authhero 8.17.3 → 8.18.0

package/dist/authhero.d.ts

@@ -1,6 +1,6 @@
 import * as hono_utils_types from 'hono/utils/types';
 import * as _authhero_adapter_interfaces from '@authhero/adapter-interfaces';
-import { LoginSession, DataAdapters, RolePermissionInsert, AuthorizationResponseMode, AuthorizationResponseType, User, CustomDomain, ProxyRoute, ResourceServer, ResourceServerInsert, Role, RoleInsert, Connection, ConnectionInsert, Tenant, CreateTenantParams, Hook, TenantOperationKind, TenantOperation, CodeExecutor, SigningKey, Theme, Branding, AuthParams, CacheAdapter, EmailServiceAdapter, EmailServiceSendParams, AuditEvent, OutboxAdapter, HooksAdapter, LogsDataAdapter, LogInsert, UserDataAdapter, CustomDomainsAdapter, ProxyRoutesAdapter, ListParams, KeysAdapter, CodeExecutionResult } from '@authhero/adapter-interfaces';
+import { LoginSession, DataAdapters, RolePermissionInsert, AuthorizationResponseMode, AuthorizationResponseType, User, CustomDomain, ProxyRoute, ResourceServer, ResourceServerInsert, Role, RoleInsert, Connection, ConnectionInsert, Tenant, CreateTenantParams, Hook, TenantOperationKind, TenantOperation, CodeExecutor, SigningKey, Theme, Branding, AuthParams, CacheAdapter, EmailServiceAdapter, EmailServiceSendParams, AuditEvent, OutboxAdapter, HooksAdapter, Client, LogsDataAdapter, LogInsert, UserDataAdapter, CustomDomainsAdapter, ProxyRoutesAdapter, ListParams, KeysAdapter, CodeExecutionResult } from '@authhero/adapter-interfaces';
 export * from '@authhero/adapter-interfaces';
 import * as hono_types from 'hono/types';
 import * as hono_utils_http_status from 'hono/utils/http-status';
@@ -2322,6 +2322,71 @@ interface CreateDefaultDestinationsConfig {
  */
 declare function createDefaultDestinations(config: CreateDefaultDestinationsConfig): EventDestination[];
 
+/**
+ * Whether a client can anchor interactive, user-facing flows (universal login,
+ * the DCR `/connect/start` consent bounce, etc.).
+ *
+ * A client is considered interactive unless it is explicitly machine-to-machine:
+ * `non_interactive`/`resource_server` app types, or a grant list that only
+ * allows `client_credentials`. Clients with no explicit `grant_types` are
+ * treated as interactive — that matches how a freshly created "Default App"
+ * (which relies on the authorize flow) behaves in AuthHero and Auth0.
+ */
+declare function isInteractiveClient(client: Pick<Client, "app_type" | "grant_types">): boolean;
+/** A single Management API scope entry (`{ value, description }`). */
+interface ManagementApiScope {
+    value: string;
+    description?: string;
+}
+interface ProvisionDefaultClientsOptions {
+    /** Display name for an auto-created Default App. Defaults to "Default App". */
+    defaultAppName?: string;
+    /** Callback URLs for an auto-created Default App. */
+    callbacks?: string[];
+    /** Allowed logout URLs for an auto-created Default App. */
+    allowedLogoutUrls?: string[];
+    /** Allowed web origins for an auto-created Default App. */
+    webOrigins?: string[];
+    /**
+     * Also provision an M2M "API Explorer" client authorized against the
+     * Management API (Auth0 parity). Defaults to `true`. Requires
+     * `managementApiScopes` to seed the resource server when it is missing.
+     */
+    createManagementClient?: boolean;
+    /** Management API identifier. Defaults to `urn:authhero:management`. */
+    managementApiIdentifier?: string;
+    /**
+     * Scopes used to seed the Management API resource server when it does not
+     * yet exist, and to authorize the M2M client's grant. When omitted, the
+     * resource server is assumed to already exist and the grant is created with
+     * no explicit scope.
+     */
+    managementApiScopes?: ManagementApiScope[];
+    /** Emit progress logs (used by the seed script). */
+    debug?: boolean;
+}
+interface ProvisionDefaultClientsResult {
+    /** The client the tenant's `default_client_id` now points at. */
+    defaultClientId: string;
+    /** The auto-provisioned M2M Management API client, if one was created/found. */
+    managementClientId?: string;
+}
+/**
+ * Ensures a tenant has a designated interactive default client and (optionally)
+ * an M2M Management API client, then points `tenant.default_client_id` at the
+ * former.
+ *
+ * Idempotent and import-safe:
+ * - Respects an already-set, still-valid `default_client_id`.
+ * - Reuses an existing interactive client instead of creating a duplicate.
+ * - Skips the M2M client when one already exists.
+ *
+ * Shared by every tenant-creation path (the seed/bootstrap script and the
+ * multi-tenancy provisioning hook) so new tenants come with a sensible anchor
+ * client by construction — see issue #1007.
+ */
+declare function provisionDefaultClients(adapters: DataAdapters, tenantId: string, options?: ProvisionDefaultClientsOptions): Promise<ProvisionDefaultClientsResult>;
+
 interface RunOutboxRelayConfig {
     /** Same `DataAdapters` passed to `init()`. Must include `outbox` to drain. */
     dataAdapter: DataAdapters;
@@ -9862,7 +9927,7 @@ declare function init(config: AuthHeroConfig): {
                     };
                 };
                 output: {
-                    prompt: "status" | "organizations" | "signup" | "login" | "mfa" | "login-id" | "login-password" | "signup-id" | "signup-password" | "reset-password" | "consent" | "mfa-push" | "mfa-otp" | "mfa-voice" | "mfa-phone" | "mfa-webauthn" | "mfa-email" | "mfa-recovery-code" | "device-flow" | "email-verification" | "email-otp-challenge" | "invitation" | "common" | "passkeys" | "captcha" | "custom-form" | "login-passwordless" | "mfa-login-options";
+                    prompt: "status" | "organizations" | "signup" | "mfa" | "login" | "login-id" | "login-password" | "signup-id" | "signup-password" | "reset-password" | "consent" | "mfa-push" | "mfa-otp" | "mfa-voice" | "mfa-phone" | "mfa-webauthn" | "mfa-email" | "mfa-recovery-code" | "device-flow" | "email-verification" | "email-otp-challenge" | "invitation" | "common" | "passkeys" | "captcha" | "custom-form" | "login-passwordless" | "mfa-login-options";
                     language: string;
                 }[];
                 outputFormat: "json";
@@ -9900,7 +9965,7 @@ declare function init(config: AuthHeroConfig): {
             $get: {
                 input: {
                     param: {
-                        prompt: "status" | "organizations" | "signup" | "login" | "mfa" | "login-id" | "login-password" | "signup-id" | "signup-password" | "reset-password" | "consent" | "mfa-push" | "mfa-otp" | "mfa-voice" | "mfa-phone" | "mfa-webauthn" | "mfa-email" | "mfa-recovery-code" | "device-flow" | "email-verification" | "email-otp-challenge" | "invitation" | "common" | "passkeys" | "captcha" | "custom-form" | "login-passwordless" | "mfa-login-options";
+                        prompt: "status" | "organizations" | "signup" | "mfa" | "login" | "login-id" | "login-password" | "signup-id" | "signup-password" | "reset-password" | "consent" | "mfa-push" | "mfa-otp" | "mfa-voice" | "mfa-phone" | "mfa-webauthn" | "mfa-email" | "mfa-recovery-code" | "device-flow" | "email-verification" | "email-otp-challenge" | "invitation" | "common" | "passkeys" | "captcha" | "custom-form" | "login-passwordless" | "mfa-login-options";
                         language: string;
                     };
                 } & {
@@ -9922,7 +9987,7 @@ declare function init(config: AuthHeroConfig): {
             $put: {
                 input: {
                     param: {
-                        prompt: "status" | "organizations" | "signup" | "login" | "mfa" | "login-id" | "login-password" | "signup-id" | "signup-password" | "reset-password" | "consent" | "mfa-push" | "mfa-otp" | "mfa-voice" | "mfa-phone" | "mfa-webauthn" | "mfa-email" | "mfa-recovery-code" | "device-flow" | "email-verification" | "email-otp-challenge" | "invitation" | "common" | "passkeys" | "captcha" | "custom-form" | "login-passwordless" | "mfa-login-options";
+                        prompt: "status" | "organizations" | "signup" | "mfa" | "login" | "login-id" | "login-password" | "signup-id" | "signup-password" | "reset-password" | "consent" | "mfa-push" | "mfa-otp" | "mfa-voice" | "mfa-phone" | "mfa-webauthn" | "mfa-email" | "mfa-recovery-code" | "device-flow" | "email-verification" | "email-otp-challenge" | "invitation" | "common" | "passkeys" | "captcha" | "custom-form" | "login-passwordless" | "mfa-login-options";
                         language: string;
                     };
                 } & {
@@ -9946,7 +10011,7 @@ declare function init(config: AuthHeroConfig): {
             $delete: {
                 input: {
                     param: {
-                        prompt: "status" | "organizations" | "signup" | "login" | "mfa" | "login-id" | "login-password" | "signup-id" | "signup-password" | "reset-password" | "consent" | "mfa-push" | "mfa-otp" | "mfa-voice" | "mfa-phone" | "mfa-webauthn" | "mfa-email" | "mfa-recovery-code" | "device-flow" | "email-verification" | "email-otp-challenge" | "invitation" | "common" | "passkeys" | "captcha" | "custom-form" | "login-passwordless" | "mfa-login-options";
+                        prompt: "status" | "organizations" | "signup" | "mfa" | "login" | "login-id" | "login-password" | "signup-id" | "signup-password" | "reset-password" | "consent" | "mfa-push" | "mfa-otp" | "mfa-voice" | "mfa-phone" | "mfa-webauthn" | "mfa-email" | "mfa-recovery-code" | "device-flow" | "email-verification" | "email-otp-challenge" | "invitation" | "common" | "passkeys" | "captcha" | "custom-form" | "login-passwordless" | "mfa-login-options";
                         language: string;
                     };
                 } & {
@@ -10844,7 +10909,7 @@ declare function init(config: AuthHeroConfig): {
                     tenant_id: string;
                     created_at: string;
                     updated_at: string;
-                    deploymentStatus: "deployed" | "failed" | "not_required";
+                    deploymentStatus: "failed" | "deployed" | "not_required";
                     secrets?: {
                         [x: string]: string;
                     } | undefined;
@@ -10934,7 +10999,7 @@ declare function init(config: AuthHeroConfig): {
                     tenant_id: string;
                     created_at: string;
                     updated_at: string;
-                    deploymentStatus: "deployed" | "failed" | "not_required";
+                    deploymentStatus: "failed" | "deployed" | "not_required";
                     secrets?: {
                         [x: string]: string;
                     } | undefined;
@@ -14541,6 +14606,7 @@ declare function init(config: AuthHeroConfig): {
                         permissions: {
                             permission_name: string;
                             resource_server_identifier: string;
+                            organization_id?: string | undefined;
                         }[];
                     };
                 };
@@ -14565,6 +14631,7 @@ declare function init(config: AuthHeroConfig): {
                         permissions: {
                             permission_name: string;
                             resource_server_identifier: string;
+                            organization_id?: string | undefined;
                         }[];
                     };
                 };
@@ -16200,7 +16267,7 @@ declare function init(config: AuthHeroConfig): {
                 output: {
                     id: string;
                     trigger_id: string;
-                    status: "unspecified" | "pending" | "final" | "partial" | "canceled" | "suspended";
+                    status: "pending" | "unspecified" | "final" | "partial" | "canceled" | "suspended";
                     results: {
                         action_name: string;
                         error: {
@@ -16247,7 +16314,7 @@ declare function init(config: AuthHeroConfig): {
                     logs: {
                         action_name: string;
                         lines: {
-                            level: "error" | "log" | "info" | "warn" | "debug";
+                            level: "error" | "log" | "debug" | "info" | "warn";
                             message: string;
                         }[];
                     }[];
@@ -16914,7 +16981,7 @@ declare function init(config: AuthHeroConfig): {
                         args: hono_utils_types.JSONValue[];
                     }[];
                     logs: {
-                        level: "error" | "log" | "info" | "warn" | "debug";
+                        level: "error" | "log" | "debug" | "info" | "warn";
                         message: string;
                     }[];
                     error?: string | undefined;
@@ -17666,11 +17733,11 @@ declare function init(config: AuthHeroConfig): {
                             state?: string | undefined;
                             response_type?: _authhero_adapter_interfaces.AuthorizationResponseType | undefined;
                             response_mode?: _authhero_adapter_interfaces.AuthorizationResponseMode | undefined;
-                            prompt?: string | undefined;
                             act_as?: string | undefined;
                             redirect_uri?: string | undefined;
                             organization?: string | undefined;
                             nonce?: string | undefined;
+                            prompt?: string | undefined;
                             code_challenge_method?: _authhero_adapter_interfaces.CodeChallengeMethod | undefined;
                             code_challenge?: string | undefined;
                             ui_locales?: string | undefined;
@@ -17702,11 +17769,11 @@ declare function init(config: AuthHeroConfig): {
                             state?: string | undefined;
                             response_type?: _authhero_adapter_interfaces.AuthorizationResponseType | undefined;
                             response_mode?: _authhero_adapter_interfaces.AuthorizationResponseMode | undefined;
-                            prompt?: string | undefined;
                             act_as?: string | undefined;
                             redirect_uri?: string | undefined;
                             organization?: string | undefined;
                             nonce?: string | undefined;
+                            prompt?: string | undefined;
                             code_challenge_method?: _authhero_adapter_interfaces.CodeChallengeMethod | undefined;
                             code_challenge?: string | undefined;
                             ui_locales?: string | undefined;
@@ -19783,5 +19850,5 @@ declare function init(config: AuthHeroConfig): {
     createX509Certificate: typeof createX509Certificate;
 };
 
-export { AppLogo, AuthLayout, Button$1 as Button, Button as ButtonUI, CONTROL_PLANE_SYNC_EVENT_PREFIX, CardContent, CardDescription, CardFooter, CardHeader, CardTitle, Card as CardUI, ControlPlaneSyncDestination, EmailValidatedPage, EnterCodePage, EnterPasswordPage, ErrorMessage, Footer, ForgotPasswordPage, ForgotPasswordSentPage, FormComponent, GoBack, Google as GoogleLogo, Icon, IdentifierForm, IdentifierPage, Input as InputUI, InvalidSessionPage as InvalidSession, Label as LabelUI, Layout, LocalCodeExecutor, LogsDestination, MANAGEMENT_API_AUDIENCE, MANAGEMENT_API_SCOPES, MailgunEmailService, MessagePage as Message, PostmarkEmailService, PreSignUpConfirmationPage, PreSignupPage as PreSignUpPage, RegistrationFinalizerDestination, ResendEmailService, ResetPasswordPage, SignupPage as SignUpPage, SocialButton, Spinner, Trans, USERNAME_PASSWORD_PROVIDER, UnverifiedEmailPage, UserNotFound as UserNotFoundPage, VippsLogo, WebhookDestination, addEntityHooks, backfillProxyHostsToKv, cleanupOutbox, cleanupSessions, cleanupUserSessions, clientInfoMiddleware, createApplySyncEvents, createAuthMiddleware, createDefaultDestinations, createEncryptedDataAdapter, createEncryptedDataAdapterWithKeyRing, createInMemoryCache, decryptField, decryptFieldWithRing, deepMergePatch, drainOutbox, encryptField, encryptFieldWithRing, ensureMutableResponse, fetchAll, init, injectTailwindCSS, isAllowedIssuer, isEncrypted, listControlPlaneKeys, loadEncryptionKey, mailgunCredentialsSchema, parseKeyId, postmarkCredentialsSchema, index_d as preDefinedHooks, resendCredentialsSchema, resolveSigningKeyMode, resolveSigningKeys, runOutboxRelay, seed, tailwindCss, tenantMiddleware, toMutableResponse, verifyControlPlaneToken, waitUntil, wrapProxyAdaptersWithKvPublish };
-export type { AuthHeroConfig, BackfillProxyHostsOptions, BackfillResult, ControlPlaneSyncDestinationOptions, CreateApplySyncEventsOptions, CreateDefaultDestinationsConfig, EncryptKeyIdResolver, EnsureUsernameOptions, EntityHookContext, EntityHooks, EntityHooksConfig, EventDestination, FetchAllOptions, GetServiceToken, HookEvent, HookRequest, Hooks, InMemoryCacheConfig, IssuerResolver, KeyRing, KvPublishOptions, MailgunCredentials, MailgunEmailServiceOptions, ManagementApiExtension, ManagementAudienceResolver, OnExecuteCredentialsExchange, OnExecuteCredentialsExchangeAPI, OnExecutePostLogin, OnExecutePostLoginAPI, OnExecutePostUserDeletion, OnExecutePostUserDeletionAPI, OnExecutePostUserRegistration, OnExecutePostUserRegistrationAPI, OnExecutePostUserUpdate, OnExecutePostUserUpdateAPI, OnExecutePreUserDeletion, OnExecutePreUserDeletionAPI, OnExecutePreUserRegistration, OnExecutePreUserRegistrationAPI, OnExecutePreUserUpdate, OnExecutePreUserUpdateAPI, OnExecuteValidateRegistrationUsername, OnExecuteValidateRegistrationUsernameAPI, OnFetchUserInfo, OnFetchUserInfoAPI, OutboxCleanupParams, OutboxConfig, PostmarkCredentials, PostmarkEmailServiceOptions, ResendCredentials, ResendEmailServiceOptions, ResolveSigningKeysOptions, RolePermissionHooks, RunOutboxRelayConfig, SeedOptions, SeedResult, SigningKeyMode, SigningKeyModeOption, SigningKeyModeResolver, SyncEntity, SyncEvent, SyncOp, TenantOperationExecutorBinding, TokenAPI, Transaction, UserInfoEvent, UserLinkingMode, UserLinkingModeOption, UserLinkingModeResolver, UserSessionCleanupParams, UsernamePasswordProviderResolver, VerifyControlPlaneTokenOptions, VerifyControlPlaneTokenResult, WebhookDestinationOptions, WebhookInvoker, WebhookInvokerParams, WrappedProxyAdapters };
+export { AppLogo, AuthLayout, Button$1 as Button, Button as ButtonUI, CONTROL_PLANE_SYNC_EVENT_PREFIX, CardContent, CardDescription, CardFooter, CardHeader, CardTitle, Card as CardUI, ControlPlaneSyncDestination, EmailValidatedPage, EnterCodePage, EnterPasswordPage, ErrorMessage, Footer, ForgotPasswordPage, ForgotPasswordSentPage, FormComponent, GoBack, Google as GoogleLogo, Icon, IdentifierForm, IdentifierPage, Input as InputUI, InvalidSessionPage as InvalidSession, Label as LabelUI, Layout, LocalCodeExecutor, LogsDestination, MANAGEMENT_API_AUDIENCE, MANAGEMENT_API_SCOPES, MailgunEmailService, MessagePage as Message, PostmarkEmailService, PreSignUpConfirmationPage, PreSignupPage as PreSignUpPage, RegistrationFinalizerDestination, ResendEmailService, ResetPasswordPage, SignupPage as SignUpPage, SocialButton, Spinner, Trans, USERNAME_PASSWORD_PROVIDER, UnverifiedEmailPage, UserNotFound as UserNotFoundPage, VippsLogo, WebhookDestination, addEntityHooks, backfillProxyHostsToKv, cleanupOutbox, cleanupSessions, cleanupUserSessions, clientInfoMiddleware, createApplySyncEvents, createAuthMiddleware, createDefaultDestinations, createEncryptedDataAdapter, createEncryptedDataAdapterWithKeyRing, createInMemoryCache, decryptField, decryptFieldWithRing, deepMergePatch, drainOutbox, encryptField, encryptFieldWithRing, ensureMutableResponse, fetchAll, init, injectTailwindCSS, isAllowedIssuer, isEncrypted, isInteractiveClient, listControlPlaneKeys, loadEncryptionKey, mailgunCredentialsSchema, parseKeyId, postmarkCredentialsSchema, index_d as preDefinedHooks, provisionDefaultClients, resendCredentialsSchema, resolveSigningKeyMode, resolveSigningKeys, runOutboxRelay, seed, tailwindCss, tenantMiddleware, toMutableResponse, verifyControlPlaneToken, waitUntil, wrapProxyAdaptersWithKvPublish };
+export type { AuthHeroConfig, BackfillProxyHostsOptions, BackfillResult, ControlPlaneSyncDestinationOptions, CreateApplySyncEventsOptions, CreateDefaultDestinationsConfig, EncryptKeyIdResolver, EnsureUsernameOptions, EntityHookContext, EntityHooks, EntityHooksConfig, EventDestination, FetchAllOptions, GetServiceToken, HookEvent, HookRequest, Hooks, InMemoryCacheConfig, IssuerResolver, KeyRing, KvPublishOptions, MailgunCredentials, MailgunEmailServiceOptions, ManagementApiExtension, ManagementApiScope, ManagementAudienceResolver, OnExecuteCredentialsExchange, OnExecuteCredentialsExchangeAPI, OnExecutePostLogin, OnExecutePostLoginAPI, OnExecutePostUserDeletion, OnExecutePostUserDeletionAPI, OnExecutePostUserRegistration, OnExecutePostUserRegistrationAPI, OnExecutePostUserUpdate, OnExecutePostUserUpdateAPI, OnExecutePreUserDeletion, OnExecutePreUserDeletionAPI, OnExecutePreUserRegistration, OnExecutePreUserRegistrationAPI, OnExecutePreUserUpdate, OnExecutePreUserUpdateAPI, OnExecuteValidateRegistrationUsername, OnExecuteValidateRegistrationUsernameAPI, OnFetchUserInfo, OnFetchUserInfoAPI, OutboxCleanupParams, OutboxConfig, PostmarkCredentials, PostmarkEmailServiceOptions, ProvisionDefaultClientsOptions, ProvisionDefaultClientsResult, ResendCredentials, ResendEmailServiceOptions, ResolveSigningKeysOptions, RolePermissionHooks, RunOutboxRelayConfig, SeedOptions, SeedResult, SigningKeyMode, SigningKeyModeOption, SigningKeyModeResolver, SyncEntity, SyncEvent, SyncOp, TenantOperationExecutorBinding, TokenAPI, Transaction, UserInfoEvent, UserLinkingMode, UserLinkingModeOption, UserLinkingModeResolver, UserSessionCleanupParams, UsernamePasswordProviderResolver, VerifyControlPlaneTokenOptions, VerifyControlPlaneTokenResult, WebhookDestinationOptions, WebhookInvoker, WebhookInvokerParams, WrappedProxyAdapters };