authhero 9.11.0 → 9.12.0

package/dist/types/authentication-flows/passwordless.d.ts

@@ -239,7 +239,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
             pushed_authorization_requests_supported?: boolean | undefined;
             authorization_response_iss_parameter_supported?: boolean | undefined;
             deployment_type?: "shared" | "wfp" | undefined;
-            provisioning_state?: "pending" | "ready" | "failed" | undefined;
+            provisioning_state?: "pending" | "failed" | "ready" | undefined;
             provisioning_error?: string | undefined;
             provisioning_state_changed_at?: string | undefined;
             bundle_configuration?: string | undefined;
@@ -475,7 +475,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
         custom_login_page_preview?: string | undefined;
         form_template?: string | undefined;
         addons?: Record<string, any> | undefined;
-        token_endpoint_auth_method?: "client_secret_post" | "client_secret_basic" | "none" | "client_secret_jwt" | "private_key_jwt" | undefined;
+        token_endpoint_auth_method?: "none" | "private_key_jwt" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | undefined;
         client_metadata?: Record<string, string> | undefined;
         hide_sign_up_disabled_error?: boolean | undefined;
         mobile?: Record<string, any> | undefined;

package/dist/types/emails/render.d.ts

@@ -1,6 +1,8 @@
 import { Context } from "hono";
+import { Liquid } from "liquidjs";
 import { EmailTemplateName } from "@authhero/adapter-interfaces";
 import { Bindings, Variables } from "../types";
+export declare function getLiquid(): Liquid;
 export interface RenderedEmail {
     subject: string;
     html: string;

package/dist/types/helpers/action-executions-cleanup.d.ts

@@ -1,12 +1,15 @@
 import { ActionExecutionsAdapter } from "@authhero/adapter-interfaces";
 export interface ActionExecutionsCleanupParams {
     /**
-     * Days of execution history to keep. Defaults to 30.
+     * Days of execution history to keep. Defaults to 10, matching Auth0
+     * ("Executions will only be stored for 10 days after their creation").
      *
      * Unlike `codes`, these rows have no expiry — they are diagnostic history,
      * referenced from logs when debugging an action. The window is a genuine
      * retention policy: long enough to investigate a report that arrives late,
-     * short enough that the table stops growing without bound.
+     * short enough that the table stops growing without bound. Rows can carry
+     * whatever a tenant's action wrote to `console`, so a shorter window is also
+     * the safer one.
      */
     retentionDays?: number;
 }
@@ -26,7 +29,7 @@ export interface ActionExecutionsCleanupParams {
  * // Cloudflare Workers scheduled handler
  * async scheduled(_event, env) {
  *   await cleanupActionExecutions(dataAdapter.actionExecutions, {
- *     retentionDays: 30,
+ *     retentionDays: 10,
  *   });
  * }
  * ```

package/dist/types/helpers/dcr/metadata-mapping.d.ts

@@ -23,11 +23,11 @@ export declare const dcrRequestSchema: z.ZodObject<{
     grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
     response_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
     token_endpoint_auth_method: z.ZodOptional<z.ZodEnum<{
+        none: "none";
+        private_key_jwt: "private_key_jwt";
         client_secret_post: "client_secret_post";
         client_secret_basic: "client_secret_basic";
-        none: "none";
         client_secret_jwt: "client_secret_jwt";
-        private_key_jwt: "private_key_jwt";
     }>>;
     jwks_uri: z.ZodOptional<z.ZodString>;
     jwks: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;

package/dist/types/helpers/logging.d.ts

@@ -52,11 +52,19 @@ export type LogParams = {
         body?: unknown;
     };
     /**
-     * When provided, replaces the auto-generated details object entirely.
-     * Use this to store a compact, pre-built details payload (e.g. for webhook logs)
-     * that fits within storage limits (Analytics Engine blob: 1024 bytes).
+     * When provided, replaces the auto-generated `{ request, response? }` details
+     * object entirely. Use this to store a compact, pre-built details payload
+     * (e.g. for webhook logs) that fits within storage limits (Analytics Engine
+     * blob: 1024 bytes). `execution_id` is still merged on top when set — pass it
+     * via its own field rather than inlining it here, or the request block is lost.
      */
     details?: Record<string, unknown>;
+    /**
+     * The action execution this event resulted from. Merged into `details` rather
+     * than replacing it, so a login log keeps its request snapshot while still
+     * linking to the execution (Auth0 reaches executions via the tenant logs).
+     */
+    execution_id?: string;
     /**
      * If true, wait for the log to complete before returning.
      * If false (default), execute logging asynchronously in the background.

package/dist/types/helpers/reserved-claims.d.ts

@@ -15,9 +15,9 @@ export declare const USERINFO_RESERVED_CLAIMS: readonly ["iss", "sub", "aud", "e
  * vendor/tenant for downstream APIs while `sub` stays `auth-service`.
  * Client-bound mints keep `azp` locked (see below).
  */
-export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("client_id" | "scope" | "sid" | "tenant_id" | "sub" | "org_name" | "permissions" | "iat" | "org_id" | "exp" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
+export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("tenant_id" | "client_id" | "org_name" | "sid" | "scope" | "sub" | "exp" | "iat" | "org_id" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "permissions" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
 /** Client-bound mints: `azp` must stay the registered client id. */
-export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("client_id" | "scope" | "sid" | "tenant_id" | "sub" | "org_name" | "permissions" | "iat" | "org_id" | "exp" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "azp" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
+export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("tenant_id" | "client_id" | "org_name" | "sid" | "scope" | "sub" | "exp" | "iat" | "org_id" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "azp" | "permissions" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
 export type AccessTokenReservedClaim = (typeof ACCESS_TOKEN_RESERVED_CLAIMS)[number];
 export type IdTokenReservedClaim = (typeof ID_TOKEN_RESERVED_CLAIMS)[number];
 /**
@@ -31,7 +31,23 @@ export type ServerOwnedAccessTokenClaims = Partial<Record<AccessTokenReservedCla
 export type ServerOwnedIdTokenClaims = Partial<Record<IdTokenReservedClaim, unknown>>;
 /** Which payload a custom claim is being written to. */
 export type ClaimPayloadKind = "access_token" | "id_token" | "userinfo" | "service_token" | "client_service_token";
-export declare function isReservedClaim(claim: string, kind: ClaimPayloadKind): boolean;
+/**
+ * Transitional escape hatch for `init({ unsafeAllowAzpCustomClaim: true })`.
+ *
+ * A deployment that shipped `azp` as a tenant-owned claim before this module
+ * existed cannot un-reserve it atomically: every downstream service reading
+ * `azp` has to be moved off it first, and until then reserving the name simply
+ * deletes the claim from the token (the mint never emits `azp` itself). The
+ * flag keeps those tokens intact while that migration runs.
+ *
+ * It is unsafe because `middlewares/authentication.ts` reads `azp` as the
+ * calling client's id, so a hook-supplied value lands in the request context
+ * where a registered client id is expected. Enable it only to buy time, and
+ * only where the hooks writing `azp` are first-party code.
+ */
+export declare function isReservedClaim(claim: string, kind: ClaimPayloadKind, options?: {
+    allowAzpOverride?: boolean;
+}): boolean;
 export interface ApplyCustomClaimOptions {
     /** Which payload is being written to — selects the reserved set. */
     kind: ClaimPayloadKind;

package/dist/types/helpers/run-retention.d.ts

@@ -6,7 +6,7 @@ export interface RunRetentionConfig {
     codesRetentionDays?: number;
     /** Days to keep processed/dead-lettered outbox events. Default 7. */
     outboxRetentionDays?: number;
-    /** Days of action execution history to keep. Default 30. */
+    /** Days of action execution history to keep. Default 10, matching Auth0. */
     actionExecutionsRetentionDays?: number;
     /**
      * Hours to keep finished bulk user-import jobs and their staged rows.

package/dist/types/helpers/saml.d.ts

@@ -1 +1 @@
-export * from "@authhero/saml";
+export * from "@authhero/saml/core";

package/dist/types/helpers/scopes-permissions.d.ts

@@ -41,6 +41,22 @@ export declare function userHasGlobalOrgAdminPermission(ctx: Context<{
     Bindings: Bindings;
     Variables: Variables;
 }>, tenantId: string, userId: string): Promise<boolean>;
+/**
+ * Returns the subset of `scopes` that the resource server matching `audience`
+ * does not define — the scopes that would silently vanish from an issued token.
+ *
+ * Returns an empty list when no resource server matches the audience: those
+ * grants (control-plane, cross-tenant) have no scope catalogue to check
+ * against, so there is nothing to flag.
+ */
+export declare function findUndefinedResourceServerScopes(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, params: {
+    tenantId: string;
+    audience: string;
+    scopes: string[];
+}): Promise<string[]>;
 /**
  * Calculates the scopes and permissions for a user based on the audience and resource server configuration.
  * This function implements Auth0-like behavior for RBAC and token dialects.

package/dist/types/helpers/users-import/map.d.ts

@@ -121,6 +121,20 @@ export declare function redactEntry(entry: unknown): Record<string, unknown>;
  * import. {@link redactEntry} is applied when the row is read back out.
  */
 export declare function toStagedPayload(entry: unknown): Record<string, unknown>;
+export type IdentityField = "user_id" | "email" | "username" | "phone_number";
+/**
+ * Normalize one identity value so two spellings of the same identity compare
+ * equal.
+ *
+ * `email` and `username` are case-insensitive; `user_id` and `phone_number`
+ * are compared exactly, because lowercasing an id could collapse two genuinely
+ * distinct users. `entryIdentityKeys` below applies the same rule, and the
+ * batched import probe uses this so its in-memory lookups agree with what the
+ * database considers the same row — on MySQL an `email` probe is resolved with
+ * a case-insensitive collation and can return a different spelling than the one
+ * asked for.
+ */
+export declare function identityKey(field: IdentityField, value: string): string;
 /**
  * Identity keys Auth0 dedupes an import file on: a repeat of any of these
  * within one file is an error rather than a silent overwrite.

package/dist/types/hooks/codehooks.d.ts

@@ -1,5 +1,5 @@
 import { Context } from "hono";
-import { ActionExecutionResult, CodeExecutionLog, CodeExecutor, DataAdapters, Hook } from "@authhero/adapter-interfaces";
+import { ActionExecutionLogs, ActionExecutionResult, CodeExecutionLog, CodeExecutor, DataAdapters, Hook } from "@authhero/adapter-interfaces";
 import { Bindings, Variables } from "../types";
 import { HookEvent, OnExecuteCredentialsExchangeAPI } from "../types/Hooks";
 import { EnrichedClient } from "../helpers/client";
@@ -125,6 +125,33 @@ export declare function handleCodeHook(ctx: Context<{
     code_id: string;
     hook_id: string;
 }, event: HookEvent, triggerId: string, api: CodeHookApi): Promise<HandleCodeHookOutcome | null>;
+/**
+ * Budget, in characters, for the console output persisted with a single
+ * execution record. The number comes from Auth0 ("A maximum of 256 characters
+ * may be persistently stored for `console.log()` outputs for each Action"),
+ * but the unit deliberately does not: Auth0 charges the budget per Action,
+ * AuthHero charges it once for the whole execution, so an execution with
+ * several bound actions is stricter here than on Auth0.
+ *
+ * That is the point. Each executor already caps its own capture (50 entries
+ * x 500 chars), so the per-action axis is bounded; what was not bounded is the
+ * number of actions bound to one trigger multiplying that ceiling. And
+ * `action_executions.logs` is written on every token exchange — including
+ * refresh grants — so the aggregate is what needs a ceiling.
+ *
+ * It is a budget, not a per-line trim: it is spent across lines in order.
+ */
+export declare const MAX_PERSISTED_LOG_CHARS = 256;
+/**
+ * Trim aggregated per-action console output down to
+ * `MAX_PERSISTED_LOG_CHARS` characters, in order, and append an explicit
+ * marker so a reader can tell the record is truncated rather than complete.
+ *
+ * A line that straddles the budget is cut at the boundary and kept; the lines
+ * after it are dropped. The marker is appended to the last entry that retained
+ * output and is not itself charged against the budget.
+ */
+export declare function capActionExecutionLogs(logs: ActionExecutionLogs, budget?: number): ActionExecutionLogs;
 /**
  * Aggregate per-action outcomes into an Auth0-shape execution record and
  * persist it via the adapter. Returns the generated execution_id (uuid)