authhero 8.8.1 → 8.9.1

package/dist/types/authentication-flows/password.d.ts

@@ -1,7 +1,16 @@
 import { Context } from "hono";
-import { AuthParams, LoginSession } from "@authhero/adapter-interfaces";
+import { AuthParams, LoginSession, User } from "@authhero/adapter-interfaces";
 import { EnrichedClient } from "../helpers/client";
 import { Bindings, GrantFlowUserResult, Variables } from "../types";
+/**
+ * Clear the failed-login counter for a user. Failed logins are always
+ * recorded on the primary account (see {@link recordFailedLogin}), so this
+ * resolves the linked primary before clearing. Called on a successful
+ * password login and after a successful password reset — both are strong
+ * evidence the legitimate account owner is back in control, so a stale
+ * lockout shouldn't block them.
+ */
+export declare function clearFailedLogins(data: Bindings["data"], tenantId: string, user: User): Promise<void>;
 export declare function passwordGrant(ctx: Context<{
     Bindings: Bindings;
     Variables: Variables;

package/dist/types/authentication-flows/passwordless.d.ts

@@ -414,7 +414,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                     } | undefined;
                 } | undefined;
                 passkey_options?: {
-                    challenge_ui?: "both" | "autofill" | "button" | undefined;
+                    challenge_ui?: "button" | "both" | "autofill" | undefined;
                     local_enrollment_enabled?: boolean | undefined;
                     progressive_enrollment_enabled?: boolean | undefined;
                 } | undefined;
@@ -458,7 +458,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
         custom_login_page_preview?: string | undefined;
         form_template?: string | undefined;
         addons?: Record<string, any> | undefined;
-        token_endpoint_auth_method?: "none" | "private_key_jwt" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | undefined;
+        token_endpoint_auth_method?: "none" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | "private_key_jwt" | undefined;
         client_metadata?: Record<string, string> | undefined;
         hide_sign_up_disabled_error?: boolean | undefined;
         mobile?: Record<string, any> | undefined;
@@ -541,8 +541,8 @@ export declare function passwordlessGrantUser(ctx: Context<{
         } | undefined;
         authenticated_at?: string | undefined;
     };
-    connectionType: "username" | "sms" | "email";
-    authConnection: "username" | "sms" | "email";
+    connectionType: "username" | "email" | "sms";
+    authConnection: "username" | "email" | "sms";
     session_id: string | undefined;
     authParams: {
         client_id: string;

package/dist/types/helpers/dcr/metadata-mapping.d.ts

@@ -24,10 +24,10 @@ export declare const dcrRequestSchema: z.ZodObject<{
     response_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
     token_endpoint_auth_method: z.ZodOptional<z.ZodEnum<{
         none: "none";
-        private_key_jwt: "private_key_jwt";
         client_secret_post: "client_secret_post";
         client_secret_basic: "client_secret_basic";
         client_secret_jwt: "client_secret_jwt";
+        private_key_jwt: "private_key_jwt";
     }>>;
     jwks_uri: z.ZodOptional<z.ZodString>;
     jwks: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;

package/dist/types/helpers/tenant-export-import/export.d.ts

@@ -0,0 +1,21 @@
+import { DataAdapters } from "@authhero/adapter-interfaces";
+import { ExportLine, ExportOptions } from "./types";
+/**
+ * Lazily yield an ordered stream of `{ entity, data }` lines covering all
+ * durable data for `tenant_id`. The order matches {@link EXPORT_ORDER} so a
+ * sequential importer satisfies foreign keys (parents before children).
+ *
+ * This is a generator so the HTTP layer can serialize each line straight to the
+ * response (and into gzip) without ever materializing the whole export in
+ * memory. Only bounded per-entity working sets (id lists, the hook buffer) are
+ * held at a time.
+ *
+ * Ephemeral/audit entities and the global key pool are never emitted.
+ */
+export declare function exportTenantLines(data: DataAdapters, tenant_id: string, opts: ExportOptions): AsyncGenerator<ExportLine>;
+/**
+ * Collect {@link exportTenantLines} into an array. Convenience for callers
+ * (e.g. tests) that want the whole export in memory; the HTTP layer streams the
+ * generator directly instead.
+ */
+export declare function exportTenant(data: DataAdapters, tenant_id: string, opts: ExportOptions): Promise<ExportLine[]>;

package/dist/types/helpers/tenant-export-import/import.d.ts

@@ -0,0 +1,12 @@
+import { DataAdapters } from "@authhero/adapter-interfaces";
+import { ExportLine, ImportOptions, ImportResult } from "./types";
+/**
+ * Recreate every row from an export stream under `tenant_id`, in the stream's
+ * FK-safe order, preserving ids/timestamps via `importMetadata`. Per-row
+ * failures are collected rather than aborting the whole run.
+ *
+ * The target tenant is created from the `tenants` line only when it does not
+ * already exist, and always under `tenant_id` (the source id is overridden) so
+ * an export can be loaded into a freshly-provisioned tenant.
+ */
+export declare function importTenant(data: DataAdapters, tenant_id: string, lines: ExportLine[], opts: ImportOptions): Promise<ImportResult>;

package/dist/types/helpers/tenant-export-import/index.d.ts

@@ -0,0 +1,4 @@
+export { exportTenant, exportTenantLines } from "./export";
+export { importTenant } from "./import";
+export { EXPORT_ORDER } from "./manifest";
+export type { ExportLine, ExportOptions, ImportOptions, ImportError, ImportResult, } from "./types";

package/dist/types/helpers/tenant-export-import/manifest.d.ts

@@ -0,0 +1,12 @@
+/**
+ * FK-safe import order: parents are listed before their children so a
+ * sequential importer can always satisfy foreign keys. The exporter emits
+ * lines in this same order.
+ *
+ * Excluded entirely (never exported or imported):
+ *   - keys — global signing-key pool; the target generates its own.
+ *   - ephemeral / audit: sessions, refresh_tokens, codes, login_sessions,
+ *     logs, action_executions, outbox_events, grants.
+ */
+export declare const EXPORT_ORDER: readonly ["tenants", "clients", "connections", "resource_servers", "roles", "organizations", "users", "passwords", "authentication_methods", "user_roles", "user_permissions", "role_permissions", "organization_connections", "user_organizations", "client_grants", "invites", "actions", "action_versions", "hook_code", "hooks", "flows", "forms", "themes", "branding", "prompt_settings", "universal_login_templates", "custom_text", "email_providers", "email_templates", "custom_domains", "log_streams", "migration_sources", "proxy_routes"];
+export type ExportEntity = (typeof EXPORT_ORDER)[number];

package/dist/types/helpers/tenant-export-import/row-access.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Minimal, `as`-free helpers for reading fields off the `unknown` rows carried
+ * in an export stream. Import code only needs to pluck a handful of string
+ * fields (id columns + timestamps) to reconstruct `importMetadata`; the full
+ * row is forwarded to the adapter as the typed insert payload after a single
+ * narrowing step.
+ */
+/** Narrow an unknown value to a plain record, or `undefined` if it isn't one. */
+export declare function asRecord(value: unknown): Record<string, unknown> | undefined;
+/** Read a string field off an unknown row, or `undefined` when absent. */
+export declare function getString(value: unknown, key: string): string | undefined;
+/**
+ * Return a shallow copy of an unknown row with `null`/`undefined` top-level
+ * fields removed. Export rows are full entities whose optional enum/object
+ * columns are often serialized as `null`; the matching *Insert* zod schemas
+ * mark those fields optional (not nullable), so they reject a present-but-null
+ * value. Dropping nullish keys lets a faithful row parse cleanly while keeping
+ * every real value intact.
+ */
+export declare function withoutNullish(value: unknown): Record<string, unknown>;

package/dist/types/helpers/tenant-export-import/types.d.ts

@@ -0,0 +1,53 @@
+import { DataAdapters, ImportMetadata } from "@authhero/adapter-interfaces";
+/**
+ * A single JSON-lines record in a tenant export stream.
+ *
+ * `entity` is the durable entity name (see {@link EXPORT_ORDER}); `data` is the
+ * raw row as returned by the source adapter's read methods. The stream is
+ * ordered so that a sequential importer can recreate FK parents before their
+ * children.
+ */
+export interface ExportLine {
+    entity: string;
+    data: unknown;
+}
+export interface ExportOptions {
+    /**
+     * When false, the `passwords` entity is skipped entirely on export so the
+     * stream never carries password hashes. Defaults to false at the call sites
+     * that want a redacted export.
+     */
+    includePasswordHashes: boolean;
+}
+export interface ImportOptions {
+    /**
+     * When false, any `passwords` lines present in the stream are ignored on
+     * import (defence in depth — a redacted export shouldn't contain them, but
+     * the importer refuses to write them regardless).
+     */
+    includePasswordHashes: boolean;
+}
+/** One failed row during import, surfaced rather than aborting the whole run. */
+export interface ImportError {
+    entity: string;
+    error: string;
+}
+export interface ImportResult {
+    /** Number of rows successfully written, keyed by entity name. */
+    counts: Record<string, number>;
+    /** Non-fatal per-row failures collected during the run. */
+    errors: ImportError[];
+}
+/**
+ * Build the `importMetadata` argument from a row, preserving id/timestamps.
+ * Returns `undefined` when none of the fields are present so callers can spread
+ * it without sending an empty object.
+ */
+export declare function buildImportMetadata(params: {
+    id?: string;
+    created_at?: string;
+    updated_at?: string;
+}): {
+    importMetadata: ImportMetadata;
+} | undefined;
+export type { DataAdapters };