authhero 8.23.0 → 8.24.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (43) hide show
  1. package/dist/assets/u/widget/index.esm.js +1 -1
  2. package/dist/authhero.cjs +139 -142
  3. package/dist/authhero.d.ts +349 -145
  4. package/dist/authhero.mjs +19659 -15484
  5. package/dist/tsconfig.types.tsbuildinfo +1 -1
  6. package/dist/types/adapters/control-plane-custom-domains.d.ts +35 -0
  7. package/dist/types/authentication-flows/passwordless.d.ts +5 -5
  8. package/dist/types/helpers/control-plane-client.d.ts +46 -0
  9. package/dist/types/helpers/control-plane-sync-events.d.ts +12 -28
  10. package/dist/types/index.d.ts +174 -100
  11. package/dist/types/routes/auth-api/index.d.ts +24 -24
  12. package/dist/types/routes/auth-api/passwordless.d.ts +8 -8
  13. package/dist/types/routes/auth-api/revoke.d.ts +6 -6
  14. package/dist/types/routes/auth-api/token.d.ts +10 -10
  15. package/dist/types/routes/management-api/authentication-methods.d.ts +1 -1
  16. package/dist/types/routes/management-api/branding.d.ts +1 -1
  17. package/dist/types/routes/management-api/clients.d.ts +6 -6
  18. package/dist/types/routes/management-api/connections.d.ts +15 -15
  19. package/dist/types/routes/management-api/email-templates.d.ts +18 -18
  20. package/dist/types/routes/management-api/failed-events.d.ts +1 -1
  21. package/dist/types/routes/management-api/guardian.d.ts +5 -5
  22. package/dist/types/routes/management-api/helpers.d.ts +47 -0
  23. package/dist/types/routes/management-api/index.d.ts +140 -71
  24. package/dist/types/routes/management-api/logs.d.ts +4 -4
  25. package/dist/types/routes/management-api/migration-sources.d.ts +6 -6
  26. package/dist/types/routes/management-api/organizations.d.ts +2 -2
  27. package/dist/types/routes/management-api/prompts.d.ts +4 -4
  28. package/dist/types/routes/management-api/roles.d.ts +1 -1
  29. package/dist/types/routes/management-api/tenant-export-import.d.ts +5 -5
  30. package/dist/types/routes/management-api/tenants.d.ts +1 -1
  31. package/dist/types/routes/management-api/users.d.ts +71 -2
  32. package/dist/types/routes/proxy-control-plane/custom-domains.d.ts +45 -0
  33. package/dist/types/routes/proxy-control-plane/index.d.ts +24 -6
  34. package/dist/types/routes/proxy-control-plane/scopes.d.ts +13 -0
  35. package/dist/types/routes/proxy-control-plane/verify.d.ts +15 -4
  36. package/dist/types/routes/universal-login/common.d.ts +6 -6
  37. package/dist/types/routes/universal-login/identifier.d.ts +2 -2
  38. package/dist/types/routes/universal-login/index.d.ts +2 -2
  39. package/dist/types/routes/universal-login/u2-index.d.ts +3 -3
  40. package/dist/types/routes/universal-login/u2-routes.d.ts +3 -3
  41. package/dist/types/types/AuthHeroConfig.d.ts +22 -7
  42. package/dist/types/types/IdToken.d.ts +4 -4
  43. package/package.json +8 -8
package/dist/types/routes/universal-login/index.d.ts CHANGED
@@ -515,7 +515,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
515
515
  } & {
516
516
  form: {
517
517
  username: string;
518
- login_selection?: "password" | "code" | undefined;
518
+ login_selection?: "code" | "password" | undefined;
519
519
  };
520
520
  };
521
521
  output: {};
@@ -529,7 +529,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
529
529
  } & {
530
530
  form: {
531
531
  username: string;
532
- login_selection?: "password" | "code" | undefined;
532
+ login_selection?: "code" | "password" | undefined;
533
533
  };
534
534
  };
535
535
  output: {};
package/dist/types/routes/universal-login/u2-index.d.ts CHANGED
@@ -165,7 +165,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
165
165
  $get: {
166
166
  input: {
167
167
  param: {
168
- screen: "signup" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "impersonate" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
168
+ screen: "signup" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "impersonate" | "reset-password/request" | "reset-password/code" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
169
169
  };
170
170
  } & {
171
171
  query: {
@@ -181,7 +181,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
181
181
  } | {
182
182
  input: {
183
183
  param: {
184
- screen: "signup" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "impersonate" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
184
+ screen: "signup" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "impersonate" | "reset-password/request" | "reset-password/code" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
185
185
  };
186
186
  } & {
187
187
  query: {
@@ -197,7 +197,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
197
197
  } | {
198
198
  input: {
199
199
  param: {
200
- screen: "signup" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "impersonate" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
200
+ screen: "signup" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "impersonate" | "reset-password/request" | "reset-password/code" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
201
201
  };
202
202
  } & {
203
203
  query: {
package/dist/types/routes/universal-login/u2-routes.d.ts CHANGED
@@ -170,7 +170,7 @@ export declare const u2Routes: OpenAPIHono<{
170
170
  $get: {
171
171
  input: {
172
172
  param: {
173
- screen: "signup" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "impersonate" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
173
+ screen: "signup" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "impersonate" | "reset-password/request" | "reset-password/code" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
174
174
  };
175
175
  } & {
176
176
  query: {
@@ -186,7 +186,7 @@ export declare const u2Routes: OpenAPIHono<{
186
186
  } | {
187
187
  input: {
188
188
  param: {
189
- screen: "signup" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "impersonate" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
189
+ screen: "signup" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "impersonate" | "reset-password/request" | "reset-password/code" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
190
190
  };
191
191
  } & {
192
192
  query: {
@@ -202,7 +202,7 @@ export declare const u2Routes: OpenAPIHono<{
202
202
  } | {
203
203
  input: {
204
204
  param: {
205
- screen: "signup" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "impersonate" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
205
+ screen: "signup" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "impersonate" | "reset-password/request" | "reset-password/code" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
206
206
  };
207
207
  } & {
208
208
  query: {
package/dist/types/types/AuthHeroConfig.d.ts CHANGED
@@ -319,20 +319,35 @@ export interface AuthHeroConfig {
319
319
  * Optional receiver for `POST /sync` events emitted by tenant shards via
320
320
  * the `ControlPlaneSyncDestination`. Mount on the control-plane authhero
321
321
  * instance only. Implementations MUST be idempotent — the outbox retries
322
- * on transient failures. Use `createApplySyncEvents({ customDomains,
323
- * proxyRoutes })` (exported from `authhero`) for the default
324
- * adapter-backed implementation.
322
+ * on transient failures. Use `createApplySyncEvents({ proxyRoutes })`
323
+ * (exported from `authhero`) for the default adapter-backed
324
+ * implementation.
325
325
  */
326
326
  applySyncEvents?: (events: import("../helpers/control-plane-sync-events").SyncEvent[]) => Promise<void>;
327
+ /**
328
+ * The authoritative custom-domains adapter. When set, mounts
329
+ * `/api/v2/proxy/control-plane/custom-domains` — the resource tenant
330
+ * shards write through (`createControlPlaneCustomDomainsAdapter`).
331
+ *
332
+ * Pass the Cloudflare adapter wrapping the control-plane database: a
333
+ * CF-for-SaaS hostname is an account-global resource, so registering it
334
+ * needs credentials that only exist here, and claiming it exactly once
335
+ * needs a view across every tenant that only exists here.
336
+ */
337
+ customDomains?: import("@authhero/adapter-interfaces").CustomDomainsAdapter;
327
338
  };
328
339
  /**
329
- * Optional outbox-driven replication of `custom_domains` and `proxy_routes`
330
- * mutations to a global proxy control plane. When set, every successful
331
- * write on this tenant shard enqueues a `controlplane.sync.*` outbox event;
332
- * the `ControlPlaneSyncDestination` POSTs each event to
340
+ * Optional outbox-driven replication of `proxy_routes` mutations to a global
341
+ * proxy control plane. When set, every successful write on this tenant shard
342
+ * enqueues a `controlplane.sync.*` outbox event; the
343
+ * `ControlPlaneSyncDestination` POSTs each event to
333
344
  * `${baseUrl}/api/v2/proxy/control-plane/sync`. Requires the outbox to be
334
345
  * enabled (`outbox: { enabled: true }`).
335
346
  *
347
+ * Custom domains are NOT replicated this way — the control plane is
348
+ * authoritative for them; wire `createControlPlaneCustomDomainsAdapter` into
349
+ * the shard's `dataAdapter` instead.
350
+ *
336
351
  * Leave unset for single-DB deployments — the proxy reads the same database
337
352
  * the management API writes to, so replication is unnecessary.
338
353
  */
package/dist/types/types/IdToken.d.ts CHANGED
@@ -20,11 +20,11 @@ export declare const idTokenSchema: z.ZodObject<{
20
20
  export declare const userInfoSchema: z.ZodObject<{
21
21
  name: z.ZodOptional<z.ZodString>;
22
22
  email: z.ZodOptional<z.ZodString>;
23
- given_name: z.ZodOptional<z.ZodString>;
24
- family_name: z.ZodOptional<z.ZodString>;
25
- sub: z.ZodString;
26
- exp: z.ZodNumber;
27
23
  iss: z.ZodString;
24
+ sub: z.ZodString;
28
25
  aud: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
26
+ exp: z.ZodNumber;
27
+ given_name: z.ZodOptional<z.ZodString>;
28
+ family_name: z.ZodOptional<z.ZodString>;
29
29
  }, z.core.$loose>;
30
30
  export type IdToken = z.infer<typeof idTokenSchema>;
package/package.json CHANGED
@@ -11,7 +11,7 @@
11
11
  "type": "git",
12
12
  "url": "https://github.com/markusahlstrand/authhero"
13
13
  },
14
- "version": "8.23.0",
14
+ "version": "8.24.0",
15
15
  "files": [
16
16
  "dist"
17
17
  ],
@@ -46,8 +46,8 @@
46
46
  "better-sqlite3": "^12.4.1",
47
47
  "cssnano": "7.1.2",
48
48
  "detectincognitojs": "^1.6.2",
49
- "fast-xml-parser": "^5.3.1",
50
- "hono": "^4.12.23",
49
+ "fast-xml-parser": "^5.7.0",
50
+ "hono": "^4.12.30",
51
51
  "i18nexus-cli": "^3.8.2",
52
52
  "kysely": "^0.29.2",
53
53
  "postcss": "8.5.15",
@@ -63,8 +63,8 @@
63
63
  "vite": "^8.0.14",
64
64
  "vite-plugin-dts": "^4.5.4",
65
65
  "vitest": "^4.1.7",
66
- "@authhero/kysely-adapter": "11.18.0",
67
- "@authhero/widget": "0.34.13"
66
+ "@authhero/kysely-adapter": "11.19.0",
67
+ "@authhero/widget": "0.34.14"
68
68
  },
69
69
  "dependencies": {
70
70
  "@peculiar/x509": "^1.14.0",
@@ -81,9 +81,9 @@
81
81
  "qrcode": "^1.5.4",
82
82
  "sanitize-html": "^2.17.4",
83
83
  "xstate": "^5.31.1",
84
- "@authhero/adapter-interfaces": "4.0.0",
85
- "@authhero/proxy": "0.9.3",
86
- "@authhero/saml": "0.4.4"
84
+ "@authhero/adapter-interfaces": "4.1.0",
85
+ "@authhero/proxy": "0.9.4",
86
+ "@authhero/saml": "0.4.6"
87
87
  },
88
88
  "peerDependencies": {
89
89
  "@authhero/widget": "^0.1.0",