@authhero/adapter-interfaces 1.7.0 → 1.9.0

package/dist/adapter-interfaces.mjs

@@ -1,5 +1,5 @@
 import { z as e } from "@hono/zod-openapi";
-const s = e.object({
+const r = e.object({
   created_at: e.string(),
   updated_at: e.string()
 }), V = e.object({
@@ -18,10 +18,10 @@ const s = e.object({
   runtime: e.string().max(50).optional(),
   dependencies: e.array(Y).optional(),
   secrets: e.array(Q).optional()
-}), Ro = N.partial().extend({
+}), Lo = N.partial().extend({
   status: e.enum(["draft", "built"]).optional(),
   deployed_at: e.string().optional()
-}), Do = N.extend({
+}), vo = N.extend({
   id: e.string(),
   tenant_id: e.string(),
   status: e.enum(["draft", "built"]).default("built"),
@@ -33,7 +33,7 @@ const s = e.object({
       value: e.string().optional()
     })
   ).optional(),
-  ...s.shape
+  ...r.shape
 }), Z = e.enum([
   "user_action",
   "admin_action",
@@ -95,22 +95,22 @@ const s = e.object({
   hostname: e.string(),
   is_mobile: e.boolean().optional(),
   timestamp: e.string()
-}), Lo = ie.extend({
+}), ko = ie.extend({
   id: e.string()
-}), vo = e.enum(["AUTH0", "EMAIL", "REDIRECT"]), ko = e.enum([
+}), Uo = e.enum(["AUTH0", "EMAIL", "REDIRECT"]), Fo = e.enum([
   "CREATE_USER",
   "GET_USER",
   "UPDATE_USER",
   "SEND_REQUEST",
   "SEND_EMAIL"
-]), Uo = e.enum(["VERIFY_EMAIL"]), ae = e.object({
+]), xo = e.enum(["VERIFY_EMAIL"]), ae = e.object({
   require_mx_record: e.boolean().optional(),
   block_aliases: e.boolean().optional(),
   block_free_emails: e.boolean().optional(),
   block_disposable_emails: e.boolean().optional(),
   blocklist: e.array(e.string()).optional(),
   allowlist: e.array(e.string()).optional()
-}), se = e.object({
+}), re = e.object({
   id: e.string(),
   alias: e.string().max(100).optional(),
   type: e.literal("AUTH0"),
@@ -122,7 +122,7 @@ const s = e.object({
     user_id: e.string(),
     changes: e.record(e.string(), e.any())
   })
-}), re = e.object({
+}), se = e.object({
   id: e.string(),
   alias: e.string().max(100).optional(),
   type: e.literal("EMAIL"),
@@ -149,8 +149,8 @@ const s = e.object({
     })
   })
 }), pe = e.union([
-  se,
   re,
+  se,
   ce
 ]), _e = e.object({
   name: e.string().min(1).max(150).openapi({
@@ -160,13 +160,13 @@ const s = e.object({
   actions: e.array(pe).optional().default([]).openapi({
     description: "The list of actions to execute in sequence"
   })
-}), Fo = _e.extend({
-  ...s.shape,
+}), Po = _e.extend({
+  ...r.shape,
   id: e.string().openapi({
     description: "Unique identifier for the flow",
     example: "af_12tMpdJ3iek7svMyZkSh5M"
   })
-}), xo = e.object({
+}), Mo = e.object({
   page: e.string().min(0).optional().default("0").transform((t) => parseInt(t, 10)).openapi({
     description: "The page number where 0 is the first page"
   }),
@@ -182,7 +182,7 @@ const s = e.object({
   q: e.string().optional().openapi({
     description: "A lucene query string used to filter the results"
   })
-}), Po = e.object({
+}), Ho = e.object({
   start: e.number(),
   limit: e.number(),
   length: e.number(),
@@ -281,16 +281,16 @@ const s = e.object({
   }).optional()
 }), he = e.object({
   ...me.omit({ password: !0 }).shape,
-  ...s.shape,
+  ...r.shape,
   user_id: e.string(),
   provider: e.string(),
   is_social: e.boolean(),
   email: e.string().optional(),
   login_count: e.number().default(0),
   identities: e.array(ge).optional()
-}), Mo = he.omit({
+}), Go = he.omit({
   registration_completed_at: !0
-}), Ho = w.extend({
+}), Bo = w.extend({
   login_count: e.number(),
   multifactor: e.array(e.string()).optional(),
   last_ip: e.string().optional(),
@@ -475,8 +475,17 @@ const Ee = e.object({
   par_request_expiry: e.number().optional().openapi({
     description: "Specifies how long, in seconds, a Pushed Authorization Request URI remains valid"
   }),
-  token_quota: e.record(e.any()).default({}).optional()
-}), Go = e.object({
+  token_quota: e.record(e.any()).default({}).optional(),
+  owner_user_id: e.string().optional().openapi({
+    description: "User ID of the consenting user when this client was created via IAT-gated Dynamic Client Registration. NULL for clients created via the Management API or open DCR."
+  }),
+  registration_type: e.enum(["manual", "open_dcr", "iat_dcr"]).optional().openapi({
+    description: "Provenance of this client. `manual` = Management API; `open_dcr` = RFC 7591 without IAT; `iat_dcr` = RFC 7591 with an Initial Access Token."
+  }),
+  registration_metadata: e.record(e.any()).default({}).optional().openapi({
+    description: "Arbitrary metadata captured at Dynamic Client Registration time that isn't a first-class client field (e.g. integration_type, domain). Also stores `iat_constraints` for clients created via IAT so RFC 7592 PUT can enforce field immutability."
+  })
+}), Wo = e.object({
   created_at: e.string(),
   updated_at: e.string(),
   ...Ee.shape
@@ -512,7 +521,21 @@ const Ee = e.object({
   ...Se.shape,
   created_at: e.string().optional(),
   updated_at: e.string().optional()
-}), Bo = e.array(Ae), m = e.object({
+}), Ko = e.array(Ae), ye = e.enum(["iat", "rat"]), Ie = e.object({
+  id: e.string(),
+  token_hash: e.string(),
+  type: ye,
+  client_id: e.string().optional(),
+  sub: e.string().optional(),
+  constraints: e.record(e.unknown()).optional(),
+  single_use: e.boolean().default(!1),
+  expires_at: e.string().optional()
+}), zo = e.object({
+  created_at: e.string(),
+  used_at: e.string().optional(),
+  revoked_at: e.string().optional(),
+  ...Ie.shape
+}), m = e.object({
   x: e.number(),
   y: e.number()
 });
@@ -521,7 +544,7 @@ const I = e.object({
   id: e.string(),
   category: e.nativeEnum(R),
   type: e.nativeEnum(j)
-}), ye = I.extend({
+}), Ce = I.extend({
   category: e.literal(
     "BLOCK"
     /* BLOCK */
@@ -533,7 +556,7 @@ const I = e.object({
   config: e.object({
     content: e.string()
   }).passthrough()
-}), Ie = I.extend({
+}), Te = I.extend({
   category: e.literal(
     "BLOCK"
     /* BLOCK */
@@ -555,7 +578,7 @@ const I = e.object({
   config: e.object({
     text: e.string()
   }).passthrough()
-}), Ce = I.extend({
+}), Oe = I.extend({
   category: e.literal(
     "FIELD"
     /* FIELD */
@@ -569,7 +592,7 @@ const I = e.object({
   config: e.object({
     text: e.string()
   }).passthrough()
-}), Te = I.extend({
+}), Ne = I.extend({
   category: e.literal(
     "FIELD"
     /* FIELD */
@@ -622,19 +645,19 @@ const I = e.object({
     label: e.string().optional(),
     placeholder: e.string().optional()
   }).passthrough()
-}), Oe = e.object({
+}), we = e.object({
   id: e.string(),
   category: e.string(),
   type: e.string()
-}).passthrough(), Ne = e.union([
-  ye,
-  Ie,
+}).passthrough(), je = e.union([
   Ce,
   Te,
-  Oe
+  Oe,
+  Ne,
+  we
 ]);
-var we = /* @__PURE__ */ ((t) => (t.STEP = "STEP", t.FLOW = "FLOW", t.CONDITION = "CONDITION", t.ACTION = "ACTION", t))(we || {});
-const je = e.object({
+var Re = /* @__PURE__ */ ((t) => (t.STEP = "STEP", t.FLOW = "FLOW", t.CONDITION = "CONDITION", t.ACTION = "ACTION", t))(Re || {});
+const De = e.object({
   id: e.string(),
   type: e.literal(
     "STEP"
@@ -643,10 +666,10 @@ const je = e.object({
   coordinates: m,
   alias: e.string().optional(),
   config: e.object({
-    components: e.array(Ne),
+    components: e.array(je),
     next_node: e.string()
   }).passthrough()
-}), Re = e.object({
+}), Le = e.object({
   id: e.string(),
   type: e.literal(
     "FLOW"
@@ -658,7 +681,7 @@ const je = e.object({
     flow_id: e.string(),
     next_node: e.string()
   })
-}), De = e.object({
+}), ve = e.object({
   id: e.string(),
   type: e.literal(
     "ACTION"
@@ -680,43 +703,43 @@ const je = e.object({
       description: "The next node to navigate to after action (for non-redirect actions)"
     })
   }).passthrough()
-}), Le = e.object({
+}), ke = e.object({
   id: e.string(),
   type: e.string(),
   coordinates: m
-}).passthrough(), ve = e.union([
-  je,
-  Re,
+}).passthrough(), Ue = e.union([
   De,
-  Le
-]), ke = e.object({
+  Le,
+  ve,
+  ke
+]), Fe = e.object({
   next_node: e.string(),
   coordinates: m
-}).passthrough(), Ue = e.object({
+}).passthrough(), xe = e.object({
   resume_flow: e.boolean().optional(),
   coordinates: m
-}).passthrough(), Fe = e.object({
+}).passthrough(), Pe = e.object({
   id: e.string(),
   name: e.string(),
   languages: e.object({
     primary: e.string()
   }).passthrough(),
-  nodes: e.array(ve),
-  start: ke,
-  ending: Ue,
+  nodes: e.array(Ue),
+  start: Fe,
+  ending: xe,
   created_at: e.string(),
   updated_at: e.string(),
   links: e.object({
     sdkSrc: e.string().optional(),
     sdk_src: e.string().optional()
   }).passthrough()
-}).passthrough(), Wo = Fe.omit({
+}).passthrough(), qo = Pe.omit({
   id: !0,
   created_at: !0,
   updated_at: !0
 });
 var D = /* @__PURE__ */ ((t) => (t.TOKEN = "token", t.ID_TOKEN = "id_token", t.TOKEN_ID_TOKEN = "token id_token", t.CODE = "code", t))(D || {}), L = /* @__PURE__ */ ((t) => (t.QUERY = "query", t.FRAGMENT = "fragment", t.FORM_POST = "form_post", t.WEB_MESSAGE = "web_message", t.SAML_POST = "saml_post", t))(L || {}), v = /* @__PURE__ */ ((t) => (t.S256 = "S256", t.Plain = "plain", t))(v || {});
-const xe = e.object({
+const Me = e.object({
   client_id: e.string(),
   act_as: e.string().optional(),
   response_type: e.nativeEnum(D).optional(),
@@ -740,7 +763,7 @@ const xe = e.object({
   acr_values: e.string().optional(),
   // The following fields are not available in Auth0
   vendor_id: e.string().optional()
-}), Ko = e.object({
+}), Xo = e.object({
   colors: e.object({
     primary: e.string(),
     page_background: e.object({
@@ -756,7 +779,7 @@ const xe = e.object({
   font: e.object({
     url: e.string()
   }).optional()
-}), Pe = e.enum([
+}), He = e.enum([
   "password_reset",
   "email_verification",
   "otp",
@@ -764,7 +787,7 @@ const xe = e.object({
   "authorization_code",
   "oauth2_state",
   "ticket"
-]), Me = e.object({
+]), Ge = e.object({
   code_id: e.string().openapi({
     description: "The code that will be used in for instance an email verification flow"
   }),
@@ -774,7 +797,7 @@ const xe = e.object({
   connection_id: e.string().optional().openapi({
     description: "The connection that the code is connected to"
   }),
-  code_type: Pe,
+  code_type: He,
   code_verifier: e.string().optional().openapi({
     description: "The code verifier used in PKCE in outbound flows"
   }),
@@ -799,10 +822,10 @@ const xe = e.object({
   expires_at: e.string(),
   used_at: e.string().optional(),
   user_id: e.string().optional()
-}), zo = e.object({
-  ...Me.shape,
+}), Vo = e.object({
+  ...Ge.shape,
   created_at: e.string()
-}), He = e.object({
+}), Be = e.object({
   kid: e.string().optional(),
   team_id: e.string().optional(),
   realms: e.string().optional(),
@@ -914,12 +937,12 @@ const xe = e.object({
   }).optional(),
   // Controls when root user attributes are updated from external IdP
   set_user_root_attributes: e.enum(["on_each_login", "on_first_login", "never_on_login"]).optional()
-}), Ge = e.object({
+}), We = e.object({
   id: e.string().optional(),
   name: e.string(),
   display_name: e.string().optional(),
   strategy: e.string(),
-  options: He.default({}),
+  options: Be.default({}),
   enabled_clients: e.array(e.string()).default([]).optional(),
   response_type: e.custom().optional(),
   response_mode: e.custom().optional(),
@@ -927,11 +950,11 @@ const xe = e.object({
   show_as_button: e.boolean().optional(),
   metadata: e.record(e.any()).optional(),
   is_system: e.boolean().optional()
-}), qo = e.object({
+}), Yo = e.object({
   id: e.string(),
   created_at: e.string().transform((t) => t === null ? "" : t),
   updated_at: e.string().transform((t) => t === null ? "" : t)
-}).extend(Ge.shape), Be = e.object({
+}).extend(We.shape), Ke = e.object({
   domain: e.string(),
   custom_domain_id: e.string().optional(),
   type: e.enum(["auth0_managed_certs", "self_managed_certs"]),
@@ -945,7 +968,7 @@ const xe = e.object({
     "null"
   ]).optional(),
   domain_metadata: e.record(e.string().max(255)).optional()
-}), We = e.discriminatedUnion("name", [
+}), ze = e.discriminatedUnion("name", [
   e.object({
     name: e.literal("txt"),
     record: e.string(),
@@ -956,17 +979,17 @@ const xe = e.object({
     http_body: e.string(),
     http_url: e.string()
   })
-]), Ke = e.object({
-  ...Be.shape,
+]), qe = e.object({
+  ...Ke.shape,
   custom_domain_id: e.string(),
   primary: e.boolean(),
   status: e.enum(["disabled", "pending", "pending_verification", "ready"]),
   origin_domain_name: e.string().optional(),
   verification: e.object({
-    methods: e.array(We)
+    methods: e.array(ze)
   }).optional(),
   tls_policy: e.string().optional()
-}), Xo = Ke.extend({
+}), Qo = qe.extend({
   tenant_id: e.string()
 }), C = e.object({
   id: e.string(),
@@ -974,17 +997,17 @@ const xe = e.object({
   visible: e.boolean().optional().default(!0)
 }), l = C.extend({
   category: e.literal("BLOCK").optional()
-}), ze = l.extend({
+}), Xe = l.extend({
   type: e.literal("DIVIDER"),
   config: e.object({
     text: e.string().optional()
   }).optional()
-}), qe = l.extend({
+}), Ve = l.extend({
   type: e.literal("HTML"),
   config: e.object({
     content: e.string().optional()
   }).optional()
-}), Xe = l.extend({
+}), Ye = l.extend({
   type: e.literal("IMAGE"),
   config: e.object({
     src: e.string().optional(),
@@ -992,29 +1015,29 @@ const xe = e.object({
     width: e.number().optional(),
     height: e.number().optional()
   }).optional()
-}), Ve = l.extend({
+}), Qe = l.extend({
   type: e.literal("JUMP_BUTTON"),
   config: e.object({
     text: e.string().optional(),
     target_step: e.string().optional()
   })
-}), Ye = l.extend({
+}), Ze = l.extend({
   type: e.literal("RESEND_BUTTON"),
   config: e.object({
     text: e.string().optional(),
     resend_action: e.string().optional()
   })
-}), Qe = l.extend({
+}), $e = l.extend({
   type: e.literal("NEXT_BUTTON"),
   config: e.object({
     text: e.string().optional()
   })
-}), Ze = l.extend({
+}), Je = l.extend({
   type: e.literal("PREVIOUS_BUTTON"),
   config: e.object({
     text: e.string().optional()
   })
-}), $e = l.extend({
+}), et = l.extend({
   type: e.literal("RICH_TEXT"),
   config: e.object({
     content: e.string().optional()
@@ -1025,17 +1048,17 @@ const xe = e.object({
   hint: e.string().min(1).max(500).optional(),
   required: e.boolean().optional(),
   sensitive: e.boolean().optional()
-}), Je = T.extend({
+}), tt = T.extend({
   type: e.literal("AUTH0_VERIFIABLE_CREDENTIALS"),
   config: e.object({
     credential_type: e.string().optional()
   })
-}), et = T.extend({
+}), ot = T.extend({
   type: e.literal("GMAPS_ADDRESS"),
   config: e.object({
     api_key: e.string().optional()
   })
-}), tt = T.extend({
+}), nt = T.extend({
   type: e.literal("RECAPTCHA"),
   config: e.object({
     site_key: e.string().optional()
@@ -1053,12 +1076,12 @@ const xe = e.object({
   ).optional(),
   required: e.boolean().optional(),
   sensitive: e.boolean().optional()
-}), ot = n.extend({
+}), it = n.extend({
   type: e.literal("BOOLEAN"),
   config: e.object({
     default_value: e.boolean().optional()
   }).optional()
-}), nt = n.extend({
+}), at = n.extend({
   type: e.literal("CARDS"),
   config: e.object({
     options: e.array(
@@ -1071,7 +1094,7 @@ const xe = e.object({
     ).optional(),
     multi_select: e.boolean().optional()
   }).optional()
-}), it = n.extend({
+}), rt = n.extend({
   type: e.literal("CHOICE"),
   config: e.object({
     options: e.array(
@@ -1084,7 +1107,7 @@ const xe = e.object({
     multiple: e.boolean().optional(),
     default_value: e.union([e.string(), e.array(e.string())]).optional()
   }).optional()
-}), at = n.extend({
+}), st = n.extend({
   type: e.literal("CUSTOM"),
   config: e.object({
     component: e.string().optional(),
@@ -1092,7 +1115,7 @@ const xe = e.object({
     schema: e.record(e.any()).optional(),
     code: e.string().optional()
   })
-}), st = n.extend({
+}), lt = n.extend({
   type: e.literal("DATE"),
   config: e.object({
     format: e.string().optional(),
@@ -1100,7 +1123,7 @@ const xe = e.object({
     max: e.string().optional(),
     default_value: e.string().optional()
   }).optional()
-}), rt = n.extend({
+}), ct = n.extend({
   type: e.literal("DROPDOWN"),
   config: e.object({
     options: e.array(
@@ -1114,26 +1137,26 @@ const xe = e.object({
     multiple: e.boolean().optional(),
     default_value: e.union([e.string(), e.array(e.string())]).optional()
   }).optional()
-}), lt = n.extend({
+}), pt = n.extend({
   type: e.literal("EMAIL"),
   config: e.object({
     placeholder: e.string().optional(),
     default_value: e.string().optional()
   }).optional()
-}), ct = n.extend({
+}), _t = n.extend({
   type: e.literal("FILE"),
   config: e.object({
     accept: e.string().optional(),
     max_size: e.number().optional(),
     multiple: e.boolean().optional()
   }).optional()
-}), pt = n.extend({
+}), dt = n.extend({
   type: e.literal("LEGAL"),
   config: e.object({
     text: e.string(),
     html: e.boolean().optional()
   }).optional()
-}), _t = n.extend({
+}), gt = n.extend({
   type: e.literal("NUMBER"),
   config: e.object({
     placeholder: e.string().optional(),
@@ -1142,7 +1165,7 @@ const xe = e.object({
     step: e.number().optional(),
     default_value: e.string().optional()
   }).optional()
-}), dt = n.extend({
+}), ut = n.extend({
   type: e.literal("PASSWORD"),
   config: e.object({
     placeholder: e.string().optional(),
@@ -1151,13 +1174,13 @@ const xe = e.object({
     forgot_password_link: e.string().optional(),
     default_value: e.string().optional()
   }).optional()
-}), gt = n.extend({
+}), mt = n.extend({
   type: e.literal("PAYMENT"),
   config: e.object({
     provider: e.string().optional(),
     currency: e.string().optional()
   }).optional()
-}), ut = n.extend({
+}), ht = n.extend({
   type: e.literal("SOCIAL"),
   config: e.object({
     providers: e.array(e.string()).optional(),
@@ -1172,7 +1195,7 @@ const xe = e.object({
       })
     ).optional()
   }).optional()
-}), mt = n.extend({
+}), bt = n.extend({
   type: e.literal("TEL"),
   config: e.object({
     placeholder: e.string().optional(),
@@ -1180,7 +1203,7 @@ const xe = e.object({
     default_value: e.string().optional(),
     allow_email: e.boolean().optional()
   }).optional()
-}), ht = n.extend({
+}), ft = n.extend({
   type: e.literal("TEXT"),
   config: e.object({
     placeholder: e.string().optional(),
@@ -1188,39 +1211,37 @@ const xe = e.object({
     max_length: e.number().optional(),
     default_value: e.string().optional()
   }).optional()
-}), bt = n.extend({
+}), Et = n.extend({
   type: e.literal("COUNTRY"),
   config: e.object({
     placeholder: e.string().optional(),
     default_value: e.string().optional()
   }).optional()
-}), ft = n.extend({
+}), St = n.extend({
   type: e.literal("URL"),
   config: e.object({
     placeholder: e.string().optional(),
     default_value: e.string().optional()
   }).optional()
-}), Et = e.discriminatedUnion("type", [
-  ze,
-  qe,
+}), At = e.discriminatedUnion("type", [
   Xe,
   Ve,
   Ye,
   Qe,
   Ze,
-  $e
-]), St = e.discriminatedUnion("type", [
+  $e,
   Je,
-  et,
-  tt
-]), At = e.discriminatedUnion("type", [
+  et
+]), yt = e.discriminatedUnion("type", [
+  tt,
   ot,
-  nt,
+  nt
+]), It = e.discriminatedUnion("type", [
   it,
-  bt,
   at,
-  st,
   rt,
+  Et,
+  st,
   lt,
   ct,
   pt,
@@ -1230,12 +1251,14 @@ const xe = e.object({
   ut,
   mt,
   ht,
-  ft
+  bt,
+  ft,
+  St
 ]), k = e.union([
-  Et,
-  St,
-  At
-]), Vo = /* @__PURE__ */ new Set([
+  At,
+  yt,
+  It
+]), Zo = /* @__PURE__ */ new Set([
   "BOOLEAN",
   "CARDS",
   "CHOICE",
@@ -1249,7 +1272,7 @@ const xe = e.object({
   "TEL",
   "TEXT",
   "URL"
-]), Yo = e.object({
+]), $o = e.object({
   id: e.string(),
   type: e.literal("submit"),
   label: e.string(),
@@ -1261,7 +1284,7 @@ const xe = e.object({
 }), f = e.object({
   x: e.number(),
   y: e.number()
-}), yt = e.object({
+}), Ct = e.object({
   id: e.string(),
   type: e.literal("FLOW"),
   coordinates: f,
@@ -1270,7 +1293,7 @@ const xe = e.object({
     flow_id: e.string().max(30),
     next_node: e.string().optional()
   })
-}), It = e.object({
+}), Tt = e.object({
   id: e.string(),
   type: e.literal("ROUTER"),
   coordinates: f,
@@ -1286,7 +1309,7 @@ const xe = e.object({
     ),
     fallback: e.string()
   })
-}), Ct = e.object({
+}), Ot = e.object({
   id: e.string(),
   type: e.literal("STEP"),
   coordinates: f,
@@ -1295,11 +1318,11 @@ const xe = e.object({
     components: e.array(k),
     next_node: e.string().optional()
   })
-}), Tt = e.discriminatedUnion("type", [
-  yt,
-  It,
-  Ct
-]), Ot = e.object({
+}), Nt = e.discriminatedUnion("type", [
+  Ct,
+  Tt,
+  Ot
+]), wt = e.object({
   name: e.string().openapi({
     description: "The name of the form"
   }),
@@ -1312,7 +1335,7 @@ const xe = e.object({
     default: e.string().optional()
   }).optional(),
   translations: e.record(e.string(), e.any()).optional(),
-  nodes: e.array(Tt).optional(),
+  nodes: e.array(Nt).optional(),
   start: e.object({
     hidden_fields: e.array(e.object({ key: e.string(), value: e.string() })).optional(),
     next_node: e.string().optional(),
@@ -1334,20 +1357,20 @@ const xe = e.object({
   }).optional()
 }).openapi({
   description: "Schema for flow-based forms (matches Auth0 Forms structure)"
-}), Qo = e.object({
-  ...s.shape,
-  ...Ot.shape,
+}), Jo = e.object({
+  ...r.shape,
+  ...wt.shape,
   id: e.string()
-}), Nt = e.object({
+}), jt = e.object({
   id: e.number().optional(),
   text: e.string(),
   type: e.enum(["info", "error", "success", "warning"])
-}), wt = e.object({
+}), Rt = e.object({
   id: e.string().optional(),
   text: e.string(),
   href: e.string(),
   linkText: e.string().optional()
-}), Zo = e.object({
+}), en = e.object({
   /** Screen identifier for CSS targeting (e.g., 'identifier', 'enter-password', 'signup') */
   name: e.string().optional(),
   action: e.string(),
@@ -1355,18 +1378,18 @@ const xe = e.object({
   title: e.string().optional(),
   description: e.string().optional(),
   components: e.array(k),
-  messages: e.array(Nt).optional(),
-  links: e.array(wt).optional(),
+  messages: e.array(jt).optional(),
+  links: e.array(Rt).optional(),
   /** Footer HTML content displayed at the very bottom of the widget (e.g., terms and conditions) */
   footer: e.string().optional()
 });
-function $o(t) {
+function tn(t) {
   return t.category === "BLOCK";
 }
-function Jo(t) {
+function on(t) {
   return t.category === "WIDGET";
 }
-function en(t) {
+function nn(t) {
   return t.category === "FIELD";
 }
 const U = e.enum([
@@ -1395,7 +1418,7 @@ const U = e.enum([
 ]), M = e.enum([
   "ensure-username",
   "set-preferred-username"
-]), tn = {
+]), an = {
   "ensure-username": {
     name: "Ensure Username",
     description: "Automatically assigns a username to users who sign in without one. Creates a linked username account for social/email users.",
@@ -1411,71 +1434,71 @@ const U = e.enum([
   synchronous: e.boolean().default(!1),
   priority: e.number().optional(),
   hook_id: e.string().optional()
-}, jt = e.object({
+}, Dt = e.object({
   ...c,
   trigger_id: U,
   url: e.string()
-}), Rt = e.object({
+}), Lt = e.object({
   ...c,
   trigger_id: F,
   form_id: e.string()
-}), Dt = e.object({
+}), vt = e.object({
   ...c,
   trigger_id: x,
   template_id: M
-}), Lt = e.object({
+}), kt = e.object({
   ...c,
   trigger_id: P,
   code_id: e.string()
-}), on = e.union([
-  jt,
-  Rt,
+}), rn = e.union([
   Dt,
-  Lt
-]), vt = e.object({
+  Lt,
+  vt,
+  kt
+]), Ut = e.object({
   ...c,
   trigger_id: U,
-  ...s.shape,
+  ...r.shape,
   hook_id: e.string(),
   url: e.string()
-}), kt = e.object({
+}), Ft = e.object({
   ...c,
   trigger_id: F,
-  ...s.shape,
+  ...r.shape,
   hook_id: e.string(),
   form_id: e.string()
-}), Ut = e.object({
+}), xt = e.object({
   ...c,
   trigger_id: x,
-  ...s.shape,
+  ...r.shape,
   hook_id: e.string(),
   template_id: M
-}), Ft = e.object({
+}), Pt = e.object({
   ...c,
   trigger_id: P,
-  ...s.shape,
+  ...r.shape,
   hook_id: e.string(),
   code_id: e.string()
-}), nn = e.union([
-  vt,
-  kt,
+}), sn = e.union([
   Ut,
-  Ft
-]), xt = e.object({
+  Ft,
+  xt,
+  Pt
+]), Mt = e.object({
   code: e.string().max(1e5),
   secrets: e.record(e.string()).optional()
-}), an = xt.extend({
+}), ln = Mt.extend({
   id: e.string(),
   tenant_id: e.string(),
-  ...s.shape
-}), Pt = e.object({
+  ...r.shape
+}), Ht = e.object({
   name: e.string().optional()
-}), Mt = e.object({
+}), Gt = e.object({
   email: e.string().optional()
-}), Ht = e.object({
+}), Bt = e.object({
   organization_id: e.string().max(50),
-  inviter: Pt,
-  invitee: Mt,
+  inviter: Ht,
+  invitee: Gt,
   invitation_url: e.string().url(),
   client_id: e.string(),
   connection_id: e.string().optional(),
@@ -1484,13 +1507,13 @@ const U = e.enum([
   ttl_sec: e.number().int().max(2592e3).default(604800).optional(),
   roles: e.array(e.string()).default([]).optional(),
   send_invitation_email: e.boolean().default(!0).optional()
-}), sn = e.object({
+}), cn = e.object({
   id: e.string(),
   organization_id: e.string().max(50),
   created_at: e.string().datetime(),
   expires_at: e.string().datetime(),
   ticket_id: e.string().optional()
-}).extend(Ht.shape), Gt = e.object({
+}).extend(Bt.shape), Wt = e.object({
   alg: e.enum([
     "RS256",
     "RS384",
@@ -1509,9 +1532,9 @@ const U = e.enum([
   x5t: e.string().optional(),
   x5c: e.array(e.string()).optional(),
   use: e.enum(["sig", "enc"]).optional()
-}), rn = e.object({
-  keys: e.array(Gt)
-}), ln = e.object({
+}), pn = e.object({
+  keys: e.array(Wt)
+}), _n = e.object({
   issuer: e.string(),
   authorization_endpoint: e.string(),
   token_endpoint: e.string(),
@@ -1519,7 +1542,7 @@ const U = e.enum([
   userinfo_endpoint: e.string(),
   mfa_challenge_endpoint: e.string(),
   jwks_uri: e.string(),
-  registration_endpoint: e.string(),
+  registration_endpoint: e.string().optional(),
   revocation_endpoint: e.string(),
   scopes_supported: e.array(e.string()),
   response_types_supported: e.array(e.string()),
@@ -1534,20 +1557,20 @@ const U = e.enum([
   token_endpoint_auth_signing_alg_values_supported: e.array(e.string())
 });
 var H = /* @__PURE__ */ ((t) => (t.PENDING = "pending", t.AUTHENTICATED = "authenticated", t.AWAITING_EMAIL_VERIFICATION = "awaiting_email_verification", t.AWAITING_MFA = "awaiting_mfa", t.AWAITING_HOOK = "awaiting_hook", t.AWAITING_CONTINUATION = "awaiting_continuation", t.COMPLETED = "completed", t.FAILED = "failed", t.EXPIRED = "expired", t))(H || {});
-const Bt = e.nativeEnum(H), Wt = e.object({
+const Kt = e.nativeEnum(H), zt = e.object({
   strategy: e.string(),
   strategy_type: e.string()
-}), Kt = e.object({
+}), qt = e.object({
   csrf_token: e.string(),
   auth0Client: e.string().optional(),
-  authParams: xe,
+  authParams: Me,
   expires_at: e.string(),
   deleted_at: e.string().optional(),
   ip: e.string().optional(),
   useragent: e.string().optional(),
   session_id: e.string().optional(),
   authorization_url: e.string().optional(),
-  state: Bt.optional().default(
+  state: Kt.optional().default(
     "pending"
     /* PENDING */
   ),
@@ -1558,19 +1581,19 @@ const Bt = e.nativeEnum(H), Wt = e.object({
   // Set once user is authenticated
   auth_connection: e.string().optional(),
   // The connection used to authenticate (may differ from primary user's connection)
-  auth_strategy: Wt.optional(),
+  auth_strategy: zt.optional(),
   authenticated_at: e.string().optional()
   // ISO timestamp persisted for audit/metadata; not used to reject resumed sessions
 }).openapi({
   description: "This represents a login sesion"
-}), cn = e.object({
-  ...Kt.shape,
+}), dn = e.object({
+  ...qt.shape,
   id: e.string().openapi({
     description: "This is is used as the state in the universal login"
   }),
   created_at: e.string(),
   updated_at: e.string()
-}), zt = {
+}), Xt = {
   // Network & System
   ACLS_SUMMARY: "acls_summary",
   ACTIONS_EXECUTION_FAILED: "actions_execution_failed",
@@ -1742,24 +1765,24 @@ const Bt = e.nativeEnum(H), Wt = e.object({
   WARNING_DURING_LOGIN: "w",
   WARNING_SENDING_NOTIFICATION: "wn",
   WARNING_USER_MANAGEMENT: "wum"
-}, qt = e.string().refine(
-  (t) => Object.values(zt).includes(t),
+}, Vt = e.string().refine(
+  (t) => Object.values(Xt).includes(t),
   { message: "Invalid log type" }
-), Xt = e.object({
+), Yt = e.object({
   name: e.string(),
   version: e.string(),
   env: e.object({
     node: e.string().optional()
   }).optional()
-}), Vt = e.object({
+}), Qt = e.object({
   country_code: e.string().length(2),
   city_name: e.string(),
   latitude: e.string(),
   longitude: e.string(),
   time_zone: e.string(),
   continent_code: e.string()
-}), Yt = e.object({
-  type: qt,
+}), Zt = e.object({
+  type: Vt,
   date: e.string(),
   description: e.string().optional(),
   ip: e.string().optional(),
@@ -1778,19 +1801,19 @@ const Bt = e.nativeEnum(H), Wt = e.object({
   strategy: e.string().optional(),
   strategy_type: e.string().optional(),
   hostname: e.string().optional(),
-  auth0_client: Xt.optional(),
+  auth0_client: Yt.optional(),
   log_id: e.string().optional(),
-  location_info: Vt.optional()
-}), pn = e.object({
-  ...Yt.shape,
+  location_info: Qt.optional()
+}), gn = e.object({
+  ...Zt.shape,
   log_id: e.string()
-}), Qt = e.object({
+}), $t = e.object({
   id: e.string().optional(),
   user_id: e.string(),
   password: e.string(),
   algorithm: e.enum(["bcrypt", "argon2id"]).default("argon2id"),
   is_current: e.boolean().default(!0)
-}), _n = Qt.extend({
+}), un = $t.extend({
   id: e.string(),
   created_at: e.string(),
   updated_at: e.string()
@@ -1801,7 +1824,7 @@ const Bt = e.nativeEnum(H), Wt = e.object({
   last_user_agent: e.string().describe("Last user agent of the device from which this user logged in"),
   last_ip: e.string().describe("Last IP address from which this user logged in"),
   last_asn: e.string().describe("Last autonomous system number from which this user logged in")
-}), Zt = e.object({
+}), Jt = e.object({
   id: e.string(),
   revoked_at: e.string().optional(),
   used_at: e.string().optional(),
@@ -1813,13 +1836,13 @@ const Bt = e.nativeEnum(H), Wt = e.object({
     "Metadata related to the device used in the session"
   ),
   clients: e.array(e.string()).describe("List of client details for the session")
-}), dn = e.object({
+}), mn = e.object({
   created_at: e.string(),
   updated_at: e.string(),
   authenticated_at: e.string(),
   last_interaction_at: e.string(),
-  ...Zt.shape
-}), gn = e.object({
+  ...Jt.shape
+}), hn = e.object({
   kid: e.string().openapi({ description: "The key id of the signing key" }),
   cert: e.string().openapi({ description: "The public certificate of the signing key" }),
   fingerprint: e.string().openapi({ description: "The cert fingerprint" }),
@@ -1844,7 +1867,7 @@ const Bt = e.nativeEnum(H), Wt = e.object({
   type: e.enum(["jwt_signing", "saml_encryption"]).openapi({
     description: "The type of the signing key"
   })
-}), $t = e.object({
+}), eo = e.object({
   id: e.string().optional(),
   // Basic settings
   audience: e.string(),
@@ -1895,6 +1918,33 @@ const Bt = e.nativeEnum(H), Wt = e.object({
     enable_client_connections: e.boolean().optional(),
     enable_custom_domain_in_emails: e.boolean().optional(),
     enable_dynamic_client_registration: e.boolean().optional(),
+    // AuthHero extensions — not part of Auth0. Auth0 only supports Open DCR
+    // and relies on tenant ACLs/rate limits; we implement RFC 7591 initial
+    // access tokens and a per-tenant grant-type allowlist.
+    dcr_require_initial_access_token: e.boolean().optional(),
+    dcr_allowed_grant_types: e.array(e.string()).optional(),
+    // Allowlist of `integration_type` values accepted by the
+    // `/connect/start` consent-mediated IAT flow. Empty/undefined disables
+    // the flow.
+    dcr_allowed_integration_types: e.array(e.string()).optional(),
+    // Per-tenant allowlist of fully-qualified http origins (scheme + host
+    // + port, no path) that may be used as `return_to` / `domain` on
+    // `/connect/start` despite not being loopback. Off by default.
+    allow_http_return_to: e.array(
+      e.string().refine(
+        (t) => {
+          try {
+            const o = new URL(t);
+            return o.protocol === "http:" && (o.pathname === "" || o.pathname === "/") && !o.search && !o.hash && t === o.origin;
+          } catch {
+            return !1;
+          }
+        },
+        {
+          message: "must be a fully-qualified http origin (scheme + host + port, no path)"
+        }
+      )
+    ).optional(),
     enable_idtoken_api2: e.boolean().optional(),
     enable_legacy_logs_search_v2: e.boolean().optional(),
     enable_legacy_profile: e.boolean().optional(),
@@ -1999,14 +2049,14 @@ const Bt = e.nativeEnum(H), Wt = e.object({
       message: e.string().optional()
     }).optional()
   }).optional()
-}), un = e.object({
+}), bn = e.object({
   created_at: e.string().nullable().transform((t) => t ?? ""),
   updated_at: e.string().nullable().transform((t) => t ?? ""),
-  ...$t.shape,
+  ...eo.shape,
   id: e.string()
 });
-var Jt = /* @__PURE__ */ ((t) => (t.RefreshToken = "refresh_token", t.AuthorizationCode = "authorization_code", t.ClientCredential = "client_credentials", t.Passwordless = "passwordless", t.Password = "password", t.OTP = "http://auth0.com/oauth/grant-type/passwordless/otp", t))(Jt || {});
-const mn = e.object({
+var to = /* @__PURE__ */ ((t) => (t.RefreshToken = "refresh_token", t.AuthorizationCode = "authorization_code", t.ClientCredential = "client_credentials", t.Passwordless = "passwordless", t.Password = "password", t.OTP = "http://auth0.com/oauth/grant-type/passwordless/otp", t))(to || {});
+const fn = e.object({
   access_token: e.string(),
   id_token: e.string().optional(),
   scope: e.string().optional(),
@@ -2019,7 +2069,7 @@ e.object({
   code: e.string(),
   state: e.string().optional()
 });
-const eo = e.object({
+const oo = e.object({
   button_border_radius: e.number(),
   button_border_weight: e.number(),
   buttons_style: e.enum(["pill", "rounded", "sharp"]),
@@ -2029,7 +2079,7 @@ const eo = e.object({
   show_widget_shadow: e.boolean(),
   widget_border_weight: e.number(),
   widget_corner_radius: e.number()
-}), to = e.object({
+}), no = e.object({
   base_focus_color: e.string(),
   base_hover_color: e.string(),
   body_text: e.string(),
@@ -2052,7 +2102,7 @@ const eo = e.object({
 }), u = e.object({
   bold: e.boolean(),
   size: e.number()
-}), oo = e.object({
+}), io = e.object({
   body_text: u,
   buttons_text: u,
   font_url: e.string(),
@@ -2062,31 +2112,31 @@ const eo = e.object({
   reference_text_size: e.number(),
   subtitle: u,
   title: u
-}), no = e.object({
+}), ao = e.object({
   background_color: e.string(),
   background_image_url: e.string(),
   page_layout: e.enum(["center", "left", "right"])
-}), io = e.object({
+}), ro = e.object({
   header_text_alignment: e.enum(["center", "left", "right"]),
   logo_height: e.number(),
   logo_position: e.enum(["center", "left", "none", "right"]),
   logo_url: e.string(),
   social_buttons_layout: e.enum(["bottom", "top"])
-}), ao = e.object({
-  borders: eo,
-  colors: to,
+}), so = e.object({
+  borders: oo,
+  colors: no,
   displayName: e.string(),
-  fonts: oo,
-  page_background: no,
-  widget: io
-}), hn = ao.extend({
+  fonts: io,
+  page_background: ao,
+  widget: ro
+}), En = so.extend({
   themeId: e.string()
-}), bn = e.object({
+}), Sn = e.object({
   universal_login_experience: e.enum(["new", "classic"]).default("new"),
   identifier_first: e.boolean().default(!0),
   password_first: e.boolean().default(!1),
   webauthn_platform_first_factor: e.boolean()
-}), fn = e.object({
+}), An = e.object({
   name: e.string(),
   enabled: e.boolean().optional().default(!0),
   default_from_address: e.string().optional(),
@@ -2116,7 +2166,7 @@ const eo = e.object({
     })
   ]),
   settings: e.object({}).optional()
-}), so = e.object({
+}), lo = e.object({
   // The actual refresh token value (primary key).
   id: e.string(),
   // Link to the login session
@@ -2137,23 +2187,23 @@ const eo = e.object({
     })
   ),
   rotating: e.boolean()
-}), En = e.object({
+}), yn = e.object({
   // When the refresh token record was created.
   created_at: e.string(),
   // When the token was explicitly revoked (null = still active).
   revoked_at: e.string().optional(),
   // Spread in the rest of the refresh token properties.
-  ...so.shape
-}), Sn = e.object({
+  ...lo.shape
+}), In = e.object({
   to: e.string(),
   message: e.string()
-}), An = e.object({
+}), Cn = e.object({
   name: e.string(),
   options: e.object({})
-}), ro = e.object({
+}), co = e.object({
   value: e.string(),
   description: e.string().optional()
-}), lo = e.object({
+}), po = e.object({
   token_dialect: e.enum(["access_token", "access_token_authz"]).optional(),
   enforce_policies: e.boolean().optional(),
   allow_skipping_userinfo: e.boolean().optional(),
@@ -2163,11 +2213,11 @@ const eo = e.object({
   mtls: e.object({
     bound_access_tokens: e.boolean().optional()
   }).optional()
-}), co = e.object({
+}), _o = e.object({
   id: e.string().optional(),
   name: e.string(),
   identifier: e.string(),
-  scopes: e.array(ro).optional(),
+  scopes: e.array(co).optional(),
   signing_alg: e.string().optional(),
   signing_secret: e.string().optional(),
   token_lifetime: e.number().default(86400),
@@ -2175,30 +2225,30 @@ const eo = e.object({
   skip_consent_for_verifiable_first_party_clients: e.boolean().optional(),
   allow_offline_access: e.boolean().optional(),
   verificationKey: e.string().optional(),
-  options: lo.optional(),
+  options: po.optional(),
   is_system: e.boolean().optional(),
   metadata: e.record(e.any()).optional()
-}), po = e.object({
-  ...co.shape,
+}), go = e.object({
+  ..._o.shape,
   created_at: e.string().optional(),
   updated_at: e.string().optional()
-}), yn = e.array(po), _o = e.object({
+}), Tn = e.array(go), uo = e.object({
   role_id: e.string(),
   resource_server_identifier: e.string(),
   permission_name: e.string()
-}), go = e.object({
-  ..._o.shape,
+}), mo = e.object({
+  ...uo.shape,
   created_at: e.string()
-}), In = e.array(go), uo = e.object({
+}), On = e.array(mo), ho = e.object({
   user_id: e.string(),
   resource_server_identifier: e.string(),
   permission_name: e.string(),
   organization_id: e.string().optional()
-}), mo = e.object({
-  ...uo.shape,
+}), bo = e.object({
+  ...ho.shape,
   tenant_id: e.string(),
   created_at: e.string().optional()
-}), Cn = e.array(mo), ho = e.object({
+}), Nn = e.array(bo), fo = e.object({
   user_id: e.string(),
   resource_server_identifier: e.string(),
   resource_server_name: e.string(),
@@ -2206,17 +2256,17 @@ const eo = e.object({
   description: e.string().nullable().optional(),
   created_at: e.string().optional(),
   organization_id: e.string().optional()
-}), Tn = e.array(
-  ho
-), bo = e.object({
+}), wn = e.array(
+  fo
+), Eo = e.object({
   user_id: e.string(),
   role_id: e.string(),
   organization_id: e.string().optional()
-}), fo = e.object({
-  ...bo.shape,
+}), So = e.object({
+  ...Eo.shape,
   tenant_id: e.string(),
   created_at: e.string().optional()
-}), On = e.array(fo), Eo = e.object({
+}), jn = e.array(So), Ao = e.object({
   id: e.string().optional().openapi({
     description: "The unique identifier of the role. If not provided, one will be generated."
   }),
@@ -2230,13 +2280,13 @@ const eo = e.object({
   metadata: e.record(e.any()).optional().openapi({
     description: "Metadata associated with the role. Can be used to control sync behavior in multi-tenancy scenarios."
   })
-}), So = Eo.extend({
+}), yo = Ao.extend({
   id: e.string().openapi({
     description: "The unique identifier of the role"
   }),
   created_at: e.string().optional(),
   updated_at: e.string().optional()
-}), Nn = e.array(So), Ao = e.object({
+}), Rn = e.array(yo), Io = e.object({
   logo_url: e.string().optional().openapi({
     description: "URL of the organization's logo"
   }),
@@ -2248,7 +2298,7 @@ const eo = e.object({
       description: "Page background color in hex format (e.g., #FFFFFF)"
     })
   }).optional()
-}).optional(), yo = e.object({
+}).optional(), Co = e.object({
   connection_id: e.string().openapi({
     description: "ID of the connection"
   }),
@@ -2261,7 +2311,7 @@ const eo = e.object({
   is_signup_enabled: e.boolean().default(!0).openapi({
     description: "Whether signup is enabled for this connection"
   })
-}), Io = e.object({
+}), To = e.object({
   client_credentials: e.object({
     enforce: e.boolean().default(!1).openapi({
       description: "Whether to enforce token quota limits"
@@ -2273,7 +2323,7 @@ const eo = e.object({
       description: "Maximum tokens per hour (0 = unlimited)"
     })
   }).optional()
-}).optional(), Co = e.object({
+}).optional(), Oo = e.object({
   id: e.string().optional(),
   name: e.string().min(1).regex(/^[a-z0-9_-]+$/, {
     message: "Organization name must be lowercase and can only contain letters, numbers, hyphens, and underscores"
@@ -2283,34 +2333,34 @@ const eo = e.object({
   display_name: e.string().optional().openapi({
     description: "The display name of the organization"
   }),
-  branding: Ao,
+  branding: Io,
   metadata: e.record(e.any()).default({}).optional().openapi({
     description: "Custom metadata for the organization"
   }),
-  enabled_connections: e.array(yo).default([]).optional().openapi({
+  enabled_connections: e.array(Co).default([]).optional().openapi({
     description: "List of enabled connections for the organization"
   }),
-  token_quota: Io
-}), wn = e.object({
-  ...Co.shape,
-  ...s.shape,
+  token_quota: To
+}), Dn = e.object({
+  ...Oo.shape,
+  ...r.shape,
   id: e.string(),
   // Override name to be lenient when reading from database (to support existing uppercase names)
   name: e.string().min(1).openapi({
     description: "The name of the organization"
   })
-}), To = e.object({
+}), No = e.object({
   user_id: e.string().openapi({
     description: "ID of the user"
   }),
   organization_id: e.string().openapi({
     description: "ID of the organization"
   })
-}), jn = e.object({
-  ...To.shape,
-  ...s.shape,
+}), Ln = e.object({
+  ...No.shape,
+  ...r.shape,
   id: e.string()
-}), Rn = e.object({
+}), vn = e.object({
   // Session settings
   idle_session_lifetime: e.number().default(72),
   session_lifetime: e.number().default(168),
@@ -2410,7 +2460,7 @@ const eo = e.object({
       message: e.string().optional()
     }).optional()
   }).optional()
-}), Dn = e.object({
+}), kn = e.object({
   date: e.string().openapi({
     description: "Date these events occurred in ISO 8601 format",
     example: "2025-12-19"
@@ -2435,10 +2485,10 @@ const eo = e.object({
     description: "Approximate date and time the first event occurred in ISO 8601 format",
     example: "2025-12-19T00:00:00.000Z"
   })
-}), Ln = e.number().openapi({
+}), Un = e.number().openapi({
   description: "Number of active users in the last 30 days",
   example: 1234
-}), Oo = e.enum([
+}), wo = e.enum([
   "login",
   "login-id",
   "login-password",
@@ -2467,17 +2517,17 @@ const eo = e.object({
   "custom-form",
   "login-passwordless",
   "mfa-login-options"
-]), No = e.record(e.string(), e.record(e.string(), e.string())).openapi({
+]), jo = e.record(e.string(), e.record(e.string(), e.string())).openapi({
   type: "object",
   additionalProperties: {
     type: "object",
     additionalProperties: { type: "string" }
   }
-}), vn = e.object({
-  prompt: Oo,
+}), Fn = e.object({
+  prompt: wo,
   language: e.string(),
-  custom_text: No
-}), kn = {
+  custom_text: jo
+}), xn = {
   EMAIL: "email",
   SMS: "sms",
   USERNAME_PASSWORD: "Username-Password-Authentication",
@@ -2492,11 +2542,11 @@ const eo = e.object({
   SAMLP: "samlp",
   WAAD: "waad",
   ADFS: "adfs"
-}, Un = {
+}, Pn = {
   DATABASE: "database",
   SOCIAL: "social",
   PASSWORDLESS: "passwordless"
-}, wo = e.enum([
+}, Ro = e.enum([
   "phone",
   "totp",
   "email",
@@ -2506,7 +2556,7 @@ const eo = e.object({
   "passkey"
 ]), B = e.object({
   user_id: e.string(),
-  type: wo,
+  type: Ro,
   // Phone-specific
   phone_number: e.string().optional(),
   // TOTP-specific
@@ -2540,19 +2590,19 @@ function W(t, o) {
     path: ["public_key"]
   }));
 }
-const Fn = B.superRefine(W), xn = e.object({
+const Mn = B.superRefine(W), Hn = e.object({
   ...B.shape,
   id: e.string(),
   created_at: e.string(),
   updated_at: e.string()
 }).superRefine(W);
-function Pn(t) {
+function Gn(t) {
   const [o, i] = t.split("|");
   if (!o || !i)
     throw new Error(`Invalid user_id: ${t}`);
   return { connection: o, id: i };
 }
-function Mn(t) {
+function Bn(t) {
   const {
     primary: o,
     secondaries: i,
@@ -2564,16 +2614,16 @@ function Mn(t) {
       const _ = p[a];
       return typeof _ != "function" ? _ : O.includes(a) ? async (...d) => {
         const S = await _.apply(p, d), g = [];
-        for (const r of i) {
-          const h = r.adapter[a];
+        for (const s of i) {
+          const h = s.adapter[a];
           if (typeof h != "function")
             continue;
           const A = (async () => {
             try {
-              await h.apply(r.adapter, d);
+              await h.apply(s.adapter, d);
             } catch (b) {
               try {
-                r.onError ? r.onError(b, a, d) : console.error(
+                s.onError ? s.onError(b, a, d) : console.error(
                   `Passthrough adapter: secondary write failed for ${a}:`,
                   b
                 );
@@ -2585,7 +2635,7 @@ function Mn(t) {
               }
             }
           })();
-          r.blocking && g.push(A);
+          s.blocking && g.push(A);
         }
         return g.length > 0 && await Promise.all(g), S;
       } : _.bind(p);
@@ -2593,11 +2643,11 @@ function Mn(t) {
   };
   return new Proxy(o, E);
 }
-function Hn(t) {
+function Wn(t) {
   return t;
 }
-function Gn(t) {
-  var E, p, a, _, d, S, g, r, h, A, b, y;
+function Kn(t) {
+  var E, p, a, _, d, S, g, s, h, A, b, y;
   const o = t == null ? void 0 : t.options;
   if (!o)
     return {
@@ -2608,7 +2658,7 @@ function Gn(t) {
     };
   const i = o.attributes;
   if (i) {
-    const K = ((p = (E = i.username) == null ? void 0 : E.identifier) == null ? void 0 : p.active) === !0, z = ((_ = (a = i.email) == null ? void 0 : a.identifier) == null ? void 0 : _.active) !== !1, q = ((S = (d = i.username) == null ? void 0 : d.validation) == null ? void 0 : S.min_length) ?? 1, X = ((r = (g = i.username) == null ? void 0 : g.validation) == null ? void 0 : r.max_length) ?? 15;
+    const K = ((p = (E = i.username) == null ? void 0 : E.identifier) == null ? void 0 : p.active) === !0, z = ((_ = (a = i.email) == null ? void 0 : a.identifier) == null ? void 0 : _.active) !== !1, q = ((S = (d = i.username) == null ? void 0 : d.validation) == null ? void 0 : S.min_length) ?? 1, X = ((s = (g = i.username) == null ? void 0 : g.validation) == null ? void 0 : s.max_length) ?? 15;
     return {
       usernameIdentifierActive: K,
       emailIdentifierActive: z,
@@ -2623,182 +2673,189 @@ function Gn(t) {
     usernameMaxLength: ((y = (b = o.validation) == null ? void 0 : b.username) == null ? void 0 : y.max) ?? 15
   };
 }
+function zn(t) {
+  return typeof t == "object" && t !== null && !Array.isArray(t);
+}
 export {
-  ko as Auth0ActionEnum,
-  Xt as Auth0Client,
+  Fo as Auth0ActionEnum,
+  Yt as Auth0Client,
   L as AuthorizationResponseMode,
   D as AuthorizationResponseType,
   v as CodeChallengeMethod,
   R as ComponentCategory,
   j as ComponentType,
-  Uo as EmailActionEnum,
-  Vo as FORM_FIELD_TYPES,
-  vo as FlowActionTypeEnum,
-  Jt as GrantType,
-  Vt as LocationInfo,
-  zt as LogTypes,
+  xo as EmailActionEnum,
+  Zo as FORM_FIELD_TYPES,
+  Uo as FlowActionTypeEnum,
+  to as GrantType,
+  Qt as LocationInfo,
+  Xt as LogTypes,
   H as LoginSessionState,
-  we as NodeType,
+  Re as NodeType,
   le as RedirectTargetEnum,
-  kn as Strategy,
-  Un as StrategyType,
+  xn as Strategy,
+  Pn as StrategyType,
   Y as actionDependencySchema,
   N as actionInsertSchema,
-  De as actionNodeSchema,
-  Do as actionSchema,
+  ve as actionNodeSchema,
+  vo as actionSchema,
   Q as actionSecretSchema,
   V as actionTriggerSchema,
-  Ro as actionUpdateSchema,
-  Ln as activeUsersResponseSchema,
+  Lo as actionUpdateSchema,
+  Un as activeUsersResponseSchema,
   $ as actorSchema,
   ue as addressSchema,
   Z as auditCategorySchema,
   ie as auditEventInsertSchema,
-  Lo as auditEventSchema,
+  ko as auditEventSchema,
   ne as auth0ClientSchema,
-  Wo as auth0FlowInsertSchema,
-  Fe as auth0FlowSchema,
-  xo as auth0QuerySchema,
-  se as auth0UpdateUserActionSchema,
-  Mo as auth0UserResponseSchema,
-  xe as authParamsSchema,
-  Fn as authenticationMethodInsertSchema,
-  xn as authenticationMethodSchema,
-  wo as authenticationMethodTypeSchema,
+  qo as auth0FlowInsertSchema,
+  Pe as auth0FlowSchema,
+  Mo as auth0QuerySchema,
+  re as auth0UpdateUserActionSchema,
+  Go as auth0UserResponseSchema,
+  Me as authParamsSchema,
+  Mn as authenticationMethodInsertSchema,
+  Hn as authenticationMethodSchema,
+  Ro as authenticationMethodTypeSchema,
   w as baseUserSchema,
-  Et as blockComponentSchema,
-  eo as bordersSchema,
-  Ko as brandingSchema,
-  Ie as buttonComponentSchema,
+  At as blockComponentSchema,
+  oo as bordersSchema,
+  Xo as brandingSchema,
+  Te as buttonComponentSchema,
   Se as clientGrantInsertSchema,
-  Bo as clientGrantListSchema,
+  Ko as clientGrantListSchema,
   Ae as clientGrantSchema,
   Ee as clientInsertSchema,
-  Go as clientSchema,
-  Me as codeInsertSchema,
-  zo as codeSchema,
-  Pe as codeTypeSchema,
-  to as colorsSchema,
-  Nt as componentMessageSchema,
-  Ne as componentSchema,
-  Ge as connectionInsertSchema,
-  He as connectionOptionsSchema,
-  qo as connectionSchema,
+  Ie as clientRegistrationTokenInsertSchema,
+  zo as clientRegistrationTokenSchema,
+  ye as clientRegistrationTokenTypeSchema,
+  Wo as clientSchema,
+  Ge as codeInsertSchema,
+  Vo as codeSchema,
+  He as codeTypeSchema,
+  no as colorsSchema,
+  jt as componentMessageSchema,
+  je as componentSchema,
+  We as connectionInsertSchema,
+  Be as connectionOptionsSchema,
+  Yo as connectionSchema,
   m as coordinatesSchema,
-  Mn as createPassthroughAdapter,
-  Hn as createWriteOnlyAdapter,
-  Be as customDomainInsertSchema,
-  Ke as customDomainSchema,
-  Xo as customDomainWithTenantIdSchema,
-  vn as customTextEntrySchema,
-  No as customTextSchema,
-  Dn as dailyStatsSchema,
-  fn as emailProviderSchema,
+  Bn as createPassthroughAdapter,
+  Wn as createWriteOnlyAdapter,
+  Ke as customDomainInsertSchema,
+  qe as customDomainSchema,
+  Qo as customDomainWithTenantIdSchema,
+  Fn as customTextEntrySchema,
+  jo as customTextSchema,
+  kn as dailyStatsSchema,
+  An as emailProviderSchema,
   ae as emailVerificationRulesSchema,
-  re as emailVerifyActionSchema,
-  Ue as endingSchema,
-  At as fieldComponentSchema,
+  se as emailVerifyActionSchema,
+  xe as endingSchema,
+  It as fieldComponentSchema,
   pe as flowActionStepSchema,
   _e as flowInsertSchema,
-  Fo as flowSchema,
-  Te as flowsFieldComponentSchema,
-  Re as flowsFlowNodeSchema,
-  je as flowsStepNodeSchema,
+  Po as flowSchema,
+  Ne as flowsFieldComponentSchema,
+  Le as flowsFlowNodeSchema,
+  De as flowsStepNodeSchema,
   u as fontDetailsSchema,
-  oo as fontsSchema,
-  Yo as formControlSchema,
-  Ot as formInsertSchema,
+  io as fontsSchema,
+  $o as formControlSchema,
+  wt as formInsertSchema,
   k as formNodeComponentDefinition,
-  Tt as formNodeSchema,
-  Qo as formSchema,
-  Oe as genericComponentSchema,
-  Le as genericNodeSchema,
-  Gn as getConnectionIdentifierConfig,
-  xt as hookCodeInsertSchema,
-  an as hookCodeSchema,
-  on as hookInsertSchema,
-  nn as hookSchema,
+  Nt as formNodeSchema,
+  Jo as formSchema,
+  we as genericComponentSchema,
+  ke as genericNodeSchema,
+  Kn as getConnectionIdentifierConfig,
+  Mt as hookCodeInsertSchema,
+  ln as hookCodeSchema,
+  rn as hookInsertSchema,
+  sn as hookSchema,
   M as hookTemplateId,
-  tn as hookTemplates,
+  an as hookTemplates,
   ge as identitySchema,
-  Ht as inviteInsertSchema,
-  sn as inviteSchema,
-  Mt as inviteeSchema,
-  Pt as inviterSchema,
-  $o as isBlockComponent,
-  en as isFieldComponent,
-  Jo as isWidgetComponent,
-  rn as jwksKeySchema,
-  Gt as jwksSchema,
-  Ce as legalComponentSchema,
+  Bt as inviteInsertSchema,
+  cn as inviteSchema,
+  Gt as inviteeSchema,
+  Ht as inviterSchema,
+  tn as isBlockComponent,
+  nn as isFieldComponent,
+  zn as isPlainObject,
+  on as isWidgetComponent,
+  pn as jwksKeySchema,
+  Wt as jwksSchema,
+  Oe as legalComponentSchema,
   oe as locationInfoSchema,
-  Yt as logInsertSchema,
-  pn as logSchema,
-  Wt as loginSessionAuthStrategySchema,
-  Kt as loginSessionInsertSchema,
-  cn as loginSessionSchema,
-  Bt as loginSessionStateSchema,
-  ve as nodeSchema,
-  ln as openIDConfigurationSchema,
-  Ao as organizationBrandingSchema,
-  yo as organizationEnabledConnectionSchema,
-  Co as organizationInsertSchema,
-  wn as organizationSchema,
-  Io as organizationTokenQuotaSchema,
-  no as pageBackgroundSchema,
-  Pn as parseUserId,
-  Qt as passwordInsertSchema,
-  _n as passwordSchema,
+  Zt as logInsertSchema,
+  gn as logSchema,
+  zt as loginSessionAuthStrategySchema,
+  qt as loginSessionInsertSchema,
+  dn as loginSessionSchema,
+  Kt as loginSessionStateSchema,
+  Ue as nodeSchema,
+  _n as openIDConfigurationSchema,
+  Io as organizationBrandingSchema,
+  Co as organizationEnabledConnectionSchema,
+  Oo as organizationInsertSchema,
+  Dn as organizationSchema,
+  To as organizationTokenQuotaSchema,
+  ao as pageBackgroundSchema,
+  Gn as parseUserId,
+  $t as passwordInsertSchema,
+  un as passwordSchema,
   de as profileDataSchema,
-  Oo as promptScreenSchema,
-  bn as promptSettingSchema,
+  wo as promptScreenSchema,
+  Sn as promptSettingSchema,
   ce as redirectActionSchema,
-  so as refreshTokenInsertSchema,
-  En as refreshTokenSchema,
+  lo as refreshTokenInsertSchema,
+  yn as refreshTokenSchema,
   ee as requestContextSchema,
-  co as resourceServerInsertSchema,
-  yn as resourceServerListSchema,
-  lo as resourceServerOptionsSchema,
-  po as resourceServerSchema,
-  ro as resourceServerScopeSchema,
+  _o as resourceServerInsertSchema,
+  Tn as resourceServerListSchema,
+  po as resourceServerOptionsSchema,
+  go as resourceServerSchema,
+  co as resourceServerScopeSchema,
   te as responseContextSchema,
-  ye as richTextComponentSchema,
-  Eo as roleInsertSchema,
-  Nn as roleListSchema,
-  _o as rolePermissionInsertSchema,
-  In as rolePermissionListSchema,
-  go as rolePermissionSchema,
-  So as roleSchema,
-  wt as screenLinkSchema,
-  Zt as sessionInsertSchema,
-  dn as sessionSchema,
-  gn as signingKeySchema,
-  An as smsProviderSchema,
-  Sn as smsSendParamsSchema,
-  ke as startSchema,
+  Ce as richTextComponentSchema,
+  Ao as roleInsertSchema,
+  Rn as roleListSchema,
+  uo as rolePermissionInsertSchema,
+  On as rolePermissionListSchema,
+  mo as rolePermissionSchema,
+  yo as roleSchema,
+  Rt as screenLinkSchema,
+  Jt as sessionInsertSchema,
+  mn as sessionSchema,
+  hn as signingKeySchema,
+  Cn as smsProviderSchema,
+  In as smsSendParamsSchema,
+  Fe as startSchema,
   J as targetSchema,
-  $t as tenantInsertSchema,
-  un as tenantSchema,
-  Rn as tenantSettingsSchema,
-  ao as themeInsertSchema,
-  hn as themeSchema,
-  mn as tokenResponseSchema,
-  Po as totalsSchema,
-  Zo as uiScreenSchema,
+  eo as tenantInsertSchema,
+  bn as tenantSchema,
+  vn as tenantSettingsSchema,
+  so as themeInsertSchema,
+  En as themeSchema,
+  fn as tokenResponseSchema,
+  Ho as totalsSchema,
+  en as uiScreenSchema,
   me as userInsertSchema,
-  To as userOrganizationInsertSchema,
-  jn as userOrganizationSchema,
-  uo as userPermissionInsertSchema,
-  Cn as userPermissionListSchema,
-  mo as userPermissionSchema,
-  Tn as userPermissionWithDetailsListSchema,
-  ho as userPermissionWithDetailsSchema,
-  Ho as userResponseSchema,
-  bo as userRoleInsertSchema,
-  On as userRoleListSchema,
-  fo as userRoleSchema,
+  No as userOrganizationInsertSchema,
+  Ln as userOrganizationSchema,
+  ho as userPermissionInsertSchema,
+  Nn as userPermissionListSchema,
+  bo as userPermissionSchema,
+  wn as userPermissionWithDetailsListSchema,
+  fo as userPermissionWithDetailsSchema,
+  Bo as userResponseSchema,
+  Eo as userRoleInsertSchema,
+  jn as userRoleListSchema,
+  So as userRoleSchema,
   he as userSchema,
-  We as verificationMethodsSchema,
-  St as widgetComponentSchema,
-  io as widgetSchema
+  ze as verificationMethodsSchema,
+  yt as widgetComponentSchema,
+  ro as widgetSchema
 };