authhero 9.15.0 → 9.17.0

package/dist/types/routes/universal-login/flow-api.d.ts

@@ -43,7 +43,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                         hint?: string | undefined;
                         messages?: {
                             text: string;
-                            type: "success" | "error" | "info" | "warning";
+                            type: "error" | "success" | "info" | "warning";
                             id?: number | undefined;
                         }[] | undefined;
                     }[];
@@ -51,7 +51,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                     description?: string | undefined;
                     messages?: {
                         text: string;
-                        type: "success" | "error" | "info" | "warning";
+                        type: "error" | "success" | "info" | "warning";
                         id?: number | undefined;
                     }[] | undefined;
                     links?: {
@@ -123,7 +123,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                         hint?: string | undefined;
                         messages?: {
                             text: string;
-                            type: "success" | "error" | "info" | "warning";
+                            type: "error" | "success" | "info" | "warning";
                             id?: number | undefined;
                         }[] | undefined;
                     }[];
@@ -131,7 +131,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                     description?: string | undefined;
                     messages?: {
                         text: string;
-                        type: "success" | "error" | "info" | "warning";
+                        type: "error" | "success" | "info" | "warning";
                         id?: number | undefined;
                     }[] | undefined;
                     links?: {
@@ -173,7 +173,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 404;
+            status: 400;
         } | {
             input: {
                 query: {
@@ -188,7 +188,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 400;
+            status: 404;
         } | {
             input: {
                 query: {
@@ -220,7 +220,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                         hint?: string | undefined;
                         messages?: {
                             text: string;
-                            type: "success" | "error" | "info" | "warning";
+                            type: "error" | "success" | "info" | "warning";
                             id?: number | undefined;
                         }[] | undefined;
                     }[];
@@ -228,7 +228,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                     description?: string | undefined;
                     messages?: {
                         text: string;
-                        type: "success" | "error" | "info" | "warning";
+                        type: "error" | "success" | "info" | "warning";
                         id?: number | undefined;
                     }[] | undefined;
                     links?: {
@@ -282,7 +282,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 404;
+            status: 400;
         } | {
             input: {
                 param: {
@@ -300,7 +300,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 400;
+            status: 404;
         } | {
             input: {
                 param: {
@@ -335,7 +335,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                         hint?: string | undefined;
                         messages?: {
                             text: string;
-                            type: "success" | "error" | "info" | "warning";
+                            type: "error" | "success" | "info" | "warning";
                             id?: number | undefined;
                         }[] | undefined;
                     }[];
@@ -343,7 +343,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
                     description?: string | undefined;
                     messages?: {
                         text: string;
-                        type: "success" | "error" | "info" | "warning";
+                        type: "error" | "success" | "info" | "warning";
                         id?: number | undefined;
                     }[] | undefined;
                     links?: {

package/dist/types/routes/universal-login/form-node.d.ts

@@ -18,7 +18,7 @@ export declare const formNodeRoutes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 404;
+            status: 200;
         } | {
             input: {
                 param: {
@@ -32,7 +32,7 @@ export declare const formNodeRoutes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 200;
+            status: 404;
         };
     };
 } & {
@@ -52,7 +52,7 @@ export declare const formNodeRoutes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 404;
+            status: 200;
         } | {
             input: {
                 param: {
@@ -68,7 +68,7 @@ export declare const formNodeRoutes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 200;
+            status: 404;
         };
     };
 }, "/">;

package/dist/types/routes/universal-login/index.d.ts

@@ -63,7 +63,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 404;
+            status: 200;
         } | {
             input: {
                 param: {
@@ -77,7 +77,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 200;
+            status: 404;
         };
     };
 } & {
@@ -97,7 +97,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 404;
+            status: 200;
         } | {
             input: {
                 param: {
@@ -113,7 +113,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 200;
+            status: 404;
         };
     };
 }, "/forms"> & import("hono/types").MergeSchemaPath<{

package/dist/types/routes/universal-login/screens/connect-authz.d.ts

@@ -21,6 +21,20 @@ export declare const DCR_REGISTER_PERMISSION = "create:clients";
  * Management API audience so unrelated API permissions can't satisfy it.
  */
 export declare function userHasGlobalOrgAdmin(context: ScreenContext, userId: string): Promise<boolean>;
+/**
+ * True when the user holds the global `access:all_organizations` permission
+ * (directly or through a role, Management API audience). Such a user may open
+ * any control-plane org without being a member, but is NOT a tenant admin:
+ * registering a DCR client still needs `create:clients`, which for these
+ * users can come from their global roles (#1437).
+ */
+export declare function userHasAccessAllOrganizations(context: ScreenContext, userId: string): Promise<boolean>;
+/**
+ * True when the user holds `create:clients` at global scope (Management API
+ * audience). For a user with `access:all_organizations` this lets them
+ * register on any child tenant without an org-scoped role.
+ */
+export declare function userCanRegisterGlobally(context: ScreenContext, userId: string): Promise<boolean>;
 /**
  * True when the user holds the DCR register permission on the given
  * control-plane organization (scoped to the Management API audience).
@@ -33,6 +47,8 @@ export declare function userCanRegisterOnOrg(context: ScreenContext, userId: str
  *
  * Access is granted when either:
  *  - the user holds the global `admin:organizations` escape hatch, or
+ *  - the user holds global `access:all_organizations` AND `create:clients`
+ *    (globally or on that org), with no membership needed, or
  *  - the user is a member of the control-plane org whose `name` equals the
  *    target tenant id AND holds `create:clients` on their role for that org.
  *

package/dist/types/routes/universal-login/u2-form-node.d.ts

@@ -28,7 +28,7 @@ export declare const u2FormNodeRoutes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 404;
+            status: 200;
         } | {
             input: {
                 param: {
@@ -42,7 +42,7 @@ export declare const u2FormNodeRoutes: OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 200;
+            status: 404;
         };
     };
 } & {

package/dist/types/routes/universal-login/u2-index.d.ts

@@ -165,7 +165,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         $get: {
             input: {
                 param: {
-                    screen: "signup" | "enter-password" | "login" | "reset-password" | "consent" | "impersonate" | "reset-password/request" | "reset-password/code" | "account" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "login" | "impersonate" | "signup" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -181,7 +181,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "enter-password" | "login" | "reset-password" | "consent" | "impersonate" | "reset-password/request" | "reset-password/code" | "account" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "login" | "impersonate" | "signup" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -197,7 +197,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "enter-password" | "login" | "reset-password" | "consent" | "impersonate" | "reset-password/request" | "reset-password/code" | "account" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "login" | "impersonate" | "signup" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -217,7 +217,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         $post: {
             input: {
                 param: {
-                    screen: "signup" | "enter-password" | "login" | "reset-password" | "consent" | "impersonate" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -235,7 +235,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "enter-password" | "login" | "reset-password" | "consent" | "impersonate" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -267,7 +267,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 404;
+            status: 200;
         } | {
             input: {
                 param: {
@@ -281,7 +281,7 @@ export default function createU2App(config: AuthHeroConfig): OpenAPIHono<{
             };
             output: {};
             outputFormat: string;
-            status: 200;
+            status: 404;
         };
     };
 } & {

package/dist/types/routes/universal-login/u2-routes.d.ts

@@ -170,7 +170,7 @@ export declare const u2Routes: OpenAPIHono<{
         $get: {
             input: {
                 param: {
-                    screen: "signup" | "enter-password" | "login" | "reset-password" | "consent" | "impersonate" | "reset-password/request" | "reset-password/code" | "account" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "login" | "impersonate" | "signup" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -186,7 +186,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "enter-password" | "login" | "reset-password" | "consent" | "impersonate" | "reset-password/request" | "reset-password/code" | "account" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "login" | "impersonate" | "signup" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -202,7 +202,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "enter-password" | "login" | "reset-password" | "consent" | "impersonate" | "reset-password/request" | "reset-password/code" | "account" | "try-connection-result" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "login" | "impersonate" | "signup" | "account" | "reset-password" | "consent" | "enter-password" | "try-connection-result" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -222,7 +222,7 @@ export declare const u2Routes: OpenAPIHono<{
         $post: {
             input: {
                 param: {
-                    screen: "signup" | "enter-password" | "login" | "reset-password" | "consent" | "impersonate" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {
@@ -240,7 +240,7 @@ export declare const u2Routes: OpenAPIHono<{
         } | {
             input: {
                 param: {
-                    screen: "signup" | "enter-password" | "login" | "reset-password" | "consent" | "impersonate" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
+                    screen: "login" | "impersonate" | "signup" | "reset-password" | "consent" | "enter-password" | "reset-password/request" | "reset-password/code" | "login/identifier" | "login/email-otp-challenge" | "login/sms-otp-challenge" | "login/login-passwordless-identifier" | "mfa/login-options" | "mfa/totp-challenge" | "mfa/totp-enrollment" | "mfa/phone-challenge" | "mfa/phone-enrollment" | "passkey/challenge" | "passkey/enrollment" | "passkey/enrollment-nudge" | "account/profile" | "account/security" | "account/security/totp-enrollment" | "account/security/phone-enrollment" | "account/linked" | "account/delete" | "account/passkeys" | "connect/start" | "connect/select-tenant";
                 };
             } & {
                 query: {

package/dist/types/state-machines/login-session.d.ts

@@ -140,7 +140,7 @@ export declare const loginSessionMachine: import("xstate").StateMachine<LoginSes
 } | {
     type: "setFailureReason";
     params: import("xstate").NonReducibleUnknown;
-}, never, never, "pending" | "failed" | "expired" | "authenticated" | "awaiting_email_verification" | "awaiting_mfa" | "awaiting_consent" | "awaiting_hook" | "awaiting_continuation" | "completed", string, import("xstate").NonReducibleUnknown, import("xstate").NonReducibleUnknown, import("xstate").EventObject, import("xstate").MetaObject, {
+}, never, never, "pending" | "failed" | "expired" | "completed" | "authenticated" | "awaiting_email_verification" | "awaiting_mfa" | "awaiting_consent" | "awaiting_hook" | "awaiting_continuation", string, import("xstate").NonReducibleUnknown, import("xstate").NonReducibleUnknown, import("xstate").EventObject, import("xstate").MetaObject, {
     id: "loginSession";
     states: {
         readonly pending: {};

package/dist/types/types/AuthHeroConfig.d.ts

@@ -2,6 +2,7 @@ import { CodeExecutor, Connection, ConnectionInsert, CreateTenantParams, DataAda
 import type { RolePermissionHooks, Hooks } from "./Hooks";
 import type { OutboxMetricsSink } from "./OutboxMetrics";
 import type { SamlSigner } from "@authhero/saml/core";
+import type { SigningCertificateAuthority } from "../helpers/signing-certificate-authority";
 import type { OpenAPIHono } from "@hono/zod-openapi";
 import type { Handler, MiddlewareHandler } from "hono";
 import type { ManagementAudienceResolver, IssuerResolver } from "../middlewares/authentication";
@@ -690,6 +691,43 @@ export interface AuthHeroConfig {
      * @default "control-plane"
      */
     signingKeyMode?: SigningKeyModeOption;
+    /**
+     * Issue `jwt_signing` certificates from an intermediate CA instead of
+     * self-signing them, and publish the chain (`x5c`, `x5t#S256`) in the JWKS.
+     *
+     * Each certificate carries its owner in a SubjectAlternativeName URI
+     * (`urn:authhero:tenant:<id>`, or `urn:authhero:control-plane`), so a
+     * relying party can pin one root and trust a key for a tenant without
+     * knowing which hosts that tenant is served on.
+     *
+     * Applies to keys created or renewed after it is set. Existing
+     * self-signed keys keep working and are published without a chain until
+     * they are rotated out. SAML keys are never CA-issued.
+     *
+     * @example
+     * ```ts
+     * signingCertificateAuthority: {
+     *   issuer: createLocalCertificateIssuer({
+     *     certificate: env.SIGNING_CA_CERT,
+     *     privateKey: env.SIGNING_CA_KEY,
+     *   }),
+     * }
+     * ```
+     */
+    signingCertificateAuthority?: SigningCertificateAuthority;
+    /**
+     * Answer 404 on `/.well-known/*` when the request host doesn't belong to
+     * this deployment: not the ISSUER host, not a `{tenant}.{issuer}`
+     * subdomain of an existing tenant, and not a registered custom domain.
+     *
+     * Without it, discovery and JWKS are served for any host that reaches the
+     * worker, falling back to the control-plane keys and apex metadata. Turn it
+     * on once every host the deployment is reached on is one of the above
+     * (watch for `*.workers.dev` URLs and unregistered domain aliases).
+     *
+     * @default false
+     */
+    rejectUnknownHosts?: boolean;
     /**
      * Relax the management API audience check from a hard 403 to a
      * `console.warn`. Tokens issued for any other audience will still be

package/dist/types/types/Bindings.d.ts

@@ -1,3 +1,4 @@
+import type { SigningCertificateAuthority } from "../helpers/signing-certificate-authority";
 import { CodeExecutor, DataAdapters } from "@authhero/adapter-interfaces";
 import type { SamlSigner } from "@authhero/saml/core";
 import { Hooks } from "./Hooks";
@@ -42,6 +43,8 @@ export type Bindings = {
     userLinkingMode?: UserLinkingModeOption;
     usernamePasswordProvider?: UsernamePasswordProviderResolver;
     signingKeyMode?: SigningKeyModeOption;
+    signingCertificateAuthority?: SigningCertificateAuthority;
+    rejectUnknownHosts?: boolean;
     mcp?: McpConfig;
     /**
      * Allow outbound fetches (jwks_uri, request_uri) to localhost / private IP

package/dist/types/utils/encryption.d.ts

@@ -1,5 +1,6 @@
 import * as x509 from "@peculiar/x509";
 import { SigningKey } from "@authhero/adapter-interfaces";
+import type { CertificateAuthorityIssuance } from "../helpers/signing-certificate-authority";
 /**
  * Supported signing-key shapes. Note: `EC-P-521` is not supported on
  * Cloudflare Workers (`workerd`) — `crypto.subtle.generateKey` will reject
@@ -24,7 +25,13 @@ export interface CreateX509CertificateParams {
      * emails it over — so SAML keys want years, not months.
      */
     validityDays?: number;
+    /**
+     * Issue the certificate from a CA instead of self-signing it. The key pair
+     * is still generated here; only the public key is sent to the issuer.
+     */
+    certificateAuthority?: CertificateAuthorityIssuance;
 }
+export declare function signingAlgForKeyType(keyType: SigningKeyType): RsaHashedKeyGenParams | EcdsaParams;
 /** Default certificate lifetime when a caller doesn't ask for one. */
 export declare const DEFAULT_CERT_VALIDITY_DAYS = 365;
 /**
@@ -45,6 +52,8 @@ export interface RenewX509CertificateParams {
     /** Subject/issuer CN for the new certificate. Defaults to the current CN. */
     name?: string;
     validityDays?: number;
+    /** Re-issue from a CA instead of self-signing. The key pair is unchanged. */
+    certificateAuthority?: CertificateAuthorityIssuance;
 }
 export interface RenewX509CertificateResult {
     /** The re-issued certificate, PEM-encoded. */
@@ -54,6 +63,17 @@ export interface RenewX509CertificateResult {
     /** RFC 7638 thumbprint of the public key — unchanged by definition. */
     fingerprint: string;
 }
+/**
+ * Import a PEM private key by trying each supported algorithm in turn.
+ *
+ * A PKCS#8 blob doesn't tell WebCrypto which algorithm to import it as, and
+ * the stored row doesn't record the key type, so we probe. The list is short
+ * and an import either succeeds or throws immediately.
+ */
+export declare function importPrivateKey(pkcs7: string): Promise<{
+    key: CryptoKey;
+    keyType: SigningKeyType;
+}>;
 /**
  * Re-issue a certificate over an existing key pair.
  *

package/dist/types/utils/jwks.d.ts

@@ -1,12 +1,13 @@
 import { DataAdapters } from "@authhero/adapter-interfaces";
 import { SigningKeyModeOption } from "../types/AuthHeroConfig";
+import { CertificateIssuer } from "../helpers/signing-certificate-authority";
 /**
  * JWKS for publication on a tenant's `/.well-known/jwks.json`. Honors the
  * configured `signingKeyMode` and, in `"tenant"` mode, returns the union of
  * the tenant's keys and the control-plane fallback so tokens signed by either
  * still verify during the per-tenant key rollout.
  */
-export declare function getJwksForPublication(data: DataAdapters, tenantId: string, modeOption: SigningKeyModeOption | undefined): Promise<{
+export declare function getJwksForPublication(data: DataAdapters, tenantId: string, modeOption: SigningKeyModeOption | undefined, certificateIssuer?: CertificateIssuer): Promise<{
     kty: "EC" | "RSA" | "oct";
     alg?: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "HS256" | "HS384" | "HS512" | undefined;
     kid?: string | undefined;
@@ -17,6 +18,7 @@ export declare function getJwksForPublication(data: DataAdapters, tenantId: stri
     x?: string | undefined;
     y?: string | undefined;
     x5t?: string | undefined;
+    "x5t#S256"?: string | undefined;
     x5c?: string[] | undefined;
 }[]>;
 /**
@@ -36,5 +38,6 @@ export declare function getJwksForVerification(data: DataAdapters, tenantId: str
     x?: string | undefined;
     y?: string | undefined;
     x5t?: string | undefined;
+    "x5t#S256"?: string | undefined;
     x5c?: string[] | undefined;
 }[]>;

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/markusahlstrand/authhero"
   },
-  "version": "9.15.0",
+  "version": "9.17.0",
   "files": [
     "dist"
   ],
@@ -63,8 +63,8 @@
     "vite": "^8.0.14",
     "vite-plugin-dts": "^4.5.4",
     "vitest": "^4.1.7",
-    "@authhero/kysely-adapter": "12.9.0",
-    "@authhero/widget": "0.39.1"
+    "@authhero/kysely-adapter": "12.10.0",
+    "@authhero/widget": "0.40.0"
   },
   "dependencies": {
     "@peculiar/x509": "^1.14.3",
@@ -80,9 +80,9 @@
     "qrcode": "^1.5.4",
     "sanitize-html": "^2.17.4",
     "xstate": "^5.31.1",
-    "@authhero/adapter-interfaces": "4.15.0",
-    "@authhero/proxy": "0.11.1",
-    "@authhero/saml": "0.5.13"
+    "@authhero/adapter-interfaces": "4.16.0",
+    "@authhero/saml": "0.5.14",
+    "@authhero/proxy": "0.11.2"
   },
   "peerDependencies": {
     "@authhero/widget": "^0.1.0",