authhero 5.20.0 → 5.21.1

package/dist/types/authentication-flows/common.d.ts

@@ -11,7 +11,7 @@ import { GrantType } from "@authhero/adapter-interfaces";
 export interface AuthTokenClient {
     client_id: string;
     tenant: {
-        audience: string;
+        audience?: string;
         default_audience?: string;
         allow_organization_name_in_authentication_api?: boolean;
     };

package/dist/types/authentication-flows/passwordless.d.ts

@@ -129,14 +129,14 @@ export declare function passwordlessGrantUser(ctx: Context<{
         tenant: {
             created_at: string;
             updated_at: string;
-            audience: string;
             friendly_name: string;
-            sender_email: string;
-            sender_name: string;
             id: string;
+            audience?: string | undefined;
             picture_url?: string | undefined;
             support_email?: string | undefined;
             support_url?: string | undefined;
+            sender_email?: string | undefined;
+            sender_name?: string | undefined;
             session_lifetime?: number | undefined;
             idle_session_lifetime?: number | undefined;
             ephemeral_session_lifetime?: number | undefined;
@@ -233,6 +233,15 @@ export declare function passwordlessGrantUser(ctx: Context<{
             } | null | undefined;
             pushed_authorization_requests_supported?: boolean | undefined;
             authorization_response_iss_parameter_supported?: boolean | undefined;
+            deployment_type?: "shared" | "wfp" | undefined;
+            provisioning_state?: "pending" | "ready" | "failed" | undefined;
+            provisioning_error?: string | undefined;
+            provisioning_state_changed_at?: string | undefined;
+            bundle_configuration?: string | undefined;
+            worker_version?: string | undefined;
+            worker_script_name?: string | undefined;
+            storage_kind?: "own_d1" | "existing_d1" | "shared_planetscale" | undefined;
+            d1_database_id?: string | undefined;
             attack_protection?: {
                 breached_password_detection?: {
                     enabled?: boolean | undefined;

package/dist/types/helpers/client.d.ts

@@ -133,13 +133,13 @@ export declare const enrichedClientSchema: z.ZodObject<{
     tenant: z.ZodObject<{
         created_at: z.ZodPipe<z.ZodNullable<z.ZodString>, z.ZodTransform<string, string | null>>;
         updated_at: z.ZodPipe<z.ZodNullable<z.ZodString>, z.ZodTransform<string, string | null>>;
-        audience: z.ZodString;
+        audience: z.ZodOptional<z.ZodString>;
         friendly_name: z.ZodString;
         picture_url: z.ZodOptional<z.ZodString>;
         support_email: z.ZodOptional<z.ZodString>;
         support_url: z.ZodOptional<z.ZodString>;
-        sender_email: z.ZodString;
-        sender_name: z.ZodString;
+        sender_email: z.ZodOptional<z.ZodString>;
+        sender_name: z.ZodOptional<z.ZodString>;
         session_lifetime: z.ZodOptional<z.ZodNumber>;
         idle_session_lifetime: z.ZodOptional<z.ZodNumber>;
         ephemeral_session_lifetime: z.ZodOptional<z.ZodNumber>;
@@ -242,6 +242,26 @@ export declare const enrichedClientSchema: z.ZodObject<{
         }, z.core.$strip>>>;
         pushed_authorization_requests_supported: z.ZodOptional<z.ZodBoolean>;
         authorization_response_iss_parameter_supported: z.ZodOptional<z.ZodBoolean>;
+        deployment_type: z.ZodOptional<z.ZodDefault<z.ZodEnum<{
+            shared: "shared";
+            wfp: "wfp";
+        }>>>;
+        provisioning_state: z.ZodOptional<z.ZodDefault<z.ZodEnum<{
+            pending: "pending";
+            ready: "ready";
+            failed: "failed";
+        }>>>;
+        provisioning_error: z.ZodOptional<z.ZodString>;
+        provisioning_state_changed_at: z.ZodOptional<z.ZodString>;
+        bundle_configuration: z.ZodOptional<z.ZodString>;
+        worker_version: z.ZodOptional<z.ZodString>;
+        worker_script_name: z.ZodOptional<z.ZodString>;
+        storage_kind: z.ZodOptional<z.ZodEnum<{
+            own_d1: "own_d1";
+            existing_d1: "existing_d1";
+            shared_planetscale: "shared_planetscale";
+        }>>;
+        d1_database_id: z.ZodOptional<z.ZodString>;
         attack_protection: z.ZodOptional<z.ZodObject<{
             breached_password_detection: z.ZodOptional<z.ZodObject<{
                 enabled: z.ZodOptional<z.ZodBoolean>;

package/dist/types/helpers/logging.d.ts

@@ -5,6 +5,13 @@ export type LogParams = {
     type: LogType;
     description?: string;
     userId?: string;
+    /**
+     * Human-readable identifier for the subject user (email / phone / name).
+     * Populates the legacy `user_name` field and the audit event's `actor.email`
+     * when `ctx.var.username` is not set — useful for failure logs where the
+     * route handler couldn't authenticate but the caller has resolved the user.
+     */
+    username?: string;
     /**
      * Identifier of the actor when it differs from the subject `userId`
      * (e.g. impersonation). When set, audit events attribute `actor.id` to