authhero 5.12.0 → 5.13.0

package/dist/types/adapters/createEncryptedDataAdapter.d.ts

@@ -0,0 +1,14 @@
+import { DataAdapters } from "@authhero/adapter-interfaces";
+/**
+ * Wraps a DataAdapters instance so that sensitive credential fields are
+ * transparently encrypted on write and decrypted on read. Only the adapters
+ * that hold secrets are wrapped; everything else passes through unchanged.
+ *
+ * Encrypted columns: clients.client_secret, connections.options
+ * (client_secret/app_secret/twilio_token/configuration.client_secret),
+ * email_providers.credentials, authentication_methods.totp_secret,
+ * migration_sources.credentials.client_secret.
+ *
+ * Private keys (keys.pkcs7, dkim_private_key) are intentionally NOT covered.
+ */
+export declare function createEncryptedDataAdapter(data: DataAdapters, key: CryptoKey): DataAdapters;

package/dist/types/adapters/index.d.ts

@@ -1 +1,3 @@
 export * from "./cache";
+export { createEncryptedDataAdapter } from "./createEncryptedDataAdapter";
+export { loadEncryptionKey, encryptField, decryptField, isEncrypted, } from "../utils/field-encryption";

package/dist/types/authentication-flows/passwordless.d.ts

@@ -355,7 +355,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                             active?: boolean | undefined;
                         } | undefined;
                         signup?: {
-                            status?: "optional" | "required" | "disabled" | undefined;
+                            status?: "optional" | "disabled" | "required" | undefined;
                             verification?: {
                                 active?: boolean | undefined;
                             } | undefined;
@@ -372,7 +372,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                             active?: boolean | undefined;
                         } | undefined;
                         signup?: {
-                            status?: "optional" | "required" | "disabled" | undefined;
+                            status?: "optional" | "disabled" | "required" | undefined;
                         } | undefined;
                         validation?: {
                             max_length?: number | undefined;
@@ -389,7 +389,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                             active?: boolean | undefined;
                         } | undefined;
                         signup?: {
-                            status?: "optional" | "required" | "disabled" | undefined;
+                            status?: "optional" | "disabled" | "required" | undefined;
                         } | undefined;
                     } | undefined;
                 } | undefined;

package/dist/types/helpers/custom-domain.d.ts

@@ -0,0 +1,8 @@
+import { Bindings } from "../types";
+/**
+ * Resolve the hostname of a tenant's usable custom domain, if one exists.
+ *
+ * Only domains whose verification has completed ("ready") can serve traffic,
+ * so others are ignored. A primary domain wins over a non-primary one.
+ */
+export declare function getTenantCustomDomain(env: Bindings, tenantId: string): Promise<string | undefined>;