@authhero/adapter-interfaces 1.19.0 → 2.0.0

package/dist/adapter-interfaces.mjs

@@ -19,7 +19,15 @@ const a = e.object({
   supported_triggers: e.array(j).optional(),
   runtime: e.string().max(50).optional(),
   dependencies: e.array(k).optional(),
-  secrets: e.array(R).optional()
+  secrets: e.array(R).optional(),
+  // Marks this action as a shared template owned by the control-plane tenant.
+  // Other tenants can opt-in by creating a row with the same `name` and
+  // `inherit: true`; at execute time the loader reads code from this row.
+  is_system: e.boolean().optional(),
+  // On a non-control-plane tenant, indicates the action's `code` should be
+  // read through from the control-plane system action with a matching name.
+  // The local `secrets` still override (local-first then upstream fallback).
+  inherit: e.boolean().optional()
 }), en = v.partial().extend({
   status: e.enum(["draft", "built"]).optional(),
   deployed_at: e.string().optional()
@@ -60,7 +68,7 @@ const a = e.object({
     action_name: e.string(),
     lines: e.array(ie)
   })
-), se = e.object({
+), re = e.object({
   id: e.string(),
   tenant_id: e.string(),
   trigger_id: ee,
@@ -69,11 +77,11 @@ const a = e.object({
   logs: ae.optional(),
   created_at: e.string(),
   updated_at: e.string()
-}), on = se.omit({
+}), on = re.omit({
   tenant_id: !0,
   created_at: !0,
   updated_at: !0
-}), re = e.object({
+}), se = e.object({
   action_id: e.string(),
   code: e.string().max(1e5),
   runtime: e.string().max(50).optional(),
@@ -81,7 +89,7 @@ const a = e.object({
   secrets: e.array(R).optional(),
   supported_triggers: e.array(j).optional(),
   deployed: e.boolean().default(!0)
-}), nn = re.extend({
+}), nn = se.extend({
   id: e.string(),
   tenant_id: e.string(),
   number: e.number().int(),
@@ -149,7 +157,7 @@ const a = e.object({
   timestamp: e.string()
 }), an = me.extend({
   id: e.string()
-}), sn = e.enum(["AUTH0", "EMAIL", "REDIRECT"]), rn = e.enum([
+}), rn = e.enum(["AUTH0", "EMAIL", "REDIRECT"]), sn = e.enum([
   "CREATE_USER",
   "GET_USER",
   "UPDATE_USER",
@@ -490,11 +498,8 @@ const ke = e.object({
   client_metadata: e.record(e.string().max(255)).default({}).optional().openapi({
     description: 'Metadata associated with the client, in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. Field names (max 255 chars) are alphanumeric and may only include the following special characters: :,-+=_*?"/()<>@ [Tab][Space]'
   }),
-  disable_sign_ups: e.boolean().default(!1).optional().openapi({
-    description: "When true, blocks new user sign-ups via this client. The identifier/signup screen rejects emails that don't match an existing user with `User account does not exist` (unless `hide_sign_up_disabled_error` is also set). Existing users — including those signing in via a federated connection that links to an existing account — are unaffected."
-  }),
   hide_sign_up_disabled_error: e.boolean().default(!1).optional().openapi({
-    description: "Enumeration-safe variant of `disable_sign_ups`. When both are true, the identifier screen does not reveal that an email is unknown — it advances to the OTP/password challenge as if the account existed and fails at credential check. Mitigates email enumeration at the cost of UX: users without an account see a generic credential failure instead of an explicit signup-disabled message."
+    description: "Enumeration-safe variant of the connection-level `disable_signup` flag. When a signup is blocked by the password connection and this is true, the identifier screen does not reveal that an email is unknown — it advances to the OTP/password challenge as if the account existed and fails at credential check. Mitigates email enumeration at the cost of UX: users without an account see a generic credential failure instead of an explicit signup-disabled message."
   }),
   mobile: e.record(e.any()).default({}).optional().openapi({
     description: "Additional configuration for native mobile apps."
@@ -754,7 +759,7 @@ const C = e.object({
   Me
 ]);
 var Ge = /* @__PURE__ */ ((t) => (t.STEP = "STEP", t.FLOW = "FLOW", t.CONDITION = "CONDITION", t.ACTION = "ACTION", t))(Ge || {});
-const We = e.object({
+const Be = e.object({
   id: e.string(),
   type: e.literal(
     "STEP"
@@ -766,7 +771,7 @@ const We = e.object({
     components: e.array(He),
     next_node: e.string()
   }).passthrough()
-}), Be = e.object({
+}), We = e.object({
   id: e.string(),
   type: e.literal(
     "FLOW"
@@ -805,8 +810,8 @@ const We = e.object({
   type: e.string(),
   coordinates: m
 }).passthrough(), qe = e.union([
-  We,
   Be,
+  We,
   Ke,
   ze
 ]), Xe = e.object({
@@ -996,8 +1001,19 @@ const w = e.union([
   disable_signup: e.boolean().optional(),
   // Brute force protection
   brute_force_protection: e.boolean().optional(),
-  // Import mode
+  // Import mode (Auth0 custom-DB semantics): when true and a successful
+  // upstream verification occurs, the user/password row is created locally
+  // so subsequent logins are served entirely from authhero.
   import_mode: e.boolean().optional(),
+  // Upstream migration credentials. Mirrors Auth0's
+  // `options.configuration` (encrypted env-vars accessed from custom
+  // scripts). For lazy migration, set when `import_mode: true`.
+  configuration: e.object({
+    token_endpoint: e.string().optional(),
+    userinfo_endpoint: e.string().optional(),
+    client_id: e.string().optional(),
+    client_secret: e.string().optional()
+  }).optional(),
   // Flexible Identifiers: attributes schema (replaces legacy requires_username)
   attributes: e.object({
     email: e.object({
@@ -1150,12 +1166,12 @@ const tt = e.object({
   config: e.object({
     text: e.string().optional()
   }).optional()
-}), st = l.extend({
+}), rt = l.extend({
   type: e.literal("HTML"),
   config: e.object({
     content: e.string().optional()
   }).optional()
-}), rt = l.extend({
+}), st = l.extend({
   type: e.literal("IMAGE"),
   config: e.object({
     src: e.string().optional(),
@@ -1373,8 +1389,8 @@ const tt = e.object({
   }).optional()
 }), Dt = e.discriminatedUnion("type", [
   at,
-  st,
   rt,
+  st,
   lt,
   ct,
   pt,
@@ -1513,7 +1529,7 @@ const tt = e.object({
   id: e.number().optional(),
   text: e.string(),
   type: e.enum(["info", "error", "success", "warning"])
-}), Wt = e.object({
+}), Bt = e.object({
   id: e.string().optional(),
   text: e.string(),
   href: e.string(),
@@ -1527,7 +1543,7 @@ const tt = e.object({
   description: e.string().optional(),
   components: e.array(M),
   messages: e.array(Gt).optional(),
-  links: e.array(Wt).optional(),
+  links: e.array(Bt).optional(),
   /** Footer HTML content displayed at the very bottom of the widget (e.g., terms and conditions) */
   footer: e.string().optional()
 });
@@ -1556,12 +1572,12 @@ const H = e.enum([
   "validate-registration-username",
   "pre-user-deletion",
   "post-user-deletion"
-]), W = e.enum([
+]), B = e.enum([
   "post-user-login",
   "post-user-registration",
   "post-user-update",
   "credentials-exchange"
-]), B = e.enum([
+]), W = e.enum([
   "post-user-login",
   "credentials-exchange",
   "pre-user-registration",
@@ -1607,7 +1623,7 @@ const H = e.enum([
    * Everything else is opaque to the runtime. Persisted as JSON.
    */
   metadata: e.record(e.unknown()).optional()
-}, Bt = e.object({
+}, Wt = e.object({
   ...c,
   trigger_id: H,
   url: e.string()
@@ -1617,14 +1633,14 @@ const H = e.enum([
   form_id: e.string()
 }), zt = e.object({
   ...c,
-  trigger_id: W,
+  trigger_id: B,
   template_id: K
 }), qt = e.object({
   ...c,
-  trigger_id: B,
+  trigger_id: W,
   code_id: e.string()
 }), kn = e.union([
-  Bt,
+  Wt,
   Kt,
   zt,
   qt
@@ -1642,13 +1658,13 @@ const H = e.enum([
   form_id: e.string()
 }), Yt = e.object({
   ...c,
-  trigger_id: W,
+  trigger_id: B,
   ...a.shape,
   hook_id: e.string(),
   template_id: K
 }), Zt = e.object({
   ...c,
-  trigger_id: B,
+  trigger_id: W,
   ...a.shape,
   hook_id: e.string(),
   code_id: e.string()
@@ -1962,10 +1978,10 @@ const oo = e.nativeEnum(z), no = e.object({
   WARNING_DURING_LOGIN: "w",
   WARNING_SENDING_NOTIFICATION: "wn",
   WARNING_USER_MANAGEMENT: "wum"
-}, so = e.string().refine(
+}, ro = e.string().refine(
   (t) => Object.values(ao).includes(t),
   { message: "Invalid log type" }
-), ro = e.object({
+), so = e.object({
   name: e.string(),
   version: e.string(),
   env: e.object({
@@ -1979,7 +1995,7 @@ const oo = e.nativeEnum(z), no = e.object({
   time_zone: e.string(),
   continent_code: e.string()
 }), co = e.object({
-  type: so,
+  type: ro,
   date: e.string(),
   description: e.string().optional(),
   ip: e.string().optional(),
@@ -1998,7 +2014,7 @@ const oo = e.nativeEnum(z), no = e.object({
   strategy: e.string().optional(),
   strategy_type: e.string().optional(),
   hostname: e.string().optional(),
-  auth0_client: ro.optional(),
+  auth0_client: so.optional(),
   log_id: e.string().optional(),
   location_info: lo.optional()
 }), Fn = e.object({
@@ -2315,14 +2331,14 @@ const oo = e.nativeEnum(z), no = e.object({
       message: e.string().optional()
     }).optional()
   }).optional()
-}), Wn = e.object({
+}), Bn = e.object({
   created_at: e.string().nullable().transform((t) => t ?? ""),
   updated_at: e.string().nullable().transform((t) => t ?? ""),
   ...So.shape,
   id: e.string()
 });
 var yo = /* @__PURE__ */ ((t) => (t.RefreshToken = "refresh_token", t.AuthorizationCode = "authorization_code", t.ClientCredential = "client_credentials", t.Passwordless = "passwordless", t.Password = "password", t.OTP = "http://auth0.com/oauth/grant-type/passwordless/otp", t))(yo || {});
-const Bn = e.object({
+const Wn = e.object({
   access_token: e.string(),
   id_token: e.string().optional(),
   scope: e.string().optional(),
@@ -2567,13 +2583,13 @@ const Ao = e.object({
   metadata: e.record(e.any()).optional().openapi({
     description: "Metadata associated with the role. Can be used to control sync behavior in multi-tenancy scenarios."
   })
-}), Wo = Go.extend({
+}), Bo = Go.extend({
   id: e.string().openapi({
     description: "The unique identifier of the role"
   }),
   created_at: e.string().optional(),
   updated_at: e.string().optional()
-}), oi = e.array(Wo), Bo = e.object({
+}), oi = e.array(Bo), Wo = e.object({
   logo_url: e.string().optional().openapi({
     description: "URL of the organization's logo"
   }),
@@ -2620,7 +2636,7 @@ const Ao = e.object({
   display_name: e.string().optional().openapi({
     description: "The display name of the organization"
   }),
-  branding: Bo,
+  branding: Wo,
   metadata: e.record(e.any()).default({}).optional().openapi({
     description: "Custom metadata for the organization"
   }),
@@ -2665,7 +2681,7 @@ const Ao = e.object({
   ...Yo.shape,
   ...a.shape,
   id: e.string()
-}), si = e.object({
+}), ri = e.object({
   // Session settings
   idle_session_lifetime: e.number().default(72),
   session_lifetime: e.number().default(168),
@@ -2765,7 +2781,7 @@ const Ao = e.object({
       message: e.string().optional()
     }).optional()
   }).optional()
-}), ri = e.object({
+}), si = e.object({
   date: e.string().openapi({
     description: "Date these events occurred in ISO 8601 format",
     example: "2025-12-19"
@@ -2846,8 +2862,7 @@ const Ao = e.object({
   OAUTH2: "oauth2",
   SAMLP: "samlp",
   WAAD: "waad",
-  ADFS: "adfs",
-  AUTH0: "auth0"
+  ADFS: "adfs"
 }, di = {
   DATABASE: "database",
   SOCIAL: "social",
@@ -2914,34 +2929,34 @@ function mi(t) {
     secondaries: n,
     syncMethods: h = ["create", "rawCreate", "update", "remove", "delete", "set"]
   } = t, S = {
-    get(p, s) {
-      if (typeof s == "symbol")
-        return p[s];
-      const d = p[s];
-      return typeof d != "function" ? d : h.includes(s) ? async (..._) => {
+    get(p, r) {
+      if (typeof r == "symbol")
+        return p[r];
+      const d = p[r];
+      return typeof d != "function" ? d : h.includes(r) ? async (..._) => {
         const y = await d.apply(p, _), g = [];
-        for (const r of n) {
-          const b = r.adapter[s];
+        for (const s of n) {
+          const b = s.adapter[r];
           if (typeof b != "function")
             continue;
           const A = (async () => {
             try {
-              await b.apply(r.adapter, _);
+              await b.apply(s.adapter, _);
             } catch (f) {
               try {
-                r.onError ? r.onError(f, s, _) : console.error(
-                  `Passthrough adapter: secondary write failed for ${s}:`,
+                s.onError ? s.onError(f, r, _) : console.error(
+                  `Passthrough adapter: secondary write failed for ${r}:`,
                   f
                 );
               } catch (I) {
                 console.error(
-                  `Passthrough adapter: onError handler threw for ${s}:`,
+                  `Passthrough adapter: onError handler threw for ${r}:`,
                   I
                 );
               }
             }
           })();
-          r.blocking && g.push(A);
+          s.blocking && g.push(A);
         }
         return g.length > 0 && await Promise.all(g), y;
       } : d.bind(p);
@@ -2953,7 +2968,7 @@ function hi(t) {
   return t;
 }
 function bi(t) {
-  var S, p, s, d, _, y, g, r, b, A, f, I;
+  var S, p, r, d, _, y, g, s, b, A, f, I;
   const o = t == null ? void 0 : t.options;
   if (!o)
     return {
@@ -2964,7 +2979,7 @@ function bi(t) {
     };
   const n = o.attributes;
   if (n) {
-    const Z = ((p = (S = n.username) == null ? void 0 : S.identifier) == null ? void 0 : p.active) === !0, Q = ((d = (s = n.email) == null ? void 0 : s.identifier) == null ? void 0 : d.active) !== !1, $ = ((y = (_ = n.username) == null ? void 0 : _.validation) == null ? void 0 : y.min_length) ?? 1, J = ((r = (g = n.username) == null ? void 0 : g.validation) == null ? void 0 : r.max_length) ?? 15;
+    const Z = ((p = (S = n.username) == null ? void 0 : S.identifier) == null ? void 0 : p.active) === !0, Q = ((d = (r = n.email) == null ? void 0 : r.identifier) == null ? void 0 : d.active) !== !1, $ = ((y = (_ = n.username) == null ? void 0 : _.validation) == null ? void 0 : y.min_length) ?? 1, J = ((s = (g = n.username) == null ? void 0 : g.validation) == null ? void 0 : s.max_length) ?? 15;
     return {
       usernameIdentifierActive: Z,
       emailIdentifierActive: Q,
@@ -2983,8 +2998,8 @@ function fi(t) {
   return typeof t == "object" && t !== null && !Array.isArray(t);
 }
 export {
-  rn as Auth0ActionEnum,
-  ro as Auth0Client,
+  sn as Auth0ActionEnum,
+  so as Auth0Client,
   F as AuthorizationResponseMode,
   U as AuthorizationResponseType,
   P as CodeChallengeMethod,
@@ -2992,7 +3007,7 @@ export {
   L as ComponentType,
   ln as EmailActionEnum,
   An as FORM_FIELD_TYPES,
-  sn as FlowActionTypeEnum,
+  rn as FlowActionTypeEnum,
   yo as GrantType,
   lo as LocationInfo,
   ao as LogTypes,
@@ -3007,7 +3022,7 @@ export {
   ie as actionExecutionLogEntrySchema,
   ae as actionExecutionLogsSchema,
   ne as actionExecutionResultSchema,
-  se as actionExecutionSchema,
+  re as actionExecutionSchema,
   te as actionExecutionStatusSchema,
   ee as actionExecutionTriggerIdSchema,
   v as actionInsertSchema,
@@ -3016,7 +3031,7 @@ export {
   R as actionSecretSchema,
   j as actionTriggerSchema,
   en as actionUpdateSchema,
-  re as actionVersionInsertSchema,
+  se as actionVersionInsertSchema,
   nn as actionVersionSchema,
   li as activeUsersResponseSchema,
   ce as actorSchema,
@@ -3068,7 +3083,7 @@ export {
   yn as customDomainWithTenantIdSchema,
   ci as customTextEntrySchema,
   Qo as customTextSchema,
-  ri as dailyStatsSchema,
+  si as dailyStatsSchema,
   qn as emailProviderSchema,
   wo as emailTemplateNameSchema,
   Xn as emailTemplateSchema,
@@ -3080,8 +3095,8 @@ export {
   Ae as flowInsertSchema,
   cn as flowSchema,
   Pe as flowsFieldComponentSchema,
-  Be as flowsFlowNodeSchema,
-  We as flowsStepNodeSchema,
+  We as flowsFlowNodeSchema,
+  Be as flowsStepNodeSchema,
   u as fontDetailsSchema,
   Co as fontsSchema,
   In as formControlSchema,
@@ -3124,7 +3139,7 @@ export {
   oo as loginSessionStateSchema,
   qe as nodeSchema,
   xn as openIDConfigurationSchema,
-  Bo as organizationBrandingSchema,
+  Wo as organizationBrandingSchema,
   Xo as organizationConnectionInsertSchema,
   ii as organizationConnectionListSchema,
   Vo as organizationConnectionSchema,
@@ -3155,8 +3170,8 @@ export {
   Lo as rolePermissionInsertSchema,
   $n as rolePermissionListSchema,
   xo as rolePermissionSchema,
-  Wo as roleSchema,
-  Wt as screenLinkSchema,
+  Bo as roleSchema,
+  Bt as screenLinkSchema,
   Eo as sessionInsertSchema,
   Hn as sessionSchema,
   Gn as signingKeySchema,
@@ -3166,11 +3181,11 @@ export {
   ho as suspiciousIpThrottlingSchema,
   pe as targetSchema,
   So as tenantInsertSchema,
-  Wn as tenantSchema,
-  si as tenantSettingsSchema,
+  Bn as tenantSchema,
+  ri as tenantSettingsSchema,
   No as themeInsertSchema,
   Kn as themeSchema,
-  Bn as tokenResponseSchema,
+  Wn as tokenResponseSchema,
   dn as totalsSchema,
   Tn as uiScreenSchema,
   Oe as userInsertSchema,

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/markusahlstrand/authhero"
   },
-  "version": "1.19.0",
+  "version": "2.0.0",
   "files": [
     "dist"
   ],