authhero 8.23.1 → 8.25.0

package/dist/types/routes/universal-login/u2-index.d.ts

@@ -165,7 +165,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         $get: {
             input: {
                 param: {
-                    screen: "signup" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "impersonate" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "impersonate" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -181,7 +181,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "impersonate" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "impersonate" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -197,7 +197,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "impersonate" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "impersonate" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -217,7 +217,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         $post: {
             input: {
                 param: {
-                    screen: "signup" | "consent" | "login" | "reset-password" | "enter-password" | "impersonate" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "reset-password" | "consent" | "enter-password" | "impersonate" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -235,7 +235,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "consent" | "login" | "reset-password" | "enter-password" | "impersonate" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "reset-password" | "consent" | "enter-password" | "impersonate" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {

package/dist/types/routes/universal-login/u2-routes.d.ts

@@ -170,7 +170,7 @@ export declare const u2Routes: OpenAPIHono<{
         $get: {
             input: {
                 param: {
-                    screen: "signup" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "impersonate" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "impersonate" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -186,7 +186,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "impersonate" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "impersonate" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -202,7 +202,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "impersonate" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "impersonate" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -222,7 +222,7 @@ export declare const u2Routes: OpenAPIHono<{
         $post: {
             input: {
                 param: {
-                    screen: "signup" | "consent" | "login" | "reset-password" | "enter-password" | "impersonate" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "reset-password" | "consent" | "enter-password" | "impersonate" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -240,7 +240,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "consent" | "login" | "reset-password" | "enter-password" | "impersonate" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "reset-password" | "consent" | "enter-password" | "impersonate" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {

package/dist/types/tenant-members/control-plane-roundtrip.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/types/tenant-members/local-backend.d.ts

@@ -0,0 +1,43 @@
+import { DataAdapters } from "@authhero/adapter-interfaces";
+import { TenantMembersBackend } from "./types";
+/** The control-plane adapters the team lives in. */
+type TeamAdapters = Pick<DataAdapters, "organizations" | "userOrganizations" | "userRoles" | "users" | "roles" | "invites">;
+export interface LocalTenantMembersBackendOptions {
+    /**
+     * Adapters bound to the CONTROL-PLANE database — the team lives there, not on
+     * the tenant shard. On the control-plane instance this is just `ctx.env.data`.
+     */
+    data: TeamAdapters;
+    /** Tenant id under which the org rows are stored (the control-plane tenant). */
+    controlPlaneTenantId: string;
+    /** Issuer used to build invitation acceptance links and default avatars. */
+    issuer: string;
+    /**
+     * Client id embedded in invitation links. Resolved server-side so the caller
+     * never supplies it (the admin-UI bug this fixes). Without it, invitations
+     * cannot be created and `createInvitation` throws.
+     */
+    invitationClientId?: string;
+    /**
+     * Best-effort invitation email delivery. Bound to a request context at the
+     * call site (it needs branding/email infra). Failures must not fail the
+     * create — Auth0 returns the invite even when delivery fails.
+     */
+    sendInvitationEmail?: (params: {
+        to: string;
+        invitationUrl: string;
+        inviterName?: string;
+        organizationName: string;
+        ttlSec: number;
+    }) => Promise<void>;
+}
+/**
+ * A `TenantMembersBackend` that resolves the tenant's control-plane
+ * organization and manages membership/roles/invitations directly against the
+ * control-plane adapters. Used where the code already runs with the
+ * control-plane database in reach: single-instance deployments (via the
+ * management route) and the control-plane proxy resource (which fronts remote
+ * shards).
+ */
+export declare function createLocalTenantMembersBackend(options: LocalTenantMembersBackendOptions): TenantMembersBackend;
+export {};

package/dist/types/tenant-members/local-backend.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/types/tenant-members/remote-backend.d.ts

@@ -0,0 +1,17 @@
+import { ControlPlaneClient } from "../helpers/control-plane-client";
+import { TenantMembersBackend } from "./types";
+export interface ControlPlaneTenantMembersOptions {
+    /** Authed transport to the control plane (shared with other adapters). */
+    client: ControlPlaneClient;
+    /** Override the control-plane resource path (tests, custom mounts). */
+    basePath?: string;
+}
+/**
+ * A `TenantMembersBackend` for a tenant shard whose own database does not hold
+ * the control-plane organization that models its team. Every call is delegated
+ * up to the authoritative `tenant-members` resource
+ * (`createTenantMembersControlPlaneApp`) over the shared control-plane client,
+ * which mints a service token bound to this tenant. The control plane pins the
+ * org from that token, so the shard never has to (and cannot) name it.
+ */
+export declare function createControlPlaneTenantMembersAdapter(options: ControlPlaneTenantMembersOptions): TenantMembersBackend;

package/dist/types/tenant-members/types.d.ts

@@ -0,0 +1,112 @@
+import { z } from "@hono/zod-openapi";
+import { inviteSchema, roleSchema } from "@authhero/adapter-interfaces";
+/**
+ * A tenant's "team" is not the tenant's own users. It is an organization on the
+ * control-plane tenant whose `name` equals the tenant id (see
+ * `@authhero/multi-tenancy` provisioning). Its members are control-plane users
+ * holding org-scoped roles, and the tenant shard cannot write those rows.
+ *
+ * `TenantMembersBackend` is the seam that hides "where the team actually lives":
+ *  - on a single-instance / control-plane deployment it resolves the org and
+ *    acts on the local control-plane adapters (`createLocalTenantMembersBackend`);
+ *  - on a Workers-for-Platforms shard it delegates every call up to the control
+ *    plane over the shared control-plane client
+ *    (`createControlPlaneTenantMembersAdapter`).
+ *
+ * Every method takes the CHILD `tenantId` (the tenant whose team is managed),
+ * never an organization id — the org is resolved from the tenant id internally.
+ * The management route that fronts this has already pinned `tenantId` to the
+ * caller's verified org claim, so the backend never has to re-authorize.
+ */
+export declare const tenantMemberSchema: z.ZodObject<{
+    user_id: z.ZodString;
+    email: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodString>;
+    picture: z.ZodOptional<z.ZodString>;
+    roles: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        is_system: z.ZodOptional<z.ZodBoolean>;
+        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+        id: z.ZodString;
+        created_at: z.ZodOptional<z.ZodString>;
+        updated_at: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type TenantMember = z.infer<typeof tenantMemberSchema>;
+export declare const tenantMembersListSchema: z.ZodObject<{
+    members: z.ZodArray<z.ZodObject<{
+        user_id: z.ZodString;
+        email: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+        picture: z.ZodOptional<z.ZodString>;
+        roles: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            description: z.ZodOptional<z.ZodString>;
+            is_system: z.ZodOptional<z.ZodBoolean>;
+            metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+            id: z.ZodString;
+            created_at: z.ZodOptional<z.ZodString>;
+            updated_at: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
+    start: z.ZodNumber;
+    limit: z.ZodNumber;
+    total: z.ZodNumber;
+}, z.core.$strip>;
+export type TenantMembersListResult = z.infer<typeof tenantMembersListSchema>;
+/**
+ * The invitee-facing fields of an invitation create. `organization_id`,
+ * `invitation_url` and `id` are resolved server-side (the org from the tenant
+ * id, the URL from the control-plane issuer), never trusted from the caller —
+ * that is the fix for the admin UI's "invite silently disappears when the
+ * client id isn't in local storage" foot-gun.
+ */
+export declare const tenantInvitationInputSchema: z.ZodObject<{
+    invitee: z.ZodObject<{
+        email: z.ZodString;
+    }, z.core.$strip>;
+    inviter: z.ZodDefault<z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    roles: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+    send_invitation_email: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+    ttl_sec: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type TenantInvitationInput = z.input<typeof tenantInvitationInputSchema>;
+export interface TenantMembersPageParams {
+    page?: number;
+    per_page?: number;
+    q?: string;
+}
+export type TenantInvitation = z.infer<typeof inviteSchema>;
+export type TenantRole = z.infer<typeof roleSchema>;
+export interface TenantMembersBackend {
+    listMembers(tenantId: string, params?: TenantMembersPageParams): Promise<TenantMembersListResult>;
+    addMembers(tenantId: string, userIds: string[]): Promise<void>;
+    removeMembers(tenantId: string, userIds: string[]): Promise<void>;
+    listMemberRoles(tenantId: string, userId: string): Promise<TenantRole[]>;
+    assignMemberRoles(tenantId: string, userId: string, roleIds: string[]): Promise<void>;
+    removeMemberRoles(tenantId: string, userId: string, roleIds: string[]): Promise<void>;
+    /** Roles that can be granted to a member — the control-plane tenant's roles. */
+    listRoles(tenantId: string, params?: TenantMembersPageParams): Promise<TenantRole[]>;
+    listInvitations(tenantId: string, params?: TenantMembersPageParams): Promise<TenantInvitation[]>;
+    createInvitation(tenantId: string, input: TenantInvitationInput): Promise<TenantInvitation>;
+    revokeInvitation(tenantId: string, invitationId: string): Promise<void>;
+}
+/**
+ * Base for the "asked for something that isn't there" cases a backend can hit.
+ * The management route maps any of these to a 404. It is a distinct type (not a
+ * bare HTTPException) so the local and remote backends can agree on the
+ * semantics without depending on hono.
+ */
+export declare class TenantMembersNotFoundError extends Error {
+}
+/** The tenant id names no control-plane organization — i.e. no team. */
+export declare class TenantOrganizationNotFoundError extends TenantMembersNotFoundError {
+    constructor(tenantId: string);
+}
+/** The invitation does not exist, or belongs to a different tenant's team. */
+export declare class TenantInvitationNotFoundError extends TenantMembersNotFoundError {
+    constructor(invitationId: string);
+}

package/dist/types/tenant-members/wire.d.ts

@@ -0,0 +1,28 @@
+import { z } from "@hono/zod-openapi";
+/**
+ * The HTTP contract shared by the control-plane `tenant-members` resource
+ * (`createTenantMembersControlPlaneApp`) and the remote client that calls it
+ * (`createControlPlaneTenantMembersAdapter`). Keeping the paths and body shapes
+ * in one place is what keeps the two ends from drifting.
+ */
+export declare const CONTROL_PLANE_TENANT_MEMBERS_PATH = "/api/v2/proxy/control-plane/tenant-members";
+export declare const membersMutationBodySchema: z.ZodObject<{
+    user_ids: z.ZodArray<z.ZodString>;
+    tenant_id: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const memberRolesBodySchema: z.ZodObject<{
+    roles: z.ZodArray<z.ZodString>;
+    tenant_id: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const createInvitationBodySchema: z.ZodObject<{
+    invitee: z.ZodObject<{
+        email: z.ZodString;
+    }, z.core.$strip>;
+    inviter: z.ZodDefault<z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    roles: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+    send_invitation_email: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+    ttl_sec: z.ZodOptional<z.ZodNumber>;
+    tenant_id: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;

package/dist/types/types/AuthHeroConfig.d.ts

@@ -315,24 +315,71 @@ export interface AuthHeroConfig {
          * hosts through a service binding by inspecting the URL.
          */
         jwksFetch?: (url: string) => Promise<Response>;
+        /**
+         * Optional predicate widening the accepted token issuers beyond
+         * `env.ISSUER` / the inbound host to a deployment's own WFP tenant
+         * subdomains, whose per-tenant control-plane credential `jwksFetch`
+         * resolves locally (see #1139). Consulted before any JWKS fetch; return
+         * `true` only for issuer hosts you serve.
+         */
+        isTrustedIssuer?: (iss: string) => boolean;
         /**
          * Optional receiver for `POST /sync` events emitted by tenant shards via
          * the `ControlPlaneSyncDestination`. Mount on the control-plane authhero
          * instance only. Implementations MUST be idempotent — the outbox retries
-         * on transient failures. Use `createApplySyncEvents({ customDomains,
-         * proxyRoutes })` (exported from `authhero`) for the default
-         * adapter-backed implementation.
+         * on transient failures. Use `createApplySyncEvents({ proxyRoutes })`
+         * (exported from `authhero`) for the default adapter-backed
+         * implementation.
          */
         applySyncEvents?: (events: import("../helpers/control-plane-sync-events").SyncEvent[]) => Promise<void>;
+        /**
+         * The authoritative custom-domains adapter. When set, mounts
+         * `/api/v2/proxy/control-plane/custom-domains` — the resource tenant
+         * shards write through (`createControlPlaneCustomDomainsAdapter`).
+         *
+         * Pass the Cloudflare adapter wrapping the control-plane database: a
+         * CF-for-SaaS hostname is an account-global resource, so registering it
+         * needs credentials that only exist here, and claiming it exactly once
+         * needs a view across every tenant that only exists here.
+         */
+        customDomains?: import("@authhero/adapter-interfaces").CustomDomainsAdapter;
+        /**
+         * The authoritative tenant-team resource. When set, mounts
+         * `/api/v2/proxy/control-plane/tenant-members` — the resource tenant shards
+         * call through `createControlPlaneTenantMembersAdapter` so their admins can
+         * manage who administers the tenant (control-plane organization membership
+         * + org-scoped roles + invitations). Wire the backend to the control-plane
+         * database via `createLocalTenantMembersBackend`.
+         */
+        tenantMembers?: import("../routes/proxy-control-plane/tenant-members").TenantMembersControlPlaneOptions;
     };
     /**
-     * Optional outbox-driven replication of `custom_domains` and `proxy_routes`
-     * mutations to a global proxy control plane. When set, every successful
-     * write on this tenant shard enqueues a `controlplane.sync.*` outbox event;
-     * the `ControlPlaneSyncDestination` POSTs each event to
+     * Enables the tenant-scoped `/api/v2/tenant-members` management resource,
+     * which lets a tenant admin manage their own team from the per-tenant admin
+     * UI. Every request is pinned to the caller's `org_name` claim, then
+     * delegated to the backend this returns.
+     *
+     * Return `createLocalTenantMembersBackend(...)` on a single-instance /
+     * control-plane deployment (the team lives in the same database), or
+     * `createControlPlaneTenantMembersAdapter(...)` on a Workers-for-Platforms
+     * shard (the team lives on the control plane and is reached over the shared
+     * control-plane client). Leave unset to not mount the resource.
+     */
+    tenantMembers?: {
+        getBackend: import("../routes/management-api/tenant-members").GetTenantMembersBackend;
+    };
+    /**
+     * Optional outbox-driven replication of `proxy_routes` mutations to a global
+     * proxy control plane. When set, every successful write on this tenant shard
+     * enqueues a `controlplane.sync.*` outbox event; the
+     * `ControlPlaneSyncDestination` POSTs each event to
      * `${baseUrl}/api/v2/proxy/control-plane/sync`. Requires the outbox to be
      * enabled (`outbox: { enabled: true }`).
      *
+     * Custom domains are NOT replicated this way — the control plane is
+     * authoritative for them; wire `createControlPlaneCustomDomainsAdapter` into
+     * the shard's `dataAdapter` instead.
+     *
      * Leave unset for single-DB deployments — the proxy reads the same database
      * the management API writes to, so replication is unnecessary.
      */

package/dist/types/types/IdToken.d.ts

@@ -20,11 +20,11 @@ export declare const idTokenSchema: z.ZodObject<{
 export declare const userInfoSchema: z.ZodObject<{
     name: z.ZodOptional<z.ZodString>;
     email: z.ZodOptional<z.ZodString>;
-    given_name: z.ZodOptional<z.ZodString>;
-    family_name: z.ZodOptional<z.ZodString>;
-    sub: z.ZodString;
-    exp: z.ZodNumber;
     iss: z.ZodString;
+    sub: z.ZodString;
     aud: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
+    exp: z.ZodNumber;
+    given_name: z.ZodOptional<z.ZodString>;
+    family_name: z.ZodOptional<z.ZodString>;
 }, z.core.$loose>;
 export type IdToken = z.infer<typeof idTokenSchema>;

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/markusahlstrand/authhero"
   },
-  "version": "8.23.1",
+  "version": "8.25.0",
   "files": [
     "dist"
   ],
@@ -63,8 +63,8 @@
     "vite": "^8.0.14",
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^4.1.7",
-    "@authhero/kysely-adapter": "11.18.1",
-    "@authhero/widget": "0.34.13"
+    "@authhero/widget": "0.34.14",
+    "@authhero/kysely-adapter": "11.19.0"
   },
   "dependencies": {
     "@peculiar/x509": "^1.14.0",
@@ -81,9 +81,9 @@
     "qrcode": "^1.5.4",
     "sanitize-html": "^2.17.4",
     "xstate": "^5.31.1",
-    "@authhero/adapter-interfaces": "4.0.0",
-    "@authhero/proxy": "0.9.3",
-    "@authhero/saml": "0.4.5"
+    "@authhero/adapter-interfaces": "4.1.0",
+    "@authhero/proxy": "0.9.4",
+    "@authhero/saml": "0.4.6"
   },
   "peerDependencies": {
     "@authhero/widget": "^0.1.0",