authhero 9.3.0 → 9.4.0

package/dist/types/authentication-flows/passwordless.d.ts

@@ -323,6 +323,9 @@ export declare function passwordlessGrantUser(ctx: Context<{
                 client_secret?: string | undefined;
                 app_secret?: string | undefined;
                 scope?: string | undefined;
+                client_secret_hint?: string | undefined;
+                app_secret_hint?: string | undefined;
+                twilio_token_hint?: string | undefined;
                 authorization_endpoint?: string | undefined;
                 token_endpoint?: string | undefined;
                 userinfo_endpoint?: string | undefined;
@@ -360,6 +363,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                     userinfo_endpoint?: string | undefined;
                     client_id?: string | undefined;
                     client_secret?: string | undefined;
+                    client_secret_hint?: string | undefined;
                     realm?: string | undefined;
                 } | undefined;
                 attributes?: {
@@ -368,7 +372,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                             active?: boolean | undefined;
                         } | undefined;
                         signup?: {
-                            status?: "required" | "optional" | "disabled" | undefined;
+                            status?: "optional" | "required" | "disabled" | undefined;
                             verification?: {
                                 active?: boolean | undefined;
                             } | undefined;
@@ -385,7 +389,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                             active?: boolean | undefined;
                         } | undefined;
                         signup?: {
-                            status?: "required" | "optional" | "disabled" | undefined;
+                            status?: "optional" | "required" | "disabled" | undefined;
                         } | undefined;
                         validation?: {
                             max_length?: number | undefined;
@@ -402,7 +406,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                             active?: boolean | undefined;
                         } | undefined;
                         signup?: {
-                            status?: "required" | "optional" | "disabled" | undefined;
+                            status?: "optional" | "required" | "disabled" | undefined;
                         } | undefined;
                     } | undefined;
                 } | undefined;
@@ -415,7 +419,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
                     } | undefined;
                 } | undefined;
                 passkey_options?: {
-                    challenge_ui?: "both" | "autofill" | "button" | undefined;
+                    challenge_ui?: "button" | "both" | "autofill" | undefined;
                     local_enrollment_enabled?: boolean | undefined;
                     progressive_enrollment_enabled?: boolean | undefined;
                 } | undefined;
@@ -467,7 +471,7 @@ export declare function passwordlessGrantUser(ctx: Context<{
         custom_login_page_preview?: string | undefined;
         form_template?: string | undefined;
         addons?: Record<string, any> | undefined;
-        token_endpoint_auth_method?: "none" | "private_key_jwt" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | undefined;
+        token_endpoint_auth_method?: "none" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | "private_key_jwt" | undefined;
         client_metadata?: Record<string, string> | undefined;
         hide_sign_up_disabled_error?: boolean | undefined;
         mobile?: Record<string, any> | undefined;
@@ -550,8 +554,8 @@ export declare function passwordlessGrantUser(ctx: Context<{
         } | undefined;
         authenticated_at?: string | undefined;
     };
-    connectionType: "username" | "sms" | "email";
-    authConnection: "username" | "sms" | "email";
+    connectionType: "username" | "email" | "sms";
+    authConnection: "username" | "email" | "sms";
     session_id: string | undefined;
     authParams: {
         client_id: string;

package/dist/types/helpers/client.d.ts

@@ -362,6 +362,9 @@ export declare const enrichedClientSchema: z.ZodObject<{
             client_secret: z.ZodOptional<z.ZodString>;
             app_secret: z.ZodOptional<z.ZodString>;
             scope: z.ZodOptional<z.ZodString>;
+            client_secret_hint: z.ZodOptional<z.ZodString>;
+            app_secret_hint: z.ZodOptional<z.ZodString>;
+            twilio_token_hint: z.ZodOptional<z.ZodString>;
             authorization_endpoint: z.ZodOptional<z.ZodString>;
             token_endpoint: z.ZodOptional<z.ZodString>;
             userinfo_endpoint: z.ZodOptional<z.ZodString>;
@@ -408,6 +411,7 @@ export declare const enrichedClientSchema: z.ZodObject<{
                 userinfo_endpoint: z.ZodOptional<z.ZodString>;
                 client_id: z.ZodOptional<z.ZodString>;
                 client_secret: z.ZodOptional<z.ZodString>;
+                client_secret_hint: z.ZodOptional<z.ZodString>;
                 realm: z.ZodOptional<z.ZodString>;
             }, z.core.$strip>>;
             attributes: z.ZodOptional<z.ZodObject<{

package/dist/types/helpers/dcr/metadata-mapping.d.ts

@@ -24,10 +24,10 @@ export declare const dcrRequestSchema: z.ZodObject<{
     response_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
     token_endpoint_auth_method: z.ZodOptional<z.ZodEnum<{
         none: "none";
-        private_key_jwt: "private_key_jwt";
         client_secret_post: "client_secret_post";
         client_secret_basic: "client_secret_basic";
         client_secret_jwt: "client_secret_jwt";
+        private_key_jwt: "private_key_jwt";
     }>>;
     jwks_uri: z.ZodOptional<z.ZodString>;
     jwks: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;

package/dist/types/helpers/session-usage.d.ts

@@ -0,0 +1,48 @@
+import { Context } from "hono";
+import { Session } from "@authhero/adapter-interfaces";
+import { Bindings, Variables } from "../types";
+/**
+ * How stale `sessions.used_at` may get before a session touch re-stamps it.
+ *
+ * Session retention analytics bucket by week, so even a daily stamp would be
+ * ample precision there; an hour keeps the value fresh enough to be useful as
+ * "last used" in the management API without turning every refresh-token
+ * exchange into a `sessions` write. Chatty clients that refresh hourly or more
+ * cost roughly one write per hour per session instead of one per exchange.
+ *
+ * The throttle is advisory, not a lock: the check is a read followed by a
+ * write, so concurrent uses of the same session can both decide to stamp and
+ * double-write. That is harmless — both writes set `used_at` to ~now, so the
+ * stored value is correct either way — and the write volume stays bounded by
+ * request concurrency rather than by exchange count, which is the point.
+ */
+export declare const SESSION_USED_AT_THROTTLE_MS: number;
+/** The subset of a session needed to decide whether to re-stamp `used_at`. */
+export type SessionUsage = Pick<Session, "used_at" | "created_at">;
+/**
+ * Whether a session that is being used right now should have `used_at`
+ * re-stamped, or whether the existing value is recent enough to leave alone.
+ *
+ * A session with no `used_at` falls back to `created_at`: a session created
+ * ten minutes ago has already been counted in the current week, so there is
+ * nothing to record yet.
+ */
+export declare function shouldStampUsedAt(session: SessionUsage, now?: number): boolean;
+/**
+ * Record that a session was used, off the request's critical path.
+ *
+ * Sessions are kept alive by refresh-token exchanges, but those write only to
+ * `refresh_tokens`; without this the `sessions` row keeps the `used_at` it was
+ * born with and session-retention cohorts collapse to 100% in week 0 and zero
+ * everywhere after (every session looks like it was last seen the week it was
+ * created).
+ *
+ * Both the read and the write run under `waitUntil`, so a caller on a latency-
+ * sensitive path (the token endpoint) pays nothing for them. Pass `session`
+ * when the caller already holds the row to skip the read entirely. Failures
+ * are swallowed: a missing usage stamp must never fail a grant.
+ */
+export declare function touchSessionUsedAt(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, tenantId: string, sessionId: string, session?: SessionUsage): void;

package/dist/types/hooks/formhooks.d.ts

@@ -3,6 +3,30 @@ import { Bindings, Variables } from "../types";
 import { FORM_FIELD_TYPES, LoginSession, Node, User } from "@authhero/adapter-interfaces";
 import { EnrichedClient } from "../helpers/client";
 export { FORM_FIELD_TYPES };
+/**
+ * Merges this step's submitted values into the ones already collected in this
+ * login session and returns the full set for `{{$form.*}}` resolution.
+ *
+ * Each submission only carries the components of the step being submitted, so
+ * without this an `UPDATE_USER` placed after a later step resolves an earlier
+ * step's field to `undefined` and [resolveTemplateValues] drops the key —
+ * silently, since the form path emits no logs. Accumulating on the login
+ * session's `state_data` keeps every answered field resolvable for the rest of
+ * the form.
+ *
+ * The stored values are cleared along with the rest of `state_data` when the
+ * hook completes (`completeLoginSessionHook`), so they never outlive the form.
+ * Sensitive and password/code fields resolve for the current step but are
+ * never written to the session row.
+ */
+export declare function accumulateFormValues(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, tenantId: string, loginSessionId: string, submittedFields: Record<string, string>, components: ReadonlyArray<{
+    id: string;
+    type: string;
+    sensitive?: boolean;
+}>): Promise<Record<string, string>>;
 export declare function isFormHook(hook: any): hook is {
     form_id: string;
     enabled: boolean;