authhero 9.19.0 → 9.21.0

package/dist/types/authentication-flows/auth0-migration.d.ts

@@ -43,8 +43,8 @@ interface AttemptUpstreamPasswordParams {
  * via the password-realm grant. On success, creates the local user (if
  * missing), stores the bcrypt hash of the password locally, and returns the
  * user. On any failure, returns null — the caller surfaces the existing
- * INVALID_PASSWORD/USER_NOT_FOUND error so the upstream's existence is not
- * leaked to clients.
+ * INVALID_CREDENTIALS error so the upstream's existence is not leaked to
+ * clients.
  *
  * Subsequent logins are served entirely locally because the password row now
  * exists on our side.

package/dist/types/authentication-flows/email-verification.d.ts

@@ -0,0 +1,74 @@
+import { Context } from "hono";
+import { LoginSession, User } from "@authhero/adapter-interfaces";
+import { Bindings, Variables } from "../types";
+import { EnrichedClient } from "../helpers/client";
+export type EmailVerificationMethod = "link" | "code";
+/**
+ * How a login that is blocked on an unverified email (client
+ * `email_validation: "enforced"`) should verify it. UI flows pass this to
+ * `passwordGrant`; without it the grant falls back to emailing a link and
+ * failing the login session (token endpoint, legacy /u routes).
+ */
+export interface LoginEmailVerification {
+    method: EmailVerificationMethod;
+    /** Link method only: where the emailed link returns the user. */
+    resultUrl?: string;
+}
+export interface PendingLoginEmailVerification {
+    /** The password-validated identity whose email must be verified. */
+    user_id: string;
+    /** The connection the password login targeted. */
+    connection: string;
+}
+/**
+ * The pending verification of a still-pending login session, or undefined
+ * when no password has been validated for it.
+ */
+export declare function getPendingLoginEmailVerification(loginSession: LoginSession): PendingLoginEmailVerification | undefined;
+/**
+ * Record (or with `undefined`, clear) the pending verification on the login
+ * session. Re-reads the session so other `state_data` keys aren't clobbered.
+ */
+export declare function setPendingLoginEmailVerification(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, tenantId: string, loginSessionId: string, pending: PendingLoginEmailVerification | undefined): Promise<void>;
+/**
+ * The database connection's `attributes.email.verification_method`. Defaults
+ * to "code" like the u2 password reset, so the user stays on the login page
+ * instead of depending on an emailed link.
+ */
+export declare function getEmailVerificationMethod(client: EnrichedClient): EmailVerificationMethod;
+/**
+ * Mint a one-time code bound to the login session and email it. The code is
+ * only issued after the password has been validated, so redeeming it proves
+ * both factors and lets the same login session complete.
+ */
+export declare function sendLoginEmailVerificationCode(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, params: {
+    client: EnrichedClient;
+    user: User;
+    loginSession: LoginSession;
+    connection: string;
+    language?: string;
+}): Promise<void>;
+export type VerifyLoginEmailCodeResult = {
+    ok: true;
+    /** The primary user to complete the login as. */
+    user: User;
+    /** The connection the password login targeted. */
+    connection: string;
+} | {
+    ok: false;
+    reason: "invalid" | "rate_limited";
+};
+/**
+ * Redeem a login email-verification code: marks the verified identity's
+ * email as verified and returns the user to complete the login with.
+ */
+export declare function verifyLoginEmailCode(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, client: EnrichedClient, loginSession: LoginSession, code: string): Promise<VerifyLoginEmailCodeResult>;

package/dist/types/authentication-flows/password.d.ts

@@ -2,6 +2,7 @@ import { Context } from "hono";
 import { AuthParams, LoginSession, User } from "@authhero/adapter-interfaces";
 import { EnrichedClient } from "../helpers/client";
 import { Bindings, GrantFlowUserResult, Variables } from "../types";
+import { LoginEmailVerification } from "./email-verification";
 /**
  * Clear the failed-login counter for a user. Failed logins are always
  * recorded on the primary account (see {@link recordFailedLogin}), so this
@@ -23,13 +24,13 @@ export declare function passwordGrant(ctx: Context<{
     Variables: Variables;
 }>, client: EnrichedClient, authParams: AuthParams & {
     password: string;
-}, loginSession?: LoginSession, realm?: string): Promise<GrantFlowUserResult>;
+}, loginSession?: LoginSession, realm?: string, emailVerification?: LoginEmailVerification): Promise<GrantFlowUserResult>;
 export declare function loginWithPassword(ctx: Context<{
     Bindings: Bindings;
     Variables: Variables;
 }>, client: EnrichedClient, authParams: AuthParams & {
     password: string;
-}, loginSession?: LoginSession, ticketAuth?: boolean, realm?: string): Promise<Response>;
+}, loginSession?: LoginSession, ticketAuth?: boolean, realm?: string, emailVerification?: LoginEmailVerification): Promise<Response>;
 export declare function changePassword(ctx: Context<{
     Bindings: Bindings;
     Variables: Variables;

package/dist/types/authentication-flows/passwordless.d.ts

@@ -475,7 +475,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
         custom_login_page_preview?: string | undefined;
         form_template?: string | undefined;
         addons?: Record<string, any> | undefined;
-        token_endpoint_auth_method?: "none" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | "private_key_jwt" | undefined;
+        token_endpoint_auth_method?: "client_secret_post" | "client_secret_basic" | "none" | "client_secret_jwt" | "private_key_jwt" | undefined;
         client_metadata?: Record<string, string> | undefined;
         hide_sign_up_disabled_error?: boolean | undefined;
         mobile?: Record<string, any> | undefined;
@@ -561,8 +561,8 @@ export declare function passwordlessGrantUser(ctx: Context<{
         } | undefined;
         authenticated_at?: string | undefined;
     };
-    connectionType: "username" | "email" | "sms";
-    authConnection: "username" | "email" | "sms";
+    connectionType: "email" | "username" | "sms";
+    authConnection: "email" | "username" | "sms";
     session_id: string | undefined;
     authParams: {
         audience?: string | undefined;

package/dist/types/emails/index.d.ts

@@ -45,10 +45,36 @@ export declare function sendLink(ctx: Context<{
     Bindings: Bindings;
     Variables: Variables;
 }>, { to, code, authParams, language }: SendLinkParams): Promise<void>;
+/**
+ * Where the verification landing page's "Continue" button should lead. Stored
+ * on the ticket so the page can send the user back to the app that triggered
+ * the email — it never resumes the original login session.
+ */
+export type EmailVerificationReturnTo = {
+    client_id?: string;
+    redirect_uri?: string;
+};
+export interface SendValidateEmailAddressOptions extends EmailVerificationReturnTo {
+    /**
+     * Where the ticket endpoint redirects after verifying. Set by the login
+     * flow so the link lands the user back on the login screen of the session
+     * that asked for verification instead of the landing page.
+     */
+    resultUrl?: string;
+}
 export declare function sendValidateEmailAddress(ctx: Context<{
     Bindings: Bindings;
     Variables: Variables;
-}>, user: User, language?: string): Promise<void>;
+}>, user: User, language?: string, { resultUrl, client_id, redirect_uri }?: SendValidateEmailAddressOptions): Promise<void>;
+/**
+ * Email a one-time code that verifies the user's email address. Used by the
+ * login flow when the database connection's `verification_method` is "code";
+ * the code is entered on the u2 email-verification screen.
+ */
+export declare function sendEmailVerificationCode(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, user: User, code: string, language?: string): Promise<void>;
 export declare function sendSignupValidateEmailAddress(ctx: Context<{
     Bindings: Bindings;
     Variables: Variables;

package/dist/types/generated/locale-types.d.ts

@@ -2,6 +2,7 @@ export type Locale = "cs" | "da" | "en" | "fi" | "it" | "nb" | "pl" | "sv";
 export interface CommonScreen {
     alertListTitle: () => string;
     backText: () => string;
+    backToLoginText: () => string;
     cancelText: () => string;
     closeText: () => string;
     contactSupportText: () => string;
@@ -20,6 +21,162 @@ export interface CommonScreen {
     termsShortText: () => string;
     tryAgainText: () => string;
 }
+export interface CommonAccountScreen {
+    title: () => string;
+    description: () => string;
+    editProfileLabel: () => string;
+    editProfileDetail: () => string;
+    securityLabel: () => string;
+    securityDetail: () => string;
+    securityMethodsCountOne: (vars: {
+        count: string;
+    }) => string;
+    securityMethodsCount: (vars: {
+        count: string;
+    }) => string;
+    passkeysLabel: () => string;
+    passkeysDetail: () => string;
+    passkeysCountOne: (vars: {
+        count: string;
+    }) => string;
+    passkeysCount: (vars: {
+        count: string;
+    }) => string;
+    linkedAccountsLabel: () => string;
+    linkedAccountsDetail: () => string;
+    linkedAccountsCountOne: (vars: {
+        count: string;
+    }) => string;
+    linkedAccountsCount: (vars: {
+        count: string;
+    }) => string;
+    deleteAccountLabel: () => string;
+    deleteAccountDetail: () => string;
+    logoutText: () => string;
+}
+export interface CommonAccountProfileScreen {
+    title: () => string;
+    description: () => string;
+    givenNameLabel: () => string;
+    familyNameLabel: () => string;
+    nicknameLabel: () => string;
+    phoneNumberLabel: () => string;
+    pictureLabel: () => string;
+    buttonText: () => string;
+    backToAccountText: () => string;
+    updateFailed: () => string;
+}
+export interface CommonAccountDeleteScreen {
+    title: () => string;
+    description: () => string;
+    warningTitle: () => string;
+    warningText: () => string;
+    confirmationLabel: (vars: {
+        confirmationWord: string;
+    }) => string;
+    buttonText: () => string;
+    cancelText: () => string;
+    confirmationError: (vars: {
+        confirmationWord: string;
+    }) => string;
+    deleteSuccess: () => string;
+    deleteFailed: () => string;
+}
+export interface CommonAccountLinkedScreen {
+    title: () => string;
+    description: () => string;
+    noLinkedAccounts: () => string;
+    unlinkButtonText: () => string;
+    backToAccountText: () => string;
+    unlinkSuccess: () => string;
+    unlinkFailed: () => string;
+}
+export interface CommonAccountSecurityScreen {
+    title: () => string;
+    description: () => string;
+    noEnrollments: () => string;
+    addedOn: (vars: {
+        date: string;
+    }) => string;
+    removeButtonText: () => string;
+    addTotpLabel: () => string;
+    addTotpDetail: () => string;
+    addSmsLabel: () => string;
+    addSmsDetail: () => string;
+    typeTotp: () => string;
+    typePhone: () => string;
+    typeEmail: () => string;
+    typePush: () => string;
+    typeWebauthn: () => string;
+    backToAccountText: () => string;
+    enrollmentNotFound: () => string;
+    removeSuccess: () => string;
+    removeFailed: () => string;
+}
+export interface CommonAccountPasskeysScreen {
+    title: () => string;
+    description: () => string;
+    noPasskeysText: () => string;
+    defaultPasskeyName: () => string;
+    syncedBadgeText: () => string;
+    addedOnText: (vars: {
+        date: string;
+    }) => string;
+    renameButtonText: () => string;
+    removeButtonText: () => string;
+    renamePromptText: () => string;
+    addPasskeyButtonText: () => string;
+    backToAccountText: () => string;
+    logoutText: () => string;
+    passkeyNotFoundText: () => string;
+    passkeyRemovedText: () => string;
+    removeFailedText: () => string;
+    invalidNameText: () => string;
+    passkeyRenamedText: () => string;
+    renameFailedText: () => string;
+    startRegistrationFailedText: () => string;
+    missingCredentialText: () => string;
+    challengeExpiredText: () => string;
+    invalidCredentialText: () => string;
+    verificationFailedText: () => string;
+    passkeyAddedText: () => string;
+    registrationFailedText: () => string;
+}
+export interface CommonAccountMfaPhoneEnrollmentScreen {
+    title: () => string;
+    description: () => string;
+    phoneLabel: () => string;
+    sendCodeButtonText: () => string;
+    backToSecurityText: () => string;
+    verifyTitle: () => string;
+    verifyDescription: () => string;
+    codeSentText: (vars: {
+        phoneNumber: string;
+    }) => string;
+    codeSentToYourPhoneText: () => string;
+    codeLabel: () => string;
+    codePlaceholder: () => string;
+    verifyButtonText: () => string;
+    noPhoneText: () => string;
+    invalidPhoneText: () => string;
+    sendCodeFailedText: () => string;
+    noCodeText: () => string;
+    invalidCodeText: () => string;
+    sessionInvalidText: () => string;
+}
+export interface CommonAccountMfaTotpEnrollmentScreen {
+    title: () => string;
+    description: () => string;
+    qrCodeAltText: () => string;
+    manualKeyText: () => string;
+    codeLabel: () => string;
+    codePlaceholder: () => string;
+    verifyButtonText: () => string;
+    backToSecurityText: () => string;
+    noCodeText: () => string;
+    invalidCodeText: () => string;
+    verificationFailedText: () => string;
+}
 export interface ConsentScreen {
     buttonText: () => string;
     cancelButtonText: () => string;
@@ -35,6 +192,51 @@ export interface ConsentScreen {
     title: (vars: {
         clientName: string;
     }) => string;
+    accessAccountText: (vars: {
+        tenantName: string;
+        userName: string;
+    }) => string;
+    notAuthenticated: () => string;
+    sessionExpired: () => string;
+    consentStorageNotConfigured: () => string;
+}
+export interface ConsentConnectConsentScreen {
+    title: () => string;
+    description: (vars: {
+        domain: string;
+    }) => string;
+    connectAccountText: (vars: {
+        tenantName: string;
+        userName: string;
+    }) => string;
+    workspaceLabel: () => string;
+    apiLabel: () => string;
+    permissionsLabel: () => string;
+    localDevBadge: () => string;
+    localDevTooltip: () => string;
+    buttonText: () => string;
+    cancelText: () => string;
+    notAuthenticated: () => string;
+    sessionExpired: () => string;
+    workspaceSelectionRequired: () => string;
+    noWorkspaceAccess: () => string;
+    workspaceNotFound: () => string;
+}
+export interface ConsentConnectTenantSelectScreen {
+    title: () => string;
+    description: (vars: {
+        domain: string;
+        tenantName: string;
+    }) => string;
+    noWorkspacesDescription: () => string;
+    noWorkspacesText: (vars: {
+        tenantName: string;
+    }) => string;
+    cancelText: () => string;
+    notAuthenticated: () => string;
+    sessionExpired: () => string;
+    noWorkspaceSelected: () => string;
+    noWorkspaceAccess: () => string;
 }
 export interface DeviceFlowScreen {
     buttonText: () => string;
@@ -65,11 +267,17 @@ export interface EmailOtpChallengeScreen {
     title: () => string;
     unexpectedError: () => string;
     usePasswordText: () => string;
+    tooManyRequests: () => string;
 }
 export interface EmailVerificationScreen {
     description: (vars: {
         email: string;
     }) => string;
+    linkAlreadyUsed: () => string;
+    linkInvalid: () => string;
+    linkInvalidOrExpired: () => string;
+    linkInvalidTitle: () => string;
+    linkWrongType: () => string;
     pageTitle: (vars: {
         clientName: string;
     }) => string;
@@ -78,6 +286,39 @@ export interface EmailVerificationScreen {
     successTitle: () => string;
     title: () => string;
 }
+export interface EmailVerificationEmailVerificationCodeScreen {
+    buttonText: () => string;
+    codeLabel: () => string;
+    codePlaceholder: () => string;
+    defaultDescription: () => string;
+    description: (vars: {
+        email: string;
+    }) => string;
+    invalidCode: () => string;
+    noCode: () => string;
+    pageTitle: (vars: {
+        clientName: string;
+    }) => string;
+    resendFailed: () => string;
+    resendSuccess: () => string;
+    resendText: () => string;
+    sessionExpired: () => string;
+    title: () => string;
+    tooManyAttempts: () => string;
+}
+export interface EmailVerificationEmailVerificationLinkSentScreen {
+    defaultDescription: () => string;
+    description: (vars: {
+        email: string;
+    }) => string;
+    pageTitle: (vars: {
+        clientName: string;
+    }) => string;
+    resendFailed: () => string;
+    resendSuccess: () => string;
+    resendText: () => string;
+    title: () => string;
+}
 export interface InvitationScreen {
     acceptButtonText: () => string;
     description: (vars: {
@@ -89,6 +330,8 @@ export interface InvitationScreen {
         clientName: string;
     }) => string;
     title: () => string;
+    defaultOrganizationName: () => string;
+    acceptFailed: () => string;
 }
 export interface LoginScreen {
     alertListTitle: () => string;
@@ -145,6 +388,9 @@ export interface LoginScreen {
     }) => string;
     passkeyButtonText: () => string;
     wrongCredentials: () => string;
+    userBlocked: () => string;
+    tooManyRequests: () => string;
+    unexpectedError: () => string;
 }
 export interface LoginIdScreen {
     alertListTitle: () => string;
@@ -272,6 +518,9 @@ export interface LoginPasswordScreen {
     "user-blocked": () => string;
     "wrong-credentials": () => string;
     sendCodeText: () => string;
+    sessionExpired: () => string;
+    tooManyRequests: () => string;
+    unexpectedError: () => string;
 }
 export interface LoginPasswordlessScreen {
     authMethodEmail: () => string;
@@ -345,6 +594,8 @@ export interface MfaOtpMfaTotpEnrollmentScreen {
         clientName: string;
     }) => string;
     enrollmentComplete: () => string;
+    pickAuthenticatorText: () => string;
+    qrCodeAltText: () => string;
 }
 export interface MfaOtpMfaTotpChallengeScreen {
     title: () => string;
@@ -494,6 +745,9 @@ export interface PasskeysPasskeyEnrollmentScreen {
     pageTitle: (vars: {
         clientName: string;
     }) => string;
+    sessionExpired: () => string;
+    enrollmentRequired: () => string;
+    challengeExpired: () => string;
 }
 export interface PasskeysPasskeyChallengeScreen {
     title: () => string;
@@ -504,6 +758,7 @@ export interface PasskeysPasskeyChallengeScreen {
     pageTitle: (vars: {
         clientName: string;
     }) => string;
+    sessionExpired: () => string;
 }
 export interface OrganizationsScreen {
     description: () => string;
@@ -535,6 +790,8 @@ export interface ResetPasswordScreen {
     successTitle: () => string;
     title: () => string;
     "user-not-found": () => string;
+    noPassword: () => string;
+    sessionExpired: () => string;
 }
 export interface ResetPasswordResetPasswordCodeScreen {
     backToLoginText: () => string;
@@ -562,6 +819,7 @@ export interface ResetPasswordResetPasswordCodeScreen {
     resendText: () => string;
     sessionExpired: () => string;
     title: () => string;
+    noPassword: () => string;
 }
 export interface SignupScreen {
     buttonText: () => string;
@@ -595,6 +853,8 @@ export interface SignupScreen {
     "username-already-exists": () => string;
     usernamePlaceholder: () => string;
     verifyEmailText: () => string;
+    confirmPasswordRequired: () => string;
+    createUserFailed: () => string;
 }
 export interface SignupIdScreen {
     buttonText: () => string;
@@ -629,6 +889,16 @@ export interface SignupPasswordScreen {
     passwordPlaceholder: () => string;
     showPasswordText: () => string;
     title: () => string;
+    passwordTooShort: (vars: {
+        minLength: string;
+    }) => string;
+    passwordMissingLowercase: () => string;
+    passwordMissingUppercase: () => string;
+    passwordMissingNumber: () => string;
+    passwordMissingSpecial: () => string;
+    passwordReused: () => string;
+    passwordContainsPersonalInfo: () => string;
+    passwordContainsForbiddenWord: () => string;
 }
 export interface SmsOtpChallengeScreen {
     buttonText: () => string;
@@ -647,6 +917,7 @@ export interface SmsOtpChallengeScreen {
     sessionExpired: () => string;
     title: () => string;
     unexpectedError: () => string;
+    tooManyRequests: () => string;
 }
 export interface StatusScreen {
     continueButtonText: () => string;
@@ -659,10 +930,22 @@ export interface StatusScreen {
 }
 export interface ScreenMap {
     "common.common": CommonScreen;
+    "common.account": CommonAccountScreen;
+    "common.account-profile": CommonAccountProfileScreen;
+    "common.account-delete": CommonAccountDeleteScreen;
+    "common.account-linked": CommonAccountLinkedScreen;
+    "common.account-security": CommonAccountSecurityScreen;
+    "common.account-passkeys": CommonAccountPasskeysScreen;
+    "common.account-mfa-phone-enrollment": CommonAccountMfaPhoneEnrollmentScreen;
+    "common.account-mfa-totp-enrollment": CommonAccountMfaTotpEnrollmentScreen;
     "consent.consent": ConsentScreen;
+    "consent.connect-consent": ConsentConnectConsentScreen;
+    "consent.connect-tenant-select": ConsentConnectTenantSelectScreen;
     "device-flow.device-flow": DeviceFlowScreen;
     "email-otp-challenge.email-otp-challenge": EmailOtpChallengeScreen;
     "email-verification.email-verification": EmailVerificationScreen;
+    "email-verification.email-verification-code": EmailVerificationEmailVerificationCodeScreen;
+    "email-verification.email-verification-link-sent": EmailVerificationEmailVerificationLinkSentScreen;
     "invitation.invitation": InvitationScreen;
     "login.login": LoginScreen;
     "login-id.login-id": LoginIdScreen;

package/dist/types/helpers/dcr/metadata-mapping.d.ts

@@ -24,10 +24,10 @@ export declare const dcrRequestSchema: z.ZodObject<{
     response_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
     token_endpoint_auth_method: z.ZodOptional<z.ZodEnum<{
         none: "none";
+        private_key_jwt: "private_key_jwt";
         client_secret_post: "client_secret_post";
         client_secret_basic: "client_secret_basic";
         client_secret_jwt: "client_secret_jwt";
-        private_key_jwt: "private_key_jwt";
     }>>;
     jwks_uri: z.ZodOptional<z.ZodString>;
     jwks: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;

package/dist/types/helpers/default-destinations.d.ts

@@ -1,7 +1,7 @@
 import { CodeExecutor, DataAdapters } from "@authhero/adapter-interfaces";
 import { EventDestination } from "./outbox-relay";
 import { type GetServiceToken } from "./outbox-destinations/webhooks";
-import type { OutboxPipelineConfig, WebhookInvoker } from "../types/AuthHeroConfig";
+import type { ActionExecutionLogCapture, OutboxPipelineConfig, WebhookInvoker } from "../types/AuthHeroConfig";
 export interface CreateDefaultDestinationsConfig {
     /**
      * Data adapter — the `logs`, `hooks`, `users`, and `logStreams` adapters are
@@ -47,6 +47,12 @@ export interface CreateDefaultDestinationsConfig {
      * failed per-request delivery would be silently skipped on retry.
      */
     codeExecutor?: CodeExecutor;
+    /**
+     * Same value as `init({ actionExecutionLogs })`. Controls which console
+     * output cron-drained code hooks persist to `action_executions.logs`, so
+     * they match inline deliveries. Defaults to `"full"`.
+     */
+    actionExecutionLogs?: ActionExecutionLogCapture;
     /**
      * Same shape as `init({ outbox: { pipeline } })`. When set, cron-drained
      * events are also archived to the Cloudflare Pipelines stream, matching the

package/dist/types/helpers/outbox-destinations/code-hooks.d.ts

@@ -1,6 +1,7 @@
 import { AuditEvent, CodeExecutor } from "@authhero/adapter-interfaces";
 import { EventDestination } from "../outbox-relay";
 import { CodeHookData } from "../../hooks/codehooks";
+import type { ActionExecutionLogCapture } from "../../types/AuthHeroConfig";
 interface CodeHookInvocation {
     eventId: string;
     tenantId: string;
@@ -42,7 +43,10 @@ export declare class CodeHookDestination implements EventDestination {
     name: string;
     private data;
     private codeExecutor?;
-    constructor(data: CodeHookData, codeExecutor?: CodeExecutor);
+    private logCapture?;
+    constructor(data: CodeHookData, codeExecutor?: CodeExecutor, options?: {
+        logCapture?: ActionExecutionLogCapture;
+    });
     accepts(event: AuditEvent): boolean;
     transform(event: AuditEvent): CodeHookInvocation;
     deliver(invocations: CodeHookInvocation[]): Promise<void>;

package/dist/types/helpers/request-data.d.ts

@@ -0,0 +1,24 @@
+import { Context } from "hono";
+import { DataAdapters } from "@authhero/adapter-interfaces";
+import { Bindings, Variables } from "../types";
+/**
+ * Installs `data` as this request's adapter stack on `ctx.var.data`.
+ *
+ * Also writes it to `ctx.env.data`, a deprecated alias kept for readers that
+ * have not moved to `ctx.var.data` yet, including consumers outside this repo.
+ * The env write is only safe because `applyConfigMiddleware` gives every
+ * request its own shallow copy of `env`. Drop it in the next major (#140).
+ */
+export declare function setRequestData(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, data: DataAdapters): void;
+/**
+ * The raw adapter a route group composes its per-request stack on: the base
+ * an earlier middleware installed on `ctx.var.baseData` (per-tenant database
+ * isolation), or `fallback`, the startup adapter from the config.
+ */
+export declare function getBaseData(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, fallback: DataAdapters): DataAdapters;

package/dist/types/helpers/reserved-claims.d.ts

@@ -14,9 +14,9 @@ export declare const USERINFO_RESERVED_CLAIMS: readonly ["iss", "sub", "aud", "e
  * vendor/tenant for downstream APIs while `sub` stays `auth-service`.
  * Client-bound mints keep `azp` locked (see below).
  */
-export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("tenant_id" | "client_id" | "org_name" | "scope" | "org_id" | "sid" | "sub" | "exp" | "iat" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "permissions" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
+export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("sub" | "permissions" | "tenant_id" | "client_id" | "org_name" | "scope" | "sid" | "exp" | "iat" | "org_id" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
 /** Client-bound mints: `azp` must stay the registered client id. */
-export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("tenant_id" | "client_id" | "org_name" | "scope" | "org_id" | "sid" | "sub" | "exp" | "iat" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "azp" | "permissions" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
+export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("sub" | "permissions" | "tenant_id" | "client_id" | "org_name" | "scope" | "sid" | "exp" | "iat" | "org_id" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "azp" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
 export type AccessTokenReservedClaim = (typeof ACCESS_TOKEN_RESERVED_CLAIMS)[number];
 export type IdTokenReservedClaim = (typeof ID_TOKEN_RESERVED_CLAIMS)[number];
 /**