@authhero/proxy 0.10.15 → 0.11.0

package/dist/proxy.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("@hono/zod-openapi"),t=require("hono");var n=e.z.object({created_at:e.z.string(),updated_at:e.z.string()}),r=e.z.object({id:e.z.string(),version:e.z.string().optional()}),i=e.z.object({name:e.z.string(),version:e.z.string()}),a=e.z.object({name:e.z.string(),value:e.z.string().optional()}),o=e.z.object({name:e.z.string().max(255),code:e.z.string().max(1e5),supported_triggers:e.z.array(r).optional(),runtime:e.z.string().max(50).optional(),dependencies:e.z.array(i).optional(),secrets:e.z.array(a).optional(),is_system:e.z.boolean().optional(),inherit:e.z.boolean().optional()});o.partial().extend({status:e.z.enum([`draft`,`built`]).optional(),deployed_at:e.z.string().optional()});var s=o.extend({id:e.z.string(),tenant_id:e.z.string(),status:e.z.enum([`draft`,`built`]).default(`built`),deployed_at:e.z.string().optional(),secrets:e.z.array(e.z.object({name:e.z.string(),value:e.z.string().optional()})).optional()}).extend(n.shape),c=e.z.object({name:e.z.string()});s.extend({secrets:e.z.array(c).optional()});var l=e.z.string(),u=e.z.enum([`unspecified`,`pending`,`final`,`partial`,`canceled`,`suspended`]),d=e.z.object({id:e.z.string(),msg:e.z.string(),url:e.z.string().optional()}),f=e.z.object({action_name:e.z.string(),error:d.nullable(),started_at:e.z.string(),ended_at:e.z.string()}),p=e.z.object({level:e.z.enum([`log`,`info`,`warn`,`error`,`debug`]),message:e.z.string()}),m=e.z.array(e.z.object({action_name:e.z.string(),lines:e.z.array(p)}));e.z.object({id:e.z.string(),tenant_id:e.z.string(),trigger_id:l,status:u,results:e.z.array(f),logs:m.optional(),created_at:e.z.string(),updated_at:e.z.string()}).omit({tenant_id:!0,created_at:!0,updated_at:!0}),e.z.object({action_id:e.z.string(),code:e.z.string().max(1e5),runtime:e.z.string().max(50).optional(),dependencies:e.z.array(i).optional(),secrets:e.z.array(a).optional(),supported_triggers:e.z.array(r).optional(),deployed:e.z.boolean().default(!0)}).extend({id:e.z.string(),tenant_id:e.z.string(),number:e.z.number().int()}).extend(n.shape);var h=e.z.enum([`user_action`,`admin_action`,`system`,`api`]),g=e.z.object({type:e.z.enum([`user`,`admin`,`system`,`api_key`,`client_credentials`]),id:e.z.string().optional(),email:e.z.string().optional(),org_id:e.z.string().optional(),org_name:e.z.string().optional(),scopes:e.z.array(e.z.string()).optional(),client_id:e.z.string().optional()}),_=e.z.object({type:e.z.string(),id:e.z.string(),before:e.z.record(e.z.string(),e.z.unknown()).optional(),after:e.z.record(e.z.string(),e.z.unknown()).optional(),diff:e.z.record(e.z.string(),e.z.object({old:e.z.unknown(),new:e.z.unknown()})).optional()}),v=e.z.object({method:e.z.string(),path:e.z.string(),query:e.z.record(e.z.string(),e.z.string()).optional(),body:e.z.unknown().optional(),ip:e.z.string(),user_agent:e.z.string().optional(),correlation_id:e.z.string().optional(),redirect_uri:e.z.string().optional()}),y=e.z.object({status_code:e.z.number(),body:e.z.unknown().optional()}),ee=e.z.object({country_code:e.z.string(),city_name:e.z.string(),latitude:e.z.string(),longitude:e.z.string(),time_zone:e.z.string(),continent_code:e.z.string()}),te=e.z.object({name:e.z.string(),version:e.z.string(),env:e.z.record(e.z.string(),e.z.string()).optional()});e.z.object({tenant_id:e.z.string(),event_type:e.z.string(),log_type:e.z.string(),description:e.z.string().optional(),category:h,actor:g,target:_,request:v,response:y.optional(),connection:e.z.string().optional(),connection_id:e.z.string().optional(),client_name:e.z.string().optional(),strategy:e.z.string().optional(),strategy_type:e.z.string().optional(),audience:e.z.string().optional(),scope:e.z.string().optional(),location:ee.optional(),auth0_client:te.optional(),hostname:e.z.string(),is_mobile:e.z.boolean().optional(),timestamp:e.z.string()}).extend({id:e.z.string()}),e.z.enum([`AUTH0`,`EMAIL`,`REDIRECT`]),e.z.enum([`CREATE_USER`,`GET_USER`,`UPDATE_USER`,`SEND_REQUEST`,`SEND_EMAIL`]),e.z.enum([`VERIFY_EMAIL`]);var ne=e.z.object({require_mx_record:e.z.boolean().optional(),block_aliases:e.z.boolean().optional(),block_free_emails:e.z.boolean().optional(),block_disposable_emails:e.z.boolean().optional(),blocklist:e.z.array(e.z.string()).optional(),allowlist:e.z.array(e.z.string()).optional()}),re=e.z.object({id:e.z.string(),alias:e.z.string().max(100).optional(),type:e.z.literal(`AUTH0`),action:e.z.literal(`UPDATE_USER`),allow_failure:e.z.boolean().optional(),mask_output:e.z.boolean().optional(),params:e.z.object({connection_id:e.z.string().optional(),user_id:e.z.string(),changes:e.z.record(e.z.string(),e.z.any())})}),ie=e.z.object({id:e.z.string(),alias:e.z.string().max(100).optional(),type:e.z.literal(`EMAIL`),action:e.z.literal(`VERIFY_EMAIL`),allow_failure:e.z.boolean().optional(),mask_output:e.z.boolean().optional(),params:e.z.object({email:e.z.string(),rules:ne.optional()})}),ae=e.z.enum([`change-email`,`account`,`custom`]),oe=e.z.object({id:e.z.string(),alias:e.z.string().max(100).optional(),type:e.z.literal(`REDIRECT`),action:e.z.literal(`REDIRECT_USER`),allow_failure:e.z.boolean().optional(),mask_output:e.z.boolean().optional(),params:e.z.object({target:ae.openapi({description:`The predefined target to redirect to, or 'custom' for a custom URL`}),custom_url:e.z.string().optional().openapi({description:`Custom URL to redirect to when target is 'custom'`})})}),se=e.z.union([re,ie,oe]);e.z.object({name:e.z.string().min(1).max(150).openapi({description:`The name of the flow`}),actions:e.z.array(se).optional().default([]).openapi({description:`The list of actions to execute in sequence`})}).extend(n.shape).extend({id:e.z.string().openapi({description:`Unique identifier for the flow`,example:`af_12tMpdJ3iek7svMyZkSh5M`})}),e.z.object({page:e.z.string().min(0).optional().default(`0`).transform(e=>parseInt(e,10)).openapi({description:`The page number where 0 is the first page`}),per_page:e.z.string().min(1).optional().default(`50`).transform(e=>parseInt(e,10)).openapi({description:`The number of items per page. Defaults to 50.`}),include_totals:e.z.string().optional().default(`false`).transform(e=>e===`true`).openapi({description:`If the total number of items should be included in the response`}),sort:e.z.string().regex(/^.+:(-1|1)$/).optional().openapi({description:`A property that should have the format 'string:-1' or 'string:1'`}),q:e.z.string().optional().openapi({description:`A lucene query string used to filter the results`})}),e.z.object({start:e.z.number(),limit:e.z.number(),length:e.z.number(),total:e.z.number().optional(),next:e.z.string().optional()});var ce=e.z.object({email:e.z.string().optional(),email_verified:e.z.boolean().optional(),name:e.z.string().optional(),username:e.z.string().optional(),given_name:e.z.string().optional(),phone_number:e.z.string().optional(),phone_verified:e.z.boolean().optional(),family_name:e.z.string().optional()}).catchall(e.z.any()),le=e.z.object({connection:e.z.string(),user_id:e.z.string(),provider:e.z.string(),isSocial:e.z.boolean(),email:e.z.string().optional(),email_verified:e.z.boolean().optional(),phone_number:e.z.string().optional(),phone_verified:e.z.boolean().optional(),username:e.z.string().optional(),access_token:e.z.string().optional(),access_token_secret:e.z.string().optional(),refresh_token:e.z.string().optional(),profileData:ce.optional()}),ue=e.z.object({formatted:e.z.string().optional(),street_address:e.z.string().optional(),locality:e.z.string().optional(),region:e.z.string().optional(),postal_code:e.z.string().optional(),country:e.z.string().optional()}).optional(),de=e.z.object({email:e.z.string().transform(e=>e.toLowerCase()).optional(),username:e.z.string().refine(e=>!e.includes(`@`),{message:`Usernames must not contain "@". Use the email field for email addresses.`}).optional(),phone_number:e.z.string().optional(),phone_verified:e.z.boolean().optional(),given_name:e.z.string().optional(),family_name:e.z.string().optional(),nickname:e.z.string().optional(),name:e.z.string().optional(),picture:e.z.string().optional(),locale:e.z.string().optional(),linked_to:e.z.string().optional(),profileData:e.z.string().optional(),user_id:e.z.string().optional(),app_metadata:e.z.any().default({}).optional(),user_metadata:e.z.any().default({}).optional(),middle_name:e.z.string().optional(),preferred_username:e.z.string().optional(),profile:e.z.string().optional(),website:e.z.string().optional(),gender:e.z.string().optional(),birthdate:e.z.string().optional(),zoneinfo:e.z.string().optional(),address:ue});de.extend({email_verified:e.z.boolean().default(!1),verify_email:e.z.boolean().optional(),last_ip:e.z.string().optional(),last_login:e.z.string().optional(),user_id:e.z.string().optional(),provider:e.z.string().optional(),connection:e.z.string(),is_social:e.z.boolean().optional(),blocked:e.z.boolean().optional(),registration_completed_at:e.z.string().optional(),password:e.z.object({hash:e.z.string(),algorithm:e.z.string()}).optional()}).omit({password:!0}).extend(n.shape).extend({user_id:e.z.string(),provider:e.z.string(),is_social:e.z.boolean(),email:e.z.string().optional(),login_count:e.z.number().default(0),identities:e.z.array(le).optional()}).omit({registration_completed_at:!0}),de.extend({login_count:e.z.number(),multifactor:e.z.array(e.z.string()).optional(),last_ip:e.z.string().optional(),last_login:e.z.string().optional(),user_id:e.z.string()}).catchall(e.z.any());var fe=`useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict`,pe=(e=21)=>{let t=``,n=crypto.getRandomValues(new Uint8Array(e|=0));for(;e--;)t+=fe[n[e]&63];return t},me=e.z.object({client_id:e.z.string().optional().openapi({description:`ID of this client. Generated server-side if omitted (Auth0 behavior).`}),name:e.z.string().min(1).openapi({description:`Name of this client (min length: 1 character, does not allow < or >).`}),description:e.z.string().max(140).optional().openapi({description:`Free text description of this client (max length: 140 characters).`}),global:e.z.boolean().default(!1).openapi({description:`Whether this is your global 'All Applications' client representing legacy tenant settings (true) or a regular client (false).`}),client_secret:e.z.string().default(()=>pe()).optional().openapi({description:`Client secret (which you must not make public).`}),app_type:e.z.enum([`native`,`spa`,`regular_web`,`non_interactive`,`resource_server`,`express_configuration`,`rms`,`box`,`cloudbees`,`concur`,`dropbox`,`mscrm`,`echosign`,`egnyte`,`newrelic`,`office365`,`salesforce`,`sentry`,`sharepoint`,`slack`,`springcm`,`zendesk`,`zoom`,`sso_integration`,`oag`]).default(`regular_web`).optional().openapi({description:`The type of application this client represents`}),logo_uri:e.z.string().url().optional().openapi({description:`URL of the logo to display for this client. Recommended size is 150x150 pixels.`}),is_first_party:e.z.boolean().default(!0).openapi({description:`Whether this client is a first party client (true) or not (false). First-party clients skip the consent screen; third-party clients require explicit user consent for non-basic scopes.`}),oidc_conformant:e.z.boolean().default(!0).openapi({description:`Whether this client conforms to strict OIDC specifications (true) or uses legacy features (false).`}),auth0_conformant:e.z.boolean().default(!0).openapi({description:`Whether this client follows Auth0-compatible behavior (true) or strict OIDC behavior (false). When true, profile/email claims are included in the ID token when scopes are requested. When false, these claims are only available from the userinfo endpoint (strict OIDC 5.4 compliance).`}),callbacks:e.z.array(e.z.string()).default([]).optional().openapi({description:`Comma-separated list of URLs whitelisted for Auth0 to use as a callback to the client after authentication.`}),allowed_origins:e.z.array(e.z.string()).default([]).optional().openapi({description:`Comma-separated list of URLs allowed to make requests from JavaScript to Auth0 API (typically used with CORS). By default, all your callback URLs will be allowed. This field allows you to enter other origins if necessary. You can also use wildcards at the subdomain level (e.g., https://*.contoso.com). Query strings and hash information are not taken into account when validating these URLs.`}),web_origins:e.z.array(e.z.string()).default([]).optional().openapi({description:`Comma-separated list of allowed origins for use with Cross-Origin Authentication, Device Flow, and web message response mode.`}),client_aliases:e.z.array(e.z.string()).default([]).optional().openapi({description:`List of audiences/realms for SAML protocol. Used by the wsfed addon.`}),allowed_clients:e.z.array(e.z.string()).default([]).optional().openapi({description:`List of allow clients and API ids that are allowed to make delegation requests. Empty means all all your clients are allowed.`}),connections:e.z.array(e.z.string()).default([]).optional().openapi({description:`List of connection IDs enabled for this client. The order determines the display order on the login page.`}),allowed_logout_urls:e.z.array(e.z.string()).default([]).optional().openapi({description:`Comma-separated list of URLs that are valid to redirect to after logout from Auth0. Wildcards are allowed for subdomains.`}),session_transfer:e.z.record(e.z.string(),e.z.any()).default({}).optional().openapi({description:`Native to Web SSO Configuration`}),oidc_logout:e.z.object({backchannel_logout_urls:e.z.array(e.z.string()).optional().openapi({description:`URLs that receive a signed OIDC Back-Channel Logout 1.0 logout token when a session this client participated in ends.`}),backchannel_logout_initiators:e.z.object({mode:e.z.enum([`all`,`custom`]).optional().openapi({description:`Whether all session-end events initiate a backchannel logout (all) or only the selected_initiators (custom).`}),selected_initiators:e.z.array(e.z.string()).optional().openapi({description:`Logout initiators that trigger a backchannel logout when mode is custom (e.g. rp-logout, idp-logout, password-changed).`})}).passthrough().optional().openapi({description:`Controls which session-end events initiate backchannel logout notifications. Stored for Auth0 compatibility; not yet enforced — all initiators currently notify.`})}).passthrough().default({}).optional().openapi({description:`Configuration for OIDC backchannel logout`}),grant_types:e.z.array(e.z.string()).default([]).optional().openapi({description:`List of grant types supported for this application. Can include authorization_code, implicit, refresh_token, client_credentials, password, http://auth0.com/oauth/grant-type/password-realm, http://auth0.com/oauth/grant-type/mfa-oob, http://auth0.com/oauth/grant-type/mfa-otp, http://auth0.com/oauth/grant-type/mfa-recovery-code, urn:openid:params:grant-type:ciba, and urn:ietf:params:oauth:grant-type:device_code.`}),jwt_configuration:e.z.record(e.z.string(),e.z.any()).default({}).optional().openapi({description:`Configuration related to JWTs for the client.`}),signing_keys:e.z.array(e.z.record(e.z.string(),e.z.any())).default([]).optional().openapi({description:`Signing certificates associated with this client.`}),encryption_key:e.z.record(e.z.string(),e.z.any()).default({}).optional().openapi({description:`Encryption used for WsFed responses with this client.`}),sso:e.z.boolean().default(!1).openapi({description:`Applies only to SSO clients and determines whether Auth0 will handle Single Sign On (true) or whether the Identity Provider will (false).`}),sso_disabled:e.z.boolean().default(!1).openapi({description:`Whether Single Sign On is disabled for this client. When true, existing SSO sessions will not be reused and users must authenticate every time.`}),cross_origin_authentication:e.z.boolean().default(!1).openapi({description:`Whether this client can be used to make cross-origin authentication requests (true) or it is not allowed to make such requests (false).`}),cross_origin_loc:e.z.string().url().optional().openapi({description:`URL of the location in your site where the cross origin verification takes place for the cross-origin auth flow when performing Auth in your own domain instead of Auth0 hosted login page.`}),custom_login_page_on:e.z.boolean().default(!1).openapi({description:`Whether a custom login page is to be used (true) or the default provided login page (false).`}),custom_login_page:e.z.string().optional().openapi({description:`The content (HTML, CSS, JS) of the custom login page.`}),custom_login_page_preview:e.z.string().optional().openapi({description:`The content (HTML, CSS, JS) of the custom login page. (Used on Previews)`}),form_template:e.z.string().optional().openapi({description:`HTML form template to be used for WS-Federation.`}),addons:e.z.record(e.z.string(),e.z.any()).default({}).optional().openapi({description:`Addons enabled for this client and their associated configurations.`}),token_endpoint_auth_method:e.z.enum([`none`,`client_secret_post`,`client_secret_basic`,`client_secret_jwt`,`private_key_jwt`]).default(`client_secret_basic`).optional().openapi({description:"Defines the requested authentication method for the token endpoint. `none` (public client), `client_secret_post` / `client_secret_basic` (HTTP POST / Basic), `client_secret_jwt` (RFC 7523 HMAC assertion using client_secret), or `private_key_jwt` (RFC 7523 asymmetric assertion verified against the client's `jwks` / `jwks_uri`)."}),client_metadata:e.z.record(e.z.string(),e.z.string().max(255)).default({}).optional().openapi({description:`Metadata associated with the client, in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. Field names (max 255 chars) are alphanumeric and may only include the following special characters: :,-+=_*?"/()<>@ [Tab][Space]`}),hide_sign_up_disabled_error:e.z.boolean().default(!1).optional().openapi({description:"Enumeration-safe variant of the connection-level `disable_signup` flag. When a signup is blocked by the password connection and this is true, the identifier screen does not reveal that an email is unknown — it advances to the OTP/password challenge as if the account existed and fails at credential check. Mitigates email enumeration at the cost of UX: users without an account see a generic credential failure instead of an explicit signup-disabled message."}),mobile:e.z.record(e.z.string(),e.z.any()).default({}).optional().openapi({description:`Additional configuration for native mobile apps.`}),initiate_login_uri:e.z.string().url().optional().openapi({description:`Initiate login uri, must be https`}),native_social_login:e.z.record(e.z.string(),e.z.any()).default({}).optional(),refresh_token:e.z.object({rotation_type:e.z.enum([`rotating`,`non-rotating`]).optional().openapi({description:`Whether refresh tokens for this client are rotated on every exchange (Auth0 'rotating' behavior) or kept stable (legacy non-rotating). Defaults to 'non-rotating' when unset.`}),leeway:e.z.number().int().min(0).max(600).optional().openapi({description:`Seconds after a parent token's first rotation during which presenting it again still mints a fresh sibling child instead of triggering reuse-detection. Defaults to 30s when unset.`}),expiration_type:e.z.enum([`expiring`,`non-expiring`]).optional().openapi({description:`Whether refresh tokens for this client expire at all. 'non-expiring' overrides both the absolute and the idle lifetime.`}),token_lifetime:e.z.number().int().min(0).optional().openapi({description:"Refresh-token absolute lifetime in seconds. Falls back to the tenant's `session_lifetime` when unset."}),infinite_token_lifetime:e.z.boolean().optional().openapi({description:"When true, refresh tokens have no absolute expiry (overrides `token_lifetime`)."}),idle_token_lifetime:e.z.number().int().min(0).optional().openapi({description:"Refresh-token idle (sliding) lifetime in seconds, refreshed on every exchange. Falls back to the tenant's `idle_session_lifetime` when unset."}),infinite_idle_token_lifetime:e.z.boolean().optional().openapi({description:"When true, refresh tokens have no idle expiry (overrides `idle_token_lifetime`)."})}).default({}).optional().openapi({description:`Refresh token configuration`}),default_organization:e.z.record(e.z.string(),e.z.any()).default({}).optional().openapi({description:`Defines the default Organization ID and flows`}),organization_usage:e.z.enum([`deny`,`allow`,`require`]).default(`deny`).optional().openapi({description:`Defines how to proceed during an authentication transaction with regards an organization. Can be deny (default), allow or require.`}),organization_require_behavior:e.z.enum([`no_prompt`,`pre_login_prompt`,`post_login_prompt`]).default(`no_prompt`).optional().openapi({description:`Defines how to proceed during an authentication transaction when client.organization_usage: 'require'. Can be no_prompt (default), pre_login_prompt or post_login_prompt. post_login_prompt requires oidc_conformant: true.`}),client_authentication_methods:e.z.record(e.z.string(),e.z.any()).default({}).optional().openapi({description:`Defines client authentication methods.`}),require_pushed_authorization_requests:e.z.boolean().default(!1).openapi({description:`Makes the use of Pushed Authorization Requests mandatory for this client`}),require_proof_of_possession:e.z.boolean().default(!1).openapi({description:`Makes the use of Proof-of-Possession mandatory for this client`}),signed_request_object:e.z.record(e.z.string(),e.z.any()).default({}).optional().openapi({description:`JWT-secured Authorization Requests (JAR) settings.`}),compliance_level:e.z.enum([`none`,`fapi1_adv_pkj_par`,`fapi1_adv_mtls_par`,`fapi2_sp_pkj_mtls`,`fapi2_sp_mtls_mtls`]).optional().openapi({description:`Defines the compliance level for this client, which may restrict it's capabilities`}),par_request_expiry:e.z.number().optional().openapi({description:`Specifies how long, in seconds, a Pushed Authorization Request URI remains valid`}),token_quota:e.z.record(e.z.string(),e.z.any()).default({}).optional(),owner_user_id:e.z.string().optional().openapi({description:`User ID of the consenting user when this client was created via IAT-gated Dynamic Client Registration. NULL for clients created via the Management API or open DCR.`}),registration_type:e.z.enum([`manual`,`open_dcr`,`iat_dcr`]).optional().openapi({description:"Provenance of this client. `manual` = Management API; `open_dcr` = RFC 7591 without IAT; `iat_dcr` = RFC 7591 with an Initial Access Token."}),registration_metadata:e.z.record(e.z.string(),e.z.any()).default({}).optional().openapi({description:"Arbitrary metadata captured at Dynamic Client Registration time that isn't a first-class client field (e.g. integration_type, domain). Also stores `iat_constraints` for clients created via IAT so RFC 7592 PUT can enforce field immutability."}),user_linking_mode:e.z.enum([`builtin`,`off`]).optional().openapi({description:"Per-client override for the built-in email-based user-linking path. `builtin` runs the legacy in-process linking at user creation/email update. `off` disables the legacy path; linking only happens if the tenant has enabled the `account-linking` template hook. When unset, the service-level `userLinkingMode` default applies."})});e.z.object({created_at:e.z.string(),updated_at:e.z.string()}).extend(me.shape).extend({client_id:e.z.string()});var he=e.z.object({client_id:e.z.string().min(1).openapi({description:`ID of the client.`}),audience:e.z.string().min(1).openapi({description:`The audience (API identifier) of this client grant.`}),scope:e.z.array(e.z.string()).optional().openapi({description:`Scopes allowed for this client grant.`}),organization_usage:e.z.enum([`deny`,`allow`,`require`]).optional().openapi({description:`Defines whether organizations can be used with client credentials exchanges for this grant.`}),allow_any_organization:e.z.boolean().optional().openapi({description:`If enabled, any organization can be used with this grant. If disabled (default), the grant must be explicitly assigned to the desired organizations.`}),is_system:e.z.boolean().optional().openapi({description:`If enabled, this grant is a special grant created by Auth0. It cannot be modified or deleted directly.`}),subject_type:e.z.enum([`client`,`user`]).optional().openapi({description:`The type of application access the client grant allows. Use of this field is subject to the applicable Free Trial terms in Okta's Master Subscription Agreement.`}),authorization_details_types:e.z.array(e.z.string()).optional().openapi({description:`Types of authorization_details allowed for this client grant. Use of this field is subject to the applicable Free Trial terms in Okta's Master Subscription Agreement.`})}),ge=e.z.object({id:e.z.string().openapi({description:`ID of the client grant.`})}).extend(he.shape).extend({created_at:e.z.string().optional(),updated_at:e.z.string().optional()});e.z.array(ge);var _e=e.z.enum([`iat`,`rat`]),ve=e.z.object({id:e.z.string(),token_hash:e.z.string(),type:_e,client_id:e.z.string().optional(),sub:e.z.string().optional(),constraints:e.z.record(e.z.string(),e.z.unknown()).optional(),single_use:e.z.boolean().default(!1),expires_at:e.z.string().optional()});e.z.object({created_at:e.z.string(),used_at:e.z.string().optional(),revoked_at:e.z.string().optional()}).extend(ve.shape);var b=e.z.object({x:e.z.number(),y:e.z.number()}),ye=function(e){return e.RICH_TEXT=`RICH_TEXT`,e.NEXT_BUTTON=`NEXT_BUTTON`,e.BACK_BUTTON=`BACK_BUTTON`,e.SUBMIT_BUTTON=`SUBMIT_BUTTON`,e.DIVIDER=`DIVIDER`,e.TEXT=`TEXT`,e.EMAIL=`EMAIL`,e.PASSWORD=`PASSWORD`,e.NUMBER=`NUMBER`,e.PHONE=`PHONE`,e.DATE=`DATE`,e.CHECKBOX=`CHECKBOX`,e.RADIO=`RADIO`,e.SELECT=`SELECT`,e.HIDDEN=`HIDDEN`,e.LEGAL=`LEGAL`,e}({}),be=function(e){return e.BLOCK=`BLOCK`,e.FIELD=`FIELD`,e}({}),x=e.z.object({id:e.z.string(),category:e.z.nativeEnum(be),type:e.z.nativeEnum(ye)}),xe=x.extend({category:e.z.literal(`BLOCK`),type:e.z.literal(`RICH_TEXT`),config:e.z.object({content:e.z.string()}).passthrough()}),Se=x.extend({category:e.z.literal(`BLOCK`),type:e.z.union([e.z.literal(`NEXT_BUTTON`),e.z.literal(`BACK_BUTTON`),e.z.literal(`SUBMIT_BUTTON`)]),config:e.z.object({text:e.z.string()}).passthrough()}),Ce=x.extend({category:e.z.literal(`FIELD`),type:e.z.literal(`LEGAL`),required:e.z.boolean().optional(),sensitive:e.z.boolean().optional(),config:e.z.object({text:e.z.string()}).passthrough()}),we=x.extend({category:e.z.literal(`FIELD`),type:e.z.union([e.z.literal(`TEXT`),e.z.literal(`EMAIL`),e.z.literal(`PASSWORD`),e.z.literal(`NUMBER`),e.z.literal(`PHONE`),e.z.literal(`DATE`),e.z.literal(`CHECKBOX`),e.z.literal(`RADIO`),e.z.literal(`SELECT`),e.z.literal(`HIDDEN`)]),required:e.z.boolean().optional(),sensitive:e.z.boolean().optional(),config:e.z.object({label:e.z.string().optional(),placeholder:e.z.string().optional()}).passthrough()}),Te=e.z.object({id:e.z.string(),category:e.z.string(),type:e.z.string()}).passthrough(),Ee=e.z.union([xe,Se,Ce,we,Te]),De=e.z.object({id:e.z.string(),type:e.z.literal(`STEP`),coordinates:b,alias:e.z.string().optional(),config:e.z.object({components:e.z.array(Ee),next_node:e.z.string()}).passthrough()}),Oe=e.z.object({id:e.z.string(),type:e.z.literal(`FLOW`),coordinates:b,alias:e.z.string().optional(),config:e.z.object({flow_id:e.z.string(),next_node:e.z.string()})}),ke=e.z.object({id:e.z.string(),type:e.z.literal(`ACTION`),coordinates:b,alias:e.z.string().optional(),config:e.z.object({action_type:e.z.enum([`REDIRECT`]).openapi({description:`The type of action to perform`}),target:e.z.enum([`change-email`,`account`,`custom`]).openapi({description:`The predefined target to redirect to`}),custom_url:e.z.string().optional().openapi({description:`Custom URL when target is 'custom'`}),next_node:e.z.string().openapi({description:`The next node to navigate to after action (for non-redirect actions)`})}).passthrough()}),Ae=e.z.object({id:e.z.string(),type:e.z.string(),coordinates:b}).passthrough(),je=e.z.union([De,Oe,ke,Ae]),Me=e.z.object({next_node:e.z.string(),coordinates:b}).passthrough(),Ne=e.z.object({resume_flow:e.z.boolean().optional(),coordinates:b}).passthrough();e.z.object({id:e.z.string(),name:e.z.string(),languages:e.z.object({primary:e.z.string()}).passthrough(),nodes:e.z.array(je),start:Me,ending:Ne,created_at:e.z.string(),updated_at:e.z.string(),links:e.z.object({sdkSrc:e.z.string().optional(),sdk_src:e.z.string().optional()}).passthrough()}).passthrough().omit({id:!0,created_at:!0,updated_at:!0});var S=function(e){return e.TOKEN=`token`,e.ID_TOKEN=`id_token`,e.TOKEN_ID_TOKEN=`id_token token`,e.CODE=`code`,e.CODE_ID_TOKEN=`code id_token`,e.CODE_TOKEN=`code token`,e.CODE_ID_TOKEN_TOKEN=`code id_token token`,e}({}),Pe=function(e){return e.QUERY=`query`,e.FRAGMENT=`fragment`,e.FORM_POST=`form_post`,e.WEB_MESSAGE=`web_message`,e.SAML_POST=`saml_post`,e}({}),Fe=function(e){return e.S256=`S256`,e.Plain=`plain`,e}({}),Ie=e.z.union([e.z.null(),e.z.object({essential:e.z.boolean().optional(),value:e.z.unknown().optional(),values:e.z.array(e.z.unknown()).optional()})]).nullable(),Le=e.z.object({userinfo:e.z.record(e.z.string(),Ie).optional(),id_token:e.z.record(e.z.string(),Ie).optional()}),Re=e.z.object({client_id:e.z.string(),act_as:e.z.string().optional(),response_type:e.z.nativeEnum(S).optional(),response_mode:e.z.nativeEnum(Pe).optional(),redirect_uri:e.z.string().optional(),audience:e.z.string().optional(),organization:e.z.string().optional(),state:e.z.string().optional(),nonce:e.z.string().optional(),scope:e.z.string().optional(),prompt:e.z.string().optional(),code_challenge_method:e.z.nativeEnum(Fe).optional(),code_challenge:e.z.string().optional(),username:e.z.string().optional(),ui_locales:e.z.string().optional(),max_age:e.z.number().optional(),acr_values:e.z.string().optional(),claims:Le.optional(),vendor_id:e.z.string().optional()});e.z.object({colors:e.z.object({primary:e.z.string(),page_background:e.z.union([e.z.string(),e.z.object({type:e.z.string().optional(),start:e.z.string().optional(),end:e.z.string().optional(),angle_deg:e.z.number().optional()})]).optional()}).optional(),logo_url:e.z.string().optional(),favicon_url:e.z.string().optional(),powered_by_logo_url:e.z.string().optional(),font:e.z.object({url:e.z.string()}).optional(),dark_mode:e.z.enum([`dark`,`light`,`auto`]).optional()});var ze=e.z.enum([`password_reset`,`email_verification`,`otp`,`mfa_otp`,`authorization_code`,`oauth2_state`,`ticket`,`client_assertion_jti`]);e.z.object({code_id:e.z.string().openapi({description:`The code that will be used in for instance an email verification flow`}),login_id:e.z.string().optional().openapi({description:`The id of the login session that the code is connected to`}),connection_id:e.z.string().optional().openapi({description:`The connection that the code is connected to`}),code_type:ze,code_verifier:e.z.string().optional().openapi({description:`The code verifier used in PKCE in outbound flows`}),code_challenge:e.z.string().optional().openapi({description:`The code challenge used in PKCE in outbound flows`}),code_challenge_method:e.z.enum([`plain`,`S256`]).optional().openapi({description:`The code challenge method used in PKCE in outbound flows`}),redirect_uri:e.z.string().optional().openapi({description:`The redirect URI associated with the code`}),otp:e.z.string().optional().openapi({description:`The one-time password value for OTP-based flows`}),nonce:e.z.string().optional().openapi({description:`The nonce value used for security in OIDC flows`}),state:e.z.string().optional().openapi({description:`The state parameter used for CSRF protection in OAuth flows`}),expires_at:e.z.string(),used_at:e.z.string().optional(),user_id:e.z.string().optional()}).extend({created_at:e.z.string()});var Be=e.z.object({kid:e.z.string().optional(),team_id:e.z.string().optional(),realms:e.z.string().optional(),authentication_method:e.z.string().optional(),client_id:e.z.string().optional(),client_secret:e.z.string().optional(),app_secret:e.z.string().optional(),scope:e.z.string().optional(),client_secret_hint:e.z.string().optional(),app_secret_hint:e.z.string().optional(),twilio_token_hint:e.z.string().optional(),authorization_endpoint:e.z.string().optional(),token_endpoint:e.z.string().optional(),userinfo_endpoint:e.z.string().optional(),jwks_uri:e.z.string().optional(),discovery_url:e.z.string().optional(),issuer:e.z.string().optional(),token_endpoint_auth_method:e.z.enum([`client_secret_basic`,`client_secret_post`]).optional(),provider:e.z.string().optional(),from:e.z.string().optional(),twilio_sid:e.z.string().optional(),twilio_token:e.z.string().optional(),icon_url:e.z.string().optional(),domain_aliases:e.z.array(e.z.string()).optional(),callback_url:e.z.string().url().optional(),passwordPolicy:e.z.enum([`none`,`low`,`fair`,`good`,`excellent`]).optional(),password_complexity_options:e.z.object({min_length:e.z.number().optional()}).optional(),password_history:e.z.object({enable:e.z.boolean().optional(),size:e.z.number().optional()}).optional(),password_no_personal_info:e.z.object({enable:e.z.boolean().optional()}).optional(),password_dictionary:e.z.object({enable:e.z.boolean().optional(),dictionary:e.z.array(e.z.string()).optional()}).optional(),disable_signup:e.z.boolean().optional(),brute_force_protection:e.z.boolean().optional(),import_mode:e.z.boolean().optional(),configuration:e.z.object({token_endpoint:e.z.string().optional(),userinfo_endpoint:e.z.string().optional(),client_id:e.z.string().optional(),client_secret:e.z.string().optional(),client_secret_hint:e.z.string().optional(),realm:e.z.string().optional()}).optional(),attributes:e.z.object({email:e.z.object({identifier:e.z.object({active:e.z.boolean().optional()}).optional(),signup:e.z.object({status:e.z.enum([`required`,`optional`,`disabled`]).optional(),verification:e.z.object({active:e.z.boolean().optional()}).optional()}).optional(),validation:e.z.object({allowed:e.z.boolean().optional()}).optional(),unique:e.z.boolean().optional(),profile_required:e.z.boolean().optional(),verification_method:e.z.enum([`link`,`code`]).optional()}).optional(),username:e.z.object({identifier:e.z.object({active:e.z.boolean().optional()}).optional(),signup:e.z.object({status:e.z.enum([`required`,`optional`,`disabled`]).optional()}).optional(),validation:e.z.object({max_length:e.z.number().optional(),min_length:e.z.number().optional(),allowed_types:e.z.object({email:e.z.boolean().optional(),phone_number:e.z.boolean().optional()}).optional()}).optional(),profile_required:e.z.boolean().optional()}).optional(),phone_number:e.z.object({identifier:e.z.object({active:e.z.boolean().optional()}).optional(),signup:e.z.object({status:e.z.enum([`required`,`optional`,`disabled`]).optional()}).optional()}).optional()}).optional(),authentication_methods:e.z.object({password:e.z.object({enabled:e.z.boolean().optional()}).optional(),passkey:e.z.object({enabled:e.z.boolean().optional()}).optional()}).optional(),passkey_options:e.z.object({challenge_ui:e.z.enum([`both`,`autofill`,`button`]).optional(),local_enrollment_enabled:e.z.boolean().optional(),progressive_enrollment_enabled:e.z.boolean().optional()}).optional(),requires_username:e.z.boolean().optional(),validation:e.z.object({username:e.z.object({min:e.z.number().optional(),max:e.z.number().optional()}).optional()}).optional(),set_user_root_attributes:e.z.enum([`on_each_login`,`on_first_login`,`never_on_login`]).optional()});function C(e){if(e!==null){if(Array.isArray(e))return e.filter(e=>e!==null).map(C);if(e&&typeof e==`object`){let t={};for(let[n,r]of Object.entries(e))r!==null&&(t[n]=C(r));return t}return e}}var Ve=e.z.object({id:e.z.string().optional(),name:e.z.string(),display_name:e.z.string().optional(),strategy:e.z.string(),options:e.z.preprocess(e=>e===null?{}:C(e),Be).default({}),enabled_clients:e.z.array(e.z.string()).default([]).optional(),response_type:e.z.nativeEnum(S).optional(),response_mode:e.z.nativeEnum(Pe).optional(),is_domain_connection:e.z.boolean().optional(),show_as_button:e.z.boolean().optional(),metadata:e.z.record(e.z.string(),e.z.any()).optional(),is_system:e.z.boolean().optional()});e.z.object({id:e.z.string(),created_at:e.z.string().transform(e=>e===null?``:e),updated_at:e.z.string().transform(e=>e===null?``:e)}).extend(Ve.shape);var w=e.z.object({domain:e.z.string(),custom_domain_id:e.z.string().optional(),type:e.z.enum([`auth0_managed_certs`,`self_managed_certs`]),verification_method:e.z.enum([`txt`]).optional(),tls_policy:e.z.enum([`recommended`]).optional(),custom_client_ip_header:e.z.enum([`true-client-ip`,`cf-connecting-ip`,`x-forwarded-for`,`x-azure-clientip`,`null`]).optional(),domain_metadata:e.z.record(e.z.string(),e.z.string().max(255)).optional()}),He=e.z.discriminatedUnion(`name`,[e.z.object({name:e.z.literal(`txt`),record:e.z.string(),domain:e.z.string()}),e.z.object({name:e.z.literal(`http`),http_body:e.z.string(),http_url:e.z.string()})]),Ue=w.extend({custom_domain_id:e.z.string(),primary:e.z.boolean(),status:e.z.enum([`disabled`,`pending`,`pending_verification`,`ready`]),origin_domain_name:e.z.string().optional(),verification:e.z.object({methods:e.z.array(He)}).optional(),tls_policy:e.z.string().optional()});w.pick({tls_policy:!0,custom_client_ip_header:!0,domain_metadata:!0}).strict(),Ue.extend({tenant_id:e.z.string()}),e.z.object({certificate:e.z.string().regex(/^-----BEGIN CERTIFICATE-----[\s\S]+-----END CERTIFICATE-----\s*$/,`must be PEM-encoded; include the full certificate chain in leaf-first order`),private_key:e.z.string().regex(/-----BEGIN (RSA |EC |ENCRYPTED )?PRIVATE KEY-----[\s\S]+-----END \1PRIVATE KEY-----\s*$/,`must be a PEM-encoded private key`)});var T=e.z.object({id:e.z.string(),order:e.z.number().optional(),visible:e.z.boolean().optional().default(!0)}),E=T.extend({category:e.z.literal(`BLOCK`).optional()}),We=E.extend({type:e.z.literal(`DIVIDER`),config:e.z.object({text:e.z.string().optional()}).optional()}),Ge=E.extend({type:e.z.literal(`HTML`),config:e.z.object({content:e.z.string().optional()}).optional()}),Ke=E.extend({type:e.z.literal(`IMAGE`),config:e.z.object({src:e.z.string().optional(),alt:e.z.string().optional(),width:e.z.number().optional(),height:e.z.number().optional()}).optional()}),qe=E.extend({type:e.z.literal(`JUMP_BUTTON`),config:e.z.object({text:e.z.string().optional(),target_step:e.z.string().optional()})}),Je=E.extend({type:e.z.literal(`RESEND_BUTTON`),config:e.z.object({text:e.z.string().optional(),resend_action:e.z.string().optional()})}),Ye=E.extend({type:e.z.literal(`NEXT_BUTTON`),config:e.z.object({text:e.z.string().optional()})}),Xe=E.extend({type:e.z.literal(`PREVIOUS_BUTTON`),config:e.z.object({text:e.z.string().optional()})}),Ze=E.extend({type:e.z.literal(`RICH_TEXT`),config:e.z.object({content:e.z.string().optional()}).optional()}),D=T.extend({category:e.z.literal(`WIDGET`).optional(),label:e.z.string().min(1).optional(),hint:e.z.string().min(1).max(500).optional(),required:e.z.boolean().optional(),sensitive:e.z.boolean().optional()}),Qe=D.extend({type:e.z.literal(`AUTH0_VERIFIABLE_CREDENTIALS`),config:e.z.object({credential_type:e.z.string().optional()})}),$e=D.extend({type:e.z.literal(`GMAPS_ADDRESS`),config:e.z.object({api_key:e.z.string().optional()})}),et=D.extend({type:e.z.literal(`RECAPTCHA`),config:e.z.object({site_key:e.z.string().optional()})}),O=T.extend({category:e.z.literal(`FIELD`).optional(),label:e.z.string().min(1).optional(),hint:e.z.string().min(1).max(500).optional(),messages:e.z.array(e.z.object({id:e.z.number().optional(),text:e.z.string(),type:e.z.enum([`info`,`error`,`success`,`warning`])})).optional(),required:e.z.boolean().optional(),sensitive:e.z.boolean().optional()}),tt=O.extend({type:e.z.literal(`BOOLEAN`),config:e.z.object({default_value:e.z.boolean().optional()}).optional()}),nt=O.extend({type:e.z.literal(`CARDS`),config:e.z.object({options:e.z.array(e.z.object({value:e.z.string(),label:e.z.string(),description:e.z.string().optional(),image:e.z.string().optional()})).optional(),multi_select:e.z.boolean().optional()}).optional()}),rt=O.extend({type:e.z.literal(`CHOICE`),config:e.z.object({options:e.z.array(e.z.object({value:e.z.string(),label:e.z.string()})).optional(),display:e.z.enum([`radio`,`checkbox`]).optional(),multiple:e.z.boolean().optional(),default_value:e.z.union([e.z.string(),e.z.array(e.z.string())]).optional()}).optional()}),it=O.extend({type:e.z.literal(`CODE`),config:e.z.object({length:e.z.number().int().positive().max(100).optional(),mode:e.z.enum([`numeric`,`alphanumeric`]).optional(),auto_submit:e.z.boolean().optional(),group_size:e.z.number().int().min(0).max(100).optional(),separator:e.z.string().optional(),placeholder:e.z.string().optional(),default_value:e.z.string().optional()}).refine(e=>e.group_size===void 0||e.length===void 0||e.group_size<=e.length,{message:`group_size cannot exceed length`,path:[`group_size`]}).refine(e=>e.default_value===void 0||e.length===void 0||e.default_value.length<=e.length,{message:`default_value is longer than the configured length`,path:[`default_value`]}).optional()}),at=O.extend({type:e.z.literal(`CUSTOM`),config:e.z.object({component:e.z.string().optional(),props:e.z.record(e.z.string(),e.z.any()).optional(),schema:e.z.record(e.z.string(),e.z.any()).optional(),code:e.z.string().optional()})}),ot=O.extend({type:e.z.literal(`DATE`),config:e.z.object({format:e.z.string().optional(),min:e.z.string().optional(),max:e.z.string().optional(),default_value:e.z.string().optional()}).optional()}),st=O.extend({type:e.z.literal(`DROPDOWN`),config:e.z.object({options:e.z.array(e.z.object({value:e.z.string(),label:e.z.string()})).optional(),placeholder:e.z.string().optional(),searchable:e.z.boolean().optional(),multiple:e.z.boolean().optional(),default_value:e.z.union([e.z.string(),e.z.array(e.z.string())]).optional()}).optional()}),ct=O.extend({type:e.z.literal(`EMAIL`),config:e.z.object({placeholder:e.z.string().optional(),default_value:e.z.string().optional(),last_used:e.z.boolean().optional(),last_used_label:e.z.string().optional()}).optional()}),lt=O.extend({type:e.z.literal(`FILE`),config:e.z.object({accept:e.z.string().optional(),max_size:e.z.number().optional(),multiple:e.z.boolean().optional()}).optional()}),ut=O.extend({type:e.z.literal(`LEGAL`),config:e.z.object({text:e.z.string(),html:e.z.boolean().optional()}).optional()}),dt=O.extend({type:e.z.literal(`NUMBER`),config:e.z.object({placeholder:e.z.string().optional(),min:e.z.number().optional(),max:e.z.number().optional(),step:e.z.number().optional(),default_value:e.z.string().optional()}).optional()}),ft=O.extend({type:e.z.literal(`PASSWORD`),config:e.z.object({placeholder:e.z.string().optional(),min_length:e.z.number().optional(),show_toggle:e.z.boolean().optional(),forgot_password_link:e.z.string().optional(),default_value:e.z.string().optional()}).optional()}),pt=O.extend({type:e.z.literal(`PAYMENT`),config:e.z.object({provider:e.z.string().optional(),currency:e.z.string().optional()}).optional()}),mt=O.extend({type:e.z.literal(`SOCIAL`),config:e.z.object({providers:e.z.array(e.z.string()).optional(),provider_details:e.z.array(e.z.object({name:e.z.string(),strategy:e.z.string().optional(),display_name:e.z.string().optional(),icon_url:e.z.string().optional(),href:e.z.string().optional(),last_used:e.z.boolean().optional(),last_used_label:e.z.string().optional()})).optional()}).optional()}),ht=O.extend({type:e.z.literal(`TEL`),config:e.z.object({placeholder:e.z.string().optional(),default_country:e.z.string().optional(),default_value:e.z.string().optional(),allow_email:e.z.boolean().optional()}).optional()}),gt=O.extend({type:e.z.literal(`TEXT`),config:e.z.object({placeholder:e.z.string().optional(),multiline:e.z.boolean().optional(),max_length:e.z.number().optional(),default_value:e.z.string().optional(),last_used:e.z.boolean().optional(),last_used_label:e.z.string().optional()}).optional()}),_t=O.extend({type:e.z.literal(`COUNTRY`),config:e.z.object({placeholder:e.z.string().optional(),default_value:e.z.string().optional()}).optional()}),vt=O.extend({type:e.z.literal(`URL`),config:e.z.object({placeholder:e.z.string().optional(),default_value:e.z.string().optional()}).optional()}),yt=e.z.discriminatedUnion(`type`,[We,Ge,Ke,qe,Je,Ye,Xe,Ze]),bt=e.z.discriminatedUnion(`type`,[Qe,$e,et]),xt=e.z.discriminatedUnion(`type`,[tt,nt,rt,it,_t,at,ot,st,ct,lt,ut,dt,ft,pt,mt,ht,gt,vt]),St=e.z.union([yt,bt,xt]);new Set([`BOOLEAN`,`CARDS`,`CHOICE`,`CODE`,`COUNTRY`,`DATE`,`DROPDOWN`,`EMAIL`,`LEGAL`,`NUMBER`,`PASSWORD`,`TEL`,`TEXT`,`URL`]),e.z.object({id:e.z.string(),type:e.z.literal(`submit`),label:e.z.string(),className:e.z.string().optional(),disabled:e.z.boolean().optional().default(!1),order:e.z.number().optional(),visible:e.z.boolean().optional().default(!0),customizations:e.z.record(e.z.string(),e.z.any()).optional()});var k=e.z.object({x:e.z.number(),y:e.z.number()}),Ct=e.z.object({id:e.z.string(),type:e.z.literal(`FLOW`),coordinates:k,alias:e.z.string().min(1).max(150).optional(),config:e.z.object({flow_id:e.z.string().max(30),next_node:e.z.string().optional()})}),wt=e.z.object({id:e.z.string(),type:e.z.literal(`ROUTER`),coordinates:k,alias:e.z.string().min(1).max(150),config:e.z.object({rules:e.z.array(e.z.object({id:e.z.string(),alias:e.z.string().min(1).max(150).optional(),condition:e.z.any(),next_node:e.z.string()})),fallback:e.z.string()})}),Tt=e.z.object({id:e.z.string(),type:e.z.literal(`STEP`),coordinates:k,alias:e.z.string().min(1).max(150).optional(),config:e.z.object({components:e.z.array(St),next_node:e.z.string().optional()})}),Et=e.z.discriminatedUnion(`type`,[Ct,wt,Tt]),Dt=e.z.object({name:e.z.string().openapi({description:`The name of the form`}),messages:e.z.object({errors:e.z.record(e.z.string(),e.z.any()).optional(),custom:e.z.record(e.z.string(),e.z.any()).optional()}).optional(),languages:e.z.object({primary:e.z.string().optional(),default:e.z.string().optional()}).optional(),translations:e.z.record(e.z.string(),e.z.any()).optional(),nodes:e.z.array(Et).optional(),start:e.z.object({hidden_fields:e.z.array(e.z.object({key:e.z.string(),value:e.z.string()})).optional(),next_node:e.z.string().optional(),coordinates:k.optional()}).optional(),ending:e.z.object({redirection:e.z.object({delay:e.z.number().optional(),target:e.z.string().optional()}).optional(),after_submit:e.z.object({flow_id:e.z.string().optional()}).optional(),coordinates:k.optional(),resume_flow:e.z.boolean().optional()}).optional(),style:e.z.object({css:e.z.string().optional()}).optional(),links:e.z.object({sdkSrc:e.z.string().optional(),sdk_src:e.z.string().optional()}).optional()}).openapi({description:`Schema for flow-based forms (matches Auth0 Forms structure)`});n.extend(Dt.shape).extend({id:e.z.string()});var Ot=e.z.object({id:e.z.number().optional(),text:e.z.string(),type:e.z.enum([`info`,`error`,`success`,`warning`])}),kt=e.z.object({id:e.z.string().optional(),text:e.z.string(),href:e.z.string(),linkText:e.z.string().optional()});e.z.object({name:e.z.string().optional(),action:e.z.string(),method:e.z.enum([`POST`,`GET`]),title:e.z.string().optional(),description:e.z.string().optional(),components:e.z.array(St),messages:e.z.array(Ot).optional(),links:e.z.array(kt).optional(),footer:e.z.string().optional()});var A=e.z.enum([`pre-user-registration`,`post-user-registration`,`post-user-login`,`post-user-update`,`validate-registration-username`,`pre-user-deletion`,`post-user-deletion`]),j=e.z.enum([`post-user-login`]),M=e.z.enum([`post-user-login`,`post-user-registration`,`post-user-update`,`credentials-exchange`]),N=e.z.enum([`post-user-login`,`credentials-exchange`,`pre-user-registration`,`post-user-registration`]),P=e.z.enum([`post-user-login`]);A.options,j.options,M.options,N.options,P.options;var At=e.z.enum([`impersonate`]),jt=e.z.enum([`ensure-username`,`set-preferred-username`,`account-linking`]),F={enabled:e.z.boolean().default(!1),synchronous:e.z.boolean().default(!1),priority:e.z.number().optional(),hook_id:e.z.string().optional(),metadata:e.z.record(e.z.string(),e.z.unknown()).optional()},Mt=e.z.object({...F,trigger_id:A,url:e.z.string()}),Nt=e.z.object({...F,trigger_id:j,form_id:e.z.string()}),Pt=e.z.object({...F,trigger_id:M,template_id:jt}),Ft=e.z.object({...F,trigger_id:N,code_id:e.z.string()}),It=e.z.object({...F,trigger_id:P,page_id:At,permission_required:e.z.string().optional()});e.z.union([Mt,Nt,Pt,Ft,It]);var Lt=e.z.object({...F,trigger_id:A}).extend(n.shape).extend({hook_id:e.z.string(),url:e.z.string()}),Rt=e.z.object({...F,trigger_id:j}).extend(n.shape).extend({hook_id:e.z.string(),form_id:e.z.string()}),zt=e.z.object({...F,trigger_id:M}).extend(n.shape).extend({hook_id:e.z.string(),template_id:jt}),Bt=e.z.object({...F,trigger_id:N}).extend(n.shape).extend({hook_id:e.z.string(),code_id:e.z.string()}),Vt=e.z.object({...F,trigger_id:P}).extend(n.shape).extend({hook_id:e.z.string(),page_id:At,permission_required:e.z.string().optional()});e.z.union([Lt,Rt,zt,Bt,Vt]),e.z.object({code:e.z.string().max(1e5),secrets:e.z.record(e.z.string(),e.z.string()).optional()}).extend({id:e.z.string(),tenant_id:e.z.string()}).extend(n.shape);var Ht=e.z.object({name:e.z.string().optional()}),Ut=e.z.object({email:e.z.string().optional()}),Wt=e.z.object({id:e.z.string().optional(),organization_id:e.z.string().max(50),inviter:Ht,invitee:Ut,invitation_url:e.z.string().url(),client_id:e.z.string(),connection_id:e.z.string().optional(),app_metadata:e.z.record(e.z.string(),e.z.any()).default({}).optional(),user_metadata:e.z.record(e.z.string(),e.z.any()).default({}).optional(),ttl_sec:e.z.number().int().max(2592e3).default(604800).optional(),roles:e.z.array(e.z.string()).default([]).optional(),send_invitation_email:e.z.boolean().default(!0).optional()});e.z.object({id:e.z.string(),organization_id:e.z.string().max(50),created_at:e.z.string().datetime(),expires_at:e.z.string().datetime(),ticket_id:e.z.string().optional()}).extend(Wt.omit({id:!0}).shape);var Gt=e.z.object({alg:e.z.enum([`RS256`,`RS384`,`RS512`,`ES256`,`ES384`,`ES512`,`HS256`,`HS384`,`HS512`]),kid:e.z.string().optional(),kty:e.z.enum([`RSA`,`EC`,`oct`]),use:e.z.enum([`sig`,`enc`]).optional(),n:e.z.string().optional(),e:e.z.string().optional(),crv:e.z.string().optional(),x:e.z.string().optional(),y:e.z.string().optional(),x5t:e.z.string().optional(),x5c:e.z.array(e.z.string()).optional()}).superRefine((t,n)=>{if(t.kty===`RSA`)for(let r of[`n`,`e`])t[r]||n.addIssue({code:e.z.ZodIssueCode.custom,path:[r],message:`RSA JWK is missing required member '${r}'`});else if(t.kty===`EC`)for(let r of[`crv`,`x`,`y`])t[r]||n.addIssue({code:e.z.ZodIssueCode.custom,path:[r],message:`EC JWK is missing required member '${r}'`})});e.z.object({keys:e.z.array(Gt)}),e.z.object({issuer:e.z.string(),authorization_endpoint:e.z.string(),token_endpoint:e.z.string(),userinfo_endpoint:e.z.string(),jwks_uri:e.z.string(),registration_endpoint:e.z.string().optional(),revocation_endpoint:e.z.string(),end_session_endpoint:e.z.string().optional(),scopes_supported:e.z.array(e.z.string()),response_types_supported:e.z.array(e.z.string()),grant_types_supported:e.z.array(e.z.string()).optional(),code_challenge_methods_supported:e.z.array(e.z.string()),response_modes_supported:e.z.array(e.z.string()),subject_types_supported:e.z.array(e.z.string()),id_token_signing_alg_values_supported:e.z.array(e.z.string()),token_endpoint_auth_methods_supported:e.z.array(e.z.string()),claims_supported:e.z.array(e.z.string()),request_uri_parameter_supported:e.z.boolean(),request_parameter_supported:e.z.boolean(),claims_parameter_supported:e.z.boolean().optional(),request_object_signing_alg_values_supported:e.z.array(e.z.string()).optional(),token_endpoint_auth_signing_alg_values_supported:e.z.array(e.z.string()),client_id_metadata_document_supported:e.z.boolean().optional(),backchannel_logout_supported:e.z.boolean().optional(),backchannel_logout_session_supported:e.z.boolean().optional()});var Kt=function(e){return e.PENDING=`pending`,e.AUTHENTICATED=`authenticated`,e.AWAITING_EMAIL_VERIFICATION=`awaiting_email_verification`,e.AWAITING_MFA=`awaiting_mfa`,e.AWAITING_HOOK=`awaiting_hook`,e.AWAITING_CONTINUATION=`awaiting_continuation`,e.AWAITING_CONSENT=`awaiting_consent`,e.COMPLETED=`completed`,e.FAILED=`failed`,e.EXPIRED=`expired`,e}({}),qt=e.z.nativeEnum(Kt),I=e.z.object({strategy:e.z.string(),strategy_type:e.z.string()});e.z.object({csrf_token:e.z.string(),auth0Client:e.z.string().optional(),authParams:Re,expires_at:e.z.string(),deleted_at:e.z.string().optional(),ip:e.z.string().optional(),useragent:e.z.string().optional(),session_id:e.z.string().optional(),authorization_url:e.z.string().optional(),state:qt.optional().default(`pending`),state_data:e.z.string().optional(),failure_reason:e.z.string().optional(),user_id:e.z.string().optional(),auth_connection:e.z.string().optional(),auth_strategy:I.optional(),authenticated_at:e.z.string().optional()}).openapi({description:`This represents a login sesion`}).extend({id:e.z.string().openapi({description:`This is is used as the state in the universal login`}),created_at:e.z.string(),updated_at:e.z.string()});var L={ACLS_SUMMARY:`acls_summary`,ACTIONS_EXECUTION_FAILED:`actions_execution_failed`,API_LIMIT:`api_limit`,API_LIMIT_WARNING:`api_limit_warning`,APPI:`appi`,CIBA_EXCHANGE_FAILED:`ciba_exchange_failed`,CIBA_EXCHANGE_SUCCEEDED:`ciba_exchange_succeeded`,CIBA_START_FAILED:`ciba_start_failed`,CIBA_START_SUCCEEDED:`ciba_start_succeeded`,CODE_LINK_SENT:`cls`,CODE_SENT:`cs`,DEPRECATION_NOTICE:`depnote`,FAILED_LOGIN:`f`,FAILED_BY_CONNECTOR:`fc`,FAILED_CHANGE_EMAIL:`fce`,FAILED_BY_CORS:`fco`,FAILED_CROSS_ORIGIN_AUTHENTICATION:`fcoa`,FAILED_CHANGE_PASSWORD:`fcp`,FAILED_POST_CHANGE_PASSWORD_HOOK:`fcph`,FAILED_CHANGE_PHONE_NUMBER:`fcpn`,FAILED_CHANGE_PASSWORD_REQUEST:`fcpr`,FAILED_CONNECTOR_PROVISIONING:`fcpro`,FAILED_CHANGE_USERNAME:`fcu`,FAILED_DELEGATION:`fd`,FAILED_DEVICE_ACTIVATION:`fdeac`,FAILED_DEVICE_AUTHORIZATION_REQUEST:`fdeaz`,USER_CANCELED_DEVICE_CONFIRMATION:`fdecc`,FAILED_USER_DELETION:`fdu`,FAILED_EXCHANGE_AUTHORIZATION_CODE_FOR_ACCESS_TOKEN:`feacft`,FAILED_EXCHANGE_ACCESS_TOKEN_FOR_CLIENT_CREDENTIALS:`feccft`,FAILED_EXCHANGE_CUSTOM_TOKEN:`fecte`,FAILED_EXCHANGE_DEVICE_CODE_FOR_ACCESS_TOKEN:`fede`,FAILED_FEDERATED_LOGOUT:`federated_logout_failed`,FAILED_EXCHANGE_NATIVE_SOCIAL_LOGIN:`fens`,FAILED_EXCHANGE_PASSWORD_OOB_FOR_ACCESS_TOKEN:`feoobft`,FAILED_EXCHANGE_PASSWORD_OTP_FOR_ACCESS_TOKEN:`feotpft`,FAILED_EXCHANGE_PASSWORD_FOR_ACCESS_TOKEN:`fepft`,FAILED_EXCHANGE_PASSWORDLESS_OTP_FOR_ACCESS_TOKEN:`fepotpft`,FAILED_EXCHANGE_PASSWORD_MFA_RECOVERY_FOR_ACCESS_TOKEN:`fercft`,FAILED_EXCHANGE_ROTATING_REFRESH_TOKEN:`ferrt`,FAILED_EXCHANGE_REFRESH_TOKEN_FOR_ACCESS_TOKEN:`fertft`,FAILED_EXCHANGE_SUBJECT_TOKEN_FOR_ACCESS_TOKEN:`festft`,FAILED_HOOK:`fh`,FAILED_IMPERSONATION:`fimp`,FAILED_INVITE_ACCEPT:`fi`,FAILED_LOGOUT:`flo`,FLOWS_EXECUTION_COMPLETED:`flows_execution_completed`,FLOWS_EXECUTION_FAILED:`flows_execution_failed`,FAILED_SENDING_NOTIFICATION:`fn`,FORMS_SUBMISSION_FAILED:`forms_submission_failed`,FORMS_SUBMISSION_SUCCEEDED:`forms_submission_succeeded`,FAILED_LOGIN_INCORRECT_PASSWORD:`fp`,FAILED_PUSHED_AUTHORIZATION_REQUEST:`fpar`,FAILED_POST_USER_REGISTRATION_HOOK:`fpurh`,FAILED_SIGNUP:`fs`,FAILED_SILENT_AUTH:`fsa`,FAILED_LOGIN_INVALID_EMAIL_USERNAME:`fu`,FAILED_USERS_IMPORT:`fui`,FAILED_VERIFICATION_EMAIL:`fv`,FAILED_VERIFICATION_EMAIL_REQUEST:`fvr`,EMAIL_VERIFICATION_CONFIRMED:`gd_auth_email_verification`,EMAIL_VERIFICATION_FAILED:`gd_auth_fail_email_verification`,MFA_AUTH_FAILED:`gd_auth_failed`,MFA_AUTH_REJECTED:`gd_auth_rejected`,MFA_AUTH_SUCCESS:`gd_auth_succeed`,MFA_ENROLLMENT_COMPLETE:`gd_enrollment_complete`,TOO_MANY_MFA_FAILURES:`gd_otp_rate_limit_exceed`,MFA_RECOVERY_FAILED:`gd_recovery_failed`,MFA_RECOVERY_RATE_LIMIT_EXCEED:`gd_recovery_rate_limit_exceed`,MFA_RECOVERY_SUCCESS:`gd_recovery_succeed`,MFA_EMAIL_SENT:`gd_send_email`,EMAIL_VERIFICATION_SENT:`gd_send_email_verification`,EMAIL_VERIFICATION_SEND_FAILURE:`gd_send_email_verification_failure`,PUSH_NOTIFICATION_SENT:`gd_send_pn`,ERROR_SENDING_MFA_PUSH_NOTIFICATION:`gd_send_pn_failure`,MFA_SMS_SENT:`gd_send_sms`,ERROR_SENDING_MFA_SMS:`gd_send_sms_failure`,MFA_VOICE_CALL_SUCCESS:`gd_send_voice`,MFA_VOICE_CALL_FAILED:`gd_send_voice_failure`,SECOND_FACTOR_STARTED:`gd_start_auth`,MFA_ENROLL_STARTED:`gd_start_enroll`,MFA_ENROLLMENT_FAILED:`gd_start_enroll_failed`,GUARDIAN_TENANT_UPDATE:`gd_tenant_update`,UNENROLL_DEVICE_ACCOUNT:`gd_unenroll`,UPDATE_DEVICE_ACCOUNT:`gd_update_device_account`,WEBAUTHN_CHALLENGE_FAILED:`gd_webauthn_challenge_failed`,WEBAUTHN_ENROLLMENT_FAILED:`gd_webauthn_enrollment_failed`,FAILED_KMS_API_OPERATION:`kms_key_management_failure`,SUCCESS_KMS_API_OPERATION:`kms_key_management_success`,KMS_KEY_STATE_CHANGED:`kms_key_state_changed`,TOO_MANY_CALLS_TO_DELEGATION:`limit_delegation`,BLOCKED_IP_ADDRESS:`limit_mu`,BLOCKED_ACCOUNT_IP:`limit_sul`,BLOCKED_ACCOUNT_EMAIL:`limit_wc`,INFORMATION:`i`,MFA_REQUIRED:`mfar`,MANAGEMENT_API_READ_OPERATION:`mgmt_api_read`,FAILED_AUTHENTICATION_METHOD_OPERATION_MY_ACCOUNT:`my_account_authentication_method_failed`,SUCCESSFUL_AUTHENTICATION_METHOD_OPERATION_MY_ACCOUNT:`my_account_authentication_method_succeeded`,FAILED_OIDC_BACKCHANNEL_LOGOUT:`oidc_backchannel_logout_failed`,SUCCESSFUL_OIDC_BACKCHANNEL_LOGOUT:`oidc_backchannel_logout_succeeded`,ORGANIZATION_MEMBER_ADDED:`organization_member_added`,PASSKEY_CHALLENGE_FAILED:`passkey_challenge_failed`,PASSKEY_CHALLENGE_STARTED:`passkey_challenge_started`,PRE_LOGIN_ASSESSMENT:`pla`,BREACHED_PASSWORD:`pwd_leak`,BREACHED_PASSWORD_ON_RESET:`reset_pwd_leak`,SUCCESS_RESOURCE_CLEANUP:`resource_cleanup`,RICH_CONSENTS_ACCESS_ERROR:`rich_consents_access_error`,SUCCESS_LOGIN:`s`,SUCCESS_API_OPERATION:`sapi`,FAILED_API_OPERATION:`fapi`,SUCCESS_CHANGE_EMAIL:`sce`,SUCCESS_CROSS_ORIGIN_AUTHENTICATION:`scoa`,SUCCESS_CHANGE_PASSWORD:`scp`,SUCCESS_CHANGE_PHONE_NUMBER:`scpn`,SUCCESS_CHANGE_PASSWORD_REQUEST:`scpr`,SUCCESS_CHANGE_USERNAME:`scu`,SUCCESS_CREDENTIAL_VALIDATION:`scv`,SUCCESS_DELEGATION:`sd`,SUCCESS_USER_DELETION:`sdu`,SUCCESS_EXCHANGE_AUTHORIZATION_CODE_FOR_ACCESS_TOKEN:`seacft`,SUCCESS_EXCHANGE_ACCESS_TOKEN_FOR_CLIENT_CREDENTIALS:`seccft`,SUCCESS_EXCHANGE_CUSTOM_TOKEN:`secte`,SUCCESS_EXCHANGE_DEVICE_CODE_FOR_ACCESS_TOKEN:`sede`,SUCCESS_EXCHANGE_NATIVE_SOCIAL_LOGIN:`sens`,SUCCESS_EXCHANGE_PASSWORD_OOB_FOR_ACCESS_TOKEN:`seoobft`,SUCCESS_EXCHANGE_PASSWORD_OTP_FOR_ACCESS_TOKEN:`seotpft`,SUCCESS_EXCHANGE_PASSWORDLESS_OTP_FOR_ACCESS_TOKEN:`sepotpft`,SUCCESS_EXCHANGE_PASSWORD_FOR_ACCESS_TOKEN:`sepft`,SUCCESS_EXCHANGE_PASSKEY_OOB_FOR_ACCESS_TOKEN:`sepkoobft`,SUCCESS_EXCHANGE_PASSKEY_OTP_FOR_ACCESS_TOKEN:`sepkotpft`,SUCCESS_EXCHANGE_PASSKEY_MFA_RECOVERY_FOR_ACCESS_TOKEN:`sepkrcft`,SUCCESS_EXCHANGE_PASSWORD_MFA_RECOVERY_FOR_ACCESS_TOKEN:`sercft`,SUCCESS_EXCHANGE_REFRESH_TOKEN_FOR_ACCESS_TOKEN:`sertft`,SUCCESS_EXCHANGE_SUBJECT_TOKEN_FOR_ACCESS_TOKEN:`sestft`,SUCCESS_IMPERSONATION:`simp`,SUCCESSFULLY_ACCEPTED_USER_INVITE:`si`,BREACHED_PASSWORD_ON_SIGNUP:`signup_pwd_leak`,SUCCESS_LOGOUT:`slo`,SUCCESS_HOOK:`sh`,SUCCESS_PASSWORD_MIGRATION:`spm`,SUCCESS_REVOCATION:`srrt`,SUCCESS_SIGNUP:`ss`,FAILED_SS_SSO_OPERATION:`ss_sso_failure`,INFORMATION_FROM_SS_SSO_OPERATION:`ss_sso_info`,SUCCESS_SS_SSO_OPERATION:`ss_sso_success`,SUCCESS_SILENT_AUTH:`ssa`,SUCCESSFUL_SCIM_OPERATION:`sscim`,SUCCESSFULLY_IMPORTED_USERS:`sui`,SUCCESS_VERIFICATION_EMAIL:`sv`,SUCCESS_VERIFICATION_EMAIL_REQUEST:`svr`,MAX_AMOUNT_OF_AUTHENTICATORS:`too_many_records`,USER_LOGIN_BLOCK_RELEASED:`ublkdu`,FAILED_UNIVERSAL_LOGOUT:`universal_logout_failed`,SUCCESSFUL_UNIVERSAL_LOGOUT:`universal_logout_succeeded`,WARNING_DURING_LOGIN:`w`,WARNING_SENDING_NOTIFICATION:`wn`,WARNING_USER_MANAGEMENT:`wum`},Jt=e.z.string().refine(e=>Object.values(L).includes(e),{message:`Invalid log type`});L.ACLS_SUMMARY,L.ACTIONS_EXECUTION_FAILED,L.API_LIMIT,L.API_LIMIT_WARNING,L.APPI,L.CIBA_EXCHANGE_FAILED,L.CIBA_EXCHANGE_SUCCEEDED,L.CIBA_START_FAILED,L.CIBA_START_SUCCEEDED,L.CODE_LINK_SENT,L.CODE_SENT,L.DEPRECATION_NOTICE,L.FAILED_LOGIN,L.FAILED_BY_CONNECTOR,L.FAILED_CHANGE_EMAIL,L.FAILED_BY_CORS,L.FAILED_CROSS_ORIGIN_AUTHENTICATION,L.FAILED_CHANGE_PASSWORD,L.FAILED_POST_CHANGE_PASSWORD_HOOK,L.FAILED_CHANGE_PHONE_NUMBER,L.FAILED_CHANGE_PASSWORD_REQUEST,L.FAILED_CONNECTOR_PROVISIONING,L.FAILED_CHANGE_USERNAME,L.FAILED_DELEGATION,L.FAILED_DEVICE_ACTIVATION,L.FAILED_DEVICE_AUTHORIZATION_REQUEST,L.USER_CANCELED_DEVICE_CONFIRMATION,L.FAILED_USER_DELETION,L.FAILED_EXCHANGE_AUTHORIZATION_CODE_FOR_ACCESS_TOKEN,L.FAILED_EXCHANGE_ACCESS_TOKEN_FOR_CLIENT_CREDENTIALS,L.FAILED_EXCHANGE_CUSTOM_TOKEN,L.FAILED_EXCHANGE_DEVICE_CODE_FOR_ACCESS_TOKEN,L.FAILED_FEDERATED_LOGOUT,L.FAILED_EXCHANGE_NATIVE_SOCIAL_LOGIN,L.FAILED_EXCHANGE_PASSWORD_OOB_FOR_ACCESS_TOKEN,L.FAILED_EXCHANGE_PASSWORD_OTP_FOR_ACCESS_TOKEN,L.FAILED_EXCHANGE_PASSWORD_FOR_ACCESS_TOKEN,L.FAILED_EXCHANGE_PASSWORDLESS_OTP_FOR_ACCESS_TOKEN,L.FAILED_EXCHANGE_PASSWORD_MFA_RECOVERY_FOR_ACCESS_TOKEN,L.FAILED_EXCHANGE_ROTATING_REFRESH_TOKEN,L.FAILED_EXCHANGE_REFRESH_TOKEN_FOR_ACCESS_TOKEN,L.FAILED_EXCHANGE_SUBJECT_TOKEN_FOR_ACCESS_TOKEN,L.FAILED_HOOK,L.FAILED_IMPERSONATION,L.FAILED_INVITE_ACCEPT,L.FAILED_LOGOUT,L.FLOWS_EXECUTION_COMPLETED,L.FLOWS_EXECUTION_FAILED,L.FAILED_SENDING_NOTIFICATION,L.FORMS_SUBMISSION_FAILED,L.FORMS_SUBMISSION_SUCCEEDED,L.FAILED_LOGIN_INCORRECT_PASSWORD,L.FAILED_PUSHED_AUTHORIZATION_REQUEST,L.FAILED_POST_USER_REGISTRATION_HOOK,L.FAILED_SIGNUP,L.FAILED_SILENT_AUTH,L.FAILED_LOGIN_INVALID_EMAIL_USERNAME,L.FAILED_USERS_IMPORT,L.FAILED_VERIFICATION_EMAIL,L.FAILED_VERIFICATION_EMAIL_REQUEST,L.EMAIL_VERIFICATION_CONFIRMED,L.EMAIL_VERIFICATION_FAILED,L.MFA_AUTH_FAILED,L.MFA_AUTH_REJECTED,L.MFA_AUTH_SUCCESS,L.MFA_ENROLLMENT_COMPLETE,L.TOO_MANY_MFA_FAILURES,L.MFA_RECOVERY_FAILED,L.MFA_RECOVERY_RATE_LIMIT_EXCEED,L.MFA_RECOVERY_SUCCESS,L.MFA_EMAIL_SENT,L.EMAIL_VERIFICATION_SENT,L.EMAIL_VERIFICATION_SEND_FAILURE,L.PUSH_NOTIFICATION_SENT,L.ERROR_SENDING_MFA_PUSH_NOTIFICATION,L.MFA_SMS_SENT,L.ERROR_SENDING_MFA_SMS,L.MFA_VOICE_CALL_SUCCESS,L.MFA_VOICE_CALL_FAILED,L.SECOND_FACTOR_STARTED,L.MFA_ENROLL_STARTED,L.MFA_ENROLLMENT_FAILED,L.GUARDIAN_TENANT_UPDATE,L.UNENROLL_DEVICE_ACCOUNT,L.UPDATE_DEVICE_ACCOUNT,L.WEBAUTHN_CHALLENGE_FAILED,L.WEBAUTHN_ENROLLMENT_FAILED,L.FAILED_KMS_API_OPERATION,L.SUCCESS_KMS_API_OPERATION,L.KMS_KEY_STATE_CHANGED,L.TOO_MANY_CALLS_TO_DELEGATION,L.BLOCKED_IP_ADDRESS,L.BLOCKED_ACCOUNT_IP,L.BLOCKED_ACCOUNT_EMAIL,L.INFORMATION,L.MFA_REQUIRED,L.MANAGEMENT_API_READ_OPERATION,L.FAILED_AUTHENTICATION_METHOD_OPERATION_MY_ACCOUNT,L.SUCCESSFUL_AUTHENTICATION_METHOD_OPERATION_MY_ACCOUNT,L.FAILED_OIDC_BACKCHANNEL_LOGOUT,L.SUCCESSFUL_OIDC_BACKCHANNEL_LOGOUT,L.ORGANIZATION_MEMBER_ADDED,L.PASSKEY_CHALLENGE_FAILED,L.PASSKEY_CHALLENGE_STARTED,L.PRE_LOGIN_ASSESSMENT,L.BREACHED_PASSWORD,L.BREACHED_PASSWORD_ON_RESET,L.SUCCESS_RESOURCE_CLEANUP,L.RICH_CONSENTS_ACCESS_ERROR,L.SUCCESS_LOGIN,L.SUCCESS_API_OPERATION,L.FAILED_API_OPERATION,L.SUCCESS_CHANGE_EMAIL,L.SUCCESS_CROSS_ORIGIN_AUTHENTICATION,L.SUCCESS_CHANGE_PASSWORD,L.SUCCESS_CHANGE_PHONE_NUMBER,L.SUCCESS_CHANGE_PASSWORD_REQUEST,L.SUCCESS_CHANGE_USERNAME,L.SUCCESS_CREDENTIAL_VALIDATION,L.SUCCESS_DELEGATION,L.SUCCESS_USER_DELETION,L.SUCCESS_EXCHANGE_AUTHORIZATION_CODE_FOR_ACCESS_TOKEN,L.SUCCESS_EXCHANGE_ACCESS_TOKEN_FOR_CLIENT_CREDENTIALS,L.SUCCESS_EXCHANGE_CUSTOM_TOKEN,L.SUCCESS_EXCHANGE_DEVICE_CODE_FOR_ACCESS_TOKEN,L.SUCCESS_EXCHANGE_NATIVE_SOCIAL_LOGIN,L.SUCCESS_EXCHANGE_PASSWORD_OOB_FOR_ACCESS_TOKEN,L.SUCCESS_EXCHANGE_PASSWORD_OTP_FOR_ACCESS_TOKEN,L.SUCCESS_EXCHANGE_PASSWORDLESS_OTP_FOR_ACCESS_TOKEN,L.SUCCESS_EXCHANGE_PASSWORD_FOR_ACCESS_TOKEN,L.SUCCESS_EXCHANGE_PASSKEY_OOB_FOR_ACCESS_TOKEN,L.SUCCESS_EXCHANGE_PASSKEY_OTP_FOR_ACCESS_TOKEN,L.SUCCESS_EXCHANGE_PASSKEY_MFA_RECOVERY_FOR_ACCESS_TOKEN,L.SUCCESS_EXCHANGE_PASSWORD_MFA_RECOVERY_FOR_ACCESS_TOKEN,L.SUCCESS_EXCHANGE_REFRESH_TOKEN_FOR_ACCESS_TOKEN,L.SUCCESS_EXCHANGE_SUBJECT_TOKEN_FOR_ACCESS_TOKEN,L.SUCCESS_IMPERSONATION,L.SUCCESSFULLY_ACCEPTED_USER_INVITE,L.BREACHED_PASSWORD_ON_SIGNUP,L.SUCCESS_LOGOUT,L.SUCCESS_HOOK,L.SUCCESS_PASSWORD_MIGRATION,L.SUCCESS_REVOCATION,L.SUCCESS_SIGNUP,L.FAILED_SS_SSO_OPERATION,L.INFORMATION_FROM_SS_SSO_OPERATION,L.SUCCESS_SS_SSO_OPERATION,L.SUCCESS_SILENT_AUTH,L.SUCCESSFUL_SCIM_OPERATION,L.SUCCESSFULLY_IMPORTED_USERS,L.SUCCESS_VERIFICATION_EMAIL,L.SUCCESS_VERIFICATION_EMAIL_REQUEST,L.MAX_AMOUNT_OF_AUTHENTICATORS,L.USER_LOGIN_BLOCK_RELEASED,L.FAILED_UNIVERSAL_LOGOUT,L.SUCCESSFUL_UNIVERSAL_LOGOUT,L.WARNING_DURING_LOGIN,L.WARNING_SENDING_NOTIFICATION,L.WARNING_USER_MANAGEMENT,(()=>{let e={};for(let[t,n]of Object.entries(L))t.startsWith(`SUCCESS_`)||t.startsWith(`SUCCESSFUL_`)||t.startsWith(`SUCCESSFULLY_`)||t.endsWith(`_SUCCEEDED`)||t.endsWith(`_COMPLETED`)?e[n]=`success`:t.startsWith(`FAILED_`)||t.startsWith(`ERROR_`)||t.startsWith(`BREACHED_`)||t.startsWith(`BLOCKED_`)||t===`MFA_AUTH_FAILED`||t===`MFA_AUTH_REJECTED`||t===`MFA_RECOVERY_FAILED`||t===`MFA_ENROLLMENT_FAILED`||t===`EMAIL_VERIFICATION_FAILED`||t===`WEBAUTHN_CHALLENGE_FAILED`||t===`WEBAUTHN_ENROLLMENT_FAILED`||t===`PASSKEY_CHALLENGE_FAILED`||t===`FLOWS_EXECUTION_FAILED`||t===`FORMS_SUBMISSION_FAILED`||t===`CIBA_EXCHANGE_FAILED`||t===`CIBA_START_FAILED`||t===`ACTIONS_EXECUTION_FAILED`||t===`RICH_CONSENTS_ACCESS_ERROR`||t===`USER_CANCELED_DEVICE_CONFIRMATION`||t===`TOO_MANY_MFA_FAILURES`||t===`MFA_RECOVERY_RATE_LIMIT_EXCEED`||t===`API_LIMIT`||t===`MAX_AMOUNT_OF_AUTHENTICATORS`?e[n]=`failure`:t.startsWith(`WARNING_`)||t===`API_LIMIT_WARNING`||t===`DEPRECATION_NOTICE`||t===`PRE_LOGIN_ASSESSMENT`?e[n]=`warning`:t===`CODE_SENT`||t===`CODE_LINK_SENT`||t===`MFA_EMAIL_SENT`||t===`MFA_SMS_SENT`||t===`EMAIL_VERIFICATION_SENT`||t===`PUSH_NOTIFICATION_SENT`?e[n]=`code_sent`:t===`INFORMATION`||t===`INFORMATION_FROM_SS_SSO_OPERATION`||t===`MANAGEMENT_API_READ_OPERATION`||t===`APPI`||t===`ACLS_SUMMARY`||t===`ORGANIZATION_MEMBER_ADDED`?e[n]=`info`:e[n]=`other`;return e})();var Yt=e.z.object({name:e.z.string(),version:e.z.string(),env:e.z.object({node:e.z.string().optional()}).optional()}),Xt=e.z.object({country_code:e.z.string().length(2),city_name:e.z.string(),latitude:e.z.string(),longitude:e.z.string(),time_zone:e.z.string(),continent_code:e.z.string()});e.z.object({type:Jt,date:e.z.string(),description:e.z.string().optional(),ip:e.z.string().optional(),user_agent:e.z.string().optional(),details:e.z.any().optional(),isMobile:e.z.boolean(),user_id:e.z.string().optional(),user_name:e.z.string().optional(),connection:e.z.string().optional(),connection_id:e.z.string().optional(),client_id:e.z.string().optional(),client_name:e.z.string().optional(),audience:e.z.string().optional(),scope:e.z.string().optional(),strategy:e.z.string().optional(),strategy_type:e.z.string().optional(),hostname:e.z.string().optional(),auth0_client:Yt.optional(),log_id:e.z.string().optional(),location_info:Xt.optional()}).extend({log_id:e.z.string()});var Zt=e.z.enum([`http`,`eventbridge`,`eventgrid`,`splunk`,`datadog`,`sumo`]),Qt=e.z.enum([`active`,`paused`,`suspended`]),$t=e.z.object({type:e.z.string(),name:e.z.string()});e.z.object({name:e.z.string(),type:Zt,status:Qt.optional(),sink:e.z.record(e.z.string(),e.z.unknown()),filters:e.z.array($t).optional(),isPriority:e.z.boolean().optional()}).extend({id:e.z.string(),status:Qt,created_at:e.z.string().optional(),updated_at:e.z.string().optional()});var en=e.z.enum([`auth0`,`cognito`,`okta`,`oidc`]),tn=e.z.object({domain:e.z.string(),client_id:e.z.string(),client_secret:e.z.string(),audience:e.z.string().optional(),scope:e.z.string().optional()}),nn=e.z.object({id:e.z.string().optional(),name:e.z.string(),provider:en,connection:e.z.string(),enabled:e.z.boolean().default(!0),credentials:tn});e.z.object({id:e.z.string(),created_at:e.z.string(),updated_at:e.z.string()}).extend(nn.shape);var rn=e.z.object({enabled:e.z.boolean().optional(),shields:e.z.array(e.z.string()).optional(),admin_notification_frequency:e.z.array(e.z.string()).optional(),method:e.z.string().optional(),stage:e.z.object({"pre-user-registration":e.z.object({shields:e.z.array(e.z.string()).optional()}).optional(),"pre-change-password":e.z.object({shields:e.z.array(e.z.string()).optional()}).optional()}).optional()}),an=e.z.object({enabled:e.z.boolean().optional(),shields:e.z.array(e.z.string()).optional(),allowlist:e.z.array(e.z.string()).optional(),mode:e.z.string().optional(),max_attempts:e.z.number().optional()}),on=e.z.object({enabled:e.z.boolean().optional(),shields:e.z.array(e.z.string()).optional(),allowlist:e.z.array(e.z.string()).optional(),stage:e.z.object({"pre-login":e.z.object({max_attempts:e.z.number().optional(),rate:e.z.number().optional()}).optional(),"pre-user-registration":e.z.object({max_attempts:e.z.number().optional(),rate:e.z.number().optional()}).optional()}).optional()}),sn=e.z.object({breached_password_detection:rn.optional(),brute_force_protection:an.optional(),suspicious_ip_throttling:on.optional()});e.z.object({id:e.z.string().optional(),user_id:e.z.string(),password:e.z.string(),algorithm:e.z.enum([`bcrypt`,`argon2id`]).default(`argon2id`),is_current:e.z.boolean().default(!0)}).extend({id:e.z.string(),created_at:e.z.string(),updated_at:e.z.string()});var cn=e.z.object({initial_user_agent:e.z.string().describe(`First user agent of the device from which this user logged in`),initial_ip:e.z.string().describe(`First IP address associated with this session`),initial_asn:e.z.string().describe(`First autonomous system number associated with this session`),last_user_agent:e.z.string().describe(`Last user agent of the device from which this user logged in`),last_ip:e.z.string().describe(`Last IP address from which this user logged in`),last_asn:e.z.string().describe(`Last autonomous system number from which this user logged in`)}),ln=e.z.object({id:e.z.string(),revoked_at:e.z.string().optional(),used_at:e.z.string().optional(),user_id:e.z.string().describe(`The user ID associated with the session`),expires_at:e.z.string().optional(),login_session_id:e.z.string(),idle_expires_at:e.z.string().optional(),device:cn.describe(`Metadata related to the device used in the session`),clients:e.z.array(e.z.string()).describe(`List of client details for the session`)});e.z.object({created_at:e.z.string(),updated_at:e.z.string(),authenticated_at:e.z.string(),last_interaction_at:e.z.string()}).extend(ln.shape),e.z.object({kid:e.z.string().openapi({description:`The key id of the signing key`}),tenant_id:e.z.string().optional().openapi({description:`The tenant the key belongs to. Omitted means the key is shared / control-plane scoped.`}),cert:e.z.string().openapi({description:`The public certificate of the signing key`}),fingerprint:e.z.string().openapi({description:`The cert fingerprint`}),thumbprint:e.z.string().openapi({description:`The cert thumbprint`}),pkcs7:e.z.string().optional().openapi({description:`The private key in pkcs7 format`}),current:e.z.boolean().optional().openapi({description:`True if the key is the current key`}),next:e.z.boolean().optional().openapi({description:`True if the key is the next key`}),previous:e.z.boolean().optional().openapi({description:`True if the key is the previous key`}),current_since:e.z.string().optional().openapi({description:`The date and time when the key became the current key`}),current_until:e.z.string().optional().openapi({description:`The date and time when the current key was rotated`}),revoked:e.z.boolean().optional().openapi({description:`True if the key is revoked`}),revoked_at:e.z.string().optional().openapi({description:`The date and time when the key was revoked`}),connection:e.z.string().optional().openapi({description:`The connection identifier associated with the key`}),type:e.z.enum([`jwt_signing`,`saml_encryption`]).openapi({description:`The type of the signing key`})});var un=e.z.object({id:e.z.string().optional(),audience:e.z.string().optional(),friendly_name:e.z.string(),picture_url:e.z.string().optional(),support_email:e.z.string().optional(),support_url:e.z.string().optional(),sender_email:e.z.string().email().optional(),sender_name:e.z.string().optional(),session_lifetime:e.z.number().optional(),idle_session_lifetime:e.z.number().optional(),ephemeral_session_lifetime:e.z.number().optional(),idle_ephemeral_session_lifetime:e.z.number().optional(),session_cookie:e.z.object({mode:e.z.enum([`persistent`,`non-persistent`]).optional()}).optional(),allowed_logout_urls:e.z.array(e.z.string()).optional(),default_redirection_uri:e.z.string().optional(),default_client_id:e.z.string().optional(),enabled_locales:e.z.array(e.z.string()).optional(),default_directory:e.z.string().optional(),error_page:e.z.object({html:e.z.string().optional(),show_log_link:e.z.boolean().optional(),url:e.z.string().optional()}).nullish(),flags:e.z.object({allow_changing_enable_sso:e.z.boolean().optional(),allow_legacy_delegation_grant_types:e.z.boolean().optional(),allow_legacy_ro_grant_types:e.z.boolean().optional(),allow_legacy_tokeninfo_endpoint:e.z.boolean().optional(),change_pwd_flow_v1:e.z.boolean().optional(),client_id_metadata_document_registration:e.z.boolean().optional(),custom_domains_provisioning:e.z.boolean().optional(),dashboard_insights_view:e.z.boolean().optional(),dashboard_log_streams_next:e.z.boolean().optional(),disable_clickjack_protection_headers:e.z.boolean().optional(),disable_fields_map_fix:e.z.boolean().optional(),disable_impersonation:e.z.boolean().optional(),disable_management_api_sms_obfuscation:e.z.boolean().optional(),enable_adfs_waad_email_verification:e.z.boolean().optional(),enable_apis_section:e.z.boolean().optional(),enable_client_connections:e.z.boolean().optional(),enable_custom_domain_in_emails:e.z.boolean().optional(),enable_dynamic_client_registration:e.z.boolean().optional(),dcr_require_initial_access_token:e.z.boolean().optional(),dcr_allowed_grant_types:e.z.array(e.z.string()).optional(),allow_http_return_to:e.z.array(e.z.string().refine(e=>{try{let t=new URL(e);return t.protocol===`http:`&&(t.pathname===``||t.pathname===`/`)&&!t.search&&!t.hash&&e===t.origin}catch{return!1}},{message:`must be a fully-qualified http origin (scheme + host + port, no path)`})).optional(),enable_idtoken_api2:e.z.boolean().optional(),enable_legacy_logs_search_v2:e.z.boolean().optional(),enable_legacy_profile:e.z.boolean().optional(),enable_pipeline2:e.z.boolean().optional(),enable_public_signup_user_exists_error:e.z.boolean().optional(),enable_sso:e.z.boolean().optional(),enforce_client_authentication_on_passwordless_start:e.z.boolean().optional(),genai_trial:e.z.boolean().optional(),improved_signup_bot_detection_in_classic:e.z.boolean().optional(),mfa_show_factor_list_on_enrollment:e.z.boolean().optional(),no_disclose_enterprise_connections:e.z.boolean().optional(),remove_alg_from_jwks:e.z.boolean().optional(),revoke_refresh_token_grant:e.z.boolean().optional(),trust_azure_adfs_email_verified_connection_property:e.z.boolean().optional(),use_scope_descriptions_for_consent:e.z.boolean().optional(),inherit_global_permissions_in_organizations:e.z.boolean().optional(),restrict_undefined_scopes:e.z.boolean().optional()}).optional(),sandbox_version:e.z.string().optional(),legacy_sandbox_version:e.z.string().optional(),sandbox_versions_available:e.z.array(e.z.string()).optional(),change_password:e.z.object({enabled:e.z.boolean().optional(),html:e.z.string().optional()}).optional(),guardian_mfa_page:e.z.object({enabled:e.z.boolean().optional(),html:e.z.string().optional()}).optional(),device_flow:e.z.object({charset:e.z.enum([`base20`,`digits`]).optional(),mask:e.z.string().max(20).optional()}).optional(),default_token_quota:e.z.object({clients:e.z.object({client_credentials:e.z.record(e.z.string(),e.z.any()).optional()}).optional(),organizations:e.z.object({client_credentials:e.z.record(e.z.string(),e.z.any()).optional()}).optional()}).nullish(),default_audience:e.z.string().optional(),default_organization:e.z.string().optional(),sessions:e.z.object({oidc_logout_prompt_enabled:e.z.boolean().optional()}).optional(),oidc_logout:e.z.object({rp_logout_end_session_endpoint_discovery:e.z.boolean().optional()}).optional(),allow_organization_name_in_authentication_api:e.z.boolean().optional(),customize_mfa_in_postlogin_action:e.z.boolean().optional(),acr_values_supported:e.z.array(e.z.string()).optional(),mtls:e.z.object({enable_endpoint_aliases:e.z.boolean().optional()}).nullish(),pushed_authorization_requests_supported:e.z.boolean().optional(),authorization_response_iss_parameter_supported:e.z.boolean().optional(),deployment_type:e.z.enum([`shared`,`wfp`]).default(`shared`).optional(),provisioning_state:e.z.enum([`pending`,`ready`,`failed`]).default(`ready`).optional(),provisioning_error:e.z.string().max(2048).optional(),provisioning_state_changed_at:e.z.string().optional(),bundle_configuration:e.z.string().max(64).optional(),worker_version:e.z.string().max(64).optional(),database_version:e.z.string().max(64).optional(),worker_script_name:e.z.string().max(255).optional(),storage_kind:e.z.enum([`own_d1`,`existing_d1`,`shared_planetscale`]).optional(),d1_database_id:e.z.string().max(64).optional(),attack_protection:sn.optional(),mfa:e.z.object({policy:e.z.enum([`never`,`always`]).default(`never`).optional(),factors:e.z.object({sms:e.z.boolean().default(!1),otp:e.z.boolean().default(!1),email:e.z.boolean().default(!1),push_notification:e.z.boolean().default(!1),webauthn_roaming:e.z.boolean().default(!1),webauthn_platform:e.z.boolean().default(!1),recovery_code:e.z.boolean().default(!1),duo:e.z.boolean().default(!1)}).optional(),sms_provider:e.z.object({provider:e.z.enum([`twilio`,`vonage`,`aws_sns`,`phone_message_hook`]).optional()}).optional(),twilio:e.z.object({sid:e.z.string().optional(),auth_token:e.z.string().optional(),from:e.z.string().optional(),messaging_service_sid:e.z.string().optional()}).optional(),phone_message:e.z.object({message:e.z.string().optional()}).optional()}).optional()});e.z.object({created_at:e.z.string().nullable().transform(e=>e??``),updated_at:e.z.string().nullable().transform(e=>e??``)}).extend(un.shape).extend({id:e.z.string(),is_control_plane:e.z.boolean().optional()});var dn=e.z.enum([`provision`,`seed`,`upgrade`,`backup`,`deprovision`,`users_import`]),fn=e.z.enum([`pending`,`running`,`succeeded`,`failed`,`cancelled`]),pn=e.z.string().max(64);e.z.object({tenant_id:e.z.string().max(255).nullable().default(null),rollout_id:e.z.string().max(255).nullable().optional(),kind:dn,engine:pn,engine_instance_id:e.z.string().max(100).nullable().optional(),target_worker_version:e.z.string().max(255).nullable().optional(),target_database_version:e.z.string().max(255).nullable().optional(),initiated_by:e.z.string().max(255).nullable().optional(),input:e.z.record(e.z.string(),e.z.unknown()).nullable().optional()}).extend({id:e.z.string(),status:fn,current_step:e.z.string().max(255).nullable().optional(),error:e.z.string().nullable().optional(),result:e.z.record(e.z.string(),e.z.unknown()).nullable().optional(),claimed_by:e.z.string().max(255).nullable().optional(),claim_expires_at:e.z.string().nullable().optional(),created_at:e.z.string(),updated_at:e.z.string(),finished_at:e.z.string().nullable().optional()}).pick({status:!0,current_step:!0,engine_instance_id:!0,target_worker_version:!0,target_database_version:!0,error:!0,result:!0,claimed_by:!0,claim_expires_at:!0,finished_at:!0}).partial();var mn=e.z.enum([`started`,`succeeded`,`failed`,`retried`,`skipped`,`reconciled`]);e.z.object({operation_id:e.z.string().max(255),step:e.z.string().max(255),outcome:mn,detail:e.z.record(e.z.string(),e.z.unknown()).nullable().optional(),attempt:e.z.number().int().min(1).default(1)}).extend({id:e.z.string(),created_at:e.z.string()});var R=e.z.enum([`pending`,`inserted`,`updated`,`failed`,`skipped`]);e.z.object({operation_id:e.z.string().max(255),seq:e.z.number().int().min(0),payload:e.z.record(e.z.string(),e.z.unknown()),status:R.default(`pending`),error_code:e.z.string().max(64).nullable().optional(),error_message:e.z.string().nullable().optional(),error_path:e.z.string().max(255).nullable().optional(),entity_id:e.z.string().max(255).nullable().optional()}).extend({status:R,created_at:e.z.string(),updated_at:e.z.string()}),e.z.object({seq:e.z.number().int().min(0),status:R,error_code:e.z.string().max(64).nullable().optional(),error_message:e.z.string().nullable().optional(),error_path:e.z.string().max(255).nullable().optional(),entity_id:e.z.string().max(255).nullable().optional()});var hn=e.z.enum([`upgrade`,`reseed`,`backup`]),gn=e.z.enum([`pending`,`canary`,`rolling`,`paused`,`done`,`failed`]);e.z.object({kind:hn,target_worker_version:e.z.string().max(255).nullable().optional(),target_database_version:e.z.string().max(255).nullable().optional(),wave_size:e.z.number().int().min(1).default(10),canary_tenant_ids:e.z.array(e.z.string()).nullable().optional(),filter:e.z.record(e.z.string(),e.z.unknown()).nullable().optional(),initiated_by:e.z.string().max(255).nullable().optional()}).extend({id:e.z.string(),status:gn,created_at:e.z.string(),updated_at:e.z.string(),finished_at:e.z.string().nullable().optional()}).pick({status:!0,wave_size:!0,canary_tenant_ids:!0,filter:!0,finished_at:!0}).partial(),e.z.object({access_token:e.z.string(),id_token:e.z.string().optional(),scope:e.z.string().optional(),state:e.z.string().optional(),refresh_token:e.z.string().optional(),token_type:e.z.string(),expires_in:e.z.number()}),e.z.object({code:e.z.string(),state:e.z.string().optional()});var _n=e.z.object({button_border_radius:e.z.number(),button_border_weight:e.z.number(),buttons_style:e.z.enum([`pill`,`rounded`,`sharp`]),input_border_radius:e.z.number(),input_border_weight:e.z.number(),inputs_style:e.z.enum([`pill`,`rounded`,`sharp`]),show_widget_shadow:e.z.boolean(),widget_border_weight:e.z.number(),widget_corner_radius:e.z.number()}),vn=e.z.object({base_focus_color:e.z.string(),base_hover_color:e.z.string(),body_text:e.z.string(),captcha_widget_theme:e.z.enum([`auto`,`dark`,`light`]),error:e.z.string(),header:e.z.string(),icons:e.z.string(),input_background:e.z.string(),input_border:e.z.string(),input_filled_text:e.z.string(),input_labels_placeholders:e.z.string(),links_focused_components:e.z.string(),primary_button:e.z.string(),primary_button_label:e.z.string(),secondary_button_border:e.z.string(),secondary_button_label:e.z.string(),success:e.z.string(),widget_background:e.z.string(),widget_border:e.z.string()}),z=e.z.object({bold:e.z.boolean(),size:e.z.number()}),yn=e.z.object({body_text:z,buttons_text:z,font_url:e.z.string(),input_labels:z,links:z,links_style:e.z.enum([`normal`,`underlined`]),reference_text_size:e.z.number(),subtitle:z,title:z}),bn=e.z.object({background_color:e.z.string(),background_image_url:e.z.string(),page_layout:e.z.enum([`center`,`left`,`right`]),logo_placement:e.z.enum([`widget`,`chip`,`none`]).optional()}),xn=e.z.object({header_text_alignment:e.z.enum([`center`,`left`,`right`]),logo_height:e.z.number(),logo_position:e.z.enum([`center`,`left`,`none`,`right`]),logo_url:e.z.string(),social_buttons_layout:e.z.enum([`bottom`,`top`])});e.z.object({borders:_n,colors:vn,displayName:e.z.string(),fonts:yn,page_background:bn,widget:xn}).extend({themeId:e.z.string()}),e.z.object({universal_login_experience:e.z.enum([`new`,`classic`]).default(`new`),identifier_first:e.z.boolean().default(!0),password_first:e.z.boolean().default(!1),show_last_used_connection:e.z.boolean().default(!1),webauthn_platform_first_factor:e.z.boolean()});var Sn=e.z.object({hosts:e.z.array(e.z.string()).optional(),methods:e.z.array(e.z.string()).optional(),path:e.z.string().default(`/*`),headers:e.z.record(e.z.string(),e.z.string()).optional(),query:e.z.record(e.z.string(),e.z.string()).optional()}),Cn=e.z.object({type:e.z.string(),options:e.z.record(e.z.string(),e.z.unknown()).default({})}),B=e.z.object({id:e.z.string().optional(),custom_domain_id:e.z.string(),priority:e.z.number().int().default(100),match:Sn,handlers:e.z.array(Cn).min(1)}),wn=B.extend({id:e.z.string(),tenant_id:e.z.string(),created_at:e.z.string(),updated_at:e.z.string()}),Tn=B.partial().omit({id:!0,custom_domain_id:!0}),En=e.z.object({scim:e.z.string(),auth0:e.z.string()}),Dn=e.z.object({connection_id:e.z.string(),user_id_attribute:e.z.string().default(`externalId`),mapping:e.z.array(En).default([])});e.z.object({created_at:e.z.string(),updated_at:e.z.string()}).extend(Dn.shape);var On=e.z.object({token_id:e.z.string(),connection_id:e.z.string(),token_hash:e.z.string(),scopes:e.z.array(e.z.string()).default([]),valid_until:e.z.string().optional()});e.z.object({created_at:e.z.string(),last_used_at:e.z.string().optional()}).extend(On.shape);var kn=e.z.object({connection_id:e.z.string(),external_id:e.z.string(),user_id:e.z.string()});e.z.object({created_at:e.z.string()}).extend(kn.shape),e.z.object({name:e.z.string(),enabled:e.z.boolean().optional().default(!0),default_from_address:e.z.string().optional(),credentials:e.z.record(e.z.string(),e.z.unknown()),settings:e.z.object({}).optional()});var An=e.z.enum([`verify_email`,`verify_email_by_code`,`reset_email`,`reset_email_by_code`,`welcome_email`,`blocked_account`,`stolen_credentials`,`enrollment_email`,`mfa_oob_code`,`change_password`,`password_reset`,`user_invitation`]);e.z.object({template:An,body:e.z.string(),from:e.z.string(),subject:e.z.string(),syntax:e.z.literal(`liquid`).default(`liquid`),resultUrl:e.z.string().optional(),urlLifetimeInSeconds:e.z.number().int().nonnegative().optional(),includeEmailInRedirect:e.z.boolean().default(!1),enabled:e.z.boolean().default(!0)}),e.z.object({id:e.z.string(),login_id:e.z.string(),session_id:e.z.string().optional(),organization:e.z.string().optional(),auth_connection:e.z.string().optional(),auth_strategy:I.optional(),user_id:e.z.string(),client_id:e.z.string(),expires_at:e.z.string().optional(),idle_expires_at:e.z.string().optional(),last_exchanged_at:e.z.string().optional(),device:cn,resource_servers:e.z.array(e.z.object({audience:e.z.string(),scopes:e.z.string()})),rotating:e.z.boolean(),token_lookup:e.z.string().optional(),token_hash:e.z.string().optional(),family_id:e.z.string().optional(),rotated_to:e.z.string().optional(),rotated_at:e.z.string().optional()}).extend({created_at:e.z.string(),revoked_at:e.z.string().optional()}),e.z.object({to:e.z.string(),message:e.z.string()}),e.z.object({name:e.z.string(),options:e.z.object({})});var jn=e.z.object({value:e.z.string(),description:e.z.string().optional()}),Mn=e.z.object({token_dialect:e.z.enum([`access_token`,`access_token_authz`]).optional(),enforce_policies:e.z.boolean().optional(),allow_skipping_userinfo:e.z.boolean().optional(),skip_userinfo:e.z.boolean().optional(),persist_client_authorization:e.z.boolean().optional(),enable_introspection_endpoint:e.z.boolean().optional(),mtls:e.z.object({bound_access_tokens:e.z.boolean().optional()}).optional()}),Nn=e.z.object({id:e.z.string().optional(),name:e.z.string(),identifier:e.z.string(),scopes:e.z.array(jn).optional(),signing_alg:e.z.string().optional(),signing_secret:e.z.string().optional(),token_lifetime:e.z.number().default(86400),token_lifetime_for_web:e.z.number().default(7200),skip_consent_for_verifiable_first_party_clients:e.z.boolean().optional(),allow_offline_access:e.z.boolean().optional(),verificationKey:e.z.string().optional(),options:Mn.optional(),is_system:e.z.boolean().optional(),metadata:e.z.record(e.z.string(),e.z.any()).optional()}).extend({created_at:e.z.string().optional(),updated_at:e.z.string().optional()});e.z.array(Nn);var Pn=e.z.object({role_id:e.z.string(),resource_server_identifier:e.z.string(),permission_name:e.z.string()}).extend({created_at:e.z.string()});e.z.array(Pn),e.z.object({user_id:e.z.string().openapi({description:`The id of the user that granted the consent`}),clientID:e.z.string().openapi({description:`The id of the client the grant was issued to`}),audience:e.z.string().optional().openapi({description:`The audience the grant applies to`}),scope:e.z.array(e.z.string()).default([]).openapi({description:`The list of OAuth scopes the user has consented to`})}).extend({id:e.z.string()}),e.z.object({user_id:e.z.string(),last_login:e.z.string().optional(),last_ip:e.z.string().optional(),login_count:e.z.number().default(0),failed_logins:e.z.array(e.z.string()).optional(),last_password_reset:e.z.string().optional()});var Fn=e.z.object({user_id:e.z.string(),resource_server_identifier:e.z.string(),permission_name:e.z.string(),organization_id:e.z.string().optional()}).extend({tenant_id:e.z.string(),created_at:e.z.string().optional()});e.z.array(Fn);var In=e.z.object({user_id:e.z.string(),resource_server_identifier:e.z.string(),resource_server_name:e.z.string(),permission_name:e.z.string(),description:e.z.string().nullable().optional(),created_at:e.z.string().optional(),organization_id:e.z.string().optional()});e.z.array(In);var Ln=e.z.object({user_id:e.z.string(),role_id:e.z.string(),organization_id:e.z.string().optional()}).extend({tenant_id:e.z.string(),created_at:e.z.string().optional()});e.z.array(Ln);var Rn=e.z.object({id:e.z.string().optional().openapi({description:`The unique identifier of the role. If not provided, one will be generated.`}),name:e.z.string().min(1).max(50).openapi({description:`The name of the role. Cannot include '<' or '>'`}),description:e.z.string().max(255).optional().openapi({description:`The description of the role`}),is_system:e.z.boolean().optional(),metadata:e.z.record(e.z.string(),e.z.any()).optional().openapi({description:`Metadata associated with the role. Can be used to control sync behavior in multi-tenancy scenarios.`})}).extend({id:e.z.string().openapi({description:`The unique identifier of the role`}),created_at:e.z.string().optional(),updated_at:e.z.string().optional()});e.z.array(Rn);var zn=e.z.object({logo_url:e.z.string().optional().openapi({description:`URL of the organization's logo`}),colors:e.z.object({primary:e.z.string().optional().openapi({description:`Primary color in hex format (e.g., #FF0000)`}),page_background:e.z.string().optional().openapi({description:`Page background color in hex format (e.g., #FFFFFF)`})}).optional()}).optional(),Bn=e.z.object({connection_id:e.z.string().openapi({description:`ID of the connection`}),assign_membership_on_login:e.z.boolean().default(!1).openapi({description:`Whether to assign membership to the organization on login`}),show_as_button:e.z.boolean().default(!0).openapi({description:`Whether to show this connection as a button in the login screen`}),is_signup_enabled:e.z.boolean().default(!0).openapi({description:`Whether signup is enabled for this connection`})}),Vn=e.z.object({client_credentials:e.z.object({enforce:e.z.boolean().default(!1).openapi({description:`Whether to enforce token quota limits`}),per_day:e.z.number().min(0).default(0).openapi({description:`Maximum tokens per day (0 = unlimited)`}),per_hour:e.z.number().min(0).default(0).openapi({description:`Maximum tokens per hour (0 = unlimited)`})}).optional()}).optional();e.z.object({id:e.z.string().optional(),name:e.z.string().min(1).regex(/^[a-z0-9_-]+$/,{message:`Organization name must be lowercase and can only contain letters, numbers, hyphens, and underscores`}).openapi({description:`The name of the organization. Must be lowercase and can only contain letters, numbers, hyphens, and underscores.`}),display_name:e.z.string().optional().openapi({description:`The display name of the organization`}),branding:zn,metadata:e.z.record(e.z.string(),e.z.any()).default({}).optional().openapi({description:`Custom metadata for the organization`}),enabled_connections:e.z.array(Bn).default([]).optional().openapi({description:`List of enabled connections for the organization`}),token_quota:Vn}).extend(n.shape).extend({id:e.z.string(),name:e.z.string().min(1).openapi({description:`The name of the organization`})});var Hn=e.z.object({connection_id:e.z.string().openapi({description:`ID of the tenant-level connection to enable for the org.`}),assign_membership_on_login:e.z.boolean().optional().default(!1),show_as_button:e.z.boolean().optional().default(!0),is_signup_enabled:e.z.boolean().optional().default(!0)}).extend({connection:e.z.object({name:e.z.string().optional(),strategy:e.z.string().optional()}).optional(),created_at:e.z.string().optional(),updated_at:e.z.string().optional()});e.z.array(Hn),e.z.object({user_id:e.z.string().openapi({description:`ID of the user`}),organization_id:e.z.string().openapi({description:`ID of the organization`})}).extend(n.shape).extend({id:e.z.string()}),e.z.object({idle_session_lifetime:e.z.number().default(72),session_lifetime:e.z.number().default(168),session_cookie:e.z.object({mode:e.z.enum([`persistent`,`non-persistent`]).optional()}).optional(),enable_client_connections:e.z.boolean().optional(),default_redirection_uri:e.z.string().optional(),enabled_locales:e.z.array(e.z.string()).optional(),default_directory:e.z.string().optional(),error_page:e.z.object({html:e.z.string().optional(),show_log_link:e.z.boolean().optional(),url:e.z.string().optional()}).optional(),flags:e.z.object({allow_legacy_delegation_grant_types:e.z.boolean().optional(),allow_legacy_ro_grant_types:e.z.boolean().optional(),allow_legacy_tokeninfo_endpoint:e.z.boolean().optional(),disable_clickjack_protection_headers:e.z.boolean().optional(),enable_apis_section:e.z.boolean().optional(),enable_client_connections:e.z.boolean().optional(),enable_custom_domain_in_emails:e.z.boolean().optional(),enable_dynamic_client_registration:e.z.boolean().optional(),enable_idtoken_api2:e.z.boolean().optional(),enable_legacy_logs_search_v2:e.z.boolean().optional(),enable_legacy_profile:e.z.boolean().optional(),enable_pipeline2:e.z.boolean().optional(),enable_public_signup_user_exists_error:e.z.boolean().optional(),use_scope_descriptions_for_consent:e.z.boolean().optional(),disable_management_api_sms_obfuscation:e.z.boolean().optional(),enable_adfs_waad_email_verification:e.z.boolean().optional(),revoke_refresh_token_grant:e.z.boolean().optional(),dashboard_log_streams_next:e.z.boolean().optional(),dashboard_insights_view:e.z.boolean().optional(),disable_fields_map_fix:e.z.boolean().optional(),mfa_show_factor_list_on_enrollment:e.z.boolean().optional()}).optional(),friendly_name:e.z.string().optional(),picture_url:e.z.string().optional(),support_email:e.z.string().optional(),support_url:e.z.string().optional(),sandbox_version:e.z.string().optional(),sandbox_versions_available:e.z.array(e.z.string()).optional(),change_password:e.z.object({enabled:e.z.boolean(),html:e.z.string()}).optional(),guardian_mfa_page:e.z.object({enabled:e.z.boolean(),html:e.z.string()}).optional(),default_audience:e.z.string().optional(),default_organization:e.z.string().optional(),sessions:e.z.object({oidc_logout_prompt_enabled:e.z.boolean().optional()}).optional(),mfa:e.z.object({policy:e.z.enum([`never`,`always`]).default(`never`).optional(),factors:e.z.object({sms:e.z.boolean().default(!1),otp:e.z.boolean().default(!1),email:e.z.boolean().default(!1),push_notification:e.z.boolean().default(!1),webauthn_roaming:e.z.boolean().default(!1),webauthn_platform:e.z.boolean().default(!1),recovery_code:e.z.boolean().default(!1),duo:e.z.boolean().default(!1)}).optional(),sms_provider:e.z.object({provider:e.z.enum([`twilio`,`vonage`,`aws_sns`,`phone_message_hook`]).optional()}).optional(),twilio:e.z.object({sid:e.z.string().optional(),auth_token:e.z.string().optional(),from:e.z.string().optional(),messaging_service_sid:e.z.string().optional()}).optional(),phone_message:e.z.object({message:e.z.string().optional()}).optional()}).optional()}),e.z.object({date:e.z.string().openapi({description:`Date these events occurred in ISO 8601 format`,example:`2025-12-19`}),logins:e.z.number().openapi({description:`Number of logins on this date`,example:150}),signups:e.z.number().openapi({description:`Number of signups on this date`,example:25}),leaked_passwords:e.z.number().openapi({description:`Number of breached-password detections on this date (subscription required)`,example:0}),updated_at:e.z.string().openapi({description:`Date and time this stats entry was last updated in ISO 8601 format`,example:`2025-12-19T10:30:00.000Z`}),created_at:e.z.string().openapi({description:`Approximate date and time the first event occurred in ISO 8601 format`,example:`2025-12-19T00:00:00.000Z`})}),e.z.number().openapi({description:`Number of active users in the last 30 days`,example:1234}),e.z.enum([`active-users`,`logins`,`signups`,`refresh-tokens`,`sessions`,`logouts`,`password-changes`,`password-migrations`,`mfa`,`email-verifications`,`codes-sent`]),e.z.enum([`hour`,`day`,`week`,`month`]),e.z.enum([`time`,`connection`,`client_id`,`user_type`,`event`]),e.z.enum([`password`,`social`,`passwordless`,`enterprise`]);var Un=e.z.object({cohort:e.z.string(),sessions:e.z.number(),active:e.z.array(e.z.number())});e.z.object({interval:e.z.literal(`week`),from:e.z.string(),to:e.z.string(),cohorts:e.z.array(Un)});var Wn=e.z.object({cohort:e.z.string(),tokens:e.z.number(),active:e.z.array(e.z.number())});e.z.object({interval:e.z.literal(`week`),from:e.z.string(),to:e.z.string(),cohorts:e.z.array(Wn)});var Gn=e.z.object({name:e.z.string(),type:e.z.string()}),Kn=e.z.object({elapsed:e.z.number(),rows_read:e.z.number().optional(),bytes_read:e.z.number().optional()});e.z.object({meta:e.z.array(Gn),data:e.z.array(e.z.record(e.z.string(),e.z.any())),rows:e.z.number(),rows_before_limit_at_least:e.z.number().optional(),statistics:Kn.optional()});var qn=e.z.enum(`login.login-id.login-password.signup.signup-id.signup-password.reset-password.consent.mfa.mfa-push.mfa-otp.mfa-voice.mfa-phone.mfa-webauthn.mfa-email.mfa-recovery-code.status.device-flow.email-verification.email-otp-challenge.organizations.invitation.common.passkeys.captcha.custom-form.login-passwordless.mfa-login-options`.split(`.`)),Jn=e.z.record(e.z.string(),e.z.record(e.z.string(),e.z.string())).openapi({type:`object`,additionalProperties:{type:`object`,additionalProperties:{type:`string`}}});e.z.object({prompt:qn,language:e.z.string(),custom_text:Jn});var Yn=e.z.enum([`phone`,`totp`,`email`,`push`,`webauthn-roaming`,`webauthn-platform`,`passkey`]),Xn=e.z.object({user_id:e.z.string(),type:Yn,phone_number:e.z.string().optional(),totp_secret:e.z.string().optional(),credential_id:e.z.string().optional(),public_key:e.z.string().optional(),sign_count:e.z.number().int().nonnegative().optional(),credential_backed_up:e.z.boolean().optional(),transports:e.z.array(e.z.string()).optional(),friendly_name:e.z.string().optional(),confirmed:e.z.boolean().default(!1)});function Zn(t,n){t.type===`phone`&&!t.phone_number&&n.addIssue({code:e.z.ZodIssueCode.custom,message:`phone_number is required when type is 'phone'`,path:[`phone_number`]}),t.type===`totp`&&!t.totp_secret&&n.addIssue({code:e.z.ZodIssueCode.custom,message:`totp_secret is required when type is 'totp'`,path:[`totp_secret`]}),[`webauthn-roaming`,`webauthn-platform`,`passkey`].includes(t.type)&&(t.credential_id||n.addIssue({code:e.z.ZodIssueCode.custom,message:`credential_id is required when type is '${t.type}'`,path:[`credential_id`]}),t.public_key||n.addIssue({code:e.z.ZodIssueCode.custom,message:`public_key is required when type is '${t.type}'`,path:[`public_key`]}))}Xn.superRefine(Zn),Xn.extend({id:e.z.string(),created_at:e.z.string(),updated_at:e.z.string()}).superRefine(Zn),e.z.object({id:e.z.string().optional(),created_at:e.z.string().datetime({offset:!0}).optional(),updated_at:e.z.string().datetime({offset:!0}).optional()});var Qn=`x-authhero-preserve-location`,V=class extends Error{ms;constructor(e,t){super(`${t??`Operation`} timed out after ${e}ms`),this.name=`TimeoutError`,this.ms=e}};function H(e){return e instanceof V?!0:e instanceof Error?e.name===`AbortError`||e.name===`TimeoutError`:!1}function U(e,t){let n=new AbortController,r=setTimeout(()=>n.abort(),e);return t(n.signal).finally(()=>clearTimeout(r))}function W(e,t,n){let r,i=new Promise((e,i)=>{r=setTimeout(()=>i(new V(t,n)),t)});return Promise.race([e,i]).finally(()=>{r&&clearTimeout(r)})}var $n=1e4,er=8e3;function G(e,t,n){let r=typeof t==`number`?{freshTtlMs:t,maxEntries:n}:t,i=r.freshTtlMs,a=r.staleTtlMs??0,o=r.staleIfErrorTtlMs??0,s=r.negativeTtlMs??i,c=r.maxEntries??$n,l=r.waitUntil,u=r.upstreamTimeoutMs??er,d=u>0?u:1e4,f=new Map;function p(e){for(let[t,n]of f)n.stale_if_error_until<=e&&n.stale_until<=e&&f.delete(t);for(;f.size>=c;){let e=f.keys().next().value;if(e===void 0)break;f.delete(e)}}function m(e,t,n){let r=n+(t===null?s:i),c=t===null?r:r+a,l={value:t,fresh_until:r,stale_until:c,stale_if_error_until:t===null?c:c+o};return f.delete(e),p(n),f.set(e,l),l}function h(e,t){return e.refresh_started_at===void 0?!1:t-e.refresh_started_at<d?!0:(e.refresh_started_at=void 0,!1)}function g(t){let n=e.resolveHost(t);return u>0?W(n,u,`resolveHost`):n}async function _(e){let t=f.get(e);t&&(t.refresh_started_at=Date.now());try{let t=await g(e);return m(e,t,Date.now()),t}catch(t){let n=f.get(e);throw n&&(n.refresh_started_at=void 0,n.stale_if_error_until<=Date.now()&&f.delete(e)),t}}return{async resolveHost(e){let t=Date.now(),n=f.get(e);if(n&&n.fresh_until>t)return f.delete(e),f.set(e,n),n.value;if(n&&n.stale_until>t){if(f.delete(e),f.set(e,n),!h(n,t)){let t=_(e).catch(()=>void 0);l&&l(t)}return n.value}try{return await _(e)}catch(e){if(n&&n.stale_if_error_until>t)return n.value;throw e}}}}var tr=class{definitions=new Map;bindings;constructor(e={}){this.bindings=e}add(e){return this.definitions.set(e.type,e),this}has(e){return this.definitions.has(e)}build(e,t){let n=this.definitions.get(e);if(!n)throw Error(`Unknown proxy handler type: ${e}`);let r=n.optionsSchema.safeParse(t);if(!r.success)throw Error(`Invalid options for proxy handler "${e}": ${r.error.message}`);return n.build(r.data,{bindings:this.bindings})}};function K(e){return e}var nr=`__authhero_proxy_request__`,rr=`__authhero_proxy_tenant_id__`,ir=`__authhero_proxy_custom_domain_id__`,ar=`__authhero_proxy_domain__`,or=`x-authhero-proxy-mutability-probe`;function sr(e,t){e.set(nr,t)}function q(e){return e.get(nr)??e.req.raw}function cr(e,t){e.set(rr,t.tenant_id),e.set(ir,t.custom_domain_id),e.set(ar,t.domain)}function lr(e){return e.get(rr)}function ur(e){return e.get(ir)}function dr(e){return e.get(ar)}function fr(e,t){let n=q(e),r=new Headers(n.headers);t(r),sr(e,new Request(n,{headers:r}))}function J(e){let t=e.res;try{t.headers.append(or,`1`),t.headers.delete(or);return}catch{e.res=new Response(t.body,{status:t.status,statusText:t.statusText,headers:new Headers(t.headers)})}}var pr=e.z.object({origins:e.z.array(e.z.string()).optional(),allow_credentials:e.z.boolean().optional(),allow_headers:e.z.array(e.z.string()).optional(),allow_methods:e.z.array(e.z.string()).optional(),expose_headers:e.z.array(e.z.string()).optional(),max_age:e.z.number().int().optional()}).refine(e=>!(e.allow_credentials&&e.origins?.includes(`*`)),{message:`Cannot use wildcard origin (*) with allow_credentials`});function mr(e,t){let n=new Headers,r=e.origins??[`*`],i=r.includes(`*`);return i&&!e.allow_credentials?n.set(`Access-Control-Allow-Origin`,`*`):t&&(i||r.includes(t))&&(n.set(`Access-Control-Allow-Origin`,t),n.append(`Vary`,`Origin`)),e.allow_credentials&&n.set(`Access-Control-Allow-Credentials`,`true`),e.allow_methods?.length&&n.set(`Access-Control-Allow-Methods`,e.allow_methods.join(`, `)),e.allow_headers?.length&&n.set(`Access-Control-Allow-Headers`,e.allow_headers.join(`, `)),e.expose_headers?.length&&n.set(`Access-Control-Expose-Headers`,e.expose_headers.join(`, `)),e.max_age!==void 0&&n.set(`Access-Control-Max-Age`,String(e.max_age)),n}var hr=K({type:`cors`,optionsSchema:pr,build(e){return async(t,n)=>{let r=t.req.header(`origin`)??null;if(t.req.method===`OPTIONS`&&r!==null&&t.req.header(`access-control-request-method`)!==void 0){let t=mr(e,r);return new Response(null,{status:204,headers:t})}await n();let i=mr(e,r);J(t),i.forEach((e,n)=>{n.toLowerCase()===`vary`?t.res.headers.append(n,e):t.res.headers.set(n,e)})}}}),gr=e.z.object({username:e.z.string(),password:e.z.string(),realm:e.z.string().optional()});function _r(e,t){let n=`${e}:${t}`;return typeof btoa==`function`?btoa(n):Buffer.from(n,`utf-8`).toString(`base64`)}var vr=K({type:`basic_auth`,optionsSchema:gr,build(e){let t=_r(e.username,e.password),n=(e.realm??`Restricted`).replace(/["\\\r\n]/g,``);return async(e,r)=>{let i=e.req.header(`authorization`);if(i){let e=i.indexOf(` `);if(e>0){let n=i.slice(0,e),a=i.slice(e+1);if(n.toLowerCase()===`basic`&&a===t)return r()}}return new Response(`Unauthorized`,{status:401,headers:{"WWW-Authenticate":`Basic realm="${n}"`}})}}}),yr=K({type:`headers`,optionsSchema:e.z.object({request:e.z.record(e.z.string(),e.z.string()).optional(),response:e.z.record(e.z.string(),e.z.string()).optional(),remove_request:e.z.array(e.z.string()).optional(),remove_response:e.z.array(e.z.string()).optional()}),build(e){return async(t,n)=>{if((e.request||e.remove_request)&&fr(t,t=>{if(e.remove_request?.forEach(e=>t.delete(e)),e.request)for(let[n,r]of Object.entries(e.request))t.set(n,r)}),await n(),(e.response||e.remove_response)&&(J(t),e.remove_response?.forEach(e=>t.res.headers.delete(e)),e.response))for(let[n,r]of Object.entries(e.response))t.res.headers.set(n,r)}}}),br=K({type:`cache`,optionsSchema:e.z.object({ttl_seconds:e.z.number().int().positive()}),build(e){return async(t,n)=>{if(await n(),!t.res.headers.has(`Cache-Control`)){let n=t.res.headers.has(`set-cookie`)?`private`:`public`;J(t),t.res.headers.set(`Cache-Control`,`${n}, max-age=${e.ttl_seconds}`)}}}}),xr=[`173.245.48.0/20`,`103.21.244.0/22`,`103.22.200.0/22`,`103.31.4.0/22`,`141.101.64.0/18`,`108.162.192.0/18`,`190.93.240.0/20`,`188.114.96.0/20`,`197.234.240.0/22`,`198.41.128.0/17`,`162.158.0.0/15`,`104.16.0.0/13`,`104.24.0.0/14`,`172.64.0.0/13`,`131.0.72.0/22`,`2400:cb00::/32`,`2606:4700::/32`,`2803:f800::/32`,`2405:b500::/32`,`2405:8100::/32`,`2a06:98c0::/29`,`2c0f:f248::/32`];function Sr(e){let t=e.split(`.`);if(t.length!==4)return null;let n=[];for(let e of t){if(!/^\d{1,3}$/.test(e))return null;let t=Number(e);if(t>255)return null;n.push(t)}return n}function Cr(e){if(e===``)return[];let t=e.split(`:`),n=[];for(let e=0;e<t.length;e++){let r=t[e];if(r.includes(`.`)){if(e!==t.length-1)return null;let i=Sr(r);if(!i)return null;n.push(i[0]<<8|i[1],i[2]<<8|i[3]);continue}if(!/^[0-9a-f]{1,4}$/i.test(r))return null;n.push(parseInt(r,16))}return n}function wr(e){let t=e.split(`::`);if(t.length>2)return null;let n=Cr(t[0]??``);if(!n)return null;let r;if(t.length===2){let e=Cr(t[1]??``);if(!e)return null;let i=8-n.length-e.length;if(i<1)return null;r=[...n,...Array(i).fill(0),...e]}else r=n;if(r.length!==8)return null;let i=[];for(let e of r)i.push(e>>8&255,e&255);return i}function Tr(e){let t=e.trim();t.startsWith(`[`)&&t.endsWith(`]`)&&(t=t.slice(1,-1));let n=t.indexOf(`%`);if(n!==-1&&(t=t.slice(0,n)),t===``)return null;if(!t.includes(`:`))return Sr(t);let r=wr(t);return r?r.slice(0,10).every(e=>e===0)&&r[10]===255&&r[11]===255?r.slice(12):r:null}function Er(e){let[t,n]=e.split(`/`),r=Tr(t??``),i=Number(n);if(!r||!Number.isInteger(i))throw Error(`Invalid Cloudflare CIDR: ${e}`);return{bytes:r,prefixBits:i}}var Dr=xr.map(Er);function Or(e,t){if(e.length!==t.bytes.length)return!1;let n=t.prefixBits>>3;for(let r=0;r<n;r++)if(e[r]!==t.bytes[r])return!1;let r=t.prefixBits&7;if(r===0)return!0;let i=255<<8-r&255;return(e[n]&i)===(t.bytes[n]&i)}function kr(e){let t=Tr(e);return t?Dr.some(e=>Or(t,e)):!1}var Ar=K({type:`forwarded_headers`,optionsSchema:e.z.object({client_ip_header:e.z.string().default(`cf-connecting-ip`),set_x_real_ip:e.z.boolean().default(!0),set_x_original_url:e.z.boolean().default(!0),skip_cloudflare_client_ip:e.z.boolean().default(!0)}),build(e){return async(t,n)=>{let r=new URL(t.req.url);fr(t,n=>{n.set(`x-forwarded-host`,r.host),n.set(`x-forwarded-proto`,r.protocol.replace(`:`,``)),e.set_x_original_url&&n.set(`x-original-url`,t.req.url);let i=n.get(e.client_ip_header),a=i&&e.skip_cloudflare_client_ip&&kr(i)?null:i,o=(n.get(`x-forwarded-for`)??``).split(`,`).map(e=>e.trim()).filter(Boolean),s=a??o[o.length-1]??`127.0.0.1`,c=o.length===0||o[o.length-1]!==s,l=o.length?c?`${o.join(`, `)}, ${s}`:o.join(`, `):s;n.set(`x-forwarded-for`,l),e.set_x_real_ip&&n.set(`x-real-ip`,s)}),await n()}}}),jr=e.z.object({upstream_host:e.z.string().optional()});function Mr(e){return e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`)}function Nr(e){if(typeof e.getSetCookie==`function`)return e.getSetCookie();let t=[];return e.forEach((e,n)=>{n.toLowerCase()===`set-cookie`&&t.push(e)}),t}var Pr=K({type:`rewrite_cookies`,optionsSchema:jr,build(e){return async(t,n)=>{await n();let r=new URL(t.req.url).hostname,i=e.upstream_host??t.get(`__proxy_upstream_host__`);if(!i)return;let a=Nr(t.res.headers);if(a.length===0)return;let o=Mr(i),s=RegExp(`(?:^|;\\s*)Domain=\\.?${o}(?=;|$)`,`i`);J(t),t.res.headers.delete(`set-cookie`);for(let e of a)t.res.headers.append(`set-cookie`,e.replace(s,`Domain=${r}`))}}}),Fr=K({type:`rewrite_location`,optionsSchema:e.z.object({upstream_origin:e.z.string().optional()}),build(e){return async(t,n)=>{if(await n(),t.res.headers.has(`x-authhero-preserve-location`)){J(t),t.res.headers.delete(Qn);return}let r=t.res.status;if(r<300||r>=400)return;let i=t.res.headers.get(`location`);if(!i)return;let a=e.upstream_origin??t.get(`__proxy_upstream_origin__`);if(!a)return;let o;try{o=new URL(i)}catch{return}if(o.origin!==a)return;let s=new URL(t.req.url),c=`${`${s.protocol}//${s.host}`}${o.pathname}${o.search}${o.hash}`;J(t),t.res.headers.set(`location`,c)}}}),Ir=new Set([`connection`,`keep-alive`,`proxy-authenticate`,`proxy-authorization`,`te`,`trailers`,`transfer-encoding`,`upgrade`]),Lr=3e4,Rr=e.z.object({upstream_url:e.z.string(),preserve_host:e.z.boolean().default(!1),timeout_ms:e.z.number().int().positive().optional()});function zr(e,t){return e===``||e===`/`?t:`${e.endsWith(`/`)?e.slice(0,-1):e}${t.startsWith(`/`)?t:`/${t}`}`}function Br(e){return e!==`GET`&&e!==`HEAD`}var Vr=128*1024;function Hr(e){let t=e.headers.get(`content-length`);if(t===null)return null;let n=Number(t);return Number.isInteger(n)&&n>=0?n:null}async function Ur(e,t){let n=e.getReader(),r=!1,i=setTimeout(()=>{r=!0,n.cancel().catch(()=>{})},t),a=[],o=0;try{for(;;){let{done:e,value:i}=await n.read();if(r)throw new V(t,`Request body read`);if(e)break;a.push(i),o+=i.byteLength}}finally{clearTimeout(i)}let s=new Uint8Array(o),c=0;for(let e of a)s.set(e,c),c+=e.byteLength;return s.buffer}function Wr(e){return H(e)?new Response(`Request body timeout`,{status:408,headers:{"x-authhero-proxy-error":`request_body_timeout`}}):new Response(`Bad request`,{status:400,headers:{"x-authhero-proxy-error":`request_body_failed`}})}async function Gr(e,t,n){if(!Br(e.method)||!e.body)return;let r=Hr(e);if(r===null||r>Vr)return e.body;let i=await Ur(e.body,n);return t.set(`content-length`,String(i.byteLength)),i}async function Kr(e,t,n){let r=new URL(t.url),i=new URL(e.upstream_url);i.pathname=zr(i.pathname,r.pathname),i.search=r.search;let a=new Headers(t.headers);for(let e of Ir)a.delete(e);e.preserve_host||a.set(`host`,i.host),a.has(`x-forwarded-host`)||a.set(`x-forwarded-host`,r.host),a.has(`x-forwarded-proto`)||a.set(`x-forwarded-proto`,r.protocol.replace(`:`,``));let o=await Gr(t,a,n),s={method:t.method,headers:a,body:o,redirect:`manual`};return o instanceof ReadableStream&&(s.duplex=`half`),{target:i,init:s}}var qr=K({type:`http`,optionsSchema:Rr,build(e){let t=e.timeout_ms??Lr;return async n=>{let r=q(n),i;try{i=await Kr(e,r,t)}catch(e){return Wr(e)}let{target:a,init:o}=i;n.set(`__proxy_upstream_host__`,a.hostname),n.set(`__proxy_upstream_origin__`,`${a.protocol}//${a.host}`);try{return await U(t,e=>fetch(a.toString(),{...o,signal:e}))}catch(e){return H(e)?n.text(`Upstream timeout`,504,{"x-authhero-proxy-error":`http_timeout`}):n.text(`Bad gateway`,502,{"x-authhero-proxy-error":`http_failed`})}}}}),Jr=3e4,Yr=e.z.object({binding:e.z.string(),upstream_url:e.z.string().optional(),preserve_host:e.z.boolean().default(!0),timeout_ms:e.z.number().int().positive().optional()});function Xr(e){return typeof e==`object`&&!!e&&typeof e.fetch==`function`}var Zr=K({type:`service_binding`,optionsSchema:Yr,build(e,t){let n=t.bindings[e.binding];if(!Xr(n))throw Error(`Service binding "${e.binding}" is not configured or is not a Fetcher`);let r=e.upstream_url??`https://${e.binding}.binding.invalid/`,i=e.timeout_ms??Jr;return async t=>{let a=q(t),o;try{o=await Kr({upstream_url:r,preserve_host:e.preserve_host},a,i)}catch(e){return Wr(e)}let{target:s,init:c}=o;t.set(`__proxy_upstream_host__`,s.hostname),t.set(`__proxy_upstream_origin__`,`${s.protocol}//${s.host}`);try{return await U(i,async e=>n.fetch(new Request(s.toString(),{...c,signal:e})))}catch(e){return H(e)?t.text(`service_binding timed out after ${i}ms`,504,{"x-authhero-proxy-error":`service_binding_timeout`}):t.text(`Bad gateway`,502,{"x-authhero-proxy-error":`service_binding_failed`})}}}}),Qr=3e4,$r=e.z.object({binding:e.z.string(),script_name:e.z.string(),cpu_ms:e.z.number().int().positive().optional(),subrequests:e.z.number().int().positive().optional(),timeout_ms:e.z.number().int().positive().optional()});function ei(e){return typeof e==`object`&&!!e&&typeof e.get==`function`}var Y=/\{(tenant_id|custom_domain_id|domain|host)\}/g;function ti(e){return Y.lastIndex=0,Y.test(e)}var ni=K({type:`dispatch_namespace`,optionsSchema:$r,build(e,t){let n=t.bindings[e.binding];if(!ei(n))throw Error(`Dispatch namespace binding "${e.binding}" is not configured or does not expose .get()`);let r=ti(e.script_name),i=e.timeout_ms??Qr,a=e.cpu_ms||e.subrequests?{limits:{...e.cpu_ms?{cpuMs:e.cpu_ms}:{},...e.subrequests?{subrequests:e.subrequests}:{}}}:void 0;return async t=>{let o=e.script_name;if(r){let n=lr(t),r=ur(t),i=dr(t),a=t.req.header(`host`)??t.req.header(`x-forwarded-host`)??``;if(o=o.replace(Y,(e,t)=>{switch(t){case`tenant_id`:return n??``;case`custom_domain_id`:return r??``;case`domain`:return i??``;case`host`:return a;default:return``}}),o.includes(`{`)||o===``)return t.text(`dispatch_namespace: could not resolve script name from template "${e.script_name}"`,500)}let s=q(t);try{let e=n.get(o,void 0,a);return await U(i,async t=>{let n=new Request(s,{signal:t});return e.fetch(n)})}catch(e){return H(e)?t.text(`dispatch_namespace timed out after ${i}ms`,504,{"x-authhero-proxy-error":`dispatch_namespace_timeout`}):t.text(`Bad gateway`,502,{"x-authhero-proxy-error":`dispatch_namespace_failed`})}}}}),ri=K({type:`redirect`,optionsSchema:e.z.object({upstream_url:e.z.string().refine(e=>{try{let t=new URL(e);return(t.protocol===`http:`||t.protocol===`https:`)&&!!t.hostname}catch{return!1}},{message:`upstream_url must be a valid http(s) URL with a hostname`}),status:e.z.union([e.z.literal(301),e.z.literal(302),e.z.literal(307),e.z.literal(308)]).default(302),preserve_path:e.z.boolean().default(!0),preserve_query:e.z.boolean().default(!0)}),build(e){return async t=>{let n=new URL(t.req.url),r=new URL(e.upstream_url),i=r.pathname&&r.pathname!==`/`;return e.preserve_path&&!i&&(r.pathname=n.pathname),e.preserve_query&&!r.search&&(r.search=n.search),new Response(null,{status:e.status,headers:{location:r.toString()}})}}}),ii=K({type:`static`,optionsSchema:e.z.object({status:e.z.number().int().default(200),headers:e.z.record(e.z.string(),e.z.string()).optional(),body:e.z.string().optional(),json:e.z.unknown().optional()}),build(e){return async()=>{let t=new Headers(e.headers??{}),n=e.body??null;return e.json!==void 0&&(n=JSON.stringify(e.json),t.has(`content-type`)||t.set(`content-type`,`application/json; charset=utf-8`)),new Response(n,{status:e.status,headers:t})}}});function ai(e){e.add(hr).add(vr).add(yr).add(br).add(Ar).add(Pr).add(Fr).add(qr).add(Zr).add(ni).add(ri).add(ii)}function oi(e){return[...e].sort((e,t)=>e.priority===t.priority?e.created_at.localeCompare(t.created_at):e.priority-t.priority)}function si(e,t){let n=e.toLowerCase(),r=t.toLowerCase();if(n===r)return!0;if(n.startsWith(`*.`)){let e=n.slice(1);return r.endsWith(e)&&r.length>e.length}return!1}function ci(e,t){return!e||e.length===0?!0:e.some(e=>si(e,t))}function li(e){let t=(e.headers?Object.entries(e.headers):[]).map(([e,t])=>[e.toLowerCase(),new RegExp(t)]),n=(e.query?Object.entries(e.query):[]).map(([e,t])=>[e,new RegExp(t)]),r=e.hosts;return async(e,i)=>{if(r&&!ci(r,e.req.header(`host`)??``))return new Response(`No matching route`,{status:404});for(let[n,r]of t){let t=e.req.header(n);if(t===void 0||!r.test(t))return new Response(`No matching route`,{status:404})}if(n.length>0){let t=new URL(e.req.url);for(let[e,r]of n){let n=t.searchParams.get(e);if(n===null||!r.test(n))return new Response(`No matching route`,{status:404})}}await i()}}var ui=`forwarded_headers`;function di(e){return e.some(e=>e.type===`forwarded_headers`)?[...e]:[{type:ui,options:{}},...e]}function X(e,t){return e.has(`forwarded_headers`)?di(t):[...t]}var fi=[`GET`,`POST`,`PUT`,`PATCH`,`DELETE`,`OPTIONS`,`HEAD`];function Z(e,n,r,i){let a=new t.Hono;r&&a.use(`*`,async(e,t)=>{cr(e,r),await t()});let o=oi(e);for(let e of o){let t=[];t.push(li(e.match));for(let r of X(n,e.handlers))t.push(n.build(r.type,r.options));let r=e.match.methods?.length?e.match.methods.map(e=>e.toUpperCase()):fi,i=e.match.path||`/*`;a.on(r,[i],...t)}return i&&i.length>0?a.on(fi,[`*`],...i):a.all(`*`,e=>e.text(`No matching route`,404)),a.onError((e,t)=>{let n=H(e);return t.text(n?`Upstream timeout`:`Bad gateway`,n?504:502,{"x-authhero-proxy-error":n?`handler_timeout`:`handler_failed`})}),a}var pi=1e4;function mi(e){return e.resolver?e.resolver:e.cache?G(e.data,e.cache):G(e.data,e.cacheTtlMs??3e4)}function hi(e){if(e.registry)return e.registry;let t=new tr(e.bindings??{});return ai(t),t}function Q(e){let t=mi(e),n=hi(e),r=new WeakMap,i=e.resolveHostTimeoutMs??pi,a=e.defaultHandlers&&e.defaultHandlers.length>0?X(n,e.defaultHandlers).map(e=>n.build(e.type,e.options)):void 0,o=a?Z([],n,void 0,a):void 0;return async e=>{let s=e.req.header(`host`)??e.req.header(`x-forwarded-host`);if(!s)return e.text(`Missing host`,400);try{let c=await W(t.resolveHost(s),i,`resolveHost`);if(!c)return o?await o.fetch(e.req.raw):e.text(`Unknown host`,404);let l=r.get(c);return l||(l=Z(c.routes,n,{tenant_id:c.tenant_id,custom_domain_id:c.custom_domain_id,domain:c.domain},a),r.set(c,l)),await l.fetch(e.req.raw)}catch(t){return o?await o.fetch(e.req.raw):H(t)?e.text(`Resolve host timed out after ${i}ms`,504,{"x-authhero-proxy-error":`resolve_host_timeout`}):e.text(`Bad gateway`,502,{"x-authhero-proxy-error":`data_plane_error`})}}}function gi(e){let n=new t.Hono;return n.all(`*`,Q(e)),n}function _i(e){let n=new t.Hono;return n.all(`*`,Q({data:e.data,cacheTtlMs:e.cacheTtlMs,cache:e.cache,resolver:e.resolver,registry:e.registry,bindings:e.bindings,resolveHostTimeoutMs:e.resolveHostTimeoutMs,defaultHandlers:e.defaultHandlers})),n.onError((e,t)=>{let n=H(e);return t.text(n?`Proxy timeout`:`Bad gateway`,n?504:502,{"x-authhero-proxy-error":n?`proxy_timeout`:`proxy_error`})}),n}var vi=1e3,yi=1e3;function bi(e,t){return new Request(`https://proxy-cache.internal/${encodeURIComponent(e)}/hosts/${encodeURIComponent(t.toLowerCase())}`,{method:`GET`})}function xi(){return globalThis.caches?.default}function Si(e){let t=e.cache??xi();if(!t)return e.upstream;let n=t,r=e.namespace??`authhero-proxy`,i=e.cacheTtlSeconds??60,a=e.negativeCacheTtlSeconds??10,o=e.waitUntil,s=e.cacheReadTimeoutMs??vi,c=e.cacheWriteTimeoutMs??yi;async function l(e){try{return await W(Promise.resolve(n.match(e)),s,`cache.match`)}catch{return}}return{async resolveHost(t){let s=bi(r,t),u=await l(s);if(u)try{return(await u.json()).value}catch{}let d=await e.upstream.resolveHost(t),f=d===null?a:i,p=new Response(JSON.stringify({value:d}),{headers:{"content-type":`application/json`,"cache-control":`public, max-age=${f}`}}),m=W(Promise.resolve(n.put(s,p)),c,`cache.put`).catch(()=>void 0);return o?o(m):await m,d}}}function Ci(e,t){return bi(e,t)}var wi=1e3,Ti=1e3,Ei=5e3;function Di(e){let{upstream:t,cache:n,freshTtlMs:r,staleTtlMs:i=0,staleIfErrorTtlMs:a=0,negativeTtlMs:o=r,keyPrefix:s=`authhero-proxy-host`,waitUntil:c,cacheReadTimeoutMs:l=wi,cacheWriteTimeoutMs:u=Ti,upstreamTimeoutMs:d=Ei}=e,f=d>0?d:1e4,p=new Map;function m(e){return`${s}:${e.toLowerCase()}`}async function h(e){try{return await W(n.get(e),l,`cache.get`)??null}catch{return null}}function g(e,t,r){let i=W(Promise.resolve().then(()=>n.set(e,t,r)),u,`cache.set`).catch(()=>void 0);return c?(c(i),Promise.resolve()):i}function _(e,t){let n=p.get(e);return n===void 0?!1:t-n<f?!0:(p.delete(e),!1)}function v(e){let n=t.resolveHost(e);return d>0?W(n,d,`resolveHost`):n}async function y(e){return p.set(e,Date.now()),(async()=>{try{let t=await v(e),n=Date.now(),s=t===null?o:r,c=t===null?0:i,l=t===null?0:a,u={value:t,freshUntilMs:n+s,staleUntilMs:n+s+c,staleIfErrorUntilMs:n+s+c+l},d=Math.max(1,Math.ceil((s+c+l)/1e3));return await g(m(e),u,d),t}finally{p.delete(e)}})()}return{async resolveHost(e){let t=await h(m(e)),n=Date.now();if(t&&typeof t.freshUntilMs==`number`){if(t.freshUntilMs>n)return t.value;if(t.staleUntilMs>n){if(!_(e,n)){let t=y(e).catch(()=>void 0);c&&c(t)}return t.value}}try{return await y(e)}catch(e){if(t&&(t.staleIfErrorUntilMs??t.staleUntilMs)>n)return t.value;throw e}}}}function Oi(e,t){return`${e}:${t.toLowerCase()}`}function $(){throw Error(`Static proxy adapter is read-only; configure routes at init time`)}function ki(e,t,n,r,i,a){return{id:e.id??`${n}:${t}`,tenant_id:r,custom_domain_id:i,priority:e.priority??100,match:{...e.match,path:e.match.path||`/*`},handlers:e.handlers,created_at:e.created_at??a,updated_at:e.updated_at??a}}function Ai(e){let t=new Date().toISOString(),n=e.defaultTenantId??`static`,r=new Map;for(let[i,a]of Object.entries(e.hosts)){let e=i.toLowerCase(),o=Array.isArray(a)?{routes:a}:a,s=o.tenant_id??n,c=o.custom_domain_id??e,l=o.routes.map((n,r)=>ki(n,r,e,s,c,t)).sort((e,t)=>e.priority-t.priority);r.set(e,{tenant_id:s,custom_domain_id:c,domain:e,routes:l})}return{proxyRoutes:{async create(){return $()},async update(){return $()},async remove(){return $()},async get(e,t){for(let n of r.values()){if(n.tenant_id!==e)continue;let r=n.routes.find(e=>e.id===t);if(r)return r}return null},async list(e,t){let n=[];for(let i of r.values())i.tenant_id===e&&(t?.custom_domain_id&&i.custom_domain_id!==t.custom_domain_id||n.push(...i.routes));let i=t?.per_page??n.length,a=(t?.page??0)*i,o=n.slice(a,a+i);return{proxy_routes:o,start:a,limit:i,length:o.length}}},async resolveHost(e){return r.get(e.toLowerCase())??null}}}function ji(e,t={}){return{priority:t.priority,match:{path:t.path??`/*`},handlers:[{type:`http`,options:{upstream_url:e,preserve_host:t.preserve_host??!1}}]}}var Mi=`proxy:resolve_host`;function Ni(){let e=()=>{throw Error(`HTTP proxy adapter does not expose write access to proxy_routes; mutate via the control-plane management API`)};return{async create(){return e()},async update(){return e()},async remove(){return e()},async get(){throw Error(`HTTP proxy adapter does not expose per-route reads; use resolveHost`)},async list(){throw Error(`HTTP proxy adapter does not expose per-route reads; use resolveHost`)}}}function Pi(e){let t=e.fetch??fetch,n=e.baseUrl.replace(/\/+$/,``),r=e.resolveHostPath??`/api/v2/proxy/control-plane/hosts/`,i=e.audience??`${n}/api/v2/`,a=e.scope??`proxy:resolve_host`,o=e.tokenRefreshSkewSeconds??60,s=e.timeoutMs??2500;function c(e){let t=new AbortController,n,r=new Promise((e,r)=>{n=setTimeout(()=>{t.abort(),r(new V(s,`control plane`))},s)});return Promise.race([e(t.signal),r]).finally(()=>clearTimeout(n))}let l=null;async function u(){let r=await c(async r=>{let o=await t(`${n}/oauth/token`,{method:`POST`,headers:{"content-type":`application/json`},body:JSON.stringify({grant_type:`client_credentials`,client_id:e.clientId,client_secret:e.clientSecret,audience:i,scope:a}),signal:r});if(!o.ok)throw Error(`Proxy adapter token request failed: ${o.status} ${await o.text().catch(()=>``)}`);return await o.json()}),s=r.expires_in??3600;return l={value:r.access_token,expires_at:Date.now()+(s-o)*1e3},r.access_token}async function d(){return l&&l.expires_at>Date.now()?l.value:u()}return{proxyRoutes:Ni(),async resolveHost(e){let i=await d(),a=`${n}${r}${encodeURIComponent(e.toLowerCase())}`;return c(async e=>{let n=await t(a,{headers:{authorization:`Bearer ${i}`},signal:e});if(n.status===404)return null;if(!n.ok)throw Error(`Proxy adapter resolveHost failed: ${n.status} ${await n.text().catch(()=>``)}`);return await n.json()})}}}function Fi(e){return(t,n)=>{let r=t instanceof Request&&n===void 0?t:new Request(t,n);return e.fetch(r)}}var Ii=`authhero-proxy-host:`;function Li(e,t){return`${e}${t.toLowerCase()}`}function Ri(){let e=()=>{throw Error(`KV proxy adapter does not expose write access to proxy_routes; mutate via the control-plane management API`)};return{async create(){return e()},async update(){return e()},async remove(){return e()},async get(){throw Error(`KV proxy adapter does not expose per-route reads; use resolveHost`)},async list(){throw Error(`KV proxy adapter does not expose per-route reads; use resolveHost`)}}}function zi(e){let{kv:t,keyPrefix:n=Ii,timeoutMs:r}=e;return{proxyRoutes:Ri(),async resolveHost(e){let i=Li(n,e),a=t.get(i,`json`);return(r&&r>0?await W(a,r,`kv.get`):await a)??null}}}exports.DEFAULT_KV_HOST_KEY_PREFIX=Ii,exports.FORWARDED_HEADERS_HANDLER_TYPE=ui,exports.HandlerRegistry=tr,exports.PROXY_RESOLVE_HOST_SCOPE=Mi,exports.basicAuthHandler=vr,exports.buildCacheAdapterKey=Oi,exports.buildCacheApiKey=Ci,exports.buildKvHostKey=Li,exports.buildMatchFilter=li,exports.cacheHandler=br,exports.compileHostApp=Z,exports.corsHandler=hr,exports.createCacheAdapterHostCache=Di,exports.createCacheApiHostCache=Si,exports.createHttpProxyAdapter=Pi,exports.createInMemoryHostCache=G,exports.createKvProxyAdapter=zi,exports.createProxyApp=_i,exports.createProxyDataPlaneHandler=Q,exports.createProxyDataPlaneRouter=gi,exports.createServiceBindingFetch=Fi,exports.createStaticProxyAdapter=Ai,exports.defineHandler=K,exports.dispatchNamespaceHandler=ni,exports.forwardedHeadersHandler=Ar,exports.handlerConfigSchema=Cn,exports.headersHandler=yr,exports.httpHandler=qr,exports.httpRoute=ji,exports.isCloudflareIp=kr,exports.matchSchema=Sn,exports.matchesAnyHost=ci,exports.matchesHost=si,exports.proxyRouteInsertSchema=B,exports.proxyRouteSchema=wn,exports.proxyRouteUpdateSchema=Tn,exports.redirectHandler=ri,exports.registerBuiltinHandlers=ai,exports.rewriteCookiesHandler=Pr,exports.rewriteLocationHandler=Fr,exports.serviceBindingHandler=Zr,exports.sortRoutes=oi,exports.staticHandler=ii,exports.withForwardedHeaders=di,exports.withForwardedHeadersFor=X;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("@hono/zod-openapi"),t=require("hono");var n=e.z.object({created_at:e.z.string(),updated_at:e.z.string()}),r=e.z.object({id:e.z.string(),version:e.z.string().optional()}),i=e.z.object({name:e.z.string(),version:e.z.string()}),a=e.z.object({name:e.z.string(),value:e.z.string().optional()}),o=e.z.object({name:e.z.string().max(255),code:e.z.string().max(1e5),supported_triggers:e.z.array(r).optional(),runtime:e.z.string().max(50).optional(),dependencies:e.z.array(i).optional(),secrets:e.z.array(a).optional(),is_system:e.z.boolean().optional(),inherit:e.z.boolean().optional()});o.partial().extend({status:e.z.enum([`draft`,`built`]).optional(),deployed_at:e.z.string().optional()});var s=o.extend({id:e.z.string(),tenant_id:e.z.string(),status:e.z.enum([`draft`,`built`]).default(`built`),deployed_at:e.z.string().optional(),secrets:e.z.array(e.z.object({name:e.z.string(),value:e.z.string().optional()})).optional()}).extend(n.shape),c=e.z.object({name:e.z.string()});s.extend({secrets:e.z.array(c).optional()});var l=e.z.string(),u=e.z.enum([`unspecified`,`pending`,`final`,`partial`,`canceled`,`suspended`]),d=e.z.object({id:e.z.string(),msg:e.z.string(),url:e.z.string().optional()}),f=e.z.object({action_name:e.z.string(),error:d.nullable(),started_at:e.z.string(),ended_at:e.z.string()}),p=e.z.object({level:e.z.enum([`log`,`info`,`warn`,`error`,`debug`]),message:e.z.string()}),m=e.z.array(e.z.object({action_name:e.z.string(),lines:e.z.array(p)}));e.z.object({id:e.z.string(),tenant_id:e.z.string(),trigger_id:l,status:u,results:e.z.array(f),logs:m.optional(),created_at:e.z.string(),updated_at:e.z.string()}).omit({tenant_id:!0,created_at:!0,updated_at:!0}),e.z.object({action_id:e.z.string(),code:e.z.string().max(1e5),runtime:e.z.string().max(50).optional(),dependencies:e.z.array(i).optional(),secrets:e.z.array(a).optional(),supported_triggers:e.z.array(r).optional(),deployed:e.z.boolean().default(!0)}).extend({id:e.z.string(),tenant_id:e.z.string(),number:e.z.number().int()}).extend(n.shape);var h=e.z.enum([`user_action`,`admin_action`,`system`,`api`]),g=e.z.object({type:e.z.enum([`user`,`admin`,`system`,`api_key`,`client_credentials`]),id:e.z.string().optional(),email:e.z.string().optional(),org_id:e.z.string().optional(),org_name:e.z.string().optional(),scopes:e.z.array(e.z.string()).optional(),client_id:e.z.string().optional()}),_=e.z.object({type:e.z.string(),id:e.z.string(),before:e.z.record(e.z.string(),e.z.unknown()).optional(),after:e.z.record(e.z.string(),e.z.unknown()).optional(),diff:e.z.record(e.z.string(),e.z.object({old:e.z.unknown(),new:e.z.unknown()})).optional()}),v=e.z.object({method:e.z.string(),path:e.z.string(),query:e.z.record(e.z.string(),e.z.string()).optional(),body:e.z.unknown().optional(),ip:e.z.string(),user_agent:e.z.string().optional(),correlation_id:e.z.string().optional(),redirect_uri:e.z.string().optional()}),y=e.z.object({status_code:e.z.number(),body:e.z.unknown().optional()}),ee=e.z.object({country_code:e.z.string(),city_name:e.z.string(),latitude:e.z.string(),longitude:e.z.string(),time_zone:e.z.string(),continent_code:e.z.string()}),te=e.z.object({name:e.z.string(),version:e.z.string(),env:e.z.record(e.z.string(),e.z.string()).optional()});e.z.object({tenant_id:e.z.string(),event_type:e.z.string(),log_type:e.z.string(),description:e.z.string().optional(),category:h,actor:g,target:_,request:v,response:y.optional(),connection:e.z.string().optional(),connection_id:e.z.string().optional(),client_name:e.z.string().optional(),strategy:e.z.string().optional(),strategy_type:e.z.string().optional(),audience:e.z.string().optional(),scope:e.z.string().optional(),location:ee.optional(),auth0_client:te.optional(),hostname:e.z.string(),is_mobile:e.z.boolean().optional(),timestamp:e.z.string()}).extend({id:e.z.string()}),e.z.enum([`AUTH0`,`EMAIL`,`REDIRECT`]),e.z.enum([`CREATE_USER`,`GET_USER`,`UPDATE_USER`,`SEND_REQUEST`,`SEND_EMAIL`]),e.z.enum([`VERIFY_EMAIL`]);var ne=e.z.object({require_mx_record:e.z.boolean().optional(),block_aliases:e.z.boolean().optional(),block_free_emails:e.z.boolean().optional(),block_disposable_emails:e.z.boolean().optional(),blocklist:e.z.array(e.z.string()).optional(),allowlist:e.z.array(e.z.string()).optional()}),re=e.z.object({id:e.z.string(),alias:e.z.string().max(100).optional(),type:e.z.literal(`AUTH0`),action:e.z.literal(`UPDATE_USER`),allow_failure:e.z.boolean().optional(),mask_output:e.z.boolean().optional(),params:e.z.object({connection_id:e.z.string().optional(),user_id:e.z.string(),changes:e.z.record(e.z.string(),e.z.any())})}),ie=e.z.object({id:e.z.string(),alias:e.z.string().max(100).optional(),type:e.z.literal(`EMAIL`),action:e.z.literal(`VERIFY_EMAIL`),allow_failure:e.z.boolean().optional(),mask_output:e.z.boolean().optional(),params:e.z.object({email:e.z.string(),rules:ne.optional()})}),ae=e.z.enum([`change-email`,`account`,`custom`]),oe=e.z.object({id:e.z.string(),alias:e.z.string().max(100).optional(),type:e.z.literal(`REDIRECT`),action:e.z.literal(`REDIRECT_USER`),allow_failure:e.z.boolean().optional(),mask_output:e.z.boolean().optional(),params:e.z.object({target:ae.openapi({description:`The predefined target to redirect to, or 'custom' for a custom URL`}),custom_url:e.z.string().optional().openapi({description:`Custom URL to redirect to when target is 'custom'`})})}),se=e.z.union([re,ie,oe]);e.z.object({name:e.z.string().min(1).max(150).openapi({description:`The name of the flow`}),actions:e.z.array(se).optional().default([]).openapi({description:`The list of actions to execute in sequence`})}).extend(n.shape).extend({id:e.z.string().openapi({description:`Unique identifier for the flow`,example:`af_12tMpdJ3iek7svMyZkSh5M`})}),e.z.object({page:e.z.string().min(0).optional().default(`0`).transform(e=>parseInt(e,10)).openapi({description:`The page number where 0 is the first page`}),per_page:e.z.string().min(1).optional().default(`50`).transform(e=>parseInt(e,10)).openapi({description:`The number of items per page. Defaults to 50.`}),include_totals:e.z.string().optional().default(`false`).transform(e=>e===`true`).openapi({description:`If the total number of items should be included in the response`}),sort:e.z.string().regex(/^.+:(-1|1)$/).optional().openapi({description:`A property that should have the format 'string:-1' or 'string:1'`}),q:e.z.string().optional().openapi({description:`A lucene query string used to filter the results`})}),e.z.object({start:e.z.number(),limit:e.z.number(),length:e.z.number(),total:e.z.number().optional(),next:e.z.string().optional()});var ce=e.z.object({email:e.z.string().optional(),email_verified:e.z.boolean().optional(),name:e.z.string().optional(),username:e.z.string().optional(),given_name:e.z.string().optional(),phone_number:e.z.string().optional(),phone_verified:e.z.boolean().optional(),family_name:e.z.string().optional()}).catchall(e.z.any()),le=e.z.object({connection:e.z.string(),user_id:e.z.string(),provider:e.z.string(),isSocial:e.z.boolean(),email:e.z.string().optional(),email_verified:e.z.boolean().optional(),phone_number:e.z.string().optional(),phone_verified:e.z.boolean().optional(),username:e.z.string().optional(),access_token:e.z.string().optional(),access_token_secret:e.z.string().optional(),refresh_token:e.z.string().optional(),profileData:ce.optional()}),ue=e.z.object({formatted:e.z.string().optional(),street_address:e.z.string().optional(),locality:e.z.string().optional(),region:e.z.string().optional(),postal_code:e.z.string().optional(),country:e.z.string().optional()}).optional(),de=e.z.object({email:e.z.string().transform(e=>e.toLowerCase()).optional(),username:e.z.string().refine(e=>!e.includes(`@`),{message:`Usernames must not contain "@". Use the email field for email addresses.`}).optional(),phone_number:e.z.string().optional(),phone_verified:e.z.boolean().optional(),given_name:e.z.string().optional(),family_name:e.z.string().optional(),nickname:e.z.string().optional(),name:e.z.string().optional(),picture:e.z.string().optional(),locale:e.z.string().optional(),linked_to:e.z.string().optional(),profileData:e.z.string().optional(),user_id:e.z.string().optional(),app_metadata:e.z.any().default({}).optional(),user_metadata:e.z.any().default({}).optional(),middle_name:e.z.string().optional(),preferred_username:e.z.string().optional(),profile:e.z.string().optional(),website:e.z.string().optional(),gender:e.z.string().optional(),birthdate:e.z.string().optional(),zoneinfo:e.z.string().optional(),address:ue});de.extend({email_verified:e.z.boolean().default(!1),verify_email:e.z.boolean().optional(),last_ip:e.z.string().optional(),last_login:e.z.string().optional(),user_id:e.z.string().optional(),provider:e.z.string().optional(),connection:e.z.string(),is_social:e.z.boolean().optional(),blocked:e.z.boolean().optional(),registration_completed_at:e.z.string().optional(),password:e.z.object({hash:e.z.string(),algorithm:e.z.string()}).optional()}).omit({password:!0}).extend(n.shape).extend({user_id:e.z.string(),provider:e.z.string(),is_social:e.z.boolean(),email:e.z.string().optional(),login_count:e.z.number().default(0),identities:e.z.array(le).optional()}).omit({registration_completed_at:!0}),de.extend({login_count:e.z.number(),multifactor:e.z.array(e.z.string()).optional(),last_ip:e.z.string().optional(),last_login:e.z.string().optional(),user_id:e.z.string()}).catchall(e.z.any());var fe=`useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict`,pe=(e=21)=>{let t=``,n=crypto.getRandomValues(new Uint8Array(e|=0));for(;e--;)t+=fe[n[e]&63];return t},me=e.z.object({client_id:e.z.string().optional().openapi({description:`ID of this client. Generated server-side if omitted (Auth0 behavior).`}),name:e.z.string().min(1).openapi({description:`Name of this client (min length: 1 character, does not allow < or >).`}),description:e.z.string().max(140).optional().openapi({description:`Free text description of this client (max length: 140 characters).`}),global:e.z.boolean().default(!1).openapi({description:`Whether this is your global 'All Applications' client representing legacy tenant settings (true) or a regular client (false).`}),client_secret:e.z.string().default(()=>pe()).optional().openapi({description:`Client secret (which you must not make public).`}),app_type:e.z.enum([`native`,`spa`,`regular_web`,`non_interactive`,`resource_server`,`express_configuration`,`rms`,`box`,`cloudbees`,`concur`,`dropbox`,`mscrm`,`echosign`,`egnyte`,`newrelic`,`office365`,`salesforce`,`sentry`,`sharepoint`,`slack`,`springcm`,`zendesk`,`zoom`,`sso_integration`,`oag`]).default(`regular_web`).optional().openapi({description:`The type of application this client represents`}),logo_uri:e.z.string().url().optional().openapi({description:`URL of the logo to display for this client. Recommended size is 150x150 pixels.`}),is_first_party:e.z.boolean().default(!0).openapi({description:`Whether this client is a first party client (true) or not (false). First-party clients skip the consent screen; third-party clients require explicit user consent for non-basic scopes.`}),oidc_conformant:e.z.boolean().default(!0).openapi({description:`Whether this client conforms to strict OIDC specifications (true) or uses legacy features (false).`}),auth0_conformant:e.z.boolean().default(!0).openapi({description:`Whether this client follows Auth0-compatible behavior (true) or strict OIDC behavior (false). When true, profile/email claims are included in the ID token when scopes are requested. When false, these claims are only available from the userinfo endpoint (strict OIDC 5.4 compliance).`}),callbacks:e.z.array(e.z.string()).default([]).optional().openapi({description:`Comma-separated list of URLs whitelisted for Auth0 to use as a callback to the client after authentication.`}),allowed_origins:e.z.array(e.z.string()).default([]).optional().openapi({description:`Comma-separated list of URLs allowed to make requests from JavaScript to Auth0 API (typically used with CORS). By default, all your callback URLs will be allowed. This field allows you to enter other origins if necessary. You can also use wildcards at the subdomain level (e.g., https://*.contoso.com). Query strings and hash information are not taken into account when validating these URLs.`}),web_origins:e.z.array(e.z.string()).default([]).optional().openapi({description:`Comma-separated list of allowed origins for use with Cross-Origin Authentication, Device Flow, and web message response mode.`}),client_aliases:e.z.array(e.z.string()).default([]).optional().openapi({description:`List of audiences/realms for SAML protocol. Used by the wsfed addon.`}),allowed_clients:e.z.array(e.z.string()).default([]).optional().openapi({description:`List of allow clients and API ids that are allowed to make delegation requests. Empty means all all your clients are allowed.`}),connections:e.z.array(e.z.string()).default([]).optional().openapi({description:`List of connection IDs enabled for this client. The order determines the display order on the login page.`}),allowed_logout_urls:e.z.array(e.z.string()).default([]).optional().openapi({description:`Comma-separated list of URLs that are valid to redirect to after logout from Auth0. Wildcards are allowed for subdomains.`}),session_transfer:e.z.record(e.z.string(),e.z.any()).default({}).optional().openapi({description:`Native to Web SSO Configuration`}),oidc_logout:e.z.object({backchannel_logout_urls:e.z.array(e.z.string()).optional().openapi({description:`URLs that receive a signed OIDC Back-Channel Logout 1.0 logout token when a session this client participated in ends.`}),backchannel_logout_initiators:e.z.object({mode:e.z.enum([`all`,`custom`]).optional().openapi({description:`Whether all session-end events initiate a backchannel logout (all) or only the selected_initiators (custom).`}),selected_initiators:e.z.array(e.z.string()).optional().openapi({description:`Logout initiators that trigger a backchannel logout when mode is custom (e.g. rp-logout, idp-logout, password-changed).`})}).passthrough().optional().openapi({description:`Controls which session-end events initiate backchannel logout notifications. Stored for Auth0 compatibility; not yet enforced — all initiators currently notify.`})}).passthrough().default({}).optional().openapi({description:`Configuration for OIDC backchannel logout`}),grant_types:e.z.array(e.z.string()).default([]).optional().openapi({description:`List of grant types supported for this application. Can include authorization_code, implicit, refresh_token, client_credentials, password, http://auth0.com/oauth/grant-type/password-realm, http://auth0.com/oauth/grant-type/mfa-oob, http://auth0.com/oauth/grant-type/mfa-otp, http://auth0.com/oauth/grant-type/mfa-recovery-code, urn:openid:params:grant-type:ciba, and urn:ietf:params:oauth:grant-type:device_code.`}),jwt_configuration:e.z.record(e.z.string(),e.z.any()).default({}).optional().openapi({description:`Configuration related to JWTs for the client.`}),signing_keys:e.z.array(e.z.record(e.z.string(),e.z.any())).default([]).optional().openapi({description:`Signing certificates associated with this client.`}),encryption_key:e.z.record(e.z.string(),e.z.any()).default({}).optional().openapi({description:`Encryption used for WsFed responses with this client.`}),sso:e.z.boolean().default(!1).openapi({description:`Applies only to SSO clients and determines whether Auth0 will handle Single Sign On (true) or whether the Identity Provider will (false).`}),sso_disabled:e.z.boolean().default(!1).openapi({description:`Whether Single Sign On is disabled for this client. When true, existing SSO sessions will not be reused and users must authenticate every time.`}),cross_origin_authentication:e.z.boolean().default(!1).openapi({description:`Whether this client can be used to make cross-origin authentication requests (true) or it is not allowed to make such requests (false).`}),cross_origin_loc:e.z.string().url().optional().openapi({description:`URL of the location in your site where the cross origin verification takes place for the cross-origin auth flow when performing Auth in your own domain instead of Auth0 hosted login page.`}),custom_login_page_on:e.z.boolean().default(!1).openapi({description:`Whether a custom login page is to be used (true) or the default provided login page (false).`}),custom_login_page:e.z.string().optional().openapi({description:`The content (HTML, CSS, JS) of the custom login page.`}),custom_login_page_preview:e.z.string().optional().openapi({description:`The content (HTML, CSS, JS) of the custom login page. (Used on Previews)`}),form_template:e.z.string().optional().openapi({description:`HTML form template to be used for WS-Federation.`}),addons:e.z.record(e.z.string(),e.z.any()).default({}).optional().openapi({description:`Addons enabled for this client and their associated configurations.`}),token_endpoint_auth_method:e.z.enum([`none`,`client_secret_post`,`client_secret_basic`,`client_secret_jwt`,`private_key_jwt`]).default(`client_secret_basic`).optional().openapi({description:"Defines the requested authentication method for the token endpoint. `none` (public client), `client_secret_post` / `client_secret_basic` (HTTP POST / Basic), `client_secret_jwt` (RFC 7523 HMAC assertion using client_secret), or `private_key_jwt` (RFC 7523 asymmetric assertion verified against the client's `jwks` / `jwks_uri`)."}),client_metadata:e.z.record(e.z.string(),e.z.string().max(255)).default({}).optional().openapi({description:`Metadata associated with the client, in the form of an object with string values (max 255 chars). Maximum of 10 metadata properties allowed. Field names (max 255 chars) are alphanumeric and may only include the following special characters: :,-+=_*?"/()<>@ [Tab][Space]`}),hide_sign_up_disabled_error:e.z.boolean().default(!1).optional().openapi({description:"Enumeration-safe variant of the connection-level `disable_signup` flag. When a signup is blocked by the password connection and this is true, the identifier screen does not reveal that an email is unknown — it advances to the OTP/password challenge as if the account existed and fails at credential check. Mitigates email enumeration at the cost of UX: users without an account see a generic credential failure instead of an explicit signup-disabled message."}),mobile:e.z.record(e.z.string(),e.z.any()).default({}).optional().openapi({description:`Additional configuration for native mobile apps.`}),initiate_login_uri:e.z.string().url().optional().openapi({description:`Initiate login uri, must be https`}),native_social_login:e.z.record(e.z.string(),e.z.any()).default({}).optional(),refresh_token:e.z.object({rotation_type:e.z.enum([`rotating`,`non-rotating`]).optional().openapi({description:`Whether refresh tokens for this client are rotated on every exchange (Auth0 'rotating' behavior) or kept stable (legacy non-rotating). Defaults to 'non-rotating' when unset.`}),leeway:e.z.number().int().min(0).max(600).optional().openapi({description:`Seconds after a parent token's first rotation during which presenting it again still mints a fresh sibling child instead of triggering reuse-detection. Defaults to 30s when unset.`}),expiration_type:e.z.enum([`expiring`,`non-expiring`]).optional().openapi({description:`Whether refresh tokens for this client expire at all. 'non-expiring' overrides both the absolute and the idle lifetime.`}),token_lifetime:e.z.number().int().min(0).optional().openapi({description:"Refresh-token absolute lifetime in seconds. Falls back to the tenant's `session_lifetime` when unset."}),infinite_token_lifetime:e.z.boolean().optional().openapi({description:"When true, refresh tokens have no absolute expiry (overrides `token_lifetime`)."}),idle_token_lifetime:e.z.number().int().min(0).optional().openapi({description:"Refresh-token idle (sliding) lifetime in seconds, refreshed on every exchange. Falls back to the tenant's `idle_session_lifetime` when unset."}),infinite_idle_token_lifetime:e.z.boolean().optional().openapi({description:"When true, refresh tokens have no idle expiry (overrides `idle_token_lifetime`)."})}).default({}).optional().openapi({description:`Refresh token configuration`}),default_organization:e.z.record(e.z.string(),e.z.any()).default({}).optional().openapi({description:`Defines the default Organization ID and flows`}),organization_usage:e.z.enum([`deny`,`allow`,`require`]).default(`deny`).optional().openapi({description:`Defines how to proceed during an authentication transaction with regards an organization. Can be deny (default), allow or require.`}),organization_require_behavior:e.z.enum([`no_prompt`,`pre_login_prompt`,`post_login_prompt`]).default(`no_prompt`).optional().openapi({description:`Defines how to proceed during an authentication transaction when client.organization_usage: 'require'. Can be no_prompt (default), pre_login_prompt or post_login_prompt. post_login_prompt requires oidc_conformant: true.`}),client_authentication_methods:e.z.record(e.z.string(),e.z.any()).default({}).optional().openapi({description:`Defines client authentication methods.`}),require_pushed_authorization_requests:e.z.boolean().default(!1).openapi({description:`Makes the use of Pushed Authorization Requests mandatory for this client`}),require_proof_of_possession:e.z.boolean().default(!1).openapi({description:`Makes the use of Proof-of-Possession mandatory for this client`}),signed_request_object:e.z.record(e.z.string(),e.z.any()).default({}).optional().openapi({description:`JWT-secured Authorization Requests (JAR) settings.`}),compliance_level:e.z.enum([`none`,`fapi1_adv_pkj_par`,`fapi1_adv_mtls_par`,`fapi2_sp_pkj_mtls`,`fapi2_sp_mtls_mtls`]).optional().openapi({description:`Defines the compliance level for this client, which may restrict it's capabilities`}),par_request_expiry:e.z.number().optional().openapi({description:`Specifies how long, in seconds, a Pushed Authorization Request URI remains valid`}),token_quota:e.z.record(e.z.string(),e.z.any()).default({}).optional(),owner_user_id:e.z.string().optional().openapi({description:`User ID of the consenting user when this client was created via IAT-gated Dynamic Client Registration. NULL for clients created via the Management API or open DCR.`}),registration_type:e.z.enum([`manual`,`open_dcr`,`iat_dcr`]).optional().openapi({description:"Provenance of this client. `manual` = Management API; `open_dcr` = RFC 7591 without IAT; `iat_dcr` = RFC 7591 with an Initial Access Token."}),registration_metadata:e.z.record(e.z.string(),e.z.any()).default({}).optional().openapi({description:"Arbitrary metadata captured at Dynamic Client Registration time that isn't a first-class client field (e.g. integration_type, domain). Also stores `iat_constraints` for clients created via IAT so RFC 7592 PUT can enforce field immutability."}),user_linking_mode:e.z.enum([`builtin`,`off`]).optional().openapi({description:"Per-client override for the built-in email-based user-linking path. `builtin` runs the legacy in-process linking at user creation/email update. `off` disables the legacy path; linking only happens if the tenant has enabled the `account-linking` template hook. When unset, the service-level `userLinkingMode` default applies."})});e.z.object({created_at:e.z.string(),updated_at:e.z.string()}).extend(me.shape).extend({client_id:e.z.string()});var he=e.z.object({client_id:e.z.string().min(1).openapi({description:`ID of the client.`}),audience:e.z.string().min(1).openapi({description:`The audience (API identifier) of this client grant.`}),scope:e.z.array(e.z.string()).optional().openapi({description:`Scopes allowed for this client grant.`}),organization_usage:e.z.enum([`deny`,`allow`,`require`]).optional().openapi({description:`Defines whether organizations can be used with client credentials exchanges for this grant.`}),allow_any_organization:e.z.boolean().optional().openapi({description:`If enabled, any organization can be used with this grant. If disabled (default), the grant must be explicitly assigned to the desired organizations.`}),is_system:e.z.boolean().optional().openapi({description:`If enabled, this grant is a special grant created by Auth0. It cannot be modified or deleted directly.`}),subject_type:e.z.enum([`client`,`user`]).optional().openapi({description:`The type of application access the client grant allows. Use of this field is subject to the applicable Free Trial terms in Okta's Master Subscription Agreement.`}),authorization_details_types:e.z.array(e.z.string()).optional().openapi({description:`Types of authorization_details allowed for this client grant. Use of this field is subject to the applicable Free Trial terms in Okta's Master Subscription Agreement.`})}),ge=e.z.object({id:e.z.string().openapi({description:`ID of the client grant.`})}).extend(he.shape).extend({created_at:e.z.string().optional(),updated_at:e.z.string().optional()});e.z.array(ge);var _e=e.z.enum([`iat`,`rat`]),ve=e.z.object({id:e.z.string(),token_hash:e.z.string(),type:_e,client_id:e.z.string().optional(),sub:e.z.string().optional(),constraints:e.z.record(e.z.string(),e.z.unknown()).optional(),single_use:e.z.boolean().default(!1),expires_at:e.z.string().optional()});e.z.object({created_at:e.z.string(),used_at:e.z.string().optional(),revoked_at:e.z.string().optional()}).extend(ve.shape);var b=e.z.object({x:e.z.number(),y:e.z.number()}),ye=function(e){return e.RICH_TEXT=`RICH_TEXT`,e.NEXT_BUTTON=`NEXT_BUTTON`,e.BACK_BUTTON=`BACK_BUTTON`,e.SUBMIT_BUTTON=`SUBMIT_BUTTON`,e.DIVIDER=`DIVIDER`,e.TEXT=`TEXT`,e.EMAIL=`EMAIL`,e.PASSWORD=`PASSWORD`,e.NUMBER=`NUMBER`,e.PHONE=`PHONE`,e.DATE=`DATE`,e.CHECKBOX=`CHECKBOX`,e.RADIO=`RADIO`,e.SELECT=`SELECT`,e.HIDDEN=`HIDDEN`,e.LEGAL=`LEGAL`,e}({}),be=function(e){return e.BLOCK=`BLOCK`,e.FIELD=`FIELD`,e}({}),x=e.z.object({id:e.z.string(),category:e.z.nativeEnum(be),type:e.z.nativeEnum(ye)}),xe=x.extend({category:e.z.literal(`BLOCK`),type:e.z.literal(`RICH_TEXT`),config:e.z.object({content:e.z.string()}).passthrough()}),Se=x.extend({category:e.z.literal(`BLOCK`),type:e.z.union([e.z.literal(`NEXT_BUTTON`),e.z.literal(`BACK_BUTTON`),e.z.literal(`SUBMIT_BUTTON`)]),config:e.z.object({text:e.z.string()}).passthrough()}),Ce=x.extend({category:e.z.literal(`FIELD`),type:e.z.literal(`LEGAL`),required:e.z.boolean().optional(),sensitive:e.z.boolean().optional(),config:e.z.object({text:e.z.string()}).passthrough()}),we=x.extend({category:e.z.literal(`FIELD`),type:e.z.union([e.z.literal(`TEXT`),e.z.literal(`EMAIL`),e.z.literal(`PASSWORD`),e.z.literal(`NUMBER`),e.z.literal(`PHONE`),e.z.literal(`DATE`),e.z.literal(`CHECKBOX`),e.z.literal(`RADIO`),e.z.literal(`SELECT`),e.z.literal(`HIDDEN`)]),required:e.z.boolean().optional(),sensitive:e.z.boolean().optional(),config:e.z.object({label:e.z.string().optional(),placeholder:e.z.string().optional()}).passthrough()}),Te=e.z.object({id:e.z.string(),category:e.z.string(),type:e.z.string()}).passthrough(),Ee=e.z.union([xe,Se,Ce,we,Te]),De=e.z.object({id:e.z.string(),type:e.z.literal(`STEP`),coordinates:b,alias:e.z.string().optional(),config:e.z.object({components:e.z.array(Ee),next_node:e.z.string()}).passthrough()}),Oe=e.z.object({id:e.z.string(),type:e.z.literal(`FLOW`),coordinates:b,alias:e.z.string().optional(),config:e.z.object({flow_id:e.z.string(),next_node:e.z.string()})}),ke=e.z.object({id:e.z.string(),type:e.z.literal(`ACTION`),coordinates:b,alias:e.z.string().optional(),config:e.z.object({action_type:e.z.enum([`REDIRECT`]).openapi({description:`The type of action to perform`}),target:e.z.enum([`change-email`,`account`,`custom`]).openapi({description:`The predefined target to redirect to`}),custom_url:e.z.string().optional().openapi({description:`Custom URL when target is 'custom'`}),next_node:e.z.string().openapi({description:`The next node to navigate to after action (for non-redirect actions)`})}).passthrough()}),Ae=e.z.object({id:e.z.string(),type:e.z.string(),coordinates:b}).passthrough(),je=e.z.union([De,Oe,ke,Ae]),Me=e.z.object({next_node:e.z.string(),coordinates:b}).passthrough(),Ne=e.z.object({resume_flow:e.z.boolean().optional(),coordinates:b}).passthrough();e.z.object({id:e.z.string(),name:e.z.string(),languages:e.z.object({primary:e.z.string()}).passthrough(),nodes:e.z.array(je),start:Me,ending:Ne,created_at:e.z.string(),updated_at:e.z.string(),links:e.z.object({sdkSrc:e.z.string().optional(),sdk_src:e.z.string().optional()}).passthrough()}).passthrough().omit({id:!0,created_at:!0,updated_at:!0});var Pe=function(e){return e.TOKEN=`token`,e.ID_TOKEN=`id_token`,e.TOKEN_ID_TOKEN=`id_token token`,e.CODE=`code`,e.CODE_ID_TOKEN=`code id_token`,e.CODE_TOKEN=`code token`,e.CODE_ID_TOKEN_TOKEN=`code id_token token`,e}({}),Fe=function(e){return e.QUERY=`query`,e.FRAGMENT=`fragment`,e.FORM_POST=`form_post`,e.WEB_MESSAGE=`web_message`,e.SAML_POST=`saml_post`,e}({}),Ie=function(e){return e.S256=`S256`,e.Plain=`plain`,e}({}),Le=e.z.union([e.z.null(),e.z.object({essential:e.z.boolean().optional(),value:e.z.unknown().optional(),values:e.z.array(e.z.unknown()).optional()})]).nullable(),Re=e.z.object({userinfo:e.z.record(e.z.string(),Le).optional(),id_token:e.z.record(e.z.string(),Le).optional()}),ze=e.z.object({client_id:e.z.string(),act_as:e.z.string().optional(),response_type:e.z.nativeEnum(Pe).optional(),response_mode:e.z.nativeEnum(Fe).optional(),redirect_uri:e.z.string().optional(),audience:e.z.string().optional(),organization:e.z.string().optional(),state:e.z.string().optional(),nonce:e.z.string().optional(),scope:e.z.string().optional(),prompt:e.z.string().optional(),code_challenge_method:e.z.nativeEnum(Ie).optional(),code_challenge:e.z.string().optional(),username:e.z.string().optional(),ui_locales:e.z.string().optional(),max_age:e.z.number().optional(),acr_values:e.z.string().optional(),claims:Re.optional(),vendor_id:e.z.string().optional()});e.z.object({colors:e.z.object({primary:e.z.string(),page_background:e.z.union([e.z.string(),e.z.object({type:e.z.string().optional(),start:e.z.string().optional(),end:e.z.string().optional(),angle_deg:e.z.number().optional()})]).optional()}).optional(),logo_url:e.z.string().optional(),favicon_url:e.z.string().optional(),powered_by_logo_url:e.z.string().optional(),font:e.z.object({url:e.z.string()}).optional(),dark_mode:e.z.enum([`dark`,`light`,`auto`]).optional()});var Be=e.z.enum([`password_reset`,`email_verification`,`otp`,`mfa_otp`,`authorization_code`,`oauth2_state`,`ticket`,`client_assertion_jti`]);e.z.object({code_id:e.z.string().openapi({description:`The code that will be used in for instance an email verification flow`}),login_id:e.z.string().optional().openapi({description:`The id of the login session that the code is connected to`}),connection_id:e.z.string().optional().openapi({description:`The connection that the code is connected to`}),code_type:Be,code_verifier:e.z.string().optional().openapi({description:`The code verifier used in PKCE in outbound flows`}),code_challenge:e.z.string().optional().openapi({description:`The code challenge used in PKCE in outbound flows`}),code_challenge_method:e.z.enum([`plain`,`S256`]).optional().openapi({description:`The code challenge method used in PKCE in outbound flows`}),redirect_uri:e.z.string().optional().openapi({description:`The redirect URI associated with the code`}),otp:e.z.string().optional().openapi({description:`The one-time password value for OTP-based flows`}),nonce:e.z.string().optional().openapi({description:`The nonce value used for security in OIDC flows`}),state:e.z.string().optional().openapi({description:`The state parameter used for CSRF protection in OAuth flows`}),expires_at:e.z.string(),used_at:e.z.string().optional(),user_id:e.z.string().optional()}).extend({created_at:e.z.string()});var Ve=e.z.object({kid:e.z.string().optional(),team_id:e.z.string().optional(),realms:e.z.string().optional(),authentication_method:e.z.string().optional(),client_id:e.z.string().optional(),client_secret:e.z.string().optional(),app_secret:e.z.string().optional(),scope:e.z.string().optional(),client_secret_hint:e.z.string().optional(),app_secret_hint:e.z.string().optional(),twilio_token_hint:e.z.string().optional(),authorization_endpoint:e.z.string().optional(),token_endpoint:e.z.string().optional(),userinfo_endpoint:e.z.string().optional(),jwks_uri:e.z.string().optional(),discovery_url:e.z.string().optional(),issuer:e.z.string().optional(),token_endpoint_auth_method:e.z.enum([`client_secret_basic`,`client_secret_post`]).optional(),provider:e.z.string().optional(),from:e.z.string().optional(),twilio_sid:e.z.string().optional(),twilio_token:e.z.string().optional(),icon_url:e.z.string().optional(),domain_aliases:e.z.array(e.z.string()).optional(),callback_url:e.z.string().url().optional(),passwordPolicy:e.z.enum([`none`,`low`,`fair`,`good`,`excellent`]).optional(),password_complexity_options:e.z.object({min_length:e.z.number().optional()}).optional(),password_history:e.z.object({enable:e.z.boolean().optional(),size:e.z.number().optional()}).optional(),password_no_personal_info:e.z.object({enable:e.z.boolean().optional()}).optional(),password_dictionary:e.z.object({enable:e.z.boolean().optional(),dictionary:e.z.array(e.z.string()).optional()}).optional(),disable_signup:e.z.boolean().optional(),brute_force_protection:e.z.boolean().optional(),import_mode:e.z.boolean().optional(),configuration:e.z.object({token_endpoint:e.z.string().optional(),userinfo_endpoint:e.z.string().optional(),client_id:e.z.string().optional(),client_secret:e.z.string().optional(),client_secret_hint:e.z.string().optional(),realm:e.z.string().optional()}).optional(),attributes:e.z.object({email:e.z.object({identifier:e.z.object({active:e.z.boolean().optional()}).optional(),signup:e.z.object({status:e.z.enum([`required`,`optional`,`disabled`]).optional(),verification:e.z.object({active:e.z.boolean().optional()}).optional()}).optional(),validation:e.z.object({allowed:e.z.boolean().optional()}).optional(),unique:e.z.boolean().optional(),profile_required:e.z.boolean().optional(),verification_method:e.z.enum([`link`,`code`]).optional()}).optional(),username:e.z.object({identifier:e.z.object({active:e.z.boolean().optional()}).optional(),signup:e.z.object({status:e.z.enum([`required`,`optional`,`disabled`]).optional()}).optional(),validation:e.z.object({max_length:e.z.number().optional(),min_length:e.z.number().optional(),allowed_types:e.z.object({email:e.z.boolean().optional(),phone_number:e.z.boolean().optional()}).optional()}).optional(),profile_required:e.z.boolean().optional()}).optional(),phone_number:e.z.object({identifier:e.z.object({active:e.z.boolean().optional()}).optional(),signup:e.z.object({status:e.z.enum([`required`,`optional`,`disabled`]).optional()}).optional()}).optional()}).optional(),authentication_methods:e.z.object({password:e.z.object({enabled:e.z.boolean().optional()}).optional(),passkey:e.z.object({enabled:e.z.boolean().optional()}).optional()}).optional(),passkey_options:e.z.object({challenge_ui:e.z.enum([`both`,`autofill`,`button`]).optional(),local_enrollment_enabled:e.z.boolean().optional(),progressive_enrollment_enabled:e.z.boolean().optional()}).optional(),requires_username:e.z.boolean().optional(),validation:e.z.object({username:e.z.object({min:e.z.number().optional(),max:e.z.number().optional()}).optional()}).optional(),set_user_root_attributes:e.z.enum([`on_each_login`,`on_first_login`,`never_on_login`]).optional()});function S(e){if(e!==null){if(Array.isArray(e))return e.filter(e=>e!==null).map(S);if(e&&typeof e==`object`){let t={};for(let[n,r]of Object.entries(e))r!==null&&(t[n]=S(r));return t}return e}}var He=e.z.object({id:e.z.string().optional(),name:e.z.string(),display_name:e.z.string().optional(),strategy:e.z.string(),options:e.z.preprocess(e=>e===null?{}:S(e),Ve).default({}),enabled_clients:e.z.array(e.z.string()).default([]).optional(),response_type:e.z.nativeEnum(Pe).optional(),response_mode:e.z.nativeEnum(Fe).optional(),is_domain_connection:e.z.boolean().optional(),show_as_button:e.z.boolean().optional(),metadata:e.z.record(e.z.string(),e.z.any()).optional(),is_system:e.z.boolean().optional()});e.z.object({id:e.z.string(),created_at:e.z.string().transform(e=>e===null?``:e),updated_at:e.z.string().transform(e=>e===null?``:e)}).extend(He.shape);var Ue=e.z.object({domain:e.z.string(),custom_domain_id:e.z.string().optional(),type:e.z.enum([`auth0_managed_certs`,`self_managed_certs`]),verification_method:e.z.enum([`txt`]).optional(),tls_policy:e.z.enum([`recommended`]).optional(),custom_client_ip_header:e.z.enum([`true-client-ip`,`cf-connecting-ip`,`x-forwarded-for`,`x-azure-clientip`,`null`]).optional(),domain_metadata:e.z.record(e.z.string(),e.z.string().max(255)).optional()}),We=e.z.discriminatedUnion(`name`,[e.z.object({name:e.z.literal(`txt`),record:e.z.string(),domain:e.z.string()}),e.z.object({name:e.z.literal(`http`),http_body:e.z.string(),http_url:e.z.string()})]),Ge=Ue.extend({custom_domain_id:e.z.string(),primary:e.z.boolean(),status:e.z.enum([`disabled`,`pending`,`pending_verification`,`ready`]),origin_domain_name:e.z.string().optional(),verification:e.z.object({methods:e.z.array(We)}).optional(),tls_policy:e.z.string().optional()});Ue.pick({tls_policy:!0,custom_client_ip_header:!0,domain_metadata:!0}).strict(),Ge.extend({tenant_id:e.z.string()}),e.z.object({certificate:e.z.string().regex(/^-----BEGIN CERTIFICATE-----[\s\S]+-----END CERTIFICATE-----\s*$/,`must be PEM-encoded; include the full certificate chain in leaf-first order`),private_key:e.z.string().regex(/-----BEGIN (RSA |EC |ENCRYPTED )?PRIVATE KEY-----[\s\S]+-----END \1PRIVATE KEY-----\s*$/,`must be a PEM-encoded private key`)});var C=e.z.object({id:e.z.string(),order:e.z.number().optional(),visible:e.z.boolean().optional().default(!0)}),w=C.extend({category:e.z.literal(`BLOCK`).optional()}),Ke=w.extend({type:e.z.literal(`DIVIDER`),config:e.z.object({text:e.z.string().optional()}).optional()}),qe=w.extend({type:e.z.literal(`HTML`),config:e.z.object({content:e.z.string().optional()}).optional()}),Je=w.extend({type:e.z.literal(`IMAGE`),config:e.z.object({src:e.z.string().optional(),alt:e.z.string().optional(),width:e.z.number().optional(),height:e.z.number().optional()}).optional()}),Ye=w.extend({type:e.z.literal(`JUMP_BUTTON`),config:e.z.object({text:e.z.string().optional(),target_step:e.z.string().optional()})}),Xe=w.extend({type:e.z.literal(`RESEND_BUTTON`),config:e.z.object({text:e.z.string().optional(),resend_action:e.z.string().optional()})}),Ze=w.extend({type:e.z.literal(`NEXT_BUTTON`),config:e.z.object({text:e.z.string().optional()})}),Qe=w.extend({type:e.z.literal(`PREVIOUS_BUTTON`),config:e.z.object({text:e.z.string().optional()})}),$e=w.extend({type:e.z.literal(`RICH_TEXT`),config:e.z.object({content:e.z.string().optional()}).optional()}),T=C.extend({category:e.z.literal(`WIDGET`).optional(),label:e.z.string().min(1).optional(),hint:e.z.string().min(1).max(500).optional(),required:e.z.boolean().optional(),sensitive:e.z.boolean().optional()}),et=T.extend({type:e.z.literal(`AUTH0_VERIFIABLE_CREDENTIALS`),config:e.z.object({credential_type:e.z.string().optional()})}),tt=T.extend({type:e.z.literal(`GMAPS_ADDRESS`),config:e.z.object({api_key:e.z.string().optional()})}),nt=T.extend({type:e.z.literal(`RECAPTCHA`),config:e.z.object({site_key:e.z.string().optional()})}),E=C.extend({category:e.z.literal(`FIELD`).optional(),label:e.z.string().min(1).optional(),hint:e.z.string().min(1).max(500).optional(),messages:e.z.array(e.z.object({id:e.z.number().optional(),text:e.z.string(),type:e.z.enum([`info`,`error`,`success`,`warning`])})).optional(),required:e.z.boolean().optional(),sensitive:e.z.boolean().optional()}),rt=E.extend({type:e.z.literal(`BOOLEAN`),config:e.z.object({default_value:e.z.boolean().optional()}).optional()}),it=E.extend({type:e.z.literal(`CARDS`),config:e.z.object({options:e.z.array(e.z.object({value:e.z.string(),label:e.z.string(),description:e.z.string().optional(),image:e.z.string().optional()})).optional(),multi_select:e.z.boolean().optional()}).optional()}),at=E.extend({type:e.z.literal(`CHOICE`),config:e.z.object({options:e.z.array(e.z.object({value:e.z.string(),label:e.z.string()})).optional(),display:e.z.enum([`radio`,`checkbox`]).optional(),multiple:e.z.boolean().optional(),default_value:e.z.union([e.z.string(),e.z.array(e.z.string())]).optional()}).optional()}),ot=E.extend({type:e.z.literal(`CODE`),config:e.z.object({length:e.z.number().int().positive().max(100).optional(),mode:e.z.enum([`numeric`,`alphanumeric`]).optional(),auto_submit:e.z.boolean().optional(),group_size:e.z.number().int().min(0).max(100).optional(),separator:e.z.string().optional(),placeholder:e.z.string().optional(),default_value:e.z.string().optional()}).refine(e=>e.group_size===void 0||e.length===void 0||e.group_size<=e.length,{message:`group_size cannot exceed length`,path:[`group_size`]}).refine(e=>e.default_value===void 0||e.length===void 0||e.default_value.length<=e.length,{message:`default_value is longer than the configured length`,path:[`default_value`]}).optional()}),st=E.extend({type:e.z.literal(`CUSTOM`),config:e.z.object({component:e.z.string().optional(),props:e.z.record(e.z.string(),e.z.any()).optional(),schema:e.z.record(e.z.string(),e.z.any()).optional(),code:e.z.string().optional()})}),ct=E.extend({type:e.z.literal(`DATE`),config:e.z.object({format:e.z.string().optional(),min:e.z.string().optional(),max:e.z.string().optional(),default_value:e.z.string().optional()}).optional()}),lt=E.extend({type:e.z.literal(`DROPDOWN`),config:e.z.object({options:e.z.array(e.z.object({value:e.z.string(),label:e.z.string()})).optional(),placeholder:e.z.string().optional(),searchable:e.z.boolean().optional(),multiple:e.z.boolean().optional(),default_value:e.z.union([e.z.string(),e.z.array(e.z.string())]).optional()}).optional()}),ut=E.extend({type:e.z.literal(`EMAIL`),config:e.z.object({placeholder:e.z.string().optional(),default_value:e.z.string().optional(),last_used:e.z.boolean().optional(),last_used_label:e.z.string().optional()}).optional()}),dt=E.extend({type:e.z.literal(`FILE`),config:e.z.object({accept:e.z.string().optional(),max_size:e.z.number().optional(),multiple:e.z.boolean().optional()}).optional()}),ft=E.extend({type:e.z.literal(`LEGAL`),config:e.z.object({text:e.z.string(),html:e.z.boolean().optional()}).optional()}),pt=E.extend({type:e.z.literal(`NUMBER`),config:e.z.object({placeholder:e.z.string().optional(),min:e.z.number().optional(),max:e.z.number().optional(),step:e.z.number().optional(),default_value:e.z.string().optional()}).optional()}),mt=E.extend({type:e.z.literal(`PASSWORD`),config:e.z.object({placeholder:e.z.string().optional(),min_length:e.z.number().optional(),show_toggle:e.z.boolean().optional(),forgot_password_link:e.z.string().optional(),default_value:e.z.string().optional()}).optional()}),ht=E.extend({type:e.z.literal(`PAYMENT`),config:e.z.object({provider:e.z.string().optional(),currency:e.z.string().optional()}).optional()}),gt=E.extend({type:e.z.literal(`SOCIAL`),config:e.z.object({providers:e.z.array(e.z.string()).optional(),provider_details:e.z.array(e.z.object({name:e.z.string(),strategy:e.z.string().optional(),display_name:e.z.string().optional(),icon_url:e.z.string().optional(),href:e.z.string().optional(),last_used:e.z.boolean().optional(),last_used_label:e.z.string().optional()})).optional()}).optional()}),_t=E.extend({type:e.z.literal(`TEL`),config:e.z.object({placeholder:e.z.string().optional(),default_country:e.z.string().optional(),default_value:e.z.string().optional(),allow_email:e.z.boolean().optional()}).optional()}),vt=E.extend({type:e.z.literal(`TEXT`),config:e.z.object({placeholder:e.z.string().optional(),multiline:e.z.boolean().optional(),max_length:e.z.number().optional(),default_value:e.z.string().optional(),last_used:e.z.boolean().optional(),last_used_label:e.z.string().optional()}).optional()}),yt=E.extend({type:e.z.literal(`COUNTRY`),config:e.z.object({placeholder:e.z.string().optional(),default_value:e.z.string().optional()}).optional()}),bt=E.extend({type:e.z.literal(`URL`),config:e.z.object({placeholder:e.z.string().optional(),default_value:e.z.string().optional()}).optional()}),xt=e.z.discriminatedUnion(`type`,[Ke,qe,Je,Ye,Xe,Ze,Qe,$e]),St=e.z.discriminatedUnion(`type`,[et,tt,nt]),Ct=e.z.discriminatedUnion(`type`,[rt,it,at,ot,yt,st,ct,lt,ut,dt,ft,pt,mt,ht,gt,_t,vt,bt]),D=e.z.union([xt,St,Ct]);new Set([`BOOLEAN`,`CARDS`,`CHOICE`,`CODE`,`COUNTRY`,`DATE`,`DROPDOWN`,`EMAIL`,`LEGAL`,`NUMBER`,`PASSWORD`,`TEL`,`TEXT`,`URL`]),e.z.object({id:e.z.string(),type:e.z.literal(`submit`),label:e.z.string(),className:e.z.string().optional(),disabled:e.z.boolean().optional().default(!1),order:e.z.number().optional(),visible:e.z.boolean().optional().default(!0),customizations:e.z.record(e.z.string(),e.z.any()).optional()});var O=e.z.object({x:e.z.number(),y:e.z.number()}),wt=e.z.object({id:e.z.string(),type:e.z.literal(`FLOW`),coordinates:O,alias:e.z.string().min(1).max(150).optional(),config:e.z.object({flow_id:e.z.string().max(30),next_node:e.z.string().optional()})}),Tt=e.z.object({id:e.z.string(),type:e.z.literal(`ROUTER`),coordinates:O,alias:e.z.string().min(1).max(150),config:e.z.object({rules:e.z.array(e.z.object({id:e.z.string(),alias:e.z.string().min(1).max(150).optional(),condition:e.z.any(),next_node:e.z.string()})),fallback:e.z.string()})}),Et=e.z.object({id:e.z.string(),type:e.z.literal(`STEP`),coordinates:O,alias:e.z.string().min(1).max(150).optional(),config:e.z.object({components:e.z.array(D),next_node:e.z.string().optional()})}),Dt=e.z.discriminatedUnion(`type`,[wt,Tt,Et]),Ot=e.z.object({name:e.z.string().openapi({description:`The name of the form`}),messages:e.z.object({errors:e.z.record(e.z.string(),e.z.any()).optional(),custom:e.z.record(e.z.string(),e.z.any()).optional()}).optional(),languages:e.z.object({primary:e.z.string().optional(),default:e.z.string().optional()}).optional(),translations:e.z.record(e.z.string(),e.z.any()).optional(),nodes:e.z.array(Dt).optional(),start:e.z.object({hidden_fields:e.z.array(e.z.object({key:e.z.string(),value:e.z.string()})).optional(),next_node:e.z.string().optional(),coordinates:O.optional()}).optional(),ending:e.z.object({redirection:e.z.object({delay:e.z.number().optional(),target:e.z.string().optional()}).optional(),after_submit:e.z.object({flow_id:e.z.string().optional()}).optional(),coordinates:O.optional(),resume_flow:e.z.boolean().optional()}).optional(),style:e.z.object({css:e.z.string().optional()}).optional(),links:e.z.object({sdkSrc:e.z.string().optional(),sdk_src:e.z.string().optional()}).optional()}).openapi({description:`Schema for flow-based forms (matches Auth0 Forms structure)`});n.extend(Ot.shape).extend({id:e.z.string()});var kt=e.z.object({id:e.z.number().optional(),text:e.z.string(),type:e.z.enum([`info`,`error`,`success`,`warning`])}),At=e.z.object({id:e.z.string().optional(),text:e.z.string(),href:e.z.string(),linkText:e.z.string().optional()});e.z.object({name:e.z.string().optional(),action:e.z.string(),method:e.z.enum([`POST`,`GET`]),title:e.z.string().optional(),description:e.z.string().optional(),components:e.z.array(D),messages:e.z.array(kt).optional(),links:e.z.array(At).optional(),footer:e.z.string().optional()});var k=e.z.enum([`pre-user-registration`,`post-user-registration`,`post-user-login`,`post-user-update`,`validate-registration-username`,`pre-user-deletion`,`post-user-deletion`]),A=e.z.enum([`post-user-login`]),j=e.z.enum([`post-user-login`,`post-user-registration`,`post-user-update`,`credentials-exchange`]),M=e.z.enum([`post-user-login`,`credentials-exchange`,`pre-user-registration`,`post-user-registration`]),N=e.z.enum([`post-user-login`]);k.options,A.options,j.options,M.options,N.options;var jt=e.z.enum([`impersonate`]),Mt=e.z.enum([`ensure-username`,`set-preferred-username`,`account-linking`]),P={enabled:e.z.boolean().default(!1),synchronous:e.z.boolean().default(!1),priority:e.z.number().optional(),hook_id:e.z.string().optional(),metadata:e.z.record(e.z.string(),e.z.unknown()).optional()},Nt=e.z.object({...P,trigger_id:k,url:e.z.string()}),Pt=e.z.object({...P,trigger_id:A,form_id:e.z.string()}),Ft=e.z.object({...P,trigger_id:j,template_id:Mt}),It=e.z.object({...P,trigger_id:M,code_id:e.z.string()}),Lt=e.z.object({...P,trigger_id:N,page_id:jt,permission_required:e.z.string().optional()});e.z.union([Nt,Pt,Ft,It,Lt]);var Rt=e.z.object({...P,trigger_id:k}).extend(n.shape).extend({hook_id:e.z.string(),url:e.z.string()}),zt=e.z.object({...P,trigger_id:A}).extend(n.shape).extend({hook_id:e.z.string(),form_id:e.z.string()}),Bt=e.z.object({...P,trigger_id:j}).extend(n.shape).extend({hook_id:e.z.string(),template_id:Mt}),Vt=e.z.object({...P,trigger_id:M}).extend(n.shape).extend({hook_id:e.z.string(),code_id:e.z.string()}),Ht=e.z.object({...P,trigger_id:N}).extend(n.shape).extend({hook_id:e.z.string(),page_id:jt,permission_required:e.z.string().optional()});e.z.union([Rt,zt,Bt,Vt,Ht]),e.z.object({code:e.z.string().max(1e5),secrets:e.z.record(e.z.string(),e.z.string()).optional()}).extend({id:e.z.string(),tenant_id:e.z.string()}).extend(n.shape);var Ut=e.z.object({name:e.z.string().optional()}),Wt=e.z.object({email:e.z.string().optional()}),Gt=e.z.object({id:e.z.string().optional(),organization_id:e.z.string().max(50),inviter:Ut,invitee:Wt,invitation_url:e.z.string().url(),client_id:e.z.string(),connection_id:e.z.string().optional(),app_metadata:e.z.record(e.z.string(),e.z.any()).default({}).optional(),user_metadata:e.z.record(e.z.string(),e.z.any()).default({}).optional(),ttl_sec:e.z.number().int().max(2592e3).default(604800).optional(),roles:e.z.array(e.z.string()).default([]).optional(),send_invitation_email:e.z.boolean().default(!0).optional()});e.z.object({id:e.z.string(),organization_id:e.z.string().max(50),created_at:e.z.string().datetime(),expires_at:e.z.string().datetime(),ticket_id:e.z.string().optional()}).extend(Gt.omit({id:!0}).shape);var Kt=e.z.object({alg:e.z.enum([`RS256`,`RS384`,`RS512`,`ES256`,`ES384`,`ES512`,`HS256`,`HS384`,`HS512`]),kid:e.z.string().optional(),kty:e.z.enum([`RSA`,`EC`,`oct`]),use:e.z.enum([`sig`,`enc`]).optional(),n:e.z.string().optional(),e:e.z.string().optional(),crv:e.z.string().optional(),x:e.z.string().optional(),y:e.z.string().optional(),x5t:e.z.string().optional(),x5c:e.z.array(e.z.string()).optional()}).superRefine((t,n)=>{if(t.kty===`RSA`)for(let r of[`n`,`e`])t[r]||n.addIssue({code:e.z.ZodIssueCode.custom,path:[r],message:`RSA JWK is missing required member '${r}'`});else if(t.kty===`EC`)for(let r of[`crv`,`x`,`y`])t[r]||n.addIssue({code:e.z.ZodIssueCode.custom,path:[r],message:`EC JWK is missing required member '${r}'`})});e.z.object({keys:e.z.array(Kt)}),e.z.object({issuer:e.z.string(),authorization_endpoint:e.z.string(),token_endpoint:e.z.string(),userinfo_endpoint:e.z.string(),jwks_uri:e.z.string(),registration_endpoint:e.z.string().optional(),revocation_endpoint:e.z.string(),end_session_endpoint:e.z.string().optional(),scopes_supported:e.z.array(e.z.string()),response_types_supported:e.z.array(e.z.string()),grant_types_supported:e.z.array(e.z.string()).optional(),code_challenge_methods_supported:e.z.array(e.z.string()),response_modes_supported:e.z.array(e.z.string()),subject_types_supported:e.z.array(e.z.string()),id_token_signing_alg_values_supported:e.z.array(e.z.string()),token_endpoint_auth_methods_supported:e.z.array(e.z.string()),claims_supported:e.z.array(e.z.string()),request_uri_parameter_supported:e.z.boolean(),request_parameter_supported:e.z.boolean(),claims_parameter_supported:e.z.boolean().optional(),request_object_signing_alg_values_supported:e.z.array(e.z.string()).optional(),token_endpoint_auth_signing_alg_values_supported:e.z.array(e.z.string()),client_id_metadata_document_supported:e.z.boolean().optional(),backchannel_logout_supported:e.z.boolean().optional(),backchannel_logout_session_supported:e.z.boolean().optional()});var qt=function(e){return e.PENDING=`pending`,e.AUTHENTICATED=`authenticated`,e.AWAITING_EMAIL_VERIFICATION=`awaiting_email_verification`,e.AWAITING_MFA=`awaiting_mfa`,e.AWAITING_HOOK=`awaiting_hook`,e.AWAITING_CONTINUATION=`awaiting_continuation`,e.AWAITING_CONSENT=`awaiting_consent`,e.COMPLETED=`completed`,e.FAILED=`failed`,e.EXPIRED=`expired`,e}({}),Jt=e.z.nativeEnum(qt),F=e.z.object({strategy:e.z.string(),strategy_type:e.z.string()});e.z.object({csrf_token:e.z.string(),auth0Client:e.z.string().optional(),authParams:ze,expires_at:e.z.string(),deleted_at:e.z.string().optional(),ip:e.z.string().optional(),useragent:e.z.string().optional(),session_id:e.z.string().optional(),authorization_url:e.z.string().optional(),state:Jt.optional().default(`pending`),state_data:e.z.string().optional(),failure_reason:e.z.string().optional(),user_id:e.z.string().optional(),auth_connection:e.z.string().optional(),auth_strategy:F.optional(),authenticated_at:e.z.string().optional()}).openapi({description:`This represents a login sesion`}).extend({id:e.z.string().openapi({description:`This is is used as the state in the universal login`}),created_at:e.z.string(),updated_at:e.z.string()});var I={ACLS_SUMMARY:`acls_summary`,ACTIONS_EXECUTION_FAILED:`actions_execution_failed`,API_LIMIT:`api_limit`,API_LIMIT_WARNING:`api_limit_warning`,APPI:`appi`,CIBA_EXCHANGE_FAILED:`ciba_exchange_failed`,CIBA_EXCHANGE_SUCCEEDED:`ciba_exchange_succeeded`,CIBA_START_FAILED:`ciba_start_failed`,CIBA_START_SUCCEEDED:`ciba_start_succeeded`,CODE_LINK_SENT:`cls`,CODE_SENT:`cs`,DEPRECATION_NOTICE:`depnote`,FAILED_LOGIN:`f`,FAILED_BY_CONNECTOR:`fc`,FAILED_CHANGE_EMAIL:`fce`,FAILED_BY_CORS:`fco`,FAILED_CROSS_ORIGIN_AUTHENTICATION:`fcoa`,FAILED_CHANGE_PASSWORD:`fcp`,FAILED_POST_CHANGE_PASSWORD_HOOK:`fcph`,FAILED_CHANGE_PHONE_NUMBER:`fcpn`,FAILED_CHANGE_PASSWORD_REQUEST:`fcpr`,FAILED_CONNECTOR_PROVISIONING:`fcpro`,FAILED_CHANGE_USERNAME:`fcu`,FAILED_DELEGATION:`fd`,FAILED_DEVICE_ACTIVATION:`fdeac`,FAILED_DEVICE_AUTHORIZATION_REQUEST:`fdeaz`,USER_CANCELED_DEVICE_CONFIRMATION:`fdecc`,FAILED_USER_DELETION:`fdu`,FAILED_EXCHANGE_AUTHORIZATION_CODE_FOR_ACCESS_TOKEN:`feacft`,FAILED_EXCHANGE_ACCESS_TOKEN_FOR_CLIENT_CREDENTIALS:`feccft`,FAILED_EXCHANGE_CUSTOM_TOKEN:`fecte`,FAILED_EXCHANGE_DEVICE_CODE_FOR_ACCESS_TOKEN:`fede`,FAILED_FEDERATED_LOGOUT:`federated_logout_failed`,FAILED_EXCHANGE_NATIVE_SOCIAL_LOGIN:`fens`,FAILED_EXCHANGE_PASSWORD_OOB_FOR_ACCESS_TOKEN:`feoobft`,FAILED_EXCHANGE_PASSWORD_OTP_FOR_ACCESS_TOKEN:`feotpft`,FAILED_EXCHANGE_PASSWORD_FOR_ACCESS_TOKEN:`fepft`,FAILED_EXCHANGE_PASSWORDLESS_OTP_FOR_ACCESS_TOKEN:`fepotpft`,FAILED_EXCHANGE_PASSWORD_MFA_RECOVERY_FOR_ACCESS_TOKEN:`fercft`,FAILED_EXCHANGE_ROTATING_REFRESH_TOKEN:`ferrt`,FAILED_EXCHANGE_REFRESH_TOKEN_FOR_ACCESS_TOKEN:`fertft`,FAILED_EXCHANGE_SUBJECT_TOKEN_FOR_ACCESS_TOKEN:`festft`,FAILED_HOOK:`fh`,FAILED_IMPERSONATION:`fimp`,FAILED_INVITE_ACCEPT:`fi`,FAILED_LOGOUT:`flo`,FLOWS_EXECUTION_COMPLETED:`flows_execution_completed`,FLOWS_EXECUTION_FAILED:`flows_execution_failed`,FAILED_SENDING_NOTIFICATION:`fn`,FORMS_SUBMISSION_FAILED:`forms_submission_failed`,FORMS_SUBMISSION_SUCCEEDED:`forms_submission_succeeded`,FAILED_LOGIN_INCORRECT_PASSWORD:`fp`,FAILED_PUSHED_AUTHORIZATION_REQUEST:`fpar`,FAILED_POST_USER_REGISTRATION_HOOK:`fpurh`,FAILED_SIGNUP:`fs`,FAILED_SILENT_AUTH:`fsa`,FAILED_LOGIN_INVALID_EMAIL_USERNAME:`fu`,FAILED_USERS_IMPORT:`fui`,FAILED_VERIFICATION_EMAIL:`fv`,FAILED_VERIFICATION_EMAIL_REQUEST:`fvr`,EMAIL_VERIFICATION_CONFIRMED:`gd_auth_email_verification`,EMAIL_VERIFICATION_FAILED:`gd_auth_fail_email_verification`,MFA_AUTH_FAILED:`gd_auth_failed`,MFA_AUTH_REJECTED:`gd_auth_rejected`,MFA_AUTH_SUCCESS:`gd_auth_succeed`,MFA_ENROLLMENT_COMPLETE:`gd_enrollment_complete`,TOO_MANY_MFA_FAILURES:`gd_otp_rate_limit_exceed`,MFA_RECOVERY_FAILED:`gd_recovery_failed`,MFA_RECOVERY_RATE_LIMIT_EXCEED:`gd_recovery_rate_limit_exceed`,MFA_RECOVERY_SUCCESS:`gd_recovery_succeed`,MFA_EMAIL_SENT:`gd_send_email`,EMAIL_VERIFICATION_SENT:`gd_send_email_verification`,EMAIL_VERIFICATION_SEND_FAILURE:`gd_send_email_verification_failure`,PUSH_NOTIFICATION_SENT:`gd_send_pn`,ERROR_SENDING_MFA_PUSH_NOTIFICATION:`gd_send_pn_failure`,MFA_SMS_SENT:`gd_send_sms`,ERROR_SENDING_MFA_SMS:`gd_send_sms_failure`,MFA_VOICE_CALL_SUCCESS:`gd_send_voice`,MFA_VOICE_CALL_FAILED:`gd_send_voice_failure`,SECOND_FACTOR_STARTED:`gd_start_auth`,MFA_ENROLL_STARTED:`gd_start_enroll`,MFA_ENROLLMENT_FAILED:`gd_start_enroll_failed`,GUARDIAN_TENANT_UPDATE:`gd_tenant_update`,UNENROLL_DEVICE_ACCOUNT:`gd_unenroll`,UPDATE_DEVICE_ACCOUNT:`gd_update_device_account`,WEBAUTHN_CHALLENGE_FAILED:`gd_webauthn_challenge_failed`,WEBAUTHN_ENROLLMENT_FAILED:`gd_webauthn_enrollment_failed`,FAILED_KMS_API_OPERATION:`kms_key_management_failure`,SUCCESS_KMS_API_OPERATION:`kms_key_management_success`,KMS_KEY_STATE_CHANGED:`kms_key_state_changed`,TOO_MANY_CALLS_TO_DELEGATION:`limit_delegation`,BLOCKED_IP_ADDRESS:`limit_mu`,BLOCKED_ACCOUNT_IP:`limit_sul`,BLOCKED_ACCOUNT_EMAIL:`limit_wc`,INFORMATION:`i`,MFA_REQUIRED:`mfar`,MANAGEMENT_API_READ_OPERATION:`mgmt_api_read`,FAILED_AUTHENTICATION_METHOD_OPERATION_MY_ACCOUNT:`my_account_authentication_method_failed`,SUCCESSFUL_AUTHENTICATION_METHOD_OPERATION_MY_ACCOUNT:`my_account_authentication_method_succeeded`,FAILED_OIDC_BACKCHANNEL_LOGOUT:`oidc_backchannel_logout_failed`,SUCCESSFUL_OIDC_BACKCHANNEL_LOGOUT:`oidc_backchannel_logout_succeeded`,ORGANIZATION_MEMBER_ADDED:`organization_member_added`,PASSKEY_CHALLENGE_FAILED:`passkey_challenge_failed`,PASSKEY_CHALLENGE_STARTED:`passkey_challenge_started`,PRE_LOGIN_ASSESSMENT:`pla`,BREACHED_PASSWORD:`pwd_leak`,BREACHED_PASSWORD_ON_RESET:`reset_pwd_leak`,SUCCESS_RESOURCE_CLEANUP:`resource_cleanup`,RICH_CONSENTS_ACCESS_ERROR:`rich_consents_access_error`,SUCCESS_LOGIN:`s`,SUCCESS_API_OPERATION:`sapi`,FAILED_API_OPERATION:`fapi`,SUCCESS_CHANGE_EMAIL:`sce`,SUCCESS_CROSS_ORIGIN_AUTHENTICATION:`scoa`,SUCCESS_CHANGE_PASSWORD:`scp`,SUCCESS_CHANGE_PHONE_NUMBER:`scpn`,SUCCESS_CHANGE_PASSWORD_REQUEST:`scpr`,SUCCESS_CHANGE_USERNAME:`scu`,SUCCESS_CREDENTIAL_VALIDATION:`scv`,SUCCESS_DELEGATION:`sd`,SUCCESS_USER_DELETION:`sdu`,SUCCESS_EXCHANGE_AUTHORIZATION_CODE_FOR_ACCESS_TOKEN:`seacft`,SUCCESS_EXCHANGE_ACCESS_TOKEN_FOR_CLIENT_CREDENTIALS:`seccft`,SUCCESS_EXCHANGE_CUSTOM_TOKEN:`secte`,SUCCESS_EXCHANGE_DEVICE_CODE_FOR_ACCESS_TOKEN:`sede`,SUCCESS_EXCHANGE_NATIVE_SOCIAL_LOGIN:`sens`,SUCCESS_EXCHANGE_PASSWORD_OOB_FOR_ACCESS_TOKEN:`seoobft`,SUCCESS_EXCHANGE_PASSWORD_OTP_FOR_ACCESS_TOKEN:`seotpft`,SUCCESS_EXCHANGE_PASSWORDLESS_OTP_FOR_ACCESS_TOKEN:`sepotpft`,SUCCESS_EXCHANGE_PASSWORD_FOR_ACCESS_TOKEN:`sepft`,SUCCESS_EXCHANGE_PASSKEY_OOB_FOR_ACCESS_TOKEN:`sepkoobft`,SUCCESS_EXCHANGE_PASSKEY_OTP_FOR_ACCESS_TOKEN:`sepkotpft`,SUCCESS_EXCHANGE_PASSKEY_MFA_RECOVERY_FOR_ACCESS_TOKEN:`sepkrcft`,SUCCESS_EXCHANGE_PASSWORD_MFA_RECOVERY_FOR_ACCESS_TOKEN:`sercft`,SUCCESS_EXCHANGE_REFRESH_TOKEN_FOR_ACCESS_TOKEN:`sertft`,SUCCESS_EXCHANGE_SUBJECT_TOKEN_FOR_ACCESS_TOKEN:`sestft`,SUCCESS_IMPERSONATION:`simp`,SUCCESSFULLY_ACCEPTED_USER_INVITE:`si`,BREACHED_PASSWORD_ON_SIGNUP:`signup_pwd_leak`,SUCCESS_LOGOUT:`slo`,SUCCESS_HOOK:`sh`,SUCCESS_PASSWORD_MIGRATION:`spm`,SUCCESS_REVOCATION:`srrt`,SUCCESS_SIGNUP:`ss`,FAILED_SS_SSO_OPERATION:`ss_sso_failure`,INFORMATION_FROM_SS_SSO_OPERATION:`ss_sso_info`,SUCCESS_SS_SSO_OPERATION:`ss_sso_success`,SUCCESS_SILENT_AUTH:`ssa`,SUCCESSFUL_SCIM_OPERATION:`sscim`,SUCCESSFULLY_IMPORTED_USERS:`sui`,SUCCESS_VERIFICATION_EMAIL:`sv`,SUCCESS_VERIFICATION_EMAIL_REQUEST:`svr`,MAX_AMOUNT_OF_AUTHENTICATORS:`too_many_records`,USER_LOGIN_BLOCK_RELEASED:`ublkdu`,FAILED_UNIVERSAL_LOGOUT:`universal_logout_failed`,SUCCESSFUL_UNIVERSAL_LOGOUT:`universal_logout_succeeded`,WARNING_DURING_LOGIN:`w`,WARNING_SENDING_NOTIFICATION:`wn`,WARNING_USER_MANAGEMENT:`wum`},Yt=e.z.string().refine(e=>Object.values(I).includes(e),{message:`Invalid log type`});I.ACLS_SUMMARY,I.ACTIONS_EXECUTION_FAILED,I.API_LIMIT,I.API_LIMIT_WARNING,I.APPI,I.CIBA_EXCHANGE_FAILED,I.CIBA_EXCHANGE_SUCCEEDED,I.CIBA_START_FAILED,I.CIBA_START_SUCCEEDED,I.CODE_LINK_SENT,I.CODE_SENT,I.DEPRECATION_NOTICE,I.FAILED_LOGIN,I.FAILED_BY_CONNECTOR,I.FAILED_CHANGE_EMAIL,I.FAILED_BY_CORS,I.FAILED_CROSS_ORIGIN_AUTHENTICATION,I.FAILED_CHANGE_PASSWORD,I.FAILED_POST_CHANGE_PASSWORD_HOOK,I.FAILED_CHANGE_PHONE_NUMBER,I.FAILED_CHANGE_PASSWORD_REQUEST,I.FAILED_CONNECTOR_PROVISIONING,I.FAILED_CHANGE_USERNAME,I.FAILED_DELEGATION,I.FAILED_DEVICE_ACTIVATION,I.FAILED_DEVICE_AUTHORIZATION_REQUEST,I.USER_CANCELED_DEVICE_CONFIRMATION,I.FAILED_USER_DELETION,I.FAILED_EXCHANGE_AUTHORIZATION_CODE_FOR_ACCESS_TOKEN,I.FAILED_EXCHANGE_ACCESS_TOKEN_FOR_CLIENT_CREDENTIALS,I.FAILED_EXCHANGE_CUSTOM_TOKEN,I.FAILED_EXCHANGE_DEVICE_CODE_FOR_ACCESS_TOKEN,I.FAILED_FEDERATED_LOGOUT,I.FAILED_EXCHANGE_NATIVE_SOCIAL_LOGIN,I.FAILED_EXCHANGE_PASSWORD_OOB_FOR_ACCESS_TOKEN,I.FAILED_EXCHANGE_PASSWORD_OTP_FOR_ACCESS_TOKEN,I.FAILED_EXCHANGE_PASSWORD_FOR_ACCESS_TOKEN,I.FAILED_EXCHANGE_PASSWORDLESS_OTP_FOR_ACCESS_TOKEN,I.FAILED_EXCHANGE_PASSWORD_MFA_RECOVERY_FOR_ACCESS_TOKEN,I.FAILED_EXCHANGE_ROTATING_REFRESH_TOKEN,I.FAILED_EXCHANGE_REFRESH_TOKEN_FOR_ACCESS_TOKEN,I.FAILED_EXCHANGE_SUBJECT_TOKEN_FOR_ACCESS_TOKEN,I.FAILED_HOOK,I.FAILED_IMPERSONATION,I.FAILED_INVITE_ACCEPT,I.FAILED_LOGOUT,I.FLOWS_EXECUTION_COMPLETED,I.FLOWS_EXECUTION_FAILED,I.FAILED_SENDING_NOTIFICATION,I.FORMS_SUBMISSION_FAILED,I.FORMS_SUBMISSION_SUCCEEDED,I.FAILED_LOGIN_INCORRECT_PASSWORD,I.FAILED_PUSHED_AUTHORIZATION_REQUEST,I.FAILED_POST_USER_REGISTRATION_HOOK,I.FAILED_SIGNUP,I.FAILED_SILENT_AUTH,I.FAILED_LOGIN_INVALID_EMAIL_USERNAME,I.FAILED_USERS_IMPORT,I.FAILED_VERIFICATION_EMAIL,I.FAILED_VERIFICATION_EMAIL_REQUEST,I.EMAIL_VERIFICATION_CONFIRMED,I.EMAIL_VERIFICATION_FAILED,I.MFA_AUTH_FAILED,I.MFA_AUTH_REJECTED,I.MFA_AUTH_SUCCESS,I.MFA_ENROLLMENT_COMPLETE,I.TOO_MANY_MFA_FAILURES,I.MFA_RECOVERY_FAILED,I.MFA_RECOVERY_RATE_LIMIT_EXCEED,I.MFA_RECOVERY_SUCCESS,I.MFA_EMAIL_SENT,I.EMAIL_VERIFICATION_SENT,I.EMAIL_VERIFICATION_SEND_FAILURE,I.PUSH_NOTIFICATION_SENT,I.ERROR_SENDING_MFA_PUSH_NOTIFICATION,I.MFA_SMS_SENT,I.ERROR_SENDING_MFA_SMS,I.MFA_VOICE_CALL_SUCCESS,I.MFA_VOICE_CALL_FAILED,I.SECOND_FACTOR_STARTED,I.MFA_ENROLL_STARTED,I.MFA_ENROLLMENT_FAILED,I.GUARDIAN_TENANT_UPDATE,I.UNENROLL_DEVICE_ACCOUNT,I.UPDATE_DEVICE_ACCOUNT,I.WEBAUTHN_CHALLENGE_FAILED,I.WEBAUTHN_ENROLLMENT_FAILED,I.FAILED_KMS_API_OPERATION,I.SUCCESS_KMS_API_OPERATION,I.KMS_KEY_STATE_CHANGED,I.TOO_MANY_CALLS_TO_DELEGATION,I.BLOCKED_IP_ADDRESS,I.BLOCKED_ACCOUNT_IP,I.BLOCKED_ACCOUNT_EMAIL,I.INFORMATION,I.MFA_REQUIRED,I.MANAGEMENT_API_READ_OPERATION,I.FAILED_AUTHENTICATION_METHOD_OPERATION_MY_ACCOUNT,I.SUCCESSFUL_AUTHENTICATION_METHOD_OPERATION_MY_ACCOUNT,I.FAILED_OIDC_BACKCHANNEL_LOGOUT,I.SUCCESSFUL_OIDC_BACKCHANNEL_LOGOUT,I.ORGANIZATION_MEMBER_ADDED,I.PASSKEY_CHALLENGE_FAILED,I.PASSKEY_CHALLENGE_STARTED,I.PRE_LOGIN_ASSESSMENT,I.BREACHED_PASSWORD,I.BREACHED_PASSWORD_ON_RESET,I.SUCCESS_RESOURCE_CLEANUP,I.RICH_CONSENTS_ACCESS_ERROR,I.SUCCESS_LOGIN,I.SUCCESS_API_OPERATION,I.FAILED_API_OPERATION,I.SUCCESS_CHANGE_EMAIL,I.SUCCESS_CROSS_ORIGIN_AUTHENTICATION,I.SUCCESS_CHANGE_PASSWORD,I.SUCCESS_CHANGE_PHONE_NUMBER,I.SUCCESS_CHANGE_PASSWORD_REQUEST,I.SUCCESS_CHANGE_USERNAME,I.SUCCESS_CREDENTIAL_VALIDATION,I.SUCCESS_DELEGATION,I.SUCCESS_USER_DELETION,I.SUCCESS_EXCHANGE_AUTHORIZATION_CODE_FOR_ACCESS_TOKEN,I.SUCCESS_EXCHANGE_ACCESS_TOKEN_FOR_CLIENT_CREDENTIALS,I.SUCCESS_EXCHANGE_CUSTOM_TOKEN,I.SUCCESS_EXCHANGE_DEVICE_CODE_FOR_ACCESS_TOKEN,I.SUCCESS_EXCHANGE_NATIVE_SOCIAL_LOGIN,I.SUCCESS_EXCHANGE_PASSWORD_OOB_FOR_ACCESS_TOKEN,I.SUCCESS_EXCHANGE_PASSWORD_OTP_FOR_ACCESS_TOKEN,I.SUCCESS_EXCHANGE_PASSWORDLESS_OTP_FOR_ACCESS_TOKEN,I.SUCCESS_EXCHANGE_PASSWORD_FOR_ACCESS_TOKEN,I.SUCCESS_EXCHANGE_PASSKEY_OOB_FOR_ACCESS_TOKEN,I.SUCCESS_EXCHANGE_PASSKEY_OTP_FOR_ACCESS_TOKEN,I.SUCCESS_EXCHANGE_PASSKEY_MFA_RECOVERY_FOR_ACCESS_TOKEN,I.SUCCESS_EXCHANGE_PASSWORD_MFA_RECOVERY_FOR_ACCESS_TOKEN,I.SUCCESS_EXCHANGE_REFRESH_TOKEN_FOR_ACCESS_TOKEN,I.SUCCESS_EXCHANGE_SUBJECT_TOKEN_FOR_ACCESS_TOKEN,I.SUCCESS_IMPERSONATION,I.SUCCESSFULLY_ACCEPTED_USER_INVITE,I.BREACHED_PASSWORD_ON_SIGNUP,I.SUCCESS_LOGOUT,I.SUCCESS_HOOK,I.SUCCESS_PASSWORD_MIGRATION,I.SUCCESS_REVOCATION,I.SUCCESS_SIGNUP,I.FAILED_SS_SSO_OPERATION,I.INFORMATION_FROM_SS_SSO_OPERATION,I.SUCCESS_SS_SSO_OPERATION,I.SUCCESS_SILENT_AUTH,I.SUCCESSFUL_SCIM_OPERATION,I.SUCCESSFULLY_IMPORTED_USERS,I.SUCCESS_VERIFICATION_EMAIL,I.SUCCESS_VERIFICATION_EMAIL_REQUEST,I.MAX_AMOUNT_OF_AUTHENTICATORS,I.USER_LOGIN_BLOCK_RELEASED,I.FAILED_UNIVERSAL_LOGOUT,I.SUCCESSFUL_UNIVERSAL_LOGOUT,I.WARNING_DURING_LOGIN,I.WARNING_SENDING_NOTIFICATION,I.WARNING_USER_MANAGEMENT,(()=>{let e={};for(let[t,n]of Object.entries(I))t.startsWith(`SUCCESS_`)||t.startsWith(`SUCCESSFUL_`)||t.startsWith(`SUCCESSFULLY_`)||t.endsWith(`_SUCCEEDED`)||t.endsWith(`_COMPLETED`)?e[n]=`success`:t.startsWith(`FAILED_`)||t.startsWith(`ERROR_`)||t.startsWith(`BREACHED_`)||t.startsWith(`BLOCKED_`)||t===`MFA_AUTH_FAILED`||t===`MFA_AUTH_REJECTED`||t===`MFA_RECOVERY_FAILED`||t===`MFA_ENROLLMENT_FAILED`||t===`EMAIL_VERIFICATION_FAILED`||t===`WEBAUTHN_CHALLENGE_FAILED`||t===`WEBAUTHN_ENROLLMENT_FAILED`||t===`PASSKEY_CHALLENGE_FAILED`||t===`FLOWS_EXECUTION_FAILED`||t===`FORMS_SUBMISSION_FAILED`||t===`CIBA_EXCHANGE_FAILED`||t===`CIBA_START_FAILED`||t===`ACTIONS_EXECUTION_FAILED`||t===`RICH_CONSENTS_ACCESS_ERROR`||t===`USER_CANCELED_DEVICE_CONFIRMATION`||t===`TOO_MANY_MFA_FAILURES`||t===`MFA_RECOVERY_RATE_LIMIT_EXCEED`||t===`API_LIMIT`||t===`MAX_AMOUNT_OF_AUTHENTICATORS`?e[n]=`failure`:t.startsWith(`WARNING_`)||t===`API_LIMIT_WARNING`||t===`DEPRECATION_NOTICE`||t===`PRE_LOGIN_ASSESSMENT`?e[n]=`warning`:t===`CODE_SENT`||t===`CODE_LINK_SENT`||t===`MFA_EMAIL_SENT`||t===`MFA_SMS_SENT`||t===`EMAIL_VERIFICATION_SENT`||t===`PUSH_NOTIFICATION_SENT`?e[n]=`code_sent`:t===`INFORMATION`||t===`INFORMATION_FROM_SS_SSO_OPERATION`||t===`MANAGEMENT_API_READ_OPERATION`||t===`APPI`||t===`ACLS_SUMMARY`||t===`ORGANIZATION_MEMBER_ADDED`?e[n]=`info`:e[n]=`other`;return e})();var Xt=e.z.object({name:e.z.string(),version:e.z.string(),env:e.z.object({node:e.z.string().optional()}).optional()}),Zt=e.z.object({country_code:e.z.string().length(2),city_name:e.z.string(),latitude:e.z.string(),longitude:e.z.string(),time_zone:e.z.string(),continent_code:e.z.string()});e.z.object({type:Yt,date:e.z.string(),description:e.z.string().optional(),ip:e.z.string().optional(),user_agent:e.z.string().optional(),details:e.z.any().optional(),isMobile:e.z.boolean(),user_id:e.z.string().optional(),user_name:e.z.string().optional(),connection:e.z.string().optional(),connection_id:e.z.string().optional(),client_id:e.z.string().optional(),client_name:e.z.string().optional(),audience:e.z.string().optional(),scope:e.z.string().optional(),strategy:e.z.string().optional(),strategy_type:e.z.string().optional(),hostname:e.z.string().optional(),auth0_client:Xt.optional(),log_id:e.z.string().optional(),location_info:Zt.optional()}).extend({log_id:e.z.string()});var Qt=e.z.enum([`http`,`eventbridge`,`eventgrid`,`splunk`,`datadog`,`sumo`]),$t=e.z.enum([`active`,`paused`,`suspended`]),en=e.z.object({type:e.z.string(),name:e.z.string()});e.z.object({name:e.z.string(),type:Qt,status:$t.optional(),sink:e.z.record(e.z.string(),e.z.unknown()),filters:e.z.array(en).optional(),isPriority:e.z.boolean().optional()}).extend({id:e.z.string(),status:$t,created_at:e.z.string().optional(),updated_at:e.z.string().optional()});var tn=e.z.enum([`auth0`,`cognito`,`okta`,`oidc`]),nn=e.z.object({domain:e.z.string(),client_id:e.z.string(),client_secret:e.z.string(),audience:e.z.string().optional(),scope:e.z.string().optional()}),rn=e.z.object({id:e.z.string().optional(),name:e.z.string(),provider:tn,connection:e.z.string(),enabled:e.z.boolean().default(!0),credentials:nn});e.z.object({id:e.z.string(),created_at:e.z.string(),updated_at:e.z.string()}).extend(rn.shape);var an=e.z.object({enabled:e.z.boolean().optional(),shields:e.z.array(e.z.string()).optional(),admin_notification_frequency:e.z.array(e.z.string()).optional(),method:e.z.string().optional(),stage:e.z.object({"pre-user-registration":e.z.object({shields:e.z.array(e.z.string()).optional()}).optional(),"pre-change-password":e.z.object({shields:e.z.array(e.z.string()).optional()}).optional()}).optional()}),on=e.z.object({enabled:e.z.boolean().optional(),shields:e.z.array(e.z.string()).optional(),allowlist:e.z.array(e.z.string()).optional(),mode:e.z.string().optional(),max_attempts:e.z.number().optional()}),sn=e.z.object({enabled:e.z.boolean().optional(),shields:e.z.array(e.z.string()).optional(),allowlist:e.z.array(e.z.string()).optional(),stage:e.z.object({"pre-login":e.z.object({max_attempts:e.z.number().optional(),rate:e.z.number().optional()}).optional(),"pre-user-registration":e.z.object({max_attempts:e.z.number().optional(),rate:e.z.number().optional()}).optional()}).optional()}),cn=e.z.object({breached_password_detection:an.optional(),brute_force_protection:on.optional(),suspicious_ip_throttling:sn.optional()});e.z.object({id:e.z.string().optional(),user_id:e.z.string(),password:e.z.string(),algorithm:e.z.enum([`bcrypt`,`argon2id`]).default(`argon2id`),is_current:e.z.boolean().default(!0)}).extend({id:e.z.string(),created_at:e.z.string(),updated_at:e.z.string()});var ln=e.z.object({initial_user_agent:e.z.string().describe(`First user agent of the device from which this user logged in`),initial_ip:e.z.string().describe(`First IP address associated with this session`),initial_asn:e.z.string().describe(`First autonomous system number associated with this session`),last_user_agent:e.z.string().describe(`Last user agent of the device from which this user logged in`),last_ip:e.z.string().describe(`Last IP address from which this user logged in`),last_asn:e.z.string().describe(`Last autonomous system number from which this user logged in`)}),un=e.z.object({id:e.z.string(),revoked_at:e.z.string().optional(),used_at:e.z.string().optional(),user_id:e.z.string().describe(`The user ID associated with the session`),expires_at:e.z.string().optional(),login_session_id:e.z.string(),idle_expires_at:e.z.string().optional(),device:ln.describe(`Metadata related to the device used in the session`),clients:e.z.array(e.z.string()).describe(`List of client details for the session`)});e.z.object({created_at:e.z.string(),updated_at:e.z.string(),authenticated_at:e.z.string(),last_interaction_at:e.z.string()}).extend(un.shape),e.z.object({kid:e.z.string().openapi({description:`The key id of the signing key`}),tenant_id:e.z.string().optional().openapi({description:`The tenant the key belongs to. Omitted means the key is shared / control-plane scoped.`}),cert:e.z.string().openapi({description:`The public certificate of the signing key`}),fingerprint:e.z.string().openapi({description:`The cert fingerprint`}),thumbprint:e.z.string().openapi({description:`The cert thumbprint`}),pkcs7:e.z.string().optional().openapi({description:`The private key in pkcs7 format`}),current:e.z.boolean().optional().openapi({description:`True if the key is the current key`}),next:e.z.boolean().optional().openapi({description:`True if the key is the next key`}),previous:e.z.boolean().optional().openapi({description:`True if the key is the previous key`}),current_since:e.z.string().optional().openapi({description:`The date and time when the key became the current key`}),current_until:e.z.string().optional().openapi({description:`The date and time when the current key was rotated`}),revoked:e.z.boolean().optional().openapi({description:`True if the key is revoked`}),revoked_at:e.z.string().optional().openapi({description:`The date and time when the key was revoked`}),connection:e.z.string().optional().openapi({description:`The connection identifier associated with the key`}),type:e.z.enum([`jwt_signing`,`saml_encryption`]).openapi({description:`The type of the signing key`})});var dn=e.z.object({id:e.z.string().optional(),audience:e.z.string().optional(),friendly_name:e.z.string(),picture_url:e.z.string().optional(),support_email:e.z.string().optional(),support_url:e.z.string().optional(),sender_email:e.z.string().email().optional(),sender_name:e.z.string().optional(),session_lifetime:e.z.number().optional(),idle_session_lifetime:e.z.number().optional(),ephemeral_session_lifetime:e.z.number().optional(),idle_ephemeral_session_lifetime:e.z.number().optional(),session_cookie:e.z.object({mode:e.z.enum([`persistent`,`non-persistent`]).optional()}).optional(),allowed_logout_urls:e.z.array(e.z.string()).optional(),default_redirection_uri:e.z.string().optional(),default_client_id:e.z.string().optional(),enabled_locales:e.z.array(e.z.string()).optional(),default_directory:e.z.string().optional(),error_page:e.z.object({html:e.z.string().optional(),show_log_link:e.z.boolean().optional(),url:e.z.string().optional()}).nullish(),flags:e.z.object({allow_changing_enable_sso:e.z.boolean().optional(),allow_legacy_delegation_grant_types:e.z.boolean().optional(),allow_legacy_ro_grant_types:e.z.boolean().optional(),allow_legacy_tokeninfo_endpoint:e.z.boolean().optional(),change_pwd_flow_v1:e.z.boolean().optional(),client_id_metadata_document_registration:e.z.boolean().optional(),custom_domains_provisioning:e.z.boolean().optional(),dashboard_insights_view:e.z.boolean().optional(),dashboard_log_streams_next:e.z.boolean().optional(),disable_clickjack_protection_headers:e.z.boolean().optional(),disable_fields_map_fix:e.z.boolean().optional(),disable_impersonation:e.z.boolean().optional(),disable_management_api_sms_obfuscation:e.z.boolean().optional(),enable_adfs_waad_email_verification:e.z.boolean().optional(),enable_apis_section:e.z.boolean().optional(),enable_client_connections:e.z.boolean().optional(),enable_custom_domain_in_emails:e.z.boolean().optional(),enable_dynamic_client_registration:e.z.boolean().optional(),dcr_require_initial_access_token:e.z.boolean().optional(),dcr_allowed_grant_types:e.z.array(e.z.string()).optional(),allow_http_return_to:e.z.array(e.z.string().refine(e=>{try{let t=new URL(e);return t.protocol===`http:`&&(t.pathname===``||t.pathname===`/`)&&!t.search&&!t.hash&&e===t.origin}catch{return!1}},{message:`must be a fully-qualified http origin (scheme + host + port, no path)`})).optional(),enable_idtoken_api2:e.z.boolean().optional(),enable_legacy_logs_search_v2:e.z.boolean().optional(),enable_legacy_profile:e.z.boolean().optional(),enable_pipeline2:e.z.boolean().optional(),enable_public_signup_user_exists_error:e.z.boolean().optional(),enable_sso:e.z.boolean().optional(),enforce_client_authentication_on_passwordless_start:e.z.boolean().optional(),genai_trial:e.z.boolean().optional(),improved_signup_bot_detection_in_classic:e.z.boolean().optional(),mfa_show_factor_list_on_enrollment:e.z.boolean().optional(),no_disclose_enterprise_connections:e.z.boolean().optional(),remove_alg_from_jwks:e.z.boolean().optional(),revoke_refresh_token_grant:e.z.boolean().optional(),trust_azure_adfs_email_verified_connection_property:e.z.boolean().optional(),use_scope_descriptions_for_consent:e.z.boolean().optional(),inherit_global_permissions_in_organizations:e.z.boolean().optional(),restrict_undefined_scopes:e.z.boolean().optional()}).optional(),sandbox_version:e.z.string().optional(),legacy_sandbox_version:e.z.string().optional(),sandbox_versions_available:e.z.array(e.z.string()).optional(),change_password:e.z.object({enabled:e.z.boolean().optional(),html:e.z.string().optional()}).optional(),guardian_mfa_page:e.z.object({enabled:e.z.boolean().optional(),html:e.z.string().optional()}).optional(),device_flow:e.z.object({charset:e.z.enum([`base20`,`digits`]).optional(),mask:e.z.string().max(20).optional()}).optional(),default_token_quota:e.z.object({clients:e.z.object({client_credentials:e.z.record(e.z.string(),e.z.any()).optional()}).optional(),organizations:e.z.object({client_credentials:e.z.record(e.z.string(),e.z.any()).optional()}).optional()}).nullish(),default_audience:e.z.string().optional(),default_organization:e.z.string().optional(),sessions:e.z.object({oidc_logout_prompt_enabled:e.z.boolean().optional()}).optional(),oidc_logout:e.z.object({rp_logout_end_session_endpoint_discovery:e.z.boolean().optional()}).optional(),allow_organization_name_in_authentication_api:e.z.boolean().optional(),customize_mfa_in_postlogin_action:e.z.boolean().optional(),acr_values_supported:e.z.array(e.z.string()).optional(),mtls:e.z.object({enable_endpoint_aliases:e.z.boolean().optional()}).nullish(),pushed_authorization_requests_supported:e.z.boolean().optional(),authorization_response_iss_parameter_supported:e.z.boolean().optional(),deployment_type:e.z.enum([`shared`,`wfp`]).default(`shared`).optional(),provisioning_state:e.z.enum([`pending`,`ready`,`failed`]).default(`ready`).optional(),provisioning_error:e.z.string().max(2048).optional(),provisioning_state_changed_at:e.z.string().optional(),bundle_configuration:e.z.string().max(64).optional(),worker_version:e.z.string().max(64).optional(),database_version:e.z.string().max(64).optional(),worker_script_name:e.z.string().max(255).optional(),storage_kind:e.z.enum([`own_d1`,`existing_d1`,`shared_planetscale`]).optional(),d1_database_id:e.z.string().max(64).optional(),attack_protection:cn.optional(),mfa:e.z.object({policy:e.z.enum([`never`,`always`]).default(`never`).optional(),factors:e.z.object({sms:e.z.boolean().default(!1),otp:e.z.boolean().default(!1),email:e.z.boolean().default(!1),push_notification:e.z.boolean().default(!1),webauthn_roaming:e.z.boolean().default(!1),webauthn_platform:e.z.boolean().default(!1),recovery_code:e.z.boolean().default(!1),duo:e.z.boolean().default(!1)}).optional(),sms_provider:e.z.object({provider:e.z.enum([`twilio`,`vonage`,`aws_sns`,`phone_message_hook`]).optional()}).optional(),twilio:e.z.object({sid:e.z.string().optional(),auth_token:e.z.string().optional(),from:e.z.string().optional(),messaging_service_sid:e.z.string().optional()}).optional(),phone_message:e.z.object({message:e.z.string().optional()}).optional()}).optional()});e.z.object({created_at:e.z.string().nullable().transform(e=>e??``),updated_at:e.z.string().nullable().transform(e=>e??``)}).extend(dn.shape).extend({id:e.z.string(),is_control_plane:e.z.boolean().optional()});var fn=e.z.enum([`provision`,`seed`,`upgrade`,`backup`,`deprovision`,`users_import`]),pn=e.z.enum([`pending`,`running`,`succeeded`,`failed`,`cancelled`]),mn=e.z.string().max(64);e.z.object({tenant_id:e.z.string().max(255).nullable().default(null),rollout_id:e.z.string().max(255).nullable().optional(),kind:fn,engine:mn,engine_instance_id:e.z.string().max(100).nullable().optional(),target_worker_version:e.z.string().max(255).nullable().optional(),target_database_version:e.z.string().max(255).nullable().optional(),initiated_by:e.z.string().max(255).nullable().optional(),input:e.z.record(e.z.string(),e.z.unknown()).nullable().optional()}).extend({id:e.z.string(),status:pn,current_step:e.z.string().max(255).nullable().optional(),error:e.z.string().nullable().optional(),result:e.z.record(e.z.string(),e.z.unknown()).nullable().optional(),claimed_by:e.z.string().max(255).nullable().optional(),claim_expires_at:e.z.string().nullable().optional(),created_at:e.z.string(),updated_at:e.z.string(),finished_at:e.z.string().nullable().optional()}).pick({status:!0,current_step:!0,engine_instance_id:!0,target_worker_version:!0,target_database_version:!0,error:!0,result:!0,claimed_by:!0,claim_expires_at:!0,finished_at:!0}).partial();var hn=e.z.enum([`started`,`succeeded`,`failed`,`retried`,`skipped`,`reconciled`]);e.z.object({operation_id:e.z.string().max(255),step:e.z.string().max(255),outcome:hn,detail:e.z.record(e.z.string(),e.z.unknown()).nullable().optional(),attempt:e.z.number().int().min(1).default(1)}).extend({id:e.z.string(),created_at:e.z.string()});var L=e.z.enum([`pending`,`inserted`,`updated`,`failed`,`skipped`]);e.z.object({operation_id:e.z.string().max(255),seq:e.z.number().int().min(0),payload:e.z.record(e.z.string(),e.z.unknown()),status:L.default(`pending`),error_code:e.z.string().max(64).nullable().optional(),error_message:e.z.string().nullable().optional(),error_path:e.z.string().max(255).nullable().optional(),entity_id:e.z.string().max(255).nullable().optional()}).extend({status:L,created_at:e.z.string(),updated_at:e.z.string()}),e.z.object({seq:e.z.number().int().min(0),status:L,error_code:e.z.string().max(64).nullable().optional(),error_message:e.z.string().nullable().optional(),error_path:e.z.string().max(255).nullable().optional(),entity_id:e.z.string().max(255).nullable().optional()});var gn=e.z.enum([`upgrade`,`reseed`,`backup`]),_n=e.z.enum([`pending`,`canary`,`rolling`,`paused`,`done`,`failed`]);e.z.object({kind:gn,target_worker_version:e.z.string().max(255).nullable().optional(),target_database_version:e.z.string().max(255).nullable().optional(),wave_size:e.z.number().int().min(1).default(10),canary_tenant_ids:e.z.array(e.z.string()).nullable().optional(),filter:e.z.record(e.z.string(),e.z.unknown()).nullable().optional(),initiated_by:e.z.string().max(255).nullable().optional()}).extend({id:e.z.string(),status:_n,created_at:e.z.string(),updated_at:e.z.string(),finished_at:e.z.string().nullable().optional()}).pick({status:!0,wave_size:!0,canary_tenant_ids:!0,filter:!0,finished_at:!0}).partial(),e.z.object({access_token:e.z.string(),id_token:e.z.string().optional(),scope:e.z.string().optional(),state:e.z.string().optional(),refresh_token:e.z.string().optional(),token_type:e.z.string(),expires_in:e.z.number()}),e.z.object({code:e.z.string(),state:e.z.string().optional()});var vn=e.z.object({button_border_radius:e.z.number(),button_border_weight:e.z.number(),buttons_style:e.z.enum([`pill`,`rounded`,`sharp`]),input_border_radius:e.z.number(),input_border_weight:e.z.number(),inputs_style:e.z.enum([`pill`,`rounded`,`sharp`]),show_widget_shadow:e.z.boolean(),widget_border_weight:e.z.number(),widget_corner_radius:e.z.number()}),yn=e.z.object({base_focus_color:e.z.string(),base_hover_color:e.z.string(),body_text:e.z.string(),captcha_widget_theme:e.z.enum([`auto`,`dark`,`light`]),error:e.z.string(),header:e.z.string(),icons:e.z.string(),input_background:e.z.string(),input_border:e.z.string(),input_filled_text:e.z.string(),input_labels_placeholders:e.z.string(),links_focused_components:e.z.string(),primary_button:e.z.string(),primary_button_label:e.z.string(),secondary_button_border:e.z.string(),secondary_button_label:e.z.string(),success:e.z.string(),widget_background:e.z.string(),widget_border:e.z.string()}),R=e.z.object({bold:e.z.boolean(),size:e.z.number()}),bn=e.z.object({body_text:R,buttons_text:R,font_url:e.z.string(),input_labels:R,links:R,links_style:e.z.enum([`normal`,`underlined`]),reference_text_size:e.z.number(),subtitle:R,title:R}),xn=e.z.object({background_color:e.z.string(),background_image_url:e.z.string(),page_layout:e.z.enum([`center`,`left`,`right`]),logo_placement:e.z.enum([`widget`,`chip`,`none`]).optional()}),Sn=e.z.object({header_text_alignment:e.z.enum([`center`,`left`,`right`]),logo_height:e.z.number(),logo_position:e.z.enum([`center`,`left`,`none`,`right`]),logo_url:e.z.string(),social_buttons_layout:e.z.enum([`bottom`,`top`])});e.z.object({borders:vn,colors:yn,displayName:e.z.string(),fonts:bn,page_background:xn,widget:Sn}).extend({themeId:e.z.string()}),e.z.object({universal_login_experience:e.z.enum([`new`,`classic`]).default(`new`),identifier_first:e.z.boolean().default(!0),password_first:e.z.boolean().default(!1),show_last_used_connection:e.z.boolean().default(!1),webauthn_platform_first_factor:e.z.boolean()});var Cn=e.z.object({hosts:e.z.array(e.z.string()).optional(),methods:e.z.array(e.z.string()).optional(),path:e.z.string().default(`/*`),headers:e.z.record(e.z.string(),e.z.string()).optional(),query:e.z.record(e.z.string(),e.z.string()).optional()}),wn=e.z.object({type:e.z.string(),options:e.z.record(e.z.string(),e.z.unknown()).default({})}),z=e.z.object({id:e.z.string().optional(),custom_domain_id:e.z.string(),priority:e.z.number().int().default(100),match:Cn,handlers:e.z.array(wn).min(1)}),Tn=z.extend({id:e.z.string(),tenant_id:e.z.string(),created_at:e.z.string(),updated_at:e.z.string()}),En=z.partial().omit({id:!0,custom_domain_id:!0}),Dn=e.z.object({scim:e.z.string(),auth0:e.z.string()}),On=e.z.object({connection_id:e.z.string(),user_id_attribute:e.z.string().default(`externalId`),mapping:e.z.array(Dn).default([])});e.z.object({created_at:e.z.string(),updated_at:e.z.string()}).extend(On.shape);var kn=e.z.object({token_id:e.z.string(),connection_id:e.z.string(),token_hash:e.z.string(),scopes:e.z.array(e.z.string()).default([]),valid_until:e.z.string().optional()});e.z.object({created_at:e.z.string(),last_used_at:e.z.string().optional()}).extend(kn.shape);var An=e.z.object({connection_id:e.z.string(),external_id:e.z.string(),user_id:e.z.string()});e.z.object({created_at:e.z.string()}).extend(An.shape),e.z.object({name:e.z.string(),enabled:e.z.boolean().optional().default(!0),default_from_address:e.z.string().optional(),credentials:e.z.record(e.z.string(),e.z.unknown()),settings:e.z.object({}).optional()});var jn=e.z.enum([`verify_email`,`verify_email_by_code`,`reset_email`,`reset_email_by_code`,`welcome_email`,`blocked_account`,`stolen_credentials`,`enrollment_email`,`mfa_oob_code`,`change_password`,`password_reset`,`user_invitation`]);e.z.object({template:jn,body:e.z.string(),from:e.z.string(),subject:e.z.string(),syntax:e.z.literal(`liquid`).default(`liquid`),resultUrl:e.z.string().optional(),urlLifetimeInSeconds:e.z.number().int().nonnegative().optional(),includeEmailInRedirect:e.z.boolean().default(!1),enabled:e.z.boolean().default(!0)}),e.z.object({id:e.z.string(),login_id:e.z.string(),session_id:e.z.string().optional(),organization:e.z.string().optional(),auth_connection:e.z.string().optional(),auth_strategy:F.optional(),user_id:e.z.string(),client_id:e.z.string(),expires_at:e.z.string().optional(),idle_expires_at:e.z.string().optional(),last_exchanged_at:e.z.string().optional(),device:ln,resource_servers:e.z.array(e.z.object({audience:e.z.string(),scopes:e.z.string()})),rotating:e.z.boolean(),token_lookup:e.z.string().optional(),token_hash:e.z.string().optional(),family_id:e.z.string().optional(),rotated_to:e.z.string().optional(),rotated_at:e.z.string().optional()}).extend({created_at:e.z.string(),revoked_at:e.z.string().optional()}),e.z.object({to:e.z.string(),message:e.z.string()}),e.z.object({name:e.z.string(),options:e.z.object({})});var Mn=e.z.object({value:e.z.string(),description:e.z.string().optional()}),Nn=e.z.object({token_dialect:e.z.enum([`access_token`,`access_token_authz`]).optional(),enforce_policies:e.z.boolean().optional(),allow_skipping_userinfo:e.z.boolean().optional(),skip_userinfo:e.z.boolean().optional(),persist_client_authorization:e.z.boolean().optional(),enable_introspection_endpoint:e.z.boolean().optional(),mtls:e.z.object({bound_access_tokens:e.z.boolean().optional()}).optional()}),Pn=e.z.object({id:e.z.string().optional(),name:e.z.string(),identifier:e.z.string(),scopes:e.z.array(Mn).optional(),signing_alg:e.z.string().optional(),signing_secret:e.z.string().optional(),token_lifetime:e.z.number().default(86400),token_lifetime_for_web:e.z.number().default(7200),skip_consent_for_verifiable_first_party_clients:e.z.boolean().optional(),allow_offline_access:e.z.boolean().optional(),verificationKey:e.z.string().optional(),options:Nn.optional(),is_system:e.z.boolean().optional(),metadata:e.z.record(e.z.string(),e.z.any()).optional()}).extend({created_at:e.z.string().optional(),updated_at:e.z.string().optional()});e.z.array(Pn);var Fn=e.z.object({role_id:e.z.string(),resource_server_identifier:e.z.string(),permission_name:e.z.string()}).extend({created_at:e.z.string()});e.z.array(Fn),e.z.object({user_id:e.z.string().openapi({description:`The id of the user that granted the consent`}),clientID:e.z.string().openapi({description:`The id of the client the grant was issued to`}),audience:e.z.string().optional().openapi({description:`The audience the grant applies to`}),scope:e.z.array(e.z.string()).default([]).openapi({description:`The list of OAuth scopes the user has consented to`})}).extend({id:e.z.string()}),e.z.object({user_id:e.z.string(),last_login:e.z.string().optional(),last_ip:e.z.string().optional(),login_count:e.z.number().default(0),failed_logins:e.z.array(e.z.string()).optional(),last_password_reset:e.z.string().optional()});var In=e.z.object({user_id:e.z.string(),resource_server_identifier:e.z.string(),permission_name:e.z.string(),organization_id:e.z.string().optional()}).extend({tenant_id:e.z.string(),created_at:e.z.string().optional()});e.z.array(In);var Ln=e.z.object({user_id:e.z.string(),resource_server_identifier:e.z.string(),resource_server_name:e.z.string(),permission_name:e.z.string(),description:e.z.string().nullable().optional(),created_at:e.z.string().optional(),organization_id:e.z.string().optional()});e.z.array(Ln);var Rn=e.z.object({user_id:e.z.string(),role_id:e.z.string(),organization_id:e.z.string().optional()}).extend({tenant_id:e.z.string(),created_at:e.z.string().optional()});e.z.array(Rn);var zn=e.z.object({id:e.z.string().optional().openapi({description:`The unique identifier of the role. If not provided, one will be generated.`}),name:e.z.string().min(1).max(50).openapi({description:`The name of the role. Cannot include '<' or '>'`}),description:e.z.string().max(255).optional().openapi({description:`The description of the role`}),is_system:e.z.boolean().optional(),metadata:e.z.record(e.z.string(),e.z.any()).optional().openapi({description:`Metadata associated with the role. Can be used to control sync behavior in multi-tenancy scenarios.`})}).extend({id:e.z.string().openapi({description:`The unique identifier of the role`}),created_at:e.z.string().optional(),updated_at:e.z.string().optional()});e.z.array(zn);var Bn=e.z.object({logo_url:e.z.string().optional().openapi({description:`URL of the organization's logo`}),colors:e.z.object({primary:e.z.string().optional().openapi({description:`Primary color in hex format (e.g., #FF0000)`}),page_background:e.z.string().optional().openapi({description:`Page background color in hex format (e.g., #FFFFFF)`})}).optional()}).optional(),Vn=e.z.object({connection_id:e.z.string().openapi({description:`ID of the connection`}),assign_membership_on_login:e.z.boolean().default(!1).openapi({description:`Whether to assign membership to the organization on login`}),show_as_button:e.z.boolean().default(!0).openapi({description:`Whether to show this connection as a button in the login screen`}),is_signup_enabled:e.z.boolean().default(!0).openapi({description:`Whether signup is enabled for this connection`})}),Hn=e.z.object({client_credentials:e.z.object({enforce:e.z.boolean().default(!1).openapi({description:`Whether to enforce token quota limits`}),per_day:e.z.number().min(0).default(0).openapi({description:`Maximum tokens per day (0 = unlimited)`}),per_hour:e.z.number().min(0).default(0).openapi({description:`Maximum tokens per hour (0 = unlimited)`})}).optional()}).optional();e.z.object({id:e.z.string().optional(),name:e.z.string().min(1).regex(/^[a-z0-9_-]+$/,{message:`Organization name must be lowercase and can only contain letters, numbers, hyphens, and underscores`}).openapi({description:`The name of the organization. Must be lowercase and can only contain letters, numbers, hyphens, and underscores.`}),display_name:e.z.string().optional().openapi({description:`The display name of the organization`}),branding:Bn,metadata:e.z.record(e.z.string(),e.z.any()).default({}).optional().openapi({description:`Custom metadata for the organization`}),enabled_connections:e.z.array(Vn).default([]).optional().openapi({description:`List of enabled connections for the organization`}),token_quota:Hn}).extend(n.shape).extend({id:e.z.string(),name:e.z.string().min(1).openapi({description:`The name of the organization`})});var Un=e.z.object({connection_id:e.z.string().openapi({description:`ID of the tenant-level connection to enable for the org.`}),assign_membership_on_login:e.z.boolean().optional().default(!1),show_as_button:e.z.boolean().optional().default(!0),is_signup_enabled:e.z.boolean().optional().default(!0)}).extend({connection:e.z.object({name:e.z.string().optional(),strategy:e.z.string().optional()}).optional(),created_at:e.z.string().optional(),updated_at:e.z.string().optional()});e.z.array(Un),e.z.object({user_id:e.z.string().openapi({description:`ID of the user`}),organization_id:e.z.string().openapi({description:`ID of the organization`})}).extend(n.shape).extend({id:e.z.string()}),e.z.object({idle_session_lifetime:e.z.number().default(72),session_lifetime:e.z.number().default(168),session_cookie:e.z.object({mode:e.z.enum([`persistent`,`non-persistent`]).optional()}).optional(),enable_client_connections:e.z.boolean().optional(),default_redirection_uri:e.z.string().optional(),enabled_locales:e.z.array(e.z.string()).optional(),default_directory:e.z.string().optional(),error_page:e.z.object({html:e.z.string().optional(),show_log_link:e.z.boolean().optional(),url:e.z.string().optional()}).optional(),flags:e.z.object({allow_legacy_delegation_grant_types:e.z.boolean().optional(),allow_legacy_ro_grant_types:e.z.boolean().optional(),allow_legacy_tokeninfo_endpoint:e.z.boolean().optional(),disable_clickjack_protection_headers:e.z.boolean().optional(),enable_apis_section:e.z.boolean().optional(),enable_client_connections:e.z.boolean().optional(),enable_custom_domain_in_emails:e.z.boolean().optional(),enable_dynamic_client_registration:e.z.boolean().optional(),enable_idtoken_api2:e.z.boolean().optional(),enable_legacy_logs_search_v2:e.z.boolean().optional(),enable_legacy_profile:e.z.boolean().optional(),enable_pipeline2:e.z.boolean().optional(),enable_public_signup_user_exists_error:e.z.boolean().optional(),use_scope_descriptions_for_consent:e.z.boolean().optional(),disable_management_api_sms_obfuscation:e.z.boolean().optional(),enable_adfs_waad_email_verification:e.z.boolean().optional(),revoke_refresh_token_grant:e.z.boolean().optional(),dashboard_log_streams_next:e.z.boolean().optional(),dashboard_insights_view:e.z.boolean().optional(),disable_fields_map_fix:e.z.boolean().optional(),mfa_show_factor_list_on_enrollment:e.z.boolean().optional()}).optional(),friendly_name:e.z.string().optional(),picture_url:e.z.string().optional(),support_email:e.z.string().optional(),support_url:e.z.string().optional(),sandbox_version:e.z.string().optional(),sandbox_versions_available:e.z.array(e.z.string()).optional(),change_password:e.z.object({enabled:e.z.boolean(),html:e.z.string()}).optional(),guardian_mfa_page:e.z.object({enabled:e.z.boolean(),html:e.z.string()}).optional(),default_audience:e.z.string().optional(),default_organization:e.z.string().optional(),sessions:e.z.object({oidc_logout_prompt_enabled:e.z.boolean().optional()}).optional(),mfa:e.z.object({policy:e.z.enum([`never`,`always`]).default(`never`).optional(),factors:e.z.object({sms:e.z.boolean().default(!1),otp:e.z.boolean().default(!1),email:e.z.boolean().default(!1),push_notification:e.z.boolean().default(!1),webauthn_roaming:e.z.boolean().default(!1),webauthn_platform:e.z.boolean().default(!1),recovery_code:e.z.boolean().default(!1),duo:e.z.boolean().default(!1)}).optional(),sms_provider:e.z.object({provider:e.z.enum([`twilio`,`vonage`,`aws_sns`,`phone_message_hook`]).optional()}).optional(),twilio:e.z.object({sid:e.z.string().optional(),auth_token:e.z.string().optional(),from:e.z.string().optional(),messaging_service_sid:e.z.string().optional()}).optional(),phone_message:e.z.object({message:e.z.string().optional()}).optional()}).optional()}),e.z.object({date:e.z.string().openapi({description:`Date these events occurred in ISO 8601 format`,example:`2025-12-19`}),logins:e.z.number().openapi({description:`Number of logins on this date`,example:150}),signups:e.z.number().openapi({description:`Number of signups on this date`,example:25}),leaked_passwords:e.z.number().openapi({description:`Number of breached-password detections on this date (subscription required)`,example:0}),updated_at:e.z.string().openapi({description:`Date and time this stats entry was last updated in ISO 8601 format`,example:`2025-12-19T10:30:00.000Z`}),created_at:e.z.string().openapi({description:`Approximate date and time the first event occurred in ISO 8601 format`,example:`2025-12-19T00:00:00.000Z`})}),e.z.number().openapi({description:`Number of active users in the last 30 days`,example:1234}),e.z.enum([`active-users`,`logins`,`signups`,`refresh-tokens`,`sessions`,`logouts`,`password-changes`,`password-migrations`,`mfa`,`email-verifications`,`codes-sent`]),e.z.enum([`hour`,`day`,`week`,`month`]),e.z.enum([`time`,`connection`,`client_id`,`user_type`,`event`]),e.z.enum([`password`,`social`,`passwordless`,`enterprise`]);var Wn=e.z.object({cohort:e.z.string(),sessions:e.z.number(),active:e.z.array(e.z.number())});e.z.object({interval:e.z.literal(`week`),from:e.z.string(),to:e.z.string(),cohorts:e.z.array(Wn)});var Gn=e.z.object({cohort:e.z.string(),tokens:e.z.number(),active:e.z.array(e.z.number())});e.z.object({interval:e.z.literal(`week`),from:e.z.string(),to:e.z.string(),cohorts:e.z.array(Gn)});var Kn=e.z.object({name:e.z.string(),type:e.z.string()}),qn=e.z.object({elapsed:e.z.number(),rows_read:e.z.number().optional(),bytes_read:e.z.number().optional()});e.z.object({meta:e.z.array(Kn),data:e.z.array(e.z.record(e.z.string(),e.z.any())),rows:e.z.number(),rows_before_limit_at_least:e.z.number().optional(),statistics:qn.optional()});var Jn=e.z.enum(`login.login-id.login-password.signup.signup-id.signup-password.reset-password.consent.mfa.mfa-push.mfa-otp.mfa-voice.mfa-phone.mfa-webauthn.mfa-email.mfa-recovery-code.status.device-flow.email-verification.email-otp-challenge.organizations.invitation.common.passkeys.captcha.custom-form.login-passwordless.mfa-login-options`.split(`.`)),Yn=e.z.record(e.z.string(),e.z.record(e.z.string(),e.z.string())).openapi({type:`object`,additionalProperties:{type:`object`,additionalProperties:{type:`string`}}});e.z.object({prompt:Jn,language:e.z.string(),custom_text:Yn});var Xn=e.z.enum([`phone`,`totp`,`email`,`push`,`webauthn-roaming`,`webauthn-platform`,`passkey`]),Zn=e.z.object({user_id:e.z.string(),type:Xn,phone_number:e.z.string().optional(),totp_secret:e.z.string().optional(),credential_id:e.z.string().optional(),public_key:e.z.string().optional(),sign_count:e.z.number().int().nonnegative().optional(),credential_backed_up:e.z.boolean().optional(),transports:e.z.array(e.z.string()).optional(),friendly_name:e.z.string().optional(),confirmed:e.z.boolean().default(!1)});function Qn(t,n){t.type===`phone`&&!t.phone_number&&n.addIssue({code:e.z.ZodIssueCode.custom,message:`phone_number is required when type is 'phone'`,path:[`phone_number`]}),t.type===`totp`&&!t.totp_secret&&n.addIssue({code:e.z.ZodIssueCode.custom,message:`totp_secret is required when type is 'totp'`,path:[`totp_secret`]}),[`webauthn-roaming`,`webauthn-platform`,`passkey`].includes(t.type)&&(t.credential_id||n.addIssue({code:e.z.ZodIssueCode.custom,message:`credential_id is required when type is '${t.type}'`,path:[`credential_id`]}),t.public_key||n.addIssue({code:e.z.ZodIssueCode.custom,message:`public_key is required when type is '${t.type}'`,path:[`public_key`]}))}Zn.superRefine(Qn),Zn.extend({id:e.z.string(),created_at:e.z.string(),updated_at:e.z.string()}).superRefine(Qn),e.z.object({id:e.z.string().optional(),created_at:e.z.string().datetime({offset:!0}).optional(),updated_at:e.z.string().datetime({offset:!0}).optional()});var $n=`x-authhero-preserve-location`,B=class extends Error{ms;constructor(e,t){super(`${t??`Operation`} timed out after ${e}ms`),this.name=`TimeoutError`,this.ms=e}};function V(e){return e instanceof B?!0:e instanceof Error?e.name===`AbortError`||e.name===`TimeoutError`:!1}function H(e,t){let n=new AbortController,r=setTimeout(()=>n.abort(),e);return t(n.signal).finally(()=>clearTimeout(r))}function er(e){let t=e.filter(e=>e!==void 0);if(t.length<=1)return t[0];if(typeof AbortSignal.any==`function`)return AbortSignal.any(t);let n=new AbortController,r=t.find(e=>e.aborted);if(r)return n.abort(r.reason),n.signal;let i=()=>{for(let e of t)e.removeEventListener(`abort`,i);n.abort(t.find(e=>e.aborted)?.reason)};for(let e of t)e.addEventListener(`abort`,i);return n.signal}function U(e,t,n,r){let i=new AbortController,a=er([n,i.signal])??i.signal,o,s=new Promise((n,r)=>{o=setTimeout(()=>{let n=new B(e,t);i.abort(n),r(n)},e)});return Promise.race([Promise.resolve().then(()=>r(a)),s]).finally(()=>clearTimeout(o))}function W(e,t,n){let r,i=new Promise((e,i)=>{r=setTimeout(()=>i(new B(t,n)),t)});return Promise.race([e,i]).finally(()=>{r&&clearTimeout(r)})}var tr=1e4,nr=8e3;function G(e,t,n){let r=typeof t==`number`?{freshTtlMs:t,maxEntries:n}:t,i=r.freshTtlMs,a=r.staleTtlMs??0,o=r.staleIfErrorTtlMs??0,s=r.negativeTtlMs??i,c=r.maxEntries??tr,l=r.waitUntil,u=r.upstreamTimeoutMs??nr,d=u>0?u:1e4,f=new Map;function p(e){for(let[t,n]of f)n.stale_if_error_until<=e&&n.stale_until<=e&&f.delete(t);for(;f.size>=c;){let e=f.keys().next().value;if(e===void 0)break;f.delete(e)}}function m(e,t,n){let r=n+(t===null?s:i),c=t===null?r:r+a,l={value:t,fresh_until:r,stale_until:c,stale_if_error_until:t===null?c:c+o};return f.delete(e),p(n),f.set(e,l),l}function h(e,t){return e.refresh_started_at===void 0?!1:t-e.refresh_started_at<d?!0:(e.refresh_started_at=void 0,!1)}function g(t,n){return u>0?U(u,`resolveHost`,n,n=>e.resolveHost(t,{signal:n})):e.resolveHost(t,{signal:n})}async function _(e,t){let n=f.get(e);n&&(n.refresh_started_at=Date.now());try{let n=await g(e,t);return m(e,n,Date.now()),n}catch(t){let n=f.get(e);throw n&&(n.refresh_started_at=void 0,n.stale_if_error_until<=Date.now()&&f.delete(e)),t}}return{async resolveHost(e,t){let n=Date.now(),r=f.get(e);if(r&&r.fresh_until>n)return f.delete(e),f.set(e,r),r.value;if(r&&r.stale_until>n){if(f.delete(e),f.set(e,r),!h(r,n)){let t=_(e).catch(()=>void 0);l&&l(t)}return r.value}try{return await _(e,t?.signal)}catch(e){if(r&&r.stale_if_error_until>n)return r.value;throw e}}}}var rr=class{definitions=new Map;bindings;constructor(e={}){this.bindings=e}add(e){return this.definitions.set(e.type,e),this}has(e){return this.definitions.has(e)}build(e,t){let n=this.definitions.get(e);if(!n)throw Error(`Unknown proxy handler type: ${e}`);let r=n.optionsSchema.safeParse(t);if(!r.success)throw Error(`Invalid options for proxy handler "${e}": ${r.error.message}`);return n.build(r.data,{bindings:this.bindings})}};function K(e){return e}var ir=`__authhero_proxy_request__`,ar=`__authhero_proxy_tenant_id__`,or=`__authhero_proxy_custom_domain_id__`,sr=`__authhero_proxy_domain__`,cr=`x-authhero-proxy-mutability-probe`;function lr(e,t){e.set(ir,t)}function q(e){return e.get(ir)??e.req.raw}function ur(e,t){e.set(ar,t.tenant_id),e.set(or,t.custom_domain_id),e.set(sr,t.domain)}function dr(e){return e.get(ar)}function fr(e){return e.get(or)}function pr(e){return e.get(sr)}function mr(e,t){let n=q(e),r=new Headers(n.headers);t(r),lr(e,new Request(n,{headers:r}))}function J(e){let t=e.res;try{t.headers.append(cr,`1`),t.headers.delete(cr);return}catch{e.res=new Response(t.body,{status:t.status,statusText:t.statusText,headers:new Headers(t.headers)})}}var hr=e.z.object({origins:e.z.array(e.z.string()).optional(),allow_credentials:e.z.boolean().optional(),allow_headers:e.z.array(e.z.string()).optional(),allow_methods:e.z.array(e.z.string()).optional(),expose_headers:e.z.array(e.z.string()).optional(),max_age:e.z.number().int().optional()}).refine(e=>!(e.allow_credentials&&e.origins?.includes(`*`)),{message:`Cannot use wildcard origin (*) with allow_credentials`});function gr(e,t){let n=new Headers,r=e.origins??[`*`],i=r.includes(`*`);return i&&!e.allow_credentials?n.set(`Access-Control-Allow-Origin`,`*`):t&&(i||r.includes(t))&&(n.set(`Access-Control-Allow-Origin`,t),n.append(`Vary`,`Origin`)),e.allow_credentials&&n.set(`Access-Control-Allow-Credentials`,`true`),e.allow_methods?.length&&n.set(`Access-Control-Allow-Methods`,e.allow_methods.join(`, `)),e.allow_headers?.length&&n.set(`Access-Control-Allow-Headers`,e.allow_headers.join(`, `)),e.expose_headers?.length&&n.set(`Access-Control-Expose-Headers`,e.expose_headers.join(`, `)),e.max_age!==void 0&&n.set(`Access-Control-Max-Age`,String(e.max_age)),n}var _r=K({type:`cors`,optionsSchema:hr,build(e){return async(t,n)=>{let r=t.req.header(`origin`)??null;if(t.req.method===`OPTIONS`&&r!==null&&t.req.header(`access-control-request-method`)!==void 0){let t=gr(e,r);return new Response(null,{status:204,headers:t})}await n();let i=gr(e,r);J(t),i.forEach((e,n)=>{n.toLowerCase()===`vary`?t.res.headers.append(n,e):t.res.headers.set(n,e)})}}}),vr=e.z.object({username:e.z.string(),password:e.z.string(),realm:e.z.string().optional()});function yr(e,t){let n=`${e}:${t}`;return typeof btoa==`function`?btoa(n):Buffer.from(n,`utf-8`).toString(`base64`)}var br=K({type:`basic_auth`,optionsSchema:vr,build(e){let t=yr(e.username,e.password),n=(e.realm??`Restricted`).replace(/["\\\r\n]/g,``);return async(e,r)=>{let i=e.req.header(`authorization`);if(i){let e=i.indexOf(` `);if(e>0){let n=i.slice(0,e),a=i.slice(e+1);if(n.toLowerCase()===`basic`&&a===t)return r()}}return new Response(`Unauthorized`,{status:401,headers:{"WWW-Authenticate":`Basic realm="${n}"`}})}}}),xr=K({type:`headers`,optionsSchema:e.z.object({request:e.z.record(e.z.string(),e.z.string()).optional(),response:e.z.record(e.z.string(),e.z.string()).optional(),remove_request:e.z.array(e.z.string()).optional(),remove_response:e.z.array(e.z.string()).optional()}),build(e){return async(t,n)=>{if((e.request||e.remove_request)&&mr(t,t=>{if(e.remove_request?.forEach(e=>t.delete(e)),e.request)for(let[n,r]of Object.entries(e.request))t.set(n,r)}),await n(),(e.response||e.remove_response)&&(J(t),e.remove_response?.forEach(e=>t.res.headers.delete(e)),e.response))for(let[n,r]of Object.entries(e.response))t.res.headers.set(n,r)}}}),Sr=K({type:`cache`,optionsSchema:e.z.object({ttl_seconds:e.z.number().int().positive()}),build(e){return async(t,n)=>{if(await n(),!t.res.headers.has(`Cache-Control`)){let n=t.res.headers.has(`set-cookie`)?`private`:`public`;J(t),t.res.headers.set(`Cache-Control`,`${n}, max-age=${e.ttl_seconds}`)}}}}),Cr=[`173.245.48.0/20`,`103.21.244.0/22`,`103.22.200.0/22`,`103.31.4.0/22`,`141.101.64.0/18`,`108.162.192.0/18`,`190.93.240.0/20`,`188.114.96.0/20`,`197.234.240.0/22`,`198.41.128.0/17`,`162.158.0.0/15`,`104.16.0.0/13`,`104.24.0.0/14`,`172.64.0.0/13`,`131.0.72.0/22`,`2400:cb00::/32`,`2606:4700::/32`,`2803:f800::/32`,`2405:b500::/32`,`2405:8100::/32`,`2a06:98c0::/29`,`2c0f:f248::/32`];function wr(e){let t=e.split(`.`);if(t.length!==4)return null;let n=[];for(let e of t){if(!/^\d{1,3}$/.test(e))return null;let t=Number(e);if(t>255)return null;n.push(t)}return n}function Tr(e){if(e===``)return[];let t=e.split(`:`),n=[];for(let e=0;e<t.length;e++){let r=t[e];if(r.includes(`.`)){if(e!==t.length-1)return null;let i=wr(r);if(!i)return null;n.push(i[0]<<8|i[1],i[2]<<8|i[3]);continue}if(!/^[0-9a-f]{1,4}$/i.test(r))return null;n.push(parseInt(r,16))}return n}function Er(e){let t=e.split(`::`);if(t.length>2)return null;let n=Tr(t[0]??``);if(!n)return null;let r;if(t.length===2){let e=Tr(t[1]??``);if(!e)return null;let i=8-n.length-e.length;if(i<1)return null;r=[...n,...Array(i).fill(0),...e]}else r=n;if(r.length!==8)return null;let i=[];for(let e of r)i.push(e>>8&255,e&255);return i}function Dr(e){let t=e.trim();t.startsWith(`[`)&&t.endsWith(`]`)&&(t=t.slice(1,-1));let n=t.indexOf(`%`);if(n!==-1&&(t=t.slice(0,n)),t===``)return null;if(!t.includes(`:`))return wr(t);let r=Er(t);return r?r.slice(0,10).every(e=>e===0)&&r[10]===255&&r[11]===255?r.slice(12):r:null}function Or(e){let[t,n]=e.split(`/`),r=Dr(t??``),i=Number(n);if(!r||!Number.isInteger(i))throw Error(`Invalid Cloudflare CIDR: ${e}`);return{bytes:r,prefixBits:i}}var kr=Cr.map(Or);function Ar(e,t){if(e.length!==t.bytes.length)return!1;let n=t.prefixBits>>3;for(let r=0;r<n;r++)if(e[r]!==t.bytes[r])return!1;let r=t.prefixBits&7;if(r===0)return!0;let i=255<<8-r&255;return(e[n]&i)===(t.bytes[n]&i)}function jr(e){let t=Dr(e);return t?kr.some(e=>Ar(t,e)):!1}var Mr=K({type:`forwarded_headers`,optionsSchema:e.z.object({client_ip_header:e.z.string().default(`cf-connecting-ip`),set_x_real_ip:e.z.boolean().default(!0),set_x_original_url:e.z.boolean().default(!0),skip_cloudflare_client_ip:e.z.boolean().default(!0)}),build(e){return async(t,n)=>{let r=new URL(t.req.url);mr(t,n=>{n.set(`x-forwarded-host`,r.host),n.set(`x-forwarded-proto`,r.protocol.replace(`:`,``)),e.set_x_original_url&&n.set(`x-original-url`,t.req.url);let i=n.get(e.client_ip_header),a=i&&e.skip_cloudflare_client_ip&&jr(i)?null:i,o=(n.get(`x-forwarded-for`)??``).split(`,`).map(e=>e.trim()).filter(Boolean),s=a??o[o.length-1]??`127.0.0.1`,c=o.length===0||o[o.length-1]!==s,l=o.length?c?`${o.join(`, `)}, ${s}`:o.join(`, `):s;n.set(`x-forwarded-for`,l),e.set_x_real_ip&&n.set(`x-real-ip`,s)}),await n()}}}),Nr=e.z.object({upstream_host:e.z.string().optional()});function Pr(e){return e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`)}function Fr(e){if(typeof e.getSetCookie==`function`)return e.getSetCookie();let t=[];return e.forEach((e,n)=>{n.toLowerCase()===`set-cookie`&&t.push(e)}),t}var Ir=K({type:`rewrite_cookies`,optionsSchema:Nr,build(e){return async(t,n)=>{await n();let r=new URL(t.req.url).hostname,i=e.upstream_host??t.get(`__proxy_upstream_host__`);if(!i)return;let a=Fr(t.res.headers);if(a.length===0)return;let o=Pr(i),s=RegExp(`(?:^|;\\s*)Domain=\\.?${o}(?=;|$)`,`i`);J(t),t.res.headers.delete(`set-cookie`);for(let e of a)t.res.headers.append(`set-cookie`,e.replace(s,`Domain=${r}`))}}}),Lr=K({type:`rewrite_location`,optionsSchema:e.z.object({upstream_origin:e.z.string().optional()}),build(e){return async(t,n)=>{if(await n(),t.res.headers.has(`x-authhero-preserve-location`)){J(t),t.res.headers.delete($n);return}let r=t.res.status;if(r<300||r>=400)return;let i=t.res.headers.get(`location`);if(!i)return;let a=e.upstream_origin??t.get(`__proxy_upstream_origin__`);if(!a)return;let o;try{o=new URL(i)}catch{return}if(o.origin!==a)return;let s=new URL(t.req.url),c=`${`${s.protocol}//${s.host}`}${o.pathname}${o.search}${o.hash}`;J(t),t.res.headers.set(`location`,c)}}}),Rr=new Set([`connection`,`keep-alive`,`proxy-authenticate`,`proxy-authorization`,`te`,`trailers`,`transfer-encoding`,`upgrade`]),zr=3e4,Br=e.z.object({upstream_url:e.z.string(),preserve_host:e.z.boolean().default(!1),timeout_ms:e.z.number().int().positive().optional()});function Vr(e,t){return e===``||e===`/`?t:`${e.endsWith(`/`)?e.slice(0,-1):e}${t.startsWith(`/`)?t:`/${t}`}`}function Hr(e){return e!==`GET`&&e!==`HEAD`}var Ur=128*1024;function Wr(e){let t=e.headers.get(`content-length`);if(t===null)return null;let n=Number(t);return Number.isInteger(n)&&n>=0?n:null}async function Gr(e,t){let n=e.getReader(),r=!1,i=setTimeout(()=>{r=!0,n.cancel().catch(()=>{})},t),a=[],o=0;try{for(;;){let{done:e,value:i}=await n.read();if(r)throw new B(t,`Request body read`);if(e)break;a.push(i),o+=i.byteLength}}finally{clearTimeout(i)}let s=new Uint8Array(o),c=0;for(let e of a)s.set(e,c),c+=e.byteLength;return s.buffer}function Kr(e){return V(e)?new Response(`Request body timeout`,{status:408,headers:{"x-authhero-proxy-error":`request_body_timeout`}}):new Response(`Bad request`,{status:400,headers:{"x-authhero-proxy-error":`request_body_failed`}})}async function qr(e,t,n){if(!Hr(e.method)||!e.body)return;let r=Wr(e);if(r===null||r>Ur)return e.body;let i=await Gr(e.body,n);return t.set(`content-length`,String(i.byteLength)),i}async function Jr(e,t,n){let r=new URL(t.url),i=new URL(e.upstream_url);i.pathname=Vr(i.pathname,r.pathname),i.search=r.search;let a=new Headers(t.headers);for(let e of Rr)a.delete(e);e.preserve_host||a.set(`host`,i.host),a.has(`x-forwarded-host`)||a.set(`x-forwarded-host`,r.host),a.has(`x-forwarded-proto`)||a.set(`x-forwarded-proto`,r.protocol.replace(`:`,``));let o=await qr(t,a,n),s={method:t.method,headers:a,body:o,redirect:`manual`};return o instanceof ReadableStream&&(s.duplex=`half`),{target:i,init:s}}var Yr=K({type:`http`,optionsSchema:Br,build(e){let t=e.timeout_ms??zr;return async n=>{let r=q(n),i;try{i=await Jr(e,r,t)}catch(e){return Kr(e)}let{target:a,init:o}=i;n.set(`__proxy_upstream_host__`,a.hostname),n.set(`__proxy_upstream_origin__`,`${a.protocol}//${a.host}`);try{return await H(t,e=>fetch(a.toString(),{...o,signal:e}))}catch(e){return V(e)?n.text(`Upstream timeout`,504,{"x-authhero-proxy-error":`http_timeout`}):n.text(`Bad gateway`,502,{"x-authhero-proxy-error":`http_failed`})}}}}),Xr=3e4,Zr=e.z.object({binding:e.z.string(),upstream_url:e.z.string().optional(),preserve_host:e.z.boolean().default(!0),timeout_ms:e.z.number().int().positive().optional()});function Qr(e){return typeof e==`object`&&!!e&&typeof e.fetch==`function`}var $r=K({type:`service_binding`,optionsSchema:Zr,build(e,t){let n=t.bindings[e.binding];if(!Qr(n))throw Error(`Service binding "${e.binding}" is not configured or is not a Fetcher`);let r=e.upstream_url??`https://${e.binding}.binding.invalid/`,i=e.timeout_ms??Xr;return async t=>{let a=q(t),o;try{o=await Jr({upstream_url:r,preserve_host:e.preserve_host},a,i)}catch(e){return Kr(e)}let{target:s,init:c}=o;t.set(`__proxy_upstream_host__`,s.hostname),t.set(`__proxy_upstream_origin__`,`${s.protocol}//${s.host}`);try{return await H(i,async e=>n.fetch(new Request(s.toString(),{...c,signal:e})))}catch(e){return V(e)?t.text(`service_binding timed out after ${i}ms`,504,{"x-authhero-proxy-error":`service_binding_timeout`}):t.text(`Bad gateway`,502,{"x-authhero-proxy-error":`service_binding_failed`})}}}}),ei=3e4,ti=e.z.object({binding:e.z.string(),script_name:e.z.string(),cpu_ms:e.z.number().int().positive().optional(),subrequests:e.z.number().int().positive().optional(),timeout_ms:e.z.number().int().positive().optional()});function ni(e){return typeof e==`object`&&!!e&&typeof e.get==`function`}var Y=/\{(tenant_id|custom_domain_id|domain|host)\}/g;function ri(e){return Y.lastIndex=0,Y.test(e)}var ii=K({type:`dispatch_namespace`,optionsSchema:ti,build(e,t){let n=t.bindings[e.binding];if(!ni(n))throw Error(`Dispatch namespace binding "${e.binding}" is not configured or does not expose .get()`);let r=ri(e.script_name),i=e.timeout_ms??ei,a=e.cpu_ms||e.subrequests?{limits:{...e.cpu_ms?{cpuMs:e.cpu_ms}:{},...e.subrequests?{subrequests:e.subrequests}:{}}}:void 0;return async t=>{let o=e.script_name;if(r){let n=dr(t),r=fr(t),i=pr(t),a=t.req.header(`host`)??t.req.header(`x-forwarded-host`)??``;if(o=o.replace(Y,(e,t)=>{switch(t){case`tenant_id`:return n??``;case`custom_domain_id`:return r??``;case`domain`:return i??``;case`host`:return a;default:return``}}),o.includes(`{`)||o===``)return t.text(`dispatch_namespace: could not resolve script name from template "${e.script_name}"`,500)}let s=q(t);try{let e=n.get(o,void 0,a);return await H(i,async t=>{let n=new Request(s,{signal:t});return e.fetch(n)})}catch(e){return V(e)?t.text(`dispatch_namespace timed out after ${i}ms`,504,{"x-authhero-proxy-error":`dispatch_namespace_timeout`}):t.text(`Bad gateway`,502,{"x-authhero-proxy-error":`dispatch_namespace_failed`})}}}}),ai=K({type:`redirect`,optionsSchema:e.z.object({upstream_url:e.z.string().refine(e=>{try{let t=new URL(e);return(t.protocol===`http:`||t.protocol===`https:`)&&!!t.hostname}catch{return!1}},{message:`upstream_url must be a valid http(s) URL with a hostname`}),status:e.z.union([e.z.literal(301),e.z.literal(302),e.z.literal(307),e.z.literal(308)]).default(302),preserve_path:e.z.boolean().default(!0),preserve_query:e.z.boolean().default(!0)}),build(e){return async t=>{let n=new URL(t.req.url),r=new URL(e.upstream_url),i=r.pathname&&r.pathname!==`/`;return e.preserve_path&&!i&&(r.pathname=n.pathname),e.preserve_query&&!r.search&&(r.search=n.search),new Response(null,{status:e.status,headers:{location:r.toString()}})}}}),oi=K({type:`static`,optionsSchema:e.z.object({status:e.z.number().int().default(200),headers:e.z.record(e.z.string(),e.z.string()).optional(),body:e.z.string().optional(),json:e.z.unknown().optional()}),build(e){return async()=>{let t=new Headers(e.headers??{}),n=e.body??null;return e.json!==void 0&&(n=JSON.stringify(e.json),t.has(`content-type`)||t.set(`content-type`,`application/json; charset=utf-8`)),new Response(n,{status:e.status,headers:t})}}});function si(e){e.add(_r).add(br).add(xr).add(Sr).add(Mr).add(Ir).add(Lr).add(Yr).add($r).add(ii).add(ai).add(oi)}function ci(e){return[...e].sort((e,t)=>e.priority===t.priority?e.created_at.localeCompare(t.created_at):e.priority-t.priority)}function li(e,t){let n=e.toLowerCase(),r=t.toLowerCase();if(n===r)return!0;if(n.startsWith(`*.`)){let e=n.slice(1);return r.endsWith(e)&&r.length>e.length}return!1}function ui(e,t){return!e||e.length===0?!0:e.some(e=>li(e,t))}function di(e){let t=(e.headers?Object.entries(e.headers):[]).map(([e,t])=>[e.toLowerCase(),new RegExp(t)]),n=(e.query?Object.entries(e.query):[]).map(([e,t])=>[e,new RegExp(t)]),r=e.hosts;return async(e,i)=>{if(r&&!ui(r,e.req.header(`host`)??``))return new Response(`No matching route`,{status:404});for(let[n,r]of t){let t=e.req.header(n);if(t===void 0||!r.test(t))return new Response(`No matching route`,{status:404})}if(n.length>0){let t=new URL(e.req.url);for(let[e,r]of n){let n=t.searchParams.get(e);if(n===null||!r.test(n))return new Response(`No matching route`,{status:404})}}await i()}}var fi=`forwarded_headers`;function pi(e){return e.some(e=>e.type===`forwarded_headers`)?[...e]:[{type:fi,options:{}},...e]}function X(e,t){return e.has(`forwarded_headers`)?pi(t):[...t]}var mi=[`GET`,`POST`,`PUT`,`PATCH`,`DELETE`,`OPTIONS`,`HEAD`];function Z(e,n,r,i){let a=new t.Hono;r&&a.use(`*`,async(e,t)=>{ur(e,r),await t()});let o=ci(e);for(let e of o){let t=[];t.push(di(e.match));for(let r of X(n,e.handlers))t.push(n.build(r.type,r.options));let r=e.match.methods?.length?e.match.methods.map(e=>e.toUpperCase()):mi,i=e.match.path||`/*`;a.on(r,[i],...t)}return i&&i.length>0?a.on(mi,[`*`],...i):a.all(`*`,e=>e.text(`No matching route`,404)),a.onError((e,t)=>{let n=V(e);return t.text(n?`Upstream timeout`:`Bad gateway`,n?504:502,{"x-authhero-proxy-error":n?`handler_timeout`:`handler_failed`})}),a}var hi=1e4;function gi(e){return e.resolver?e.resolver:e.cache?G(e.data,e.cache):G(e.data,e.cacheTtlMs??3e4)}function _i(e){if(e.registry)return e.registry;let t=new rr(e.bindings??{});return si(t),t}function Q(e){let t=gi(e),n=_i(e),r=new WeakMap,i=e.resolveHostTimeoutMs??hi,a=e.defaultHandlers&&e.defaultHandlers.length>0?X(n,e.defaultHandlers).map(e=>n.build(e.type,e.options)):void 0,o=a?Z([],n,void 0,a):void 0;return async e=>{let s=e.req.header(`host`)??e.req.header(`x-forwarded-host`);if(!s)return e.text(`Missing host`,400);try{let c=await U(i,`resolveHost`,void 0,e=>t.resolveHost(s,{signal:e}));if(!c)return o?await o.fetch(e.req.raw):e.text(`Unknown host`,404);let l=r.get(c);return l||(l=Z(c.routes,n,{tenant_id:c.tenant_id,custom_domain_id:c.custom_domain_id,domain:c.domain},a),r.set(c,l)),await l.fetch(e.req.raw)}catch(t){return o?await o.fetch(e.req.raw):V(t)?e.text(`Resolve host timed out after ${i}ms`,504,{"x-authhero-proxy-error":`resolve_host_timeout`}):e.text(`Bad gateway`,502,{"x-authhero-proxy-error":`data_plane_error`})}}}function vi(e){let n=new t.Hono;return n.all(`*`,Q(e)),n}function yi(e){let n=new t.Hono;return n.all(`*`,Q({data:e.data,cacheTtlMs:e.cacheTtlMs,cache:e.cache,resolver:e.resolver,registry:e.registry,bindings:e.bindings,resolveHostTimeoutMs:e.resolveHostTimeoutMs,defaultHandlers:e.defaultHandlers})),n.onError((e,t)=>{let n=V(e);return t.text(n?`Proxy timeout`:`Bad gateway`,n?504:502,{"x-authhero-proxy-error":n?`proxy_timeout`:`proxy_error`})}),n}var bi=1e3,xi=1e3;function Si(e,t){return new Request(`https://proxy-cache.internal/${encodeURIComponent(e)}/hosts/${encodeURIComponent(t.toLowerCase())}`,{method:`GET`})}function Ci(){return globalThis.caches?.default}function wi(e){let t=e.cache??Ci();if(!t)return e.upstream;let n=t,r=e.namespace??`authhero-proxy`,i=e.cacheTtlSeconds??60,a=e.negativeCacheTtlSeconds??10,o=e.waitUntil,s=e.cacheReadTimeoutMs??bi,c=e.cacheWriteTimeoutMs??xi;async function l(e){try{return await W(Promise.resolve(n.match(e)),s,`cache.match`)}catch{return}}return{async resolveHost(t,s){let u=Si(r,t),d=await l(u);if(d)try{return(await d.json()).value}catch{}let f=await e.upstream.resolveHost(t,s),p=f===null?a:i,m=new Response(JSON.stringify({value:f}),{headers:{"content-type":`application/json`,"cache-control":`public, max-age=${p}`}}),h=W(Promise.resolve(n.put(u,m)),c,`cache.put`).catch(()=>void 0);return o?o(h):await h,f}}}function Ti(e,t){return Si(e,t)}var Ei=1e3,Di=1e3,Oi=5e3;function ki(e){let{upstream:t,cache:n,freshTtlMs:r,staleTtlMs:i=0,staleIfErrorTtlMs:a=0,negativeTtlMs:o=r,keyPrefix:s=`authhero-proxy-host`,waitUntil:c,cacheReadTimeoutMs:l=Ei,cacheWriteTimeoutMs:u=Di,upstreamTimeoutMs:d=Oi}=e,f=d>0?d:1e4,p=new Map;function m(e){return`${s}:${e.toLowerCase()}`}async function h(e){try{return await W(n.get(e),l,`cache.get`)??null}catch{return null}}function g(e,t,r){let i=W(Promise.resolve().then(()=>n.set(e,t,r)),u,`cache.set`).catch(()=>void 0);return c?(c(i),Promise.resolve()):i}function _(e,t){let n=p.get(e);return n===void 0?!1:t-n<f?!0:(p.delete(e),!1)}function v(e,n){return d>0?U(d,`resolveHost`,n,n=>t.resolveHost(e,{signal:n})):t.resolveHost(e,{signal:n})}async function y(e,t){return p.set(e,Date.now()),(async()=>{try{let n=await v(e,t),s=Date.now(),c=n===null?o:r,l=n===null?0:i,u=n===null?0:a,d={value:n,freshUntilMs:s+c,staleUntilMs:s+c+l,staleIfErrorUntilMs:s+c+l+u},f=Math.max(1,Math.ceil((c+l+u)/1e3));return await g(m(e),d,f),n}finally{p.delete(e)}})()}return{async resolveHost(e,t){let n=await h(m(e)),r=Date.now();if(n&&typeof n.freshUntilMs==`number`){if(n.freshUntilMs>r)return n.value;if(n.staleUntilMs>r){if(!_(e,r)){let t=y(e).catch(()=>void 0);c&&c(t)}return n.value}}try{return await y(e,t?.signal)}catch(e){if(n&&(n.staleIfErrorUntilMs??n.staleUntilMs)>r)return n.value;throw e}}}}function Ai(e,t){return`${e}:${t.toLowerCase()}`}function $(){throw Error(`Static proxy adapter is read-only; configure routes at init time`)}function ji(e,t,n,r,i,a){return{id:e.id??`${n}:${t}`,tenant_id:r,custom_domain_id:i,priority:e.priority??100,match:{...e.match,path:e.match.path||`/*`},handlers:e.handlers,created_at:e.created_at??a,updated_at:e.updated_at??a}}function Mi(e){let t=new Date().toISOString(),n=e.defaultTenantId??`static`,r=new Map;for(let[i,a]of Object.entries(e.hosts)){let e=i.toLowerCase(),o=Array.isArray(a)?{routes:a}:a,s=o.tenant_id??n,c=o.custom_domain_id??e,l=o.routes.map((n,r)=>ji(n,r,e,s,c,t)).sort((e,t)=>e.priority-t.priority);r.set(e,{tenant_id:s,custom_domain_id:c,domain:e,routes:l})}return{proxyRoutes:{async create(){return $()},async update(){return $()},async remove(){return $()},async get(e,t){for(let n of r.values()){if(n.tenant_id!==e)continue;let r=n.routes.find(e=>e.id===t);if(r)return r}return null},async list(e,t){let n=[];for(let i of r.values())i.tenant_id===e&&(t?.custom_domain_id&&i.custom_domain_id!==t.custom_domain_id||n.push(...i.routes));let i=t?.per_page??n.length,a=(t?.page??0)*i,o=n.slice(a,a+i);return{proxy_routes:o,start:a,limit:i,length:o.length}}},async resolveHost(e){return r.get(e.toLowerCase())??null}}}function Ni(e,t={}){return{priority:t.priority,match:{path:t.path??`/*`},handlers:[{type:`http`,options:{upstream_url:e,preserve_host:t.preserve_host??!1}}]}}var Pi=`proxy:resolve_host`;function Fi(){let e=()=>{throw Error(`HTTP proxy adapter does not expose write access to proxy_routes; mutate via the control-plane management API`)};return{async create(){return e()},async update(){return e()},async remove(){return e()},async get(){throw Error(`HTTP proxy adapter does not expose per-route reads; use resolveHost`)},async list(){throw Error(`HTTP proxy adapter does not expose per-route reads; use resolveHost`)}}}function Ii(e){let t=e.fetch??fetch,n=e.baseUrl.replace(/\/+$/,``),r=e.resolveHostPath??`/api/v2/proxy/control-plane/hosts/`,i=e.audience??`${n}/api/v2/`,a=e.scope??`proxy:resolve_host`,o=e.tokenRefreshSkewSeconds??60,s=e.timeoutMs??2500;function c(e,t){let n=new AbortController,r=er([e,n.signal])??n.signal,i,a=new Promise((e,t)=>{i=setTimeout(()=>{n.abort(),t(new B(s,`control plane`))},s)});return Promise.race([t(r),a]).finally(()=>clearTimeout(i))}let l=null;async function u(r){let s=await c(r,async r=>{let o=await t(`${n}/oauth/token`,{method:`POST`,headers:{"content-type":`application/json`},body:JSON.stringify({grant_type:`client_credentials`,client_id:e.clientId,client_secret:e.clientSecret,audience:i,scope:a}),signal:r});if(!o.ok)throw Error(`Proxy adapter token request failed: ${o.status} ${await o.text().catch(()=>``)}`);return await o.json()}),u=s.expires_in??3600;return l={value:s.access_token,expires_at:Date.now()+(u-o)*1e3},s.access_token}async function d(e){return l&&l.expires_at>Date.now()?l.value:u(e)}return{proxyRoutes:Fi(),async resolveHost(e,i){let a=i?.signal,o=await d(a),s=`${n}${r}${encodeURIComponent(e.toLowerCase())}`;return c(a,async e=>{let n=await t(s,{headers:{authorization:`Bearer ${o}`},signal:e});if(n.status===404)return null;if(!n.ok)throw Error(`Proxy adapter resolveHost failed: ${n.status} ${await n.text().catch(()=>``)}`);return await n.json()})}}}function Li(e){return(t,n)=>{let r=t instanceof Request&&n===void 0?t:new Request(t,n);return e.fetch(r)}}var Ri=`authhero-proxy-host:`;function zi(e,t){return`${e}${t.toLowerCase()}`}function Bi(){let e=()=>{throw Error(`KV proxy adapter does not expose write access to proxy_routes; mutate via the control-plane management API`)};return{async create(){return e()},async update(){return e()},async remove(){return e()},async get(){throw Error(`KV proxy adapter does not expose per-route reads; use resolveHost`)},async list(){throw Error(`KV proxy adapter does not expose per-route reads; use resolveHost`)}}}function Vi(e){let{kv:t,keyPrefix:n=Ri,timeoutMs:r}=e;return{proxyRoutes:Bi(),async resolveHost(e){let i=zi(n,e),a=t.get(i,`json`);return(r&&r>0?await W(a,r,`kv.get`):await a)??null}}}exports.DEFAULT_KV_HOST_KEY_PREFIX=Ri,exports.FORWARDED_HEADERS_HANDLER_TYPE=fi,exports.HandlerRegistry=rr,exports.PROXY_RESOLVE_HOST_SCOPE=Pi,exports.basicAuthHandler=br,exports.buildCacheAdapterKey=Ai,exports.buildCacheApiKey=Ti,exports.buildKvHostKey=zi,exports.buildMatchFilter=di,exports.cacheHandler=Sr,exports.compileHostApp=Z,exports.corsHandler=_r,exports.createCacheAdapterHostCache=ki,exports.createCacheApiHostCache=wi,exports.createHttpProxyAdapter=Ii,exports.createInMemoryHostCache=G,exports.createKvProxyAdapter=Vi,exports.createProxyApp=yi,exports.createProxyDataPlaneHandler=Q,exports.createProxyDataPlaneRouter=vi,exports.createServiceBindingFetch=Li,exports.createStaticProxyAdapter=Mi,exports.defineHandler=K,exports.dispatchNamespaceHandler=ii,exports.forwardedHeadersHandler=Mr,exports.handlerConfigSchema=wn,exports.headersHandler=xr,exports.httpHandler=Yr,exports.httpRoute=Ni,exports.isCloudflareIp=jr,exports.matchSchema=Cn,exports.matchesAnyHost=ui,exports.matchesHost=li,exports.proxyRouteInsertSchema=z,exports.proxyRouteSchema=Tn,exports.proxyRouteUpdateSchema=En,exports.redirectHandler=ai,exports.registerBuiltinHandlers=si,exports.rewriteCookiesHandler=Ir,exports.rewriteLocationHandler=Lr,exports.serviceBindingHandler=$r,exports.sortRoutes=ci,exports.staticHandler=oi,exports.withForwardedHeaders=pi,exports.withForwardedHeadersFor=X;