authhero 9.25.0 → 9.27.0

package/dist/types/adapters/createEncryptedDataAdapter.d.ts

@@ -22,7 +22,8 @@ interface EncryptionOptions {
  * Encrypted columns: clients.client_secret, connections.options
  * (client_secret/app_secret/twilio_token/configuration.client_secret),
  * email_providers.credentials, authentication_methods.totp_secret,
- * migration_sources.credentials.client_secret.
+ * migration_sources.credentials.client_secret, actions.secrets[].value,
+ * action_versions.secrets[].value, hook_code.secrets values.
  *
  * clientConnections.listByClient is also wrapped so its returned Connection
  * objects are decrypted — getEnrichedClient uses this path to load connections

package/dist/types/adapters/index.d.ts

@@ -1,5 +1,5 @@
 export * from "./cache";
 export { createEncryptedDataAdapter, createEncryptedDataAdapterWithKeyRing, } from "./createEncryptedDataAdapter";
 export type { EncryptKeyIdResolver } from "./createEncryptedDataAdapter";
-export { loadEncryptionKey, encryptField, decryptField, encryptFieldWithRing, decryptFieldWithRing, parseKeyId, isEncrypted, } from "../utils/field-encryption";
+export { loadEncryptionKey, encryptField, decryptField, encryptFieldWithRing, decryptFieldWithRing, parseKeyId, isEncrypted, canDecrypt, } from "../utils/field-encryption";
 export type { KeyRing } from "../utils/field-encryption";

package/dist/types/authentication-flows/device-code.d.ts

@@ -0,0 +1,11 @@
+import { z } from "@hono/zod-openapi";
+import { type DeviceContext } from "../helpers/device-flow";
+import type { EnrichedClient } from "../helpers/client";
+import type { GrantFlowUserResult } from "../types/GrantFlowResult";
+export declare const deviceCodeGrantParamsSchema: z.ZodObject<{
+    grant_type: z.ZodLiteral<"urn:ietf:params:oauth:grant-type:device_code">;
+    device_code: z.ZodString;
+    client_id: z.ZodString;
+    client_secret: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare function deviceCodeGrant(ctx: DeviceContext, params: z.infer<typeof deviceCodeGrantParamsSchema>, client: EnrichedClient): Promise<GrantFlowUserResult>;

package/dist/types/authentication-flows/passwordless.d.ts

@@ -137,6 +137,9 @@ export declare function passwordlessGrantUser(ctx: Context<{
             friendly_name: string;
             id: string;
             parent_tenant_id?: string | null | undefined;
+            config_sync?: "inherit-on-read" | "synced" | "detached" | null | undefined;
+            config_sync_hash?: string | null | undefined;
+            config_synced_at?: string | null | undefined;
             audience?: string | undefined;
             picture_url?: string | undefined;
             support_email?: string | undefined;
@@ -240,7 +243,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
             pushed_authorization_requests_supported?: boolean | undefined;
             authorization_response_iss_parameter_supported?: boolean | undefined;
             deployment_type?: "shared" | "wfp" | undefined;
-            provisioning_state?: "pending" | "ready" | "failed" | undefined;
+            provisioning_state?: "pending" | "failed" | "ready" | undefined;
             provisioning_error?: string | undefined;
             provisioning_state_changed_at?: string | undefined;
             bundle_configuration?: string | undefined;
@@ -313,6 +316,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                 } | undefined;
             } | undefined;
             is_control_plane?: boolean | undefined;
+            has_children?: boolean | undefined;
         };
         connections: {
             created_at: string;
@@ -387,7 +391,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                         } | undefined;
                         unique?: boolean | undefined;
                         profile_required?: boolean | undefined;
-                        verification_method?: "link" | "code" | undefined;
+                        verification_method?: "code" | "link" | undefined;
                     } | undefined;
                     username?: {
                         identifier?: {
@@ -437,7 +441,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                 } | undefined;
                 set_user_root_attributes?: "on_each_login" | "on_first_login" | "never_on_login" | undefined;
             };
-            scope?: "shared" | "local" | "platform" | undefined;
+            scope?: "local" | "shared" | "platform" | undefined;
             override?: "none" | "secrets" | "fields" | undefined;
             enforce?: boolean | undefined;
             id?: string | undefined;
@@ -565,8 +569,8 @@ export declare function passwordlessGrantUser(ctx: Context<{
         } | undefined;
         authenticated_at?: string | undefined;
     };
-    connectionType: "username" | "email" | "sms";
-    authConnection: "username" | "email" | "sms";
+    connectionType: "email" | "username" | "sms";
+    authConnection: "email" | "username" | "sms";
     session_id: string | undefined;
     authParams: {
         audience?: string | undefined;

package/dist/types/errors/management-api-error.d.ts

@@ -0,0 +1,113 @@
+import { Context } from "hono";
+import { ContentfulStatusCode } from "hono/utils/http-status";
+import { JSONHTTPException } from "./json-http-exception";
+/**
+ * Management API errors in Auth0's wire shape. Auth0 SDKs (go-auth0, the
+ * Terraform provider, node-auth0) parse `{ statusCode, error, message,
+ * errorCode }` and branch on `errorCode`.
+ *
+ * The bodies below are a superset of Auth0's: where Auth0 returns a message or
+ * errorCode we return the same bytes (captured from a live tenant, see
+ * apps/docs/api/error-codes.md), and where Auth0 omits `errorCode` we add one.
+ * Every added code is listed under "AuthHero extensions" in that doc page —
+ * keep the two in sync.
+ */
+export declare const ERROR_TEXT_BY_STATUS: Record<number, string>;
+export interface ManagementErrorBody {
+    statusCode: number;
+    error: string;
+    message: string;
+    errorCode?: string;
+}
+export declare function managementErrorBody(status: number, message: string, errorCode?: string): ManagementErrorBody;
+export declare function managementError(status: ContentfulStatusCode, message: string, errorCode?: string): JSONHTTPException;
+/**
+ * 404s per resource. Messages marked "auth0" are byte-identical to Auth0
+ * (including its inconsistent trailing periods); the rest are AuthHero
+ * resources or Auth0 resources without an errorCode, and follow the
+ * `The <resource> does not exist.` / `inexistent_<resource>` convention.
+ */
+export declare const notFound: {
+    user: () => JSONHTTPException;
+    users: () => JSONHTTPException;
+    client: () => JSONHTTPException;
+    clientOnUpdate: () => JSONHTTPException;
+    connection: () => JSONHTTPException;
+    resourceServer: () => JSONHTTPException;
+    resourceServerByIdentifier: (identifier: string) => JSONHTTPException;
+    clientGrant: () => JSONHTTPException;
+    log: () => JSONHTTPException;
+    job: () => JSONHTTPException;
+    customDomain: (id: string) => JSONHTTPException;
+    key: (kid: string) => JSONHTTPException;
+    hook: () => JSONHTTPException;
+    enrollment: () => JSONHTTPException;
+    role: () => JSONHTTPException;
+    roleOnUpdate: () => JSONHTTPException;
+    organization: () => JSONHTTPException;
+    action: () => JSONHTTPException;
+    tenant: () => JSONHTTPException;
+    invitation: () => JSONHTTPException;
+    member: () => JSONHTTPException;
+    identity: () => JSONHTTPException;
+    session: () => JSONHTTPException;
+    refreshToken: () => JSONHTTPException;
+    grant: () => JSONHTTPException;
+    logStream: () => JSONHTTPException;
+    form: () => JSONHTTPException;
+    flow: () => JSONHTTPException;
+    emailTemplate: () => JSONHTTPException;
+    emailProvider: () => JSONHTTPException;
+    authenticationMethod: () => JSONHTTPException;
+    actionExecution: () => JSONHTTPException;
+    actionVersion: () => JSONHTTPException;
+    hookCode: () => JSONHTTPException;
+    failedEvent: () => JSONHTTPException;
+    migrationSource: () => JSONHTTPException;
+    proxyRoute: () => JSONHTTPException;
+    scimConfiguration: () => JSONHTTPException;
+    scimToken: () => JSONHTTPException;
+    tenantOperation: () => JSONHTTPException;
+    rollout: () => JSONHTTPException;
+    tokenExchangeProfile: () => JSONHTTPException;
+};
+/**
+ * 409s. `userExists`, `resourceServer` and `organizationName` are Auth0's
+ * bodies (the "identifer" typo is Auth0's, kept byte-identical); the
+ * organization errorCode is added.
+ */
+export declare const conflict: {
+    userExists: () => JSONHTTPException;
+    resourceServer: (identifier: string) => JSONHTTPException;
+    organizationName: () => JSONHTTPException;
+    /** Any other AuthHero conflict: own message, shared code. */
+    other: (message: string) => JSONHTTPException;
+};
+export declare const authErrors: {
+    missingAuthentication: () => JSONHTTPException;
+    invalidToken: (message?: string) => JSONHTTPException;
+    insufficientScope: (expected: string[]) => JSONHTTPException;
+};
+/**
+ * Formats zod issues the way Auth0 does:
+ * `Payload validation error: 'Missing required property: name'.`, joined with
+ * ` (also) ` when there are several. Auth0 also appends each property's
+ * schema description, which we don't have at this layer.
+ */
+export declare function formatValidationMessage(target: string, issues: unknown[], data: unknown): ManagementErrorBody;
+/**
+ * `defaultHook` for every management-api OpenAPIHono app. The hook is the only
+ * place zod-openapi exposes which part of the request failed, which is what
+ * picks Auth0's invalid_body / invalid_query_string / invalid_uri code.
+ */
+export declare function managementValidationHook(result: {
+    success: boolean;
+    target: string;
+    data?: unknown;
+    error?: unknown;
+}, ctx: Context): (Response & import("hono").TypedResponse<{
+    statusCode: number;
+    error: string;
+    message: string;
+    errorCode?: string | undefined;
+}, 400, "json">) | undefined;

package/dist/types/generated/locale-types.d.ts

@@ -254,6 +254,22 @@ export interface DeviceFlowScreen {
         clientName: string;
     }) => string;
     title: () => string;
+    codeLabel: () => string;
+    confirmTitle: () => string;
+    confirmDescription: () => string;
+    requestDescription: (vars: {
+        clientName: string;
+    }) => string;
+    scopesLabel: () => string;
+    audienceLabel: () => string;
+    decisionLabel: () => string;
+    approveText: () => string;
+    denyText: () => string;
+    completeTitle: () => string;
+    approvedDescription: () => string;
+    deniedDescription: () => string;
+    alreadyCompleted: () => string;
+    sessionExpired: () => string;
 }
 export interface EmailOtpChallengeScreen {
     buttonText: () => string;

package/dist/types/helpers/client.d.ts

@@ -146,6 +146,13 @@ export declare const enrichedClientSchema: z.ZodObject<{
         created_at: z.ZodPipe<z.ZodNullable<z.ZodString>, z.ZodTransform<string, string | null>>;
         updated_at: z.ZodPipe<z.ZodNullable<z.ZodString>, z.ZodTransform<string, string | null>>;
         parent_tenant_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        config_sync: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+            "inherit-on-read": "inherit-on-read";
+            synced: "synced";
+            detached: "detached";
+        }>>>;
+        config_sync_hash: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        config_synced_at: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         audience: z.ZodOptional<z.ZodString>;
         friendly_name: z.ZodString;
         picture_url: z.ZodOptional<z.ZodString>;
@@ -349,6 +356,7 @@ export declare const enrichedClientSchema: z.ZodObject<{
         }, z.core.$strip>>;
         id: z.ZodString;
         is_control_plane: z.ZodOptional<z.ZodBoolean>;
+        has_children: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>;
     connections: z.ZodArray<z.ZodObject<{
         created_at: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;

package/dist/types/helpers/codes-cleanup.d.ts

@@ -25,4 +25,4 @@ export interface CodesCleanupParams {
  * }
  * ```
  */
-export declare function cleanupCodes(codes: CodesAdapter, params?: CodesCleanupParams): Promise<number>;
+export declare function cleanupCodes(codes: Pick<CodesAdapter, "cleanup">, params?: CodesCleanupParams): Promise<number>;

package/dist/types/helpers/control-plane-caller.d.ts

@@ -0,0 +1,15 @@
+/**
+ * True when the caller's token comes from the control plane (or the deployment
+ * is single-tenant, which is effectively a control plane). Organization-scoped
+ * tokens are tenant-level credentials and do not count.
+ */
+export declare function callerIsControlPlane(ctx: {
+    env: {
+        data: {
+            multiTenancyConfig?: {
+                controlPlaneTenantId?: string;
+            };
+        };
+    };
+    var: object;
+}): boolean;

package/dist/types/helpers/device-flow.d.ts

@@ -0,0 +1,25 @@
+import type { Context } from "hono";
+import type { DataAdapters, LoginSession } from "@authhero/adapter-interfaces";
+import type { Bindings, Variables } from "../types";
+import type { EnrichedClient } from "./client";
+export type DeviceContext = Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>;
+export declare const DEVICE_CODE_LIFETIME = 600;
+export declare const DEVICE_POLL_INTERVAL = 5;
+export declare function hashDeviceCode(value: string): Promise<string>;
+export declare function normalizeUserCode(value: string): string;
+export declare function requireDeviceCodes(data: DataAdapters): import("@authhero/adapter-interfaces").DeviceCodesAdapter;
+export declare function assertDeviceGrantAllowed(client: EnrichedClient): void;
+export declare function authenticateDeviceClient(ctx: DeviceContext, client: EnrichedClient, secret?: string, basic?: boolean): void;
+/** Fixed windows are persisted, so limits survive isolate restarts and work without a rate-limit binding. */
+export declare function limitDeviceRequests(ctx: DeviceContext, tenantId: string, purpose: string, limit: number, identity?: string): Promise<void>;
+export declare function deviceFlowData(session: LoginSession): {
+    deviceCodeHash?: string;
+    userCode?: string;
+    ready?: boolean;
+} | undefined;
+export declare function isDeviceLoginSession(raw?: string | null): boolean;
+export declare function deviceBrowserCookie(session: LoginSession): string;
+export declare function assertDeviceBrowser(ctx: DeviceContext, session: LoginSession): void;

package/dist/types/helpers/hook-events.d.ts

@@ -5,6 +5,10 @@ type HookCtx = Context<{
     Bindings: Bindings;
     Variables: Variables;
 }>;
+interface HookChangeContext {
+    previousUser?: User;
+    updates?: Partial<User>;
+}
 /**
  * Whether the outbox is configured for this request. When false, hook dispatch
  * falls back to inline webhook invocation (no retry / dead-letter).
@@ -21,7 +25,7 @@ export declare function outboxEnabled(ctx: HookCtx): boolean;
  * up front, the caller can relay it with {@link relayOutboxEvent} once the
  * write commits without needing a return value from the adapter.
  */
-export declare function buildPostHookEvent(ctx: HookCtx, tenantId: string, triggerId: string, user: User): OutboxEventInsert | undefined;
+export declare function buildPostHookEvent(ctx: HookCtx, tenantId: string, triggerId: string, user: User, changes?: HookChangeContext): OutboxEventInsert | undefined;
 /**
  * Relay an outbox event that has already been persisted (atomically with its
  * business write) so the outbox middleware picks it up for delivery. Mirrors
@@ -31,10 +35,10 @@ export declare function buildPostHookEvent(ctx: HookCtx, tenantId: string, trigg
  */
 export declare function relayOutboxEvent(ctx: HookCtx, id: string): void;
 /**
- * Fallback dispatch for when the outbox is not configured: invoke the
- * post-hook webhooks inline (fire-and-forget via `waitUntil`). No retry /
+ * Fallback dispatch for when the outbox is not configured: invoke post-hook
+ * webhooks and update/deletion Actions via `waitUntil`. No retry /
  * dead-letter support in this mode — configure the outbox for durable
  * delivery.
  */
-export declare function dispatchPostHookInline(ctx: HookCtx, tenantId: string, triggerId: string, user: User): void;
+export declare function dispatchPostHookInline(ctx: HookCtx, tenantId: string, triggerId: string, user: User, changes?: HookChangeContext): void;
 export {};

package/dist/types/helpers/hook-user-payload.d.ts

@@ -6,3 +6,5 @@ export type ExternalUser = Omit<User, "registration_completed_at">;
  * `onExecutePostLogin` event, outbox `target.after`, etc.).
  */
 export declare function stripInternalUserFields(user: User): ExternalUser;
+/** Update payloads can arrive from internal callers as well as validated APIs. */
+export declare function sanitizeUserUpdates(updates: Partial<User>): Partial<User>;

package/dist/types/helpers/logging.d.ts

@@ -58,7 +58,8 @@ export type LogParams = {
     };
     /**
      * When provided, replaces the auto-generated `{ request, response? }` details
-     * object entirely. Use this to store a compact, pre-built details payload
+     * object, except for verified caller attribution. Use this to store a compact,
+     * pre-built details payload
      * (e.g. for webhook logs) that fits within storage limits (Analytics Engine
      * blob: 1024 bytes). `execution_id` is still merged on top when set — pass it
      * via its own field rather than inlining it here, or the request block is lost.

package/dist/types/helpers/outbox-destinations/code-hooks.d.ts

@@ -8,6 +8,9 @@ interface CodeHookInvocation {
     triggerId: string;
     /** Serialized user snapshot from the audit event (`target.after`). */
     user?: unknown;
+    userId?: string;
+    previousUser?: unknown;
+    updates?: unknown;
     /** Serialized request context from the audit event. */
     request?: unknown;
 }
@@ -35,9 +38,9 @@ interface CodeHookInvocation {
  * Constructed per-request (via `getDestinations(ctx)`) so it can close over
  * `ctx.env.codeExecutor`. The same class is used by the cron `drainOutbox`
  * safety net when a `codeExecutor` is supplied to `createDefaultDestinations`.
- * When no executor is configured, code hooks cannot run (nor be deployed), so
- * `deliver` is a no-op success — matching the inline `handleCodeHook` which
- * returns `null` without an executor.
+ * Missing executors fail delivery for post-update/deletion so the event can be
+ * retried when the configuration is repaired. Registration retains its legacy
+ * no-op behavior without an executor.
  */
 export declare class CodeHookDestination implements EventDestination {
     name: string;
@@ -48,7 +51,9 @@ export declare class CodeHookDestination implements EventDestination {
         logCapture?: ActionExecutionLogCapture;
     });
     accepts(event: AuditEvent): boolean;
+    /** Recover the user write and stable delivery ID from a persisted hook event. */
     transform(event: AuditEvent): CodeHookInvocation;
+    /** Run matching Actions, record outcomes, and fail delivery when the relay must retry. */
     deliver(invocations: CodeHookInvocation[]): Promise<void>;
     /**
      * Fetch every hook for the tenant, paging past the adapter's default page

package/dist/types/helpers/outbox-destinations/webhooks.d.ts

@@ -15,6 +15,8 @@ interface WebhookInvocation {
         trigger_id: string;
         user?: unknown;
         request?: unknown;
+        previous_user?: unknown;
+        updates?: unknown;
     };
 }
 export interface WebhookDestinationOptions {
@@ -49,6 +51,7 @@ export declare class WebhookDestination implements EventDestination {
     private webhookInvoker?;
     constructor(hooks: HooksAdapter, getServiceToken: GetServiceToken, options?: WebhookDestinationOptions);
     accepts(event: AuditEvent): boolean;
+    /** Build the webhook payload from the event's committed user and update snapshots. */
     transform(event: AuditEvent): WebhookInvocation;
     deliver(events: WebhookInvocation[]): Promise<void>;
     private invokeCustom;

package/dist/types/helpers/platform-rows.d.ts

@@ -0,0 +1,27 @@
+import { DataAdapters } from "@authhero/adapter-interfaces";
+/**
+ * Hides `scope: "platform"` rows that a config sync delivered into a tenant
+ * from that tenant's own management API. Such rows must run (the code-hook
+ * executor reads them through other adapters) but their code and secrets are
+ * never shown, listed, edited or referenced by the tenant's admins.
+ *
+ * A row is hidden when it is platform-scoped **and** has a synced id. The
+ * control plane's own origin rows are platform-scoped too, but they are
+ * owned by the tenant that publishes them and stay visible there. Operators
+ * (control-plane credentials) see everything.
+ *
+ * A hidden row behaves as if it did not exist: `get` returns `null`, lists omit
+ * it, and writes against it are refused as not found. List totals and
+ * checkpoint cursors are not adjusted for hidden rows.
+ *
+ * Limit: this protects against the tenant's management API. The code and
+ * (encrypted) secrets are still stored in the tenant's database, so anyone
+ * with access to the database or the worker environment can read them.
+ */
+export interface PlatformRowsOptions {
+    /** The tenant whose management API is being served. */
+    tenantId: string;
+    /** Control-plane credentials see platform rows. */
+    isOperator: boolean;
+}
+export declare function withPlatformRowsHidden(data: DataAdapters, options: PlatformRowsOptions): DataAdapters;

package/dist/types/helpers/request-data.d.ts

@@ -13,6 +13,18 @@ export declare function setRequestData(ctx: Context<{
     Bindings: Bindings;
     Variables: Variables;
 }>, data: DataAdapters): void;
+/**
+ * The adapter stack code-hook and webhook execution reads.
+ *
+ * The management API hides platform-scoped rows that a config sync delivered
+ * from `ctx.var.data`, but hooks that run inline inside a management request
+ * (pre-registration, pre-deletion, ...) must still see and run them. Where no
+ * separate stack was installed this is the request's own stack.
+ */
+export declare function getExecutorData(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>): DataAdapters;
 /**
  * The raw adapter a route group composes its per-request stack on: the base
  * an earlier middleware installed on `ctx.var.baseData` (per-tenant database

package/dist/types/helpers/reserved-claims.d.ts

@@ -14,9 +14,9 @@ export declare const USERINFO_RESERVED_CLAIMS: readonly ["iss", "sub", "aud", "e
  * vendor/tenant for downstream APIs while `sub` stays `auth-service`.
  * Client-bound mints keep `azp` locked (see below).
  */
-export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("sub" | "exp" | "iat" | "tenant_id" | "client_id" | "org_name" | "jti" | "scope" | "gty" | "org_id" | "sid" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "permissions" | "nbf" | "act" | "requested_userinfo_claims")[];
+export declare const SERVICE_TOKEN_RESERVED_CLAIMS: ("tenant_id" | "client_id" | "sub" | "org_name" | "scope" | "sid" | "permissions" | "iat" | "jti" | "org_id" | "exp" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "gty" | "nbf" | "act" | "requested_userinfo_claims")[];
 /** Client-bound mints: `azp` must stay the registered client id. */
-export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("sub" | "exp" | "iat" | "tenant_id" | "client_id" | "org_name" | "jti" | "scope" | "azp" | "gty" | "org_id" | "sid" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "permissions" | "nbf" | "act" | "requested_userinfo_claims")[];
+export declare const CLIENT_SERVICE_TOKEN_RESERVED_CLAIMS: ("tenant_id" | "client_id" | "sub" | "org_name" | "scope" | "sid" | "permissions" | "iat" | "jti" | "org_id" | "exp" | "iss" | "aud" | "auth_time" | "acr" | "amr" | "azp" | "gty" | "nbf" | "act" | "requested_userinfo_claims")[];
 export type AccessTokenReservedClaim = (typeof ACCESS_TOKEN_RESERVED_CLAIMS)[number];
 export type IdTokenReservedClaim = (typeof ID_TOKEN_RESERVED_CLAIMS)[number];
 /**

package/dist/types/helpers/scopes-permissions.d.ts

@@ -13,7 +13,7 @@ interface ClientCredentialsScopesAndPermissionsParams extends BaseScopesAndPermi
     userId?: never;
 }
 interface UserBasedScopesAndPermissionsParams extends BaseScopesAndPermissionsParams {
-    grantType?: GrantType.AuthorizationCode | GrantType.RefreshToken | GrantType.Password | GrantType.Passwordless | GrantType.OTP | GrantType.TokenExchange | undefined;
+    grantType?: GrantType.DeviceCode | GrantType.AuthorizationCode | GrantType.RefreshToken | GrantType.Password | GrantType.Passwordless | GrantType.OTP | GrantType.TokenExchange | undefined;
     userId: string;
 }
 export type CalculateScopesAndPermissionsParams = ClientCredentialsScopesAndPermissionsParams | UserBasedScopesAndPermissionsParams;

package/dist/types/helpers/synced-rows.d.ts

@@ -0,0 +1 @@
+export declare function isSyncedRowId(id: string | undefined | null): boolean;

package/dist/types/hooks/lifecycle-codehooks.d.ts

@@ -0,0 +1,16 @@
+import { Context } from "hono";
+import { Bindings, Variables } from "../types";
+import { CodeHookEventInput } from "./codehooks";
+/** Blocking policies run before signup validation or a write, and fail closed. */
+export declare function runBlockingActions(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, tenantId: string, triggerId: "validate-registration-username" | "pre-user-update" | "pre-user-deletion", event: CodeHookEventInput): Promise<{
+    allowed: boolean;
+    reason?: string;
+}>;
+/** Cancel lifecycle writes when a blocking Action denies or fails. */
+export declare function runPreUserActions(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, tenantId: string, triggerId: "pre-user-update" | "pre-user-deletion", event: CodeHookEventInput): Promise<void>;

package/dist/types/hooks/user-deletion.d.ts

@@ -12,3 +12,12 @@ export declare function createUserDeletionHooks(ctx: Context<{
     Bindings: Bindings;
     Variables: Variables;
 }>, data: DataAdapters): (tenant_id: string, user_id: string) => Promise<boolean>;
+/**
+ * Approve deletion before a caller performs retryable access/mapping cleanup.
+ * The returned commit runs the existing transactional delete and post hooks;
+ * it never repeats pre hooks. If cleanup fails, the user still exists for retry.
+ */
+export declare function prepareUserDeletion(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, data: DataAdapters, tenant_id: string, user_id: string): Promise<(() => Promise<boolean>) | null>;