authhero 9.23.0 → 9.24.0

package/dist/types/generated/locale-types.d.ts

@@ -20,6 +20,12 @@ export interface CommonScreen {
     termsOfServiceText: () => string;
     termsShortText: () => string;
     tryAgainText: () => string;
+    embeddedBrowserTitle: () => string;
+    embeddedBrowserText: (vars: {
+        browserName: string;
+    }) => string;
+    privateBrowsingTitle: () => string;
+    privateBrowsingText: () => string;
 }
 export interface CommonAccountScreen {
     title: () => string;

package/dist/types/helpers/logging.d.ts

@@ -70,6 +70,13 @@ export type LogParams = {
      * linking to the execution (Auth0 reaches executions via the tenant logs).
      */
     execution_id?: string;
+    /**
+     * The login session (the `state`) this event belongs to. Merged into
+     * `details` so one login flow can be traced across /authorize, /u/* and
+     * /samlp/* log entries. Defaults to `ctx.var.loginSession?.id` when the
+     * request has resolved a login session.
+     */
+    login_session_id?: string;
     /**
      * If true, wait for the log to complete before returning.
      * If false (default), execute logging asynchronously in the background.

package/dist/types/helpers/outbox-destinations/log-streams.d.ts

@@ -32,6 +32,8 @@ interface LogStreamData {
             body?: unknown;
         };
         execution_id?: string;
+        login_session_id?: string;
+        [key: string]: unknown;
     };
 }
 interface LogStreamPayload {

package/dist/types/helpers/reserved-claims.d.ts

@@ -14,9 +14,9 @@ export declare const USERINFO_RESERVED_CLAIMS: readonly ["iss", "sub", "aud", "e
  * vendor/tenant for downstream APIs while `sub` stays `auth-service`.
  * Client-bound mints keep `azp` locked (see below).
  */
-export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("sid" | "client_id" | "scope" | "tenant_id" | "org_name" | "sub" | "exp" | "iat" | "org_id" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "permissions" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
+export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("client_id" | "sub" | "sid" | "tenant_id" | "org_name" | "scope" | "exp" | "iat" | "org_id" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "permissions" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
 /** Client-bound mints: `azp` must stay the registered client id. */
-export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("sid" | "client_id" | "scope" | "tenant_id" | "org_name" | "sub" | "exp" | "iat" | "org_id" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "azp" | "permissions" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
+export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("client_id" | "sub" | "sid" | "tenant_id" | "org_name" | "scope" | "exp" | "iat" | "org_id" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "azp" | "permissions" | "nbf" | "jti" | "act" | "requested_userinfo_claims" | "gty")[];
 export type AccessTokenReservedClaim = (typeof ACCESS_TOKEN_RESERVED_CLAIMS)[number];
 export type IdTokenReservedClaim = (typeof ID_TOKEN_RESERVED_CLAIMS)[number];
 /**

package/dist/types/helpers/users.d.ts

@@ -162,6 +162,11 @@ interface LinkUserToParams {
  * hook, or internal linking code — is safe by construction rather than by
  * remembering to call the right helper.
  *
+ * This performs several writes (repoint, and on promotion also unlink), so
+ * direct callers should pass an adapter bound to a transaction. The user-update
+ * hook already does this via `data.transaction`, so callers going through
+ * `users.update(id, { linked_to })` get atomicity automatically.
+ *
  * Returns the cluster root `userId` was actually linked to, which may differ
  * from the requested `primaryId`.
  */