@authhero/adapter-interfaces 1.18.0 → 2.0.0

package/dist/adapter-interfaces.mjs

@@ -2,28 +2,36 @@ import { z as e } from "@hono/zod-openapi";
 const a = e.object({
   created_at: e.string(),
   updated_at: e.string()
-}), w = e.object({
+}), j = e.object({
   id: e.string(),
   version: e.string().optional()
-}), j = e.object({
+}), k = e.object({
   name: e.string(),
   version: e.string()
-}), k = e.object({
+}), R = e.object({
   name: e.string(),
   // Optional on writes so PATCH callers can omit the value to preserve the
   // existing secret. The adapter merges by name when value is missing.
   value: e.string().optional()
-}), R = e.object({
+}), v = e.object({
   name: e.string().max(255),
   code: e.string().max(1e5),
-  supported_triggers: e.array(w).optional(),
+  supported_triggers: e.array(j).optional(),
   runtime: e.string().max(50).optional(),
-  dependencies: e.array(j).optional(),
-  secrets: e.array(k).optional()
-}), zo = R.partial().extend({
+  dependencies: e.array(k).optional(),
+  secrets: e.array(R).optional(),
+  // Marks this action as a shared template owned by the control-plane tenant.
+  // Other tenants can opt-in by creating a row with the same `name` and
+  // `inherit: true`; at execute time the loader reads code from this row.
+  is_system: e.boolean().optional(),
+  // On a non-control-plane tenant, indicates the action's `code` should be
+  // read through from the control-plane system action with a matching name.
+  // The local `secrets` still override (local-first then upstream fallback).
+  inherit: e.boolean().optional()
+}), en = v.partial().extend({
   status: e.enum(["draft", "built"]).optional(),
   deployed_at: e.string().optional()
-}), qo = R.extend({
+}), tn = v.extend({
   id: e.string(),
   tenant_id: e.string(),
   status: e.enum(["draft", "built"]).default("built"),
@@ -36,25 +44,62 @@ const a = e.object({
     })
   ).optional(),
   ...a.shape
-}), J = e.object({
+}), ee = e.string(), te = e.enum([
+  "unspecified",
+  "pending",
+  "final",
+  "partial",
+  "canceled",
+  "suspended"
+]), oe = e.object({
+  id: e.string(),
+  msg: e.string(),
+  url: e.string().optional()
+}), ne = e.object({
+  action_name: e.string(),
+  error: oe.nullable(),
+  started_at: e.string(),
+  ended_at: e.string()
+}), ie = e.object({
+  level: e.enum(["log", "info", "warn", "error", "debug"]),
+  message: e.string()
+}), ae = e.array(
+  e.object({
+    action_name: e.string(),
+    lines: e.array(ie)
+  })
+), re = e.object({
+  id: e.string(),
+  tenant_id: e.string(),
+  trigger_id: ee,
+  status: te,
+  results: e.array(ne),
+  logs: ae.optional(),
+  created_at: e.string(),
+  updated_at: e.string()
+}), on = re.omit({
+  tenant_id: !0,
+  created_at: !0,
+  updated_at: !0
+}), se = e.object({
   action_id: e.string(),
   code: e.string().max(1e5),
   runtime: e.string().max(50).optional(),
-  dependencies: e.array(j).optional(),
-  secrets: e.array(k).optional(),
-  supported_triggers: e.array(w).optional(),
+  dependencies: e.array(k).optional(),
+  secrets: e.array(R).optional(),
+  supported_triggers: e.array(j).optional(),
   deployed: e.boolean().default(!0)
-}), Vo = J.extend({
+}), nn = se.extend({
   id: e.string(),
   tenant_id: e.string(),
   number: e.number().int(),
   ...a.shape
-}), ee = e.enum([
+}), le = e.enum([
   "user_action",
   "admin_action",
   "system",
   "api"
-]), te = e.object({
+]), ce = e.object({
   type: e.enum(["user", "admin", "system", "api_key", "client_credentials"]),
   id: e.string().optional(),
   email: e.string().optional(),
@@ -62,13 +107,13 @@ const a = e.object({
   org_name: e.string().optional(),
   scopes: e.array(e.string()).optional(),
   client_id: e.string().optional()
-}), oe = e.object({
+}), pe = e.object({
   type: e.string(),
   id: e.string(),
   before: e.record(e.unknown()).optional(),
   after: e.record(e.unknown()).optional(),
   diff: e.record(e.object({ old: e.unknown(), new: e.unknown() })).optional()
-}), ne = e.object({
+}), de = e.object({
   method: e.string(),
   path: e.string(),
   query: e.record(e.string()).optional(),
@@ -76,56 +121,56 @@ const a = e.object({
   ip: e.string(),
   user_agent: e.string().optional(),
   correlation_id: e.string().optional()
-}), ie = e.object({
+}), _e = e.object({
   status_code: e.number(),
   body: e.unknown().optional()
-}), ae = e.object({
+}), ge = e.object({
   country_code: e.string(),
   city_name: e.string(),
   latitude: e.string(),
   longitude: e.string(),
   time_zone: e.string(),
   continent_code: e.string()
-}), re = e.object({
+}), ue = e.object({
   name: e.string(),
   version: e.string(),
   env: e.record(e.string()).optional()
-}), se = e.object({
+}), me = e.object({
   tenant_id: e.string(),
   event_type: e.string(),
   log_type: e.string(),
   description: e.string().optional(),
-  category: ee,
-  actor: te,
-  target: oe,
-  request: ne,
-  response: ie.optional(),
+  category: le,
+  actor: ce,
+  target: pe,
+  request: de,
+  response: _e.optional(),
   connection: e.string().optional(),
   strategy: e.string().optional(),
   strategy_type: e.string().optional(),
   audience: e.string().optional(),
   scope: e.string().optional(),
-  location: ae.optional(),
-  auth0_client: re.optional(),
+  location: ge.optional(),
+  auth0_client: ue.optional(),
   hostname: e.string(),
   is_mobile: e.boolean().optional(),
   timestamp: e.string()
-}), Xo = se.extend({
+}), an = me.extend({
   id: e.string()
-}), Yo = e.enum(["AUTH0", "EMAIL", "REDIRECT"]), Zo = e.enum([
+}), rn = e.enum(["AUTH0", "EMAIL", "REDIRECT"]), sn = e.enum([
   "CREATE_USER",
   "GET_USER",
   "UPDATE_USER",
   "SEND_REQUEST",
   "SEND_EMAIL"
-]), Qo = e.enum(["VERIFY_EMAIL"]), le = e.object({
+]), ln = e.enum(["VERIFY_EMAIL"]), he = e.object({
   require_mx_record: e.boolean().optional(),
   block_aliases: e.boolean().optional(),
   block_free_emails: e.boolean().optional(),
   block_disposable_emails: e.boolean().optional(),
   blocklist: e.array(e.string()).optional(),
   allowlist: e.array(e.string()).optional()
-}), pe = e.object({
+}), be = e.object({
   id: e.string(),
   alias: e.string().max(100).optional(),
   type: e.literal("AUTH0"),
@@ -137,7 +182,7 @@ const a = e.object({
     user_id: e.string(),
     changes: e.record(e.string(), e.any())
   })
-}), ce = e.object({
+}), fe = e.object({
   id: e.string(),
   alias: e.string().max(100).optional(),
   type: e.literal("EMAIL"),
@@ -146,9 +191,9 @@ const a = e.object({
   mask_output: e.boolean().optional(),
   params: e.object({
     email: e.string(),
-    rules: le.optional()
+    rules: he.optional()
   })
-}), de = e.enum(["change-email", "account", "custom"]), _e = e.object({
+}), Ee = e.enum(["change-email", "account", "custom"]), Se = e.object({
   id: e.string(),
   alias: e.string().max(100).optional(),
   type: e.literal("REDIRECT"),
@@ -156,32 +201,32 @@ const a = e.object({
   allow_failure: e.boolean().optional(),
   mask_output: e.boolean().optional(),
   params: e.object({
-    target: de.openapi({
+    target: Ee.openapi({
       description: "The predefined target to redirect to, or 'custom' for a custom URL"
     }),
     custom_url: e.string().optional().openapi({
       description: "Custom URL to redirect to when target is 'custom'"
     })
   })
-}), ge = e.union([
-  pe,
-  ce,
-  _e
-]), ue = e.object({
+}), ye = e.union([
+  be,
+  fe,
+  Se
+]), Ae = e.object({
   name: e.string().min(1).max(150).openapi({
     description: "The name of the flow"
   }),
   // Actions is an array of action steps (Auth0 stores as JSON blob)
-  actions: e.array(ge).optional().default([]).openapi({
+  actions: e.array(ye).optional().default([]).openapi({
     description: "The list of actions to execute in sequence"
   })
-}), $o = ue.extend({
+}), cn = Ae.extend({
   ...a.shape,
   id: e.string().openapi({
     description: "Unique identifier for the flow",
     example: "af_12tMpdJ3iek7svMyZkSh5M"
   })
-}), Jo = e.object({
+}), pn = e.object({
   page: e.string().min(0).optional().default("0").transform((t) => parseInt(t, 10)).openapi({
     description: "The page number where 0 is the first page"
   }),
@@ -197,12 +242,12 @@ const a = e.object({
   q: e.string().optional().openapi({
     description: "A lucene query string used to filter the results"
   })
-}), en = e.object({
+}), dn = e.object({
   start: e.number(),
   limit: e.number(),
   length: e.number(),
   total: e.number().optional()
-}), me = e.object({
+}), Ie = e.object({
   email: e.string().optional(),
   email_verified: e.boolean().optional(),
   name: e.string().optional(),
@@ -211,7 +256,7 @@ const a = e.object({
   phone_number: e.string().optional(),
   phone_verified: e.boolean().optional(),
   family_name: e.string().optional()
-}).catchall(e.any()), he = e.object({
+}).catchall(e.any()), Ce = e.object({
   connection: e.string(),
   user_id: e.string(),
   provider: e.string(),
@@ -224,8 +269,8 @@ const a = e.object({
   access_token: e.string().optional(),
   access_token_secret: e.string().optional(),
   refresh_token: e.string().optional(),
-  profileData: me.optional()
-}), be = e.object({
+  profileData: Ie.optional()
+}), Te = e.object({
   formatted: e.string().optional(),
   // Full mailing address
   street_address: e.string().optional(),
@@ -238,7 +283,7 @@ const a = e.object({
   // Zip code or postal code
   country: e.string().optional()
   // Country name
-}).optional(), v = e.object({
+}).optional(), D = e.object({
   email: e.string().optional().transform((t) => t && t.toLowerCase()),
   username: e.string().refine((t) => !t.includes("@"), {
     message: 'Usernames must not contain "@". Use the email field for email addresses.'
@@ -270,8 +315,8 @@ const a = e.object({
   zoneinfo: e.string().optional(),
   // e.g., "Europe/Paris"
   // OIDC address claim (OIDC Core 5.1.1)
-  address: be
-}), fe = v.extend({
+  address: Te
+}), Oe = D.extend({
   email_verified: e.boolean().default(!1),
   verify_email: e.boolean().optional(),
   last_ip: e.string().optional(),
@@ -294,31 +339,31 @@ const a = e.object({
     hash: e.string(),
     algorithm: e.string()
   }).optional()
-}), Ee = e.object({
-  ...fe.omit({ password: !0 }).shape,
+}), Ne = e.object({
+  ...Oe.omit({ password: !0 }).shape,
   ...a.shape,
   user_id: e.string(),
   provider: e.string(),
   is_social: e.boolean(),
   email: e.string().optional(),
   login_count: e.number().default(0),
-  identities: e.array(he).optional()
-}), tn = Ee.omit({
+  identities: e.array(Ce).optional()
+}), _n = Ne.omit({
   registration_completed_at: !0
-}), on = v.extend({
+}), gn = D.extend({
   login_count: e.number(),
   multifactor: e.array(e.string()).optional(),
   last_ip: e.string().optional(),
   last_login: e.string().optional(),
   user_id: e.string()
 }).catchall(e.any());
-let Se = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict", ye = (t = 21) => {
+let we = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict", je = (t = 21) => {
   let o = "", n = crypto.getRandomValues(new Uint8Array(t |= 0));
   for (; t--; )
-    o += Se[n[t] & 63];
+    o += we[n[t] & 63];
   return o;
 };
-const Ae = e.object({
+const ke = e.object({
   client_id: e.string().optional().openapi({
     description: "ID of this client. Generated server-side if omitted (Auth0 behavior)."
   }),
@@ -331,7 +376,7 @@ const Ae = e.object({
   global: e.boolean().default(!1).openapi({
     description: "Whether this is your global 'All Applications' client representing legacy tenant settings (true) or a regular client (false)."
   }),
-  client_secret: e.string().default(() => ye()).optional().openapi({
+  client_secret: e.string().default(() => je()).optional().openapi({
     description: "Client secret (which you must not make public)."
   }),
   app_type: e.enum([
@@ -453,6 +498,9 @@ const Ae = e.object({
   client_metadata: e.record(e.string().max(255)).default({}).optional().openapi({
     description: 'Metadata associated with the client, in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. Field names (max 255 chars) are alphanumeric and may only include the following special characters: :,-+=_*?"/()<>@ [Tab][Space]'
   }),
+  hide_sign_up_disabled_error: e.boolean().default(!1).optional().openapi({
+    description: "Enumeration-safe variant of the connection-level `disable_signup` flag. When a signup is blocked by the password connection and this is true, the identifier screen does not reveal that an email is unknown — it advances to the OTP/password challenge as if the account existed and fails at credential check. Mitigates email enumeration at the cost of UX: users without an account see a generic credential failure instead of an explicit signup-disabled message."
+  }),
   mobile: e.record(e.any()).default({}).optional().openapi({
     description: "Additional configuration for native mobile apps."
   }),
@@ -536,14 +584,14 @@ const Ae = e.object({
   user_linking_mode: e.enum(["builtin", "off"]).optional().openapi({
     description: "Per-client override for the built-in email-based user-linking path. `builtin` runs the legacy in-process linking at user creation/email update. `off` disables the legacy path; linking only happens if the tenant has enabled the `account-linking` template hook. When unset, the service-level `userLinkingMode` default applies."
   })
-}), nn = e.object({
+}), un = e.object({
   created_at: e.string(),
   updated_at: e.string(),
-  ...Ae.shape,
+  ...ke.shape,
   // Insert allows omitting (server-generated to match Auth0). The read schema
   // always has it — the row in storage is non-null.
   client_id: e.string()
-}), Ie = e.object({
+}), Re = e.object({
   client_id: e.string().min(1).openapi({
     description: "ID of the client."
   }),
@@ -568,37 +616,37 @@ const Ae = e.object({
   authorization_details_types: e.array(e.string()).optional().openapi({
     description: "Types of authorization_details allowed for this client grant. Use of this field is subject to the applicable Free Trial terms in Okta's Master Subscription Agreement."
   })
-}), Ce = e.object({
+}), ve = e.object({
   id: e.string().openapi({
     description: "ID of the client grant."
   }),
-  ...Ie.shape,
+  ...Re.shape,
   created_at: e.string().optional(),
   updated_at: e.string().optional()
-}), an = e.array(Ce), Te = e.enum(["iat", "rat"]), Oe = e.object({
+}), mn = e.array(ve), De = e.enum(["iat", "rat"]), Le = e.object({
   id: e.string(),
   token_hash: e.string(),
-  type: Te,
+  type: De,
   client_id: e.string().optional(),
   sub: e.string().optional(),
   constraints: e.record(e.unknown()).optional(),
   single_use: e.boolean().default(!1),
   expires_at: e.string().optional()
-}), rn = e.object({
+}), hn = e.object({
   created_at: e.string(),
   used_at: e.string().optional(),
   revoked_at: e.string().optional(),
-  ...Oe.shape
+  ...Le.shape
 }), m = e.object({
   x: e.number(),
   y: e.number()
 });
-var D = /* @__PURE__ */ ((t) => (t.RICH_TEXT = "RICH_TEXT", t.NEXT_BUTTON = "NEXT_BUTTON", t.BACK_BUTTON = "BACK_BUTTON", t.SUBMIT_BUTTON = "SUBMIT_BUTTON", t.DIVIDER = "DIVIDER", t.TEXT = "TEXT", t.EMAIL = "EMAIL", t.PASSWORD = "PASSWORD", t.NUMBER = "NUMBER", t.PHONE = "PHONE", t.DATE = "DATE", t.CHECKBOX = "CHECKBOX", t.RADIO = "RADIO", t.SELECT = "SELECT", t.HIDDEN = "HIDDEN", t.LEGAL = "LEGAL", t))(D || {}), L = /* @__PURE__ */ ((t) => (t.BLOCK = "BLOCK", t.FIELD = "FIELD", t))(L || {});
+var L = /* @__PURE__ */ ((t) => (t.RICH_TEXT = "RICH_TEXT", t.NEXT_BUTTON = "NEXT_BUTTON", t.BACK_BUTTON = "BACK_BUTTON", t.SUBMIT_BUTTON = "SUBMIT_BUTTON", t.DIVIDER = "DIVIDER", t.TEXT = "TEXT", t.EMAIL = "EMAIL", t.PASSWORD = "PASSWORD", t.NUMBER = "NUMBER", t.PHONE = "PHONE", t.DATE = "DATE", t.CHECKBOX = "CHECKBOX", t.RADIO = "RADIO", t.SELECT = "SELECT", t.HIDDEN = "HIDDEN", t.LEGAL = "LEGAL", t))(L || {}), x = /* @__PURE__ */ ((t) => (t.BLOCK = "BLOCK", t.FIELD = "FIELD", t))(x || {});
 const C = e.object({
   id: e.string(),
-  category: e.nativeEnum(L),
-  type: e.nativeEnum(D)
-}), Ne = C.extend({
+  category: e.nativeEnum(x),
+  type: e.nativeEnum(L)
+}), xe = C.extend({
   category: e.literal(
     "BLOCK"
     /* BLOCK */
@@ -610,7 +658,7 @@ const C = e.object({
   config: e.object({
     content: e.string()
   }).passthrough()
-}), we = C.extend({
+}), Ue = C.extend({
   category: e.literal(
     "BLOCK"
     /* BLOCK */
@@ -632,7 +680,7 @@ const C = e.object({
   config: e.object({
     text: e.string()
   }).passthrough()
-}), je = C.extend({
+}), Fe = C.extend({
   category: e.literal(
     "FIELD"
     /* FIELD */
@@ -646,7 +694,7 @@ const C = e.object({
   config: e.object({
     text: e.string()
   }).passthrough()
-}), ke = C.extend({
+}), Pe = C.extend({
   category: e.literal(
     "FIELD"
     /* FIELD */
@@ -699,19 +747,19 @@ const C = e.object({
     label: e.string().optional(),
     placeholder: e.string().optional()
   }).passthrough()
-}), Re = e.object({
+}), Me = e.object({
   id: e.string(),
   category: e.string(),
   type: e.string()
-}).passthrough(), ve = e.union([
-  Ne,
-  we,
-  je,
-  ke,
-  Re
+}).passthrough(), He = e.union([
+  xe,
+  Ue,
+  Fe,
+  Pe,
+  Me
 ]);
-var De = /* @__PURE__ */ ((t) => (t.STEP = "STEP", t.FLOW = "FLOW", t.CONDITION = "CONDITION", t.ACTION = "ACTION", t))(De || {});
-const Le = e.object({
+var Ge = /* @__PURE__ */ ((t) => (t.STEP = "STEP", t.FLOW = "FLOW", t.CONDITION = "CONDITION", t.ACTION = "ACTION", t))(Ge || {});
+const Be = e.object({
   id: e.string(),
   type: e.literal(
     "STEP"
@@ -720,10 +768,10 @@ const Le = e.object({
   coordinates: m,
   alias: e.string().optional(),
   config: e.object({
-    components: e.array(ve),
+    components: e.array(He),
     next_node: e.string()
   }).passthrough()
-}), Ue = e.object({
+}), We = e.object({
   id: e.string(),
   type: e.literal(
     "FLOW"
@@ -735,7 +783,7 @@ const Le = e.object({
     flow_id: e.string(),
     next_node: e.string()
   })
-}), xe = e.object({
+}), Ke = e.object({
   id: e.string(),
   type: e.literal(
     "ACTION"
@@ -757,47 +805,57 @@ const Le = e.object({
       description: "The next node to navigate to after action (for non-redirect actions)"
     })
   }).passthrough()
-}), Fe = e.object({
+}), ze = e.object({
   id: e.string(),
   type: e.string(),
   coordinates: m
-}).passthrough(), Pe = e.union([
-  Le,
-  Ue,
-  xe,
-  Fe
-]), Me = e.object({
+}).passthrough(), qe = e.union([
+  Be,
+  We,
+  Ke,
+  ze
+]), Xe = e.object({
   next_node: e.string(),
   coordinates: m
-}).passthrough(), He = e.object({
+}).passthrough(), Ve = e.object({
   resume_flow: e.boolean().optional(),
   coordinates: m
-}).passthrough(), Ge = e.object({
+}).passthrough(), Ye = e.object({
   id: e.string(),
   name: e.string(),
   languages: e.object({
     primary: e.string()
   }).passthrough(),
-  nodes: e.array(Pe),
-  start: Me,
-  ending: He,
+  nodes: e.array(qe),
+  start: Xe,
+  ending: Ve,
   created_at: e.string(),
   updated_at: e.string(),
   links: e.object({
     sdkSrc: e.string().optional(),
     sdk_src: e.string().optional()
   }).passthrough()
-}).passthrough(), sn = Ge.omit({
+}).passthrough(), bn = Ye.omit({
   id: !0,
   created_at: !0,
   updated_at: !0
 });
-var U = /* @__PURE__ */ ((t) => (t.TOKEN = "token", t.ID_TOKEN = "id_token", t.TOKEN_ID_TOKEN = "id_token token", t.CODE = "code", t.CODE_ID_TOKEN = "code id_token", t.CODE_TOKEN = "code token", t.CODE_ID_TOKEN_TOKEN = "code id_token token", t))(U || {}), x = /* @__PURE__ */ ((t) => (t.QUERY = "query", t.FRAGMENT = "fragment", t.FORM_POST = "form_post", t.WEB_MESSAGE = "web_message", t.SAML_POST = "saml_post", t))(x || {}), F = /* @__PURE__ */ ((t) => (t.S256 = "S256", t.Plain = "plain", t))(F || {});
-const Be = e.object({
+var U = /* @__PURE__ */ ((t) => (t.TOKEN = "token", t.ID_TOKEN = "id_token", t.TOKEN_ID_TOKEN = "id_token token", t.CODE = "code", t.CODE_ID_TOKEN = "code id_token", t.CODE_TOKEN = "code token", t.CODE_ID_TOKEN_TOKEN = "code id_token token", t))(U || {}), F = /* @__PURE__ */ ((t) => (t.QUERY = "query", t.FRAGMENT = "fragment", t.FORM_POST = "form_post", t.WEB_MESSAGE = "web_message", t.SAML_POST = "saml_post", t))(F || {}), P = /* @__PURE__ */ ((t) => (t.S256 = "S256", t.Plain = "plain", t))(P || {});
+const w = e.union([
+  e.null(),
+  e.object({
+    essential: e.boolean().optional(),
+    value: e.unknown().optional(),
+    values: e.array(e.unknown()).optional()
+  })
+]).nullable(), Ze = e.object({
+  userinfo: e.record(e.string(), w).optional(),
+  id_token: e.record(e.string(), w).optional()
+}), Qe = e.object({
   client_id: e.string(),
   act_as: e.string().optional(),
   response_type: e.nativeEnum(U).optional(),
-  response_mode: e.nativeEnum(x).optional(),
+  response_mode: e.nativeEnum(F).optional(),
   redirect_uri: e.string().optional(),
   audience: e.string().optional(),
   organization: e.string().optional(),
@@ -805,7 +863,7 @@ const Be = e.object({
   nonce: e.string().optional(),
   scope: e.string().optional(),
   prompt: e.string().optional(),
-  code_challenge_method: e.nativeEnum(F).optional(),
+  code_challenge_method: e.nativeEnum(P).optional(),
   code_challenge: e.string().optional(),
   username: e.string().optional(),
   ui_locales: e.string().optional(),
@@ -815,9 +873,12 @@ const Be = e.object({
   // OIDC Core 3.1.2.1 - acr_values is a space-separated string of requested
   // Authentication Context Class Reference values
   acr_values: e.string().optional(),
+  // OIDC Core 5.5 - parsed `claims` request parameter (individual claim
+  // requests for the id_token and/or userinfo response).
+  claims: Ze.optional(),
   // The following fields are not available in Auth0
   vendor_id: e.string().optional()
-}), ln = e.object({
+}), fn = e.object({
   colors: e.object({
     primary: e.string(),
     // Auth0 supports either a hex color string ("#ffffff") or a gradient
@@ -842,7 +903,7 @@ const Be = e.object({
   // Auth0 has no equivalent. Per-user toggle (ah-dark-mode cookie) still
   // overrides this at runtime.
   dark_mode: e.enum(["dark", "light", "auto"]).optional()
-}), We = e.enum([
+}), $e = e.enum([
   "password_reset",
   "email_verification",
   "otp",
@@ -850,7 +911,7 @@ const Be = e.object({
   "authorization_code",
   "oauth2_state",
   "ticket"
-]), Ke = e.object({
+]), Je = e.object({
   code_id: e.string().openapi({
     description: "The code that will be used in for instance an email verification flow"
   }),
@@ -860,7 +921,7 @@ const Be = e.object({
   connection_id: e.string().optional().openapi({
     description: "The connection that the code is connected to"
   }),
-  code_type: We,
+  code_type: $e,
   code_verifier: e.string().optional().openapi({
     description: "The code verifier used in PKCE in outbound flows"
   }),
@@ -885,10 +946,10 @@ const Be = e.object({
   expires_at: e.string(),
   used_at: e.string().optional(),
   user_id: e.string().optional()
-}), pn = e.object({
-  ...Ke.shape,
+}), En = e.object({
+  ...Je.shape,
   created_at: e.string()
-}), ze = e.object({
+}), et = e.object({
   kid: e.string().optional(),
   team_id: e.string().optional(),
   realms: e.string().optional(),
@@ -903,6 +964,10 @@ const Be = e.object({
   jwks_uri: e.string().optional(),
   discovery_url: e.string().optional(),
   issuer: e.string().optional(),
+  // How client credentials are sent to the token endpoint for upstream OIDC /
+  // OAuth2 connections. Defaults to `client_secret_basic` (HTTP Basic auth).
+  // Set to `client_secret_post` for providers like JumpCloud that reject Basic.
+  token_endpoint_auth_method: e.enum(["client_secret_basic", "client_secret_post"]).optional(),
   provider: e.string().optional(),
   from: e.string().optional(),
   twilio_sid: e.string().optional(),
@@ -936,8 +1001,19 @@ const Be = e.object({
   disable_signup: e.boolean().optional(),
   // Brute force protection
   brute_force_protection: e.boolean().optional(),
-  // Import mode
+  // Import mode (Auth0 custom-DB semantics): when true and a successful
+  // upstream verification occurs, the user/password row is created locally
+  // so subsequent logins are served entirely from authhero.
   import_mode: e.boolean().optional(),
+  // Upstream migration credentials. Mirrors Auth0's
+  // `options.configuration` (encrypted env-vars accessed from custom
+  // scripts). For lazy migration, set when `import_mode: true`.
+  configuration: e.object({
+    token_endpoint: e.string().optional(),
+    userinfo_endpoint: e.string().optional(),
+    client_id: e.string().optional(),
+    client_secret: e.string().optional()
+  }).optional(),
   // Flexible Identifiers: attributes schema (replaces legacy requires_username)
   attributes: e.object({
     email: e.object({
@@ -1022,14 +1098,14 @@ function T(t) {
     return t;
   }
 }
-const qe = e.object({
+const tt = e.object({
   id: e.string().optional(),
   name: e.string(),
   display_name: e.string().optional(),
   strategy: e.string(),
   options: e.preprocess(
     (t) => t === null ? {} : T(t),
-    ze
+    et
   ).default({}),
   enabled_clients: e.array(e.string()).default([]).optional(),
   response_type: e.custom().optional(),
@@ -1038,11 +1114,11 @@ const qe = e.object({
   show_as_button: e.boolean().optional(),
   metadata: e.record(e.any()).optional(),
   is_system: e.boolean().optional()
-}), cn = e.object({
+}), Sn = e.object({
   id: e.string(),
   created_at: e.string().transform((t) => t === null ? "" : t),
   updated_at: e.string().transform((t) => t === null ? "" : t)
-}).extend(qe.shape), Ve = e.object({
+}).extend(tt.shape), ot = e.object({
   domain: e.string(),
   custom_domain_id: e.string().optional(),
   type: e.enum(["auth0_managed_certs", "self_managed_certs"]),
@@ -1056,7 +1132,7 @@ const qe = e.object({
     "null"
   ]).optional(),
   domain_metadata: e.record(e.string().max(255)).optional()
-}), Xe = e.discriminatedUnion("name", [
+}), nt = e.discriminatedUnion("name", [
   e.object({
     name: e.literal("txt"),
     record: e.string(),
@@ -1067,17 +1143,17 @@ const qe = e.object({
     http_body: e.string(),
     http_url: e.string()
   })
-]), Ye = e.object({
-  ...Ve.shape,
+]), it = e.object({
+  ...ot.shape,
   custom_domain_id: e.string(),
   primary: e.boolean(),
   status: e.enum(["disabled", "pending", "pending_verification", "ready"]),
   origin_domain_name: e.string().optional(),
   verification: e.object({
-    methods: e.array(Xe)
+    methods: e.array(nt)
   }).optional(),
   tls_policy: e.string().optional()
-}), dn = Ye.extend({
+}), yn = it.extend({
   tenant_id: e.string()
 }), O = e.object({
   id: e.string(),
@@ -1085,17 +1161,17 @@ const qe = e.object({
   visible: e.boolean().optional().default(!0)
 }), l = O.extend({
   category: e.literal("BLOCK").optional()
-}), Ze = l.extend({
+}), at = l.extend({
   type: e.literal("DIVIDER"),
   config: e.object({
     text: e.string().optional()
   }).optional()
-}), Qe = l.extend({
+}), rt = l.extend({
   type: e.literal("HTML"),
   config: e.object({
     content: e.string().optional()
   }).optional()
-}), $e = l.extend({
+}), st = l.extend({
   type: e.literal("IMAGE"),
   config: e.object({
     src: e.string().optional(),
@@ -1103,29 +1179,29 @@ const qe = e.object({
     width: e.number().optional(),
     height: e.number().optional()
   }).optional()
-}), Je = l.extend({
+}), lt = l.extend({
   type: e.literal("JUMP_BUTTON"),
   config: e.object({
     text: e.string().optional(),
     target_step: e.string().optional()
   })
-}), et = l.extend({
+}), ct = l.extend({
   type: e.literal("RESEND_BUTTON"),
   config: e.object({
     text: e.string().optional(),
     resend_action: e.string().optional()
   })
-}), tt = l.extend({
+}), pt = l.extend({
   type: e.literal("NEXT_BUTTON"),
   config: e.object({
     text: e.string().optional()
   })
-}), ot = l.extend({
+}), dt = l.extend({
   type: e.literal("PREVIOUS_BUTTON"),
   config: e.object({
     text: e.string().optional()
   })
-}), nt = l.extend({
+}), _t = l.extend({
   type: e.literal("RICH_TEXT"),
   config: e.object({
     content: e.string().optional()
@@ -1136,17 +1212,17 @@ const qe = e.object({
   hint: e.string().min(1).max(500).optional(),
   required: e.boolean().optional(),
   sensitive: e.boolean().optional()
-}), it = N.extend({
+}), gt = N.extend({
   type: e.literal("AUTH0_VERIFIABLE_CREDENTIALS"),
   config: e.object({
     credential_type: e.string().optional()
   })
-}), at = N.extend({
+}), ut = N.extend({
   type: e.literal("GMAPS_ADDRESS"),
   config: e.object({
     api_key: e.string().optional()
   })
-}), rt = N.extend({
+}), mt = N.extend({
   type: e.literal("RECAPTCHA"),
   config: e.object({
     site_key: e.string().optional()
@@ -1164,12 +1240,12 @@ const qe = e.object({
   ).optional(),
   required: e.boolean().optional(),
   sensitive: e.boolean().optional()
-}), st = i.extend({
+}), ht = i.extend({
   type: e.literal("BOOLEAN"),
   config: e.object({
     default_value: e.boolean().optional()
   }).optional()
-}), lt = i.extend({
+}), bt = i.extend({
   type: e.literal("CARDS"),
   config: e.object({
     options: e.array(
@@ -1182,7 +1258,7 @@ const qe = e.object({
     ).optional(),
     multi_select: e.boolean().optional()
   }).optional()
-}), pt = i.extend({
+}), ft = i.extend({
   type: e.literal("CHOICE"),
   config: e.object({
     options: e.array(
@@ -1195,7 +1271,7 @@ const qe = e.object({
     multiple: e.boolean().optional(),
     default_value: e.union([e.string(), e.array(e.string())]).optional()
   }).optional()
-}), ct = i.extend({
+}), Et = i.extend({
   type: e.literal("CUSTOM"),
   config: e.object({
     component: e.string().optional(),
@@ -1203,7 +1279,7 @@ const qe = e.object({
     schema: e.record(e.any()).optional(),
     code: e.string().optional()
   })
-}), dt = i.extend({
+}), St = i.extend({
   type: e.literal("DATE"),
   config: e.object({
     format: e.string().optional(),
@@ -1211,7 +1287,7 @@ const qe = e.object({
     max: e.string().optional(),
     default_value: e.string().optional()
   }).optional()
-}), _t = i.extend({
+}), yt = i.extend({
   type: e.literal("DROPDOWN"),
   config: e.object({
     options: e.array(
@@ -1225,26 +1301,26 @@ const qe = e.object({
     multiple: e.boolean().optional(),
     default_value: e.union([e.string(), e.array(e.string())]).optional()
   }).optional()
-}), gt = i.extend({
+}), At = i.extend({
   type: e.literal("EMAIL"),
   config: e.object({
     placeholder: e.string().optional(),
     default_value: e.string().optional()
   }).optional()
-}), ut = i.extend({
+}), It = i.extend({
   type: e.literal("FILE"),
   config: e.object({
     accept: e.string().optional(),
     max_size: e.number().optional(),
     multiple: e.boolean().optional()
   }).optional()
-}), mt = i.extend({
+}), Ct = i.extend({
   type: e.literal("LEGAL"),
   config: e.object({
     text: e.string(),
     html: e.boolean().optional()
   }).optional()
-}), ht = i.extend({
+}), Tt = i.extend({
   type: e.literal("NUMBER"),
   config: e.object({
     placeholder: e.string().optional(),
@@ -1253,7 +1329,7 @@ const qe = e.object({
     step: e.number().optional(),
     default_value: e.string().optional()
   }).optional()
-}), bt = i.extend({
+}), Ot = i.extend({
   type: e.literal("PASSWORD"),
   config: e.object({
     placeholder: e.string().optional(),
@@ -1262,13 +1338,13 @@ const qe = e.object({
     forgot_password_link: e.string().optional(),
     default_value: e.string().optional()
   }).optional()
-}), ft = i.extend({
+}), Nt = i.extend({
   type: e.literal("PAYMENT"),
   config: e.object({
     provider: e.string().optional(),
     currency: e.string().optional()
   }).optional()
-}), Et = i.extend({
+}), wt = i.extend({
   type: e.literal("SOCIAL"),
   config: e.object({
     providers: e.array(e.string()).optional(),
@@ -1283,7 +1359,7 @@ const qe = e.object({
       })
     ).optional()
   }).optional()
-}), St = i.extend({
+}), jt = i.extend({
   type: e.literal("TEL"),
   config: e.object({
     placeholder: e.string().optional(),
@@ -1291,7 +1367,7 @@ const qe = e.object({
     default_value: e.string().optional(),
     allow_email: e.boolean().optional()
   }).optional()
-}), yt = i.extend({
+}), kt = i.extend({
   type: e.literal("TEXT"),
   config: e.object({
     placeholder: e.string().optional(),
@@ -1299,54 +1375,54 @@ const qe = e.object({
     max_length: e.number().optional(),
     default_value: e.string().optional()
   }).optional()
-}), At = i.extend({
+}), Rt = i.extend({
   type: e.literal("COUNTRY"),
   config: e.object({
     placeholder: e.string().optional(),
     default_value: e.string().optional()
   }).optional()
-}), It = i.extend({
+}), vt = i.extend({
   type: e.literal("URL"),
   config: e.object({
     placeholder: e.string().optional(),
     default_value: e.string().optional()
   }).optional()
-}), Ct = e.discriminatedUnion("type", [
-  Ze,
-  Qe,
-  $e,
-  Je,
-  et,
-  tt,
-  ot,
-  nt
-]), Tt = e.discriminatedUnion("type", [
-  it,
+}), Dt = e.discriminatedUnion("type", [
   at,
-  rt
-]), Ot = e.discriminatedUnion("type", [
+  rt,
   st,
   lt,
-  pt,
-  At,
   ct,
+  pt,
   dt,
-  _t,
+  _t
+]), Lt = e.discriminatedUnion("type", [
   gt,
   ut,
-  mt,
+  mt
+]), xt = e.discriminatedUnion("type", [
   ht,
   bt,
   ft,
+  Rt,
   Et,
   St,
   yt,
-  It
-]), P = e.union([
+  At,
+  It,
   Ct,
   Tt,
-  Ot
-]), _n = /* @__PURE__ */ new Set([
+  Ot,
+  Nt,
+  wt,
+  jt,
+  kt,
+  vt
+]), M = e.union([
+  Dt,
+  Lt,
+  xt
+]), An = /* @__PURE__ */ new Set([
   "BOOLEAN",
   "CARDS",
   "CHOICE",
@@ -1360,7 +1436,7 @@ const qe = e.object({
   "TEL",
   "TEXT",
   "URL"
-]), gn = e.object({
+]), In = e.object({
   id: e.string(),
   type: e.literal("submit"),
   label: e.string(),
@@ -1372,7 +1448,7 @@ const qe = e.object({
 }), E = e.object({
   x: e.number(),
   y: e.number()
-}), Nt = e.object({
+}), Ut = e.object({
   id: e.string(),
   type: e.literal("FLOW"),
   coordinates: E,
@@ -1381,7 +1457,7 @@ const qe = e.object({
     flow_id: e.string().max(30),
     next_node: e.string().optional()
   })
-}), wt = e.object({
+}), Ft = e.object({
   id: e.string(),
   type: e.literal("ROUTER"),
   coordinates: E,
@@ -1397,20 +1473,20 @@ const qe = e.object({
     ),
     fallback: e.string()
   })
-}), jt = e.object({
+}), Pt = e.object({
   id: e.string(),
   type: e.literal("STEP"),
   coordinates: E,
   alias: e.string().min(1).max(150).optional(),
   config: e.object({
-    components: e.array(P),
+    components: e.array(M),
     next_node: e.string().optional()
   })
-}), kt = e.discriminatedUnion("type", [
-  Nt,
-  wt,
-  jt
-]), Rt = e.object({
+}), Mt = e.discriminatedUnion("type", [
+  Ut,
+  Ft,
+  Pt
+]), Ht = e.object({
   name: e.string().openapi({
     description: "The name of the form"
   }),
@@ -1423,7 +1499,7 @@ const qe = e.object({
     default: e.string().optional()
   }).optional(),
   translations: e.record(e.string(), e.any()).optional(),
-  nodes: e.array(kt).optional(),
+  nodes: e.array(Mt).optional(),
   start: e.object({
     hidden_fields: e.array(e.object({ key: e.string(), value: e.string() })).optional(),
     next_node: e.string().optional(),
@@ -1445,42 +1521,42 @@ const qe = e.object({
   }).optional()
 }).openapi({
   description: "Schema for flow-based forms (matches Auth0 Forms structure)"
-}), un = e.object({
+}), Cn = e.object({
   ...a.shape,
-  ...Rt.shape,
+  ...Ht.shape,
   id: e.string()
-}), vt = e.object({
+}), Gt = e.object({
   id: e.number().optional(),
   text: e.string(),
   type: e.enum(["info", "error", "success", "warning"])
-}), Dt = e.object({
+}), Bt = e.object({
   id: e.string().optional(),
   text: e.string(),
   href: e.string(),
   linkText: e.string().optional()
-}), mn = e.object({
+}), Tn = e.object({
   /** Screen identifier for CSS targeting (e.g., 'identifier', 'enter-password', 'signup') */
   name: e.string().optional(),
   action: e.string(),
   method: e.enum(["POST", "GET"]),
   title: e.string().optional(),
   description: e.string().optional(),
-  components: e.array(P),
-  messages: e.array(vt).optional(),
-  links: e.array(Dt).optional(),
+  components: e.array(M),
+  messages: e.array(Gt).optional(),
+  links: e.array(Bt).optional(),
   /** Footer HTML content displayed at the very bottom of the widget (e.g., terms and conditions) */
   footer: e.string().optional()
 });
-function hn(t) {
+function On(t) {
   return t.category === "BLOCK";
 }
-function bn(t) {
+function Nn(t) {
   return t.category === "WIDGET";
 }
-function fn(t) {
+function wn(t) {
   return t.category === "FIELD";
 }
-const M = e.enum([
+const H = e.enum([
   "pre-user-registration",
   "post-user-registration",
   "post-user-login",
@@ -1489,28 +1565,28 @@ const M = e.enum([
   "pre-user-deletion",
   "post-user-deletion"
   // Potentially other triggers specific to webhooks in the future
-]), H = e.enum([
+]), G = e.enum([
   "pre-user-registration",
   "post-user-registration",
   "post-user-login",
   "validate-registration-username",
   "pre-user-deletion",
   "post-user-deletion"
-]), G = e.enum([
+]), B = e.enum([
   "post-user-login",
   "post-user-registration",
   "post-user-update",
   "credentials-exchange"
-]), B = e.enum([
+]), W = e.enum([
   "post-user-login",
   "credentials-exchange",
   "pre-user-registration",
   "post-user-registration"
-]), W = e.enum([
+]), K = e.enum([
   "ensure-username",
   "set-preferred-username",
   "account-linking"
-]), En = {
+]), jn = {
   "ensure-username": {
     name: "Ensure Username",
     description: "Automatically assigns a username to users who sign in without one. Creates a linked username account for social/email users.",
@@ -1530,7 +1606,7 @@ const M = e.enum([
       "post-user-update"
     ]
   }
-}, p = {
+}, c = {
   enabled: e.boolean().default(!1),
   synchronous: e.boolean().default(!1),
   priority: e.number().optional(),
@@ -1547,71 +1623,71 @@ const M = e.enum([
    * Everything else is opaque to the runtime. Persisted as JSON.
    */
   metadata: e.record(e.unknown()).optional()
-}, Lt = e.object({
-  ...p,
-  trigger_id: M,
-  url: e.string()
-}), Ut = e.object({
-  ...p,
+}, Wt = e.object({
+  ...c,
   trigger_id: H,
-  form_id: e.string()
-}), xt = e.object({
-  ...p,
+  url: e.string()
+}), Kt = e.object({
+  ...c,
   trigger_id: G,
-  template_id: W
-}), Ft = e.object({
-  ...p,
+  form_id: e.string()
+}), zt = e.object({
+  ...c,
   trigger_id: B,
+  template_id: K
+}), qt = e.object({
+  ...c,
+  trigger_id: W,
   code_id: e.string()
-}), Sn = e.union([
-  Lt,
-  Ut,
-  xt,
-  Ft
-]), Pt = e.object({
-  ...p,
-  trigger_id: M,
+}), kn = e.union([
+  Wt,
+  Kt,
+  zt,
+  qt
+]), Xt = e.object({
+  ...c,
+  trigger_id: H,
   ...a.shape,
   hook_id: e.string(),
   url: e.string()
-}), Mt = e.object({
-  ...p,
-  trigger_id: H,
+}), Vt = e.object({
+  ...c,
+  trigger_id: G,
   ...a.shape,
   hook_id: e.string(),
   form_id: e.string()
-}), Ht = e.object({
-  ...p,
-  trigger_id: G,
+}), Yt = e.object({
+  ...c,
+  trigger_id: B,
   ...a.shape,
   hook_id: e.string(),
-  template_id: W
-}), Gt = e.object({
-  ...p,
-  trigger_id: B,
+  template_id: K
+}), Zt = e.object({
+  ...c,
+  trigger_id: W,
   ...a.shape,
   hook_id: e.string(),
   code_id: e.string()
-}), yn = e.union([
-  Pt,
-  Mt,
-  Ht,
-  Gt
-]), Bt = e.object({
+}), Rn = e.union([
+  Xt,
+  Vt,
+  Yt,
+  Zt
+]), Qt = e.object({
   code: e.string().max(1e5),
   secrets: e.record(e.string()).optional()
-}), An = Bt.extend({
+}), vn = Qt.extend({
   id: e.string(),
   tenant_id: e.string(),
   ...a.shape
-}), Wt = e.object({
+}), $t = e.object({
   name: e.string().optional()
-}), Kt = e.object({
+}), Jt = e.object({
   email: e.string().optional()
-}), zt = e.object({
+}), eo = e.object({
   organization_id: e.string().max(50),
-  inviter: Wt,
-  invitee: Kt,
+  inviter: $t,
+  invitee: Jt,
   invitation_url: e.string().url(),
   client_id: e.string(),
   connection_id: e.string().optional(),
@@ -1620,13 +1696,13 @@ const M = e.enum([
   ttl_sec: e.number().int().max(2592e3).default(604800).optional(),
   roles: e.array(e.string()).default([]).optional(),
   send_invitation_email: e.boolean().default(!0).optional()
-}), In = e.object({
+}), Dn = e.object({
   id: e.string(),
   organization_id: e.string().max(50),
   created_at: e.string().datetime(),
   expires_at: e.string().datetime(),
   ticket_id: e.string().optional()
-}).extend(zt.shape), qt = e.object({
+}).extend(eo.shape), to = e.object({
   alg: e.enum([
     "RS256",
     "RS384",
@@ -1665,9 +1741,9 @@ const M = e.enum([
         path: [n],
         message: `EC JWK is missing required member '${n}'`
       });
-}), Cn = e.object({
-  keys: e.array(qt)
-}), Tn = e.object({
+}), Ln = e.object({
+  keys: e.array(to)
+}), xn = e.object({
   issuer: e.string(),
   authorization_endpoint: e.string(),
   token_endpoint: e.string(),
@@ -1687,24 +1763,25 @@ const M = e.enum([
   claims_supported: e.array(e.string()),
   request_uri_parameter_supported: e.boolean(),
   request_parameter_supported: e.boolean(),
+  claims_parameter_supported: e.boolean().optional(),
   request_object_signing_alg_values_supported: e.array(e.string()).optional(),
   token_endpoint_auth_signing_alg_values_supported: e.array(e.string())
 });
-var K = /* @__PURE__ */ ((t) => (t.PENDING = "pending", t.AUTHENTICATED = "authenticated", t.AWAITING_EMAIL_VERIFICATION = "awaiting_email_verification", t.AWAITING_MFA = "awaiting_mfa", t.AWAITING_HOOK = "awaiting_hook", t.AWAITING_CONTINUATION = "awaiting_continuation", t.COMPLETED = "completed", t.FAILED = "failed", t.EXPIRED = "expired", t))(K || {});
-const Vt = e.nativeEnum(K), Xt = e.object({
+var z = /* @__PURE__ */ ((t) => (t.PENDING = "pending", t.AUTHENTICATED = "authenticated", t.AWAITING_EMAIL_VERIFICATION = "awaiting_email_verification", t.AWAITING_MFA = "awaiting_mfa", t.AWAITING_HOOK = "awaiting_hook", t.AWAITING_CONTINUATION = "awaiting_continuation", t.COMPLETED = "completed", t.FAILED = "failed", t.EXPIRED = "expired", t))(z || {});
+const oo = e.nativeEnum(z), no = e.object({
   strategy: e.string(),
   strategy_type: e.string()
-}), Yt = e.object({
+}), io = e.object({
   csrf_token: e.string(),
   auth0Client: e.string().optional(),
-  authParams: Be,
+  authParams: Qe,
   expires_at: e.string(),
   deleted_at: e.string().optional(),
   ip: e.string().optional(),
   useragent: e.string().optional(),
   session_id: e.string().optional(),
   authorization_url: e.string().optional(),
-  state: Vt.optional().default(
+  state: oo.optional().default(
     "pending"
     /* PENDING */
   ),
@@ -1715,19 +1792,19 @@ const Vt = e.nativeEnum(K), Xt = e.object({
   // Set once user is authenticated
   auth_connection: e.string().optional(),
   // The connection used to authenticate (may differ from primary user's connection)
-  auth_strategy: Xt.optional(),
+  auth_strategy: no.optional(),
   authenticated_at: e.string().optional()
   // ISO timestamp persisted for audit/metadata; not used to reject resumed sessions
 }).openapi({
   description: "This represents a login sesion"
-}), On = e.object({
-  ...Yt.shape,
+}), Un = e.object({
+  ...io.shape,
   id: e.string().openapi({
     description: "This is is used as the state in the universal login"
   }),
   created_at: e.string(),
   updated_at: e.string()
-}), Zt = {
+}), ao = {
   // Network & System
   ACLS_SUMMARY: "acls_summary",
   ACTIONS_EXECUTION_FAILED: "actions_execution_failed",
@@ -1901,24 +1978,24 @@ const Vt = e.nativeEnum(K), Xt = e.object({
   WARNING_DURING_LOGIN: "w",
   WARNING_SENDING_NOTIFICATION: "wn",
   WARNING_USER_MANAGEMENT: "wum"
-}, Qt = e.string().refine(
-  (t) => Object.values(Zt).includes(t),
+}, ro = e.string().refine(
+  (t) => Object.values(ao).includes(t),
   { message: "Invalid log type" }
-), $t = e.object({
+), so = e.object({
   name: e.string(),
   version: e.string(),
   env: e.object({
     node: e.string().optional()
   }).optional()
-}), Jt = e.object({
+}), lo = e.object({
   country_code: e.string().length(2),
   city_name: e.string(),
   latitude: e.string(),
   longitude: e.string(),
   time_zone: e.string(),
   continent_code: e.string()
-}), eo = e.object({
-  type: Qt,
+}), co = e.object({
+  type: ro,
   date: e.string(),
   description: e.string().optional(),
   ip: e.string().optional(),
@@ -1937,39 +2014,39 @@ const Vt = e.nativeEnum(K), Xt = e.object({
   strategy: e.string().optional(),
   strategy_type: e.string().optional(),
   hostname: e.string().optional(),
-  auth0_client: $t.optional(),
+  auth0_client: so.optional(),
   log_id: e.string().optional(),
-  location_info: Jt.optional()
-}), Nn = e.object({
-  ...eo.shape,
+  location_info: lo.optional()
+}), Fn = e.object({
+  ...co.shape,
   log_id: e.string()
-}), to = e.enum([
+}), po = e.enum([
   "http",
   "eventbridge",
   "eventgrid",
   "splunk",
   "datadog",
   "sumo"
-]), z = e.enum([
+]), q = e.enum([
   "active",
   "paused",
   "suspended"
-]), oo = e.object({
+]), _o = e.object({
   type: e.string(),
   name: e.string()
-}), no = e.object({
+}), go = e.object({
   name: e.string(),
-  type: to,
-  status: z.optional(),
+  type: po,
+  status: q.optional(),
   sink: e.record(e.string(), e.unknown()),
-  filters: e.array(oo).optional(),
+  filters: e.array(_o).optional(),
   isPriority: e.boolean().optional()
-}), wn = no.extend({
+}), Pn = go.extend({
   id: e.string(),
-  status: z,
+  status: q,
   created_at: e.string().optional(),
   updated_at: e.string().optional()
-}), io = e.object({
+}), uo = e.object({
   enabled: e.boolean().optional(),
   shields: e.array(e.string()).optional(),
   admin_notification_frequency: e.array(e.string()).optional(),
@@ -1982,13 +2059,13 @@ const Vt = e.nativeEnum(K), Xt = e.object({
       shields: e.array(e.string()).optional()
     }).optional()
   }).optional()
-}), ao = e.object({
+}), mo = e.object({
   enabled: e.boolean().optional(),
   shields: e.array(e.string()).optional(),
   allowlist: e.array(e.string()).optional(),
   mode: e.string().optional(),
   max_attempts: e.number().optional()
-}), ro = e.object({
+}), ho = e.object({
   enabled: e.boolean().optional(),
   shields: e.array(e.string()).optional(),
   allowlist: e.array(e.string()).optional(),
@@ -2002,28 +2079,28 @@ const Vt = e.nativeEnum(K), Xt = e.object({
       rate: e.number().optional()
     }).optional()
   }).optional()
-}), so = e.object({
-  breached_password_detection: io.optional(),
-  brute_force_protection: ao.optional(),
-  suspicious_ip_throttling: ro.optional()
-}), lo = e.object({
+}), bo = e.object({
+  breached_password_detection: uo.optional(),
+  brute_force_protection: mo.optional(),
+  suspicious_ip_throttling: ho.optional()
+}), fo = e.object({
   id: e.string().optional(),
   user_id: e.string(),
   password: e.string(),
   algorithm: e.enum(["bcrypt", "argon2id"]).default("argon2id"),
   is_current: e.boolean().default(!0)
-}), jn = lo.extend({
+}), Mn = fo.extend({
   id: e.string(),
   created_at: e.string(),
   updated_at: e.string()
-}), q = e.object({
+}), X = e.object({
   initial_user_agent: e.string().describe("First user agent of the device from which this user logged in"),
   initial_ip: e.string().describe("First IP address associated with this session"),
   initial_asn: e.string().describe("First autonomous system number associated with this session"),
   last_user_agent: e.string().describe("Last user agent of the device from which this user logged in"),
   last_ip: e.string().describe("Last IP address from which this user logged in"),
   last_asn: e.string().describe("Last autonomous system number from which this user logged in")
-}), po = e.object({
+}), Eo = e.object({
   id: e.string(),
   revoked_at: e.string().optional(),
   used_at: e.string().optional(),
@@ -2031,17 +2108,17 @@ const Vt = e.nativeEnum(K), Xt = e.object({
   expires_at: e.string().optional(),
   login_session_id: e.string(),
   idle_expires_at: e.string().optional(),
-  device: q.describe(
+  device: X.describe(
     "Metadata related to the device used in the session"
   ),
   clients: e.array(e.string()).describe("List of client details for the session")
-}), kn = e.object({
+}), Hn = e.object({
   created_at: e.string(),
   updated_at: e.string(),
   authenticated_at: e.string(),
   last_interaction_at: e.string(),
-  ...po.shape
-}), Rn = e.object({
+  ...Eo.shape
+}), Gn = e.object({
   kid: e.string().openapi({ description: "The key id of the signing key" }),
   tenant_id: e.string().optional().openapi({
     description: "The tenant the key belongs to. Omitted means the key is shared / control-plane scoped."
@@ -2069,7 +2146,7 @@ const Vt = e.nativeEnum(K), Xt = e.object({
   type: e.enum(["jwt_signing", "saml_encryption"]).openapi({
     description: "The type of the signing key"
   })
-}), co = e.object({
+}), So = e.object({
   id: e.string().optional(),
   // Basic settings
   audience: e.string(),
@@ -2222,7 +2299,7 @@ const Vt = e.nativeEnum(K), Xt = e.object({
   pushed_authorization_requests_supported: e.boolean().optional(),
   authorization_response_iss_parameter_supported: e.boolean().optional(),
   // Attack-protection config (singleton, exposed via /api/v2/attack-protection)
-  attack_protection: so.optional(),
+  attack_protection: bo.optional(),
   // Guardian MFA Factors configuration (internal storage, exposed via /guardian API)
   mfa: e.object({
     // MFA policy: "never" = MFA disabled, "always" = MFA required for all logins
@@ -2254,14 +2331,14 @@ const Vt = e.nativeEnum(K), Xt = e.object({
       message: e.string().optional()
     }).optional()
   }).optional()
-}), vn = e.object({
+}), Bn = e.object({
   created_at: e.string().nullable().transform((t) => t ?? ""),
   updated_at: e.string().nullable().transform((t) => t ?? ""),
-  ...co.shape,
+  ...So.shape,
   id: e.string()
 });
-var _o = /* @__PURE__ */ ((t) => (t.RefreshToken = "refresh_token", t.AuthorizationCode = "authorization_code", t.ClientCredential = "client_credentials", t.Passwordless = "passwordless", t.Password = "password", t.OTP = "http://auth0.com/oauth/grant-type/passwordless/otp", t))(_o || {});
-const Dn = e.object({
+var yo = /* @__PURE__ */ ((t) => (t.RefreshToken = "refresh_token", t.AuthorizationCode = "authorization_code", t.ClientCredential = "client_credentials", t.Passwordless = "passwordless", t.Password = "password", t.OTP = "http://auth0.com/oauth/grant-type/passwordless/otp", t))(yo || {});
+const Wn = e.object({
   access_token: e.string(),
   id_token: e.string().optional(),
   scope: e.string().optional(),
@@ -2274,7 +2351,7 @@ e.object({
   code: e.string(),
   state: e.string().optional()
 });
-const go = e.object({
+const Ao = e.object({
   button_border_radius: e.number(),
   button_border_weight: e.number(),
   buttons_style: e.enum(["pill", "rounded", "sharp"]),
@@ -2284,7 +2361,7 @@ const go = e.object({
   show_widget_shadow: e.boolean(),
   widget_border_weight: e.number(),
   widget_corner_radius: e.number()
-}), uo = e.object({
+}), Io = e.object({
   base_focus_color: e.string(),
   base_hover_color: e.string(),
   body_text: e.string(),
@@ -2307,7 +2384,7 @@ const go = e.object({
 }), u = e.object({
   bold: e.boolean(),
   size: e.number()
-}), mo = e.object({
+}), Co = e.object({
   body_text: u,
   buttons_text: u,
   font_url: e.string(),
@@ -2317,7 +2394,7 @@ const go = e.object({
   reference_text_size: e.number(),
   subtitle: u,
   title: u
-}), ho = e.object({
+}), To = e.object({
   background_color: e.string(),
   background_image_url: e.string(),
   page_layout: e.enum(["center", "left", "right"]),
@@ -2330,33 +2407,33 @@ const go = e.object({
    * Optional for backwards compatibility; absent values mean "widget".
    */
   logo_placement: e.enum(["widget", "chip", "none"]).optional()
-}), bo = e.object({
+}), Oo = e.object({
   header_text_alignment: e.enum(["center", "left", "right"]),
   logo_height: e.number(),
   logo_position: e.enum(["center", "left", "none", "right"]),
   logo_url: e.string(),
   social_buttons_layout: e.enum(["bottom", "top"])
-}), fo = e.object({
-  borders: go,
-  colors: uo,
+}), No = e.object({
+  borders: Ao,
+  colors: Io,
   displayName: e.string(),
-  fonts: mo,
-  page_background: ho,
-  widget: bo
-}), Ln = fo.extend({
+  fonts: Co,
+  page_background: To,
+  widget: Oo
+}), Kn = No.extend({
   themeId: e.string()
-}), Un = e.object({
+}), zn = e.object({
   universal_login_experience: e.enum(["new", "classic"]).default("new"),
   identifier_first: e.boolean().default(!0),
   password_first: e.boolean().default(!1),
   webauthn_platform_first_factor: e.boolean()
-}), xn = e.object({
+}), qn = e.object({
   name: e.string(),
   enabled: e.boolean().optional().default(!0),
   default_from_address: e.string().optional(),
   credentials: e.record(e.string(), e.unknown()),
   settings: e.object({}).optional()
-}), Eo = e.enum([
+}), wo = e.enum([
   "verify_email",
   "verify_email_by_code",
   "reset_email",
@@ -2369,8 +2446,8 @@ const go = e.object({
   "change_password",
   "password_reset",
   "user_invitation"
-]), Fn = e.object({
-  template: Eo,
+]), Xn = e.object({
+  template: wo,
   body: e.string(),
   from: e.string(),
   subject: e.string(),
@@ -2379,7 +2456,7 @@ const go = e.object({
   urlLifetimeInSeconds: e.number().int().nonnegative().optional(),
   includeEmailInRedirect: e.boolean().default(!1),
   enabled: e.boolean().default(!0)
-}), So = e.object({
+}), jo = e.object({
   // Internal primary key (ULID). Never sent to clients in the new wire format.
   id: e.string(),
   // Link to the login session
@@ -2392,7 +2469,7 @@ const go = e.object({
   idle_expires_at: e.string().optional(),
   // When the token was last used.
   last_exchanged_at: e.string().optional(),
-  device: q,
+  device: X,
   resource_servers: e.array(
     e.object({
       audience: e.string(),
@@ -2413,23 +2490,23 @@ const go = e.object({
   // ISO of the *first* rotation. Anchors the leeway window so siblings minted
   // within the window don't extend the parent's exposure.
   rotated_at: e.string().optional()
-}), Pn = e.object({
+}), Vn = e.object({
   // When the refresh token record was created.
   created_at: e.string(),
   // When the token was explicitly revoked (null = still active).
   revoked_at: e.string().optional(),
   // Spread in the rest of the refresh token properties.
-  ...So.shape
-}), Mn = e.object({
+  ...jo.shape
+}), Yn = e.object({
   to: e.string(),
   message: e.string()
-}), Hn = e.object({
+}), Zn = e.object({
   name: e.string(),
   options: e.object({})
-}), yo = e.object({
+}), ko = e.object({
   value: e.string(),
   description: e.string().optional()
-}), Ao = e.object({
+}), Ro = e.object({
   token_dialect: e.enum(["access_token", "access_token_authz"]).optional(),
   enforce_policies: e.boolean().optional(),
   allow_skipping_userinfo: e.boolean().optional(),
@@ -2439,11 +2516,11 @@ const go = e.object({
   mtls: e.object({
     bound_access_tokens: e.boolean().optional()
   }).optional()
-}), Io = e.object({
+}), vo = e.object({
   id: e.string().optional(),
   name: e.string(),
   identifier: e.string(),
-  scopes: e.array(yo).optional(),
+  scopes: e.array(ko).optional(),
   signing_alg: e.string().optional(),
   signing_secret: e.string().optional(),
   token_lifetime: e.number().default(86400),
@@ -2451,30 +2528,30 @@ const go = e.object({
   skip_consent_for_verifiable_first_party_clients: e.boolean().optional(),
   allow_offline_access: e.boolean().optional(),
   verificationKey: e.string().optional(),
-  options: Ao.optional(),
+  options: Ro.optional(),
   is_system: e.boolean().optional(),
   metadata: e.record(e.any()).optional()
-}), Co = e.object({
-  ...Io.shape,
+}), Do = e.object({
+  ...vo.shape,
   created_at: e.string().optional(),
   updated_at: e.string().optional()
-}), Gn = e.array(Co), To = e.object({
+}), Qn = e.array(Do), Lo = e.object({
   role_id: e.string(),
   resource_server_identifier: e.string(),
   permission_name: e.string()
-}), Oo = e.object({
-  ...To.shape,
+}), xo = e.object({
+  ...Lo.shape,
   created_at: e.string()
-}), Bn = e.array(Oo), No = e.object({
+}), $n = e.array(xo), Uo = e.object({
   user_id: e.string(),
   resource_server_identifier: e.string(),
   permission_name: e.string(),
   organization_id: e.string().optional()
-}), wo = e.object({
-  ...No.shape,
+}), Fo = e.object({
+  ...Uo.shape,
   tenant_id: e.string(),
   created_at: e.string().optional()
-}), Wn = e.array(wo), jo = e.object({
+}), Jn = e.array(Fo), Po = e.object({
   user_id: e.string(),
   resource_server_identifier: e.string(),
   resource_server_name: e.string(),
@@ -2482,17 +2559,17 @@ const go = e.object({
   description: e.string().nullable().optional(),
   created_at: e.string().optional(),
   organization_id: e.string().optional()
-}), Kn = e.array(
-  jo
-), ko = e.object({
+}), ei = e.array(
+  Po
+), Mo = e.object({
   user_id: e.string(),
   role_id: e.string(),
   organization_id: e.string().optional()
-}), Ro = e.object({
-  ...ko.shape,
+}), Ho = e.object({
+  ...Mo.shape,
   tenant_id: e.string(),
   created_at: e.string().optional()
-}), zn = e.array(Ro), vo = e.object({
+}), ti = e.array(Ho), Go = e.object({
   id: e.string().optional().openapi({
     description: "The unique identifier of the role. If not provided, one will be generated."
   }),
@@ -2506,13 +2583,13 @@ const go = e.object({
   metadata: e.record(e.any()).optional().openapi({
     description: "Metadata associated with the role. Can be used to control sync behavior in multi-tenancy scenarios."
   })
-}), Do = vo.extend({
+}), Bo = Go.extend({
   id: e.string().openapi({
     description: "The unique identifier of the role"
   }),
   created_at: e.string().optional(),
   updated_at: e.string().optional()
-}), qn = e.array(Do), Lo = e.object({
+}), oi = e.array(Bo), Wo = e.object({
   logo_url: e.string().optional().openapi({
     description: "URL of the organization's logo"
   }),
@@ -2524,7 +2601,7 @@ const go = e.object({
       description: "Page background color in hex format (e.g., #FFFFFF)"
     })
   }).optional()
-}).optional(), Uo = e.object({
+}).optional(), Ko = e.object({
   connection_id: e.string().openapi({
     description: "ID of the connection"
   }),
@@ -2537,7 +2614,7 @@ const go = e.object({
   is_signup_enabled: e.boolean().default(!0).openapi({
     description: "Whether signup is enabled for this connection"
   })
-}), xo = e.object({
+}), zo = e.object({
   client_credentials: e.object({
     enforce: e.boolean().default(!1).openapi({
       description: "Whether to enforce token quota limits"
@@ -2549,7 +2626,7 @@ const go = e.object({
       description: "Maximum tokens per hour (0 = unlimited)"
     })
   }).optional()
-}).optional(), Fo = e.object({
+}).optional(), qo = e.object({
   id: e.string().optional(),
   name: e.string().min(1).regex(/^[a-z0-9_-]+$/, {
     message: "Organization name must be lowercase and can only contain letters, numbers, hyphens, and underscores"
@@ -2559,31 +2636,31 @@ const go = e.object({
   display_name: e.string().optional().openapi({
     description: "The display name of the organization"
   }),
-  branding: Lo,
+  branding: Wo,
   metadata: e.record(e.any()).default({}).optional().openapi({
     description: "Custom metadata for the organization"
   }),
-  enabled_connections: e.array(Uo).default([]).optional().openapi({
+  enabled_connections: e.array(Ko).default([]).optional().openapi({
     description: "List of enabled connections for the organization"
   }),
-  token_quota: xo
-}), Vn = e.object({
-  ...Fo.shape,
+  token_quota: zo
+}), ni = e.object({
+  ...qo.shape,
   ...a.shape,
   id: e.string(),
   // Override name to be lenient when reading from database (to support existing uppercase names)
   name: e.string().min(1).openapi({
     description: "The name of the organization"
   })
-}), Po = e.object({
+}), Xo = e.object({
   connection_id: e.string().openapi({
     description: "ID of the tenant-level connection to enable for the org."
   }),
   assign_membership_on_login: e.boolean().optional().default(!1),
   show_as_button: e.boolean().optional().default(!0),
   is_signup_enabled: e.boolean().optional().default(!0)
-}), Mo = e.object({
-  ...Po.shape,
+}), Vo = e.object({
+  ...Xo.shape,
   // Auth0 includes the embedded connection in GET responses.
   connection: e.object({
     name: e.string().optional(),
@@ -2591,20 +2668,20 @@ const go = e.object({
   }).optional(),
   created_at: e.string().optional(),
   updated_at: e.string().optional()
-}), Xn = e.array(
-  Mo
-), Ho = e.object({
+}), ii = e.array(
+  Vo
+), Yo = e.object({
   user_id: e.string().openapi({
     description: "ID of the user"
   }),
   organization_id: e.string().openapi({
     description: "ID of the organization"
   })
-}), Yn = e.object({
-  ...Ho.shape,
+}), ai = e.object({
+  ...Yo.shape,
   ...a.shape,
   id: e.string()
-}), Zn = e.object({
+}), ri = e.object({
   // Session settings
   idle_session_lifetime: e.number().default(72),
   session_lifetime: e.number().default(168),
@@ -2704,7 +2781,7 @@ const go = e.object({
       message: e.string().optional()
     }).optional()
   }).optional()
-}), Qn = e.object({
+}), si = e.object({
   date: e.string().openapi({
     description: "Date these events occurred in ISO 8601 format",
     example: "2025-12-19"
@@ -2729,10 +2806,10 @@ const go = e.object({
     description: "Approximate date and time the first event occurred in ISO 8601 format",
     example: "2025-12-19T00:00:00.000Z"
   })
-}), $n = e.number().openapi({
+}), li = e.number().openapi({
   description: "Number of active users in the last 30 days",
   example: 1234
-}), Go = e.enum([
+}), Zo = e.enum([
   "login",
   "login-id",
   "login-password",
@@ -2761,17 +2838,17 @@ const go = e.object({
   "custom-form",
   "login-passwordless",
   "mfa-login-options"
-]), Bo = e.record(e.string(), e.record(e.string(), e.string())).openapi({
+]), Qo = e.record(e.string(), e.record(e.string(), e.string())).openapi({
   type: "object",
   additionalProperties: {
     type: "object",
     additionalProperties: { type: "string" }
   }
-}), Jn = e.object({
-  prompt: Go,
+}), ci = e.object({
+  prompt: Zo,
   language: e.string(),
-  custom_text: Bo
-}), ei = {
+  custom_text: Qo
+}), pi = {
   EMAIL: "email",
   SMS: "sms",
   USERNAME_PASSWORD: "Username-Password-Authentication",
@@ -2785,13 +2862,12 @@ const go = e.object({
   OAUTH2: "oauth2",
   SAMLP: "samlp",
   WAAD: "waad",
-  ADFS: "adfs",
-  AUTH0: "auth0"
-}, ti = {
+  ADFS: "adfs"
+}, di = {
   DATABASE: "database",
   SOCIAL: "social",
   PASSWORDLESS: "passwordless"
-}, Wo = e.enum([
+}, $o = e.enum([
   "phone",
   "totp",
   "email",
@@ -2801,7 +2877,7 @@ const go = e.object({
   "passkey"
 ]), V = e.object({
   user_id: e.string(),
-  type: Wo,
+  type: $o,
   // Phone-specific
   phone_number: e.string().optional(),
   // TOTP-specific
@@ -2816,7 +2892,7 @@ const go = e.object({
   // Common
   confirmed: e.boolean().default(!1)
 });
-function X(t, o) {
+function Y(t, o) {
   t.type === "phone" && !t.phone_number && o.addIssue({
     code: e.ZodIssueCode.custom,
     message: "phone_number is required when type is 'phone'",
@@ -2835,30 +2911,30 @@ function X(t, o) {
     path: ["public_key"]
   }));
 }
-const oi = V.superRefine(X), ni = e.object({
+const _i = V.superRefine(Y), gi = e.object({
   ...V.shape,
   id: e.string(),
   created_at: e.string(),
   updated_at: e.string()
-}).superRefine(X);
-function ii(t) {
+}).superRefine(Y);
+function ui(t) {
   const [o, n] = t.split("|");
   if (!o || !n)
     throw new Error(`Invalid user_id: ${t}`);
   return { connection: o, id: n };
 }
-function ai(t) {
+function mi(t) {
   const {
     primary: o,
     secondaries: n,
     syncMethods: h = ["create", "rawCreate", "update", "remove", "delete", "set"]
   } = t, S = {
-    get(c, r) {
+    get(p, r) {
       if (typeof r == "symbol")
-        return c[r];
-      const d = c[r];
+        return p[r];
+      const d = p[r];
       return typeof d != "function" ? d : h.includes(r) ? async (..._) => {
-        const y = await d.apply(c, _), g = [];
+        const y = await d.apply(p, _), g = [];
         for (const s of n) {
           const b = s.adapter[r];
           if (typeof b != "function")
@@ -2883,16 +2959,16 @@ function ai(t) {
           s.blocking && g.push(A);
         }
         return g.length > 0 && await Promise.all(g), y;
-      } : d.bind(c);
+      } : d.bind(p);
     }
   };
   return new Proxy(o, S);
 }
-function ri(t) {
+function hi(t) {
   return t;
 }
-function si(t) {
-  var S, c, r, d, _, y, g, s, b, A, f, I;
+function bi(t) {
+  var S, p, r, d, _, y, g, s, b, A, f, I;
   const o = t == null ? void 0 : t.options;
   if (!o)
     return {
@@ -2903,12 +2979,12 @@ function si(t) {
     };
   const n = o.attributes;
   if (n) {
-    const Y = ((c = (S = n.username) == null ? void 0 : S.identifier) == null ? void 0 : c.active) === !0, Z = ((d = (r = n.email) == null ? void 0 : r.identifier) == null ? void 0 : d.active) !== !1, Q = ((y = (_ = n.username) == null ? void 0 : _.validation) == null ? void 0 : y.min_length) ?? 1, $ = ((s = (g = n.username) == null ? void 0 : g.validation) == null ? void 0 : s.max_length) ?? 15;
+    const Z = ((p = (S = n.username) == null ? void 0 : S.identifier) == null ? void 0 : p.active) === !0, Q = ((d = (r = n.email) == null ? void 0 : r.identifier) == null ? void 0 : d.active) !== !1, $ = ((y = (_ = n.username) == null ? void 0 : _.validation) == null ? void 0 : y.min_length) ?? 1, J = ((s = (g = n.username) == null ? void 0 : g.validation) == null ? void 0 : s.max_length) ?? 15;
     return {
-      usernameIdentifierActive: Y,
-      emailIdentifierActive: Z,
-      usernameMinLength: Q,
-      usernameMaxLength: $
+      usernameIdentifierActive: Z,
+      emailIdentifierActive: Q,
+      usernameMinLength: $,
+      usernameMaxLength: J
     };
   }
   return {
@@ -2918,205 +2994,214 @@ function si(t) {
     usernameMaxLength: ((I = (f = o.validation) == null ? void 0 : f.username) == null ? void 0 : I.max) ?? 15
   };
 }
-function li(t) {
+function fi(t) {
   return typeof t == "object" && t !== null && !Array.isArray(t);
 }
 export {
-  Zo as Auth0ActionEnum,
-  $t as Auth0Client,
-  x as AuthorizationResponseMode,
+  sn as Auth0ActionEnum,
+  so as Auth0Client,
+  F as AuthorizationResponseMode,
   U as AuthorizationResponseType,
-  F as CodeChallengeMethod,
-  L as ComponentCategory,
-  D as ComponentType,
-  Qo as EmailActionEnum,
-  _n as FORM_FIELD_TYPES,
-  Yo as FlowActionTypeEnum,
-  _o as GrantType,
-  Jt as LocationInfo,
-  Zt as LogTypes,
-  K as LoginSessionState,
-  De as NodeType,
-  de as RedirectTargetEnum,
-  ei as Strategy,
-  ti as StrategyType,
-  j as actionDependencySchema,
-  R as actionInsertSchema,
-  xe as actionNodeSchema,
-  qo as actionSchema,
-  k as actionSecretSchema,
-  w as actionTriggerSchema,
-  zo as actionUpdateSchema,
-  J as actionVersionInsertSchema,
-  Vo as actionVersionSchema,
-  $n as activeUsersResponseSchema,
-  te as actorSchema,
-  be as addressSchema,
-  so as attackProtectionSchema,
-  ee as auditCategorySchema,
-  se as auditEventInsertSchema,
-  Xo as auditEventSchema,
-  re as auth0ClientSchema,
-  sn as auth0FlowInsertSchema,
-  Ge as auth0FlowSchema,
-  Jo as auth0QuerySchema,
-  pe as auth0UpdateUserActionSchema,
-  tn as auth0UserResponseSchema,
-  Be as authParamsSchema,
-  oi as authenticationMethodInsertSchema,
-  ni as authenticationMethodSchema,
-  Wo as authenticationMethodTypeSchema,
-  v as baseUserSchema,
-  Ct as blockComponentSchema,
-  go as bordersSchema,
-  ln as brandingSchema,
-  io as breachedPasswordDetectionSchema,
-  ao as bruteForceProtectionSchema,
-  we as buttonComponentSchema,
-  Ie as clientGrantInsertSchema,
-  an as clientGrantListSchema,
-  Ce as clientGrantSchema,
-  Ae as clientInsertSchema,
-  Oe as clientRegistrationTokenInsertSchema,
-  rn as clientRegistrationTokenSchema,
-  Te as clientRegistrationTokenTypeSchema,
-  nn as clientSchema,
-  Ke as codeInsertSchema,
-  pn as codeSchema,
-  We as codeTypeSchema,
-  uo as colorsSchema,
-  vt as componentMessageSchema,
-  ve as componentSchema,
-  qe as connectionInsertSchema,
-  ze as connectionOptionsSchema,
-  cn as connectionSchema,
+  P as CodeChallengeMethod,
+  x as ComponentCategory,
+  L as ComponentType,
+  ln as EmailActionEnum,
+  An as FORM_FIELD_TYPES,
+  rn as FlowActionTypeEnum,
+  yo as GrantType,
+  lo as LocationInfo,
+  ao as LogTypes,
+  z as LoginSessionState,
+  Ge as NodeType,
+  Ee as RedirectTargetEnum,
+  pi as Strategy,
+  di as StrategyType,
+  k as actionDependencySchema,
+  oe as actionExecutionErrorSchema,
+  on as actionExecutionInsertSchema,
+  ie as actionExecutionLogEntrySchema,
+  ae as actionExecutionLogsSchema,
+  ne as actionExecutionResultSchema,
+  re as actionExecutionSchema,
+  te as actionExecutionStatusSchema,
+  ee as actionExecutionTriggerIdSchema,
+  v as actionInsertSchema,
+  Ke as actionNodeSchema,
+  tn as actionSchema,
+  R as actionSecretSchema,
+  j as actionTriggerSchema,
+  en as actionUpdateSchema,
+  se as actionVersionInsertSchema,
+  nn as actionVersionSchema,
+  li as activeUsersResponseSchema,
+  ce as actorSchema,
+  Te as addressSchema,
+  bo as attackProtectionSchema,
+  le as auditCategorySchema,
+  me as auditEventInsertSchema,
+  an as auditEventSchema,
+  ue as auth0ClientSchema,
+  bn as auth0FlowInsertSchema,
+  Ye as auth0FlowSchema,
+  pn as auth0QuerySchema,
+  be as auth0UpdateUserActionSchema,
+  _n as auth0UserResponseSchema,
+  Qe as authParamsSchema,
+  _i as authenticationMethodInsertSchema,
+  gi as authenticationMethodSchema,
+  $o as authenticationMethodTypeSchema,
+  D as baseUserSchema,
+  Dt as blockComponentSchema,
+  Ao as bordersSchema,
+  fn as brandingSchema,
+  uo as breachedPasswordDetectionSchema,
+  mo as bruteForceProtectionSchema,
+  Ue as buttonComponentSchema,
+  Ze as claimsRequestSchema,
+  Re as clientGrantInsertSchema,
+  mn as clientGrantListSchema,
+  ve as clientGrantSchema,
+  ke as clientInsertSchema,
+  Le as clientRegistrationTokenInsertSchema,
+  hn as clientRegistrationTokenSchema,
+  De as clientRegistrationTokenTypeSchema,
+  un as clientSchema,
+  Je as codeInsertSchema,
+  En as codeSchema,
+  $e as codeTypeSchema,
+  Io as colorsSchema,
+  Gt as componentMessageSchema,
+  He as componentSchema,
+  tt as connectionInsertSchema,
+  et as connectionOptionsSchema,
+  Sn as connectionSchema,
   m as coordinatesSchema,
-  ai as createPassthroughAdapter,
-  ri as createWriteOnlyAdapter,
-  Ve as customDomainInsertSchema,
-  Ye as customDomainSchema,
-  dn as customDomainWithTenantIdSchema,
-  Jn as customTextEntrySchema,
-  Bo as customTextSchema,
-  Qn as dailyStatsSchema,
-  xn as emailProviderSchema,
-  Eo as emailTemplateNameSchema,
-  Fn as emailTemplateSchema,
-  le as emailVerificationRulesSchema,
-  ce as emailVerifyActionSchema,
-  He as endingSchema,
-  Ot as fieldComponentSchema,
-  ge as flowActionStepSchema,
-  ue as flowInsertSchema,
-  $o as flowSchema,
-  ke as flowsFieldComponentSchema,
-  Ue as flowsFlowNodeSchema,
-  Le as flowsStepNodeSchema,
+  mi as createPassthroughAdapter,
+  hi as createWriteOnlyAdapter,
+  ot as customDomainInsertSchema,
+  it as customDomainSchema,
+  yn as customDomainWithTenantIdSchema,
+  ci as customTextEntrySchema,
+  Qo as customTextSchema,
+  si as dailyStatsSchema,
+  qn as emailProviderSchema,
+  wo as emailTemplateNameSchema,
+  Xn as emailTemplateSchema,
+  he as emailVerificationRulesSchema,
+  fe as emailVerifyActionSchema,
+  Ve as endingSchema,
+  xt as fieldComponentSchema,
+  ye as flowActionStepSchema,
+  Ae as flowInsertSchema,
+  cn as flowSchema,
+  Pe as flowsFieldComponentSchema,
+  We as flowsFlowNodeSchema,
+  Be as flowsStepNodeSchema,
   u as fontDetailsSchema,
-  mo as fontsSchema,
-  gn as formControlSchema,
-  Rt as formInsertSchema,
-  P as formNodeComponentDefinition,
-  kt as formNodeSchema,
-  un as formSchema,
-  Re as genericComponentSchema,
-  Fe as genericNodeSchema,
-  si as getConnectionIdentifierConfig,
-  Bt as hookCodeInsertSchema,
-  An as hookCodeSchema,
-  Sn as hookInsertSchema,
-  yn as hookSchema,
-  W as hookTemplateId,
-  En as hookTemplates,
-  he as identitySchema,
-  zt as inviteInsertSchema,
-  In as inviteSchema,
-  Kt as inviteeSchema,
-  Wt as inviterSchema,
-  hn as isBlockComponent,
-  fn as isFieldComponent,
-  li as isPlainObject,
-  bn as isWidgetComponent,
-  Cn as jwksKeySchema,
-  qt as jwksSchema,
-  je as legalComponentSchema,
-  ae as locationInfoSchema,
-  eo as logInsertSchema,
-  Nn as logSchema,
-  oo as logStreamFilterSchema,
-  no as logStreamInsertSchema,
-  wn as logStreamSchema,
-  z as logStreamStatusSchema,
-  to as logStreamTypeSchema,
-  Xt as loginSessionAuthStrategySchema,
-  Yt as loginSessionInsertSchema,
-  On as loginSessionSchema,
-  Vt as loginSessionStateSchema,
-  Pe as nodeSchema,
-  Tn as openIDConfigurationSchema,
-  Lo as organizationBrandingSchema,
-  Po as organizationConnectionInsertSchema,
-  Xn as organizationConnectionListSchema,
-  Mo as organizationConnectionSchema,
-  Uo as organizationEnabledConnectionSchema,
-  Fo as organizationInsertSchema,
-  Vn as organizationSchema,
-  xo as organizationTokenQuotaSchema,
-  ho as pageBackgroundSchema,
-  ii as parseUserId,
-  lo as passwordInsertSchema,
-  jn as passwordSchema,
-  me as profileDataSchema,
-  Go as promptScreenSchema,
-  Un as promptSettingSchema,
-  _e as redirectActionSchema,
-  So as refreshTokenInsertSchema,
-  Pn as refreshTokenSchema,
-  ne as requestContextSchema,
-  Io as resourceServerInsertSchema,
-  Gn as resourceServerListSchema,
-  Ao as resourceServerOptionsSchema,
-  Co as resourceServerSchema,
-  yo as resourceServerScopeSchema,
-  ie as responseContextSchema,
-  Ne as richTextComponentSchema,
-  vo as roleInsertSchema,
-  qn as roleListSchema,
-  To as rolePermissionInsertSchema,
-  Bn as rolePermissionListSchema,
-  Oo as rolePermissionSchema,
-  Do as roleSchema,
-  Dt as screenLinkSchema,
-  po as sessionInsertSchema,
-  kn as sessionSchema,
-  Rn as signingKeySchema,
-  Hn as smsProviderSchema,
-  Mn as smsSendParamsSchema,
-  Me as startSchema,
-  ro as suspiciousIpThrottlingSchema,
-  oe as targetSchema,
-  co as tenantInsertSchema,
-  vn as tenantSchema,
-  Zn as tenantSettingsSchema,
-  fo as themeInsertSchema,
-  Ln as themeSchema,
-  Dn as tokenResponseSchema,
-  en as totalsSchema,
-  mn as uiScreenSchema,
-  fe as userInsertSchema,
-  Ho as userOrganizationInsertSchema,
-  Yn as userOrganizationSchema,
-  No as userPermissionInsertSchema,
-  Wn as userPermissionListSchema,
-  wo as userPermissionSchema,
-  Kn as userPermissionWithDetailsListSchema,
-  jo as userPermissionWithDetailsSchema,
-  on as userResponseSchema,
-  ko as userRoleInsertSchema,
-  zn as userRoleListSchema,
-  Ro as userRoleSchema,
-  Ee as userSchema,
-  Xe as verificationMethodsSchema,
-  Tt as widgetComponentSchema,
-  bo as widgetSchema
+  Co as fontsSchema,
+  In as formControlSchema,
+  Ht as formInsertSchema,
+  M as formNodeComponentDefinition,
+  Mt as formNodeSchema,
+  Cn as formSchema,
+  Me as genericComponentSchema,
+  ze as genericNodeSchema,
+  bi as getConnectionIdentifierConfig,
+  Qt as hookCodeInsertSchema,
+  vn as hookCodeSchema,
+  kn as hookInsertSchema,
+  Rn as hookSchema,
+  K as hookTemplateId,
+  jn as hookTemplates,
+  Ce as identitySchema,
+  eo as inviteInsertSchema,
+  Dn as inviteSchema,
+  Jt as inviteeSchema,
+  $t as inviterSchema,
+  On as isBlockComponent,
+  wn as isFieldComponent,
+  fi as isPlainObject,
+  Nn as isWidgetComponent,
+  Ln as jwksKeySchema,
+  to as jwksSchema,
+  Fe as legalComponentSchema,
+  ge as locationInfoSchema,
+  co as logInsertSchema,
+  Fn as logSchema,
+  _o as logStreamFilterSchema,
+  go as logStreamInsertSchema,
+  Pn as logStreamSchema,
+  q as logStreamStatusSchema,
+  po as logStreamTypeSchema,
+  no as loginSessionAuthStrategySchema,
+  io as loginSessionInsertSchema,
+  Un as loginSessionSchema,
+  oo as loginSessionStateSchema,
+  qe as nodeSchema,
+  xn as openIDConfigurationSchema,
+  Wo as organizationBrandingSchema,
+  Xo as organizationConnectionInsertSchema,
+  ii as organizationConnectionListSchema,
+  Vo as organizationConnectionSchema,
+  Ko as organizationEnabledConnectionSchema,
+  qo as organizationInsertSchema,
+  ni as organizationSchema,
+  zo as organizationTokenQuotaSchema,
+  To as pageBackgroundSchema,
+  ui as parseUserId,
+  fo as passwordInsertSchema,
+  Mn as passwordSchema,
+  Ie as profileDataSchema,
+  Zo as promptScreenSchema,
+  zn as promptSettingSchema,
+  Se as redirectActionSchema,
+  jo as refreshTokenInsertSchema,
+  Vn as refreshTokenSchema,
+  de as requestContextSchema,
+  vo as resourceServerInsertSchema,
+  Qn as resourceServerListSchema,
+  Ro as resourceServerOptionsSchema,
+  Do as resourceServerSchema,
+  ko as resourceServerScopeSchema,
+  _e as responseContextSchema,
+  xe as richTextComponentSchema,
+  Go as roleInsertSchema,
+  oi as roleListSchema,
+  Lo as rolePermissionInsertSchema,
+  $n as rolePermissionListSchema,
+  xo as rolePermissionSchema,
+  Bo as roleSchema,
+  Bt as screenLinkSchema,
+  Eo as sessionInsertSchema,
+  Hn as sessionSchema,
+  Gn as signingKeySchema,
+  Zn as smsProviderSchema,
+  Yn as smsSendParamsSchema,
+  Xe as startSchema,
+  ho as suspiciousIpThrottlingSchema,
+  pe as targetSchema,
+  So as tenantInsertSchema,
+  Bn as tenantSchema,
+  ri as tenantSettingsSchema,
+  No as themeInsertSchema,
+  Kn as themeSchema,
+  Wn as tokenResponseSchema,
+  dn as totalsSchema,
+  Tn as uiScreenSchema,
+  Oe as userInsertSchema,
+  Yo as userOrganizationInsertSchema,
+  ai as userOrganizationSchema,
+  Uo as userPermissionInsertSchema,
+  Jn as userPermissionListSchema,
+  Fo as userPermissionSchema,
+  ei as userPermissionWithDetailsListSchema,
+  Po as userPermissionWithDetailsSchema,
+  gn as userResponseSchema,
+  Mo as userRoleInsertSchema,
+  ti as userRoleListSchema,
+  Ho as userRoleSchema,
+  Ne as userSchema,
+  nt as verificationMethodsSchema,
+  Lt as widgetComponentSchema,
+  Oo as widgetSchema
 };