authhero 8.19.0 → 8.20.0

package/dist/types/authentication-flows/passwordless.d.ts

@@ -458,7 +458,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
         custom_login_page_preview?: string | undefined;
         form_template?: string | undefined;
         addons?: Record<string, any> | undefined;
-        token_endpoint_auth_method?: "none" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | "private_key_jwt" | undefined;
+        token_endpoint_auth_method?: "none" | "private_key_jwt" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | undefined;
         client_metadata?: Record<string, string> | undefined;
         hide_sign_up_disabled_error?: boolean | undefined;
         mobile?: Record<string, any> | undefined;
@@ -541,8 +541,8 @@ export declare function passwordlessGrantUser(ctx: Context<{
         } | undefined;
         authenticated_at?: string | undefined;
     };
-    connectionType: "username" | "email" | "sms";
-    authConnection: "username" | "email" | "sms";
+    connectionType: "username" | "sms" | "email";
+    authConnection: "username" | "sms" | "email";
     session_id: string | undefined;
     authParams: {
         client_id: string;

package/dist/types/helpers/hook-events.d.ts

@@ -1,20 +1,40 @@
 import { Context } from "hono";
-import { User } from "@authhero/adapter-interfaces";
+import { OutboxEventInsert, User } from "@authhero/adapter-interfaces";
 import { Bindings, Variables } from "../types";
+type HookCtx = Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>;
 /**
- * Enqueue a `hook.{triggerId}` event to the outbox so the `WebhookDestination`
- * (and future `CodeHookDestination`) can dispatch the hook asynchronously with
- * retries instead of firing inline while the request is being served.
- *
- * Mirrors the synchronous-push pattern used by `logMessage`: the promise from
- * `outbox.create` is pushed onto `ctx.var.outboxEventPromises` so the outbox
- * middleware can await it in its finally block and then relay the resulting
- * event IDs.
+ * Whether the outbox is configured for this request. When false, hook dispatch
+ * falls back to inline webhook invocation (no retry / dead-letter).
+ */
+export declare function outboxEnabled(ctx: HookCtx): boolean;
+/**
+ * Build a `hook.{triggerId}` outbox event with a caller-assigned id, or
+ * `undefined` when the outbox is not configured (the caller then falls back to
+ * inline dispatch via {@link dispatchPostHookInline}).
  *
- * When the outbox is not configured, falls back to inline webhook invocation
- * (via `waitUntil`) so tenants without outbox still receive webhook calls.
+ * The returned event is meant to be handed to an event-emitting user write
+ * (`rawCreate` / `remove`) via its `outboxEvents` option so it commits in the
+ * same atomic unit as the business row (issue #1057). Because the id is fixed
+ * up front, the caller can relay it with {@link relayOutboxEvent} once the
+ * write commits without needing a return value from the adapter.
  */
-export declare function enqueuePostHookEvent(ctx: Context<{
-    Bindings: Bindings;
-    Variables: Variables;
-}>, tenantId: string, triggerId: string, user: User): void;
+export declare function buildPostHookEvent(ctx: HookCtx, tenantId: string, triggerId: string, user: User): OutboxEventInsert | undefined;
+/**
+ * Relay an outbox event that has already been persisted (atomically with its
+ * business write) so the outbox middleware picks it up for delivery. Mirrors
+ * the synchronous-push pattern used by `logMessage`: the id is pushed onto
+ * `ctx.var.outboxEventPromises`, which the outbox middleware drains and hands
+ * to `processOutboxEvents`.
+ */
+export declare function relayOutboxEvent(ctx: HookCtx, id: string): void;
+/**
+ * Fallback dispatch for when the outbox is not configured: invoke the
+ * post-hook webhooks inline (fire-and-forget via `waitUntil`). No retry /
+ * dead-letter support in this mode — configure the outbox for durable
+ * delivery.
+ */
+export declare function dispatchPostHookInline(ctx: HookCtx, tenantId: string, triggerId: string, user: User): void;
+export {};

package/dist/types/hooks/link-users.d.ts

@@ -1,4 +1,4 @@
-import { DataAdapters, User } from "@authhero/adapter-interfaces";
+import { DataAdapters, OutboxEventInsert, User } from "@authhero/adapter-interfaces";
 export interface CommitUserResult {
     user: User;
     created: boolean;
@@ -16,6 +16,14 @@ export interface CommitUserOptions {
      * goes away entirely).
      */
     resolveEmailLinkedPrimary?: boolean;
+    /**
+     * Post-registration outbox events to persist in the same atomic unit as the
+     * user row (issue #1057). Forwarded to `rawCreate`'s `outboxEvents` option so
+     * the event and the user commit together — a race-loser whose `rawCreate`
+     * rolls back never leaves a stranded event. The caller relays the event ids
+     * (via `relayOutboxEvent`) only after `created === true`.
+     */
+    outboxEvents?: OutboxEventInsert[];
 }
 /**
  * Commits a new user inside a transaction. Validates `linked_to` (if set),

package/dist/types/hooks/user-registration.d.ts

@@ -8,11 +8,14 @@ import { Bindings, Variables } from "../types";
  *  1. Pre-registration blocking hooks (outside any transaction so webhook
  *     latency and user-authored code don't hold a DB connection).
  *  2. `commitUserHook` — the internal transactional step that atomically
- *     writes the user row (via `rawCreate`) and, when the built-in
- *     email-based linking path is enabled, also resolves `linked_to` from
- *     the existing primary inside the same transaction.
- *  3. Post-registration hooks — webhook delivery is handed to the outbox
- *     (`enqueuePostHookEvent`) for retryable / idempotent dispatch; code
+ *     writes the user row (via `rawCreate`), the post-registration outbox
+ *     event (via `rawCreate`'s `outboxEvents` option, so business row and
+ *     event commit together — issue #1057), and, when the built-in
+ *     email-based linking path is enabled, resolves `linked_to` from the
+ *     existing primary inside the same transaction.
+ *  3. Post-registration hooks — the already-persisted event id is relayed
+ *     (`relayOutboxEvent`) for retryable / idempotent webhook dispatch, or
+ *     `dispatchPostHookInline` runs when the outbox isn't configured; code
  *     hooks currently still run inline with ctx.
  */
 export declare function createUserHooks(ctx: Context<{