authhero 8.24.0 → 8.25.1

package/dist/types/routes/management-api/organizations.d.ts

@@ -736,9 +736,9 @@ export declare const organizationRoutes: OpenAPIHono<{
                         email?: string | undefined;
                     };
                     id?: string | undefined;
-                    connection_id?: string | undefined;
                     app_metadata?: Record<string, any> | undefined;
                     user_metadata?: Record<string, any> | undefined;
+                    connection_id?: string | undefined;
                     roles?: string[] | undefined;
                     ttl_sec?: number | undefined;
                     send_invitation_email?: boolean | undefined;

package/dist/types/routes/management-api/prompts.d.ts

@@ -50,7 +50,7 @@ export declare const promptsRoutes: OpenAPIHono<{
                 };
             };
             output: {
-                prompt: "mfa" | "organizations" | "signup" | "status" | "common" | "consent" | "device-flow" | "email-otp-challenge" | "email-verification" | "invitation" | "login" | "login-id" | "login-password" | "login-passwordless" | "mfa-email" | "mfa-otp" | "mfa-phone" | "mfa-login-options" | "mfa-push" | "mfa-recovery-code" | "mfa-voice" | "mfa-webauthn" | "passkeys" | "reset-password" | "signup-id" | "signup-password" | "captcha" | "custom-form";
+                prompt: "signup" | "status" | "mfa" | "organizations" | "login" | "login-id" | "login-password" | "signup-id" | "signup-password" | "reset-password" | "consent" | "mfa-push" | "mfa-otp" | "mfa-voice" | "mfa-phone" | "mfa-webauthn" | "mfa-email" | "mfa-recovery-code" | "device-flow" | "email-verification" | "email-otp-challenge" | "invitation" | "common" | "passkeys" | "captcha" | "custom-form" | "login-passwordless" | "mfa-login-options";
                 language: string;
             }[];
             outputFormat: "json";
@@ -88,7 +88,7 @@ export declare const promptsRoutes: OpenAPIHono<{
         $get: {
             input: {
                 param: {
-                    prompt: "mfa" | "organizations" | "signup" | "status" | "common" | "consent" | "device-flow" | "email-otp-challenge" | "email-verification" | "invitation" | "login" | "login-id" | "login-password" | "login-passwordless" | "mfa-email" | "mfa-otp" | "mfa-phone" | "mfa-login-options" | "mfa-push" | "mfa-recovery-code" | "mfa-voice" | "mfa-webauthn" | "passkeys" | "reset-password" | "signup-id" | "signup-password" | "captcha" | "custom-form";
+                    prompt: "signup" | "status" | "mfa" | "organizations" | "login" | "login-id" | "login-password" | "signup-id" | "signup-password" | "reset-password" | "consent" | "mfa-push" | "mfa-otp" | "mfa-voice" | "mfa-phone" | "mfa-webauthn" | "mfa-email" | "mfa-recovery-code" | "device-flow" | "email-verification" | "email-otp-challenge" | "invitation" | "common" | "passkeys" | "captcha" | "custom-form" | "login-passwordless" | "mfa-login-options";
                     language: string;
                 };
             } & {
@@ -110,7 +110,7 @@ export declare const promptsRoutes: OpenAPIHono<{
         $put: {
             input: {
                 param: {
-                    prompt: "mfa" | "organizations" | "signup" | "status" | "common" | "consent" | "device-flow" | "email-otp-challenge" | "email-verification" | "invitation" | "login" | "login-id" | "login-password" | "login-passwordless" | "mfa-email" | "mfa-otp" | "mfa-phone" | "mfa-login-options" | "mfa-push" | "mfa-recovery-code" | "mfa-voice" | "mfa-webauthn" | "passkeys" | "reset-password" | "signup-id" | "signup-password" | "captcha" | "custom-form";
+                    prompt: "signup" | "status" | "mfa" | "organizations" | "login" | "login-id" | "login-password" | "signup-id" | "signup-password" | "reset-password" | "consent" | "mfa-push" | "mfa-otp" | "mfa-voice" | "mfa-phone" | "mfa-webauthn" | "mfa-email" | "mfa-recovery-code" | "device-flow" | "email-verification" | "email-otp-challenge" | "invitation" | "common" | "passkeys" | "captcha" | "custom-form" | "login-passwordless" | "mfa-login-options";
                     language: string;
                 };
             } & {
@@ -134,7 +134,7 @@ export declare const promptsRoutes: OpenAPIHono<{
         $delete: {
             input: {
                 param: {
-                    prompt: "mfa" | "organizations" | "signup" | "status" | "common" | "consent" | "device-flow" | "email-otp-challenge" | "email-verification" | "invitation" | "login" | "login-id" | "login-password" | "login-passwordless" | "mfa-email" | "mfa-otp" | "mfa-phone" | "mfa-login-options" | "mfa-push" | "mfa-recovery-code" | "mfa-voice" | "mfa-webauthn" | "passkeys" | "reset-password" | "signup-id" | "signup-password" | "captcha" | "custom-form";
+                    prompt: "signup" | "status" | "mfa" | "organizations" | "login" | "login-id" | "login-password" | "signup-id" | "signup-password" | "reset-password" | "consent" | "mfa-push" | "mfa-otp" | "mfa-voice" | "mfa-phone" | "mfa-webauthn" | "mfa-email" | "mfa-recovery-code" | "device-flow" | "email-verification" | "email-otp-challenge" | "invitation" | "common" | "passkeys" | "captcha" | "custom-form" | "login-passwordless" | "mfa-login-options";
                     language: string;
                 };
             } & {

package/dist/types/routes/management-api/tenant-members.d.ts

@@ -0,0 +1,304 @@
+import { OpenAPIHono } from "@hono/zod-openapi";
+import { Context } from "hono";
+import { Bindings, Variables } from "../../types";
+import { TenantMembersBackend, tenantMemberSchema } from "../../tenant-members/types";
+type Ctx = Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>;
+/** Build the request's backend (local org resolution, or a control-plane hop). */
+export type GetTenantMembersBackend = (ctx: Ctx) => TenantMembersBackend | Promise<TenantMembersBackend>;
+/**
+ * `GET/POST/DELETE /api/v2/tenant-members` — lets a tenant admin manage who
+ * administers their tenant, from the per-tenant admin UI, without a
+ * control-plane login. The heavy lifting (resolving the control-plane org,
+ * writing membership/roles/invitations) is delegated to a
+ * {@link TenantMembersBackend}; this layer only pins the tenant to the token's
+ * org claim and shapes responses.
+ */
+export declare function createTenantMembersRoutes(getBackend: GetTenantMembersBackend): OpenAPIHono<{
+    Bindings: Bindings;
+    Variables: Variables;
+}, {
+    "/roles": {
+        $get: {
+            input: {
+                query: {
+                    page?: unknown;
+                    per_page?: unknown;
+                    q?: string | undefined;
+                };
+            } & {
+                header: {
+                    "tenant-id"?: string | undefined;
+                };
+            };
+            output: {
+                name: string;
+                id: string;
+                description?: string | undefined;
+                is_system?: boolean | undefined;
+                metadata?: {
+                    [x: string]: any;
+                } | undefined;
+                created_at?: string | undefined;
+                updated_at?: string | undefined;
+            }[];
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/invitations": {
+        $get: {
+            input: {
+                query: {
+                    page?: unknown;
+                    per_page?: unknown;
+                    q?: string | undefined;
+                };
+            } & {
+                header: {
+                    "tenant-id"?: string | undefined;
+                };
+            };
+            output: {
+                id: string;
+                created_at: string;
+                expires_at: string;
+                client_id: string;
+                inviter: {
+                    name?: string | undefined;
+                };
+                invitee: {
+                    email?: string | undefined;
+                };
+                organization_id: string;
+                invitation_url: string;
+                ticket_id?: string | undefined;
+                connection_id?: string | undefined;
+                app_metadata?: {
+                    [x: string]: any;
+                } | undefined;
+                user_metadata?: {
+                    [x: string]: any;
+                } | undefined;
+                ttl_sec?: number | undefined;
+                roles?: string[] | undefined;
+                send_invitation_email?: boolean | undefined;
+            }[];
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/invitations": {
+        $post: {
+            input: {
+                header: {
+                    "tenant-id"?: string | undefined;
+                };
+            } & {
+                json: {
+                    invitee: {
+                        email: string;
+                    };
+                    inviter?: {
+                        name?: string | undefined;
+                    } | undefined;
+                    roles?: string[] | undefined;
+                    send_invitation_email?: boolean | undefined;
+                    ttl_sec?: number | undefined;
+                };
+            };
+            output: {
+                id: string;
+                created_at: string;
+                expires_at: string;
+                client_id: string;
+                inviter: {
+                    name?: string | undefined;
+                };
+                invitee: {
+                    email?: string | undefined;
+                };
+                organization_id: string;
+                invitation_url: string;
+                ticket_id?: string | undefined;
+                connection_id?: string | undefined;
+                app_metadata?: {
+                    [x: string]: any;
+                } | undefined;
+                user_metadata?: {
+                    [x: string]: any;
+                } | undefined;
+                ttl_sec?: number | undefined;
+                roles?: string[] | undefined;
+                send_invitation_email?: boolean | undefined;
+            };
+            outputFormat: "json";
+            status: 201;
+        };
+    };
+} & {
+    "/invitations/:invitation_id": {
+        $delete: {
+            input: {
+                param: {
+                    invitation_id: string;
+                };
+            } & {
+                header: {
+                    "tenant-id"?: string | undefined;
+                };
+            };
+            output: {};
+            outputFormat: string;
+            status: 204;
+        };
+    };
+} & {
+    "/": {
+        $get: {
+            input: {
+                query: {
+                    page?: unknown;
+                    per_page?: unknown;
+                    q?: string | undefined;
+                };
+            } & {
+                header: {
+                    "tenant-id"?: string | undefined;
+                };
+            };
+            output: {
+                members: {
+                    user_id: string;
+                    roles: {
+                        name: string;
+                        id: string;
+                        description?: string | undefined;
+                        is_system?: boolean | undefined;
+                        metadata?: {
+                            [x: string]: any;
+                        } | undefined;
+                        created_at?: string | undefined;
+                        updated_at?: string | undefined;
+                    }[];
+                    email?: string | undefined;
+                    name?: string | undefined;
+                    picture?: string | undefined;
+                }[];
+                start: number;
+                limit: number;
+                total: number;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/": {
+        $post: {
+            input: {
+                header: {
+                    "tenant-id"?: string | undefined;
+                };
+            } & {
+                json: {
+                    user_ids: string[];
+                };
+            };
+            output: {};
+            outputFormat: string;
+            status: 204;
+        };
+    };
+} & {
+    "/": {
+        $delete: {
+            input: {
+                header: {
+                    "tenant-id"?: string | undefined;
+                };
+            } & {
+                json: {
+                    user_ids: string[];
+                };
+            };
+            output: {};
+            outputFormat: string;
+            status: 204;
+        };
+    };
+} & {
+    "/:user_id/roles": {
+        $get: {
+            input: {
+                param: {
+                    user_id: string;
+                };
+            } & {
+                header: {
+                    "tenant-id"?: string | undefined;
+                };
+            };
+            output: {
+                name: string;
+                id: string;
+                description?: string | undefined;
+                is_system?: boolean | undefined;
+                metadata?: {
+                    [x: string]: any;
+                } | undefined;
+                created_at?: string | undefined;
+                updated_at?: string | undefined;
+            }[];
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/:user_id/roles": {
+        $post: {
+            input: {
+                param: {
+                    user_id: string;
+                };
+            } & {
+                header: {
+                    "tenant-id"?: string | undefined;
+                };
+            } & {
+                json: {
+                    roles: string[];
+                };
+            };
+            output: {};
+            outputFormat: string;
+            status: 204;
+        };
+    };
+} & {
+    "/:user_id/roles": {
+        $delete: {
+            input: {
+                param: {
+                    user_id: string;
+                };
+            } & {
+                header: {
+                    "tenant-id"?: string | undefined;
+                };
+            } & {
+                json: {
+                    roles: string[];
+                };
+            };
+            output: {};
+            outputFormat: string;
+            status: 204;
+        };
+    };
+}, "/">;
+export { tenantMemberSchema };

package/dist/types/routes/management-api/tenant-members.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/types/routes/management-api/tenants.d.ts

@@ -210,11 +210,10 @@ export declare const tenantRoutes: OpenAPIHono<{
                 };
             } & {
                 json: {
-                    allowed_logout_urls?: string[] | undefined;
-                    oidc_logout?: {
-                        rp_logout_end_session_endpoint_discovery?: boolean | undefined;
-                    } | undefined;
-                    default_organization?: string | undefined;
+                    id?: string | undefined;
+                    mtls?: {
+                        enable_endpoint_aliases?: boolean | undefined;
+                    } | null | undefined;
                     audience?: string | undefined;
                     friendly_name?: string | undefined;
                     picture_url?: string | undefined;
@@ -229,6 +228,7 @@ export declare const tenantRoutes: OpenAPIHono<{
                     session_cookie?: {
                         mode?: "persistent" | "non-persistent" | undefined;
                     } | undefined;
+                    allowed_logout_urls?: string[] | undefined;
                     default_redirection_uri?: string | undefined;
                     default_client_id?: string | undefined;
                     enabled_locales?: string[] | undefined;
@@ -302,15 +302,16 @@ export declare const tenantRoutes: OpenAPIHono<{
                         } | undefined;
                     } | null | undefined;
                     default_audience?: string | undefined;
+                    default_organization?: string | undefined;
                     sessions?: {
                         oidc_logout_prompt_enabled?: boolean | undefined;
                     } | undefined;
+                    oidc_logout?: {
+                        rp_logout_end_session_endpoint_discovery?: boolean | undefined;
+                    } | undefined;
                     allow_organization_name_in_authentication_api?: boolean | undefined;
                     customize_mfa_in_postlogin_action?: boolean | undefined;
                     acr_values_supported?: string[] | undefined;
-                    mtls?: {
-                        enable_endpoint_aliases?: boolean | undefined;
-                    } | null | undefined;
                     pushed_authorization_requests_supported?: boolean | undefined;
                     authorization_response_iss_parameter_supported?: boolean | undefined;
                     deployment_type?: "shared" | "wfp" | undefined;
@@ -385,7 +386,6 @@ export declare const tenantRoutes: OpenAPIHono<{
                             message?: string | undefined;
                         } | undefined;
                     } | undefined;
-                    id?: string | undefined;
                 };
             };
             output: {

package/dist/types/routes/management-api/users.d.ts

@@ -809,7 +809,7 @@ export declare const userRoutes: OpenAPIHono<{
                 };
             };
             output: {
-                type: "fn" | "i" | "sapi" | "fh" | "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "cs" | "depnote" | "f" | "fc" | "fce" | "fco" | "fcoa" | "fcp" | "fcph" | "fcpn" | "fcpr" | "fcpro" | "fcu" | "fd" | "fdeac" | "fdeaz" | "fdecc" | "fdu" | "feacft" | "feccft" | "fecte" | "fede" | "federated_logout_failed" | "fens" | "feoobft" | "feotpft" | "fepft" | "fepotpft" | "fercft" | "ferrt" | "fertft" | "festft" | "fimp" | "fi" | "flo" | "flows_execution_completed" | "flows_execution_failed" | "forms_submission_failed" | "forms_submission_succeeded" | "fp" | "fpar" | "fpurh" | "fs" | "fsa" | "fu" | "fui" | "fv" | "fvr" | "gd_auth_email_verification" | "gd_auth_fail_email_verification" | "gd_auth_failed" | "gd_auth_rejected" | "gd_auth_succeed" | "gd_enrollment_complete" | "gd_otp_rate_limit_exceed" | "gd_recovery_failed" | "gd_recovery_rate_limit_exceed" | "gd_recovery_succeed" | "gd_send_email" | "gd_send_email_verification" | "gd_send_email_verification_failure" | "gd_send_pn" | "gd_send_pn_failure" | "gd_send_sms" | "gd_send_sms_failure" | "gd_send_voice" | "gd_send_voice_failure" | "gd_start_auth" | "gd_start_enroll" | "gd_start_enroll_failed" | "gd_tenant_update" | "gd_unenroll" | "gd_update_device_account" | "gd_webauthn_challenge_failed" | "gd_webauthn_enrollment_failed" | "kms_key_management_failure" | "kms_key_management_success" | "kms_key_state_changed" | "limit_delegation" | "limit_mu" | "limit_sul" | "limit_wc" | "mfar" | "mgmt_api_read" | "my_account_authentication_method_failed" | "my_account_authentication_method_succeeded" | "oidc_backchannel_logout_failed" | "oidc_backchannel_logout_succeeded" | "organization_member_added" | "passkey_challenge_failed" | "passkey_challenge_started" | "pla" | "pwd_leak" | "reset_pwd_leak" | "resource_cleanup" | "rich_consents_access_error" | "s" | "fapi" | "sce" | "scoa" | "scp" | "scpn" | "scpr" | "scu" | "scv" | "sd" | "sdu" | "seacft" | "seccft" | "secte" | "sede" | "sens" | "seoobft" | "seotpft" | "sepotpft" | "sepft" | "sepkoobft" | "sepkotpft" | "sepkrcft" | "sercft" | "sertft" | "sestft" | "simp" | "si" | "signup_pwd_leak" | "slo" | "sh" | "spm" | "srrt" | "ss" | "ss_sso_failure" | "ss_sso_info" | "ss_sso_success" | "ssa" | "sscim" | "sui" | "sv" | "svr" | "too_many_records" | "ublkdu" | "universal_logout_failed" | "universal_logout_succeeded" | "w" | "wn" | "wum";
+                type: "sapi" | "fn" | "i" | "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "cs" | "depnote" | "f" | "fc" | "fce" | "fco" | "fcoa" | "fcp" | "fcph" | "fcpn" | "fcpr" | "fcpro" | "fcu" | "fd" | "fdeac" | "fdeaz" | "fdecc" | "fdu" | "feacft" | "feccft" | "fecte" | "fede" | "federated_logout_failed" | "fens" | "feoobft" | "feotpft" | "fepft" | "fepotpft" | "fercft" | "ferrt" | "fertft" | "festft" | "fh" | "fimp" | "fi" | "flo" | "flows_execution_completed" | "flows_execution_failed" | "forms_submission_failed" | "forms_submission_succeeded" | "fp" | "fpar" | "fpurh" | "fs" | "fsa" | "fu" | "fui" | "fv" | "fvr" | "gd_auth_email_verification" | "gd_auth_fail_email_verification" | "gd_auth_failed" | "gd_auth_rejected" | "gd_auth_succeed" | "gd_enrollment_complete" | "gd_otp_rate_limit_exceed" | "gd_recovery_failed" | "gd_recovery_rate_limit_exceed" | "gd_recovery_succeed" | "gd_send_email" | "gd_send_email_verification" | "gd_send_email_verification_failure" | "gd_send_pn" | "gd_send_pn_failure" | "gd_send_sms" | "gd_send_sms_failure" | "gd_send_voice" | "gd_send_voice_failure" | "gd_start_auth" | "gd_start_enroll" | "gd_start_enroll_failed" | "gd_tenant_update" | "gd_unenroll" | "gd_update_device_account" | "gd_webauthn_challenge_failed" | "gd_webauthn_enrollment_failed" | "kms_key_management_failure" | "kms_key_management_success" | "kms_key_state_changed" | "limit_delegation" | "limit_mu" | "limit_sul" | "limit_wc" | "mfar" | "mgmt_api_read" | "my_account_authentication_method_failed" | "my_account_authentication_method_succeeded" | "oidc_backchannel_logout_failed" | "oidc_backchannel_logout_succeeded" | "organization_member_added" | "passkey_challenge_failed" | "passkey_challenge_started" | "pla" | "pwd_leak" | "reset_pwd_leak" | "resource_cleanup" | "rich_consents_access_error" | "s" | "fapi" | "sce" | "scoa" | "scp" | "scpn" | "scpr" | "scu" | "scv" | "sd" | "sdu" | "seacft" | "seccft" | "secte" | "sede" | "sens" | "seoobft" | "seotpft" | "sepotpft" | "sepft" | "sepkoobft" | "sepkotpft" | "sepkrcft" | "sercft" | "sertft" | "sestft" | "simp" | "si" | "signup_pwd_leak" | "slo" | "sh" | "spm" | "srrt" | "ss" | "ss_sso_failure" | "ss_sso_info" | "ss_sso_success" | "ssa" | "sscim" | "sui" | "sv" | "svr" | "too_many_records" | "ublkdu" | "universal_logout_failed" | "universal_logout_succeeded" | "w" | "wn" | "wum";
                 date: string;
                 isMobile: boolean;
                 log_id: string;
@@ -848,7 +848,7 @@ export declare const userRoutes: OpenAPIHono<{
                 limit: number;
                 length: number;
                 logs: {
-                    type: "fn" | "i" | "sapi" | "fh" | "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "cs" | "depnote" | "f" | "fc" | "fce" | "fco" | "fcoa" | "fcp" | "fcph" | "fcpn" | "fcpr" | "fcpro" | "fcu" | "fd" | "fdeac" | "fdeaz" | "fdecc" | "fdu" | "feacft" | "feccft" | "fecte" | "fede" | "federated_logout_failed" | "fens" | "feoobft" | "feotpft" | "fepft" | "fepotpft" | "fercft" | "ferrt" | "fertft" | "festft" | "fimp" | "fi" | "flo" | "flows_execution_completed" | "flows_execution_failed" | "forms_submission_failed" | "forms_submission_succeeded" | "fp" | "fpar" | "fpurh" | "fs" | "fsa" | "fu" | "fui" | "fv" | "fvr" | "gd_auth_email_verification" | "gd_auth_fail_email_verification" | "gd_auth_failed" | "gd_auth_rejected" | "gd_auth_succeed" | "gd_enrollment_complete" | "gd_otp_rate_limit_exceed" | "gd_recovery_failed" | "gd_recovery_rate_limit_exceed" | "gd_recovery_succeed" | "gd_send_email" | "gd_send_email_verification" | "gd_send_email_verification_failure" | "gd_send_pn" | "gd_send_pn_failure" | "gd_send_sms" | "gd_send_sms_failure" | "gd_send_voice" | "gd_send_voice_failure" | "gd_start_auth" | "gd_start_enroll" | "gd_start_enroll_failed" | "gd_tenant_update" | "gd_unenroll" | "gd_update_device_account" | "gd_webauthn_challenge_failed" | "gd_webauthn_enrollment_failed" | "kms_key_management_failure" | "kms_key_management_success" | "kms_key_state_changed" | "limit_delegation" | "limit_mu" | "limit_sul" | "limit_wc" | "mfar" | "mgmt_api_read" | "my_account_authentication_method_failed" | "my_account_authentication_method_succeeded" | "oidc_backchannel_logout_failed" | "oidc_backchannel_logout_succeeded" | "organization_member_added" | "passkey_challenge_failed" | "passkey_challenge_started" | "pla" | "pwd_leak" | "reset_pwd_leak" | "resource_cleanup" | "rich_consents_access_error" | "s" | "fapi" | "sce" | "scoa" | "scp" | "scpn" | "scpr" | "scu" | "scv" | "sd" | "sdu" | "seacft" | "seccft" | "secte" | "sede" | "sens" | "seoobft" | "seotpft" | "sepotpft" | "sepft" | "sepkoobft" | "sepkotpft" | "sepkrcft" | "sercft" | "sertft" | "sestft" | "simp" | "si" | "signup_pwd_leak" | "slo" | "sh" | "spm" | "srrt" | "ss" | "ss_sso_failure" | "ss_sso_info" | "ss_sso_success" | "ssa" | "sscim" | "sui" | "sv" | "svr" | "too_many_records" | "ublkdu" | "universal_logout_failed" | "universal_logout_succeeded" | "w" | "wn" | "wum";
+                    type: "sapi" | "fn" | "i" | "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "cs" | "depnote" | "f" | "fc" | "fce" | "fco" | "fcoa" | "fcp" | "fcph" | "fcpn" | "fcpr" | "fcpro" | "fcu" | "fd" | "fdeac" | "fdeaz" | "fdecc" | "fdu" | "feacft" | "feccft" | "fecte" | "fede" | "federated_logout_failed" | "fens" | "feoobft" | "feotpft" | "fepft" | "fepotpft" | "fercft" | "ferrt" | "fertft" | "festft" | "fh" | "fimp" | "fi" | "flo" | "flows_execution_completed" | "flows_execution_failed" | "forms_submission_failed" | "forms_submission_succeeded" | "fp" | "fpar" | "fpurh" | "fs" | "fsa" | "fu" | "fui" | "fv" | "fvr" | "gd_auth_email_verification" | "gd_auth_fail_email_verification" | "gd_auth_failed" | "gd_auth_rejected" | "gd_auth_succeed" | "gd_enrollment_complete" | "gd_otp_rate_limit_exceed" | "gd_recovery_failed" | "gd_recovery_rate_limit_exceed" | "gd_recovery_succeed" | "gd_send_email" | "gd_send_email_verification" | "gd_send_email_verification_failure" | "gd_send_pn" | "gd_send_pn_failure" | "gd_send_sms" | "gd_send_sms_failure" | "gd_send_voice" | "gd_send_voice_failure" | "gd_start_auth" | "gd_start_enroll" | "gd_start_enroll_failed" | "gd_tenant_update" | "gd_unenroll" | "gd_update_device_account" | "gd_webauthn_challenge_failed" | "gd_webauthn_enrollment_failed" | "kms_key_management_failure" | "kms_key_management_success" | "kms_key_state_changed" | "limit_delegation" | "limit_mu" | "limit_sul" | "limit_wc" | "mfar" | "mgmt_api_read" | "my_account_authentication_method_failed" | "my_account_authentication_method_succeeded" | "oidc_backchannel_logout_failed" | "oidc_backchannel_logout_succeeded" | "organization_member_added" | "passkey_challenge_failed" | "passkey_challenge_started" | "pla" | "pwd_leak" | "reset_pwd_leak" | "resource_cleanup" | "rich_consents_access_error" | "s" | "fapi" | "sce" | "scoa" | "scp" | "scpn" | "scpr" | "scu" | "scv" | "sd" | "sdu" | "seacft" | "seccft" | "secte" | "sede" | "sens" | "seoobft" | "seotpft" | "sepotpft" | "sepft" | "sepkoobft" | "sepkotpft" | "sepkrcft" | "sercft" | "sertft" | "sestft" | "simp" | "si" | "signup_pwd_leak" | "slo" | "sh" | "spm" | "srrt" | "ss" | "ss_sso_failure" | "ss_sso_info" | "ss_sso_success" | "ssa" | "sscim" | "sui" | "sv" | "svr" | "too_many_records" | "ublkdu" | "universal_logout_failed" | "universal_logout_succeeded" | "w" | "wn" | "wum";
                     date: string;
                     isMobile: boolean;
                     log_id: string;

package/dist/types/routes/proxy-control-plane/index.d.ts

@@ -3,6 +3,7 @@ import type { ResolvedHost } from "@authhero/proxy";
 import { CustomDomain, CustomDomainsAdapter, ProxyRoute, ProxyRoutesAdapter } from "@authhero/adapter-interfaces";
 import { SyncEvent } from "../../helpers/control-plane-sync-events";
 import { Bindings } from "../../types";
+import { type TenantMembersControlPlaneOptions } from "./tenant-members";
 export interface ProxyControlPlaneOptions {
     /**
      * Cross-tenant host resolver. Typically delegated to a database adapter's
@@ -16,6 +17,22 @@ export interface ProxyControlPlaneOptions {
      * service binding by inspecting the URL and dispatching accordingly.
      */
     jwksFetch?: (url: string) => Promise<Response>;
+    /**
+     * Optional predicate that widens the set of accepted token issuers beyond
+     * `env.ISSUER` and the inbound host — specifically to a deployment's own
+     * Workers-for-Platforms tenant subdomains, whose per-tenant control-plane
+     * credential `jwksFetch` resolves locally (see #1139). Consulted before any
+     * JWKS fetch, so it still constrains where keys are fetched from; return
+     * `true` only for issuer hosts you serve. Applies to every mounted resource
+     * (custom-domains, tenant-members, sync).
+     *
+     * The second argument is the token's (unverified) `tenant_id` claim. Bind it
+     * to `iss` so a caller holding one tenant's subdomain key cannot act on
+     * another by naming it in the claim (#1143), e.g.
+     * `(iss, tid) => !!tid && iss === \`https://${tid}.${issuerHost}/\``. The
+     * binding is confirmed by the signature check the verifier runs afterwards.
+     */
+    isTrustedIssuer?: (iss: string, tenantId: string | undefined) => boolean;
     /**
      * Optional handler for `POST /sync` — receives `controlplane.sync.*` events
      * emitted by tenant shards via `ControlPlaneSyncDestination` and replicates
@@ -43,6 +60,18 @@ export interface ProxyControlPlaneOptions {
      * login.acme.com" needs a view across every tenant that only exists here.
      */
     customDomains?: CustomDomainsAdapter;
+    /**
+     * The authoritative tenant-team resource. When set, mounts
+     * `/api/v2/proxy/control-plane/tenant-members` — the resource tenant shards
+     * call through `createControlPlaneTenantMembersAdapter` to let their admins
+     * manage who administers the tenant (control-plane organization membership +
+     * org-scoped roles + invitations), rows the shard itself cannot write.
+     *
+     * Wire the backend to the control-plane database (see
+     * `createLocalTenantMembersBackend`); the org is pinned from the verified
+     * token, never the request.
+     */
+    tenantMembers?: TenantMembersControlPlaneOptions;
 }
 /**
  * Returns a Hono app exposing the privileged proxy control-plane endpoint

package/dist/types/routes/proxy-control-plane/scopes.d.ts

@@ -10,4 +10,11 @@ export declare const CONTROL_PLANE_SYNC_SCOPE = "controlplane:sync";
  * `createControlPlaneCustomDomainsAdapter`.
  */
 export declare const CONTROL_PLANE_CUSTOM_DOMAINS_SCOPE = "controlplane:custom_domains";
+/**
+ * Scope required by the authoritative `/tenant-members` resource on the control
+ * plane — a tenant's team (organization membership + org-scoped roles +
+ * invitations) that only the control plane can write. Tenant shards mint a
+ * token with this scope through `createControlPlaneTenantMembersAdapter`.
+ */
+export declare const CONTROL_PLANE_TENANT_MEMBERS_SCOPE = "controlplane:tenant_members";
 export { PROXY_RESOLVE_HOST_SCOPE };

package/dist/types/routes/proxy-control-plane/tenant-members.d.ts

@@ -0,0 +1,37 @@
+import { Hono, type Context } from "hono";
+import { Bindings } from "../../types";
+import { TenantMembersBackend } from "../../tenant-members/types";
+import type { AuthenticateControlPlane } from "./custom-domains";
+type TenantVars = {
+    tenantId: string;
+};
+/** Context seen by the control-plane resource: env + the pinned tenant id. */
+type CpCtx = Context<{
+    Bindings: Bindings;
+    Variables: TenantVars;
+}>;
+export interface TenantMembersControlPlaneOptions {
+    /**
+     * Build the backend for a request. Bound to the control-plane database
+     * (`c.env.data`) and, optionally, an email sender at wire-up time. The tenant
+     * is pinned separately from the verified token, so the factory does not need
+     * it.
+     */
+    getBackend: (c: CpCtx) => TenantMembersBackend | Promise<TenantMembersBackend>;
+    authenticate: AuthenticateControlPlane;
+}
+/**
+ * The authoritative `tenant-members` resource. Tenant shards reach it through
+ * `createControlPlaneTenantMembersAdapter`; it manages the control-plane
+ * organization that models a tenant's team — rows the shard cannot write.
+ *
+ * Every operation is bound to the `tenant_id` claim of the verified token. The
+ * scope alone is not authorization: each shard holds it, so a request-supplied
+ * tenant id would let any shard read or edit any other tenant's team. Mount
+ * under `/api/v2/proxy/control-plane/tenant-members`.
+ */
+export declare function createTenantMembersControlPlaneApp(options: TenantMembersControlPlaneOptions): Hono<{
+    Bindings: Bindings;
+    Variables: TenantVars;
+}>;
+export {};

package/dist/types/routes/proxy-control-plane/verify.d.ts

@@ -38,6 +38,32 @@ export interface VerifyControlPlaneTokenOptions {
      * `proxy:resolve_host`.
      */
     requiredScope?: string | string[];
+    /**
+     * Optional predicate consulted IN ADDITION to `expectedIssuers`, for issuers
+     * that can't be enumerated ahead of time — specifically a deployment's own
+     * Workers-for-Platforms tenant subdomains (`https://{tenant}.{host}/`), whose
+     * per-tenant control-plane credential the accompanying `jwksFetch` resolves
+     * locally (see #1139).
+     *
+     * Like `expectedIssuers`, it runs BEFORE the JWKS fetch, so it still gates
+     * where the verifier will fetch keys from: return `true` only for issuer
+     * hosts you actually serve. The signature must still verify against the
+     * resolved key, so this does not broaden trust beyond "a caller holding that
+     * tenant's registered private key."
+     *
+     * `tenantId` is the token's (as-yet UNVERIFIED) `tenant_id` claim. With
+     * per-tenant signing keys the key owner is encoded in `iss` while the
+     * `tenant_id` claim is set freely by the caller, so a predicate that only
+     * looks at `iss` cannot stop tenant A (holding A's key) from acting on
+     * tenant B by claiming `tenant_id: "B"`. Bind the two here — e.g.
+     * `(iss, tid) => !!tid && iss === \`https://${tid}.${host}/\``. This is
+     * sound despite `tenant_id` being unverified at predicate time: it is the
+     * SAME token whose signature is checked moments later, so verification
+     * confirms the exact `tenant_id` the predicate bound to `iss`. A forged
+     * `tenant_id` either fails the predicate (mismatch with `iss`) or fails
+     * signature verification (the caller lacks that subdomain's key).
+     */
+    isTrustedIssuer?: (iss: string, tenantId: string | undefined) => boolean;
 }
 /**
  * Verify a bearer token for the proxy control plane. Returns `{ ok: true }`

package/dist/types/routes/proxy-control-plane/verify.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/types/routes/universal-login/common.d.ts

@@ -456,7 +456,7 @@ export declare function initJSXRoute(ctx: Context<{
         custom_login_page_preview?: string | undefined;
         form_template?: string | undefined;
         addons?: Record<string, any> | undefined;
-        token_endpoint_auth_method?: "none" | "private_key_jwt" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | undefined;
+        token_endpoint_auth_method?: "client_secret_post" | "client_secret_basic" | "none" | "client_secret_jwt" | "private_key_jwt" | undefined;
         client_metadata?: Record<string, string> | undefined;
         hide_sign_up_disabled_error?: boolean | undefined;
         mobile?: Record<string, any> | undefined;
@@ -1185,7 +1185,7 @@ export declare function initJSXRouteWithSession(ctx: Context<{
         custom_login_page_preview?: string | undefined;
         form_template?: string | undefined;
         addons?: Record<string, any> | undefined;
-        token_endpoint_auth_method?: "none" | "private_key_jwt" | "client_secret_post" | "client_secret_basic" | "client_secret_jwt" | undefined;
+        token_endpoint_auth_method?: "client_secret_post" | "client_secret_basic" | "none" | "client_secret_jwt" | "private_key_jwt" | undefined;
         client_metadata?: Record<string, string> | undefined;
         hide_sign_up_disabled_error?: boolean | undefined;
         mobile?: Record<string, any> | undefined;