authhero 9.13.1 → 9.15.0

package/dist/types/routes/management-api/users.d.ts

@@ -817,11 +817,12 @@ export declare const userRoutes: OpenAPIHono<{
                 };
             };
             output: {
-                client_id: string;
-                user_id: string;
-                id: string;
                 created_at: string;
+                id: string;
+                client_id: string;
                 rotating: boolean;
+                user_id: string;
+                login_id: string;
                 device: {
                     initial_user_agent: string;
                     initial_ip: string;
@@ -830,7 +831,6 @@ export declare const userRoutes: OpenAPIHono<{
                     last_ip: string;
                     last_asn: string;
                 };
-                login_id: string;
                 resource_servers: {
                     audience: string;
                     scopes: string;
@@ -851,11 +851,12 @@ export declare const userRoutes: OpenAPIHono<{
                 limit: number;
                 length: number;
                 tokens: {
-                    client_id: string;
-                    user_id: string;
-                    id: string;
                     created_at: string;
+                    id: string;
+                    client_id: string;
                     rotating: boolean;
+                    user_id: string;
+                    login_id: string;
                     device: {
                         initial_user_agent: string;
                         initial_ip: string;
@@ -864,7 +865,6 @@ export declare const userRoutes: OpenAPIHono<{
                         last_ip: string;
                         last_asn: string;
                     };
-                    login_id: string;
                     resource_servers: {
                         audience: string;
                         scopes: string;
@@ -885,11 +885,12 @@ export declare const userRoutes: OpenAPIHono<{
                 next?: string | undefined;
             } | {
                 tokens: {
-                    client_id: string;
-                    user_id: string;
-                    id: string;
                     created_at: string;
+                    id: string;
+                    client_id: string;
                     rotating: boolean;
+                    user_id: string;
+                    login_id: string;
                     device: {
                         initial_user_agent: string;
                         initial_ip: string;
@@ -898,7 +899,6 @@ export declare const userRoutes: OpenAPIHono<{
                         last_ip: string;
                         last_asn: string;
                     };
-                    login_id: string;
                     resource_servers: {
                         audience: string;
                         scopes: string;
@@ -963,7 +963,7 @@ export declare const userRoutes: OpenAPIHono<{
                 };
             };
             output: {
-                type: "sapi" | "fn" | "i" | "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "cs" | "depnote" | "f" | "fc" | "fce" | "fco" | "fcoa" | "fcp" | "fcph" | "fcpn" | "fcpr" | "fcpro" | "fcu" | "fd" | "fdeac" | "fdeaz" | "fdecc" | "fdu" | "feacft" | "feccft" | "fecte" | "fede" | "federated_logout_failed" | "fens" | "feoobft" | "feotpft" | "fepft" | "fepotpft" | "fercft" | "ferrt" | "fertft" | "festft" | "fh" | "fimp" | "fi" | "flo" | "flows_execution_completed" | "flows_execution_failed" | "forms_submission_failed" | "forms_submission_succeeded" | "fp" | "fpar" | "fpurh" | "fs" | "fsa" | "fu" | "fui" | "fv" | "fvr" | "gd_auth_email_verification" | "gd_auth_fail_email_verification" | "gd_auth_failed" | "gd_auth_rejected" | "gd_auth_succeed" | "gd_enrollment_complete" | "gd_otp_rate_limit_exceed" | "gd_recovery_failed" | "gd_recovery_rate_limit_exceed" | "gd_recovery_succeed" | "gd_send_email" | "gd_send_email_verification" | "gd_send_email_verification_failure" | "gd_send_pn" | "gd_send_pn_failure" | "gd_send_sms" | "gd_send_sms_failure" | "gd_send_voice" | "gd_send_voice_failure" | "gd_start_auth" | "gd_start_enroll" | "gd_start_enroll_failed" | "gd_tenant_update" | "gd_unenroll" | "gd_update_device_account" | "gd_webauthn_challenge_failed" | "gd_webauthn_enrollment_failed" | "kms_key_management_failure" | "kms_key_management_success" | "kms_key_state_changed" | "limit_delegation" | "limit_mu" | "limit_sul" | "limit_wc" | "mfar" | "mgmt_api_read" | "my_account_authentication_method_failed" | "my_account_authentication_method_succeeded" | "oidc_backchannel_logout_failed" | "oidc_backchannel_logout_succeeded" | "organization_member_added" | "passkey_challenge_failed" | "passkey_challenge_started" | "pla" | "pwd_leak" | "reset_pwd_leak" | "resource_cleanup" | "rich_consents_access_error" | "s" | "fapi" | "sce" | "scoa" | "scp" | "scpn" | "scpr" | "scu" | "scv" | "sd" | "sdu" | "seacft" | "seccft" | "secte" | "sede" | "sens" | "seoobft" | "seotpft" | "sepotpft" | "sepft" | "sepkoobft" | "sepkotpft" | "sepkrcft" | "sercft" | "sertft" | "sestft" | "simp" | "si" | "signup_pwd_leak" | "slo" | "sh" | "spm" | "srrt" | "ss" | "ss_sso_failure" | "ss_sso_info" | "ss_sso_success" | "ssa" | "sscim" | "sui" | "sv" | "svr" | "too_many_records" | "ublkdu" | "universal_logout_failed" | "universal_logout_succeeded" | "w" | "wn" | "wum";
+                type: "cs" | "fi" | "sv" | "fn" | "sapi" | "i" | "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "depnote" | "f" | "fc" | "fce" | "fco" | "fcoa" | "fcp" | "fcph" | "fcpn" | "fcpr" | "fcpro" | "fcu" | "fd" | "fdeac" | "fdeaz" | "fdecc" | "fdu" | "feacft" | "feccft" | "fecte" | "fede" | "federated_logout_failed" | "fens" | "feoobft" | "feotpft" | "fepft" | "fepotpft" | "fercft" | "ferrt" | "fertft" | "festft" | "fh" | "fimp" | "flo" | "flows_execution_completed" | "flows_execution_failed" | "forms_submission_failed" | "forms_submission_succeeded" | "fp" | "fpar" | "fpurh" | "fs" | "fsa" | "fu" | "fui" | "fv" | "fvr" | "gd_auth_email_verification" | "gd_auth_fail_email_verification" | "gd_auth_failed" | "gd_auth_rejected" | "gd_auth_succeed" | "gd_enrollment_complete" | "gd_otp_rate_limit_exceed" | "gd_recovery_failed" | "gd_recovery_rate_limit_exceed" | "gd_recovery_succeed" | "gd_send_email" | "gd_send_email_verification" | "gd_send_email_verification_failure" | "gd_send_pn" | "gd_send_pn_failure" | "gd_send_sms" | "gd_send_sms_failure" | "gd_send_voice" | "gd_send_voice_failure" | "gd_start_auth" | "gd_start_enroll" | "gd_start_enroll_failed" | "gd_tenant_update" | "gd_unenroll" | "gd_update_device_account" | "gd_webauthn_challenge_failed" | "gd_webauthn_enrollment_failed" | "kms_key_management_failure" | "kms_key_management_success" | "kms_key_state_changed" | "limit_delegation" | "limit_mu" | "limit_sul" | "limit_wc" | "mfar" | "mgmt_api_read" | "my_account_authentication_method_failed" | "my_account_authentication_method_succeeded" | "oidc_backchannel_logout_failed" | "oidc_backchannel_logout_succeeded" | "organization_member_added" | "passkey_challenge_failed" | "passkey_challenge_started" | "pla" | "pwd_leak" | "reset_pwd_leak" | "resource_cleanup" | "rich_consents_access_error" | "s" | "fapi" | "sce" | "scoa" | "scp" | "scpn" | "scpr" | "scu" | "scv" | "sd" | "sdu" | "seacft" | "seccft" | "secte" | "sede" | "sens" | "seoobft" | "seotpft" | "sepotpft" | "sepft" | "sepkoobft" | "sepkotpft" | "sepkrcft" | "sercft" | "sertft" | "sestft" | "simp" | "si" | "signup_pwd_leak" | "slo" | "sh" | "spm" | "srrt" | "ss" | "ss_sso_failure" | "ss_sso_info" | "ss_sso_success" | "ssa" | "sscim" | "sui" | "svr" | "too_many_records" | "ublkdu" | "universal_logout_failed" | "universal_logout_succeeded" | "w" | "wn" | "wum";
                 date: string;
                 isMobile: boolean;
                 log_id: string;
@@ -1002,7 +1002,7 @@ export declare const userRoutes: OpenAPIHono<{
                 limit: number;
                 length: number;
                 logs: {
-                    type: "sapi" | "fn" | "i" | "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "cs" | "depnote" | "f" | "fc" | "fce" | "fco" | "fcoa" | "fcp" | "fcph" | "fcpn" | "fcpr" | "fcpro" | "fcu" | "fd" | "fdeac" | "fdeaz" | "fdecc" | "fdu" | "feacft" | "feccft" | "fecte" | "fede" | "federated_logout_failed" | "fens" | "feoobft" | "feotpft" | "fepft" | "fepotpft" | "fercft" | "ferrt" | "fertft" | "festft" | "fh" | "fimp" | "fi" | "flo" | "flows_execution_completed" | "flows_execution_failed" | "forms_submission_failed" | "forms_submission_succeeded" | "fp" | "fpar" | "fpurh" | "fs" | "fsa" | "fu" | "fui" | "fv" | "fvr" | "gd_auth_email_verification" | "gd_auth_fail_email_verification" | "gd_auth_failed" | "gd_auth_rejected" | "gd_auth_succeed" | "gd_enrollment_complete" | "gd_otp_rate_limit_exceed" | "gd_recovery_failed" | "gd_recovery_rate_limit_exceed" | "gd_recovery_succeed" | "gd_send_email" | "gd_send_email_verification" | "gd_send_email_verification_failure" | "gd_send_pn" | "gd_send_pn_failure" | "gd_send_sms" | "gd_send_sms_failure" | "gd_send_voice" | "gd_send_voice_failure" | "gd_start_auth" | "gd_start_enroll" | "gd_start_enroll_failed" | "gd_tenant_update" | "gd_unenroll" | "gd_update_device_account" | "gd_webauthn_challenge_failed" | "gd_webauthn_enrollment_failed" | "kms_key_management_failure" | "kms_key_management_success" | "kms_key_state_changed" | "limit_delegation" | "limit_mu" | "limit_sul" | "limit_wc" | "mfar" | "mgmt_api_read" | "my_account_authentication_method_failed" | "my_account_authentication_method_succeeded" | "oidc_backchannel_logout_failed" | "oidc_backchannel_logout_succeeded" | "organization_member_added" | "passkey_challenge_failed" | "passkey_challenge_started" | "pla" | "pwd_leak" | "reset_pwd_leak" | "resource_cleanup" | "rich_consents_access_error" | "s" | "fapi" | "sce" | "scoa" | "scp" | "scpn" | "scpr" | "scu" | "scv" | "sd" | "sdu" | "seacft" | "seccft" | "secte" | "sede" | "sens" | "seoobft" | "seotpft" | "sepotpft" | "sepft" | "sepkoobft" | "sepkotpft" | "sepkrcft" | "sercft" | "sertft" | "sestft" | "simp" | "si" | "signup_pwd_leak" | "slo" | "sh" | "spm" | "srrt" | "ss" | "ss_sso_failure" | "ss_sso_info" | "ss_sso_success" | "ssa" | "sscim" | "sui" | "sv" | "svr" | "too_many_records" | "ublkdu" | "universal_logout_failed" | "universal_logout_succeeded" | "w" | "wn" | "wum";
+                    type: "cs" | "fi" | "sv" | "fn" | "sapi" | "i" | "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "depnote" | "f" | "fc" | "fce" | "fco" | "fcoa" | "fcp" | "fcph" | "fcpn" | "fcpr" | "fcpro" | "fcu" | "fd" | "fdeac" | "fdeaz" | "fdecc" | "fdu" | "feacft" | "feccft" | "fecte" | "fede" | "federated_logout_failed" | "fens" | "feoobft" | "feotpft" | "fepft" | "fepotpft" | "fercft" | "ferrt" | "fertft" | "festft" | "fh" | "fimp" | "flo" | "flows_execution_completed" | "flows_execution_failed" | "forms_submission_failed" | "forms_submission_succeeded" | "fp" | "fpar" | "fpurh" | "fs" | "fsa" | "fu" | "fui" | "fv" | "fvr" | "gd_auth_email_verification" | "gd_auth_fail_email_verification" | "gd_auth_failed" | "gd_auth_rejected" | "gd_auth_succeed" | "gd_enrollment_complete" | "gd_otp_rate_limit_exceed" | "gd_recovery_failed" | "gd_recovery_rate_limit_exceed" | "gd_recovery_succeed" | "gd_send_email" | "gd_send_email_verification" | "gd_send_email_verification_failure" | "gd_send_pn" | "gd_send_pn_failure" | "gd_send_sms" | "gd_send_sms_failure" | "gd_send_voice" | "gd_send_voice_failure" | "gd_start_auth" | "gd_start_enroll" | "gd_start_enroll_failed" | "gd_tenant_update" | "gd_unenroll" | "gd_update_device_account" | "gd_webauthn_challenge_failed" | "gd_webauthn_enrollment_failed" | "kms_key_management_failure" | "kms_key_management_success" | "kms_key_state_changed" | "limit_delegation" | "limit_mu" | "limit_sul" | "limit_wc" | "mfar" | "mgmt_api_read" | "my_account_authentication_method_failed" | "my_account_authentication_method_succeeded" | "oidc_backchannel_logout_failed" | "oidc_backchannel_logout_succeeded" | "organization_member_added" | "passkey_challenge_failed" | "passkey_challenge_started" | "pla" | "pwd_leak" | "reset_pwd_leak" | "resource_cleanup" | "rich_consents_access_error" | "s" | "fapi" | "sce" | "scoa" | "scp" | "scpn" | "scpr" | "scu" | "scv" | "sd" | "sdu" | "seacft" | "seccft" | "secte" | "sede" | "sens" | "seoobft" | "seotpft" | "sepotpft" | "sepft" | "sepkoobft" | "sepkotpft" | "sepkrcft" | "sercft" | "sertft" | "sestft" | "simp" | "si" | "signup_pwd_leak" | "slo" | "sh" | "spm" | "srrt" | "ss" | "ss_sso_failure" | "ss_sso_info" | "ss_sso_success" | "ssa" | "sscim" | "sui" | "svr" | "too_many_records" | "ublkdu" | "universal_logout_failed" | "universal_logout_succeeded" | "w" | "wn" | "wum";
                     date: string;
                     isMobile: boolean;
                     log_id: string;

package/dist/types/routes/proxy-control-plane/tenant-members.d.ts

@@ -15,10 +15,17 @@ export interface TenantMembersControlPlaneOptions {
      * Build the backend for a request. Bound to the control-plane database
      * (`c.env.data`) and, optionally, an email sender at wire-up time. The tenant
      * is pinned separately from the verified token, so the factory does not need
-     * it.
+     * it. Pass `c` as the local backend's `ctx` to send invitation emails as the
+     * control-plane tenant.
      */
     getBackend: (c: CpCtx) => TenantMembersBackend | Promise<TenantMembersBackend>;
-    authenticate: AuthenticateControlPlane;
+    /**
+     * Defaults to verifying a `controlplane:tenant_members` bearer token issued
+     * by `env.ISSUER` or the inbound host. Ignored under
+     * `createProxyControlPlaneApp`, which always applies that check together with
+     * its own `jwksFetch` / `isTrustedIssuer`.
+     */
+    authenticate?: AuthenticateControlPlane;
 }
 /**
  * The authoritative `tenant-members` resource. Tenant shards reach it through

package/dist/types/routes/proxy-control-plane/verify.d.ts

@@ -78,4 +78,19 @@ export interface VerifyControlPlaneTokenOptions {
  * so an attacker cannot redirect the verifier to a JWKS they control.
  */
 export declare function verifyControlPlaneToken(options: VerifyControlPlaneTokenOptions): Promise<VerifyControlPlaneTokenResult>;
+/**
+ * Authenticate a control-plane request: its `Bearer` JWT must be issued by
+ * either the runtime `env.ISSUER` or the host the request actually arrived on
+ * (`x-forwarded-host` or the request URL's host), and carry `requiredScope`.
+ */
+export declare function authenticateControlPlaneRequest(c: {
+    req: {
+        raw: Request;
+        header(name: string): string | undefined;
+        url: string;
+    };
+    env: {
+        ISSUER: string;
+    };
+}, requiredScope: string | string[], options?: Pick<VerifyControlPlaneTokenOptions, "jwksFetch" | "isTrustedIssuer">): Promise<VerifyControlPlaneTokenResult>;
 export { PROXY_RESOLVE_HOST_SCOPE };

package/dist/types/routes/universal-login/common.d.ts

@@ -486,6 +486,9 @@ export declare function initJSXRoute(ctx: Context<{
         owner_user_id?: string | undefined;
         registration_type?: "manual" | "open_dcr" | "iat_dcr" | undefined;
         registration_metadata?: Record<string, any> | undefined;
+        token_exchange?: {
+            allow_any_profile_of_type?: "custom_authentication"[] | undefined;
+        } | undefined;
         user_linking_mode?: "builtin" | "off" | undefined;
     };
     tenant: {
@@ -1219,6 +1222,9 @@ export declare function initJSXRouteWithSession(ctx: Context<{
         owner_user_id?: string | undefined;
         registration_type?: "manual" | "open_dcr" | "iat_dcr" | undefined;
         registration_metadata?: Record<string, any> | undefined;
+        token_exchange?: {
+            allow_any_profile_of_type?: "custom_authentication"[] | undefined;
+        } | undefined;
         user_linking_mode?: "builtin" | "off" | undefined;
     };
     user: {

package/dist/types/routes/universal-login/flow-api.d.ts

@@ -173,7 +173,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 400;
+            status: 404;
         } | {
             input: {
                 query: {
@@ -188,7 +188,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 404;
+            status: 400;
         } | {
             input: {
                 query: {
@@ -282,7 +282,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 400;
+            status: 404;
         } | {
             input: {
                 param: {
@@ -300,7 +300,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 404;
+            status: 400;
         } | {
             input: {
                 param: {

package/dist/types/routes/universal-login/form-node.d.ts

@@ -18,7 +18,7 @@ export declare const formNodeRoutes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 200;
+            status: 404;
         } | {
             input: {
                 param: {
@@ -32,7 +32,7 @@ export declare const formNodeRoutes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 404;
+            status: 200;
         };
     };
 } & {
@@ -52,7 +52,7 @@ export declare const formNodeRoutes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 200;
+            status: 404;
         } | {
             input: {
                 param: {
@@ -68,7 +68,7 @@ export declare const formNodeRoutes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 404;
+            status: 200;
         };
     };
 }, "/">;

package/dist/types/routes/universal-login/index.d.ts

@@ -63,7 +63,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 200;
+            status: 404;
         } | {
             input: {
                 param: {
@@ -77,7 +77,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 404;
+            status: 200;
         };
     };
 } & {
@@ -97,7 +97,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 200;
+            status: 404;
         } | {
             input: {
                 param: {
@@ -113,7 +113,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 404;
+            status: 200;
         };
     };
 }, "/forms"> & import("hono/types").MergeSchemaPath<{
@@ -515,7 +515,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
             } & {
                 form: {
                     username: string;
-                    login_selection?: "password" | "code" | undefined;
+                    login_selection?: "code" | "password" | undefined;
                 };
             };
             output: {};
@@ -529,7 +529,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
             } & {
                 form: {
                     username: string;
-                    login_selection?: "password" | "code" | undefined;
+                    login_selection?: "code" | "password" | undefined;
                 };
             };
             output: {};

package/dist/types/routes/universal-login/screens/login-otp.d.ts

@@ -0,0 +1,17 @@
+import type { Context } from "hono";
+import type { LoginSession } from "@authhero/adapter-interfaces";
+import type { EnrichedClient } from "../../../helpers/client";
+import type { Bindings, Variables } from "../../../types";
+/**
+ * Create a one-time code bound to the login session and deliver it to the
+ * user, either as a code or (for magic-link email connections) as a link.
+ */
+export declare function sendLoginOtp(ctx: Context<{
+    Bindings: Bindings;
+    Variables: Variables;
+}>, { client, loginSession, to, magicLink, }: {
+    client: EnrichedClient;
+    loginSession: LoginSession;
+    to: string;
+    magicLink: boolean;
+}): Promise<void>;

package/dist/types/routes/universal-login/screens/types.d.ts

@@ -165,6 +165,12 @@ export interface ScreenDefinition {
  * Returns "/u2/login" for password-first or "/u2/login/identifier" for identifier-first.
  */
 export declare function getLoginPath(context: ScreenContext): Promise<string>;
+/**
+ * Whether the login flow starts on the identifier screen. On the combined
+ * password-first login page the user picks password or code up front, so the
+ * "or" switch between the two challenge screens is only offered here.
+ */
+export declare function isIdentifierFirstLogin(context: ScreenContext): Promise<boolean>;
 /**
  * Resolve the "Last used" connection hint for the identifier/login screens.
  *

package/dist/types/routes/universal-login/u2-form-node.d.ts

@@ -28,7 +28,7 @@ export declare const u2FormNodeRoutes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 200;
+            status: 404;
         } | {
             input: {
                 param: {
@@ -42,7 +42,7 @@ export declare const u2FormNodeRoutes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 404;
+            status: 200;
         };
     };
 } & {

package/dist/types/routes/universal-login/u2-index.d.ts

@@ -165,7 +165,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         $get: {
             input: {
                 param: {
-                    screen: "login" | "signup" | "impersonate" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "enter-password" | "login" | "reset-password" | "consent" | "impersonate" | "reset-password/request" | "reset-password/code" | "account" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -181,7 +181,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "login" | "signup" | "impersonate" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "enter-password" | "login" | "reset-password" | "consent" | "impersonate" | "reset-password/request" | "reset-password/code" | "account" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -197,7 +197,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "login" | "signup" | "impersonate" | "reset-password" | "consent" | "account" | "enter-password" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "enter-password" | "login" | "reset-password" | "consent" | "impersonate" | "reset-password/request" | "reset-password/code" | "account" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -217,7 +217,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         $post: {
             input: {
                 param: {
-                    screen: "login" | "signup" | "impersonate" | "reset-password" | "consent" | "enter-password" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "enter-password" | "login" | "reset-password" | "consent" | "impersonate" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -235,7 +235,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "login" | "signup" | "impersonate" | "reset-password" | "consent" | "enter-password" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "reset-password/code" | "reset-password/request" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "enter-password" | "login" | "reset-password" | "consent" | "impersonate" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -267,7 +267,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 200;
+            status: 404;
         } | {
             input: {
                 param: {
@@ -281,7 +281,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 404;
+            status: 200;
         };
     };
 } & {

package/dist/types/routes/universal-login/u2-routes.d.ts

@@ -170,7 +170,7 @@ export declare const u2Routes: OpenAPIHono<{
         $get: {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "login" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "enter-password" | "login" | "reset-password" | "consent" | "impersonate" | "reset-password/request" | "reset-password/code" | "account" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -186,7 +186,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "login" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "enter-password" | "login" | "reset-password" | "consent" | "impersonate" | "reset-password/request" | "reset-password/code" | "account" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -202,7 +202,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "login" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "enter-password" | "login" | "reset-password" | "consent" | "impersonate" | "reset-password/request" | "reset-password/code" | "account" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -222,7 +222,7 @@ export declare const u2Routes: OpenAPIHono<{
         $post: {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "login" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "enter-password" | "login" | "reset-password" | "consent" | "impersonate" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -240,7 +240,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "impersonate" | "login" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "signup" | "enter-password" | "login" | "reset-password" | "consent" | "impersonate" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {

package/dist/types/state-machines/login-session.d.ts

@@ -140,7 +140,7 @@ export declare const loginSessionMachine: import("xstate").StateMachine<LoginSes
 } | {
     type: "setFailureReason";
     params: import("xstate").NonReducibleUnknown;
-}, never, never, "pending" | "failed" | "completed" | "expired" | "authenticated" | "awaiting_email_verification" | "awaiting_mfa" | "awaiting_consent" | "awaiting_hook" | "awaiting_continuation", string, import("xstate").NonReducibleUnknown, import("xstate").NonReducibleUnknown, import("xstate").EventObject, import("xstate").MetaObject, {
+}, never, never, "pending" | "failed" | "expired" | "authenticated" | "awaiting_email_verification" | "awaiting_mfa" | "awaiting_consent" | "awaiting_hook" | "awaiting_continuation" | "completed", string, import("xstate").NonReducibleUnknown, import("xstate").NonReducibleUnknown, import("xstate").EventObject, import("xstate").MetaObject, {
     id: "loginSession";
     states: {
         readonly pending: {};

package/dist/types/tenant-members/local-backend.d.ts

@@ -1,4 +1,5 @@
 import { DataAdapters } from "@authhero/adapter-interfaces";
+import { RequestContext } from "../types";
 import { TenantMembersBackend } from "./types";
 /** The control-plane adapters the team lives in. */
 type TeamAdapters = Pick<DataAdapters, "organizations" | "userOrganizations" | "userRoles" | "users" | "roles" | "invites">;
@@ -19,9 +20,16 @@ export interface LocalTenantMembersBackendOptions {
      */
     invitationClientId?: string;
     /**
-     * Best-effort invitation email delivery. Bound to a request context at the
-     * call site (it needs branding/email infra). Failures must not fail the
-     * create — Auth0 returns the invite even when delivery fails.
+     * The request context. When set and `sendInvitationEmail` is not, invitation
+     * emails are sent with the built-in `user_invitation` template as the
+     * control-plane tenant (its email provider, branding and locales), not the
+     * request's tenant.
+     */
+    ctx?: RequestContext;
+    /**
+     * Best-effort invitation email delivery. Overrides the built-in sender used
+     * when `ctx` is set. Failures must not fail the create — Auth0 returns the
+     * invite even when delivery fails.
      */
     sendInvitationEmail?: (params: {
         to: string;

package/dist/types/types/RequestContext.d.ts

@@ -0,0 +1,16 @@
+import type { Context } from "hono";
+import type { Bindings } from "./Bindings";
+import type { Variables } from "./Variables";
+/**
+ * The part of a request context the email, logging and service-token helpers
+ * use. Every `Variables` entry is optional, so a context that sets only some of
+ * them (such as the proxy control-plane resource) can call these helpers too.
+ * The app's full `Context<{ Bindings; Variables }>` is assignable to it.
+ */
+export type RequestContext = Pick<Context<{
+    Bindings: Bindings;
+    Variables: Partial<Variables>;
+}>, "env" | "var" | "req" | "executionCtx"> & {
+    set(key: "outboxEventPromises", value: Promise<string>[]): void;
+    set(key: "backgroundPromises", value: Promise<void>[]): void;
+};

package/dist/types/types/index.d.ts

@@ -1,5 +1,6 @@
 export * from "./Variables";
 export * from "./Bindings";
+export * from "./RequestContext";
 export * from "./auth0";
 export * from "./AuthHeroConfig";
 export * from "./OutboxMetrics";

package/dist/types/utils/jwks.d.ts

@@ -7,8 +7,8 @@ import { SigningKeyModeOption } from "../types/AuthHeroConfig";
  * still verify during the per-tenant key rollout.
  */
 export declare function getJwksForPublication(data: DataAdapters, tenantId: string, modeOption: SigningKeyModeOption | undefined): Promise<{
-    alg: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "HS256" | "HS384" | "HS512";
     kty: "EC" | "RSA" | "oct";
+    alg?: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "HS256" | "HS384" | "HS512" | undefined;
     kid?: string | undefined;
     use?: "sig" | "enc" | undefined;
     n?: string | undefined;
@@ -26,8 +26,8 @@ export declare function getJwksForPublication(data: DataAdapters, tenantId: stri
  * subdomain), only control-plane-signed tokens are accepted.
  */
 export declare function getJwksForVerification(data: DataAdapters, tenantId: string | undefined, modeOption: SigningKeyModeOption | undefined): Promise<{
-    alg: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "HS256" | "HS384" | "HS512";
     kty: "EC" | "RSA" | "oct";
+    alg?: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "HS256" | "HS384" | "HS512" | undefined;
     kid?: string | undefined;
     use?: "sig" | "enc" | undefined;
     n?: string | undefined;

package/dist/types/utils/jws-verify.d.ts

@@ -0,0 +1,46 @@
+import { Jwk } from "@authhero/adapter-interfaces";
+import { SupportedAlg } from "./jwk-alg";
+/**
+ * Asymmetric JWS signature verification against a set of public JWKs.
+ *
+ * Shared by RFC 7523 client assertions (`helpers/client-assertion.ts`) and
+ * Custom Token Exchange subject tokens, which both verify a compact JWS signed
+ * by a party that registered its keys with us. Claim validation is left to
+ * the caller because the two differ (iss/sub/aud rules).
+ */
+export declare const ASYMMETRIC_JWS_ALGS: readonly SupportedAlg[];
+export declare function isAsymmetricJwsAlg(alg: unknown): alg is SupportedAlg;
+export declare function jwkMatchesAlg(jwk: Jwk, alg: SupportedAlg): boolean;
+export type JwsKeySelection = {
+    verified: true;
+} | {
+    verified: false;
+    reason: "no_matching_key" | "bad_signature";
+};
+/**
+ * Verify `signature` over `signedInput` with the JWKs that could have produced
+ * it: the one named by `kid` when the header carries one, otherwise every key
+ * compatible with `alg`. Keys that fail to import are skipped.
+ */
+export declare function verifyAsymmetricJwsSignature(params: {
+    signedInput: Uint8Array<ArrayBuffer>;
+    signature: Uint8Array<ArrayBuffer>;
+    alg: SupportedAlg;
+    kid?: string;
+    jwks: Jwk[];
+}): Promise<JwsKeySelection>;
+export interface DecodedCompactJws {
+    header: {
+        alg?: unknown;
+        kid?: unknown;
+        typ?: unknown;
+    };
+    payload: Record<string, unknown>;
+    signedInput: Uint8Array<ArrayBuffer>;
+    signature: Uint8Array<ArrayBuffer>;
+}
+/**
+ * Split and decode a compact JWS without verifying it. Returns null when the
+ * token is not a 3-part JWS with JSON-object header and payload.
+ */
+export declare function decodeCompactJws(token: string): DecodedCompactJws | null;