@authhero/adapter-interfaces 4.13.0 → 4.15.0

package/dist/adapter-interfaces.d.ts

@@ -1206,6 +1206,9 @@ declare const clientInsertSchema: z.ZodObject<{
         iat_dcr: "iat_dcr";
     }>>;
     registration_metadata: z.ZodOptional<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodAny>>>;
+    token_exchange: z.ZodOptional<z.ZodObject<{
+        allow_any_profile_of_type: z.ZodOptional<z.ZodArray<z.ZodLiteral<"custom_authentication">>>;
+    }, z.core.$strip>>;
     user_linking_mode: z.ZodOptional<z.ZodEnum<{
         builtin: "builtin";
         off: "off";
@@ -1339,6 +1342,9 @@ declare const clientSchema: z.ZodObject<{
         iat_dcr: "iat_dcr";
     }>>;
     registration_metadata: z.ZodOptional<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodAny>>>;
+    token_exchange: z.ZodOptional<z.ZodObject<{
+        allow_any_profile_of_type: z.ZodOptional<z.ZodArray<z.ZodLiteral<"custom_authentication">>>;
+    }, z.core.$strip>>;
     user_linking_mode: z.ZodOptional<z.ZodEnum<{
         builtin: "builtin";
         off: "off";
@@ -2117,6 +2123,7 @@ declare const codeTypeSchema: z.ZodEnum<{
     oauth2_state: "oauth2_state";
     ticket: "ticket";
     client_assertion_jti: "client_assertion_jti";
+    subject_token_jti: "subject_token_jti";
 }>;
 type CodeType = z.infer<typeof codeTypeSchema>;
 declare const codeInsertSchema: z.ZodObject<{
@@ -2132,6 +2139,7 @@ declare const codeInsertSchema: z.ZodObject<{
         oauth2_state: "oauth2_state";
         ticket: "ticket";
         client_assertion_jti: "client_assertion_jti";
+        subject_token_jti: "subject_token_jti";
     }>;
     code_verifier: z.ZodOptional<z.ZodString>;
     code_challenge: z.ZodOptional<z.ZodString>;
@@ -2161,6 +2169,7 @@ declare const codeSchema: z.ZodObject<{
         oauth2_state: "oauth2_state";
         ticket: "ticket";
         client_assertion_jti: "client_assertion_jti";
+        subject_token_jti: "subject_token_jti";
     }>;
     code_verifier: z.ZodOptional<z.ZodString>;
     code_challenge: z.ZodOptional<z.ZodString>;
@@ -2864,6 +2873,11 @@ declare const nextButtonComponent: z.ZodObject<{
     type: z.ZodLiteral<"NEXT_BUTTON">;
     config: z.ZodObject<{
         text: z.ZodOptional<z.ZodString>;
+        variant: z.ZodOptional<z.ZodEnum<{
+            primary: "primary";
+            secondary: "secondary";
+        }>>;
+        skip_validation: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>;
 }, z.core.$strip>;
 declare const previousButtonComponent: z.ZodObject<{
@@ -3482,6 +3496,11 @@ declare const blockComponentSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     type: z.ZodLiteral<"NEXT_BUTTON">;
     config: z.ZodObject<{
         text: z.ZodOptional<z.ZodString>;
+        variant: z.ZodOptional<z.ZodEnum<{
+            primary: "primary";
+            secondary: "secondary";
+        }>>;
+        skip_validation: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>;
 }, z.core.$strip>, z.ZodObject<{
     id: z.ZodString;
@@ -4095,6 +4114,11 @@ declare const formNodeComponentDefinition: z.ZodUnion<readonly [z.ZodDiscriminat
     type: z.ZodLiteral<"NEXT_BUTTON">;
     config: z.ZodObject<{
         text: z.ZodOptional<z.ZodString>;
+        variant: z.ZodOptional<z.ZodEnum<{
+            primary: "primary";
+            secondary: "secondary";
+        }>>;
+        skip_validation: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>;
 }, z.core.$strip>, z.ZodObject<{
     id: z.ZodString;
@@ -4790,6 +4814,11 @@ declare const stepNodeSchema: z.ZodObject<{
             type: z.ZodLiteral<"NEXT_BUTTON">;
             config: z.ZodObject<{
                 text: z.ZodOptional<z.ZodString>;
+                variant: z.ZodOptional<z.ZodEnum<{
+                    primary: "primary";
+                    secondary: "secondary";
+                }>>;
+                skip_validation: z.ZodOptional<z.ZodBoolean>;
             }, z.core.$strip>;
         }, z.core.$strip>, z.ZodObject<{
             id: z.ZodString;
@@ -5433,6 +5462,11 @@ declare const formNodeSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             type: z.ZodLiteral<"NEXT_BUTTON">;
             config: z.ZodObject<{
                 text: z.ZodOptional<z.ZodString>;
+                variant: z.ZodOptional<z.ZodEnum<{
+                    primary: "primary";
+                    secondary: "secondary";
+                }>>;
+                skip_validation: z.ZodOptional<z.ZodBoolean>;
             }, z.core.$strip>;
         }, z.core.$strip>, z.ZodObject<{
             id: z.ZodString;
@@ -6094,6 +6128,11 @@ declare const formInsertSchema: z.ZodObject<{
                 type: z.ZodLiteral<"NEXT_BUTTON">;
                 config: z.ZodObject<{
                     text: z.ZodOptional<z.ZodString>;
+                    variant: z.ZodOptional<z.ZodEnum<{
+                        primary: "primary";
+                        secondary: "secondary";
+                    }>>;
+                    skip_validation: z.ZodOptional<z.ZodBoolean>;
                 }, z.core.$strip>;
             }, z.core.$strip>, z.ZodObject<{
                 id: z.ZodString;
@@ -6787,6 +6826,11 @@ declare const formSchema: z.ZodObject<{
                 type: z.ZodLiteral<"NEXT_BUTTON">;
                 config: z.ZodObject<{
                     text: z.ZodOptional<z.ZodString>;
+                    variant: z.ZodOptional<z.ZodEnum<{
+                        primary: "primary";
+                        secondary: "secondary";
+                    }>>;
+                    skip_validation: z.ZodOptional<z.ZodBoolean>;
                 }, z.core.$strip>;
             }, z.core.$strip>, z.ZodObject<{
                 id: z.ZodString;
@@ -7471,6 +7515,11 @@ declare const uiScreenSchema: z.ZodObject<{
         type: z.ZodLiteral<"NEXT_BUTTON">;
         config: z.ZodObject<{
             text: z.ZodOptional<z.ZodString>;
+            variant: z.ZodOptional<z.ZodEnum<{
+                primary: "primary";
+                secondary: "secondary";
+            }>>;
+            skip_validation: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>;
     }, z.core.$strip>, z.ZodObject<{
         id: z.ZodString;
@@ -8331,7 +8380,7 @@ declare const inviteSchema: z.ZodObject<{
 type Invite = z.infer<typeof inviteSchema>;
 
 declare const jwksSchema: z.ZodObject<{
-    alg: z.ZodEnum<{
+    alg: z.ZodOptional<z.ZodEnum<{
         RS256: "RS256";
         RS384: "RS384";
         RS512: "RS512";
@@ -8341,7 +8390,7 @@ declare const jwksSchema: z.ZodObject<{
         HS256: "HS256";
         HS384: "HS384";
         HS512: "HS512";
-    }>;
+    }>>;
     kid: z.ZodOptional<z.ZodString>;
     kty: z.ZodEnum<{
         RSA: "RSA";
@@ -8362,7 +8411,7 @@ declare const jwksSchema: z.ZodObject<{
 }, z.core.$strip>;
 declare const jwksKeySchema: z.ZodObject<{
     keys: z.ZodArray<z.ZodObject<{
-        alg: z.ZodEnum<{
+        alg: z.ZodOptional<z.ZodEnum<{
             RS256: "RS256";
             RS384: "RS384";
             RS512: "RS512";
@@ -8372,7 +8421,7 @@ declare const jwksKeySchema: z.ZodObject<{
             HS256: "HS256";
             HS384: "HS384";
             HS512: "HS512";
-        }>;
+        }>>;
         kid: z.ZodOptional<z.ZodString>;
         kty: z.ZodEnum<{
             RSA: "RSA";
@@ -10316,6 +10365,286 @@ declare const proxyRouteUpdateSchema: z.ZodObject<{
 }, z.core.$strip>;
 type ProxyRouteUpdate = z.infer<typeof proxyRouteUpdateSchema>;
 
+/**
+ * Custom Token Exchange profiles (Auth0-compatible, issue #1417).
+ *
+ * A profile maps an RFC 8693 `subject_token_type` to the logic that validates
+ * a customer-issued subject token and decides which user the exchange issues
+ * tokens for. Auth0 only supports that logic as an Action (`action_id`).
+ * AuthHero additionally supports a declarative `jwt_verification` block so the
+ * common "verify our signed JWT against our JWKS" case needs no code.
+ * Exactly one of `action_id` and `jwt_verification` is set on a profile.
+ */
+declare const TOKEN_EXCHANGE_PROFILE_TYPE: "custom_authentication";
+/**
+ * Namespaces a profile may not claim. `urn:ietf:params:oauth` holds the
+ * standard RFC 8693 token types that AuthHero handles natively; the vendor
+ * namespaces are reserved by Auth0.
+ */
+declare const RESERVED_SUBJECT_TOKEN_TYPE_PREFIXES: readonly ["urn:ietf:params:oauth:", "urn:auth0", "urn:okta", "http://auth0.com", "https://auth0.com", "http://okta.com", "https://okta.com"];
+declare const subjectTokenTypeSchema: z.ZodString;
+declare const tokenExchangeJwtAlgorithmSchema: z.ZodEnum<{
+    RS256: "RS256";
+    RS384: "RS384";
+    RS512: "RS512";
+    ES256: "ES256";
+    ES384: "ES384";
+    ES512: "ES512";
+}>;
+type TokenExchangeJwtAlgorithm = z.infer<typeof tokenExchangeJwtAlgorithmSchema>;
+declare const tokenExchangeUserMappingSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"connection">;
+    connection: z.ZodString;
+    create_if_not_exists: z.ZodDefault<z.ZodBoolean>;
+    trust_email_verified: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"user_id">;
+}, z.core.$strip>], "type">;
+type TokenExchangeUserMapping = z.infer<typeof tokenExchangeUserMappingSchema>;
+declare const tokenExchangeJwtVerificationSchema: z.ZodObject<{
+    issuer: z.ZodString;
+    jwks: z.ZodOptional<z.ZodObject<{
+        keys: z.ZodArray<z.ZodObject<{
+            alg: z.ZodOptional<z.ZodEnum<{
+                RS256: "RS256";
+                RS384: "RS384";
+                RS512: "RS512";
+                ES256: "ES256";
+                ES384: "ES384";
+                ES512: "ES512";
+                HS256: "HS256";
+                HS384: "HS384";
+                HS512: "HS512";
+            }>>;
+            kid: z.ZodOptional<z.ZodString>;
+            kty: z.ZodEnum<{
+                RSA: "RSA";
+                EC: "EC";
+                oct: "oct";
+            }>;
+            use: z.ZodOptional<z.ZodEnum<{
+                sig: "sig";
+                enc: "enc";
+            }>>;
+            n: z.ZodOptional<z.ZodString>;
+            e: z.ZodOptional<z.ZodString>;
+            crv: z.ZodOptional<z.ZodString>;
+            x: z.ZodOptional<z.ZodString>;
+            y: z.ZodOptional<z.ZodString>;
+            x5t: z.ZodOptional<z.ZodString>;
+            x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    jwks_uri: z.ZodOptional<z.ZodString>;
+    audience: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    algorithms: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        RS256: "RS256";
+        RS384: "RS384";
+        RS512: "RS512";
+        ES256: "ES256";
+        ES384: "ES384";
+        ES512: "ES512";
+    }>>>;
+    max_lifetime_seconds: z.ZodDefault<z.ZodNumber>;
+    require_jti: z.ZodDefault<z.ZodBoolean>;
+    user_mapping: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"connection">;
+        connection: z.ZodString;
+        create_if_not_exists: z.ZodDefault<z.ZodBoolean>;
+        trust_email_verified: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"user_id">;
+    }, z.core.$strip>], "type">;
+}, z.core.$strip>;
+type TokenExchangeJwtVerification = z.infer<typeof tokenExchangeJwtVerificationSchema>;
+declare const tokenExchangeProfileInsertSchema: z.ZodObject<{
+    name: z.ZodString;
+    subject_token_type: z.ZodString;
+    action_id: z.ZodOptional<z.ZodString>;
+    type: z.ZodLiteral<"custom_authentication">;
+    jwt_verification: z.ZodOptional<z.ZodObject<{
+        issuer: z.ZodString;
+        jwks: z.ZodOptional<z.ZodObject<{
+            keys: z.ZodArray<z.ZodObject<{
+                alg: z.ZodOptional<z.ZodEnum<{
+                    RS256: "RS256";
+                    RS384: "RS384";
+                    RS512: "RS512";
+                    ES256: "ES256";
+                    ES384: "ES384";
+                    ES512: "ES512";
+                    HS256: "HS256";
+                    HS384: "HS384";
+                    HS512: "HS512";
+                }>>;
+                kid: z.ZodOptional<z.ZodString>;
+                kty: z.ZodEnum<{
+                    RSA: "RSA";
+                    EC: "EC";
+                    oct: "oct";
+                }>;
+                use: z.ZodOptional<z.ZodEnum<{
+                    sig: "sig";
+                    enc: "enc";
+                }>>;
+                n: z.ZodOptional<z.ZodString>;
+                e: z.ZodOptional<z.ZodString>;
+                crv: z.ZodOptional<z.ZodString>;
+                x: z.ZodOptional<z.ZodString>;
+                y: z.ZodOptional<z.ZodString>;
+                x5t: z.ZodOptional<z.ZodString>;
+                x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+        jwks_uri: z.ZodOptional<z.ZodString>;
+        audience: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        algorithms: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            RS256: "RS256";
+            RS384: "RS384";
+            RS512: "RS512";
+            ES256: "ES256";
+            ES384: "ES384";
+            ES512: "ES512";
+        }>>>;
+        max_lifetime_seconds: z.ZodDefault<z.ZodNumber>;
+        require_jti: z.ZodDefault<z.ZodBoolean>;
+        user_mapping: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"connection">;
+            connection: z.ZodString;
+            create_if_not_exists: z.ZodDefault<z.ZodBoolean>;
+            trust_email_verified: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip>, z.ZodObject<{
+            type: z.ZodLiteral<"user_id">;
+        }, z.core.$strip>], "type">;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+type TokenExchangeProfileInsert = z.input<typeof tokenExchangeProfileInsertSchema>;
+declare const tokenExchangeProfileSchema: z.ZodObject<{
+    name: z.ZodString;
+    subject_token_type: z.ZodString;
+    action_id: z.ZodOptional<z.ZodString>;
+    type: z.ZodLiteral<"custom_authentication">;
+    jwt_verification: z.ZodOptional<z.ZodObject<{
+        issuer: z.ZodString;
+        jwks: z.ZodOptional<z.ZodObject<{
+            keys: z.ZodArray<z.ZodObject<{
+                alg: z.ZodOptional<z.ZodEnum<{
+                    RS256: "RS256";
+                    RS384: "RS384";
+                    RS512: "RS512";
+                    ES256: "ES256";
+                    ES384: "ES384";
+                    ES512: "ES512";
+                    HS256: "HS256";
+                    HS384: "HS384";
+                    HS512: "HS512";
+                }>>;
+                kid: z.ZodOptional<z.ZodString>;
+                kty: z.ZodEnum<{
+                    RSA: "RSA";
+                    EC: "EC";
+                    oct: "oct";
+                }>;
+                use: z.ZodOptional<z.ZodEnum<{
+                    sig: "sig";
+                    enc: "enc";
+                }>>;
+                n: z.ZodOptional<z.ZodString>;
+                e: z.ZodOptional<z.ZodString>;
+                crv: z.ZodOptional<z.ZodString>;
+                x: z.ZodOptional<z.ZodString>;
+                y: z.ZodOptional<z.ZodString>;
+                x5t: z.ZodOptional<z.ZodString>;
+                x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+        jwks_uri: z.ZodOptional<z.ZodString>;
+        audience: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        algorithms: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            RS256: "RS256";
+            RS384: "RS384";
+            RS512: "RS512";
+            ES256: "ES256";
+            ES384: "ES384";
+            ES512: "ES512";
+        }>>>;
+        max_lifetime_seconds: z.ZodDefault<z.ZodNumber>;
+        require_jti: z.ZodDefault<z.ZodBoolean>;
+        user_mapping: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"connection">;
+            connection: z.ZodString;
+            create_if_not_exists: z.ZodDefault<z.ZodBoolean>;
+            trust_email_verified: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip>, z.ZodObject<{
+            type: z.ZodLiteral<"user_id">;
+        }, z.core.$strip>], "type">;
+    }, z.core.$strip>>;
+    id: z.ZodString;
+    created_at: z.ZodString;
+    updated_at: z.ZodString;
+}, z.core.$strip>;
+type TokenExchangeProfile = z.infer<typeof tokenExchangeProfileSchema>;
+declare const tokenExchangeProfileUpdateSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    subject_token_type: z.ZodOptional<z.ZodString>;
+    jwt_verification: z.ZodOptional<z.ZodObject<{
+        issuer: z.ZodString;
+        jwks: z.ZodOptional<z.ZodObject<{
+            keys: z.ZodArray<z.ZodObject<{
+                alg: z.ZodOptional<z.ZodEnum<{
+                    RS256: "RS256";
+                    RS384: "RS384";
+                    RS512: "RS512";
+                    ES256: "ES256";
+                    ES384: "ES384";
+                    ES512: "ES512";
+                    HS256: "HS256";
+                    HS384: "HS384";
+                    HS512: "HS512";
+                }>>;
+                kid: z.ZodOptional<z.ZodString>;
+                kty: z.ZodEnum<{
+                    RSA: "RSA";
+                    EC: "EC";
+                    oct: "oct";
+                }>;
+                use: z.ZodOptional<z.ZodEnum<{
+                    sig: "sig";
+                    enc: "enc";
+                }>>;
+                n: z.ZodOptional<z.ZodString>;
+                e: z.ZodOptional<z.ZodString>;
+                crv: z.ZodOptional<z.ZodString>;
+                x: z.ZodOptional<z.ZodString>;
+                y: z.ZodOptional<z.ZodString>;
+                x5t: z.ZodOptional<z.ZodString>;
+                x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+        jwks_uri: z.ZodOptional<z.ZodString>;
+        audience: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        algorithms: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            RS256: "RS256";
+            RS384: "RS384";
+            RS512: "RS512";
+            ES256: "ES256";
+            ES384: "ES384";
+            ES512: "ES512";
+        }>>>;
+        max_lifetime_seconds: z.ZodDefault<z.ZodNumber>;
+        require_jti: z.ZodDefault<z.ZodBoolean>;
+        user_mapping: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"connection">;
+            connection: z.ZodString;
+            create_if_not_exists: z.ZodDefault<z.ZodBoolean>;
+            trust_email_verified: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip>, z.ZodObject<{
+            type: z.ZodLiteral<"user_id">;
+        }, z.core.$strip>], "type">;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+type TokenExchangeProfileUpdate = z.input<typeof tokenExchangeProfileUpdateSchema>;
+
 /**
  * One attribute-mapping entry translating a SCIM resource attribute to an
  * AuthHero user field. Mirrors Auth0's SCIM `mapping` shape (`{ scim, auth0 }`).
@@ -11435,6 +11764,12 @@ interface CreateOptions {
  * this const keeps them byte-identical by construction.
  */
 declare const TRIGGER_API_SHAPES: Readonly<Record<string, Readonly<Record<string, readonly string[]>>>>;
+/**
+ * The export each trigger's user code must define, e.g.
+ * `exports.onExecutePostLogin = async (event, api) => { ... }`. Shared by both
+ * executors for the same reason as {@link TRIGGER_API_SHAPES}.
+ */
+declare const TRIGGER_FUNCTION_NAMES: Readonly<Record<string, string>>;
 /**
  * A single candidate primary the built-in email-based linking policy would
  * consider, pre-resolved into a `post-user-login` code-hook event as
@@ -12106,6 +12441,25 @@ interface UserDataAdapter {
      * the same atomic unit as the user row.
      */
     rawCreate(tenantId: string, user: UserInsert, options?: WriteOptions): Promise<User>;
+    /**
+     * Insert many users in as few round-trips as the backend allows.
+     *
+     * Optional. Callers MUST fall back to looping `create` when it is absent —
+     * this exists to make bulk paths (the users-import job) fast, not to add a
+     * second way of writing a user that every backend has to implement.
+     *
+     * Unlike `create` this is deliberately narrow: it writes the users row and,
+     * where `user.password` is set, the companion password row. It does NOT
+     * handle identities, activity counters or outbox events, because no bulk
+     * caller needs them and supporting them would make the batch no cheaper than
+     * the loop it replaces. Pass a user carrying those and the implementation is
+     * free to reject the batch.
+     *
+     * Returns the created users in input order. On a uniqueness violation the
+     * whole batch is rejected — the caller is expected to have de-duplicated and
+     * probed first, and to retry row-by-row to attribute the failure.
+     */
+    createMany?(tenantId: string, users: UserInsert[], options?: WriteOptions): Promise<User[]>;
     remove(tenantId: string, id: string, options?: WriteOptions): Promise<boolean>;
     list(tenantId: string, params?: ListParams): Promise<ListUsersResponse>;
     update(tenantId: string, id: string, user: Partial<User>, options?: WriteOptions): Promise<boolean>;
@@ -12234,6 +12588,19 @@ interface ProxyRoutesAdapter {
     remove(tenant_id: string, id: string): Promise<boolean>;
 }
 
+interface TokenExchangeProfilesAdapter {
+    create(tenant_id: string, profile: TokenExchangeProfileInsert, options?: CreateOptions): Promise<TokenExchangeProfile>;
+    get(tenant_id: string, id: string): Promise<TokenExchangeProfile | null>;
+    /**
+     * All profiles for the tenant, oldest first. Tenants hold a handful of
+     * profiles, so the management API pages in memory and the token endpoint
+     * resolves a `subject_token_type` from this list.
+     */
+    list(tenant_id: string): Promise<TokenExchangeProfile[]>;
+    update(tenant_id: string, id: string, profile: TokenExchangeProfileUpdate): Promise<boolean>;
+    remove(tenant_id: string, id: string): Promise<boolean>;
+}
+
 interface ScimConfigurationsAdapter {
     create: (tenant_id: string, configuration: ScimConfigurationInsert) => Promise<ScimConfiguration>;
     get: (tenant_id: string, connection_id: string) => Promise<ScimConfiguration | null>;
@@ -13055,6 +13422,12 @@ interface DataAdapters {
      */
     analytics?: AnalyticsAdapter;
     tenants: TenantsDataAdapter;
+    /**
+     * Optional Custom Token Exchange profiles (issue #1417). When set, the
+     * `/api/v2/token-exchange-profiles` management API is mounted and the
+     * token-exchange grant accepts customer-defined `subject_token_type`s.
+     */
+    tokenExchangeProfiles?: TokenExchangeProfilesAdapter;
     /**
      * Optional control-plane log of durable tenant lifecycle operations
      * (provision / seed / upgrade / backup / deprovision — issue #1026).
@@ -13140,5 +13513,5 @@ interface DataAdapters {
     };
 }
 
-export { Auth0ActionEnum, Auth0Client, AuthorizationResponseMode, AuthorizationResponseType, CodeChallengeMethod, ComponentCategory, ComponentType, DATABASE_CONNECTION_STRATEGY, EmailActionEnum, FORM_FIELD_TYPES, FeatureNotSupportedError, FlowActionTypeEnum, GrantType, KNOWN_TENANT_OPERATION_ENGINES, LocationInfo, LogTypes, LoginSessionState, MONDAY_EPOCH_SHIFT_MS, NodeType, PRESERVE_LOCATION_HEADER, RedirectTargetEnum, Strategy, StrategyType, TERMINAL_TENANT_OPERATION_ROW_STATUSES, TRIGGER_API_SHAPES, USERNAME_CONTAINS_AT_MESSAGE, USERNAME_INVALID_CHARACTERS_MESSAGE, WEEK_MS, actionDependencySchema, actionExecutionErrorSchema, actionExecutionInsertSchema, actionExecutionLogEntrySchema, actionExecutionLogsSchema, actionExecutionResultSchema, actionExecutionSchema, actionExecutionStatusSchema, actionExecutionTriggerIdSchema, actionInsertSchema, actionNodeSchema, actionResponseSchema, actionSchema, actionSecretNameSchema, actionSecretSchema, actionTriggerSchema, actionUpdateSchema, actionVersionInsertSchema, actionVersionSchema, activeUsersResponseSchema, actorSchema, addressSchema, allowedTriggersForHook, analyticsColumnMetaSchema, analyticsGroupBySchema, analyticsIntervalSchema, analyticsQueryResponseSchema, analyticsResourceSchema, analyticsStatisticsSchema, analyticsUserTypeSchema, attackProtectionSchema, auditCategorySchema, auditEventInsertSchema, auditEventSchema, auth0ClientSchema, auth0FlowInsertSchema, auth0FlowSchema, auth0QuerySchema, auth0UpdateUserActionSchema, auth0UserResponseSchema, authParamsSchema, authenticationMethodInsertSchema, authenticationMethodSchema, authenticationMethodTypeSchema, baseUserSchema, blockComponentSchema, bordersSchema, brandingSchema, breachedPasswordDetectionSchema, bruteForceProtectionSchema, buildRefreshTokenRetention, buildSessionRetention, buttonComponentSchema, claimsRequestSchema, clientGrantInsertSchema, clientGrantListSchema, clientGrantSchema, clientInsertSchema, clientRegistrationTokenInsertSchema, clientRegistrationTokenSchema, clientRegistrationTokenTypeSchema, clientSchema, codeInsertSchema, codeSchema, codeTypeSchema, colorsSchema, componentMessageSchema, componentSchema, connectionInsertSchema, connectionOptionsSchema, connectionSchema, coordinatesSchema, createPassthroughAdapter, createWriteOnlyAdapter, customDomainCertificateUploadSchema, customDomainInsertSchema, customDomainSchema, customDomainUpdateSchema, customDomainWithTenantIdSchema, customTextEntrySchema, customTextSchema, dailyStatsSchema, decodeBase32, decodeBase64, decodeBase64Url, decodeBase64UrlString, decodeCursor, emailProviderSchema, emailTemplateNameSchema, emailTemplateSchema, emailVerificationRulesSchema, emailVerifyActionSchema, encodeBase32, encodeBase64, encodeBase64Url, encodeBase64UrlString, encodeCursor, encodeHex, endingSchema, escapeLuceneValue, fieldComponentSchema, flowActionStepSchema, flowInsertSchema, flowSchema, fieldComponentSchema$1 as flowsFieldComponentSchema, flowNodeSchema$1 as flowsFlowNodeSchema, stepNodeSchema$1 as flowsStepNodeSchema, fontDetailsSchema, fontsSchema, formControlSchema, formInsertSchema, formNodeComponentDefinition, formNodeSchema, formSchema, genericComponentSchema, genericNodeSchema, getConnectionIdentifierConfig, getLogTypeCategory, getLogTypeDescription, grantInsertSchema, grantSchema, handlerConfigSchema, hookCodeInsertSchema, hookCodeSchema, hookInsertSchema, hookPageId, hookSchema, hookTemplateId, hookTemplates, identitySchema, importMetadataSchema, inviteInsertSchema, inviteSchema, inviteeSchema, inviterSchema, isBlockComponent, isDatabaseConnectionStrategy, isEmailSearchTerm, isFeatureNotSupportedError, isFieldComponent, isPlainObject, isWidgetComponent, jwksKeySchema, jwksSchema, legalComponentSchema, locationInfoSchema, logInsertSchema, logSchema, logStreamFilterSchema, logStreamInsertSchema, logStreamSchema, logStreamStatusSchema, logStreamTypeSchema, logTypeCategories, logTypeDescriptions, loginSessionAuthStrategySchema, loginSessionInsertSchema, loginSessionSchema, loginSessionStateSchema, matchSchema, migrationProviderTypeSchema, migrationSourceCredentialsSchema, migrationSourceInsertSchema, migrationSourceSchema, nodeSchema, normalizeUsername, openIDConfigurationSchema, organizationBrandingSchema, organizationConnectionInsertSchema, organizationConnectionListSchema, organizationConnectionSchema, organizationEnabledConnectionSchema, organizationInsertSchema, organizationSchema, organizationTokenQuotaSchema, pageBackgroundSchema, parseUserId, passwordInsertSchema, passwordSchema, profileDataSchema, promptScreenSchema, promptSettingSchema, proxyRouteInsertSchema, proxyRouteSchema, proxyRouteUpdateSchema, redirectActionSchema, refreshTokenInsertSchema, refreshTokenRetentionCohortSchema, refreshTokenRetentionResponseSchema, refreshTokenSchema, requestContextSchema, resourceServerInsertSchema, resourceServerListSchema, resourceServerOptionsSchema, resourceServerSchema, resourceServerScopeSchema, responseContextSchema, richTextComponentSchema, roleInsertSchema, roleListSchema, rolePermissionInsertSchema, rolePermissionListSchema, rolePermissionSchema, roleSchema, rolloutInsertSchema, rolloutKindSchema, rolloutSchema, rolloutStatusSchema, rolloutUpdateSchema, sanitizeLuceneQuery, scimConfigurationInsertSchema, scimConfigurationSchema, scimExternalIdInsertSchema, scimExternalIdSchema, scimMappingEntrySchema, scimTokenInsertSchema, scimTokenSchema, screenLinkSchema, sessionInsertSchema, sessionRetentionCohortSchema, sessionRetentionResponseSchema, sessionRetentionWindow, sessionSchema, signingKeySchema, smsProviderSchema, smsSendParamsSchema, splitLuceneOrGroups, startSchema, suspiciousIpThrottlingSchema, targetSchema, tenantInsertSchema, tenantOperationEngineSchema, tenantOperationEventInsertSchema, tenantOperationEventOutcomeSchema, tenantOperationEventSchema, tenantOperationInsertSchema, tenantOperationKindSchema, tenantOperationRowInsertSchema, tenantOperationRowOutcomeSchema, tenantOperationRowSchema, tenantOperationRowStatusSchema, tenantOperationSchema, tenantOperationStatusSchema, tenantOperationUpdateSchema, tenantSchema, tenantSettingsSchema, themeInsertSchema, themeSchema, tokenResponseSchema, tokenizeLuceneQuery, totalsSchema, uiScreenSchema, unescapeLuceneValue, unquoteLuceneValue, userActivitySchema, userInsertSchema, userOrganizationInsertSchema, userOrganizationSchema, userPermissionInsertSchema, userPermissionListSchema, userPermissionSchema, userPermissionWithDetailsListSchema, userPermissionWithDetailsSchema, userResponseSchema, userRoleInsertSchema, userRoleListSchema, userRoleSchema, userSchema, usernameHasOnlyAllowedCharacters, validateUsername, verificationMethodsSchema, weekIndex, weekStartMs, widgetComponentSchema, widgetSchema };
-export type { Action, ActionExecution, ActionExecutionError, ActionExecutionInsert, ActionExecutionLogEntry, ActionExecutionLogs, ActionExecutionResult, ActionExecutionStatus, ActionExecutionsAdapter, ActionInsert, ActionNode, ActionResponse, ActionUpdate, ActionVersion, ActionVersionInsert, ActionVersionsAdapter, ActionsAdapter, ActiveUsersResponse, Actor, Address, AnalyticsAdapter, AnalyticsColumnMeta, AnalyticsFilters, AnalyticsGroupBy, AnalyticsInterval, AnalyticsQueryParams, AnalyticsQueryResponse, AnalyticsResource, AnalyticsUserType, AttackProtection, AuditCategory, AuditEvent, AuditEventInsert, Auth0Flow, Auth0FlowInsert, Auth0UpdateUserAction, AuthParams, AuthenticationMethod, AuthenticationMethodInsert, AuthenticationMethodType, AuthenticationMethodUpdate, AuthenticationMethodsAdapter, BaseUser, BlockComponent, BooleanField, Branding, BrandingAdapter, BreachedPasswordDetection, BruteForceProtection, ButtonComponent, CacheAdapter, CacheItem, CardsField, ChoiceField, ClaimsRequest, Client, ClientConnectionsAdapter, ClientGrant, ClientGrantInsert, ClientGrantList, ClientGrantsAdapter, ClientInsert, ClientRegistrationToken, ClientRegistrationTokenInsert, ClientRegistrationTokenType, ClientRegistrationTokensAdapter, ClientWithTenantId, ClientsAdapter, Code, CodeExecutionLog, CodeExecutionResult, CodeExecutor, CodeField, CodeInsert, CodeResponse, CodeType, CodesAdapter, Component, ComponentMessage, Connection, ConnectionInsert, ConnectionsAdapter, ContinuationScope, Coordinates, CountryField, CreateOptions, CreateServiceTokenFn, CreateServiceTokenParams, CreateTenantParams, CursorPayload, CustomDomain, CustomDomainCertificateUpload, CustomDomainInsert, CustomDomainUpdate, CustomDomainWithTenantId, CustomDomainsAdapter, CustomField, CustomText, CustomTextAdapter, CustomTextEntry, DailyStats, DataAdapters, DateField, DividerComponent, DropdownField, EmailField, EmailProvider, EmailProvidersAdapter, EmailServiceAdapter, EmailServiceSendParams, EmailTemplate, EmailTemplateName, EmailTemplatesAdapter, EmailVerificationRules, EmailVerifyAction, Ending, FieldComponent, FileField, Flow, FlowActionStep, FlowActionType, FlowInsert, FlowNode, FlowsAdapter, FieldComponent$1 as FlowsFieldComponent, FlowNode$1 as FlowsFlowNode, StepNode$1 as FlowsStepNode, Form, FormControl, FormInsert, FormNode, FormNodeComponent, FormsAdapter, GenericComponent, GenericNode, GeoAdapter, GeoInfo, GmapsAddressWidget, Grant, GrantInsert, GrantsAdapter, HandlerConfig, Hook, HookCode, HookCodeAdapter, HookCodeInsert, HookInsert, HookPageId, HookTemplateId, HooksAdapter, HtmlComponent, Identity, ImageComponent, ImportMetadata, Invite, InviteInsert, Invitee, Inviter, InvitesAdapter, JumpButtonComponent, Jwk, Jwks, KeysAdapter, LegalComponent, LegalField, LinkCandidate, ListActionVersionsResponse, ListActionsResponse, ListClientGrantsResponse, ListCodesResponse, ListConnectionsResponse, ListFailedEventsResponse, ListFlowsResponse, ListFormsResponse, ListGrantsResponse, ListHooksResponse, ListInvitesResponse, ListKeysResponse, ListOrganizationsResponse, ListParams, ListProxyRoutesParams, ListProxyRoutesResult, ListRefreshTokenResponse, ListResourceServersResponse, ListRoleUsersResponse, ListRolesResponse, ListRolloutsResult, ListSesssionsResponse, ListTenantOperationEventsResult, ListTenantOperationRowsParams, ListTenantOperationRowsResult, ListTenantOperationsParams, ListTenantOperationsResult, ListUserRolesResponse, ListUsersResponse, Log, LogCategory, LogInsert, LogStream, LogStreamInsert, LogStreamsAdapter, LogType, LoginSession, LoginSessionAuthStrategy, LoginSessionInsert, LoginSessionsAdapter, LogsDataAdapter, MigrationProviderType, MigrationSource, MigrationSourceCredentials, MigrationSourceInsert, MigrationSourcesAdapter, NextButtonComponent, Node, NumberField, Organization, OrganizationConnection, OrganizationConnectionInsert, OrganizationConnectionList, OrganizationConnectionsAdapter, OrganizationInsert, OrganizationsAdapter, OutboxAdapter, OutboxEvent, OutboxEventInsert, PassthroughConfig, Password, PasswordField, PasswordInsert, PasswordsAdapter, PaymentField, PostUsersBody, PreviousButtonComponent, PromptScreen, PromptSetting, PromptSettingsAdapter, ProxyRoute, ProxyRouteInsert, ProxyRouteUpdate, ProxyRoutesAdapter, RateLimitAdapter, RateLimitDecision, RateLimitScope, RecaptchaWidget, RedirectAction, RedirectTarget, RefreshToken, RefreshTokenInsert, RefreshTokenListParams, RefreshTokenRetentionCohort, RefreshTokenRetentionParams, RefreshTokenRetentionResponse, RefreshTokenUpdate, RefreshTokensAdapter, RequestContext, ResendButtonComponent, ResourceServer, ResourceServerInsert, ResourceServerList, ResourceServerOptions, ResourceServerScope, ResourceServersAdapter, ResponseContext, RichTextComponent, Role, RoleInsert, RoleList, RolePermission, RolePermissionInsert, RolePermissionList, RolePermissionsAdapter, RolesAdapter, Rollout, RolloutInsert, RolloutKind, RolloutStatus, RolloutUpdate, RolloutsAdapter, RouteMatch, RouterNode, RuntimeComponent, ScimConfiguration, ScimConfigurationInsert, ScimConfigurationsAdapter, ScimExternalId, ScimExternalIdInsert, ScimExternalIdsAdapter, ScimMappingEntry, ScimToken, ScimTokenInsert, ScimTokensAdapter, ScreenLink, SecondaryAdapterConfig, Session, SessionCleanupParams, SessionInsert, SessionRetentionCohort, SessionRetentionParams, SessionRetentionRawRow, SessionRetentionResponse, SessionRetentionWindow, SessionsAdapter, SigningKey, SmsProvider, SmsSendParams, SmsServiceAdapter, SmsServiceSendParams, SocialField, Start, StatsAdapter, StatsListParams, StepNode, SuspiciousIpThrottling, Target, TelField, Tenant, TenantOperation, TenantOperationEngine, TenantOperationEvent, TenantOperationEventInsert, TenantOperationEventOutcome, TenantOperationEventsAdapter, TenantOperationInsert, TenantOperationKind, TenantOperationRow, TenantOperationRowCounts, TenantOperationRowInsert, TenantOperationRowOutcome, TenantOperationRowStatus, TenantOperationRowsAdapter, TenantOperationStatus, TenantOperationUpdate, TenantOperationsAdapter, TenantSettings, TenantSettingsAdapter, TenantsDataAdapter, TextField, Theme, ThemeInsert, ThemesAdapter, TokenResponse, Totals, UiScreen, UniversalLoginTemplate, UniversalLoginTemplatesAdapter, UpdateRefreshTokenOptions, UrlField, User, UserActivity, UserActivityAdapter, UserActivityUpdate, UserDataAdapter, UserInsert, UserOrganization, UserOrganizationInsert, UserOrganizationsAdapter, UserPermission, UserPermissionInsert, UserPermissionList, UserPermissionWithDetails, UserPermissionWithDetailsList, UserPermissionsAdapter, UserResponse, UserRole, UserRoleInsert, UserRoleList, UserRolesAdapter, UsernameLengthBounds, VerifiableCredentialsWidget, VerificationMethods, WidgetComponent, WriteOptions };
+export { Auth0ActionEnum, Auth0Client, AuthorizationResponseMode, AuthorizationResponseType, CodeChallengeMethod, ComponentCategory, ComponentType, DATABASE_CONNECTION_STRATEGY, EmailActionEnum, FORM_FIELD_TYPES, FeatureNotSupportedError, FlowActionTypeEnum, GrantType, KNOWN_TENANT_OPERATION_ENGINES, LocationInfo, LogTypes, LoginSessionState, MONDAY_EPOCH_SHIFT_MS, NodeType, PRESERVE_LOCATION_HEADER, RESERVED_SUBJECT_TOKEN_TYPE_PREFIXES, RedirectTargetEnum, Strategy, StrategyType, TERMINAL_TENANT_OPERATION_ROW_STATUSES, TOKEN_EXCHANGE_PROFILE_TYPE, TRIGGER_API_SHAPES, TRIGGER_FUNCTION_NAMES, USERNAME_CONTAINS_AT_MESSAGE, USERNAME_INVALID_CHARACTERS_MESSAGE, WEEK_MS, actionDependencySchema, actionExecutionErrorSchema, actionExecutionInsertSchema, actionExecutionLogEntrySchema, actionExecutionLogsSchema, actionExecutionResultSchema, actionExecutionSchema, actionExecutionStatusSchema, actionExecutionTriggerIdSchema, actionInsertSchema, actionNodeSchema, actionResponseSchema, actionSchema, actionSecretNameSchema, actionSecretSchema, actionTriggerSchema, actionUpdateSchema, actionVersionInsertSchema, actionVersionSchema, activeUsersResponseSchema, actorSchema, addressSchema, allowedTriggersForHook, analyticsColumnMetaSchema, analyticsGroupBySchema, analyticsIntervalSchema, analyticsQueryResponseSchema, analyticsResourceSchema, analyticsStatisticsSchema, analyticsUserTypeSchema, attackProtectionSchema, auditCategorySchema, auditEventInsertSchema, auditEventSchema, auth0ClientSchema, auth0FlowInsertSchema, auth0FlowSchema, auth0QuerySchema, auth0UpdateUserActionSchema, auth0UserResponseSchema, authParamsSchema, authenticationMethodInsertSchema, authenticationMethodSchema, authenticationMethodTypeSchema, baseUserSchema, blockComponentSchema, bordersSchema, brandingSchema, breachedPasswordDetectionSchema, bruteForceProtectionSchema, buildRefreshTokenRetention, buildSessionRetention, buttonComponentSchema, claimsRequestSchema, clientGrantInsertSchema, clientGrantListSchema, clientGrantSchema, clientInsertSchema, clientRegistrationTokenInsertSchema, clientRegistrationTokenSchema, clientRegistrationTokenTypeSchema, clientSchema, codeInsertSchema, codeSchema, codeTypeSchema, colorsSchema, componentMessageSchema, componentSchema, connectionInsertSchema, connectionOptionsSchema, connectionSchema, coordinatesSchema, createPassthroughAdapter, createWriteOnlyAdapter, customDomainCertificateUploadSchema, customDomainInsertSchema, customDomainSchema, customDomainUpdateSchema, customDomainWithTenantIdSchema, customTextEntrySchema, customTextSchema, dailyStatsSchema, decodeBase32, decodeBase64, decodeBase64Url, decodeBase64UrlString, decodeCursor, emailProviderSchema, emailTemplateNameSchema, emailTemplateSchema, emailVerificationRulesSchema, emailVerifyActionSchema, encodeBase32, encodeBase64, encodeBase64Url, encodeBase64UrlString, encodeCursor, encodeHex, endingSchema, escapeLuceneValue, fieldComponentSchema, flowActionStepSchema, flowInsertSchema, flowSchema, fieldComponentSchema$1 as flowsFieldComponentSchema, flowNodeSchema$1 as flowsFlowNodeSchema, stepNodeSchema$1 as flowsStepNodeSchema, fontDetailsSchema, fontsSchema, formControlSchema, formInsertSchema, formNodeComponentDefinition, formNodeSchema, formSchema, genericComponentSchema, genericNodeSchema, getConnectionIdentifierConfig, getLogTypeCategory, getLogTypeDescription, grantInsertSchema, grantSchema, handlerConfigSchema, hookCodeInsertSchema, hookCodeSchema, hookInsertSchema, hookPageId, hookSchema, hookTemplateId, hookTemplates, identitySchema, importMetadataSchema, inviteInsertSchema, inviteSchema, inviteeSchema, inviterSchema, isBlockComponent, isDatabaseConnectionStrategy, isEmailSearchTerm, isFeatureNotSupportedError, isFieldComponent, isPlainObject, isWidgetComponent, jwksKeySchema, jwksSchema, legalComponentSchema, locationInfoSchema, logInsertSchema, logSchema, logStreamFilterSchema, logStreamInsertSchema, logStreamSchema, logStreamStatusSchema, logStreamTypeSchema, logTypeCategories, logTypeDescriptions, loginSessionAuthStrategySchema, loginSessionInsertSchema, loginSessionSchema, loginSessionStateSchema, matchSchema, migrationProviderTypeSchema, migrationSourceCredentialsSchema, migrationSourceInsertSchema, migrationSourceSchema, nodeSchema, normalizeUsername, openIDConfigurationSchema, organizationBrandingSchema, organizationConnectionInsertSchema, organizationConnectionListSchema, organizationConnectionSchema, organizationEnabledConnectionSchema, organizationInsertSchema, organizationSchema, organizationTokenQuotaSchema, pageBackgroundSchema, parseUserId, passwordInsertSchema, passwordSchema, profileDataSchema, promptScreenSchema, promptSettingSchema, proxyRouteInsertSchema, proxyRouteSchema, proxyRouteUpdateSchema, redirectActionSchema, refreshTokenInsertSchema, refreshTokenRetentionCohortSchema, refreshTokenRetentionResponseSchema, refreshTokenSchema, requestContextSchema, resourceServerInsertSchema, resourceServerListSchema, resourceServerOptionsSchema, resourceServerSchema, resourceServerScopeSchema, responseContextSchema, richTextComponentSchema, roleInsertSchema, roleListSchema, rolePermissionInsertSchema, rolePermissionListSchema, rolePermissionSchema, roleSchema, rolloutInsertSchema, rolloutKindSchema, rolloutSchema, rolloutStatusSchema, rolloutUpdateSchema, sanitizeLuceneQuery, scimConfigurationInsertSchema, scimConfigurationSchema, scimExternalIdInsertSchema, scimExternalIdSchema, scimMappingEntrySchema, scimTokenInsertSchema, scimTokenSchema, screenLinkSchema, sessionInsertSchema, sessionRetentionCohortSchema, sessionRetentionResponseSchema, sessionRetentionWindow, sessionSchema, signingKeySchema, smsProviderSchema, smsSendParamsSchema, splitLuceneOrGroups, startSchema, subjectTokenTypeSchema, suspiciousIpThrottlingSchema, targetSchema, tenantInsertSchema, tenantOperationEngineSchema, tenantOperationEventInsertSchema, tenantOperationEventOutcomeSchema, tenantOperationEventSchema, tenantOperationInsertSchema, tenantOperationKindSchema, tenantOperationRowInsertSchema, tenantOperationRowOutcomeSchema, tenantOperationRowSchema, tenantOperationRowStatusSchema, tenantOperationSchema, tenantOperationStatusSchema, tenantOperationUpdateSchema, tenantSchema, tenantSettingsSchema, themeInsertSchema, themeSchema, tokenExchangeJwtAlgorithmSchema, tokenExchangeJwtVerificationSchema, tokenExchangeProfileInsertSchema, tokenExchangeProfileSchema, tokenExchangeProfileUpdateSchema, tokenExchangeUserMappingSchema, tokenResponseSchema, tokenizeLuceneQuery, totalsSchema, uiScreenSchema, unescapeLuceneValue, unquoteLuceneValue, userActivitySchema, userInsertSchema, userOrganizationInsertSchema, userOrganizationSchema, userPermissionInsertSchema, userPermissionListSchema, userPermissionSchema, userPermissionWithDetailsListSchema, userPermissionWithDetailsSchema, userResponseSchema, userRoleInsertSchema, userRoleListSchema, userRoleSchema, userSchema, usernameHasOnlyAllowedCharacters, validateUsername, verificationMethodsSchema, weekIndex, weekStartMs, widgetComponentSchema, widgetSchema };
+export type { Action, ActionExecution, ActionExecutionError, ActionExecutionInsert, ActionExecutionLogEntry, ActionExecutionLogs, ActionExecutionResult, ActionExecutionStatus, ActionExecutionsAdapter, ActionInsert, ActionNode, ActionResponse, ActionUpdate, ActionVersion, ActionVersionInsert, ActionVersionsAdapter, ActionsAdapter, ActiveUsersResponse, Actor, Address, AnalyticsAdapter, AnalyticsColumnMeta, AnalyticsFilters, AnalyticsGroupBy, AnalyticsInterval, AnalyticsQueryParams, AnalyticsQueryResponse, AnalyticsResource, AnalyticsUserType, AttackProtection, AuditCategory, AuditEvent, AuditEventInsert, Auth0Flow, Auth0FlowInsert, Auth0UpdateUserAction, AuthParams, AuthenticationMethod, AuthenticationMethodInsert, AuthenticationMethodType, AuthenticationMethodUpdate, AuthenticationMethodsAdapter, BaseUser, BlockComponent, BooleanField, Branding, BrandingAdapter, BreachedPasswordDetection, BruteForceProtection, ButtonComponent, CacheAdapter, CacheItem, CardsField, ChoiceField, ClaimsRequest, Client, ClientConnectionsAdapter, ClientGrant, ClientGrantInsert, ClientGrantList, ClientGrantsAdapter, ClientInsert, ClientRegistrationToken, ClientRegistrationTokenInsert, ClientRegistrationTokenType, ClientRegistrationTokensAdapter, ClientWithTenantId, ClientsAdapter, Code, CodeExecutionLog, CodeExecutionResult, CodeExecutor, CodeField, CodeInsert, CodeResponse, CodeType, CodesAdapter, Component, ComponentMessage, Connection, ConnectionInsert, ConnectionsAdapter, ContinuationScope, Coordinates, CountryField, CreateOptions, CreateServiceTokenFn, CreateServiceTokenParams, CreateTenantParams, CursorPayload, CustomDomain, CustomDomainCertificateUpload, CustomDomainInsert, CustomDomainUpdate, CustomDomainWithTenantId, CustomDomainsAdapter, CustomField, CustomText, CustomTextAdapter, CustomTextEntry, DailyStats, DataAdapters, DateField, DividerComponent, DropdownField, EmailField, EmailProvider, EmailProvidersAdapter, EmailServiceAdapter, EmailServiceSendParams, EmailTemplate, EmailTemplateName, EmailTemplatesAdapter, EmailVerificationRules, EmailVerifyAction, Ending, FieldComponent, FileField, Flow, FlowActionStep, FlowActionType, FlowInsert, FlowNode, FlowsAdapter, FieldComponent$1 as FlowsFieldComponent, FlowNode$1 as FlowsFlowNode, StepNode$1 as FlowsStepNode, Form, FormControl, FormInsert, FormNode, FormNodeComponent, FormsAdapter, GenericComponent, GenericNode, GeoAdapter, GeoInfo, GmapsAddressWidget, Grant, GrantInsert, GrantsAdapter, HandlerConfig, Hook, HookCode, HookCodeAdapter, HookCodeInsert, HookInsert, HookPageId, HookTemplateId, HooksAdapter, HtmlComponent, Identity, ImageComponent, ImportMetadata, Invite, InviteInsert, Invitee, Inviter, InvitesAdapter, JumpButtonComponent, Jwk, Jwks, KeysAdapter, LegalComponent, LegalField, LinkCandidate, ListActionVersionsResponse, ListActionsResponse, ListClientGrantsResponse, ListCodesResponse, ListConnectionsResponse, ListFailedEventsResponse, ListFlowsResponse, ListFormsResponse, ListGrantsResponse, ListHooksResponse, ListInvitesResponse, ListKeysResponse, ListOrganizationsResponse, ListParams, ListProxyRoutesParams, ListProxyRoutesResult, ListRefreshTokenResponse, ListResourceServersResponse, ListRoleUsersResponse, ListRolesResponse, ListRolloutsResult, ListSesssionsResponse, ListTenantOperationEventsResult, ListTenantOperationRowsParams, ListTenantOperationRowsResult, ListTenantOperationsParams, ListTenantOperationsResult, ListUserRolesResponse, ListUsersResponse, Log, LogCategory, LogInsert, LogStream, LogStreamInsert, LogStreamsAdapter, LogType, LoginSession, LoginSessionAuthStrategy, LoginSessionInsert, LoginSessionsAdapter, LogsDataAdapter, MigrationProviderType, MigrationSource, MigrationSourceCredentials, MigrationSourceInsert, MigrationSourcesAdapter, NextButtonComponent, Node, NumberField, Organization, OrganizationConnection, OrganizationConnectionInsert, OrganizationConnectionList, OrganizationConnectionsAdapter, OrganizationInsert, OrganizationsAdapter, OutboxAdapter, OutboxEvent, OutboxEventInsert, PassthroughConfig, Password, PasswordField, PasswordInsert, PasswordsAdapter, PaymentField, PostUsersBody, PreviousButtonComponent, PromptScreen, PromptSetting, PromptSettingsAdapter, ProxyRoute, ProxyRouteInsert, ProxyRouteUpdate, ProxyRoutesAdapter, RateLimitAdapter, RateLimitDecision, RateLimitScope, RecaptchaWidget, RedirectAction, RedirectTarget, RefreshToken, RefreshTokenInsert, RefreshTokenListParams, RefreshTokenRetentionCohort, RefreshTokenRetentionParams, RefreshTokenRetentionResponse, RefreshTokenUpdate, RefreshTokensAdapter, RequestContext, ResendButtonComponent, ResourceServer, ResourceServerInsert, ResourceServerList, ResourceServerOptions, ResourceServerScope, ResourceServersAdapter, ResponseContext, RichTextComponent, Role, RoleInsert, RoleList, RolePermission, RolePermissionInsert, RolePermissionList, RolePermissionsAdapter, RolesAdapter, Rollout, RolloutInsert, RolloutKind, RolloutStatus, RolloutUpdate, RolloutsAdapter, RouteMatch, RouterNode, RuntimeComponent, ScimConfiguration, ScimConfigurationInsert, ScimConfigurationsAdapter, ScimExternalId, ScimExternalIdInsert, ScimExternalIdsAdapter, ScimMappingEntry, ScimToken, ScimTokenInsert, ScimTokensAdapter, ScreenLink, SecondaryAdapterConfig, Session, SessionCleanupParams, SessionInsert, SessionRetentionCohort, SessionRetentionParams, SessionRetentionRawRow, SessionRetentionResponse, SessionRetentionWindow, SessionsAdapter, SigningKey, SmsProvider, SmsSendParams, SmsServiceAdapter, SmsServiceSendParams, SocialField, Start, StatsAdapter, StatsListParams, StepNode, SuspiciousIpThrottling, Target, TelField, Tenant, TenantOperation, TenantOperationEngine, TenantOperationEvent, TenantOperationEventInsert, TenantOperationEventOutcome, TenantOperationEventsAdapter, TenantOperationInsert, TenantOperationKind, TenantOperationRow, TenantOperationRowCounts, TenantOperationRowInsert, TenantOperationRowOutcome, TenantOperationRowStatus, TenantOperationRowsAdapter, TenantOperationStatus, TenantOperationUpdate, TenantOperationsAdapter, TenantSettings, TenantSettingsAdapter, TenantsDataAdapter, TextField, Theme, ThemeInsert, ThemesAdapter, TokenExchangeJwtAlgorithm, TokenExchangeJwtVerification, TokenExchangeProfile, TokenExchangeProfileInsert, TokenExchangeProfileUpdate, TokenExchangeProfilesAdapter, TokenExchangeUserMapping, TokenResponse, Totals, UiScreen, UniversalLoginTemplate, UniversalLoginTemplatesAdapter, UpdateRefreshTokenOptions, UrlField, User, UserActivity, UserActivityAdapter, UserActivityUpdate, UserDataAdapter, UserInsert, UserOrganization, UserOrganizationInsert, UserOrganizationsAdapter, UserPermission, UserPermissionInsert, UserPermissionList, UserPermissionWithDetails, UserPermissionWithDetailsList, UserPermissionsAdapter, UserResponse, UserRole, UserRoleInsert, UserRoleList, UserRolesAdapter, UsernameLengthBounds, VerifiableCredentialsWidget, VerificationMethods, WidgetComponent, WriteOptions };