@authhero/adapter-interfaces 2.4.0 → 2.6.0

package/dist/adapter-interfaces.mjs

@@ -2,10 +2,10 @@ import { z as e } from "@hono/zod-openapi";
 const s = e.object({
   created_at: e.string(),
   updated_at: e.string()
-}), F = e.object({
+}), D = e.object({
   id: e.string(),
   version: e.string().optional()
-}), D = e.object({
+}), F = e.object({
   name: e.string(),
   version: e.string()
 }), U = e.object({
@@ -16,9 +16,9 @@ const s = e.object({
 }), w = e.object({
   name: e.string().max(255),
   code: e.string().max(1e5),
-  supported_triggers: e.array(F).optional(),
+  supported_triggers: e.array(D).optional(),
   runtime: e.string().max(50).optional(),
-  dependencies: e.array(D).optional(),
+  dependencies: e.array(F).optional(),
   secrets: e.array(U).optional(),
   // Marks this action as a shared template owned by the control-plane tenant.
   // Other tenants can opt-in by creating a row with the same `name` and
@@ -42,9 +42,8 @@ const s = e.object({
       name: e.string(),
       value: e.string().optional()
     })
-  ).optional(),
-  ...s.shape
-}), te = e.string(), oe = e.enum([
+  ).optional()
+}).extend(s.shape), te = e.string(), oe = e.enum([
   "unspecified",
   "pending",
   "final",
@@ -77,7 +76,7 @@ const s = e.object({
   logs: se.optional(),
   created_at: e.string(),
   updated_at: e.string()
-}), pn = re.omit({
+}), _n = re.omit({
   tenant_id: !0,
   created_at: !0,
   updated_at: !0
@@ -85,21 +84,20 @@ const s = e.object({
   action_id: e.string(),
   code: e.string().max(1e5),
   runtime: e.string().max(50).optional(),
-  dependencies: e.array(D).optional(),
+  dependencies: e.array(F).optional(),
   secrets: e.array(U).optional(),
-  supported_triggers: e.array(F).optional(),
+  supported_triggers: e.array(D).optional(),
   deployed: e.boolean().default(!0)
-}), _n = le.extend({
+}), pn = le.extend({
   id: e.string(),
   tenant_id: e.string(),
-  number: e.number().int(),
-  ...s.shape
-}), ce = e.enum([
+  number: e.number().int()
+}).extend(s.shape), ce = e.enum([
   "user_action",
   "admin_action",
   "system",
   "api"
-]), pe = e.object({
+]), _e = e.object({
   type: e.enum(["user", "admin", "system", "api_key", "client_credentials"]),
   id: e.string().optional(),
   email: e.string().optional(),
@@ -107,16 +105,16 @@ const s = e.object({
   org_name: e.string().optional(),
   scopes: e.array(e.string()).optional(),
   client_id: e.string().optional()
-}), _e = e.object({
+}), pe = e.object({
   type: e.string(),
   id: e.string(),
-  before: e.record(e.unknown()).optional(),
-  after: e.record(e.unknown()).optional(),
-  diff: e.record(e.object({ old: e.unknown(), new: e.unknown() })).optional()
+  before: e.record(e.string(), e.unknown()).optional(),
+  after: e.record(e.string(), e.unknown()).optional(),
+  diff: e.record(e.string(), e.object({ old: e.unknown(), new: e.unknown() })).optional()
 }), de = e.object({
   method: e.string(),
   path: e.string(),
-  query: e.record(e.string()).optional(),
+  query: e.record(e.string(), e.string()).optional(),
   body: e.unknown().optional(),
   ip: e.string(),
   user_agent: e.string().optional(),
@@ -134,15 +132,15 @@ const s = e.object({
 }), me = e.object({
   name: e.string(),
   version: e.string(),
-  env: e.record(e.string()).optional()
+  env: e.record(e.string(), e.string()).optional()
 }), Ee = e.object({
   tenant_id: e.string(),
   event_type: e.string(),
   log_type: e.string(),
   description: e.string().optional(),
   category: ce,
-  actor: pe,
-  target: _e,
+  actor: _e,
+  target: pe,
   request: de,
   response: ge.optional(),
   connection: e.string().optional(),
@@ -182,7 +180,7 @@ const s = e.object({
     user_id: e.string(),
     changes: e.record(e.string(), e.any())
   })
-}), be = e.object({
+}), Ae = e.object({
   id: e.string(),
   alias: e.string().max(100).optional(),
   type: e.literal("EMAIL"),
@@ -193,7 +191,7 @@ const s = e.object({
     email: e.string(),
     rules: Se.optional()
   })
-}), Ae = e.enum(["change-email", "account", "custom"]), fe = e.object({
+}), be = e.enum(["change-email", "account", "custom"]), fe = e.object({
   id: e.string(),
   alias: e.string().max(100).optional(),
   type: e.literal("REDIRECT"),
@@ -201,27 +199,26 @@ const s = e.object({
   allow_failure: e.boolean().optional(),
   mask_output: e.boolean().optional(),
   params: e.object({
-    target: Ae.openapi({
+    target: be.openapi({
       description: "The predefined target to redirect to, or 'custom' for a custom URL"
     }),
     custom_url: e.string().optional().openapi({
       description: "Custom URL to redirect to when target is 'custom'"
     })
   })
-}), Ie = e.union([
+}), Ce = e.union([
   he,
-  be,
+  Ae,
   fe
-]), Ce = e.object({
+]), Ie = e.object({
   name: e.string().min(1).max(150).openapi({
     description: "The name of the flow"
   }),
   // Actions is an array of action steps (Auth0 stores as JSON blob)
-  actions: e.array(Ie).optional().default([]).openapi({
+  actions: e.array(Ce).optional().default([]).openapi({
     description: "The list of actions to execute in sequence"
   })
-}), En = Ce.extend({
-  ...s.shape,
+}), En = Ie.extend(s.shape).extend({
   id: e.string().openapi({
     description: "Unique identifier for the flow",
     example: "af_12tMpdJ3iek7svMyZkSh5M"
@@ -284,7 +281,11 @@ const s = e.object({
   country: e.string().optional()
   // Country name
 }).optional(), k = e.object({
-  email: e.string().optional().transform((o) => o && o.toLowerCase()),
+  // Apply the lowercase transform *before* `.optional()` so the key remains
+  // optional (`email?: string`) in inference. Zod 4 strips the optional-key
+  // marker when a transform runs over an `.optional()` schema, which made
+  // User/UserInsert types diverge.
+  email: e.string().transform((o) => o.toLowerCase()).optional(),
   username: e.string().refine((o) => !o.includes("@"), {
     message: 'Usernames must not contain "@". Use the email field for email addresses.'
   }).optional(),
@@ -339,31 +340,29 @@ const s = e.object({
     hash: e.string(),
     algorithm: e.string()
   }).optional()
-}), Re = e.object({
-  ...ye.omit({ password: !0 }).shape,
-  ...s.shape,
+}), Re = ye.omit({ password: !0 }).extend(s.shape).extend({
   user_id: e.string(),
   provider: e.string(),
   is_social: e.boolean(),
   email: e.string().optional(),
   login_count: e.number().default(0),
   identities: e.array(Te).optional()
-}), bn = Re.omit({
+}), An = Re.omit({
   registration_completed_at: !0
-}), An = k.extend({
+}), bn = k.extend({
   login_count: e.number(),
   multifactor: e.array(e.string()).optional(),
   last_ip: e.string().optional(),
   last_login: e.string().optional(),
   user_id: e.string()
 }).catchall(e.any());
-let Le = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict", Fe = (o = 21) => {
+let Le = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict", De = (o = 21) => {
   let n = "", i = crypto.getRandomValues(new Uint8Array(o |= 0));
   for (; o--; )
     n += Le[i[o] & 63];
   return n;
 };
-const De = e.object({
+const Fe = e.object({
   client_id: e.string().optional().openapi({
     description: "ID of this client. Generated server-side if omitted (Auth0 behavior)."
   }),
@@ -376,7 +375,7 @@ const De = e.object({
   global: e.boolean().default(!1).openapi({
     description: "Whether this is your global 'All Applications' client representing legacy tenant settings (true) or a regular client (false)."
   }),
-  client_secret: e.string().default(() => Fe()).optional().openapi({
+  client_secret: e.string().default(() => De()).optional().openapi({
     description: "Client secret (which you must not make public)."
   }),
   app_type: e.enum([
@@ -441,22 +440,22 @@ const De = e.object({
   allowed_logout_urls: e.array(e.string()).default([]).optional().openapi({
     description: "Comma-separated list of URLs that are valid to redirect to after logout from Auth0. Wildcards are allowed for subdomains."
   }),
-  session_transfer: e.record(e.any()).default({}).optional().openapi({
+  session_transfer: e.record(e.string(), e.any()).default({}).optional().openapi({
     description: "Native to Web SSO Configuration"
   }),
-  oidc_logout: e.record(e.any()).default({}).optional().openapi({
+  oidc_logout: e.record(e.string(), e.any()).default({}).optional().openapi({
     description: "Configuration for OIDC backchannel logout"
   }),
   grant_types: e.array(e.string()).default([]).optional().openapi({
     description: "List of grant types supported for this application. Can include authorization_code, implicit, refresh_token, client_credentials, password, http://auth0.com/oauth/grant-type/password-realm, http://auth0.com/oauth/grant-type/mfa-oob, http://auth0.com/oauth/grant-type/mfa-otp, http://auth0.com/oauth/grant-type/mfa-recovery-code, urn:openid:params:grant-type:ciba, and urn:ietf:params:oauth:grant-type:device_code."
   }),
-  jwt_configuration: e.record(e.any()).default({}).optional().openapi({
+  jwt_configuration: e.record(e.string(), e.any()).default({}).optional().openapi({
     description: "Configuration related to JWTs for the client."
   }),
-  signing_keys: e.array(e.record(e.any())).default([]).optional().openapi({
+  signing_keys: e.array(e.record(e.string(), e.any())).default([]).optional().openapi({
     description: "Signing certificates associated with this client."
   }),
-  encryption_key: e.record(e.any()).default({}).optional().openapi({
+  encryption_key: e.record(e.string(), e.any()).default({}).optional().openapi({
     description: "Encryption used for WsFed responses with this client."
   }),
   sso: e.boolean().default(!1).openapi({
@@ -483,7 +482,7 @@ const De = e.object({
   form_template: e.string().optional().openapi({
     description: "HTML form template to be used for WS-Federation."
   }),
-  addons: e.record(e.any()).default({}).optional().openapi({
+  addons: e.record(e.string(), e.any()).default({}).optional().openapi({
     description: "Addons enabled for this client and their associated configurations."
   }),
   token_endpoint_auth_method: e.enum([
@@ -495,19 +494,19 @@ const De = e.object({
   ]).default("client_secret_basic").optional().openapi({
     description: "Defines the requested authentication method for the token endpoint. `none` (public client), `client_secret_post` / `client_secret_basic` (HTTP POST / Basic), `client_secret_jwt` (RFC 7523 HMAC assertion using client_secret), or `private_key_jwt` (RFC 7523 asymmetric assertion verified against the client's `jwks` / `jwks_uri`)."
   }),
-  client_metadata: e.record(e.string().max(255)).default({}).optional().openapi({
+  client_metadata: e.record(e.string(), e.string().max(255)).default({}).optional().openapi({
     description: 'Metadata associated with the client, in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. Field names (max 255 chars) are alphanumeric and may only include the following special characters: :,-+=_*?"/()<>@ [Tab][Space]'
   }),
   hide_sign_up_disabled_error: e.boolean().default(!1).optional().openapi({
     description: "Enumeration-safe variant of the connection-level `disable_signup` flag. When a signup is blocked by the password connection and this is true, the identifier screen does not reveal that an email is unknown — it advances to the OTP/password challenge as if the account existed and fails at credential check. Mitigates email enumeration at the cost of UX: users without an account see a generic credential failure instead of an explicit signup-disabled message."
   }),
-  mobile: e.record(e.any()).default({}).optional().openapi({
+  mobile: e.record(e.string(), e.any()).default({}).optional().openapi({
     description: "Additional configuration for native mobile apps."
   }),
   initiate_login_uri: e.string().url().optional().openapi({
     description: "Initiate login uri, must be https"
   }),
-  native_social_login: e.record(e.any()).default({}).optional(),
+  native_social_login: e.record(e.string(), e.any()).default({}).optional(),
   refresh_token: e.object({
     rotation_type: e.enum(["rotating", "non-rotating"]).optional().openapi({
       description: "Whether refresh tokens for this client are rotated on every exchange (Auth0 'rotating' behavior) or kept stable (legacy non-rotating). Defaults to 'non-rotating' when unset."
@@ -538,7 +537,7 @@ const De = e.object({
   }).default({}).optional().openapi({
     description: "Refresh token configuration"
   }),
-  default_organization: e.record(e.any()).default({}).optional().openapi({
+  default_organization: e.record(e.string(), e.any()).default({}).optional().openapi({
     description: "Defines the default Organization ID and flows"
   }),
   organization_usage: e.enum(["deny", "allow", "require"]).default("deny").optional().openapi({
@@ -547,7 +546,7 @@ const De = e.object({
   organization_require_behavior: e.enum(["no_prompt", "pre_login_prompt", "post_login_prompt"]).default("no_prompt").optional().openapi({
     description: "Defines how to proceed during an authentication transaction when client.organization_usage: 'require'. Can be no_prompt (default), pre_login_prompt or post_login_prompt. post_login_prompt requires oidc_conformant: true."
   }),
-  client_authentication_methods: e.record(e.any()).default({}).optional().openapi({
+  client_authentication_methods: e.record(e.string(), e.any()).default({}).optional().openapi({
     description: "Defines client authentication methods."
   }),
   require_pushed_authorization_requests: e.boolean().default(!1).openapi({
@@ -556,7 +555,7 @@ const De = e.object({
   require_proof_of_possession: e.boolean().default(!1).openapi({
     description: "Makes the use of Proof-of-Possession mandatory for this client"
   }),
-  signed_request_object: e.record(e.any()).default({}).optional().openapi({
+  signed_request_object: e.record(e.string(), e.any()).default({}).optional().openapi({
     description: "JWT-secured Authorization Requests (JAR) settings."
   }),
   compliance_level: e.enum([
@@ -571,14 +570,14 @@ const De = e.object({
   par_request_expiry: e.number().optional().openapi({
     description: "Specifies how long, in seconds, a Pushed Authorization Request URI remains valid"
   }),
-  token_quota: e.record(e.any()).default({}).optional(),
+  token_quota: e.record(e.string(), e.any()).default({}).optional(),
   owner_user_id: e.string().optional().openapi({
     description: "User ID of the consenting user when this client was created via IAT-gated Dynamic Client Registration. NULL for clients created via the Management API or open DCR."
   }),
   registration_type: e.enum(["manual", "open_dcr", "iat_dcr"]).optional().openapi({
     description: "Provenance of this client. `manual` = Management API; `open_dcr` = RFC 7591 without IAT; `iat_dcr` = RFC 7591 with an Initial Access Token."
   }),
-  registration_metadata: e.record(e.any()).default({}).optional().openapi({
+  registration_metadata: e.record(e.string(), e.any()).default({}).optional().openapi({
     description: "Arbitrary metadata captured at Dynamic Client Registration time that isn't a first-class client field (e.g. integration_type, domain). Also stores `iat_constraints` for clients created via IAT so RFC 7592 PUT can enforce field immutability."
   }),
   user_linking_mode: e.enum(["builtin", "off"]).optional().openapi({
@@ -586,8 +585,8 @@ const De = e.object({
   })
 }), fn = e.object({
   created_at: e.string(),
-  updated_at: e.string(),
-  ...De.shape,
+  updated_at: e.string()
+}).extend(Fe.shape).extend({
   // Insert allows omitting (server-generated to match Auth0). The read schema
   // always has it — the row in storage is non-null.
   client_id: e.string()
@@ -619,34 +618,33 @@ const De = e.object({
 }), we = e.object({
   id: e.string().openapi({
     description: "ID of the client grant."
-  }),
-  ...Ue.shape,
+  })
+}).extend(Ue.shape).extend({
   created_at: e.string().optional(),
   updated_at: e.string().optional()
-}), In = e.array(we), ke = e.enum(["iat", "rat"]), je = e.object({
+}), Cn = e.array(we), ke = e.enum(["iat", "rat"]), Me = e.object({
   id: e.string(),
   token_hash: e.string(),
   type: ke,
   client_id: e.string().optional(),
   sub: e.string().optional(),
-  constraints: e.record(e.unknown()).optional(),
+  constraints: e.record(e.string(), e.unknown()).optional(),
   single_use: e.boolean().default(!1),
   expires_at: e.string().optional()
-}), Cn = e.object({
+}), In = e.object({
   created_at: e.string(),
   used_at: e.string().optional(),
-  revoked_at: e.string().optional(),
-  ...je.shape
-}), E = e.object({
+  revoked_at: e.string().optional()
+}).extend(Me.shape), E = e.object({
   x: e.number(),
   y: e.number()
 });
-var j = /* @__PURE__ */ ((o) => (o.RICH_TEXT = "RICH_TEXT", o.NEXT_BUTTON = "NEXT_BUTTON", o.BACK_BUTTON = "BACK_BUTTON", o.SUBMIT_BUTTON = "SUBMIT_BUTTON", o.DIVIDER = "DIVIDER", o.TEXT = "TEXT", o.EMAIL = "EMAIL", o.PASSWORD = "PASSWORD", o.NUMBER = "NUMBER", o.PHONE = "PHONE", o.DATE = "DATE", o.CHECKBOX = "CHECKBOX", o.RADIO = "RADIO", o.SELECT = "SELECT", o.HIDDEN = "HIDDEN", o.LEGAL = "LEGAL", o))(j || {}), M = /* @__PURE__ */ ((o) => (o.BLOCK = "BLOCK", o.FIELD = "FIELD", o))(M || {});
+var M = /* @__PURE__ */ ((o) => (o.RICH_TEXT = "RICH_TEXT", o.NEXT_BUTTON = "NEXT_BUTTON", o.BACK_BUTTON = "BACK_BUTTON", o.SUBMIT_BUTTON = "SUBMIT_BUTTON", o.DIVIDER = "DIVIDER", o.TEXT = "TEXT", o.EMAIL = "EMAIL", o.PASSWORD = "PASSWORD", o.NUMBER = "NUMBER", o.PHONE = "PHONE", o.DATE = "DATE", o.CHECKBOX = "CHECKBOX", o.RADIO = "RADIO", o.SELECT = "SELECT", o.HIDDEN = "HIDDEN", o.LEGAL = "LEGAL", o))(M || {}), v = /* @__PURE__ */ ((o) => (o.BLOCK = "BLOCK", o.FIELD = "FIELD", o))(v || {});
 const T = e.object({
   id: e.string(),
-  category: e.nativeEnum(M),
-  type: e.nativeEnum(j)
-}), Me = T.extend({
+  category: e.nativeEnum(v),
+  type: e.nativeEnum(M)
+}), ve = T.extend({
   category: e.literal(
     "BLOCK"
     /* BLOCK */
@@ -658,7 +656,7 @@ const T = e.object({
   config: e.object({
     content: e.string()
   }).passthrough()
-}), ve = T.extend({
+}), Pe = T.extend({
   category: e.literal(
     "BLOCK"
     /* BLOCK */
@@ -680,7 +678,7 @@ const T = e.object({
   config: e.object({
     text: e.string()
   }).passthrough()
-}), Pe = T.extend({
+}), je = T.extend({
   category: e.literal(
     "FIELD"
     /* FIELD */
@@ -752,14 +750,14 @@ const T = e.object({
   category: e.string(),
   type: e.string()
 }).passthrough(), Ge = e.union([
-  Me,
   ve,
   Pe,
+  je,
   xe,
   He
 ]);
-var Be = /* @__PURE__ */ ((o) => (o.STEP = "STEP", o.FLOW = "FLOW", o.CONDITION = "CONDITION", o.ACTION = "ACTION", o))(Be || {});
-const Ke = e.object({
+var We = /* @__PURE__ */ ((o) => (o.STEP = "STEP", o.FLOW = "FLOW", o.CONDITION = "CONDITION", o.ACTION = "ACTION", o))(We || {});
+const Be = e.object({
   id: e.string(),
   type: e.literal(
     "STEP"
@@ -771,7 +769,7 @@ const Ke = e.object({
     components: e.array(Ge),
     next_node: e.string()
   }).passthrough()
-}), We = e.object({
+}), Ke = e.object({
   id: e.string(),
   type: e.literal(
     "FLOW"
@@ -810,8 +808,8 @@ const Ke = e.object({
   type: e.string(),
   coordinates: E
 }).passthrough(), qe = e.union([
+  Be,
   Ke,
-  We,
   Ve,
   Xe
 ]), ze = e.object({
@@ -840,7 +838,7 @@ const Ke = e.object({
   created_at: !0,
   updated_at: !0
 });
-var v = /* @__PURE__ */ ((o) => (o.TOKEN = "token", o.ID_TOKEN = "id_token", o.TOKEN_ID_TOKEN = "id_token token", o.CODE = "code", o.CODE_ID_TOKEN = "code id_token", o.CODE_TOKEN = "code token", o.CODE_ID_TOKEN_TOKEN = "code id_token token", o))(v || {}), P = /* @__PURE__ */ ((o) => (o.QUERY = "query", o.FRAGMENT = "fragment", o.FORM_POST = "form_post", o.WEB_MESSAGE = "web_message", o.SAML_POST = "saml_post", o))(P || {}), x = /* @__PURE__ */ ((o) => (o.S256 = "S256", o.Plain = "plain", o))(x || {});
+var P = /* @__PURE__ */ ((o) => (o.TOKEN = "token", o.ID_TOKEN = "id_token", o.TOKEN_ID_TOKEN = "id_token token", o.CODE = "code", o.CODE_ID_TOKEN = "code id_token", o.CODE_TOKEN = "code token", o.CODE_ID_TOKEN_TOKEN = "code id_token token", o))(P || {}), j = /* @__PURE__ */ ((o) => (o.QUERY = "query", o.FRAGMENT = "fragment", o.FORM_POST = "form_post", o.WEB_MESSAGE = "web_message", o.SAML_POST = "saml_post", o))(j || {}), x = /* @__PURE__ */ ((o) => (o.S256 = "S256", o.Plain = "plain", o))(x || {});
 const L = e.union([
   e.null(),
   e.object({
@@ -854,8 +852,8 @@ const L = e.union([
 }), Je = e.object({
   client_id: e.string(),
   act_as: e.string().optional(),
-  response_type: e.nativeEnum(v).optional(),
-  response_mode: e.nativeEnum(P).optional(),
+  response_type: e.nativeEnum(P).optional(),
+  response_mode: e.nativeEnum(j).optional(),
   redirect_uri: e.string().optional(),
   audience: e.string().optional(),
   organization: e.string().optional(),
@@ -946,8 +944,7 @@ const L = e.union([
   expires_at: e.string(),
   used_at: e.string().optional(),
   user_id: e.string().optional()
-}), Nn = e.object({
-  ...et.shape,
+}), Nn = et.extend({
   created_at: e.string()
 }), tt = e.object({
   kid: e.string().optional(),
@@ -1115,7 +1112,7 @@ const ot = e.object({
   response_mode: e.custom().optional(),
   is_domain_connection: e.boolean().optional(),
   show_as_button: e.boolean().optional(),
-  metadata: e.record(e.any()).optional(),
+  metadata: e.record(e.string(), e.any()).optional(),
   is_system: e.boolean().optional()
 }), yn = e.object({
   id: e.string(),
@@ -1134,7 +1131,7 @@ const ot = e.object({
     "x-azure-clientip",
     "null"
   ]).optional(),
-  domain_metadata: e.record(e.string().max(255)).optional()
+  domain_metadata: e.record(e.string(), e.string().max(255)).optional()
 }), it = e.discriminatedUnion("name", [
   e.object({
     name: e.literal("txt"),
@@ -1146,8 +1143,7 @@ const ot = e.object({
     http_body: e.string(),
     http_url: e.string()
   })
-]), at = e.object({
-  ...nt.shape,
+]), at = nt.extend({
   custom_domain_id: e.string(),
   primary: e.boolean(),
   status: e.enum(["disabled", "pending", "pending_verification", "ready"]),
@@ -1188,13 +1184,13 @@ const ot = e.object({
     text: e.string().optional(),
     target_step: e.string().optional()
   })
-}), pt = c.extend({
+}), _t = c.extend({
   type: e.literal("RESEND_BUTTON"),
   config: e.object({
     text: e.string().optional(),
     resend_action: e.string().optional()
   })
-}), _t = c.extend({
+}), pt = c.extend({
   type: e.literal("NEXT_BUTTON"),
   config: e.object({
     text: e.string().optional()
@@ -1261,7 +1257,7 @@ const ot = e.object({
     ).optional(),
     multi_select: e.boolean().optional()
   }).optional()
-}), bt = a.extend({
+}), At = a.extend({
   type: e.literal("CHOICE"),
   config: e.object({
     options: e.array(
@@ -1274,12 +1270,12 @@ const ot = e.object({
     multiple: e.boolean().optional(),
     default_value: e.union([e.string(), e.array(e.string())]).optional()
   }).optional()
-}), At = a.extend({
+}), bt = a.extend({
   type: e.literal("CUSTOM"),
   config: e.object({
     component: e.string().optional(),
-    props: e.record(e.any()).optional(),
-    schema: e.record(e.any()).optional(),
+    props: e.record(e.string(), e.any()).optional(),
+    schema: e.record(e.string(), e.any()).optional(),
     code: e.string().optional()
   })
 }), ft = a.extend({
@@ -1290,7 +1286,7 @@ const ot = e.object({
     max: e.string().optional(),
     default_value: e.string().optional()
   }).optional()
-}), It = a.extend({
+}), Ct = a.extend({
   type: e.literal("DROPDOWN"),
   config: e.object({
     options: e.array(
@@ -1304,7 +1300,7 @@ const ot = e.object({
     multiple: e.boolean().optional(),
     default_value: e.union([e.string(), e.array(e.string())]).optional()
   }).optional()
-}), Ct = a.extend({
+}), It = a.extend({
   type: e.literal("EMAIL"),
   config: e.object({
     placeholder: e.string().optional(),
@@ -1362,7 +1358,7 @@ const ot = e.object({
       })
     ).optional()
   }).optional()
-}), Ft = a.extend({
+}), Dt = a.extend({
   type: e.literal("TEL"),
   config: e.object({
     placeholder: e.string().optional(),
@@ -1370,7 +1366,7 @@ const ot = e.object({
     default_value: e.string().optional(),
     allow_email: e.boolean().optional()
   }).optional()
-}), Dt = a.extend({
+}), Ft = a.extend({
   type: e.literal("TEXT"),
   config: e.object({
     placeholder: e.string().optional(),
@@ -1395,36 +1391,36 @@ const ot = e.object({
   rt,
   lt,
   ct,
-  pt,
   _t,
+  pt,
   dt,
   gt
-]), jt = e.discriminatedUnion("type", [
+]), Mt = e.discriminatedUnion("type", [
   ut,
   mt,
   Et
-]), Mt = e.discriminatedUnion("type", [
+]), vt = e.discriminatedUnion("type", [
   St,
   ht,
-  bt,
-  Ut,
   At,
+  Ut,
+  bt,
   ft,
-  It,
   Ct,
+  It,
   Ot,
   Tt,
   Nt,
   yt,
   Rt,
   Lt,
-  Ft,
   Dt,
+  Ft,
   wt
 ]), H = e.union([
   kt,
-  jt,
-  Mt
+  Mt,
+  vt
 ]), Ln = /* @__PURE__ */ new Set([
   "BOOLEAN",
   "CARDS",
@@ -1439,7 +1435,7 @@ const ot = e.object({
   "TEL",
   "TEXT",
   "URL"
-]), Fn = e.object({
+]), Dn = e.object({
   id: e.string(),
   type: e.literal("submit"),
   label: e.string(),
@@ -1448,22 +1444,22 @@ const ot = e.object({
   order: e.number().optional(),
   visible: e.boolean().optional().default(!0),
   customizations: e.record(e.string(), e.any()).optional()
-}), A = e.object({
+}), b = e.object({
   x: e.number(),
   y: e.number()
-}), vt = e.object({
+}), Pt = e.object({
   id: e.string(),
   type: e.literal("FLOW"),
-  coordinates: A,
+  coordinates: b,
   alias: e.string().min(1).max(150).optional(),
   config: e.object({
     flow_id: e.string().max(30),
     next_node: e.string().optional()
   })
-}), Pt = e.object({
+}), jt = e.object({
   id: e.string(),
   type: e.literal("ROUTER"),
-  coordinates: A,
+  coordinates: b,
   alias: e.string().min(1).max(150),
   config: e.object({
     rules: e.array(
@@ -1479,15 +1475,15 @@ const ot = e.object({
 }), xt = e.object({
   id: e.string(),
   type: e.literal("STEP"),
-  coordinates: A,
+  coordinates: b,
   alias: e.string().min(1).max(150).optional(),
   config: e.object({
     components: e.array(H),
     next_node: e.string().optional()
   })
 }), Ht = e.discriminatedUnion("type", [
-  vt,
   Pt,
+  jt,
   xt
 ]), Gt = e.object({
   name: e.string().openapi({
@@ -1506,7 +1502,7 @@ const ot = e.object({
   start: e.object({
     hidden_fields: e.array(e.object({ key: e.string(), value: e.string() })).optional(),
     next_node: e.string().optional(),
-    coordinates: A.optional()
+    coordinates: b.optional()
   }).optional(),
   ending: e.object({
     redirection: e.object({
@@ -1514,7 +1510,7 @@ const ot = e.object({
       target: e.string().optional()
     }).optional(),
     after_submit: e.object({ flow_id: e.string().optional() }).optional(),
-    coordinates: A.optional(),
+    coordinates: b.optional(),
     resume_flow: e.boolean().optional()
   }).optional(),
   style: e.object({ css: e.string().optional() }).optional(),
@@ -1524,15 +1520,13 @@ const ot = e.object({
   }).optional()
 }).openapi({
   description: "Schema for flow-based forms (matches Auth0 Forms structure)"
-}), Dn = e.object({
-  ...s.shape,
-  ...Gt.shape,
+}), Fn = s.extend(Gt.shape).extend({
   id: e.string()
-}), Bt = e.object({
+}), Wt = e.object({
   id: e.number().optional(),
   text: e.string(),
   type: e.enum(["info", "error", "success", "warning"])
-}), Kt = e.object({
+}), Bt = e.object({
   id: e.string().optional(),
   text: e.string(),
   href: e.string(),
@@ -1545,8 +1539,8 @@ const ot = e.object({
   title: e.string().optional(),
   description: e.string().optional(),
   components: e.array(H),
-  messages: e.array(Bt).optional(),
-  links: e.array(Kt).optional(),
+  messages: e.array(Wt).optional(),
+  links: e.array(Bt).optional(),
   /** Footer HTML content displayed at the very bottom of the widget (e.g., terms and conditions) */
   footer: e.string().optional()
 });
@@ -1556,7 +1550,7 @@ function wn(o) {
 function kn(o) {
   return o.category === "WIDGET";
 }
-function jn(o) {
+function Mn(o) {
   return o.category === "FIELD";
 }
 const G = e.enum([
@@ -1568,19 +1562,19 @@ const G = e.enum([
   "pre-user-deletion",
   "post-user-deletion"
   // Potentially other triggers specific to webhooks in the future
-]), B = e.enum([
+]), W = e.enum([
   "pre-user-registration",
   "post-user-registration",
   "post-user-login",
   "validate-registration-username",
   "pre-user-deletion",
   "post-user-deletion"
-]), K = e.enum([
+]), B = e.enum([
   "post-user-login",
   "post-user-registration",
   "post-user-update",
   "credentials-exchange"
-]), W = e.enum([
+]), K = e.enum([
   "post-user-login",
   "credentials-exchange",
   "pre-user-registration",
@@ -1589,7 +1583,7 @@ const G = e.enum([
   "ensure-username",
   "set-preferred-username",
   "account-linking"
-]), Mn = {
+]), vn = {
   "ensure-username": {
     name: "Ensure Username",
     description: "Automatically assigns a username to users who sign in without one. Creates a linked username account for social/email users.",
@@ -1609,7 +1603,7 @@ const G = e.enum([
       "post-user-update"
     ]
   }
-}, p = {
+}, _ = {
   enabled: e.boolean().default(!1),
   synchronous: e.boolean().default(!1),
   priority: e.number().optional(),
@@ -1625,77 +1619,77 @@ const G = e.enum([
    *
    * Everything else is opaque to the runtime. Persisted as JSON.
    */
-  metadata: e.record(e.unknown()).optional()
-}, Wt = e.object({
-  ...p,
+  metadata: e.record(e.string(), e.unknown()).optional()
+}, Kt = e.object({
+  ..._,
   trigger_id: G,
   url: e.string()
 }), Vt = e.object({
-  ...p,
-  trigger_id: B,
+  ..._,
+  trigger_id: W,
   form_id: e.string()
 }), Xt = e.object({
-  ...p,
-  trigger_id: K,
+  ..._,
+  trigger_id: B,
   template_id: V
 }), qt = e.object({
-  ...p,
-  trigger_id: W,
+  ..._,
+  trigger_id: K,
   code_id: e.string()
-}), vn = e.union([
-  Wt,
+}), Pn = e.union([
+  Kt,
   Vt,
   Xt,
   qt
 ]), zt = e.object({
-  ...p,
-  trigger_id: G,
-  ...s.shape,
+  ..._,
+  trigger_id: G
+}).extend(s.shape).extend({
   hook_id: e.string(),
   url: e.string()
 }), Yt = e.object({
-  ...p,
-  trigger_id: B,
-  ...s.shape,
+  ..._,
+  trigger_id: W
+}).extend(s.shape).extend({
   hook_id: e.string(),
   form_id: e.string()
 }), Qt = e.object({
-  ...p,
-  trigger_id: K,
-  ...s.shape,
+  ..._,
+  trigger_id: B
+}).extend(s.shape).extend({
   hook_id: e.string(),
   template_id: V
 }), Zt = e.object({
-  ...p,
-  trigger_id: W,
-  ...s.shape,
+  ..._,
+  trigger_id: K
+}).extend(s.shape).extend({
   hook_id: e.string(),
   code_id: e.string()
-}), Pn = e.union([
+}), jn = e.union([
   zt,
   Yt,
   Qt,
   Zt
 ]), Jt = e.object({
   code: e.string().max(1e5),
-  secrets: e.record(e.string()).optional()
+  secrets: e.record(e.string(), e.string()).optional()
 }), xn = Jt.extend({
   id: e.string(),
-  tenant_id: e.string(),
-  ...s.shape
-}), $t = e.object({
+  tenant_id: e.string()
+}).extend(s.shape), $t = e.object({
   name: e.string().optional()
 }), eo = e.object({
   email: e.string().optional()
 }), to = e.object({
+  id: e.string().optional(),
   organization_id: e.string().max(50),
   inviter: $t,
   invitee: eo,
   invitation_url: e.string().url(),
   client_id: e.string(),
   connection_id: e.string().optional(),
-  app_metadata: e.record(e.any()).default({}).optional(),
-  user_metadata: e.record(e.any()).default({}).optional(),
+  app_metadata: e.record(e.string(), e.any()).default({}).optional(),
+  user_metadata: e.record(e.string(), e.any()).default({}).optional(),
   ttl_sec: e.number().int().max(2592e3).default(604800).optional(),
   roles: e.array(e.string()).default([]).optional(),
   send_invitation_email: e.boolean().default(!0).optional()
@@ -1705,7 +1699,7 @@ const G = e.enum([
   created_at: e.string().datetime(),
   expires_at: e.string().datetime(),
   ticket_id: e.string().optional()
-}).extend(to.shape), oo = e.object({
+}).extend(to.omit({ id: !0 }).shape), oo = e.object({
   alg: e.enum([
     "RS256",
     "RS384",
@@ -1746,7 +1740,7 @@ const G = e.enum([
       });
 }), Gn = e.object({
   keys: e.array(oo)
-}), Bn = e.object({
+}), Wn = e.object({
   issuer: e.string(),
   authorization_endpoint: e.string(),
   token_endpoint: e.string(),
@@ -1800,8 +1794,7 @@ const no = e.nativeEnum(X), io = e.object({
   // ISO timestamp persisted for audit/metadata; not used to reject resumed sessions
 }).openapi({
   description: "This represents a login sesion"
-}), Kn = e.object({
-  ...ao.shape,
+}), Bn = ao.extend({
   id: e.string().openapi({
     description: "This is is used as the state in the universal login"
   }),
@@ -1952,6 +1945,7 @@ const no = e.nativeEnum(X), io = e.object({
   SUCCESS_EXCHANGE_NATIVE_SOCIAL_LOGIN: "sens",
   SUCCESS_EXCHANGE_PASSWORD_OOB_FOR_ACCESS_TOKEN: "seoobft",
   SUCCESS_EXCHANGE_PASSWORD_OTP_FOR_ACCESS_TOKEN: "seotpft",
+  SUCCESS_EXCHANGE_PASSWORDLESS_OTP_FOR_ACCESS_TOKEN: "sepotpft",
   SUCCESS_EXCHANGE_PASSWORD_FOR_ACCESS_TOKEN: "sepft",
   SUCCESS_EXCHANGE_PASSKEY_OOB_FOR_ACCESS_TOKEN: "sepkoobft",
   SUCCESS_EXCHANGE_PASSKEY_OTP_FOR_ACCESS_TOKEN: "sepkotpft",
@@ -2116,6 +2110,7 @@ const no = e.nativeEnum(X), io = e.object({
   [t.SUCCESS_EXCHANGE_NATIVE_SOCIAL_LOGIN]: "Success Exchange Native Social Login",
   [t.SUCCESS_EXCHANGE_PASSWORD_OOB_FOR_ACCESS_TOKEN]: "Success Exchange Password OOB for Access Token",
   [t.SUCCESS_EXCHANGE_PASSWORD_OTP_FOR_ACCESS_TOKEN]: "Success Exchange Password OTP for Access Token",
+  [t.SUCCESS_EXCHANGE_PASSWORDLESS_OTP_FOR_ACCESS_TOKEN]: "Success Exchange Passwordless OTP for Access Token",
   [t.SUCCESS_EXCHANGE_PASSWORD_FOR_ACCESS_TOKEN]: "Success Exchange Password for Access Token",
   [t.SUCCESS_EXCHANGE_PASSKEY_OOB_FOR_ACCESS_TOKEN]: "Success Exchange Passkey OOB for Access Token",
   [t.SUCCESS_EXCHANGE_PASSKEY_OTP_FOR_ACCESS_TOKEN]: "Success Exchange Passkey OTP for Access Token",
@@ -2148,10 +2143,10 @@ const no = e.nativeEnum(X), io = e.object({
 }, lo = (() => {
   const o = {};
   for (const [n, i] of Object.entries(t))
-    n.startsWith("SUCCESS_") || n.startsWith("SUCCESSFUL_") || n.startsWith("SUCCESSFULLY_") ? o[i] = "success" : n.startsWith("FAILED_") || n.startsWith("ERROR_") || n.startsWith("BREACHED_") || n.startsWith("BLOCKED_") || n === "MFA_AUTH_FAILED" || n === "MFA_AUTH_REJECTED" || n === "MFA_RECOVERY_FAILED" || n === "MFA_ENROLLMENT_FAILED" || n === "EMAIL_VERIFICATION_FAILED" || n === "WEBAUTHN_CHALLENGE_FAILED" || n === "WEBAUTHN_ENROLLMENT_FAILED" || n === "PASSKEY_CHALLENGE_FAILED" || n === "FLOWS_EXECUTION_FAILED" || n === "FORMS_SUBMISSION_FAILED" || n === "CIBA_EXCHANGE_FAILED" || n === "CIBA_START_FAILED" || n === "ACTIONS_EXECUTION_FAILED" || n === "RICH_CONSENTS_ACCESS_ERROR" || n === "USER_CANCELED_DEVICE_CONFIRMATION" || n === "TOO_MANY_MFA_FAILURES" || n === "MFA_RECOVERY_RATE_LIMIT_EXCEED" || n === "API_LIMIT" || n === "MAX_AMOUNT_OF_AUTHENTICATORS" ? o[i] = "failure" : n.startsWith("WARNING_") || n === "API_LIMIT_WARNING" || n === "DEPRECATION_NOTICE" || n === "PRE_LOGIN_ASSESSMENT" ? o[i] = "warning" : n === "CODE_SENT" || n === "CODE_LINK_SENT" || n === "MFA_EMAIL_SENT" || n === "MFA_SMS_SENT" || n === "EMAIL_VERIFICATION_SENT" || n === "PUSH_NOTIFICATION_SENT" ? o[i] = "code_sent" : n === "INFORMATION" || n === "INFORMATION_FROM_SS_SSO_OPERATION" || n === "MANAGEMENT_API_READ_OPERATION" || n === "APPI" || n === "ACLS_SUMMARY" || n === "ORGANIZATION_MEMBER_ADDED" ? o[i] = "info" : o[i] = "other";
+    n.startsWith("SUCCESS_") || n.startsWith("SUCCESSFUL_") || n.startsWith("SUCCESSFULLY_") || n.endsWith("_SUCCEEDED") || n.endsWith("_COMPLETED") ? o[i] = "success" : n.startsWith("FAILED_") || n.startsWith("ERROR_") || n.startsWith("BREACHED_") || n.startsWith("BLOCKED_") || n === "MFA_AUTH_FAILED" || n === "MFA_AUTH_REJECTED" || n === "MFA_RECOVERY_FAILED" || n === "MFA_ENROLLMENT_FAILED" || n === "EMAIL_VERIFICATION_FAILED" || n === "WEBAUTHN_CHALLENGE_FAILED" || n === "WEBAUTHN_ENROLLMENT_FAILED" || n === "PASSKEY_CHALLENGE_FAILED" || n === "FLOWS_EXECUTION_FAILED" || n === "FORMS_SUBMISSION_FAILED" || n === "CIBA_EXCHANGE_FAILED" || n === "CIBA_START_FAILED" || n === "ACTIONS_EXECUTION_FAILED" || n === "RICH_CONSENTS_ACCESS_ERROR" || n === "USER_CANCELED_DEVICE_CONFIRMATION" || n === "TOO_MANY_MFA_FAILURES" || n === "MFA_RECOVERY_RATE_LIMIT_EXCEED" || n === "API_LIMIT" || n === "MAX_AMOUNT_OF_AUTHENTICATORS" ? o[i] = "failure" : n.startsWith("WARNING_") || n === "API_LIMIT_WARNING" || n === "DEPRECATION_NOTICE" || n === "PRE_LOGIN_ASSESSMENT" ? o[i] = "warning" : n === "CODE_SENT" || n === "CODE_LINK_SENT" || n === "MFA_EMAIL_SENT" || n === "MFA_SMS_SENT" || n === "EMAIL_VERIFICATION_SENT" || n === "PUSH_NOTIFICATION_SENT" ? o[i] = "code_sent" : n === "INFORMATION" || n === "INFORMATION_FROM_SS_SSO_OPERATION" || n === "MANAGEMENT_API_READ_OPERATION" || n === "APPI" || n === "ACLS_SUMMARY" || n === "ORGANIZATION_MEMBER_ADDED" ? o[i] = "info" : o[i] = "other";
   return o;
 })();
-function Wn(o) {
+function Kn(o) {
   return ro[o] ?? o;
 }
 function Vn(o) {
@@ -2163,14 +2158,14 @@ const co = e.object({
   env: e.object({
     node: e.string().optional()
   }).optional()
-}), po = e.object({
+}), _o = e.object({
   country_code: e.string().length(2),
   city_name: e.string(),
   latitude: e.string(),
   longitude: e.string(),
   time_zone: e.string(),
   continent_code: e.string()
-}), _o = e.object({
+}), po = e.object({
   type: so,
   date: e.string(),
   description: e.string().optional(),
@@ -2192,9 +2187,8 @@ const co = e.object({
   hostname: e.string().optional(),
   auth0_client: co.optional(),
   log_id: e.string().optional(),
-  location_info: po.optional()
-}), Xn = e.object({
-  ..._o.shape,
+  location_info: _o.optional()
+}), Xn = po.extend({
   log_id: e.string()
 }), go = e.enum([
   "http",
@@ -2240,7 +2234,7 @@ const co = e.object({
   id: e.string(),
   created_at: e.string(),
   updated_at: e.string()
-}).extend(ho.shape), bo = e.object({
+}).extend(ho.shape), Ao = e.object({
   enabled: e.boolean().optional(),
   shields: e.array(e.string()).optional(),
   admin_notification_frequency: e.array(e.string()).optional(),
@@ -2253,7 +2247,7 @@ const co = e.object({
       shields: e.array(e.string()).optional()
     }).optional()
   }).optional()
-}), Ao = e.object({
+}), bo = e.object({
   enabled: e.boolean().optional(),
   shields: e.array(e.string()).optional(),
   allowlist: e.array(e.string()).optional(),
@@ -2273,17 +2267,17 @@ const co = e.object({
       rate: e.number().optional()
     }).optional()
   }).optional()
-}), Io = e.object({
-  breached_password_detection: bo.optional(),
-  brute_force_protection: Ao.optional(),
-  suspicious_ip_throttling: fo.optional()
 }), Co = e.object({
+  breached_password_detection: Ao.optional(),
+  brute_force_protection: bo.optional(),
+  suspicious_ip_throttling: fo.optional()
+}), Io = e.object({
   id: e.string().optional(),
   user_id: e.string(),
   password: e.string(),
   algorithm: e.enum(["bcrypt", "argon2id"]).default("argon2id"),
   is_current: e.boolean().default(!0)
-}), Yn = Co.extend({
+}), Yn = Io.extend({
   id: e.string(),
   created_at: e.string(),
   updated_at: e.string()
@@ -2310,9 +2304,8 @@ const co = e.object({
   created_at: e.string(),
   updated_at: e.string(),
   authenticated_at: e.string(),
-  last_interaction_at: e.string(),
-  ...Oo.shape
-}), Zn = e.object({
+  last_interaction_at: e.string()
+}).extend(Oo.shape), Zn = e.object({
   kid: e.string().openapi({ description: "The key id of the signing key" }),
   tenant_id: e.string().optional().openapi({
     description: "The tenant the key belongs to. Omitted means the key is shared / control-plane scoped."
@@ -2461,10 +2454,10 @@ const co = e.object({
   // Default token quota
   default_token_quota: e.object({
     clients: e.object({
-      client_credentials: e.record(e.any()).optional()
+      client_credentials: e.record(e.string(), e.any()).optional()
     }).optional(),
     organizations: e.object({
-      client_credentials: e.record(e.any()).optional()
+      client_credentials: e.record(e.string(), e.any()).optional()
     }).optional()
   }).nullish(),
   // Default audience
@@ -2493,7 +2486,7 @@ const co = e.object({
   pushed_authorization_requests_supported: e.boolean().optional(),
   authorization_response_iss_parameter_supported: e.boolean().optional(),
   // Attack-protection config (singleton, exposed via /api/v2/attack-protection)
-  attack_protection: Io.optional(),
+  attack_protection: Co.optional(),
   // Guardian MFA Factors configuration (internal storage, exposed via /guardian API)
   mfa: e.object({
     // MFA policy: "never" = MFA disabled, "always" = MFA required for all logins
@@ -2527,8 +2520,8 @@ const co = e.object({
   }).optional()
 }), Jn = e.object({
   created_at: e.string().nullable().transform((o) => o ?? ""),
-  updated_at: e.string().nullable().transform((o) => o ?? ""),
-  ...To.shape,
+  updated_at: e.string().nullable().transform((o) => o ?? "")
+}).extend(To.shape).extend({
   id: e.string(),
   // Computed server-side: true when this tenant is the deployment's control
   // plane (either `multiTenancyConfig.controlPlaneTenantId` matches the
@@ -2593,7 +2586,7 @@ const yo = e.object({
   reference_text_size: e.number(),
   subtitle: m,
   title: m
-}), Fo = e.object({
+}), Do = e.object({
   background_color: e.string(),
   background_image_url: e.string(),
   page_layout: e.enum(["center", "left", "right"]),
@@ -2606,7 +2599,7 @@ const yo = e.object({
    * Optional for backwards compatibility; absent values mean "widget".
    */
   logo_placement: e.enum(["widget", "chip", "none"]).optional()
-}), Do = e.object({
+}), Fo = e.object({
   header_text_alignment: e.enum(["center", "left", "right"]),
   logo_height: e.number(),
   logo_position: e.enum(["center", "left", "none", "right"]),
@@ -2617,8 +2610,8 @@ const yo = e.object({
   colors: Ro,
   displayName: e.string(),
   fonts: Lo,
-  page_background: Fo,
-  widget: Do
+  page_background: Do,
+  widget: Fo
 }), ei = Uo.extend({
   themeId: e.string()
 }), ti = e.object({
@@ -2689,23 +2682,21 @@ const yo = e.object({
   // ISO of the *first* rotation. Anchors the leeway window so siblings minted
   // within the window don't extend the parent's exposure.
   rotated_at: e.string().optional()
-}), ii = e.object({
+}), ii = ko.extend({
   // When the refresh token record was created.
   created_at: e.string(),
   // When the token was explicitly revoked (null = still active).
-  revoked_at: e.string().optional(),
-  // Spread in the rest of the refresh token properties.
-  ...ko.shape
+  revoked_at: e.string().optional()
 }), ai = e.object({
   to: e.string(),
   message: e.string()
 }), si = e.object({
   name: e.string(),
   options: e.object({})
-}), jo = e.object({
+}), Mo = e.object({
   value: e.string(),
   description: e.string().optional()
-}), Mo = e.object({
+}), vo = e.object({
   token_dialect: e.enum(["access_token", "access_token_authz"]).optional(),
   enforce_policies: e.boolean().optional(),
   allow_skipping_userinfo: e.boolean().optional(),
@@ -2715,11 +2706,11 @@ const yo = e.object({
   mtls: e.object({
     bound_access_tokens: e.boolean().optional()
   }).optional()
-}), vo = e.object({
+}), Po = e.object({
   id: e.string().optional(),
   name: e.string(),
   identifier: e.string(),
-  scopes: e.array(jo).optional(),
+  scopes: e.array(Mo).optional(),
   signing_alg: e.string().optional(),
   signing_secret: e.string().optional(),
   token_lifetime: e.number().default(86400),
@@ -2727,30 +2718,27 @@ const yo = e.object({
   skip_consent_for_verifiable_first_party_clients: e.boolean().optional(),
   allow_offline_access: e.boolean().optional(),
   verificationKey: e.string().optional(),
-  options: Mo.optional(),
+  options: vo.optional(),
   is_system: e.boolean().optional(),
-  metadata: e.record(e.any()).optional()
-}), Po = e.object({
-  ...vo.shape,
+  metadata: e.record(e.string(), e.any()).optional()
+}), jo = Po.extend({
   created_at: e.string().optional(),
   updated_at: e.string().optional()
-}), ri = e.array(Po), xo = e.object({
+}), ri = e.array(jo), xo = e.object({
   role_id: e.string(),
   resource_server_identifier: e.string(),
   permission_name: e.string()
-}), Ho = e.object({
-  ...xo.shape,
+}), Ho = xo.extend({
   created_at: e.string()
 }), li = e.array(Ho), Go = e.object({
   user_id: e.string(),
   resource_server_identifier: e.string(),
   permission_name: e.string(),
   organization_id: e.string().optional()
-}), Bo = e.object({
-  ...Go.shape,
+}), Wo = Go.extend({
   tenant_id: e.string(),
   created_at: e.string().optional()
-}), ci = e.array(Bo), Ko = e.object({
+}), ci = e.array(Wo), Bo = e.object({
   user_id: e.string(),
   resource_server_identifier: e.string(),
   resource_server_name: e.string(),
@@ -2758,17 +2746,16 @@ const yo = e.object({
   description: e.string().nullable().optional(),
   created_at: e.string().optional(),
   organization_id: e.string().optional()
-}), pi = e.array(
-  Ko
-), Wo = e.object({
+}), _i = e.array(
+  Bo
+), Ko = e.object({
   user_id: e.string(),
   role_id: e.string(),
   organization_id: e.string().optional()
-}), Vo = e.object({
-  ...Wo.shape,
+}), Vo = Ko.extend({
   tenant_id: e.string(),
   created_at: e.string().optional()
-}), _i = e.array(Vo), Xo = e.object({
+}), pi = e.array(Vo), Xo = e.object({
   id: e.string().optional().openapi({
     description: "The unique identifier of the role. If not provided, one will be generated."
   }),
@@ -2779,7 +2766,7 @@ const yo = e.object({
     description: "The description of the role"
   }),
   is_system: e.boolean().optional(),
-  metadata: e.record(e.any()).optional().openapi({
+  metadata: e.record(e.string(), e.any()).optional().openapi({
     description: "Metadata associated with the role. Can be used to control sync behavior in multi-tenancy scenarios."
   })
 }), qo = Xo.extend({
@@ -2836,16 +2823,14 @@ const yo = e.object({
     description: "The display name of the organization"
   }),
   branding: zo,
-  metadata: e.record(e.any()).default({}).optional().openapi({
+  metadata: e.record(e.string(), e.any()).default({}).optional().openapi({
     description: "Custom metadata for the organization"
   }),
   enabled_connections: e.array(Yo).default([]).optional().openapi({
     description: "List of enabled connections for the organization"
   }),
   token_quota: Qo
-}), gi = e.object({
-  ...Zo.shape,
-  ...s.shape,
+}), gi = Zo.extend(s.shape).extend({
   id: e.string(),
   // Override name to be lenient when reading from database (to support existing uppercase names)
   name: e.string().min(1).openapi({
@@ -2858,8 +2843,7 @@ const yo = e.object({
   assign_membership_on_login: e.boolean().optional().default(!1),
   show_as_button: e.boolean().optional().default(!0),
   is_signup_enabled: e.boolean().optional().default(!0)
-}), $o = e.object({
-  ...Jo.shape,
+}), $o = Jo.extend({
   // Auth0 includes the embedded connection in GET responses.
   connection: e.object({
     name: e.string().optional(),
@@ -2876,9 +2860,7 @@ const yo = e.object({
   organization_id: e.string().openapi({
     description: "ID of the organization"
   })
-}), mi = e.object({
-  ...en.shape,
-  ...s.shape,
+}), mi = en.extend(s.shape).extend({
   id: e.string()
 }), Ei = e.object({
   // Session settings
@@ -3008,19 +2990,19 @@ const yo = e.object({
 }), hi = e.number().openapi({
   description: "Number of active users in the last 30 days",
   example: 1234
-}), bi = e.enum([
+}), Ai = e.enum([
   "active-users",
   "logins",
   "signups",
   "refresh-tokens",
   "sessions"
-]), Ai = e.enum(["hour", "day", "week", "month"]), fi = e.enum([
+]), bi = e.enum(["hour", "day", "week", "month"]), fi = e.enum([
   "time",
   "connection",
   "client_id",
   "user_type",
   "event"
-]), Ii = e.enum([
+]), Ci = e.enum([
   "password",
   "social",
   "passwordless",
@@ -3032,7 +3014,7 @@ const yo = e.object({
   elapsed: e.number(),
   rows_read: e.number().optional(),
   bytes_read: e.number().optional()
-}), Ci = e.object({
+}), Ii = e.object({
   meta: e.array(tn),
   data: e.array(e.record(e.string(), e.any())),
   rows: e.number(),
@@ -3140,8 +3122,7 @@ function Q(o, n) {
     path: ["public_key"]
   }));
 }
-const yi = Y.superRefine(Q), Ri = e.object({
-  ...Y.shape,
+const yi = Y.superRefine(Q), Ri = Y.extend({
   id: e.string(),
   created_at: e.string(),
   updated_at: e.string()
@@ -3152,30 +3133,30 @@ function Li(o) {
     throw new Error(`Invalid user_id: ${o}`);
   return { connection: n, id: i };
 }
-function Fi(o) {
+function Di(o) {
   const {
     primary: n,
     secondaries: i,
     syncMethods: S = ["create", "rawCreate", "update", "remove", "delete", "set"]
   } = o, f = {
-    get(_, r) {
+    get(p, r) {
       if (typeof r == "symbol")
-        return _[r];
-      const d = _[r];
+        return p[r];
+      const d = p[r];
       return typeof d != "function" ? d : S.includes(r) ? async (...g) => {
-        const I = await d.apply(_, g), u = [];
+        const C = await d.apply(p, g), u = [];
         for (const l of i) {
           const h = l.adapter[r];
           if (typeof h != "function")
             continue;
-          const C = (async () => {
+          const I = (async () => {
             try {
               await h.apply(l.adapter, g);
-            } catch (b) {
+            } catch (A) {
               try {
-                l.onError ? l.onError(b, r, g) : console.error(
+                l.onError ? l.onError(A, r, g) : console.error(
                   `Passthrough adapter: secondary write failed for ${r}:`,
-                  b
+                  A
                 );
               } catch (O) {
                 console.error(
@@ -3185,19 +3166,19 @@ function Fi(o) {
               }
             }
           })();
-          l.blocking && u.push(C);
+          l.blocking && u.push(I);
         }
-        return u.length > 0 && await Promise.all(u), I;
-      } : d.bind(_);
+        return u.length > 0 && await Promise.all(u), C;
+      } : d.bind(p);
     }
   };
   return new Proxy(n, f);
 }
-function Di(o) {
+function Fi(o) {
   return o;
 }
 function Ui(o) {
-  var f, _, r, d, g, I, u, l, h, C, b, O;
+  var f, p, r, d, g, C, u, l, h, I, A, O;
   const n = o == null ? void 0 : o.options;
   if (!n)
     return {
@@ -3208,7 +3189,7 @@ function Ui(o) {
     };
   const i = n.attributes;
   if (i) {
-    const Z = ((_ = (f = i.username) == null ? void 0 : f.identifier) == null ? void 0 : _.active) === !0, J = ((d = (r = i.email) == null ? void 0 : r.identifier) == null ? void 0 : d.active) !== !1, $ = ((I = (g = i.username) == null ? void 0 : g.validation) == null ? void 0 : I.min_length) ?? 1, ee = ((l = (u = i.username) == null ? void 0 : u.validation) == null ? void 0 : l.max_length) ?? 15;
+    const Z = ((p = (f = i.username) == null ? void 0 : f.identifier) == null ? void 0 : p.active) === !0, J = ((d = (r = i.email) == null ? void 0 : r.identifier) == null ? void 0 : d.active) !== !1, $ = ((C = (g = i.username) == null ? void 0 : g.validation) == null ? void 0 : C.min_length) ?? 1, ee = ((l = (u = i.username) == null ? void 0 : u.validation) == null ? void 0 : l.max_length) ?? 15;
     return {
       usernameIdentifierActive: Z,
       emailIdentifierActive: J,
@@ -3219,8 +3200,8 @@ function Ui(o) {
   return {
     usernameIdentifierActive: n.requires_username === !0,
     emailIdentifierActive: !0,
-    usernameMinLength: ((C = (h = n.validation) == null ? void 0 : h.username) == null ? void 0 : C.min) ?? 1,
-    usernameMaxLength: ((O = (b = n.validation) == null ? void 0 : b.username) == null ? void 0 : O.max) ?? 15
+    usernameMinLength: ((I = (h = n.validation) == null ? void 0 : h.username) == null ? void 0 : I.min) ?? 1,
+    usernameMaxLength: ((O = (A = n.validation) == null ? void 0 : A.username) == null ? void 0 : O.max) ?? 15
   };
 }
 function wi(o) {
@@ -3229,25 +3210,25 @@ function wi(o) {
 export {
   un as Auth0ActionEnum,
   co as Auth0Client,
-  P as AuthorizationResponseMode,
-  v as AuthorizationResponseType,
+  j as AuthorizationResponseMode,
+  P as AuthorizationResponseType,
   x as CodeChallengeMethod,
-  M as ComponentCategory,
-  j as ComponentType,
+  v as ComponentCategory,
+  M as ComponentType,
   mn as EmailActionEnum,
   Ln as FORM_FIELD_TYPES,
   gn as FlowActionTypeEnum,
   No as GrantType,
-  po as LocationInfo,
+  _o as LocationInfo,
   t as LogTypes,
   X as LoginSessionState,
-  Be as NodeType,
-  Ae as RedirectTargetEnum,
+  We as NodeType,
+  be as RedirectTargetEnum,
   Ti as Strategy,
   Ni as StrategyType,
-  D as actionDependencySchema,
+  F as actionDependencySchema,
   ne as actionExecutionErrorSchema,
-  pn as actionExecutionInsertSchema,
+  _n as actionExecutionInsertSchema,
   ae as actionExecutionLogEntrySchema,
   se as actionExecutionLogsSchema,
   ie as actionExecutionResultSchema,
@@ -3258,21 +3239,21 @@ export {
   Ve as actionNodeSchema,
   cn as actionSchema,
   U as actionSecretSchema,
-  F as actionTriggerSchema,
+  D as actionTriggerSchema,
   ln as actionUpdateSchema,
   le as actionVersionInsertSchema,
-  _n as actionVersionSchema,
+  pn as actionVersionSchema,
   hi as activeUsersResponseSchema,
-  pe as actorSchema,
+  _e as actorSchema,
   Ne as addressSchema,
   tn as analyticsColumnMetaSchema,
   fi as analyticsGroupBySchema,
-  Ai as analyticsIntervalSchema,
-  Ci as analyticsQueryResponseSchema,
-  bi as analyticsResourceSchema,
+  bi as analyticsIntervalSchema,
+  Ii as analyticsQueryResponseSchema,
+  Ai as analyticsResourceSchema,
   on as analyticsStatisticsSchema,
-  Ii as analyticsUserTypeSchema,
-  Io as attackProtectionSchema,
+  Ci as analyticsUserTypeSchema,
+  Co as attackProtectionSchema,
   ce as auditCategorySchema,
   Ee as auditEventInsertSchema,
   dn as auditEventSchema,
@@ -3281,7 +3262,7 @@ export {
   Qe as auth0FlowSchema,
   Sn as auth0QuerySchema,
   he as auth0UpdateUserActionSchema,
-  bn as auth0UserResponseSchema,
+  An as auth0UserResponseSchema,
   Je as authParamsSchema,
   yi as authenticationMethodInsertSchema,
   Ri as authenticationMethodSchema,
@@ -3290,30 +3271,30 @@ export {
   kt as blockComponentSchema,
   yo as bordersSchema,
   Tn as brandingSchema,
-  bo as breachedPasswordDetectionSchema,
-  Ao as bruteForceProtectionSchema,
-  ve as buttonComponentSchema,
+  Ao as breachedPasswordDetectionSchema,
+  bo as bruteForceProtectionSchema,
+  Pe as buttonComponentSchema,
   Ze as claimsRequestSchema,
   Ue as clientGrantInsertSchema,
-  In as clientGrantListSchema,
+  Cn as clientGrantListSchema,
   we as clientGrantSchema,
-  De as clientInsertSchema,
-  je as clientRegistrationTokenInsertSchema,
-  Cn as clientRegistrationTokenSchema,
+  Fe as clientInsertSchema,
+  Me as clientRegistrationTokenInsertSchema,
+  In as clientRegistrationTokenSchema,
   ke as clientRegistrationTokenTypeSchema,
   fn as clientSchema,
   et as codeInsertSchema,
   Nn as codeSchema,
   $e as codeTypeSchema,
   Ro as colorsSchema,
-  Bt as componentMessageSchema,
+  Wt as componentMessageSchema,
   Ge as componentSchema,
   ot as connectionInsertSchema,
   tt as connectionOptionsSchema,
   yn as connectionSchema,
   E as coordinatesSchema,
-  Fi as createPassthroughAdapter,
-  Di as createWriteOnlyAdapter,
+  Di as createPassthroughAdapter,
+  Fi as createWriteOnlyAdapter,
   nt as customDomainInsertSchema,
   at as customDomainSchema,
   Rn as customDomainWithTenantIdSchema,
@@ -3324,47 +3305,47 @@ export {
   wo as emailTemplateNameSchema,
   ni as emailTemplateSchema,
   Se as emailVerificationRulesSchema,
-  be as emailVerifyActionSchema,
+  Ae as emailVerifyActionSchema,
   Ye as endingSchema,
-  Mt as fieldComponentSchema,
-  Ie as flowActionStepSchema,
-  Ce as flowInsertSchema,
+  vt as fieldComponentSchema,
+  Ce as flowActionStepSchema,
+  Ie as flowInsertSchema,
   En as flowSchema,
   xe as flowsFieldComponentSchema,
-  We as flowsFlowNodeSchema,
-  Ke as flowsStepNodeSchema,
+  Ke as flowsFlowNodeSchema,
+  Be as flowsStepNodeSchema,
   m as fontDetailsSchema,
   Lo as fontsSchema,
-  Fn as formControlSchema,
+  Dn as formControlSchema,
   Gt as formInsertSchema,
   H as formNodeComponentDefinition,
   Ht as formNodeSchema,
-  Dn as formSchema,
+  Fn as formSchema,
   He as genericComponentSchema,
   Xe as genericNodeSchema,
   Ui as getConnectionIdentifierConfig,
   Vn as getLogTypeCategory,
-  Wn as getLogTypeDescription,
+  Kn as getLogTypeDescription,
   Jt as hookCodeInsertSchema,
   xn as hookCodeSchema,
-  vn as hookInsertSchema,
-  Pn as hookSchema,
+  Pn as hookInsertSchema,
+  jn as hookSchema,
   V as hookTemplateId,
-  Mn as hookTemplates,
+  vn as hookTemplates,
   Te as identitySchema,
   to as inviteInsertSchema,
   Hn as inviteSchema,
   eo as inviteeSchema,
   $t as inviterSchema,
   wn as isBlockComponent,
-  jn as isFieldComponent,
+  Mn as isFieldComponent,
   wi as isPlainObject,
   kn as isWidgetComponent,
   Gn as jwksKeySchema,
   oo as jwksSchema,
-  Pe as legalComponentSchema,
+  je as legalComponentSchema,
   ue as locationInfoSchema,
-  _o as logInsertSchema,
+  po as logInsertSchema,
   Xn as logSchema,
   uo as logStreamFilterSchema,
   mo as logStreamInsertSchema,
@@ -3375,14 +3356,14 @@ export {
   ro as logTypeDescriptions,
   io as loginSessionAuthStrategySchema,
   ao as loginSessionInsertSchema,
-  Kn as loginSessionSchema,
+  Bn as loginSessionSchema,
   no as loginSessionStateSchema,
   Eo as migrationProviderTypeSchema,
   So as migrationSourceCredentialsSchema,
   ho as migrationSourceInsertSchema,
   zn as migrationSourceSchema,
   qe as nodeSchema,
-  Bn as openIDConfigurationSchema,
+  Wn as openIDConfigurationSchema,
   zo as organizationBrandingSchema,
   Jo as organizationConnectionInsertSchema,
   ui as organizationConnectionListSchema,
@@ -3391,9 +3372,9 @@ export {
   Zo as organizationInsertSchema,
   gi as organizationSchema,
   Qo as organizationTokenQuotaSchema,
-  Fo as pageBackgroundSchema,
+  Do as pageBackgroundSchema,
   Li as parseUserId,
-  Co as passwordInsertSchema,
+  Io as passwordInsertSchema,
   Yn as passwordSchema,
   Oe as profileDataSchema,
   nn as promptScreenSchema,
@@ -3402,20 +3383,20 @@ export {
   ko as refreshTokenInsertSchema,
   ii as refreshTokenSchema,
   de as requestContextSchema,
-  vo as resourceServerInsertSchema,
+  Po as resourceServerInsertSchema,
   ri as resourceServerListSchema,
-  Mo as resourceServerOptionsSchema,
-  Po as resourceServerSchema,
-  jo as resourceServerScopeSchema,
+  vo as resourceServerOptionsSchema,
+  jo as resourceServerSchema,
+  Mo as resourceServerScopeSchema,
   ge as responseContextSchema,
-  Me as richTextComponentSchema,
+  ve as richTextComponentSchema,
   Xo as roleInsertSchema,
   di as roleListSchema,
   xo as rolePermissionInsertSchema,
   li as rolePermissionListSchema,
   Ho as rolePermissionSchema,
   qo as roleSchema,
-  Kt as screenLinkSchema,
+  Bt as screenLinkSchema,
   Oo as sessionInsertSchema,
   Qn as sessionSchema,
   Zn as signingKeySchema,
@@ -3423,7 +3404,7 @@ export {
   ai as smsSendParamsSchema,
   ze as startSchema,
   fo as suspiciousIpThrottlingSchema,
-  _e as targetSchema,
+  pe as targetSchema,
   To as tenantInsertSchema,
   Jn as tenantSchema,
   Ei as tenantSettingsSchema,
@@ -3437,15 +3418,15 @@ export {
   mi as userOrganizationSchema,
   Go as userPermissionInsertSchema,
   ci as userPermissionListSchema,
-  Bo as userPermissionSchema,
-  pi as userPermissionWithDetailsListSchema,
-  Ko as userPermissionWithDetailsSchema,
-  An as userResponseSchema,
-  Wo as userRoleInsertSchema,
-  _i as userRoleListSchema,
+  Wo as userPermissionSchema,
+  _i as userPermissionWithDetailsListSchema,
+  Bo as userPermissionWithDetailsSchema,
+  bn as userResponseSchema,
+  Ko as userRoleInsertSchema,
+  pi as userRoleListSchema,
   Vo as userRoleSchema,
   Re as userSchema,
   it as verificationMethodsSchema,
-  jt as widgetComponentSchema,
-  Do as widgetSchema
+  Mt as widgetComponentSchema,
+  Fo as widgetSchema
 };