they log out.
      * @param options Options used to configure the logout process.
@@ -1091,4 +1180,4 @@ declare class SessionExpiredError extends Error {
     constructor(message?: string);
 }
 
-export { type AbstractDataStore, AbstractStateStore, AbstractTransactionStore, type AccessTokenForConnectionOptions, type AuthorizationParameters, BackchannelLogoutError, type CompletePasswordlessEmailOptions, type CompletePasswordlessOptions, type CompletePasswordlessResult, type CompletePasswordlessSmsOptions, type ConnectionTokenSet, type CookieHandler, type CookieSerializeOptions, CookieTransactionStore, type CustomTokenExchangeOptions, type DomainResolver, type EncryptedStoreOptions, type GetAccessTokenOptions, type InternalStateData, InvalidConfigurationError, IssuerValidationError, type LoginBackchannelOptions, type LoginBackchannelResult, type LoginWithCustomTokenExchangeOptions, type LoginWithCustomTokenExchangeResult, type LogoutOptions, type LogoutTokenClaims, type MfaVerifyResponse, MissingRequiredArgumentError, MissingSessionError, MissingTransactionError, type PasskeyGetTokenResult, ServerClient, type ServerClientOptions, ServerMfaClient, ServerPasskeyClient, type SessionConfiguration, type SessionCookieOptions, type SessionData, SessionExpiredError, type SessionStore, type StartInteractiveLoginOptions, StartLinkUserError, type StartLinkUserOptions, type StartPasswordlessEmailCodeOptions, type StartPasswordlessEmailLinkOptions, type StartPasswordlessOptions, type StartPasswordlessSmsOptions, type StartUnlinkUserOptions, type StateData, type StateStore, StatefulStateStore, type StatefulStateStoreOptions, StatelessStateStore, type TokenSet, type TransactionData, type TransactionStore, type UserClaims };
+export { type AbstractDataStore, AbstractStateStore, AbstractTransactionStore, type AccessTokenForConnectionOptions, type AuthorizationParameters, BackchannelLogoutError, type CompletePasswordlessEmailOptions, type CompletePasswordlessOptions, type CompletePasswordlessResult, type CompletePasswordlessSmsOptions, type ConnectionTokenSet, type CookieHandler, type CookieSerializeOptions, CookieTransactionStore, type CustomTokenExchangeOptions, type DomainResolver, type EncryptedStoreOptions, type GetAccessTokenOptions, type InternalStateData, InvalidConfigurationError, IssuerValidationError, type LoginBackchannelOptions, type LoginBackchannelResult, type LoginWithCustomTokenExchangeOptions, type LoginWithCustomTokenExchangeResult, type LogoutOptions, type LogoutTokenClaims, type MfaVerifyResponse, MissingRequiredArgumentError, MissingSessionError, MissingTransactionError, type PasskeyGetTokenResult, type RevokeRefreshTokenOptions, ServerClient, type ServerClientOptions, ServerDatabaseClient, ServerMfaClient, ServerPasskeyClient, type SessionConfiguration, type SessionCookieOptions, type SessionData, SessionExpiredError, type SessionStore, type StartInteractiveLoginOptions, StartLinkUserError, type StartLinkUserOptions, type StartPasswordlessEmailCodeOptions, type StartPasswordlessEmailLinkOptions, type StartPasswordlessOptions, type StartPasswordlessSmsOptions, type StartUnlinkUserOptions, type StateData, type StateStore, StatefulStateStore, type StatefulStateStoreOptions, StatelessStateStore, type TokenSet, type TransactionData, type TransactionStore, type UserClaims };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { AuthorizationDetails, ExchangeProfileOptions, DiscoveryCacheOptions, TelemetryConfig, AuthClient, ListAuthenticatorsOptions, AuthenticatorResponse, EnrollAuthenticatorOptions, EnrollmentResponse, ChallengeOptions, ChallengeResponse, MfaVerifyOptions, PasskeySignupChallengeOptions, PasskeySignupChallengeResponse, PasskeyLoginChallengeOptions, PasskeyLoginChallengeResponse, GetTokenByPasskeyOptions, TokenResponse } from '@auth0/auth0-auth-js';
-export { ActClaim, AuthenticatorResponse, AuthenticatorType, ChallengeOptions, ChallengeResponse, DiscoveryCacheOptions, EnrollAuthenticatorOptions, EnrollEmailOptions, EnrollOobOptions, EnrollOtpOptions, EnrollmentResponse, ListAuthenticatorsOptions, MfaChallengeError, MfaEnrollmentError, MfaFactorType, MfaListAuthenticatorsError, MfaRequirements, MfaVerifyError, MfaVerifyOobOptions, MfaVerifyOptions, MfaVerifyOtpOptions, MfaVerifyRecoveryCodeOptions, MissingClientAuthError, OobChannel, OobEnrollmentResponse, OrganizationValidationError, OtpEnrollmentResponse, PasskeyChallengeError, PasskeyLoginChallengeOptions as PasskeyChallengeOptions, PasskeyLoginChallengeResponse as PasskeyChallengeResponse, PasskeyCreationOptions, PasskeyCredentialResponse, PasskeyGetTokenError, GetTokenByPasskeyOptions as PasskeyGetTokenOptions, PasskeyRegisterError, PasskeySignupChallengeOptions as PasskeyRegisterOptions, PasskeySignupChallengeResponse as PasskeyRegisterResponse, PasskeyRequestOptions, TelemetryConfig, TokenExchangeError, TokenResponse, isMfaRequiredError } from '@auth0/auth0-auth-js';
+import { AuthorizationDetails, ExchangeProfileOptions, DiscoveryCacheOptions, TelemetryConfig, AuthClient, ListAuthenticatorsOptions, AuthenticatorResponse, EnrollAuthenticatorOptions, EnrollmentResponse, ChallengeOptions, ChallengeResponse, MfaVerifyOptions, PasskeySignupChallengeOptions, PasskeySignupChallengeResponse, PasskeyLoginChallengeOptions, PasskeyLoginChallengeResponse, GetTokenByPasskeyOptions, SignUpOptions, SignUpResult, ChangePasswordOptions, TokenResponse } from '@auth0/auth0-auth-js';
+export { ActClaim, AuthenticatorResponse, AuthenticatorType, ChallengeOptions, ChallengeResponse, ChangePasswordError, ChangePasswordOptions, DiscoveryCacheOptions, EnrollAuthenticatorOptions, EnrollEmailOptions, EnrollOobOptions, EnrollOtpOptions, EnrollmentResponse, ListAuthenticatorsOptions, MfaChallengeError, MfaEnrollmentError, MfaFactorType, MfaListAuthenticatorsError, MfaRequirements, MfaVerifyError, MfaVerifyOobOptions, MfaVerifyOptions, MfaVerifyOtpOptions, MfaVerifyRecoveryCodeOptions, MissingClientAuthError, OobChannel, OobEnrollmentResponse, OrganizationValidationError, OtpEnrollmentResponse, PasskeyChallengeError, PasskeyLoginChallengeOptions as PasskeyChallengeOptions, PasskeyLoginChallengeResponse as PasskeyChallengeResponse, PasskeyCreationOptions, PasskeyCredentialResponse, PasskeyGetTokenError, GetTokenByPasskeyOptions as PasskeyGetTokenOptions, PasskeyRegisterError, PasskeySignupChallengeOptions as PasskeyRegisterOptions, PasskeySignupChallengeResponse as PasskeyRegisterResponse, PasskeyRequestOptions, SignUpError, SignUpOptions, SignUpResult, TelemetryConfig, TokenExchangeError, TokenResponse, TokenRevocationError, isMfaRequiredError } from '@auth0/auth0-auth-js';
 import { JWTPayload } from 'jose';
 
 /**
@@ -330,6 +330,13 @@ interface GetAccessTokenOptions {
      */
     scope?: string;
 }
+interface RevokeRefreshTokenOptions {
+    /**
+     * Explicitly provide a refresh token to revoke.
+     * If omitted, the token stored in the current session is used.
+     */
+    token?: string;
+}
 interface LogoutOptions {
     returnTo: string;
 }
@@ -602,6 +609,59 @@ declare class ServerPasskeyClient<TStoreOptions = unknown> {
     getToken(options: GetTokenByPasskeyOptions, storeOptions?: TStoreOptions): Promise<PasskeyGetTokenResult>;
 }
 
+/**
+ * @internal
+ * Options for constructing a ServerDatabaseClient.
+ *
+ * Like the passkey client, the database client resolves the domain per call so
+ * it keeps working in resolver (multi-tenant) mode. It therefore receives the
+ * parent client's `resolveDomain` and `getAuthClient` helpers instead of a
+ * fixed domain/authClient. Unlike the MFA/passkey clients, it never touches the
+ * state store — signup and change-password write no session.
+ */
+interface ServerDatabaseClientOptions<TStoreOptions = unknown> {
+    resolveDomain: (storeOptions?: TStoreOptions) => Promise<string>;
+    getAuthClient: (domain: string) => AuthClient;
+}
+
+declare class ServerDatabaseClient<TStoreOptions = unknown> {
+    #private;
+    /**
+     * @internal
+     */
+    constructor(options: ServerDatabaseClientOptions<TStoreOptions>);
+    /**
+     * Registers a new user in a database connection.
+     *
+     * Delegates to the underlying `AuthClient.database.signUp` without any session
+     * state modification. The caller is responsible for handling the returned user
+     * data as needed.
+     *
+     * @param options The signup options (email, password, connection, etc.).
+     * @param storeOptions Optional options used to resolve the domain (resolver mode).
+     *
+     * @throws {SignUpError} If there was an issue signing the user up.
+     *
+     * @returns A promise resolving to the created user result with a normalized `id` field.
+     */
+    signUp(options: SignUpOptions, storeOptions?: TStoreOptions): Promise<SignUpResult>;
+    /**
+     * Requests a password-change email for a database connection user.
+     *
+     * Delegates to the underlying `AuthClient.database.changePassword` without any
+     * session state modification. The caller is responsible for informing the user
+     * of the sent email as needed.
+     *
+     * @param options The password change options (email, connection, organization, etc.).
+     * @param storeOptions Optional options used to resolve the domain (resolver mode).
+     *
+     * @throws {ChangePasswordError} If there was an issue requesting the password change.
+     *
+     * @returns A promise resolving to the server's plain-text confirmation message.
+     */
+    changePassword(options: ChangePasswordOptions, storeOptions?: TStoreOptions): Promise<string>;
+}
+
 declare class ServerClient<TStoreOptions = unknown> {
     #private;
     /**
@@ -639,6 +699,19 @@ declare class ServerClient<TStoreOptions = unknown> {
      * and `getToken()` so the credential is exchanged against the tenant that issued it.
      */
     get passkey(): ServerPasskeyClient<TStoreOptions>;
+    /**
+     * The database client for self-service sign-up and password-change requests
+     * against an Auth0 database connection.
+     *
+     * Provides `signUp()` to register a user and `changePassword()` to request a
+     * password-reset email. Both are pure passthrough operations to the Auth0
+     * Authentication API — they never read or write the session/state store.
+     *
+     * Like `passkey`, this property is available in both static and resolver
+     * (multi-tenant) domain modes. In resolver mode, pass `storeOptions` so the
+     * request resolves the intended tenant.
+     */
+    get database(): ServerDatabaseClient<TStoreOptions>;
     constructor(options: ServerClientOptions<TStoreOptions>);
     /**
      * Starts the interactive login process, and returns a URL to redirect the user-agent to to request authorization at Auth0.
@@ -850,6 +923,22 @@ declare class ServerClient<TStoreOptions = unknown> {
      * @returns The Connection Token Set, containing the access token for the connection, as well as additional information.
      */
     getAccessTokenForConnection(options: AccessTokenForConnectionOptions, storeOptions?: TStoreOptions): Promise<ConnectionTokenSet>;
+    /**
+     * Revokes the refresh token stored in the current session, or an explicitly supplied token.
+     *
+     * In resolver mode, revocation only occurs when the session domain matches the domain resolved
+     * for the current request. If the domains differ (or the session has no stored domain), the call
+     * returns without revoking to avoid sending a token to the wrong tenant. This guard applies even
+     * when a token is passed explicitly via `options.token`.
+     *
+     * @param options Optionally supply a token to revoke instead of reading from the session.
+     * @param storeOptions Optional options passed to the StateStore.
+     *
+     * @throws {MissingRequiredArgumentError} If `options.token` is an empty string.
+     * @throws {MissingSessionError} If no refresh token is found in the session and none was provided.
+     * @throws {TokenRevocationError} If the revocation request fails.
+     */
+    revokeRefreshToken(options?: RevokeRefreshTokenOptions, storeOptions?: TStoreOptions): Promise<void>;
     /**
      * Logs the user out and returns a URL to redirect the user-agent to after they log out.
      * @param options Options used to configure the logout process.
@@ -1091,4 +1180,4 @@ declare class SessionExpiredError extends Error {
     constructor(message?: string);
 }
 
-export { type AbstractDataStore, AbstractStateStore, AbstractTransactionStore, type AccessTokenForConnectionOptions, type AuthorizationParameters, BackchannelLogoutError, type CompletePasswordlessEmailOptions, type CompletePasswordlessOptions, type CompletePasswordlessResult, type CompletePasswordlessSmsOptions, type ConnectionTokenSet, type CookieHandler, type CookieSerializeOptions, CookieTransactionStore, type CustomTokenExchangeOptions, type DomainResolver, type EncryptedStoreOptions, type GetAccessTokenOptions, type InternalStateData, InvalidConfigurationError, IssuerValidationError, type LoginBackchannelOptions, type LoginBackchannelResult, type LoginWithCustomTokenExchangeOptions, type LoginWithCustomTokenExchangeResult, type LogoutOptions, type LogoutTokenClaims, type MfaVerifyResponse, MissingRequiredArgumentError, MissingSessionError, MissingTransactionError, type PasskeyGetTokenResult, ServerClient, type ServerClientOptions, ServerMfaClient, ServerPasskeyClient, type SessionConfiguration, type SessionCookieOptions, type SessionData, SessionExpiredError, type SessionStore, type StartInteractiveLoginOptions, StartLinkUserError, type StartLinkUserOptions, type StartPasswordlessEmailCodeOptions, type StartPasswordlessEmailLinkOptions, type StartPasswordlessOptions, type StartPasswordlessSmsOptions, type StartUnlinkUserOptions, type StateData, type StateStore, StatefulStateStore, type StatefulStateStoreOptions, StatelessStateStore, type TokenSet, type TransactionData, type TransactionStore, type UserClaims };
+export { type AbstractDataStore, AbstractStateStore, AbstractTransactionStore, type AccessTokenForConnectionOptions, type AuthorizationParameters, BackchannelLogoutError, type CompletePasswordlessEmailOptions, type CompletePasswordlessOptions, type CompletePasswordlessResult, type CompletePasswordlessSmsOptions, type ConnectionTokenSet, type CookieHandler, type CookieSerializeOptions, CookieTransactionStore, type CustomTokenExchangeOptions, type DomainResolver, type EncryptedStoreOptions, type GetAccessTokenOptions, type InternalStateData, InvalidConfigurationError, IssuerValidationError, type LoginBackchannelOptions, type LoginBackchannelResult, type LoginWithCustomTokenExchangeOptions, type LoginWithCustomTokenExchangeResult, type LogoutOptions, type LogoutTokenClaims, type MfaVerifyResponse, MissingRequiredArgumentError, MissingSessionError, MissingTransactionError, type PasskeyGetTokenResult, type RevokeRefreshTokenOptions, ServerClient, type ServerClientOptions, ServerDatabaseClient, ServerMfaClient, ServerPasskeyClient, type SessionConfiguration, type SessionCookieOptions, type SessionData, SessionExpiredError, type SessionStore, type StartInteractiveLoginOptions, StartLinkUserError, type StartLinkUserOptions, type StartPasswordlessEmailCodeOptions, type StartPasswordlessEmailLinkOptions, type StartPasswordlessOptions, type StartPasswordlessSmsOptions, type StartUnlinkUserOptions, type StateData, type StateStore, StatefulStateStore, type StatefulStateStoreOptions, StatelessStateStore, type TokenSet, type TransactionData, type TransactionStore, type UserClaims };

package/dist/index.js

@@ -205,7 +205,7 @@ function getTelemetryConfig(config) {
   return {
     enabled: true,
     name: config?.name ?? "@auth0/auth0-server-js",
-    version: config?.version ?? "1.9.0"
+    version: config?.version ?? "1.10.0"
   };
 }
 
@@ -384,6 +384,53 @@ var ServerPasskeyClient = class {
   }
 };
 
+// src/database/server-database-client.ts
+var ServerDatabaseClient = class {
+  #options;
+  /**
+   * @internal
+   */
+  constructor(options) {
+    this.#options = options;
+  }
+  /**
+   * Registers a new user in a database connection.
+   *
+   * Delegates to the underlying `AuthClient.database.signUp` without any session
+   * state modification. The caller is responsible for handling the returned user
+   * data as needed.
+   *
+   * @param options The signup options (email, password, connection, etc.).
+   * @param storeOptions Optional options used to resolve the domain (resolver mode).
+   *
+   * @throws {SignUpError} If there was an issue signing the user up.
+   *
+   * @returns A promise resolving to the created user result with a normalized `id` field.
+   */
+  async signUp(options, storeOptions) {
+    const domain = await this.#options.resolveDomain(storeOptions);
+    return this.#options.getAuthClient(domain).database.signUp(options);
+  }
+  /**
+   * Requests a password-change email for a database connection user.
+   *
+   * Delegates to the underlying `AuthClient.database.changePassword` without any
+   * session state modification. The caller is responsible for informing the user
+   * of the sent email as needed.
+   *
+   * @param options The password change options (email, connection, organization, etc.).
+   * @param storeOptions Optional options used to resolve the domain (resolver mode).
+   *
+   * @throws {ChangePasswordError} If there was an issue requesting the password change.
+   *
+   * @returns A promise resolving to the server's plain-text confirmation message.
+   */
+  async changePassword(options, storeOptions) {
+    const domain = await this.#options.resolveDomain(storeOptions);
+    return this.#options.getAuthClient(domain).database.changePassword(options);
+  }
+};
+
 // src/server-client.ts
 var normalizeDomain = (value) => {
   const trimmed = value.trim();
@@ -409,6 +456,7 @@ var ServerClient = class {
   #authClient;
   #mfaClient;
   #passkeyClient;
+  #databaseClient;
   /**
    * The underlying `authClient` instance that can be used to interact with the Auth0 Authentication API.
    * Generally, you should prefer to use the higher-level methods exposed on the `ServerClient` instance.
@@ -456,6 +504,21 @@ var ServerClient = class {
   get passkey() {
     return this.#passkeyClient;
   }
+  /**
+   * The database client for self-service sign-up and password-change requests
+   * against an Auth0 database connection.
+   *
+   * Provides `signUp()` to register a user and `changePassword()` to request a
+   * password-reset email. Both are pure passthrough operations to the Auth0
+   * Authentication API — they never read or write the session/state store.
+   *
+   * Like `passkey`, this property is available in both static and resolver
+   * (multi-tenant) domain modes. In resolver mode, pass `storeOptions` so the
+   * request resolves the intended tenant.
+   */
+  get database() {
+    return this.#databaseClient;
+  }
   constructor(options) {
     this.#options = options;
     this.#stateStoreIdentifier = this.#options.stateIdentifier || "__a0_session";
@@ -505,6 +568,10 @@ var ServerClient = class {
       defaultScope: this.#options.authorizationParams?.scope,
       defaultAudience: this.#options.authorizationParams?.audience
     });
+    this.#databaseClient = new ServerDatabaseClient({
+      resolveDomain: (storeOptions) => this.#resolveDomain(storeOptions),
+      getAuthClient: (domain) => this.#getAuthClient(domain)
+    });
   }
   async #resolveDomain(storeOptions) {
     if (typeof this.#options.domain === "function") {
@@ -1170,6 +1237,47 @@ var ServerClient = class {
       loginHint: options.loginHint
     };
   }
+  /**
+   * Revokes the refresh token stored in the current session, or an explicitly supplied token.
+   *
+   * In resolver mode, revocation only occurs when the session domain matches the domain resolved
+   * for the current request. If the domains differ (or the session has no stored domain), the call
+   * returns without revoking to avoid sending a token to the wrong tenant. This guard applies even
+   * when a token is passed explicitly via `options.token`.
+   *
+   * @param options Optionally supply a token to revoke instead of reading from the session.
+   * @param storeOptions Optional options passed to the StateStore.
+   *
+   * @throws {MissingRequiredArgumentError} If `options.token` is an empty string.
+   * @throws {MissingSessionError} If no refresh token is found in the session and none was provided.
+   * @throws {TokenRevocationError} If the revocation request fails.
+   */
+  async revokeRefreshToken(options = {}, storeOptions) {
+    if (options.token !== void 0 && options.token.length === 0) {
+      throw new MissingRequiredArgumentError("options.token must not be an empty string.");
+    }
+    let refreshToken = options.token;
+    const needsStateData = !refreshToken || this.#isResolverMode();
+    const stateData = needsStateData ? await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions) : void 0;
+    if (!refreshToken) {
+      refreshToken = stateData?.refreshToken;
+    }
+    if (!refreshToken) {
+      throw new MissingSessionError("Unable to revoke refresh token: no refresh token found in session.");
+    }
+    let authClient;
+    if (this.#isResolverMode()) {
+      const resolvedDomain = await this.#resolveDomain(storeOptions);
+      const sessionDomain = stateData ? this.#getSessionDomain(stateData) : void 0;
+      if (stateData && sessionDomain !== resolvedDomain) {
+        return;
+      }
+      authClient = this.#getAuthClient(sessionDomain ?? resolvedDomain);
+    } else {
+      authClient = this.authClient;
+    }
+    await authClient.revokeToken({ token: refreshToken, tokenTypeHint: "refresh_token" });
+  }
   /**
    * Logs the user out and returns a URL to redirect the user-agent to after they log out.
    * @param options Options used to configure the logout process.
@@ -1178,17 +1286,26 @@ var ServerClient = class {
    */
   async logout(options, storeOptions) {
     if (!this.#isResolverMode()) {
+      try {
+        await this.revokeRefreshToken({}, storeOptions);
+      } catch {
+      }
       await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);
       return this.authClient.buildLogoutUrl(options);
     }
     const resolvedDomain = await this.#resolveDomain(storeOptions);
     const authClient = this.#getAuthClient(resolvedDomain);
     const stateData = await this.#stateStore.get(this.#stateStoreIdentifier, storeOptions);
-    const sessionDomain = stateData ? this.#getSessionDomain(stateData) : void 0;
     if (!stateData) {
       return authClient.buildLogoutUrl(options);
     }
-    if (sessionDomain && sessionDomain === resolvedDomain) {
+    const sessionDomain = this.#getSessionDomain(stateData);
+    const domainMatches = sessionDomain === resolvedDomain;
+    if (domainMatches) {
+      try {
+        await this.revokeRefreshToken({}, storeOptions);
+      } catch {
+      }
       await this.#stateStore.delete(this.#stateStoreIdentifier, storeOptions);
     }
     return authClient.buildLogoutUrl(options);
@@ -1406,7 +1523,7 @@ var AbstractTransactionStore = class extends AbstractStore {
 };
 
 // src/index.ts
-import { TokenExchangeError, MissingClientAuthError, OrganizationValidationError as OrganizationValidationError3 } from "@auth0/auth0-auth-js";
+import { TokenExchangeError, TokenRevocationError, MissingClientAuthError, OrganizationValidationError as OrganizationValidationError3 } from "@auth0/auth0-auth-js";
 
 // src/store/cookie-transaction-store.ts
 var CookieTransactionStore = class extends AbstractTransactionStore {
@@ -1618,10 +1735,14 @@ import {
   PasskeyGetTokenError,
   OrganizationValidationError as OrganizationValidationError2
 } from "@auth0/auth0-auth-js";
+
+// src/database/index.ts
+import { SignUpError, ChangePasswordError } from "@auth0/auth0-auth-js";
 export {
   AbstractStateStore,
   AbstractTransactionStore,
   BackchannelLogoutError,
+  ChangePasswordError,
   CookieTransactionStore,
   InvalidConfigurationError,
   IssuerValidationError,
@@ -1638,13 +1759,16 @@ export {
   PasskeyGetTokenError,
   PasskeyRegisterError,
   ServerClient,
+  ServerDatabaseClient,
   ServerMfaClient,
   ServerPasskeyClient,
   SessionExpiredError,
+  SignUpError,
   StartLinkUserError,
   StatefulStateStore,
   StatelessStateStore,
   TokenExchangeError,
+  TokenRevocationError,
   isMfaRequiredError
 };
 //# sourceMappingURL=index.js.map