authhero 9.7.0 → 9.9.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (38) hide show
  1. package/dist/authhero.cjs +132 -132
  2. package/dist/authhero.d.ts +361 -249
  3. package/dist/authhero.mjs +11713 -11450
  4. package/dist/tsconfig.types.tsbuildinfo +1 -1
  5. package/dist/types/authentication-flows/passwordless.d.ts +31 -8
  6. package/dist/types/constants.d.ts +2 -0
  7. package/dist/types/helpers/revoke-session-refresh-tokens.d.ts +33 -0
  8. package/dist/types/helpers/signing-keys.d.ts +11 -0
  9. package/dist/types/index.d.ts +351 -249
  10. package/dist/types/routes/auth-api/index.d.ts +32 -12
  11. package/dist/types/routes/auth-api/passwordless.d.ts +12 -12
  12. package/dist/types/routes/auth-api/token.d.ts +20 -0
  13. package/dist/types/routes/management-api/clients.d.ts +6 -6
  14. package/dist/types/routes/management-api/connections.d.ts +16 -16
  15. package/dist/types/routes/management-api/custom-domains.d.ts +6 -6
  16. package/dist/types/routes/management-api/email-templates.d.ts +18 -18
  17. package/dist/types/routes/management-api/forms.d.ts +126 -126
  18. package/dist/types/routes/management-api/guardian.d.ts +5 -5
  19. package/dist/types/routes/management-api/helpers.d.ts +1 -1
  20. package/dist/types/routes/management-api/index.d.ts +312 -230
  21. package/dist/types/routes/management-api/keys.d.ts +92 -10
  22. package/dist/types/routes/management-api/logs.d.ts +4 -4
  23. package/dist/types/routes/management-api/migration-sources.d.ts +6 -6
  24. package/dist/types/routes/management-api/organizations.d.ts +5 -5
  25. package/dist/types/routes/management-api/prompts.d.ts +4 -4
  26. package/dist/types/routes/management-api/roles.d.ts +1 -1
  27. package/dist/types/routes/management-api/tenant-export-import.d.ts +5 -5
  28. package/dist/types/routes/management-api/tenants.d.ts +4 -4
  29. package/dist/types/routes/management-api/users.d.ts +18 -18
  30. package/dist/types/routes/universal-login/common.d.ts +6 -6
  31. package/dist/types/routes/universal-login/flow-api.d.ts +12 -12
  32. package/dist/types/routes/universal-login/identifier.d.ts +2 -2
  33. package/dist/types/routes/universal-login/index.d.ts +2 -2
  34. package/dist/types/routes/universal-login/u2-index.d.ts +5 -5
  35. package/dist/types/routes/universal-login/u2-routes.d.ts +5 -5
  36. package/dist/types/state-machines/login-session.d.ts +1 -1
  37. package/dist/types/utils/encryption.d.ts +51 -0
  38. package/package.json +6 -6
@@ -361,7 +361,7 @@ export declare function initJSXRoute(ctx: Context<{
361
361
  active?: boolean | undefined;
362
362
  } | undefined;
363
363
  signup?: {
364
- status?: "required" | "optional" | "disabled" | undefined;
364
+ status?: "optional" | "required" | "disabled" | undefined;
365
365
  verification?: {
366
366
  active?: boolean | undefined;
367
367
  } | undefined;
@@ -378,7 +378,7 @@ export declare function initJSXRoute(ctx: Context<{
378
378
  active?: boolean | undefined;
379
379
  } | undefined;
380
380
  signup?: {
381
- status?: "required" | "optional" | "disabled" | undefined;
381
+ status?: "optional" | "required" | "disabled" | undefined;
382
382
  } | undefined;
383
383
  validation?: {
384
384
  max_length?: number | undefined;
@@ -395,7 +395,7 @@ export declare function initJSXRoute(ctx: Context<{
395
395
  active?: boolean | undefined;
396
396
  } | undefined;
397
397
  signup?: {
398
- status?: "required" | "optional" | "disabled" | undefined;
398
+ status?: "optional" | "required" | "disabled" | undefined;
399
399
  } | undefined;
400
400
  } | undefined;
401
401
  } | undefined;
@@ -1094,7 +1094,7 @@ export declare function initJSXRouteWithSession(ctx: Context<{
1094
1094
  active?: boolean | undefined;
1095
1095
  } | undefined;
1096
1096
  signup?: {
1097
- status?: "required" | "optional" | "disabled" | undefined;
1097
+ status?: "optional" | "required" | "disabled" | undefined;
1098
1098
  verification?: {
1099
1099
  active?: boolean | undefined;
1100
1100
  } | undefined;
@@ -1111,7 +1111,7 @@ export declare function initJSXRouteWithSession(ctx: Context<{
1111
1111
  active?: boolean | undefined;
1112
1112
  } | undefined;
1113
1113
  signup?: {
1114
- status?: "required" | "optional" | "disabled" | undefined;
1114
+ status?: "optional" | "required" | "disabled" | undefined;
1115
1115
  } | undefined;
1116
1116
  validation?: {
1117
1117
  max_length?: number | undefined;
@@ -1128,7 +1128,7 @@ export declare function initJSXRouteWithSession(ctx: Context<{
1128
1128
  active?: boolean | undefined;
1129
1129
  } | undefined;
1130
1130
  signup?: {
1131
- status?: "required" | "optional" | "disabled" | undefined;
1131
+ status?: "optional" | "required" | "disabled" | undefined;
1132
1132
  } | undefined;
1133
1133
  } | undefined;
1134
1134
  } | undefined;
@@ -27,7 +27,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
27
27
  output: {
28
28
  screen: {
29
29
  action: string;
30
- method: "GET" | "POST";
30
+ method: "POST" | "GET";
31
31
  components: {
32
32
  id: string;
33
33
  type: string;
@@ -43,7 +43,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
43
43
  hint?: string | undefined;
44
44
  messages?: {
45
45
  text: string;
46
- type: "error" | "success" | "info" | "warning";
46
+ type: "success" | "error" | "info" | "warning";
47
47
  id?: number | undefined;
48
48
  }[] | undefined;
49
49
  }[];
@@ -51,7 +51,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
51
51
  description?: string | undefined;
52
52
  messages?: {
53
53
  text: string;
54
- type: "error" | "success" | "info" | "warning";
54
+ type: "success" | "error" | "info" | "warning";
55
55
  id?: number | undefined;
56
56
  }[] | undefined;
57
57
  links?: {
@@ -107,7 +107,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
107
107
  output: {
108
108
  screen: {
109
109
  action: string;
110
- method: "GET" | "POST";
110
+ method: "POST" | "GET";
111
111
  components: {
112
112
  id: string;
113
113
  type: string;
@@ -123,7 +123,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
123
123
  hint?: string | undefined;
124
124
  messages?: {
125
125
  text: string;
126
- type: "error" | "success" | "info" | "warning";
126
+ type: "success" | "error" | "info" | "warning";
127
127
  id?: number | undefined;
128
128
  }[] | undefined;
129
129
  }[];
@@ -131,7 +131,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
131
131
  description?: string | undefined;
132
132
  messages?: {
133
133
  text: string;
134
- type: "error" | "success" | "info" | "warning";
134
+ type: "success" | "error" | "info" | "warning";
135
135
  id?: number | undefined;
136
136
  }[] | undefined;
137
137
  links?: {
@@ -204,7 +204,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
204
204
  output: {
205
205
  screen: {
206
206
  action: string;
207
- method: "GET" | "POST";
207
+ method: "POST" | "GET";
208
208
  components: {
209
209
  id: string;
210
210
  type: string;
@@ -220,7 +220,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
220
220
  hint?: string | undefined;
221
221
  messages?: {
222
222
  text: string;
223
- type: "error" | "success" | "info" | "warning";
223
+ type: "success" | "error" | "info" | "warning";
224
224
  id?: number | undefined;
225
225
  }[] | undefined;
226
226
  }[];
@@ -228,7 +228,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
228
228
  description?: string | undefined;
229
229
  messages?: {
230
230
  text: string;
231
- type: "error" | "success" | "info" | "warning";
231
+ type: "success" | "error" | "info" | "warning";
232
232
  id?: number | undefined;
233
233
  }[] | undefined;
234
234
  links?: {
@@ -319,7 +319,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
319
319
  output: {
320
320
  screen: {
321
321
  action: string;
322
- method: "GET" | "POST";
322
+ method: "POST" | "GET";
323
323
  components: {
324
324
  id: string;
325
325
  type: string;
@@ -335,7 +335,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
335
335
  hint?: string | undefined;
336
336
  messages?: {
337
337
  text: string;
338
- type: "error" | "success" | "info" | "warning";
338
+ type: "success" | "error" | "info" | "warning";
339
339
  id?: number | undefined;
340
340
  }[] | undefined;
341
341
  }[];
@@ -343,7 +343,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
343
343
  description?: string | undefined;
344
344
  messages?: {
345
345
  text: string;
346
- type: "error" | "success" | "info" | "warning";
346
+ type: "success" | "error" | "info" | "warning";
347
347
  id?: number | undefined;
348
348
  }[] | undefined;
349
349
  links?: {
@@ -30,7 +30,7 @@ export declare const identifierRoutes: OpenAPIHono<{
30
30
  } & {
31
31
  form: {
32
32
  username: string;
33
- login_selection?: "password" | "code" | undefined;
33
+ login_selection?: "code" | "password" | undefined;
34
34
  };
35
35
  };
36
36
  output: {};
@@ -44,7 +44,7 @@ export declare const identifierRoutes: OpenAPIHono<{
44
44
  } & {
45
45
  form: {
46
46
  username: string;
47
- login_selection?: "password" | "code" | undefined;
47
+ login_selection?: "code" | "password" | undefined;
48
48
  };
49
49
  };
50
50
  output: {};
@@ -515,7 +515,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
515
515
  } & {
516
516
  form: {
517
517
  username: string;
518
- login_selection?: "password" | "code" | undefined;
518
+ login_selection?: "code" | "password" | undefined;
519
519
  };
520
520
  };
521
521
  output: {};
@@ -529,7 +529,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
529
529
  } & {
530
530
  form: {
531
531
  username: string;
532
- login_selection?: "password" | "code" | undefined;
532
+ login_selection?: "code" | "password" | undefined;
533
533
  };
534
534
  };
535
535
  output: {};
@@ -165,7 +165,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
165
165
  $get: {
166
166
  input: {
167
167
  param: {
168
- screen: "signup" | "login" | "impersonate" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
168
+ screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
169
169
  };
170
170
  } & {
171
171
  query: {
@@ -181,7 +181,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
181
181
  } | {
182
182
  input: {
183
183
  param: {
184
- screen: "signup" | "login" | "impersonate" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
184
+ screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
185
185
  };
186
186
  } & {
187
187
  query: {
@@ -197,7 +197,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
197
197
  } | {
198
198
  input: {
199
199
  param: {
200
- screen: "signup" | "login" | "impersonate" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
200
+ screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
201
201
  };
202
202
  } & {
203
203
  query: {
@@ -217,7 +217,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
217
217
  $post: {
218
218
  input: {
219
219
  param: {
220
- screen: "signup" | "login" | "impersonate" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
220
+ screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
221
221
  };
222
222
  } & {
223
223
  query: {
@@ -235,7 +235,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
235
235
  } | {
236
236
  input: {
237
237
  param: {
238
- screen: "signup" | "login" | "impersonate" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
238
+ screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
239
239
  };
240
240
  } & {
241
241
  query: {
@@ -170,7 +170,7 @@ export declare const u2Routes: OpenAPIHono<{
170
170
  $get: {
171
171
  input: {
172
172
  param: {
173
- screen: "signup" | "login" | "impersonate" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
173
+ screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
174
174
  };
175
175
  } & {
176
176
  query: {
@@ -186,7 +186,7 @@ export declare const u2Routes: OpenAPIHono<{
186
186
  } | {
187
187
  input: {
188
188
  param: {
189
- screen: "signup" | "login" | "impersonate" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
189
+ screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
190
190
  };
191
191
  } & {
192
192
  query: {
@@ -202,7 +202,7 @@ export declare const u2Routes: OpenAPIHono<{
202
202
  } | {
203
203
  input: {
204
204
  param: {
205
- screen: "signup" | "login" | "impersonate" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
205
+ screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
206
206
  };
207
207
  } & {
208
208
  query: {
@@ -222,7 +222,7 @@ export declare const u2Routes: OpenAPIHono<{
222
222
  $post: {
223
223
  input: {
224
224
  param: {
225
- screen: "signup" | "login" | "impersonate" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
225
+ screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
226
226
  };
227
227
  } & {
228
228
  query: {
@@ -240,7 +240,7 @@ export declare const u2Routes: OpenAPIHono<{
240
240
  } | {
241
241
  input: {
242
242
  param: {
243
- screen: "signup" | "login" | "impersonate" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
243
+ screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
244
244
  };
245
245
  } & {
246
246
  query: {
@@ -140,7 +140,7 @@ export declare const loginSessionMachine: import("xstate").StateMachine<LoginSes
140
140
  } | {
141
141
  type: "setFailureReason";
142
142
  params: import("xstate").NonReducibleUnknown;
143
- }, never, never, "pending" | "failed" | "authenticated" | "expired" | "awaiting_email_verification" | "awaiting_mfa" | "awaiting_consent" | "awaiting_hook" | "awaiting_continuation" | "completed", string, import("xstate").NonReducibleUnknown, import("xstate").NonReducibleUnknown, import("xstate").EventObject, import("xstate").MetaObject, {
143
+ }, never, never, "pending" | "failed" | "expired" | "authenticated" | "awaiting_email_verification" | "awaiting_mfa" | "awaiting_consent" | "awaiting_hook" | "awaiting_continuation" | "completed", string, import("xstate").NonReducibleUnknown, import("xstate").NonReducibleUnknown, import("xstate").EventObject, import("xstate").MetaObject, {
144
144
  id: "loginSession";
145
145
  states: {
146
146
  readonly pending: {};
@@ -14,8 +14,59 @@ export interface CreateX509CertificateParams {
14
14
  * backwards compatibility with existing tenants.
15
15
  */
16
16
  keyType?: SigningKeyType;
17
+ /**
18
+ * How long the certificate stays valid, in days. Defaults to
19
+ * `DEFAULT_CERT_VALIDITY_DAYS` (one year).
20
+ *
21
+ * Relying parties that fetch JWKS re-read the key on every rotation, so a
22
+ * short life is cheap there. A SAML service provider, by contrast, pins the
23
+ * certificate out-of-band and only learns about a new one when someone
24
+ * emails it over — so SAML keys want years, not months.
25
+ */
26
+ validityDays?: number;
17
27
  }
28
+ /** Default certificate lifetime when a caller doesn't ask for one. */
29
+ export declare const DEFAULT_CERT_VALIDITY_DAYS = 365;
30
+ /**
31
+ * Upper bound on a caller-supplied lifetime. Ten years is already generous for
32
+ * a signing certificate; beyond that the value is far more likely to be a
33
+ * mistake than an intention.
34
+ */
35
+ export declare const MAX_CERT_VALIDITY_DAYS = 3650;
18
36
  export declare function createX509Certificate(params: CreateX509CertificateParams): Promise<SigningKey>;
37
+ export interface RenewX509CertificateParams {
38
+ /**
39
+ * The key's current certificate. Supplies the subject CN to carry over and
40
+ * the public key we assert the private key still matches.
41
+ */
42
+ cert: string;
43
+ /** The key's private key, PEM-encoded (the `pkcs7` column). */
44
+ pkcs7: string;
45
+ /** Subject/issuer CN for the new certificate. Defaults to the current CN. */
46
+ name?: string;
47
+ validityDays?: number;
48
+ }
49
+ export interface RenewX509CertificateResult {
50
+ /** The re-issued certificate, PEM-encoded. */
51
+ cert: string;
52
+ /** SHA-1 of the new certificate's DER — changes, the cert bytes changed. */
53
+ thumbprint: string;
54
+ /** RFC 7638 thumbprint of the public key — unchanged by definition. */
55
+ fingerprint: string;
56
+ }
57
+ /**
58
+ * Re-issue a certificate over an existing key pair.
59
+ *
60
+ * This is renewal, not rotation: the key material is untouched, so the public
61
+ * key, its RFC 7638 fingerprint and therefore the `kid` all stay the same —
62
+ * only the validity window (and the certificate bytes carrying it) move. A
63
+ * SAML service provider that validates against the public key it already
64
+ * holds keeps working with no coordination at all; one that pinned the
65
+ * certificate itself still needs the new bytes, same as a full rotation.
66
+ *
67
+ * Use `createX509Certificate` when you actually want new key material.
68
+ */
69
+ export declare function renewX509Certificate(params: RenewX509CertificateParams): Promise<RenewX509CertificateResult>;
19
70
  export declare function convertPKCS7ToPem(keyType: "PRIVATE" | "PUBLIC", binaryData: ArrayBuffer): string;
20
71
  export declare function toJWKS(key: CryptoKey): Promise<JsonWebKey>;
21
72
  export declare function getJWKThumbprint(cert: x509.X509Certificate): Promise<string>;
package/package.json CHANGED
@@ -11,7 +11,7 @@
11
11
  "type": "git",
12
12
  "url": "https://github.com/markusahlstrand/authhero"
13
13
  },
14
- "version": "9.7.0",
14
+ "version": "9.9.0",
15
15
  "files": [
16
16
  "dist"
17
17
  ],
@@ -63,8 +63,8 @@
63
63
  "vite": "^8.0.14",
64
64
  "vite-plugin-dts": "^4.5.4",
65
65
  "vitest": "^4.1.7",
66
- "@authhero/kysely-adapter": "12.5.0",
67
- "@authhero/widget": "0.38.4"
66
+ "@authhero/kysely-adapter": "12.6.0",
67
+ "@authhero/widget": "0.38.5"
68
68
  },
69
69
  "dependencies": {
70
70
  "@peculiar/x509": "^1.14.0",
@@ -80,9 +80,9 @@
80
80
  "qrcode": "^1.5.4",
81
81
  "sanitize-html": "^2.17.4",
82
82
  "xstate": "^5.31.1",
83
- "@authhero/adapter-interfaces": "4.9.0",
84
- "@authhero/proxy": "0.10.8",
85
- "@authhero/saml": "0.5.7"
83
+ "@authhero/adapter-interfaces": "4.10.0",
84
+ "@authhero/proxy": "0.10.9",
85
+ "@authhero/saml": "0.5.8"
86
86
  },
87
87
  "peerDependencies": {
88
88
  "@authhero/widget": "^0.1.0",