authhero 8.26.0 → 8.27.0

package/dist/types/authentication-flows/passwordless.d.ts

@@ -367,7 +367,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                             active?: boolean | undefined;
                         } | undefined;
                         signup?: {
-                            status?: "required" | "optional" | "disabled" | undefined;
+                            status?: "optional" | "required" | "disabled" | undefined;
                             verification?: {
                                 active?: boolean | undefined;
                             } | undefined;
@@ -384,7 +384,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                             active?: boolean | undefined;
                         } | undefined;
                         signup?: {
-                            status?: "required" | "optional" | "disabled" | undefined;
+                            status?: "optional" | "required" | "disabled" | undefined;
                         } | undefined;
                         validation?: {
                             max_length?: number | undefined;
@@ -401,7 +401,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                             active?: boolean | undefined;
                         } | undefined;
                         signup?: {
-                            status?: "required" | "optional" | "disabled" | undefined;
+                            status?: "optional" | "required" | "disabled" | undefined;
                         } | undefined;
                     } | undefined;
                 } | undefined;
@@ -466,7 +466,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
         custom_login_page_preview?: string | undefined;
         form_template?: string | undefined;
         addons?: Record<string, any> | undefined;
-        token_endpoint_auth_method?: "none" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | "private_key_jwt" | undefined;
+        token_endpoint_auth_method?: "none" | "private_key_jwt" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | undefined;
         client_metadata?: Record<string, string> | undefined;
         hide_sign_up_disabled_error?: boolean | undefined;
         mobile?: Record<string, any> | undefined;
@@ -549,8 +549,8 @@ export declare function passwordlessGrantUser(ctx: Context<{
         } | undefined;
         authenticated_at?: string | undefined;
     };
-    connectionType: "sms" | "email" | "username";
-    authConnection: "sms" | "email" | "username";
+    connectionType: "username" | "sms" | "email";
+    authConnection: "username" | "sms" | "email";
     session_id: string | undefined;
     authParams: {
         client_id: string;

package/dist/types/components/stories/IdentifierPage.stories.d.ts

@@ -31,3 +31,5 @@ export declare const SocialOnly: Story;
 export declare const UsernamePassword: Story;
 export declare const NoTheming: Story;
 export declare const CustomColors: Story;
+export declare const MultipleSocialConnections: Story;
+export declare const DeveloperSocialLogins: Story;

package/dist/types/helpers/codes-cleanup.d.ts

@@ -11,11 +11,11 @@ export interface CodesCleanupParams {
 }
 /**
  * Delete codes that expired more than the retention window ago.
- * Intended for use in a scheduled handler / cron job.
  *
- * Codes are short-lived by design but nothing else prunes them, so without a
- * scheduled call to this the table grows without bound. See the Data Retention
- * deployment guide for the full set of tables that need sweeping.
+ * Prefer `runRetention`, which calls this along with every other prunable
+ * table — scheduling one call means a future prunable table is covered without
+ * editing your handler. Use this directly only when you want to sweep `codes`
+ * on its own schedule.
  *
  * @example
  * ```ts

package/dist/types/helpers/dcr/metadata-mapping.d.ts

@@ -24,10 +24,10 @@ export declare const dcrRequestSchema: z.ZodObject<{
     response_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
     token_endpoint_auth_method: z.ZodOptional<z.ZodEnum<{
         none: "none";
+        private_key_jwt: "private_key_jwt";
         client_secret_post: "client_secret_post";
         client_secret_basic: "client_secret_basic";
         client_secret_jwt: "client_secret_jwt";
-        private_key_jwt: "private_key_jwt";
     }>>;
     jwks_uri: z.ZodOptional<z.ZodString>;
     jwks: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;

package/dist/types/helpers/run-retention.d.ts

@@ -0,0 +1,86 @@
+import { DataAdapters } from "@authhero/adapter-interfaces";
+export interface RunRetentionConfig {
+    /** Same `DataAdapters` passed to `init()`. */
+    dataAdapter: DataAdapters;
+    /** Grace period past expiry for `codes`. Default 1. */
+    codesRetentionDays?: number;
+    /** Days to keep processed/dead-lettered outbox events. Default 7. */
+    outboxRetentionDays?: number;
+    /**
+     * Scope the session sweep to a single tenant. Codes and outbox events are
+     * always swept globally — an expired row is dead regardless of who owns it.
+     */
+    tenantId?: string;
+}
+export type RetentionSweepStatus = "swept" | "skipped" | "failed";
+interface RetentionSweepBase {
+    /** Table(s) this sweep covers, for logging. */
+    table: string;
+}
+export interface RetentionSweepSwept extends RetentionSweepBase {
+    status: "swept";
+    /**
+     * Rows deleted. Absent when the underlying adapter reports no count —
+     * `sessionCleanup` returns void, so a session sweep succeeds without one.
+     */
+    deleted?: number;
+}
+export interface RetentionSweepSkipped extends RetentionSweepBase {
+    status: "skipped";
+    /** Why the sweep was skipped — an adapter that does not support it. */
+    reason: string;
+}
+export interface RetentionSweepFailed extends RetentionSweepBase {
+    status: "failed";
+    error: unknown;
+}
+/**
+ * Discriminated on `status`, so a sweep cannot carry fields that contradict
+ * it — no `error` on a successful sweep, no `deleted` on a failed one.
+ */
+export type RetentionSweep = RetentionSweepSwept | RetentionSweepSkipped | RetentionSweepFailed;
+export interface RunRetentionResult {
+    sweeps: RetentionSweep[];
+}
+/**
+ * Thrown when one or more sweeps failed. The other sweeps still ran — check
+ * `result` for what succeeded.
+ */
+export declare class RetentionSweepError extends Error {
+    readonly result: RunRetentionResult;
+    readonly errors: unknown[];
+    constructor(result: RunRetentionResult, errors: unknown[]);
+}
+/**
+ * Sweep every prunable AuthHero table in one call.
+ *
+ * This is the entry point for retention — a deployment that schedules this
+ * daily needs nothing else, and gains coverage of future prunable tables
+ * without editing its handler.
+ *
+ * Covers `codes`, `outbox_events`, and (where the adapter supports it)
+ * `sessions` / `refresh_tokens` / `login_sessions`. It does **not** drain the
+ * outbox: delivery is `runOutboxRelay`'s job, and the two are scheduled
+ * independently. Running both is safe — the relay's own cleanup pass and this
+ * one are idempotent.
+ *
+ * `logs` is deliberately excluded. Audit-retention obligations differ per
+ * deployment, so AuthHero will not silently delete audit rows on your behalf;
+ * prune `logs` on `date` yourself.
+ *
+ * Every sweep runs even if an earlier one throws, so one broken adapter method
+ * cannot stop the rest of the tables being pruned. If any sweep failed, a
+ * `RetentionSweepError` carrying the partial result is thrown once at the end.
+ *
+ * @example
+ * ```ts
+ * export default {
+ *   async scheduled(_event, env) {
+ *     const { sweeps } = await runRetention({ dataAdapter });
+ *     console.log(sweeps);
+ *   },
+ * };
+ * ```
+ */
+export declare function runRetention(config: RunRetentionConfig): Promise<RunRetentionResult>;
+export {};