authhero 9.18.0 → 9.20.0

package/dist/types/routes/management-api/users.d.ts

@@ -818,14 +818,10 @@ export declare const userRoutes: OpenAPIHono<{
             };
             output: {
                 user_id: string;
-                client_id: string;
-                created_at: string;
                 id: string;
-                resource_servers: {
-                    audience: string;
-                    scopes: string;
-                }[];
-                login_id: string;
+                created_at: string;
+                client_id: string;
+                rotating: boolean;
                 device: {
                     initial_user_agent: string;
                     initial_ip: string;
@@ -834,9 +830,12 @@ export declare const userRoutes: OpenAPIHono<{
                     last_ip: string;
                     last_asn: string;
                 };
-                rotating: boolean;
+                login_id: string;
+                resource_servers: {
+                    audience: string;
+                    scopes: string;
+                }[];
                 expires_at?: string | undefined;
-                organization?: string | undefined;
                 session_id?: string | undefined;
                 auth_connection?: string | undefined;
                 auth_strategy?: {
@@ -845,21 +844,15 @@ export declare const userRoutes: OpenAPIHono<{
                 } | undefined;
                 revoked_at?: string | undefined;
                 idle_expires_at?: string | undefined;
+                organization?: string | undefined;
                 last_exchanged_at?: string | undefined;
             }[] | {
-                start: number;
-                limit: number;
-                length: number;
                 tokens: {
                     user_id: string;
-                    client_id: string;
-                    created_at: string;
                     id: string;
-                    resource_servers: {
-                        audience: string;
-                        scopes: string;
-                    }[];
-                    login_id: string;
+                    created_at: string;
+                    client_id: string;
+                    rotating: boolean;
                     device: {
                         initial_user_agent: string;
                         initial_ip: string;
@@ -868,9 +861,12 @@ export declare const userRoutes: OpenAPIHono<{
                         last_ip: string;
                         last_asn: string;
                     };
-                    rotating: boolean;
+                    login_id: string;
+                    resource_servers: {
+                        audience: string;
+                        scopes: string;
+                    }[];
                     expires_at?: string | undefined;
-                    organization?: string | undefined;
                     session_id?: string | undefined;
                     auth_connection?: string | undefined;
                     auth_strategy?: {
@@ -879,21 +875,20 @@ export declare const userRoutes: OpenAPIHono<{
                     } | undefined;
                     revoked_at?: string | undefined;
                     idle_expires_at?: string | undefined;
+                    organization?: string | undefined;
                     last_exchanged_at?: string | undefined;
                 }[];
-                total?: number | undefined;
                 next?: string | undefined;
             } | {
+                start: number;
+                limit: number;
+                length: number;
                 tokens: {
                     user_id: string;
-                    client_id: string;
-                    created_at: string;
                     id: string;
-                    resource_servers: {
-                        audience: string;
-                        scopes: string;
-                    }[];
-                    login_id: string;
+                    created_at: string;
+                    client_id: string;
+                    rotating: boolean;
                     device: {
                         initial_user_agent: string;
                         initial_ip: string;
@@ -902,9 +897,12 @@ export declare const userRoutes: OpenAPIHono<{
                         last_ip: string;
                         last_asn: string;
                     };
-                    rotating: boolean;
+                    login_id: string;
+                    resource_servers: {
+                        audience: string;
+                        scopes: string;
+                    }[];
                     expires_at?: string | undefined;
-                    organization?: string | undefined;
                     session_id?: string | undefined;
                     auth_connection?: string | undefined;
                     auth_strategy?: {
@@ -913,8 +911,10 @@ export declare const userRoutes: OpenAPIHono<{
                     } | undefined;
                     revoked_at?: string | undefined;
                     idle_expires_at?: string | undefined;
+                    organization?: string | undefined;
                     last_exchanged_at?: string | undefined;
                 }[];
+                total?: number | undefined;
                 next?: string | undefined;
             };
             outputFormat: "json";
@@ -963,7 +963,7 @@ export declare const userRoutes: OpenAPIHono<{
                 };
             };
             output: {
-                type: "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "cs" | "depnote" | "f" | "fc" | "fce" | "fco" | "fcoa" | "fcp" | "fcph" | "fcpn" | "fcpr" | "fcpro" | "fcu" | "fd" | "fdeac" | "fdeaz" | "fdecc" | "fdu" | "feacft" | "feccft" | "fecte" | "fede" | "federated_logout_failed" | "fens" | "feoobft" | "feotpft" | "fepft" | "fepotpft" | "fercft" | "ferrt" | "fertft" | "festft" | "fh" | "fimp" | "fi" | "flo" | "flows_execution_completed" | "flows_execution_failed" | "fn" | "forms_submission_failed" | "forms_submission_succeeded" | "fp" | "fpar" | "fpurh" | "fs" | "fsa" | "fu" | "fui" | "fv" | "fvr" | "gd_auth_email_verification" | "gd_auth_fail_email_verification" | "gd_auth_failed" | "gd_auth_rejected" | "gd_auth_succeed" | "gd_enrollment_complete" | "gd_otp_rate_limit_exceed" | "gd_recovery_failed" | "gd_recovery_rate_limit_exceed" | "gd_recovery_succeed" | "gd_send_email" | "gd_send_email_verification" | "gd_send_email_verification_failure" | "gd_send_pn" | "gd_send_pn_failure" | "gd_send_sms" | "gd_send_sms_failure" | "gd_send_voice" | "gd_send_voice_failure" | "gd_start_auth" | "gd_start_enroll" | "gd_start_enroll_failed" | "gd_tenant_update" | "gd_unenroll" | "gd_update_device_account" | "gd_webauthn_challenge_failed" | "gd_webauthn_enrollment_failed" | "kms_key_management_failure" | "kms_key_management_success" | "kms_key_state_changed" | "limit_delegation" | "limit_mu" | "limit_sul" | "limit_wc" | "i" | "mfar" | "mgmt_api_read" | "my_account_authentication_method_failed" | "my_account_authentication_method_succeeded" | "oidc_backchannel_logout_failed" | "oidc_backchannel_logout_succeeded" | "organization_member_added" | "passkey_challenge_failed" | "passkey_challenge_started" | "pla" | "pwd_leak" | "reset_pwd_leak" | "resource_cleanup" | "rich_consents_access_error" | "s" | "sapi" | "fapi" | "sce" | "scoa" | "scp" | "scpn" | "scpr" | "scu" | "scv" | "sd" | "sdu" | "seacft" | "seccft" | "secte" | "sede" | "sens" | "seoobft" | "seotpft" | "sepotpft" | "sepft" | "sepkoobft" | "sepkotpft" | "sepkrcft" | "sercft" | "sertft" | "sestft" | "simp" | "si" | "signup_pwd_leak" | "slo" | "sh" | "spm" | "srrt" | "ss" | "ss_sso_failure" | "ss_sso_info" | "ss_sso_success" | "ssa" | "sscim" | "sui" | "sv" | "svr" | "too_many_records" | "ublkdu" | "universal_logout_failed" | "universal_logout_succeeded" | "w" | "wn" | "wum";
+                type: "fn" | "i" | "cs" | "fi" | "sv" | "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "depnote" | "f" | "fc" | "fce" | "fco" | "fcoa" | "fcp" | "fcph" | "fcpn" | "fcpr" | "fcpro" | "fcu" | "fd" | "fdeac" | "fdeaz" | "fdecc" | "fdu" | "feacft" | "feccft" | "fecte" | "fede" | "federated_logout_failed" | "fens" | "feoobft" | "feotpft" | "fepft" | "fepotpft" | "fercft" | "ferrt" | "fertft" | "festft" | "fh" | "fimp" | "flo" | "flows_execution_completed" | "flows_execution_failed" | "forms_submission_failed" | "forms_submission_succeeded" | "fp" | "fpar" | "fpurh" | "fs" | "fsa" | "fu" | "fui" | "fv" | "fvr" | "gd_auth_email_verification" | "gd_auth_fail_email_verification" | "gd_auth_failed" | "gd_auth_rejected" | "gd_auth_succeed" | "gd_enrollment_complete" | "gd_otp_rate_limit_exceed" | "gd_recovery_failed" | "gd_recovery_rate_limit_exceed" | "gd_recovery_succeed" | "gd_send_email" | "gd_send_email_verification" | "gd_send_email_verification_failure" | "gd_send_pn" | "gd_send_pn_failure" | "gd_send_sms" | "gd_send_sms_failure" | "gd_send_voice" | "gd_send_voice_failure" | "gd_start_auth" | "gd_start_enroll" | "gd_start_enroll_failed" | "gd_tenant_update" | "gd_unenroll" | "gd_update_device_account" | "gd_webauthn_challenge_failed" | "gd_webauthn_enrollment_failed" | "kms_key_management_failure" | "kms_key_management_success" | "kms_key_state_changed" | "limit_delegation" | "limit_mu" | "limit_sul" | "limit_wc" | "mfar" | "mgmt_api_read" | "my_account_authentication_method_failed" | "my_account_authentication_method_succeeded" | "oidc_backchannel_logout_failed" | "oidc_backchannel_logout_succeeded" | "organization_member_added" | "passkey_challenge_failed" | "passkey_challenge_started" | "pla" | "pwd_leak" | "reset_pwd_leak" | "resource_cleanup" | "rich_consents_access_error" | "s" | "sapi" | "fapi" | "sce" | "scoa" | "scp" | "scpn" | "scpr" | "scu" | "scv" | "sd" | "sdu" | "seacft" | "seccft" | "secte" | "sede" | "sens" | "seoobft" | "seotpft" | "sepotpft" | "sepft" | "sepkoobft" | "sepkotpft" | "sepkrcft" | "sercft" | "sertft" | "sestft" | "simp" | "si" | "signup_pwd_leak" | "slo" | "sh" | "spm" | "srrt" | "ss" | "ss_sso_failure" | "ss_sso_info" | "ss_sso_success" | "ssa" | "sscim" | "sui" | "svr" | "too_many_records" | "ublkdu" | "universal_logout_failed" | "universal_logout_succeeded" | "w" | "wn" | "wum";
                 date: string;
                 isMobile: boolean;
                 log_id: string;
@@ -1002,7 +1002,7 @@ export declare const userRoutes: OpenAPIHono<{
                 limit: number;
                 length: number;
                 logs: {
-                    type: "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "cs" | "depnote" | "f" | "fc" | "fce" | "fco" | "fcoa" | "fcp" | "fcph" | "fcpn" | "fcpr" | "fcpro" | "fcu" | "fd" | "fdeac" | "fdeaz" | "fdecc" | "fdu" | "feacft" | "feccft" | "fecte" | "fede" | "federated_logout_failed" | "fens" | "feoobft" | "feotpft" | "fepft" | "fepotpft" | "fercft" | "ferrt" | "fertft" | "festft" | "fh" | "fimp" | "fi" | "flo" | "flows_execution_completed" | "flows_execution_failed" | "fn" | "forms_submission_failed" | "forms_submission_succeeded" | "fp" | "fpar" | "fpurh" | "fs" | "fsa" | "fu" | "fui" | "fv" | "fvr" | "gd_auth_email_verification" | "gd_auth_fail_email_verification" | "gd_auth_failed" | "gd_auth_rejected" | "gd_auth_succeed" | "gd_enrollment_complete" | "gd_otp_rate_limit_exceed" | "gd_recovery_failed" | "gd_recovery_rate_limit_exceed" | "gd_recovery_succeed" | "gd_send_email" | "gd_send_email_verification" | "gd_send_email_verification_failure" | "gd_send_pn" | "gd_send_pn_failure" | "gd_send_sms" | "gd_send_sms_failure" | "gd_send_voice" | "gd_send_voice_failure" | "gd_start_auth" | "gd_start_enroll" | "gd_start_enroll_failed" | "gd_tenant_update" | "gd_unenroll" | "gd_update_device_account" | "gd_webauthn_challenge_failed" | "gd_webauthn_enrollment_failed" | "kms_key_management_failure" | "kms_key_management_success" | "kms_key_state_changed" | "limit_delegation" | "limit_mu" | "limit_sul" | "limit_wc" | "i" | "mfar" | "mgmt_api_read" | "my_account_authentication_method_failed" | "my_account_authentication_method_succeeded" | "oidc_backchannel_logout_failed" | "oidc_backchannel_logout_succeeded" | "organization_member_added" | "passkey_challenge_failed" | "passkey_challenge_started" | "pla" | "pwd_leak" | "reset_pwd_leak" | "resource_cleanup" | "rich_consents_access_error" | "s" | "sapi" | "fapi" | "sce" | "scoa" | "scp" | "scpn" | "scpr" | "scu" | "scv" | "sd" | "sdu" | "seacft" | "seccft" | "secte" | "sede" | "sens" | "seoobft" | "seotpft" | "sepotpft" | "sepft" | "sepkoobft" | "sepkotpft" | "sepkrcft" | "sercft" | "sertft" | "sestft" | "simp" | "si" | "signup_pwd_leak" | "slo" | "sh" | "spm" | "srrt" | "ss" | "ss_sso_failure" | "ss_sso_info" | "ss_sso_success" | "ssa" | "sscim" | "sui" | "sv" | "svr" | "too_many_records" | "ublkdu" | "universal_logout_failed" | "universal_logout_succeeded" | "w" | "wn" | "wum";
+                    type: "fn" | "i" | "cs" | "fi" | "sv" | "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "depnote" | "f" | "fc" | "fce" | "fco" | "fcoa" | "fcp" | "fcph" | "fcpn" | "fcpr" | "fcpro" | "fcu" | "fd" | "fdeac" | "fdeaz" | "fdecc" | "fdu" | "feacft" | "feccft" | "fecte" | "fede" | "federated_logout_failed" | "fens" | "feoobft" | "feotpft" | "fepft" | "fepotpft" | "fercft" | "ferrt" | "fertft" | "festft" | "fh" | "fimp" | "flo" | "flows_execution_completed" | "flows_execution_failed" | "forms_submission_failed" | "forms_submission_succeeded" | "fp" | "fpar" | "fpurh" | "fs" | "fsa" | "fu" | "fui" | "fv" | "fvr" | "gd_auth_email_verification" | "gd_auth_fail_email_verification" | "gd_auth_failed" | "gd_auth_rejected" | "gd_auth_succeed" | "gd_enrollment_complete" | "gd_otp_rate_limit_exceed" | "gd_recovery_failed" | "gd_recovery_rate_limit_exceed" | "gd_recovery_succeed" | "gd_send_email" | "gd_send_email_verification" | "gd_send_email_verification_failure" | "gd_send_pn" | "gd_send_pn_failure" | "gd_send_sms" | "gd_send_sms_failure" | "gd_send_voice" | "gd_send_voice_failure" | "gd_start_auth" | "gd_start_enroll" | "gd_start_enroll_failed" | "gd_tenant_update" | "gd_unenroll" | "gd_update_device_account" | "gd_webauthn_challenge_failed" | "gd_webauthn_enrollment_failed" | "kms_key_management_failure" | "kms_key_management_success" | "kms_key_state_changed" | "limit_delegation" | "limit_mu" | "limit_sul" | "limit_wc" | "mfar" | "mgmt_api_read" | "my_account_authentication_method_failed" | "my_account_authentication_method_succeeded" | "oidc_backchannel_logout_failed" | "oidc_backchannel_logout_succeeded" | "organization_member_added" | "passkey_challenge_failed" | "passkey_challenge_started" | "pla" | "pwd_leak" | "reset_pwd_leak" | "resource_cleanup" | "rich_consents_access_error" | "s" | "sapi" | "fapi" | "sce" | "scoa" | "scp" | "scpn" | "scpr" | "scu" | "scv" | "sd" | "sdu" | "seacft" | "seccft" | "secte" | "sede" | "sens" | "seoobft" | "seotpft" | "sepotpft" | "sepft" | "sepkoobft" | "sepkotpft" | "sepkrcft" | "sercft" | "sertft" | "sestft" | "simp" | "si" | "signup_pwd_leak" | "slo" | "sh" | "spm" | "srrt" | "ss" | "ss_sso_failure" | "ss_sso_info" | "ss_sso_success" | "ssa" | "sscim" | "sui" | "svr" | "too_many_records" | "ublkdu" | "universal_logout_failed" | "universal_logout_succeeded" | "w" | "wn" | "wum";
                     date: string;
                     isMobile: boolean;
                     log_id: string;

package/dist/types/routes/universal-login/common.d.ts

@@ -72,12 +72,12 @@ export declare function initJSXRoute(ctx: Context<{
             background_color: string;
             background_image_url: string;
             page_layout: "center" | "left" | "right";
-            logo_placement?: "none" | "widget" | "chip" | undefined;
+            logo_placement?: "widget" | "none" | "chip" | undefined;
         };
         widget: {
             header_text_alignment: "center" | "left" | "right";
             logo_height: number;
-            logo_position: "none" | "center" | "left" | "right";
+            logo_position: "center" | "left" | "right" | "none";
             logo_url: string;
             social_buttons_layout: "bottom" | "top";
         };
@@ -808,12 +808,12 @@ export declare function initJSXRouteWithSession(ctx: Context<{
             background_color: string;
             background_image_url: string;
             page_layout: "center" | "left" | "right";
-            logo_placement?: "none" | "widget" | "chip" | undefined;
+            logo_placement?: "widget" | "none" | "chip" | undefined;
         };
         widget: {
             header_text_alignment: "center" | "left" | "right";
             logo_height: number;
-            logo_position: "none" | "center" | "left" | "right";
+            logo_position: "center" | "left" | "right" | "none";
             logo_url: string;
             social_buttons_layout: "bottom" | "top";
         };

package/dist/types/routes/universal-login/error-page.d.ts

@@ -10,7 +10,14 @@ export type ErrorPageProps = {
     title?: string;
     message: string;
     statusCode: number;
-    variant?: "error" | "info";
+    variant?: "error" | "info" | "success";
+    /** Optional call-to-action rendered as a primary button under the message. */
+    action?: {
+        label: string;
+        href: string;
+    };
+    /** Overrides the default `lang` attribute ("en"). */
+    lang?: string;
     branding?: {
         colors?: {
             primary?: string;
@@ -37,4 +44,4 @@ export type ErrorPageProps = {
      */
     embed?: boolean;
 };
-export declare function ErrorPage({ title, message, statusCode, variant, branding, theme, darkMode, extraScript, embed, }: ErrorPageProps): import("hono/jsx/jsx-dev-runtime").JSX.Element;
+export declare function ErrorPage({ title, message, statusCode, variant, action, lang, branding, theme, darkMode, extraScript, embed, }: ErrorPageProps): import("hono/jsx/jsx-dev-runtime").JSX.Element;

package/dist/types/routes/universal-login/flow-api.d.ts

@@ -27,7 +27,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
             output: {
                 screen: {
                     action: string;
-                    method: "POST" | "GET";
+                    method: "GET" | "POST";
                     components: {
                         id: string;
                         type: string;
@@ -107,7 +107,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
             output: {
                 screen: {
                     action: string;
-                    method: "POST" | "GET";
+                    method: "GET" | "POST";
                     components: {
                         id: string;
                         type: string;
@@ -204,7 +204,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
             output: {
                 screen: {
                     action: string;
-                    method: "POST" | "GET";
+                    method: "GET" | "POST";
                     components: {
                         id: string;
                         type: string;
@@ -319,7 +319,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
             output: {
                 screen: {
                     action: string;
-                    method: "POST" | "GET";
+                    method: "GET" | "POST";
                     components: {
                         id: string;
                         type: string;

package/dist/types/routes/universal-login/sanitization-utils.d.ts

@@ -22,6 +22,13 @@ export declare function escapeCssUrl(url: string): string;
  * Sanitize URL for use in href/src attributes
  */
 export declare function sanitizeUrl(url: string | undefined): string;
+/**
+ * Validate a URL for a JSX link `href` and return it unescaped, since JSX
+ * escapes attribute values itself (running sanitizeUrl first double-escapes
+ * `&` in query strings). Only http(s) and same-origin paths are allowed —
+ * no `data:` here, as the result is a clickable link.
+ */
+export declare function safeLinkHref(url: string | undefined): string | undefined;
 /**
  * Sanitize CSS color value
  */

package/dist/types/routes/universal-login/screen-prompt-map.d.ts

@@ -0,0 +1,2 @@
+import type { PromptScreen } from "@authhero/adapter-interfaces";
+export declare function getPromptScreenForScreen(screenId: string): PromptScreen | undefined;

package/dist/types/routes/universal-login/screens/email-verification.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Email verification screens for logins blocked on an unverified email
+ * (client `email_validation: "enforced"`). Which one is shown follows the
+ * database connection's `attributes.email.verification_method`:
+ *
+ * - "code" (default): email-verification-code — enter the emailed code and
+ *   the same login session continues.
+ * - "link": email-verification-link-sent — the emailed link verifies the
+ *   address and returns the user to the login screen.
+ *
+ * Corresponds to: /u2/login/email-verification and
+ * /u2/login/email-verification-sent
+ */
+import type { ScreenContext, ScreenResult, ScreenDefinition } from "./types";
+import { LoginEmailVerification } from "../../../authentication-flows/email-verification";
+/**
+ * The verification options a u2 password login passes to `loginWithPassword`.
+ * The link method returns the user to this session's login screen.
+ */
+export declare function getLoginEmailVerification(context: ScreenContext): Promise<LoginEmailVerification>;
+/**
+ * The screen to show after a u2 password login threw EMAIL_NOT_VERIFIED. The
+ * verification email has already been sent by the password grant.
+ */
+export declare function emailVerificationRequiredScreen(context: ScreenContext, email: string | undefined): Promise<ScreenResult>;
+export declare function emailVerificationCodeScreen(context: ScreenContext): Promise<ScreenResult>;
+export declare function emailVerificationLinkSentScreen(context: ScreenContext): Promise<ScreenResult>;
+export declare const emailVerificationCodeScreenDefinition: ScreenDefinition;
+export declare const emailVerificationLinkSentScreenDefinition: ScreenDefinition;

package/dist/types/routes/universal-login/screens/handler-error.d.ts

@@ -0,0 +1,11 @@
+import type { UiScreen } from "@authhero/adapter-interfaces";
+/**
+ * Surface a screen handler's `error` as a screen-level message, unless the
+ * re-rendered screen already shows an error (on a field or at screen level).
+ *
+ * Handlers usually attach a localized message to the offending field, so
+ * adding `error` on top would show the same problem twice. The fallback only
+ * kicks in for handlers that return an error without rendering one, so the
+ * user isn't left with an unchanged screen and no explanation.
+ */
+export declare function withHandlerError(screen: UiScreen, error: string): UiScreen;

package/dist/types/routes/universal-login/screens/reset-password.d.ts

@@ -23,8 +23,12 @@ export declare function executePasswordReset(params: {
 }): Promise<{
     success: true;
 } | {
-    error: string;
+    error: "user_not_found" | "code_expired" | "reset_failed";
     field: "code" | "password";
+} | {
+    error: "password_policy";
+    field: "password";
+    policyError: unknown;
 }>;
 /**
  * Create the reset-password screen

package/dist/types/routes/universal-login/screens/signup.d.ts

@@ -3,7 +3,13 @@
  *
  * Corresponds to: /u/signup
  */
+import type { CustomText } from "@authhero/adapter-interfaces";
 import type { ScreenContext, ScreenResult, ScreenDefinition } from "./types";
+/**
+ * Translate a validatePasswordPolicy failure into a user-facing message.
+ * The PasswordPolicyError message itself is English-only.
+ */
+export declare function localizePasswordPolicyError(error: unknown, locale: string, customText?: CustomText): string;
 /**
  * Create the signup screen
  */

package/dist/types/routes/universal-login/u2-index.d.ts

@@ -165,7 +165,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         $get: {
             input: {
                 param: {
-                    screen: "login" | "impersonate" | "signup" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "enter-password" | "reset-password" | "impersonate" | "account" | "consent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -181,7 +181,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "login" | "impersonate" | "signup" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "enter-password" | "reset-password" | "impersonate" | "account" | "consent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -197,7 +197,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "login" | "impersonate" | "signup" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "enter-password" | "reset-password" | "impersonate" | "account" | "consent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -217,7 +217,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         $post: {
             input: {
                 param: {
-                    screen: "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "enter-password" | "reset-password" | "impersonate" | "consent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -235,7 +235,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "enter-password" | "reset-password" | "impersonate" | "consent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {

package/dist/types/routes/universal-login/u2-routes.d.ts

@@ -170,7 +170,7 @@ export declare const u2Routes: OpenAPIHono<{
         $get: {
             input: {
                 param: {
-                    screen: "login" | "impersonate" | "signup" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "enter-password" | "reset-password" | "impersonate" | "account" | "consent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -186,7 +186,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "login" | "impersonate" | "signup" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "enter-password" | "reset-password" | "impersonate" | "account" | "consent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -202,7 +202,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "login" | "impersonate" | "signup" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "enter-password" | "reset-password" | "impersonate" | "account" | "consent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -222,7 +222,7 @@ export declare const u2Routes: OpenAPIHono<{
         $post: {
             input: {
                 param: {
-                    screen: "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "enter-password" | "reset-password" | "impersonate" | "consent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -240,7 +240,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "enter-password" | "reset-password" | "impersonate" | "consent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {

package/dist/types/state-machines/login-session.d.ts

@@ -140,7 +140,7 @@ export declare const loginSessionMachine: import("xstate").StateMachine<LoginSes
 } | {
     type: "setFailureReason";
     params: import("xstate").NonReducibleUnknown;
-}, never, never, "pending" | "failed" | "expired" | "completed" | "authenticated" | "awaiting_email_verification" | "awaiting_mfa" | "awaiting_consent" | "awaiting_hook" | "awaiting_continuation", string, import("xstate").NonReducibleUnknown, import("xstate").NonReducibleUnknown, import("xstate").EventObject, import("xstate").MetaObject, {
+}, never, never, "pending" | "failed" | "expired" | "authenticated" | "awaiting_email_verification" | "awaiting_mfa" | "awaiting_consent" | "awaiting_hook" | "awaiting_continuation" | "completed", string, import("xstate").NonReducibleUnknown, import("xstate").NonReducibleUnknown, import("xstate").EventObject, import("xstate").MetaObject, {
     id: "loginSession";
     states: {
         readonly pending: {};

package/dist/types/types/AuthHeroConfig.d.ts

@@ -204,6 +204,11 @@ export type UserLinkingModeResolver = (params: {
     client_id?: string;
 }) => UserLinkingMode | Promise<UserLinkingMode>;
 export type UserLinkingModeOption = UserLinkingMode | UserLinkingModeResolver;
+/**
+ * Which action (code hook) console output is persisted to
+ * `action_executions.logs`. See `AuthHeroConfig.actionExecutionLogs`.
+ */
+export type ActionExecutionLogCapture = "full" | "errors" | "off";
 /**
  * Resolver for the per-tenant username/password provider value.
  *
@@ -728,6 +733,26 @@ export interface AuthHeroConfig {
      * @default false
      */
     rejectUnknownHosts?: boolean;
+    /**
+     * Controls which action (code hook) console output is persisted to
+     * `action_executions.logs`. Actions still capture and see their own
+     * console output while they run; only what is written to the database
+     * changes. The execution record itself (status, results) is always
+     * persisted.
+     *
+     * - `"full"`: persist console output for every action, subject to the
+     *   256-character budget per execution.
+     * - `"errors"`: persist console output only for actions that failed
+     *   (errored or denied access). Output from successful actions is dropped.
+     * - `"off"`: never persist console output.
+     *
+     * `credentials-exchange` runs on every token exchange, and console output
+     * often contains user PII, so `"errors"` or `"off"` is recommended for
+     * high-volume or privacy-sensitive deployments.
+     *
+     * @default "full"
+     */
+    actionExecutionLogs?: ActionExecutionLogCapture;
     /**
      * Relax the management API audience check from a hard 403 to a
      * `console.warn`. Tokens issued for any other audience will still be

package/dist/types/types/Bindings.d.ts

@@ -2,7 +2,7 @@ import type { SigningCertificateAuthority } from "../helpers/signing-certificate
 import { CodeExecutor, DataAdapters } from "@authhero/adapter-interfaces";
 import type { SamlSigner } from "@authhero/saml/core";
 import { Hooks } from "./Hooks";
-import { EntityHooksConfig, McpConfig, OutboxConfig, SigningKeyModeOption, TenantOperationExecutorBinding, UserLinkingModeOption, UsernamePasswordProviderResolver, WebhookInvoker } from "./AuthHeroConfig";
+import { ActionExecutionLogCapture, EntityHooksConfig, McpConfig, OutboxConfig, SigningKeyModeOption, TenantOperationExecutorBinding, UserLinkingModeOption, UsernamePasswordProviderResolver, WebhookInvoker } from "./AuthHeroConfig";
 import { StrategyHandler } from "../strategies";
 export type Bindings = {
     ENVIRONMENT: string;
@@ -11,6 +11,12 @@ export type Bindings = {
     UNIVERSAL_LOGIN_URL?: string;
     OAUTH_API_URL?: string;
     ENCRYPTION_KEY?: string;
+    /**
+     * @deprecated Read `ctx.var.data` instead. Holds the raw adapter passed in
+     * at startup until a route group composes its per-request stack, after
+     * which it is a compatibility alias for the same object as `ctx.var.data`.
+     * The alias will be removed in the next major release (#140).
+     */
     data: DataAdapters;
     hooks?: Hooks;
     /**
@@ -45,6 +51,7 @@ export type Bindings = {
     signingKeyMode?: SigningKeyModeOption;
     signingCertificateAuthority?: SigningCertificateAuthority;
     rejectUnknownHosts?: boolean;
+    actionExecutionLogs?: ActionExecutionLogCapture;
     mcp?: McpConfig;
     /**
      * Allow outbound fetches (jwks_uri, request_uri) to localhost / private IP

package/dist/types/types/Variables.d.ts

@@ -1,9 +1,26 @@
-import { LoginSession } from "@authhero/adapter-interfaces";
+import { DataAdapters, LoginSession } from "@authhero/adapter-interfaces";
 import { CountryCode } from "libphonenumber-js";
 import { Auth0Client } from "./Auth0Client";
 import type { PreferState } from "../middlewares/prefer";
 import type { EmbedLoginContext } from "../routes/universal-login/embed";
 export type Variables = {
+    /**
+     * The adapter stack for this request. Read this, not `ctx.env.data`.
+     *
+     * Route groups compose a per-request stack (`composeAuthData({ ctx, ... })`)
+     * that holds request-scoped state: the dedup map, the client-bundle promise
+     * and hooks bound to this `ctx`. It lives here rather than on `env` because
+     * Cloudflare Workers hand every request in an isolate the same `env`
+     * object, so a stack stored there leaks between concurrent requests (#140).
+     *
+     * Typed as required because `applyConfigMiddleware`, the first middleware
+     * of every route group, always sets it (to the startup adapter until a
+     * route group composes its own stack). Optional would force a guard on
+     * every read for a case that cannot happen behind that middleware; code
+     * mounted without it has to set the variable itself. Set it through
+     * `setRequestData` so the deprecated `ctx.env.data` alias stays in sync.
+     */
+    data: DataAdapters;
     tenant_id: string;
     ip: string;
     client_id?: string;