@authhero/adapter-interfaces 1.10.2 → 1.11.0

package/dist/adapter-interfaces.mjs

@@ -1,27 +1,27 @@
 import { z as e } from "@hono/zod-openapi";
-const s = e.object({
+const r = e.object({
   created_at: e.string(),
   updated_at: e.string()
-}), V = e.object({
+}), Q = e.object({
   id: e.string(),
   version: e.string().optional()
-}), Y = e.object({
+}), Z = e.object({
   name: e.string(),
   version: e.string()
-}), Q = e.object({
+}), $ = e.object({
   name: e.string(),
   value: e.string()
-}), N = e.object({
+}), w = e.object({
   name: e.string().max(255),
   code: e.string().max(1e5),
-  supported_triggers: e.array(V).optional(),
+  supported_triggers: e.array(Q).optional(),
   runtime: e.string().max(50).optional(),
-  dependencies: e.array(Y).optional(),
-  secrets: e.array(Q).optional()
-}), Lo = N.partial().extend({
+  dependencies: e.array(Z).optional(),
+  secrets: e.array($).optional()
+}), Wo = w.partial().extend({
   status: e.enum(["draft", "built"]).optional(),
   deployed_at: e.string().optional()
-}), vo = N.extend({
+}), zo = w.extend({
   id: e.string(),
   tenant_id: e.string(),
   status: e.enum(["draft", "built"]).default("built"),
@@ -33,13 +33,13 @@ const s = e.object({
       value: e.string().optional()
     })
   ).optional(),
-  ...s.shape
-}), Z = e.enum([
+  ...r.shape
+}), J = e.enum([
   "user_action",
   "admin_action",
   "system",
   "api"
-]), $ = e.object({
+]), ee = e.object({
   type: e.enum(["user", "admin", "system", "api_key", "client_credentials"]),
   id: e.string().optional(),
   email: e.string().optional(),
@@ -47,13 +47,13 @@ const s = e.object({
   org_name: e.string().optional(),
   scopes: e.array(e.string()).optional(),
   client_id: e.string().optional()
-}), J = e.object({
+}), te = e.object({
   type: e.string(),
   id: e.string(),
   before: e.record(e.unknown()).optional(),
   after: e.record(e.unknown()).optional(),
   diff: e.record(e.object({ old: e.unknown(), new: e.unknown() })).optional()
-}), ee = e.object({
+}), oe = e.object({
   method: e.string(),
   path: e.string(),
   query: e.record(e.string()).optional(),
@@ -61,56 +61,56 @@ const s = e.object({
   ip: e.string(),
   user_agent: e.string().optional(),
   correlation_id: e.string().optional()
-}), te = e.object({
+}), ne = e.object({
   status_code: e.number(),
   body: e.unknown().optional()
-}), oe = e.object({
+}), ie = e.object({
   country_code: e.string(),
   city_name: e.string(),
   latitude: e.string(),
   longitude: e.string(),
   time_zone: e.string(),
   continent_code: e.string()
-}), ne = e.object({
+}), ae = e.object({
   name: e.string(),
   version: e.string(),
   env: e.record(e.string()).optional()
-}), ie = e.object({
+}), re = e.object({
   tenant_id: e.string(),
   event_type: e.string(),
   log_type: e.string(),
   description: e.string().optional(),
-  category: Z,
-  actor: $,
-  target: J,
-  request: ee,
-  response: te.optional(),
+  category: J,
+  actor: ee,
+  target: te,
+  request: oe,
+  response: ne.optional(),
   connection: e.string().optional(),
   strategy: e.string().optional(),
   strategy_type: e.string().optional(),
   audience: e.string().optional(),
   scope: e.string().optional(),
-  location: oe.optional(),
-  auth0_client: ne.optional(),
+  location: ie.optional(),
+  auth0_client: ae.optional(),
   hostname: e.string(),
   is_mobile: e.boolean().optional(),
   timestamp: e.string()
-}), ko = ie.extend({
+}), Ko = re.extend({
   id: e.string()
-}), Uo = e.enum(["AUTH0", "EMAIL", "REDIRECT"]), Fo = e.enum([
+}), qo = e.enum(["AUTH0", "EMAIL", "REDIRECT"]), Xo = e.enum([
   "CREATE_USER",
   "GET_USER",
   "UPDATE_USER",
   "SEND_REQUEST",
   "SEND_EMAIL"
-]), xo = e.enum(["VERIFY_EMAIL"]), ae = e.object({
+]), Vo = e.enum(["VERIFY_EMAIL"]), se = e.object({
   require_mx_record: e.boolean().optional(),
   block_aliases: e.boolean().optional(),
   block_free_emails: e.boolean().optional(),
   block_disposable_emails: e.boolean().optional(),
   blocklist: e.array(e.string()).optional(),
   allowlist: e.array(e.string()).optional()
-}), se = e.object({
+}), le = e.object({
   id: e.string(),
   alias: e.string().max(100).optional(),
   type: e.literal("AUTH0"),
@@ -122,7 +122,7 @@ const s = e.object({
     user_id: e.string(),
     changes: e.record(e.string(), e.any())
   })
-}), re = e.object({
+}), pe = e.object({
   id: e.string(),
   alias: e.string().max(100).optional(),
   type: e.literal("EMAIL"),
@@ -131,9 +131,9 @@ const s = e.object({
   mask_output: e.boolean().optional(),
   params: e.object({
     email: e.string(),
-    rules: ae.optional()
+    rules: se.optional()
   })
-}), le = e.enum(["change-email", "account", "custom"]), ce = e.object({
+}), ce = e.enum(["change-email", "account", "custom"]), de = e.object({
   id: e.string(),
   alias: e.string().max(100).optional(),
   type: e.literal("REDIRECT"),
@@ -141,32 +141,32 @@ const s = e.object({
   allow_failure: e.boolean().optional(),
   mask_output: e.boolean().optional(),
   params: e.object({
-    target: le.openapi({
+    target: ce.openapi({
       description: "The predefined target to redirect to, or 'custom' for a custom URL"
     }),
     custom_url: e.string().optional().openapi({
       description: "Custom URL to redirect to when target is 'custom'"
     })
   })
-}), pe = e.union([
-  se,
-  re,
-  ce
-]), _e = e.object({
+}), _e = e.union([
+  le,
+  pe,
+  de
+]), ge = e.object({
   name: e.string().min(1).max(150).openapi({
     description: "The name of the flow"
   }),
   // Actions is an array of action steps (Auth0 stores as JSON blob)
-  actions: e.array(pe).optional().default([]).openapi({
+  actions: e.array(_e).optional().default([]).openapi({
     description: "The list of actions to execute in sequence"
   })
-}), Po = _e.extend({
-  ...s.shape,
+}), Yo = ge.extend({
+  ...r.shape,
   id: e.string().openapi({
     description: "Unique identifier for the flow",
     example: "af_12tMpdJ3iek7svMyZkSh5M"
   })
-}), Mo = e.object({
+}), Qo = e.object({
   page: e.string().min(0).optional().default("0").transform((t) => parseInt(t, 10)).openapi({
     description: "The page number where 0 is the first page"
   }),
@@ -182,12 +182,12 @@ const s = e.object({
   q: e.string().optional().openapi({
     description: "A lucene query string used to filter the results"
   })
-}), Ho = e.object({
+}), Zo = e.object({
   start: e.number(),
   limit: e.number(),
   length: e.number(),
   total: e.number().optional()
-}), de = e.object({
+}), ue = e.object({
   email: e.string().optional(),
   email_verified: e.boolean().optional(),
   name: e.string().optional(),
@@ -196,7 +196,7 @@ const s = e.object({
   phone_number: e.string().optional(),
   phone_verified: e.boolean().optional(),
   family_name: e.string().optional()
-}).catchall(e.any()), ge = e.object({
+}).catchall(e.any()), me = e.object({
   connection: e.string(),
   user_id: e.string(),
   provider: e.string(),
@@ -209,8 +209,8 @@ const s = e.object({
   access_token: e.string().optional(),
   access_token_secret: e.string().optional(),
   refresh_token: e.string().optional(),
-  profileData: de.optional()
-}), ue = e.object({
+  profileData: ue.optional()
+}), he = e.object({
   formatted: e.string().optional(),
   // Full mailing address
   street_address: e.string().optional(),
@@ -223,7 +223,7 @@ const s = e.object({
   // Zip code or postal code
   country: e.string().optional()
   // Country name
-}).optional(), w = e.object({
+}).optional(), j = e.object({
   email: e.string().optional().transform((t) => t && t.toLowerCase()),
   username: e.string().refine((t) => !t.includes("@"), {
     message: 'Usernames must not contain "@". Use the email field for email addresses.'
@@ -255,8 +255,8 @@ const s = e.object({
   zoneinfo: e.string().optional(),
   // e.g., "Europe/Paris"
   // OIDC address claim (OIDC Core 5.1.1)
-  address: ue
-}), me = w.extend({
+  address: he
+}), be = j.extend({
   email_verified: e.boolean().default(!1),
   verify_email: e.boolean().optional(),
   last_ip: e.string().optional(),
@@ -279,33 +279,33 @@ const s = e.object({
     hash: e.string(),
     algorithm: e.string()
   }).optional()
-}), he = e.object({
-  ...me.omit({ password: !0 }).shape,
-  ...s.shape,
+}), fe = e.object({
+  ...be.omit({ password: !0 }).shape,
+  ...r.shape,
   user_id: e.string(),
   provider: e.string(),
   is_social: e.boolean(),
   email: e.string().optional(),
   login_count: e.number().default(0),
-  identities: e.array(ge).optional()
-}), Go = he.omit({
+  identities: e.array(me).optional()
+}), $o = fe.omit({
   registration_completed_at: !0
-}), Bo = w.extend({
+}), Jo = j.extend({
   login_count: e.number(),
   multifactor: e.array(e.string()).optional(),
   last_ip: e.string().optional(),
   last_login: e.string().optional(),
   user_id: e.string()
 }).catchall(e.any());
-let be = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict", fe = (t = 21) => {
+let Ee = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict", Se = (t = 21) => {
   let o = "", i = crypto.getRandomValues(new Uint8Array(t |= 0));
   for (; t--; )
-    o += be[i[t] & 63];
+    o += Ee[i[t] & 63];
   return o;
 };
-const Ee = e.object({
-  client_id: e.string().openapi({
-    description: "ID of this client."
+const ye = e.object({
+  client_id: e.string().optional().openapi({
+    description: "ID of this client. Generated server-side if omitted (Auth0 behavior)."
   }),
   name: e.string().min(1).openapi({
     description: "Name of this client (min length: 1 character, does not allow < or >)."
@@ -316,7 +316,7 @@ const Ee = e.object({
   global: e.boolean().default(!1).openapi({
     description: "Whether this is your global 'All Applications' client representing legacy tenant settings (true) or a regular client (false)."
   }),
-  client_secret: e.string().default(() => fe()).optional().openapi({
+  client_secret: e.string().default(() => Se()).optional().openapi({
     description: "Client secret (which you must not make public)."
   }),
   app_type: e.enum([
@@ -439,7 +439,34 @@ const Ee = e.object({
     description: "Initiate login uri, must be https"
   }),
   native_social_login: e.record(e.any()).default({}).optional(),
-  refresh_token: e.record(e.any()).default({}).optional().openapi({
+  refresh_token: e.object({
+    rotation_type: e.enum(["rotating", "non-rotating"]).optional().openapi({
+      description: "Whether refresh tokens for this client are rotated on every exchange (Auth0 'rotating' behavior) or kept stable (legacy non-rotating). Defaults to 'non-rotating' when unset."
+    }),
+    leeway: e.number().int().min(0).max(600).optional().openapi({
+      description: "Seconds after a parent token's first rotation during which presenting it again still mints a fresh sibling child instead of triggering reuse-detection. Defaults to 30s when unset."
+    }),
+    // Auth0-compatible fields. Listed explicitly (rather than using
+    // .passthrough()) so they survive parse cycles AND keep type info,
+    // without tripping dts-bundle-generator's handling of zod's
+    // `objectInputType`. Not yet honored by the engine — added so values
+    // round-trip cleanly when migrating tenants from Auth0.
+    expiration_type: e.enum(["expiring", "non-expiring"]).optional().openapi({
+      description: "Auth0-compatible: whether refresh tokens expire."
+    }),
+    token_lifetime: e.number().int().min(0).optional().openapi({
+      description: "Auth0-compatible: refresh-token absolute lifetime in seconds."
+    }),
+    infinite_token_lifetime: e.boolean().optional().openapi({
+      description: "Auth0-compatible: when true, refresh tokens have no absolute expiry."
+    }),
+    idle_token_lifetime: e.number().int().min(0).optional().openapi({
+      description: "Auth0-compatible: refresh-token idle (sliding) lifetime in seconds."
+    }),
+    infinite_idle_token_lifetime: e.boolean().optional().openapi({
+      description: "Auth0-compatible: when true, refresh tokens have no idle expiry."
+    })
+  }).default({}).optional().openapi({
     description: "Refresh token configuration"
   }),
   default_organization: e.record(e.any()).default({}).optional().openapi({
@@ -488,11 +515,14 @@ const Ee = e.object({
   user_linking_mode: e.enum(["builtin", "off"]).optional().openapi({
     description: "Per-client override for the built-in email-based user-linking path. `builtin` runs the legacy in-process linking at user creation/email update. `off` disables the legacy path; linking only happens if the tenant has enabled the `account-linking` template hook. When unset, the service-level `userLinkingMode` default applies."
   })
-}), Wo = e.object({
+}), en = e.object({
   created_at: e.string(),
   updated_at: e.string(),
-  ...Ee.shape
-}), Se = e.object({
+  ...ye.shape,
+  // Insert allows omitting (server-generated to match Auth0). The read schema
+  // always has it — the row in storage is non-null.
+  client_id: e.string()
+}), Ae = e.object({
   client_id: e.string().min(1).openapi({
     description: "ID of the client."
   }),
@@ -517,37 +547,37 @@ const Ee = e.object({
   authorization_details_types: e.array(e.string()).optional().openapi({
     description: "Types of authorization_details allowed for this client grant. Use of this field is subject to the applicable Free Trial terms in Okta's Master Subscription Agreement."
   })
-}), ye = e.object({
+}), Ie = e.object({
   id: e.string().openapi({
     description: "ID of the client grant."
   }),
-  ...Se.shape,
+  ...Ae.shape,
   created_at: e.string().optional(),
   updated_at: e.string().optional()
-}), Ko = e.array(ye), Ae = e.enum(["iat", "rat"]), Ie = e.object({
+}), tn = e.array(Ie), Ce = e.enum(["iat", "rat"]), Te = e.object({
   id: e.string(),
   token_hash: e.string(),
-  type: Ae,
+  type: Ce,
   client_id: e.string().optional(),
   sub: e.string().optional(),
   constraints: e.record(e.unknown()).optional(),
   single_use: e.boolean().default(!1),
   expires_at: e.string().optional()
-}), zo = e.object({
+}), on = e.object({
   created_at: e.string(),
   used_at: e.string().optional(),
   revoked_at: e.string().optional(),
-  ...Ie.shape
+  ...Te.shape
 }), m = e.object({
   x: e.number(),
   y: e.number()
 });
-var j = /* @__PURE__ */ ((t) => (t.RICH_TEXT = "RICH_TEXT", t.NEXT_BUTTON = "NEXT_BUTTON", t.BACK_BUTTON = "BACK_BUTTON", t.SUBMIT_BUTTON = "SUBMIT_BUTTON", t.DIVIDER = "DIVIDER", t.TEXT = "TEXT", t.EMAIL = "EMAIL", t.PASSWORD = "PASSWORD", t.NUMBER = "NUMBER", t.PHONE = "PHONE", t.DATE = "DATE", t.CHECKBOX = "CHECKBOX", t.RADIO = "RADIO", t.SELECT = "SELECT", t.HIDDEN = "HIDDEN", t.LEGAL = "LEGAL", t))(j || {}), R = /* @__PURE__ */ ((t) => (t.BLOCK = "BLOCK", t.FIELD = "FIELD", t))(R || {});
-const I = e.object({
+var R = /* @__PURE__ */ ((t) => (t.RICH_TEXT = "RICH_TEXT", t.NEXT_BUTTON = "NEXT_BUTTON", t.BACK_BUTTON = "BACK_BUTTON", t.SUBMIT_BUTTON = "SUBMIT_BUTTON", t.DIVIDER = "DIVIDER", t.TEXT = "TEXT", t.EMAIL = "EMAIL", t.PASSWORD = "PASSWORD", t.NUMBER = "NUMBER", t.PHONE = "PHONE", t.DATE = "DATE", t.CHECKBOX = "CHECKBOX", t.RADIO = "RADIO", t.SELECT = "SELECT", t.HIDDEN = "HIDDEN", t.LEGAL = "LEGAL", t))(R || {}), k = /* @__PURE__ */ ((t) => (t.BLOCK = "BLOCK", t.FIELD = "FIELD", t))(k || {});
+const C = e.object({
   id: e.string(),
-  category: e.nativeEnum(R),
-  type: e.nativeEnum(j)
-}), Ce = I.extend({
+  category: e.nativeEnum(k),
+  type: e.nativeEnum(R)
+}), Oe = C.extend({
   category: e.literal(
     "BLOCK"
     /* BLOCK */
@@ -559,7 +589,7 @@ const I = e.object({
   config: e.object({
     content: e.string()
   }).passthrough()
-}), Te = I.extend({
+}), Ne = C.extend({
   category: e.literal(
     "BLOCK"
     /* BLOCK */
@@ -581,7 +611,7 @@ const I = e.object({
   config: e.object({
     text: e.string()
   }).passthrough()
-}), Oe = I.extend({
+}), we = C.extend({
   category: e.literal(
     "FIELD"
     /* FIELD */
@@ -595,7 +625,7 @@ const I = e.object({
   config: e.object({
     text: e.string()
   }).passthrough()
-}), Ne = I.extend({
+}), je = C.extend({
   category: e.literal(
     "FIELD"
     /* FIELD */
@@ -648,19 +678,19 @@ const I = e.object({
     label: e.string().optional(),
     placeholder: e.string().optional()
   }).passthrough()
-}), we = e.object({
+}), Re = e.object({
   id: e.string(),
   category: e.string(),
   type: e.string()
-}).passthrough(), je = e.union([
-  Ce,
-  Te,
+}).passthrough(), ke = e.union([
   Oe,
   Ne,
-  we
+  we,
+  je,
+  Re
 ]);
-var Re = /* @__PURE__ */ ((t) => (t.STEP = "STEP", t.FLOW = "FLOW", t.CONDITION = "CONDITION", t.ACTION = "ACTION", t))(Re || {});
-const De = e.object({
+var De = /* @__PURE__ */ ((t) => (t.STEP = "STEP", t.FLOW = "FLOW", t.CONDITION = "CONDITION", t.ACTION = "ACTION", t))(De || {});
+const ve = e.object({
   id: e.string(),
   type: e.literal(
     "STEP"
@@ -669,7 +699,7 @@ const De = e.object({
   coordinates: m,
   alias: e.string().optional(),
   config: e.object({
-    components: e.array(je),
+    components: e.array(ke),
     next_node: e.string()
   }).passthrough()
 }), Le = e.object({
@@ -684,7 +714,7 @@ const De = e.object({
     flow_id: e.string(),
     next_node: e.string()
   })
-}), ve = e.object({
+}), Ue = e.object({
   id: e.string(),
   type: e.literal(
     "ACTION"
@@ -706,47 +736,47 @@ const De = e.object({
       description: "The next node to navigate to after action (for non-redirect actions)"
     })
   }).passthrough()
-}), ke = e.object({
+}), xe = e.object({
   id: e.string(),
   type: e.string(),
   coordinates: m
-}).passthrough(), Ue = e.union([
-  De,
-  Le,
+}).passthrough(), Fe = e.union([
   ve,
-  ke
-]), Fe = e.object({
+  Le,
+  Ue,
+  xe
+]), Pe = e.object({
   next_node: e.string(),
   coordinates: m
-}).passthrough(), xe = e.object({
+}).passthrough(), Me = e.object({
   resume_flow: e.boolean().optional(),
   coordinates: m
-}).passthrough(), Pe = e.object({
+}).passthrough(), He = e.object({
   id: e.string(),
   name: e.string(),
   languages: e.object({
     primary: e.string()
   }).passthrough(),
-  nodes: e.array(Ue),
-  start: Fe,
-  ending: xe,
+  nodes: e.array(Fe),
+  start: Pe,
+  ending: Me,
   created_at: e.string(),
   updated_at: e.string(),
   links: e.object({
     sdkSrc: e.string().optional(),
     sdk_src: e.string().optional()
   }).passthrough()
-}).passthrough(), qo = Pe.omit({
+}).passthrough(), nn = He.omit({
   id: !0,
   created_at: !0,
   updated_at: !0
 });
-var D = /* @__PURE__ */ ((t) => (t.TOKEN = "token", t.ID_TOKEN = "id_token", t.TOKEN_ID_TOKEN = "token id_token", t.CODE = "code", t))(D || {}), L = /* @__PURE__ */ ((t) => (t.QUERY = "query", t.FRAGMENT = "fragment", t.FORM_POST = "form_post", t.WEB_MESSAGE = "web_message", t.SAML_POST = "saml_post", t))(L || {}), v = /* @__PURE__ */ ((t) => (t.S256 = "S256", t.Plain = "plain", t))(v || {});
-const Me = e.object({
+var D = /* @__PURE__ */ ((t) => (t.TOKEN = "token", t.ID_TOKEN = "id_token", t.TOKEN_ID_TOKEN = "token id_token", t.CODE = "code", t))(D || {}), v = /* @__PURE__ */ ((t) => (t.QUERY = "query", t.FRAGMENT = "fragment", t.FORM_POST = "form_post", t.WEB_MESSAGE = "web_message", t.SAML_POST = "saml_post", t))(v || {}), L = /* @__PURE__ */ ((t) => (t.S256 = "S256", t.Plain = "plain", t))(L || {});
+const Ge = e.object({
   client_id: e.string(),
   act_as: e.string().optional(),
   response_type: e.nativeEnum(D).optional(),
-  response_mode: e.nativeEnum(L).optional(),
+  response_mode: e.nativeEnum(v).optional(),
   redirect_uri: e.string().optional(),
   audience: e.string().optional(),
   organization: e.string().optional(),
@@ -754,7 +784,7 @@ const Me = e.object({
   nonce: e.string().optional(),
   scope: e.string().optional(),
   prompt: e.string().optional(),
-  code_challenge_method: e.nativeEnum(v).optional(),
+  code_challenge_method: e.nativeEnum(L).optional(),
   code_challenge: e.string().optional(),
   username: e.string().optional(),
   ui_locales: e.string().optional(),
@@ -766,15 +796,20 @@ const Me = e.object({
   acr_values: e.string().optional(),
   // The following fields are not available in Auth0
   vendor_id: e.string().optional()
-}), Xo = e.object({
+}), an = e.object({
   colors: e.object({
     primary: e.string(),
-    page_background: e.object({
-      type: e.string().optional(),
-      start: e.string().optional(),
-      end: e.string().optional(),
-      angle_deg: e.number().optional()
-    }).optional()
+    // Auth0 supports either a hex color string ("#ffffff") or a gradient
+    // object. Match both shapes so SDK callers don't get rejected.
+    page_background: e.union([
+      e.string(),
+      e.object({
+        type: e.string().optional(),
+        start: e.string().optional(),
+        end: e.string().optional(),
+        angle_deg: e.number().optional()
+      })
+    ]).optional()
   }).optional(),
   logo_url: e.string().optional(),
   favicon_url: e.string().optional(),
@@ -782,7 +817,7 @@ const Me = e.object({
   font: e.object({
     url: e.string()
   }).optional()
-}), He = e.enum([
+}), Be = e.enum([
   "password_reset",
   "email_verification",
   "otp",
@@ -790,7 +825,7 @@ const Me = e.object({
   "authorization_code",
   "oauth2_state",
   "ticket"
-]), Ge = e.object({
+]), We = e.object({
   code_id: e.string().openapi({
     description: "The code that will be used in for instance an email verification flow"
   }),
@@ -800,7 +835,7 @@ const Me = e.object({
   connection_id: e.string().optional().openapi({
     description: "The connection that the code is connected to"
   }),
-  code_type: He,
+  code_type: Be,
   code_verifier: e.string().optional().openapi({
     description: "The code verifier used in PKCE in outbound flows"
   }),
@@ -825,10 +860,10 @@ const Me = e.object({
   expires_at: e.string(),
   used_at: e.string().optional(),
   user_id: e.string().optional()
-}), Vo = e.object({
-  ...Ge.shape,
+}), rn = e.object({
+  ...We.shape,
   created_at: e.string()
-}), Be = e.object({
+}), ze = e.object({
   kid: e.string().optional(),
   team_id: e.string().optional(),
   realms: e.string().optional(),
@@ -940,12 +975,29 @@ const Me = e.object({
   }).optional(),
   // Controls when root user attributes are updated from external IdP
   set_user_root_attributes: e.enum(["on_each_login", "on_first_login", "never_on_login"]).optional()
-}), We = e.object({
+});
+function T(t) {
+  if (t !== null) {
+    if (Array.isArray(t))
+      return t.filter((o) => o !== null).map(T);
+    if (t && typeof t == "object") {
+      const o = {};
+      for (const [i, h] of Object.entries(t))
+        h !== null && (o[i] = T(h));
+      return o;
+    }
+    return t;
+  }
+}
+const Ke = e.object({
   id: e.string().optional(),
   name: e.string(),
   display_name: e.string().optional(),
   strategy: e.string(),
-  options: Be.default({}),
+  options: e.preprocess(
+    (t) => t === null ? {} : T(t),
+    ze
+  ).default({}),
   enabled_clients: e.array(e.string()).default([]).optional(),
   response_type: e.custom().optional(),
   response_mode: e.custom().optional(),
@@ -953,11 +1005,11 @@ const Me = e.object({
   show_as_button: e.boolean().optional(),
   metadata: e.record(e.any()).optional(),
   is_system: e.boolean().optional()
-}), Yo = e.object({
+}), sn = e.object({
   id: e.string(),
   created_at: e.string().transform((t) => t === null ? "" : t),
   updated_at: e.string().transform((t) => t === null ? "" : t)
-}).extend(We.shape), Ke = e.object({
+}).extend(Ke.shape), qe = e.object({
   domain: e.string(),
   custom_domain_id: e.string().optional(),
   type: e.enum(["auth0_managed_certs", "self_managed_certs"]),
@@ -971,7 +1023,7 @@ const Me = e.object({
     "null"
   ]).optional(),
   domain_metadata: e.record(e.string().max(255)).optional()
-}), ze = e.discriminatedUnion("name", [
+}), Xe = e.discriminatedUnion("name", [
   e.object({
     name: e.literal("txt"),
     record: e.string(),
@@ -982,35 +1034,35 @@ const Me = e.object({
     http_body: e.string(),
     http_url: e.string()
   })
-]), qe = e.object({
-  ...Ke.shape,
+]), Ve = e.object({
+  ...qe.shape,
   custom_domain_id: e.string(),
   primary: e.boolean(),
   status: e.enum(["disabled", "pending", "pending_verification", "ready"]),
   origin_domain_name: e.string().optional(),
   verification: e.object({
-    methods: e.array(ze)
+    methods: e.array(Xe)
   }).optional(),
   tls_policy: e.string().optional()
-}), Qo = qe.extend({
+}), ln = Ve.extend({
   tenant_id: e.string()
-}), C = e.object({
+}), O = e.object({
   id: e.string(),
   order: e.number().optional(),
   visible: e.boolean().optional().default(!0)
-}), l = C.extend({
+}), l = O.extend({
   category: e.literal("BLOCK").optional()
-}), Xe = l.extend({
+}), Ye = l.extend({
   type: e.literal("DIVIDER"),
   config: e.object({
     text: e.string().optional()
   }).optional()
-}), Ve = l.extend({
+}), Qe = l.extend({
   type: e.literal("HTML"),
   config: e.object({
     content: e.string().optional()
   }).optional()
-}), Ye = l.extend({
+}), Ze = l.extend({
   type: e.literal("IMAGE"),
   config: e.object({
     src: e.string().optional(),
@@ -1018,55 +1070,55 @@ const Me = e.object({
     width: e.number().optional(),
     height: e.number().optional()
   }).optional()
-}), Qe = l.extend({
+}), $e = l.extend({
   type: e.literal("JUMP_BUTTON"),
   config: e.object({
     text: e.string().optional(),
     target_step: e.string().optional()
   })
-}), Ze = l.extend({
+}), Je = l.extend({
   type: e.literal("RESEND_BUTTON"),
   config: e.object({
     text: e.string().optional(),
     resend_action: e.string().optional()
   })
-}), $e = l.extend({
+}), et = l.extend({
   type: e.literal("NEXT_BUTTON"),
   config: e.object({
     text: e.string().optional()
   })
-}), Je = l.extend({
+}), tt = l.extend({
   type: e.literal("PREVIOUS_BUTTON"),
   config: e.object({
     text: e.string().optional()
   })
-}), et = l.extend({
+}), ot = l.extend({
   type: e.literal("RICH_TEXT"),
   config: e.object({
     content: e.string().optional()
   }).optional()
-}), T = C.extend({
+}), N = O.extend({
   category: e.literal("WIDGET").optional(),
   label: e.string().min(1).optional(),
   hint: e.string().min(1).max(500).optional(),
   required: e.boolean().optional(),
   sensitive: e.boolean().optional()
-}), tt = T.extend({
+}), nt = N.extend({
   type: e.literal("AUTH0_VERIFIABLE_CREDENTIALS"),
   config: e.object({
     credential_type: e.string().optional()
   })
-}), ot = T.extend({
+}), it = N.extend({
   type: e.literal("GMAPS_ADDRESS"),
   config: e.object({
     api_key: e.string().optional()
   })
-}), nt = T.extend({
+}), at = N.extend({
   type: e.literal("RECAPTCHA"),
   config: e.object({
     site_key: e.string().optional()
   })
-}), n = C.extend({
+}), n = O.extend({
   category: e.literal("FIELD").optional(),
   label: e.string().min(1).optional(),
   hint: e.string().min(1).max(500).optional(),
@@ -1079,12 +1131,12 @@ const Me = e.object({
   ).optional(),
   required: e.boolean().optional(),
   sensitive: e.boolean().optional()
-}), it = n.extend({
+}), rt = n.extend({
   type: e.literal("BOOLEAN"),
   config: e.object({
     default_value: e.boolean().optional()
   }).optional()
-}), at = n.extend({
+}), st = n.extend({
   type: e.literal("CARDS"),
   config: e.object({
     options: e.array(
@@ -1097,7 +1149,7 @@ const Me = e.object({
     ).optional(),
     multi_select: e.boolean().optional()
   }).optional()
-}), st = n.extend({
+}), lt = n.extend({
   type: e.literal("CHOICE"),
   config: e.object({
     options: e.array(
@@ -1110,7 +1162,7 @@ const Me = e.object({
     multiple: e.boolean().optional(),
     default_value: e.union([e.string(), e.array(e.string())]).optional()
   }).optional()
-}), rt = n.extend({
+}), pt = n.extend({
   type: e.literal("CUSTOM"),
   config: e.object({
     component: e.string().optional(),
@@ -1118,7 +1170,7 @@ const Me = e.object({
     schema: e.record(e.any()).optional(),
     code: e.string().optional()
   })
-}), lt = n.extend({
+}), ct = n.extend({
   type: e.literal("DATE"),
   config: e.object({
     format: e.string().optional(),
@@ -1126,7 +1178,7 @@ const Me = e.object({
     max: e.string().optional(),
     default_value: e.string().optional()
   }).optional()
-}), ct = n.extend({
+}), dt = n.extend({
   type: e.literal("DROPDOWN"),
   config: e.object({
     options: e.array(
@@ -1140,26 +1192,26 @@ const Me = e.object({
     multiple: e.boolean().optional(),
     default_value: e.union([e.string(), e.array(e.string())]).optional()
   }).optional()
-}), pt = n.extend({
+}), _t = n.extend({
   type: e.literal("EMAIL"),
   config: e.object({
     placeholder: e.string().optional(),
     default_value: e.string().optional()
   }).optional()
-}), _t = n.extend({
+}), gt = n.extend({
   type: e.literal("FILE"),
   config: e.object({
     accept: e.string().optional(),
     max_size: e.number().optional(),
     multiple: e.boolean().optional()
   }).optional()
-}), dt = n.extend({
+}), ut = n.extend({
   type: e.literal("LEGAL"),
   config: e.object({
     text: e.string(),
     html: e.boolean().optional()
   }).optional()
-}), gt = n.extend({
+}), mt = n.extend({
   type: e.literal("NUMBER"),
   config: e.object({
     placeholder: e.string().optional(),
@@ -1168,7 +1220,7 @@ const Me = e.object({
     step: e.number().optional(),
     default_value: e.string().optional()
   }).optional()
-}), ut = n.extend({
+}), ht = n.extend({
   type: e.literal("PASSWORD"),
   config: e.object({
     placeholder: e.string().optional(),
@@ -1177,13 +1229,13 @@ const Me = e.object({
     forgot_password_link: e.string().optional(),
     default_value: e.string().optional()
   }).optional()
-}), mt = n.extend({
+}), bt = n.extend({
   type: e.literal("PAYMENT"),
   config: e.object({
     provider: e.string().optional(),
     currency: e.string().optional()
   }).optional()
-}), ht = n.extend({
+}), ft = n.extend({
   type: e.literal("SOCIAL"),
   config: e.object({
     providers: e.array(e.string()).optional(),
@@ -1198,7 +1250,7 @@ const Me = e.object({
       })
     ).optional()
   }).optional()
-}), bt = n.extend({
+}), Et = n.extend({
   type: e.literal("TEL"),
   config: e.object({
     placeholder: e.string().optional(),
@@ -1206,7 +1258,7 @@ const Me = e.object({
     default_value: e.string().optional(),
     allow_email: e.boolean().optional()
   }).optional()
-}), ft = n.extend({
+}), St = n.extend({
   type: e.literal("TEXT"),
   config: e.object({
     placeholder: e.string().optional(),
@@ -1214,54 +1266,54 @@ const Me = e.object({
     max_length: e.number().optional(),
     default_value: e.string().optional()
   }).optional()
-}), Et = n.extend({
+}), yt = n.extend({
   type: e.literal("COUNTRY"),
   config: e.object({
     placeholder: e.string().optional(),
     default_value: e.string().optional()
   }).optional()
-}), St = n.extend({
+}), At = n.extend({
   type: e.literal("URL"),
   config: e.object({
     placeholder: e.string().optional(),
     default_value: e.string().optional()
   }).optional()
-}), yt = e.discriminatedUnion("type", [
-  Xe,
-  Ve,
+}), It = e.discriminatedUnion("type", [
   Ye,
   Qe,
   Ze,
   $e,
   Je,
-  et
-]), At = e.discriminatedUnion("type", [
+  et,
   tt,
-  ot,
-  nt
-]), It = e.discriminatedUnion("type", [
+  ot
+]), Ct = e.discriminatedUnion("type", [
+  nt,
   it,
-  at,
-  st,
-  Et,
+  at
+]), Tt = e.discriminatedUnion("type", [
   rt,
+  st,
   lt,
-  ct,
+  yt,
   pt,
-  _t,
+  ct,
   dt,
+  _t,
   gt,
   ut,
   mt,
   ht,
   bt,
   ft,
-  St
-]), k = e.union([
-  yt,
-  At,
-  It
-]), Zo = /* @__PURE__ */ new Set([
+  Et,
+  St,
+  At
+]), U = e.union([
+  It,
+  Ct,
+  Tt
+]), pn = /* @__PURE__ */ new Set([
   "BOOLEAN",
   "CARDS",
   "CHOICE",
@@ -1275,7 +1327,7 @@ const Me = e.object({
   "TEL",
   "TEXT",
   "URL"
-]), $o = e.object({
+]), cn = e.object({
   id: e.string(),
   type: e.literal("submit"),
   label: e.string(),
@@ -1284,22 +1336,22 @@ const Me = e.object({
   order: e.number().optional(),
   visible: e.boolean().optional().default(!0),
   customizations: e.record(e.string(), e.any()).optional()
-}), f = e.object({
+}), E = e.object({
   x: e.number(),
   y: e.number()
-}), Ct = e.object({
+}), Ot = e.object({
   id: e.string(),
   type: e.literal("FLOW"),
-  coordinates: f,
+  coordinates: E,
   alias: e.string().min(1).max(150).optional(),
   config: e.object({
     flow_id: e.string().max(30),
     next_node: e.string().optional()
   })
-}), Tt = e.object({
+}), Nt = e.object({
   id: e.string(),
   type: e.literal("ROUTER"),
-  coordinates: f,
+  coordinates: E,
   alias: e.string().min(1).max(150),
   config: e.object({
     rules: e.array(
@@ -1312,20 +1364,20 @@ const Me = e.object({
     ),
     fallback: e.string()
   })
-}), Ot = e.object({
+}), wt = e.object({
   id: e.string(),
   type: e.literal("STEP"),
-  coordinates: f,
+  coordinates: E,
   alias: e.string().min(1).max(150).optional(),
   config: e.object({
-    components: e.array(k),
+    components: e.array(U),
     next_node: e.string().optional()
   })
-}), Nt = e.discriminatedUnion("type", [
-  Ct,
-  Tt,
-  Ot
-]), wt = e.object({
+}), jt = e.discriminatedUnion("type", [
+  Ot,
+  Nt,
+  wt
+]), Rt = e.object({
   name: e.string().openapi({
     description: "The name of the form"
   }),
@@ -1338,11 +1390,11 @@ const Me = e.object({
     default: e.string().optional()
   }).optional(),
   translations: e.record(e.string(), e.any()).optional(),
-  nodes: e.array(Nt).optional(),
+  nodes: e.array(jt).optional(),
   start: e.object({
     hidden_fields: e.array(e.object({ key: e.string(), value: e.string() })).optional(),
     next_node: e.string().optional(),
-    coordinates: f.optional()
+    coordinates: E.optional()
   }).optional(),
   ending: e.object({
     redirection: e.object({
@@ -1350,7 +1402,7 @@ const Me = e.object({
       target: e.string().optional()
     }).optional(),
     after_submit: e.object({ flow_id: e.string().optional() }).optional(),
-    coordinates: f.optional(),
+    coordinates: E.optional(),
     resume_flow: e.boolean().optional()
   }).optional(),
   style: e.object({ css: e.string().optional() }).optional(),
@@ -1360,42 +1412,42 @@ const Me = e.object({
   }).optional()
 }).openapi({
   description: "Schema for flow-based forms (matches Auth0 Forms structure)"
-}), Jo = e.object({
-  ...s.shape,
-  ...wt.shape,
+}), dn = e.object({
+  ...r.shape,
+  ...Rt.shape,
   id: e.string()
-}), jt = e.object({
+}), kt = e.object({
   id: e.number().optional(),
   text: e.string(),
   type: e.enum(["info", "error", "success", "warning"])
-}), Rt = e.object({
+}), Dt = e.object({
   id: e.string().optional(),
   text: e.string(),
   href: e.string(),
   linkText: e.string().optional()
-}), en = e.object({
+}), _n = e.object({
   /** Screen identifier for CSS targeting (e.g., 'identifier', 'enter-password', 'signup') */
   name: e.string().optional(),
   action: e.string(),
   method: e.enum(["POST", "GET"]),
   title: e.string().optional(),
   description: e.string().optional(),
-  components: e.array(k),
-  messages: e.array(jt).optional(),
-  links: e.array(Rt).optional(),
+  components: e.array(U),
+  messages: e.array(kt).optional(),
+  links: e.array(Dt).optional(),
   /** Footer HTML content displayed at the very bottom of the widget (e.g., terms and conditions) */
   footer: e.string().optional()
 });
-function tn(t) {
+function gn(t) {
   return t.category === "BLOCK";
 }
-function on(t) {
+function un(t) {
   return t.category === "WIDGET";
 }
-function nn(t) {
+function mn(t) {
   return t.category === "FIELD";
 }
-const U = e.enum([
+const x = e.enum([
   "pre-user-registration",
   "post-user-registration",
   "post-user-login",
@@ -1411,21 +1463,21 @@ const U = e.enum([
   "validate-registration-username",
   "pre-user-deletion",
   "post-user-deletion"
-]), x = e.enum([
+]), P = e.enum([
   "post-user-login",
   "post-user-registration",
   "post-user-update",
   "credentials-exchange"
-]), P = e.enum([
+]), M = e.enum([
   "post-user-login",
   "credentials-exchange",
   "pre-user-registration",
   "post-user-registration"
-]), M = e.enum([
+]), H = e.enum([
   "ensure-username",
   "set-preferred-username",
   "account-linking"
-]), an = {
+]), hn = {
   "ensure-username": {
     name: "Ensure Username",
     description: "Automatically assigns a username to users who sign in without one. Creates a linked username account for social/email users.",
@@ -1445,7 +1497,7 @@ const U = e.enum([
       "post-user-update"
     ]
   }
-}, c = {
+}, p = {
   enabled: e.boolean().default(!1),
   synchronous: e.boolean().default(!1),
   priority: e.number().optional(),
@@ -1462,71 +1514,71 @@ const U = e.enum([
    * Everything else is opaque to the runtime. Persisted as JSON.
    */
   metadata: e.record(e.unknown()).optional()
-}, Dt = e.object({
-  ...c,
-  trigger_id: U,
+}, vt = e.object({
+  ...p,
+  trigger_id: x,
   url: e.string()
 }), Lt = e.object({
-  ...c,
+  ...p,
   trigger_id: F,
   form_id: e.string()
-}), vt = e.object({
-  ...c,
-  trigger_id: x,
-  template_id: M
-}), kt = e.object({
-  ...c,
+}), Ut = e.object({
+  ...p,
   trigger_id: P,
+  template_id: H
+}), xt = e.object({
+  ...p,
+  trigger_id: M,
   code_id: e.string()
-}), sn = e.union([
-  Dt,
-  Lt,
+}), bn = e.union([
   vt,
-  kt
-]), Ut = e.object({
-  ...c,
-  trigger_id: U,
-  ...s.shape,
+  Lt,
+  Ut,
+  xt
+]), Ft = e.object({
+  ...p,
+  trigger_id: x,
+  ...r.shape,
   hook_id: e.string(),
   url: e.string()
-}), Ft = e.object({
-  ...c,
+}), Pt = e.object({
+  ...p,
   trigger_id: F,
-  ...s.shape,
+  ...r.shape,
   hook_id: e.string(),
   form_id: e.string()
-}), xt = e.object({
-  ...c,
-  trigger_id: x,
-  ...s.shape,
-  hook_id: e.string(),
-  template_id: M
-}), Pt = e.object({
-  ...c,
+}), Mt = e.object({
+  ...p,
   trigger_id: P,
-  ...s.shape,
+  ...r.shape,
+  hook_id: e.string(),
+  template_id: H
+}), Ht = e.object({
+  ...p,
+  trigger_id: M,
+  ...r.shape,
   hook_id: e.string(),
   code_id: e.string()
-}), rn = e.union([
-  Ut,
+}), fn = e.union([
   Ft,
-  xt,
-  Pt
-]), Mt = e.object({
+  Pt,
+  Mt,
+  Ht
+]), Gt = e.object({
   code: e.string().max(1e5),
   secrets: e.record(e.string()).optional()
-}), ln = Mt.extend({
+}), En = Gt.extend({
   id: e.string(),
   tenant_id: e.string(),
-  ...s.shape
-}), Ht = e.object({
+  ...r.shape
+}), Bt = e.object({
   name: e.string().optional()
-}), Gt = e.object({
+}), Wt = e.object({
   email: e.string().optional()
-}), Bt = e.object({
+}), zt = e.object({
   organization_id: e.string().max(50),
-  inviter: Ht,
-  invitee: Gt,
+  inviter: Bt,
+  invitee: Wt,
   invitation_url: e.string().url(),
   client_id: e.string(),
   connection_id: e.string().optional(),
@@ -1535,13 +1587,13 @@ const U = e.enum([
   ttl_sec: e.number().int().max(2592e3).default(604800).optional(),
   roles: e.array(e.string()).default([]).optional(),
   send_invitation_email: e.boolean().default(!0).optional()
-}), cn = e.object({
+}), Sn = e.object({
   id: e.string(),
   organization_id: e.string().max(50),
   created_at: e.string().datetime(),
   expires_at: e.string().datetime(),
   ticket_id: e.string().optional()
-}).extend(Bt.shape), Wt = e.object({
+}).extend(zt.shape), Kt = e.object({
   alg: e.enum([
     "RS256",
     "RS384",
@@ -1560,9 +1612,9 @@ const U = e.enum([
   x5t: e.string().optional(),
   x5c: e.array(e.string()).optional(),
   use: e.enum(["sig", "enc"]).optional()
-}), pn = e.object({
-  keys: e.array(Wt)
-}), _n = e.object({
+}), yn = e.object({
+  keys: e.array(Kt)
+}), An = e.object({
   issuer: e.string(),
   authorization_endpoint: e.string(),
   token_endpoint: e.string(),
@@ -1572,8 +1624,10 @@ const U = e.enum([
   jwks_uri: e.string(),
   registration_endpoint: e.string().optional(),
   revocation_endpoint: e.string(),
+  end_session_endpoint: e.string().optional(),
   scopes_supported: e.array(e.string()),
   response_types_supported: e.array(e.string()),
+  grant_types_supported: e.array(e.string()).optional(),
   code_challenge_methods_supported: e.array(e.string()),
   response_modes_supported: e.array(e.string()),
   subject_types_supported: e.array(e.string()),
@@ -1584,21 +1638,21 @@ const U = e.enum([
   request_parameter_supported: e.boolean(),
   token_endpoint_auth_signing_alg_values_supported: e.array(e.string())
 });
-var H = /* @__PURE__ */ ((t) => (t.PENDING = "pending", t.AUTHENTICATED = "authenticated", t.AWAITING_EMAIL_VERIFICATION = "awaiting_email_verification", t.AWAITING_MFA = "awaiting_mfa", t.AWAITING_HOOK = "awaiting_hook", t.AWAITING_CONTINUATION = "awaiting_continuation", t.COMPLETED = "completed", t.FAILED = "failed", t.EXPIRED = "expired", t))(H || {});
-const Kt = e.nativeEnum(H), zt = e.object({
+var G = /* @__PURE__ */ ((t) => (t.PENDING = "pending", t.AUTHENTICATED = "authenticated", t.AWAITING_EMAIL_VERIFICATION = "awaiting_email_verification", t.AWAITING_MFA = "awaiting_mfa", t.AWAITING_HOOK = "awaiting_hook", t.AWAITING_CONTINUATION = "awaiting_continuation", t.COMPLETED = "completed", t.FAILED = "failed", t.EXPIRED = "expired", t))(G || {});
+const qt = e.nativeEnum(G), Xt = e.object({
   strategy: e.string(),
   strategy_type: e.string()
-}), qt = e.object({
+}), Vt = e.object({
   csrf_token: e.string(),
   auth0Client: e.string().optional(),
-  authParams: Me,
+  authParams: Ge,
   expires_at: e.string(),
   deleted_at: e.string().optional(),
   ip: e.string().optional(),
   useragent: e.string().optional(),
   session_id: e.string().optional(),
   authorization_url: e.string().optional(),
-  state: Kt.optional().default(
+  state: qt.optional().default(
     "pending"
     /* PENDING */
   ),
@@ -1609,19 +1663,19 @@ const Kt = e.nativeEnum(H), zt = e.object({
   // Set once user is authenticated
   auth_connection: e.string().optional(),
   // The connection used to authenticate (may differ from primary user's connection)
-  auth_strategy: zt.optional(),
+  auth_strategy: Xt.optional(),
   authenticated_at: e.string().optional()
   // ISO timestamp persisted for audit/metadata; not used to reject resumed sessions
 }).openapi({
   description: "This represents a login sesion"
-}), dn = e.object({
-  ...qt.shape,
+}), In = e.object({
+  ...Vt.shape,
   id: e.string().openapi({
     description: "This is is used as the state in the universal login"
   }),
   created_at: e.string(),
   updated_at: e.string()
-}), Xt = {
+}), Yt = {
   // Network & System
   ACLS_SUMMARY: "acls_summary",
   ACTIONS_EXECUTION_FAILED: "actions_execution_failed",
@@ -1793,24 +1847,24 @@ const Kt = e.nativeEnum(H), zt = e.object({
   WARNING_DURING_LOGIN: "w",
   WARNING_SENDING_NOTIFICATION: "wn",
   WARNING_USER_MANAGEMENT: "wum"
-}, Vt = e.string().refine(
-  (t) => Object.values(Xt).includes(t),
+}, Qt = e.string().refine(
+  (t) => Object.values(Yt).includes(t),
   { message: "Invalid log type" }
-), Yt = e.object({
+), Zt = e.object({
   name: e.string(),
   version: e.string(),
   env: e.object({
     node: e.string().optional()
   }).optional()
-}), Qt = e.object({
+}), $t = e.object({
   country_code: e.string().length(2),
   city_name: e.string(),
   latitude: e.string(),
   longitude: e.string(),
   time_zone: e.string(),
   continent_code: e.string()
-}), Zt = e.object({
-  type: Vt,
+}), Jt = e.object({
+  type: Qt,
   date: e.string(),
   description: e.string().optional(),
   ip: e.string().optional(),
@@ -1829,30 +1883,93 @@ const Kt = e.nativeEnum(H), zt = e.object({
   strategy: e.string().optional(),
   strategy_type: e.string().optional(),
   hostname: e.string().optional(),
-  auth0_client: Yt.optional(),
+  auth0_client: Zt.optional(),
   log_id: e.string().optional(),
-  location_info: Qt.optional()
-}), gn = e.object({
-  ...Zt.shape,
+  location_info: $t.optional()
+}), Cn = e.object({
+  ...Jt.shape,
   log_id: e.string()
-}), $t = e.object({
+}), eo = e.enum([
+  "http",
+  "eventbridge",
+  "eventgrid",
+  "splunk",
+  "datadog",
+  "sumo"
+]), B = e.enum([
+  "active",
+  "paused",
+  "suspended"
+]), to = e.object({
+  type: e.string(),
+  name: e.string()
+}), oo = e.object({
+  name: e.string(),
+  type: eo,
+  status: B.optional(),
+  sink: e.record(e.string(), e.unknown()),
+  filters: e.array(to).optional(),
+  isPriority: e.boolean().optional()
+}), Tn = oo.extend({
+  id: e.string(),
+  status: B,
+  created_at: e.string().optional(),
+  updated_at: e.string().optional()
+}), no = e.object({
+  enabled: e.boolean().optional(),
+  shields: e.array(e.string()).optional(),
+  admin_notification_frequency: e.array(e.string()).optional(),
+  method: e.string().optional(),
+  stage: e.object({
+    "pre-user-registration": e.object({
+      shields: e.array(e.string()).optional()
+    }).optional(),
+    "pre-change-password": e.object({
+      shields: e.array(e.string()).optional()
+    }).optional()
+  }).optional()
+}), io = e.object({
+  enabled: e.boolean().optional(),
+  shields: e.array(e.string()).optional(),
+  allowlist: e.array(e.string()).optional(),
+  mode: e.string().optional(),
+  max_attempts: e.number().optional()
+}), ao = e.object({
+  enabled: e.boolean().optional(),
+  shields: e.array(e.string()).optional(),
+  allowlist: e.array(e.string()).optional(),
+  stage: e.object({
+    "pre-login": e.object({
+      max_attempts: e.number().optional(),
+      rate: e.number().optional()
+    }).optional(),
+    "pre-user-registration": e.object({
+      max_attempts: e.number().optional(),
+      rate: e.number().optional()
+    }).optional()
+  }).optional()
+}), ro = e.object({
+  breached_password_detection: no.optional(),
+  brute_force_protection: io.optional(),
+  suspicious_ip_throttling: ao.optional()
+}), so = e.object({
   id: e.string().optional(),
   user_id: e.string(),
   password: e.string(),
   algorithm: e.enum(["bcrypt", "argon2id"]).default("argon2id"),
   is_current: e.boolean().default(!0)
-}), un = $t.extend({
+}), On = so.extend({
   id: e.string(),
   created_at: e.string(),
   updated_at: e.string()
-}), G = e.object({
+}), W = e.object({
   initial_user_agent: e.string().describe("First user agent of the device from which this user logged in"),
   initial_ip: e.string().describe("First IP address associated with this session"),
   initial_asn: e.string().describe("First autonomous system number associated with this session"),
   last_user_agent: e.string().describe("Last user agent of the device from which this user logged in"),
   last_ip: e.string().describe("Last IP address from which this user logged in"),
   last_asn: e.string().describe("Last autonomous system number from which this user logged in")
-}), Jt = e.object({
+}), lo = e.object({
   id: e.string(),
   revoked_at: e.string().optional(),
   used_at: e.string().optional(),
@@ -1860,17 +1977,17 @@ const Kt = e.nativeEnum(H), zt = e.object({
   expires_at: e.string().optional(),
   login_session_id: e.string(),
   idle_expires_at: e.string().optional(),
-  device: G.describe(
+  device: W.describe(
     "Metadata related to the device used in the session"
   ),
   clients: e.array(e.string()).describe("List of client details for the session")
-}), mn = e.object({
+}), Nn = e.object({
   created_at: e.string(),
   updated_at: e.string(),
   authenticated_at: e.string(),
   last_interaction_at: e.string(),
-  ...Jt.shape
-}), hn = e.object({
+  ...lo.shape
+}), wn = e.object({
   kid: e.string().openapi({ description: "The key id of the signing key" }),
   cert: e.string().openapi({ description: "The public certificate of the signing key" }),
   fingerprint: e.string().openapi({ description: "The cert fingerprint" }),
@@ -1895,7 +2012,7 @@ const Kt = e.nativeEnum(H), zt = e.object({
   type: e.enum(["jwt_signing", "saml_encryption"]).openapi({
     description: "The type of the signing key"
   })
-}), eo = e.object({
+}), po = e.object({
   id: e.string().optional(),
   // Basic settings
   audience: e.string(),
@@ -1926,7 +2043,7 @@ const Kt = e.nativeEnum(H), zt = e.object({
     html: e.string().optional(),
     show_log_link: e.boolean().optional(),
     url: e.string().optional()
-  }).optional(),
+  }).nullish(),
   // Flags
   flags: e.object({
     allow_changing_enable_sso: e.boolean().optional(),
@@ -2016,7 +2133,7 @@ const Kt = e.nativeEnum(H), zt = e.object({
     organizations: e.object({
       client_credentials: e.record(e.any()).optional()
     }).optional()
-  }).optional(),
+  }).nullish(),
   // Default audience
   default_audience: e.string().optional(),
   // Default organization
@@ -2038,10 +2155,12 @@ const Kt = e.nativeEnum(H), zt = e.object({
   // mTLS settings
   mtls: e.object({
     enable_endpoint_aliases: e.boolean().optional()
-  }).optional(),
+  }).nullish(),
   // Authorization settings
   pushed_authorization_requests_supported: e.boolean().optional(),
   authorization_response_iss_parameter_supported: e.boolean().optional(),
+  // Attack-protection config (singleton, exposed via /api/v2/attack-protection)
+  attack_protection: ro.optional(),
   // Guardian MFA Factors configuration (internal storage, exposed via /guardian API)
   mfa: e.object({
     // MFA policy: "never" = MFA disabled, "always" = MFA required for all logins
@@ -2073,14 +2192,14 @@ const Kt = e.nativeEnum(H), zt = e.object({
       message: e.string().optional()
     }).optional()
   }).optional()
-}), bn = e.object({
+}), jn = e.object({
   created_at: e.string().nullable().transform((t) => t ?? ""),
   updated_at: e.string().nullable().transform((t) => t ?? ""),
-  ...eo.shape,
+  ...po.shape,
   id: e.string()
 });
-var to = /* @__PURE__ */ ((t) => (t.RefreshToken = "refresh_token", t.AuthorizationCode = "authorization_code", t.ClientCredential = "client_credentials", t.Passwordless = "passwordless", t.Password = "password", t.OTP = "http://auth0.com/oauth/grant-type/passwordless/otp", t))(to || {});
-const fn = e.object({
+var co = /* @__PURE__ */ ((t) => (t.RefreshToken = "refresh_token", t.AuthorizationCode = "authorization_code", t.ClientCredential = "client_credentials", t.Passwordless = "passwordless", t.Password = "password", t.OTP = "http://auth0.com/oauth/grant-type/passwordless/otp", t))(co || {});
+const Rn = e.object({
   access_token: e.string(),
   id_token: e.string().optional(),
   scope: e.string().optional(),
@@ -2093,7 +2212,7 @@ e.object({
   code: e.string(),
   state: e.string().optional()
 });
-const oo = e.object({
+const _o = e.object({
   button_border_radius: e.number(),
   button_border_weight: e.number(),
   buttons_style: e.enum(["pill", "rounded", "sharp"]),
@@ -2103,7 +2222,7 @@ const oo = e.object({
   show_widget_shadow: e.boolean(),
   widget_border_weight: e.number(),
   widget_corner_radius: e.number()
-}), no = e.object({
+}), go = e.object({
   base_focus_color: e.string(),
   base_hover_color: e.string(),
   body_text: e.string(),
@@ -2126,7 +2245,7 @@ const oo = e.object({
 }), u = e.object({
   bold: e.boolean(),
   size: e.number()
-}), io = e.object({
+}), uo = e.object({
   body_text: u,
   buttons_text: u,
   font_url: e.string(),
@@ -2136,62 +2255,38 @@ const oo = e.object({
   reference_text_size: e.number(),
   subtitle: u,
   title: u
-}), ao = e.object({
+}), mo = e.object({
   background_color: e.string(),
   background_image_url: e.string(),
   page_layout: e.enum(["center", "left", "right"])
-}), so = e.object({
+}), ho = e.object({
   header_text_alignment: e.enum(["center", "left", "right"]),
   logo_height: e.number(),
   logo_position: e.enum(["center", "left", "none", "right"]),
   logo_url: e.string(),
   social_buttons_layout: e.enum(["bottom", "top"])
-}), ro = e.object({
-  borders: oo,
-  colors: no,
+}), bo = e.object({
+  borders: _o,
+  colors: go,
   displayName: e.string(),
-  fonts: io,
-  page_background: ao,
-  widget: so
-}), En = ro.extend({
+  fonts: uo,
+  page_background: mo,
+  widget: ho
+}), kn = bo.extend({
   themeId: e.string()
-}), Sn = e.object({
+}), Dn = e.object({
   universal_login_experience: e.enum(["new", "classic"]).default("new"),
   identifier_first: e.boolean().default(!0),
   password_first: e.boolean().default(!1),
   webauthn_platform_first_factor: e.boolean()
-}), yn = e.object({
+}), vn = e.object({
   name: e.string(),
   enabled: e.boolean().optional().default(!0),
   default_from_address: e.string().optional(),
-  credentials: e.union([
-    e.object({
-      accessKeyId: e.string(),
-      secretAccessKey: e.string(),
-      region: e.string()
-    }),
-    e.object({
-      smtp_host: e.array(e.string()),
-      smtp_port: e.number(),
-      smtp_user: e.string(),
-      smtp_pass: e.string()
-    }),
-    e.object({
-      api_key: e.string(),
-      domain: e.string().optional()
-    }),
-    e.object({
-      connectionString: e.string()
-    }),
-    e.object({
-      tenantId: e.string(),
-      clientId: e.string(),
-      clientSecret: e.string()
-    })
-  ]),
+  credentials: e.record(e.string(), e.unknown()),
   settings: e.object({}).optional()
-}), lo = e.object({
-  // The actual refresh token value (primary key).
+}), fo = e.object({
+  // Internal primary key (ULID). Never sent to clients in the new wire format.
   id: e.string(),
   // Link to the login session
   login_id: e.string(),
@@ -2203,31 +2298,44 @@ const oo = e.object({
   idle_expires_at: e.string().optional(),
   // When the token was last used.
   last_exchanged_at: e.string().optional(),
-  device: G,
+  device: W,
   resource_servers: e.array(
     e.object({
       audience: e.string(),
       scopes: e.string()
     })
   ),
-  rotating: e.boolean()
-}), An = e.object({
+  rotating: e.boolean(),
+  // Plaintext lookup slice extracted from the wire token. Indexed for the
+  // refresh-grant path. NULL on legacy (pre-hashing) rows.
+  token_lookup: e.string().optional(),
+  // SHA-256 hex of the secret part of the wire token. NULL on legacy rows.
+  token_hash: e.string().optional(),
+  // Root token id of the rotation chain. NULL on legacy rows; for the first
+  // token in a chain it equals `id`.
+  family_id: e.string().optional(),
+  // Most recently issued child id (debug/traceability). NULL until rotated.
+  rotated_to: e.string().optional(),
+  // ISO of the *first* rotation. Anchors the leeway window so siblings minted
+  // within the window don't extend the parent's exposure.
+  rotated_at: e.string().optional()
+}), Ln = e.object({
   // When the refresh token record was created.
   created_at: e.string(),
   // When the token was explicitly revoked (null = still active).
   revoked_at: e.string().optional(),
   // Spread in the rest of the refresh token properties.
-  ...lo.shape
-}), In = e.object({
+  ...fo.shape
+}), Un = e.object({
   to: e.string(),
   message: e.string()
-}), Cn = e.object({
+}), xn = e.object({
   name: e.string(),
   options: e.object({})
-}), co = e.object({
+}), Eo = e.object({
   value: e.string(),
   description: e.string().optional()
-}), po = e.object({
+}), So = e.object({
   token_dialect: e.enum(["access_token", "access_token_authz"]).optional(),
   enforce_policies: e.boolean().optional(),
   allow_skipping_userinfo: e.boolean().optional(),
@@ -2237,11 +2345,11 @@ const oo = e.object({
   mtls: e.object({
     bound_access_tokens: e.boolean().optional()
   }).optional()
-}), _o = e.object({
+}), yo = e.object({
   id: e.string().optional(),
   name: e.string(),
   identifier: e.string(),
-  scopes: e.array(co).optional(),
+  scopes: e.array(Eo).optional(),
   signing_alg: e.string().optional(),
   signing_secret: e.string().optional(),
   token_lifetime: e.number().default(86400),
@@ -2249,30 +2357,30 @@ const oo = e.object({
   skip_consent_for_verifiable_first_party_clients: e.boolean().optional(),
   allow_offline_access: e.boolean().optional(),
   verificationKey: e.string().optional(),
-  options: po.optional(),
+  options: So.optional(),
   is_system: e.boolean().optional(),
   metadata: e.record(e.any()).optional()
-}), go = e.object({
-  ..._o.shape,
+}), Ao = e.object({
+  ...yo.shape,
   created_at: e.string().optional(),
   updated_at: e.string().optional()
-}), Tn = e.array(go), uo = e.object({
+}), Fn = e.array(Ao), Io = e.object({
   role_id: e.string(),
   resource_server_identifier: e.string(),
   permission_name: e.string()
-}), mo = e.object({
-  ...uo.shape,
+}), Co = e.object({
+  ...Io.shape,
   created_at: e.string()
-}), On = e.array(mo), ho = e.object({
+}), Pn = e.array(Co), To = e.object({
   user_id: e.string(),
   resource_server_identifier: e.string(),
   permission_name: e.string(),
   organization_id: e.string().optional()
-}), bo = e.object({
-  ...ho.shape,
+}), Oo = e.object({
+  ...To.shape,
   tenant_id: e.string(),
   created_at: e.string().optional()
-}), Nn = e.array(bo), fo = e.object({
+}), Mn = e.array(Oo), No = e.object({
   user_id: e.string(),
   resource_server_identifier: e.string(),
   resource_server_name: e.string(),
@@ -2280,17 +2388,17 @@ const oo = e.object({
   description: e.string().nullable().optional(),
   created_at: e.string().optional(),
   organization_id: e.string().optional()
-}), wn = e.array(
-  fo
-), Eo = e.object({
+}), Hn = e.array(
+  No
+), wo = e.object({
   user_id: e.string(),
   role_id: e.string(),
   organization_id: e.string().optional()
-}), So = e.object({
-  ...Eo.shape,
+}), jo = e.object({
+  ...wo.shape,
   tenant_id: e.string(),
   created_at: e.string().optional()
-}), jn = e.array(So), yo = e.object({
+}), Gn = e.array(jo), Ro = e.object({
   id: e.string().optional().openapi({
     description: "The unique identifier of the role. If not provided, one will be generated."
   }),
@@ -2304,13 +2412,13 @@ const oo = e.object({
   metadata: e.record(e.any()).optional().openapi({
     description: "Metadata associated with the role. Can be used to control sync behavior in multi-tenancy scenarios."
   })
-}), Ao = yo.extend({
+}), ko = Ro.extend({
   id: e.string().openapi({
     description: "The unique identifier of the role"
   }),
   created_at: e.string().optional(),
   updated_at: e.string().optional()
-}), Rn = e.array(Ao), Io = e.object({
+}), Bn = e.array(ko), Do = e.object({
   logo_url: e.string().optional().openapi({
     description: "URL of the organization's logo"
   }),
@@ -2322,7 +2430,7 @@ const oo = e.object({
       description: "Page background color in hex format (e.g., #FFFFFF)"
     })
   }).optional()
-}).optional(), Co = e.object({
+}).optional(), vo = e.object({
   connection_id: e.string().openapi({
     description: "ID of the connection"
   }),
@@ -2335,7 +2443,7 @@ const oo = e.object({
   is_signup_enabled: e.boolean().default(!0).openapi({
     description: "Whether signup is enabled for this connection"
   })
-}), To = e.object({
+}), Lo = e.object({
   client_credentials: e.object({
     enforce: e.boolean().default(!1).openapi({
       description: "Whether to enforce token quota limits"
@@ -2347,7 +2455,7 @@ const oo = e.object({
       description: "Maximum tokens per hour (0 = unlimited)"
     })
   }).optional()
-}).optional(), Oo = e.object({
+}).optional(), Uo = e.object({
   id: e.string().optional(),
   name: e.string().min(1).regex(/^[a-z0-9_-]+$/, {
     message: "Organization name must be lowercase and can only contain letters, numbers, hyphens, and underscores"
@@ -2357,34 +2465,52 @@ const oo = e.object({
   display_name: e.string().optional().openapi({
     description: "The display name of the organization"
   }),
-  branding: Io,
+  branding: Do,
   metadata: e.record(e.any()).default({}).optional().openapi({
     description: "Custom metadata for the organization"
   }),
-  enabled_connections: e.array(Co).default([]).optional().openapi({
+  enabled_connections: e.array(vo).default([]).optional().openapi({
     description: "List of enabled connections for the organization"
   }),
-  token_quota: To
-}), Dn = e.object({
-  ...Oo.shape,
-  ...s.shape,
+  token_quota: Lo
+}), Wn = e.object({
+  ...Uo.shape,
+  ...r.shape,
   id: e.string(),
   // Override name to be lenient when reading from database (to support existing uppercase names)
   name: e.string().min(1).openapi({
     description: "The name of the organization"
   })
-}), No = e.object({
+}), xo = e.object({
+  connection_id: e.string().openapi({
+    description: "ID of the tenant-level connection to enable for the org."
+  }),
+  assign_membership_on_login: e.boolean().optional().default(!1),
+  show_as_button: e.boolean().optional().default(!0),
+  is_signup_enabled: e.boolean().optional().default(!0)
+}), Fo = e.object({
+  ...xo.shape,
+  // Auth0 includes the embedded connection in GET responses.
+  connection: e.object({
+    name: e.string().optional(),
+    strategy: e.string().optional()
+  }).optional(),
+  created_at: e.string().optional(),
+  updated_at: e.string().optional()
+}), zn = e.array(
+  Fo
+), Po = e.object({
   user_id: e.string().openapi({
     description: "ID of the user"
   }),
   organization_id: e.string().openapi({
     description: "ID of the organization"
   })
-}), Ln = e.object({
-  ...No.shape,
-  ...s.shape,
+}), Kn = e.object({
+  ...Po.shape,
+  ...r.shape,
   id: e.string()
-}), vn = e.object({
+}), qn = e.object({
   // Session settings
   idle_session_lifetime: e.number().default(72),
   session_lifetime: e.number().default(168),
@@ -2484,7 +2610,7 @@ const oo = e.object({
       message: e.string().optional()
     }).optional()
   }).optional()
-}), kn = e.object({
+}), Xn = e.object({
   date: e.string().openapi({
     description: "Date these events occurred in ISO 8601 format",
     example: "2025-12-19"
@@ -2509,10 +2635,10 @@ const oo = e.object({
     description: "Approximate date and time the first event occurred in ISO 8601 format",
     example: "2025-12-19T00:00:00.000Z"
   })
-}), Un = e.number().openapi({
+}), Vn = e.number().openapi({
   description: "Number of active users in the last 30 days",
   example: 1234
-}), wo = e.enum([
+}), Mo = e.enum([
   "login",
   "login-id",
   "login-password",
@@ -2541,17 +2667,17 @@ const oo = e.object({
   "custom-form",
   "login-passwordless",
   "mfa-login-options"
-]), jo = e.record(e.string(), e.record(e.string(), e.string())).openapi({
+]), Ho = e.record(e.string(), e.record(e.string(), e.string())).openapi({
   type: "object",
   additionalProperties: {
     type: "object",
     additionalProperties: { type: "string" }
   }
-}), Fn = e.object({
-  prompt: wo,
+}), Yn = e.object({
+  prompt: Mo,
   language: e.string(),
-  custom_text: jo
-}), xn = {
+  custom_text: Ho
+}), Qn = {
   EMAIL: "email",
   SMS: "sms",
   USERNAME_PASSWORD: "Username-Password-Authentication",
@@ -2566,11 +2692,11 @@ const oo = e.object({
   SAMLP: "samlp",
   WAAD: "waad",
   ADFS: "adfs"
-}, Pn = {
+}, Zn = {
   DATABASE: "database",
   SOCIAL: "social",
   PASSWORDLESS: "passwordless"
-}, Ro = e.enum([
+}, Go = e.enum([
   "phone",
   "totp",
   "email",
@@ -2578,9 +2704,9 @@ const oo = e.object({
   "webauthn-roaming",
   "webauthn-platform",
   "passkey"
-]), B = e.object({
+]), z = e.object({
   user_id: e.string(),
-  type: Ro,
+  type: Go,
   // Phone-specific
   phone_number: e.string().optional(),
   // TOTP-specific
@@ -2595,7 +2721,7 @@ const oo = e.object({
   // Common
   confirmed: e.boolean().default(!1)
 });
-function W(t, o) {
+function K(t, o) {
   t.type === "phone" && !t.phone_number && o.addIssue({
     code: e.ZodIssueCode.custom,
     message: "phone_number is required when type is 'phone'",
@@ -2614,64 +2740,64 @@ function W(t, o) {
     path: ["public_key"]
   }));
 }
-const Mn = B.superRefine(W), Hn = e.object({
-  ...B.shape,
+const $n = z.superRefine(K), Jn = e.object({
+  ...z.shape,
   id: e.string(),
   created_at: e.string(),
   updated_at: e.string()
-}).superRefine(W);
-function Gn(t) {
+}).superRefine(K);
+function ei(t) {
   const [o, i] = t.split("|");
   if (!o || !i)
     throw new Error(`Invalid user_id: ${t}`);
   return { connection: o, id: i };
 }
-function Bn(t) {
+function ti(t) {
   const {
     primary: o,
     secondaries: i,
-    syncMethods: O = ["create", "rawCreate", "update", "remove", "delete", "set"]
-  } = t, E = {
-    get(p, a) {
+    syncMethods: h = ["create", "rawCreate", "update", "remove", "delete", "set"]
+  } = t, S = {
+    get(c, a) {
       if (typeof a == "symbol")
-        return p[a];
-      const _ = p[a];
-      return typeof _ != "function" ? _ : O.includes(a) ? async (...d) => {
-        const S = await _.apply(p, d), g = [];
-        for (const r of i) {
-          const h = r.adapter[a];
-          if (typeof h != "function")
+        return c[a];
+      const d = c[a];
+      return typeof d != "function" ? d : h.includes(a) ? async (..._) => {
+        const y = await d.apply(c, _), g = [];
+        for (const s of i) {
+          const b = s.adapter[a];
+          if (typeof b != "function")
             continue;
-          const y = (async () => {
+          const A = (async () => {
             try {
-              await h.apply(r.adapter, d);
-            } catch (b) {
+              await b.apply(s.adapter, _);
+            } catch (f) {
               try {
-                r.onError ? r.onError(b, a, d) : console.error(
+                s.onError ? s.onError(f, a, _) : console.error(
                   `Passthrough adapter: secondary write failed for ${a}:`,
-                  b
+                  f
                 );
-              } catch (A) {
+              } catch (I) {
                 console.error(
                   `Passthrough adapter: onError handler threw for ${a}:`,
-                  A
+                  I
                 );
               }
             }
           })();
-          r.blocking && g.push(y);
+          s.blocking && g.push(A);
         }
-        return g.length > 0 && await Promise.all(g), S;
-      } : _.bind(p);
+        return g.length > 0 && await Promise.all(g), y;
+      } : d.bind(c);
     }
   };
-  return new Proxy(o, E);
+  return new Proxy(o, S);
 }
-function Wn(t) {
+function oi(t) {
   return t;
 }
-function Kn(t) {
-  var E, p, a, _, d, S, g, r, h, y, b, A;
+function ni(t) {
+  var S, c, a, d, _, y, g, s, b, A, f, I;
   const o = t == null ? void 0 : t.options;
   if (!o)
     return {
@@ -2682,204 +2808,216 @@ function Kn(t) {
     };
   const i = o.attributes;
   if (i) {
-    const K = ((p = (E = i.username) == null ? void 0 : E.identifier) == null ? void 0 : p.active) === !0, z = ((_ = (a = i.email) == null ? void 0 : a.identifier) == null ? void 0 : _.active) !== !1, q = ((S = (d = i.username) == null ? void 0 : d.validation) == null ? void 0 : S.min_length) ?? 1, X = ((r = (g = i.username) == null ? void 0 : g.validation) == null ? void 0 : r.max_length) ?? 15;
+    const q = ((c = (S = i.username) == null ? void 0 : S.identifier) == null ? void 0 : c.active) === !0, X = ((d = (a = i.email) == null ? void 0 : a.identifier) == null ? void 0 : d.active) !== !1, V = ((y = (_ = i.username) == null ? void 0 : _.validation) == null ? void 0 : y.min_length) ?? 1, Y = ((s = (g = i.username) == null ? void 0 : g.validation) == null ? void 0 : s.max_length) ?? 15;
     return {
-      usernameIdentifierActive: K,
-      emailIdentifierActive: z,
-      usernameMinLength: q,
-      usernameMaxLength: X
+      usernameIdentifierActive: q,
+      emailIdentifierActive: X,
+      usernameMinLength: V,
+      usernameMaxLength: Y
     };
   }
   return {
     usernameIdentifierActive: o.requires_username === !0,
     emailIdentifierActive: !0,
-    usernameMinLength: ((y = (h = o.validation) == null ? void 0 : h.username) == null ? void 0 : y.min) ?? 1,
-    usernameMaxLength: ((A = (b = o.validation) == null ? void 0 : b.username) == null ? void 0 : A.max) ?? 15
+    usernameMinLength: ((A = (b = o.validation) == null ? void 0 : b.username) == null ? void 0 : A.min) ?? 1,
+    usernameMaxLength: ((I = (f = o.validation) == null ? void 0 : f.username) == null ? void 0 : I.max) ?? 15
   };
 }
-function zn(t) {
+function ii(t) {
   return typeof t == "object" && t !== null && !Array.isArray(t);
 }
 export {
-  Fo as Auth0ActionEnum,
-  Yt as Auth0Client,
-  L as AuthorizationResponseMode,
+  Xo as Auth0ActionEnum,
+  Zt as Auth0Client,
+  v as AuthorizationResponseMode,
   D as AuthorizationResponseType,
-  v as CodeChallengeMethod,
-  R as ComponentCategory,
-  j as ComponentType,
-  xo as EmailActionEnum,
-  Zo as FORM_FIELD_TYPES,
-  Uo as FlowActionTypeEnum,
-  to as GrantType,
-  Qt as LocationInfo,
-  Xt as LogTypes,
-  H as LoginSessionState,
-  Re as NodeType,
-  le as RedirectTargetEnum,
-  xn as Strategy,
-  Pn as StrategyType,
-  Y as actionDependencySchema,
-  N as actionInsertSchema,
-  ve as actionNodeSchema,
-  vo as actionSchema,
-  Q as actionSecretSchema,
-  V as actionTriggerSchema,
-  Lo as actionUpdateSchema,
-  Un as activeUsersResponseSchema,
-  $ as actorSchema,
-  ue as addressSchema,
-  Z as auditCategorySchema,
-  ie as auditEventInsertSchema,
-  ko as auditEventSchema,
-  ne as auth0ClientSchema,
-  qo as auth0FlowInsertSchema,
-  Pe as auth0FlowSchema,
-  Mo as auth0QuerySchema,
-  se as auth0UpdateUserActionSchema,
-  Go as auth0UserResponseSchema,
-  Me as authParamsSchema,
-  Mn as authenticationMethodInsertSchema,
-  Hn as authenticationMethodSchema,
-  Ro as authenticationMethodTypeSchema,
-  w as baseUserSchema,
-  yt as blockComponentSchema,
-  oo as bordersSchema,
-  Xo as brandingSchema,
-  Te as buttonComponentSchema,
-  Se as clientGrantInsertSchema,
-  Ko as clientGrantListSchema,
-  ye as clientGrantSchema,
-  Ee as clientInsertSchema,
-  Ie as clientRegistrationTokenInsertSchema,
-  zo as clientRegistrationTokenSchema,
-  Ae as clientRegistrationTokenTypeSchema,
-  Wo as clientSchema,
-  Ge as codeInsertSchema,
-  Vo as codeSchema,
-  He as codeTypeSchema,
-  no as colorsSchema,
-  jt as componentMessageSchema,
-  je as componentSchema,
-  We as connectionInsertSchema,
-  Be as connectionOptionsSchema,
-  Yo as connectionSchema,
+  L as CodeChallengeMethod,
+  k as ComponentCategory,
+  R as ComponentType,
+  Vo as EmailActionEnum,
+  pn as FORM_FIELD_TYPES,
+  qo as FlowActionTypeEnum,
+  co as GrantType,
+  $t as LocationInfo,
+  Yt as LogTypes,
+  G as LoginSessionState,
+  De as NodeType,
+  ce as RedirectTargetEnum,
+  Qn as Strategy,
+  Zn as StrategyType,
+  Z as actionDependencySchema,
+  w as actionInsertSchema,
+  Ue as actionNodeSchema,
+  zo as actionSchema,
+  $ as actionSecretSchema,
+  Q as actionTriggerSchema,
+  Wo as actionUpdateSchema,
+  Vn as activeUsersResponseSchema,
+  ee as actorSchema,
+  he as addressSchema,
+  ro as attackProtectionSchema,
+  J as auditCategorySchema,
+  re as auditEventInsertSchema,
+  Ko as auditEventSchema,
+  ae as auth0ClientSchema,
+  nn as auth0FlowInsertSchema,
+  He as auth0FlowSchema,
+  Qo as auth0QuerySchema,
+  le as auth0UpdateUserActionSchema,
+  $o as auth0UserResponseSchema,
+  Ge as authParamsSchema,
+  $n as authenticationMethodInsertSchema,
+  Jn as authenticationMethodSchema,
+  Go as authenticationMethodTypeSchema,
+  j as baseUserSchema,
+  It as blockComponentSchema,
+  _o as bordersSchema,
+  an as brandingSchema,
+  no as breachedPasswordDetectionSchema,
+  io as bruteForceProtectionSchema,
+  Ne as buttonComponentSchema,
+  Ae as clientGrantInsertSchema,
+  tn as clientGrantListSchema,
+  Ie as clientGrantSchema,
+  ye as clientInsertSchema,
+  Te as clientRegistrationTokenInsertSchema,
+  on as clientRegistrationTokenSchema,
+  Ce as clientRegistrationTokenTypeSchema,
+  en as clientSchema,
+  We as codeInsertSchema,
+  rn as codeSchema,
+  Be as codeTypeSchema,
+  go as colorsSchema,
+  kt as componentMessageSchema,
+  ke as componentSchema,
+  Ke as connectionInsertSchema,
+  ze as connectionOptionsSchema,
+  sn as connectionSchema,
   m as coordinatesSchema,
-  Bn as createPassthroughAdapter,
-  Wn as createWriteOnlyAdapter,
-  Ke as customDomainInsertSchema,
-  qe as customDomainSchema,
-  Qo as customDomainWithTenantIdSchema,
-  Fn as customTextEntrySchema,
-  jo as customTextSchema,
-  kn as dailyStatsSchema,
-  yn as emailProviderSchema,
-  ae as emailVerificationRulesSchema,
-  re as emailVerifyActionSchema,
-  xe as endingSchema,
-  It as fieldComponentSchema,
-  pe as flowActionStepSchema,
-  _e as flowInsertSchema,
-  Po as flowSchema,
-  Ne as flowsFieldComponentSchema,
+  ti as createPassthroughAdapter,
+  oi as createWriteOnlyAdapter,
+  qe as customDomainInsertSchema,
+  Ve as customDomainSchema,
+  ln as customDomainWithTenantIdSchema,
+  Yn as customTextEntrySchema,
+  Ho as customTextSchema,
+  Xn as dailyStatsSchema,
+  vn as emailProviderSchema,
+  se as emailVerificationRulesSchema,
+  pe as emailVerifyActionSchema,
+  Me as endingSchema,
+  Tt as fieldComponentSchema,
+  _e as flowActionStepSchema,
+  ge as flowInsertSchema,
+  Yo as flowSchema,
+  je as flowsFieldComponentSchema,
   Le as flowsFlowNodeSchema,
-  De as flowsStepNodeSchema,
+  ve as flowsStepNodeSchema,
   u as fontDetailsSchema,
-  io as fontsSchema,
-  $o as formControlSchema,
-  wt as formInsertSchema,
-  k as formNodeComponentDefinition,
-  Nt as formNodeSchema,
-  Jo as formSchema,
-  we as genericComponentSchema,
-  ke as genericNodeSchema,
-  Kn as getConnectionIdentifierConfig,
-  Mt as hookCodeInsertSchema,
-  ln as hookCodeSchema,
-  sn as hookInsertSchema,
-  rn as hookSchema,
-  M as hookTemplateId,
-  an as hookTemplates,
-  ge as identitySchema,
-  Bt as inviteInsertSchema,
-  cn as inviteSchema,
-  Gt as inviteeSchema,
-  Ht as inviterSchema,
-  tn as isBlockComponent,
-  nn as isFieldComponent,
-  zn as isPlainObject,
-  on as isWidgetComponent,
-  pn as jwksKeySchema,
-  Wt as jwksSchema,
-  Oe as legalComponentSchema,
-  oe as locationInfoSchema,
-  Zt as logInsertSchema,
-  gn as logSchema,
-  zt as loginSessionAuthStrategySchema,
-  qt as loginSessionInsertSchema,
-  dn as loginSessionSchema,
-  Kt as loginSessionStateSchema,
-  Ue as nodeSchema,
-  _n as openIDConfigurationSchema,
-  Io as organizationBrandingSchema,
-  Co as organizationEnabledConnectionSchema,
-  Oo as organizationInsertSchema,
-  Dn as organizationSchema,
-  To as organizationTokenQuotaSchema,
-  ao as pageBackgroundSchema,
-  Gn as parseUserId,
-  $t as passwordInsertSchema,
-  un as passwordSchema,
-  de as profileDataSchema,
-  wo as promptScreenSchema,
-  Sn as promptSettingSchema,
-  ce as redirectActionSchema,
-  lo as refreshTokenInsertSchema,
-  An as refreshTokenSchema,
-  ee as requestContextSchema,
-  _o as resourceServerInsertSchema,
-  Tn as resourceServerListSchema,
-  po as resourceServerOptionsSchema,
-  go as resourceServerSchema,
-  co as resourceServerScopeSchema,
-  te as responseContextSchema,
-  Ce as richTextComponentSchema,
-  yo as roleInsertSchema,
-  Rn as roleListSchema,
-  uo as rolePermissionInsertSchema,
-  On as rolePermissionListSchema,
-  mo as rolePermissionSchema,
-  Ao as roleSchema,
-  Rt as screenLinkSchema,
-  Jt as sessionInsertSchema,
-  mn as sessionSchema,
-  hn as signingKeySchema,
-  Cn as smsProviderSchema,
-  In as smsSendParamsSchema,
-  Fe as startSchema,
-  J as targetSchema,
-  eo as tenantInsertSchema,
-  bn as tenantSchema,
-  vn as tenantSettingsSchema,
-  ro as themeInsertSchema,
-  En as themeSchema,
-  fn as tokenResponseSchema,
-  Ho as totalsSchema,
-  en as uiScreenSchema,
-  me as userInsertSchema,
-  No as userOrganizationInsertSchema,
-  Ln as userOrganizationSchema,
-  ho as userPermissionInsertSchema,
-  Nn as userPermissionListSchema,
-  bo as userPermissionSchema,
-  wn as userPermissionWithDetailsListSchema,
-  fo as userPermissionWithDetailsSchema,
-  Bo as userResponseSchema,
-  Eo as userRoleInsertSchema,
-  jn as userRoleListSchema,
-  So as userRoleSchema,
-  he as userSchema,
-  ze as verificationMethodsSchema,
-  At as widgetComponentSchema,
-  so as widgetSchema
+  uo as fontsSchema,
+  cn as formControlSchema,
+  Rt as formInsertSchema,
+  U as formNodeComponentDefinition,
+  jt as formNodeSchema,
+  dn as formSchema,
+  Re as genericComponentSchema,
+  xe as genericNodeSchema,
+  ni as getConnectionIdentifierConfig,
+  Gt as hookCodeInsertSchema,
+  En as hookCodeSchema,
+  bn as hookInsertSchema,
+  fn as hookSchema,
+  H as hookTemplateId,
+  hn as hookTemplates,
+  me as identitySchema,
+  zt as inviteInsertSchema,
+  Sn as inviteSchema,
+  Wt as inviteeSchema,
+  Bt as inviterSchema,
+  gn as isBlockComponent,
+  mn as isFieldComponent,
+  ii as isPlainObject,
+  un as isWidgetComponent,
+  yn as jwksKeySchema,
+  Kt as jwksSchema,
+  we as legalComponentSchema,
+  ie as locationInfoSchema,
+  Jt as logInsertSchema,
+  Cn as logSchema,
+  to as logStreamFilterSchema,
+  oo as logStreamInsertSchema,
+  Tn as logStreamSchema,
+  B as logStreamStatusSchema,
+  eo as logStreamTypeSchema,
+  Xt as loginSessionAuthStrategySchema,
+  Vt as loginSessionInsertSchema,
+  In as loginSessionSchema,
+  qt as loginSessionStateSchema,
+  Fe as nodeSchema,
+  An as openIDConfigurationSchema,
+  Do as organizationBrandingSchema,
+  xo as organizationConnectionInsertSchema,
+  zn as organizationConnectionListSchema,
+  Fo as organizationConnectionSchema,
+  vo as organizationEnabledConnectionSchema,
+  Uo as organizationInsertSchema,
+  Wn as organizationSchema,
+  Lo as organizationTokenQuotaSchema,
+  mo as pageBackgroundSchema,
+  ei as parseUserId,
+  so as passwordInsertSchema,
+  On as passwordSchema,
+  ue as profileDataSchema,
+  Mo as promptScreenSchema,
+  Dn as promptSettingSchema,
+  de as redirectActionSchema,
+  fo as refreshTokenInsertSchema,
+  Ln as refreshTokenSchema,
+  oe as requestContextSchema,
+  yo as resourceServerInsertSchema,
+  Fn as resourceServerListSchema,
+  So as resourceServerOptionsSchema,
+  Ao as resourceServerSchema,
+  Eo as resourceServerScopeSchema,
+  ne as responseContextSchema,
+  Oe as richTextComponentSchema,
+  Ro as roleInsertSchema,
+  Bn as roleListSchema,
+  Io as rolePermissionInsertSchema,
+  Pn as rolePermissionListSchema,
+  Co as rolePermissionSchema,
+  ko as roleSchema,
+  Dt as screenLinkSchema,
+  lo as sessionInsertSchema,
+  Nn as sessionSchema,
+  wn as signingKeySchema,
+  xn as smsProviderSchema,
+  Un as smsSendParamsSchema,
+  Pe as startSchema,
+  ao as suspiciousIpThrottlingSchema,
+  te as targetSchema,
+  po as tenantInsertSchema,
+  jn as tenantSchema,
+  qn as tenantSettingsSchema,
+  bo as themeInsertSchema,
+  kn as themeSchema,
+  Rn as tokenResponseSchema,
+  Zo as totalsSchema,
+  _n as uiScreenSchema,
+  be as userInsertSchema,
+  Po as userOrganizationInsertSchema,
+  Kn as userOrganizationSchema,
+  To as userPermissionInsertSchema,
+  Mn as userPermissionListSchema,
+  Oo as userPermissionSchema,
+  Hn as userPermissionWithDetailsListSchema,
+  No as userPermissionWithDetailsSchema,
+  Jo as userResponseSchema,
+  wo as userRoleInsertSchema,
+  Gn as userRoleListSchema,
+  jo as userRoleSchema,
+  fe as userSchema,
+  Xe as verificationMethodsSchema,
+  Ct as widgetComponentSchema,
+  ho as widgetSchema
 };