@authhero/saml 0.5.1 → 0.5.3

package/dist/core.mjs

@@ -4929,7 +4929,9 @@ var Mr = e.object({
 	type: e.literal("EMAIL"),
 	config: e.object({
 		placeholder: e.string().optional(),
-		default_value: e.string().optional()
+		default_value: e.string().optional(),
+		last_used: e.boolean().optional(),
+		last_used_label: e.string().optional()
 	}).optional()
 }), $r = Y.extend({
 	type: e.literal("FILE"),
@@ -4996,7 +4998,9 @@ var Mr = e.object({
 		placeholder: e.string().optional(),
 		multiline: e.boolean().optional(),
 		max_length: e.number().optional(),
-		default_value: e.string().optional()
+		default_value: e.string().optional(),
+		last_used: e.boolean().optional(),
+		last_used_label: e.string().optional()
 	}).optional()
 }), si = Y.extend({
 	type: e.literal("COUNTRY"),
@@ -5198,7 +5202,7 @@ var bi = e.enum([
 	"credentials-exchange",
 	"pre-user-registration",
 	"post-user-registration"
-]), wi = e.enum([
+]), wi = e.enum(["post-user-login"]), Ti = e.enum(["impersonate"]), Ei = e.enum([
 	"ensure-username",
 	"set-preferred-username",
 	"account-linking"
@@ -5208,59 +5212,73 @@ var bi = e.enum([
 	priority: e.number().optional(),
 	hook_id: e.string().optional(),
 	metadata: e.record(e.string(), e.unknown()).optional()
-}, Ti = e.object({
+}, Di = e.object({
 	...Z,
 	trigger_id: bi,
 	url: e.string()
-}), Ei = e.object({
+}), Oi = e.object({
 	...Z,
 	trigger_id: xi,
 	form_id: e.string()
-}), Di = e.object({
+}), ki = e.object({
 	...Z,
 	trigger_id: Si,
-	template_id: wi
-}), Oi = e.object({
+	template_id: Ei
+}), Ai = e.object({
 	...Z,
 	trigger_id: Ci,
 	code_id: e.string()
+}), ji = e.object({
+	...Z,
+	trigger_id: wi,
+	page_id: Ti,
+	permission_required: e.string().optional()
 });
 e.union([
-	Ti,
-	Ei,
 	Di,
-	Oi
+	Oi,
+	ki,
+	Ai,
+	ji
 ]);
-var ki = e.object({
+var Mi = e.object({
 	...Z,
 	trigger_id: bi
 }).extend(G.shape).extend({
 	hook_id: e.string(),
 	url: e.string()
-}), Ai = e.object({
+}), Ni = e.object({
 	...Z,
 	trigger_id: xi
 }).extend(G.shape).extend({
 	hook_id: e.string(),
 	form_id: e.string()
-}), ji = e.object({
+}), Pi = e.object({
 	...Z,
 	trigger_id: Si
 }).extend(G.shape).extend({
 	hook_id: e.string(),
-	template_id: wi
-}), Mi = e.object({
+	template_id: Ei
+}), Fi = e.object({
 	...Z,
 	trigger_id: Ci
 }).extend(G.shape).extend({
 	hook_id: e.string(),
 	code_id: e.string()
+}), Ii = e.object({
+	...Z,
+	trigger_id: wi
+}).extend(G.shape).extend({
+	hook_id: e.string(),
+	page_id: Ti,
+	permission_required: e.string().optional()
 });
 e.union([
-	ki,
-	Ai,
-	ji,
-	Mi
+	Mi,
+	Ni,
+	Pi,
+	Fi,
+	Ii
 ]), e.object({
 	code: e.string().max(1e5),
 	secrets: e.record(e.string(), e.string()).optional()
@@ -5268,11 +5286,11 @@ e.union([
 	id: e.string(),
 	tenant_id: e.string()
 }).extend(G.shape);
-var Ni = e.object({ name: e.string().optional() }), Pi = e.object({ email: e.string().optional() }), Fi = e.object({
+var Li = e.object({ name: e.string().optional() }), Ri = e.object({ email: e.string().optional() }), zi = e.object({
 	id: e.string().optional(),
 	organization_id: e.string().max(50),
-	inviter: Ni,
-	invitee: Pi,
+	inviter: Li,
+	invitee: Ri,
 	invitation_url: e.string().url(),
 	client_id: e.string(),
 	connection_id: e.string().optional(),
@@ -5288,8 +5306,8 @@ e.object({
 	created_at: e.string().datetime(),
 	expires_at: e.string().datetime(),
 	ticket_id: e.string().optional()
-}).extend(Fi.omit({ id: !0 }).shape);
-var Ii = e.object({
+}).extend(zi.omit({ id: !0 }).shape);
+var Bi = e.object({
 	alg: e.enum([
 		"RS256",
 		"RS384",
@@ -5331,7 +5349,7 @@ var Ii = e.object({
 		message: `EC JWK is missing required member '${r}'`
 	});
 });
-e.object({ keys: e.array(Ii) }), e.object({
+e.object({ keys: e.array(Bi) }), e.object({
 	issuer: e.string(),
 	authorization_endpoint: e.string(),
 	token_endpoint: e.string(),
@@ -5358,9 +5376,9 @@ e.object({ keys: e.array(Ii) }), e.object({
 	backchannel_logout_supported: e.boolean().optional(),
 	backchannel_logout_session_supported: e.boolean().optional()
 });
-var Li = /* @__PURE__ */ function(e) {
+var Vi = /* @__PURE__ */ function(e) {
 	return e.PENDING = "pending", e.AUTHENTICATED = "authenticated", e.AWAITING_EMAIL_VERIFICATION = "awaiting_email_verification", e.AWAITING_MFA = "awaiting_mfa", e.AWAITING_HOOK = "awaiting_hook", e.AWAITING_CONTINUATION = "awaiting_continuation", e.AWAITING_CONSENT = "awaiting_consent", e.COMPLETED = "completed", e.FAILED = "failed", e.EXPIRED = "expired", e;
-}({}), Ri = e.nativeEnum(Li), zi = e.object({
+}({}), Hi = e.nativeEnum(Vi), Ui = e.object({
 	strategy: e.string(),
 	strategy_type: e.string()
 });
@@ -5374,12 +5392,12 @@ e.object({
 	useragent: e.string().optional(),
 	session_id: e.string().optional(),
 	authorization_url: e.string().optional(),
-	state: Ri.optional().default("pending"),
+	state: Hi.optional().default("pending"),
 	state_data: e.string().optional(),
 	failure_reason: e.string().optional(),
 	user_id: e.string().optional(),
 	auth_connection: e.string().optional(),
-	auth_strategy: zi.optional(),
+	auth_strategy: Ui.optional(),
 	authenticated_at: e.string().optional()
 }).openapi({ description: "This represents a login sesion" }).extend({
 	id: e.string().openapi({ description: "This is is used as the state in the universal login" }),
@@ -5546,17 +5564,17 @@ var Q = {
 	WARNING_DURING_LOGIN: "w",
 	WARNING_SENDING_NOTIFICATION: "wn",
 	WARNING_USER_MANAGEMENT: "wum"
-}, Bi = e.string().refine((e) => Object.values(Q).includes(e), { message: "Invalid log type" });
+}, Wi = e.string().refine((e) => Object.values(Q).includes(e), { message: "Invalid log type" });
 Q.ACLS_SUMMARY, Q.ACTIONS_EXECUTION_FAILED, Q.API_LIMIT, Q.API_LIMIT_WARNING, Q.APPI, Q.CIBA_EXCHANGE_FAILED, Q.CIBA_EXCHANGE_SUCCEEDED, Q.CIBA_START_FAILED, Q.CIBA_START_SUCCEEDED, Q.CODE_LINK_SENT, Q.CODE_SENT, Q.DEPRECATION_NOTICE, Q.FAILED_LOGIN, Q.FAILED_BY_CONNECTOR, Q.FAILED_CHANGE_EMAIL, Q.FAILED_BY_CORS, Q.FAILED_CROSS_ORIGIN_AUTHENTICATION, Q.FAILED_CHANGE_PASSWORD, Q.FAILED_POST_CHANGE_PASSWORD_HOOK, Q.FAILED_CHANGE_PHONE_NUMBER, Q.FAILED_CHANGE_PASSWORD_REQUEST, Q.FAILED_CONNECTOR_PROVISIONING, Q.FAILED_CHANGE_USERNAME, Q.FAILED_DELEGATION, Q.FAILED_DEVICE_ACTIVATION, Q.FAILED_DEVICE_AUTHORIZATION_REQUEST, Q.USER_CANCELED_DEVICE_CONFIRMATION, Q.FAILED_USER_DELETION, Q.FAILED_EXCHANGE_AUTHORIZATION_CODE_FOR_ACCESS_TOKEN, Q.FAILED_EXCHANGE_ACCESS_TOKEN_FOR_CLIENT_CREDENTIALS, Q.FAILED_EXCHANGE_CUSTOM_TOKEN, Q.FAILED_EXCHANGE_DEVICE_CODE_FOR_ACCESS_TOKEN, Q.FAILED_FEDERATED_LOGOUT, Q.FAILED_EXCHANGE_NATIVE_SOCIAL_LOGIN, Q.FAILED_EXCHANGE_PASSWORD_OOB_FOR_ACCESS_TOKEN, Q.FAILED_EXCHANGE_PASSWORD_OTP_FOR_ACCESS_TOKEN, Q.FAILED_EXCHANGE_PASSWORD_FOR_ACCESS_TOKEN, Q.FAILED_EXCHANGE_PASSWORDLESS_OTP_FOR_ACCESS_TOKEN, Q.FAILED_EXCHANGE_PASSWORD_MFA_RECOVERY_FOR_ACCESS_TOKEN, Q.FAILED_EXCHANGE_ROTATING_REFRESH_TOKEN, Q.FAILED_EXCHANGE_REFRESH_TOKEN_FOR_ACCESS_TOKEN, Q.FAILED_EXCHANGE_SUBJECT_TOKEN_FOR_ACCESS_TOKEN, Q.FAILED_HOOK, Q.FAILED_IMPERSONATION, Q.FAILED_INVITE_ACCEPT, Q.FAILED_LOGOUT, Q.FLOWS_EXECUTION_COMPLETED, Q.FLOWS_EXECUTION_FAILED, Q.FAILED_SENDING_NOTIFICATION, Q.FORMS_SUBMISSION_FAILED, Q.FORMS_SUBMISSION_SUCCEEDED, Q.FAILED_LOGIN_INCORRECT_PASSWORD, Q.FAILED_PUSHED_AUTHORIZATION_REQUEST, Q.FAILED_POST_USER_REGISTRATION_HOOK, Q.FAILED_SIGNUP, Q.FAILED_SILENT_AUTH, Q.FAILED_LOGIN_INVALID_EMAIL_USERNAME, Q.FAILED_USERS_IMPORT, Q.FAILED_VERIFICATION_EMAIL, Q.FAILED_VERIFICATION_EMAIL_REQUEST, Q.EMAIL_VERIFICATION_CONFIRMED, Q.EMAIL_VERIFICATION_FAILED, Q.MFA_AUTH_FAILED, Q.MFA_AUTH_REJECTED, Q.MFA_AUTH_SUCCESS, Q.MFA_ENROLLMENT_COMPLETE, Q.TOO_MANY_MFA_FAILURES, Q.MFA_RECOVERY_FAILED, Q.MFA_RECOVERY_RATE_LIMIT_EXCEED, Q.MFA_RECOVERY_SUCCESS, Q.MFA_EMAIL_SENT, Q.EMAIL_VERIFICATION_SENT, Q.EMAIL_VERIFICATION_SEND_FAILURE, Q.PUSH_NOTIFICATION_SENT, Q.ERROR_SENDING_MFA_PUSH_NOTIFICATION, Q.MFA_SMS_SENT, Q.ERROR_SENDING_MFA_SMS, Q.MFA_VOICE_CALL_SUCCESS, Q.MFA_VOICE_CALL_FAILED, Q.SECOND_FACTOR_STARTED, Q.MFA_ENROLL_STARTED, Q.MFA_ENROLLMENT_FAILED, Q.GUARDIAN_TENANT_UPDATE, Q.UNENROLL_DEVICE_ACCOUNT, Q.UPDATE_DEVICE_ACCOUNT, Q.WEBAUTHN_CHALLENGE_FAILED, Q.WEBAUTHN_ENROLLMENT_FAILED, Q.FAILED_KMS_API_OPERATION, Q.SUCCESS_KMS_API_OPERATION, Q.KMS_KEY_STATE_CHANGED, Q.TOO_MANY_CALLS_TO_DELEGATION, Q.BLOCKED_IP_ADDRESS, Q.BLOCKED_ACCOUNT_IP, Q.BLOCKED_ACCOUNT_EMAIL, Q.INFORMATION, Q.MFA_REQUIRED, Q.MANAGEMENT_API_READ_OPERATION, Q.FAILED_AUTHENTICATION_METHOD_OPERATION_MY_ACCOUNT, Q.SUCCESSFUL_AUTHENTICATION_METHOD_OPERATION_MY_ACCOUNT, Q.FAILED_OIDC_BACKCHANNEL_LOGOUT, Q.SUCCESSFUL_OIDC_BACKCHANNEL_LOGOUT, Q.ORGANIZATION_MEMBER_ADDED, Q.PASSKEY_CHALLENGE_FAILED, Q.PASSKEY_CHALLENGE_STARTED, Q.PRE_LOGIN_ASSESSMENT, Q.BREACHED_PASSWORD, Q.BREACHED_PASSWORD_ON_RESET, Q.SUCCESS_RESOURCE_CLEANUP, Q.RICH_CONSENTS_ACCESS_ERROR, Q.SUCCESS_LOGIN, Q.SUCCESS_API_OPERATION, Q.FAILED_API_OPERATION, Q.SUCCESS_CHANGE_EMAIL, Q.SUCCESS_CROSS_ORIGIN_AUTHENTICATION, Q.SUCCESS_CHANGE_PASSWORD, Q.SUCCESS_CHANGE_PHONE_NUMBER, Q.SUCCESS_CHANGE_PASSWORD_REQUEST, Q.SUCCESS_CHANGE_USERNAME, Q.SUCCESS_CREDENTIAL_VALIDATION, Q.SUCCESS_DELEGATION, Q.SUCCESS_USER_DELETION, Q.SUCCESS_EXCHANGE_AUTHORIZATION_CODE_FOR_ACCESS_TOKEN, Q.SUCCESS_EXCHANGE_ACCESS_TOKEN_FOR_CLIENT_CREDENTIALS, Q.SUCCESS_EXCHANGE_CUSTOM_TOKEN, Q.SUCCESS_EXCHANGE_DEVICE_CODE_FOR_ACCESS_TOKEN, Q.SUCCESS_EXCHANGE_NATIVE_SOCIAL_LOGIN, Q.SUCCESS_EXCHANGE_PASSWORD_OOB_FOR_ACCESS_TOKEN, Q.SUCCESS_EXCHANGE_PASSWORD_OTP_FOR_ACCESS_TOKEN, Q.SUCCESS_EXCHANGE_PASSWORDLESS_OTP_FOR_ACCESS_TOKEN, Q.SUCCESS_EXCHANGE_PASSWORD_FOR_ACCESS_TOKEN, Q.SUCCESS_EXCHANGE_PASSKEY_OOB_FOR_ACCESS_TOKEN, Q.SUCCESS_EXCHANGE_PASSKEY_OTP_FOR_ACCESS_TOKEN, Q.SUCCESS_EXCHANGE_PASSKEY_MFA_RECOVERY_FOR_ACCESS_TOKEN, Q.SUCCESS_EXCHANGE_PASSWORD_MFA_RECOVERY_FOR_ACCESS_TOKEN, Q.SUCCESS_EXCHANGE_REFRESH_TOKEN_FOR_ACCESS_TOKEN, Q.SUCCESS_EXCHANGE_SUBJECT_TOKEN_FOR_ACCESS_TOKEN, Q.SUCCESS_IMPERSONATION, Q.SUCCESSFULLY_ACCEPTED_USER_INVITE, Q.BREACHED_PASSWORD_ON_SIGNUP, Q.SUCCESS_LOGOUT, Q.SUCCESS_HOOK, Q.SUCCESS_PASSWORD_MIGRATION, Q.SUCCESS_REVOCATION, Q.SUCCESS_SIGNUP, Q.FAILED_SS_SSO_OPERATION, Q.INFORMATION_FROM_SS_SSO_OPERATION, Q.SUCCESS_SS_SSO_OPERATION, Q.SUCCESS_SILENT_AUTH, Q.SUCCESSFUL_SCIM_OPERATION, Q.SUCCESSFULLY_IMPORTED_USERS, Q.SUCCESS_VERIFICATION_EMAIL, Q.SUCCESS_VERIFICATION_EMAIL_REQUEST, Q.MAX_AMOUNT_OF_AUTHENTICATORS, Q.USER_LOGIN_BLOCK_RELEASED, Q.FAILED_UNIVERSAL_LOGOUT, Q.SUCCESSFUL_UNIVERSAL_LOGOUT, Q.WARNING_DURING_LOGIN, Q.WARNING_SENDING_NOTIFICATION, Q.WARNING_USER_MANAGEMENT, (() => {
 	let e = {};
 	for (let [t, n] of Object.entries(Q)) t.startsWith("SUCCESS_") || t.startsWith("SUCCESSFUL_") || t.startsWith("SUCCESSFULLY_") || t.endsWith("_SUCCEEDED") || t.endsWith("_COMPLETED") ? e[n] = "success" : t.startsWith("FAILED_") || t.startsWith("ERROR_") || t.startsWith("BREACHED_") || t.startsWith("BLOCKED_") || t === "MFA_AUTH_FAILED" || t === "MFA_AUTH_REJECTED" || t === "MFA_RECOVERY_FAILED" || t === "MFA_ENROLLMENT_FAILED" || t === "EMAIL_VERIFICATION_FAILED" || t === "WEBAUTHN_CHALLENGE_FAILED" || t === "WEBAUTHN_ENROLLMENT_FAILED" || t === "PASSKEY_CHALLENGE_FAILED" || t === "FLOWS_EXECUTION_FAILED" || t === "FORMS_SUBMISSION_FAILED" || t === "CIBA_EXCHANGE_FAILED" || t === "CIBA_START_FAILED" || t === "ACTIONS_EXECUTION_FAILED" || t === "RICH_CONSENTS_ACCESS_ERROR" || t === "USER_CANCELED_DEVICE_CONFIRMATION" || t === "TOO_MANY_MFA_FAILURES" || t === "MFA_RECOVERY_RATE_LIMIT_EXCEED" || t === "API_LIMIT" || t === "MAX_AMOUNT_OF_AUTHENTICATORS" ? e[n] = "failure" : t.startsWith("WARNING_") || t === "API_LIMIT_WARNING" || t === "DEPRECATION_NOTICE" || t === "PRE_LOGIN_ASSESSMENT" ? e[n] = "warning" : t === "CODE_SENT" || t === "CODE_LINK_SENT" || t === "MFA_EMAIL_SENT" || t === "MFA_SMS_SENT" || t === "EMAIL_VERIFICATION_SENT" || t === "PUSH_NOTIFICATION_SENT" ? e[n] = "code_sent" : t === "INFORMATION" || t === "INFORMATION_FROM_SS_SSO_OPERATION" || t === "MANAGEMENT_API_READ_OPERATION" || t === "APPI" || t === "ACLS_SUMMARY" || t === "ORGANIZATION_MEMBER_ADDED" ? e[n] = "info" : e[n] = "other";
 	return e;
 })();
-var Vi = e.object({
+var Gi = e.object({
 	name: e.string(),
 	version: e.string(),
 	env: e.object({ node: e.string().optional() }).optional()
-}), Hi = e.object({
+}), Ki = e.object({
 	country_code: e.string().length(2),
 	city_name: e.string(),
 	latitude: e.string(),
@@ -5565,7 +5583,7 @@ var Vi = e.object({
 	continent_code: e.string()
 });
 e.object({
-	type: Bi,
+	type: Wi,
 	date: e.string(),
 	description: e.string().optional(),
 	ip: e.string().optional(),
@@ -5583,63 +5601,63 @@ e.object({
 	strategy: e.string().optional(),
 	strategy_type: e.string().optional(),
 	hostname: e.string().optional(),
-	auth0_client: Vi.optional(),
+	auth0_client: Gi.optional(),
 	log_id: e.string().optional(),
-	location_info: Hi.optional()
+	location_info: Ki.optional()
 }).extend({ log_id: e.string() });
-var Ui = e.enum([
+var qi = e.enum([
 	"http",
 	"eventbridge",
 	"eventgrid",
 	"splunk",
 	"datadog",
 	"sumo"
-]), Wi = e.enum([
+]), Ji = e.enum([
 	"active",
 	"paused",
 	"suspended"
-]), Gi = e.object({
+]), Yi = e.object({
 	type: e.string(),
 	name: e.string()
 });
 e.object({
 	name: e.string(),
-	type: Ui,
-	status: Wi.optional(),
+	type: qi,
+	status: Ji.optional(),
 	sink: e.record(e.string(), e.unknown()),
-	filters: e.array(Gi).optional(),
+	filters: e.array(Yi).optional(),
 	isPriority: e.boolean().optional()
 }).extend({
 	id: e.string(),
-	status: Wi,
+	status: Ji,
 	created_at: e.string().optional(),
 	updated_at: e.string().optional()
 });
-var Ki = e.enum([
+var Xi = e.enum([
 	"auth0",
 	"cognito",
 	"okta",
 	"oidc"
-]), qi = e.object({
+]), Zi = e.object({
 	domain: e.string(),
 	client_id: e.string(),
 	client_secret: e.string(),
 	audience: e.string().optional(),
 	scope: e.string().optional()
-}), Ji = e.object({
+}), Qi = e.object({
 	id: e.string().optional(),
 	name: e.string(),
-	provider: Ki,
+	provider: Xi,
 	connection: e.string(),
 	enabled: e.boolean().default(!0),
-	credentials: qi
+	credentials: Zi
 });
 e.object({
 	id: e.string(),
 	created_at: e.string(),
 	updated_at: e.string()
-}).extend(Ji.shape);
-var Yi = e.object({
+}).extend(Qi.shape);
+var $i = e.object({
 	enabled: e.boolean().optional(),
 	shields: e.array(e.string()).optional(),
 	admin_notification_frequency: e.array(e.string()).optional(),
@@ -5648,13 +5666,13 @@ var Yi = e.object({
 		"pre-user-registration": e.object({ shields: e.array(e.string()).optional() }).optional(),
 		"pre-change-password": e.object({ shields: e.array(e.string()).optional() }).optional()
 	}).optional()
-}), Xi = e.object({
+}), ea = e.object({
 	enabled: e.boolean().optional(),
 	shields: e.array(e.string()).optional(),
 	allowlist: e.array(e.string()).optional(),
 	mode: e.string().optional(),
 	max_attempts: e.number().optional()
-}), Zi = e.object({
+}), ta = e.object({
 	enabled: e.boolean().optional(),
 	shields: e.array(e.string()).optional(),
 	allowlist: e.array(e.string()).optional(),
@@ -5668,10 +5686,10 @@ var Yi = e.object({
 			rate: e.number().optional()
 		}).optional()
 	}).optional()
-}), Qi = e.object({
-	breached_password_detection: Yi.optional(),
-	brute_force_protection: Xi.optional(),
-	suspicious_ip_throttling: Zi.optional()
+}), na = e.object({
+	breached_password_detection: $i.optional(),
+	brute_force_protection: ea.optional(),
+	suspicious_ip_throttling: ta.optional()
 });
 e.object({
 	id: e.string().optional(),
@@ -5684,14 +5702,14 @@ e.object({
 	created_at: e.string(),
 	updated_at: e.string()
 });
-var $i = e.object({
+var ra = e.object({
 	initial_user_agent: e.string().describe("First user agent of the device from which this user logged in"),
 	initial_ip: e.string().describe("First IP address associated with this session"),
 	initial_asn: e.string().describe("First autonomous system number associated with this session"),
 	last_user_agent: e.string().describe("Last user agent of the device from which this user logged in"),
 	last_ip: e.string().describe("Last IP address from which this user logged in"),
 	last_asn: e.string().describe("Last autonomous system number from which this user logged in")
-}), ea = e.object({
+}), ia = e.object({
 	id: e.string(),
 	revoked_at: e.string().optional(),
 	used_at: e.string().optional(),
@@ -5699,7 +5717,7 @@ var $i = e.object({
 	expires_at: e.string().optional(),
 	login_session_id: e.string(),
 	idle_expires_at: e.string().optional(),
-	device: $i.describe("Metadata related to the device used in the session"),
+	device: ra.describe("Metadata related to the device used in the session"),
 	clients: e.array(e.string()).describe("List of client details for the session")
 });
 e.object({
@@ -5707,7 +5725,7 @@ e.object({
 	updated_at: e.string(),
 	authenticated_at: e.string(),
 	last_interaction_at: e.string()
-}).extend(ea.shape), e.object({
+}).extend(ia.shape), e.object({
 	kid: e.string().openapi({ description: "The key id of the signing key" }),
 	tenant_id: e.string().optional().openapi({ description: "The tenant the key belongs to. Omitted means the key is shared / control-plane scoped." }),
 	cert: e.string().openapi({ description: "The public certificate of the signing key" }),
@@ -5724,7 +5742,7 @@ e.object({
 	connection: e.string().optional().openapi({ description: "The connection identifier associated with the key" }),
 	type: e.enum(["jwt_signing", "saml_encryption"]).openapi({ description: "The type of the signing key" })
 });
-var ta = e.object({
+var aa = e.object({
 	id: e.string().optional(),
 	audience: e.string().optional(),
 	friendly_name: e.string(),
@@ -5842,7 +5860,7 @@ var ta = e.object({
 		"shared_planetscale"
 	]).optional(),
 	d1_database_id: e.string().max(64).optional(),
-	attack_protection: Qi.optional(),
+	attack_protection: na.optional(),
 	mfa: e.object({
 		policy: e.enum(["never", "always"]).default("never").optional(),
 		factors: e.object({
@@ -5873,35 +5891,35 @@ var ta = e.object({
 e.object({
 	created_at: e.string().nullable().transform((e) => e ?? ""),
 	updated_at: e.string().nullable().transform((e) => e ?? "")
-}).extend(ta.shape).extend({
+}).extend(aa.shape).extend({
 	id: e.string(),
 	is_control_plane: e.boolean().optional()
 });
-var na = e.enum([
+var oa = e.enum([
 	"provision",
 	"seed",
 	"upgrade",
 	"backup",
 	"deprovision"
-]), ra = e.enum([
+]), sa = e.enum([
 	"pending",
 	"running",
 	"succeeded",
 	"failed",
 	"cancelled"
-]), ia = e.enum(["inline", "cloudflare-workflows"]);
+]), ca = e.enum(["inline", "cloudflare-workflows"]);
 e.object({
 	tenant_id: e.string().max(255).nullable().default(null),
 	rollout_id: e.string().max(255).nullable().optional(),
-	kind: na,
-	engine: ia,
+	kind: oa,
+	engine: ca,
 	engine_instance_id: e.string().max(100).nullable().optional(),
 	target_worker_version: e.string().max(255).nullable().optional(),
 	target_database_version: e.string().max(255).nullable().optional(),
 	initiated_by: e.string().max(255).nullable().optional()
 }).extend({
 	id: e.string(),
-	status: ra,
+	status: sa,
 	current_step: e.string().max(255).nullable().optional(),
 	error: e.string().nullable().optional(),
 	created_at: e.string(),
@@ -5916,7 +5934,7 @@ e.object({
 	error: !0,
 	finished_at: !0
 }).partial();
-var aa = e.enum([
+var la = e.enum([
 	"started",
 	"succeeded",
 	"failed",
@@ -5927,18 +5945,18 @@ var aa = e.enum([
 e.object({
 	operation_id: e.string().max(255),
 	step: e.string().max(255),
-	outcome: aa,
+	outcome: la,
 	detail: e.record(e.string(), e.unknown()).nullable().optional(),
 	attempt: e.number().int().min(1).default(1)
 }).extend({
 	id: e.string(),
 	created_at: e.string()
 });
-var oa = e.enum([
+var ua = e.enum([
 	"upgrade",
 	"reseed",
 	"backup"
-]), sa = e.enum([
+]), da = e.enum([
 	"pending",
 	"canary",
 	"rolling",
@@ -5947,7 +5965,7 @@ var oa = e.enum([
 	"failed"
 ]);
 e.object({
-	kind: oa,
+	kind: ua,
 	target_worker_version: e.string().max(255).nullable().optional(),
 	target_database_version: e.string().max(255).nullable().optional(),
 	wave_size: e.number().int().min(1).default(10),
@@ -5956,7 +5974,7 @@ e.object({
 	initiated_by: e.string().max(255).nullable().optional()
 }).extend({
 	id: e.string(),
-	status: sa,
+	status: da,
 	created_at: e.string(),
 	updated_at: e.string(),
 	finished_at: e.string().nullable().optional()
@@ -5978,7 +5996,7 @@ e.object({
 	code: e.string(),
 	state: e.string().optional()
 });
-var ca = e.object({
+var fa = e.object({
 	button_border_radius: e.number(),
 	button_border_weight: e.number(),
 	buttons_style: e.enum([
@@ -5996,7 +6014,7 @@ var ca = e.object({
 	show_widget_shadow: e.boolean(),
 	widget_border_weight: e.number(),
 	widget_corner_radius: e.number()
-}), la = e.object({
+}), pa = e.object({
 	base_focus_color: e.string(),
 	base_hover_color: e.string(),
 	body_text: e.string(),
@@ -6023,7 +6041,7 @@ var ca = e.object({
 }), $ = e.object({
 	bold: e.boolean(),
 	size: e.number()
-}), ua = e.object({
+}), ma = e.object({
 	body_text: $,
 	buttons_text: $,
 	font_url: e.string(),
@@ -6033,7 +6051,7 @@ var ca = e.object({
 	reference_text_size: e.number(),
 	subtitle: $,
 	title: $
-}), da = e.object({
+}), ha = e.object({
 	background_color: e.string(),
 	background_image_url: e.string(),
 	page_layout: e.enum([
@@ -6046,7 +6064,7 @@ var ca = e.object({
 		"chip",
 		"none"
 	]).optional()
-}), fa = e.object({
+}), ga = e.object({
 	header_text_alignment: e.enum([
 		"center",
 		"left",
@@ -6063,12 +6081,12 @@ var ca = e.object({
 	social_buttons_layout: e.enum(["bottom", "top"])
 });
 e.object({
-	borders: ca,
-	colors: la,
+	borders: fa,
+	colors: pa,
 	displayName: e.string(),
-	fonts: ua,
-	page_background: da,
-	widget: fa
+	fonts: ma,
+	page_background: ha,
+	widget: ga
 }).extend({ themeId: e.string() }), e.object({
 	universal_login_experience: e.enum(["new", "classic"]).default("new"),
 	identifier_first: e.boolean().default(!0),
@@ -6076,44 +6094,44 @@ e.object({
 	show_last_used_connection: e.boolean().default(!1),
 	webauthn_platform_first_factor: e.boolean()
 });
-var pa = e.object({
+var _a = e.object({
 	hosts: e.array(e.string()).optional(),
 	methods: e.array(e.string()).optional(),
 	path: e.string().default("/*"),
 	headers: e.record(e.string(), e.string()).optional(),
 	query: e.record(e.string(), e.string()).optional()
-}), ma = e.object({
+}), va = e.object({
 	type: e.string(),
 	options: e.record(e.string(), e.unknown()).default({})
-}), ha = e.object({
+}), ya = e.object({
 	id: e.string().optional(),
 	custom_domain_id: e.string(),
 	priority: e.number().int().default(100),
-	match: pa,
-	handlers: e.array(ma).min(1)
+	match: _a,
+	handlers: e.array(va).min(1)
 });
-ha.extend({
+ya.extend({
 	id: e.string(),
 	tenant_id: e.string(),
 	created_at: e.string(),
 	updated_at: e.string()
-}), ha.partial().omit({
+}), ya.partial().omit({
 	id: !0,
 	custom_domain_id: !0
 });
-var ga = e.object({
+var ba = e.object({
 	scim: e.string(),
 	auth0: e.string()
-}), _a = e.object({
+}), xa = e.object({
 	connection_id: e.string(),
 	user_id_attribute: e.string().default("externalId"),
-	mapping: e.array(ga).default([])
+	mapping: e.array(ba).default([])
 });
 e.object({
 	created_at: e.string(),
 	updated_at: e.string()
-}).extend(_a.shape);
-var va = e.object({
+}).extend(xa.shape);
+var Sa = e.object({
 	token_id: e.string(),
 	connection_id: e.string(),
 	token_hash: e.string(),
@@ -6123,20 +6141,20 @@ var va = e.object({
 e.object({
 	created_at: e.string(),
 	last_used_at: e.string().optional()
-}).extend(va.shape);
-var ya = e.object({
+}).extend(Sa.shape);
+var Ca = e.object({
 	connection_id: e.string(),
 	external_id: e.string(),
 	user_id: e.string()
 });
-e.object({ created_at: e.string() }).extend(ya.shape), e.object({
+e.object({ created_at: e.string() }).extend(Ca.shape), e.object({
 	name: e.string(),
 	enabled: e.boolean().optional().default(!0),
 	default_from_address: e.string().optional(),
 	credentials: e.record(e.string(), e.unknown()),
 	settings: e.object({}).optional()
 });
-var ba = e.enum([
+var wa = e.enum([
 	"verify_email",
 	"verify_email_by_code",
 	"reset_email",
@@ -6151,7 +6169,7 @@ var ba = e.enum([
 	"user_invitation"
 ]);
 e.object({
-	template: ba,
+	template: wa,
 	body: e.string(),
 	from: e.string(),
 	subject: e.string(),
@@ -6168,7 +6186,7 @@ e.object({
 	expires_at: e.string().optional(),
 	idle_expires_at: e.string().optional(),
 	last_exchanged_at: e.string().optional(),
-	device: $i,
+	device: ra,
 	resource_servers: e.array(e.object({
 		audience: e.string(),
 		scopes: e.string()
@@ -6189,10 +6207,10 @@ e.object({
 	name: e.string(),
 	options: e.object({})
 });
-var xa = e.object({
+var Ta = e.object({
 	value: e.string(),
 	description: e.string().optional()
-}), Sa = e.object({
+}), Ea = e.object({
 	token_dialect: e.enum(["access_token", "access_token_authz"]).optional(),
 	enforce_policies: e.boolean().optional(),
 	allow_skipping_userinfo: e.boolean().optional(),
@@ -6200,11 +6218,11 @@ var xa = e.object({
 	persist_client_authorization: e.boolean().optional(),
 	enable_introspection_endpoint: e.boolean().optional(),
 	mtls: e.object({ bound_access_tokens: e.boolean().optional() }).optional()
-}), Ca = e.object({
+}), Da = e.object({
 	id: e.string().optional(),
 	name: e.string(),
 	identifier: e.string(),
-	scopes: e.array(xa).optional(),
+	scopes: e.array(Ta).optional(),
 	signing_alg: e.string().optional(),
 	signing_secret: e.string().optional(),
 	token_lifetime: e.number().default(86400),
@@ -6212,20 +6230,20 @@ var xa = e.object({
 	skip_consent_for_verifiable_first_party_clients: e.boolean().optional(),
 	allow_offline_access: e.boolean().optional(),
 	verificationKey: e.string().optional(),
-	options: Sa.optional(),
+	options: Ea.optional(),
 	is_system: e.boolean().optional(),
 	metadata: e.record(e.string(), e.any()).optional()
 }).extend({
 	created_at: e.string().optional(),
 	updated_at: e.string().optional()
 });
-e.array(Ca);
-var wa = e.object({
+e.array(Da);
+var Oa = e.object({
 	role_id: e.string(),
 	resource_server_identifier: e.string(),
 	permission_name: e.string()
 }).extend({ created_at: e.string() });
-e.array(wa), e.object({
+e.array(Oa), e.object({
 	user_id: e.string().openapi({ description: "The id of the user that granted the consent" }),
 	clientID: e.string().openapi({ description: "The id of the client the grant was issued to" }),
 	audience: e.string().optional().openapi({ description: "The audience the grant applies to" }),
@@ -6238,7 +6256,7 @@ e.array(wa), e.object({
 	failed_logins: e.array(e.string()).optional(),
 	last_password_reset: e.string().optional()
 });
-var Ta = e.object({
+var ka = e.object({
 	user_id: e.string(),
 	resource_server_identifier: e.string(),
 	permission_name: e.string(),
@@ -6247,8 +6265,8 @@ var Ta = e.object({
 	tenant_id: e.string(),
 	created_at: e.string().optional()
 });
-e.array(Ta);
-var Ea = e.object({
+e.array(ka);
+var Aa = e.object({
 	user_id: e.string(),
 	resource_server_identifier: e.string(),
 	resource_server_name: e.string(),
@@ -6257,8 +6275,8 @@ var Ea = e.object({
 	created_at: e.string().optional(),
 	organization_id: e.string().optional()
 });
-e.array(Ea);
-var Da = e.object({
+e.array(Aa);
+var ja = e.object({
 	user_id: e.string(),
 	role_id: e.string(),
 	organization_id: e.string().optional()
@@ -6266,8 +6284,8 @@ var Da = e.object({
 	tenant_id: e.string(),
 	created_at: e.string().optional()
 });
-e.array(Da);
-var Oa = e.object({
+e.array(ja);
+var Ma = e.object({
 	id: e.string().optional().openapi({ description: "The unique identifier of the role. If not provided, one will be generated." }),
 	name: e.string().min(1).max(50).openapi({ description: "The name of the role. Cannot include '<' or '>'" }),
 	description: e.string().max(255).optional().openapi({ description: "The description of the role" }),
@@ -6278,19 +6296,19 @@ var Oa = e.object({
 	created_at: e.string().optional(),
 	updated_at: e.string().optional()
 });
-e.array(Oa);
-var ka = e.object({
+e.array(Ma);
+var Na = e.object({
 	logo_url: e.string().optional().openapi({ description: "URL of the organization's logo" }),
 	colors: e.object({
 		primary: e.string().optional().openapi({ description: "Primary color in hex format (e.g., #FF0000)" }),
 		page_background: e.string().optional().openapi({ description: "Page background color in hex format (e.g., #FFFFFF)" })
 	}).optional()
-}).optional(), Aa = e.object({
+}).optional(), Pa = e.object({
 	connection_id: e.string().openapi({ description: "ID of the connection" }),
 	assign_membership_on_login: e.boolean().default(!1).openapi({ description: "Whether to assign membership to the organization on login" }),
 	show_as_button: e.boolean().default(!0).openapi({ description: "Whether to show this connection as a button in the login screen" }),
 	is_signup_enabled: e.boolean().default(!0).openapi({ description: "Whether signup is enabled for this connection" })
-}), ja = e.object({ client_credentials: e.object({
+}), Fa = e.object({ client_credentials: e.object({
 	enforce: e.boolean().default(!1).openapi({ description: "Whether to enforce token quota limits" }),
 	per_day: e.number().min(0).default(0).openapi({ description: "Maximum tokens per day (0 = unlimited)" }),
 	per_hour: e.number().min(0).default(0).openapi({ description: "Maximum tokens per hour (0 = unlimited)" })
@@ -6299,15 +6317,15 @@ e.object({
 	id: e.string().optional(),
 	name: e.string().min(1).regex(/^[a-z0-9_-]+$/, { message: "Organization name must be lowercase and can only contain letters, numbers, hyphens, and underscores" }).openapi({ description: "The name of the organization. Must be lowercase and can only contain letters, numbers, hyphens, and underscores." }),
 	display_name: e.string().optional().openapi({ description: "The display name of the organization" }),
-	branding: ka,
+	branding: Na,
 	metadata: e.record(e.string(), e.any()).default({}).optional().openapi({ description: "Custom metadata for the organization" }),
-	enabled_connections: e.array(Aa).default([]).optional().openapi({ description: "List of enabled connections for the organization" }),
-	token_quota: ja
+	enabled_connections: e.array(Pa).default([]).optional().openapi({ description: "List of enabled connections for the organization" }),
+	token_quota: Fa
 }).extend(G.shape).extend({
 	id: e.string(),
 	name: e.string().min(1).openapi({ description: "The name of the organization" })
 });
-var Ma = e.object({
+var Ia = e.object({
 	connection_id: e.string().openapi({ description: "ID of the tenant-level connection to enable for the org." }),
 	assign_membership_on_login: e.boolean().optional().default(!1),
 	show_as_button: e.boolean().optional().default(!0),
@@ -6320,7 +6338,7 @@ var Ma = e.object({
 	created_at: e.string().optional(),
 	updated_at: e.string().optional()
 });
-e.array(Ma), e.object({
+e.array(Ia), e.object({
 	user_id: e.string().openapi({ description: "ID of the user" }),
 	organization_id: e.string().openapi({ description: "ID of the organization" })
 }).extend(G.shape).extend({ id: e.string() }), e.object({
@@ -6459,22 +6477,33 @@ e.array(Ma), e.object({
 	"passwordless",
 	"enterprise"
 ]);
-var Na = e.object({
+var La = e.object({
+	cohort: e.string(),
+	sessions: e.number(),
+	active: e.array(e.number())
+});
+e.object({
+	interval: e.literal("week"),
+	from: e.string(),
+	to: e.string(),
+	cohorts: e.array(La)
+});
+var Ra = e.object({
 	name: e.string(),
 	type: e.string()
-}), Pa = e.object({
+}), za = e.object({
 	elapsed: e.number(),
 	rows_read: e.number().optional(),
 	bytes_read: e.number().optional()
 });
 e.object({
-	meta: e.array(Na),
+	meta: e.array(Ra),
 	data: e.array(e.record(e.string(), e.any())),
 	rows: e.number(),
 	rows_before_limit_at_least: e.number().optional(),
-	statistics: Pa.optional()
+	statistics: za.optional()
 });
-var Fa = e.enum(/* @__PURE__ */ "login.login-id.login-password.signup.signup-id.signup-password.reset-password.consent.mfa.mfa-push.mfa-otp.mfa-voice.mfa-phone.mfa-webauthn.mfa-email.mfa-recovery-code.status.device-flow.email-verification.email-otp-challenge.organizations.invitation.common.passkeys.captcha.custom-form.login-passwordless.mfa-login-options".split(".")), Ia = e.record(e.string(), e.record(e.string(), e.string())).openapi({
+var Ba = e.enum(/* @__PURE__ */ "login.login-id.login-password.signup.signup-id.signup-password.reset-password.consent.mfa.mfa-push.mfa-otp.mfa-voice.mfa-phone.mfa-webauthn.mfa-email.mfa-recovery-code.status.device-flow.email-verification.email-otp-challenge.organizations.invitation.common.passkeys.captcha.custom-form.login-passwordless.mfa-login-options".split(".")), Va = e.record(e.string(), e.record(e.string(), e.string())).openapi({
 	type: "object",
 	additionalProperties: {
 		type: "object",
@@ -6482,11 +6511,11 @@ var Fa = e.enum(/* @__PURE__ */ "login.login-id.login-password.signup.signup-id.
 	}
 });
 e.object({
-	prompt: Fa,
+	prompt: Ba,
 	language: e.string(),
-	custom_text: Ia
+	custom_text: Va
 });
-var La = e.enum([
+var Ha = e.enum([
 	"phone",
 	"totp",
 	"email",
@@ -6494,9 +6523,9 @@ var La = e.enum([
 	"webauthn-roaming",
 	"webauthn-platform",
 	"passkey"
-]), Ra = e.object({
+]), Ua = e.object({
 	user_id: e.string(),
-	type: La,
+	type: Ha,
 	phone_number: e.string().optional(),
 	totp_secret: e.string().optional(),
 	credential_id: e.string().optional(),
@@ -6507,7 +6536,7 @@ var La = e.enum([
 	friendly_name: e.string().optional(),
 	confirmed: e.boolean().default(!1)
 });
-function za(t, n) {
+function Wa(t, n) {
 	t.type === "phone" && !t.phone_number && n.addIssue({
 		code: e.ZodIssueCode.custom,
 		message: "phone_number is required when type is 'phone'",
@@ -6530,51 +6559,51 @@ function za(t, n) {
 		path: ["public_key"]
 	}));
 }
-Ra.superRefine(za), Ra.extend({
+Ua.superRefine(Wa), Ua.extend({
 	id: e.string(),
 	created_at: e.string(),
 	updated_at: e.string()
-}).superRefine(za), e.object({
+}).superRefine(Wa), e.object({
 	id: e.string().optional(),
 	created_at: e.string().datetime({ offset: !0 }).optional(),
 	updated_at: e.string().datetime({ offset: !0 }).optional()
 });
-function Ba(e) {
+function Ga(e) {
 	let t = atob(e), n = new Uint8Array(t.length);
 	for (let e = 0; e < t.length; e++) n[e] = t.charCodeAt(e);
 	return n;
 }
 //#endregion
 //#region ../../node_modules/.pnpm/nanoid@5.1.11/node_modules/nanoid/url-alphabet/index.js
-var Va = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict", Ha = (e = 21) => {
+var Ka = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict", qa = (e = 21) => {
 	let t = "", n = crypto.getRandomValues(new Uint8Array(e |= 0));
-	for (; e--;) t += Va[n[e] & 63];
+	for (; e--;) t += Ka[n[e] & 63];
 	return t;
 };
 //#endregion
 //#region src/helpers.ts
-async function Ua(e) {
+async function Ja(e) {
 	let t = new DecompressionStream("deflate-raw"), n = new Uint8Array(e), r = new Blob([n]).stream().pipeThrough(t);
 	return new Uint8Array(await new Response(r).arrayBuffer());
 }
-async function Wa(e) {
-	let t = Ba(e.replace(/ /g, "+"));
+async function Ya(e) {
+	let t = Ga(e.replace(/ /g, "+"));
 	try {
-		let e = await Ua(t);
+		let e = await Ja(t);
 		return new TextDecoder().decode(e);
 	} catch (e) {
 		return console.warn("Decompression failed, assuming data is not compressed:", e), new TextDecoder().decode(t);
 	}
 }
-async function Ga(e) {
-	let t = await Wa(e), n = new en({
+async function Xa(e) {
+	let t = await Ya(e), n = new en({
 		attributeNamePrefix: "@_",
 		alwaysCreateTextNode: !0,
 		ignoreAttributes: !1
 	}).parse(t);
 	return r.parse(n);
 }
-function Ka(e) {
+function Za(e) {
 	let t = e.certificates.map((e) => ({
 		"@_use": "signing",
 		KeyInfo: {
@@ -6648,8 +6677,8 @@ function Ka(e) {
 		attributeNamePrefix: "@_"
 	}).build(n);
 }
-async function qa(e, t) {
-	let n = e.notBefore || (/* @__PURE__ */ new Date()).toISOString(), r = e.notAfter || new Date(new Date(n).getTime() + 600 * 1e3).toISOString(), i = e.issueInstant || n, a = e.sessionNotOnOrAfter || r, o = e.responseId || `_${Ha()}`, s = e.assertionId || `_${Ha()}`, c = [{
+async function Qa(e, t) {
+	let n = e.notBefore || (/* @__PURE__ */ new Date()).toISOString(), r = e.notAfter || new Date(new Date(n).getTime() + 600 * 1e3).toISOString(), i = e.issueInstant || n, a = e.sessionNotOnOrAfter || r, o = e.responseId || `_${qa()}`, s = e.assertionId || `_${qa()}`, c = [{
 		"samlp:Response": [
 			{ "saml:Issuer": [{ "#text": e.issuer }] },
 			{ "samlp:Status": [{
@@ -6830,7 +6859,7 @@ async function qa(e, t) {
 }
 //#endregion
 //#region src/signers/http.ts
-var Ja = class {
+var $a = class {
 	signUrl;
 	constructor(e) {
 		this.signUrl = e;
@@ -6850,4 +6879,4 @@ var Ja = class {
 	}
 };
 //#endregion
-export { Ja as HttpSamlSigner, Ka as createSamlMetadata, qa as createSamlResponse, s as dsSignatureSchema, Wa as inflateDecompress, Ua as inflateRaw, Ga as parseSamlRequestQuery, n as samlIssuerSchema, i as samlMetadataResponseSchema, r as samlRequestSchema, c as samlResponseJsonSchema };
+export { $a as HttpSamlSigner, Za as createSamlMetadata, Qa as createSamlResponse, s as dsSignatureSchema, Ya as inflateDecompress, Ja as inflateRaw, Xa as parseSamlRequestQuery, n as samlIssuerSchema, i as samlMetadataResponseSchema, r as samlRequestSchema, c as samlResponseJsonSchema };