authhero 5.11.0 → 5.12.0

package/dist/types/routes/management-api/organizations.d.ts

@@ -703,10 +703,10 @@ export declare const organizationRoutes: OpenAPIHono<{
                         email?: string | undefined;
                     };
                     id?: string | undefined;
-                    connection_id?: string | undefined;
                     app_metadata?: Record<string, any> | undefined;
                     user_metadata?: Record<string, any> | undefined;
                     roles?: string[] | undefined;
+                    connection_id?: string | undefined;
                     ttl_sec?: number | undefined;
                     send_invitation_email?: boolean | undefined;
                 };

package/dist/types/routes/management-api/prompts.d.ts

@@ -50,7 +50,7 @@ export declare const promptsRoutes: OpenAPIHono<{
                 };
             };
             output: {
-                prompt: "mfa" | "organizations" | "signup" | "status" | "invitation" | "common" | "consent" | "device-flow" | "email-otp-challenge" | "email-verification" | "login" | "login-id" | "login-password" | "login-passwordless" | "mfa-email" | "mfa-otp" | "mfa-phone" | "mfa-login-options" | "mfa-push" | "mfa-recovery-code" | "mfa-voice" | "mfa-webauthn" | "passkeys" | "reset-password" | "signup-id" | "signup-password" | "captcha" | "custom-form";
+                prompt: "signup" | "status" | "mfa" | "organizations" | "common" | "consent" | "device-flow" | "email-otp-challenge" | "email-verification" | "invitation" | "login" | "login-id" | "login-password" | "login-passwordless" | "mfa-email" | "mfa-otp" | "mfa-phone" | "mfa-login-options" | "mfa-push" | "mfa-recovery-code" | "mfa-voice" | "mfa-webauthn" | "passkeys" | "reset-password" | "signup-id" | "signup-password" | "captcha" | "custom-form";
                 language: string;
             }[];
             outputFormat: "json";
@@ -88,7 +88,7 @@ export declare const promptsRoutes: OpenAPIHono<{
         $get: {
             input: {
                 param: {
-                    prompt: "mfa" | "organizations" | "signup" | "status" | "invitation" | "common" | "consent" | "device-flow" | "email-otp-challenge" | "email-verification" | "login" | "login-id" | "login-password" | "login-passwordless" | "mfa-email" | "mfa-otp" | "mfa-phone" | "mfa-login-options" | "mfa-push" | "mfa-recovery-code" | "mfa-voice" | "mfa-webauthn" | "passkeys" | "reset-password" | "signup-id" | "signup-password" | "captcha" | "custom-form";
+                    prompt: "signup" | "status" | "mfa" | "organizations" | "common" | "consent" | "device-flow" | "email-otp-challenge" | "email-verification" | "invitation" | "login" | "login-id" | "login-password" | "login-passwordless" | "mfa-email" | "mfa-otp" | "mfa-phone" | "mfa-login-options" | "mfa-push" | "mfa-recovery-code" | "mfa-voice" | "mfa-webauthn" | "passkeys" | "reset-password" | "signup-id" | "signup-password" | "captcha" | "custom-form";
                     language: string;
                 };
             } & {
@@ -110,7 +110,7 @@ export declare const promptsRoutes: OpenAPIHono<{
         $put: {
             input: {
                 param: {
-                    prompt: "mfa" | "organizations" | "signup" | "status" | "invitation" | "common" | "consent" | "device-flow" | "email-otp-challenge" | "email-verification" | "login" | "login-id" | "login-password" | "login-passwordless" | "mfa-email" | "mfa-otp" | "mfa-phone" | "mfa-login-options" | "mfa-push" | "mfa-recovery-code" | "mfa-voice" | "mfa-webauthn" | "passkeys" | "reset-password" | "signup-id" | "signup-password" | "captcha" | "custom-form";
+                    prompt: "signup" | "status" | "mfa" | "organizations" | "common" | "consent" | "device-flow" | "email-otp-challenge" | "email-verification" | "invitation" | "login" | "login-id" | "login-password" | "login-passwordless" | "mfa-email" | "mfa-otp" | "mfa-phone" | "mfa-login-options" | "mfa-push" | "mfa-recovery-code" | "mfa-voice" | "mfa-webauthn" | "passkeys" | "reset-password" | "signup-id" | "signup-password" | "captcha" | "custom-form";
                     language: string;
                 };
             } & {
@@ -134,7 +134,7 @@ export declare const promptsRoutes: OpenAPIHono<{
         $delete: {
             input: {
                 param: {
-                    prompt: "mfa" | "organizations" | "signup" | "status" | "invitation" | "common" | "consent" | "device-flow" | "email-otp-challenge" | "email-verification" | "login" | "login-id" | "login-password" | "login-passwordless" | "mfa-email" | "mfa-otp" | "mfa-phone" | "mfa-login-options" | "mfa-push" | "mfa-recovery-code" | "mfa-voice" | "mfa-webauthn" | "passkeys" | "reset-password" | "signup-id" | "signup-password" | "captcha" | "custom-form";
+                    prompt: "signup" | "status" | "mfa" | "organizations" | "common" | "consent" | "device-flow" | "email-otp-challenge" | "email-verification" | "invitation" | "login" | "login-id" | "login-password" | "login-passwordless" | "mfa-email" | "mfa-otp" | "mfa-phone" | "mfa-login-options" | "mfa-push" | "mfa-recovery-code" | "mfa-voice" | "mfa-webauthn" | "passkeys" | "reset-password" | "signup-id" | "signup-password" | "captcha" | "custom-form";
                     language: string;
                 };
             } & {

package/dist/types/routes/management-api/proxy-routes.d.ts

@@ -0,0 +1,221 @@
+import { OpenAPIHono } from "@hono/zod-openapi";
+import { Bindings, Variables } from "../../types";
+export declare const proxyRoutesRoutes: OpenAPIHono<{
+    Bindings: Bindings;
+    Variables: Variables;
+}, {
+    "/": {
+        $get: {
+            input: {
+                query: {
+                    page?: unknown;
+                    per_page?: unknown;
+                    custom_domain_id?: string | undefined;
+                };
+            } & {
+                header: {
+                    "tenant-id"?: string | undefined;
+                };
+            };
+            output: {
+                proxy_routes: {
+                    custom_domain_id: string;
+                    priority: number;
+                    match: {
+                        path: string;
+                        hosts?: string[] | undefined;
+                        methods?: string[] | undefined;
+                        headers?: {
+                            [x: string]: string;
+                        } | undefined;
+                        query?: {
+                            [x: string]: string;
+                        } | undefined;
+                    };
+                    handlers: {
+                        type: string;
+                        options: {
+                            [x: string]: import("hono/utils/types").JSONValue;
+                        };
+                    }[];
+                    id: string;
+                    tenant_id: string;
+                    created_at: string;
+                    updated_at: string;
+                }[];
+                start: number;
+                limit: number;
+                length: number;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/:id": {
+        $get: {
+            input: {
+                param: {
+                    id: string;
+                };
+            } & {
+                header: {
+                    "tenant-id"?: string | undefined;
+                };
+            };
+            output: {
+                custom_domain_id: string;
+                priority: number;
+                match: {
+                    path: string;
+                    hosts?: string[] | undefined;
+                    methods?: string[] | undefined;
+                    headers?: {
+                        [x: string]: string;
+                    } | undefined;
+                    query?: {
+                        [x: string]: string;
+                    } | undefined;
+                };
+                handlers: {
+                    type: string;
+                    options: {
+                        [x: string]: import("hono/utils/types").JSONValue;
+                    };
+                }[];
+                id: string;
+                tenant_id: string;
+                created_at: string;
+                updated_at: string;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/": {
+        $post: {
+            input: {
+                header: {
+                    "tenant-id"?: string | undefined;
+                };
+            } & {
+                json: {
+                    custom_domain_id: string;
+                    match: {
+                        hosts?: string[] | undefined;
+                        methods?: string[] | undefined;
+                        path?: string | undefined;
+                        headers?: Record<string, string> | undefined;
+                        query?: Record<string, string> | undefined;
+                    };
+                    handlers: {
+                        type: string;
+                        options?: Record<string, unknown> | undefined;
+                    }[];
+                    priority?: number | undefined;
+                };
+            };
+            output: {
+                custom_domain_id: string;
+                priority: number;
+                match: {
+                    path: string;
+                    hosts?: string[] | undefined;
+                    methods?: string[] | undefined;
+                    headers?: {
+                        [x: string]: string;
+                    } | undefined;
+                    query?: {
+                        [x: string]: string;
+                    } | undefined;
+                };
+                handlers: {
+                    type: string;
+                    options: {
+                        [x: string]: import("hono/utils/types").JSONValue;
+                    };
+                }[];
+                id: string;
+                tenant_id: string;
+                created_at: string;
+                updated_at: string;
+            };
+            outputFormat: "json";
+            status: 201;
+        };
+    };
+} & {
+    "/:id": {
+        $patch: {
+            input: {
+                param: {
+                    id: string;
+                };
+            } & {
+                header: {
+                    "tenant-id"?: string | undefined;
+                };
+            } & {
+                json: {
+                    priority?: number | undefined;
+                    match?: {
+                        hosts?: string[] | undefined;
+                        methods?: string[] | undefined;
+                        path?: string | undefined;
+                        headers?: Record<string, string> | undefined;
+                        query?: Record<string, string> | undefined;
+                    } | undefined;
+                    handlers?: {
+                        type: string;
+                        options?: Record<string, unknown> | undefined;
+                    }[] | undefined;
+                };
+            };
+            output: {
+                custom_domain_id: string;
+                priority: number;
+                match: {
+                    path: string;
+                    hosts?: string[] | undefined;
+                    methods?: string[] | undefined;
+                    headers?: {
+                        [x: string]: string;
+                    } | undefined;
+                    query?: {
+                        [x: string]: string;
+                    } | undefined;
+                };
+                handlers: {
+                    type: string;
+                    options: {
+                        [x: string]: import("hono/utils/types").JSONValue;
+                    };
+                }[];
+                id: string;
+                tenant_id: string;
+                created_at: string;
+                updated_at: string;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/:id": {
+        $delete: {
+            input: {
+                param: {
+                    id: string;
+                };
+            } & {
+                header: {
+                    "tenant-id"?: string | undefined;
+                };
+            };
+            output: {};
+            outputFormat: string;
+            status: 204;
+        };
+    };
+}, "/">;

package/dist/types/routes/management-api/users.d.ts

@@ -737,7 +737,7 @@ export declare const userRoutes: OpenAPIHono<{
                 };
             };
             output: {
-                type: "gd_send_sms" | "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "cs" | "depnote" | "f" | "fc" | "fce" | "fco" | "fcoa" | "fcp" | "fcph" | "fcpn" | "fcpr" | "fcpro" | "fcu" | "fd" | "fdeac" | "fdeaz" | "fdecc" | "fdu" | "feacft" | "feccft" | "fecte" | "fede" | "federated_logout_failed" | "fens" | "feoobft" | "feotpft" | "fepft" | "fepotpft" | "fercft" | "ferrt" | "fertft" | "fh" | "fimp" | "fi" | "flo" | "flows_execution_completed" | "flows_execution_failed" | "fn" | "forms_submission_failed" | "forms_submission_succeeded" | "fp" | "fpar" | "fpurh" | "fs" | "fsa" | "fu" | "fui" | "fv" | "fvr" | "gd_auth_email_verification" | "gd_auth_fail_email_verification" | "gd_auth_failed" | "gd_auth_rejected" | "gd_auth_succeed" | "gd_enrollment_complete" | "gd_otp_rate_limit_exceed" | "gd_recovery_failed" | "gd_recovery_rate_limit_exceed" | "gd_recovery_succeed" | "gd_send_email" | "gd_send_email_verification" | "gd_send_email_verification_failure" | "gd_send_pn" | "gd_send_pn_failure" | "gd_send_sms_failure" | "gd_send_voice" | "gd_send_voice_failure" | "gd_start_auth" | "gd_start_enroll" | "gd_start_enroll_failed" | "gd_tenant_update" | "gd_unenroll" | "gd_update_device_account" | "gd_webauthn_challenge_failed" | "gd_webauthn_enrollment_failed" | "kms_key_management_failure" | "kms_key_management_success" | "kms_key_state_changed" | "limit_delegation" | "limit_mu" | "limit_sul" | "limit_wc" | "i" | "mfar" | "mgmt_api_read" | "my_account_authentication_method_failed" | "my_account_authentication_method_succeeded" | "oidc_backchannel_logout_failed" | "oidc_backchannel_logout_succeeded" | "organization_member_added" | "passkey_challenge_failed" | "passkey_challenge_started" | "pla" | "pwd_leak" | "reset_pwd_leak" | "resource_cleanup" | "rich_consents_access_error" | "s" | "sapi" | "fapi" | "sce" | "scoa" | "scp" | "scpn" | "scpr" | "scu" | "scv" | "sd" | "sdu" | "seacft" | "seccft" | "secte" | "sede" | "sens" | "seoobft" | "seotpft" | "sepotpft" | "sepft" | "sepkoobft" | "sepkotpft" | "sepkrcft" | "sercft" | "sertft" | "simp" | "si" | "signup_pwd_leak" | "slo" | "sh" | "spm" | "srrt" | "ss" | "ss_sso_failure" | "ss_sso_info" | "ss_sso_success" | "ssa" | "sscim" | "sui" | "sv" | "svr" | "too_many_records" | "ublkdu" | "universal_logout_failed" | "universal_logout_succeeded" | "w" | "wn" | "wum";
+                type: "fn" | "sapi" | "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "cs" | "depnote" | "f" | "fc" | "fce" | "fco" | "fcoa" | "fcp" | "fcph" | "fcpn" | "fcpr" | "fcpro" | "fcu" | "fd" | "fdeac" | "fdeaz" | "fdecc" | "fdu" | "feacft" | "feccft" | "fecte" | "fede" | "federated_logout_failed" | "fens" | "feoobft" | "feotpft" | "fepft" | "fepotpft" | "fercft" | "ferrt" | "fertft" | "fh" | "fimp" | "fi" | "flo" | "flows_execution_completed" | "flows_execution_failed" | "forms_submission_failed" | "forms_submission_succeeded" | "fp" | "fpar" | "fpurh" | "fs" | "fsa" | "fu" | "fui" | "fv" | "fvr" | "gd_auth_email_verification" | "gd_auth_fail_email_verification" | "gd_auth_failed" | "gd_auth_rejected" | "gd_auth_succeed" | "gd_enrollment_complete" | "gd_otp_rate_limit_exceed" | "gd_recovery_failed" | "gd_recovery_rate_limit_exceed" | "gd_recovery_succeed" | "gd_send_email" | "gd_send_email_verification" | "gd_send_email_verification_failure" | "gd_send_pn" | "gd_send_pn_failure" | "gd_send_sms" | "gd_send_sms_failure" | "gd_send_voice" | "gd_send_voice_failure" | "gd_start_auth" | "gd_start_enroll" | "gd_start_enroll_failed" | "gd_tenant_update" | "gd_unenroll" | "gd_update_device_account" | "gd_webauthn_challenge_failed" | "gd_webauthn_enrollment_failed" | "kms_key_management_failure" | "kms_key_management_success" | "kms_key_state_changed" | "limit_delegation" | "limit_mu" | "limit_sul" | "limit_wc" | "i" | "mfar" | "mgmt_api_read" | "my_account_authentication_method_failed" | "my_account_authentication_method_succeeded" | "oidc_backchannel_logout_failed" | "oidc_backchannel_logout_succeeded" | "organization_member_added" | "passkey_challenge_failed" | "passkey_challenge_started" | "pla" | "pwd_leak" | "reset_pwd_leak" | "resource_cleanup" | "rich_consents_access_error" | "s" | "fapi" | "sce" | "scoa" | "scp" | "scpn" | "scpr" | "scu" | "scv" | "sd" | "sdu" | "seacft" | "seccft" | "secte" | "sede" | "sens" | "seoobft" | "seotpft" | "sepotpft" | "sepft" | "sepkoobft" | "sepkotpft" | "sepkrcft" | "sercft" | "sertft" | "simp" | "si" | "signup_pwd_leak" | "slo" | "sh" | "spm" | "srrt" | "ss" | "ss_sso_failure" | "ss_sso_info" | "ss_sso_success" | "ssa" | "sscim" | "sui" | "sv" | "svr" | "too_many_records" | "ublkdu" | "universal_logout_failed" | "universal_logout_succeeded" | "w" | "wn" | "wum";
                 date: string;
                 isMobile: boolean;
                 log_id: string;
@@ -776,7 +776,7 @@ export declare const userRoutes: OpenAPIHono<{
                 limit: number;
                 length: number;
                 logs: {
-                    type: "gd_send_sms" | "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "cs" | "depnote" | "f" | "fc" | "fce" | "fco" | "fcoa" | "fcp" | "fcph" | "fcpn" | "fcpr" | "fcpro" | "fcu" | "fd" | "fdeac" | "fdeaz" | "fdecc" | "fdu" | "feacft" | "feccft" | "fecte" | "fede" | "federated_logout_failed" | "fens" | "feoobft" | "feotpft" | "fepft" | "fepotpft" | "fercft" | "ferrt" | "fertft" | "fh" | "fimp" | "fi" | "flo" | "flows_execution_completed" | "flows_execution_failed" | "fn" | "forms_submission_failed" | "forms_submission_succeeded" | "fp" | "fpar" | "fpurh" | "fs" | "fsa" | "fu" | "fui" | "fv" | "fvr" | "gd_auth_email_verification" | "gd_auth_fail_email_verification" | "gd_auth_failed" | "gd_auth_rejected" | "gd_auth_succeed" | "gd_enrollment_complete" | "gd_otp_rate_limit_exceed" | "gd_recovery_failed" | "gd_recovery_rate_limit_exceed" | "gd_recovery_succeed" | "gd_send_email" | "gd_send_email_verification" | "gd_send_email_verification_failure" | "gd_send_pn" | "gd_send_pn_failure" | "gd_send_sms_failure" | "gd_send_voice" | "gd_send_voice_failure" | "gd_start_auth" | "gd_start_enroll" | "gd_start_enroll_failed" | "gd_tenant_update" | "gd_unenroll" | "gd_update_device_account" | "gd_webauthn_challenge_failed" | "gd_webauthn_enrollment_failed" | "kms_key_management_failure" | "kms_key_management_success" | "kms_key_state_changed" | "limit_delegation" | "limit_mu" | "limit_sul" | "limit_wc" | "i" | "mfar" | "mgmt_api_read" | "my_account_authentication_method_failed" | "my_account_authentication_method_succeeded" | "oidc_backchannel_logout_failed" | "oidc_backchannel_logout_succeeded" | "organization_member_added" | "passkey_challenge_failed" | "passkey_challenge_started" | "pla" | "pwd_leak" | "reset_pwd_leak" | "resource_cleanup" | "rich_consents_access_error" | "s" | "sapi" | "fapi" | "sce" | "scoa" | "scp" | "scpn" | "scpr" | "scu" | "scv" | "sd" | "sdu" | "seacft" | "seccft" | "secte" | "sede" | "sens" | "seoobft" | "seotpft" | "sepotpft" | "sepft" | "sepkoobft" | "sepkotpft" | "sepkrcft" | "sercft" | "sertft" | "simp" | "si" | "signup_pwd_leak" | "slo" | "sh" | "spm" | "srrt" | "ss" | "ss_sso_failure" | "ss_sso_info" | "ss_sso_success" | "ssa" | "sscim" | "sui" | "sv" | "svr" | "too_many_records" | "ublkdu" | "universal_logout_failed" | "universal_logout_succeeded" | "w" | "wn" | "wum";
+                    type: "fn" | "sapi" | "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "cs" | "depnote" | "f" | "fc" | "fce" | "fco" | "fcoa" | "fcp" | "fcph" | "fcpn" | "fcpr" | "fcpro" | "fcu" | "fd" | "fdeac" | "fdeaz" | "fdecc" | "fdu" | "feacft" | "feccft" | "fecte" | "fede" | "federated_logout_failed" | "fens" | "feoobft" | "feotpft" | "fepft" | "fepotpft" | "fercft" | "ferrt" | "fertft" | "fh" | "fimp" | "fi" | "flo" | "flows_execution_completed" | "flows_execution_failed" | "forms_submission_failed" | "forms_submission_succeeded" | "fp" | "fpar" | "fpurh" | "fs" | "fsa" | "fu" | "fui" | "fv" | "fvr" | "gd_auth_email_verification" | "gd_auth_fail_email_verification" | "gd_auth_failed" | "gd_auth_rejected" | "gd_auth_succeed" | "gd_enrollment_complete" | "gd_otp_rate_limit_exceed" | "gd_recovery_failed" | "gd_recovery_rate_limit_exceed" | "gd_recovery_succeed" | "gd_send_email" | "gd_send_email_verification" | "gd_send_email_verification_failure" | "gd_send_pn" | "gd_send_pn_failure" | "gd_send_sms" | "gd_send_sms_failure" | "gd_send_voice" | "gd_send_voice_failure" | "gd_start_auth" | "gd_start_enroll" | "gd_start_enroll_failed" | "gd_tenant_update" | "gd_unenroll" | "gd_update_device_account" | "gd_webauthn_challenge_failed" | "gd_webauthn_enrollment_failed" | "kms_key_management_failure" | "kms_key_management_success" | "kms_key_state_changed" | "limit_delegation" | "limit_mu" | "limit_sul" | "limit_wc" | "i" | "mfar" | "mgmt_api_read" | "my_account_authentication_method_failed" | "my_account_authentication_method_succeeded" | "oidc_backchannel_logout_failed" | "oidc_backchannel_logout_succeeded" | "organization_member_added" | "passkey_challenge_failed" | "passkey_challenge_started" | "pla" | "pwd_leak" | "reset_pwd_leak" | "resource_cleanup" | "rich_consents_access_error" | "s" | "fapi" | "sce" | "scoa" | "scp" | "scpn" | "scpr" | "scu" | "scv" | "sd" | "sdu" | "seacft" | "seccft" | "secte" | "sede" | "sens" | "seoobft" | "seotpft" | "sepotpft" | "sepft" | "sepkoobft" | "sepkotpft" | "sepkrcft" | "sercft" | "sertft" | "simp" | "si" | "signup_pwd_leak" | "slo" | "sh" | "spm" | "srrt" | "ss" | "ss_sso_failure" | "ss_sso_info" | "ss_sso_success" | "ssa" | "sscim" | "sui" | "sv" | "svr" | "too_many_records" | "ublkdu" | "universal_logout_failed" | "universal_logout_succeeded" | "w" | "wn" | "wum";
                     date: string;
                     isMobile: boolean;
                     log_id: string;

package/dist/types/routes/proxy-control-plane/index.d.ts

@@ -0,0 +1,22 @@
+import { Hono } from "hono";
+import type { ResolvedHost } from "@authhero/proxy";
+export interface ProxyControlPlaneOptions {
+    /**
+     * Cross-tenant host resolver. Typically delegated to a database adapter's
+     * `createProxyDataAdapter(db).resolveHost`.
+     */
+    resolveHost: (host: string) => Promise<ResolvedHost | null>;
+    /**
+     * Authentication check for incoming requests. Return `true` to allow,
+     * `false` to reject with 401. The control-plane endpoint is cross-tenant
+     * and must not be exposed to regular tenant tokens — use a dedicated
+     * proxy-reader credential (shared secret, mTLS, JWT with `proxy:resolve_host`
+     * scope, …).
+     */
+    authenticate: (request: Request) => Promise<boolean> | boolean;
+}
+/**
+ * Returns a Hono app exposing the privileged proxy control-plane endpoint
+ * `GET /hosts/:host`. Mount under `/api/v2/proxy/control-plane`.
+ */
+export declare function createProxyControlPlaneApp(options: ProxyControlPlaneOptions): Hono;

package/dist/types/routes/universal-login/common.d.ts

@@ -436,7 +436,7 @@ export declare function initJSXRoute(ctx: Context<{
         custom_login_page_preview?: string | undefined;
         form_template?: string | undefined;
         addons?: Record<string, any> | undefined;
-        token_endpoint_auth_method?: "none" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | "private_key_jwt" | undefined;
+        token_endpoint_auth_method?: "client_secret_post" | "client_secret_basic" | "none" | "client_secret_jwt" | "private_key_jwt" | undefined;
         client_metadata?: Record<string, string> | undefined;
         hide_sign_up_disabled_error?: boolean | undefined;
         mobile?: Record<string, any> | undefined;
@@ -1133,7 +1133,7 @@ export declare function initJSXRouteWithSession(ctx: Context<{
         custom_login_page_preview?: string | undefined;
         form_template?: string | undefined;
         addons?: Record<string, any> | undefined;
-        token_endpoint_auth_method?: "none" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | "private_key_jwt" | undefined;
+        token_endpoint_auth_method?: "client_secret_post" | "client_secret_basic" | "none" | "client_secret_jwt" | "private_key_jwt" | undefined;
         client_metadata?: Record<string, string> | undefined;
         hide_sign_up_disabled_error?: boolean | undefined;
         mobile?: Record<string, any> | undefined;

package/dist/types/types/AuthHeroConfig.d.ts

@@ -276,6 +276,20 @@ export interface AuthHeroConfig {
      * ```
      */
     managementApiExtensions?: ManagementApiExtension[];
+    /**
+     * Optional privileged control-plane endpoint for the `@authhero/proxy`
+     * data plane. When set, mounts `GET /api/v2/proxy/control-plane/hosts/:host`
+     * which returns the cross-tenant `ResolvedHost` for the given hostname.
+     *
+     * This endpoint is read by remote proxy deployments via
+     * `createHttpProxyAdapter`. It is **cross-tenant** — gate it with a
+     * dedicated credential (shared secret, mTLS, or a JWT scoped to
+     * `proxy:resolve_host`), never with a tenant token.
+     */
+    proxyControlPlane?: {
+        resolveHost: (host: string) => Promise<import("@authhero/proxy").ResolvedHost | null>;
+        authenticate: (request: Request) => Promise<boolean> | boolean;
+    };
     /**
      * Optional powered-by logo to display at the bottom left of the login widget.
      * This is only configurable in code, not stored in the database.

package/dist/types/types/IdToken.d.ts

@@ -18,13 +18,13 @@ export declare const idTokenSchema: z.ZodObject<{
     c_hash: z.ZodOptional<z.ZodString>;
 }, z.core.$loose>;
 export declare const userInfoSchema: z.ZodObject<{
-    email: z.ZodOptional<z.ZodString>;
     name: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodString>;
+    given_name: z.ZodOptional<z.ZodString>;
+    family_name: z.ZodOptional<z.ZodString>;
     sub: z.ZodString;
     iss: z.ZodString;
     aud: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
     exp: z.ZodNumber;
-    given_name: z.ZodOptional<z.ZodString>;
-    family_name: z.ZodOptional<z.ZodString>;
 }, z.core.$loose>;
 export type IdToken = z.infer<typeof idTokenSchema>;

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/markusahlstrand/authhero"
   },
-  "version": "5.11.0",
+  "version": "5.12.0",
   "files": [
     "dist"
   ],
@@ -62,8 +62,8 @@
     "vite": "^8.0.14",
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^4.1.7",
-    "@authhero/kysely-adapter": "11.4.1",
-    "@authhero/widget": "0.32.29"
+    "@authhero/kysely-adapter": "11.5.0",
+    "@authhero/widget": "0.32.30"
   },
   "dependencies": {
     "@peculiar/x509": "^1.14.0",
@@ -81,7 +81,8 @@
     "qrcode": "^1.5.4",
     "sanitize-html": "^2.17.4",
     "xstate": "^5.31.1",
-    "@authhero/adapter-interfaces": "2.7.0",
+    "@authhero/adapter-interfaces": "2.8.0",
+    "@authhero/proxy": "0.3.0",
     "@authhero/saml": "0.4.1"
   },
   "peerDependencies": {