authhero 9.1.0 → 9.1.1

package/dist/types/authentication-flows/common.d.ts

@@ -261,6 +261,12 @@ export declare function completeLogin(ctx: Context<{
      * stale-overwrite re-fetch.
      */
     loginSessionIsCurrent?: boolean;
+    /**
+     * True when the login completed by reusing an existing SSO session
+     * rather than fresh credentials. Page hooks (e.g. impersonate) are
+     * skipped for reused sessions.
+     */
+    sessionReused?: boolean;
 }): Promise<TokenResponse | {
     code: string;
     state?: string;

package/dist/types/helpers/service-token.d.ts

@@ -14,6 +14,12 @@ export interface CreateServiceTokenCoreParams {
     tenantId: string;
     scope: string;
     issuer: string;
+    /**
+     * Explicit audience override. When unset the tenant's `audience` is
+     * required — callers that want a fallback chain (e.g. `default_audience`)
+     * resolve it themselves and pass the result here.
+     */
+    audience?: string;
     expiresInSeconds?: number;
     customClaims?: Record<string, unknown>;
     /**
@@ -31,14 +37,19 @@ export interface CreateServiceTokenCoreParams {
  * binding, and signing key.
  */
 export declare function createServiceTokenCore(params: CreateServiceTokenCoreParams): Promise<ServiceTokenResponse>;
+/**
+ * Mint an internal `auth-service` token for calling our own (or a trusted
+ * downstream) API. Deliberately does NOT go through `createAuthTokens`: that
+ * path runs the tenant's credentials-exchange hooks, which must never fire for
+ * internal mints. A hook that calls `api.access.deny()` (e.g. a tenant gating
+ * logins on an external membership lookup) would otherwise reject the mint —
+ * and since post-user-update hooks commonly mint service tokens, a hook that
+ * updates a user could recurse straight back into itself.
+ */
 export declare function createServiceToken(ctx: Context<{
     Bindings: Bindings;
     Variables: Variables;
-}>, tenant_id: string, scope: string, expiresInSeconds?: number, customClaims?: Record<string, unknown>): Promise<{
-    access_token: string;
-    token_type: string;
-    expires_in: number;
-}>;
+}>, tenant_id: string, scope: string, expiresInSeconds?: number, customClaims?: Record<string, unknown>): Promise<ServiceTokenResponse>;
 /**
  * Bound ctx-free token factory for outbox destinations. Mirrors the shape
  * expected by `WebhookDestination` and `createDefaultDestinations` but uses

package/dist/types/hooks/post-user-login.d.ts

@@ -28,4 +28,10 @@ export declare function postUserLoginHook(ctx: Context<{
     };
     /** The connection name actually used to authenticate. */
     authConnection?: string;
+    /**
+     * True when the login completed by reusing an existing SSO session
+     * rather than fresh credentials. Page hooks (e.g. impersonate) only
+     * interrupt fresh logins.
+     */
+    sessionReused?: boolean;
 }): Promise<User | Response>;