authhero 8.8.0 → 8.9.0

package/dist/types/authentication-flows/passwordless.d.ts

@@ -367,7 +367,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                             active?: boolean | undefined;
                         } | undefined;
                         signup?: {
-                            status?: "optional" | "required" | "disabled" | undefined;
+                            status?: "optional" | "disabled" | "required" | undefined;
                             verification?: {
                                 active?: boolean | undefined;
                             } | undefined;
@@ -384,7 +384,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                             active?: boolean | undefined;
                         } | undefined;
                         signup?: {
-                            status?: "optional" | "required" | "disabled" | undefined;
+                            status?: "optional" | "disabled" | "required" | undefined;
                         } | undefined;
                         validation?: {
                             max_length?: number | undefined;
@@ -401,7 +401,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                             active?: boolean | undefined;
                         } | undefined;
                         signup?: {
-                            status?: "optional" | "required" | "disabled" | undefined;
+                            status?: "optional" | "disabled" | "required" | undefined;
                         } | undefined;
                     } | undefined;
                 } | undefined;
@@ -458,7 +458,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
         custom_login_page_preview?: string | undefined;
         form_template?: string | undefined;
         addons?: Record<string, any> | undefined;
-        token_endpoint_auth_method?: "client_secret_post" | "client_secret_basic" | "none" | "client_secret_jwt" | "private_key_jwt" | undefined;
+        token_endpoint_auth_method?: "none" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | "private_key_jwt" | undefined;
         client_metadata?: Record<string, string> | undefined;
         hide_sign_up_disabled_error?: boolean | undefined;
         mobile?: Record<string, any> | undefined;
@@ -541,8 +541,8 @@ export declare function passwordlessGrantUser(ctx: Context<{
         } | undefined;
         authenticated_at?: string | undefined;
     };
-    connectionType: "username" | "email" | "sms";
-    authConnection: "username" | "email" | "sms";
+    connectionType: "sms" | "email" | "username";
+    authConnection: "sms" | "email" | "username";
     session_id: string | undefined;
     authParams: {
         client_id: string;

package/dist/types/helpers/dcr/metadata-mapping.d.ts

@@ -23,9 +23,9 @@ export declare const dcrRequestSchema: z.ZodObject<{
     grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
     response_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
     token_endpoint_auth_method: z.ZodOptional<z.ZodEnum<{
+        none: "none";
         client_secret_post: "client_secret_post";
         client_secret_basic: "client_secret_basic";
-        none: "none";
         client_secret_jwt: "client_secret_jwt";
         private_key_jwt: "private_key_jwt";
     }>>;

package/dist/types/helpers/mutable-response.d.ts

@@ -13,15 +13,27 @@
  * (the body stream is passed through, not copied) and deterministic, so there is
  * nothing to detect.
  */
+/**
+ * True only for a live WebSocket upgrade — a `101 Switching Protocols` response
+ * that carries a non-null `webSocket` handle.
+ *
+ * The check must NOT be `"webSocket" in res`: the Cloudflare Workers runtime
+ * defines a `webSocket` property on *every* `Response` (it is `null` for an
+ * ordinary response), so the `in` operator is always true there and would
+ * misclassify every response as an upgrade. (In Node / the test runtime the
+ * property is absent, so the bug stays invisible to tests.) A real upgrade has
+ * a non-null handle, which is what we detect here.
+ */
+export declare function isWebSocketUpgrade(res: Response): boolean;
 /**
  * Return a response whose headers are mutable. A received response is re-wrapped
  * into a fresh `Response` (which has the mutable "response" header guard); an
  * already-mutable response is re-wrapped too, harmlessly, preserving every header
  * already set on it.
  *
- * A `101 Switching Protocols` upgrade is returned untouched: it carries a
- * `webSocket` handle that reconstruction would drop, breaking the upgrade. Its
- * headers stay immutable, so callers must not write to an upgrade response.
+ * A WebSocket upgrade is returned untouched: it carries a `webSocket` handle
+ * that reconstruction would drop, breaking the upgrade. Its headers stay
+ * immutable, so callers must not write to an upgrade response.
  */
 export declare function toMutableResponse(res: Response): Response;
 /**

package/dist/types/helpers/tenant-export-import/export.d.ts

@@ -0,0 +1,21 @@
+import { DataAdapters } from "@authhero/adapter-interfaces";
+import { ExportLine, ExportOptions } from "./types";
+/**
+ * Lazily yield an ordered stream of `{ entity, data }` lines covering all
+ * durable data for `tenant_id`. The order matches {@link EXPORT_ORDER} so a
+ * sequential importer satisfies foreign keys (parents before children).
+ *
+ * This is a generator so the HTTP layer can serialize each line straight to the
+ * response (and into gzip) without ever materializing the whole export in
+ * memory. Only bounded per-entity working sets (id lists, the hook buffer) are
+ * held at a time.
+ *
+ * Ephemeral/audit entities and the global key pool are never emitted.
+ */
+export declare function exportTenantLines(data: DataAdapters, tenant_id: string, opts: ExportOptions): AsyncGenerator<ExportLine>;
+/**
+ * Collect {@link exportTenantLines} into an array. Convenience for callers
+ * (e.g. tests) that want the whole export in memory; the HTTP layer streams the
+ * generator directly instead.
+ */
+export declare function exportTenant(data: DataAdapters, tenant_id: string, opts: ExportOptions): Promise<ExportLine[]>;

package/dist/types/helpers/tenant-export-import/import.d.ts

@@ -0,0 +1,12 @@
+import { DataAdapters } from "@authhero/adapter-interfaces";
+import { ExportLine, ImportOptions, ImportResult } from "./types";
+/**
+ * Recreate every row from an export stream under `tenant_id`, in the stream's
+ * FK-safe order, preserving ids/timestamps via `importMetadata`. Per-row
+ * failures are collected rather than aborting the whole run.
+ *
+ * The target tenant is created from the `tenants` line only when it does not
+ * already exist, and always under `tenant_id` (the source id is overridden) so
+ * an export can be loaded into a freshly-provisioned tenant.
+ */
+export declare function importTenant(data: DataAdapters, tenant_id: string, lines: ExportLine[], opts: ImportOptions): Promise<ImportResult>;

package/dist/types/helpers/tenant-export-import/index.d.ts

@@ -0,0 +1,4 @@
+export { exportTenant, exportTenantLines } from "./export";
+export { importTenant } from "./import";
+export { EXPORT_ORDER } from "./manifest";
+export type { ExportLine, ExportOptions, ImportOptions, ImportError, ImportResult, } from "./types";

package/dist/types/helpers/tenant-export-import/manifest.d.ts

@@ -0,0 +1,12 @@
+/**
+ * FK-safe import order: parents are listed before their children so a
+ * sequential importer can always satisfy foreign keys. The exporter emits
+ * lines in this same order.
+ *
+ * Excluded entirely (never exported or imported):
+ *   - keys — global signing-key pool; the target generates its own.
+ *   - ephemeral / audit: sessions, refresh_tokens, codes, login_sessions,
+ *     logs, action_executions, outbox_events, grants.
+ */
+export declare const EXPORT_ORDER: readonly ["tenants", "clients", "connections", "resource_servers", "roles", "organizations", "users", "passwords", "authentication_methods", "user_roles", "user_permissions", "role_permissions", "organization_connections", "user_organizations", "client_grants", "invites", "actions", "action_versions", "hook_code", "hooks", "flows", "forms", "themes", "branding", "prompt_settings", "universal_login_templates", "custom_text", "email_providers", "email_templates", "custom_domains", "log_streams", "migration_sources", "proxy_routes"];
+export type ExportEntity = (typeof EXPORT_ORDER)[number];

package/dist/types/helpers/tenant-export-import/row-access.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Minimal, `as`-free helpers for reading fields off the `unknown` rows carried
+ * in an export stream. Import code only needs to pluck a handful of string
+ * fields (id columns + timestamps) to reconstruct `importMetadata`; the full
+ * row is forwarded to the adapter as the typed insert payload after a single
+ * narrowing step.
+ */
+/** Narrow an unknown value to a plain record, or `undefined` if it isn't one. */
+export declare function asRecord(value: unknown): Record<string, unknown> | undefined;
+/** Read a string field off an unknown row, or `undefined` when absent. */
+export declare function getString(value: unknown, key: string): string | undefined;
+/**
+ * Return a shallow copy of an unknown row with `null`/`undefined` top-level
+ * fields removed. Export rows are full entities whose optional enum/object
+ * columns are often serialized as `null`; the matching *Insert* zod schemas
+ * mark those fields optional (not nullable), so they reject a present-but-null
+ * value. Dropping nullish keys lets a faithful row parse cleanly while keeping
+ * every real value intact.
+ */
+export declare function withoutNullish(value: unknown): Record<string, unknown>;

package/dist/types/helpers/tenant-export-import/types.d.ts

@@ -0,0 +1,53 @@
+import { DataAdapters, ImportMetadata } from "@authhero/adapter-interfaces";
+/**
+ * A single JSON-lines record in a tenant export stream.
+ *
+ * `entity` is the durable entity name (see {@link EXPORT_ORDER}); `data` is the
+ * raw row as returned by the source adapter's read methods. The stream is
+ * ordered so that a sequential importer can recreate FK parents before their
+ * children.
+ */
+export interface ExportLine {
+    entity: string;
+    data: unknown;
+}
+export interface ExportOptions {
+    /**
+     * When false, the `passwords` entity is skipped entirely on export so the
+     * stream never carries password hashes. Defaults to false at the call sites
+     * that want a redacted export.
+     */
+    includePasswordHashes: boolean;
+}
+export interface ImportOptions {
+    /**
+     * When false, any `passwords` lines present in the stream are ignored on
+     * import (defence in depth — a redacted export shouldn't contain them, but
+     * the importer refuses to write them regardless).
+     */
+    includePasswordHashes: boolean;
+}
+/** One failed row during import, surfaced rather than aborting the whole run. */
+export interface ImportError {
+    entity: string;
+    error: string;
+}
+export interface ImportResult {
+    /** Number of rows successfully written, keyed by entity name. */
+    counts: Record<string, number>;
+    /** Non-fatal per-row failures collected during the run. */
+    errors: ImportError[];
+}
+/**
+ * Build the `importMetadata` argument from a row, preserving id/timestamps.
+ * Returns `undefined` when none of the fields are present so callers can spread
+ * it without sending an empty object.
+ */
+export declare function buildImportMetadata(params: {
+    id?: string;
+    created_at?: string;
+    updated_at?: string;
+}): {
+    importMetadata: ImportMetadata;
+} | undefined;
+export type { DataAdapters };