npm - authhero - Versions diffs - 9.25.0 → 9.27.0 - Mend

authhero 9.25.0 → 9.27.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (91) hide show

package/dist/types/routes/management-api/tenants.d.ts CHANGED Viewed

@@ -1,5 +1,6 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
 import { Bindings, Variables } from "../../types";
+import { TenantsDataAdapter } from "@authhero/adapter-interfaces";
 export declare const tenantRoutes: OpenAPIHono<{
     Bindings: Bindings;
     Variables: Variables;
@@ -17,6 +18,9 @@ export declare const tenantRoutes: OpenAPIHono<{
                 friendly_name: string;
                 id: string;
                 parent_tenant_id?: string | null | undefined;
+                config_sync?: "inherit-on-read" | "synced" | "detached" | null | undefined;
+                config_sync_hash?: string | null | undefined;
+                config_synced_at?: string | null | undefined;
                 audience?: string | undefined;
                 picture_url?: string | undefined;
                 support_email?: string | undefined;
@@ -124,7 +128,7 @@ export declare const tenantRoutes: OpenAPIHono<{
                 pushed_authorization_requests_supported?: boolean | undefined;
                 authorization_response_iss_parameter_supported?: boolean | undefined;
                 deployment_type?: "shared" | "wfp" | undefined;
-                provisioning_state?: "pending" | "ready" | "failed" | undefined;
+                provisioning_state?: "pending" | "failed" | "ready" | undefined;
                 provisioning_error?: string | undefined;
                 provisioning_state_changed_at?: string | undefined;
                 bundle_configuration?: string | undefined;
@@ -197,6 +201,7 @@ export declare const tenantRoutes: OpenAPIHono<{
                     } | undefined;
                 } | undefined;
                 is_control_plane?: boolean | undefined;
+                has_children?: boolean | undefined;
             };
             outputFormat: "json";
             status: 200;
@@ -212,13 +217,14 @@ export declare const tenantRoutes: OpenAPIHono<{
             } & {
                 json: {
                     id?: string | undefined;
-                    allowed_logout_urls?: string[] | undefined;
-                    oidc_logout?: {
-                        rp_logout_end_session_endpoint_discovery?: boolean | undefined;
-                    } | undefined;
-                    default_organization?: string | undefined;
-                    audience?: string | undefined;
+                    mtls?: {
+                        enable_endpoint_aliases?: boolean | undefined;
+                    } | null | undefined;
                     parent_tenant_id?: string | null | undefined;
+                    config_sync?: "inherit-on-read" | "synced" | "detached" | null | undefined;
+                    config_sync_hash?: string | null | undefined;
+                    config_synced_at?: string | null | undefined;
+                    audience?: string | undefined;
                     friendly_name?: string | undefined;
                     picture_url?: string | undefined;
                     support_email?: string | undefined;
@@ -232,6 +238,7 @@ export declare const tenantRoutes: OpenAPIHono<{
                     session_cookie?: {
                         mode?: "persistent" | "non-persistent" | undefined;
                     } | undefined;
+                    allowed_logout_urls?: string[] | undefined;
                     default_redirection_uri?: string | undefined;
                     default_client_id?: string | undefined;
                     enabled_locales?: string[] | undefined;
@@ -305,19 +312,20 @@ export declare const tenantRoutes: OpenAPIHono<{
                         } | undefined;
                     } | null | undefined;
                     default_audience?: string | undefined;
+                    default_organization?: string | undefined;
                     sessions?: {
                         oidc_logout_prompt_enabled?: boolean | undefined;
                     } | undefined;
+                    oidc_logout?: {
+                        rp_logout_end_session_endpoint_discovery?: boolean | undefined;
+                    } | undefined;
                     allow_organization_name_in_authentication_api?: boolean | undefined;
                     customize_mfa_in_postlogin_action?: boolean | undefined;
                     acr_values_supported?: string[] | undefined;
-                    mtls?: {
-                        enable_endpoint_aliases?: boolean | undefined;
-                    } | null | undefined;
                     pushed_authorization_requests_supported?: boolean | undefined;
                     authorization_response_iss_parameter_supported?: boolean | undefined;
                     deployment_type?: "shared" | "wfp" | undefined;
-                    provisioning_state?: "pending" | "ready" | "failed" | undefined;
+                    provisioning_state?: "pending" | "failed" | "ready" | undefined;
                     provisioning_error?: string | undefined;
                     provisioning_state_changed_at?: string | undefined;
                     bundle_configuration?: string | undefined;
@@ -396,6 +404,9 @@ export declare const tenantRoutes: OpenAPIHono<{
                 friendly_name: string;
                 id: string;
                 parent_tenant_id?: string | null | undefined;
+                config_sync?: "inherit-on-read" | "synced" | "detached" | null | undefined;
+                config_sync_hash?: string | null | undefined;
+                config_synced_at?: string | null | undefined;
                 audience?: string | undefined;
                 picture_url?: string | undefined;
                 support_email?: string | undefined;
@@ -503,7 +514,7 @@ export declare const tenantRoutes: OpenAPIHono<{
                 pushed_authorization_requests_supported?: boolean | undefined;
                 authorization_response_iss_parameter_supported?: boolean | undefined;
                 deployment_type?: "shared" | "wfp" | undefined;
-                provisioning_state?: "pending" | "ready" | "failed" | undefined;
+                provisioning_state?: "pending" | "failed" | "ready" | undefined;
                 provisioning_error?: string | undefined;
                 provisioning_state_changed_at?: string | undefined;
                 bundle_configuration?: string | undefined;
@@ -576,6 +587,7 @@ export declare const tenantRoutes: OpenAPIHono<{
                     } | undefined;
                 } | undefined;
                 is_control_plane?: boolean | undefined;
+                has_children?: boolean | undefined;
             };
             outputFormat: "json";
             status: 200;
@@ -599,6 +611,9 @@ export declare const tenantRoutes: OpenAPIHono<{
                 friendly_name: string;
                 id: string;
                 parent_tenant_id?: string | null | undefined;
+                config_sync?: "inherit-on-read" | "synced" | "detached" | null | undefined;
+                config_sync_hash?: string | null | undefined;
+                config_synced_at?: string | null | undefined;
                 audience?: string | undefined;
                 picture_url?: string | undefined;
                 support_email?: string | undefined;
@@ -706,7 +721,7 @@ export declare const tenantRoutes: OpenAPIHono<{
                 pushed_authorization_requests_supported?: boolean | undefined;
                 authorization_response_iss_parameter_supported?: boolean | undefined;
                 deployment_type?: "shared" | "wfp" | undefined;
-                provisioning_state?: "pending" | "ready" | "failed" | undefined;
+                provisioning_state?: "pending" | "failed" | "ready" | undefined;
                 provisioning_error?: string | undefined;
                 provisioning_state_changed_at?: string | undefined;
                 bundle_configuration?: string | undefined;
@@ -779,12 +794,23 @@ export declare const tenantRoutes: OpenAPIHono<{
                     } | undefined;
                 } | undefined;
                 is_control_plane?: boolean | undefined;
+                has_children?: boolean | undefined;
             };
             outputFormat: "json";
             status: 200;
         };
     };
 }, "/">;
+export declare function hasChildTenants(ctx: {
+    env: {
+        data: {
+            multiTenancyConfig?: {
+                controlPlaneTenantId?: string;
+            };
+            tenants: TenantsDataAdapter;
+        };
+    };
+}, tenantId: string): Promise<boolean>;
 export declare function isControlPlaneTenant(ctx: {
     env: {
         data: {

package/dist/types/routes/management-api/token-exchange-profiles.d.ts CHANGED Viewed

@@ -40,7 +40,7 @@ export declare const tokenExchangeProfilesRoutes: OpenAPIHono<{
                         jwks?: {
                             keys: {
                                 kty: "EC" | "RSA" | "oct";
-                                alg?: "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | undefined;
+                                alg?: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "HS256" | "HS384" | "HS512" | undefined;
                                 kid?: string | undefined;
                                 use?: "sig" | "enc" | undefined;
                                 n?: string | undefined;
@@ -99,7 +99,7 @@ export declare const tokenExchangeProfilesRoutes: OpenAPIHono<{
                     jwks?: {
                         keys: {
                             kty: "EC" | "RSA" | "oct";
-                            alg?: "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | undefined;
+                            alg?: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "HS256" | "HS384" | "HS512" | undefined;
                             kid?: string | undefined;
                             use?: "sig" | "enc" | undefined;
                             n?: string | undefined;
@@ -147,7 +147,7 @@ export declare const tokenExchangeProfilesRoutes: OpenAPIHono<{
                         jwks?: {
                             keys: {
                                 kty: "EC" | "RSA" | "oct";
-                                alg?: "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | undefined;
+                                alg?: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "HS256" | "HS384" | "HS512" | undefined;
                                 kid?: string | undefined;
                                 use?: "sig" | "enc" | undefined;
                                 n?: string | undefined;
@@ -191,7 +191,7 @@ export declare const tokenExchangeProfilesRoutes: OpenAPIHono<{
                     jwks?: {
                         keys: {
                             kty: "EC" | "RSA" | "oct";
-                            alg?: "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | undefined;
+                            alg?: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "HS256" | "HS384" | "HS512" | undefined;
                             kid?: string | undefined;
                             use?: "sig" | "enc" | undefined;
                             n?: string | undefined;
@@ -241,7 +241,7 @@ export declare const tokenExchangeProfilesRoutes: OpenAPIHono<{
                         jwks?: {
                             keys: {
                                 kty: "EC" | "RSA" | "oct";
-                                alg?: "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | undefined;
+                                alg?: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "HS256" | "HS384" | "HS512" | undefined;
                                 kid?: string | undefined;
                                 use?: "sig" | "enc" | undefined;
                                 n?: string | undefined;
@@ -285,7 +285,7 @@ export declare const tokenExchangeProfilesRoutes: OpenAPIHono<{
                     jwks?: {
                         keys: {
                             kty: "EC" | "RSA" | "oct";
-                            alg?: "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | undefined;
+                            alg?: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "HS256" | "HS384" | "HS512" | undefined;
                             kid?: string | undefined;
                             use?: "sig" | "enc" | undefined;
                             n?: string | undefined;

package/dist/types/routes/management-api/users.d.ts CHANGED Viewed

@@ -873,20 +873,17 @@ export declare const userRoutes: OpenAPIHono<{
                     scopes: string;
                 }[];
                 expires_at?: string | undefined;
+                revoked_at?: string | undefined;
+                idle_expires_at?: string | undefined;
                 session_id?: string | undefined;
+                organization?: string | undefined;
                 auth_connection?: string | undefined;
                 auth_strategy?: {
                     strategy: string;
                     strategy_type: string;
                 } | undefined;
-                revoked_at?: string | undefined;
-                organization?: string | undefined;
-                idle_expires_at?: string | undefined;
                 last_exchanged_at?: string | undefined;
             }[] | {
-                start: number;
-                limit: number;
-                length: number;
                 tokens: {
                     user_id: string;
                     id: string;
@@ -907,20 +904,22 @@ export declare const userRoutes: OpenAPIHono<{
                         scopes: string;
                     }[];
                     expires_at?: string | undefined;
+                    revoked_at?: string | undefined;
+                    idle_expires_at?: string | undefined;
                     session_id?: string | undefined;
+                    organization?: string | undefined;
                     auth_connection?: string | undefined;
                     auth_strategy?: {
                         strategy: string;
                         strategy_type: string;
                     } | undefined;
-                    revoked_at?: string | undefined;
-                    organization?: string | undefined;
-                    idle_expires_at?: string | undefined;
                     last_exchanged_at?: string | undefined;
                 }[];
-                total?: number | undefined;
                 next?: string | undefined;
             } | {
+                start: number;
+                limit: number;
+                length: number;
                 tokens: {
                     user_id: string;
                     id: string;
@@ -941,17 +940,18 @@ export declare const userRoutes: OpenAPIHono<{
                         scopes: string;
                     }[];
                     expires_at?: string | undefined;
+                    revoked_at?: string | undefined;
+                    idle_expires_at?: string | undefined;
                     session_id?: string | undefined;
+                    organization?: string | undefined;
                     auth_connection?: string | undefined;
                     auth_strategy?: {
                         strategy: string;
                         strategy_type: string;
                     } | undefined;
-                    revoked_at?: string | undefined;
-                    organization?: string | undefined;
-                    idle_expires_at?: string | undefined;
                     last_exchanged_at?: string | undefined;
                 }[];
+                total?: number | undefined;
                 next?: string | undefined;
             };
             outputFormat: "json";
@@ -1000,7 +1000,7 @@ export declare const userRoutes: OpenAPIHono<{
                 };
             };
             output: {
-                type: "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "cs" | "depnote" | "cfgdiff" | "f" | "fc" | "fce" | "fco" | "fcoa" | "fcp" | "fcph" | "fcpn" | "fcpr" | "fcpro" | "fcu" | "fd" | "fdeac" | "fdeaz" | "fdecc" | "fdu" | "feacft" | "feccft" | "fecte" | "fede" | "federated_logout_failed" | "fens" | "feoobft" | "feotpft" | "fepft" | "fepotpft" | "fercft" | "ferrt" | "fertft" | "festft" | "fh" | "fimp" | "fi" | "flo" | "flows_execution_completed" | "flows_execution_failed" | "fn" | "forms_submission_failed" | "forms_submission_succeeded" | "fp" | "fpar" | "fpurh" | "fs" | "fsa" | "fu" | "fui" | "fv" | "fvr" | "gd_auth_email_verification" | "gd_auth_fail_email_verification" | "gd_auth_failed" | "gd_auth_rejected" | "gd_auth_succeed" | "gd_enrollment_complete" | "gd_otp_rate_limit_exceed" | "gd_recovery_failed" | "gd_recovery_rate_limit_exceed" | "gd_recovery_succeed" | "gd_send_email" | "gd_send_email_verification" | "gd_send_email_verification_failure" | "gd_send_pn" | "gd_send_pn_failure" | "gd_send_sms" | "gd_send_sms_failure" | "gd_send_voice" | "gd_send_voice_failure" | "gd_start_auth" | "gd_start_enroll" | "gd_start_enroll_failed" | "gd_tenant_update" | "gd_unenroll" | "gd_update_device_account" | "gd_webauthn_challenge_failed" | "gd_webauthn_enrollment_failed" | "kms_key_management_failure" | "kms_key_management_success" | "kms_key_state_changed" | "limit_delegation" | "limit_mu" | "limit_sul" | "limit_wc" | "i" | "mfar" | "mgmt_api_read" | "my_account_authentication_method_failed" | "my_account_authentication_method_succeeded" | "oidc_backchannel_logout_failed" | "oidc_backchannel_logout_succeeded" | "organization_member_added" | "passkey_challenge_failed" | "passkey_challenge_started" | "pla" | "pwd_leak" | "reset_pwd_leak" | "resource_cleanup" | "rich_consents_access_error" | "s" | "sapi" | "fapi" | "sce" | "scoa" | "scp" | "scpn" | "scpr" | "scu" | "scv" | "sd" | "sdu" | "seacft" | "seccft" | "secte" | "sede" | "sens" | "seoobft" | "seotpft" | "sepotpft" | "sepft" | "sepkoobft" | "sepkotpft" | "sepkrcft" | "sercft" | "sertft" | "sestft" | "simp" | "si" | "signup_pwd_leak" | "slo" | "sh" | "spm" | "srrt" | "ss" | "ss_sso_failure" | "ss_sso_info" | "ss_sso_success" | "ssa" | "sscim" | "sui" | "sv" | "svr" | "too_many_records" | "ublkdu" | "universal_logout_failed" | "universal_logout_succeeded" | "w" | "wn" | "wum";
+                type: "fn" | "i" | "cs" | "fi" | "sv" | "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "depnote" | "cfgdiff" | "cfgdrift" | "f" | "fc" | "fce" | "fco" | "fcoa" | "fcp" | "fcph" | "fcpn" | "fcpr" | "fcpro" | "fcu" | "fd" | "fdeac" | "fdeaz" | "fdecc" | "fdu" | "feacft" | "feccft" | "fecte" | "fede" | "federated_logout_failed" | "fens" | "feoobft" | "feotpft" | "fepft" | "fepotpft" | "fercft" | "ferrt" | "fertft" | "festft" | "fh" | "fimp" | "flo" | "flows_execution_completed" | "flows_execution_failed" | "forms_submission_failed" | "forms_submission_succeeded" | "fp" | "fpar" | "fpurh" | "fs" | "fsa" | "fu" | "fui" | "fv" | "fvr" | "gd_auth_email_verification" | "gd_auth_fail_email_verification" | "gd_auth_failed" | "gd_auth_rejected" | "gd_auth_succeed" | "gd_enrollment_complete" | "gd_otp_rate_limit_exceed" | "gd_recovery_failed" | "gd_recovery_rate_limit_exceed" | "gd_recovery_succeed" | "gd_send_email" | "gd_send_email_verification" | "gd_send_email_verification_failure" | "gd_send_pn" | "gd_send_pn_failure" | "gd_send_sms" | "gd_send_sms_failure" | "gd_send_voice" | "gd_send_voice_failure" | "gd_start_auth" | "gd_start_enroll" | "gd_start_enroll_failed" | "gd_tenant_update" | "gd_unenroll" | "gd_update_device_account" | "gd_webauthn_challenge_failed" | "gd_webauthn_enrollment_failed" | "kms_key_management_failure" | "kms_key_management_success" | "kms_key_state_changed" | "limit_delegation" | "limit_mu" | "limit_sul" | "limit_wc" | "mfar" | "mgmt_api_read" | "my_account_authentication_method_failed" | "my_account_authentication_method_succeeded" | "oidc_backchannel_logout_failed" | "oidc_backchannel_logout_succeeded" | "organization_member_added" | "passkey_challenge_failed" | "passkey_challenge_started" | "pla" | "pwd_leak" | "reset_pwd_leak" | "resource_cleanup" | "rich_consents_access_error" | "s" | "sapi" | "fapi" | "sce" | "scoa" | "scp" | "scpn" | "scpr" | "scu" | "scv" | "sd" | "sdu" | "seacft" | "seccft" | "secte" | "sede" | "sens" | "seoobft" | "seotpft" | "sepotpft" | "sepft" | "sepkoobft" | "sepkotpft" | "sepkrcft" | "sercft" | "sertft" | "sestft" | "simp" | "si" | "signup_pwd_leak" | "slo" | "sh" | "spm" | "srrt" | "ss" | "ss_sso_failure" | "ss_sso_info" | "ss_sso_success" | "ssa" | "sscim" | "sui" | "svr" | "too_many_records" | "ublkdu" | "universal_logout_failed" | "universal_logout_succeeded" | "w" | "wn" | "wum";
                 date: string;
                 isMobile: boolean;
                 log_id: string;
@@ -1035,8 +1035,11 @@ export declare const userRoutes: OpenAPIHono<{
                     continent_code: string;
                 } | undefined;
             }[] | {
+                start: number;
+                limit: number;
+                length: number;
                 logs: {
-                    type: "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "cs" | "depnote" | "cfgdiff" | "f" | "fc" | "fce" | "fco" | "fcoa" | "fcp" | "fcph" | "fcpn" | "fcpr" | "fcpro" | "fcu" | "fd" | "fdeac" | "fdeaz" | "fdecc" | "fdu" | "feacft" | "feccft" | "fecte" | "fede" | "federated_logout_failed" | "fens" | "feoobft" | "feotpft" | "fepft" | "fepotpft" | "fercft" | "ferrt" | "fertft" | "festft" | "fh" | "fimp" | "fi" | "flo" | "flows_execution_completed" | "flows_execution_failed" | "fn" | "forms_submission_failed" | "forms_submission_succeeded" | "fp" | "fpar" | "fpurh" | "fs" | "fsa" | "fu" | "fui" | "fv" | "fvr" | "gd_auth_email_verification" | "gd_auth_fail_email_verification" | "gd_auth_failed" | "gd_auth_rejected" | "gd_auth_succeed" | "gd_enrollment_complete" | "gd_otp_rate_limit_exceed" | "gd_recovery_failed" | "gd_recovery_rate_limit_exceed" | "gd_recovery_succeed" | "gd_send_email" | "gd_send_email_verification" | "gd_send_email_verification_failure" | "gd_send_pn" | "gd_send_pn_failure" | "gd_send_sms" | "gd_send_sms_failure" | "gd_send_voice" | "gd_send_voice_failure" | "gd_start_auth" | "gd_start_enroll" | "gd_start_enroll_failed" | "gd_tenant_update" | "gd_unenroll" | "gd_update_device_account" | "gd_webauthn_challenge_failed" | "gd_webauthn_enrollment_failed" | "kms_key_management_failure" | "kms_key_management_success" | "kms_key_state_changed" | "limit_delegation" | "limit_mu" | "limit_sul" | "limit_wc" | "i" | "mfar" | "mgmt_api_read" | "my_account_authentication_method_failed" | "my_account_authentication_method_succeeded" | "oidc_backchannel_logout_failed" | "oidc_backchannel_logout_succeeded" | "organization_member_added" | "passkey_challenge_failed" | "passkey_challenge_started" | "pla" | "pwd_leak" | "reset_pwd_leak" | "resource_cleanup" | "rich_consents_access_error" | "s" | "sapi" | "fapi" | "sce" | "scoa" | "scp" | "scpn" | "scpr" | "scu" | "scv" | "sd" | "sdu" | "seacft" | "seccft" | "secte" | "sede" | "sens" | "seoobft" | "seotpft" | "sepotpft" | "sepft" | "sepkoobft" | "sepkotpft" | "sepkrcft" | "sercft" | "sertft" | "sestft" | "simp" | "si" | "signup_pwd_leak" | "slo" | "sh" | "spm" | "srrt" | "ss" | "ss_sso_failure" | "ss_sso_info" | "ss_sso_success" | "ssa" | "sscim" | "sui" | "sv" | "svr" | "too_many_records" | "ublkdu" | "universal_logout_failed" | "universal_logout_succeeded" | "w" | "wn" | "wum";
+                    type: "fn" | "i" | "cs" | "fi" | "sv" | "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "depnote" | "cfgdiff" | "cfgdrift" | "f" | "fc" | "fce" | "fco" | "fcoa" | "fcp" | "fcph" | "fcpn" | "fcpr" | "fcpro" | "fcu" | "fd" | "fdeac" | "fdeaz" | "fdecc" | "fdu" | "feacft" | "feccft" | "fecte" | "fede" | "federated_logout_failed" | "fens" | "feoobft" | "feotpft" | "fepft" | "fepotpft" | "fercft" | "ferrt" | "fertft" | "festft" | "fh" | "fimp" | "flo" | "flows_execution_completed" | "flows_execution_failed" | "forms_submission_failed" | "forms_submission_succeeded" | "fp" | "fpar" | "fpurh" | "fs" | "fsa" | "fu" | "fui" | "fv" | "fvr" | "gd_auth_email_verification" | "gd_auth_fail_email_verification" | "gd_auth_failed" | "gd_auth_rejected" | "gd_auth_succeed" | "gd_enrollment_complete" | "gd_otp_rate_limit_exceed" | "gd_recovery_failed" | "gd_recovery_rate_limit_exceed" | "gd_recovery_succeed" | "gd_send_email" | "gd_send_email_verification" | "gd_send_email_verification_failure" | "gd_send_pn" | "gd_send_pn_failure" | "gd_send_sms" | "gd_send_sms_failure" | "gd_send_voice" | "gd_send_voice_failure" | "gd_start_auth" | "gd_start_enroll" | "gd_start_enroll_failed" | "gd_tenant_update" | "gd_unenroll" | "gd_update_device_account" | "gd_webauthn_challenge_failed" | "gd_webauthn_enrollment_failed" | "kms_key_management_failure" | "kms_key_management_success" | "kms_key_state_changed" | "limit_delegation" | "limit_mu" | "limit_sul" | "limit_wc" | "mfar" | "mgmt_api_read" | "my_account_authentication_method_failed" | "my_account_authentication_method_succeeded" | "oidc_backchannel_logout_failed" | "oidc_backchannel_logout_succeeded" | "organization_member_added" | "passkey_challenge_failed" | "passkey_challenge_started" | "pla" | "pwd_leak" | "reset_pwd_leak" | "resource_cleanup" | "rich_consents_access_error" | "s" | "sapi" | "fapi" | "sce" | "scoa" | "scp" | "scpn" | "scpr" | "scu" | "scv" | "sd" | "sdu" | "seacft" | "seccft" | "secte" | "sede" | "sens" | "seoobft" | "seotpft" | "sepotpft" | "sepft" | "sepkoobft" | "sepkotpft" | "sepkrcft" | "sercft" | "sertft" | "sestft" | "simp" | "si" | "signup_pwd_leak" | "slo" | "sh" | "spm" | "srrt" | "ss" | "ss_sso_failure" | "ss_sso_info" | "ss_sso_success" | "ssa" | "sscim" | "sui" | "svr" | "too_many_records" | "ublkdu" | "universal_logout_failed" | "universal_logout_succeeded" | "w" | "wn" | "wum";
                     date: string;
                     isMobile: boolean;
                     log_id: string;
@@ -1071,13 +1074,11 @@ export declare const userRoutes: OpenAPIHono<{
                         continent_code: string;
                     } | undefined;
                 }[];
+                total?: number | undefined;
                 next?: string | undefined;
             } | {
-                start: number;
-                limit: number;
-                length: number;
                 logs: {
-                    type: "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "cs" | "depnote" | "cfgdiff" | "f" | "fc" | "fce" | "fco" | "fcoa" | "fcp" | "fcph" | "fcpn" | "fcpr" | "fcpro" | "fcu" | "fd" | "fdeac" | "fdeaz" | "fdecc" | "fdu" | "feacft" | "feccft" | "fecte" | "fede" | "federated_logout_failed" | "fens" | "feoobft" | "feotpft" | "fepft" | "fepotpft" | "fercft" | "ferrt" | "fertft" | "festft" | "fh" | "fimp" | "fi" | "flo" | "flows_execution_completed" | "flows_execution_failed" | "fn" | "forms_submission_failed" | "forms_submission_succeeded" | "fp" | "fpar" | "fpurh" | "fs" | "fsa" | "fu" | "fui" | "fv" | "fvr" | "gd_auth_email_verification" | "gd_auth_fail_email_verification" | "gd_auth_failed" | "gd_auth_rejected" | "gd_auth_succeed" | "gd_enrollment_complete" | "gd_otp_rate_limit_exceed" | "gd_recovery_failed" | "gd_recovery_rate_limit_exceed" | "gd_recovery_succeed" | "gd_send_email" | "gd_send_email_verification" | "gd_send_email_verification_failure" | "gd_send_pn" | "gd_send_pn_failure" | "gd_send_sms" | "gd_send_sms_failure" | "gd_send_voice" | "gd_send_voice_failure" | "gd_start_auth" | "gd_start_enroll" | "gd_start_enroll_failed" | "gd_tenant_update" | "gd_unenroll" | "gd_update_device_account" | "gd_webauthn_challenge_failed" | "gd_webauthn_enrollment_failed" | "kms_key_management_failure" | "kms_key_management_success" | "kms_key_state_changed" | "limit_delegation" | "limit_mu" | "limit_sul" | "limit_wc" | "i" | "mfar" | "mgmt_api_read" | "my_account_authentication_method_failed" | "my_account_authentication_method_succeeded" | "oidc_backchannel_logout_failed" | "oidc_backchannel_logout_succeeded" | "organization_member_added" | "passkey_challenge_failed" | "passkey_challenge_started" | "pla" | "pwd_leak" | "reset_pwd_leak" | "resource_cleanup" | "rich_consents_access_error" | "s" | "sapi" | "fapi" | "sce" | "scoa" | "scp" | "scpn" | "scpr" | "scu" | "scv" | "sd" | "sdu" | "seacft" | "seccft" | "secte" | "sede" | "sens" | "seoobft" | "seotpft" | "sepotpft" | "sepft" | "sepkoobft" | "sepkotpft" | "sepkrcft" | "sercft" | "sertft" | "sestft" | "simp" | "si" | "signup_pwd_leak" | "slo" | "sh" | "spm" | "srrt" | "ss" | "ss_sso_failure" | "ss_sso_info" | "ss_sso_success" | "ssa" | "sscim" | "sui" | "sv" | "svr" | "too_many_records" | "ublkdu" | "universal_logout_failed" | "universal_logout_succeeded" | "w" | "wn" | "wum";
+                    type: "fn" | "i" | "cs" | "fi" | "sv" | "acls_summary" | "actions_execution_failed" | "api_limit" | "api_limit_warning" | "appi" | "ciba_exchange_failed" | "ciba_exchange_succeeded" | "ciba_start_failed" | "ciba_start_succeeded" | "cls" | "depnote" | "cfgdiff" | "cfgdrift" | "f" | "fc" | "fce" | "fco" | "fcoa" | "fcp" | "fcph" | "fcpn" | "fcpr" | "fcpro" | "fcu" | "fd" | "fdeac" | "fdeaz" | "fdecc" | "fdu" | "feacft" | "feccft" | "fecte" | "fede" | "federated_logout_failed" | "fens" | "feoobft" | "feotpft" | "fepft" | "fepotpft" | "fercft" | "ferrt" | "fertft" | "festft" | "fh" | "fimp" | "flo" | "flows_execution_completed" | "flows_execution_failed" | "forms_submission_failed" | "forms_submission_succeeded" | "fp" | "fpar" | "fpurh" | "fs" | "fsa" | "fu" | "fui" | "fv" | "fvr" | "gd_auth_email_verification" | "gd_auth_fail_email_verification" | "gd_auth_failed" | "gd_auth_rejected" | "gd_auth_succeed" | "gd_enrollment_complete" | "gd_otp_rate_limit_exceed" | "gd_recovery_failed" | "gd_recovery_rate_limit_exceed" | "gd_recovery_succeed" | "gd_send_email" | "gd_send_email_verification" | "gd_send_email_verification_failure" | "gd_send_pn" | "gd_send_pn_failure" | "gd_send_sms" | "gd_send_sms_failure" | "gd_send_voice" | "gd_send_voice_failure" | "gd_start_auth" | "gd_start_enroll" | "gd_start_enroll_failed" | "gd_tenant_update" | "gd_unenroll" | "gd_update_device_account" | "gd_webauthn_challenge_failed" | "gd_webauthn_enrollment_failed" | "kms_key_management_failure" | "kms_key_management_success" | "kms_key_state_changed" | "limit_delegation" | "limit_mu" | "limit_sul" | "limit_wc" | "mfar" | "mgmt_api_read" | "my_account_authentication_method_failed" | "my_account_authentication_method_succeeded" | "oidc_backchannel_logout_failed" | "oidc_backchannel_logout_succeeded" | "organization_member_added" | "passkey_challenge_failed" | "passkey_challenge_started" | "pla" | "pwd_leak" | "reset_pwd_leak" | "resource_cleanup" | "rich_consents_access_error" | "s" | "sapi" | "fapi" | "sce" | "scoa" | "scp" | "scpn" | "scpr" | "scu" | "scv" | "sd" | "sdu" | "seacft" | "seccft" | "secte" | "sede" | "sens" | "seoobft" | "seotpft" | "sepotpft" | "sepft" | "sepkoobft" | "sepkotpft" | "sepkrcft" | "sercft" | "sertft" | "sestft" | "simp" | "si" | "signup_pwd_leak" | "slo" | "sh" | "spm" | "srrt" | "ss" | "ss_sso_failure" | "ss_sso_info" | "ss_sso_success" | "ssa" | "sscim" | "sui" | "svr" | "too_many_records" | "ublkdu" | "universal_logout_failed" | "universal_logout_succeeded" | "w" | "wn" | "wum";
                     date: string;
                     isMobile: boolean;
                     log_id: string;
@@ -1112,7 +1113,6 @@ export declare const userRoutes: OpenAPIHono<{
                         continent_code: string;
                     } | undefined;
                 }[];
-                total?: number | undefined;
                 next?: string | undefined;
             };
             outputFormat: "json";

package/dist/types/routes/proxy-control-plane/tenant-members.d.ts CHANGED Viewed

@@ -19,6 +19,17 @@ export interface TenantMembersControlPlaneOptions {
      * control-plane tenant.
      */
     getBackend: (c: CpCtx) => TenantMembersBackend | Promise<TenantMembersBackend>;
+    /**
+     * Team-change requests (issue #1550). A shard registers a request in its own
+     * database and calls `POST /requests/notify` with its id; `onNotify` takes
+     * it from there, typically by enqueueing a tenant operation that reads the
+     * request from the shard and carries it out. `tenantId` is the verified
+     * token's, never the body's. Unset, the endpoint answers 501 and the shard
+     * keeps the request until a control plane that has it is in place.
+     */
+    requests?: {
+        onNotify: (c: CpCtx, tenantId: string, requestId: string) => Promise<void>;
+    };
     /**
      * Defaults to verifying a `controlplane:tenant_members` bearer token issued
      * by `env.ISSUER` or the inbound host. Ignored under

package/dist/types/routes/scim/index.d.ts CHANGED Viewed

@@ -1,5 +1,6 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
 import { AuthHeroConfig, Bindings, Variables } from "../../types";
+/** Mount connection-scoped SCIM provisioning with user lifecycle hooks and outbox delivery. */
 export declare function createScimApi(config: AuthHeroConfig): OpenAPIHono<{
     Bindings: Bindings;
     Variables: Variables;

package/dist/types/routes/universal-login/common.d.ts CHANGED Viewed

@@ -100,7 +100,7 @@ export declare function initJSXRoute(ctx: Context<{
             url: string;
         } | undefined;
         dark_mode?: "dark" | "light" | "auto" | undefined;
-        scope?: "shared" | "local" | "platform" | undefined;
+        scope?: "local" | "shared" | "platform" | undefined;
         override?: "none" | "secrets" | "fields" | undefined;
         enforce?: boolean | undefined;
     } | null;
@@ -125,6 +125,9 @@ export declare function initJSXRoute(ctx: Context<{
             friendly_name: string;
             id: string;
             parent_tenant_id?: string | null | undefined;
+            config_sync?: "inherit-on-read" | "synced" | "detached" | null | undefined;
+            config_sync_hash?: string | null | undefined;
+            config_synced_at?: string | null | undefined;
             audience?: string | undefined;
             picture_url?: string | undefined;
             support_email?: string | undefined;
@@ -228,7 +231,7 @@ export declare function initJSXRoute(ctx: Context<{
             pushed_authorization_requests_supported?: boolean | undefined;
             authorization_response_iss_parameter_supported?: boolean | undefined;
             deployment_type?: "shared" | "wfp" | undefined;
-            provisioning_state?: "pending" | "ready" | "failed" | undefined;
+            provisioning_state?: "pending" | "failed" | "ready" | undefined;
             provisioning_error?: string | undefined;
             provisioning_state_changed_at?: string | undefined;
             bundle_configuration?: string | undefined;
@@ -301,6 +304,7 @@ export declare function initJSXRoute(ctx: Context<{
                 } | undefined;
             } | undefined;
             is_control_plane?: boolean | undefined;
+            has_children?: boolean | undefined;
         };
         connections: {
             created_at: string;
@@ -375,7 +379,7 @@ export declare function initJSXRoute(ctx: Context<{
                         } | undefined;
                         unique?: boolean | undefined;
                         profile_required?: boolean | undefined;
-                        verification_method?: "link" | "code" | undefined;
+                        verification_method?: "code" | "link" | undefined;
                     } | undefined;
                     username?: {
                         identifier?: {
@@ -425,7 +429,7 @@ export declare function initJSXRoute(ctx: Context<{
                 } | undefined;
                 set_user_root_attributes?: "on_each_login" | "on_first_login" | "never_on_login" | undefined;
             };
-            scope?: "shared" | "local" | "platform" | undefined;
+            scope?: "local" | "shared" | "platform" | undefined;
             override?: "none" | "secrets" | "fields" | undefined;
             enforce?: boolean | undefined;
             id?: string | undefined;
@@ -504,6 +508,9 @@ export declare function initJSXRoute(ctx: Context<{
         friendly_name: string;
         id: string;
         parent_tenant_id?: string | null | undefined;
+        config_sync?: "inherit-on-read" | "synced" | "detached" | null | undefined;
+        config_sync_hash?: string | null | undefined;
+        config_synced_at?: string | null | undefined;
         audience?: string | undefined;
         picture_url?: string | undefined;
         support_email?: string | undefined;
@@ -607,7 +614,7 @@ export declare function initJSXRoute(ctx: Context<{
         pushed_authorization_requests_supported?: boolean | undefined;
         authorization_response_iss_parameter_supported?: boolean | undefined;
         deployment_type?: "shared" | "wfp" | undefined;
-        provisioning_state?: "pending" | "ready" | "failed" | undefined;
+        provisioning_state?: "pending" | "failed" | "ready" | undefined;
         provisioning_error?: string | undefined;
         provisioning_state_changed_at?: string | undefined;
         bundle_configuration?: string | undefined;
@@ -680,6 +687,7 @@ export declare function initJSXRoute(ctx: Context<{
             } | undefined;
         } | undefined;
         is_control_plane?: boolean | undefined;
+        has_children?: boolean | undefined;
     };
     loginSession: {
         csrf_token: string;
@@ -844,7 +852,7 @@ export declare function initJSXRouteWithSession(ctx: Context<{
             url: string;
         } | undefined;
         dark_mode?: "dark" | "light" | "auto" | undefined;
-        scope?: "shared" | "local" | "platform" | undefined;
+        scope?: "local" | "shared" | "platform" | undefined;
         override?: "none" | "secrets" | "fields" | undefined;
         enforce?: boolean | undefined;
     } | null;
@@ -869,6 +877,9 @@ export declare function initJSXRouteWithSession(ctx: Context<{
             friendly_name: string;
             id: string;
             parent_tenant_id?: string | null | undefined;
+            config_sync?: "inherit-on-read" | "synced" | "detached" | null | undefined;
+            config_sync_hash?: string | null | undefined;
+            config_synced_at?: string | null | undefined;
             audience?: string | undefined;
             picture_url?: string | undefined;
             support_email?: string | undefined;
@@ -972,7 +983,7 @@ export declare function initJSXRouteWithSession(ctx: Context<{
             pushed_authorization_requests_supported?: boolean | undefined;
             authorization_response_iss_parameter_supported?: boolean | undefined;
             deployment_type?: "shared" | "wfp" | undefined;
-            provisioning_state?: "pending" | "ready" | "failed" | undefined;
+            provisioning_state?: "pending" | "failed" | "ready" | undefined;
             provisioning_error?: string | undefined;
             provisioning_state_changed_at?: string | undefined;
             bundle_configuration?: string | undefined;
@@ -1045,6 +1056,7 @@ export declare function initJSXRouteWithSession(ctx: Context<{
                 } | undefined;
             } | undefined;
             is_control_plane?: boolean | undefined;
+            has_children?: boolean | undefined;
         };
         connections: {
             created_at: string;
@@ -1119,7 +1131,7 @@ export declare function initJSXRouteWithSession(ctx: Context<{
                         } | undefined;
                         unique?: boolean | undefined;
                         profile_required?: boolean | undefined;
-                        verification_method?: "link" | "code" | undefined;
+                        verification_method?: "code" | "link" | undefined;
                     } | undefined;
                     username?: {
                         identifier?: {
@@ -1169,7 +1181,7 @@ export declare function initJSXRouteWithSession(ctx: Context<{
                 } | undefined;
                 set_user_root_attributes?: "on_each_login" | "on_first_login" | "never_on_login" | undefined;
             };
-            scope?: "shared" | "local" | "platform" | undefined;
+            scope?: "local" | "shared" | "platform" | undefined;
             override?: "none" | "secrets" | "fields" | undefined;
             enforce?: boolean | undefined;
             id?: string | undefined;
@@ -1317,6 +1329,9 @@ export declare function initJSXRouteWithSession(ctx: Context<{
         friendly_name: string;
         id: string;
         parent_tenant_id?: string | null | undefined;
+        config_sync?: "inherit-on-read" | "synced" | "detached" | null | undefined;
+        config_sync_hash?: string | null | undefined;
+        config_synced_at?: string | null | undefined;
         audience?: string | undefined;
         picture_url?: string | undefined;
         support_email?: string | undefined;
@@ -1420,7 +1435,7 @@ export declare function initJSXRouteWithSession(ctx: Context<{
         pushed_authorization_requests_supported?: boolean | undefined;
         authorization_response_iss_parameter_supported?: boolean | undefined;
         deployment_type?: "shared" | "wfp" | undefined;
-        provisioning_state?: "pending" | "ready" | "failed" | undefined;
+        provisioning_state?: "pending" | "failed" | "ready" | undefined;
         provisioning_error?: string | undefined;
         provisioning_state_changed_at?: string | undefined;
         bundle_configuration?: string | undefined;
@@ -1493,6 +1508,7 @@ export declare function initJSXRouteWithSession(ctx: Context<{
             } | undefined;
         } | undefined;
         is_control_plane?: boolean | undefined;
+        has_children?: boolean | undefined;
     };
     loginSession: {
         csrf_token: string;

package/dist/types/routes/universal-login/flow-api.d.ts CHANGED Viewed

@@ -27,7 +27,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
             output: {
                 screen: {
                     action: string;
-                    method: "POST" | "GET";
+                    method: "GET" | "POST";
                     components: {
                         id: string;
                         type: string;
@@ -107,7 +107,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
             output: {
                 screen: {
                     action: string;
-                    method: "POST" | "GET";
+                    method: "GET" | "POST";
                     components: {
                         id: string;
                         type: string;
@@ -204,7 +204,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
             output: {
                 screen: {
                     action: string;
-                    method: "POST" | "GET";
+                    method: "GET" | "POST";
                     components: {
                         id: string;
                         type: string;
@@ -319,7 +319,7 @@ export declare const flowApiRoutes: OpenAPIHono<{
             output: {
                 screen: {
                     action: string;
-                    method: "POST" | "GET";
+                    method: "GET" | "POST";
                     components: {
                         id: string;
                         type: string;

package/dist/types/routes/universal-login/identifier.d.ts CHANGED Viewed

@@ -30,7 +30,7 @@ export declare const identifierRoutes: OpenAPIHono<{
             } & {
                 form: {
                     username: string;
-                    login_selection?: "password" | "code" | undefined;
+                    login_selection?: "code" | "password" | undefined;
                 };
             };
             output: {};
@@ -44,7 +44,7 @@ export declare const identifierRoutes: OpenAPIHono<{
             } & {
                 form: {
                     username: string;
-                    login_selection?: "password" | "code" | undefined;
+                    login_selection?: "code" | "password" | undefined;
                 };
             };
             output: {};

package/dist/types/routes/universal-login/index.d.ts CHANGED Viewed

@@ -515,7 +515,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
             } & {
                 form: {
                     username: string;
-                    login_selection?: "password" | "code" | undefined;
+                    login_selection?: "code" | "password" | undefined;
                 };
             };
             output: {};
@@ -529,7 +529,7 @@ export default function create(config: AuthHeroConfig): OpenAPIHono<{
             } & {
                 form: {
                     username: string;
-                    login_selection?: "password" | "code" | undefined;
+                    login_selection?: "code" | "password" | undefined;
                 };
             };
             output: {};

package/dist/types/routes/universal-login/screens/device-flow.d.ts ADDED Viewed

@@ -0,0 +1,4 @@
+import { type ScreenDefinition } from "./types";
+export declare const deviceCodeScreenDefinition: ScreenDefinition;
+export declare const deviceConfirmationScreenDefinition: ScreenDefinition;
+export declare const deviceCompleteScreenDefinition: ScreenDefinition;