authhero 9.24.0 → 9.25.0

package/dist/types/routes/universal-login/screens/mfa-phone-enrollment.d.ts

@@ -1,8 +1,3 @@
-/**
- * MFA Phone Enrollment screen - for setting up SMS MFA
- *
- * Corresponds to: /u2/mfa/phone-enrollment
- */
 import type { ScreenContext, ScreenResult, ScreenDefinition } from "./types";
 /**
  * Create the mfa-phone-enrollment screen

package/dist/types/routes/universal-login/screens/mfa-totp-challenge.d.ts

@@ -1,8 +1,3 @@
-/**
- * MFA TOTP Challenge screen - for verifying authenticator app MFA code
- *
- * Corresponds to: /u2/mfa/totp-challenge
- */
 import type { ScreenContext, ScreenResult, ScreenDefinition } from "./types";
 /**
  * Create the mfa-totp-challenge screen

package/dist/types/routes/universal-login/screens/mfa-totp-enrollment.d.ts

@@ -1,8 +1,3 @@
-/**
- * MFA TOTP Enrollment screen - for setting up authenticator app MFA
- *
- * Corresponds to: /u2/mfa/totp-enrollment
- */
 import type { ScreenContext, ScreenResult, ScreenDefinition } from "./types";
 /**
  * Create the mfa-totp-enrollment screen

package/dist/types/routes/universal-login/screens/passkey-challenge.d.ts

@@ -1,16 +1,2 @@
-/**
- * Passkey Challenge screen — WebAuthn authentication ceremony
- *
- * Allows users to sign in using a registered passkey (discoverable credential).
- * This triggers navigator.credentials.get() and verifies the assertion response.
- *
- * GET:  Generates WebAuthn authentication options and renders the challenge screen.
- * POST: Verifies the assertion response, resolves the user, and completes login.
- *
- * Passkey authentication bypasses MFA since it already provides strong
- * multi-factor assurance (possession + biometric/PIN).
- *
- * Corresponds to: /u2/passkey/challenge
- */
 import type { ScreenDefinition } from "./types";
 export declare const passkeyChallengeScreenDefinition: ScreenDefinition;

package/dist/types/routes/universal-login/screens/passkey-enrollment-nudge.d.ts

@@ -1,17 +1,2 @@
-/**
- * Passkey Enrollment Nudge screen
- *
- * Shown after login when progressive enrollment is enabled and the user
- * has no passkeys registered. Offers three choices:
- *   - "Set up passkey" → proceeds to the enrollment ceremony
- *   - "Maybe later"    → snoozes the prompt for 30 days
- *   - "Don't show again" → permanently opts out
- *
- * Client-side: if the browser doesn't support WebAuthn
- * (window.PublicKeyCredential is undefined), the screen auto-submits
- * with action_no_webauthn so the login flow is never blocked.
- *
- * Corresponds to: /u2/passkey/enrollment-nudge
- */
 import type { ScreenDefinition } from "./types";
 export declare const passkeyEnrollmentNudgeScreenDefinition: ScreenDefinition;

package/dist/types/routes/universal-login/screens/passkey-enrollment.d.ts

@@ -1,11 +1,2 @@
-/**
- * Passkey Enrollment screen — WebAuthn registration ceremony
- *
- * GET:  Generates WebAuthn registration options and renders a screen that
- *       triggers `navigator.credentials.create()` via an inline script.
- * POST: Verifies the attestation response and stores the credential.
- *
- * Corresponds to: /u2/passkey/enrollment
- */
 import type { ScreenDefinition } from "./types";
 export declare const passkeyEnrollmentScreenDefinition: ScreenDefinition;

package/dist/types/routes/universal-login/screens/reset-password-code.d.ts

@@ -1,12 +1,3 @@
-/**
- * Reset Password Code screen - enter code + new password
- *
- * Used when the connection's verification_method is "code".
- * The user receives a 6-digit code via email and enters it
- * along with their new password on the same page.
- *
- * Corresponds to: /u2/reset-password/code
- */
 import type { ScreenContext, ScreenResult, ScreenDefinition } from "./types";
 /**
  * Create the reset-password-code screen

package/dist/types/routes/universal-login/screens/reset-password.d.ts

@@ -1,8 +1,3 @@
-/**
- * Reset Password screen - set new password after reset
- *
- * Corresponds to: /u/reset-password
- */
 import type { ScreenContext, ScreenResult, ScreenDefinition } from "./types";
 import type { Context } from "hono";
 import type { Bindings, Variables } from "../../../types";
@@ -19,7 +14,8 @@ export declare function executePasswordReset(params: {
     client: EnrichedClient;
     code: string;
     password: string;
-    username: string;
+    loginSessionId: string;
+    method: "code" | "link";
 }): Promise<{
     success: true;
 } | {

package/dist/types/routes/universal-login/u2-index.d.ts

@@ -165,7 +165,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         $get: {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "login" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "impersonate" | "account" | "consent" | "login" | "reset-password" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -181,7 +181,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "login" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "impersonate" | "account" | "consent" | "login" | "reset-password" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -193,11 +193,11 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 400;
+            status: 302;
         } | {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "login" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "impersonate" | "account" | "consent" | "login" | "reset-password" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -209,7 +209,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 302;
+            status: 400;
         };
     };
 } & {
@@ -217,7 +217,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         $post: {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "login" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -235,7 +235,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "login" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {

package/dist/types/routes/universal-login/u2-routes.d.ts

@@ -170,7 +170,7 @@ export declare const u2Routes: OpenAPIHono<{
         $get: {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "login" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "impersonate" | "account" | "consent" | "login" | "reset-password" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -186,7 +186,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "login" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "impersonate" | "account" | "consent" | "login" | "reset-password" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -198,11 +198,11 @@ export declare const u2Routes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 400;
+            status: 302;
         } | {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "login" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "impersonate" | "account" | "consent" | "login" | "reset-password" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -214,7 +214,7 @@ export declare const u2Routes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 302;
+            status: 400;
         };
     };
 } & {
@@ -222,7 +222,7 @@ export declare const u2Routes: OpenAPIHono<{
         $post: {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "login" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -240,7 +240,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "login" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {

package/dist/types/state-machines/index.d.ts

@@ -1 +1,3 @@
-export { loginSessionMachine, transitionLoginSession, transitionLoginSessionFromEntity, canTransition, getValidEvents, LoginSessionEventType, type LoginSessionContext, type LoginSessionEvent, } from "./login-session";
+export { loginSessionMachine, transitionLoginSession, transitionLoginSessionFromEntity, canTransition, getValidEvents, LoginSessionEventType, type LoginSessionContext, type LoginSessionData, type LoginSessionEvent, } from "./login-session";
+export { readLoginSessionData, updateLoginSessionData, createLoginSessionWithData, type LoginSessionDataEvent, } from "./login-session-data";
+export { passwordResetMachine, transitionPasswordReset, canCompletePasswordReset, type PasswordResetFlow, } from "./password-reset";

package/dist/types/state-machines/login-session-data.d.ts

@@ -0,0 +1,19 @@
+import type { LoginSession, LoginSessionInsert, LoginSessionsAdapter } from "@authhero/adapter-interfaces";
+import { LoginSessionEventType, type LoginSessionData, type LoginSessionEvent } from "./login-session";
+export { readLoginSessionData } from "./login-session";
+export type LoginSessionDataEvent = Extract<LoginSessionEvent, {
+    type: LoginSessionEventType.UPDATE_CONTEXT | LoginSessionEventType.PASSWORD_RESET_REQUESTED | LoginSessionEventType.PASSWORD_RESET_COMPLETED;
+}>;
+/** A terminal session cannot accept further context events. */
+export declare class FinalizedLoginSessionError extends Error {
+    constructor(id: string);
+}
+/**
+ * Sole persistence boundary for session context updates. Always reduce against
+ * the latest stored context, never a caller's stale session snapshot. Optional
+ * session fields (e.g. MFA state) are persisted in the same adapter update.
+ * This is read/modify/write, not a cross-request atomic compare-and-swap.
+ */
+export declare function updateLoginSessionData(sessions: LoginSessionsAdapter, tenantId: string, id: string, event: LoginSessionDataEvent, fields?: Omit<Partial<LoginSession>, "state_data">): Promise<boolean>;
+/** Initialize context through the same machine reducer before inserting it. */
+export declare function createLoginSessionWithData(sessions: LoginSessionsAdapter, tenantId: string, fields: Omit<LoginSessionInsert, "state_data">, data: Omit<LoginSessionData, "passwordReset">): Promise<LoginSession>;

package/dist/types/state-machines/login-session.d.ts

@@ -1,4 +1,31 @@
+import { type PasswordResetFlow } from "./password-reset";
 import { LoginSession, LoginSessionState } from "@authhero/adapter-interfaces";
+/** Persisted context, grouped by responsibility in types, flat on disk. */
+export interface LoginSessionData {
+    passwordReset?: PasswordResetFlow;
+    mfa_verified?: boolean;
+    authenticationMethodId?: string;
+    phoneNumber?: string;
+    totpSecret?: string;
+    guardian_enrollment?: boolean;
+    pending_email_verification?: unknown;
+    hookId?: string;
+    form_values?: Record<string, unknown>;
+    continuationScope?: string[];
+    continuationReturnUrl?: string;
+    webauthn_challenge?: string;
+    passkey_nudge_completed?: boolean;
+    notice?: "password_reset_success";
+    invitation_id?: string;
+    organization_id?: string;
+    organization_name?: string;
+    inviter_name?: string;
+    roles?: string[];
+    connect?: Record<string, unknown>;
+    try_connection_result?: unknown;
+}
+/** The on-disk JSON shape stays flat for compatibility with existing sessions. */
+export declare function readLoginSessionData(raw?: string | null): LoginSessionData;
 /**
  * Context for the login session state machine
  */
@@ -12,12 +39,15 @@ export interface LoginSessionContext {
     /** Continuation scope - which pages are allowed during AWAITING_CONTINUATION */
     continuationScope?: string[];
     /** Additional state data */
-    stateData?: Record<string, unknown>;
+    stateData?: LoginSessionData;
 }
 /**
  * Event types for the login session state machine
  */
 export declare enum LoginSessionEventType {
+    PASSWORD_RESET_REQUESTED = "PASSWORD_RESET_REQUESTED",
+    PASSWORD_RESET_COMPLETED = "PASSWORD_RESET_COMPLETED",
+    UPDATE_CONTEXT = "UPDATE_CONTEXT",
     AUTHENTICATE = "AUTHENTICATE",
     REQUIRE_EMAIL_VERIFICATION = "REQUIRE_EMAIL_VERIFICATION",
     REQUIRE_MFA = "REQUIRE_MFA",
@@ -36,6 +66,17 @@ export declare enum LoginSessionEventType {
  * Events that can trigger state transitions
  */
 export type LoginSessionEvent = {
+    type: LoginSessionEventType.PASSWORD_RESET_REQUESTED;
+    username: string;
+    requestId: string;
+    method: "code" | "link";
+} | {
+    type: LoginSessionEventType.PASSWORD_RESET_COMPLETED;
+    requestId: string;
+} | {
+    type: LoginSessionEventType.UPDATE_CONTEXT;
+    data: Partial<Omit<LoginSessionData, "passwordReset">>;
+} | {
     type: LoginSessionEventType.AUTHENTICATE;
     userId: string;
 } | {
@@ -93,6 +134,17 @@ export type LoginSessionEvent = {
  * - expired: Session timed out (final)
  */
 export declare const loginSessionMachine: import("xstate").StateMachine<LoginSessionContext, {
+    type: LoginSessionEventType.PASSWORD_RESET_REQUESTED;
+    username: string;
+    requestId: string;
+    method: "code" | "link";
+} | {
+    type: LoginSessionEventType.PASSWORD_RESET_COMPLETED;
+    requestId: string;
+} | {
+    type: LoginSessionEventType.UPDATE_CONTEXT;
+    data: Partial<Omit<LoginSessionData, "passwordReset">>;
+} | {
     type: LoginSessionEventType.AUTHENTICATE;
     userId: string;
 } | {
@@ -123,6 +175,15 @@ export declare const loginSessionMachine: import("xstate").StateMachine<LoginSes
 } | {
     type: LoginSessionEventType.EXPIRE;
 }, {}, never, {
+    type: "requestPasswordReset";
+    params: import("xstate").NonReducibleUnknown;
+} | {
+    type: "completePasswordReset";
+    params: import("xstate").NonReducibleUnknown;
+} | {
+    type: "updateContext";
+    params: import("xstate").NonReducibleUnknown;
+} | {
     type: "setUserId";
     params: import("xstate").NonReducibleUnknown;
 } | {
@@ -140,7 +201,10 @@ export declare const loginSessionMachine: import("xstate").StateMachine<LoginSes
 } | {
     type: "setFailureReason";
     params: import("xstate").NonReducibleUnknown;
-}, never, never, "pending" | "failed" | "expired" | "authenticated" | "awaiting_email_verification" | "awaiting_mfa" | "awaiting_consent" | "awaiting_hook" | "awaiting_continuation" | "completed", string, import("xstate").NonReducibleUnknown, import("xstate").NonReducibleUnknown, import("xstate").EventObject, import("xstate").MetaObject, {
+}, {
+    type: "passwordResetRequested";
+    params: unknown;
+}, never, "pending" | "failed" | "expired" | "authenticated" | "awaiting_email_verification" | "awaiting_mfa" | "awaiting_consent" | "awaiting_hook" | "awaiting_continuation" | "completed", string, import("xstate").NonReducibleUnknown, import("xstate").NonReducibleUnknown, import("xstate").EventObject, import("xstate").MetaObject, {
     id: "loginSession";
     states: {
         readonly pending: {};
@@ -168,7 +232,7 @@ export declare function transitionLoginSession(currentState: LoginSessionState,
 /**
  * Check if a login session can transition with the given event
  *
- * Uses XState's transition - if the state changes, the transition is valid.
+ * Includes targetless context updates as well as authentication transitions.
  */
 export declare function canTransition(currentState: LoginSessionState, eventType: LoginSessionEvent["type"], context?: LoginSessionContext): boolean;
 /**

package/dist/types/state-machines/password-reset.d.ts

@@ -0,0 +1,46 @@
+export interface PasswordResetFlow {
+    state: "awaiting_code" | "awaiting_link" | "completed";
+    username: string;
+    requestId: string;
+}
+export type PasswordResetEvent = {
+    type: "REQUEST_CODE";
+    username: string;
+    requestId: string;
+} | {
+    type: "REQUEST_LINK";
+    username: string;
+    requestId: string;
+} | {
+    type: "COMPLETE";
+};
+/** A reset request belongs to the login session, independently of login progress. */
+export declare const passwordResetMachine: import("xstate").StateMachine<{
+    username?: string;
+    requestId?: string;
+}, {
+    type: "REQUEST_CODE";
+    username: string;
+    requestId: string;
+} | {
+    type: "REQUEST_LINK";
+    username: string;
+    requestId: string;
+} | {
+    type: "COMPLETE";
+}, {}, never, {
+    type: "setUsername";
+    params: import("xstate").NonReducibleUnknown;
+}, never, never, "idle" | "awaiting_code" | "completed" | "awaiting_link", string, import("xstate").NonReducibleUnknown, import("xstate").NonReducibleUnknown, import("xstate").EventObject, import("xstate").MetaObject, {
+    id: "passwordReset";
+    states: {
+        readonly idle: {};
+        readonly awaiting_code: {};
+        readonly awaiting_link: {};
+        readonly completed: {};
+    };
+}>;
+/** Rehydrate the persisted child flow and reduce one domain event. */
+export declare function transitionPasswordReset(flow: PasswordResetFlow | undefined, event: PasswordResetEvent): PasswordResetFlow | undefined;
+/** Code and link submission endpoints accept only their own requested flow. */
+export declare function canCompletePasswordReset(flow: PasswordResetFlow | undefined, method?: "code" | "link"): flow is PasswordResetFlow;

package/dist/types/types/Variables.d.ts

@@ -52,6 +52,9 @@ export type Variables = {
         org_id?: string;
         scope?: string;
         aud?: string | string[];
+        azp?: string;
+        gty?: string;
+        jti?: string;
     };
     organization_id?: string;
     org_name?: string;

package/dist/types/utils/jwks.d.ts

@@ -9,7 +9,7 @@ import { CertificateIssuer } from "../helpers/signing-certificate-authority";
  */
 export declare function getJwksForPublication(data: DataAdapters, tenantId: string, modeOption: SigningKeyModeOption | undefined, certificateIssuer?: CertificateIssuer): Promise<{
     kty: "EC" | "RSA" | "oct";
-    alg?: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "HS256" | "HS384" | "HS512" | undefined;
+    alg?: "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | undefined;
     kid?: string | undefined;
     use?: "sig" | "enc" | undefined;
     n?: string | undefined;
@@ -29,7 +29,7 @@ export declare function getJwksForPublication(data: DataAdapters, tenantId: stri
  */
 export declare function getJwksForVerification(data: DataAdapters, tenantId: string | undefined, modeOption: SigningKeyModeOption | undefined): Promise<{
     kty: "EC" | "RSA" | "oct";
-    alg?: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "HS256" | "HS384" | "HS512" | undefined;
+    alg?: "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | undefined;
     kid?: string | undefined;
     use?: "sig" | "enc" | undefined;
     n?: string | undefined;

package/dist/types/utils/jwt.d.ts

@@ -38,6 +38,8 @@ export interface JwtPayload {
     scope: string;
     permissions?: string[];
     azp?: string;
+    gty?: string;
+    jti?: string;
     tenant_id?: string;
     org_id?: string;
     org_name?: string;

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/sesamyab/authhero"
   },
-  "version": "9.24.0",
+  "version": "9.25.0",
   "files": [
     "dist"
   ],
@@ -63,8 +63,8 @@
     "vite": "^8.0.14",
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^4.1.7",
-    "@authhero/kysely-adapter": "12.15.0",
-    "@authhero/widget": "0.41.3"
+    "@authhero/kysely-adapter": "12.16.0",
+    "@authhero/widget": "0.41.4"
   },
   "dependencies": {
     "@peculiar/x509": "^1.14.3",
@@ -80,9 +80,9 @@
     "qrcode": "^1.5.4",
     "sanitize-html": "^2.17.4",
     "xstate": "^5.31.1",
-    "@authhero/adapter-interfaces": "4.21.0",
-    "@authhero/proxy": "0.11.7",
-    "@authhero/saml": "0.6.0"
+    "@authhero/adapter-interfaces": "4.22.0",
+    "@authhero/proxy": "0.11.8",
+    "@authhero/saml": "0.6.1"
   },
   "peerDependencies": {
     "@authhero/widget": "^0.1.0",