authhero 4.106.0 → 4.107.0

package/dist/authhero.d.ts

@@ -3101,6 +3101,10 @@ export declare const clientInsertSchema: z.ZodObject<{
 		"iat_dcr"
 	]>>;
 	registration_metadata: z.ZodOptional<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodAny>>>;
+	user_linking_mode: z.ZodOptional<z.ZodEnum<[
+		"builtin",
+		"off"
+	]>>;
 }, "strip", z.ZodTypeAny, {
 	name: string;
 	client_id: string;
@@ -3153,6 +3157,7 @@ export declare const clientInsertSchema: z.ZodObject<{
 	owner_user_id?: string | undefined;
 	registration_type?: "manual" | "open_dcr" | "iat_dcr" | undefined;
 	registration_metadata?: Record<string, any> | undefined;
+	user_linking_mode?: "builtin" | "off" | undefined;
 }, {
 	name: string;
 	client_id: string;
@@ -3205,6 +3210,7 @@ export declare const clientInsertSchema: z.ZodObject<{
 	owner_user_id?: string | undefined;
 	registration_type?: "manual" | "open_dcr" | "iat_dcr" | undefined;
 	registration_metadata?: Record<string, any> | undefined;
+	user_linking_mode?: "builtin" | "off" | undefined;
 }>;
 export type ClientInsert = z.input<typeof clientInsertSchema>;
 export declare const clientSchema: z.ZodObject<{
@@ -3307,6 +3313,10 @@ export declare const clientSchema: z.ZodObject<{
 		"iat_dcr"
 	]>>;
 	registration_metadata: z.ZodOptional<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodAny>>>;
+	user_linking_mode: z.ZodOptional<z.ZodEnum<[
+		"builtin",
+		"off"
+	]>>;
 	created_at: z.ZodString;
 	updated_at: z.ZodString;
 }, "strip", z.ZodTypeAny, {
@@ -3363,6 +3373,7 @@ export declare const clientSchema: z.ZodObject<{
 	owner_user_id?: string | undefined;
 	registration_type?: "manual" | "open_dcr" | "iat_dcr" | undefined;
 	registration_metadata?: Record<string, any> | undefined;
+	user_linking_mode?: "builtin" | "off" | undefined;
 }, {
 	created_at: string;
 	updated_at: string;
@@ -3417,6 +3428,7 @@ export declare const clientSchema: z.ZodObject<{
 	owner_user_id?: string | undefined;
 	registration_type?: "manual" | "open_dcr" | "iat_dcr" | undefined;
 	registration_metadata?: Record<string, any> | undefined;
+	user_linking_mode?: "builtin" | "off" | undefined;
 }>;
 export type Client = z.infer<typeof clientSchema>;
 export declare const clientGrantInsertSchema: z.ZodObject<{
@@ -42344,17 +42356,20 @@ export declare function isWidgetComponent(component: FormNodeComponent): compone
 export declare function isFieldComponent(component: FormNodeComponent): component is FieldComponent$1;
 export declare const hookTemplateId: z.ZodEnum<[
 	"ensure-username",
-	"set-preferred-username"
+	"set-preferred-username",
+	"account-linking"
 ]>;
 export type HookTemplateId = z.infer<typeof hookTemplateId>;
 /**
  * Registry of available hook templates.
- * Maps template IDs to their metadata and allowed triggers.
+ * Maps template IDs to their metadata and allowed triggers. Some templates
+ * (e.g. `account-linking`) can bind to more than one trigger; in that case
+ * `trigger_ids` lists every trigger the template supports.
  */
 export declare const hookTemplates: Record<HookTemplateId, {
 	name: string;
 	description: string;
-	trigger_id: string;
+	trigger_ids: string[];
 }>;
 export declare const hookInsertSchema: z.ZodUnion<[
 	z.ZodObject<{
@@ -42362,6 +42377,7 @@ export declare const hookInsertSchema: z.ZodUnion<[
 			"pre-user-registration",
 			"post-user-registration",
 			"post-user-login",
+			"post-user-update",
 			"validate-registration-username",
 			"pre-user-deletion",
 			"post-user-deletion"
@@ -42371,17 +42387,31 @@ export declare const hookInsertSchema: z.ZodUnion<[
 		synchronous: z.ZodDefault<z.ZodBoolean>;
 		priority: z.ZodOptional<z.ZodNumber>;
 		hook_id: z.ZodOptional<z.ZodString>;
+		/**
+		 * Free-form key/value bag for hook properties. Two well-known keys:
+		 *
+		 * - `inheritable: true` — when set on a hook on the control-plane tenant,
+		 *   the multi-tenancy sync surfaces this hook to sub-tenants (Phase 2).
+		 * - Template-specific options. Templates read their config here, e.g.
+		 *   `account-linking` reads `copy_user_metadata: true` to merge secondary
+		 *   user_metadata into the primary on link.
+		 *
+		 * Everything else is opaque to the runtime. Persisted as JSON.
+		 */
+		metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 	}, "strip", z.ZodTypeAny, {
 		url: string;
 		enabled: boolean;
-		trigger_id: "pre-user-registration" | "post-user-registration" | "post-user-login" | "validate-registration-username" | "pre-user-deletion" | "post-user-deletion";
+		trigger_id: "pre-user-registration" | "post-user-registration" | "post-user-login" | "post-user-update" | "validate-registration-username" | "pre-user-deletion" | "post-user-deletion";
 		synchronous: boolean;
+		metadata?: Record<string, unknown> | undefined;
 		priority?: number | undefined;
 		hook_id?: string | undefined;
 	}, {
 		url: string;
-		trigger_id: "pre-user-registration" | "post-user-registration" | "post-user-login" | "validate-registration-username" | "pre-user-deletion" | "post-user-deletion";
+		trigger_id: "pre-user-registration" | "post-user-registration" | "post-user-login" | "post-user-update" | "validate-registration-username" | "pre-user-deletion" | "post-user-deletion";
 		enabled?: boolean | undefined;
+		metadata?: Record<string, unknown> | undefined;
 		synchronous?: boolean | undefined;
 		priority?: number | undefined;
 		hook_id?: string | undefined;
@@ -42400,17 +42430,31 @@ export declare const hookInsertSchema: z.ZodUnion<[
 		synchronous: z.ZodDefault<z.ZodBoolean>;
 		priority: z.ZodOptional<z.ZodNumber>;
 		hook_id: z.ZodOptional<z.ZodString>;
+		/**
+		 * Free-form key/value bag for hook properties. Two well-known keys:
+		 *
+		 * - `inheritable: true` — when set on a hook on the control-plane tenant,
+		 *   the multi-tenancy sync surfaces this hook to sub-tenants (Phase 2).
+		 * - Template-specific options. Templates read their config here, e.g.
+		 *   `account-linking` reads `copy_user_metadata: true` to merge secondary
+		 *   user_metadata into the primary on link.
+		 *
+		 * Everything else is opaque to the runtime. Persisted as JSON.
+		 */
+		metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 	}, "strip", z.ZodTypeAny, {
 		enabled: boolean;
 		trigger_id: "pre-user-registration" | "post-user-registration" | "post-user-login" | "validate-registration-username" | "pre-user-deletion" | "post-user-deletion";
 		synchronous: boolean;
 		form_id: string;
+		metadata?: Record<string, unknown> | undefined;
 		priority?: number | undefined;
 		hook_id?: string | undefined;
 	}, {
 		trigger_id: "pre-user-registration" | "post-user-registration" | "post-user-login" | "validate-registration-username" | "pre-user-deletion" | "post-user-deletion";
 		form_id: string;
 		enabled?: boolean | undefined;
+		metadata?: Record<string, unknown> | undefined;
 		synchronous?: boolean | undefined;
 		priority?: number | undefined;
 		hook_id?: string | undefined;
@@ -42418,27 +42462,44 @@ export declare const hookInsertSchema: z.ZodUnion<[
 	z.ZodObject<{
 		trigger_id: z.ZodEnum<[
 			"post-user-login",
+			"post-user-registration",
+			"post-user-update",
 			"credentials-exchange"
 		]>;
 		template_id: z.ZodEnum<[
 			"ensure-username",
-			"set-preferred-username"
+			"set-preferred-username",
+			"account-linking"
 		]>;
 		enabled: z.ZodDefault<z.ZodBoolean>;
 		synchronous: z.ZodDefault<z.ZodBoolean>;
 		priority: z.ZodOptional<z.ZodNumber>;
 		hook_id: z.ZodOptional<z.ZodString>;
+		/**
+		 * Free-form key/value bag for hook properties. Two well-known keys:
+		 *
+		 * - `inheritable: true` — when set on a hook on the control-plane tenant,
+		 *   the multi-tenancy sync surfaces this hook to sub-tenants (Phase 2).
+		 * - Template-specific options. Templates read their config here, e.g.
+		 *   `account-linking` reads `copy_user_metadata: true` to merge secondary
+		 *   user_metadata into the primary on link.
+		 *
+		 * Everything else is opaque to the runtime. Persisted as JSON.
+		 */
+		metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 	}, "strip", z.ZodTypeAny, {
 		enabled: boolean;
-		trigger_id: "post-user-login" | "credentials-exchange";
+		trigger_id: "post-user-registration" | "post-user-login" | "post-user-update" | "credentials-exchange";
 		synchronous: boolean;
-		template_id: "ensure-username" | "set-preferred-username";
+		template_id: "ensure-username" | "set-preferred-username" | "account-linking";
+		metadata?: Record<string, unknown> | undefined;
 		priority?: number | undefined;
 		hook_id?: string | undefined;
 	}, {
-		trigger_id: "post-user-login" | "credentials-exchange";
-		template_id: "ensure-username" | "set-preferred-username";
+		trigger_id: "post-user-registration" | "post-user-login" | "post-user-update" | "credentials-exchange";
+		template_id: "ensure-username" | "set-preferred-username" | "account-linking";
 		enabled?: boolean | undefined;
+		metadata?: Record<string, unknown> | undefined;
 		synchronous?: boolean | undefined;
 		priority?: number | undefined;
 		hook_id?: string | undefined;
@@ -42455,17 +42516,31 @@ export declare const hookInsertSchema: z.ZodUnion<[
 		synchronous: z.ZodDefault<z.ZodBoolean>;
 		priority: z.ZodOptional<z.ZodNumber>;
 		hook_id: z.ZodOptional<z.ZodString>;
+		/**
+		 * Free-form key/value bag for hook properties. Two well-known keys:
+		 *
+		 * - `inheritable: true` — when set on a hook on the control-plane tenant,
+		 *   the multi-tenancy sync surfaces this hook to sub-tenants (Phase 2).
+		 * - Template-specific options. Templates read their config here, e.g.
+		 *   `account-linking` reads `copy_user_metadata: true` to merge secondary
+		 *   user_metadata into the primary on link.
+		 *
+		 * Everything else is opaque to the runtime. Persisted as JSON.
+		 */
+		metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 	}, "strip", z.ZodTypeAny, {
 		code_id: string;
 		enabled: boolean;
 		trigger_id: "pre-user-registration" | "post-user-registration" | "post-user-login" | "credentials-exchange";
 		synchronous: boolean;
+		metadata?: Record<string, unknown> | undefined;
 		priority?: number | undefined;
 		hook_id?: string | undefined;
 	}, {
 		code_id: string;
 		trigger_id: "pre-user-registration" | "post-user-registration" | "post-user-login" | "credentials-exchange";
 		enabled?: boolean | undefined;
+		metadata?: Record<string, unknown> | undefined;
 		synchronous?: boolean | undefined;
 		priority?: number | undefined;
 		hook_id?: string | undefined;
@@ -42482,6 +42557,7 @@ export declare const hookSchema: z.ZodUnion<[
 			"pre-user-registration",
 			"post-user-registration",
 			"post-user-login",
+			"post-user-update",
 			"validate-registration-username",
 			"pre-user-deletion",
 			"post-user-deletion"
@@ -42489,22 +42565,36 @@ export declare const hookSchema: z.ZodUnion<[
 		enabled: z.ZodDefault<z.ZodBoolean>;
 		synchronous: z.ZodDefault<z.ZodBoolean>;
 		priority: z.ZodOptional<z.ZodNumber>;
+		/**
+		 * Free-form key/value bag for hook properties. Two well-known keys:
+		 *
+		 * - `inheritable: true` — when set on a hook on the control-plane tenant,
+		 *   the multi-tenancy sync surfaces this hook to sub-tenants (Phase 2).
+		 * - Template-specific options. Templates read their config here, e.g.
+		 *   `account-linking` reads `copy_user_metadata: true` to merge secondary
+		 *   user_metadata into the primary on link.
+		 *
+		 * Everything else is opaque to the runtime. Persisted as JSON.
+		 */
+		metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 	}, "strip", z.ZodTypeAny, {
 		created_at: string;
 		updated_at: string;
 		url: string;
 		enabled: boolean;
-		trigger_id: "pre-user-registration" | "post-user-registration" | "post-user-login" | "validate-registration-username" | "pre-user-deletion" | "post-user-deletion";
+		trigger_id: "pre-user-registration" | "post-user-registration" | "post-user-login" | "post-user-update" | "validate-registration-username" | "pre-user-deletion" | "post-user-deletion";
 		synchronous: boolean;
 		hook_id: string;
+		metadata?: Record<string, unknown> | undefined;
 		priority?: number | undefined;
 	}, {
 		created_at: string;
 		updated_at: string;
 		url: string;
-		trigger_id: "pre-user-registration" | "post-user-registration" | "post-user-login" | "validate-registration-username" | "pre-user-deletion" | "post-user-deletion";
+		trigger_id: "pre-user-registration" | "post-user-registration" | "post-user-login" | "post-user-update" | "validate-registration-username" | "pre-user-deletion" | "post-user-deletion";
 		hook_id: string;
 		enabled?: boolean | undefined;
+		metadata?: Record<string, unknown> | undefined;
 		synchronous?: boolean | undefined;
 		priority?: number | undefined;
 	}>,
@@ -42524,6 +42614,18 @@ export declare const hookSchema: z.ZodUnion<[
 		enabled: z.ZodDefault<z.ZodBoolean>;
 		synchronous: z.ZodDefault<z.ZodBoolean>;
 		priority: z.ZodOptional<z.ZodNumber>;
+		/**
+		 * Free-form key/value bag for hook properties. Two well-known keys:
+		 *
+		 * - `inheritable: true` — when set on a hook on the control-plane tenant,
+		 *   the multi-tenancy sync surfaces this hook to sub-tenants (Phase 2).
+		 * - Template-specific options. Templates read their config here, e.g.
+		 *   `account-linking` reads `copy_user_metadata: true` to merge secondary
+		 *   user_metadata into the primary on link.
+		 *
+		 * Everything else is opaque to the runtime. Persisted as JSON.
+		 */
+		metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 	}, "strip", z.ZodTypeAny, {
 		created_at: string;
 		updated_at: string;
@@ -42532,6 +42634,7 @@ export declare const hookSchema: z.ZodUnion<[
 		synchronous: boolean;
 		hook_id: string;
 		form_id: string;
+		metadata?: Record<string, unknown> | undefined;
 		priority?: number | undefined;
 	}, {
 		created_at: string;
@@ -42540,6 +42643,7 @@ export declare const hookSchema: z.ZodUnion<[
 		hook_id: string;
 		form_id: string;
 		enabled?: boolean | undefined;
+		metadata?: Record<string, unknown> | undefined;
 		synchronous?: boolean | undefined;
 		priority?: number | undefined;
 	}>,
@@ -42547,33 +42651,50 @@ export declare const hookSchema: z.ZodUnion<[
 		hook_id: z.ZodString;
 		template_id: z.ZodEnum<[
 			"ensure-username",
-			"set-preferred-username"
+			"set-preferred-username",
+			"account-linking"
 		]>;
 		created_at: z.ZodString;
 		updated_at: z.ZodString;
 		trigger_id: z.ZodEnum<[
 			"post-user-login",
+			"post-user-registration",
+			"post-user-update",
 			"credentials-exchange"
 		]>;
 		enabled: z.ZodDefault<z.ZodBoolean>;
 		synchronous: z.ZodDefault<z.ZodBoolean>;
 		priority: z.ZodOptional<z.ZodNumber>;
+		/**
+		 * Free-form key/value bag for hook properties. Two well-known keys:
+		 *
+		 * - `inheritable: true` — when set on a hook on the control-plane tenant,
+		 *   the multi-tenancy sync surfaces this hook to sub-tenants (Phase 2).
+		 * - Template-specific options. Templates read their config here, e.g.
+		 *   `account-linking` reads `copy_user_metadata: true` to merge secondary
+		 *   user_metadata into the primary on link.
+		 *
+		 * Everything else is opaque to the runtime. Persisted as JSON.
+		 */
+		metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 	}, "strip", z.ZodTypeAny, {
 		created_at: string;
 		updated_at: string;
 		enabled: boolean;
-		trigger_id: "post-user-login" | "credentials-exchange";
+		trigger_id: "post-user-registration" | "post-user-login" | "post-user-update" | "credentials-exchange";
 		synchronous: boolean;
 		hook_id: string;
-		template_id: "ensure-username" | "set-preferred-username";
+		template_id: "ensure-username" | "set-preferred-username" | "account-linking";
+		metadata?: Record<string, unknown> | undefined;
 		priority?: number | undefined;
 	}, {
 		created_at: string;
 		updated_at: string;
-		trigger_id: "post-user-login" | "credentials-exchange";
+		trigger_id: "post-user-registration" | "post-user-login" | "post-user-update" | "credentials-exchange";
 		hook_id: string;
-		template_id: "ensure-username" | "set-preferred-username";
+		template_id: "ensure-username" | "set-preferred-username" | "account-linking";
 		enabled?: boolean | undefined;
+		metadata?: Record<string, unknown> | undefined;
 		synchronous?: boolean | undefined;
 		priority?: number | undefined;
 	}>,
@@ -42591,6 +42712,18 @@ export declare const hookSchema: z.ZodUnion<[
 		enabled: z.ZodDefault<z.ZodBoolean>;
 		synchronous: z.ZodDefault<z.ZodBoolean>;
 		priority: z.ZodOptional<z.ZodNumber>;
+		/**
+		 * Free-form key/value bag for hook properties. Two well-known keys:
+		 *
+		 * - `inheritable: true` — when set on a hook on the control-plane tenant,
+		 *   the multi-tenancy sync surfaces this hook to sub-tenants (Phase 2).
+		 * - Template-specific options. Templates read their config here, e.g.
+		 *   `account-linking` reads `copy_user_metadata: true` to merge secondary
+		 *   user_metadata into the primary on link.
+		 *
+		 * Everything else is opaque to the runtime. Persisted as JSON.
+		 */
+		metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 	}, "strip", z.ZodTypeAny, {
 		created_at: string;
 		updated_at: string;
@@ -42599,6 +42732,7 @@ export declare const hookSchema: z.ZodUnion<[
 		trigger_id: "pre-user-registration" | "post-user-registration" | "post-user-login" | "credentials-exchange";
 		synchronous: boolean;
 		hook_id: string;
+		metadata?: Record<string, unknown> | undefined;
 		priority?: number | undefined;
 	}, {
 		created_at: string;
@@ -42607,6 +42741,7 @@ export declare const hookSchema: z.ZodUnion<[
 		trigger_id: "pre-user-registration" | "post-user-registration" | "post-user-login" | "credentials-exchange";
 		hook_id: string;
 		enabled?: boolean | undefined;
+		metadata?: Record<string, unknown> | undefined;
 		synchronous?: boolean | undefined;
 		priority?: number | undefined;
 	}>
@@ -51206,6 +51341,10 @@ declare const enrichedClientSchema: z.ZodObject<{
 		"iat_dcr"
 	]>>;
 	registration_metadata: z.ZodOptional<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodAny>>>;
+	user_linking_mode: z.ZodOptional<z.ZodEnum<[
+		"builtin",
+		"off"
+	]>>;
 	created_at: z.ZodString;
 	updated_at: z.ZodString;
 }, "strip", z.ZodTypeAny, {
@@ -51510,6 +51649,7 @@ declare const enrichedClientSchema: z.ZodObject<{
 	owner_user_id?: string | undefined;
 	registration_type?: "manual" | "open_dcr" | "iat_dcr" | undefined;
 	registration_metadata?: Record<string, any> | undefined;
+	user_linking_mode?: "builtin" | "off" | undefined;
 }, {
 	name: string;
 	tenant: {
@@ -51812,6 +51952,7 @@ declare const enrichedClientSchema: z.ZodObject<{
 	owner_user_id?: string | undefined;
 	registration_type?: "manual" | "open_dcr" | "iat_dcr" | undefined;
 	registration_metadata?: Record<string, any> | undefined;
+	user_linking_mode?: "builtin" | "off" | undefined;
 }>;
 export type EnrichedClient = z.infer<typeof enrichedClientSchema>;
 /** Context passed to entity hooks */
@@ -52157,6 +52298,26 @@ export interface OutboxConfig {
 	/** Max delivery retries before giving up on an event (default: 5) */
 	maxRetries?: number;
 }
+/**
+ * Mode for the built-in email-based user linking path.
+ *
+ * - `"builtin"` — `commitUserHook` runs the email→primary lookup at user
+ *   creation and email update, linking by verified email match. Default
+ *   for backwards compatibility.
+ * - `"off"` — built-in lookup is skipped. Linking only happens if the
+ *   tenant has enabled the `account-linking` template hook for the
+ *   relevant trigger (`post-user-registration`, `post-user-update`, or
+ *   `post-user-login`).
+ *
+ * The template hook is controlled independently via the management API,
+ * so a tenant on `"builtin"` mode can still enable the template at
+ * `post-user-login` to catch legacy unlinked accounts. Running both at
+ * the same trigger is harmless but redundant — the template no-ops once
+ * the built-in has set `linked_to`.
+ *
+ * A per-client `user_linking_mode` overrides this service-level default.
+ */
+export type UserLinkingMode = "builtin" | "off";
 export interface AuthHeroConfig {
 	dataAdapter: DataAdapters;
 	/**
@@ -52343,6 +52504,16 @@ export interface AuthHeroConfig {
 	 * by a background relay to the logs table (and other destinations).
 	 */
 	outbox?: OutboxConfig;
+	/**
+	 * Default mode for the built-in email-based user-linking path.
+	 *
+	 * Controls whether `linkUsersHook` performs an automatic primary-user
+	 * lookup by verified email at user creation and email update. A per-client
+	 * `user_linking_mode` setting overrides this default.
+	 *
+	 * @default "builtin"
+	 */
+	userLinkingMode?: UserLinkingMode;
 }
 export type UserInfo = {
 	sub: string;
@@ -52402,6 +52573,7 @@ export type Bindings = {
 	codeExecutor?: CodeExecutor;
 	webhookInvoker?: WebhookInvoker;
 	outbox?: OutboxConfig;
+	userLinkingMode?: UserLinkingMode;
 };
 export interface CreateX509CertificateParams {
 	name: string;
@@ -53228,8 +53400,27 @@ export interface AccountLinkingOptions {
 	 * @default true
 	 */
 	requireVerifiedEmail?: boolean;
+	/**
+	 * When the link is performed, merge the secondary user's `user_metadata`
+	 * into the primary's. Existing keys on the primary are NOT overwritten —
+	 * only keys absent from the primary are filled in from the secondary, so
+	 * the primary remains the source of truth for any conflicting values.
+	 *
+	 * `app_metadata` is intentionally never copied to avoid auto-merging into
+	 * the admin-only namespace.
+	 *
+	 * @default false
+	 */
+	copyUserMetadata?: boolean;
 }
-declare function accountLinking(options?: AccountLinkingOptions): OnExecutePostLogin;
+/**
+ * Trigger-agnostic event handler used by all `account-linking` template
+ * dispatch sites. It accepts the same shape as `OnExecutePostLogin` but
+ * ignores the trigger-specific `api` object, which lets the same function
+ * back `post-user-login`, `post-user-registration`, and `post-user-update`.
+ */
+export type AccountLinkingHandler = (event: HookEvent) => Promise<void>;
+declare function accountLinking(options?: AccountLinkingOptions): OnExecutePostLogin & AccountLinkingHandler;
 /**
  * Local code executor using `new Function()`.
  * Suitable for local development only — no isolation or sandboxing.
@@ -60814,9 +61005,12 @@ export declare function init(config: AuthHeroConfig): {
 					updated_at: string;
 					url: string;
 					enabled: boolean;
-					trigger_id: "pre-user-registration" | "post-user-registration" | "post-user-login" | "validate-registration-username" | "pre-user-deletion" | "post-user-deletion";
+					trigger_id: "pre-user-registration" | "post-user-registration" | "post-user-login" | "post-user-update" | "validate-registration-username" | "pre-user-deletion" | "post-user-deletion";
 					synchronous: boolean;
 					hook_id: string;
+					metadata?: {
+						[x: string]: import("hono/utils/types").JSONValue;
+					} | undefined;
 					priority?: number | undefined | undefined;
 				} | {
 					created_at: string;
@@ -60826,15 +61020,21 @@ export declare function init(config: AuthHeroConfig): {
 					synchronous: boolean;
 					hook_id: string;
 					form_id: string;
+					metadata?: {
+						[x: string]: import("hono/utils/types").JSONValue;
+					} | undefined;
 					priority?: number | undefined | undefined;
 				} | {
 					created_at: string;
 					updated_at: string;
 					enabled: boolean;
-					trigger_id: "post-user-login" | "credentials-exchange";
+					trigger_id: "post-user-registration" | "post-user-login" | "post-user-update" | "credentials-exchange";
 					synchronous: boolean;
 					hook_id: string;
-					template_id: "ensure-username" | "set-preferred-username";
+					template_id: "ensure-username" | "set-preferred-username" | "account-linking";
+					metadata?: {
+						[x: string]: import("hono/utils/types").JSONValue;
+					} | undefined;
 					priority?: number | undefined | undefined;
 				} | {
 					created_at: string;
@@ -60844,6 +61044,9 @@ export declare function init(config: AuthHeroConfig): {
 					trigger_id: "pre-user-registration" | "post-user-registration" | "post-user-login" | "credentials-exchange";
 					synchronous: boolean;
 					hook_id: string;
+					metadata?: {
+						[x: string]: import("hono/utils/types").JSONValue;
+					} | undefined;
 					priority?: number | undefined | undefined;
 				})[] | {
 					length: number;
@@ -60854,9 +61057,12 @@ export declare function init(config: AuthHeroConfig): {
 						updated_at: string;
 						url: string;
 						enabled: boolean;
-						trigger_id: "pre-user-registration" | "post-user-registration" | "post-user-login" | "validate-registration-username" | "pre-user-deletion" | "post-user-deletion";
+						trigger_id: "pre-user-registration" | "post-user-registration" | "post-user-login" | "post-user-update" | "validate-registration-username" | "pre-user-deletion" | "post-user-deletion";
 						synchronous: boolean;
 						hook_id: string;
+						metadata?: {
+							[x: string]: import("hono/utils/types").JSONValue;
+						} | undefined;
 						priority?: number | undefined | undefined;
 					} | {
 						created_at: string;
@@ -60866,15 +61072,21 @@ export declare function init(config: AuthHeroConfig): {
 						synchronous: boolean;
 						hook_id: string;
 						form_id: string;
+						metadata?: {
+							[x: string]: import("hono/utils/types").JSONValue;
+						} | undefined;
 						priority?: number | undefined | undefined;
 					} | {
 						created_at: string;
 						updated_at: string;
 						enabled: boolean;
-						trigger_id: "post-user-login" | "credentials-exchange";
+						trigger_id: "post-user-registration" | "post-user-login" | "post-user-update" | "credentials-exchange";
 						synchronous: boolean;
 						hook_id: string;
-						template_id: "ensure-username" | "set-preferred-username";
+						template_id: "ensure-username" | "set-preferred-username" | "account-linking";
+						metadata?: {
+							[x: string]: import("hono/utils/types").JSONValue;
+						} | undefined;
 						priority?: number | undefined | undefined;
 					} | {
 						created_at: string;
@@ -60884,6 +61096,9 @@ export declare function init(config: AuthHeroConfig): {
 						trigger_id: "pre-user-registration" | "post-user-registration" | "post-user-login" | "credentials-exchange";
 						synchronous: boolean;
 						hook_id: string;
+						metadata?: {
+							[x: string]: import("hono/utils/types").JSONValue;
+						} | undefined;
 						priority?: number | undefined | undefined;
 					})[];
 					total?: number | undefined;
@@ -60902,8 +61117,9 @@ export declare function init(config: AuthHeroConfig): {
 				} & {
 					json: {
 						url: string;
-						trigger_id: "pre-user-registration" | "post-user-registration" | "post-user-login" | "validate-registration-username" | "pre-user-deletion" | "post-user-deletion";
+						trigger_id: "pre-user-registration" | "post-user-registration" | "post-user-login" | "post-user-update" | "validate-registration-username" | "pre-user-deletion" | "post-user-deletion";
 						enabled?: boolean | undefined;
+						metadata?: Record<string, unknown> | undefined;
 						synchronous?: boolean | undefined;
 						priority?: number | undefined;
 						hook_id?: string | undefined;
@@ -60911,13 +61127,15 @@ export declare function init(config: AuthHeroConfig): {
 						trigger_id: "pre-user-registration" | "post-user-registration" | "post-user-login" | "validate-registration-username" | "pre-user-deletion" | "post-user-deletion";
 						form_id: string;
 						enabled?: boolean | undefined;
+						metadata?: Record<string, unknown> | undefined;
 						synchronous?: boolean | undefined;
 						priority?: number | undefined;
 						hook_id?: string | undefined;
 					} | {
-						trigger_id: "post-user-login" | "credentials-exchange";
-						template_id: "ensure-username" | "set-preferred-username";
+						trigger_id: "post-user-registration" | "post-user-login" | "post-user-update" | "credentials-exchange";
+						template_id: "ensure-username" | "set-preferred-username" | "account-linking";
 						enabled?: boolean | undefined;
+						metadata?: Record<string, unknown> | undefined;
 						synchronous?: boolean | undefined;
 						priority?: number | undefined;
 						hook_id?: string | undefined;
@@ -60925,6 +61143,7 @@ export declare function init(config: AuthHeroConfig): {
 						code_id: string;
 						trigger_id: "pre-user-registration" | "post-user-registration" | "post-user-login" | "credentials-exchange";
 						enabled?: boolean | undefined;
+						metadata?: Record<string, unknown> | undefined;
 						synchronous?: boolean | undefined;
 						priority?: number | undefined;
 						hook_id?: string | undefined;
@@ -60935,9 +61154,12 @@ export declare function init(config: AuthHeroConfig): {
 					updated_at: string;
 					url: string;
 					enabled: boolean;
-					trigger_id: "pre-user-registration" | "post-user-registration" | "post-user-login" | "validate-registration-username" | "pre-user-deletion" | "post-user-deletion";
+					trigger_id: "pre-user-registration" | "post-user-registration" | "post-user-login" | "post-user-update" | "validate-registration-username" | "pre-user-deletion" | "post-user-deletion";
 					synchronous: boolean;
 					hook_id: string;
+					metadata?: {
+						[x: string]: import("hono/utils/types").JSONValue;
+					} | undefined;
 					priority?: number | undefined | undefined;
 				} | {
 					created_at: string;
@@ -60947,15 +61169,21 @@ export declare function init(config: AuthHeroConfig): {
 					synchronous: boolean;
 					hook_id: string;
 					form_id: string;
+					metadata?: {
+						[x: string]: import("hono/utils/types").JSONValue;
+					} | undefined;
 					priority?: number | undefined | undefined;
 				} | {
 					created_at: string;
 					updated_at: string;
 					enabled: boolean;
-					trigger_id: "post-user-login" | "credentials-exchange";
+					trigger_id: "post-user-registration" | "post-user-login" | "post-user-update" | "credentials-exchange";
 					synchronous: boolean;
 					hook_id: string;
-					template_id: "ensure-username" | "set-preferred-username";
+					template_id: "ensure-username" | "set-preferred-username" | "account-linking";
+					metadata?: {
+						[x: string]: import("hono/utils/types").JSONValue;
+					} | undefined;
 					priority?: number | undefined | undefined;
 				} | {
 					created_at: string;
@@ -60965,6 +61193,9 @@ export declare function init(config: AuthHeroConfig): {
 					trigger_id: "pre-user-registration" | "post-user-registration" | "post-user-login" | "credentials-exchange";
 					synchronous: boolean;
 					hook_id: string;
+					metadata?: {
+						[x: string]: import("hono/utils/types").JSONValue;
+					} | undefined;
 					priority?: number | undefined | undefined;
 				};
 				outputFormat: "json";
@@ -61005,9 +61236,12 @@ export declare function init(config: AuthHeroConfig): {
 					updated_at: string;
 					url: string;
 					enabled: boolean;
-					trigger_id: "pre-user-registration" | "post-user-registration" | "post-user-login" | "validate-registration-username" | "pre-user-deletion" | "post-user-deletion";
+					trigger_id: "pre-user-registration" | "post-user-registration" | "post-user-login" | "post-user-update" | "validate-registration-username" | "pre-user-deletion" | "post-user-deletion";
 					synchronous: boolean;
 					hook_id: string;
+					metadata?: {
+						[x: string]: import("hono/utils/types").JSONValue;
+					} | undefined;
 					priority?: number | undefined | undefined;
 				} | {
 					created_at: string;
@@ -61017,15 +61251,21 @@ export declare function init(config: AuthHeroConfig): {
 					synchronous: boolean;
 					hook_id: string;
 					form_id: string;
+					metadata?: {
+						[x: string]: import("hono/utils/types").JSONValue;
+					} | undefined;
 					priority?: number | undefined | undefined;
 				} | {
 					created_at: string;
 					updated_at: string;
 					enabled: boolean;
-					trigger_id: "post-user-login" | "credentials-exchange";
+					trigger_id: "post-user-registration" | "post-user-login" | "post-user-update" | "credentials-exchange";
 					synchronous: boolean;
 					hook_id: string;
-					template_id: "ensure-username" | "set-preferred-username";
+					template_id: "ensure-username" | "set-preferred-username" | "account-linking";
+					metadata?: {
+						[x: string]: import("hono/utils/types").JSONValue;
+					} | undefined;
 					priority?: number | undefined | undefined;
 				} | {
 					created_at: string;
@@ -61035,6 +61275,9 @@ export declare function init(config: AuthHeroConfig): {
 					trigger_id: "pre-user-registration" | "post-user-registration" | "post-user-login" | "credentials-exchange";
 					synchronous: boolean;
 					hook_id: string;
+					metadata?: {
+						[x: string]: import("hono/utils/types").JSONValue;
+					} | undefined;
 					priority?: number | undefined | undefined;
 				};
 				outputFormat: "json";
@@ -61071,9 +61314,12 @@ export declare function init(config: AuthHeroConfig): {
 					updated_at: string;
 					url: string;
 					enabled: boolean;
-					trigger_id: "pre-user-registration" | "post-user-registration" | "post-user-login" | "validate-registration-username" | "pre-user-deletion" | "post-user-deletion";
+					trigger_id: "pre-user-registration" | "post-user-registration" | "post-user-login" | "post-user-update" | "validate-registration-username" | "pre-user-deletion" | "post-user-deletion";
 					synchronous: boolean;
 					hook_id: string;
+					metadata?: {
+						[x: string]: import("hono/utils/types").JSONValue;
+					} | undefined;
 					priority?: number | undefined | undefined;
 				} | {
 					created_at: string;
@@ -61083,15 +61329,21 @@ export declare function init(config: AuthHeroConfig): {
 					synchronous: boolean;
 					hook_id: string;
 					form_id: string;
+					metadata?: {
+						[x: string]: import("hono/utils/types").JSONValue;
+					} | undefined;
 					priority?: number | undefined | undefined;
 				} | {
 					created_at: string;
 					updated_at: string;
 					enabled: boolean;
-					trigger_id: "post-user-login" | "credentials-exchange";
+					trigger_id: "post-user-registration" | "post-user-login" | "post-user-update" | "credentials-exchange";
 					synchronous: boolean;
 					hook_id: string;
-					template_id: "ensure-username" | "set-preferred-username";
+					template_id: "ensure-username" | "set-preferred-username" | "account-linking";
+					metadata?: {
+						[x: string]: import("hono/utils/types").JSONValue;
+					} | undefined;
 					priority?: number | undefined | undefined;
 				} | {
 					created_at: string;
@@ -61101,6 +61353,9 @@ export declare function init(config: AuthHeroConfig): {
 					trigger_id: "pre-user-registration" | "post-user-registration" | "post-user-login" | "credentials-exchange";
 					synchronous: boolean;
 					hook_id: string;
+					metadata?: {
+						[x: string]: import("hono/utils/types").JSONValue;
+					} | undefined;
 					priority?: number | undefined | undefined;
 				};
 				outputFormat: "json";
@@ -61721,6 +61976,7 @@ export declare function init(config: AuthHeroConfig): {
 					registration_metadata?: {
 						[x: string]: any;
 					} | undefined;
+					user_linking_mode?: "builtin" | "off" | undefined | undefined;
 				}[] | {
 					length: number;
 					start: number;
@@ -61809,6 +62065,7 @@ export declare function init(config: AuthHeroConfig): {
 						registration_metadata?: {
 							[x: string]: any;
 						} | undefined;
+						user_linking_mode?: "builtin" | "off" | undefined | undefined;
 					}[];
 					total?: number | undefined;
 				};
@@ -61912,6 +62169,7 @@ export declare function init(config: AuthHeroConfig): {
 					registration_metadata?: {
 						[x: string]: any;
 					} | undefined;
+					user_linking_mode?: "builtin" | "off" | undefined | undefined;
 				};
 				outputFormat: "json";
 				status: 200;
@@ -61998,6 +62256,7 @@ export declare function init(config: AuthHeroConfig): {
 						owner_user_id?: string | undefined;
 						registration_type?: "manual" | "open_dcr" | "iat_dcr" | undefined;
 						registration_metadata?: Record<string, any> | undefined;
+						user_linking_mode?: "builtin" | "off" | undefined;
 					};
 				};
 				output: {
@@ -62084,6 +62343,7 @@ export declare function init(config: AuthHeroConfig): {
 					registration_metadata?: {
 						[x: string]: any;
 					} | undefined;
+					user_linking_mode?: "builtin" | "off" | undefined | undefined;
 				};
 				outputFormat: "json";
 				status: 200;
@@ -62149,6 +62409,7 @@ export declare function init(config: AuthHeroConfig): {
 						owner_user_id?: string | undefined;
 						registration_type?: "manual" | "open_dcr" | "iat_dcr" | undefined;
 						registration_metadata?: Record<string, any> | undefined;
+						user_linking_mode?: "builtin" | "off" | undefined;
 					};
 				};
 				output: {
@@ -62235,6 +62496,7 @@ export declare function init(config: AuthHeroConfig): {
 					registration_metadata?: {
 						[x: string]: any;
 					} | undefined;
+					user_linking_mode?: "builtin" | "off" | undefined;
 				};
 				outputFormat: "json";
 				status: 201;