npm - authhero - Versions diffs - 9.23.1 → 9.24.1 - Mend

authhero 9.23.1 → 9.24.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (74) hide show

package/dist/types/routes/universal-login/flow-api.d.ts CHANGED Viewed

@@ -43,7 +43,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                         hint?: string | undefined;
                         messages?: {
                             text: string;
-                            type: "success" | "error" | "info" | "warning";
+                            type: "error" | "success" | "info" | "warning";
                             id?: number | undefined;
                         }[] | undefined;
                     }[];
@@ -51,7 +51,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                     description?: string | undefined;
                     messages?: {
                         text: string;
-                        type: "success" | "error" | "info" | "warning";
+                        type: "error" | "success" | "info" | "warning";
                         id?: number | undefined;
                     }[] | undefined;
                     links?: {
@@ -123,7 +123,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                         hint?: string | undefined;
                         messages?: {
                             text: string;
-                            type: "success" | "error" | "info" | "warning";
+                            type: "error" | "success" | "info" | "warning";
                             id?: number | undefined;
                         }[] | undefined;
                     }[];
@@ -131,7 +131,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                     description?: string | undefined;
                     messages?: {
                         text: string;
-                        type: "success" | "error" | "info" | "warning";
+                        type: "error" | "success" | "info" | "warning";
                         id?: number | undefined;
                     }[] | undefined;
                     links?: {
@@ -173,7 +173,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 404;
+            status: 400;
         } | {
             input: {
                 query: {
@@ -188,7 +188,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 400;
+            status: 404;
         } | {
             input: {
                 query: {
@@ -220,7 +220,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                         hint?: string | undefined;
                         messages?: {
                             text: string;
-                            type: "success" | "error" | "info" | "warning";
+                            type: "error" | "success" | "info" | "warning";
                             id?: number | undefined;
                         }[] | undefined;
                     }[];
@@ -228,7 +228,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                     description?: string | undefined;
                     messages?: {
                         text: string;
-                        type: "success" | "error" | "info" | "warning";
+                        type: "error" | "success" | "info" | "warning";
                         id?: number | undefined;
                     }[] | undefined;
                     links?: {
@@ -282,7 +282,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 404;
+            status: 400;
         } | {
             input: {
                 param: {
@@ -300,7 +300,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 400;
+            status: 404;
         } | {
             input: {
                 param: {
@@ -335,7 +335,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                         hint?: string | undefined;
                         messages?: {
                             text: string;
-                            type: "success" | "error" | "info" | "warning";
+                            type: "error" | "success" | "info" | "warning";
                             id?: number | undefined;
                         }[] | undefined;
                     }[];
@@ -343,7 +343,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                     description?: string | undefined;
                     messages?: {
                         text: string;
-                        type: "success" | "error" | "info" | "warning";
+                        type: "error" | "success" | "info" | "warning";
                         id?: number | undefined;
                     }[] | undefined;
                     links?: {

package/dist/types/routes/universal-login/form-node.d.ts CHANGED Viewed

@@ -18,7 +18,7 @@ export declare const formNodeRoutes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 404;
+            status: 200;
         } | {
             input: {
                 param: {
@@ -32,7 +32,7 @@ export declare const formNodeRoutes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 200;
+            status: 404;
         };
     };
 } & {
@@ -52,7 +52,7 @@ export declare const formNodeRoutes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 404;
+            status: 200;
         } | {
             input: {
                 param: {
@@ -68,7 +68,7 @@ export declare const formNodeRoutes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 200;
+            status: 404;
         };
     };
 }, "/">;

package/dist/types/routes/universal-login/screens/account-mfa-phone-enrollment.d.ts CHANGED Viewed

@@ -1,8 +1,3 @@
-/**
- * Account MFA Phone Enrollment screen - enroll SMS MFA from account settings
- *
- * Corresponds to: /u2/account/security/phone-enrollment
- */
 import type { ScreenDefinition } from "./types";
 /**
  * Screen definition for account MFA phone enrollment

package/dist/types/routes/universal-login/screens/account-mfa-totp-enrollment.d.ts CHANGED Viewed

@@ -1,8 +1,3 @@
-/**
- * Account MFA TOTP Enrollment screen - enroll authenticator app from account settings
- *
- * Corresponds to: /u2/account/security/totp-enrollment
- */
 import type { ScreenDefinition } from "./types";
 /**
  * Screen definition for account MFA TOTP enrollment

package/dist/types/routes/universal-login/screens/account-passkeys.d.ts CHANGED Viewed

@@ -1,8 +1,3 @@
-/**
- * Account Passkeys screen - manage passkey credentials
- *
- * Corresponds to: /u2/account/passkeys
- */
 import type { ScreenDefinition } from "./types";
 /**
  * Screen definition for the account-passkeys screen

package/dist/types/routes/universal-login/screens/connect-tenant-select.d.ts CHANGED Viewed

@@ -1,13 +1,3 @@
-/**
- * Connect Tenant Select screen — control-plane-only step in the consent flow.
- *
- * When `/connect/start` is hit on the multi-tenancy control plane, the user
- * picks which child tenant the IAT should be minted on. Each child tenant is
- * represented by an organization on the control plane whose `name` matches
- * the child tenant id (see @authhero/multi-tenancy provisioning hooks).
- *
- * Corresponds to: /u2/connect/select-tenant
- */
 import type { ScreenContext, ScreenResult, ScreenDefinition } from "./types";
 export declare function connectTenantSelectScreen(context: ScreenContext): Promise<ScreenResult>;
 export declare const connectTenantSelectScreenDefinition: ScreenDefinition;

package/dist/types/routes/universal-login/screens/identifier.d.ts CHANGED Viewed

@@ -1,8 +1,3 @@
-/**
- * Identifier screen - the first screen in the login flow
- *
- * Corresponds to: /u/login/identifier
- */
 import type { ScreenContext, ScreenResult, ScreenDefinition } from "./types";
 /**
  * Create the identifier screen

package/dist/types/routes/universal-login/screens/login.d.ts CHANGED Viewed

@@ -1,11 +1,3 @@
-/**
- * Login screen - combined identifier + password screen (Identifier + Password flow)
- *
- * This screen shows email/username input, password input, and social login buttons
- * all on a single page. Used when identifier_first is set to false.
- *
- * Corresponds to: /u2/login
- */
 import type { ScreenContext, ScreenResult, ScreenDefinition } from "./types";
 /**
  * Create the login screen (combined identifier + password)

package/dist/types/routes/universal-login/screens/mfa-login-options.d.ts CHANGED Viewed

@@ -1,8 +1,3 @@
-/**
- * MFA Login Options screen - factor selection when multiple MFA methods are available
- *
- * Corresponds to: /u2/mfa/login-options
- */
 import type { ScreenContext, ScreenResult, ScreenDefinition } from "./types";
 interface MfaOption {
     id: string;

package/dist/types/routes/universal-login/screens/mfa-phone-challenge.d.ts CHANGED Viewed

@@ -1,8 +1,3 @@
-/**
- * MFA Phone Challenge screen - for verifying SMS MFA code
- *
- * Corresponds to: /u2/mfa/phone-challenge
- */
 import type { ScreenContext, ScreenResult, ScreenDefinition } from "./types";
 /**
  * Create the mfa-phone-challenge screen

package/dist/types/routes/universal-login/screens/mfa-phone-enrollment.d.ts CHANGED Viewed

@@ -1,8 +1,3 @@
-/**
- * MFA Phone Enrollment screen - for setting up SMS MFA
- *
- * Corresponds to: /u2/mfa/phone-enrollment
- */
 import type { ScreenContext, ScreenResult, ScreenDefinition } from "./types";
 /**
  * Create the mfa-phone-enrollment screen

package/dist/types/routes/universal-login/screens/mfa-totp-challenge.d.ts CHANGED Viewed

@@ -1,8 +1,3 @@
-/**
- * MFA TOTP Challenge screen - for verifying authenticator app MFA code
- *
- * Corresponds to: /u2/mfa/totp-challenge
- */
 import type { ScreenContext, ScreenResult, ScreenDefinition } from "./types";
 /**
  * Create the mfa-totp-challenge screen

package/dist/types/routes/universal-login/screens/mfa-totp-enrollment.d.ts CHANGED Viewed

@@ -1,8 +1,3 @@
-/**
- * MFA TOTP Enrollment screen - for setting up authenticator app MFA
- *
- * Corresponds to: /u2/mfa/totp-enrollment
- */
 import type { ScreenContext, ScreenResult, ScreenDefinition } from "./types";
 /**
  * Create the mfa-totp-enrollment screen

package/dist/types/routes/universal-login/screens/passkey-challenge.d.ts CHANGED Viewed

@@ -1,16 +1,2 @@
-/**
- * Passkey Challenge screen — WebAuthn authentication ceremony
- *
- * Allows users to sign in using a registered passkey (discoverable credential).
- * This triggers navigator.credentials.get() and verifies the assertion response.
- *
- * GET:  Generates WebAuthn authentication options and renders the challenge screen.
- * POST: Verifies the assertion response, resolves the user, and completes login.
- *
- * Passkey authentication bypasses MFA since it already provides strong
- * multi-factor assurance (possession + biometric/PIN).
- *
- * Corresponds to: /u2/passkey/challenge
- */
 import type { ScreenDefinition } from "./types";
 export declare const passkeyChallengeScreenDefinition: ScreenDefinition;

package/dist/types/routes/universal-login/screens/passkey-enrollment-nudge.d.ts CHANGED Viewed

@@ -1,17 +1,2 @@
-/**
- * Passkey Enrollment Nudge screen
- *
- * Shown after login when progressive enrollment is enabled and the user
- * has no passkeys registered. Offers three choices:
- *   - "Set up passkey" → proceeds to the enrollment ceremony
- *   - "Maybe later"    → snoozes the prompt for 30 days
- *   - "Don't show again" → permanently opts out
- *
- * Client-side: if the browser doesn't support WebAuthn
- * (window.PublicKeyCredential is undefined), the screen auto-submits
- * with action_no_webauthn so the login flow is never blocked.
- *
- * Corresponds to: /u2/passkey/enrollment-nudge
- */
 import type { ScreenDefinition } from "./types";
 export declare const passkeyEnrollmentNudgeScreenDefinition: ScreenDefinition;

package/dist/types/routes/universal-login/screens/passkey-enrollment.d.ts CHANGED Viewed

@@ -1,11 +1,2 @@
-/**
- * Passkey Enrollment screen — WebAuthn registration ceremony
- *
- * GET:  Generates WebAuthn registration options and renders a screen that
- *       triggers `navigator.credentials.create()` via an inline script.
- * POST: Verifies the attestation response and stores the credential.
- *
- * Corresponds to: /u2/passkey/enrollment
- */
 import type { ScreenDefinition } from "./types";
 export declare const passkeyEnrollmentScreenDefinition: ScreenDefinition;

package/dist/types/routes/universal-login/screens/reset-password-code.d.ts CHANGED Viewed

@@ -1,12 +1,3 @@
-/**
- * Reset Password Code screen - enter code + new password
- *
- * Used when the connection's verification_method is "code".
- * The user receives a 6-digit code via email and enters it
- * along with their new password on the same page.
- *
- * Corresponds to: /u2/reset-password/code
- */
 import type { ScreenContext, ScreenResult, ScreenDefinition } from "./types";
 /**
  * Create the reset-password-code screen

package/dist/types/routes/universal-login/screens/reset-password.d.ts CHANGED Viewed

@@ -1,8 +1,3 @@
-/**
- * Reset Password screen - set new password after reset
- *
- * Corresponds to: /u/reset-password
- */
 import type { ScreenContext, ScreenResult, ScreenDefinition } from "./types";
 import type { Context } from "hono";
 import type { Bindings, Variables } from "../../../types";
@@ -19,7 +14,8 @@ export declare function executePasswordReset(params: {
     client: EnrichedClient;
     code: string;
     password: string;
-    username: string;
+    loginSessionId: string;
+    method: "code" | "link";
 }): Promise<{
     success: true;
 } | {

package/dist/types/routes/universal-login/u2-index.d.ts CHANGED Viewed

@@ -165,7 +165,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         $get: {
             input: {
                 param: {
-                    screen: "account" | "consent" | "login" | "reset-password" | "signup" | "impersonate" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "account" | "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -181,7 +181,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "account" | "consent" | "login" | "reset-password" | "signup" | "impersonate" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "account" | "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -197,7 +197,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "account" | "consent" | "login" | "reset-password" | "signup" | "impersonate" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "account" | "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -217,7 +217,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         $post: {
             input: {
                 param: {
-                    screen: "consent" | "login" | "reset-password" | "signup" | "impersonate" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -235,7 +235,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "consent" | "login" | "reset-password" | "signup" | "impersonate" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {

package/dist/types/routes/universal-login/u2-routes.d.ts CHANGED Viewed

@@ -170,7 +170,7 @@ export declare const u2Routes: OpenAPIHono<{
         $get: {
             input: {
                 param: {
-                    screen: "account" | "consent" | "login" | "reset-password" | "signup" | "impersonate" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "account" | "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -186,7 +186,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "account" | "consent" | "login" | "reset-password" | "signup" | "impersonate" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "account" | "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -202,7 +202,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "account" | "consent" | "login" | "reset-password" | "signup" | "impersonate" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "account" | "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -222,7 +222,7 @@ export declare const u2Routes: OpenAPIHono<{
         $post: {
             input: {
                 param: {
-                    screen: "consent" | "login" | "reset-password" | "signup" | "impersonate" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -240,7 +240,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "consent" | "login" | "reset-password" | "signup" | "impersonate" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {

package/dist/types/state-machines/index.d.ts CHANGED Viewed

@@ -1 +1,3 @@
-export { loginSessionMachine, transitionLoginSession, transitionLoginSessionFromEntity, canTransition, getValidEvents, LoginSessionEventType, type LoginSessionContext, type LoginSessionEvent, } from "./login-session";
+export { loginSessionMachine, transitionLoginSession, transitionLoginSessionFromEntity, canTransition, getValidEvents, LoginSessionEventType, type LoginSessionContext, type LoginSessionData, type LoginSessionEvent, } from "./login-session";
+export { readLoginSessionData, updateLoginSessionData, createLoginSessionWithData, type LoginSessionDataEvent, } from "./login-session-data";
+export { passwordResetMachine, transitionPasswordReset, canCompletePasswordReset, type PasswordResetFlow, } from "./password-reset";

package/dist/types/state-machines/login-session-data.d.ts ADDED Viewed

@@ -0,0 +1,19 @@
+import type { LoginSession, LoginSessionInsert, LoginSessionsAdapter } from "@authhero/adapter-interfaces";
+import { LoginSessionEventType, type LoginSessionData, type LoginSessionEvent } from "./login-session";
+export { readLoginSessionData } from "./login-session";
+export type LoginSessionDataEvent = Extract<LoginSessionEvent, {
+    type: LoginSessionEventType.UPDATE_CONTEXT | LoginSessionEventType.PASSWORD_RESET_REQUESTED | LoginSessionEventType.PASSWORD_RESET_COMPLETED;
+}>;
+/** A terminal session cannot accept further context events. */
+export declare class FinalizedLoginSessionError extends Error {
+    constructor(id: string);
+}
+/**
+ * Sole persistence boundary for session context updates. Always reduce against
+ * the latest stored context, never a caller's stale session snapshot. Optional
+ * session fields (e.g. MFA state) are persisted in the same adapter update.
+ * This is read/modify/write, not a cross-request atomic compare-and-swap.
+ */
+export declare function updateLoginSessionData(sessions: LoginSessionsAdapter, tenantId: string, id: string, event: LoginSessionDataEvent, fields?: Omit<Partial<LoginSession>, "state_data">): Promise<boolean>;
+/** Initialize context through the same machine reducer before inserting it. */
+export declare function createLoginSessionWithData(sessions: LoginSessionsAdapter, tenantId: string, fields: Omit<LoginSessionInsert, "state_data">, data: Omit<LoginSessionData, "passwordReset">): Promise<LoginSession>;

package/dist/types/state-machines/login-session.d.ts CHANGED Viewed

@@ -1,4 +1,31 @@
+import { type PasswordResetFlow } from "./password-reset";
 import { LoginSession, LoginSessionState } from "@authhero/adapter-interfaces";
+/** Persisted context, grouped by responsibility in types, flat on disk. */
+export interface LoginSessionData {
+    passwordReset?: PasswordResetFlow;
+    mfa_verified?: boolean;
+    authenticationMethodId?: string;
+    phoneNumber?: string;
+    totpSecret?: string;
+    guardian_enrollment?: boolean;
+    pending_email_verification?: unknown;
+    hookId?: string;
+    form_values?: Record<string, unknown>;
+    continuationScope?: string[];
+    continuationReturnUrl?: string;
+    webauthn_challenge?: string;
+    passkey_nudge_completed?: boolean;
+    notice?: "password_reset_success";
+    invitation_id?: string;
+    organization_id?: string;
+    organization_name?: string;
+    inviter_name?: string;
+    roles?: string[];
+    connect?: Record<string, unknown>;
+    try_connection_result?: unknown;
+}
+/** The on-disk JSON shape stays flat for compatibility with existing sessions. */
+export declare function readLoginSessionData(raw?: string | null): LoginSessionData;
 /**
  * Context for the login session state machine
  */
@@ -12,12 +39,15 @@ export interface LoginSessionContext {
     /** Continuation scope - which pages are allowed during AWAITING_CONTINUATION */
     continuationScope?: string[];
     /** Additional state data */
-    stateData?: Record<string, unknown>;
+    stateData?: LoginSessionData;
 }
 /**
  * Event types for the login session state machine
  */
 export declare enum LoginSessionEventType {
+    PASSWORD_RESET_REQUESTED = "PASSWORD_RESET_REQUESTED",
+    PASSWORD_RESET_COMPLETED = "PASSWORD_RESET_COMPLETED",
+    UPDATE_CONTEXT = "UPDATE_CONTEXT",
     AUTHENTICATE = "AUTHENTICATE",
     REQUIRE_EMAIL_VERIFICATION = "REQUIRE_EMAIL_VERIFICATION",
     REQUIRE_MFA = "REQUIRE_MFA",
@@ -36,6 +66,17 @@ export declare enum LoginSessionEventType {
  * Events that can trigger state transitions
  */
 export type LoginSessionEvent = {
+    type: LoginSessionEventType.PASSWORD_RESET_REQUESTED;
+    username: string;
+    requestId: string;
+    method: "code" | "link";
+} | {
+    type: LoginSessionEventType.PASSWORD_RESET_COMPLETED;
+    requestId: string;
+} | {
+    type: LoginSessionEventType.UPDATE_CONTEXT;
+    data: Partial<Omit<LoginSessionData, "passwordReset">>;
+} | {
     type: LoginSessionEventType.AUTHENTICATE;
     userId: string;
 } | {
@@ -93,6 +134,17 @@ export type LoginSessionEvent = {
  * - expired: Session timed out (final)
  */
 export declare const loginSessionMachine: import("xstate").StateMachine<LoginSessionContext, {
+    type: LoginSessionEventType.PASSWORD_RESET_REQUESTED;
+    username: string;
+    requestId: string;
+    method: "code" | "link";
+} | {
+    type: LoginSessionEventType.PASSWORD_RESET_COMPLETED;
+    requestId: string;
+} | {
+    type: LoginSessionEventType.UPDATE_CONTEXT;
+    data: Partial<Omit<LoginSessionData, "passwordReset">>;
+} | {
     type: LoginSessionEventType.AUTHENTICATE;
     userId: string;
 } | {
@@ -123,6 +175,15 @@ export declare const loginSessionMachine: import("xstate").StateMachine<LoginSes
 } | {
     type: LoginSessionEventType.EXPIRE;
 }, {}, never, {
+    type: "requestPasswordReset";
+    params: import("xstate").NonReducibleUnknown;
+} | {
+    type: "completePasswordReset";
+    params: import("xstate").NonReducibleUnknown;
+} | {
+    type: "updateContext";
+    params: import("xstate").NonReducibleUnknown;
+} | {
     type: "setUserId";
     params: import("xstate").NonReducibleUnknown;
 } | {
@@ -140,7 +201,10 @@ export declare const loginSessionMachine: import("xstate").StateMachine<LoginSes
 } | {
     type: "setFailureReason";
     params: import("xstate").NonReducibleUnknown;
-}, never, never, "pending" | "failed" | "expired" | "authenticated" | "awaiting_email_verification" | "awaiting_mfa" | "awaiting_consent" | "awaiting_hook" | "awaiting_continuation" | "completed", string, import("xstate").NonReducibleUnknown, import("xstate").NonReducibleUnknown, import("xstate").EventObject, import("xstate").MetaObject, {
+}, {
+    type: "passwordResetRequested";
+    params: unknown;
+}, never, "completed" | "pending" | "authenticated" | "failed" | "expired" | "awaiting_email_verification" | "awaiting_mfa" | "awaiting_consent" | "awaiting_hook" | "awaiting_continuation", string, import("xstate").NonReducibleUnknown, import("xstate").NonReducibleUnknown, import("xstate").EventObject, import("xstate").MetaObject, {
     id: "loginSession";
     states: {
         readonly pending: {};
@@ -168,7 +232,7 @@ export declare function transitionLoginSession(currentState: LoginSessionState,
 /**
  * Check if a login session can transition with the given event
  *
- * Uses XState's transition - if the state changes, the transition is valid.
+ * Includes targetless context updates as well as authentication transitions.
  */
 export declare function canTransition(currentState: LoginSessionState, eventType: LoginSessionEvent["type"], context?: LoginSessionContext): boolean;
 /**