authhero 9.24.0 → 9.24.1

package/dist/types/routes/universal-login/u2-routes.d.ts

@@ -170,7 +170,7 @@ export declare const u2Routes: OpenAPIHono<{
         $get: {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "login" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "account" | "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -186,7 +186,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "login" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "account" | "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -198,11 +198,11 @@ export declare const u2Routes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 400;
+            status: 302;
         } | {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "login" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "account" | "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -214,7 +214,7 @@ export declare const u2Routes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 302;
+            status: 400;
         };
     };
 } & {
@@ -222,7 +222,7 @@ export declare const u2Routes: OpenAPIHono<{
         $post: {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "login" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -240,7 +240,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "login" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {

package/dist/types/state-machines/index.d.ts

@@ -1 +1,3 @@
-export { loginSessionMachine, transitionLoginSession, transitionLoginSessionFromEntity, canTransition, getValidEvents, LoginSessionEventType, type LoginSessionContext, type LoginSessionEvent, } from "./login-session";
+export { loginSessionMachine, transitionLoginSession, transitionLoginSessionFromEntity, canTransition, getValidEvents, LoginSessionEventType, type LoginSessionContext, type LoginSessionData, type LoginSessionEvent, } from "./login-session";
+export { readLoginSessionData, updateLoginSessionData, createLoginSessionWithData, type LoginSessionDataEvent, } from "./login-session-data";
+export { passwordResetMachine, transitionPasswordReset, canCompletePasswordReset, type PasswordResetFlow, } from "./password-reset";

package/dist/types/state-machines/login-session-data.d.ts

@@ -0,0 +1,19 @@
+import type { LoginSession, LoginSessionInsert, LoginSessionsAdapter } from "@authhero/adapter-interfaces";
+import { LoginSessionEventType, type LoginSessionData, type LoginSessionEvent } from "./login-session";
+export { readLoginSessionData } from "./login-session";
+export type LoginSessionDataEvent = Extract<LoginSessionEvent, {
+    type: LoginSessionEventType.UPDATE_CONTEXT | LoginSessionEventType.PASSWORD_RESET_REQUESTED | LoginSessionEventType.PASSWORD_RESET_COMPLETED;
+}>;
+/** A terminal session cannot accept further context events. */
+export declare class FinalizedLoginSessionError extends Error {
+    constructor(id: string);
+}
+/**
+ * Sole persistence boundary for session context updates. Always reduce against
+ * the latest stored context, never a caller's stale session snapshot. Optional
+ * session fields (e.g. MFA state) are persisted in the same adapter update.
+ * This is read/modify/write, not a cross-request atomic compare-and-swap.
+ */
+export declare function updateLoginSessionData(sessions: LoginSessionsAdapter, tenantId: string, id: string, event: LoginSessionDataEvent, fields?: Omit<Partial<LoginSession>, "state_data">): Promise<boolean>;
+/** Initialize context through the same machine reducer before inserting it. */
+export declare function createLoginSessionWithData(sessions: LoginSessionsAdapter, tenantId: string, fields: Omit<LoginSessionInsert, "state_data">, data: Omit<LoginSessionData, "passwordReset">): Promise<LoginSession>;

package/dist/types/state-machines/login-session.d.ts

@@ -1,4 +1,31 @@
+import { type PasswordResetFlow } from "./password-reset";
 import { LoginSession, LoginSessionState } from "@authhero/adapter-interfaces";
+/** Persisted context, grouped by responsibility in types, flat on disk. */
+export interface LoginSessionData {
+    passwordReset?: PasswordResetFlow;
+    mfa_verified?: boolean;
+    authenticationMethodId?: string;
+    phoneNumber?: string;
+    totpSecret?: string;
+    guardian_enrollment?: boolean;
+    pending_email_verification?: unknown;
+    hookId?: string;
+    form_values?: Record<string, unknown>;
+    continuationScope?: string[];
+    continuationReturnUrl?: string;
+    webauthn_challenge?: string;
+    passkey_nudge_completed?: boolean;
+    notice?: "password_reset_success";
+    invitation_id?: string;
+    organization_id?: string;
+    organization_name?: string;
+    inviter_name?: string;
+    roles?: string[];
+    connect?: Record<string, unknown>;
+    try_connection_result?: unknown;
+}
+/** The on-disk JSON shape stays flat for compatibility with existing sessions. */
+export declare function readLoginSessionData(raw?: string | null): LoginSessionData;
 /**
  * Context for the login session state machine
  */
@@ -12,12 +39,15 @@ export interface LoginSessionContext {
     /** Continuation scope - which pages are allowed during AWAITING_CONTINUATION */
     continuationScope?: string[];
     /** Additional state data */
-    stateData?: Record<string, unknown>;
+    stateData?: LoginSessionData;
 }
 /**
  * Event types for the login session state machine
  */
 export declare enum LoginSessionEventType {
+    PASSWORD_RESET_REQUESTED = "PASSWORD_RESET_REQUESTED",
+    PASSWORD_RESET_COMPLETED = "PASSWORD_RESET_COMPLETED",
+    UPDATE_CONTEXT = "UPDATE_CONTEXT",
     AUTHENTICATE = "AUTHENTICATE",
     REQUIRE_EMAIL_VERIFICATION = "REQUIRE_EMAIL_VERIFICATION",
     REQUIRE_MFA = "REQUIRE_MFA",
@@ -36,6 +66,17 @@ export declare enum LoginSessionEventType {
  * Events that can trigger state transitions
  */
 export type LoginSessionEvent = {
+    type: LoginSessionEventType.PASSWORD_RESET_REQUESTED;
+    username: string;
+    requestId: string;
+    method: "code" | "link";
+} | {
+    type: LoginSessionEventType.PASSWORD_RESET_COMPLETED;
+    requestId: string;
+} | {
+    type: LoginSessionEventType.UPDATE_CONTEXT;
+    data: Partial<Omit<LoginSessionData, "passwordReset">>;
+} | {
     type: LoginSessionEventType.AUTHENTICATE;
     userId: string;
 } | {
@@ -93,6 +134,17 @@ export type LoginSessionEvent = {
  * - expired: Session timed out (final)
  */
 export declare const loginSessionMachine: import("xstate").StateMachine<LoginSessionContext, {
+    type: LoginSessionEventType.PASSWORD_RESET_REQUESTED;
+    username: string;
+    requestId: string;
+    method: "code" | "link";
+} | {
+    type: LoginSessionEventType.PASSWORD_RESET_COMPLETED;
+    requestId: string;
+} | {
+    type: LoginSessionEventType.UPDATE_CONTEXT;
+    data: Partial<Omit<LoginSessionData, "passwordReset">>;
+} | {
     type: LoginSessionEventType.AUTHENTICATE;
     userId: string;
 } | {
@@ -123,6 +175,15 @@ export declare const loginSessionMachine: import("xstate").StateMachine<LoginSes
 } | {
     type: LoginSessionEventType.EXPIRE;
 }, {}, never, {
+    type: "requestPasswordReset";
+    params: import("xstate").NonReducibleUnknown;
+} | {
+    type: "completePasswordReset";
+    params: import("xstate").NonReducibleUnknown;
+} | {
+    type: "updateContext";
+    params: import("xstate").NonReducibleUnknown;
+} | {
     type: "setUserId";
     params: import("xstate").NonReducibleUnknown;
 } | {
@@ -140,7 +201,10 @@ export declare const loginSessionMachine: import("xstate").StateMachine<LoginSes
 } | {
     type: "setFailureReason";
     params: import("xstate").NonReducibleUnknown;
-}, never, never, "pending" | "failed" | "expired" | "authenticated" | "awaiting_email_verification" | "awaiting_mfa" | "awaiting_consent" | "awaiting_hook" | "awaiting_continuation" | "completed", string, import("xstate").NonReducibleUnknown, import("xstate").NonReducibleUnknown, import("xstate").EventObject, import("xstate").MetaObject, {
+}, {
+    type: "passwordResetRequested";
+    params: unknown;
+}, never, "completed" | "pending" | "authenticated" | "failed" | "expired" | "awaiting_email_verification" | "awaiting_mfa" | "awaiting_consent" | "awaiting_hook" | "awaiting_continuation", string, import("xstate").NonReducibleUnknown, import("xstate").NonReducibleUnknown, import("xstate").EventObject, import("xstate").MetaObject, {
     id: "loginSession";
     states: {
         readonly pending: {};
@@ -168,7 +232,7 @@ export declare function transitionLoginSession(currentState: LoginSessionState,
 /**
  * Check if a login session can transition with the given event
  *
- * Uses XState's transition - if the state changes, the transition is valid.
+ * Includes targetless context updates as well as authentication transitions.
  */
 export declare function canTransition(currentState: LoginSessionState, eventType: LoginSessionEvent["type"], context?: LoginSessionContext): boolean;
 /**

package/dist/types/state-machines/password-reset.d.ts

@@ -0,0 +1,46 @@
+export interface PasswordResetFlow {
+    state: "awaiting_code" | "awaiting_link" | "completed";
+    username: string;
+    requestId: string;
+}
+export type PasswordResetEvent = {
+    type: "REQUEST_CODE";
+    username: string;
+    requestId: string;
+} | {
+    type: "REQUEST_LINK";
+    username: string;
+    requestId: string;
+} | {
+    type: "COMPLETE";
+};
+/** A reset request belongs to the login session, independently of login progress. */
+export declare const passwordResetMachine: import("xstate").StateMachine<{
+    username?: string;
+    requestId?: string;
+}, {
+    type: "REQUEST_CODE";
+    username: string;
+    requestId: string;
+} | {
+    type: "REQUEST_LINK";
+    username: string;
+    requestId: string;
+} | {
+    type: "COMPLETE";
+}, {}, never, {
+    type: "setUsername";
+    params: import("xstate").NonReducibleUnknown;
+}, never, never, "idle" | "awaiting_code" | "completed" | "awaiting_link", string, import("xstate").NonReducibleUnknown, import("xstate").NonReducibleUnknown, import("xstate").EventObject, import("xstate").MetaObject, {
+    id: "passwordReset";
+    states: {
+        readonly idle: {};
+        readonly awaiting_code: {};
+        readonly awaiting_link: {};
+        readonly completed: {};
+    };
+}>;
+/** Rehydrate the persisted child flow and reduce one domain event. */
+export declare function transitionPasswordReset(flow: PasswordResetFlow | undefined, event: PasswordResetEvent): PasswordResetFlow | undefined;
+/** Code and link submission endpoints accept only their own requested flow. */
+export declare function canCompletePasswordReset(flow: PasswordResetFlow | undefined, method?: "code" | "link"): flow is PasswordResetFlow;

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/sesamyab/authhero"
   },
-  "version": "9.24.0",
+  "version": "9.24.1",
   "files": [
     "dist"
   ],
@@ -63,7 +63,7 @@
     "vite": "^8.0.14",
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^4.1.7",
-    "@authhero/kysely-adapter": "12.15.0",
+    "@authhero/kysely-adapter": "12.15.1",
     "@authhero/widget": "0.41.3"
   },
   "dependencies": {