authhero 9.1.1 → 9.3.0

package/dist/types/authentication-flows/passwordless.d.ts

@@ -368,7 +368,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                             active?: boolean | undefined;
                         } | undefined;
                         signup?: {
-                            status?: "optional" | "required" | "disabled" | undefined;
+                            status?: "required" | "optional" | "disabled" | undefined;
                             verification?: {
                                 active?: boolean | undefined;
                             } | undefined;
@@ -385,7 +385,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                             active?: boolean | undefined;
                         } | undefined;
                         signup?: {
-                            status?: "optional" | "required" | "disabled" | undefined;
+                            status?: "required" | "optional" | "disabled" | undefined;
                         } | undefined;
                         validation?: {
                             max_length?: number | undefined;
@@ -402,7 +402,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                             active?: boolean | undefined;
                         } | undefined;
                         signup?: {
-                            status?: "optional" | "required" | "disabled" | undefined;
+                            status?: "required" | "optional" | "disabled" | undefined;
                         } | undefined;
                     } | undefined;
                 } | undefined;
@@ -467,7 +467,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
         custom_login_page_preview?: string | undefined;
         form_template?: string | undefined;
         addons?: Record<string, any> | undefined;
-        token_endpoint_auth_method?: "none" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | "private_key_jwt" | undefined;
+        token_endpoint_auth_method?: "none" | "private_key_jwt" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | undefined;
         client_metadata?: Record<string, string> | undefined;
         hide_sign_up_disabled_error?: boolean | undefined;
         mobile?: Record<string, any> | undefined;
@@ -550,8 +550,8 @@ export declare function passwordlessGrantUser(ctx: Context<{
         } | undefined;
         authenticated_at?: string | undefined;
     };
-    connectionType: "username" | "email" | "sms";
-    authConnection: "username" | "email" | "sms";
+    connectionType: "username" | "sms" | "email";
+    authConnection: "username" | "sms" | "email";
     session_id: string | undefined;
     authParams: {
         client_id: string;

package/dist/types/helpers/action-executions-cleanup.d.ts

@@ -0,0 +1,34 @@
+import { ActionExecutionsAdapter } from "@authhero/adapter-interfaces";
+export interface ActionExecutionsCleanupParams {
+    /**
+     * Days of execution history to keep. Defaults to 30.
+     *
+     * Unlike `codes`, these rows have no expiry — they are diagnostic history,
+     * referenced from logs when debugging an action. The window is a genuine
+     * retention policy: long enough to investigate a report that arrives late,
+     * short enough that the table stops growing without bound.
+     */
+    retentionDays?: number;
+}
+/**
+ * Delete action executions created more than the retention window ago.
+ *
+ * Prefer `runRetention`, which calls this along with every other prunable
+ * table — scheduling one call means a future prunable table is covered
+ * without editing your handler. Use this directly only when you want to sweep
+ * `action_executions` on its own schedule.
+ *
+ * Returns `null` when the adapter does not support cleanup (backends like
+ * DynamoDB TTL or Analytics Engine expire rows themselves).
+ *
+ * @example
+ * ```ts
+ * // Cloudflare Workers scheduled handler
+ * async scheduled(_event, env) {
+ *   await cleanupActionExecutions(dataAdapter.actionExecutions, {
+ *     retentionDays: 30,
+ *   });
+ * }
+ * ```
+ */
+export declare function cleanupActionExecutions(actionExecutions: ActionExecutionsAdapter, params?: ActionExecutionsCleanupParams): Promise<number | null>;

package/dist/types/helpers/dcr/metadata-mapping.d.ts

@@ -24,10 +24,10 @@ export declare const dcrRequestSchema: z.ZodObject<{
     response_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
     token_endpoint_auth_method: z.ZodOptional<z.ZodEnum<{
         none: "none";
+        private_key_jwt: "private_key_jwt";
         client_secret_post: "client_secret_post";
         client_secret_basic: "client_secret_basic";
         client_secret_jwt: "client_secret_jwt";
-        private_key_jwt: "private_key_jwt";
     }>>;
     jwks_uri: z.ZodOptional<z.ZodString>;
     jwks: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;

package/dist/types/helpers/run-retention.d.ts

@@ -6,6 +6,8 @@ export interface RunRetentionConfig {
     codesRetentionDays?: number;
     /** Days to keep processed/dead-lettered outbox events. Default 7. */
     outboxRetentionDays?: number;
+    /** Days of action execution history to keep. Default 30. */
+    actionExecutionsRetentionDays?: number;
     /**
      * Scope the session sweep to a single tenant. Codes and outbox events are
      * always swept globally — an expired row is dead regardless of who owns it.
@@ -59,7 +61,8 @@ export declare class RetentionSweepError extends Error {
  * without editing its handler.
  *
  * Covers `codes`, `outbox_events`, and (where the adapter supports it)
- * `sessions` / `refresh_tokens` / `login_sessions`. It does **not** drain the
+ * `action_executions` and `sessions` / `refresh_tokens` / `login_sessions`.
+ * It does **not** drain the
  * outbox: delivery is `runOutboxRelay`'s job, and the two are scheduled
  * independently. Running both is safe — the relay's own cleanup pass and this
  * one are idempotent.