authhero 9.9.0 → 9.10.0

package/dist/types/routes/universal-login/flow-api.d.ts

@@ -43,7 +43,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                         hint?: string | undefined;
                         messages?: {
                             text: string;
-                            type: "success" | "error" | "info" | "warning";
+                            type: "error" | "success" | "info" | "warning";
                             id?: number | undefined;
                         }[] | undefined;
                     }[];
@@ -51,7 +51,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                     description?: string | undefined;
                     messages?: {
                         text: string;
-                        type: "success" | "error" | "info" | "warning";
+                        type: "error" | "success" | "info" | "warning";
                         id?: number | undefined;
                     }[] | undefined;
                     links?: {
@@ -123,7 +123,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                         hint?: string | undefined;
                         messages?: {
                             text: string;
-                            type: "success" | "error" | "info" | "warning";
+                            type: "error" | "success" | "info" | "warning";
                             id?: number | undefined;
                         }[] | undefined;
                     }[];
@@ -131,7 +131,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                     description?: string | undefined;
                     messages?: {
                         text: string;
-                        type: "success" | "error" | "info" | "warning";
+                        type: "error" | "success" | "info" | "warning";
                         id?: number | undefined;
                     }[] | undefined;
                     links?: {
@@ -220,7 +220,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                         hint?: string | undefined;
                         messages?: {
                             text: string;
-                            type: "success" | "error" | "info" | "warning";
+                            type: "error" | "success" | "info" | "warning";
                             id?: number | undefined;
                         }[] | undefined;
                     }[];
@@ -228,7 +228,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                     description?: string | undefined;
                     messages?: {
                         text: string;
-                        type: "success" | "error" | "info" | "warning";
+                        type: "error" | "success" | "info" | "warning";
                         id?: number | undefined;
                     }[] | undefined;
                     links?: {
@@ -335,7 +335,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                         hint?: string | undefined;
                         messages?: {
                             text: string;
-                            type: "success" | "error" | "info" | "warning";
+                            type: "error" | "success" | "info" | "warning";
                             id?: number | undefined;
                         }[] | undefined;
                     }[];
@@ -343,7 +343,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                     description?: string | undefined;
                     messages?: {
                         text: string;
-                        type: "success" | "error" | "info" | "warning";
+                        type: "error" | "success" | "info" | "warning";
                         id?: number | undefined;
                     }[] | undefined;
                     links?: {

package/dist/types/routes/universal-login/info-code-exchange.d.ts

@@ -0,0 +1,27 @@
+import { Context } from "hono";
+import { TokenResponse, User } from "@authhero/adapter-interfaces";
+import { Bindings, Variables } from "../../types";
+import { EnrichedClient } from "../../helpers/client";
+export type InfoCodeExchangeResult = {
+    ok: true;
+    tokens: TokenResponse;
+    user: User;
+    client: EnrichedClient;
+} | {
+    ok: false;
+    error: string;
+    error_description: string;
+};
+/**
+ * Redeem an authorization code that was issued with the info page itself as
+ * `redirect_uri`, using the client's own credentials on the server side.
+ *
+ * The page lives on the auth server, so it can complete the exchange without
+ * the browser ever seeing a client secret. The redirect_uri guard is
+ * load-bearing: without it a code intercepted from any other redirect target
+ * could be pasted into this page and redeemed with the client's secret.
+ */
+export declare function exchangeInfoPageCode(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, tenantId: string, code: string): Promise<InfoCodeExchangeResult>;

package/dist/types/routes/universal-login/token-info-page.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Signed-in landing page for the /u2/info test redirect target.
+ *
+ * Shows the outcome of a server-side authorization code exchange: buttons
+ * that copy the issued tokens to the clipboard, and a grid with the claims
+ * from the ID token (or the user's profile when no ID token was issued).
+ */
+import type { Theme, TokenResponse, User } from "@authhero/adapter-interfaces";
+import type { DarkModePreference } from "./u2-widget-page";
+import type { ErrorPageProps } from "./error-page";
+export type TokenInfoPageProps = {
+    tokens: TokenResponse;
+    user: User;
+    branding?: ErrorPageProps["branding"];
+    theme?: Theme | null;
+    darkMode?: DarkModePreference;
+};
+type ClaimRow = {
+    key: string;
+    value: string;
+};
+/** Decode a JWT payload without verifying it — the server just minted it. */
+export declare function decodeJwtPayload(token: string): Record<string, unknown> | null;
+export declare function buildClaimRows(tokens: TokenResponse, user: User): ClaimRow[];
+export declare function TokenInfoPage({ tokens, user, branding, theme, darkMode, }: TokenInfoPageProps): import("hono/jsx/jsx-dev-runtime").JSX.Element;
+export {};

package/dist/types/routes/universal-login/u2-index.d.ts

@@ -165,7 +165,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         $get: {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -181,7 +181,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -197,7 +197,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -217,7 +217,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         $post: {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "enter-password" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -235,7 +235,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "enter-password" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {

package/dist/types/routes/universal-login/u2-routes.d.ts

@@ -170,7 +170,7 @@ export declare const u2Routes: OpenAPIHono<{
         $get: {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -186,7 +186,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -202,7 +202,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -222,7 +222,7 @@ export declare const u2Routes: OpenAPIHono<{
         $post: {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "enter-password" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -240,7 +240,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "consent" | "login" | "reset-password" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "enter-password" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {

package/dist/types/types/AuthHeroConfig.d.ts

@@ -1,5 +1,6 @@
 import { CodeExecutor, Connection, ConnectionInsert, CreateTenantParams, DataAdapters, Hook, ResourceServer, ResourceServerInsert, Role, RoleInsert, Tenant, TenantOperation, TenantOperationKind } from "@authhero/adapter-interfaces";
 import type { RolePermissionHooks, Hooks } from "./Hooks";
+import type { OutboxMetricsSink } from "./OutboxMetrics";
 import type { SamlSigner } from "@authhero/saml/core";
 import type { OpenAPIHono } from "@hono/zod-openapi";
 import type { Handler, MiddlewareHandler } from "hono";
@@ -127,6 +128,32 @@ export interface OutboxConfig {
     retentionDays?: number;
     /** Max delivery retries before giving up on an event (default: 5) */
     maxRetries?: number;
+    /**
+     * Optional sink for relay metrics (`outbox_events_processed_total`,
+     * `outbox_events_dead_lettered_total`, `outbox_retry_delay_seconds`).
+     * Left unset, the relay emits nothing beyond its existing console logging.
+     */
+    metrics?: OutboxMetricsSink;
+    /**
+     * When set, audit events are additionally archived to a Cloudflare Pipelines
+     * stream, which lands them in R2 as an Iceberg table. Left unset, no archive
+     * destination is registered and delivery is unchanged.
+     *
+     * See `apps/docs/architecture/audit-archive.md`.
+     */
+    pipeline?: OutboxPipelineConfig;
+}
+export interface OutboxPipelineConfig {
+    /**
+     * Stream HTTP ingest endpoint, e.g. `https://<stream-id>.ingest.cloudflare.com`.
+     * Must be https — the destination rejects any other scheme at startup, since
+     * every request carries the ingest token and a full audit event.
+     */
+    endpoint: string;
+    /** Stream ingest token, sent as `Authorization: Bearer`. */
+    token: string;
+    /** Per-request timeout in ms (default: 10_000). */
+    timeoutMs?: number;
 }
 /**
  * Mode for the built-in email-based user linking path.

package/dist/types/types/Bindings.d.ts

@@ -45,6 +45,18 @@ export type Bindings = {
      * leave unset (or false) in production so SSRF protection stays on.
      */
     ALLOW_PRIVATE_OUTBOUND_FETCH?: boolean;
+    /**
+     * Clock-skew leeway in seconds applied to a client assertion's `exp`/`nbf`
+     * at `POST /oauth/token`. Defaults to 30 when unset.
+     */
+    CLIENT_ASSERTION_LEEWAY_SECONDS?: number;
+    /**
+     * Upper bound, in seconds, on a client assertion's lifetime (`exp - iat`,
+     * and the absolute `exp` measured from now). RFC 7523 sets no limit, so
+     * without one a client can mint an assertion valid for a year. Defaults to
+     * 300 when unset.
+     */
+    CLIENT_ASSERTION_MAX_LIFETIME_SECONDS?: number;
     /**
      * Controls where Server-Timing instrumentation goes. The data/cache adapters
      * and the webhook hook always measure per-operation latency; this decides the

package/dist/types/types/OutboxMetrics.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Metric names emitted by the outbox relay.
+ *
+ * - `outbox_events_processed_total` — counter, one per event that every
+ *   accepting destination delivered successfully.
+ * - `outbox_events_dead_lettered_total` — counter, one per event successfully
+ *   moved to the dead-letter state (retries exhausted, or no destination
+ *   accepted it). Not emitted when the dead-letter write itself fails, since
+ *   the event has not transitioned.
+ * - `outbox_retry_delay_seconds` — observation, emitted once per delivery
+ *   failure with the backoff delay before the next attempt. Its count doubles
+ *   as a retry counter.
+ */
+export type OutboxMetricName = "outbox_events_processed_total" | "outbox_events_dead_lettered_total" | "outbox_retry_delay_seconds";
+/** A single metric emission from the outbox relay. */
+export interface OutboxMetric {
+    name: OutboxMetricName;
+    /** Counter increment, or the observed value for `outbox_retry_delay_seconds`. */
+    value: number;
+    /** Tenant the event belongs to. */
+    tenantId: string;
+    /** Audit event type, e.g. `hook.post-user-registration`. */
+    eventType: string;
+    /** Which relay path emitted this: inline per-request, or the cron drain. */
+    source: "request" | "cron";
+    /** Destination that failed, when the metric was caused by a delivery failure. */
+    destination?: string;
+    /** Failure reason, for retry and dead-letter metrics. */
+    error?: string;
+    /** Retry count of the event at the time of emission. */
+    retryCount?: number;
+}
+/**
+ * Optional sink for outbox relay metrics.
+ *
+ * Kept deliberately sink-agnostic: `packages/authhero` never knows where the
+ * numbers end up. Consumers pass a callback that forwards to whatever they
+ * use (Cloudflare Analytics Engine, StatsD, OpenTelemetry, a log line).
+ * `@authhero/cloudflare-adapter` ships an Analytics Engine implementation via
+ * `createAnalyticsEngineOutboxMetricsSink`.
+ *
+ * Implementations should be synchronous and must not throw. The relay calls
+ * the sink without awaiting it and swallows both synchronous throws and
+ * rejections from a promise-returning sink, so a broken sink can never fail
+ * event delivery.
+ */
+export type OutboxMetricsSink = (metric: OutboxMetric) => void;

package/dist/types/types/index.d.ts

@@ -2,5 +2,6 @@ export * from "./Variables";
 export * from "./Bindings";
 export * from "./auth0";
 export * from "./AuthHeroConfig";
+export * from "./OutboxMetrics";
 export * from "./GrantFlowResult";
 export * from "./Hooks";

package/dist/types/utils/email.d.ts

@@ -1,16 +1,28 @@
 export declare const EMAIL_REGEX: RegExp;
 export declare function isValidEmail(value: string): boolean;
 /**
- * Return `payload` with `email` lowercased, or unchanged when there is nothing
- * to normalize.
+ * Canonical form of an email identifier: surrounding whitespace stripped, then
+ * lowercased.
  *
- * Emails are case-insensitive identifiers: every lookup (identifier-first
- * login, `getPrimaryUserByEmail`, email-based auto-linking) lowercases its
- * input, so a mixed-case stored email is unreachable and spawns duplicate
- * accounts. The zod request-schema transform only covers validated bodies —
- * emails sourced upstream (SCIM provisioning, Auth0 lazy migration, IdP
- * profiles) and emails assigned by lifecycle hooks never pass through it.
+ * Both halves matter. Emails are case-insensitive identifiers, so a mixed-case
+ * stored address is unreachable from a lowercasing lookup. Whitespace is worse:
+ * `"user@example.com "` is stored verbatim, passes every uniqueness check
+ * against its trimmed twin, and produces a second account for the same person
+ * on the same connection (issue #1279). Every read and write path must agree on
+ * this single definition or the two halves diverge again.
  */
-export declare function withLowercasedEmail<T extends {
+export declare function normalizeEmail(email: string): string;
+/**
+ * Return `payload` with `email` normalized via {@link normalizeEmail}, or
+ * unchanged when there is nothing to normalize.
+ *
+ * This is the write-path chokepoint: every lookup (identifier-first login,
+ * `getPrimaryUserByEmail`, email-based auto-linking) normalizes its input, so
+ * an un-normalized stored email is unreachable and spawns duplicate accounts.
+ * The zod request-schema transform only covers validated bodies — emails
+ * sourced upstream (SCIM provisioning, Auth0 lazy migration, IdP profiles) and
+ * emails assigned by lifecycle hooks never pass through it.
+ */
+export declare function withNormalizedEmail<T extends {
     email?: string;
 }>(payload: T): T;

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/markusahlstrand/authhero"
   },
-  "version": "9.9.0",
+  "version": "9.10.0",
   "files": [
     "dist"
   ],
@@ -33,8 +33,7 @@
     "@ape-egg/tailwind-rows-columns": "^1.0.2",
     "@hono/node-server": "^1.19.14",
     "@hono/zod-openapi": "^1.4.0",
-    "@react-email/components": "^1.0.12",
-    "@react-email/render": "^2.0.6",
+    "@react-email/render": "^2.1.0",
     "@storybook/react": "^10.4.1",
     "@storybook/react-vite": "^10.4.1",
     "@types/node": "^24.12.4",
@@ -53,6 +52,7 @@
     "postcss": "8.5.15",
     "react": "^19.2.6",
     "react-dom": "^19.2.6",
+    "react-email": "^6.9.3",
     "rollup": "^4.54.0",
     "rollup-plugin-dts": "^6.4.1",
     "rollup-plugin-visualizer": "^6.0.5",
@@ -63,8 +63,8 @@
     "vite": "^8.0.14",
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^4.1.7",
-    "@authhero/kysely-adapter": "12.6.0",
-    "@authhero/widget": "0.38.5"
+    "@authhero/kysely-adapter": "12.6.2",
+    "@authhero/widget": "0.38.7"
   },
   "dependencies": {
     "@peculiar/x509": "^1.14.0",
@@ -80,9 +80,9 @@
     "qrcode": "^1.5.4",
     "sanitize-html": "^2.17.4",
     "xstate": "^5.31.1",
-    "@authhero/adapter-interfaces": "4.10.0",
-    "@authhero/proxy": "0.10.9",
-    "@authhero/saml": "0.5.8"
+    "@authhero/adapter-interfaces": "4.12.0",
+    "@authhero/proxy": "0.10.11",
+    "@authhero/saml": "0.5.10"
   },
   "peerDependencies": {
     "@authhero/widget": "^0.1.0",