authhero 5.19.0 → 5.21.0

package/dist/types/provisioning/index.d.ts

@@ -0,0 +1,2 @@
+export { NoopTenantProvisioner } from "./noop-provisioner";
+export type { TenantProvisioner, TenantProvisionerContext, } from "./provisioner";

package/dist/types/provisioning/noop-provisioner.d.ts

@@ -0,0 +1,11 @@
+import type { Tenant } from "@authhero/adapter-interfaces";
+import type { TenantProvisioner, TenantProvisionerContext } from "./provisioner";
+/**
+ * Default provisioner. Flips `provisioning_state` to `"ready"` and clears any
+ * prior error, doing nothing else. Correct for `deployment_type: "shared"`
+ * tenants (the historical default) and useful as a stand-in until the
+ * Cloudflare WFP provisioner is wired in.
+ */
+export declare class NoopTenantProvisioner implements TenantProvisioner {
+    provision(tenant: Tenant, ctx: TenantProvisionerContext): Promise<void>;
+}

package/dist/types/provisioning/provisioner.d.ts

@@ -0,0 +1,25 @@
+import type { Tenant, TenantsDataAdapter } from "@authhero/adapter-interfaces";
+export interface TenantProvisionerContext {
+    tenants: TenantsDataAdapter;
+}
+/**
+ * Drives a tenant from `provisioning_state: "pending"` to `"ready"` or
+ * `"failed"`. Owns whatever side effects are required to make the tenant
+ * actually serve traffic — creating a D1, uploading a worker to a dispatch
+ * namespace, wiring secrets, etc. — and writes the resulting state back via
+ * `ctx.tenants.update(...)`.
+ *
+ * Contract:
+ *  - Implementations MUST be idempotent. The same tenant may be passed in
+ *    twice if a previous run crashed mid-flight, the API is retried, or an
+ *    operator manually re-triggers provisioning.
+ *  - `provision()` MUST resolve (not reject) even on failure. Errors should
+ *    be captured into `provisioning_error` and the state set to `"failed"`
+ *    so the admin UI can render a useful message.
+ *  - `provision()` should be safe to schedule via `ctx.executionCtx.waitUntil`
+ *    on Cloudflare Workers — it must not depend on the originating request
+ *    surviving.
+ */
+export interface TenantProvisioner {
+    provision(tenant: Tenant, ctx: TenantProvisionerContext): Promise<void>;
+}

package/dist/types/routes/auth-api/index.d.ts

@@ -288,7 +288,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
                     scope?: string | undefined;
                     grant_types?: string[] | undefined;
                     response_types?: string[] | undefined;
-                    token_endpoint_auth_method?: "none" | "private_key_jwt" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | undefined;
+                    token_endpoint_auth_method?: "client_secret_post" | "client_secret_basic" | "none" | "client_secret_jwt" | "private_key_jwt" | undefined;
                     jwks_uri?: string | undefined;
                     jwks?: Record<string, unknown> | undefined;
                     software_id?: string | undefined;
@@ -377,7 +377,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
                     scope?: string | undefined;
                     grant_types?: string[] | undefined;
                     response_types?: string[] | undefined;
-                    token_endpoint_auth_method?: "none" | "private_key_jwt" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | undefined;
+                    token_endpoint_auth_method?: "client_secret_post" | "client_secret_basic" | "none" | "client_secret_jwt" | "private_key_jwt" | undefined;
                     jwks_uri?: string | undefined;
                     jwks?: Record<string, unknown> | undefined;
                     software_id?: string | undefined;
@@ -723,20 +723,20 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
                     email: string;
                     send: "code" | "link";
                     authParams: {
-                        username?: string | undefined;
-                        state?: string | undefined;
                         audience?: string | undefined;
                         response_type?: import("@authhero/adapter-interfaces").AuthorizationResponseType | undefined;
                         response_mode?: import("@authhero/adapter-interfaces").AuthorizationResponseMode | undefined;
                         scope?: string | undefined;
+                        username?: string | undefined;
+                        state?: string | undefined;
+                        prompt?: string | undefined;
+                        ui_locales?: string | undefined;
                         organization?: string | undefined;
-                        nonce?: string | undefined;
                         redirect_uri?: string | undefined;
                         act_as?: string | undefined;
-                        prompt?: string | undefined;
+                        nonce?: string | undefined;
                         code_challenge_method?: import("@authhero/adapter-interfaces").CodeChallengeMethod | undefined;
                         code_challenge?: string | undefined;
-                        ui_locales?: string | undefined;
                         max_age?: number | undefined;
                         acr_values?: string | undefined;
                         claims?: {
@@ -759,20 +759,20 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
                     phone_number: string;
                     send: "code" | "link";
                     authParams: {
-                        username?: string | undefined;
-                        state?: string | undefined;
                         audience?: string | undefined;
                         response_type?: import("@authhero/adapter-interfaces").AuthorizationResponseType | undefined;
                         response_mode?: import("@authhero/adapter-interfaces").AuthorizationResponseMode | undefined;
                         scope?: string | undefined;
+                        username?: string | undefined;
+                        state?: string | undefined;
+                        prompt?: string | undefined;
+                        ui_locales?: string | undefined;
                         organization?: string | undefined;
-                        nonce?: string | undefined;
                         redirect_uri?: string | undefined;
                         act_as?: string | undefined;
-                        prompt?: string | undefined;
+                        nonce?: string | undefined;
                         code_challenge_method?: import("@authhero/adapter-interfaces").CodeChallengeMethod | undefined;
                         code_challenge?: string | undefined;
-                        ui_locales?: string | undefined;
                         max_age?: number | undefined;
                         acr_values?: string | undefined;
                         claims?: {
@@ -903,14 +903,14 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
             input: {
                 form: {
                     token: string;
-                    token_type_hint?: "refresh_token" | "access_token" | undefined;
+                    token_type_hint?: "access_token" | "refresh_token" | undefined;
                     client_id?: string | undefined;
                     client_secret?: string | undefined;
                 };
             } & {
                 json: {
                     token: string;
-                    token_type_hint?: "refresh_token" | "access_token" | undefined;
+                    token_type_hint?: "access_token" | "refresh_token" | undefined;
                     client_id?: string | undefined;
                     client_secret?: string | undefined;
                 };
@@ -922,14 +922,14 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
             input: {
                 form: {
                     token: string;
-                    token_type_hint?: "refresh_token" | "access_token" | undefined;
+                    token_type_hint?: "access_token" | "refresh_token" | undefined;
                     client_id?: string | undefined;
                     client_secret?: string | undefined;
                 };
             } & {
                 json: {
                     token: string;
-                    token_type_hint?: "refresh_token" | "access_token" | undefined;
+                    token_type_hint?: "access_token" | "refresh_token" | undefined;
                     client_id?: string | undefined;
                     client_secret?: string | undefined;
                 };
@@ -944,14 +944,14 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
             input: {
                 form: {
                     token: string;
-                    token_type_hint?: "refresh_token" | "access_token" | undefined;
+                    token_type_hint?: "access_token" | "refresh_token" | undefined;
                     client_id?: string | undefined;
                     client_secret?: string | undefined;
                 };
             } & {
                 json: {
                     token: string;
-                    token_type_hint?: "refresh_token" | "access_token" | undefined;
+                    token_type_hint?: "access_token" | "refresh_token" | undefined;
                     client_id?: string | undefined;
                     client_secret?: string | undefined;
                 };
@@ -1002,6 +1002,17 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
                     username: string;
                     otp: string;
                     realm: "sms" | "email";
+                } | {
+                    grant_type: "urn:ietf:params:oauth:grant-type:token-exchange";
+                    subject_token: string;
+                    subject_token_type: "urn:ietf:params:oauth:token-type:access_token";
+                    organization: string;
+                    audience?: string | undefined;
+                    scope?: string | undefined;
+                    client_id?: string | undefined;
+                    client_secret?: string | undefined;
+                    client_assertion?: string | undefined;
+                    client_assertion_type?: string | undefined;
                 };
             } & {
                 json: {
@@ -1038,6 +1049,17 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
                     username: string;
                     otp: string;
                     realm: "sms" | "email";
+                } | {
+                    grant_type: "urn:ietf:params:oauth:grant-type:token-exchange";
+                    subject_token: string;
+                    subject_token_type: "urn:ietf:params:oauth:token-type:access_token";
+                    organization: string;
+                    audience?: string | undefined;
+                    scope?: string | undefined;
+                    client_id?: string | undefined;
+                    client_secret?: string | undefined;
+                    client_assertion?: string | undefined;
+                    client_assertion_type?: string | undefined;
                 };
             };
             output: {};
@@ -1079,6 +1101,17 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
                     username: string;
                     otp: string;
                     realm: "sms" | "email";
+                } | {
+                    grant_type: "urn:ietf:params:oauth:grant-type:token-exchange";
+                    subject_token: string;
+                    subject_token_type: "urn:ietf:params:oauth:token-type:access_token";
+                    organization: string;
+                    audience?: string | undefined;
+                    scope?: string | undefined;
+                    client_id?: string | undefined;
+                    client_secret?: string | undefined;
+                    client_assertion?: string | undefined;
+                    client_assertion_type?: string | undefined;
                 };
             } & {
                 json: {
@@ -1115,6 +1148,17 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
                     username: string;
                     otp: string;
                     realm: "sms" | "email";
+                } | {
+                    grant_type: "urn:ietf:params:oauth:grant-type:token-exchange";
+                    subject_token: string;
+                    subject_token_type: "urn:ietf:params:oauth:token-type:access_token";
+                    organization: string;
+                    audience?: string | undefined;
+                    scope?: string | undefined;
+                    client_id?: string | undefined;
+                    client_secret?: string | undefined;
+                    client_assertion?: string | undefined;
+                    client_assertion_type?: string | undefined;
                 };
             };
             output: {
@@ -1164,6 +1208,17 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
                     username: string;
                     otp: string;
                     realm: "sms" | "email";
+                } | {
+                    grant_type: "urn:ietf:params:oauth:grant-type:token-exchange";
+                    subject_token: string;
+                    subject_token_type: "urn:ietf:params:oauth:token-type:access_token";
+                    organization: string;
+                    audience?: string | undefined;
+                    scope?: string | undefined;
+                    client_id?: string | undefined;
+                    client_secret?: string | undefined;
+                    client_assertion?: string | undefined;
+                    client_assertion_type?: string | undefined;
                 };
             } & {
                 json: {
@@ -1200,6 +1255,17 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
                     username: string;
                     otp: string;
                     realm: "sms" | "email";
+                } | {
+                    grant_type: "urn:ietf:params:oauth:grant-type:token-exchange";
+                    subject_token: string;
+                    subject_token_type: "urn:ietf:params:oauth:token-type:access_token";
+                    organization: string;
+                    audience?: string | undefined;
+                    scope?: string | undefined;
+                    client_id?: string | undefined;
+                    client_secret?: string | undefined;
+                    client_assertion?: string | undefined;
+                    client_assertion_type?: string | undefined;
                 };
             };
             output: {
@@ -1244,6 +1310,17 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
                     username: string;
                     otp: string;
                     realm: "sms" | "email";
+                } | {
+                    grant_type: "urn:ietf:params:oauth:grant-type:token-exchange";
+                    subject_token: string;
+                    subject_token_type: "urn:ietf:params:oauth:token-type:access_token";
+                    organization: string;
+                    audience?: string | undefined;
+                    scope?: string | undefined;
+                    client_id?: string | undefined;
+                    client_secret?: string | undefined;
+                    client_assertion?: string | undefined;
+                    client_assertion_type?: string | undefined;
                 };
             } & {
                 json: {
@@ -1280,6 +1357,17 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
                     username: string;
                     otp: string;
                     realm: "sms" | "email";
+                } | {
+                    grant_type: "urn:ietf:params:oauth:grant-type:token-exchange";
+                    subject_token: string;
+                    subject_token_type: "urn:ietf:params:oauth:token-type:access_token";
+                    organization: string;
+                    audience?: string | undefined;
+                    scope?: string | undefined;
+                    client_id?: string | undefined;
+                    client_secret?: string | undefined;
+                    client_assertion?: string | undefined;
+                    client_assertion_type?: string | undefined;
                 };
             };
             output: {
@@ -1324,6 +1412,17 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
                     username: string;
                     otp: string;
                     realm: "sms" | "email";
+                } | {
+                    grant_type: "urn:ietf:params:oauth:grant-type:token-exchange";
+                    subject_token: string;
+                    subject_token_type: "urn:ietf:params:oauth:token-type:access_token";
+                    organization: string;
+                    audience?: string | undefined;
+                    scope?: string | undefined;
+                    client_id?: string | undefined;
+                    client_secret?: string | undefined;
+                    client_assertion?: string | undefined;
+                    client_assertion_type?: string | undefined;
                 };
             } & {
                 json: {
@@ -1360,6 +1459,17 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
                     username: string;
                     otp: string;
                     realm: "sms" | "email";
+                } | {
+                    grant_type: "urn:ietf:params:oauth:grant-type:token-exchange";
+                    subject_token: string;
+                    subject_token_type: "urn:ietf:params:oauth:token-type:access_token";
+                    organization: string;
+                    audience?: string | undefined;
+                    scope?: string | undefined;
+                    client_id?: string | undefined;
+                    client_secret?: string | undefined;
+                    client_assertion?: string | undefined;
+                    client_assertion_type?: string | undefined;
                 };
             };
             output: {
@@ -1377,8 +1487,8 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
             output: {
                 keys: {
                     alg: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "HS256" | "HS384" | "HS512";
-                    kid: string;
                     kty: "EC" | "RSA" | "oct";
+                    kid?: string | undefined;
                     use?: "sig" | "enc" | undefined;
                     n?: string | undefined;
                     e?: string | undefined;

package/dist/types/routes/auth-api/passwordless.d.ts

@@ -14,20 +14,20 @@ export declare const passwordlessRoutes: OpenAPIHono<{
                     email: string;
                     send: "code" | "link";
                     authParams: {
-                        username?: string | undefined;
-                        state?: string | undefined;
                         audience?: string | undefined;
                         response_type?: AuthorizationResponseType | undefined;
                         response_mode?: import("@authhero/adapter-interfaces").AuthorizationResponseMode | undefined;
                         scope?: string | undefined;
+                        username?: string | undefined;
+                        state?: string | undefined;
+                        prompt?: string | undefined;
+                        ui_locales?: string | undefined;
                         organization?: string | undefined;
-                        nonce?: string | undefined;
                         redirect_uri?: string | undefined;
                         act_as?: string | undefined;
-                        prompt?: string | undefined;
+                        nonce?: string | undefined;
                         code_challenge_method?: import("@authhero/adapter-interfaces").CodeChallengeMethod | undefined;
                         code_challenge?: string | undefined;
-                        ui_locales?: string | undefined;
                         max_age?: number | undefined;
                         acr_values?: string | undefined;
                         claims?: {
@@ -50,20 +50,20 @@ export declare const passwordlessRoutes: OpenAPIHono<{
                     phone_number: string;
                     send: "code" | "link";
                     authParams: {
-                        username?: string | undefined;
-                        state?: string | undefined;
                         audience?: string | undefined;
                         response_type?: AuthorizationResponseType | undefined;
                         response_mode?: import("@authhero/adapter-interfaces").AuthorizationResponseMode | undefined;
                         scope?: string | undefined;
+                        username?: string | undefined;
+                        state?: string | undefined;
+                        prompt?: string | undefined;
+                        ui_locales?: string | undefined;
                         organization?: string | undefined;
-                        nonce?: string | undefined;
                         redirect_uri?: string | undefined;
                         act_as?: string | undefined;
-                        prompt?: string | undefined;
+                        nonce?: string | undefined;
                         code_challenge_method?: import("@authhero/adapter-interfaces").CodeChallengeMethod | undefined;
                         code_challenge?: string | undefined;
-                        ui_locales?: string | undefined;
                         max_age?: number | undefined;
                         acr_values?: string | undefined;
                         claims?: {

package/dist/types/routes/auth-api/register/index.d.ts

@@ -18,7 +18,7 @@ export declare const registerRoutes: OpenAPIHono<{
                     scope?: string | undefined;
                     grant_types?: string[] | undefined;
                     response_types?: string[] | undefined;
-                    token_endpoint_auth_method?: "none" | "private_key_jwt" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | undefined;
+                    token_endpoint_auth_method?: "client_secret_post" | "client_secret_basic" | "none" | "client_secret_jwt" | "private_key_jwt" | undefined;
                     jwks_uri?: string | undefined;
                     jwks?: Record<string, unknown> | undefined;
                     software_id?: string | undefined;
@@ -107,7 +107,7 @@ export declare const registerRoutes: OpenAPIHono<{
                     scope?: string | undefined;
                     grant_types?: string[] | undefined;
                     response_types?: string[] | undefined;
-                    token_endpoint_auth_method?: "none" | "private_key_jwt" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | undefined;
+                    token_endpoint_auth_method?: "client_secret_post" | "client_secret_basic" | "none" | "client_secret_jwt" | "private_key_jwt" | undefined;
                     jwks_uri?: string | undefined;
                     jwks?: Record<string, unknown> | undefined;
                     software_id?: string | undefined;

package/dist/types/routes/auth-api/revoke.d.ts

@@ -9,14 +9,14 @@ export declare const revokeRoutes: OpenAPIHono<{
             input: {
                 form: {
                     token: string;
-                    token_type_hint?: "refresh_token" | "access_token" | undefined;
+                    token_type_hint?: "access_token" | "refresh_token" | undefined;
                     client_id?: string | undefined;
                     client_secret?: string | undefined;
                 };
             } & {
                 json: {
                     token: string;
-                    token_type_hint?: "refresh_token" | "access_token" | undefined;
+                    token_type_hint?: "access_token" | "refresh_token" | undefined;
                     client_id?: string | undefined;
                     client_secret?: string | undefined;
                 };
@@ -28,14 +28,14 @@ export declare const revokeRoutes: OpenAPIHono<{
             input: {
                 form: {
                     token: string;
-                    token_type_hint?: "refresh_token" | "access_token" | undefined;
+                    token_type_hint?: "access_token" | "refresh_token" | undefined;
                     client_id?: string | undefined;
                     client_secret?: string | undefined;
                 };
             } & {
                 json: {
                     token: string;
-                    token_type_hint?: "refresh_token" | "access_token" | undefined;
+                    token_type_hint?: "access_token" | "refresh_token" | undefined;
                     client_id?: string | undefined;
                     client_secret?: string | undefined;
                 };
@@ -50,14 +50,14 @@ export declare const revokeRoutes: OpenAPIHono<{
             input: {
                 form: {
                     token: string;
-                    token_type_hint?: "refresh_token" | "access_token" | undefined;
+                    token_type_hint?: "access_token" | "refresh_token" | undefined;
                     client_id?: string | undefined;
                     client_secret?: string | undefined;
                 };
             } & {
                 json: {
                     token: string;
-                    token_type_hint?: "refresh_token" | "access_token" | undefined;
+                    token_type_hint?: "access_token" | "refresh_token" | undefined;
                     client_id?: string | undefined;
                     client_secret?: string | undefined;
                 };

package/dist/types/routes/auth-api/token.d.ts

@@ -41,6 +41,17 @@ export declare const tokenRoutes: OpenAPIHono<{
                     username: string;
                     otp: string;
                     realm: "sms" | "email";
+                } | {
+                    grant_type: "urn:ietf:params:oauth:grant-type:token-exchange";
+                    subject_token: string;
+                    subject_token_type: "urn:ietf:params:oauth:token-type:access_token";
+                    organization: string;
+                    audience?: string | undefined;
+                    scope?: string | undefined;
+                    client_id?: string | undefined;
+                    client_secret?: string | undefined;
+                    client_assertion?: string | undefined;
+                    client_assertion_type?: string | undefined;
                 };
             } & {
                 json: {
@@ -77,6 +88,17 @@ export declare const tokenRoutes: OpenAPIHono<{
                     username: string;
                     otp: string;
                     realm: "sms" | "email";
+                } | {
+                    grant_type: "urn:ietf:params:oauth:grant-type:token-exchange";
+                    subject_token: string;
+                    subject_token_type: "urn:ietf:params:oauth:token-type:access_token";
+                    organization: string;
+                    audience?: string | undefined;
+                    scope?: string | undefined;
+                    client_id?: string | undefined;
+                    client_secret?: string | undefined;
+                    client_assertion?: string | undefined;
+                    client_assertion_type?: string | undefined;
                 };
             };
             output: {};
@@ -118,6 +140,17 @@ export declare const tokenRoutes: OpenAPIHono<{
                     username: string;
                     otp: string;
                     realm: "sms" | "email";
+                } | {
+                    grant_type: "urn:ietf:params:oauth:grant-type:token-exchange";
+                    subject_token: string;
+                    subject_token_type: "urn:ietf:params:oauth:token-type:access_token";
+                    organization: string;
+                    audience?: string | undefined;
+                    scope?: string | undefined;
+                    client_id?: string | undefined;
+                    client_secret?: string | undefined;
+                    client_assertion?: string | undefined;
+                    client_assertion_type?: string | undefined;
                 };
             } & {
                 json: {
@@ -154,6 +187,17 @@ export declare const tokenRoutes: OpenAPIHono<{
                     username: string;
                     otp: string;
                     realm: "sms" | "email";
+                } | {
+                    grant_type: "urn:ietf:params:oauth:grant-type:token-exchange";
+                    subject_token: string;
+                    subject_token_type: "urn:ietf:params:oauth:token-type:access_token";
+                    organization: string;
+                    audience?: string | undefined;
+                    scope?: string | undefined;
+                    client_id?: string | undefined;
+                    client_secret?: string | undefined;
+                    client_assertion?: string | undefined;
+                    client_assertion_type?: string | undefined;
                 };
             };
             output: {
@@ -203,6 +247,17 @@ export declare const tokenRoutes: OpenAPIHono<{
                     username: string;
                     otp: string;
                     realm: "sms" | "email";
+                } | {
+                    grant_type: "urn:ietf:params:oauth:grant-type:token-exchange";
+                    subject_token: string;
+                    subject_token_type: "urn:ietf:params:oauth:token-type:access_token";
+                    organization: string;
+                    audience?: string | undefined;
+                    scope?: string | undefined;
+                    client_id?: string | undefined;
+                    client_secret?: string | undefined;
+                    client_assertion?: string | undefined;
+                    client_assertion_type?: string | undefined;
                 };
             } & {
                 json: {
@@ -239,6 +294,17 @@ export declare const tokenRoutes: OpenAPIHono<{
                     username: string;
                     otp: string;
                     realm: "sms" | "email";
+                } | {
+                    grant_type: "urn:ietf:params:oauth:grant-type:token-exchange";
+                    subject_token: string;
+                    subject_token_type: "urn:ietf:params:oauth:token-type:access_token";
+                    organization: string;
+                    audience?: string | undefined;
+                    scope?: string | undefined;
+                    client_id?: string | undefined;
+                    client_secret?: string | undefined;
+                    client_assertion?: string | undefined;
+                    client_assertion_type?: string | undefined;
                 };
             };
             output: {
@@ -283,6 +349,17 @@ export declare const tokenRoutes: OpenAPIHono<{
                     username: string;
                     otp: string;
                     realm: "sms" | "email";
+                } | {
+                    grant_type: "urn:ietf:params:oauth:grant-type:token-exchange";
+                    subject_token: string;
+                    subject_token_type: "urn:ietf:params:oauth:token-type:access_token";
+                    organization: string;
+                    audience?: string | undefined;
+                    scope?: string | undefined;
+                    client_id?: string | undefined;
+                    client_secret?: string | undefined;
+                    client_assertion?: string | undefined;
+                    client_assertion_type?: string | undefined;
                 };
             } & {
                 json: {
@@ -319,6 +396,17 @@ export declare const tokenRoutes: OpenAPIHono<{
                     username: string;
                     otp: string;
                     realm: "sms" | "email";
+                } | {
+                    grant_type: "urn:ietf:params:oauth:grant-type:token-exchange";
+                    subject_token: string;
+                    subject_token_type: "urn:ietf:params:oauth:token-type:access_token";
+                    organization: string;
+                    audience?: string | undefined;
+                    scope?: string | undefined;
+                    client_id?: string | undefined;
+                    client_secret?: string | undefined;
+                    client_assertion?: string | undefined;
+                    client_assertion_type?: string | undefined;
                 };
             };
             output: {
@@ -363,6 +451,17 @@ export declare const tokenRoutes: OpenAPIHono<{
                     username: string;
                     otp: string;
                     realm: "sms" | "email";
+                } | {
+                    grant_type: "urn:ietf:params:oauth:grant-type:token-exchange";
+                    subject_token: string;
+                    subject_token_type: "urn:ietf:params:oauth:token-type:access_token";
+                    organization: string;
+                    audience?: string | undefined;
+                    scope?: string | undefined;
+                    client_id?: string | undefined;
+                    client_secret?: string | undefined;
+                    client_assertion?: string | undefined;
+                    client_assertion_type?: string | undefined;
                 };
             } & {
                 json: {
@@ -399,6 +498,17 @@ export declare const tokenRoutes: OpenAPIHono<{
                     username: string;
                     otp: string;
                     realm: "sms" | "email";
+                } | {
+                    grant_type: "urn:ietf:params:oauth:grant-type:token-exchange";
+                    subject_token: string;
+                    subject_token_type: "urn:ietf:params:oauth:token-type:access_token";
+                    organization: string;
+                    audience?: string | undefined;
+                    scope?: string | undefined;
+                    client_id?: string | undefined;
+                    client_secret?: string | undefined;
+                    client_assertion?: string | undefined;
+                    client_assertion_type?: string | undefined;
                 };
             };
             output: {

package/dist/types/routes/auth-api/well-known.d.ts

@@ -9,8 +9,8 @@ export declare const wellKnownRoutes: import("hono/hono-base").HonoBase<{
             output: {
                 keys: {
                     alg: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "HS256" | "HS384" | "HS512";
-                    kid: string;
                     kty: "EC" | "RSA" | "oct";
+                    kid?: string | undefined;
                     use?: "sig" | "enc" | undefined;
                     n?: string | undefined;
                     e?: string | undefined;