authhero 9.25.0 → 9.26.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (65) hide show
  1. package/dist/assets/u/widget/index.esm.js +1 -1
  2. package/dist/authhero.cjs +155 -155
  3. package/dist/authhero.d.ts +623 -473
  4. package/dist/authhero.mjs +16319 -15605
  5. package/dist/tsconfig.types.tsbuildinfo +1 -1
  6. package/dist/types/adapters/createEncryptedDataAdapter.d.ts +2 -1
  7. package/dist/types/adapters/index.d.ts +1 -1
  8. package/dist/types/authentication-flows/passwordless.d.ts +8 -5
  9. package/dist/types/errors/management-api-error.d.ts +113 -0
  10. package/dist/types/helpers/client.d.ts +6 -0
  11. package/dist/types/helpers/control-plane-caller.d.ts +15 -0
  12. package/dist/types/helpers/platform-rows.d.ts +27 -0
  13. package/dist/types/helpers/request-data.d.ts +12 -0
  14. package/dist/types/helpers/reserved-claims.d.ts +2 -2
  15. package/dist/types/helpers/synced-rows.d.ts +1 -0
  16. package/dist/types/index.d.ts +525 -469
  17. package/dist/types/routes/auth-api/account.d.ts +2 -2
  18. package/dist/types/routes/auth-api/index.d.ts +19 -19
  19. package/dist/types/routes/auth-api/passwordless.d.ts +10 -10
  20. package/dist/types/routes/auth-api/revoke.d.ts +6 -6
  21. package/dist/types/routes/auth-api/well-known.d.ts +1 -1
  22. package/dist/types/routes/management-api/action-executions.d.ts +2 -2
  23. package/dist/types/routes/management-api/action-triggers.d.ts +4 -4
  24. package/dist/types/routes/management-api/actions.d.ts +23 -23
  25. package/dist/types/routes/management-api/authentication-methods.d.ts +1 -1
  26. package/dist/types/routes/management-api/branding.d.ts +9 -9
  27. package/dist/types/routes/management-api/client-grants.d.ts +13 -0
  28. package/dist/types/routes/management-api/clients.d.ts +19 -6
  29. package/dist/types/routes/management-api/connections.d.ts +36 -23
  30. package/dist/types/routes/management-api/email-templates.d.ts +18 -18
  31. package/dist/types/routes/management-api/emails.d.ts +12 -12
  32. package/dist/types/routes/management-api/failed-events.d.ts +2 -2
  33. package/dist/types/routes/management-api/flows.d.ts +8 -8
  34. package/dist/types/routes/management-api/forms.d.ts +144 -144
  35. package/dist/types/routes/management-api/guardian.d.ts +5 -5
  36. package/dist/types/routes/management-api/helpers.d.ts +1 -1
  37. package/dist/types/routes/management-api/hook-code.d.ts +2 -2
  38. package/dist/types/routes/management-api/hooks.d.ts +91 -91
  39. package/dist/types/routes/management-api/index.d.ts +495 -443
  40. package/dist/types/routes/management-api/keys.d.ts +16 -16
  41. package/dist/types/routes/management-api/logs.d.ts +4 -4
  42. package/dist/types/routes/management-api/migration-sources.d.ts +6 -6
  43. package/dist/types/routes/management-api/organizations.d.ts +6 -6
  44. package/dist/types/routes/management-api/prompts.d.ts +10 -10
  45. package/dist/types/routes/management-api/resource-servers.d.ts +29 -16
  46. package/dist/types/routes/management-api/roles.d.ts +1 -1
  47. package/dist/types/routes/management-api/rollouts.d.ts +261 -0
  48. package/dist/types/routes/management-api/tenant-export-import.d.ts +5 -5
  49. package/dist/types/routes/management-api/tenant-operations.d.ts +10 -5
  50. package/dist/types/routes/management-api/tenants.d.ts +17 -5
  51. package/dist/types/routes/management-api/token-exchange-profiles.d.ts +6 -6
  52. package/dist/types/routes/management-api/users.d.ts +17 -17
  53. package/dist/types/routes/universal-login/common.d.ts +22 -10
  54. package/dist/types/routes/universal-login/flow-api.d.ts +12 -12
  55. package/dist/types/routes/universal-login/identifier.d.ts +2 -2
  56. package/dist/types/routes/universal-login/index.d.ts +2 -2
  57. package/dist/types/routes/universal-login/u2-index.d.ts +5 -5
  58. package/dist/types/routes/universal-login/u2-routes.d.ts +5 -5
  59. package/dist/types/state-machines/login-session.d.ts +1 -1
  60. package/dist/types/types/AuthHeroConfig.d.ts +37 -1
  61. package/dist/types/types/Bindings.d.ts +2 -1
  62. package/dist/types/types/Variables.d.ts +5 -0
  63. package/dist/types/utils/field-encryption.d.ts +7 -0
  64. package/dist/types/utils/jwks.d.ts +2 -2
  65. package/package.json +6 -6
package/dist/types/routes/universal-login/common.d.ts CHANGED
@@ -100,8 +100,8 @@ export declare function initJSXRoute(ctx: Context<{
100
100
  url: string;
101
101
  } | undefined;
102
102
  dark_mode?: "dark" | "light" | "auto" | undefined;
103
- scope?: "shared" | "local" | "platform" | undefined;
104
- override?: "none" | "secrets" | "fields" | undefined;
103
+ scope?: "local" | "shared" | "platform" | undefined;
104
+ override?: "secrets" | "none" | "fields" | undefined;
105
105
  enforce?: boolean | undefined;
106
106
  } | null;
107
107
  client: {
@@ -125,6 +125,9 @@ export declare function initJSXRoute(ctx: Context<{
125
125
  friendly_name: string;
126
126
  id: string;
127
127
  parent_tenant_id?: string | null | undefined;
128
+ config_sync?: "inherit-on-read" | "synced" | null | undefined;
129
+ config_sync_hash?: string | null | undefined;
130
+ config_synced_at?: string | null | undefined;
128
131
  audience?: string | undefined;
129
132
  picture_url?: string | undefined;
130
133
  support_email?: string | undefined;
@@ -375,7 +378,7 @@ export declare function initJSXRoute(ctx: Context<{
375
378
  } | undefined;
376
379
  unique?: boolean | undefined;
377
380
  profile_required?: boolean | undefined;
378
- verification_method?: "link" | "code" | undefined;
381
+ verification_method?: "code" | "link" | undefined;
379
382
  } | undefined;
380
383
  username?: {
381
384
  identifier?: {
@@ -425,8 +428,8 @@ export declare function initJSXRoute(ctx: Context<{
425
428
  } | undefined;
426
429
  set_user_root_attributes?: "on_each_login" | "on_first_login" | "never_on_login" | undefined;
427
430
  };
428
- scope?: "shared" | "local" | "platform" | undefined;
429
- override?: "none" | "secrets" | "fields" | undefined;
431
+ scope?: "local" | "shared" | "platform" | undefined;
432
+ override?: "secrets" | "none" | "fields" | undefined;
430
433
  enforce?: boolean | undefined;
431
434
  id?: string | undefined;
432
435
  display_name?: string | undefined;
@@ -504,6 +507,9 @@ export declare function initJSXRoute(ctx: Context<{
504
507
  friendly_name: string;
505
508
  id: string;
506
509
  parent_tenant_id?: string | null | undefined;
510
+ config_sync?: "inherit-on-read" | "synced" | null | undefined;
511
+ config_sync_hash?: string | null | undefined;
512
+ config_synced_at?: string | null | undefined;
507
513
  audience?: string | undefined;
508
514
  picture_url?: string | undefined;
509
515
  support_email?: string | undefined;
@@ -844,8 +850,8 @@ export declare function initJSXRouteWithSession(ctx: Context<{
844
850
  url: string;
845
851
  } | undefined;
846
852
  dark_mode?: "dark" | "light" | "auto" | undefined;
847
- scope?: "shared" | "local" | "platform" | undefined;
848
- override?: "none" | "secrets" | "fields" | undefined;
853
+ scope?: "local" | "shared" | "platform" | undefined;
854
+ override?: "secrets" | "none" | "fields" | undefined;
849
855
  enforce?: boolean | undefined;
850
856
  } | null;
851
857
  client: {
@@ -869,6 +875,9 @@ export declare function initJSXRouteWithSession(ctx: Context<{
869
875
  friendly_name: string;
870
876
  id: string;
871
877
  parent_tenant_id?: string | null | undefined;
878
+ config_sync?: "inherit-on-read" | "synced" | null | undefined;
879
+ config_sync_hash?: string | null | undefined;
880
+ config_synced_at?: string | null | undefined;
872
881
  audience?: string | undefined;
873
882
  picture_url?: string | undefined;
874
883
  support_email?: string | undefined;
@@ -1119,7 +1128,7 @@ export declare function initJSXRouteWithSession(ctx: Context<{
1119
1128
  } | undefined;
1120
1129
  unique?: boolean | undefined;
1121
1130
  profile_required?: boolean | undefined;
1122
- verification_method?: "link" | "code" | undefined;
1131
+ verification_method?: "code" | "link" | undefined;
1123
1132
  } | undefined;
1124
1133
  username?: {
1125
1134
  identifier?: {
@@ -1169,8 +1178,8 @@ export declare function initJSXRouteWithSession(ctx: Context<{
1169
1178
  } | undefined;
1170
1179
  set_user_root_attributes?: "on_each_login" | "on_first_login" | "never_on_login" | undefined;
1171
1180
  };
1172
- scope?: "shared" | "local" | "platform" | undefined;
1173
- override?: "none" | "secrets" | "fields" | undefined;
1181
+ scope?: "local" | "shared" | "platform" | undefined;
1182
+ override?: "secrets" | "none" | "fields" | undefined;
1174
1183
  enforce?: boolean | undefined;
1175
1184
  id?: string | undefined;
1176
1185
  display_name?: string | undefined;
@@ -1317,6 +1326,9 @@ export declare function initJSXRouteWithSession(ctx: Context<{
1317
1326
  friendly_name: string;
1318
1327
  id: string;
1319
1328
  parent_tenant_id?: string | null | undefined;
1329
+ config_sync?: "inherit-on-read" | "synced" | null | undefined;
1330
+ config_sync_hash?: string | null | undefined;
1331
+ config_synced_at?: string | null | undefined;
1320
1332
  audience?: string | undefined;
1321
1333
  picture_url?: string | undefined;
1322
1334
  support_email?: string | undefined;
package/dist/types/routes/universal-login/flow-api.d.ts CHANGED
@@ -27,7 +27,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
27
27
  output: {
28
28
  screen: {
29
29
  action: string;
30
- method: "POST" | "GET";
30
+ method: "GET" | "POST";
31
31
  components: {
32
32
  id: string;
33
33
  type: string;
@@ -43,7 +43,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
43
43
  hint?: string | undefined;
44
44
  messages?: {
45
45
  text: string;
46
- type: "success" | "error" | "info" | "warning";
46
+ type: "error" | "success" | "info" | "warning";
47
47
  id?: number | undefined;
48
48
  }[] | undefined;
49
49
  }[];
@@ -51,7 +51,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
51
51
  description?: string | undefined;
52
52
  messages?: {
53
53
  text: string;
54
- type: "success" | "error" | "info" | "warning";
54
+ type: "error" | "success" | "info" | "warning";
55
55
  id?: number | undefined;
56
56
  }[] | undefined;
57
57
  links?: {
@@ -107,7 +107,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
107
107
  output: {
108
108
  screen: {
109
109
  action: string;
110
- method: "POST" | "GET";
110
+ method: "GET" | "POST";
111
111
  components: {
112
112
  id: string;
113
113
  type: string;
@@ -123,7 +123,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
123
123
  hint?: string | undefined;
124
124
  messages?: {
125
125
  text: string;
126
- type: "success" | "error" | "info" | "warning";
126
+ type: "error" | "success" | "info" | "warning";
127
127
  id?: number | undefined;
128
128
  }[] | undefined;
129
129
  }[];
@@ -131,7 +131,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
131
131
  description?: string | undefined;
132
132
  messages?: {
133
133
  text: string;
134
- type: "success" | "error" | "info" | "warning";
134
+ type: "error" | "success" | "info" | "warning";
135
135
  id?: number | undefined;
136
136
  }[] | undefined;
137
137
  links?: {
@@ -204,7 +204,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
204
204
  output: {
205
205
  screen: {
206
206
  action: string;
207
- method: "POST" | "GET";
207
+ method: "GET" | "POST";
208
208
  components: {
209
209
  id: string;
210
210
  type: string;
@@ -220,7 +220,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
220
220
  hint?: string | undefined;
221
221
  messages?: {
222
222
  text: string;
223
- type: "success" | "error" | "info" | "warning";
223
+ type: "error" | "success" | "info" | "warning";
224
224
  id?: number | undefined;
225
225
  }[] | undefined;
226
226
  }[];
@@ -228,7 +228,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
228
228
  description?: string | undefined;
229
229
  messages?: {
230
230
  text: string;
231
- type: "success" | "error" | "info" | "warning";
231
+ type: "error" | "success" | "info" | "warning";
232
232
  id?: number | undefined;
233
233
  }[] | undefined;
234
234
  links?: {
@@ -319,7 +319,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
319
319
  output: {
320
320
  screen: {
321
321
  action: string;
322
- method: "POST" | "GET";
322
+ method: "GET" | "POST";
323
323
  components: {
324
324
  id: string;
325
325
  type: string;
@@ -335,7 +335,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
335
335
  hint?: string | undefined;
336
336
  messages?: {
337
337
  text: string;
338
- type: "success" | "error" | "info" | "warning";
338
+ type: "error" | "success" | "info" | "warning";
339
339
  id?: number | undefined;
340
340
  }[] | undefined;
341
341
  }[];
@@ -343,7 +343,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
343
343
  description?: string | undefined;
344
344
  messages?: {
345
345
  text: string;
346
- type: "success" | "error" | "info" | "warning";
346
+ type: "error" | "success" | "info" | "warning";
347
347
  id?: number | undefined;
348
348
  }[] | undefined;
349
349
  links?: {
package/dist/types/routes/universal-login/identifier.d.ts CHANGED
@@ -30,7 +30,7 @@ export declare const identifierRoutes: OpenAPIHono<{
30
30
  } & {
31
31
  form: {
32
32
  username: string;
33
- login_selection?: "password" | "code" | undefined;
33
+ login_selection?: "code" | "password" | undefined;
34
34
  };
35
35
  };
36
36
  output: {};
@@ -44,7 +44,7 @@ export declare const identifierRoutes: OpenAPIHono<{
44
44
  } & {
45
45
  form: {
46
46
  username: string;
47
- login_selection?: "password" | "code" | undefined;
47
+ login_selection?: "code" | "password" | undefined;
48
48
  };
49
49
  };
50
50
  output: {};
package/dist/types/routes/universal-login/index.d.ts CHANGED
@@ -515,7 +515,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
515
515
  } & {
516
516
  form: {
517
517
  username: string;
518
- login_selection?: "password" | "code" | undefined;
518
+ login_selection?: "code" | "password" | undefined;
519
519
  };
520
520
  };
521
521
  output: {};
@@ -529,7 +529,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
529
529
  } & {
530
530
  form: {
531
531
  username: string;
532
- login_selection?: "password" | "code" | undefined;
532
+ login_selection?: "code" | "password" | undefined;
533
533
  };
534
534
  };
535
535
  output: {};
package/dist/types/routes/universal-login/u2-index.d.ts CHANGED
@@ -165,7 +165,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
165
165
  $get: {
166
166
  input: {
167
167
  param: {
168
- screen: "signup" | "impersonate" | "account" | "consent" | "login" | "reset-password" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
168
+ screen: "impersonate" | "login" | "signup" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
169
169
  };
170
170
  } & {
171
171
  query: {
@@ -181,7 +181,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
181
181
  } | {
182
182
  input: {
183
183
  param: {
184
- screen: "signup" | "impersonate" | "account" | "consent" | "login" | "reset-password" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
184
+ screen: "impersonate" | "login" | "signup" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
185
185
  };
186
186
  } & {
187
187
  query: {
@@ -197,7 +197,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
197
197
  } | {
198
198
  input: {
199
199
  param: {
200
- screen: "signup" | "impersonate" | "account" | "consent" | "login" | "reset-password" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
200
+ screen: "impersonate" | "login" | "signup" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
201
201
  };
202
202
  } & {
203
203
  query: {
@@ -217,7 +217,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
217
217
  $post: {
218
218
  input: {
219
219
  param: {
220
- screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
220
+ screen: "impersonate" | "login" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
221
221
  };
222
222
  } & {
223
223
  query: {
@@ -235,7 +235,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
235
235
  } | {
236
236
  input: {
237
237
  param: {
238
- screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
238
+ screen: "impersonate" | "login" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
239
239
  };
240
240
  } & {
241
241
  query: {
package/dist/types/routes/universal-login/u2-routes.d.ts CHANGED
@@ -170,7 +170,7 @@ export declare const u2Routes: OpenAPIHono<{
170
170
  $get: {
171
171
  input: {
172
172
  param: {
173
- screen: "signup" | "impersonate" | "account" | "consent" | "login" | "reset-password" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
173
+ screen: "impersonate" | "login" | "signup" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
174
174
  };
175
175
  } & {
176
176
  query: {
@@ -186,7 +186,7 @@ export declare const u2Routes: OpenAPIHono<{
186
186
  } | {
187
187
  input: {
188
188
  param: {
189
- screen: "signup" | "impersonate" | "account" | "consent" | "login" | "reset-password" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
189
+ screen: "impersonate" | "login" | "signup" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
190
190
  };
191
191
  } & {
192
192
  query: {
@@ -202,7 +202,7 @@ export declare const u2Routes: OpenAPIHono<{
202
202
  } | {
203
203
  input: {
204
204
  param: {
205
- screen: "signup" | "impersonate" | "account" | "consent" | "login" | "reset-password" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
205
+ screen: "impersonate" | "login" | "signup" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
206
206
  };
207
207
  } & {
208
208
  query: {
@@ -222,7 +222,7 @@ export declare const u2Routes: OpenAPIHono<{
222
222
  $post: {
223
223
  input: {
224
224
  param: {
225
- screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
225
+ screen: "impersonate" | "login" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
226
226
  };
227
227
  } & {
228
228
  query: {
@@ -240,7 +240,7 @@ export declare const u2Routes: OpenAPIHono<{
240
240
  } | {
241
241
  input: {
242
242
  param: {
243
- screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
243
+ screen: "impersonate" | "login" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
244
244
  };
245
245
  } & {
246
246
  query: {
package/dist/types/state-machines/login-session.d.ts CHANGED
@@ -204,7 +204,7 @@ export declare const loginSessionMachine: import("xstate").StateMachine<LoginSes
204
204
  }, {
205
205
  type: "passwordResetRequested";
206
206
  params: unknown;
207
- }, never, "pending" | "failed" | "expired" | "authenticated" | "awaiting_email_verification" | "awaiting_mfa" | "awaiting_consent" | "awaiting_hook" | "awaiting_continuation" | "completed", string, import("xstate").NonReducibleUnknown, import("xstate").NonReducibleUnknown, import("xstate").EventObject, import("xstate").MetaObject, {
207
+ }, never, "pending" | "failed" | "expired" | "completed" | "authenticated" | "awaiting_email_verification" | "awaiting_mfa" | "awaiting_consent" | "awaiting_hook" | "awaiting_continuation", string, import("xstate").NonReducibleUnknown, import("xstate").NonReducibleUnknown, import("xstate").EventObject, import("xstate").MetaObject, {
208
208
  id: "loginSession";
209
209
  states: {
210
210
  readonly pending: {};
package/dist/types/types/AuthHeroConfig.d.ts CHANGED
@@ -1,4 +1,4 @@
1
- import { CodeExecutor, Connection, ConnectionInsert, CreateTenantParams, DataAdapters, Hook, ResourceServer, ResourceServerInsert, Role, RoleInsert, Tenant, TenantOperation, TenantOperationKind } from "@authhero/adapter-interfaces";
1
+ import { Action, ActionInsert, ActionUpdate, CodeExecutor, Connection, ConnectionInsert, CreateTenantParams, DataAdapters, Hook, HookCode, HookCodeInsert, HookInsert, ResourceServer, ResourceServerInsert, Role, RoleInsert, Rollout, Tenant, TenantOperation, TenantOperationKind } from "@authhero/adapter-interfaces";
2
2
  import type { RolePermissionHooks, Hooks } from "./Hooks";
3
3
  import type { OutboxMetricsSink } from "./OutboxMetrics";
4
4
  import type { SamlSigner } from "@authhero/saml/core";
@@ -102,6 +102,9 @@ export interface EntityHooksConfig {
102
102
  rolePermissions?: (RolePermissionHooks | undefined)[];
103
103
  connections?: (EntityHooks<Connection, ConnectionInsert> | undefined)[];
104
104
  tenants?: (EntityHooks<Tenant, CreateTenantParams> | undefined)[];
105
+ actions?: (EntityHooks<Action, ActionInsert, ActionUpdate> | undefined)[];
106
+ hooks?: (EntityHooks<Hook, HookInsert> | undefined)[];
107
+ hookCode?: (EntityHooks<HookCode, HookCodeInsert> | undefined)[];
105
108
  }
106
109
  /**
107
110
  * Route extension for the management API.
@@ -126,12 +129,39 @@ export interface ManagementApiExtension {
126
129
  * resolve as soon as the run is enqueued — clients poll
127
130
  * `GET /api/v2/operations/{id}`.
128
131
  */
132
+ /**
133
+ * Creates and controls fleet rollouts of synced config (issue #1499). Kept
134
+ * structural, like {@link TenantOperationExecutorBinding}: the multi-tenancy
135
+ * package's `createRolloutController` satisfies it.
136
+ */
137
+ export interface RolloutControllerBinding {
138
+ create(params: {
139
+ rootTenantId?: string;
140
+ tenantIds?: string[];
141
+ canary?: number;
142
+ waves?: number[];
143
+ failureThreshold?: number;
144
+ maxConcurrent?: number;
145
+ dryRun?: boolean;
146
+ force?: boolean;
147
+ initiatedBy?: string;
148
+ }): Promise<Rollout>;
149
+ pause(id: string, reason?: string): Promise<Rollout | null>;
150
+ resume(id: string): Promise<Rollout | null>;
151
+ }
129
152
  export interface TenantOperationExecutorBinding {
130
153
  engine: string;
154
+ /**
155
+ * The kinds this executor can run. Absent means any. A request for another
156
+ * kind is answered `501` without creating an operation.
157
+ */
158
+ kinds?: readonly TenantOperationKind[];
131
159
  enqueue(params: {
132
160
  kind: TenantOperationKind;
133
161
  tenant_id: string | null;
134
162
  initiated_by?: string;
163
+ /** Kind-specific parameters, fixed at creation. Never contains secrets. */
164
+ input?: Record<string, unknown>;
135
165
  }): Promise<TenantOperation>;
136
166
  }
137
167
  /**
@@ -537,6 +567,12 @@ export interface AuthHeroConfig {
537
567
  * satisfy this shape.
538
568
  */
539
569
  tenantOperationExecutor?: TenantOperationExecutorBinding;
570
+ /**
571
+ * Creates and controls fleet rollouts of synced config. Drives
572
+ * `POST /api/v2/rollouts` and the pause and resume routes; reading rollouts
573
+ * only needs the `rollouts` adapter.
574
+ */
575
+ rolloutController?: RolloutControllerBinding;
540
576
  /**
541
577
  * Maximum accepted size of a bulk user-import file, in bytes
542
578
  * (`POST /api/v2/jobs/users-imports`). Defaults to Auth0's documented
package/dist/types/types/Bindings.d.ts CHANGED
@@ -2,7 +2,7 @@ import type { SigningCertificateAuthority } from "../helpers/signing-certificate
2
2
  import { CodeExecutor, DataAdapters } from "@authhero/adapter-interfaces";
3
3
  import type { SamlSigner } from "@authhero/saml/core";
4
4
  import { Hooks } from "./Hooks";
5
- import { ActionExecutionLogCapture, EntityHooksConfig, McpConfig, OutboxConfig, SigningKeyModeOption, TenantOperationExecutorBinding, UserLinkingModeOption, UsernamePasswordProviderResolver, WebhookInvoker } from "./AuthHeroConfig";
5
+ import { ActionExecutionLogCapture, EntityHooksConfig, McpConfig, OutboxConfig, SigningKeyModeOption, RolloutControllerBinding, TenantOperationExecutorBinding, UserLinkingModeOption, UsernamePasswordProviderResolver, WebhookInvoker } from "./AuthHeroConfig";
6
6
  import { StrategyHandler } from "../strategies";
7
7
  export type Bindings = {
8
8
  ENVIRONMENT: string;
@@ -42,6 +42,7 @@ export type Bindings = {
42
42
  webhookInvoker?: WebhookInvoker;
43
43
  tenantUpgrade?: (tenantId: string) => Promise<void>;
44
44
  tenantOperationExecutor?: TenantOperationExecutorBinding;
45
+ rolloutController?: RolloutControllerBinding;
45
46
  usersImportMaxBytes?: number;
46
47
  usersImportMaxConcurrentJobs?: number;
47
48
  unsafeAllowAzpCustomClaim?: boolean;
package/dist/types/types/Variables.d.ts CHANGED
@@ -29,6 +29,11 @@ export type Variables = {
29
29
  * twice. Read it through `getBaseData`.
30
30
  */
31
31
  baseData?: DataAdapters;
32
+ /**
33
+ * Management API only: the request stack before platform-scoped rows are
34
+ * hidden from it. Code-hook execution reads this; see `getExecutorData`.
35
+ */
36
+ executorData?: DataAdapters;
32
37
  tenant_id: string;
33
38
  ip: string;
34
39
  client_id?: string;
package/dist/types/utils/field-encryption.d.ts CHANGED
@@ -42,6 +42,13 @@ export declare function decryptField(value: string, key: CryptoKey): Promise<str
42
42
  * ring's default key and is byte-compatible with `encryptField` (legacy form).
43
43
  */
44
44
  export declare function encryptFieldWithRing(plaintext: string, ring: KeyRing, keyId?: string): Promise<EncryptedField>;
45
+ /**
46
+ * Whether `ring` can decrypt `value`. Plaintext values are trivially readable.
47
+ * For ciphertext this checks that the key id embedded in it is in the ring and
48
+ * that decryption succeeds (a key can be present but wrong). Never throws and
49
+ * never returns the plaintext.
50
+ */
51
+ export declare function canDecrypt(value: string, ring: KeyRing): Promise<boolean>;
45
52
  /**
46
53
  * Decrypts a value using a key ring, selecting the key from the id embedded in
47
54
  * the ciphertext (or the default key for legacy unkeyed values). Plaintext
package/dist/types/utils/jwks.d.ts CHANGED
@@ -9,7 +9,7 @@ import { CertificateIssuer } from "../helpers/signing-certificate-authority";
9
9
  */
10
10
  export declare function getJwksForPublication(data: DataAdapters, tenantId: string, modeOption: SigningKeyModeOption | undefined, certificateIssuer?: CertificateIssuer): Promise<{
11
11
  kty: "EC" | "RSA" | "oct";
12
- alg?: "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | undefined;
12
+ alg?: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "HS256" | "HS384" | "HS512" | undefined;
13
13
  kid?: string | undefined;
14
14
  use?: "sig" | "enc" | undefined;
15
15
  n?: string | undefined;
@@ -29,7 +29,7 @@ export declare function getJwksForPublication(data: DataAdapters, tenantId: stri
29
29
  */
30
30
  export declare function getJwksForVerification(data: DataAdapters, tenantId: string | undefined, modeOption: SigningKeyModeOption | undefined): Promise<{
31
31
  kty: "EC" | "RSA" | "oct";
32
- alg?: "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | undefined;
32
+ alg?: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "HS256" | "HS384" | "HS512" | undefined;
33
33
  kid?: string | undefined;
34
34
  use?: "sig" | "enc" | undefined;
35
35
  n?: string | undefined;
package/package.json CHANGED
@@ -11,7 +11,7 @@
11
11
  "type": "git",
12
12
  "url": "https://github.com/sesamyab/authhero"
13
13
  },
14
- "version": "9.25.0",
14
+ "version": "9.26.0",
15
15
  "files": [
16
16
  "dist"
17
17
  ],
@@ -63,8 +63,8 @@
63
63
  "vite": "^8.0.14",
64
64
  "vite-plugin-dts": "^4.5.4",
65
65
  "vitest": "^4.1.7",
66
- "@authhero/kysely-adapter": "12.16.0",
67
- "@authhero/widget": "0.41.4"
66
+ "@authhero/kysely-adapter": "12.17.0",
67
+ "@authhero/widget": "0.41.5"
68
68
  },
69
69
  "dependencies": {
70
70
  "@peculiar/x509": "^1.14.3",
@@ -80,9 +80,9 @@
80
80
  "qrcode": "^1.5.4",
81
81
  "sanitize-html": "^2.17.4",
82
82
  "xstate": "^5.31.1",
83
- "@authhero/adapter-interfaces": "4.22.0",
84
- "@authhero/proxy": "0.11.8",
85
- "@authhero/saml": "0.6.1"
83
+ "@authhero/adapter-interfaces": "4.23.0",
84
+ "@authhero/proxy": "0.11.9",
85
+ "@authhero/saml": "0.6.2"
86
86
  },
87
87
  "peerDependencies": {
88
88
  "@authhero/widget": "^0.1.0",