@authhero/adapter-interfaces 2.5.0 → 2.6.1

package/dist/adapter-interfaces.mjs

@@ -42,9 +42,8 @@ const s = e.object({
       name: e.string(),
       value: e.string().optional()
     })
-  ).optional(),
-  ...s.shape
-}), te = e.string(), oe = e.enum([
+  ).optional()
+}).extend(s.shape), te = e.string(), oe = e.enum([
   "unspecified",
   "pending",
   "final",
@@ -77,7 +76,7 @@ const s = e.object({
   logs: se.optional(),
   created_at: e.string(),
   updated_at: e.string()
-}), pn = re.omit({
+}), _n = re.omit({
   tenant_id: !0,
   created_at: !0,
   updated_at: !0
@@ -89,17 +88,16 @@ const s = e.object({
   secrets: e.array(U).optional(),
   supported_triggers: e.array(D).optional(),
   deployed: e.boolean().default(!0)
-}), _n = le.extend({
+}), pn = le.extend({
   id: e.string(),
   tenant_id: e.string(),
-  number: e.number().int(),
-  ...s.shape
-}), ce = e.enum([
+  number: e.number().int()
+}).extend(s.shape), ce = e.enum([
   "user_action",
   "admin_action",
   "system",
   "api"
-]), pe = e.object({
+]), _e = e.object({
   type: e.enum(["user", "admin", "system", "api_key", "client_credentials"]),
   id: e.string().optional(),
   email: e.string().optional(),
@@ -107,16 +105,16 @@ const s = e.object({
   org_name: e.string().optional(),
   scopes: e.array(e.string()).optional(),
   client_id: e.string().optional()
-}), _e = e.object({
+}), pe = e.object({
   type: e.string(),
   id: e.string(),
-  before: e.record(e.unknown()).optional(),
-  after: e.record(e.unknown()).optional(),
-  diff: e.record(e.object({ old: e.unknown(), new: e.unknown() })).optional()
+  before: e.record(e.string(), e.unknown()).optional(),
+  after: e.record(e.string(), e.unknown()).optional(),
+  diff: e.record(e.string(), e.object({ old: e.unknown(), new: e.unknown() })).optional()
 }), de = e.object({
   method: e.string(),
   path: e.string(),
-  query: e.record(e.string()).optional(),
+  query: e.record(e.string(), e.string()).optional(),
   body: e.unknown().optional(),
   ip: e.string(),
   user_agent: e.string().optional(),
@@ -134,15 +132,15 @@ const s = e.object({
 }), me = e.object({
   name: e.string(),
   version: e.string(),
-  env: e.record(e.string()).optional()
+  env: e.record(e.string(), e.string()).optional()
 }), Ee = e.object({
   tenant_id: e.string(),
   event_type: e.string(),
   log_type: e.string(),
   description: e.string().optional(),
   category: ce,
-  actor: pe,
-  target: _e,
+  actor: _e,
+  target: pe,
   request: de,
   response: ge.optional(),
   connection: e.string().optional(),
@@ -182,7 +180,7 @@ const s = e.object({
     user_id: e.string(),
     changes: e.record(e.string(), e.any())
   })
-}), be = e.object({
+}), Ae = e.object({
   id: e.string(),
   alias: e.string().max(100).optional(),
   type: e.literal("EMAIL"),
@@ -193,7 +191,7 @@ const s = e.object({
     email: e.string(),
     rules: Se.optional()
   })
-}), Ae = e.enum(["change-email", "account", "custom"]), fe = e.object({
+}), be = e.enum(["change-email", "account", "custom"]), fe = e.object({
   id: e.string(),
   alias: e.string().max(100).optional(),
   type: e.literal("REDIRECT"),
@@ -201,7 +199,7 @@ const s = e.object({
   allow_failure: e.boolean().optional(),
   mask_output: e.boolean().optional(),
   params: e.object({
-    target: Ae.openapi({
+    target: be.openapi({
       description: "The predefined target to redirect to, or 'custom' for a custom URL"
     }),
     custom_url: e.string().optional().openapi({
@@ -210,7 +208,7 @@ const s = e.object({
   })
 }), Ce = e.union([
   he,
-  be,
+  Ae,
   fe
 ]), Ie = e.object({
   name: e.string().min(1).max(150).openapi({
@@ -220,8 +218,7 @@ const s = e.object({
   actions: e.array(Ce).optional().default([]).openapi({
     description: "The list of actions to execute in sequence"
   })
-}), En = Ie.extend({
-  ...s.shape,
+}), En = Ie.extend(s.shape).extend({
   id: e.string().openapi({
     description: "Unique identifier for the flow",
     example: "af_12tMpdJ3iek7svMyZkSh5M"
@@ -284,7 +281,11 @@ const s = e.object({
   country: e.string().optional()
   // Country name
 }).optional(), k = e.object({
-  email: e.string().optional().transform((o) => o && o.toLowerCase()),
+  // Apply the lowercase transform *before* `.optional()` so the key remains
+  // optional (`email?: string`) in inference. Zod 4 strips the optional-key
+  // marker when a transform runs over an `.optional()` schema, which made
+  // User/UserInsert types diverge.
+  email: e.string().transform((o) => o.toLowerCase()).optional(),
   username: e.string().refine((o) => !o.includes("@"), {
     message: 'Usernames must not contain "@". Use the email field for email addresses.'
   }).optional(),
@@ -339,18 +340,16 @@ const s = e.object({
     hash: e.string(),
     algorithm: e.string()
   }).optional()
-}), Re = e.object({
-  ...ye.omit({ password: !0 }).shape,
-  ...s.shape,
+}), Re = ye.omit({ password: !0 }).extend(s.shape).extend({
   user_id: e.string(),
   provider: e.string(),
   is_social: e.boolean(),
   email: e.string().optional(),
   login_count: e.number().default(0),
   identities: e.array(Te).optional()
-}), bn = Re.omit({
+}), An = Re.omit({
   registration_completed_at: !0
-}), An = k.extend({
+}), bn = k.extend({
   login_count: e.number(),
   multifactor: e.array(e.string()).optional(),
   last_ip: e.string().optional(),
@@ -441,22 +440,22 @@ const Fe = e.object({
   allowed_logout_urls: e.array(e.string()).default([]).optional().openapi({
     description: "Comma-separated list of URLs that are valid to redirect to after logout from Auth0. Wildcards are allowed for subdomains."
   }),
-  session_transfer: e.record(e.any()).default({}).optional().openapi({
+  session_transfer: e.record(e.string(), e.any()).default({}).optional().openapi({
     description: "Native to Web SSO Configuration"
   }),
-  oidc_logout: e.record(e.any()).default({}).optional().openapi({
+  oidc_logout: e.record(e.string(), e.any()).default({}).optional().openapi({
     description: "Configuration for OIDC backchannel logout"
   }),
   grant_types: e.array(e.string()).default([]).optional().openapi({
     description: "List of grant types supported for this application. Can include authorization_code, implicit, refresh_token, client_credentials, password, http://auth0.com/oauth/grant-type/password-realm, http://auth0.com/oauth/grant-type/mfa-oob, http://auth0.com/oauth/grant-type/mfa-otp, http://auth0.com/oauth/grant-type/mfa-recovery-code, urn:openid:params:grant-type:ciba, and urn:ietf:params:oauth:grant-type:device_code."
   }),
-  jwt_configuration: e.record(e.any()).default({}).optional().openapi({
+  jwt_configuration: e.record(e.string(), e.any()).default({}).optional().openapi({
     description: "Configuration related to JWTs for the client."
   }),
-  signing_keys: e.array(e.record(e.any())).default([]).optional().openapi({
+  signing_keys: e.array(e.record(e.string(), e.any())).default([]).optional().openapi({
     description: "Signing certificates associated with this client."
   }),
-  encryption_key: e.record(e.any()).default({}).optional().openapi({
+  encryption_key: e.record(e.string(), e.any()).default({}).optional().openapi({
     description: "Encryption used for WsFed responses with this client."
   }),
   sso: e.boolean().default(!1).openapi({
@@ -483,7 +482,7 @@ const Fe = e.object({
   form_template: e.string().optional().openapi({
     description: "HTML form template to be used for WS-Federation."
   }),
-  addons: e.record(e.any()).default({}).optional().openapi({
+  addons: e.record(e.string(), e.any()).default({}).optional().openapi({
     description: "Addons enabled for this client and their associated configurations."
   }),
   token_endpoint_auth_method: e.enum([
@@ -495,19 +494,19 @@ const Fe = e.object({
   ]).default("client_secret_basic").optional().openapi({
     description: "Defines the requested authentication method for the token endpoint. `none` (public client), `client_secret_post` / `client_secret_basic` (HTTP POST / Basic), `client_secret_jwt` (RFC 7523 HMAC assertion using client_secret), or `private_key_jwt` (RFC 7523 asymmetric assertion verified against the client's `jwks` / `jwks_uri`)."
   }),
-  client_metadata: e.record(e.string().max(255)).default({}).optional().openapi({
+  client_metadata: e.record(e.string(), e.string().max(255)).default({}).optional().openapi({
     description: 'Metadata associated with the client, in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. Field names (max 255 chars) are alphanumeric and may only include the following special characters: :,-+=_*?"/()<>@ [Tab][Space]'
   }),
   hide_sign_up_disabled_error: e.boolean().default(!1).optional().openapi({
     description: "Enumeration-safe variant of the connection-level `disable_signup` flag. When a signup is blocked by the password connection and this is true, the identifier screen does not reveal that an email is unknown — it advances to the OTP/password challenge as if the account existed and fails at credential check. Mitigates email enumeration at the cost of UX: users without an account see a generic credential failure instead of an explicit signup-disabled message."
   }),
-  mobile: e.record(e.any()).default({}).optional().openapi({
+  mobile: e.record(e.string(), e.any()).default({}).optional().openapi({
     description: "Additional configuration for native mobile apps."
   }),
   initiate_login_uri: e.string().url().optional().openapi({
     description: "Initiate login uri, must be https"
   }),
-  native_social_login: e.record(e.any()).default({}).optional(),
+  native_social_login: e.record(e.string(), e.any()).default({}).optional(),
   refresh_token: e.object({
     rotation_type: e.enum(["rotating", "non-rotating"]).optional().openapi({
       description: "Whether refresh tokens for this client are rotated on every exchange (Auth0 'rotating' behavior) or kept stable (legacy non-rotating). Defaults to 'non-rotating' when unset."
@@ -538,7 +537,7 @@ const Fe = e.object({
   }).default({}).optional().openapi({
     description: "Refresh token configuration"
   }),
-  default_organization: e.record(e.any()).default({}).optional().openapi({
+  default_organization: e.record(e.string(), e.any()).default({}).optional().openapi({
     description: "Defines the default Organization ID and flows"
   }),
   organization_usage: e.enum(["deny", "allow", "require"]).default("deny").optional().openapi({
@@ -547,7 +546,7 @@ const Fe = e.object({
   organization_require_behavior: e.enum(["no_prompt", "pre_login_prompt", "post_login_prompt"]).default("no_prompt").optional().openapi({
     description: "Defines how to proceed during an authentication transaction when client.organization_usage: 'require'. Can be no_prompt (default), pre_login_prompt or post_login_prompt. post_login_prompt requires oidc_conformant: true."
   }),
-  client_authentication_methods: e.record(e.any()).default({}).optional().openapi({
+  client_authentication_methods: e.record(e.string(), e.any()).default({}).optional().openapi({
     description: "Defines client authentication methods."
   }),
   require_pushed_authorization_requests: e.boolean().default(!1).openapi({
@@ -556,7 +555,7 @@ const Fe = e.object({
   require_proof_of_possession: e.boolean().default(!1).openapi({
     description: "Makes the use of Proof-of-Possession mandatory for this client"
   }),
-  signed_request_object: e.record(e.any()).default({}).optional().openapi({
+  signed_request_object: e.record(e.string(), e.any()).default({}).optional().openapi({
     description: "JWT-secured Authorization Requests (JAR) settings."
   }),
   compliance_level: e.enum([
@@ -571,14 +570,14 @@ const Fe = e.object({
   par_request_expiry: e.number().optional().openapi({
     description: "Specifies how long, in seconds, a Pushed Authorization Request URI remains valid"
   }),
-  token_quota: e.record(e.any()).default({}).optional(),
+  token_quota: e.record(e.string(), e.any()).default({}).optional(),
   owner_user_id: e.string().optional().openapi({
     description: "User ID of the consenting user when this client was created via IAT-gated Dynamic Client Registration. NULL for clients created via the Management API or open DCR."
   }),
   registration_type: e.enum(["manual", "open_dcr", "iat_dcr"]).optional().openapi({
     description: "Provenance of this client. `manual` = Management API; `open_dcr` = RFC 7591 without IAT; `iat_dcr` = RFC 7591 with an Initial Access Token."
   }),
-  registration_metadata: e.record(e.any()).default({}).optional().openapi({
+  registration_metadata: e.record(e.string(), e.any()).default({}).optional().openapi({
     description: "Arbitrary metadata captured at Dynamic Client Registration time that isn't a first-class client field (e.g. integration_type, domain). Also stores `iat_constraints` for clients created via IAT so RFC 7592 PUT can enforce field immutability."
   }),
   user_linking_mode: e.enum(["builtin", "off"]).optional().openapi({
@@ -586,8 +585,8 @@ const Fe = e.object({
   })
 }), fn = e.object({
   created_at: e.string(),
-  updated_at: e.string(),
-  ...Fe.shape,
+  updated_at: e.string()
+}).extend(Fe.shape).extend({
   // Insert allows omitting (server-generated to match Auth0). The read schema
   // always has it — the row in storage is non-null.
   client_id: e.string()
@@ -619,34 +618,33 @@ const Fe = e.object({
 }), we = e.object({
   id: e.string().openapi({
     description: "ID of the client grant."
-  }),
-  ...Ue.shape,
+  })
+}).extend(Ue.shape).extend({
   created_at: e.string().optional(),
   updated_at: e.string().optional()
-}), Cn = e.array(we), ke = e.enum(["iat", "rat"]), je = e.object({
+}), Cn = e.array(we), ke = e.enum(["iat", "rat"]), Me = e.object({
   id: e.string(),
   token_hash: e.string(),
   type: ke,
   client_id: e.string().optional(),
   sub: e.string().optional(),
-  constraints: e.record(e.unknown()).optional(),
+  constraints: e.record(e.string(), e.unknown()).optional(),
   single_use: e.boolean().default(!1),
   expires_at: e.string().optional()
 }), In = e.object({
   created_at: e.string(),
   used_at: e.string().optional(),
-  revoked_at: e.string().optional(),
-  ...je.shape
-}), E = e.object({
+  revoked_at: e.string().optional()
+}).extend(Me.shape), E = e.object({
   x: e.number(),
   y: e.number()
 });
-var j = /* @__PURE__ */ ((o) => (o.RICH_TEXT = "RICH_TEXT", o.NEXT_BUTTON = "NEXT_BUTTON", o.BACK_BUTTON = "BACK_BUTTON", o.SUBMIT_BUTTON = "SUBMIT_BUTTON", o.DIVIDER = "DIVIDER", o.TEXT = "TEXT", o.EMAIL = "EMAIL", o.PASSWORD = "PASSWORD", o.NUMBER = "NUMBER", o.PHONE = "PHONE", o.DATE = "DATE", o.CHECKBOX = "CHECKBOX", o.RADIO = "RADIO", o.SELECT = "SELECT", o.HIDDEN = "HIDDEN", o.LEGAL = "LEGAL", o))(j || {}), M = /* @__PURE__ */ ((o) => (o.BLOCK = "BLOCK", o.FIELD = "FIELD", o))(M || {});
+var M = /* @__PURE__ */ ((o) => (o.RICH_TEXT = "RICH_TEXT", o.NEXT_BUTTON = "NEXT_BUTTON", o.BACK_BUTTON = "BACK_BUTTON", o.SUBMIT_BUTTON = "SUBMIT_BUTTON", o.DIVIDER = "DIVIDER", o.TEXT = "TEXT", o.EMAIL = "EMAIL", o.PASSWORD = "PASSWORD", o.NUMBER = "NUMBER", o.PHONE = "PHONE", o.DATE = "DATE", o.CHECKBOX = "CHECKBOX", o.RADIO = "RADIO", o.SELECT = "SELECT", o.HIDDEN = "HIDDEN", o.LEGAL = "LEGAL", o))(M || {}), v = /* @__PURE__ */ ((o) => (o.BLOCK = "BLOCK", o.FIELD = "FIELD", o))(v || {});
 const T = e.object({
   id: e.string(),
-  category: e.nativeEnum(M),
-  type: e.nativeEnum(j)
-}), Me = T.extend({
+  category: e.nativeEnum(v),
+  type: e.nativeEnum(M)
+}), ve = T.extend({
   category: e.literal(
     "BLOCK"
     /* BLOCK */
@@ -680,7 +678,7 @@ const T = e.object({
   config: e.object({
     text: e.string()
   }).passthrough()
-}), ve = T.extend({
+}), je = T.extend({
   category: e.literal(
     "FIELD"
     /* FIELD */
@@ -752,9 +750,9 @@ const T = e.object({
   category: e.string(),
   type: e.string()
 }).passthrough(), Ge = e.union([
-  Me,
-  Pe,
   ve,
+  Pe,
+  je,
   xe,
   He
 ]);
@@ -840,7 +838,7 @@ const Be = e.object({
   created_at: !0,
   updated_at: !0
 });
-var P = /* @__PURE__ */ ((o) => (o.TOKEN = "token", o.ID_TOKEN = "id_token", o.TOKEN_ID_TOKEN = "id_token token", o.CODE = "code", o.CODE_ID_TOKEN = "code id_token", o.CODE_TOKEN = "code token", o.CODE_ID_TOKEN_TOKEN = "code id_token token", o))(P || {}), v = /* @__PURE__ */ ((o) => (o.QUERY = "query", o.FRAGMENT = "fragment", o.FORM_POST = "form_post", o.WEB_MESSAGE = "web_message", o.SAML_POST = "saml_post", o))(v || {}), x = /* @__PURE__ */ ((o) => (o.S256 = "S256", o.Plain = "plain", o))(x || {});
+var P = /* @__PURE__ */ ((o) => (o.TOKEN = "token", o.ID_TOKEN = "id_token", o.TOKEN_ID_TOKEN = "id_token token", o.CODE = "code", o.CODE_ID_TOKEN = "code id_token", o.CODE_TOKEN = "code token", o.CODE_ID_TOKEN_TOKEN = "code id_token token", o))(P || {}), j = /* @__PURE__ */ ((o) => (o.QUERY = "query", o.FRAGMENT = "fragment", o.FORM_POST = "form_post", o.WEB_MESSAGE = "web_message", o.SAML_POST = "saml_post", o))(j || {}), x = /* @__PURE__ */ ((o) => (o.S256 = "S256", o.Plain = "plain", o))(x || {});
 const L = e.union([
   e.null(),
   e.object({
@@ -855,7 +853,7 @@ const L = e.union([
   client_id: e.string(),
   act_as: e.string().optional(),
   response_type: e.nativeEnum(P).optional(),
-  response_mode: e.nativeEnum(v).optional(),
+  response_mode: e.nativeEnum(j).optional(),
   redirect_uri: e.string().optional(),
   audience: e.string().optional(),
   organization: e.string().optional(),
@@ -946,8 +944,7 @@ const L = e.union([
   expires_at: e.string(),
   used_at: e.string().optional(),
   user_id: e.string().optional()
-}), Nn = e.object({
-  ...et.shape,
+}), Nn = et.extend({
   created_at: e.string()
 }), tt = e.object({
   kid: e.string().optional(),
@@ -1115,7 +1112,7 @@ const ot = e.object({
   response_mode: e.custom().optional(),
   is_domain_connection: e.boolean().optional(),
   show_as_button: e.boolean().optional(),
-  metadata: e.record(e.any()).optional(),
+  metadata: e.record(e.string(), e.any()).optional(),
   is_system: e.boolean().optional()
 }), yn = e.object({
   id: e.string(),
@@ -1134,7 +1131,7 @@ const ot = e.object({
     "x-azure-clientip",
     "null"
   ]).optional(),
-  domain_metadata: e.record(e.string().max(255)).optional()
+  domain_metadata: e.record(e.string(), e.string().max(255)).optional()
 }), it = e.discriminatedUnion("name", [
   e.object({
     name: e.literal("txt"),
@@ -1146,8 +1143,7 @@ const ot = e.object({
     http_body: e.string(),
     http_url: e.string()
   })
-]), at = e.object({
-  ...nt.shape,
+]), at = nt.extend({
   custom_domain_id: e.string(),
   primary: e.boolean(),
   status: e.enum(["disabled", "pending", "pending_verification", "ready"]),
@@ -1188,13 +1184,13 @@ const ot = e.object({
     text: e.string().optional(),
     target_step: e.string().optional()
   })
-}), pt = c.extend({
+}), _t = c.extend({
   type: e.literal("RESEND_BUTTON"),
   config: e.object({
     text: e.string().optional(),
     resend_action: e.string().optional()
   })
-}), _t = c.extend({
+}), pt = c.extend({
   type: e.literal("NEXT_BUTTON"),
   config: e.object({
     text: e.string().optional()
@@ -1261,7 +1257,7 @@ const ot = e.object({
     ).optional(),
     multi_select: e.boolean().optional()
   }).optional()
-}), bt = a.extend({
+}), At = a.extend({
   type: e.literal("CHOICE"),
   config: e.object({
     options: e.array(
@@ -1274,12 +1270,12 @@ const ot = e.object({
     multiple: e.boolean().optional(),
     default_value: e.union([e.string(), e.array(e.string())]).optional()
   }).optional()
-}), At = a.extend({
+}), bt = a.extend({
   type: e.literal("CUSTOM"),
   config: e.object({
     component: e.string().optional(),
-    props: e.record(e.any()).optional(),
-    schema: e.record(e.any()).optional(),
+    props: e.record(e.string(), e.any()).optional(),
+    schema: e.record(e.string(), e.any()).optional(),
     code: e.string().optional()
   })
 }), ft = a.extend({
@@ -1395,20 +1391,20 @@ const ot = e.object({
   rt,
   lt,
   ct,
-  pt,
   _t,
+  pt,
   dt,
   gt
-]), jt = e.discriminatedUnion("type", [
+]), Mt = e.discriminatedUnion("type", [
   ut,
   mt,
   Et
-]), Mt = e.discriminatedUnion("type", [
+]), vt = e.discriminatedUnion("type", [
   St,
   ht,
-  bt,
-  Ut,
   At,
+  Ut,
+  bt,
   ft,
   Ct,
   It,
@@ -1423,8 +1419,8 @@ const ot = e.object({
   wt
 ]), H = e.union([
   kt,
-  jt,
-  Mt
+  Mt,
+  vt
 ]), Ln = /* @__PURE__ */ new Set([
   "BOOLEAN",
   "CARDS",
@@ -1448,22 +1444,22 @@ const ot = e.object({
   order: e.number().optional(),
   visible: e.boolean().optional().default(!0),
   customizations: e.record(e.string(), e.any()).optional()
-}), A = e.object({
+}), b = e.object({
   x: e.number(),
   y: e.number()
 }), Pt = e.object({
   id: e.string(),
   type: e.literal("FLOW"),
-  coordinates: A,
+  coordinates: b,
   alias: e.string().min(1).max(150).optional(),
   config: e.object({
     flow_id: e.string().max(30),
     next_node: e.string().optional()
   })
-}), vt = e.object({
+}), jt = e.object({
   id: e.string(),
   type: e.literal("ROUTER"),
-  coordinates: A,
+  coordinates: b,
   alias: e.string().min(1).max(150),
   config: e.object({
     rules: e.array(
@@ -1479,7 +1475,7 @@ const ot = e.object({
 }), xt = e.object({
   id: e.string(),
   type: e.literal("STEP"),
-  coordinates: A,
+  coordinates: b,
   alias: e.string().min(1).max(150).optional(),
   config: e.object({
     components: e.array(H),
@@ -1487,7 +1483,7 @@ const ot = e.object({
   })
 }), Ht = e.discriminatedUnion("type", [
   Pt,
-  vt,
+  jt,
   xt
 ]), Gt = e.object({
   name: e.string().openapi({
@@ -1506,7 +1502,7 @@ const ot = e.object({
   start: e.object({
     hidden_fields: e.array(e.object({ key: e.string(), value: e.string() })).optional(),
     next_node: e.string().optional(),
-    coordinates: A.optional()
+    coordinates: b.optional()
   }).optional(),
   ending: e.object({
     redirection: e.object({
@@ -1514,7 +1510,7 @@ const ot = e.object({
       target: e.string().optional()
     }).optional(),
     after_submit: e.object({ flow_id: e.string().optional() }).optional(),
-    coordinates: A.optional(),
+    coordinates: b.optional(),
     resume_flow: e.boolean().optional()
   }).optional(),
   style: e.object({ css: e.string().optional() }).optional(),
@@ -1524,9 +1520,7 @@ const ot = e.object({
   }).optional()
 }).openapi({
   description: "Schema for flow-based forms (matches Auth0 Forms structure)"
-}), Fn = e.object({
-  ...s.shape,
-  ...Gt.shape,
+}), Fn = s.extend(Gt.shape).extend({
   id: e.string()
 }), Wt = e.object({
   id: e.number().optional(),
@@ -1556,7 +1550,7 @@ function wn(o) {
 function kn(o) {
   return o.category === "WIDGET";
 }
-function jn(o) {
+function Mn(o) {
   return o.category === "FIELD";
 }
 const G = e.enum([
@@ -1589,7 +1583,7 @@ const G = e.enum([
   "ensure-username",
   "set-preferred-username",
   "account-linking"
-]), Mn = {
+]), vn = {
   "ensure-username": {
     name: "Ensure Username",
     description: "Automatically assigns a username to users who sign in without one. Creates a linked username account for social/email users.",
@@ -1609,7 +1603,7 @@ const G = e.enum([
       "post-user-update"
     ]
   }
-}, p = {
+}, _ = {
   enabled: e.boolean().default(!1),
   synchronous: e.boolean().default(!1),
   priority: e.number().optional(),
@@ -1625,21 +1619,21 @@ const G = e.enum([
    *
    * Everything else is opaque to the runtime. Persisted as JSON.
    */
-  metadata: e.record(e.unknown()).optional()
+  metadata: e.record(e.string(), e.unknown()).optional()
 }, Kt = e.object({
-  ...p,
+  ..._,
   trigger_id: G,
   url: e.string()
 }), Vt = e.object({
-  ...p,
+  ..._,
   trigger_id: W,
   form_id: e.string()
 }), Xt = e.object({
-  ...p,
+  ..._,
   trigger_id: B,
   template_id: V
 }), qt = e.object({
-  ...p,
+  ..._,
   trigger_id: K,
   code_id: e.string()
 }), Pn = e.union([
@@ -1648,42 +1642,41 @@ const G = e.enum([
   Xt,
   qt
 ]), zt = e.object({
-  ...p,
-  trigger_id: G,
-  ...s.shape,
+  ..._,
+  trigger_id: G
+}).extend(s.shape).extend({
   hook_id: e.string(),
   url: e.string()
 }), Yt = e.object({
-  ...p,
-  trigger_id: W,
-  ...s.shape,
+  ..._,
+  trigger_id: W
+}).extend(s.shape).extend({
   hook_id: e.string(),
   form_id: e.string()
 }), Qt = e.object({
-  ...p,
-  trigger_id: B,
-  ...s.shape,
+  ..._,
+  trigger_id: B
+}).extend(s.shape).extend({
   hook_id: e.string(),
   template_id: V
 }), Zt = e.object({
-  ...p,
-  trigger_id: K,
-  ...s.shape,
+  ..._,
+  trigger_id: K
+}).extend(s.shape).extend({
   hook_id: e.string(),
   code_id: e.string()
-}), vn = e.union([
+}), jn = e.union([
   zt,
   Yt,
   Qt,
   Zt
 ]), Jt = e.object({
   code: e.string().max(1e5),
-  secrets: e.record(e.string()).optional()
+  secrets: e.record(e.string(), e.string()).optional()
 }), xn = Jt.extend({
   id: e.string(),
-  tenant_id: e.string(),
-  ...s.shape
-}), $t = e.object({
+  tenant_id: e.string()
+}).extend(s.shape), $t = e.object({
   name: e.string().optional()
 }), eo = e.object({
   email: e.string().optional()
@@ -1695,8 +1688,8 @@ const G = e.enum([
   invitation_url: e.string().url(),
   client_id: e.string(),
   connection_id: e.string().optional(),
-  app_metadata: e.record(e.any()).default({}).optional(),
-  user_metadata: e.record(e.any()).default({}).optional(),
+  app_metadata: e.record(e.string(), e.any()).default({}).optional(),
+  user_metadata: e.record(e.string(), e.any()).default({}).optional(),
   ttl_sec: e.number().int().max(2592e3).default(604800).optional(),
   roles: e.array(e.string()).default([]).optional(),
   send_invitation_email: e.boolean().default(!0).optional()
@@ -1801,8 +1794,7 @@ const no = e.nativeEnum(X), io = e.object({
   // ISO timestamp persisted for audit/metadata; not used to reject resumed sessions
 }).openapi({
   description: "This represents a login sesion"
-}), Bn = e.object({
-  ...ao.shape,
+}), Bn = ao.extend({
   id: e.string().openapi({
     description: "This is is used as the state in the universal login"
   }),
@@ -2166,14 +2158,14 @@ const co = e.object({
   env: e.object({
     node: e.string().optional()
   }).optional()
-}), po = e.object({
+}), _o = e.object({
   country_code: e.string().length(2),
   city_name: e.string(),
   latitude: e.string(),
   longitude: e.string(),
   time_zone: e.string(),
   continent_code: e.string()
-}), _o = e.object({
+}), po = e.object({
   type: so,
   date: e.string(),
   description: e.string().optional(),
@@ -2195,9 +2187,8 @@ const co = e.object({
   hostname: e.string().optional(),
   auth0_client: co.optional(),
   log_id: e.string().optional(),
-  location_info: po.optional()
-}), Xn = e.object({
-  ..._o.shape,
+  location_info: _o.optional()
+}), Xn = po.extend({
   log_id: e.string()
 }), go = e.enum([
   "http",
@@ -2243,7 +2234,7 @@ const co = e.object({
   id: e.string(),
   created_at: e.string(),
   updated_at: e.string()
-}).extend(ho.shape), bo = e.object({
+}).extend(ho.shape), Ao = e.object({
   enabled: e.boolean().optional(),
   shields: e.array(e.string()).optional(),
   admin_notification_frequency: e.array(e.string()).optional(),
@@ -2256,7 +2247,7 @@ const co = e.object({
       shields: e.array(e.string()).optional()
     }).optional()
   }).optional()
-}), Ao = e.object({
+}), bo = e.object({
   enabled: e.boolean().optional(),
   shields: e.array(e.string()).optional(),
   allowlist: e.array(e.string()).optional(),
@@ -2277,8 +2268,8 @@ const co = e.object({
     }).optional()
   }).optional()
 }), Co = e.object({
-  breached_password_detection: bo.optional(),
-  brute_force_protection: Ao.optional(),
+  breached_password_detection: Ao.optional(),
+  brute_force_protection: bo.optional(),
   suspicious_ip_throttling: fo.optional()
 }), Io = e.object({
   id: e.string().optional(),
@@ -2313,9 +2304,8 @@ const co = e.object({
   created_at: e.string(),
   updated_at: e.string(),
   authenticated_at: e.string(),
-  last_interaction_at: e.string(),
-  ...Oo.shape
-}), Zn = e.object({
+  last_interaction_at: e.string()
+}).extend(Oo.shape), Zn = e.object({
   kid: e.string().openapi({ description: "The key id of the signing key" }),
   tenant_id: e.string().optional().openapi({
     description: "The tenant the key belongs to. Omitted means the key is shared / control-plane scoped."
@@ -2464,10 +2454,10 @@ const co = e.object({
   // Default token quota
   default_token_quota: e.object({
     clients: e.object({
-      client_credentials: e.record(e.any()).optional()
+      client_credentials: e.record(e.string(), e.any()).optional()
     }).optional(),
     organizations: e.object({
-      client_credentials: e.record(e.any()).optional()
+      client_credentials: e.record(e.string(), e.any()).optional()
     }).optional()
   }).nullish(),
   // Default audience
@@ -2530,8 +2520,8 @@ const co = e.object({
   }).optional()
 }), Jn = e.object({
   created_at: e.string().nullable().transform((o) => o ?? ""),
-  updated_at: e.string().nullable().transform((o) => o ?? ""),
-  ...To.shape,
+  updated_at: e.string().nullable().transform((o) => o ?? "")
+}).extend(To.shape).extend({
   id: e.string(),
   // Computed server-side: true when this tenant is the deployment's control
   // plane (either `multiTenancyConfig.controlPlaneTenantId` matches the
@@ -2692,23 +2682,21 @@ const yo = e.object({
   // ISO of the *first* rotation. Anchors the leeway window so siblings minted
   // within the window don't extend the parent's exposure.
   rotated_at: e.string().optional()
-}), ii = e.object({
+}), ii = ko.extend({
   // When the refresh token record was created.
   created_at: e.string(),
   // When the token was explicitly revoked (null = still active).
-  revoked_at: e.string().optional(),
-  // Spread in the rest of the refresh token properties.
-  ...ko.shape
+  revoked_at: e.string().optional()
 }), ai = e.object({
   to: e.string(),
   message: e.string()
 }), si = e.object({
   name: e.string(),
   options: e.object({})
-}), jo = e.object({
+}), Mo = e.object({
   value: e.string(),
   description: e.string().optional()
-}), Mo = e.object({
+}), vo = e.object({
   token_dialect: e.enum(["access_token", "access_token_authz"]).optional(),
   enforce_policies: e.boolean().optional(),
   allow_skipping_userinfo: e.boolean().optional(),
@@ -2722,7 +2710,7 @@ const yo = e.object({
   id: e.string().optional(),
   name: e.string(),
   identifier: e.string(),
-  scopes: e.array(jo).optional(),
+  scopes: e.array(Mo).optional(),
   signing_alg: e.string().optional(),
   signing_secret: e.string().optional(),
   token_lifetime: e.number().default(86400),
@@ -2730,27 +2718,24 @@ const yo = e.object({
   skip_consent_for_verifiable_first_party_clients: e.boolean().optional(),
   allow_offline_access: e.boolean().optional(),
   verificationKey: e.string().optional(),
-  options: Mo.optional(),
+  options: vo.optional(),
   is_system: e.boolean().optional(),
-  metadata: e.record(e.any()).optional()
-}), vo = e.object({
-  ...Po.shape,
+  metadata: e.record(e.string(), e.any()).optional()
+}), jo = Po.extend({
   created_at: e.string().optional(),
   updated_at: e.string().optional()
-}), ri = e.array(vo), xo = e.object({
+}), ri = e.array(jo), xo = e.object({
   role_id: e.string(),
   resource_server_identifier: e.string(),
   permission_name: e.string()
-}), Ho = e.object({
-  ...xo.shape,
+}), Ho = xo.extend({
   created_at: e.string()
 }), li = e.array(Ho), Go = e.object({
   user_id: e.string(),
   resource_server_identifier: e.string(),
   permission_name: e.string(),
   organization_id: e.string().optional()
-}), Wo = e.object({
-  ...Go.shape,
+}), Wo = Go.extend({
   tenant_id: e.string(),
   created_at: e.string().optional()
 }), ci = e.array(Wo), Bo = e.object({
@@ -2761,17 +2746,16 @@ const yo = e.object({
   description: e.string().nullable().optional(),
   created_at: e.string().optional(),
   organization_id: e.string().optional()
-}), pi = e.array(
+}), _i = e.array(
   Bo
 ), Ko = e.object({
   user_id: e.string(),
   role_id: e.string(),
   organization_id: e.string().optional()
-}), Vo = e.object({
-  ...Ko.shape,
+}), Vo = Ko.extend({
   tenant_id: e.string(),
   created_at: e.string().optional()
-}), _i = e.array(Vo), Xo = e.object({
+}), pi = e.array(Vo), Xo = e.object({
   id: e.string().optional().openapi({
     description: "The unique identifier of the role. If not provided, one will be generated."
   }),
@@ -2782,7 +2766,7 @@ const yo = e.object({
     description: "The description of the role"
   }),
   is_system: e.boolean().optional(),
-  metadata: e.record(e.any()).optional().openapi({
+  metadata: e.record(e.string(), e.any()).optional().openapi({
     description: "Metadata associated with the role. Can be used to control sync behavior in multi-tenancy scenarios."
   })
 }), qo = Xo.extend({
@@ -2839,16 +2823,14 @@ const yo = e.object({
     description: "The display name of the organization"
   }),
   branding: zo,
-  metadata: e.record(e.any()).default({}).optional().openapi({
+  metadata: e.record(e.string(), e.any()).default({}).optional().openapi({
     description: "Custom metadata for the organization"
   }),
   enabled_connections: e.array(Yo).default([]).optional().openapi({
     description: "List of enabled connections for the organization"
   }),
   token_quota: Qo
-}), gi = e.object({
-  ...Zo.shape,
-  ...s.shape,
+}), gi = Zo.extend(s.shape).extend({
   id: e.string(),
   // Override name to be lenient when reading from database (to support existing uppercase names)
   name: e.string().min(1).openapi({
@@ -2861,8 +2843,7 @@ const yo = e.object({
   assign_membership_on_login: e.boolean().optional().default(!1),
   show_as_button: e.boolean().optional().default(!0),
   is_signup_enabled: e.boolean().optional().default(!0)
-}), $o = e.object({
-  ...Jo.shape,
+}), $o = Jo.extend({
   // Auth0 includes the embedded connection in GET responses.
   connection: e.object({
     name: e.string().optional(),
@@ -2879,9 +2860,7 @@ const yo = e.object({
   organization_id: e.string().openapi({
     description: "ID of the organization"
   })
-}), mi = e.object({
-  ...en.shape,
-  ...s.shape,
+}), mi = en.extend(s.shape).extend({
   id: e.string()
 }), Ei = e.object({
   // Session settings
@@ -3011,13 +2990,13 @@ const yo = e.object({
 }), hi = e.number().openapi({
   description: "Number of active users in the last 30 days",
   example: 1234
-}), bi = e.enum([
+}), Ai = e.enum([
   "active-users",
   "logins",
   "signups",
   "refresh-tokens",
   "sessions"
-]), Ai = e.enum(["hour", "day", "week", "month"]), fi = e.enum([
+]), bi = e.enum(["hour", "day", "week", "month"]), fi = e.enum([
   "time",
   "connection",
   "client_id",
@@ -3143,8 +3122,7 @@ function Q(o, n) {
     path: ["public_key"]
   }));
 }
-const yi = Y.superRefine(Q), Ri = e.object({
-  ...Y.shape,
+const yi = Y.superRefine(Q), Ri = Y.extend({
   id: e.string(),
   created_at: e.string(),
   updated_at: e.string()
@@ -3161,12 +3139,12 @@ function Di(o) {
     secondaries: i,
     syncMethods: S = ["create", "rawCreate", "update", "remove", "delete", "set"]
   } = o, f = {
-    get(_, r) {
+    get(p, r) {
       if (typeof r == "symbol")
-        return _[r];
-      const d = _[r];
+        return p[r];
+      const d = p[r];
       return typeof d != "function" ? d : S.includes(r) ? async (...g) => {
-        const C = await d.apply(_, g), u = [];
+        const C = await d.apply(p, g), u = [];
         for (const l of i) {
           const h = l.adapter[r];
           if (typeof h != "function")
@@ -3174,11 +3152,11 @@ function Di(o) {
           const I = (async () => {
             try {
               await h.apply(l.adapter, g);
-            } catch (b) {
+            } catch (A) {
               try {
-                l.onError ? l.onError(b, r, g) : console.error(
+                l.onError ? l.onError(A, r, g) : console.error(
                   `Passthrough adapter: secondary write failed for ${r}:`,
-                  b
+                  A
                 );
               } catch (O) {
                 console.error(
@@ -3191,7 +3169,7 @@ function Di(o) {
           l.blocking && u.push(I);
         }
         return u.length > 0 && await Promise.all(u), C;
-      } : d.bind(_);
+      } : d.bind(p);
     }
   };
   return new Proxy(n, f);
@@ -3200,7 +3178,7 @@ function Fi(o) {
   return o;
 }
 function Ui(o) {
-  var f, _, r, d, g, C, u, l, h, I, b, O;
+  var f, p, r, d, g, C, u, l, h, I, A, O;
   const n = o == null ? void 0 : o.options;
   if (!n)
     return {
@@ -3211,7 +3189,7 @@ function Ui(o) {
     };
   const i = n.attributes;
   if (i) {
-    const Z = ((_ = (f = i.username) == null ? void 0 : f.identifier) == null ? void 0 : _.active) === !0, J = ((d = (r = i.email) == null ? void 0 : r.identifier) == null ? void 0 : d.active) !== !1, $ = ((C = (g = i.username) == null ? void 0 : g.validation) == null ? void 0 : C.min_length) ?? 1, ee = ((l = (u = i.username) == null ? void 0 : u.validation) == null ? void 0 : l.max_length) ?? 15;
+    const Z = ((p = (f = i.username) == null ? void 0 : f.identifier) == null ? void 0 : p.active) === !0, J = ((d = (r = i.email) == null ? void 0 : r.identifier) == null ? void 0 : d.active) !== !1, $ = ((C = (g = i.username) == null ? void 0 : g.validation) == null ? void 0 : C.min_length) ?? 1, ee = ((l = (u = i.username) == null ? void 0 : u.validation) == null ? void 0 : l.max_length) ?? 15;
     return {
       usernameIdentifierActive: Z,
       emailIdentifierActive: J,
@@ -3223,7 +3201,7 @@ function Ui(o) {
     usernameIdentifierActive: n.requires_username === !0,
     emailIdentifierActive: !0,
     usernameMinLength: ((I = (h = n.validation) == null ? void 0 : h.username) == null ? void 0 : I.min) ?? 1,
-    usernameMaxLength: ((O = (b = n.validation) == null ? void 0 : b.username) == null ? void 0 : O.max) ?? 15
+    usernameMaxLength: ((O = (A = n.validation) == null ? void 0 : A.username) == null ? void 0 : O.max) ?? 15
   };
 }
 function wi(o) {
@@ -3232,25 +3210,25 @@ function wi(o) {
 export {
   un as Auth0ActionEnum,
   co as Auth0Client,
-  v as AuthorizationResponseMode,
+  j as AuthorizationResponseMode,
   P as AuthorizationResponseType,
   x as CodeChallengeMethod,
-  M as ComponentCategory,
-  j as ComponentType,
+  v as ComponentCategory,
+  M as ComponentType,
   mn as EmailActionEnum,
   Ln as FORM_FIELD_TYPES,
   gn as FlowActionTypeEnum,
   No as GrantType,
-  po as LocationInfo,
+  _o as LocationInfo,
   t as LogTypes,
   X as LoginSessionState,
   We as NodeType,
-  Ae as RedirectTargetEnum,
+  be as RedirectTargetEnum,
   Ti as Strategy,
   Ni as StrategyType,
   F as actionDependencySchema,
   ne as actionExecutionErrorSchema,
-  pn as actionExecutionInsertSchema,
+  _n as actionExecutionInsertSchema,
   ae as actionExecutionLogEntrySchema,
   se as actionExecutionLogsSchema,
   ie as actionExecutionResultSchema,
@@ -3264,15 +3242,15 @@ export {
   D as actionTriggerSchema,
   ln as actionUpdateSchema,
   le as actionVersionInsertSchema,
-  _n as actionVersionSchema,
+  pn as actionVersionSchema,
   hi as activeUsersResponseSchema,
-  pe as actorSchema,
+  _e as actorSchema,
   Ne as addressSchema,
   tn as analyticsColumnMetaSchema,
   fi as analyticsGroupBySchema,
-  Ai as analyticsIntervalSchema,
+  bi as analyticsIntervalSchema,
   Ii as analyticsQueryResponseSchema,
-  bi as analyticsResourceSchema,
+  Ai as analyticsResourceSchema,
   on as analyticsStatisticsSchema,
   Ci as analyticsUserTypeSchema,
   Co as attackProtectionSchema,
@@ -3284,7 +3262,7 @@ export {
   Qe as auth0FlowSchema,
   Sn as auth0QuerySchema,
   he as auth0UpdateUserActionSchema,
-  bn as auth0UserResponseSchema,
+  An as auth0UserResponseSchema,
   Je as authParamsSchema,
   yi as authenticationMethodInsertSchema,
   Ri as authenticationMethodSchema,
@@ -3293,15 +3271,15 @@ export {
   kt as blockComponentSchema,
   yo as bordersSchema,
   Tn as brandingSchema,
-  bo as breachedPasswordDetectionSchema,
-  Ao as bruteForceProtectionSchema,
+  Ao as breachedPasswordDetectionSchema,
+  bo as bruteForceProtectionSchema,
   Pe as buttonComponentSchema,
   Ze as claimsRequestSchema,
   Ue as clientGrantInsertSchema,
   Cn as clientGrantListSchema,
   we as clientGrantSchema,
   Fe as clientInsertSchema,
-  je as clientRegistrationTokenInsertSchema,
+  Me as clientRegistrationTokenInsertSchema,
   In as clientRegistrationTokenSchema,
   ke as clientRegistrationTokenTypeSchema,
   fn as clientSchema,
@@ -3327,9 +3305,9 @@ export {
   wo as emailTemplateNameSchema,
   ni as emailTemplateSchema,
   Se as emailVerificationRulesSchema,
-  be as emailVerifyActionSchema,
+  Ae as emailVerifyActionSchema,
   Ye as endingSchema,
-  Mt as fieldComponentSchema,
+  vt as fieldComponentSchema,
   Ce as flowActionStepSchema,
   Ie as flowInsertSchema,
   En as flowSchema,
@@ -3351,23 +3329,23 @@ export {
   Jt as hookCodeInsertSchema,
   xn as hookCodeSchema,
   Pn as hookInsertSchema,
-  vn as hookSchema,
+  jn as hookSchema,
   V as hookTemplateId,
-  Mn as hookTemplates,
+  vn as hookTemplates,
   Te as identitySchema,
   to as inviteInsertSchema,
   Hn as inviteSchema,
   eo as inviteeSchema,
   $t as inviterSchema,
   wn as isBlockComponent,
-  jn as isFieldComponent,
+  Mn as isFieldComponent,
   wi as isPlainObject,
   kn as isWidgetComponent,
   Gn as jwksKeySchema,
   oo as jwksSchema,
-  ve as legalComponentSchema,
+  je as legalComponentSchema,
   ue as locationInfoSchema,
-  _o as logInsertSchema,
+  po as logInsertSchema,
   Xn as logSchema,
   uo as logStreamFilterSchema,
   mo as logStreamInsertSchema,
@@ -3407,11 +3385,11 @@ export {
   de as requestContextSchema,
   Po as resourceServerInsertSchema,
   ri as resourceServerListSchema,
-  Mo as resourceServerOptionsSchema,
-  vo as resourceServerSchema,
-  jo as resourceServerScopeSchema,
+  vo as resourceServerOptionsSchema,
+  jo as resourceServerSchema,
+  Mo as resourceServerScopeSchema,
   ge as responseContextSchema,
-  Me as richTextComponentSchema,
+  ve as richTextComponentSchema,
   Xo as roleInsertSchema,
   di as roleListSchema,
   xo as rolePermissionInsertSchema,
@@ -3426,7 +3404,7 @@ export {
   ai as smsSendParamsSchema,
   ze as startSchema,
   fo as suspiciousIpThrottlingSchema,
-  _e as targetSchema,
+  pe as targetSchema,
   To as tenantInsertSchema,
   Jn as tenantSchema,
   Ei as tenantSettingsSchema,
@@ -3441,14 +3419,14 @@ export {
   Go as userPermissionInsertSchema,
   ci as userPermissionListSchema,
   Wo as userPermissionSchema,
-  pi as userPermissionWithDetailsListSchema,
+  _i as userPermissionWithDetailsListSchema,
   Bo as userPermissionWithDetailsSchema,
-  An as userResponseSchema,
+  bn as userResponseSchema,
   Ko as userRoleInsertSchema,
-  _i as userRoleListSchema,
+  pi as userRoleListSchema,
   Vo as userRoleSchema,
   Re as userSchema,
   it as verificationMethodsSchema,
-  jt as widgetComponentSchema,
+  Mt as widgetComponentSchema,
   Fo as widgetSchema
 };