authhero 5.8.0 → 5.9.0

package/dist/types/authentication-flows/passwordless.d.ts

@@ -0,0 +1,571 @@
+import { Context } from "hono";
+import { z } from "@hono/zod-openapi";
+import { Bindings, Variables } from "../types";
+export declare const passwordlessGrantParamsSchema: z.ZodObject<{
+    client_id: z.ZodString;
+    username: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+    otp: z.ZodString;
+    authParams: z.ZodOptional<z.ZodObject<{
+        client_id: z.ZodString;
+        act_as: z.ZodOptional<z.ZodString>;
+        response_type: z.ZodOptional<z.ZodEnum<typeof import("@authhero/adapter-interfaces").AuthorizationResponseType>>;
+        response_mode: z.ZodOptional<z.ZodEnum<typeof import("@authhero/adapter-interfaces").AuthorizationResponseMode>>;
+        redirect_uri: z.ZodOptional<z.ZodString>;
+        audience: z.ZodOptional<z.ZodString>;
+        organization: z.ZodOptional<z.ZodString>;
+        state: z.ZodOptional<z.ZodString>;
+        nonce: z.ZodOptional<z.ZodString>;
+        scope: z.ZodOptional<z.ZodString>;
+        prompt: z.ZodOptional<z.ZodString>;
+        code_challenge_method: z.ZodOptional<z.ZodEnum<typeof import("@authhero/adapter-interfaces").CodeChallengeMethod>>;
+        code_challenge: z.ZodOptional<z.ZodString>;
+        username: z.ZodOptional<z.ZodString>;
+        ui_locales: z.ZodOptional<z.ZodString>;
+        max_age: z.ZodOptional<z.ZodNumber>;
+        acr_values: z.ZodOptional<z.ZodString>;
+        claims: z.ZodOptional<z.ZodObject<{
+            userinfo: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodUnion<readonly [z.ZodNull, z.ZodObject<{
+                essential: z.ZodOptional<z.ZodBoolean>;
+                value: z.ZodOptional<z.ZodUnknown>;
+                values: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
+            }, z.core.$strip>]>>>>;
+            id_token: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodUnion<readonly [z.ZodNull, z.ZodObject<{
+                essential: z.ZodOptional<z.ZodBoolean>;
+                value: z.ZodOptional<z.ZodUnknown>;
+                values: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
+            }, z.core.$strip>]>>>>;
+        }, z.core.$strip>>;
+        vendor_id: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    enforceIpCheck: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+}, z.core.$strip>;
+export declare function passwordlessGrantUser(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, { client_id, username, otp, authParams, enforceIpCheck, }: z.input<typeof passwordlessGrantParamsSchema>): Promise<{
+    user: {
+        connection: string;
+        email_verified: boolean;
+        created_at: string;
+        updated_at: string;
+        user_id: string;
+        provider: string;
+        is_social: boolean;
+        login_count: number;
+        name?: string | undefined;
+        username?: string | undefined;
+        given_name?: string | undefined;
+        phone_number?: string | undefined;
+        phone_verified?: boolean | undefined;
+        family_name?: string | undefined;
+        profileData?: string | undefined;
+        address?: {
+            formatted?: string | undefined;
+            street_address?: string | undefined;
+            locality?: string | undefined;
+            region?: string | undefined;
+            postal_code?: string | undefined;
+            country?: string | undefined;
+        } | undefined;
+        nickname?: string | undefined;
+        picture?: string | undefined;
+        locale?: string | undefined;
+        linked_to?: string | undefined;
+        app_metadata?: any;
+        user_metadata?: any;
+        middle_name?: string | undefined;
+        preferred_username?: string | undefined;
+        profile?: string | undefined;
+        website?: string | undefined;
+        gender?: string | undefined;
+        birthdate?: string | undefined;
+        zoneinfo?: string | undefined;
+        verify_email?: boolean | undefined;
+        last_ip?: string | undefined;
+        last_login?: string | undefined;
+        registration_completed_at?: string | undefined;
+        email?: string | undefined;
+        identities?: {
+            connection: string;
+            user_id: string;
+            provider: string;
+            isSocial: boolean;
+            email?: string | undefined;
+            email_verified?: boolean | undefined;
+            phone_number?: string | undefined;
+            phone_verified?: boolean | undefined;
+            username?: string | undefined;
+            access_token?: string | undefined;
+            access_token_secret?: string | undefined;
+            refresh_token?: string | undefined;
+            profileData?: {
+                [x: string]: any;
+                email?: string | undefined;
+                email_verified?: boolean | undefined;
+                name?: string | undefined;
+                username?: string | undefined;
+                given_name?: string | undefined;
+                phone_number?: string | undefined;
+                phone_verified?: boolean | undefined;
+                family_name?: string | undefined;
+            } | undefined;
+        }[] | undefined;
+    };
+    client: {
+        created_at: string;
+        updated_at: string;
+        name: string;
+        global: boolean;
+        is_first_party: boolean;
+        oidc_conformant: boolean;
+        auth0_conformant: boolean;
+        sso: boolean;
+        sso_disabled: boolean;
+        cross_origin_authentication: boolean;
+        custom_login_page_on: boolean;
+        require_pushed_authorization_requests: boolean;
+        require_proof_of_possession: boolean;
+        client_id: string;
+        tenant: {
+            created_at: string;
+            updated_at: string;
+            audience: string;
+            friendly_name: string;
+            sender_email: string;
+            sender_name: string;
+            id: string;
+            picture_url?: string | undefined;
+            support_email?: string | undefined;
+            support_url?: string | undefined;
+            session_lifetime?: number | undefined;
+            idle_session_lifetime?: number | undefined;
+            ephemeral_session_lifetime?: number | undefined;
+            idle_ephemeral_session_lifetime?: number | undefined;
+            session_cookie?: {
+                mode?: "persistent" | "non-persistent" | undefined;
+            } | undefined;
+            allowed_logout_urls?: string[] | undefined;
+            default_redirection_uri?: string | undefined;
+            default_client_id?: string | undefined;
+            enabled_locales?: string[] | undefined;
+            default_directory?: string | undefined;
+            error_page?: {
+                html?: string | undefined;
+                show_log_link?: boolean | undefined;
+                url?: string | undefined;
+            } | null | undefined;
+            flags?: {
+                allow_changing_enable_sso?: boolean | undefined;
+                allow_legacy_delegation_grant_types?: boolean | undefined;
+                allow_legacy_ro_grant_types?: boolean | undefined;
+                allow_legacy_tokeninfo_endpoint?: boolean | undefined;
+                change_pwd_flow_v1?: boolean | undefined;
+                custom_domains_provisioning?: boolean | undefined;
+                dashboard_insights_view?: boolean | undefined;
+                dashboard_log_streams_next?: boolean | undefined;
+                disable_clickjack_protection_headers?: boolean | undefined;
+                disable_fields_map_fix?: boolean | undefined;
+                disable_impersonation?: boolean | undefined;
+                disable_management_api_sms_obfuscation?: boolean | undefined;
+                enable_adfs_waad_email_verification?: boolean | undefined;
+                enable_apis_section?: boolean | undefined;
+                enable_client_connections?: boolean | undefined;
+                enable_custom_domain_in_emails?: boolean | undefined;
+                enable_dynamic_client_registration?: boolean | undefined;
+                dcr_require_initial_access_token?: boolean | undefined;
+                dcr_allowed_grant_types?: string[] | undefined;
+                allow_http_return_to?: string[] | undefined;
+                enable_idtoken_api2?: boolean | undefined;
+                enable_legacy_logs_search_v2?: boolean | undefined;
+                enable_legacy_profile?: boolean | undefined;
+                enable_pipeline2?: boolean | undefined;
+                enable_public_signup_user_exists_error?: boolean | undefined;
+                enable_sso?: boolean | undefined;
+                enforce_client_authentication_on_passwordless_start?: boolean | undefined;
+                genai_trial?: boolean | undefined;
+                improved_signup_bot_detection_in_classic?: boolean | undefined;
+                mfa_show_factor_list_on_enrollment?: boolean | undefined;
+                no_disclose_enterprise_connections?: boolean | undefined;
+                remove_alg_from_jwks?: boolean | undefined;
+                revoke_refresh_token_grant?: boolean | undefined;
+                trust_azure_adfs_email_verified_connection_property?: boolean | undefined;
+                use_scope_descriptions_for_consent?: boolean | undefined;
+                inherit_global_permissions_in_organizations?: boolean | undefined;
+            } | undefined;
+            sandbox_version?: string | undefined;
+            legacy_sandbox_version?: string | undefined;
+            sandbox_versions_available?: string[] | undefined;
+            change_password?: {
+                enabled?: boolean | undefined;
+                html?: string | undefined;
+            } | undefined;
+            guardian_mfa_page?: {
+                enabled?: boolean | undefined;
+                html?: string | undefined;
+            } | undefined;
+            device_flow?: {
+                charset?: "base20" | "digits" | undefined;
+                mask?: string | undefined;
+            } | undefined;
+            default_token_quota?: {
+                clients?: {
+                    client_credentials?: Record<string, any> | undefined;
+                } | undefined;
+                organizations?: {
+                    client_credentials?: Record<string, any> | undefined;
+                } | undefined;
+            } | null | undefined;
+            default_audience?: string | undefined;
+            default_organization?: string | undefined;
+            sessions?: {
+                oidc_logout_prompt_enabled?: boolean | undefined;
+            } | undefined;
+            oidc_logout?: {
+                rp_logout_end_session_endpoint_discovery?: boolean | undefined;
+            } | undefined;
+            allow_organization_name_in_authentication_api?: boolean | undefined;
+            customize_mfa_in_postlogin_action?: boolean | undefined;
+            acr_values_supported?: string[] | undefined;
+            mtls?: {
+                enable_endpoint_aliases?: boolean | undefined;
+            } | null | undefined;
+            pushed_authorization_requests_supported?: boolean | undefined;
+            authorization_response_iss_parameter_supported?: boolean | undefined;
+            attack_protection?: {
+                breached_password_detection?: {
+                    enabled?: boolean | undefined;
+                    shields?: string[] | undefined;
+                    admin_notification_frequency?: string[] | undefined;
+                    method?: string | undefined;
+                    stage?: {
+                        "pre-user-registration"?: {
+                            shields?: string[] | undefined;
+                        } | undefined;
+                        "pre-change-password"?: {
+                            shields?: string[] | undefined;
+                        } | undefined;
+                    } | undefined;
+                } | undefined;
+                brute_force_protection?: {
+                    enabled?: boolean | undefined;
+                    shields?: string[] | undefined;
+                    allowlist?: string[] | undefined;
+                    mode?: string | undefined;
+                    max_attempts?: number | undefined;
+                } | undefined;
+                suspicious_ip_throttling?: {
+                    enabled?: boolean | undefined;
+                    shields?: string[] | undefined;
+                    allowlist?: string[] | undefined;
+                    stage?: {
+                        "pre-login"?: {
+                            max_attempts?: number | undefined;
+                            rate?: number | undefined;
+                        } | undefined;
+                        "pre-user-registration"?: {
+                            max_attempts?: number | undefined;
+                            rate?: number | undefined;
+                        } | undefined;
+                    } | undefined;
+                } | undefined;
+            } | undefined;
+            mfa?: {
+                policy?: "never" | "always" | undefined;
+                factors?: {
+                    sms: boolean;
+                    otp: boolean;
+                    email: boolean;
+                    push_notification: boolean;
+                    webauthn_roaming: boolean;
+                    webauthn_platform: boolean;
+                    recovery_code: boolean;
+                    duo: boolean;
+                } | undefined;
+                sms_provider?: {
+                    provider?: "twilio" | "vonage" | "aws_sns" | "phone_message_hook" | undefined;
+                } | undefined;
+                twilio?: {
+                    sid?: string | undefined;
+                    auth_token?: string | undefined;
+                    from?: string | undefined;
+                    messaging_service_sid?: string | undefined;
+                } | undefined;
+                phone_message?: {
+                    message?: string | undefined;
+                } | undefined;
+            } | undefined;
+            is_control_plane?: boolean | undefined;
+        };
+        connections: {
+            created_at: string;
+            updated_at: string;
+            name: string;
+            strategy: string;
+            options: {
+                kid?: string | undefined;
+                team_id?: string | undefined;
+                realms?: string | undefined;
+                authentication_method?: string | undefined;
+                client_id?: string | undefined;
+                client_secret?: string | undefined;
+                app_secret?: string | undefined;
+                scope?: string | undefined;
+                authorization_endpoint?: string | undefined;
+                token_endpoint?: string | undefined;
+                userinfo_endpoint?: string | undefined;
+                jwks_uri?: string | undefined;
+                discovery_url?: string | undefined;
+                issuer?: string | undefined;
+                token_endpoint_auth_method?: "client_secret_post" | "client_secret_basic" | undefined;
+                provider?: string | undefined;
+                from?: string | undefined;
+                twilio_sid?: string | undefined;
+                twilio_token?: string | undefined;
+                icon_url?: string | undefined;
+                domain_aliases?: string[] | undefined;
+                callback_url?: string | undefined;
+                passwordPolicy?: "none" | "low" | "fair" | "good" | "excellent" | undefined;
+                password_complexity_options?: {
+                    min_length?: number | undefined;
+                } | undefined;
+                password_history?: {
+                    enable?: boolean | undefined;
+                    size?: number | undefined;
+                } | undefined;
+                password_no_personal_info?: {
+                    enable?: boolean | undefined;
+                } | undefined;
+                password_dictionary?: {
+                    enable?: boolean | undefined;
+                    dictionary?: string[] | undefined;
+                } | undefined;
+                disable_signup?: boolean | undefined;
+                brute_force_protection?: boolean | undefined;
+                import_mode?: boolean | undefined;
+                configuration?: {
+                    token_endpoint?: string | undefined;
+                    userinfo_endpoint?: string | undefined;
+                    client_id?: string | undefined;
+                    client_secret?: string | undefined;
+                    realm?: string | undefined;
+                } | undefined;
+                attributes?: {
+                    email?: {
+                        identifier?: {
+                            active?: boolean | undefined;
+                        } | undefined;
+                        signup?: {
+                            status?: "optional" | "required" | "disabled" | undefined;
+                            verification?: {
+                                active?: boolean | undefined;
+                            } | undefined;
+                        } | undefined;
+                        validation?: {
+                            allowed?: boolean | undefined;
+                        } | undefined;
+                        unique?: boolean | undefined;
+                        profile_required?: boolean | undefined;
+                        verification_method?: "code" | "link" | undefined;
+                    } | undefined;
+                    username?: {
+                        identifier?: {
+                            active?: boolean | undefined;
+                        } | undefined;
+                        signup?: {
+                            status?: "optional" | "required" | "disabled" | undefined;
+                        } | undefined;
+                        validation?: {
+                            max_length?: number | undefined;
+                            min_length?: number | undefined;
+                            allowed_types?: {
+                                email?: boolean | undefined;
+                                phone_number?: boolean | undefined;
+                            } | undefined;
+                        } | undefined;
+                        profile_required?: boolean | undefined;
+                    } | undefined;
+                    phone_number?: {
+                        identifier?: {
+                            active?: boolean | undefined;
+                        } | undefined;
+                        signup?: {
+                            status?: "optional" | "required" | "disabled" | undefined;
+                        } | undefined;
+                    } | undefined;
+                } | undefined;
+                authentication_methods?: {
+                    password?: {
+                        enabled?: boolean | undefined;
+                    } | undefined;
+                    passkey?: {
+                        enabled?: boolean | undefined;
+                    } | undefined;
+                } | undefined;
+                passkey_options?: {
+                    challenge_ui?: "both" | "autofill" | "button" | undefined;
+                    local_enrollment_enabled?: boolean | undefined;
+                    progressive_enrollment_enabled?: boolean | undefined;
+                } | undefined;
+                requires_username?: boolean | undefined;
+                validation?: {
+                    username?: {
+                        min?: number | undefined;
+                        max?: number | undefined;
+                    } | undefined;
+                } | undefined;
+                set_user_root_attributes?: "on_each_login" | "on_first_login" | "never_on_login" | undefined;
+            };
+            id?: string | undefined;
+            display_name?: string | undefined;
+            enabled_clients?: string[] | undefined;
+            response_type?: import("@authhero/adapter-interfaces").AuthorizationResponseType | undefined;
+            response_mode?: import("@authhero/adapter-interfaces").AuthorizationResponseMode | undefined;
+            is_domain_connection?: boolean | undefined;
+            show_as_button?: boolean | undefined;
+            metadata?: Record<string, any> | undefined;
+            is_system?: boolean | undefined;
+        }[];
+        description?: string | undefined;
+        client_secret?: string | undefined;
+        app_type?: "native" | "spa" | "regular_web" | "non_interactive" | "resource_server" | "express_configuration" | "rms" | "box" | "cloudbees" | "concur" | "dropbox" | "mscrm" | "echosign" | "egnyte" | "newrelic" | "office365" | "salesforce" | "sentry" | "sharepoint" | "slack" | "springcm" | "zendesk" | "zoom" | "sso_integration" | "oag" | undefined;
+        logo_uri?: string | undefined;
+        callbacks?: string[] | undefined;
+        allowed_origins?: string[] | undefined;
+        web_origins?: string[] | undefined;
+        client_aliases?: string[] | undefined;
+        allowed_clients?: string[] | undefined;
+        allowed_logout_urls?: string[] | undefined;
+        session_transfer?: Record<string, any> | undefined;
+        oidc_logout?: Record<string, any> | undefined;
+        grant_types?: string[] | undefined;
+        jwt_configuration?: Record<string, any> | undefined;
+        signing_keys?: Record<string, any>[] | undefined;
+        encryption_key?: Record<string, any> | undefined;
+        cross_origin_loc?: string | undefined;
+        custom_login_page?: string | undefined;
+        custom_login_page_preview?: string | undefined;
+        form_template?: string | undefined;
+        addons?: Record<string, any> | undefined;
+        token_endpoint_auth_method?: "none" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | "private_key_jwt" | undefined;
+        client_metadata?: Record<string, string> | undefined;
+        hide_sign_up_disabled_error?: boolean | undefined;
+        mobile?: Record<string, any> | undefined;
+        initiate_login_uri?: string | undefined;
+        native_social_login?: Record<string, any> | undefined;
+        refresh_token?: {
+            rotation_type?: "rotating" | "non-rotating" | undefined;
+            leeway?: number | undefined;
+            expiration_type?: "expiring" | "non-expiring" | undefined;
+            token_lifetime?: number | undefined;
+            infinite_token_lifetime?: boolean | undefined;
+            idle_token_lifetime?: number | undefined;
+            infinite_idle_token_lifetime?: boolean | undefined;
+        } | undefined;
+        default_organization?: Record<string, any> | undefined;
+        organization_usage?: "deny" | "allow" | "require" | undefined;
+        organization_require_behavior?: "no_prompt" | "pre_login_prompt" | "post_login_prompt" | undefined;
+        client_authentication_methods?: Record<string, any> | undefined;
+        signed_request_object?: Record<string, any> | undefined;
+        compliance_level?: "none" | "fapi1_adv_pkj_par" | "fapi1_adv_mtls_par" | "fapi2_sp_pkj_mtls" | "fapi2_sp_mtls_mtls" | undefined;
+        par_request_expiry?: number | undefined;
+        token_quota?: Record<string, any> | undefined;
+        owner_user_id?: string | undefined;
+        registration_type?: "manual" | "open_dcr" | "iat_dcr" | undefined;
+        registration_metadata?: Record<string, any> | undefined;
+        user_linking_mode?: "builtin" | "off" | undefined;
+    };
+    loginSession: {
+        csrf_token: string;
+        authParams: {
+            client_id: string;
+            act_as?: string | undefined;
+            response_type?: import("@authhero/adapter-interfaces").AuthorizationResponseType | undefined;
+            response_mode?: import("@authhero/adapter-interfaces").AuthorizationResponseMode | undefined;
+            redirect_uri?: string | undefined;
+            audience?: string | undefined;
+            organization?: string | undefined;
+            state?: string | undefined;
+            nonce?: string | undefined;
+            scope?: string | undefined;
+            prompt?: string | undefined;
+            code_challenge_method?: import("@authhero/adapter-interfaces").CodeChallengeMethod | undefined;
+            code_challenge?: string | undefined;
+            username?: string | undefined;
+            ui_locales?: string | undefined;
+            max_age?: number | undefined;
+            acr_values?: string | undefined;
+            claims?: {
+                userinfo?: Record<string, {
+                    essential?: boolean | undefined;
+                    value?: unknown;
+                    values?: unknown[] | undefined;
+                } | null> | undefined;
+                id_token?: Record<string, {
+                    essential?: boolean | undefined;
+                    value?: unknown;
+                    values?: unknown[] | undefined;
+                } | null> | undefined;
+            } | undefined;
+            vendor_id?: string | undefined;
+        };
+        expires_at: string;
+        state: import("@authhero/adapter-interfaces").LoginSessionState;
+        id: string;
+        created_at: string;
+        updated_at: string;
+        auth0Client?: string | undefined;
+        deleted_at?: string | undefined;
+        ip?: string | undefined;
+        useragent?: string | undefined;
+        session_id?: string | undefined;
+        authorization_url?: string | undefined;
+        state_data?: string | undefined;
+        failure_reason?: string | undefined;
+        user_id?: string | undefined;
+        auth_connection?: string | undefined;
+        auth_strategy?: {
+            strategy: string;
+            strategy_type: string;
+        } | undefined;
+        authenticated_at?: string | undefined;
+    };
+    connectionType: "sms" | "email" | "username";
+    authConnection: "sms" | "email" | "username";
+    session_id: string | undefined;
+    authParams: {
+        client_id: string;
+        act_as?: string | undefined;
+        response_type?: import("@authhero/adapter-interfaces").AuthorizationResponseType | undefined;
+        response_mode?: import("@authhero/adapter-interfaces").AuthorizationResponseMode | undefined;
+        redirect_uri?: string | undefined;
+        audience?: string | undefined;
+        organization?: string | undefined;
+        state?: string | undefined;
+        nonce?: string | undefined;
+        scope?: string | undefined;
+        prompt?: string | undefined;
+        code_challenge_method?: import("@authhero/adapter-interfaces").CodeChallengeMethod | undefined;
+        code_challenge?: string | undefined;
+        username?: string | undefined;
+        ui_locales?: string | undefined;
+        max_age?: number | undefined;
+        acr_values?: string | undefined;
+        claims?: {
+            userinfo?: Record<string, {
+                essential?: boolean | undefined;
+                value?: unknown;
+                values?: unknown[] | undefined;
+            } | null> | undefined;
+            id_token?: Record<string, {
+                essential?: boolean | undefined;
+                value?: unknown;
+                values?: unknown[] | undefined;
+            } | null> | undefined;
+        } | undefined;
+        vendor_id?: string | undefined;
+    };
+}>;
+export declare function passwordlessGrant(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, params: z.input<typeof passwordlessGrantParamsSchema>): Promise<Response>;

package/dist/types/authentication-flows/refresh-token-migration.d.ts

@@ -0,0 +1,17 @@
+import { Context } from "hono";
+import { Bindings, Variables, GrantFlowUserResult } from "../types";
+import { EnrichedClient } from "../helpers/client";
+/**
+ * Try to redeem an unrecognized refresh token at one of the tenant's
+ * configured migration sources. On success, lazy-create the local user
+ * (matched by upstream `sub`), mint a fresh authhero refresh token, and
+ * return a `GrantFlowUserResult` so the outer dispatcher can issue
+ * access/id/refresh tokens through the normal mint path.
+ *
+ * Returns `null` if no migration source accepts the token, letting the
+ * caller fall through to the standard `invalid_grant` response.
+ */
+export declare function tryUpstreamRemint(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, client: EnrichedClient, refreshToken: string): Promise<GrantFlowUserResult | null>;

package/dist/types/authentication-flows/refresh-token.d.ts

@@ -0,0 +1,15 @@
+import { Context } from "hono";
+import { Bindings, Variables, GrantFlowUserResult } from "../types";
+import { z } from "@hono/zod-openapi";
+export declare const refreshTokenParamsSchema: z.ZodObject<{
+    grant_type: z.ZodLiteral<"refresh_token">;
+    client_id: z.ZodString;
+    redirect_uri: z.ZodOptional<z.ZodString>;
+    refresh_token: z.ZodString;
+    client_secret: z.ZodOptional<z.ZodString>;
+    organization: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare function refreshTokenGrant(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, params: z.infer<typeof refreshTokenParamsSchema>): Promise<GrantFlowUserResult>;

package/dist/types/authentication-flows/resume.d.ts

@@ -0,0 +1,22 @@
+import { Context } from "hono";
+import { Bindings, Variables } from "../types";
+/**
+ * Handler for `GET /authorize/resume?state=<login_session_id>`.
+ *
+ * Auth0 exposes an identically-named endpoint (see
+ * `app.pocketlaw.com.har`): after a Universal Login sub-flow submits the
+ * user's credentials, the sub-flow 302s here rather than issuing tokens
+ * inline. This endpoint is the single terminal site that:
+ *
+ *  1. Hops to the original authorization host if the browser is on the
+ *     wrong custom domain (so the session cookie lands under the right
+ *     wildcard).
+ *  2. Dispatches based on the LoginSessionMachine state.
+ *  3. Delegates the actual token/code issuance (and cookie write) to
+ *     `createFrontChannelAuthResponse`, which already handles MFA /
+ *     passkey-nudge / response-mode branching.
+ */
+export declare function resumeLoginSession(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, state: string): Promise<Response>;

package/dist/types/authentication-flows/silent.d.ts

@@ -0,0 +1,25 @@
+import { Context } from "hono";
+import { AuthorizationResponseType, AuthorizationResponseMode, CodeChallengeMethod, Session } from "@authhero/adapter-interfaces";
+import { EnrichedClient } from "../helpers/client";
+import { Bindings, Variables } from "../types";
+interface SilentAuthParams {
+    ctx: Context<{
+        Bindings: Bindings;
+        Variables: Variables;
+    }>;
+    client: EnrichedClient;
+    session?: Session;
+    redirect_uri: string;
+    state: string;
+    response_type: AuthorizationResponseType;
+    response_mode?: AuthorizationResponseMode;
+    nonce?: string;
+    code_challenge_method?: CodeChallengeMethod;
+    code_challenge?: string;
+    audience?: string;
+    scope?: string;
+    organization?: string;
+    max_age?: number;
+}
+export declare function silentAuth({ ctx, client, session, redirect_uri, state, nonce, code_challenge_method, code_challenge, audience, scope, response_type, response_mode, organization, max_age, }: SilentAuthParams): Promise<Response>;
+export {};

package/dist/types/authentication-flows/ticket.d.ts

@@ -0,0 +1,7 @@
+import { AuthParams } from "@authhero/adapter-interfaces";
+import { Context } from "hono";
+import { Bindings, Variables } from "../types";
+export declare function ticketAuth(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, tenant_id: string, ticketId: string, authParams: AuthParams, realm: string): Promise<Response>;