authhero 9.24.1 → 9.26.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (59) hide show
  1. package/dist/assets/u/widget/index.esm.js +1 -1
  2. package/dist/authhero.cjs +155 -155
  3. package/dist/authhero.d.ts +612 -171
  4. package/dist/authhero.mjs +16457 -15581
  5. package/dist/tsconfig.types.tsbuildinfo +1 -1
  6. package/dist/types/adapters/createEncryptedDataAdapter.d.ts +2 -1
  7. package/dist/types/adapters/index.d.ts +1 -1
  8. package/dist/types/authentication-flows/passwordless.d.ts +12 -5
  9. package/dist/types/errors/management-api-error.d.ts +113 -0
  10. package/dist/types/helpers/audit-target-types.d.ts +26 -0
  11. package/dist/types/helpers/client.d.ts +18 -0
  12. package/dist/types/helpers/control-plane-caller.d.ts +15 -0
  13. package/dist/types/helpers/platform-rows.d.ts +27 -0
  14. package/dist/types/helpers/request-data.d.ts +12 -0
  15. package/dist/types/helpers/reserved-claims.d.ts +2 -2
  16. package/dist/types/helpers/synced-rows.d.ts +1 -0
  17. package/dist/types/index.d.ts +499 -167
  18. package/dist/types/routes/auth-api/index.d.ts +10 -10
  19. package/dist/types/routes/auth-api/passwordless.d.ts +10 -10
  20. package/dist/types/routes/management-api/action-executions.d.ts +1 -1
  21. package/dist/types/routes/management-api/action-triggers.d.ts +8 -2
  22. package/dist/types/routes/management-api/actions.d.ts +44 -11
  23. package/dist/types/routes/management-api/authentication-methods.d.ts +1 -1
  24. package/dist/types/routes/management-api/branding.d.ts +13 -1
  25. package/dist/types/routes/management-api/client-grants.d.ts +13 -0
  26. package/dist/types/routes/management-api/clients.d.ts +27 -8
  27. package/dist/types/routes/management-api/connections.d.ts +43 -6
  28. package/dist/types/routes/management-api/custom-domains.d.ts +6 -6
  29. package/dist/types/routes/management-api/email-templates.d.ts +18 -18
  30. package/dist/types/routes/management-api/emails.d.ts +18 -0
  31. package/dist/types/routes/management-api/failed-events.d.ts +24 -0
  32. package/dist/types/routes/management-api/guardian.d.ts +5 -5
  33. package/dist/types/routes/management-api/helpers.d.ts +1 -1
  34. package/dist/types/routes/management-api/hook-code.d.ts +2 -2
  35. package/dist/types/routes/management-api/hooks.d.ts +126 -21
  36. package/dist/types/routes/management-api/index.d.ts +480 -152
  37. package/dist/types/routes/management-api/keys.d.ts +8 -8
  38. package/dist/types/routes/management-api/log-streams.d.ts +6 -6
  39. package/dist/types/routes/management-api/logs.d.ts +4 -4
  40. package/dist/types/routes/management-api/migration-sources.d.ts +6 -6
  41. package/dist/types/routes/management-api/organizations.d.ts +2 -2
  42. package/dist/types/routes/management-api/prompts.d.ts +12 -6
  43. package/dist/types/routes/management-api/resource-servers.d.ts +57 -20
  44. package/dist/types/routes/management-api/rollouts.d.ts +261 -0
  45. package/dist/types/routes/management-api/tenant-operations.d.ts +10 -5
  46. package/dist/types/routes/management-api/tenants.d.ts +24 -8
  47. package/dist/types/routes/management-api/users.d.ts +24 -24
  48. package/dist/types/routes/universal-login/common.d.ts +38 -10
  49. package/dist/types/routes/universal-login/flow-api.d.ts +4 -4
  50. package/dist/types/routes/universal-login/screens/login-partials.d.ts +8 -0
  51. package/dist/types/routes/universal-login/u2-index.d.ts +5 -5
  52. package/dist/types/routes/universal-login/u2-routes.d.ts +5 -5
  53. package/dist/types/state-machines/login-session.d.ts +1 -1
  54. package/dist/types/types/AuthHeroConfig.d.ts +37 -1
  55. package/dist/types/types/Bindings.d.ts +2 -1
  56. package/dist/types/types/Variables.d.ts +8 -0
  57. package/dist/types/utils/field-encryption.d.ts +7 -0
  58. package/dist/types/utils/jwt.d.ts +2 -0
  59. package/package.json +6 -6
package/dist/types/routes/universal-login/common.d.ts CHANGED
@@ -100,6 +100,9 @@ export declare function initJSXRoute(ctx: Context<{
100
100
  url: string;
101
101
  } | undefined;
102
102
  dark_mode?: "dark" | "light" | "auto" | undefined;
103
+ scope?: "local" | "shared" | "platform" | undefined;
104
+ override?: "secrets" | "none" | "fields" | undefined;
105
+ enforce?: boolean | undefined;
103
106
  } | null;
104
107
  client: {
105
108
  created_at: string;
@@ -121,6 +124,10 @@ export declare function initJSXRoute(ctx: Context<{
121
124
  updated_at: string;
122
125
  friendly_name: string;
123
126
  id: string;
127
+ parent_tenant_id?: string | null | undefined;
128
+ config_sync?: "inherit-on-read" | "synced" | null | undefined;
129
+ config_sync_hash?: string | null | undefined;
130
+ config_synced_at?: string | null | undefined;
124
131
  audience?: string | undefined;
125
132
  picture_url?: string | undefined;
126
133
  support_email?: string | undefined;
@@ -224,7 +231,7 @@ export declare function initJSXRoute(ctx: Context<{
224
231
  pushed_authorization_requests_supported?: boolean | undefined;
225
232
  authorization_response_iss_parameter_supported?: boolean | undefined;
226
233
  deployment_type?: "shared" | "wfp" | undefined;
227
- provisioning_state?: "pending" | "failed" | "ready" | undefined;
234
+ provisioning_state?: "pending" | "ready" | "failed" | undefined;
228
235
  provisioning_error?: string | undefined;
229
236
  provisioning_state_changed_at?: string | undefined;
230
237
  bundle_configuration?: string | undefined;
@@ -272,7 +279,7 @@ export declare function initJSXRoute(ctx: Context<{
272
279
  } | undefined;
273
280
  } | undefined;
274
281
  mfa?: {
275
- policy?: "always" | "never" | undefined;
282
+ policy?: "never" | "always" | undefined;
276
283
  factors?: {
277
284
  sms: boolean;
278
285
  otp: boolean;
@@ -371,7 +378,7 @@ export declare function initJSXRoute(ctx: Context<{
371
378
  } | undefined;
372
379
  unique?: boolean | undefined;
373
380
  profile_required?: boolean | undefined;
374
- verification_method?: "link" | "code" | undefined;
381
+ verification_method?: "code" | "link" | undefined;
375
382
  } | undefined;
376
383
  username?: {
377
384
  identifier?: {
@@ -421,6 +428,9 @@ export declare function initJSXRoute(ctx: Context<{
421
428
  } | undefined;
422
429
  set_user_root_attributes?: "on_each_login" | "on_first_login" | "never_on_login" | undefined;
423
430
  };
431
+ scope?: "local" | "shared" | "platform" | undefined;
432
+ override?: "secrets" | "none" | "fields" | undefined;
433
+ enforce?: boolean | undefined;
424
434
  id?: string | undefined;
425
435
  display_name?: string | undefined;
426
436
  enabled_clients?: string[] | undefined;
@@ -496,6 +506,10 @@ export declare function initJSXRoute(ctx: Context<{
496
506
  updated_at: string;
497
507
  friendly_name: string;
498
508
  id: string;
509
+ parent_tenant_id?: string | null | undefined;
510
+ config_sync?: "inherit-on-read" | "synced" | null | undefined;
511
+ config_sync_hash?: string | null | undefined;
512
+ config_synced_at?: string | null | undefined;
499
513
  audience?: string | undefined;
500
514
  picture_url?: string | undefined;
501
515
  support_email?: string | undefined;
@@ -599,7 +613,7 @@ export declare function initJSXRoute(ctx: Context<{
599
613
  pushed_authorization_requests_supported?: boolean | undefined;
600
614
  authorization_response_iss_parameter_supported?: boolean | undefined;
601
615
  deployment_type?: "shared" | "wfp" | undefined;
602
- provisioning_state?: "pending" | "failed" | "ready" | undefined;
616
+ provisioning_state?: "pending" | "ready" | "failed" | undefined;
603
617
  provisioning_error?: string | undefined;
604
618
  provisioning_state_changed_at?: string | undefined;
605
619
  bundle_configuration?: string | undefined;
@@ -647,7 +661,7 @@ export declare function initJSXRoute(ctx: Context<{
647
661
  } | undefined;
648
662
  } | undefined;
649
663
  mfa?: {
650
- policy?: "always" | "never" | undefined;
664
+ policy?: "never" | "always" | undefined;
651
665
  factors?: {
652
666
  sms: boolean;
653
667
  otp: boolean;
@@ -836,6 +850,9 @@ export declare function initJSXRouteWithSession(ctx: Context<{
836
850
  url: string;
837
851
  } | undefined;
838
852
  dark_mode?: "dark" | "light" | "auto" | undefined;
853
+ scope?: "local" | "shared" | "platform" | undefined;
854
+ override?: "secrets" | "none" | "fields" | undefined;
855
+ enforce?: boolean | undefined;
839
856
  } | null;
840
857
  client: {
841
858
  created_at: string;
@@ -857,6 +874,10 @@ export declare function initJSXRouteWithSession(ctx: Context<{
857
874
  updated_at: string;
858
875
  friendly_name: string;
859
876
  id: string;
877
+ parent_tenant_id?: string | null | undefined;
878
+ config_sync?: "inherit-on-read" | "synced" | null | undefined;
879
+ config_sync_hash?: string | null | undefined;
880
+ config_synced_at?: string | null | undefined;
860
881
  audience?: string | undefined;
861
882
  picture_url?: string | undefined;
862
883
  support_email?: string | undefined;
@@ -960,7 +981,7 @@ export declare function initJSXRouteWithSession(ctx: Context<{
960
981
  pushed_authorization_requests_supported?: boolean | undefined;
961
982
  authorization_response_iss_parameter_supported?: boolean | undefined;
962
983
  deployment_type?: "shared" | "wfp" | undefined;
963
- provisioning_state?: "pending" | "failed" | "ready" | undefined;
984
+ provisioning_state?: "pending" | "ready" | "failed" | undefined;
964
985
  provisioning_error?: string | undefined;
965
986
  provisioning_state_changed_at?: string | undefined;
966
987
  bundle_configuration?: string | undefined;
@@ -1008,7 +1029,7 @@ export declare function initJSXRouteWithSession(ctx: Context<{
1008
1029
  } | undefined;
1009
1030
  } | undefined;
1010
1031
  mfa?: {
1011
- policy?: "always" | "never" | undefined;
1032
+ policy?: "never" | "always" | undefined;
1012
1033
  factors?: {
1013
1034
  sms: boolean;
1014
1035
  otp: boolean;
@@ -1107,7 +1128,7 @@ export declare function initJSXRouteWithSession(ctx: Context<{
1107
1128
  } | undefined;
1108
1129
  unique?: boolean | undefined;
1109
1130
  profile_required?: boolean | undefined;
1110
- verification_method?: "link" | "code" | undefined;
1131
+ verification_method?: "code" | "link" | undefined;
1111
1132
  } | undefined;
1112
1133
  username?: {
1113
1134
  identifier?: {
@@ -1157,6 +1178,9 @@ export declare function initJSXRouteWithSession(ctx: Context<{
1157
1178
  } | undefined;
1158
1179
  set_user_root_attributes?: "on_each_login" | "on_first_login" | "never_on_login" | undefined;
1159
1180
  };
1181
+ scope?: "local" | "shared" | "platform" | undefined;
1182
+ override?: "secrets" | "none" | "fields" | undefined;
1183
+ enforce?: boolean | undefined;
1160
1184
  id?: string | undefined;
1161
1185
  display_name?: string | undefined;
1162
1186
  enabled_clients?: string[] | undefined;
@@ -1301,6 +1325,10 @@ export declare function initJSXRouteWithSession(ctx: Context<{
1301
1325
  updated_at: string;
1302
1326
  friendly_name: string;
1303
1327
  id: string;
1328
+ parent_tenant_id?: string | null | undefined;
1329
+ config_sync?: "inherit-on-read" | "synced" | null | undefined;
1330
+ config_sync_hash?: string | null | undefined;
1331
+ config_synced_at?: string | null | undefined;
1304
1332
  audience?: string | undefined;
1305
1333
  picture_url?: string | undefined;
1306
1334
  support_email?: string | undefined;
@@ -1404,7 +1432,7 @@ export declare function initJSXRouteWithSession(ctx: Context<{
1404
1432
  pushed_authorization_requests_supported?: boolean | undefined;
1405
1433
  authorization_response_iss_parameter_supported?: boolean | undefined;
1406
1434
  deployment_type?: "shared" | "wfp" | undefined;
1407
- provisioning_state?: "pending" | "failed" | "ready" | undefined;
1435
+ provisioning_state?: "pending" | "ready" | "failed" | undefined;
1408
1436
  provisioning_error?: string | undefined;
1409
1437
  provisioning_state_changed_at?: string | undefined;
1410
1438
  bundle_configuration?: string | undefined;
@@ -1452,7 +1480,7 @@ export declare function initJSXRouteWithSession(ctx: Context<{
1452
1480
  } | undefined;
1453
1481
  } | undefined;
1454
1482
  mfa?: {
1455
- policy?: "always" | "never" | undefined;
1483
+ policy?: "never" | "always" | undefined;
1456
1484
  factors?: {
1457
1485
  sms: boolean;
1458
1486
  otp: boolean;
package/dist/types/routes/universal-login/flow-api.d.ts CHANGED
@@ -27,7 +27,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
27
27
  output: {
28
28
  screen: {
29
29
  action: string;
30
- method: "POST" | "GET";
30
+ method: "GET" | "POST";
31
31
  components: {
32
32
  id: string;
33
33
  type: string;
@@ -107,7 +107,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
107
107
  output: {
108
108
  screen: {
109
109
  action: string;
110
- method: "POST" | "GET";
110
+ method: "GET" | "POST";
111
111
  components: {
112
112
  id: string;
113
113
  type: string;
@@ -204,7 +204,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
204
204
  output: {
205
205
  screen: {
206
206
  action: string;
207
- method: "POST" | "GET";
207
+ method: "GET" | "POST";
208
208
  components: {
209
209
  id: string;
210
210
  type: string;
@@ -319,7 +319,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
319
319
  output: {
320
320
  screen: {
321
321
  action: string;
322
- method: "POST" | "GET";
322
+ method: "GET" | "POST";
323
323
  components: {
324
324
  id: string;
325
325
  type: string;
package/dist/types/routes/universal-login/screens/login-partials.d.ts ADDED
@@ -0,0 +1,8 @@
1
+ /**
2
+ * Prompt partials on the login screens. Auth0 keys partials by prompt and
3
+ * screen; each login screen reads the one stored under its own prompt name
4
+ * (`login-id`, `login-password`, `login`), like the signup screen does.
5
+ */
6
+ import type { UiScreen } from "@authhero/adapter-interfaces";
7
+ import type { ScreenContext } from "./types";
8
+ export declare function getLoginPartials(context: ScreenContext, prompt: "login-id" | "login-password" | "login"): Promise<UiScreen["partials"]>;
package/dist/types/routes/universal-login/u2-index.d.ts CHANGED
@@ -165,7 +165,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
165
165
  $get: {
166
166
  input: {
167
167
  param: {
168
- screen: "account" | "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
168
+ screen: "impersonate" | "login" | "signup" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
169
169
  };
170
170
  } & {
171
171
  query: {
@@ -181,7 +181,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
181
181
  } | {
182
182
  input: {
183
183
  param: {
184
- screen: "account" | "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
184
+ screen: "impersonate" | "login" | "signup" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
185
185
  };
186
186
  } & {
187
187
  query: {
@@ -197,7 +197,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
197
197
  } | {
198
198
  input: {
199
199
  param: {
200
- screen: "account" | "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
200
+ screen: "impersonate" | "login" | "signup" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
201
201
  };
202
202
  } & {
203
203
  query: {
@@ -217,7 +217,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
217
217
  $post: {
218
218
  input: {
219
219
  param: {
220
- screen: "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
220
+ screen: "impersonate" | "login" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
221
221
  };
222
222
  } & {
223
223
  query: {
@@ -235,7 +235,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
235
235
  } | {
236
236
  input: {
237
237
  param: {
238
- screen: "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
238
+ screen: "impersonate" | "login" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
239
239
  };
240
240
  } & {
241
241
  query: {
package/dist/types/routes/universal-login/u2-routes.d.ts CHANGED
@@ -170,7 +170,7 @@ export declare const u2Routes: OpenAPIHono<{
170
170
  $get: {
171
171
  input: {
172
172
  param: {
173
- screen: "account" | "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
173
+ screen: "impersonate" | "login" | "signup" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
174
174
  };
175
175
  } & {
176
176
  query: {
@@ -186,7 +186,7 @@ export declare const u2Routes: OpenAPIHono<{
186
186
  } | {
187
187
  input: {
188
188
  param: {
189
- screen: "account" | "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
189
+ screen: "impersonate" | "login" | "signup" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
190
190
  };
191
191
  } & {
192
192
  query: {
@@ -202,7 +202,7 @@ export declare const u2Routes: OpenAPIHono<{
202
202
  } | {
203
203
  input: {
204
204
  param: {
205
- screen: "account" | "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
205
+ screen: "impersonate" | "login" | "signup" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
206
206
  };
207
207
  } & {
208
208
  query: {
@@ -222,7 +222,7 @@ export declare const u2Routes: OpenAPIHono<{
222
222
  $post: {
223
223
  input: {
224
224
  param: {
225
- screen: "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
225
+ screen: "impersonate" | "login" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
226
226
  };
227
227
  } & {
228
228
  query: {
@@ -240,7 +240,7 @@ export declare const u2Routes: OpenAPIHono<{
240
240
  } | {
241
241
  input: {
242
242
  param: {
243
- screen: "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
243
+ screen: "impersonate" | "login" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
244
244
  };
245
245
  } & {
246
246
  query: {
package/dist/types/state-machines/login-session.d.ts CHANGED
@@ -204,7 +204,7 @@ export declare const loginSessionMachine: import("xstate").StateMachine<LoginSes
204
204
  }, {
205
205
  type: "passwordResetRequested";
206
206
  params: unknown;
207
- }, never, "completed" | "pending" | "authenticated" | "failed" | "expired" | "awaiting_email_verification" | "awaiting_mfa" | "awaiting_consent" | "awaiting_hook" | "awaiting_continuation", string, import("xstate").NonReducibleUnknown, import("xstate").NonReducibleUnknown, import("xstate").EventObject, import("xstate").MetaObject, {
207
+ }, never, "pending" | "failed" | "expired" | "completed" | "authenticated" | "awaiting_email_verification" | "awaiting_mfa" | "awaiting_consent" | "awaiting_hook" | "awaiting_continuation", string, import("xstate").NonReducibleUnknown, import("xstate").NonReducibleUnknown, import("xstate").EventObject, import("xstate").MetaObject, {
208
208
  id: "loginSession";
209
209
  states: {
210
210
  readonly pending: {};
package/dist/types/types/AuthHeroConfig.d.ts CHANGED
@@ -1,4 +1,4 @@
1
- import { CodeExecutor, Connection, ConnectionInsert, CreateTenantParams, DataAdapters, Hook, ResourceServer, ResourceServerInsert, Role, RoleInsert, Tenant, TenantOperation, TenantOperationKind } from "@authhero/adapter-interfaces";
1
+ import { Action, ActionInsert, ActionUpdate, CodeExecutor, Connection, ConnectionInsert, CreateTenantParams, DataAdapters, Hook, HookCode, HookCodeInsert, HookInsert, ResourceServer, ResourceServerInsert, Role, RoleInsert, Rollout, Tenant, TenantOperation, TenantOperationKind } from "@authhero/adapter-interfaces";
2
2
  import type { RolePermissionHooks, Hooks } from "./Hooks";
3
3
  import type { OutboxMetricsSink } from "./OutboxMetrics";
4
4
  import type { SamlSigner } from "@authhero/saml/core";
@@ -102,6 +102,9 @@ export interface EntityHooksConfig {
102
102
  rolePermissions?: (RolePermissionHooks | undefined)[];
103
103
  connections?: (EntityHooks<Connection, ConnectionInsert> | undefined)[];
104
104
  tenants?: (EntityHooks<Tenant, CreateTenantParams> | undefined)[];
105
+ actions?: (EntityHooks<Action, ActionInsert, ActionUpdate> | undefined)[];
106
+ hooks?: (EntityHooks<Hook, HookInsert> | undefined)[];
107
+ hookCode?: (EntityHooks<HookCode, HookCodeInsert> | undefined)[];
105
108
  }
106
109
  /**
107
110
  * Route extension for the management API.
@@ -126,12 +129,39 @@ export interface ManagementApiExtension {
126
129
  * resolve as soon as the run is enqueued — clients poll
127
130
  * `GET /api/v2/operations/{id}`.
128
131
  */
132
+ /**
133
+ * Creates and controls fleet rollouts of synced config (issue #1499). Kept
134
+ * structural, like {@link TenantOperationExecutorBinding}: the multi-tenancy
135
+ * package's `createRolloutController` satisfies it.
136
+ */
137
+ export interface RolloutControllerBinding {
138
+ create(params: {
139
+ rootTenantId?: string;
140
+ tenantIds?: string[];
141
+ canary?: number;
142
+ waves?: number[];
143
+ failureThreshold?: number;
144
+ maxConcurrent?: number;
145
+ dryRun?: boolean;
146
+ force?: boolean;
147
+ initiatedBy?: string;
148
+ }): Promise<Rollout>;
149
+ pause(id: string, reason?: string): Promise<Rollout | null>;
150
+ resume(id: string): Promise<Rollout | null>;
151
+ }
129
152
  export interface TenantOperationExecutorBinding {
130
153
  engine: string;
154
+ /**
155
+ * The kinds this executor can run. Absent means any. A request for another
156
+ * kind is answered `501` without creating an operation.
157
+ */
158
+ kinds?: readonly TenantOperationKind[];
131
159
  enqueue(params: {
132
160
  kind: TenantOperationKind;
133
161
  tenant_id: string | null;
134
162
  initiated_by?: string;
163
+ /** Kind-specific parameters, fixed at creation. Never contains secrets. */
164
+ input?: Record<string, unknown>;
135
165
  }): Promise<TenantOperation>;
136
166
  }
137
167
  /**
@@ -537,6 +567,12 @@ export interface AuthHeroConfig {
537
567
  * satisfy this shape.
538
568
  */
539
569
  tenantOperationExecutor?: TenantOperationExecutorBinding;
570
+ /**
571
+ * Creates and controls fleet rollouts of synced config. Drives
572
+ * `POST /api/v2/rollouts` and the pause and resume routes; reading rollouts
573
+ * only needs the `rollouts` adapter.
574
+ */
575
+ rolloutController?: RolloutControllerBinding;
540
576
  /**
541
577
  * Maximum accepted size of a bulk user-import file, in bytes
542
578
  * (`POST /api/v2/jobs/users-imports`). Defaults to Auth0's documented
package/dist/types/types/Bindings.d.ts CHANGED
@@ -2,7 +2,7 @@ import type { SigningCertificateAuthority } from "../helpers/signing-certificate
2
2
  import { CodeExecutor, DataAdapters } from "@authhero/adapter-interfaces";
3
3
  import type { SamlSigner } from "@authhero/saml/core";
4
4
  import { Hooks } from "./Hooks";
5
- import { ActionExecutionLogCapture, EntityHooksConfig, McpConfig, OutboxConfig, SigningKeyModeOption, TenantOperationExecutorBinding, UserLinkingModeOption, UsernamePasswordProviderResolver, WebhookInvoker } from "./AuthHeroConfig";
5
+ import { ActionExecutionLogCapture, EntityHooksConfig, McpConfig, OutboxConfig, SigningKeyModeOption, RolloutControllerBinding, TenantOperationExecutorBinding, UserLinkingModeOption, UsernamePasswordProviderResolver, WebhookInvoker } from "./AuthHeroConfig";
6
6
  import { StrategyHandler } from "../strategies";
7
7
  export type Bindings = {
8
8
  ENVIRONMENT: string;
@@ -42,6 +42,7 @@ export type Bindings = {
42
42
  webhookInvoker?: WebhookInvoker;
43
43
  tenantUpgrade?: (tenantId: string) => Promise<void>;
44
44
  tenantOperationExecutor?: TenantOperationExecutorBinding;
45
+ rolloutController?: RolloutControllerBinding;
45
46
  usersImportMaxBytes?: number;
46
47
  usersImportMaxConcurrentJobs?: number;
47
48
  unsafeAllowAzpCustomClaim?: boolean;
package/dist/types/types/Variables.d.ts CHANGED
@@ -29,6 +29,11 @@ export type Variables = {
29
29
  * twice. Read it through `getBaseData`.
30
30
  */
31
31
  baseData?: DataAdapters;
32
+ /**
33
+ * Management API only: the request stack before platform-scoped rows are
34
+ * hidden from it. Code-hook execution reads this; see `getExecutorData`.
35
+ */
36
+ executorData?: DataAdapters;
32
37
  tenant_id: string;
33
38
  ip: string;
34
39
  client_id?: string;
@@ -52,6 +57,9 @@ export type Variables = {
52
57
  org_id?: string;
53
58
  scope?: string;
54
59
  aud?: string | string[];
60
+ azp?: string;
61
+ gty?: string;
62
+ jti?: string;
55
63
  };
56
64
  organization_id?: string;
57
65
  org_name?: string;
package/dist/types/utils/field-encryption.d.ts CHANGED
@@ -42,6 +42,13 @@ export declare function decryptField(value: string, key: CryptoKey): Promise<str
42
42
  * ring's default key and is byte-compatible with `encryptField` (legacy form).
43
43
  */
44
44
  export declare function encryptFieldWithRing(plaintext: string, ring: KeyRing, keyId?: string): Promise<EncryptedField>;
45
+ /**
46
+ * Whether `ring` can decrypt `value`. Plaintext values are trivially readable.
47
+ * For ciphertext this checks that the key id embedded in it is in the ring and
48
+ * that decryption succeeds (a key can be present but wrong). Never throws and
49
+ * never returns the plaintext.
50
+ */
51
+ export declare function canDecrypt(value: string, ring: KeyRing): Promise<boolean>;
45
52
  /**
46
53
  * Decrypts a value using a key ring, selecting the key from the id embedded in
47
54
  * the ciphertext (or the default key for legacy unkeyed values). Plaintext
package/dist/types/utils/jwt.d.ts CHANGED
@@ -38,6 +38,8 @@ export interface JwtPayload {
38
38
  scope: string;
39
39
  permissions?: string[];
40
40
  azp?: string;
41
+ gty?: string;
42
+ jti?: string;
41
43
  tenant_id?: string;
42
44
  org_id?: string;
43
45
  org_name?: string;
package/package.json CHANGED
@@ -11,7 +11,7 @@
11
11
  "type": "git",
12
12
  "url": "https://github.com/sesamyab/authhero"
13
13
  },
14
- "version": "9.24.1",
14
+ "version": "9.26.0",
15
15
  "files": [
16
16
  "dist"
17
17
  ],
@@ -63,8 +63,8 @@
63
63
  "vite": "^8.0.14",
64
64
  "vite-plugin-dts": "^4.5.4",
65
65
  "vitest": "^4.1.7",
66
- "@authhero/kysely-adapter": "12.15.1",
67
- "@authhero/widget": "0.41.3"
66
+ "@authhero/kysely-adapter": "12.17.0",
67
+ "@authhero/widget": "0.41.5"
68
68
  },
69
69
  "dependencies": {
70
70
  "@peculiar/x509": "^1.14.3",
@@ -80,9 +80,9 @@
80
80
  "qrcode": "^1.5.4",
81
81
  "sanitize-html": "^2.17.4",
82
82
  "xstate": "^5.31.1",
83
- "@authhero/adapter-interfaces": "4.21.0",
84
- "@authhero/proxy": "0.11.7",
85
- "@authhero/saml": "0.6.0"
83
+ "@authhero/adapter-interfaces": "4.23.0",
84
+ "@authhero/proxy": "0.11.9",
85
+ "@authhero/saml": "0.6.2"
86
86
  },
87
87
  "peerDependencies": {
88
88
  "@authhero/widget": "^0.1.0",