authhero 9.19.0 → 9.20.0

package/dist/types/routes/universal-login/flow-api.d.ts

@@ -27,7 +27,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
             output: {
                 screen: {
                     action: string;
-                    method: "POST" | "GET";
+                    method: "GET" | "POST";
                     components: {
                         id: string;
                         type: string;
@@ -43,7 +43,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                         hint?: string | undefined;
                         messages?: {
                             text: string;
-                            type: "success" | "error" | "info" | "warning";
+                            type: "error" | "success" | "info" | "warning";
                             id?: number | undefined;
                         }[] | undefined;
                     }[];
@@ -51,7 +51,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                     description?: string | undefined;
                     messages?: {
                         text: string;
-                        type: "success" | "error" | "info" | "warning";
+                        type: "error" | "success" | "info" | "warning";
                         id?: number | undefined;
                     }[] | undefined;
                     links?: {
@@ -107,7 +107,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
             output: {
                 screen: {
                     action: string;
-                    method: "POST" | "GET";
+                    method: "GET" | "POST";
                     components: {
                         id: string;
                         type: string;
@@ -123,7 +123,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                         hint?: string | undefined;
                         messages?: {
                             text: string;
-                            type: "success" | "error" | "info" | "warning";
+                            type: "error" | "success" | "info" | "warning";
                             id?: number | undefined;
                         }[] | undefined;
                     }[];
@@ -131,7 +131,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                     description?: string | undefined;
                     messages?: {
                         text: string;
-                        type: "success" | "error" | "info" | "warning";
+                        type: "error" | "success" | "info" | "warning";
                         id?: number | undefined;
                     }[] | undefined;
                     links?: {
@@ -204,7 +204,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
             output: {
                 screen: {
                     action: string;
-                    method: "POST" | "GET";
+                    method: "GET" | "POST";
                     components: {
                         id: string;
                         type: string;
@@ -220,7 +220,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                         hint?: string | undefined;
                         messages?: {
                             text: string;
-                            type: "success" | "error" | "info" | "warning";
+                            type: "error" | "success" | "info" | "warning";
                             id?: number | undefined;
                         }[] | undefined;
                     }[];
@@ -228,7 +228,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                     description?: string | undefined;
                     messages?: {
                         text: string;
-                        type: "success" | "error" | "info" | "warning";
+                        type: "error" | "success" | "info" | "warning";
                         id?: number | undefined;
                     }[] | undefined;
                     links?: {
@@ -319,7 +319,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
             output: {
                 screen: {
                     action: string;
-                    method: "POST" | "GET";
+                    method: "GET" | "POST";
                     components: {
                         id: string;
                         type: string;
@@ -335,7 +335,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                         hint?: string | undefined;
                         messages?: {
                             text: string;
-                            type: "success" | "error" | "info" | "warning";
+                            type: "error" | "success" | "info" | "warning";
                             id?: number | undefined;
                         }[] | undefined;
                     }[];
@@ -343,7 +343,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                     description?: string | undefined;
                     messages?: {
                         text: string;
-                        type: "success" | "error" | "info" | "warning";
+                        type: "error" | "success" | "info" | "warning";
                         id?: number | undefined;
                     }[] | undefined;
                     links?: {

package/dist/types/routes/universal-login/identifier.d.ts

@@ -30,7 +30,7 @@ export declare const identifierRoutes: OpenAPIHono<{
             } & {
                 form: {
                     username: string;
-                    login_selection?: "password" | "code" | undefined;
+                    login_selection?: "code" | "password" | undefined;
                 };
             };
             output: {};
@@ -44,7 +44,7 @@ export declare const identifierRoutes: OpenAPIHono<{
             } & {
                 form: {
                     username: string;
-                    login_selection?: "password" | "code" | undefined;
+                    login_selection?: "code" | "password" | undefined;
                 };
             };
             output: {};

package/dist/types/routes/universal-login/index.d.ts

@@ -515,7 +515,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
             } & {
                 form: {
                     username: string;
-                    login_selection?: "password" | "code" | undefined;
+                    login_selection?: "code" | "password" | undefined;
                 };
             };
             output: {};
@@ -529,7 +529,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
             } & {
                 form: {
                     username: string;
-                    login_selection?: "password" | "code" | undefined;
+                    login_selection?: "code" | "password" | undefined;
                 };
             };
             output: {};

package/dist/types/routes/universal-login/sanitization-utils.d.ts

@@ -22,6 +22,13 @@ export declare function escapeCssUrl(url: string): string;
  * Sanitize URL for use in href/src attributes
  */
 export declare function sanitizeUrl(url: string | undefined): string;
+/**
+ * Validate a URL for a JSX link `href` and return it unescaped, since JSX
+ * escapes attribute values itself (running sanitizeUrl first double-escapes
+ * `&` in query strings). Only http(s) and same-origin paths are allowed —
+ * no `data:` here, as the result is a clickable link.
+ */
+export declare function safeLinkHref(url: string | undefined): string | undefined;
 /**
  * Sanitize CSS color value
  */

package/dist/types/routes/universal-login/screen-prompt-map.d.ts

@@ -0,0 +1,2 @@
+import type { PromptScreen } from "@authhero/adapter-interfaces";
+export declare function getPromptScreenForScreen(screenId: string): PromptScreen | undefined;

package/dist/types/routes/universal-login/screens/email-verification.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Email verification screens for logins blocked on an unverified email
+ * (client `email_validation: "enforced"`). Which one is shown follows the
+ * database connection's `attributes.email.verification_method`:
+ *
+ * - "code" (default): email-verification-code — enter the emailed code and
+ *   the same login session continues.
+ * - "link": email-verification-link-sent — the emailed link verifies the
+ *   address and returns the user to the login screen.
+ *
+ * Corresponds to: /u2/login/email-verification and
+ * /u2/login/email-verification-sent
+ */
+import type { ScreenContext, ScreenResult, ScreenDefinition } from "./types";
+import { LoginEmailVerification } from "../../../authentication-flows/email-verification";
+/**
+ * The verification options a u2 password login passes to `loginWithPassword`.
+ * The link method returns the user to this session's login screen.
+ */
+export declare function getLoginEmailVerification(context: ScreenContext): Promise<LoginEmailVerification>;
+/**
+ * The screen to show after a u2 password login threw EMAIL_NOT_VERIFIED. The
+ * verification email has already been sent by the password grant.
+ */
+export declare function emailVerificationRequiredScreen(context: ScreenContext, email: string | undefined): Promise<ScreenResult>;
+export declare function emailVerificationCodeScreen(context: ScreenContext): Promise<ScreenResult>;
+export declare function emailVerificationLinkSentScreen(context: ScreenContext): Promise<ScreenResult>;
+export declare const emailVerificationCodeScreenDefinition: ScreenDefinition;
+export declare const emailVerificationLinkSentScreenDefinition: ScreenDefinition;

package/dist/types/routes/universal-login/screens/handler-error.d.ts

@@ -0,0 +1,11 @@
+import type { UiScreen } from "@authhero/adapter-interfaces";
+/**
+ * Surface a screen handler's `error` as a screen-level message, unless the
+ * re-rendered screen already shows an error (on a field or at screen level).
+ *
+ * Handlers usually attach a localized message to the offending field, so
+ * adding `error` on top would show the same problem twice. The fallback only
+ * kicks in for handlers that return an error without rendering one, so the
+ * user isn't left with an unchanged screen and no explanation.
+ */
+export declare function withHandlerError(screen: UiScreen, error: string): UiScreen;

package/dist/types/routes/universal-login/screens/reset-password.d.ts

@@ -23,8 +23,12 @@ export declare function executePasswordReset(params: {
 }): Promise<{
     success: true;
 } | {
-    error: string;
+    error: "user_not_found" | "code_expired" | "reset_failed";
     field: "code" | "password";
+} | {
+    error: "password_policy";
+    field: "password";
+    policyError: unknown;
 }>;
 /**
  * Create the reset-password screen

package/dist/types/routes/universal-login/screens/signup.d.ts

@@ -3,7 +3,13 @@
  *
  * Corresponds to: /u/signup
  */
+import type { CustomText } from "@authhero/adapter-interfaces";
 import type { ScreenContext, ScreenResult, ScreenDefinition } from "./types";
+/**
+ * Translate a validatePasswordPolicy failure into a user-facing message.
+ * The PasswordPolicyError message itself is English-only.
+ */
+export declare function localizePasswordPolicyError(error: unknown, locale: string, customText?: CustomText): string;
 /**
  * Create the signup screen
  */

package/dist/types/routes/universal-login/u2-index.d.ts

@@ -165,7 +165,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         $get: {
             input: {
                 param: {
-                    screen: "impersonate" | "signup" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "enter-password" | "reset-password" | "impersonate" | "account" | "consent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -181,7 +181,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "impersonate" | "signup" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "enter-password" | "reset-password" | "impersonate" | "account" | "consent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -197,7 +197,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "impersonate" | "signup" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "enter-password" | "reset-password" | "impersonate" | "account" | "consent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -217,7 +217,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         $post: {
             input: {
                 param: {
-                    screen: "impersonate" | "signup" | "consent" | "login" | "reset-password" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "enter-password" | "reset-password" | "impersonate" | "consent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -235,7 +235,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "impersonate" | "signup" | "consent" | "login" | "reset-password" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "enter-password" | "reset-password" | "impersonate" | "consent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {

package/dist/types/routes/universal-login/u2-routes.d.ts

@@ -170,7 +170,7 @@ export declare const u2Routes: OpenAPIHono<{
         $get: {
             input: {
                 param: {
-                    screen: "impersonate" | "signup" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "enter-password" | "reset-password" | "impersonate" | "account" | "consent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -186,7 +186,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "impersonate" | "signup" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "enter-password" | "reset-password" | "impersonate" | "account" | "consent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -202,7 +202,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "impersonate" | "signup" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "enter-password" | "reset-password" | "impersonate" | "account" | "consent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -222,7 +222,7 @@ export declare const u2Routes: OpenAPIHono<{
         $post: {
             input: {
                 param: {
-                    screen: "impersonate" | "signup" | "consent" | "login" | "reset-password" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "enter-password" | "reset-password" | "impersonate" | "consent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -240,7 +240,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "impersonate" | "signup" | "consent" | "login" | "reset-password" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "enter-password" | "reset-password" | "impersonate" | "consent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {

package/dist/types/types/AuthHeroConfig.d.ts

@@ -204,6 +204,11 @@ export type UserLinkingModeResolver = (params: {
     client_id?: string;
 }) => UserLinkingMode | Promise<UserLinkingMode>;
 export type UserLinkingModeOption = UserLinkingMode | UserLinkingModeResolver;
+/**
+ * Which action (code hook) console output is persisted to
+ * `action_executions.logs`. See `AuthHeroConfig.actionExecutionLogs`.
+ */
+export type ActionExecutionLogCapture = "full" | "errors" | "off";
 /**
  * Resolver for the per-tenant username/password provider value.
  *
@@ -728,6 +733,26 @@ export interface AuthHeroConfig {
      * @default false
      */
     rejectUnknownHosts?: boolean;
+    /**
+     * Controls which action (code hook) console output is persisted to
+     * `action_executions.logs`. Actions still capture and see their own
+     * console output while they run; only what is written to the database
+     * changes. The execution record itself (status, results) is always
+     * persisted.
+     *
+     * - `"full"`: persist console output for every action, subject to the
+     *   256-character budget per execution.
+     * - `"errors"`: persist console output only for actions that failed
+     *   (errored or denied access). Output from successful actions is dropped.
+     * - `"off"`: never persist console output.
+     *
+     * `credentials-exchange` runs on every token exchange, and console output
+     * often contains user PII, so `"errors"` or `"off"` is recommended for
+     * high-volume or privacy-sensitive deployments.
+     *
+     * @default "full"
+     */
+    actionExecutionLogs?: ActionExecutionLogCapture;
     /**
      * Relax the management API audience check from a hard 403 to a
      * `console.warn`. Tokens issued for any other audience will still be

package/dist/types/types/Bindings.d.ts

@@ -2,7 +2,7 @@ import type { SigningCertificateAuthority } from "../helpers/signing-certificate
 import { CodeExecutor, DataAdapters } from "@authhero/adapter-interfaces";
 import type { SamlSigner } from "@authhero/saml/core";
 import { Hooks } from "./Hooks";
-import { EntityHooksConfig, McpConfig, OutboxConfig, SigningKeyModeOption, TenantOperationExecutorBinding, UserLinkingModeOption, UsernamePasswordProviderResolver, WebhookInvoker } from "./AuthHeroConfig";
+import { ActionExecutionLogCapture, EntityHooksConfig, McpConfig, OutboxConfig, SigningKeyModeOption, TenantOperationExecutorBinding, UserLinkingModeOption, UsernamePasswordProviderResolver, WebhookInvoker } from "./AuthHeroConfig";
 import { StrategyHandler } from "../strategies";
 export type Bindings = {
     ENVIRONMENT: string;
@@ -11,6 +11,12 @@ export type Bindings = {
     UNIVERSAL_LOGIN_URL?: string;
     OAUTH_API_URL?: string;
     ENCRYPTION_KEY?: string;
+    /**
+     * @deprecated Read `ctx.var.data` instead. Holds the raw adapter passed in
+     * at startup until a route group composes its per-request stack, after
+     * which it is a compatibility alias for the same object as `ctx.var.data`.
+     * The alias will be removed in the next major release (#140).
+     */
     data: DataAdapters;
     hooks?: Hooks;
     /**
@@ -45,6 +51,7 @@ export type Bindings = {
     signingKeyMode?: SigningKeyModeOption;
     signingCertificateAuthority?: SigningCertificateAuthority;
     rejectUnknownHosts?: boolean;
+    actionExecutionLogs?: ActionExecutionLogCapture;
     mcp?: McpConfig;
     /**
      * Allow outbound fetches (jwks_uri, request_uri) to localhost / private IP

package/dist/types/types/Variables.d.ts

@@ -1,9 +1,26 @@
-import { LoginSession } from "@authhero/adapter-interfaces";
+import { DataAdapters, LoginSession } from "@authhero/adapter-interfaces";
 import { CountryCode } from "libphonenumber-js";
 import { Auth0Client } from "./Auth0Client";
 import type { PreferState } from "../middlewares/prefer";
 import type { EmbedLoginContext } from "../routes/universal-login/embed";
 export type Variables = {
+    /**
+     * The adapter stack for this request. Read this, not `ctx.env.data`.
+     *
+     * Route groups compose a per-request stack (`composeAuthData({ ctx, ... })`)
+     * that holds request-scoped state: the dedup map, the client-bundle promise
+     * and hooks bound to this `ctx`. It lives here rather than on `env` because
+     * Cloudflare Workers hand every request in an isolate the same `env`
+     * object, so a stack stored there leaks between concurrent requests (#140).
+     *
+     * Typed as required because `applyConfigMiddleware`, the first middleware
+     * of every route group, always sets it (to the startup adapter until a
+     * route group composes its own stack). Optional would force a guard on
+     * every read for a case that cannot happen behind that middleware; code
+     * mounted without it has to set the variable itself. Set it through
+     * `setRequestData` so the deprecated `ctx.env.data` alias stays in sync.
+     */
+    data: DataAdapters;
     tenant_id: string;
     ip: string;
     client_id?: string;

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/markusahlstrand/authhero"
   },
-  "version": "9.19.0",
+  "version": "9.20.0",
   "files": [
     "dist"
   ],
@@ -63,8 +63,8 @@
     "vite": "^8.0.14",
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^4.1.7",
-    "@authhero/kysely-adapter": "12.11.1",
-    "@authhero/widget": "0.40.1"
+    "@authhero/kysely-adapter": "12.12.0",
+    "@authhero/widget": "0.40.2"
   },
   "dependencies": {
     "@peculiar/x509": "^1.14.3",
@@ -80,9 +80,9 @@
     "qrcode": "^1.5.4",
     "sanitize-html": "^2.17.4",
     "xstate": "^5.31.1",
-    "@authhero/adapter-interfaces": "4.17.0",
-    "@authhero/proxy": "0.11.3",
-    "@authhero/saml": "0.5.15"
+    "@authhero/adapter-interfaces": "4.18.0",
+    "@authhero/proxy": "0.11.4",
+    "@authhero/saml": "0.5.16"
   },
   "peerDependencies": {
     "@authhero/widget": "^0.1.0",