authhero 9.25.0 → 9.27.0

package/dist/types/routes/universal-login/u2-index.d.ts

@@ -165,7 +165,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         $get: {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "account" | "consent" | "login" | "reset-password" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant" | "device/code" | "device/confirmation" | "device/complete";
                 };
             } & {
                 query: {
@@ -181,7 +181,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "account" | "consent" | "login" | "reset-password" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant" | "device/code" | "device/confirmation" | "device/complete";
                 };
             } & {
                 query: {
@@ -197,7 +197,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "account" | "consent" | "login" | "reset-password" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant" | "device/code" | "device/confirmation" | "device/complete";
                 };
             } & {
                 query: {
@@ -217,7 +217,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         $post: {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "enter-password" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant" | "device/code" | "device/confirmation";
                 };
             } & {
                 query: {
@@ -235,7 +235,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "enter-password" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant" | "device/code" | "device/confirmation";
                 };
             } & {
                 query: {

package/dist/types/routes/universal-login/u2-routes.d.ts

@@ -170,7 +170,7 @@ export declare const u2Routes: OpenAPIHono<{
         $get: {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "account" | "consent" | "login" | "reset-password" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant" | "device/code" | "device/confirmation" | "device/complete";
                 };
             } & {
                 query: {
@@ -186,7 +186,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "account" | "consent" | "login" | "reset-password" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant" | "device/code" | "device/confirmation" | "device/complete";
                 };
             } & {
                 query: {
@@ -202,7 +202,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "account" | "consent" | "login" | "reset-password" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant" | "device/code" | "device/confirmation" | "device/complete";
                 };
             } & {
                 query: {
@@ -222,7 +222,7 @@ export declare const u2Routes: OpenAPIHono<{
         $post: {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "enter-password" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant" | "device/code" | "device/confirmation";
                 };
             } & {
                 query: {
@@ -240,7 +240,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/email-verification" | "login/email-verification-sent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "enter-password" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "login/email-verification" | "login/email-verification-sent" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant" | "device/code" | "device/confirmation";
                 };
             } & {
                 query: {

package/dist/types/state-machines/login-session.d.ts

@@ -22,6 +22,11 @@ export interface LoginSessionData {
     inviter_name?: string;
     roles?: string[];
     connect?: Record<string, unknown>;
+    deviceFlow?: {
+        deviceCodeHash?: string;
+        userCode?: string;
+        ready?: boolean;
+    };
     try_connection_result?: unknown;
 }
 /** The on-disk JSON shape stays flat for compatibility with existing sessions. */
@@ -204,7 +209,7 @@ export declare const loginSessionMachine: import("xstate").StateMachine<LoginSes
 }, {
     type: "passwordResetRequested";
     params: unknown;
-}, never, "pending" | "failed" | "expired" | "authenticated" | "awaiting_email_verification" | "awaiting_mfa" | "awaiting_consent" | "awaiting_hook" | "awaiting_continuation" | "completed", string, import("xstate").NonReducibleUnknown, import("xstate").NonReducibleUnknown, import("xstate").EventObject, import("xstate").MetaObject, {
+}, never, "pending" | "failed" | "expired" | "completed" | "authenticated" | "awaiting_email_verification" | "awaiting_mfa" | "awaiting_consent" | "awaiting_hook" | "awaiting_continuation", string, import("xstate").NonReducibleUnknown, import("xstate").NonReducibleUnknown, import("xstate").EventObject, import("xstate").MetaObject, {
     id: "loginSession";
     states: {
         readonly pending: {};

package/dist/types/tenant-members/request-notifier.d.ts

@@ -0,0 +1,9 @@
+import type { ControlPlaneClient } from "../helpers/control-plane-client";
+import type { AfterTenantMemberRequestRegistered } from "./requests";
+/**
+ * Tells the control plane, over the shared control-plane client, that a
+ * request is waiting, and records that it was told. If the control plane is
+ * down the request simply stays unnotified and a control-plane sweep finds it
+ * later, so this never throws.
+ */
+export declare function createControlPlaneRequestNotifier(client: ControlPlaneClient): AfterTenantMemberRequestRegistered;

package/dist/types/tenant-members/request-notify.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/types/tenant-members/requests.d.ts

@@ -0,0 +1,79 @@
+import { z } from "@hono/zod-openapi";
+import type { Context } from "hono";
+import type { TenantMemberRequest } from "@authhero/adapter-interfaces";
+import type { Bindings, Variables } from "../types";
+import { TenantMembersBackend } from "./types";
+/** What each kind of request carries in `payload`. */
+export declare const tenantMemberRequestPayloadSchemas: {
+    invite: z.ZodObject<{
+        invitee: z.ZodObject<{
+            email: z.ZodString;
+        }, z.core.$strip>;
+        inviter: z.ZodDefault<z.ZodObject<{
+            name: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        roles: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+        send_invitation_email: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        ttl_sec: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>;
+    add_members: z.ZodObject<{
+        user_ids: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+    remove_members: z.ZodObject<{
+        user_ids: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+    assign_roles: z.ZodObject<{
+        user_id: z.ZodString;
+        roles: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+    remove_roles: z.ZodObject<{
+        user_id: z.ZodString;
+        roles: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+    revoke_invitation: z.ZodObject<{
+        invitation_id: z.ZodString;
+    }, z.core.$strip>;
+};
+type Ctx = Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>;
+/**
+ * What a deployment does once a request is stored, given the stored row. A
+ * shard tells the control plane (`createControlPlaneRequestNotifier`), a
+ * single-instance deployment runs it right away. A failure here never fails
+ * the registration: the request stays `pending` and is picked up later.
+ */
+export type AfterTenantMemberRequestRegistered = (ctx: Ctx, request: TenantMemberRequest) => Promise<void>;
+export interface TenantMemberRequestsConfig {
+    afterRegister?: AfterTenantMemberRequestRegistered;
+}
+/**
+ * The request cannot be carried out, for a reason an admin may read: it is not
+ * a failure of the system, so it is not retried.
+ */
+export declare class TenantMemberRequestRejected extends Error {
+    constructor(reason: string);
+}
+export interface ExecuteTenantMemberRequestOptions {
+    /**
+     * Whether the requester may still change this tenant's team. Defaults to
+     * holding at least one role in the tenant's organization.
+     */
+    isRequesterAllowed?: (backend: TenantMembersBackend, tenantId: string, userId: string) => Promise<boolean>;
+}
+/**
+ * Carries out one request against the control-plane team of its tenant.
+ *
+ * `tenantId` is the tenant the caller proved it speaks for (the verified
+ * service token's `tenant_id`); a request that names another tenant is
+ * refused. The requester is checked again here because the request may have
+ * waited a while. Running it twice is safe: membership and role changes are
+ * idempotent, and an invitation that was already created for the same address
+ * is reused instead of created again.
+ *
+ * Returns what the request produced, to store on the row. Throws
+ * {@link TenantMemberRequestRejected} when it must not or cannot run.
+ */
+export declare function executeTenantMemberRequest(backend: TenantMembersBackend, tenantId: string, request: Pick<TenantMemberRequest, "tenant_id" | "kind" | "requested_by" | "payload" | "result">, options?: ExecuteTenantMemberRequestOptions): Promise<Record<string, unknown> | null>;
+export {};

package/dist/types/tenant-members/requests.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/types/tenant-members/wire.d.ts

@@ -26,3 +26,13 @@ export declare const createInvitationBodySchema: z.ZodObject<{
     ttl_sec: z.ZodOptional<z.ZodNumber>;
     tenant_id: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
+/**
+ * A shard tells the control plane that a team-change request is waiting
+ * (issue #1550). Only the id travels: the control plane reads the request from
+ * the shard, so what was asked never rests on what the notification claims.
+ */
+export declare const CONTROL_PLANE_TENANT_MEMBER_REQUESTS_NOTIFY_PATH = "/api/v2/proxy/control-plane/tenant-members/requests/notify";
+export declare const notifyMemberRequestBodySchema: z.ZodObject<{
+    request_id: z.ZodString;
+    tenant_id: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;

package/dist/types/types/AuthHeroConfig.d.ts

@@ -1,4 +1,4 @@
-import { CodeExecutor, Connection, ConnectionInsert, CreateTenantParams, DataAdapters, Hook, ResourceServer, ResourceServerInsert, Role, RoleInsert, Tenant, TenantOperation, TenantOperationKind } from "@authhero/adapter-interfaces";
+import { Action, ActionInsert, ActionUpdate, CodeExecutor, Connection, ConnectionInsert, CreateTenantParams, DataAdapters, Hook, HookCode, HookCodeInsert, HookInsert, ResourceServer, ResourceServerInsert, Role, RoleInsert, Rollout, Tenant, TenantOperation, TenantOperationKind } from "@authhero/adapter-interfaces";
 import type { RolePermissionHooks, Hooks } from "./Hooks";
 import type { OutboxMetricsSink } from "./OutboxMetrics";
 import type { SamlSigner } from "@authhero/saml/core";
@@ -102,6 +102,9 @@ export interface EntityHooksConfig {
     rolePermissions?: (RolePermissionHooks | undefined)[];
     connections?: (EntityHooks<Connection, ConnectionInsert> | undefined)[];
     tenants?: (EntityHooks<Tenant, CreateTenantParams> | undefined)[];
+    actions?: (EntityHooks<Action, ActionInsert, ActionUpdate> | undefined)[];
+    hooks?: (EntityHooks<Hook, HookInsert> | undefined)[];
+    hookCode?: (EntityHooks<HookCode, HookCodeInsert> | undefined)[];
 }
 /**
  * Route extension for the management API.
@@ -126,12 +129,39 @@ export interface ManagementApiExtension {
  * resolve as soon as the run is enqueued — clients poll
  * `GET /api/v2/operations/{id}`.
  */
+/**
+ * Creates and controls fleet rollouts of synced config (issue #1499). Kept
+ * structural, like {@link TenantOperationExecutorBinding}: the multi-tenancy
+ * package's `createRolloutController` satisfies it.
+ */
+export interface RolloutControllerBinding {
+    create(params: {
+        rootTenantId?: string;
+        tenantIds?: string[];
+        canary?: number;
+        waves?: number[];
+        failureThreshold?: number;
+        maxConcurrent?: number;
+        dryRun?: boolean;
+        force?: boolean;
+        initiatedBy?: string;
+    }): Promise<Rollout>;
+    pause(id: string, reason?: string): Promise<Rollout | null>;
+    resume(id: string): Promise<Rollout | null>;
+}
 export interface TenantOperationExecutorBinding {
     engine: string;
+    /**
+     * The kinds this executor can run. Absent means any. A request for another
+     * kind is answered `501` without creating an operation.
+     */
+    kinds?: readonly TenantOperationKind[];
     enqueue(params: {
         kind: TenantOperationKind;
         tenant_id: string | null;
         initiated_by?: string;
+        /** Kind-specific parameters, fixed at creation. Never contains secrets. */
+        input?: Record<string, unknown>;
     }): Promise<TenantOperation>;
 }
 /**
@@ -452,6 +482,16 @@ export interface AuthHeroConfig {
      */
     tenantMembers?: {
         getBackend: import("../routes/management-api/tenant-members").GetTenantMembersBackend;
+        /**
+         * Register team changes as requests instead of making them in the request
+         * (issue #1550). Needs `tenantMemberRequests` on the data adapter. A write
+         * then answers `202` with the request id, `GET /tenant-members/requests`
+         * lists them, and `afterRegister` decides what happens next: a shard tells
+         * the control plane (`createControlPlaneRequestNotifier`), a
+         * single-instance deployment runs the request right away. Unset keeps the
+         * synchronous writes.
+         */
+        requests?: import("../tenant-members/requests").TenantMemberRequestsConfig;
     };
     /**
      * Optional outbox-driven replication of `proxy_routes` mutations to a global
@@ -537,6 +577,12 @@ export interface AuthHeroConfig {
      * satisfy this shape.
      */
     tenantOperationExecutor?: TenantOperationExecutorBinding;
+    /**
+     * Creates and controls fleet rollouts of synced config. Drives
+     * `POST /api/v2/rollouts` and the pause and resume routes; reading rollouts
+     * only needs the `rollouts` adapter.
+     */
+    rolloutController?: RolloutControllerBinding;
     /**
      * Maximum accepted size of a bulk user-import file, in bytes
      * (`POST /api/v2/jobs/users-imports`). Defaults to Auth0's documented

package/dist/types/types/Bindings.d.ts

@@ -2,7 +2,7 @@ import type { SigningCertificateAuthority } from "../helpers/signing-certificate
 import { CodeExecutor, DataAdapters } from "@authhero/adapter-interfaces";
 import type { SamlSigner } from "@authhero/saml/core";
 import { Hooks } from "./Hooks";
-import { ActionExecutionLogCapture, EntityHooksConfig, McpConfig, OutboxConfig, SigningKeyModeOption, TenantOperationExecutorBinding, UserLinkingModeOption, UsernamePasswordProviderResolver, WebhookInvoker } from "./AuthHeroConfig";
+import { ActionExecutionLogCapture, EntityHooksConfig, McpConfig, OutboxConfig, SigningKeyModeOption, RolloutControllerBinding, TenantOperationExecutorBinding, UserLinkingModeOption, UsernamePasswordProviderResolver, WebhookInvoker } from "./AuthHeroConfig";
 import { StrategyHandler } from "../strategies";
 export type Bindings = {
     ENVIRONMENT: string;
@@ -42,6 +42,7 @@ export type Bindings = {
     webhookInvoker?: WebhookInvoker;
     tenantUpgrade?: (tenantId: string) => Promise<void>;
     tenantOperationExecutor?: TenantOperationExecutorBinding;
+    rolloutController?: RolloutControllerBinding;
     usersImportMaxBytes?: number;
     usersImportMaxConcurrentJobs?: number;
     unsafeAllowAzpCustomClaim?: boolean;

package/dist/types/types/Variables.d.ts

@@ -1,4 +1,4 @@
-import { DataAdapters, LoginSession } from "@authhero/adapter-interfaces";
+import { DataAdapters, LoginSession, RequestAuth } from "@authhero/adapter-interfaces";
 import { CountryCode } from "libphonenumber-js";
 import { Auth0Client } from "./Auth0Client";
 import type { PreferState } from "../middlewares/prefer";
@@ -29,11 +29,18 @@ export type Variables = {
      * twice. Read it through `getBaseData`.
      */
     baseData?: DataAdapters;
+    /**
+     * Management API only: the request stack before platform-scoped rows are
+     * hidden from it. Code-hook execution reads this; see `getExecutorData`.
+     */
+    executorData?: DataAdapters;
     tenant_id: string;
     ip: string;
     client_id?: string;
     user_id?: string;
     username?: string;
+    /** Verified account-session caller, captured before account mutations. */
+    sessionAuth?: RequestAuth;
     connection?: string;
     body?: any;
     /**

package/dist/types/utils/field-encryption.d.ts

@@ -42,6 +42,13 @@ export declare function decryptField(value: string, key: CryptoKey): Promise<str
  * ring's default key and is byte-compatible with `encryptField` (legacy form).
  */
 export declare function encryptFieldWithRing(plaintext: string, ring: KeyRing, keyId?: string): Promise<EncryptedField>;
+/**
+ * Whether `ring` can decrypt `value`. Plaintext values are trivially readable.
+ * For ciphertext this checks that the key id embedded in it is in the ring and
+ * that decryption succeeds (a key can be present but wrong). Never throws and
+ * never returns the plaintext.
+ */
+export declare function canDecrypt(value: string, ring: KeyRing): Promise<boolean>;
 /**
  * Decrypts a value using a key ring, selecting the key from the id embedded in
  * the ciphertext (or the default key for legacy unkeyed values). Plaintext

package/dist/types/utils/jwks.d.ts

@@ -9,7 +9,7 @@ import { CertificateIssuer } from "../helpers/signing-certificate-authority";
  */
 export declare function getJwksForPublication(data: DataAdapters, tenantId: string, modeOption: SigningKeyModeOption | undefined, certificateIssuer?: CertificateIssuer): Promise<{
     kty: "EC" | "RSA" | "oct";
-    alg?: "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | undefined;
+    alg?: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "HS256" | "HS384" | "HS512" | undefined;
     kid?: string | undefined;
     use?: "sig" | "enc" | undefined;
     n?: string | undefined;
@@ -29,7 +29,7 @@ export declare function getJwksForPublication(data: DataAdapters, tenantId: stri
  */
 export declare function getJwksForVerification(data: DataAdapters, tenantId: string | undefined, modeOption: SigningKeyModeOption | undefined): Promise<{
     kty: "EC" | "RSA" | "oct";
-    alg?: "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | undefined;
+    alg?: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "HS256" | "HS384" | "HS512" | undefined;
     kid?: string | undefined;
     use?: "sig" | "enc" | undefined;
     n?: string | undefined;

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/sesamyab/authhero"
   },
-  "version": "9.25.0",
+  "version": "9.27.0",
   "files": [
     "dist"
   ],
@@ -63,8 +63,8 @@
     "vite": "^8.0.14",
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^4.1.7",
-    "@authhero/kysely-adapter": "12.16.0",
-    "@authhero/widget": "0.41.4"
+    "@authhero/kysely-adapter": "12.18.0",
+    "@authhero/widget": "0.41.7"
   },
   "dependencies": {
     "@peculiar/x509": "^1.14.3",
@@ -80,9 +80,9 @@
     "qrcode": "^1.5.4",
     "sanitize-html": "^2.17.4",
     "xstate": "^5.31.1",
-    "@authhero/adapter-interfaces": "4.22.0",
-    "@authhero/proxy": "0.11.8",
-    "@authhero/saml": "0.6.1"
+    "@authhero/adapter-interfaces": "4.24.0",
+    "@authhero/proxy": "0.11.10",
+    "@authhero/saml": "0.6.3"
   },
   "peerDependencies": {
     "@authhero/widget": "^0.1.0",