@authhero/drizzle 0.43.2 → 0.43.4

package/dist/drizzle-adapter.mjs

@@ -230,8 +230,8 @@ function Pr(n) {
     e.sql += i.sql, e.params.push(...i.params), (t = i.typings) != null && t.length && (e.typings || (e.typings = []), e.typings.push(...i.typings));
   return e;
 }
-var Gi;
-Gi = L;
+var Ji;
+Ji = L;
 class ve {
   constructor(e) {
     y(this, "value");
@@ -241,9 +241,9 @@ class ve {
     return new de([this]);
   }
 }
-y(ve, Gi, "StringChunk");
-var Ji;
-Ji = L;
+y(ve, Ji, "StringChunk");
+var Gi;
+Gi = L;
 const pt = class pt {
   constructor(e) {
     /** @internal */
@@ -385,7 +385,7 @@ const pt = class pt {
     return e ? this : void 0;
   }
 };
-y(pt, Ji, "SQL");
+y(pt, Gi, "SQL");
 let de = pt;
 var Wi;
 Wi = L;
@@ -532,7 +532,7 @@ fe.prototype.getSQL = function() {
 ui.prototype.getSQL = function() {
   return new de([this]);
 };
-function Gt(n, e) {
+function Jt(n, e) {
   return {
     name: typeof n == "string" && n.length > 0 ? n : "",
     config: typeof n == "object" ? n : e
@@ -770,7 +770,7 @@ class Ro extends (wa = Fe, va = L, wa) {
 }
 y(Ro, va, "SQLiteBlobBuffer");
 function Vr(n, e) {
-  const { name: t, config: i } = Gt(n, e);
+  const { name: t, config: i } = Jt(n, e);
   return (i == null ? void 0 : i.mode) === "json" ? new Co(t) : (i == null ? void 0 : i.mode) === "bigint" ? new Ao(t) : new Lo(t);
 }
 var Na, Sa;
@@ -809,7 +809,7 @@ class zo extends (Ea = Fe, ba = L, Ea) {
 y(zo, ba, "SQLiteCustomColumn");
 function Zr(n) {
   return (e, t) => {
-    const { name: i, config: a } = Gt(e, t);
+    const { name: i, config: a } = Jt(e, t);
     return new Uo(
       i,
       a,
@@ -919,7 +919,7 @@ class $o extends (qa = hn, Ma = L, qa) {
 }
 y($o, Ma, "SQLiteBoolean");
 function w(n, e) {
-  const { name: t, config: i } = Gt(n, e);
+  const { name: t, config: i } = Jt(n, e);
   return (i == null ? void 0 : i.mode) === "timestamp" || (i == null ? void 0 : i.mode) === "timestamp_ms" ? new Mo(t, i.mode) : (i == null ? void 0 : i.mode) === "boolean" ? new Bo(t, i.mode) : new Fo(t);
 }
 var Ba, $a;
@@ -974,8 +974,8 @@ class Ho extends (Qa = Fe, Ka = L, Qa) {
   }
 }
 y(Ho, Ka, "SQLiteNumericNumber");
-var Ga, Ja;
-class Ko extends (Ja = ze, Ga = L, Ja) {
+var Ja, Ga;
+class Ko extends (Ga = ze, Ja = L, Ga) {
   constructor(e) {
     super(e, "bigint", "SQLiteNumericBigInt");
   }
@@ -987,7 +987,7 @@ class Ko extends (Ja = ze, Ga = L, Ja) {
     );
   }
 }
-y(Ko, Ga, "SQLiteNumericBigIntBuilder");
+y(Ko, Ja, "SQLiteNumericBigIntBuilder");
 var Wa, Xa;
 class Qo extends (Xa = Fe, Wa = L, Xa) {
   constructor() {
@@ -1001,29 +1001,29 @@ class Qo extends (Xa = Fe, Wa = L, Xa) {
 }
 y(Qo, Wa, "SQLiteNumericBigInt");
 function Hr(n, e) {
-  const { name: t, config: i } = Gt(n, e), a = i == null ? void 0 : i.mode;
+  const { name: t, config: i } = Jt(n, e), a = i == null ? void 0 : i.mode;
   return a === "number" ? new Zo(t) : a === "bigint" ? new Ko(t) : new jo(t);
 }
 var Ya, eo;
-class Go extends (eo = ze, Ya = L, eo) {
+class Jo extends (eo = ze, Ya = L, eo) {
   constructor(e) {
     super(e, "number", "SQLiteReal");
   }
   /** @internal */
   build(e) {
-    return new Jo(e, this.config);
+    return new Go(e, this.config);
   }
 }
-y(Go, Ya, "SQLiteRealBuilder");
+y(Jo, Ya, "SQLiteRealBuilder");
 var to, no;
-class Jo extends (no = Fe, to = L, no) {
+class Go extends (no = Fe, to = L, no) {
   getSQLType() {
     return "real";
   }
 }
-y(Jo, to, "SQLiteReal");
+y(Go, to, "SQLiteReal");
 function Kr(n) {
-  return new Go(n ?? "");
+  return new Jo(n ?? "");
 }
 var io, ao;
 class Wo extends (ao = ze, io = L, ao) {
@@ -1079,7 +1079,7 @@ class er extends (_o = Fe, co = L, _o) {
 }
 y(er, co, "SQLiteTextJson");
 function s(n, e = {}) {
-  const { name: t, config: i } = Gt(n, e);
+  const { name: t, config: i } = Jt(n, e);
   return i.mode === "json" ? new Yo(t) : new Wo(t, i);
 }
 function Qr() {
@@ -1092,9 +1092,9 @@ function Qr() {
     text: s
   };
 }
-const Gn = Symbol.for("drizzle:SQLiteInlineForeignKeys");
+const Jn = Symbol.for("drizzle:SQLiteInlineForeignKeys");
 var uo, po, fo, ho, go;
-class Rt extends (go = fe, ho = L, fo = fe.Symbol.Columns, po = Gn, uo = fe.Symbol.ExtraConfigBuilder, go) {
+class Rt extends (go = fe, ho = L, fo = fe.Symbol.Columns, po = Jn, uo = fe.Symbol.ExtraConfigBuilder, go) {
   constructor() {
     super(...arguments);
     /** @internal */
@@ -1107,20 +1107,20 @@ class Rt extends (go = fe, ho = L, fo = fe.Symbol.Columns, po = Gn, uo = fe.Symb
 }
 y(Rt, ho, "SQLiteTable"), /** @internal */
 y(Rt, "Symbol", Object.assign({}, fe.Symbol, {
-  InlineForeignKeys: Gn
+  InlineForeignKeys: Jn
 }));
-function Gr(n, e, t, i, a = n) {
+function Jr(n, e, t, i, a = n) {
   const r = new Rt(n, i, a), l = typeof e == "function" ? e(Qr()) : e, d = Object.fromEntries(
     Object.entries(l).map(([f, p]) => {
       const v = p;
       v.setName(f);
       const m = v.build(r);
-      return r[Gn].push(...v.buildForeignKeys(m, r)), [f, m];
+      return r[Jn].push(...v.buildForeignKeys(m, r)), [f, m];
     })
   ), u = Object.assign(r, d);
   return u[fe.Symbol.Columns] = d, u[fe.Symbol.ExtraConfigColumns] = d, t && (u[Rt.Symbol.ExtraConfigBuilder] = t), u;
 }
-const $ = (n, e, t) => Gr(n, e, t);
+const $ = (n, e, t) => Jr(n, e, t);
 var mo;
 mo = L;
 class fi {
@@ -1173,11 +1173,11 @@ function ht(n) {
   return new fi(n, !0);
 }
 function Te(...n) {
-  return n[0].columns ? new Jn(n[0].columns, n[0].name) : new Jn(n);
+  return n[0].columns ? new Gn(n[0].columns, n[0].name) : new Gn(n);
 }
 var wo;
 wo = L;
-class Jn {
+class Gn {
   constructor(e, t) {
     /** @internal */
     y(this, "columns");
@@ -1190,7 +1190,7 @@ class Jn {
     return new ir(e, this.columns, this.name);
   }
 }
-y(Jn, wo, "SQLitePrimaryKeyBuilder");
+y(Gn, wo, "SQLitePrimaryKeyBuilder");
 var No;
 No = L;
 class ir {
@@ -1391,7 +1391,7 @@ const B = $("tenants", {
     D("idx_refresh_tokens_login_id").on(n.login_id),
     D("idx_refresh_tokens_expires_at_ts").on(n.expires_at_ts)
   ]
-), J = $(
+), G = $(
   "login_sessions",
   {
     id: s("id", { length: 21 }).notNull(),
@@ -1460,7 +1460,7 @@ const B = $("tenants", {
     }),
     D("codes_expires_at_index").on(n.expires_at)
   ]
-), Jr = $("authentication_codes", {
+), Gr = $("authentication_codes", {
   tenant_id: s("tenant_id", { length: 191 }).notNull().references(() => B.id, { onDelete: "cascade" }),
   code: s("code", { length: 255 }).primaryKey(),
   client_id: s("client_id", { length: 255 }).notNull(),
@@ -1580,7 +1580,8 @@ const B = $("tenants", {
     connections: s("connections").notNull().default("[]"),
     owner_user_id: s("owner_user_id", { length: 255 }),
     registration_type: s("registration_type", { length: 32 }),
-    registration_metadata: s("registration_metadata")
+    registration_metadata: s("registration_metadata"),
+    user_linking_mode: s("user_linking_mode", { length: 16 })
   },
   (n) => [
     Te({
@@ -1589,7 +1590,7 @@ const B = $("tenants", {
     }),
     D("idx_clients_owner_user_id").on(n.tenant_id, n.owner_user_id)
   ]
-), G = $(
+), J = $(
   "client_registration_tokens",
   {
     id: s("id", { length: 255 }).primaryKey(),
@@ -1893,7 +1894,7 @@ const B = $("tenants", {
   }),
   colors_page_background_end: s("colors_page_background_end", { length: 8 }),
   colors_page_background_angle_dev: w("colors_page_background_angle_dev")
-}), nt = $(
+}), it = $(
   "universal_login_templates",
   {
     tenant_id: s("tenant_id", { length: 191 }).primaryKey().references(() => B.id, { onDelete: "cascade" }),
@@ -2067,7 +2068,7 @@ const B = $("tenants", {
   webauthn_platform_first_factor: w("webauthn_platform_first_factor", {
     mode: "boolean"
   }).notNull().default(!1)
-}), it = $("email_providers", {
+}), at = $("email_providers", {
   tenant_id: s("tenant_id", { length: 191 }).primaryKey(),
   name: s("name", { length: 255 }).notNull(),
   enabled: w("enabled", { mode: "boolean" }).notNull(),
@@ -2093,8 +2094,10 @@ const B = $("tenants", {
     // only required for form type hooks
     template_id: s("template_id", { length: 64 }),
     // only required for template type hooks
-    code_id: s("code_id", { length: 21 })
+    code_id: s("code_id", { length: 21 }),
     // only required for code type hooks
+    metadata: s("metadata")
+    // JSON property bag (inheritable flag, template options)
   },
   (n) => [D("hooks_tenant_id_idx").on(n.tenant_id)]
 ), qe = $(
@@ -2242,27 +2245,27 @@ const B = $("tenants", {
       n.dead_lettered_at
     )
   ]
-), f_ = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+), h_ = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
   __proto__: null,
-  authenticationCodes: Jr,
+  authenticationCodes: Gr,
   authenticationMethods: ue,
   branding: At,
   clientGrants: me,
-  clientRegistrationTokens: G,
+  clientRegistrationTokens: J,
   clients: Z,
   codes: re,
   connections: pe,
   customDomains: Oe,
   customText: Ne,
   domains: Yr,
-  emailProviders: it,
+  emailProviders: at,
   flows: xe,
   forms: Ee,
   hookCode: qe,
   hooks: we,
   invites: be,
   keys: Be,
-  loginSessions: J,
+  loginSessions: G,
   logs: Q,
   organizations: W,
   otps: Wr,
@@ -2277,7 +2280,7 @@ const B = $("tenants", {
   tenants: B,
   themes: Me,
   tickets: Xr,
-  universalLoginTemplates: nt,
+  universalLoginTemplates: it,
   userOrganizations: se,
   userPermissions: Le,
   userRoles: Re,
@@ -2930,10 +2933,10 @@ function fs(n) {
     var l, d, u, f, p, v;
     const m = typeof a == "string" ? r : a, S = m ?? {}, { param: T } = S, ee = us(S, ["param"]), ie = Object.assign(Object.assign({}, (l = this._def.openapi) === null || l === void 0 ? void 0 : l._internal), typeof a == "string" ? { refId: a } : void 0), ae = Object.assign(Object.assign(Object.assign({}, (d = this._def.openapi) === null || d === void 0 ? void 0 : d.metadata), ee), !((f = (u = this._def.openapi) === null || u === void 0 ? void 0 : u.metadata) === null || f === void 0) && f.param || T ? {
       param: Object.assign(Object.assign({}, (v = (p = this._def.openapi) === null || p === void 0 ? void 0 : p.metadata) === null || v === void 0 ? void 0 : v.param), T)
-    } : void 0), Ge = new this.constructor(Object.assign(Object.assign({}, this._def), { openapi: Object.assign(Object.assign({}, Object.keys(ie).length > 0 ? { _internal: ie } : void 0), Object.keys(ae).length > 0 ? { metadata: ae } : void 0) }));
+    } : void 0), Je = new this.constructor(Object.assign(Object.assign({}, this._def), { openapi: Object.assign(Object.assign({}, Object.keys(ie).length > 0 ? { _internal: ie } : void 0), Object.keys(ae).length > 0 ? { metadata: ae } : void 0) }));
     if (ps(this, "ZodObject")) {
       const ut = this.extend;
-      Ge.extend = function(...vn) {
+      Je.extend = function(...vn) {
         var wn, Nn, Sn, bn, En, xn, kn;
         const On = ut.apply(this, vn);
         return On._def.openapi = {
@@ -2944,7 +2947,7 @@ function fs(n) {
         }, On;
       };
     }
-    return Ge;
+    return Je;
   }, Tt(n, "optional"), Tt(n, "nullable"), Tt(n, "default"), Tt(n, "transform"), Tt(n, "refine");
   const e = n.ZodObject.prototype.deepPartial;
   n.ZodObject.prototype.deepPartial = function() {
@@ -3011,7 +3014,7 @@ var Xn;
     // second overwrites first
   });
 })(Xn || (Xn = {}));
-const x = H.arrayToEnum([
+const k = H.arrayToEnum([
   "string",
   "nan",
   "number",
@@ -3035,23 +3038,23 @@ const x = H.arrayToEnum([
 ]), We = (n) => {
   switch (typeof n) {
     case "undefined":
-      return x.undefined;
+      return k.undefined;
     case "string":
-      return x.string;
+      return k.string;
     case "number":
-      return Number.isNaN(n) ? x.nan : x.number;
+      return Number.isNaN(n) ? k.nan : k.number;
     case "boolean":
-      return x.boolean;
+      return k.boolean;
     case "function":
-      return x.function;
+      return k.function;
     case "bigint":
-      return x.bigint;
+      return k.bigint;
     case "symbol":
-      return x.symbol;
+      return k.symbol;
     case "object":
-      return Array.isArray(n) ? x.array : n === null ? x.null : n.then && typeof n.then == "function" && n.catch && typeof n.catch == "function" ? x.promise : typeof Map < "u" && n instanceof Map ? x.map : typeof Set < "u" && n instanceof Set ? x.set : typeof Date < "u" && n instanceof Date ? x.date : x.object;
+      return Array.isArray(n) ? k.array : n === null ? k.null : n.then && typeof n.then == "function" && n.catch && typeof n.catch == "function" ? k.promise : typeof Map < "u" && n instanceof Map ? k.map : typeof Set < "u" && n instanceof Set ? k.set : typeof Date < "u" && n instanceof Date ? k.date : k.object;
     default:
-      return x.unknown;
+      return k.unknown;
   }
 }, N = H.arrayToEnum([
   "invalid_type",
@@ -3139,7 +3142,7 @@ const ln = (n, e) => {
   let t;
   switch (n.code) {
     case N.invalid_type:
-      n.received === x.undefined ? t = "Required" : t = `Expected ${n.expected}, received ${n.received}`;
+      n.received === k.undefined ? t = "Required" : t = `Expected ${n.expected}, received ${n.received}`;
       break;
     case N.invalid_literal:
       t = `Invalid literal value, expected ${JSON.stringify(n.expected, H.jsonStringifyReplacer)}`;
@@ -3445,7 +3448,7 @@ class q {
     return this._refinement((i, a) => e(i) ? !0 : (a.addIssue(typeof t == "function" ? t(i, a) : t), !1));
   }
   _refinement(e) {
-    return new tt({
+    return new nt({
       schema: this,
       typeName: U.ZodEffects,
       effect: { type: "refinement", refinement: e }
@@ -3483,7 +3486,7 @@ class q {
     return Mt.create(this, e, this._def);
   }
   transform(e) {
-    return new tt({
+    return new nt({
       ...M(this._def),
       schema: this,
       typeName: U.ZodEffects,
@@ -3573,11 +3576,11 @@ function Us(n, e) {
 }
 class Ze extends q {
   _parse(e) {
-    if (this._def.coerce && (e.data = String(e.data)), this._getType(e) !== x.string) {
+    if (this._def.coerce && (e.data = String(e.data)), this._getType(e) !== k.string) {
       const r = this._getOrReturnCtx(e);
       return E(r, {
         code: N.invalid_type,
-        expected: x.string,
+        expected: k.string,
         received: r.parsedType
       }), R;
     }
@@ -3963,11 +3966,11 @@ class yt extends q {
     super(...arguments), this.min = this.gte, this.max = this.lte, this.step = this.multipleOf;
   }
   _parse(e) {
-    if (this._def.coerce && (e.data = Number(e.data)), this._getType(e) !== x.number) {
+    if (this._def.coerce && (e.data = Number(e.data)), this._getType(e) !== k.number) {
       const r = this._getOrReturnCtx(e);
       return E(r, {
         code: N.invalid_type,
-        expected: x.number,
+        expected: k.number,
         received: r.parsedType
       }), R;
     }
@@ -4141,7 +4144,7 @@ class Et extends q {
       } catch {
         return this._getInvalidInput(e);
       }
-    if (this._getType(e) !== x.bigint)
+    if (this._getType(e) !== k.bigint)
       return this._getInvalidInput(e);
     let i;
     const a = new ke();
@@ -4169,7 +4172,7 @@ class Et extends q {
     const t = this._getOrReturnCtx(e);
     return E(t, {
       code: N.invalid_type,
-      expected: x.bigint,
+      expected: k.bigint,
       received: t.parsedType
     }), R;
   }
@@ -4265,11 +4268,11 @@ Et.create = (n) => new Et({
 });
 class dn extends q {
   _parse(e) {
-    if (this._def.coerce && (e.data = !!e.data), this._getType(e) !== x.boolean) {
+    if (this._def.coerce && (e.data = !!e.data), this._getType(e) !== k.boolean) {
       const i = this._getOrReturnCtx(e);
       return E(i, {
         code: N.invalid_type,
-        expected: x.boolean,
+        expected: k.boolean,
         received: i.parsedType
       }), R;
     }
@@ -4283,11 +4286,11 @@ dn.create = (n) => new dn({
 });
 class zt extends q {
   _parse(e) {
-    if (this._def.coerce && (e.data = new Date(e.data)), this._getType(e) !== x.date) {
+    if (this._def.coerce && (e.data = new Date(e.data)), this._getType(e) !== k.date) {
       const r = this._getOrReturnCtx(e);
       return E(r, {
         code: N.invalid_type,
-        expected: x.date,
+        expected: k.date,
         received: r.parsedType
       }), R;
     }
@@ -4361,11 +4364,11 @@ zt.create = (n) => new zt({
 });
 class ti extends q {
   _parse(e) {
-    if (this._getType(e) !== x.symbol) {
+    if (this._getType(e) !== k.symbol) {
       const i = this._getOrReturnCtx(e);
       return E(i, {
         code: N.invalid_type,
-        expected: x.symbol,
+        expected: k.symbol,
         received: i.parsedType
       }), R;
     }
@@ -4378,11 +4381,11 @@ ti.create = (n) => new ti({
 });
 class cn extends q {
   _parse(e) {
-    if (this._getType(e) !== x.undefined) {
+    if (this._getType(e) !== k.undefined) {
       const i = this._getOrReturnCtx(e);
       return E(i, {
         code: N.invalid_type,
-        expected: x.undefined,
+        expected: k.undefined,
         received: i.parsedType
       }), R;
     }
@@ -4395,11 +4398,11 @@ cn.create = (n) => new cn({
 });
 class _n extends q {
   _parse(e) {
-    if (this._getType(e) !== x.null) {
+    if (this._getType(e) !== k.null) {
       const i = this._getOrReturnCtx(e);
       return E(i, {
         code: N.invalid_type,
-        expected: x.null,
+        expected: k.null,
         received: i.parsedType
       }), R;
     }
@@ -4434,27 +4437,27 @@ un.create = (n) => new un({
   typeName: U.ZodUnknown,
   ...M(n)
 });
-class et extends q {
+class tt extends q {
   _parse(e) {
     const t = this._getOrReturnCtx(e);
     return E(t, {
       code: N.invalid_type,
-      expected: x.never,
+      expected: k.never,
       received: t.parsedType
     }), R;
   }
 }
-et.create = (n) => new et({
+tt.create = (n) => new tt({
   typeName: U.ZodNever,
   ...M(n)
 });
 class ni extends q {
   _parse(e) {
-    if (this._getType(e) !== x.undefined) {
+    if (this._getType(e) !== k.undefined) {
       const i = this._getOrReturnCtx(e);
       return E(i, {
         code: N.invalid_type,
-        expected: x.void,
+        expected: k.void,
         received: i.parsedType
       }), R;
     }
@@ -4468,10 +4471,10 @@ ni.create = (n) => new ni({
 class $e extends q {
   _parse(e) {
     const { ctx: t, status: i } = this._processInputParams(e), a = this._def;
-    if (t.parsedType !== x.array)
+    if (t.parsedType !== k.array)
       return E(t, {
         code: N.invalid_type,
-        expected: x.array,
+        expected: k.array,
         received: t.parsedType
       }), R;
     if (a.exactLength !== null) {
@@ -4565,16 +4568,16 @@ class le extends q {
     return this._cached = { shape: e, keys: t }, this._cached;
   }
   _parse(e) {
-    if (this._getType(e) !== x.object) {
+    if (this._getType(e) !== k.object) {
       const f = this._getOrReturnCtx(e);
       return E(f, {
         code: N.invalid_type,
-        expected: x.object,
+        expected: k.object,
         received: f.parsedType
       }), R;
     }
     const { status: i, ctx: a } = this._processInputParams(e), { shape: r, keys: l } = this._getCached(), d = [];
-    if (!(this._def.catchall instanceof et && this._def.unknownKeys === "strip"))
+    if (!(this._def.catchall instanceof tt && this._def.unknownKeys === "strip"))
       for (const f in a.data)
         l.includes(f) || d.push(f);
     const u = [];
@@ -4586,7 +4589,7 @@ class le extends q {
         alwaysSet: f in a.data
       });
     }
-    if (this._def.catchall instanceof et) {
+    if (this._def.catchall instanceof tt) {
       const f = this._def.unknownKeys;
       if (f === "passthrough")
         for (const p of d)
@@ -4824,21 +4827,21 @@ class le extends q {
 le.create = (n, e) => new le({
   shape: () => n,
   unknownKeys: "strip",
-  catchall: et.create(),
+  catchall: tt.create(),
   typeName: U.ZodObject,
   ...M(e)
 });
 le.strictCreate = (n, e) => new le({
   shape: () => n,
   unknownKeys: "strict",
-  catchall: et.create(),
+  catchall: tt.create(),
   typeName: U.ZodObject,
   ...M(e)
 });
 le.lazycreate = (n, e) => new le({
   shape: n,
   unknownKeys: "strip",
-  catchall: et.create(),
+  catchall: tt.create(),
   typeName: U.ZodObject,
   ...M(e)
 });
@@ -4915,14 +4918,14 @@ Pt.create = (n, e) => new Pt({
   typeName: U.ZodUnion,
   ...M(e)
 });
-const Je = (n) => n instanceof pn ? Je(n.schema) : n instanceof tt ? Je(n.innerType()) : n instanceof Bt ? [n.value] : n instanceof lt ? n.options : n instanceof $t ? H.objectValues(n.enum) : n instanceof Vt ? Je(n._def.innerType) : n instanceof cn ? [void 0] : n instanceof _n ? [null] : n instanceof He ? [void 0, ...Je(n.unwrap())] : n instanceof dt ? [null, ...Je(n.unwrap())] : n instanceof yi || n instanceof Ht ? Je(n.unwrap()) : n instanceof Zt ? Je(n._def.innerType) : [];
+const Ge = (n) => n instanceof pn ? Ge(n.schema) : n instanceof nt ? Ge(n.innerType()) : n instanceof Bt ? [n.value] : n instanceof lt ? n.options : n instanceof $t ? H.objectValues(n.enum) : n instanceof Vt ? Ge(n._def.innerType) : n instanceof cn ? [void 0] : n instanceof _n ? [null] : n instanceof He ? [void 0, ...Ge(n.unwrap())] : n instanceof dt ? [null, ...Ge(n.unwrap())] : n instanceof yi || n instanceof Ht ? Ge(n.unwrap()) : n instanceof Zt ? Ge(n._def.innerType) : [];
 class gn extends q {
   _parse(e) {
     const { ctx: t } = this._processInputParams(e);
-    if (t.parsedType !== x.object)
+    if (t.parsedType !== k.object)
       return E(t, {
         code: N.invalid_type,
-        expected: x.object,
+        expected: k.object,
         received: t.parsedType
       }), R;
     const i = this.discriminator, a = t.data[i], r = this.optionsMap.get(a);
@@ -4960,7 +4963,7 @@ class gn extends q {
   static create(e, t, i) {
     const a = /* @__PURE__ */ new Map();
     for (const r of t) {
-      const l = Je(r.shape[e]);
+      const l = Ge(r.shape[e]);
       if (!l.length)
         throw new Error(`A discriminator value for key \`${e}\` could not be extracted from all schema options`);
       for (const d of l) {
@@ -4982,7 +4985,7 @@ function ii(n, e) {
   const t = We(n), i = We(e);
   if (n === e)
     return { valid: !0, data: n };
-  if (t === x.object && i === x.object) {
+  if (t === k.object && i === k.object) {
     const a = H.objectKeys(e), r = H.objectKeys(n).filter((d) => a.indexOf(d) !== -1), l = { ...n, ...e };
     for (const d of r) {
       const u = ii(n[d], e[d]);
@@ -4991,7 +4994,7 @@ function ii(n, e) {
       l[d] = u.data;
     }
     return { valid: !0, data: l };
-  } else if (t === x.array && i === x.array) {
+  } else if (t === k.array && i === k.array) {
     if (n.length !== e.length)
       return { valid: !1 };
     const a = [];
@@ -5002,7 +5005,7 @@ function ii(n, e) {
       a.push(u.data);
     }
     return { valid: !0, data: a };
-  } else return t === x.date && i === x.date && +n == +e ? { valid: !0, data: n } : { valid: !1 };
+  } else return t === k.date && i === k.date && +n == +e ? { valid: !0, data: n } : { valid: !1 };
 }
 class Mt extends q {
   _parse(e) {
@@ -5045,10 +5048,10 @@ Mt.create = (n, e, t) => new Mt({
 class st extends q {
   _parse(e) {
     const { status: t, ctx: i } = this._processInputParams(e);
-    if (i.parsedType !== x.array)
+    if (i.parsedType !== k.array)
       return E(i, {
         code: N.invalid_type,
-        expected: x.array,
+        expected: k.array,
         received: i.parsedType
       }), R;
     if (i.data.length < this._def.items.length)
@@ -5101,10 +5104,10 @@ class qt extends q {
   }
   _parse(e) {
     const { status: t, ctx: i } = this._processInputParams(e);
-    if (i.parsedType !== x.object)
+    if (i.parsedType !== k.object)
       return E(i, {
         code: N.invalid_type,
-        expected: x.object,
+        expected: k.object,
         received: i.parsedType
       }), R;
     const a = [], r = this._def.keyType, l = this._def.valueType;
@@ -5142,10 +5145,10 @@ class ai extends q {
   }
   _parse(e) {
     const { status: t, ctx: i } = this._processInputParams(e);
-    if (i.parsedType !== x.map)
+    if (i.parsedType !== k.map)
       return E(i, {
         code: N.invalid_type,
-        expected: x.map,
+        expected: k.map,
         received: i.parsedType
       }), R;
     const a = this._def.keyType, r = this._def.valueType, l = [...i.data.entries()].map(([d, u], f) => ({
@@ -5184,10 +5187,10 @@ ai.create = (n, e, t) => new ai({
 class xt extends q {
   _parse(e) {
     const { status: t, ctx: i } = this._processInputParams(e);
-    if (i.parsedType !== x.set)
+    if (i.parsedType !== k.set)
       return E(i, {
         code: N.invalid_type,
-        expected: x.set,
+        expected: k.set,
         received: i.parsedType
       }), R;
     const a = this._def;
@@ -5345,7 +5348,7 @@ lt.create = _r;
 class $t extends q {
   _parse(e) {
     const t = H.getValidEnumValues(this._def.values), i = this._getOrReturnCtx(e);
-    if (i.parsedType !== x.string && i.parsedType !== x.number) {
+    if (i.parsedType !== k.string && i.parsedType !== k.number) {
       const a = H.objectValues(t);
       return E(i, {
         expected: H.joinValues(a),
@@ -5378,13 +5381,13 @@ class jt extends q {
   }
   _parse(e) {
     const { ctx: t } = this._processInputParams(e);
-    if (t.parsedType !== x.promise && t.common.async === !1)
+    if (t.parsedType !== k.promise && t.common.async === !1)
       return E(t, {
         code: N.invalid_type,
-        expected: x.promise,
+        expected: k.promise,
         received: t.parsedType
       }), R;
-    const i = t.parsedType === x.promise ? t.data : Promise.resolve(t.data);
+    const i = t.parsedType === k.promise ? t.data : Promise.resolve(t.data);
     return De(i.then((a) => this._def.type.parseAsync(a, {
       path: t.path,
       errorMap: t.common.contextualErrorMap
@@ -5396,7 +5399,7 @@ jt.create = (n, e) => new jt({
   typeName: U.ZodPromise,
   ...M(e)
 });
-class tt extends q {
+class nt extends q {
   innerType() {
     return this._def.schema;
   }
@@ -5476,13 +5479,13 @@ class tt extends q {
     H.assertNever(a);
   }
 }
-tt.create = (n, e, t) => new tt({
+nt.create = (n, e, t) => new nt({
   schema: n,
   typeName: U.ZodEffects,
   effect: e,
   ...M(t)
 });
-tt.createWithPreprocess = (n, e, t) => new tt({
+nt.createWithPreprocess = (n, e, t) => new nt({
   schema: e,
   effect: { type: "preprocess", transform: n },
   typeName: U.ZodEffects,
@@ -5490,7 +5493,7 @@ tt.createWithPreprocess = (n, e, t) => new tt({
 });
 class He extends q {
   _parse(e) {
-    return this._getType(e) === x.undefined ? De(void 0) : this._def.innerType._parse(e);
+    return this._getType(e) === k.undefined ? De(void 0) : this._def.innerType._parse(e);
   }
   unwrap() {
     return this._def.innerType;
@@ -5503,7 +5506,7 @@ He.create = (n, e) => new He({
 });
 class dt extends q {
   _parse(e) {
-    return this._getType(e) === x.null ? De(null) : this._def.innerType._parse(e);
+    return this._getType(e) === k.null ? De(null) : this._def.innerType._parse(e);
   }
   unwrap() {
     return this._def.innerType;
@@ -5518,7 +5521,7 @@ class Vt extends q {
   _parse(e) {
     const { ctx: t } = this._processInputParams(e);
     let i = t.data;
-    return t.parsedType === x.undefined && (i = this._def.defaultValue()), this._def.innerType._parse({
+    return t.parsedType === k.undefined && (i = this._def.defaultValue()), this._def.innerType._parse({
       data: i,
       path: t.path,
       parent: t
@@ -5579,11 +5582,11 @@ Zt.create = (n, e) => new Zt({
 });
 class oi extends q {
   _parse(e) {
-    if (this._getType(e) !== x.nan) {
+    if (this._getType(e) !== k.nan) {
       const i = this._getOrReturnCtx(e);
       return E(i, {
         code: N.invalid_type,
-        expected: x.nan,
+        expected: k.nan,
         received: i.parsedType
       }), R;
     }
@@ -5668,12 +5671,12 @@ var U;
 (function(n) {
   n.ZodString = "ZodString", n.ZodNumber = "ZodNumber", n.ZodNaN = "ZodNaN", n.ZodBigInt = "ZodBigInt", n.ZodBoolean = "ZodBoolean", n.ZodDate = "ZodDate", n.ZodSymbol = "ZodSymbol", n.ZodUndefined = "ZodUndefined", n.ZodNull = "ZodNull", n.ZodAny = "ZodAny", n.ZodUnknown = "ZodUnknown", n.ZodNever = "ZodNever", n.ZodVoid = "ZodVoid", n.ZodArray = "ZodArray", n.ZodObject = "ZodObject", n.ZodUnion = "ZodUnion", n.ZodDiscriminatedUnion = "ZodDiscriminatedUnion", n.ZodIntersection = "ZodIntersection", n.ZodTuple = "ZodTuple", n.ZodRecord = "ZodRecord", n.ZodMap = "ZodMap", n.ZodSet = "ZodSet", n.ZodFunction = "ZodFunction", n.ZodLazy = "ZodLazy", n.ZodLiteral = "ZodLiteral", n.ZodEnum = "ZodEnum", n.ZodEffects = "ZodEffects", n.ZodNativeEnum = "ZodNativeEnum", n.ZodOptional = "ZodOptional", n.ZodNullable = "ZodNullable", n.ZodDefault = "ZodDefault", n.ZodCatch = "ZodCatch", n.ZodPromise = "ZodPromise", n.ZodBranded = "ZodBranded", n.ZodPipeline = "ZodPipeline", n.ZodReadonly = "ZodReadonly";
 })(U || (U = {}));
-const o = Ze.create, I = yt.create, h = dn.create, j = Ft.create, at = un.create;
-et.create;
+const o = Ze.create, I = yt.create, h = dn.create, j = Ft.create, et = un.create;
+tt.create;
 const b = $e.create, _ = le.create, Pe = Pt.create, kt = gn.create;
 Mt.create;
 st.create;
-const P = qt.create, O = Bt.create, k = lt.create, gt = $t.create;
+const P = qt.create, O = Bt.create, x = lt.create, gt = $t.create;
 jt.create;
 He.create;
 dt.create;
@@ -5693,7 +5696,7 @@ const Fs = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
   ZodDate: zt,
   ZodDefault: Vt,
   ZodDiscriminatedUnion: gn,
-  ZodEffects: tt,
+  ZodEffects: nt,
   ZodEnum: lt,
   ZodError: Ke,
   get ZodFirstPartyTypeKind() {
@@ -5706,13 +5709,13 @@ const Fs = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
   ZodMap: ai,
   ZodNaN: oi,
   ZodNativeEnum: $t,
-  ZodNever: et,
+  ZodNever: tt,
   ZodNull: _n,
   ZodNullable: dt,
   ZodNumber: yt,
   ZodObject: le,
   ZodOptional: He,
-  ZodParsedType: x,
+  ZodParsedType: k,
   ZodPipeline: mn,
   ZodPromise: jt,
   ZodReadonly: Ht,
@@ -5721,7 +5724,7 @@ const Fs = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
   ZodSet: xt,
   ZodString: Ze,
   ZodSymbol: ti,
-  ZodTransformer: tt,
+  ZodTransformer: nt,
   ZodTuple: st,
   ZodType: q,
   ZodUndefined: cn,
@@ -5736,7 +5739,7 @@ const Fs = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
   datetimeRegex: cr,
   defaultErrorMap: ln,
   discriminatedUnion: kt,
-  enum: k,
+  enum: x,
   getErrorMap: rr,
   getParsedType: We,
   isAborted: Yn,
@@ -5754,7 +5757,7 @@ const Fs = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
   record: P,
   string: o,
   union: Pe,
-  unknown: at,
+  unknown: et,
   get util() {
     return H;
   }
@@ -5781,13 +5784,13 @@ const Ve = _({
   secrets: b(qs).optional()
 });
 ur.partial().extend({
-  status: k(["draft", "built"]).optional(),
+  status: x(["draft", "built"]).optional(),
   deployed_at: o().optional()
 });
 ur.extend({
   id: o(),
   tenant_id: o(),
-  status: k(["draft", "built"]).default("built"),
+  status: x(["draft", "built"]).default("built"),
   deployed_at: o().optional(),
   // Override secrets to return names only (no values) in responses
   secrets: b(
@@ -5798,13 +5801,13 @@ ur.extend({
   ).optional(),
   ...Ve.shape
 });
-const Bs = k([
+const Bs = x([
   "user_action",
   "admin_action",
   "system",
   "api"
 ]), $s = _({
-  type: k(["user", "admin", "system", "api_key", "client_credentials"]),
+  type: x(["user", "admin", "system", "api_key", "client_credentials"]),
   id: o().optional(),
   email: o().optional(),
   org_id: o().optional(),
@@ -5814,20 +5817,20 @@ const Bs = k([
 }), js = _({
   type: o(),
   id: o(),
-  before: P(at()).optional(),
-  after: P(at()).optional(),
-  diff: P(_({ old: at(), new: at() })).optional()
+  before: P(et()).optional(),
+  after: P(et()).optional(),
+  diff: P(_({ old: et(), new: et() })).optional()
 }), Vs = _({
   method: o(),
   path: o(),
   query: P(o()).optional(),
-  body: at().optional(),
+  body: et().optional(),
   ip: o(),
   user_agent: o().optional(),
   correlation_id: o().optional()
 }), Zs = _({
   status_code: I(),
-  body: at().optional()
+  body: et().optional()
 }), Hs = _({
   country_code: o(),
   city_name: o(),
@@ -5863,23 +5866,23 @@ const Bs = k([
 Qs.extend({
   id: o()
 });
-k(["AUTH0", "EMAIL", "REDIRECT"]);
-k([
+x(["AUTH0", "EMAIL", "REDIRECT"]);
+x([
   "CREATE_USER",
   "GET_USER",
   "UPDATE_USER",
   "SEND_REQUEST",
   "SEND_EMAIL"
 ]);
-k(["VERIFY_EMAIL"]);
-const Gs = _({
+x(["VERIFY_EMAIL"]);
+const Js = _({
   require_mx_record: h().optional(),
   block_aliases: h().optional(),
   block_free_emails: h().optional(),
   block_disposable_emails: h().optional(),
   blocklist: b(o()).optional(),
   allowlist: b(o()).optional()
-}), Js = _({
+}), Gs = _({
   id: o(),
   alias: o().max(100).optional(),
   type: O("AUTH0"),
@@ -5900,9 +5903,9 @@ const Gs = _({
   mask_output: h().optional(),
   params: _({
     email: o(),
-    rules: Gs.optional()
+    rules: Js.optional()
   })
-}), Xs = k(["change-email", "account", "custom"]), Ys = _({
+}), Xs = x(["change-email", "account", "custom"]), Ys = _({
   id: o(),
   alias: o().max(100).optional(),
   type: O("REDIRECT"),
@@ -5918,7 +5921,7 @@ const Gs = _({
     })
   })
 }), el = Pe([
-  Js,
+  Gs,
   Ws,
   Ys
 ]), tl = _({
@@ -6094,7 +6097,7 @@ const dl = _({
   client_secret: o().default(() => ll()).optional().openapi({
     description: "Client secret (which you must not make public)."
   }),
-  app_type: k([
+  app_type: x([
     "native",
     "spa",
     "regular_web",
@@ -6201,7 +6204,7 @@ const dl = _({
   addons: P(j()).default({}).optional().openapi({
     description: "Addons enabled for this client and their associated configurations."
   }),
-  token_endpoint_auth_method: k(["none", "client_secret_post", "client_secret_basic"]).default("client_secret_basic").optional().openapi({
+  token_endpoint_auth_method: x(["none", "client_secret_post", "client_secret_basic"]).default("client_secret_basic").optional().openapi({
     description: "Defines the requested authentication method for the token endpoint. Can be none (public client without a client secret), client_secret_post (client uses HTTP POST parameters), or client_secret_basic (client uses HTTP Basic)."
   }),
   client_metadata: P(o().max(255)).default({}).optional().openapi({
@@ -6220,10 +6223,10 @@ const dl = _({
   default_organization: P(j()).default({}).optional().openapi({
     description: "Defines the default Organization ID and flows"
   }),
-  organization_usage: k(["deny", "allow", "require"]).default("deny").optional().openapi({
+  organization_usage: x(["deny", "allow", "require"]).default("deny").optional().openapi({
     description: "Defines how to proceed during an authentication transaction with regards an organization. Can be deny (default), allow or require."
   }),
-  organization_require_behavior: k(["no_prompt", "pre_login_prompt", "post_login_prompt"]).default("no_prompt").optional().openapi({
+  organization_require_behavior: x(["no_prompt", "pre_login_prompt", "post_login_prompt"]).default("no_prompt").optional().openapi({
     description: "Defines how to proceed during an authentication transaction when client.organization_usage: 'require'. Can be no_prompt (default), pre_login_prompt or post_login_prompt. post_login_prompt requires oidc_conformant: true."
   }),
   client_authentication_methods: P(j()).default({}).optional().openapi({
@@ -6238,7 +6241,7 @@ const dl = _({
   signed_request_object: P(j()).default({}).optional().openapi({
     description: "JWT-secured Authorization Requests (JAR) settings."
   }),
-  compliance_level: k([
+  compliance_level: x([
     "none",
     "fapi1_adv_pkj_par",
     "fapi1_adv_mtls_par",
@@ -6254,11 +6257,14 @@ const dl = _({
   owner_user_id: o().optional().openapi({
     description: "User ID of the consenting user when this client was created via IAT-gated Dynamic Client Registration. NULL for clients created via the Management API or open DCR."
   }),
-  registration_type: k(["manual", "open_dcr", "iat_dcr"]).optional().openapi({
+  registration_type: x(["manual", "open_dcr", "iat_dcr"]).optional().openapi({
     description: "Provenance of this client. `manual` = Management API; `open_dcr` = RFC 7591 without IAT; `iat_dcr` = RFC 7591 with an Initial Access Token."
   }),
   registration_metadata: P(j()).default({}).optional().openapi({
     description: "Arbitrary metadata captured at Dynamic Client Registration time that isn't a first-class client field (e.g. integration_type, domain). Also stores `iat_constraints` for clients created via IAT so RFC 7592 PUT can enforce field immutability."
+  }),
+  user_linking_mode: x(["builtin", "off"]).optional().openapi({
+    description: "Per-client override for the built-in email-based user-linking path. `builtin` runs the legacy in-process linking at user creation/email update. `off` disables the legacy path; linking only happens if the tenant has enabled the `account-linking` template hook. When unset, the service-level `userLinkingMode` default applies."
   })
 });
 _({
@@ -6276,7 +6282,7 @@ const cl = _({
   scope: b(o()).optional().openapi({
     description: "Scopes allowed for this client grant."
   }),
-  organization_usage: k(["deny", "allow", "require"]).optional().openapi({
+  organization_usage: x(["deny", "allow", "require"]).optional().openapi({
     description: "Defines whether organizations can be used with client credentials exchanges for this grant."
   }),
   allow_any_organization: h().optional().openapi({
@@ -6285,7 +6291,7 @@ const cl = _({
   is_system: h().optional().openapi({
     description: "If enabled, this grant is a special grant created by Auth0. It cannot be modified or deleted directly."
   }),
-  subject_type: k(["client", "user"]).optional().openapi({
+  subject_type: x(["client", "user"]).optional().openapi({
     description: "The type of application access the client grant allows. Use of this field is subject to the applicable Free Trial terms in Okta's Master Subscription Agreement."
   }),
   authorization_details_types: b(o()).optional().openapi({
@@ -6300,13 +6306,13 @@ const cl = _({
   updated_at: o().optional()
 });
 b(_l);
-const fr = k(["iat", "rat"]), ul = _({
+const fr = x(["iat", "rat"]), ul = _({
   id: o(),
   token_hash: o(),
   type: fr,
   client_id: o().optional(),
   sub: o().optional(),
-  constraints: P(at()).optional(),
+  constraints: P(et()).optional(),
   single_use: h().default(!1),
   expires_at: o().optional()
 });
@@ -6469,10 +6475,10 @@ const yn = _({
   coordinates: Ot,
   alias: o().optional(),
   config: _({
-    action_type: k(["REDIRECT"]).openapi({
+    action_type: x(["REDIRECT"]).openapi({
       description: "The type of action to perform"
     }),
-    target: k(["change-email", "account", "custom"]).openapi({
+    target: x(["change-email", "account", "custom"]).openapi({
       description: "The predefined target to redirect to"
     }),
     custom_url: o().optional().openapi({
@@ -6561,7 +6567,7 @@ _({
     url: o()
   }).optional()
 });
-const Tl = k([
+const Tl = x([
   "password_reset",
   "email_verification",
   "otp",
@@ -6586,7 +6592,7 @@ const Tl = k([
   code_challenge: o().optional().openapi({
     description: "The code challenge used in PKCE in outbound flows"
   }),
-  code_challenge_method: k(["plain", "S256"]).optional().openapi({
+  code_challenge_method: x(["plain", "S256"]).optional().openapi({
     description: "The code challenge method used in PKCE in outbound flows"
   }),
   redirect_uri: o().optional().openapi({
@@ -6630,7 +6636,7 @@ const Il = _({
   twilio_token: o().optional(),
   icon_url: o().optional(),
   // Password policy options for Username-Password-Authentication connections
-  passwordPolicy: k(["none", "low", "fair", "good", "excellent"]).optional(),
+  passwordPolicy: x(["none", "low", "fair", "good", "excellent"]).optional(),
   password_complexity_options: _({
     min_length: I().optional()
   }).optional(),
@@ -6658,7 +6664,7 @@ const Il = _({
         active: h().optional()
       }).optional(),
       signup: _({
-        status: k(["required", "optional", "disabled"]).optional(),
+        status: x(["required", "optional", "disabled"]).optional(),
         verification: _({
           active: h().optional()
         }).optional()
@@ -6668,14 +6674,14 @@ const Il = _({
       }).optional(),
       unique: h().optional(),
       profile_required: h().optional(),
-      verification_method: k(["link", "code"]).optional()
+      verification_method: x(["link", "code"]).optional()
     }).optional(),
     username: _({
       identifier: _({
         active: h().optional()
       }).optional(),
       signup: _({
-        status: k(["required", "optional", "disabled"]).optional()
+        status: x(["required", "optional", "disabled"]).optional()
       }).optional(),
       validation: _({
         max_length: I().optional(),
@@ -6692,7 +6698,7 @@ const Il = _({
         active: h().optional()
       }).optional(),
       signup: _({
-        status: k(["required", "optional", "disabled"]).optional()
+        status: x(["required", "optional", "disabled"]).optional()
       }).optional()
     }).optional()
   }).optional(),
@@ -6707,7 +6713,7 @@ const Il = _({
   }).optional(),
   // Passkey options for Username-Password-Authentication connections
   passkey_options: _({
-    challenge_ui: k(["both", "autofill", "button"]).optional(),
+    challenge_ui: x(["both", "autofill", "button"]).optional(),
     local_enrollment_enabled: h().optional(),
     progressive_enrollment_enabled: h().optional()
   }).optional(),
@@ -6720,7 +6726,7 @@ const Il = _({
     }).optional()
   }).optional(),
   // Controls when root user attributes are updated from external IdP
-  set_user_root_attributes: k(["on_each_login", "on_first_login", "never_on_login"]).optional()
+  set_user_root_attributes: x(["on_each_login", "on_first_login", "never_on_login"]).optional()
 }), Cl = _({
   id: o().optional(),
   name: o(),
@@ -6743,10 +6749,10 @@ _({
 const Dl = _({
   domain: o(),
   custom_domain_id: o().optional(),
-  type: k(["auth0_managed_certs", "self_managed_certs"]),
-  verification_method: k(["txt"]).optional(),
-  tls_policy: k(["recommended"]).optional(),
-  custom_client_ip_header: k([
+  type: x(["auth0_managed_certs", "self_managed_certs"]),
+  verification_method: x(["txt"]).optional(),
+  tls_policy: x(["recommended"]).optional(),
+  custom_client_ip_header: x([
     "true-client-ip",
     "cf-connecting-ip",
     "x-forwarded-for",
@@ -6769,7 +6775,7 @@ const Dl = _({
   ...Dl.shape,
   custom_domain_id: o(),
   primary: h(),
-  status: k(["disabled", "pending", "pending_verification", "ready"]),
+  status: x(["disabled", "pending", "pending_verification", "ready"]),
   origin_domain_name: o().optional(),
   verification: _({
     methods: b(Ll)
@@ -6859,7 +6865,7 @@ const vi = _({
     _({
       id: I().optional(),
       text: o(),
-      type: k(["info", "error", "success", "warning"])
+      type: x(["info", "error", "success", "warning"])
     })
   ).optional(),
   required: h().optional(),
@@ -6891,11 +6897,11 @@ const vi = _({
         label: o()
       })
     ).optional(),
-    display: k(["radio", "checkbox"]).optional(),
+    display: x(["radio", "checkbox"]).optional(),
     multiple: h().optional(),
     default_value: Pe([o(), b(o())]).optional()
   }).optional()
-}), Gl = Se.extend({
+}), Jl = Se.extend({
   type: O("CUSTOM"),
   config: _({
     component: o().optional(),
@@ -6903,7 +6909,7 @@ const vi = _({
     schema: P(j()).optional(),
     code: o().optional()
   })
-}), Jl = Se.extend({
+}), Gl = Se.extend({
   type: O("DATE"),
   config: _({
     format: o().optional(),
@@ -7029,8 +7035,8 @@ const vi = _({
   Kl,
   Ql,
   sd,
-  Gl,
   Jl,
+  Gl,
   Wl,
   Xl,
   Yl,
@@ -7142,7 +7148,7 @@ _({
 const md = _({
   id: I().optional(),
   text: o(),
-  type: k(["info", "error", "success", "warning"])
+  type: x(["info", "error", "success", "warning"])
 }), yd = _({
   id: o().optional(),
   text: o(),
@@ -7153,7 +7159,7 @@ _({
   /** Screen identifier for CSS targeting (e.g., 'identifier', 'enter-password', 'signup') */
   name: o().optional(),
   action: o(),
-  method: k(["POST", "GET"]),
+  method: x(["POST", "GET"]),
   title: o().optional(),
   description: o().optional(),
   components: b(wr),
@@ -7162,37 +7168,53 @@ _({
   /** Footer HTML content displayed at the very bottom of the widget (e.g., terms and conditions) */
   footer: o().optional()
 });
-const Nr = k([
+const Nr = x([
   "pre-user-registration",
   "post-user-registration",
   "post-user-login",
+  "post-user-update",
   "validate-registration-username",
   "pre-user-deletion",
   "post-user-deletion"
   // Potentially other triggers specific to webhooks in the future
-]), Sr = k([
+]), Sr = x([
   "pre-user-registration",
   "post-user-registration",
   "post-user-login",
   "validate-registration-username",
   "pre-user-deletion",
   "post-user-deletion"
-]), br = k([
+]), br = x([
   "post-user-login",
+  "post-user-registration",
+  "post-user-update",
   "credentials-exchange"
-]), Er = k([
+]), Er = x([
   "post-user-login",
   "credentials-exchange",
   "pre-user-registration",
   "post-user-registration"
-]), xr = k([
+]), xr = x([
   "ensure-username",
-  "set-preferred-username"
+  "set-preferred-username",
+  "account-linking"
 ]), _t = {
   enabled: h().default(!1),
   synchronous: h().default(!1),
   priority: I().optional(),
-  hook_id: o().optional()
+  hook_id: o().optional(),
+  /**
+   * Free-form key/value bag for hook properties. Two well-known keys:
+   *
+   * - `inheritable: true` — when set on a hook on the control-plane tenant,
+   *   the multi-tenancy sync surfaces this hook to sub-tenants (Phase 2).
+   * - Template-specific options. Templates read their config here, e.g.
+   *   `account-linking` reads `copy_user_metadata: true` to merge secondary
+   *   user_metadata into the primary on link.
+   *
+   * Everything else is opaque to the runtime. Persisted as JSON.
+   */
+  metadata: P(et()).optional()
 }, vd = _({
   ..._t,
   trigger_id: Nr,
@@ -7281,7 +7303,7 @@ _({
   ticket_id: o().optional()
 }).extend(Id.shape);
 const Cd = _({
-  alg: k([
+  alg: x([
     "RS256",
     "RS384",
     "RS512",
@@ -7294,11 +7316,11 @@ const Cd = _({
   ]),
   e: o(),
   kid: o(),
-  kty: k(["RSA", "EC", "oct"]),
+  kty: x(["RSA", "EC", "oct"]),
   n: o(),
   x5t: o().optional(),
   x5c: b(o()).optional(),
-  use: k(["sig", "enc"]).optional()
+  use: x(["sig", "enc"]).optional()
 });
 _({
   keys: b(Cd)
@@ -7584,7 +7606,7 @@ const qd = _({
   id: o().optional(),
   user_id: o(),
   password: o(),
-  algorithm: k(["bcrypt", "argon2id"]).default("argon2id"),
+  algorithm: x(["bcrypt", "argon2id"]).default("argon2id"),
   is_current: h().default(!0)
 });
 qd.extend({
@@ -7641,7 +7663,7 @@ _({
   connection: o().optional().openapi({
     description: "The connection identifier associated with the key"
   }),
-  type: k(["jwt_signing", "saml_encryption"]).openapi({
+  type: x(["jwt_signing", "saml_encryption"]).openapi({
     description: "The type of the signing key"
   })
 });
@@ -7663,7 +7685,7 @@ const $d = _({
   ephemeral_session_lifetime: I().optional(),
   idle_ephemeral_session_lifetime: I().optional(),
   session_cookie: _({
-    mode: k(["persistent", "non-persistent"]).optional()
+    mode: x(["persistent", "non-persistent"]).optional()
   }).optional(),
   // Logout settings
   allowed_logout_urls: b(o()).optional(),
@@ -7755,7 +7777,7 @@ const $d = _({
   }).optional(),
   // Device flow settings
   device_flow: _({
-    charset: k(["base20", "digits"]).optional(),
+    charset: x(["base20", "digits"]).optional(),
     mask: o().max(20).optional()
   }).optional(),
   // Default token quota
@@ -7795,7 +7817,7 @@ const $d = _({
   // Guardian MFA Factors configuration (internal storage, exposed via /guardian API)
   mfa: _({
     // MFA policy: "never" = MFA disabled, "always" = MFA required for all logins
-    policy: k(["never", "always"]).default("never").optional(),
+    policy: x(["never", "always"]).default("never").optional(),
     // Factor states
     factors: _({
       sms: h().default(!1),
@@ -7809,7 +7831,7 @@ const $d = _({
     }).optional(),
     // SMS provider configuration
     sms_provider: _({
-      provider: k(["twilio", "vonage", "aws_sns", "phone_message_hook"]).optional()
+      provider: x(["twilio", "vonage", "aws_sns", "phone_message_hook"]).optional()
     }).optional(),
     // Twilio-specific configuration
     twilio: _({
@@ -7846,10 +7868,10 @@ _({
 const jd = _({
   button_border_radius: I(),
   button_border_weight: I(),
-  buttons_style: k(["pill", "rounded", "sharp"]),
+  buttons_style: x(["pill", "rounded", "sharp"]),
   input_border_radius: I(),
   input_border_weight: I(),
-  inputs_style: k(["pill", "rounded", "sharp"]),
+  inputs_style: x(["pill", "rounded", "sharp"]),
   show_widget_shadow: h(),
   widget_border_weight: I(),
   widget_corner_radius: I()
@@ -7857,7 +7879,7 @@ const jd = _({
   base_focus_color: o(),
   base_hover_color: o(),
   body_text: o(),
-  captcha_widget_theme: k(["auto", "dark", "light"]),
+  captcha_widget_theme: x(["auto", "dark", "light"]),
   error: o(),
   header: o(),
   icons: o(),
@@ -7882,20 +7904,20 @@ const jd = _({
   font_url: o(),
   input_labels: vt,
   links: vt,
-  links_style: k(["normal", "underlined"]),
+  links_style: x(["normal", "underlined"]),
   reference_text_size: I(),
   subtitle: vt,
   title: vt
 }), Hd = _({
   background_color: o(),
   background_image_url: o(),
-  page_layout: k(["center", "left", "right"])
+  page_layout: x(["center", "left", "right"])
 }), Kd = _({
-  header_text_alignment: k(["center", "left", "right"]),
+  header_text_alignment: x(["center", "left", "right"]),
   logo_height: I(),
-  logo_position: k(["center", "left", "none", "right"]),
+  logo_position: x(["center", "left", "none", "right"]),
   logo_url: o(),
-  social_buttons_layout: k(["bottom", "top"])
+  social_buttons_layout: x(["bottom", "top"])
 }), Qd = _({
   borders: jd,
   colors: Vd,
@@ -7908,7 +7930,7 @@ Qd.extend({
   themeId: o()
 });
 _({
-  universal_login_experience: k(["new", "classic"]).default("new"),
+  universal_login_experience: x(["new", "classic"]).default("new"),
   identifier_first: h().default(!0),
   password_first: h().default(!1),
   webauthn_platform_first_factor: h()
@@ -7944,7 +7966,7 @@ _({
   ]),
   settings: _({}).optional()
 });
-const Gd = _({
+const Jd = _({
   // The actual refresh token value (primary key).
   id: o(),
   // Link to the login session
@@ -7972,7 +7994,7 @@ _({
   // When the token was explicitly revoked (null = still active).
   revoked_at: o().optional(),
   // Spread in the rest of the refresh token properties.
-  ...Gd.shape
+  ...Jd.shape
 });
 _({
   to: o(),
@@ -7982,11 +8004,11 @@ _({
   name: o(),
   options: _({})
 });
-const Jd = _({
+const Gd = _({
   value: o(),
   description: o().optional()
 }), Wd = _({
-  token_dialect: k(["access_token", "access_token_authz"]).optional(),
+  token_dialect: x(["access_token", "access_token_authz"]).optional(),
   enforce_policies: h().optional(),
   allow_skipping_userinfo: h().optional(),
   skip_userinfo: h().optional(),
@@ -7999,7 +8021,7 @@ const Jd = _({
   id: o().optional(),
   name: o(),
   identifier: o(),
-  scopes: b(Jd).optional(),
+  scopes: b(Gd).optional(),
   signing_alg: o().optional(),
   signing_secret: o().optional(),
   token_lifetime: I().default(86400),
@@ -8163,7 +8185,7 @@ _({
   idle_session_lifetime: I().default(72),
   session_lifetime: I().default(168),
   session_cookie: _({
-    mode: k(["persistent", "non-persistent"]).optional()
+    mode: x(["persistent", "non-persistent"]).optional()
   }).optional(),
   // MFA settings
   enable_client_connections: h().optional(),
@@ -8230,7 +8252,7 @@ _({
   // Guardian MFA Factors configuration (internal storage, exposed via /guardian API)
   mfa: _({
     // MFA policy: "never" = MFA disabled, "always" = MFA required for all logins
-    policy: k(["never", "always"]).default("never").optional(),
+    policy: x(["never", "always"]).default("never").optional(),
     // Factor states
     factors: _({
       sms: h().default(!1),
@@ -8244,7 +8266,7 @@ _({
     }).optional(),
     // SMS provider configuration
     sms_provider: _({
-      provider: k(["twilio", "vonage", "aws_sns", "phone_message_hook"]).optional()
+      provider: x(["twilio", "vonage", "aws_sns", "phone_message_hook"]).optional()
     }).optional(),
     // Twilio-specific configuration
     twilio: _({
@@ -8289,7 +8311,7 @@ I().openapi({
   description: "Number of active users in the last 30 days",
   example: 1234
 });
-const fc = k([
+const fc = x([
   "login",
   "login-id",
   "login-password",
@@ -8330,7 +8352,7 @@ _({
   language: o(),
   custom_text: hc
 });
-const gc = k([
+const gc = x([
   "phone",
   "totp",
   "email",
@@ -8417,7 +8439,7 @@ function vc(n) {
   return {
     async create(e, t) {
       const i = Date.now();
-      return await n.insert(G).values({
+      return await n.insert(J).values({
         id: t.id,
         tenant_id: e,
         token_hash: t.token_hash,
@@ -8441,63 +8463,63 @@ function vc(n) {
       };
     },
     async get(e, t) {
-      const i = await n.select().from(G).where(
+      const i = await n.select().from(J).where(
         g(
-          c(G.tenant_id, e),
-          c(G.id, t)
+          c(J.tenant_id, e),
+          c(J.id, t)
         )
       ).get();
       return i ? Rn(i) : null;
     },
     async getByHash(e, t) {
-      const i = await n.select().from(G).where(
+      const i = await n.select().from(J).where(
         g(
-          c(G.tenant_id, e),
-          c(G.token_hash, t)
+          c(J.tenant_id, e),
+          c(J.token_hash, t)
         )
       ).get();
       return i ? Rn(i) : null;
     },
     async listByClient(e, t) {
-      return (await n.select().from(G).where(
+      return (await n.select().from(J).where(
         g(
-          c(G.tenant_id, e),
-          c(G.client_id, t)
+          c(J.tenant_id, e),
+          c(J.client_id, t)
         )
-      ).orderBy(ce(G.created_at_ts))).map(Rn);
+      ).orderBy(ce(J.created_at_ts))).map(Rn);
     },
     async markUsed(e, t, i) {
-      return (await n.update(G).set({ used_at_ts: Xt(i) }).where(
+      return (await n.update(J).set({ used_at_ts: Xt(i) }).where(
         g(
-          c(G.tenant_id, e),
-          c(G.id, t),
-          Ae(G.used_at_ts)
+          c(J.tenant_id, e),
+          c(J.id, t),
+          Ae(J.used_at_ts)
         )
       ).returning()).length > 0;
     },
     async revoke(e, t, i) {
-      return (await n.update(G).set({ revoked_at_ts: Xt(i) }).where(
+      return (await n.update(J).set({ revoked_at_ts: Xt(i) }).where(
         g(
-          c(G.tenant_id, e),
-          c(G.id, t),
-          Ae(G.revoked_at_ts)
+          c(J.tenant_id, e),
+          c(J.id, t),
+          Ae(J.revoked_at_ts)
         )
       ).returning()).length > 0;
     },
     async revokeByClient(e, t, i) {
-      return (await n.update(G).set({ revoked_at_ts: Xt(i) }).where(
+      return (await n.update(J).set({ revoked_at_ts: Xt(i) }).where(
         g(
-          c(G.tenant_id, e),
-          c(G.client_id, t),
-          Ae(G.revoked_at_ts)
+          c(J.tenant_id, e),
+          c(J.client_id, t),
+          Ae(J.revoked_at_ts)
         )
       ).returning()).length;
     },
     async remove(e, t) {
-      return (await n.delete(G).where(
+      return (await n.delete(J).where(
         g(
-          c(G.tenant_id, e),
-          c(G.id, t)
+          c(J.tenant_id, e),
+          c(J.id, t)
         )
       ).returning()).length > 0;
     }
@@ -8793,7 +8815,7 @@ function xc(n) {
   return {
     async create(e, t) {
       const i = (/* @__PURE__ */ new Date()).toISOString();
-      await n.insert(it).values({
+      await n.insert(at).values({
         tenant_id: e,
         name: t.name,
         enabled: t.enabled,
@@ -8805,7 +8827,7 @@ function xc(n) {
       });
     },
     async get(e) {
-      const t = await n.select().from(it).where(c(it.tenant_id, e)).get();
+      const t = await n.select().from(at).where(c(at.tenant_id, e)).get();
       if (!t) return null;
       const { tenant_id: i, ...a } = t;
       return K({
@@ -8819,10 +8841,10 @@ function xc(n) {
       const i = {
         updated_at: (/* @__PURE__ */ new Date()).toISOString()
       };
-      t.name !== void 0 && (i.name = t.name), t.enabled !== void 0 && (i.enabled = t.enabled), t.default_from_address !== void 0 && (i.default_from_address = t.default_from_address), t.credentials !== void 0 && (i.credentials = JSON.stringify(t.credentials)), t.settings !== void 0 && (i.settings = JSON.stringify(t.settings)), await n.update(it).set(i).where(c(it.tenant_id, e));
+      t.name !== void 0 && (i.name = t.name), t.enabled !== void 0 && (i.enabled = t.enabled), t.default_from_address !== void 0 && (i.default_from_address = t.default_from_address), t.credentials !== void 0 && (i.credentials = JSON.stringify(t.credentials)), t.settings !== void 0 && (i.settings = JSON.stringify(t.settings)), await n.update(at).set(i).where(c(at.tenant_id, e));
     },
     async remove(e) {
-      await n.delete(it).where(c(it.tenant_id, e));
+      await n.delete(at).where(c(at.tenant_id, e));
     }
   };
 }
@@ -8994,7 +9016,7 @@ function ne(n) {
   const e = new Date(n);
   return isNaN(e.getTime()) ? null : e.getTime();
 }
-function Jt(n, e, t = []) {
+function Gt(n, e, t = []) {
   const i = {};
   for (const a of e) {
     const r = a.replace(/_ts$/, "");
@@ -9011,7 +9033,7 @@ function Ac() {
   return `hc_${Tc()}`;
 }
 function Oi(n) {
-  const { created_at_ts: e, updated_at_ts: t, secrets: i, ...a } = n, r = Jt({ created_at_ts: e, updated_at_ts: t }, [
+  const { created_at_ts: e, updated_at_ts: t, secrets: i, ...a } = n, r = Gt({ created_at_ts: e, updated_at_ts: t }, [
     "created_at_ts",
     "updated_at_ts"
   ]);
@@ -9053,19 +9075,29 @@ function Cc() {
   const { customAlphabet: n } = require("nanoid");
   return `h_${n("0123456789abcdefghijklmnopqrstuvwxyz", 17)()}`;
 }
+function Dc(n) {
+  if (!(typeof n != "string" || !n))
+    try {
+      const e = JSON.parse(n);
+      return e && typeof e == "object" && !Array.isArray(e) ? e : void 0;
+    } catch {
+      return;
+    }
+}
 function Fn(n) {
-  const { tenant_id: e, created_at_ts: t, updated_at_ts: i, ...a } = n, r = Jt({ created_at_ts: t, updated_at_ts: i }, [
+  const { tenant_id: e, created_at_ts: t, updated_at_ts: i, metadata: a, ...r } = n, l = Gt({ created_at_ts: t, updated_at_ts: i }, [
     "created_at_ts",
     "updated_at_ts"
   ]);
   return K({
-    ...a,
-    enabled: !!a.enabled,
-    synchronous: !!a.synchronous,
-    ...r
+    ...r,
+    enabled: !!r.enabled,
+    synchronous: !!r.synchronous,
+    metadata: Dc(a),
+    ...l
   });
 }
-function Dc(n) {
+function Lc(n) {
   return {
     async create(e, t) {
       const i = Date.now(), r = {
@@ -9079,6 +9111,7 @@ function Dc(n) {
         form_id: t.form_id,
         template_id: t.template_id,
         code_id: t.code_id,
+        metadata: t.metadata ? JSON.stringify(t.metadata) : null,
         created_at_ts: i,
         updated_at_ts: i
       };
@@ -9092,7 +9125,7 @@ function Dc(n) {
       const a = {
         updated_at_ts: Date.now()
       };
-      return i.trigger_id !== void 0 && (a.trigger_id = i.trigger_id), i.url !== void 0 && (a.url = i.url), i.enabled !== void 0 && (a.enabled = i.enabled), i.synchronous !== void 0 && (a.synchronous = i.synchronous), i.priority !== void 0 && (a.priority = i.priority), i.form_id !== void 0 && (a.form_id = i.form_id), i.template_id !== void 0 && (a.template_id = i.template_id), i.code_id !== void 0 && (a.code_id = i.code_id), (await n.update(we).set(a).where(g(c(we.tenant_id, e), c(we.hook_id, t))).returning()).length > 0;
+      return i.trigger_id !== void 0 && (a.trigger_id = i.trigger_id), i.url !== void 0 && (a.url = i.url), i.enabled !== void 0 && (a.enabled = i.enabled), i.synchronous !== void 0 && (a.synchronous = i.synchronous), i.priority !== void 0 && (a.priority = i.priority), i.form_id !== void 0 && (a.form_id = i.form_id), i.template_id !== void 0 && (a.template_id = i.template_id), i.code_id !== void 0 && (a.code_id = i.code_id), i.metadata !== void 0 && (a.metadata = i.metadata === null ? null : JSON.stringify(i.metadata)), (await n.update(we).set(a).where(g(c(we.tenant_id, e), c(we.hook_id, t))).returning()).length > 0;
     },
     async list(e, t) {
       const {
@@ -9130,7 +9163,7 @@ function Dc(n) {
     }
   };
 }
-function Lc() {
+function Rc() {
   const { customAlphabet: n } = require("nanoid");
   return `inv_${n("0123456789abcdefghijklmnopqrstuvwxyz", 17)()}`;
 }
@@ -9147,11 +9180,11 @@ function Pn(n) {
     a[r] = z(i[r], r === "roles" ? [] : {});
   return a.send_invitation_email = !!t, K(a);
 }
-function Rc(n) {
+function Uc(n) {
   return {
     async create(e, t) {
       var u, f;
-      const i = t.id || Lc(), a = t.ttl_sec || 604800, r = /* @__PURE__ */ new Date(), l = new Date(r.getTime() + a * 1e3).toISOString(), d = {
+      const i = t.id || Rc(), a = t.ttl_sec || 604800, r = /* @__PURE__ */ new Date(), l = new Date(r.getTime() + a * 1e3).toISOString(), d = {
         id: i,
         tenant_id: e,
         organization_id: t.organization_id,
@@ -9215,7 +9248,7 @@ function Rc(n) {
     }
   };
 }
-function Uc(n) {
+function zc(n) {
   return {
     async create(e) {
       await n.insert(Be).values({
@@ -9257,7 +9290,7 @@ function Uc(n) {
   };
 }
 const di = "0123456789ABCDEFGHJKMNPQRSTVWXYZ", Mn = di.length;
-function zc() {
+function Fc() {
   let t = Date.now(), i = "";
   for (let r = 10; r > 0; r--)
     i = di.charAt(t % Mn) + i, t = Math.floor(t / Mn);
@@ -9276,7 +9309,7 @@ function Ti(n) {
     state_data: r,
     auth_params: l,
     ...d
-  } = n, u = Jt(
+  } = n, u = Gt(
     { created_at_ts: t, updated_at_ts: i, expires_at_ts: a },
     ["created_at_ts", "updated_at_ts", "expires_at_ts"]
   ), f = {};
@@ -9290,12 +9323,12 @@ function Ti(n) {
     state_data: z(r)
   });
 }
-function Fc(n) {
+function Pc(n) {
   return {
     async create(e, t) {
       var l, d;
       const i = Date.now(), r = {
-        id: zc(),
+        id: Fc(),
         tenant_id: e,
         session_id: t.session_id,
         csrf_token: t.csrf_token,
@@ -9316,10 +9349,10 @@ function Fc(n) {
         updated_at_ts: i,
         expires_at_ts: t.expires_at ? ne(t.expires_at) : i + 1e3 * 60 * 60 * 24
       };
-      return await n.insert(J).values(r), Ti({ ...r, tenant_id: e });
+      return await n.insert(G).values(r), Ti({ ...r, tenant_id: e });
     },
     async get(e, t) {
-      const i = e ? g(c(J.tenant_id, e), c(J.id, t)) : c(J.id, t), a = await n.select().from(J).where(i).get();
+      const i = e ? g(c(G.tenant_id, e), c(G.id, t)) : c(G.id, t), a = await n.select().from(G).where(i).get();
       return a ? Ti(a) : null;
     },
     async update(e, t, i) {
@@ -9331,10 +9364,10 @@ function Fc(n) {
         0,
         1024
       )), i.expires_at !== void 0 && (a.expires_at_ts = ne(i.expires_at)), i.authParams !== void 0) {
-        const u = await n.select({ auth_params: J.auth_params }).from(J).where(
+        const u = await n.select({ auth_params: G.auth_params }).from(G).where(
           g(
-            c(J.tenant_id, e),
-            c(J.id, t)
+            c(G.tenant_id, e),
+            c(G.id, t)
           )
         ).get(), f = u != null && u.auth_params && typeof u.auth_params == "string" && u.auth_params.length > 0 ? JSON.parse(u.auth_params) : {};
         a.auth_params = JSON.stringify({
@@ -9342,13 +9375,13 @@ function Fc(n) {
           ...i.authParams
         });
       }
-      return await n.update(J).set(a).where(
-        g(c(J.tenant_id, e), c(J.id, t))
+      return await n.update(G).set(a).where(
+        g(c(G.tenant_id, e), c(G.id, t))
       ), !0;
     },
     async remove(e, t) {
-      return (await n.delete(J).where(
-        g(c(J.tenant_id, e), c(J.id, t))
+      return (await n.delete(G).where(
+        g(c(G.tenant_id, e), c(G.id, t))
       ).returning()).length > 0;
     }
   };
@@ -9383,7 +9416,7 @@ function qn(n) {
     continent_code: p
   })), K(S);
 }
-function Pc(n) {
+function Mc(n) {
   return {
     async create(e, t) {
       var r, l;
@@ -9455,7 +9488,7 @@ function Pc(n) {
   };
 }
 const ci = "0123456789ABCDEFGHJKMNPQRSTVWXYZ", Bn = ci.length;
-function Mc() {
+function qc() {
   let t = Date.now(), i = "";
   for (let r = 10; r > 0; r--)
     i = ci.charAt(t % Bn) + i, t = Math.floor(t / Bn);
@@ -9484,11 +9517,11 @@ function tn(n) {
     updated_at: si(i)
   });
 }
-function qc(n) {
+function Bc(n) {
   return {
     async create(e, t) {
       const i = Date.now(), r = {
-        id: t.id || Mc(),
+        id: t.id || qc(),
         tenant_id: e,
         user_id: t.user_id,
         type: t.type,
@@ -9559,7 +9592,7 @@ function qc(n) {
     }
   };
 }
-function Bc() {
+function $c() {
   const { customAlphabet: n } = require("nanoid");
   return `org_${n("0123456789abcdefghijklmnopqrstuvwxyz", 17)()}`;
 }
@@ -9580,12 +9613,12 @@ function $n(n) {
     token_quota: z(r, {})
   });
 }
-function $c(n) {
+function jc(n) {
   return {
     async create(e, t) {
       var l, d;
       const i = (/* @__PURE__ */ new Date()).toISOString(), r = {
-        id: t.id || Bc(),
+        id: t.id || $c(),
         tenant_id: e,
         name: t.name,
         display_name: t.display_name,
@@ -9678,7 +9711,7 @@ function jn(n) {
     is_current: !!t
   };
 }
-function jc(n) {
+function Vc(n) {
   return {
     async create(e, t) {
       const i = (/* @__PURE__ */ new Date()).toISOString(), a = t.id || Ie();
@@ -9738,7 +9771,7 @@ function jc(n) {
     }
   };
 }
-function Vc(n) {
+function Zc(n) {
   return {
     async get(e) {
       const t = await n.select().from(It).where(c(It.tenant_id, e)).get();
@@ -9785,7 +9818,7 @@ function Vn(n) {
     resource_servers: u,
     rotating: f,
     ...p
-  } = n, v = Jt(
+  } = n, v = Gt(
     {
       created_at_ts: t,
       expires_at_ts: i,
@@ -9809,10 +9842,10 @@ function Vn(n) {
     resource_servers: z(u, [])
   });
 }
-function Zc(n, e) {
+function Hc(n, e) {
   return Math.max(n ?? 0, e ?? 0);
 }
-function Hc(n) {
+function Kc(n) {
   return {
     async create(e, t) {
       const i = Date.now(), a = {
@@ -9832,18 +9865,18 @@ function Hc(n) {
       await n.run(A`BEGIN`);
       try {
         await n.insert(X).values(a);
-        const r = Zc(
+        const r = Hc(
           a.expires_at_ts,
           a.idle_expires_at_ts
         );
-        r > 0 && a.login_id && await n.update(J).set({
+        r > 0 && a.login_id && await n.update(G).set({
           expires_at_ts: r,
           updated_at_ts: i
         }).where(
           g(
-            c(J.tenant_id, e),
-            c(J.id, a.login_id),
-            Xe(J.expires_at_ts, r)
+            c(G.tenant_id, e),
+            c(G.id, a.login_id),
+            Xe(G.expires_at_ts, r)
           )
         ), await n.run(A`COMMIT`);
       } catch (r) {
@@ -9866,14 +9899,14 @@ function Hc(n) {
           c(X.id, t)
         )
       ).returning();
-      return l != null && l.login_id && d && d > 0 && await n.update(J).set({
+      return l != null && l.login_id && d && d > 0 && await n.update(G).set({
         expires_at_ts: d,
         updated_at_ts: Date.now()
       }).where(
         g(
-          c(J.tenant_id, e),
-          c(J.id, l.login_id),
-          Xe(J.expires_at_ts, d)
+          c(G.tenant_id, e),
+          c(G.id, l.login_id),
+          Xe(G.expires_at_ts, d)
         )
       ).catch(() => {
       }), u.length > 0;
@@ -9926,7 +9959,7 @@ function Hc(n) {
     }
   };
 }
-function Kc() {
+function Qc() {
   const { customAlphabet: n } = require("nanoid");
   return `api_${n("0123456789abcdefghijklmnopqrstuvwxyz", 17)()}`;
 }
@@ -9967,11 +10000,11 @@ function Zn(n) {
     l[u] !== void 0 && l[u] !== null && (d[u] = !!l[u]);
   return K(d);
 }
-function Qc(n) {
+function Jc(n) {
   return {
     async create(e, t) {
       const i = (/* @__PURE__ */ new Date()).toISOString(), r = {
-        id: t.id || Kc(),
+        id: t.id || Qc(),
         tenant_id: e,
         identifier: t.identifier,
         name: t.name,
@@ -10027,8 +10060,8 @@ function Qc(n) {
       if (d) {
         const ee = d.match(/^([^:]+):(.+)$/);
         if (ee) {
-          const [, ie, ae] = ee, Ge = ie == null ? void 0 : ie.startsWith("-"), ut = Ge ? ie == null ? void 0 : ie.substring(1) : ie;
-          if (ut && Ai.has(ut) && !Ge) {
+          const [, ie, ae] = ee, Je = ie == null ? void 0 : ie.startsWith("-"), ut = Je ? ie == null ? void 0 : ie.substring(1) : ie;
+          if (ut && Ai.has(ut) && !Je) {
             const vn = Y[ut];
             p.push(Nt(vn, `%${ae}%`));
           }
@@ -10127,7 +10160,7 @@ function Gc(n) {
     }
   };
 }
-function Jc(n) {
+function Wc(n) {
   return {
     async create(e, t, i, a) {
       var r, l;
@@ -10195,7 +10228,7 @@ function Hn(n) {
     metadata: z(i)
   });
 }
-function Wc(n) {
+function Xc(n) {
   return {
     async create(e, t) {
       const i = (/* @__PURE__ */ new Date()).toISOString(), r = {
@@ -10251,7 +10284,7 @@ function Wc(n) {
     }
   };
 }
-const Xc = ["created_at_ts", "updated_at_ts"], Yc = [
+const Yc = ["created_at_ts", "updated_at_ts"], e_ = [
   "expires_at_ts",
   "idle_expires_at_ts",
   "authenticated_at_ts",
@@ -10273,7 +10306,7 @@ function Kn(n) {
     device: p,
     clients: v,
     ...m
-  } = n, S = Jt(
+  } = n, S = Gt(
     {
       created_at_ts: t,
       updated_at_ts: i,
@@ -10284,8 +10317,8 @@ function Kn(n) {
       used_at_ts: u,
       revoked_at_ts: f
     },
-    [...Xc],
-    [...Yc]
+    [...Yc],
+    [...e_]
   );
   return K({
     ...m,
@@ -10294,7 +10327,7 @@ function Kn(n) {
     clients: z(v, [])
   });
 }
-function e_(n) {
+function t_(n) {
   return {
     async create(e, t) {
       const i = Date.now(), a = {
@@ -10399,7 +10432,7 @@ function Ci(n) {
     n[t] !== void 0 && (e[t] = n[t] ? 1 : 0);
   return ar(e);
 }
-function t_(n) {
+function n_(n) {
   return {
     async create(e) {
       var a, r;
@@ -10465,7 +10498,7 @@ function t_(n) {
     }
   };
 }
-const n_ = [
+const i_ = [
   "colors",
   "borders",
   "fonts",
@@ -10473,10 +10506,10 @@ const n_ = [
   "widget"
 ];
 function Di(n) {
-  const { tenant_id: e, ...t } = n, i = or(t, n_);
+  const { tenant_id: e, ...t } = n, i = or(t, i_);
   return i.borders && (i.borders.show_widget_shadow = !!i.borders.show_widget_shadow), i.fonts && (i.fonts.links_bold = !!i.fonts.links_bold, i.fonts.subtitle_bold = !!i.fonts.subtitle_bold, i.fonts.title_bold = !!i.fonts.title_bold), K(i);
 }
-function i_(n) {
+function a_(n) {
   return {
     async create(e, t, i) {
       const a = (/* @__PURE__ */ new Date()).toISOString(), r = i || Ie(), d = {
@@ -10507,21 +10540,21 @@ function i_(n) {
     }
   };
 }
-function a_(n) {
+function o_(n) {
   return {
     async get(e) {
-      const t = await n.select({ body: nt.body }).from(nt).where(c(nt.tenant_id, e)).get();
+      const t = await n.select({ body: it.body }).from(it).where(c(it.tenant_id, e)).get();
       return t ? { body: t.body } : null;
     },
     async set(e, t) {
       const i = Date.now();
-      await n.insert(nt).values({
+      await n.insert(it).values({
         tenant_id: e,
         body: t.body,
         created_at_ts: i,
         updated_at_ts: i
       }).onConflictDoUpdate({
-        target: nt.tenant_id,
+        target: it.tenant_id,
         set: {
           body: t.body,
           updated_at_ts: i
@@ -10529,7 +10562,7 @@ function a_(n) {
       });
     },
     async delete(e) {
-      await n.delete(nt).where(c(nt.tenant_id, e));
+      await n.delete(it).where(c(it.tenant_id, e));
     }
   };
 }
@@ -10571,7 +10604,7 @@ function Qn(n, e = []) {
     identities: [m, ...S]
   });
 }
-function o_(n) {
+function r_(n) {
   const e = async (t, i) => {
     var d, u;
     const a = (/* @__PURE__ */ new Date()).toISOString(), r = {
@@ -10716,8 +10749,8 @@ function o_(n) {
         )
       ));
       const ee = m.map((ae) => {
-        const Ge = T.filter((ut) => ut.linked_to === ae.user_id);
-        return Qn(ae, Ge);
+        const Je = T.filter((ut) => ut.linked_to === ae.user_id);
+        return Qn(ae, Je);
       });
       if (!l)
         return { users: ee };
@@ -10768,7 +10801,7 @@ function o_(n) {
     }
   };
 }
-function r_(n) {
+function s_(n) {
   return {
     async create(e, t, i, a) {
       var r, l;
@@ -10823,7 +10856,7 @@ function r_(n) {
     }
   };
 }
-function s_(n) {
+function l_(n) {
   return {
     async create(e, t) {
       var u, f;
@@ -10917,10 +10950,10 @@ function s_(n) {
             metadata: ee,
             enabled_connections: ie,
             token_quota: ae,
-            ...Ge
+            ...Je
           } = m;
           return K({
-            ...Ge,
+            ...Je,
             branding: z(T, {}),
             metadata: z(ee, {}),
             enabled_connections: z(ie, []),
@@ -10953,8 +10986,8 @@ function s_(n) {
     }
   };
 }
-const Ri = ["s", "seacft", "seccft", "sepft", "sertft", "ssa"], l_ = ["pwd_leak", "signup_pwd_leak", "reset_pwd_leak"];
-function d_(n) {
+const Ri = ["s", "seacft", "seccft", "sepft", "sertft", "ssa"], d_ = ["pwd_leak", "signup_pwd_leak", "reset_pwd_leak"];
+function c_(n) {
   return {
     async getDaily(e, t) {
       const i = /* @__PURE__ */ new Date(), a = (t == null ? void 0 : t.from) || new Date(i.getTime() - 30 * 24 * 60 * 60 * 1e3).toISOString().split("T")[0], r = (t == null ? void 0 : t.to) || i.toISOString().split("T")[0];
@@ -10968,7 +11001,7 @@ function d_(n) {
           "signups"
         ),
         leaked_passwords: A`SUM(CASE WHEN ${Q.type} IN (${A.join(
-          l_.map((d) => A`${d}`),
+          d_.map((d) => A`${d}`),
           A`, `
         )}) THEN 1 ELSE 0 END)`.as("leaked_passwords")
       }).from(Q).where(
@@ -11011,7 +11044,7 @@ function Ui(n) {
     payload: z(n.payload, {})
   };
 }
-function c_(n) {
+function __(n) {
   return {
     async create(e, t) {
       const i = Ie(), a = (/* @__PURE__ */ new Date()).toISOString();
@@ -11153,10 +11186,10 @@ function c_(n) {
     }
   };
 }
-const __ = 7 * 24 * 60 * 60 * 1e3;
-function u_(n) {
+const u_ = 7 * 24 * 60 * 60 * 1e3;
+function p_(n) {
   return async (e) => {
-    const t = Date.now() - __;
+    const t = Date.now() - u_;
     try {
       let i = [
         Ue(
@@ -11169,13 +11202,13 @@ function u_(n) {
           Xe(oe.expires_at_ts, t),
           Xe(oe.idle_expires_at_ts, t)
         )
-      ], e != null && e.tenant_id && i.push(c(oe.tenant_id, e.tenant_id)), e != null && e.user_id && i.push(c(oe.user_id, e.user_id)), await n.delete(oe).where(g(...i)), i = [Xe(J.expires_at_ts, t)], e != null && e.tenant_id && i.push(c(J.tenant_id, e.tenant_id)), await n.delete(J).where(g(...i));
+      ], e != null && e.tenant_id && i.push(c(oe.tenant_id, e.tenant_id)), e != null && e.user_id && i.push(c(oe.user_id, e.user_id)), await n.delete(oe).where(g(...i)), i = [Xe(G.expires_at_ts, t)], e != null && e.tenant_id && i.push(c(G.tenant_id, e.tenant_id)), await n.delete(G).where(g(...i));
     } catch (i) {
       console.error("Session cleanup error:", i);
     }
   };
 }
-function h_(n, e = { useTransactions: !0 }) {
+function g_(n, e = { useTransactions: !0 }) {
   const t = {
     actions: $r(),
     branding: is(n),
@@ -11191,30 +11224,30 @@ function h_(n, e = { useTransactions: !0 }) {
     flows: kc(n),
     forms: Oc(n),
     hookCode: Ic(n),
-    hooks: Dc(n),
-    invites: Rc(n),
-    keys: Uc(n),
-    loginSessions: Fc(n),
-    logs: Pc(n),
-    authenticationMethods: qc(n),
-    organizations: $c(n),
-    passwords: jc(n),
-    promptSettings: Vc(n),
-    refreshTokens: Hc(n),
-    resourceServers: Qc(n),
+    hooks: Lc(n),
+    invites: Uc(n),
+    keys: zc(n),
+    loginSessions: Pc(n),
+    logs: Mc(n),
+    authenticationMethods: Bc(n),
+    organizations: jc(n),
+    passwords: Vc(n),
+    promptSettings: Zc(n),
+    refreshTokens: Kc(n),
+    resourceServers: Jc(n),
     rolePermissions: Gc(n),
-    userPermissions: Jc(n),
-    roles: Wc(n),
-    sessions: e_(n),
-    sessionCleanup: u_(n),
-    tenants: t_(n),
-    themes: i_(n),
-    universalLoginTemplates: a_(n),
-    users: o_(n),
-    userRoles: r_(n),
-    userOrganizations: s_(n),
-    stats: d_(n),
-    outbox: c_(n),
+    userPermissions: Wc(n),
+    roles: Xc(n),
+    sessions: t_(n),
+    sessionCleanup: p_(n),
+    tenants: n_(n),
+    themes: a_(n),
+    universalLoginTemplates: o_(n),
+    users: r_(n),
+    userRoles: s_(n),
+    userOrganizations: l_(n),
+    stats: c_(n),
+    outbox: __(n),
     async transaction(i) {
       if (e.useTransactions === !1)
         return i(t);
@@ -11230,6 +11263,6 @@ function h_(n, e = { useTransactions: !0 }) {
   return t;
 }
 export {
-  h_ as default,
-  f_ as sqlite
+  g_ as default,
+  h_ as sqlite
 };