@authhero/kysely-adapter 12.6.1 → 12.7.0

package/dist/types/migrate/migrations/2026-09-01T12:00:00_tenant_operation_rows.d.ts

@@ -0,0 +1,4 @@
+import { Kysely } from "kysely";
+import { Database } from "../../src/db";
+export declare function up(db: Kysely<Database>): Promise<void>;
+export declare function down(db: Kysely<Database>): Promise<void>;

package/dist/types/migrate/migrations/index.d.ts

@@ -7,6 +7,7 @@ import * as actionExecutionsCreatedAtIndex from "./2026-08-10T12:00:00_action_ex
 import * as pageHooks from "./2026-08-11T12:00:00_page_hooks";
 import * as refreshTokenSessionId from "./2026-08-20T12:00:00_refresh_token_session_id";
 import * as refreshTokenSessionIdBackfill from "./2026-08-21T12:00:00_refresh_token_session_id_backfill";
+import * as tenantOperationRows from "./2026-09-01T12:00:00_tenant_operation_rows";
 /**
  * Kysely runs these in key order and refuses to start if an already-executed
  * migration sorts after a pending one, so the keys must sort in execution
@@ -32,5 +33,6 @@ declare const _default: {
     "2026-08-11T12:00:00_page_hooks": typeof pageHooks;
     "2026-08-20T12:00:00_refresh_token_session_id": typeof refreshTokenSessionId;
     "2026-08-21T12:00:00_refresh_token_session_id_backfill": typeof refreshTokenSessionIdBackfill;
+    "2026-09-01T12:00:00_tenant_operation_rows": typeof tenantOperationRows;
 };
 export default _default;

package/dist/types/src/codes/create.d.ts

@@ -3,10 +3,10 @@ import { Kysely } from "kysely";
 import { Database } from "../db";
 export declare function create(db: Kysely<Database>): (tenant_id: string, code: CodeInsert) => Promise<{
     code_id: string;
-    login_id: string;
-    code_type: "otp" | "password_reset" | "email_verification" | "mfa_otp" | "authorization_code" | "oauth2_state" | "ticket";
+    code_type: "otp" | "password_reset" | "email_verification" | "mfa_otp" | "authorization_code" | "oauth2_state" | "ticket" | "client_assertion_jti";
     expires_at: string;
     created_at: string;
+    login_id?: string | undefined;
     connection_id?: string | undefined;
     code_verifier?: string | undefined;
     code_challenge?: string | undefined;

package/dist/types/src/customDomains/getByDomain.d.ts

@@ -3,22 +3,12 @@ import { Database } from "../db";
 export declare function getByDomain(db: Kysely<Database>): (domain: string) => Promise<{
     primary: boolean;
     domain_metadata: undefined;
+    verification: undefined;
     tenant_id: string;
     created_at: string;
     updated_at: string;
     verification_method: "txt" | undefined;
     status: "pending" | "disabled" | "pending_verification" | "ready";
-    verification: {
-        methods: ({
-            name: "txt";
-            record: string;
-            domain: string;
-        } | {
-            name: "http";
-            http_body: string;
-            http_url: string;
-        })[];
-    } | undefined;
     type: "auth0_managed_certs" | "self_managed_certs";
     domain: string;
     custom_client_ip_header: "null" | "true-client-ip" | "cf-connecting-ip" | "x-forwarded-for" | "x-azure-clientip" | undefined;

package/dist/types/src/db.d.ts

@@ -285,21 +285,11 @@ declare const sqlCustomDomainSchema: z.ZodObject<{
         ready: "ready";
     }>;
     origin_domain_name: z.ZodOptional<z.ZodString>;
-    verification: z.ZodOptional<z.ZodObject<{
-        methods: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
-            name: z.ZodLiteral<"txt">;
-            record: z.ZodString;
-            domain: z.ZodString;
-        }, z.core.$strip>, z.ZodObject<{
-            name: z.ZodLiteral<"http">;
-            http_body: z.ZodString;
-            http_url: z.ZodString;
-        }, z.core.$strip>], "name">>;
-    }, z.core.$strip>>;
     tls_policy: z.ZodOptional<z.ZodString>;
     primary: z.ZodNumber;
     tenant_id: z.ZodString;
     domain_metadata: z.ZodOptional<z.ZodString>;
+    verification: z.ZodOptional<z.ZodString>;
     created_at: z.ZodString;
     updated_at: z.ZodString;
 }, z.core.$strip>;
@@ -986,10 +976,26 @@ export interface Database {
         target_database_version: string | null;
         error: string | null;
         initiated_by: string | null;
+        input: string | null;
+        result: string | null;
+        claimed_by: string | null;
+        claim_expires_at: string | null;
         created_at: string;
         updated_at: string;
         finished_at: string | null;
     };
+    tenant_operation_rows: {
+        operation_id: string;
+        seq: number;
+        payload: string;
+        status: string;
+        error_code: string | null;
+        error_message: string | null;
+        error_path: string | null;
+        entity_id: string | null;
+        created_at: string;
+        updated_at: string;
+    };
     tenant_operation_events: {
         id: string;
         operation_id: string;

package/dist/types/src/outbox/replay.d.ts

@@ -6,6 +6,11 @@ import { Database } from "../db";
  * next_retry_at. Scoped to tenantId so management-API callers can't reach
  * into another tenant's dead-letter queue.
  *
+ * The claim is released too. `deadLetter` leaves `claimed_by` /
+ * `claim_expires_at` set from the relay pass that retired the event (unlike
+ * `markRetry`, which clears them), so a replay inside the 30s lease window
+ * would otherwise be skipped by `getUnprocessed` until the lease aged out.
+ *
  * Returns true if a row was updated (matched id + tenant + was dead-lettered),
  * false otherwise (so the route handler's 404 branch still works).
  */

package/dist/types/src/tenantOperationRows/index.d.ts

@@ -0,0 +1,4 @@
+import { Kysely } from "kysely";
+import { TenantOperationRowsAdapter } from "@authhero/adapter-interfaces";
+import { Database } from "../db";
+export declare function createTenantOperationRowsAdapter(db: Kysely<Database>): TenantOperationRowsAdapter;