authhero 9.22.1 → 9.23.1

package/dist/types/authentication-flows/passwordless.d.ts

@@ -475,7 +475,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
         custom_login_page_preview?: string | undefined;
         form_template?: string | undefined;
         addons?: Record<string, any> | undefined;
-        token_endpoint_auth_method?: "client_secret_post" | "client_secret_basic" | "none" | "client_secret_jwt" | "private_key_jwt" | undefined;
+        token_endpoint_auth_method?: "none" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | "private_key_jwt" | undefined;
         client_metadata?: Record<string, string> | undefined;
         hide_sign_up_disabled_error?: boolean | undefined;
         mobile?: Record<string, any> | undefined;
@@ -561,8 +561,8 @@ export declare function passwordlessGrantUser(ctx: Context<{
         } | undefined;
         authenticated_at?: string | undefined;
     };
-    connectionType: "email" | "username" | "sms";
-    authConnection: "email" | "username" | "sms";
+    connectionType: "sms" | "email" | "username";
+    authConnection: "sms" | "email" | "username";
     session_id: string | undefined;
     authParams: {
         audience?: string | undefined;

package/dist/types/errors/signup-validation-error.d.ts

@@ -0,0 +1,9 @@
+import { HTTPException } from "hono/http-exception";
+/**
+ * Flow-control error thrown by pre-user-registration hooks when submitted
+ * signup data fails custom validation.
+ */
+export declare class SignupValidationError extends HTTPException {
+    readonly code: string;
+    constructor(code: string, message: string);
+}

package/dist/types/generated/locale-types.d.ts

@@ -20,6 +20,12 @@ export interface CommonScreen {
     termsOfServiceText: () => string;
     termsShortText: () => string;
     tryAgainText: () => string;
+    embeddedBrowserTitle: () => string;
+    embeddedBrowserText: (vars: {
+        browserName: string;
+    }) => string;
+    privateBrowsingTitle: () => string;
+    privateBrowsingText: () => string;
 }
 export interface CommonAccountScreen {
     title: () => string;

package/dist/types/helpers/dcr/metadata-mapping.d.ts

@@ -24,10 +24,10 @@ export declare const dcrRequestSchema: z.ZodObject<{
     response_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
     token_endpoint_auth_method: z.ZodOptional<z.ZodEnum<{
         none: "none";
-        private_key_jwt: "private_key_jwt";
         client_secret_post: "client_secret_post";
         client_secret_basic: "client_secret_basic";
         client_secret_jwt: "client_secret_jwt";
+        private_key_jwt: "private_key_jwt";
     }>>;
     jwks_uri: z.ZodOptional<z.ZodString>;
     jwks: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;

package/dist/types/helpers/prompt-partials.d.ts

@@ -0,0 +1,5 @@
+import type { PromptPartials } from "@authhero/adapter-interfaces";
+export declare const promptPartialPrompts: readonly ["signup", "signup-id", "signup-password", "login", "login-id", "login-password", "login-passwordless", "login-passwordless-sms-otp", "login-passwordless-email-code"];
+export declare const MAX_PROMPT_PARTIAL_LENGTH = 100000;
+export declare function isAllowedPromptPartialMappingTarget(target: string): boolean;
+export declare function sanitizePromptPartials(partials: PromptPartials): PromptPartials;

package/dist/types/helpers/reserved-claims.d.ts

@@ -14,9 +14,9 @@ export declare const USERINFO_RESERVED_CLAIMS: readonly ["iss", "sub", "aud", "e
  * vendor/tenant for downstream APIs while `sub` stays `auth-service`.
  * Client-bound mints keep `azp` locked (see below).
  */
-export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("client_id" | "scope" | "iss" | "sub" | "aud" | "exp" | "iat" | "auth_time" | "acr" | "amr" | "tenant_id" | "sid" | "org_name" | "org_id" | "permissions" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
+export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("sid" | "client_id" | "scope" | "tenant_id" | "org_name" | "sub" | "exp" | "iat" | "org_id" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "permissions" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
 /** Client-bound mints: `azp` must stay the registered client id. */
-export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("client_id" | "scope" | "iss" | "sub" | "aud" | "exp" | "iat" | "auth_time" | "acr" | "amr" | "azp" | "tenant_id" | "sid" | "org_name" | "org_id" | "permissions" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
+export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("sid" | "client_id" | "scope" | "tenant_id" | "org_name" | "sub" | "exp" | "iat" | "org_id" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "azp" | "permissions" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
 export type AccessTokenReservedClaim = (typeof ACCESS_TOKEN_RESERVED_CLAIMS)[number];
 export type IdTokenReservedClaim = (typeof ID_TOKEN_RESERVED_CLAIMS)[number];
 /**

package/dist/types/helpers/tenant-export-import/manifest.d.ts

@@ -8,5 +8,5 @@
  *   - ephemeral / audit: sessions, refresh_tokens, codes, login_sessions,
  *     logs, action_executions, outbox_events, grants.
  */
-export declare const EXPORT_ORDER: readonly ["tenants", "clients", "connections", "resource_servers", "roles", "organizations", "users", "passwords", "authentication_methods", "user_roles", "user_permissions", "role_permissions", "organization_connections", "user_organizations", "client_grants", "invites", "actions", "action_versions", "hook_code", "hooks", "flows", "forms", "themes", "branding", "prompt_settings", "universal_login_templates", "custom_text", "email_providers", "email_templates", "custom_domains", "log_streams", "migration_sources", "proxy_routes"];
+export declare const EXPORT_ORDER: readonly ["tenants", "clients", "connections", "resource_servers", "roles", "organizations", "users", "passwords", "authentication_methods", "user_roles", "user_permissions", "role_permissions", "organization_connections", "user_organizations", "client_grants", "invites", "actions", "action_versions", "hook_code", "hooks", "flows", "forms", "themes", "branding", "prompt_settings", "prompt_partials", "universal_login_templates", "custom_text", "email_providers", "email_templates", "custom_domains", "log_streams", "migration_sources", "proxy_routes"];
 export type ExportEntity = (typeof EXPORT_ORDER)[number];

package/dist/types/hooks/codehooks.d.ts

@@ -77,7 +77,7 @@ export declare function replayApiCalls(apiCalls: Array<{
 export type HandleCodeHookOutcome = {
     result: ActionExecutionResult;
     logs: CodeExecutionLog[];
-    /** True if api.access.deny was recorded by the executor. */
+    /** True if the executor recorded an API call that cancels the flow. */
     denied: boolean;
 };
 /**
@@ -90,8 +90,9 @@ export type HandleCodeHookOutcome = {
  *
  * Always returns an outcome — including a `code_not_found` / `execution_failed`
  * outcome — so the caller can persist an `action_executions` record. It only
- * throws for `api.access.deny`, which surfaces as a thrown `HTTPException` from
- * the replayed API call; callers that must abort the flow catch it.
+ * throws for blocking API calls such as `api.access.deny` and
+ * `api.validation.error`, which surface as thrown `HTTPException`s from the
+ * replayed API call; callers that must abort the flow catch them.
  *
  * `idempotencyKey`, when set, is exposed to user code as `event.idempotency_key`.
  * The outbox is at-least-once, so a retried hook event re-runs the code; authors

package/dist/types/hooks/pagehooks.d.ts

@@ -1,6 +1,7 @@
 import { Context } from "hono";
 import { Bindings, Variables } from "../types";
 import { LoginSession, User } from "@authhero/adapter-interfaces";
+import { EnrichedClient } from "../helpers/client";
 export declare function isPageHook(hook: any): hook is {
     page_id: string;
     enabled: boolean;
@@ -13,4 +14,4 @@ export declare function isPageHook(hook: any): hook is {
 export declare function handlePageHook(ctx: Context<{
     Bindings: Bindings;
     Variables: Variables;
-}>, page_id: string, loginSession: LoginSession, user: User, permission_required?: string): Promise<User | Response>;
+}>, page_id: string, loginSession: LoginSession, user: User, permission_required?: string, client?: EnrichedClient): Promise<User | Response>;