authhero 9.13.1 → 9.14.0

package/dist/types/authentication-flows/passwordless.d.ts

@@ -475,7 +475,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
         custom_login_page_preview?: string | undefined;
         form_template?: string | undefined;
         addons?: Record<string, any> | undefined;
-        token_endpoint_auth_method?: "none" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | "private_key_jwt" | undefined;
+        token_endpoint_auth_method?: "client_secret_post" | "client_secret_basic" | "none" | "client_secret_jwt" | "private_key_jwt" | undefined;
         client_metadata?: Record<string, string> | undefined;
         hide_sign_up_disabled_error?: boolean | undefined;
         mobile?: Record<string, any> | undefined;
@@ -558,8 +558,8 @@ export declare function passwordlessGrantUser(ctx: Context<{
         } | undefined;
         authenticated_at?: string | undefined;
     };
-    connectionType: "username" | "sms" | "email";
-    authConnection: "username" | "sms" | "email";
+    connectionType: "email" | "username" | "sms";
+    authConnection: "email" | "username" | "sms";
     session_id: string | undefined;
     authParams: {
         audience?: string | undefined;

package/dist/types/emails/index.d.ts

@@ -1,5 +1,5 @@
 import { Context } from "hono";
-import { Bindings, Variables } from "../types";
+import { Bindings, RequestContext, Variables } from "../types";
 import { AuthParams, EmailTemplateName, User } from "@authhero/adapter-interfaces";
 export type SendEmailParams = {
     to: string;
@@ -10,10 +10,7 @@ export type SendEmailParams = {
     data: Record<string, string>;
     from?: string;
 };
-export declare function sendEmail(ctx: Context<{
-    Bindings: Bindings;
-    Variables: Variables;
-}>, params: SendEmailParams): Promise<void>;
+export declare function sendEmail(ctx: RequestContext, params: SendEmailParams, tenantIdOverride?: string): Promise<void>;
 export type SendSmsParams = {
     to: string;
     from?: string;
@@ -63,11 +60,13 @@ export interface SendInvitationParams {
     organizationName: string;
     ttlSec: number;
     language?: string;
+    /**
+     * Tenant whose email provider, branding, templates and locales are used.
+     * Defaults to the request's tenant.
+     */
+    tenantId?: string;
 }
-export declare function sendInvitation(ctx: Context<{
-    Bindings: Bindings;
-    Variables: Variables;
-}>, { to, invitationUrl, inviterName, organizationName, ttlSec, language, }: SendInvitationParams): Promise<void>;
+export declare function sendInvitation(ctx: RequestContext, { to, invitationUrl, inviterName, organizationName, ttlSec, language, tenantId: tenantIdOverride, }: SendInvitationParams): Promise<void>;
 export interface SendTestEmailParams {
     to: string;
     templateName: EmailTemplateName;

package/dist/types/emails/render.d.ts

@@ -1,7 +1,6 @@
-import { Context } from "hono";
 import { Liquid } from "liquidjs";
 import { EmailTemplateName } from "@authhero/adapter-interfaces";
-import { Bindings, Variables } from "../types";
+import { RequestContext } from "../types";
 export declare function getLiquid(): Liquid;
 export interface RenderedEmail {
     subject: string;
@@ -29,10 +28,7 @@ export type RenderResult = {
  *   2. Bundled default (compiled from MJML at build time).
  *   3. `{ kind: "none" }` if neither exists.
  */
-export declare function renderEmailTemplate(ctx: Context<{
-    Bindings: Bindings;
-    Variables: Variables;
-}>, templateName: EmailTemplateName, vars: Record<string, unknown>, fallbackFrom: string): Promise<RenderResult>;
+export declare function renderEmailTemplate(ctx: RequestContext, templateName: EmailTemplateName, vars: Record<string, unknown>, fallbackFrom: string, tenantId: string): Promise<RenderResult>;
 /**
  * Render the bundled default template directly, without consulting the
  * adapter. Exposed for tests and tooling.

package/dist/types/helpers/connection.d.ts

@@ -1,6 +1,5 @@
-import { Context } from "hono";
 import { LoginSession, User } from "@authhero/adapter-interfaces";
-import { Bindings, Variables } from "../types";
+import { RequestContext } from "../types";
 import { HookEvent } from "../types/Hooks";
 export type ConnectionInfo = NonNullable<HookEvent["connection"]>;
 export interface ConnectionNameSources {
@@ -34,7 +33,4 @@ export declare function resolveConnectionName(sources: ConnectionNameSources): s
  * Returns `undefined` when the name is empty or doesn't resolve to a known
  * connection — callers decide whether to synthesize a fallback.
  */
-export declare function getConnectionInfo(ctx: Context<{
-    Bindings: Bindings;
-    Variables: Variables;
-}>, tenantId: string, connectionName: string | undefined, user?: Pick<User, "provider"> | null): Promise<ConnectionInfo | undefined>;
+export declare function getConnectionInfo(ctx: RequestContext, tenantId: string, connectionName: string | undefined, user?: Pick<User, "provider"> | null): Promise<ConnectionInfo | undefined>;

package/dist/types/helpers/logging.d.ts

@@ -1,6 +1,6 @@
 import { Context } from "hono";
 import { DataAdapters, LogType } from "@authhero/adapter-interfaces";
-import { Variables, Bindings } from "../types";
+import { Variables, Bindings, RequestContext } from "../types";
 export type LogParams = {
     type: LogType;
     description?: string;
@@ -80,10 +80,7 @@ export type LogParams = {
     /** Entity ID being mutated */
     targetId?: string;
 };
-export declare function logMessage(ctx: Context<{
-    Bindings: Bindings;
-    Variables: Variables;
-}>, tenantId: string, params: LogParams): Promise<void>;
+export declare function logMessage(ctx: RequestContext, tenantId: string, params: LogParams): Promise<void>;
 /**
  * Transactional variant of {@link logMessage}. Writes the audit event to the
  * outbox through the caller-provided `trxData` so the insert commits (or rolls

package/dist/types/helpers/reserved-claims.d.ts

@@ -1,5 +1,4 @@
-import { Context } from "hono";
-import { Bindings, Variables } from "../types";
+import { RequestContext } from "../types";
 /** RFC 9068 §2.2 + AuthHero-owned access-token claims. */
 export declare const ACCESS_TOKEN_RESERVED_CLAIMS: readonly ["iss", "sub", "aud", "exp", "nbf", "iat", "jti", "client_id", "azp", "scope", "auth_time", "acr", "amr", "act", "sid", "permissions", "tenant_id", "org_id", "org_name", "requested_userinfo_claims", "gty"];
 /** OIDC Core ID-token claims: the access-token set plus the ID-token-only ones. */
@@ -15,9 +14,9 @@ export declare const USERINFO_RESERVED_CLAIMS: readonly ["iss", "sub", "aud", "e
  * vendor/tenant for downstream APIs while `sub` stays `auth-service`.
  * Client-bound mints keep `azp` locked (see below).
  */
-export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("tenant_id" | "client_id" | "org_name" | "scope" | "sid" | "sub" | "exp" | "iat" | "org_id" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "permissions" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
+export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("iss" | "tenant_id" | "scope" | "client_id" | "org_name" | "org_id" | "sub" | "aud" | "exp" | "nbf" | "iat" | "jti" | "auth_time" | "acr" | "amr" | "act" | "sid" | "permissions" | "requested_userinfo_claims" | "gty")[];
 /** Client-bound mints: `azp` must stay the registered client id. */
-export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("tenant_id" | "client_id" | "org_name" | "scope" | "sid" | "sub" | "exp" | "iat" | "org_id" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "azp" | "permissions" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
+export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("iss" | "tenant_id" | "scope" | "client_id" | "org_name" | "org_id" | "sub" | "aud" | "exp" | "nbf" | "iat" | "jti" | "azp" | "auth_time" | "acr" | "amr" | "act" | "sid" | "permissions" | "requested_userinfo_claims" | "gty")[];
 export type AccessTokenReservedClaim = (typeof ACCESS_TOKEN_RESERVED_CLAIMS)[number];
 export type IdTokenReservedClaim = (typeof ID_TOKEN_RESERVED_CLAIMS)[number];
 /**
@@ -58,10 +57,7 @@ export interface ApplyCustomClaimOptions {
      */
     source: string;
     /** Request context, when there is one — the warning goes to the tenant log. */
-    ctx?: Context<{
-        Bindings: Bindings;
-        Variables: Variables;
-    }>;
+    ctx?: RequestContext;
     /** Tenant to log against. Defaults to `ctx.var.tenant_id`. */
     tenantId?: string;
 }

package/dist/types/helpers/service-token.d.ts

@@ -1,6 +1,6 @@
 import { Context } from "hono";
 import { KeysAdapter, TenantsDataAdapter } from "@authhero/adapter-interfaces";
-import { Bindings, Variables } from "../types";
+import { Bindings, RequestContext, Variables } from "../types";
 import { SigningKeyModeOption } from "../types/AuthHeroConfig";
 declare const AUTH_SERVICE_CLIENT_ID = "auth-service";
 export interface ServiceTokenResponse {
@@ -89,8 +89,5 @@ export interface CreateClientServiceTokenOptions {
  * Fails closed: rejects if the client has no grant for the (audience), or if
  * any requested scope is not in `grant.scope`.
  */
-export declare function createClientServiceToken(ctx: Context<{
-    Bindings: Bindings;
-    Variables: Variables;
-}>, tenantId: string, params: CreateClientServiceTokenParams, options?: CreateClientServiceTokenOptions): Promise<ServiceTokenResponse>;
+export declare function createClientServiceToken(ctx: RequestContext, tenantId: string, params: CreateClientServiceTokenParams, options?: CreateClientServiceTokenOptions): Promise<ServiceTokenResponse>;
 export { AUTH_SERVICE_CLIENT_ID };

package/dist/types/helpers/wait-until.d.ts

@@ -12,7 +12,9 @@ import { Context } from "hono";
  * webhook dispatches) completes, producing flaky test behavior and requests
  * that occasionally lose tail work if the process exits.
  */
-export declare function waitUntil(ctx: Context, promise: Promise<unknown>): void;
+export declare function waitUntil(ctx: Pick<Context, "executionCtx" | "var"> & {
+    set(key: "backgroundPromises", value: Promise<void>[]): void;
+}, promise: Promise<unknown>): void;
 /**
  * Await any `waitUntil` promises registered during the current request. Invoke
  * from a middleware's finally block (after `await next()`) so non-Workers