authhero 9.1.0 → 9.2.0

package/dist/types/authentication-flows/common.d.ts

@@ -261,6 +261,12 @@ export declare function completeLogin(ctx: Context<{
      * stale-overwrite re-fetch.
      */
     loginSessionIsCurrent?: boolean;
+    /**
+     * True when the login completed by reusing an existing SSO session
+     * rather than fresh credentials. Page hooks (e.g. impersonate) are
+     * skipped for reused sessions.
+     */
+    sessionReused?: boolean;
 }): Promise<TokenResponse | {
     code: string;
     state?: string;

package/dist/types/authentication-flows/passwordless.d.ts

@@ -467,7 +467,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
         custom_login_page_preview?: string | undefined;
         form_template?: string | undefined;
         addons?: Record<string, any> | undefined;
-        token_endpoint_auth_method?: "none" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | "private_key_jwt" | undefined;
+        token_endpoint_auth_method?: "client_secret_post" | "client_secret_basic" | "none" | "client_secret_jwt" | "private_key_jwt" | undefined;
         client_metadata?: Record<string, string> | undefined;
         hide_sign_up_disabled_error?: boolean | undefined;
         mobile?: Record<string, any> | undefined;
@@ -550,8 +550,8 @@ export declare function passwordlessGrantUser(ctx: Context<{
         } | undefined;
         authenticated_at?: string | undefined;
     };
-    connectionType: "username" | "email" | "sms";
-    authConnection: "username" | "email" | "sms";
+    connectionType: "email" | "username" | "sms";
+    authConnection: "email" | "username" | "sms";
     session_id: string | undefined;
     authParams: {
         client_id: string;

package/dist/types/helpers/action-executions-cleanup.d.ts

@@ -0,0 +1,34 @@
+import { ActionExecutionsAdapter } from "@authhero/adapter-interfaces";
+export interface ActionExecutionsCleanupParams {
+    /**
+     * Days of execution history to keep. Defaults to 30.
+     *
+     * Unlike `codes`, these rows have no expiry — they are diagnostic history,
+     * referenced from logs when debugging an action. The window is a genuine
+     * retention policy: long enough to investigate a report that arrives late,
+     * short enough that the table stops growing without bound.
+     */
+    retentionDays?: number;
+}
+/**
+ * Delete action executions created more than the retention window ago.
+ *
+ * Prefer `runRetention`, which calls this along with every other prunable
+ * table — scheduling one call means a future prunable table is covered
+ * without editing your handler. Use this directly only when you want to sweep
+ * `action_executions` on its own schedule.
+ *
+ * Returns `null` when the adapter does not support cleanup (backends like
+ * DynamoDB TTL or Analytics Engine expire rows themselves).
+ *
+ * @example
+ * ```ts
+ * // Cloudflare Workers scheduled handler
+ * async scheduled(_event, env) {
+ *   await cleanupActionExecutions(dataAdapter.actionExecutions, {
+ *     retentionDays: 30,
+ *   });
+ * }
+ * ```
+ */
+export declare function cleanupActionExecutions(actionExecutions: ActionExecutionsAdapter, params?: ActionExecutionsCleanupParams): Promise<number | null>;

package/dist/types/helpers/dcr/metadata-mapping.d.ts

@@ -23,9 +23,9 @@ export declare const dcrRequestSchema: z.ZodObject<{
     grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
     response_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
     token_endpoint_auth_method: z.ZodOptional<z.ZodEnum<{
-        none: "none";
         client_secret_post: "client_secret_post";
         client_secret_basic: "client_secret_basic";
+        none: "none";
         client_secret_jwt: "client_secret_jwt";
         private_key_jwt: "private_key_jwt";
     }>>;

package/dist/types/helpers/run-retention.d.ts

@@ -6,6 +6,8 @@ export interface RunRetentionConfig {
     codesRetentionDays?: number;
     /** Days to keep processed/dead-lettered outbox events. Default 7. */
     outboxRetentionDays?: number;
+    /** Days of action execution history to keep. Default 30. */
+    actionExecutionsRetentionDays?: number;
     /**
      * Scope the session sweep to a single tenant. Codes and outbox events are
      * always swept globally — an expired row is dead regardless of who owns it.
@@ -59,7 +61,8 @@ export declare class RetentionSweepError extends Error {
  * without editing its handler.
  *
  * Covers `codes`, `outbox_events`, and (where the adapter supports it)
- * `sessions` / `refresh_tokens` / `login_sessions`. It does **not** drain the
+ * `action_executions` and `sessions` / `refresh_tokens` / `login_sessions`.
+ * It does **not** drain the
  * outbox: delivery is `runOutboxRelay`'s job, and the two are scheduled
  * independently. Running both is safe — the relay's own cleanup pass and this
  * one are idempotent.

package/dist/types/helpers/service-token.d.ts

@@ -14,6 +14,12 @@ export interface CreateServiceTokenCoreParams {
     tenantId: string;
     scope: string;
     issuer: string;
+    /**
+     * Explicit audience override. When unset the tenant's `audience` is
+     * required — callers that want a fallback chain (e.g. `default_audience`)
+     * resolve it themselves and pass the result here.
+     */
+    audience?: string;
     expiresInSeconds?: number;
     customClaims?: Record<string, unknown>;
     /**
@@ -31,14 +37,19 @@ export interface CreateServiceTokenCoreParams {
  * binding, and signing key.
  */
 export declare function createServiceTokenCore(params: CreateServiceTokenCoreParams): Promise<ServiceTokenResponse>;
+/**
+ * Mint an internal `auth-service` token for calling our own (or a trusted
+ * downstream) API. Deliberately does NOT go through `createAuthTokens`: that
+ * path runs the tenant's credentials-exchange hooks, which must never fire for
+ * internal mints. A hook that calls `api.access.deny()` (e.g. a tenant gating
+ * logins on an external membership lookup) would otherwise reject the mint —
+ * and since post-user-update hooks commonly mint service tokens, a hook that
+ * updates a user could recurse straight back into itself.
+ */
 export declare function createServiceToken(ctx: Context<{
     Bindings: Bindings;
     Variables: Variables;
-}>, tenant_id: string, scope: string, expiresInSeconds?: number, customClaims?: Record<string, unknown>): Promise<{
-    access_token: string;
-    token_type: string;
-    expires_in: number;
-}>;
+}>, tenant_id: string, scope: string, expiresInSeconds?: number, customClaims?: Record<string, unknown>): Promise<ServiceTokenResponse>;
 /**
  * Bound ctx-free token factory for outbox destinations. Mirrors the shape
  * expected by `WebhookDestination` and `createDefaultDestinations` but uses

package/dist/types/hooks/post-user-login.d.ts

@@ -28,4 +28,10 @@ export declare function postUserLoginHook(ctx: Context<{
     };
     /** The connection name actually used to authenticate. */
     authConnection?: string;
+    /**
+     * True when the login completed by reusing an existing SSO session
+     * rather than fresh credentials. Page hooks (e.g. impersonate) only
+     * interrupt fresh logins.
+     */
+    sessionReused?: boolean;
 }): Promise<User | Response>;