authhero 9.9.1 → 9.10.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (53) hide show
  1. package/dist/assets/u/widget/index.esm.js +1 -1
  2. package/dist/authhero.cjs +146 -146
  3. package/dist/authhero.d.ts +313 -140
  4. package/dist/authhero.mjs +14974 -14666
  5. package/dist/tsconfig.types.tsbuildinfo +1 -1
  6. package/dist/types/authentication-flows/authorization-code.d.ts +2 -1
  7. package/dist/types/authentication-flows/client-credentials.d.ts +2 -1
  8. package/dist/types/authentication-flows/passwordless.d.ts +6 -5
  9. package/dist/types/authentication-flows/refresh-token.d.ts +2 -1
  10. package/dist/types/authentication-flows/token-exchange.d.ts +2 -1
  11. package/dist/types/helpers/client-assertion-replay.d.ts +21 -0
  12. package/dist/types/helpers/client-assertion.d.ts +24 -2
  13. package/dist/types/helpers/default-destinations.d.ts +7 -1
  14. package/dist/types/helpers/outbox-destinations/index.d.ts +1 -0
  15. package/dist/types/helpers/outbox-destinations/pipeline.d.ts +63 -0
  16. package/dist/types/helpers/outbox-relay.d.ts +3 -0
  17. package/dist/types/helpers/reserved-claims.d.ts +64 -0
  18. package/dist/types/helpers/run-outbox-relay.d.ts +8 -0
  19. package/dist/types/index.d.ts +150 -137
  20. package/dist/types/routes/auth-api/index.d.ts +44 -44
  21. package/dist/types/routes/auth-api/passwordless.d.ts +14 -14
  22. package/dist/types/routes/auth-api/register/index.d.ts +2 -2
  23. package/dist/types/routes/auth-api/token.d.ts +24 -24
  24. package/dist/types/routes/management-api/action-triggers.d.ts +0 -2
  25. package/dist/types/routes/management-api/actions.d.ts +0 -7
  26. package/dist/types/routes/management-api/authentication-methods.d.ts +1 -1
  27. package/dist/types/routes/management-api/branding.d.ts +9 -9
  28. package/dist/types/routes/management-api/clients.d.ts +8 -8
  29. package/dist/types/routes/management-api/connections.d.ts +1 -1
  30. package/dist/types/routes/management-api/email-templates.d.ts +18 -18
  31. package/dist/types/routes/management-api/failed-events.d.ts +21 -1
  32. package/dist/types/routes/management-api/guardian.d.ts +5 -5
  33. package/dist/types/routes/management-api/helpers.d.ts +1 -1
  34. package/dist/types/routes/management-api/index.d.ts +122 -111
  35. package/dist/types/routes/management-api/keys.d.ts +16 -16
  36. package/dist/types/routes/management-api/logs.d.ts +4 -4
  37. package/dist/types/routes/management-api/migration-sources.d.ts +6 -6
  38. package/dist/types/routes/management-api/organizations.d.ts +3 -3
  39. package/dist/types/routes/management-api/prompts.d.ts +4 -4
  40. package/dist/types/routes/management-api/roles.d.ts +1 -1
  41. package/dist/types/routes/management-api/tenants.d.ts +11 -11
  42. package/dist/types/routes/management-api/users.d.ts +24 -24
  43. package/dist/types/routes/universal-login/common.d.ts +2 -2
  44. package/dist/types/routes/universal-login/flow-api.d.ts +8 -8
  45. package/dist/types/routes/universal-login/identifier.d.ts +2 -2
  46. package/dist/types/routes/universal-login/index.d.ts +2 -2
  47. package/dist/types/routes/universal-login/u2-index.d.ts +5 -5
  48. package/dist/types/routes/universal-login/u2-routes.d.ts +5 -5
  49. package/dist/types/types/AuthHeroConfig.d.ts +27 -0
  50. package/dist/types/types/Bindings.d.ts +12 -0
  51. package/dist/types/types/OutboxMetrics.d.ts +47 -0
  52. package/dist/types/types/index.d.ts +1 -0
  53. package/package.json +6 -6
@@ -30,7 +30,7 @@ export declare const identifierRoutes: OpenAPIHono<{
30
30
  } & {
31
31
  form: {
32
32
  username: string;
33
- login_selection?: "password" | "code" | undefined;
33
+ login_selection?: "code" | "password" | undefined;
34
34
  };
35
35
  };
36
36
  output: {};
@@ -44,7 +44,7 @@ export declare const identifierRoutes: OpenAPIHono<{
44
44
  } & {
45
45
  form: {
46
46
  username: string;
47
- login_selection?: "password" | "code" | undefined;
47
+ login_selection?: "code" | "password" | undefined;
48
48
  };
49
49
  };
50
50
  output: {};
@@ -515,7 +515,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
515
515
  } & {
516
516
  form: {
517
517
  username: string;
518
- login_selection?: "password" | "code" | undefined;
518
+ login_selection?: "code" | "password" | undefined;
519
519
  };
520
520
  };
521
521
  output: {};
@@ -529,7 +529,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
529
529
  } & {
530
530
  form: {
531
531
  username: string;
532
- login_selection?: "password" | "code" | undefined;
532
+ login_selection?: "code" | "password" | undefined;
533
533
  };
534
534
  };
535
535
  output: {};
@@ -165,7 +165,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
165
165
  $get: {
166
166
  input: {
167
167
  param: {
168
- screen: "login" | "signup" | "enter-password" | "reset-password" | "impersonate" | "account" | "consent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
168
+ screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
169
169
  };
170
170
  } & {
171
171
  query: {
@@ -181,7 +181,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
181
181
  } | {
182
182
  input: {
183
183
  param: {
184
- screen: "login" | "signup" | "enter-password" | "reset-password" | "impersonate" | "account" | "consent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
184
+ screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
185
185
  };
186
186
  } & {
187
187
  query: {
@@ -197,7 +197,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
197
197
  } | {
198
198
  input: {
199
199
  param: {
200
- screen: "login" | "signup" | "enter-password" | "reset-password" | "impersonate" | "account" | "consent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
200
+ screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
201
201
  };
202
202
  } & {
203
203
  query: {
@@ -217,7 +217,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
217
217
  $post: {
218
218
  input: {
219
219
  param: {
220
- screen: "login" | "signup" | "enter-password" | "reset-password" | "impersonate" | "consent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
220
+ screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "enter-password" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
221
221
  };
222
222
  } & {
223
223
  query: {
@@ -235,7 +235,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
235
235
  } | {
236
236
  input: {
237
237
  param: {
238
- screen: "login" | "signup" | "enter-password" | "reset-password" | "impersonate" | "consent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
238
+ screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "enter-password" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
239
239
  };
240
240
  } & {
241
241
  query: {
@@ -170,7 +170,7 @@ export declare const u2Routes: OpenAPIHono<{
170
170
  $get: {
171
171
  input: {
172
172
  param: {
173
- screen: "login" | "signup" | "enter-password" | "reset-password" | "impersonate" | "account" | "consent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
173
+ screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
174
174
  };
175
175
  } & {
176
176
  query: {
@@ -186,7 +186,7 @@ export declare const u2Routes: OpenAPIHono<{
186
186
  } | {
187
187
  input: {
188
188
  param: {
189
- screen: "login" | "signup" | "enter-password" | "reset-password" | "impersonate" | "account" | "consent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
189
+ screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
190
190
  };
191
191
  } & {
192
192
  query: {
@@ -202,7 +202,7 @@ export declare const u2Routes: OpenAPIHono<{
202
202
  } | {
203
203
  input: {
204
204
  param: {
205
- screen: "login" | "signup" | "enter-password" | "reset-password" | "impersonate" | "account" | "consent" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
205
+ screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
206
206
  };
207
207
  } & {
208
208
  query: {
@@ -222,7 +222,7 @@ export declare const u2Routes: OpenAPIHono<{
222
222
  $post: {
223
223
  input: {
224
224
  param: {
225
- screen: "login" | "signup" | "enter-password" | "reset-password" | "impersonate" | "consent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
225
+ screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "enter-password" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
226
226
  };
227
227
  } & {
228
228
  query: {
@@ -240,7 +240,7 @@ export declare const u2Routes: OpenAPIHono<{
240
240
  } | {
241
241
  input: {
242
242
  param: {
243
- screen: "login" | "signup" | "enter-password" | "reset-password" | "impersonate" | "consent" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
243
+ screen: "impersonate" | "signup" | "login" | "reset-password" | "consent" | "enter-password" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
244
244
  };
245
245
  } & {
246
246
  query: {
@@ -1,5 +1,6 @@
1
1
  import { CodeExecutor, Connection, ConnectionInsert, CreateTenantParams, DataAdapters, Hook, ResourceServer, ResourceServerInsert, Role, RoleInsert, Tenant, TenantOperation, TenantOperationKind } from "@authhero/adapter-interfaces";
2
2
  import type { RolePermissionHooks, Hooks } from "./Hooks";
3
+ import type { OutboxMetricsSink } from "./OutboxMetrics";
3
4
  import type { SamlSigner } from "@authhero/saml/core";
4
5
  import type { OpenAPIHono } from "@hono/zod-openapi";
5
6
  import type { Handler, MiddlewareHandler } from "hono";
@@ -127,6 +128,32 @@ export interface OutboxConfig {
127
128
  retentionDays?: number;
128
129
  /** Max delivery retries before giving up on an event (default: 5) */
129
130
  maxRetries?: number;
131
+ /**
132
+ * Optional sink for relay metrics (`outbox_events_processed_total`,
133
+ * `outbox_events_dead_lettered_total`, `outbox_retry_delay_seconds`).
134
+ * Left unset, the relay emits nothing beyond its existing console logging.
135
+ */
136
+ metrics?: OutboxMetricsSink;
137
+ /**
138
+ * When set, audit events are additionally archived to a Cloudflare Pipelines
139
+ * stream, which lands them in R2 as an Iceberg table. Left unset, no archive
140
+ * destination is registered and delivery is unchanged.
141
+ *
142
+ * See `apps/docs/architecture/audit-archive.md`.
143
+ */
144
+ pipeline?: OutboxPipelineConfig;
145
+ }
146
+ export interface OutboxPipelineConfig {
147
+ /**
148
+ * Stream HTTP ingest endpoint, e.g. `https://<stream-id>.ingest.cloudflare.com`.
149
+ * Must be https — the destination rejects any other scheme at startup, since
150
+ * every request carries the ingest token and a full audit event.
151
+ */
152
+ endpoint: string;
153
+ /** Stream ingest token, sent as `Authorization: Bearer`. */
154
+ token: string;
155
+ /** Per-request timeout in ms (default: 10_000). */
156
+ timeoutMs?: number;
130
157
  }
131
158
  /**
132
159
  * Mode for the built-in email-based user linking path.
@@ -45,6 +45,18 @@ export type Bindings = {
45
45
  * leave unset (or false) in production so SSRF protection stays on.
46
46
  */
47
47
  ALLOW_PRIVATE_OUTBOUND_FETCH?: boolean;
48
+ /**
49
+ * Clock-skew leeway in seconds applied to a client assertion's `exp`/`nbf`
50
+ * at `POST /oauth/token`. Defaults to 30 when unset.
51
+ */
52
+ CLIENT_ASSERTION_LEEWAY_SECONDS?: number;
53
+ /**
54
+ * Upper bound, in seconds, on a client assertion's lifetime (`exp - iat`,
55
+ * and the absolute `exp` measured from now). RFC 7523 sets no limit, so
56
+ * without one a client can mint an assertion valid for a year. Defaults to
57
+ * 300 when unset.
58
+ */
59
+ CLIENT_ASSERTION_MAX_LIFETIME_SECONDS?: number;
48
60
  /**
49
61
  * Controls where Server-Timing instrumentation goes. The data/cache adapters
50
62
  * and the webhook hook always measure per-operation latency; this decides the
@@ -0,0 +1,47 @@
1
+ /**
2
+ * Metric names emitted by the outbox relay.
3
+ *
4
+ * - `outbox_events_processed_total` — counter, one per event that every
5
+ * accepting destination delivered successfully.
6
+ * - `outbox_events_dead_lettered_total` — counter, one per event successfully
7
+ * moved to the dead-letter state (retries exhausted, or no destination
8
+ * accepted it). Not emitted when the dead-letter write itself fails, since
9
+ * the event has not transitioned.
10
+ * - `outbox_retry_delay_seconds` — observation, emitted once per delivery
11
+ * failure with the backoff delay before the next attempt. Its count doubles
12
+ * as a retry counter.
13
+ */
14
+ export type OutboxMetricName = "outbox_events_processed_total" | "outbox_events_dead_lettered_total" | "outbox_retry_delay_seconds";
15
+ /** A single metric emission from the outbox relay. */
16
+ export interface OutboxMetric {
17
+ name: OutboxMetricName;
18
+ /** Counter increment, or the observed value for `outbox_retry_delay_seconds`. */
19
+ value: number;
20
+ /** Tenant the event belongs to. */
21
+ tenantId: string;
22
+ /** Audit event type, e.g. `hook.post-user-registration`. */
23
+ eventType: string;
24
+ /** Which relay path emitted this: inline per-request, or the cron drain. */
25
+ source: "request" | "cron";
26
+ /** Destination that failed, when the metric was caused by a delivery failure. */
27
+ destination?: string;
28
+ /** Failure reason, for retry and dead-letter metrics. */
29
+ error?: string;
30
+ /** Retry count of the event at the time of emission. */
31
+ retryCount?: number;
32
+ }
33
+ /**
34
+ * Optional sink for outbox relay metrics.
35
+ *
36
+ * Kept deliberately sink-agnostic: `packages/authhero` never knows where the
37
+ * numbers end up. Consumers pass a callback that forwards to whatever they
38
+ * use (Cloudflare Analytics Engine, StatsD, OpenTelemetry, a log line).
39
+ * `@authhero/cloudflare-adapter` ships an Analytics Engine implementation via
40
+ * `createAnalyticsEngineOutboxMetricsSink`.
41
+ *
42
+ * Implementations should be synchronous and must not throw. The relay calls
43
+ * the sink without awaiting it and swallows both synchronous throws and
44
+ * rejections from a promise-returning sink, so a broken sink can never fail
45
+ * event delivery.
46
+ */
47
+ export type OutboxMetricsSink = (metric: OutboxMetric) => void;
@@ -2,5 +2,6 @@ export * from "./Variables";
2
2
  export * from "./Bindings";
3
3
  export * from "./auth0";
4
4
  export * from "./AuthHeroConfig";
5
+ export * from "./OutboxMetrics";
5
6
  export * from "./GrantFlowResult";
6
7
  export * from "./Hooks";
package/package.json CHANGED
@@ -11,7 +11,7 @@
11
11
  "type": "git",
12
12
  "url": "https://github.com/markusahlstrand/authhero"
13
13
  },
14
- "version": "9.9.1",
14
+ "version": "9.10.0",
15
15
  "files": [
16
16
  "dist"
17
17
  ],
@@ -63,8 +63,8 @@
63
63
  "vite": "^8.0.14",
64
64
  "vite-plugin-dts": "^4.5.4",
65
65
  "vitest": "^4.1.7",
66
- "@authhero/kysely-adapter": "12.6.1",
67
- "@authhero/widget": "0.38.6"
66
+ "@authhero/kysely-adapter": "12.6.2",
67
+ "@authhero/widget": "0.38.7"
68
68
  },
69
69
  "dependencies": {
70
70
  "@peculiar/x509": "^1.14.0",
@@ -80,9 +80,9 @@
80
80
  "qrcode": "^1.5.4",
81
81
  "sanitize-html": "^2.17.4",
82
82
  "xstate": "^5.31.1",
83
- "@authhero/adapter-interfaces": "4.11.0",
84
- "@authhero/proxy": "0.10.10",
85
- "@authhero/saml": "0.5.9"
83
+ "@authhero/adapter-interfaces": "4.12.0",
84
+ "@authhero/proxy": "0.10.11",
85
+ "@authhero/saml": "0.5.10"
86
86
  },
87
87
  "peerDependencies": {
88
88
  "@authhero/widget": "^0.1.0",