authhero 8.24.0 → 8.25.0

package/dist/types/routes/proxy-control-plane/index.d.ts

@@ -3,6 +3,7 @@ import type { ResolvedHost } from "@authhero/proxy";
 import { CustomDomain, CustomDomainsAdapter, ProxyRoute, ProxyRoutesAdapter } from "@authhero/adapter-interfaces";
 import { SyncEvent } from "../../helpers/control-plane-sync-events";
 import { Bindings } from "../../types";
+import { type TenantMembersControlPlaneOptions } from "./tenant-members";
 export interface ProxyControlPlaneOptions {
     /**
      * Cross-tenant host resolver. Typically delegated to a database adapter's
@@ -16,6 +17,16 @@ export interface ProxyControlPlaneOptions {
      * service binding by inspecting the URL and dispatching accordingly.
      */
     jwksFetch?: (url: string) => Promise<Response>;
+    /**
+     * Optional predicate that widens the set of accepted token issuers beyond
+     * `env.ISSUER` and the inbound host — specifically to a deployment's own
+     * Workers-for-Platforms tenant subdomains, whose per-tenant control-plane
+     * credential `jwksFetch` resolves locally (see #1139). Consulted before any
+     * JWKS fetch, so it still constrains where keys are fetched from; return
+     * `true` only for issuer hosts you serve. Applies to every mounted resource
+     * (custom-domains, tenant-members, sync).
+     */
+    isTrustedIssuer?: (iss: string) => boolean;
     /**
      * Optional handler for `POST /sync` — receives `controlplane.sync.*` events
      * emitted by tenant shards via `ControlPlaneSyncDestination` and replicates
@@ -43,6 +54,18 @@ export interface ProxyControlPlaneOptions {
      * login.acme.com" needs a view across every tenant that only exists here.
      */
     customDomains?: CustomDomainsAdapter;
+    /**
+     * The authoritative tenant-team resource. When set, mounts
+     * `/api/v2/proxy/control-plane/tenant-members` — the resource tenant shards
+     * call through `createControlPlaneTenantMembersAdapter` to let their admins
+     * manage who administers the tenant (control-plane organization membership +
+     * org-scoped roles + invitations), rows the shard itself cannot write.
+     *
+     * Wire the backend to the control-plane database (see
+     * `createLocalTenantMembersBackend`); the org is pinned from the verified
+     * token, never the request.
+     */
+    tenantMembers?: TenantMembersControlPlaneOptions;
 }
 /**
  * Returns a Hono app exposing the privileged proxy control-plane endpoint

package/dist/types/routes/proxy-control-plane/scopes.d.ts

@@ -10,4 +10,11 @@ export declare const CONTROL_PLANE_SYNC_SCOPE = "controlplane:sync";
  * `createControlPlaneCustomDomainsAdapter`.
  */
 export declare const CONTROL_PLANE_CUSTOM_DOMAINS_SCOPE = "controlplane:custom_domains";
+/**
+ * Scope required by the authoritative `/tenant-members` resource on the control
+ * plane — a tenant's team (organization membership + org-scoped roles +
+ * invitations) that only the control plane can write. Tenant shards mint a
+ * token with this scope through `createControlPlaneTenantMembersAdapter`.
+ */
+export declare const CONTROL_PLANE_TENANT_MEMBERS_SCOPE = "controlplane:tenant_members";
 export { PROXY_RESOLVE_HOST_SCOPE };

package/dist/types/routes/proxy-control-plane/tenant-members.d.ts

@@ -0,0 +1,37 @@
+import { Hono, type Context } from "hono";
+import { Bindings } from "../../types";
+import { TenantMembersBackend } from "../../tenant-members/types";
+import type { AuthenticateControlPlane } from "./custom-domains";
+type TenantVars = {
+    tenantId: string;
+};
+/** Context seen by the control-plane resource: env + the pinned tenant id. */
+type CpCtx = Context<{
+    Bindings: Bindings;
+    Variables: TenantVars;
+}>;
+export interface TenantMembersControlPlaneOptions {
+    /**
+     * Build the backend for a request. Bound to the control-plane database
+     * (`c.env.data`) and, optionally, an email sender at wire-up time. The tenant
+     * is pinned separately from the verified token, so the factory does not need
+     * it.
+     */
+    getBackend: (c: CpCtx) => TenantMembersBackend | Promise<TenantMembersBackend>;
+    authenticate: AuthenticateControlPlane;
+}
+/**
+ * The authoritative `tenant-members` resource. Tenant shards reach it through
+ * `createControlPlaneTenantMembersAdapter`; it manages the control-plane
+ * organization that models a tenant's team — rows the shard cannot write.
+ *
+ * Every operation is bound to the `tenant_id` claim of the verified token. The
+ * scope alone is not authorization: each shard holds it, so a request-supplied
+ * tenant id would let any shard read or edit any other tenant's team. Mount
+ * under `/api/v2/proxy/control-plane/tenant-members`.
+ */
+export declare function createTenantMembersControlPlaneApp(options: TenantMembersControlPlaneOptions): Hono<{
+    Bindings: Bindings;
+    Variables: TenantVars;
+}>;
+export {};

package/dist/types/routes/proxy-control-plane/verify.d.ts

@@ -38,6 +38,20 @@ export interface VerifyControlPlaneTokenOptions {
      * `proxy:resolve_host`.
      */
     requiredScope?: string | string[];
+    /**
+     * Optional predicate consulted IN ADDITION to `expectedIssuers`, for issuers
+     * that can't be enumerated ahead of time — specifically a deployment's own
+     * Workers-for-Platforms tenant subdomains (`https://{tenant}.{host}/`), whose
+     * per-tenant control-plane credential the accompanying `jwksFetch` resolves
+     * locally (see #1139).
+     *
+     * Like `expectedIssuers`, it runs BEFORE the JWKS fetch, so it still gates
+     * where the verifier will fetch keys from: return `true` only for issuer
+     * hosts you actually serve. The signature must still verify against the
+     * resolved key, so this does not broaden trust beyond "a caller holding that
+     * tenant's registered private key."
+     */
+    isTrustedIssuer?: (iss: string) => boolean;
 }
 /**
  * Verify a bearer token for the proxy control plane. Returns `{ ok: true }`

package/dist/types/routes/proxy-control-plane/verify.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/types/routes/universal-login/common.d.ts

@@ -456,7 +456,7 @@ export declare function initJSXRoute(ctx: Context<{
         custom_login_page_preview?: string | undefined;
         form_template?: string | undefined;
         addons?: Record<string, any> | undefined;
-        token_endpoint_auth_method?: "none" | "private_key_jwt" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | undefined;
+        token_endpoint_auth_method?: "client_secret_post" | "client_secret_basic" | "none" | "client_secret_jwt" | "private_key_jwt" | undefined;
         client_metadata?: Record<string, string> | undefined;
         hide_sign_up_disabled_error?: boolean | undefined;
         mobile?: Record<string, any> | undefined;
@@ -1185,7 +1185,7 @@ export declare function initJSXRouteWithSession(ctx: Context<{
         custom_login_page_preview?: string | undefined;
         form_template?: string | undefined;
         addons?: Record<string, any> | undefined;
-        token_endpoint_auth_method?: "none" | "private_key_jwt" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | undefined;
+        token_endpoint_auth_method?: "client_secret_post" | "client_secret_basic" | "none" | "client_secret_jwt" | "private_key_jwt" | undefined;
         client_metadata?: Record<string, string> | undefined;
         hide_sign_up_disabled_error?: boolean | undefined;
         mobile?: Record<string, any> | undefined;

package/dist/types/routes/universal-login/flow-api.d.ts

@@ -27,7 +27,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
             output: {
                 screen: {
                     action: string;
-                    method: "POST" | "GET";
+                    method: "GET" | "POST";
                     components: {
                         id: string;
                         type: string;
@@ -43,7 +43,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                         hint?: string | undefined;
                         messages?: {
                             text: string;
-                            type: "error" | "success" | "info" | "warning";
+                            type: "success" | "error" | "info" | "warning";
                             id?: number | undefined;
                         }[] | undefined;
                     }[];
@@ -51,7 +51,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                     description?: string | undefined;
                     messages?: {
                         text: string;
-                        type: "error" | "success" | "info" | "warning";
+                        type: "success" | "error" | "info" | "warning";
                         id?: number | undefined;
                     }[] | undefined;
                     links?: {
@@ -107,7 +107,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
             output: {
                 screen: {
                     action: string;
-                    method: "POST" | "GET";
+                    method: "GET" | "POST";
                     components: {
                         id: string;
                         type: string;
@@ -123,7 +123,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                         hint?: string | undefined;
                         messages?: {
                             text: string;
-                            type: "error" | "success" | "info" | "warning";
+                            type: "success" | "error" | "info" | "warning";
                             id?: number | undefined;
                         }[] | undefined;
                     }[];
@@ -131,7 +131,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                     description?: string | undefined;
                     messages?: {
                         text: string;
-                        type: "error" | "success" | "info" | "warning";
+                        type: "success" | "error" | "info" | "warning";
                         id?: number | undefined;
                     }[] | undefined;
                     links?: {
@@ -204,7 +204,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
             output: {
                 screen: {
                     action: string;
-                    method: "POST" | "GET";
+                    method: "GET" | "POST";
                     components: {
                         id: string;
                         type: string;
@@ -220,7 +220,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                         hint?: string | undefined;
                         messages?: {
                             text: string;
-                            type: "error" | "success" | "info" | "warning";
+                            type: "success" | "error" | "info" | "warning";
                             id?: number | undefined;
                         }[] | undefined;
                     }[];
@@ -228,7 +228,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                     description?: string | undefined;
                     messages?: {
                         text: string;
-                        type: "error" | "success" | "info" | "warning";
+                        type: "success" | "error" | "info" | "warning";
                         id?: number | undefined;
                     }[] | undefined;
                     links?: {
@@ -319,7 +319,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
             output: {
                 screen: {
                     action: string;
-                    method: "POST" | "GET";
+                    method: "GET" | "POST";
                     components: {
                         id: string;
                         type: string;
@@ -335,7 +335,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                         hint?: string | undefined;
                         messages?: {
                             text: string;
-                            type: "error" | "success" | "info" | "warning";
+                            type: "success" | "error" | "info" | "warning";
                             id?: number | undefined;
                         }[] | undefined;
                     }[];
@@ -343,7 +343,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                     description?: string | undefined;
                     messages?: {
                         text: string;
-                        type: "error" | "success" | "info" | "warning";
+                        type: "success" | "error" | "info" | "warning";
                         id?: number | undefined;
                     }[] | undefined;
                     links?: {

package/dist/types/routes/universal-login/u2-index.d.ts

@@ -165,7 +165,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         $get: {
             input: {
                 param: {
-                    screen: "signup" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "impersonate" | "reset-password/request" | "reset-password/code" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "impersonate" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -181,7 +181,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "impersonate" | "reset-password/request" | "reset-password/code" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "impersonate" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -197,7 +197,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "impersonate" | "reset-password/request" | "reset-password/code" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "impersonate" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -217,7 +217,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         $post: {
             input: {
                 param: {
-                    screen: "signup" | "consent" | "login" | "reset-password" | "enter-password" | "impersonate" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "reset-password" | "consent" | "enter-password" | "impersonate" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -235,7 +235,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "consent" | "login" | "reset-password" | "enter-password" | "impersonate" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "reset-password" | "consent" | "enter-password" | "impersonate" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {

package/dist/types/routes/universal-login/u2-routes.d.ts

@@ -170,7 +170,7 @@ export declare const u2Routes: OpenAPIHono<{
         $get: {
             input: {
                 param: {
-                    screen: "signup" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "impersonate" | "reset-password/request" | "reset-password/code" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "impersonate" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -186,7 +186,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "impersonate" | "reset-password/request" | "reset-password/code" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "impersonate" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -202,7 +202,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "consent" | "login" | "reset-password" | "account" | "enter-password" | "impersonate" | "reset-password/request" | "reset-password/code" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "reset-password" | "consent" | "account" | "enter-password" | "impersonate" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -222,7 +222,7 @@ export declare const u2Routes: OpenAPIHono<{
         $post: {
             input: {
                 param: {
-                    screen: "signup" | "consent" | "login" | "reset-password" | "enter-password" | "impersonate" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "reset-password" | "consent" | "enter-password" | "impersonate" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -240,7 +240,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "consent" | "login" | "reset-password" | "enter-password" | "impersonate" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "login" | "reset-password" | "consent" | "enter-password" | "impersonate" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {

package/dist/types/tenant-members/control-plane-roundtrip.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/types/tenant-members/local-backend.d.ts

@@ -0,0 +1,43 @@
+import { DataAdapters } from "@authhero/adapter-interfaces";
+import { TenantMembersBackend } from "./types";
+/** The control-plane adapters the team lives in. */
+type TeamAdapters = Pick<DataAdapters, "organizations" | "userOrganizations" | "userRoles" | "users" | "roles" | "invites">;
+export interface LocalTenantMembersBackendOptions {
+    /**
+     * Adapters bound to the CONTROL-PLANE database — the team lives there, not on
+     * the tenant shard. On the control-plane instance this is just `ctx.env.data`.
+     */
+    data: TeamAdapters;
+    /** Tenant id under which the org rows are stored (the control-plane tenant). */
+    controlPlaneTenantId: string;
+    /** Issuer used to build invitation acceptance links and default avatars. */
+    issuer: string;
+    /**
+     * Client id embedded in invitation links. Resolved server-side so the caller
+     * never supplies it (the admin-UI bug this fixes). Without it, invitations
+     * cannot be created and `createInvitation` throws.
+     */
+    invitationClientId?: string;
+    /**
+     * Best-effort invitation email delivery. Bound to a request context at the
+     * call site (it needs branding/email infra). Failures must not fail the
+     * create — Auth0 returns the invite even when delivery fails.
+     */
+    sendInvitationEmail?: (params: {
+        to: string;
+        invitationUrl: string;
+        inviterName?: string;
+        organizationName: string;
+        ttlSec: number;
+    }) => Promise<void>;
+}
+/**
+ * A `TenantMembersBackend` that resolves the tenant's control-plane
+ * organization and manages membership/roles/invitations directly against the
+ * control-plane adapters. Used where the code already runs with the
+ * control-plane database in reach: single-instance deployments (via the
+ * management route) and the control-plane proxy resource (which fronts remote
+ * shards).
+ */
+export declare function createLocalTenantMembersBackend(options: LocalTenantMembersBackendOptions): TenantMembersBackend;
+export {};

package/dist/types/tenant-members/local-backend.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/types/tenant-members/remote-backend.d.ts

@@ -0,0 +1,17 @@
+import { ControlPlaneClient } from "../helpers/control-plane-client";
+import { TenantMembersBackend } from "./types";
+export interface ControlPlaneTenantMembersOptions {
+    /** Authed transport to the control plane (shared with other adapters). */
+    client: ControlPlaneClient;
+    /** Override the control-plane resource path (tests, custom mounts). */
+    basePath?: string;
+}
+/**
+ * A `TenantMembersBackend` for a tenant shard whose own database does not hold
+ * the control-plane organization that models its team. Every call is delegated
+ * up to the authoritative `tenant-members` resource
+ * (`createTenantMembersControlPlaneApp`) over the shared control-plane client,
+ * which mints a service token bound to this tenant. The control plane pins the
+ * org from that token, so the shard never has to (and cannot) name it.
+ */
+export declare function createControlPlaneTenantMembersAdapter(options: ControlPlaneTenantMembersOptions): TenantMembersBackend;

package/dist/types/tenant-members/types.d.ts

@@ -0,0 +1,112 @@
+import { z } from "@hono/zod-openapi";
+import { inviteSchema, roleSchema } from "@authhero/adapter-interfaces";
+/**
+ * A tenant's "team" is not the tenant's own users. It is an organization on the
+ * control-plane tenant whose `name` equals the tenant id (see
+ * `@authhero/multi-tenancy` provisioning). Its members are control-plane users
+ * holding org-scoped roles, and the tenant shard cannot write those rows.
+ *
+ * `TenantMembersBackend` is the seam that hides "where the team actually lives":
+ *  - on a single-instance / control-plane deployment it resolves the org and
+ *    acts on the local control-plane adapters (`createLocalTenantMembersBackend`);
+ *  - on a Workers-for-Platforms shard it delegates every call up to the control
+ *    plane over the shared control-plane client
+ *    (`createControlPlaneTenantMembersAdapter`).
+ *
+ * Every method takes the CHILD `tenantId` (the tenant whose team is managed),
+ * never an organization id — the org is resolved from the tenant id internally.
+ * The management route that fronts this has already pinned `tenantId` to the
+ * caller's verified org claim, so the backend never has to re-authorize.
+ */
+export declare const tenantMemberSchema: z.ZodObject<{
+    user_id: z.ZodString;
+    email: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodString>;
+    picture: z.ZodOptional<z.ZodString>;
+    roles: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        is_system: z.ZodOptional<z.ZodBoolean>;
+        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+        id: z.ZodString;
+        created_at: z.ZodOptional<z.ZodString>;
+        updated_at: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type TenantMember = z.infer<typeof tenantMemberSchema>;
+export declare const tenantMembersListSchema: z.ZodObject<{
+    members: z.ZodArray<z.ZodObject<{
+        user_id: z.ZodString;
+        email: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+        picture: z.ZodOptional<z.ZodString>;
+        roles: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            description: z.ZodOptional<z.ZodString>;
+            is_system: z.ZodOptional<z.ZodBoolean>;
+            metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+            id: z.ZodString;
+            created_at: z.ZodOptional<z.ZodString>;
+            updated_at: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
+    start: z.ZodNumber;
+    limit: z.ZodNumber;
+    total: z.ZodNumber;
+}, z.core.$strip>;
+export type TenantMembersListResult = z.infer<typeof tenantMembersListSchema>;
+/**
+ * The invitee-facing fields of an invitation create. `organization_id`,
+ * `invitation_url` and `id` are resolved server-side (the org from the tenant
+ * id, the URL from the control-plane issuer), never trusted from the caller —
+ * that is the fix for the admin UI's "invite silently disappears when the
+ * client id isn't in local storage" foot-gun.
+ */
+export declare const tenantInvitationInputSchema: z.ZodObject<{
+    invitee: z.ZodObject<{
+        email: z.ZodString;
+    }, z.core.$strip>;
+    inviter: z.ZodDefault<z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    roles: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+    send_invitation_email: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+    ttl_sec: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type TenantInvitationInput = z.input<typeof tenantInvitationInputSchema>;
+export interface TenantMembersPageParams {
+    page?: number;
+    per_page?: number;
+    q?: string;
+}
+export type TenantInvitation = z.infer<typeof inviteSchema>;
+export type TenantRole = z.infer<typeof roleSchema>;
+export interface TenantMembersBackend {
+    listMembers(tenantId: string, params?: TenantMembersPageParams): Promise<TenantMembersListResult>;
+    addMembers(tenantId: string, userIds: string[]): Promise<void>;
+    removeMembers(tenantId: string, userIds: string[]): Promise<void>;
+    listMemberRoles(tenantId: string, userId: string): Promise<TenantRole[]>;
+    assignMemberRoles(tenantId: string, userId: string, roleIds: string[]): Promise<void>;
+    removeMemberRoles(tenantId: string, userId: string, roleIds: string[]): Promise<void>;
+    /** Roles that can be granted to a member — the control-plane tenant's roles. */
+    listRoles(tenantId: string, params?: TenantMembersPageParams): Promise<TenantRole[]>;
+    listInvitations(tenantId: string, params?: TenantMembersPageParams): Promise<TenantInvitation[]>;
+    createInvitation(tenantId: string, input: TenantInvitationInput): Promise<TenantInvitation>;
+    revokeInvitation(tenantId: string, invitationId: string): Promise<void>;
+}
+/**
+ * Base for the "asked for something that isn't there" cases a backend can hit.
+ * The management route maps any of these to a 404. It is a distinct type (not a
+ * bare HTTPException) so the local and remote backends can agree on the
+ * semantics without depending on hono.
+ */
+export declare class TenantMembersNotFoundError extends Error {
+}
+/** The tenant id names no control-plane organization — i.e. no team. */
+export declare class TenantOrganizationNotFoundError extends TenantMembersNotFoundError {
+    constructor(tenantId: string);
+}
+/** The invitation does not exist, or belongs to a different tenant's team. */
+export declare class TenantInvitationNotFoundError extends TenantMembersNotFoundError {
+    constructor(invitationId: string);
+}

package/dist/types/tenant-members/wire.d.ts

@@ -0,0 +1,28 @@
+import { z } from "@hono/zod-openapi";
+/**
+ * The HTTP contract shared by the control-plane `tenant-members` resource
+ * (`createTenantMembersControlPlaneApp`) and the remote client that calls it
+ * (`createControlPlaneTenantMembersAdapter`). Keeping the paths and body shapes
+ * in one place is what keeps the two ends from drifting.
+ */
+export declare const CONTROL_PLANE_TENANT_MEMBERS_PATH = "/api/v2/proxy/control-plane/tenant-members";
+export declare const membersMutationBodySchema: z.ZodObject<{
+    user_ids: z.ZodArray<z.ZodString>;
+    tenant_id: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const memberRolesBodySchema: z.ZodObject<{
+    roles: z.ZodArray<z.ZodString>;
+    tenant_id: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const createInvitationBodySchema: z.ZodObject<{
+    invitee: z.ZodObject<{
+        email: z.ZodString;
+    }, z.core.$strip>;
+    inviter: z.ZodDefault<z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    roles: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+    send_invitation_email: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+    ttl_sec: z.ZodOptional<z.ZodNumber>;
+    tenant_id: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;

package/dist/types/types/AuthHeroConfig.d.ts

@@ -315,6 +315,14 @@ export interface AuthHeroConfig {
          * hosts through a service binding by inspecting the URL.
          */
         jwksFetch?: (url: string) => Promise<Response>;
+        /**
+         * Optional predicate widening the accepted token issuers beyond
+         * `env.ISSUER` / the inbound host to a deployment's own WFP tenant
+         * subdomains, whose per-tenant control-plane credential `jwksFetch`
+         * resolves locally (see #1139). Consulted before any JWKS fetch; return
+         * `true` only for issuer hosts you serve.
+         */
+        isTrustedIssuer?: (iss: string) => boolean;
         /**
          * Optional receiver for `POST /sync` events emitted by tenant shards via
          * the `ControlPlaneSyncDestination`. Mount on the control-plane authhero
@@ -335,6 +343,30 @@ export interface AuthHeroConfig {
          * needs a view across every tenant that only exists here.
          */
         customDomains?: import("@authhero/adapter-interfaces").CustomDomainsAdapter;
+        /**
+         * The authoritative tenant-team resource. When set, mounts
+         * `/api/v2/proxy/control-plane/tenant-members` — the resource tenant shards
+         * call through `createControlPlaneTenantMembersAdapter` so their admins can
+         * manage who administers the tenant (control-plane organization membership
+         * + org-scoped roles + invitations). Wire the backend to the control-plane
+         * database via `createLocalTenantMembersBackend`.
+         */
+        tenantMembers?: import("../routes/proxy-control-plane/tenant-members").TenantMembersControlPlaneOptions;
+    };
+    /**
+     * Enables the tenant-scoped `/api/v2/tenant-members` management resource,
+     * which lets a tenant admin manage their own team from the per-tenant admin
+     * UI. Every request is pinned to the caller's `org_name` claim, then
+     * delegated to the backend this returns.
+     *
+     * Return `createLocalTenantMembersBackend(...)` on a single-instance /
+     * control-plane deployment (the team lives in the same database), or
+     * `createControlPlaneTenantMembersAdapter(...)` on a Workers-for-Platforms
+     * shard (the team lives on the control plane and is reached over the shared
+     * control-plane client). Leave unset to not mount the resource.
+     */
+    tenantMembers?: {
+        getBackend: import("../routes/management-api/tenant-members").GetTenantMembersBackend;
     };
     /**
      * Optional outbox-driven replication of `proxy_routes` mutations to a global