@authhero/saml 0.5.12 → 0.5.14

package/dist/saml.mjs

@@ -4354,6 +4354,7 @@ var $n = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict", er
 		"iat_dcr"
 	]).optional().openapi({ description: "Provenance of this client. `manual` = Management API; `open_dcr` = RFC 7591 without IAT; `iat_dcr` = RFC 7591 with an Initial Access Token." }),
 	registration_metadata: e.record(e.string(), e.any()).default({}).optional().openapi({ description: "Arbitrary metadata captured at Dynamic Client Registration time that isn't a first-class client field (e.g. integration_type, domain). Also stores `iat_constraints` for clients created via IAT so RFC 7592 PUT can enforce field immutability." }),
+	token_exchange: e.object({ allow_any_profile_of_type: e.array(e.literal("custom_authentication")).optional() }).optional().openapi({ description: "Custom Token Exchange settings. Set `allow_any_profile_of_type` to `[\"custom_authentication\"]` to let this client exchange subject tokens through the tenant's token exchange profiles." }),
 	user_linking_mode: e.enum(["builtin", "off"]).optional().openapi({ description: "Per-client override for the built-in email-based user-linking path. `builtin` runs the legacy in-process linking at user creation/email update. `off` disables the legacy path; linking only happens if the tenant has enabled the `account-linking` template hook. When unset, the service-level `userLinkingMode` default applies." })
 });
 e.object({
@@ -4581,7 +4582,8 @@ var Dr = e.enum([
 	"authorization_code",
 	"oauth2_state",
 	"ticket",
-	"client_assertion_jti"
+	"client_assertion_jti",
+	"subject_token_jti"
 ]);
 e.object({
 	code_id: e.string().openapi({ description: "The code that will be used in for instance an email verification flow" }),
@@ -4824,7 +4826,11 @@ var Pr = e.object({
 	})
 }), Br = J.extend({
 	type: e.literal("NEXT_BUTTON"),
-	config: e.object({ text: e.string().optional() })
+	config: e.object({
+		text: e.string().optional(),
+		variant: e.enum(["primary", "secondary"]).optional(),
+		skip_validation: e.boolean().optional()
+	})
 }), Vr = J.extend({
 	type: e.literal("PREVIOUS_BUTTON"),
 	config: e.object({ text: e.string().optional() })
@@ -4985,6 +4991,7 @@ var Pr = e.object({
 			name: e.string(),
 			strategy: e.string().optional(),
 			display_name: e.string().optional(),
+			short_name: e.string().optional(),
 			icon_url: e.string().optional(),
 			href: e.string().optional(),
 			last_used: e.boolean().optional(),
@@ -5320,7 +5327,7 @@ var Hi = e.object({
 		"HS256",
 		"HS384",
 		"HS512"
-	]),
+	]).optional(),
 	kid: e.string().optional(),
 	kty: e.enum([
 		"RSA",
@@ -5334,6 +5341,7 @@ var Hi = e.object({
 	x: e.string().optional(),
 	y: e.string().optional(),
 	x5t: e.string().optional(),
+	"x5t#S256": e.string().optional(),
 	x5c: e.array(e.string()).optional()
 }).superRefine((t, n) => {
 	if (t.kty === "RSA") for (let r of ["n", "e"]) t[r] || n.addIssue({
@@ -5350,8 +5358,8 @@ var Hi = e.object({
 		path: [r],
 		message: `EC JWK is missing required member '${r}'`
 	});
-});
-e.object({ keys: e.array(Hi) }), e.object({
+}), Ui = e.object({ keys: e.array(Hi) });
+e.object({
 	issuer: e.string(),
 	authorization_endpoint: e.string(),
 	token_endpoint: e.string(),
@@ -5378,9 +5386,9 @@ e.object({ keys: e.array(Hi) }), e.object({
 	backchannel_logout_supported: e.boolean().optional(),
 	backchannel_logout_session_supported: e.boolean().optional()
 });
-var Ui = /* @__PURE__ */ function(e) {
+var Wi = /* @__PURE__ */ function(e) {
 	return e.PENDING = "pending", e.AUTHENTICATED = "authenticated", e.AWAITING_EMAIL_VERIFICATION = "awaiting_email_verification", e.AWAITING_MFA = "awaiting_mfa", e.AWAITING_HOOK = "awaiting_hook", e.AWAITING_CONTINUATION = "awaiting_continuation", e.AWAITING_CONSENT = "awaiting_consent", e.COMPLETED = "completed", e.FAILED = "failed", e.EXPIRED = "expired", e;
-}({}), Wi = e.nativeEnum(Ui), Gi = e.object({
+}({}), Gi = e.nativeEnum(Wi), Ki = e.object({
 	strategy: e.string(),
 	strategy_type: e.string()
 });
@@ -5394,12 +5402,12 @@ e.object({
 	useragent: e.string().optional(),
 	session_id: e.string().optional(),
 	authorization_url: e.string().optional(),
-	state: Wi.optional().default("pending"),
+	state: Gi.optional().default("pending"),
 	state_data: e.string().optional(),
 	failure_reason: e.string().optional(),
 	user_id: e.string().optional(),
 	auth_connection: e.string().optional(),
-	auth_strategy: Gi.optional(),
+	auth_strategy: Ki.optional(),
 	authenticated_at: e.string().optional()
 }).openapi({ description: "This represents a login sesion" }).extend({
 	id: e.string().openapi({ description: "This is is used as the state in the universal login" }),
@@ -5566,17 +5574,17 @@ var Q = {
 	WARNING_DURING_LOGIN: "w",
 	WARNING_SENDING_NOTIFICATION: "wn",
 	WARNING_USER_MANAGEMENT: "wum"
-}, Ki = e.string().refine((e) => Object.values(Q).includes(e), { message: "Invalid log type" });
+}, qi = e.string().refine((e) => Object.values(Q).includes(e), { message: "Invalid log type" });
 Q.ACLS_SUMMARY, Q.ACTIONS_EXECUTION_FAILED, Q.API_LIMIT, Q.API_LIMIT_WARNING, Q.APPI, Q.CIBA_EXCHANGE_FAILED, Q.CIBA_EXCHANGE_SUCCEEDED, Q.CIBA_START_FAILED, Q.CIBA_START_SUCCEEDED, Q.CODE_LINK_SENT, Q.CODE_SENT, Q.DEPRECATION_NOTICE, Q.FAILED_LOGIN, Q.FAILED_BY_CONNECTOR, Q.FAILED_CHANGE_EMAIL, Q.FAILED_BY_CORS, Q.FAILED_CROSS_ORIGIN_AUTHENTICATION, Q.FAILED_CHANGE_PASSWORD, Q.FAILED_POST_CHANGE_PASSWORD_HOOK, Q.FAILED_CHANGE_PHONE_NUMBER, Q.FAILED_CHANGE_PASSWORD_REQUEST, Q.FAILED_CONNECTOR_PROVISIONING, Q.FAILED_CHANGE_USERNAME, Q.FAILED_DELEGATION, Q.FAILED_DEVICE_ACTIVATION, Q.FAILED_DEVICE_AUTHORIZATION_REQUEST, Q.USER_CANCELED_DEVICE_CONFIRMATION, Q.FAILED_USER_DELETION, Q.FAILED_EXCHANGE_AUTHORIZATION_CODE_FOR_ACCESS_TOKEN, Q.FAILED_EXCHANGE_ACCESS_TOKEN_FOR_CLIENT_CREDENTIALS, Q.FAILED_EXCHANGE_CUSTOM_TOKEN, Q.FAILED_EXCHANGE_DEVICE_CODE_FOR_ACCESS_TOKEN, Q.FAILED_FEDERATED_LOGOUT, Q.FAILED_EXCHANGE_NATIVE_SOCIAL_LOGIN, Q.FAILED_EXCHANGE_PASSWORD_OOB_FOR_ACCESS_TOKEN, Q.FAILED_EXCHANGE_PASSWORD_OTP_FOR_ACCESS_TOKEN, Q.FAILED_EXCHANGE_PASSWORD_FOR_ACCESS_TOKEN, Q.FAILED_EXCHANGE_PASSWORDLESS_OTP_FOR_ACCESS_TOKEN, Q.FAILED_EXCHANGE_PASSWORD_MFA_RECOVERY_FOR_ACCESS_TOKEN, Q.FAILED_EXCHANGE_ROTATING_REFRESH_TOKEN, Q.FAILED_EXCHANGE_REFRESH_TOKEN_FOR_ACCESS_TOKEN, Q.FAILED_EXCHANGE_SUBJECT_TOKEN_FOR_ACCESS_TOKEN, Q.FAILED_HOOK, Q.FAILED_IMPERSONATION, Q.FAILED_INVITE_ACCEPT, Q.FAILED_LOGOUT, Q.FLOWS_EXECUTION_COMPLETED, Q.FLOWS_EXECUTION_FAILED, Q.FAILED_SENDING_NOTIFICATION, Q.FORMS_SUBMISSION_FAILED, Q.FORMS_SUBMISSION_SUCCEEDED, Q.FAILED_LOGIN_INCORRECT_PASSWORD, Q.FAILED_PUSHED_AUTHORIZATION_REQUEST, Q.FAILED_POST_USER_REGISTRATION_HOOK, Q.FAILED_SIGNUP, Q.FAILED_SILENT_AUTH, Q.FAILED_LOGIN_INVALID_EMAIL_USERNAME, Q.FAILED_USERS_IMPORT, Q.FAILED_VERIFICATION_EMAIL, Q.FAILED_VERIFICATION_EMAIL_REQUEST, Q.EMAIL_VERIFICATION_CONFIRMED, Q.EMAIL_VERIFICATION_FAILED, Q.MFA_AUTH_FAILED, Q.MFA_AUTH_REJECTED, Q.MFA_AUTH_SUCCESS, Q.MFA_ENROLLMENT_COMPLETE, Q.TOO_MANY_MFA_FAILURES, Q.MFA_RECOVERY_FAILED, Q.MFA_RECOVERY_RATE_LIMIT_EXCEED, Q.MFA_RECOVERY_SUCCESS, Q.MFA_EMAIL_SENT, Q.EMAIL_VERIFICATION_SENT, Q.EMAIL_VERIFICATION_SEND_FAILURE, Q.PUSH_NOTIFICATION_SENT, Q.ERROR_SENDING_MFA_PUSH_NOTIFICATION, Q.MFA_SMS_SENT, Q.ERROR_SENDING_MFA_SMS, Q.MFA_VOICE_CALL_SUCCESS, Q.MFA_VOICE_CALL_FAILED, Q.SECOND_FACTOR_STARTED, Q.MFA_ENROLL_STARTED, Q.MFA_ENROLLMENT_FAILED, Q.GUARDIAN_TENANT_UPDATE, Q.UNENROLL_DEVICE_ACCOUNT, Q.UPDATE_DEVICE_ACCOUNT, Q.WEBAUTHN_CHALLENGE_FAILED, Q.WEBAUTHN_ENROLLMENT_FAILED, Q.FAILED_KMS_API_OPERATION, Q.SUCCESS_KMS_API_OPERATION, Q.KMS_KEY_STATE_CHANGED, Q.TOO_MANY_CALLS_TO_DELEGATION, Q.BLOCKED_IP_ADDRESS, Q.BLOCKED_ACCOUNT_IP, Q.BLOCKED_ACCOUNT_EMAIL, Q.INFORMATION, Q.MFA_REQUIRED, Q.MANAGEMENT_API_READ_OPERATION, Q.FAILED_AUTHENTICATION_METHOD_OPERATION_MY_ACCOUNT, Q.SUCCESSFUL_AUTHENTICATION_METHOD_OPERATION_MY_ACCOUNT, Q.FAILED_OIDC_BACKCHANNEL_LOGOUT, Q.SUCCESSFUL_OIDC_BACKCHANNEL_LOGOUT, Q.ORGANIZATION_MEMBER_ADDED, Q.PASSKEY_CHALLENGE_FAILED, Q.PASSKEY_CHALLENGE_STARTED, Q.PRE_LOGIN_ASSESSMENT, Q.BREACHED_PASSWORD, Q.BREACHED_PASSWORD_ON_RESET, Q.SUCCESS_RESOURCE_CLEANUP, Q.RICH_CONSENTS_ACCESS_ERROR, Q.SUCCESS_LOGIN, Q.SUCCESS_API_OPERATION, Q.FAILED_API_OPERATION, Q.SUCCESS_CHANGE_EMAIL, Q.SUCCESS_CROSS_ORIGIN_AUTHENTICATION, Q.SUCCESS_CHANGE_PASSWORD, Q.SUCCESS_CHANGE_PHONE_NUMBER, Q.SUCCESS_CHANGE_PASSWORD_REQUEST, Q.SUCCESS_CHANGE_USERNAME, Q.SUCCESS_CREDENTIAL_VALIDATION, Q.SUCCESS_DELEGATION, Q.SUCCESS_USER_DELETION, Q.SUCCESS_EXCHANGE_AUTHORIZATION_CODE_FOR_ACCESS_TOKEN, Q.SUCCESS_EXCHANGE_ACCESS_TOKEN_FOR_CLIENT_CREDENTIALS, Q.SUCCESS_EXCHANGE_CUSTOM_TOKEN, Q.SUCCESS_EXCHANGE_DEVICE_CODE_FOR_ACCESS_TOKEN, Q.SUCCESS_EXCHANGE_NATIVE_SOCIAL_LOGIN, Q.SUCCESS_EXCHANGE_PASSWORD_OOB_FOR_ACCESS_TOKEN, Q.SUCCESS_EXCHANGE_PASSWORD_OTP_FOR_ACCESS_TOKEN, Q.SUCCESS_EXCHANGE_PASSWORDLESS_OTP_FOR_ACCESS_TOKEN, Q.SUCCESS_EXCHANGE_PASSWORD_FOR_ACCESS_TOKEN, Q.SUCCESS_EXCHANGE_PASSKEY_OOB_FOR_ACCESS_TOKEN, Q.SUCCESS_EXCHANGE_PASSKEY_OTP_FOR_ACCESS_TOKEN, Q.SUCCESS_EXCHANGE_PASSKEY_MFA_RECOVERY_FOR_ACCESS_TOKEN, Q.SUCCESS_EXCHANGE_PASSWORD_MFA_RECOVERY_FOR_ACCESS_TOKEN, Q.SUCCESS_EXCHANGE_REFRESH_TOKEN_FOR_ACCESS_TOKEN, Q.SUCCESS_EXCHANGE_SUBJECT_TOKEN_FOR_ACCESS_TOKEN, Q.SUCCESS_IMPERSONATION, Q.SUCCESSFULLY_ACCEPTED_USER_INVITE, Q.BREACHED_PASSWORD_ON_SIGNUP, Q.SUCCESS_LOGOUT, Q.SUCCESS_HOOK, Q.SUCCESS_PASSWORD_MIGRATION, Q.SUCCESS_REVOCATION, Q.SUCCESS_SIGNUP, Q.FAILED_SS_SSO_OPERATION, Q.INFORMATION_FROM_SS_SSO_OPERATION, Q.SUCCESS_SS_SSO_OPERATION, Q.SUCCESS_SILENT_AUTH, Q.SUCCESSFUL_SCIM_OPERATION, Q.SUCCESSFULLY_IMPORTED_USERS, Q.SUCCESS_VERIFICATION_EMAIL, Q.SUCCESS_VERIFICATION_EMAIL_REQUEST, Q.MAX_AMOUNT_OF_AUTHENTICATORS, Q.USER_LOGIN_BLOCK_RELEASED, Q.FAILED_UNIVERSAL_LOGOUT, Q.SUCCESSFUL_UNIVERSAL_LOGOUT, Q.WARNING_DURING_LOGIN, Q.WARNING_SENDING_NOTIFICATION, Q.WARNING_USER_MANAGEMENT, (() => {
 	let e = {};
 	for (let [t, n] of Object.entries(Q)) t.startsWith("SUCCESS_") || t.startsWith("SUCCESSFUL_") || t.startsWith("SUCCESSFULLY_") || t.endsWith("_SUCCEEDED") || t.endsWith("_COMPLETED") ? e[n] = "success" : t.startsWith("FAILED_") || t.startsWith("ERROR_") || t.startsWith("BREACHED_") || t.startsWith("BLOCKED_") || t === "MFA_AUTH_FAILED" || t === "MFA_AUTH_REJECTED" || t === "MFA_RECOVERY_FAILED" || t === "MFA_ENROLLMENT_FAILED" || t === "EMAIL_VERIFICATION_FAILED" || t === "WEBAUTHN_CHALLENGE_FAILED" || t === "WEBAUTHN_ENROLLMENT_FAILED" || t === "PASSKEY_CHALLENGE_FAILED" || t === "FLOWS_EXECUTION_FAILED" || t === "FORMS_SUBMISSION_FAILED" || t === "CIBA_EXCHANGE_FAILED" || t === "CIBA_START_FAILED" || t === "ACTIONS_EXECUTION_FAILED" || t === "RICH_CONSENTS_ACCESS_ERROR" || t === "USER_CANCELED_DEVICE_CONFIRMATION" || t === "TOO_MANY_MFA_FAILURES" || t === "MFA_RECOVERY_RATE_LIMIT_EXCEED" || t === "API_LIMIT" || t === "MAX_AMOUNT_OF_AUTHENTICATORS" ? e[n] = "failure" : t.startsWith("WARNING_") || t === "API_LIMIT_WARNING" || t === "DEPRECATION_NOTICE" || t === "PRE_LOGIN_ASSESSMENT" ? e[n] = "warning" : t === "CODE_SENT" || t === "CODE_LINK_SENT" || t === "MFA_EMAIL_SENT" || t === "MFA_SMS_SENT" || t === "EMAIL_VERIFICATION_SENT" || t === "PUSH_NOTIFICATION_SENT" ? e[n] = "code_sent" : t === "INFORMATION" || t === "INFORMATION_FROM_SS_SSO_OPERATION" || t === "MANAGEMENT_API_READ_OPERATION" || t === "APPI" || t === "ACLS_SUMMARY" || t === "ORGANIZATION_MEMBER_ADDED" ? e[n] = "info" : e[n] = "other";
 	return e;
 })();
-var qi = e.object({
+var Ji = e.object({
 	name: e.string(),
 	version: e.string(),
 	env: e.object({ node: e.string().optional() }).optional()
-}), Ji = e.object({
+}), Yi = e.object({
 	country_code: e.string().length(2),
 	city_name: e.string(),
 	latitude: e.string(),
@@ -5585,7 +5593,7 @@ var qi = e.object({
 	continent_code: e.string()
 });
 e.object({
-	type: Ki,
+	type: qi,
 	date: e.string(),
 	description: e.string().optional(),
 	ip: e.string().optional(),
@@ -5603,63 +5611,63 @@ e.object({
 	strategy: e.string().optional(),
 	strategy_type: e.string().optional(),
 	hostname: e.string().optional(),
-	auth0_client: qi.optional(),
+	auth0_client: Ji.optional(),
 	log_id: e.string().optional(),
-	location_info: Ji.optional()
+	location_info: Yi.optional()
 }).extend({ log_id: e.string() });
-var Yi = e.enum([
+var Xi = e.enum([
 	"http",
 	"eventbridge",
 	"eventgrid",
 	"splunk",
 	"datadog",
 	"sumo"
-]), Xi = e.enum([
+]), Zi = e.enum([
 	"active",
 	"paused",
 	"suspended"
-]), Zi = e.object({
+]), Qi = e.object({
 	type: e.string(),
 	name: e.string()
 });
 e.object({
 	name: e.string(),
-	type: Yi,
-	status: Xi.optional(),
+	type: Xi,
+	status: Zi.optional(),
 	sink: e.record(e.string(), e.unknown()),
-	filters: e.array(Zi).optional(),
+	filters: e.array(Qi).optional(),
 	isPriority: e.boolean().optional()
 }).extend({
 	id: e.string(),
-	status: Xi,
+	status: Zi,
 	created_at: e.string().optional(),
 	updated_at: e.string().optional()
 });
-var Qi = e.enum([
+var $i = e.enum([
 	"auth0",
 	"cognito",
 	"okta",
 	"oidc"
-]), $i = e.object({
+]), ea = e.object({
 	domain: e.string(),
 	client_id: e.string(),
 	client_secret: e.string(),
 	audience: e.string().optional(),
 	scope: e.string().optional()
-}), ea = e.object({
+}), ta = e.object({
 	id: e.string().optional(),
 	name: e.string(),
-	provider: Qi,
+	provider: $i,
 	connection: e.string(),
 	enabled: e.boolean().default(!0),
-	credentials: $i
+	credentials: ea
 });
 e.object({
 	id: e.string(),
 	created_at: e.string(),
 	updated_at: e.string()
-}).extend(ea.shape);
-var ta = e.object({
+}).extend(ta.shape);
+var na = e.object({
 	enabled: e.boolean().optional(),
 	shields: e.array(e.string()).optional(),
 	admin_notification_frequency: e.array(e.string()).optional(),
@@ -5668,13 +5676,13 @@ var ta = e.object({
 		"pre-user-registration": e.object({ shields: e.array(e.string()).optional() }).optional(),
 		"pre-change-password": e.object({ shields: e.array(e.string()).optional() }).optional()
 	}).optional()
-}), na = e.object({
+}), ra = e.object({
 	enabled: e.boolean().optional(),
 	shields: e.array(e.string()).optional(),
 	allowlist: e.array(e.string()).optional(),
 	mode: e.string().optional(),
 	max_attempts: e.number().optional()
-}), ra = e.object({
+}), ia = e.object({
 	enabled: e.boolean().optional(),
 	shields: e.array(e.string()).optional(),
 	allowlist: e.array(e.string()).optional(),
@@ -5688,10 +5696,10 @@ var ta = e.object({
 			rate: e.number().optional()
 		}).optional()
 	}).optional()
-}), ia = e.object({
-	breached_password_detection: ta.optional(),
-	brute_force_protection: na.optional(),
-	suspicious_ip_throttling: ra.optional()
+}), aa = e.object({
+	breached_password_detection: na.optional(),
+	brute_force_protection: ra.optional(),
+	suspicious_ip_throttling: ia.optional()
 });
 e.object({
 	id: e.string().optional(),
@@ -5704,14 +5712,14 @@ e.object({
 	created_at: e.string(),
 	updated_at: e.string()
 });
-var aa = e.object({
+var oa = e.object({
 	initial_user_agent: e.string().describe("First user agent of the device from which this user logged in"),
 	initial_ip: e.string().describe("First IP address associated with this session"),
 	initial_asn: e.string().describe("First autonomous system number associated with this session"),
 	last_user_agent: e.string().describe("Last user agent of the device from which this user logged in"),
 	last_ip: e.string().describe("Last IP address from which this user logged in"),
 	last_asn: e.string().describe("Last autonomous system number from which this user logged in")
-}), oa = e.object({
+}), sa = e.object({
 	id: e.string(),
 	revoked_at: e.string().optional(),
 	used_at: e.string().optional(),
@@ -5719,7 +5727,7 @@ var aa = e.object({
 	expires_at: e.string().optional(),
 	login_session_id: e.string(),
 	idle_expires_at: e.string().optional(),
-	device: aa.describe("Metadata related to the device used in the session"),
+	device: oa.describe("Metadata related to the device used in the session"),
 	clients: e.array(e.string()).describe("List of client details for the session")
 });
 e.object({
@@ -5727,7 +5735,7 @@ e.object({
 	updated_at: e.string(),
 	authenticated_at: e.string(),
 	last_interaction_at: e.string()
-}).extend(oa.shape), e.object({
+}).extend(sa.shape), e.object({
 	kid: e.string().openapi({ description: "The key id of the signing key" }),
 	tenant_id: e.string().optional().openapi({ description: "The tenant the key belongs to. Omitted means the key is shared / control-plane scoped." }),
 	cert: e.string().openapi({ description: "The public certificate of the signing key" }),
@@ -5744,7 +5752,7 @@ e.object({
 	connection: e.string().optional().openapi({ description: "The connection identifier associated with the key" }),
 	type: e.enum(["jwt_signing", "saml_encryption"]).openapi({ description: "The type of the signing key" })
 });
-var sa = e.object({
+var ca = e.object({
 	id: e.string().optional(),
 	audience: e.string().optional(),
 	friendly_name: e.string(),
@@ -5862,7 +5870,7 @@ var sa = e.object({
 		"shared_planetscale"
 	]).optional(),
 	d1_database_id: e.string().max(64).optional(),
-	attack_protection: ia.optional(),
+	attack_protection: aa.optional(),
 	mfa: e.object({
 		policy: e.enum(["never", "always"]).default("never").optional(),
 		factors: e.object({
@@ -5893,29 +5901,29 @@ var sa = e.object({
 e.object({
 	created_at: e.string().nullable().transform((e) => e ?? ""),
 	updated_at: e.string().nullable().transform((e) => e ?? "")
-}).extend(sa.shape).extend({
+}).extend(ca.shape).extend({
 	id: e.string(),
 	is_control_plane: e.boolean().optional()
 });
-var ca = e.enum([
+var la = e.enum([
 	"provision",
 	"seed",
 	"upgrade",
 	"backup",
 	"deprovision",
 	"users_import"
-]), la = e.enum([
+]), ua = e.enum([
 	"pending",
 	"running",
 	"succeeded",
 	"failed",
 	"cancelled"
-]), ua = e.string().max(64);
+]), da = e.string().max(64);
 e.object({
 	tenant_id: e.string().max(255).nullable().default(null),
 	rollout_id: e.string().max(255).nullable().optional(),
-	kind: ca,
-	engine: ua,
+	kind: la,
+	engine: da,
 	engine_instance_id: e.string().max(100).nullable().optional(),
 	target_worker_version: e.string().max(255).nullable().optional(),
 	target_database_version: e.string().max(255).nullable().optional(),
@@ -5923,7 +5931,7 @@ e.object({
 	input: e.record(e.string(), e.unknown()).nullable().optional()
 }).extend({
 	id: e.string(),
-	status: la,
+	status: ua,
 	current_step: e.string().max(255).nullable().optional(),
 	error: e.string().nullable().optional(),
 	result: e.record(e.string(), e.unknown()).nullable().optional(),
@@ -5944,7 +5952,7 @@ e.object({
 	claim_expires_at: !0,
 	finished_at: !0
 }).partial();
-var da = e.enum([
+var fa = e.enum([
 	"started",
 	"succeeded",
 	"failed",
@@ -5955,14 +5963,14 @@ var da = e.enum([
 e.object({
 	operation_id: e.string().max(255),
 	step: e.string().max(255),
-	outcome: da,
+	outcome: fa,
 	detail: e.record(e.string(), e.unknown()).nullable().optional(),
 	attempt: e.number().int().min(1).default(1)
 }).extend({
 	id: e.string(),
 	created_at: e.string()
 });
-var fa = e.enum([
+var pa = e.enum([
 	"pending",
 	"inserted",
 	"updated",
@@ -5973,28 +5981,28 @@ e.object({
 	operation_id: e.string().max(255),
 	seq: e.number().int().min(0),
 	payload: e.record(e.string(), e.unknown()),
-	status: fa.default("pending"),
+	status: pa.default("pending"),
 	error_code: e.string().max(64).nullable().optional(),
 	error_message: e.string().nullable().optional(),
 	error_path: e.string().max(255).nullable().optional(),
 	entity_id: e.string().max(255).nullable().optional()
 }).extend({
-	status: fa,
+	status: pa,
 	created_at: e.string(),
 	updated_at: e.string()
 }), e.object({
 	seq: e.number().int().min(0),
-	status: fa,
+	status: pa,
 	error_code: e.string().max(64).nullable().optional(),
 	error_message: e.string().nullable().optional(),
 	error_path: e.string().max(255).nullable().optional(),
 	entity_id: e.string().max(255).nullable().optional()
 });
-var pa = e.enum([
+var ma = e.enum([
 	"upgrade",
 	"reseed",
 	"backup"
-]), ma = e.enum([
+]), ha = e.enum([
 	"pending",
 	"canary",
 	"rolling",
@@ -6003,7 +6011,7 @@ var pa = e.enum([
 	"failed"
 ]);
 e.object({
-	kind: pa,
+	kind: ma,
 	target_worker_version: e.string().max(255).nullable().optional(),
 	target_database_version: e.string().max(255).nullable().optional(),
 	wave_size: e.number().int().min(1).default(10),
@@ -6012,7 +6020,7 @@ e.object({
 	initiated_by: e.string().max(255).nullable().optional()
 }).extend({
 	id: e.string(),
-	status: ma,
+	status: ha,
 	created_at: e.string(),
 	updated_at: e.string(),
 	finished_at: e.string().nullable().optional()
@@ -6034,7 +6042,7 @@ e.object({
 	code: e.string(),
 	state: e.string().optional()
 });
-var ha = e.object({
+var ga = e.object({
 	button_border_radius: e.number(),
 	button_border_weight: e.number(),
 	buttons_style: e.enum([
@@ -6052,7 +6060,7 @@ var ha = e.object({
 	show_widget_shadow: e.boolean(),
 	widget_border_weight: e.number(),
 	widget_corner_radius: e.number()
-}), ga = e.object({
+}), _a = e.object({
 	base_focus_color: e.string(),
 	base_hover_color: e.string(),
 	body_text: e.string(),
@@ -6079,7 +6087,7 @@ var ha = e.object({
 }), $ = e.object({
 	bold: e.boolean(),
 	size: e.number()
-}), _a = e.object({
+}), va = e.object({
 	body_text: $,
 	buttons_text: $,
 	font_url: e.string(),
@@ -6089,7 +6097,7 @@ var ha = e.object({
 	reference_text_size: e.number(),
 	subtitle: $,
 	title: $
-}), va = e.object({
+}), ya = e.object({
 	background_color: e.string(),
 	background_image_url: e.string(),
 	page_layout: e.enum([
@@ -6102,7 +6110,7 @@ var ha = e.object({
 		"chip",
 		"none"
 	]).optional()
-}), ya = e.object({
+}), ba = e.object({
 	header_text_alignment: e.enum([
 		"center",
 		"left",
@@ -6119,12 +6127,12 @@ var ha = e.object({
 	social_buttons_layout: e.enum(["bottom", "top"])
 });
 e.object({
-	borders: ha,
-	colors: ga,
+	borders: ga,
+	colors: _a,
 	displayName: e.string(),
-	fonts: _a,
-	page_background: va,
-	widget: ya
+	fonts: va,
+	page_background: ya,
+	widget: ba
 }).extend({ themeId: e.string() }), e.object({
 	universal_login_experience: e.enum(["new", "classic"]).default("new"),
 	identifier_first: e.boolean().default(!0),
@@ -6132,44 +6140,89 @@ e.object({
 	show_last_used_connection: e.boolean().default(!1),
 	webauthn_platform_first_factor: e.boolean()
 });
-var ba = e.object({
+var xa = e.object({
 	hosts: e.array(e.string()).optional(),
 	methods: e.array(e.string()).optional(),
 	path: e.string().default("/*"),
 	headers: e.record(e.string(), e.string()).optional(),
 	query: e.record(e.string(), e.string()).optional()
-}), xa = e.object({
+}), Sa = e.object({
 	type: e.string(),
 	options: e.record(e.string(), e.unknown()).default({})
-}), Sa = e.object({
+}), Ca = e.object({
 	id: e.string().optional(),
 	custom_domain_id: e.string(),
 	priority: e.number().int().default(100),
-	match: ba,
-	handlers: e.array(xa).min(1)
+	match: xa,
+	handlers: e.array(Sa).min(1)
 });
-Sa.extend({
+Ca.extend({
 	id: e.string(),
 	tenant_id: e.string(),
 	created_at: e.string(),
 	updated_at: e.string()
-}), Sa.partial().omit({
+}), Ca.partial().omit({
 	id: !0,
 	custom_domain_id: !0
 });
-var Ca = e.object({
+var wa = "custom_authentication", Ta = [
+	"urn:ietf:params:oauth:",
+	"urn:auth0",
+	"urn:okta",
+	"http://auth0.com",
+	"https://auth0.com",
+	"http://okta.com",
+	"https://okta.com"
+], Ea = e.string().min(1).max(200).refine((e) => e.startsWith("https://") || e.startsWith("urn:"), { message: "subject_token_type must be a URI starting with https:// or urn:" }).refine((e) => !Ta.some((t) => e.toLowerCase().startsWith(t)), { message: "subject_token_type uses a reserved namespace" }), Da = e.enum([
+	"RS256",
+	"RS384",
+	"RS512",
+	"ES256",
+	"ES384",
+	"ES512"
+]), Oa = e.discriminatedUnion("type", [e.object({
+	type: e.literal("connection"),
+	connection: e.string().min(1),
+	create_if_not_exists: e.boolean().default(!0),
+	trust_email_verified: e.boolean().default(!1)
+}), e.object({ type: e.literal("user_id") })]), ka = e.object({
+	issuer: e.string().min(1).max(2048),
+	jwks: Ui.optional(),
+	jwks_uri: e.string().url().optional(),
+	audience: e.array(e.string().min(1)).min(1).optional(),
+	algorithms: e.array(Da).min(1).optional(),
+	max_lifetime_seconds: e.number().int().min(1).max(3600).default(300),
+	require_jti: e.boolean().default(!0),
+	user_mapping: Oa
+});
+e.object({
+	name: e.string().min(1).max(255),
+	subject_token_type: Ea,
+	action_id: e.string().min(1).optional(),
+	type: e.literal(wa),
+	jwt_verification: ka.optional()
+}).extend({
+	id: e.string(),
+	created_at: e.string(),
+	updated_at: e.string()
+}), e.object({
+	name: e.string().min(1).max(255).optional(),
+	subject_token_type: Ea.optional(),
+	jwt_verification: ka.optional()
+});
+var Aa = e.object({
 	scim: e.string(),
 	auth0: e.string()
-}), wa = e.object({
+}), ja = e.object({
 	connection_id: e.string(),
 	user_id_attribute: e.string().default("externalId"),
-	mapping: e.array(Ca).default([])
+	mapping: e.array(Aa).default([])
 });
 e.object({
 	created_at: e.string(),
 	updated_at: e.string()
-}).extend(wa.shape);
-var Ta = e.object({
+}).extend(ja.shape);
+var Ma = e.object({
 	token_id: e.string(),
 	connection_id: e.string(),
 	token_hash: e.string(),
@@ -6179,20 +6232,20 @@ var Ta = e.object({
 e.object({
 	created_at: e.string(),
 	last_used_at: e.string().optional()
-}).extend(Ta.shape);
-var Ea = e.object({
+}).extend(Ma.shape);
+var Na = e.object({
 	connection_id: e.string(),
 	external_id: e.string(),
 	user_id: e.string()
 });
-e.object({ created_at: e.string() }).extend(Ea.shape), e.object({
+e.object({ created_at: e.string() }).extend(Na.shape), e.object({
 	name: e.string(),
 	enabled: e.boolean().optional().default(!0),
 	default_from_address: e.string().optional(),
 	credentials: e.record(e.string(), e.unknown()),
 	settings: e.object({}).optional()
 });
-var Da = e.enum([
+var Pa = e.enum([
 	"verify_email",
 	"verify_email_by_code",
 	"reset_email",
@@ -6207,7 +6260,7 @@ var Da = e.enum([
 	"user_invitation"
 ]);
 e.object({
-	template: Da,
+	template: Pa,
 	body: e.string(),
 	from: e.string(),
 	subject: e.string(),
@@ -6222,13 +6275,13 @@ e.object({
 	session_id: e.string().optional(),
 	organization: e.string().optional(),
 	auth_connection: e.string().optional(),
-	auth_strategy: Gi.optional(),
+	auth_strategy: Ki.optional(),
 	user_id: e.string(),
 	client_id: e.string(),
 	expires_at: e.string().optional(),
 	idle_expires_at: e.string().optional(),
 	last_exchanged_at: e.string().optional(),
-	device: aa,
+	device: oa,
 	resource_servers: e.array(e.object({
 		audience: e.string(),
 		scopes: e.string()
@@ -6249,10 +6302,10 @@ e.object({
 	name: e.string(),
 	options: e.object({})
 });
-var Oa = e.object({
+var Fa = e.object({
 	value: e.string(),
 	description: e.string().optional()
-}), ka = e.object({
+}), Ia = e.object({
 	token_dialect: e.enum(["access_token", "access_token_authz"]).optional(),
 	enforce_policies: e.boolean().optional(),
 	allow_skipping_userinfo: e.boolean().optional(),
@@ -6260,11 +6313,11 @@ var Oa = e.object({
 	persist_client_authorization: e.boolean().optional(),
 	enable_introspection_endpoint: e.boolean().optional(),
 	mtls: e.object({ bound_access_tokens: e.boolean().optional() }).optional()
-}), Aa = e.object({
+}), La = e.object({
 	id: e.string().optional(),
 	name: e.string(),
 	identifier: e.string(),
-	scopes: e.array(Oa).optional(),
+	scopes: e.array(Fa).optional(),
 	signing_alg: e.string().optional(),
 	signing_secret: e.string().optional(),
 	token_lifetime: e.number().default(86400),
@@ -6272,20 +6325,20 @@ var Oa = e.object({
 	skip_consent_for_verifiable_first_party_clients: e.boolean().optional(),
 	allow_offline_access: e.boolean().optional(),
 	verificationKey: e.string().optional(),
-	options: ka.optional(),
+	options: Ia.optional(),
 	is_system: e.boolean().optional(),
 	metadata: e.record(e.string(), e.any()).optional()
 }).extend({
 	created_at: e.string().optional(),
 	updated_at: e.string().optional()
 });
-e.array(Aa);
-var ja = e.object({
+e.array(La);
+var Ra = e.object({
 	role_id: e.string(),
 	resource_server_identifier: e.string(),
 	permission_name: e.string()
 }).extend({ created_at: e.string() });
-e.array(ja), e.object({
+e.array(Ra), e.object({
 	user_id: e.string().openapi({ description: "The id of the user that granted the consent" }),
 	clientID: e.string().openapi({ description: "The id of the client the grant was issued to" }),
 	audience: e.string().optional().openapi({ description: "The audience the grant applies to" }),
@@ -6298,7 +6351,7 @@ e.array(ja), e.object({
 	failed_logins: e.array(e.string()).optional(),
 	last_password_reset: e.string().optional()
 });
-var Ma = e.object({
+var za = e.object({
 	user_id: e.string(),
 	resource_server_identifier: e.string(),
 	permission_name: e.string(),
@@ -6307,8 +6360,8 @@ var Ma = e.object({
 	tenant_id: e.string(),
 	created_at: e.string().optional()
 });
-e.array(Ma);
-var Na = e.object({
+e.array(za);
+var Ba = e.object({
 	user_id: e.string(),
 	resource_server_identifier: e.string(),
 	resource_server_name: e.string(),
@@ -6317,8 +6370,8 @@ var Na = e.object({
 	created_at: e.string().optional(),
 	organization_id: e.string().optional()
 });
-e.array(Na);
-var Pa = e.object({
+e.array(Ba);
+var Va = e.object({
 	user_id: e.string(),
 	role_id: e.string(),
 	organization_id: e.string().optional()
@@ -6326,8 +6379,8 @@ var Pa = e.object({
 	tenant_id: e.string(),
 	created_at: e.string().optional()
 });
-e.array(Pa);
-var Fa = e.object({
+e.array(Va);
+var Ha = e.object({
 	id: e.string().optional().openapi({ description: "The unique identifier of the role. If not provided, one will be generated." }),
 	name: e.string().min(1).max(50).openapi({ description: "The name of the role. Cannot include '<' or '>'" }),
 	description: e.string().max(255).optional().openapi({ description: "The description of the role" }),
@@ -6338,19 +6391,19 @@ var Fa = e.object({
 	created_at: e.string().optional(),
 	updated_at: e.string().optional()
 });
-e.array(Fa);
-var Ia = e.object({
+e.array(Ha);
+var Ua = e.object({
 	logo_url: e.string().optional().openapi({ description: "URL of the organization's logo" }),
 	colors: e.object({
 		primary: e.string().optional().openapi({ description: "Primary color in hex format (e.g., #FF0000)" }),
 		page_background: e.string().optional().openapi({ description: "Page background color in hex format (e.g., #FFFFFF)" })
 	}).optional()
-}).optional(), La = e.object({
+}).optional(), Wa = e.object({
 	connection_id: e.string().openapi({ description: "ID of the connection" }),
 	assign_membership_on_login: e.boolean().default(!1).openapi({ description: "Whether to assign membership to the organization on login" }),
 	show_as_button: e.boolean().default(!0).openapi({ description: "Whether to show this connection as a button in the login screen" }),
 	is_signup_enabled: e.boolean().default(!0).openapi({ description: "Whether signup is enabled for this connection" })
-}), Ra = e.object({ client_credentials: e.object({
+}), Ga = e.object({ client_credentials: e.object({
 	enforce: e.boolean().default(!1).openapi({ description: "Whether to enforce token quota limits" }),
 	per_day: e.number().min(0).default(0).openapi({ description: "Maximum tokens per day (0 = unlimited)" }),
 	per_hour: e.number().min(0).default(0).openapi({ description: "Maximum tokens per hour (0 = unlimited)" })
@@ -6359,15 +6412,15 @@ e.object({
 	id: e.string().optional(),
 	name: e.string().min(1).regex(/^[a-z0-9_-]+$/, { message: "Organization name must be lowercase and can only contain letters, numbers, hyphens, and underscores" }).openapi({ description: "The name of the organization. Must be lowercase and can only contain letters, numbers, hyphens, and underscores." }),
 	display_name: e.string().optional().openapi({ description: "The display name of the organization" }),
-	branding: Ia,
+	branding: Ua,
 	metadata: e.record(e.string(), e.any()).default({}).optional().openapi({ description: "Custom metadata for the organization" }),
-	enabled_connections: e.array(La).default([]).optional().openapi({ description: "List of enabled connections for the organization" }),
-	token_quota: Ra
+	enabled_connections: e.array(Wa).default([]).optional().openapi({ description: "List of enabled connections for the organization" }),
+	token_quota: Ga
 }).extend(G.shape).extend({
 	id: e.string(),
 	name: e.string().min(1).openapi({ description: "The name of the organization" })
 });
-var za = e.object({
+var Ka = e.object({
 	connection_id: e.string().openapi({ description: "ID of the tenant-level connection to enable for the org." }),
 	assign_membership_on_login: e.boolean().optional().default(!1),
 	show_as_button: e.boolean().optional().default(!0),
@@ -6380,7 +6433,7 @@ var za = e.object({
 	created_at: e.string().optional(),
 	updated_at: e.string().optional()
 });
-e.array(za), e.object({
+e.array(Ka), e.object({
 	user_id: e.string().openapi({ description: "ID of the user" }),
 	organization_id: e.string().openapi({ description: "ID of the organization" })
 }).extend(G.shape).extend({ id: e.string() }), e.object({
@@ -6519,7 +6572,7 @@ e.array(za), e.object({
 	"passwordless",
 	"enterprise"
 ]);
-var Ba = e.object({
+var qa = e.object({
 	cohort: e.string(),
 	sessions: e.number(),
 	active: e.array(e.number())
@@ -6528,9 +6581,9 @@ e.object({
 	interval: e.literal("week"),
 	from: e.string(),
 	to: e.string(),
-	cohorts: e.array(Ba)
+	cohorts: e.array(qa)
 });
-var Va = e.object({
+var Ja = e.object({
 	cohort: e.string(),
 	tokens: e.number(),
 	active: e.array(e.number())
@@ -6539,24 +6592,24 @@ e.object({
 	interval: e.literal("week"),
 	from: e.string(),
 	to: e.string(),
-	cohorts: e.array(Va)
+	cohorts: e.array(Ja)
 });
-var Ha = e.object({
+var Ya = e.object({
 	name: e.string(),
 	type: e.string()
-}), Ua = e.object({
+}), Xa = e.object({
 	elapsed: e.number(),
 	rows_read: e.number().optional(),
 	bytes_read: e.number().optional()
 });
 e.object({
-	meta: e.array(Ha),
+	meta: e.array(Ya),
 	data: e.array(e.record(e.string(), e.any())),
 	rows: e.number(),
 	rows_before_limit_at_least: e.number().optional(),
-	statistics: Ua.optional()
+	statistics: Xa.optional()
 });
-var Wa = e.enum(/* @__PURE__ */ "login.login-id.login-password.signup.signup-id.signup-password.reset-password.consent.mfa.mfa-push.mfa-otp.mfa-voice.mfa-phone.mfa-webauthn.mfa-email.mfa-recovery-code.status.device-flow.email-verification.email-otp-challenge.organizations.invitation.common.passkeys.captcha.custom-form.login-passwordless.mfa-login-options".split(".")), Ga = e.record(e.string(), e.record(e.string(), e.string())).openapi({
+var Za = e.enum(/* @__PURE__ */ "login.login-id.login-password.signup.signup-id.signup-password.reset-password.consent.mfa.mfa-push.mfa-otp.mfa-voice.mfa-phone.mfa-webauthn.mfa-email.mfa-recovery-code.status.device-flow.email-verification.email-otp-challenge.organizations.invitation.common.passkeys.captcha.custom-form.login-passwordless.mfa-login-options".split(".")), Qa = e.record(e.string(), e.record(e.string(), e.string())).openapi({
 	type: "object",
 	additionalProperties: {
 		type: "object",
@@ -6564,11 +6617,11 @@ var Wa = e.enum(/* @__PURE__ */ "login.login-id.login-password.signup.signup-id.
 	}
 });
 e.object({
-	prompt: Wa,
+	prompt: Za,
 	language: e.string(),
-	custom_text: Ga
+	custom_text: Qa
 });
-var Ka = e.enum([
+var $a = e.enum([
 	"phone",
 	"totp",
 	"email",
@@ -6576,9 +6629,9 @@ var Ka = e.enum([
 	"webauthn-roaming",
 	"webauthn-platform",
 	"passkey"
-]), qa = e.object({
+]), eo = e.object({
 	user_id: e.string(),
-	type: Ka,
+	type: $a,
 	phone_number: e.string().optional(),
 	totp_secret: e.string().optional(),
 	credential_id: e.string().optional(),
@@ -6589,7 +6642,7 @@ var Ka = e.enum([
 	friendly_name: e.string().optional(),
 	confirmed: e.boolean().default(!1)
 });
-function Ja(t, n) {
+function to(t, n) {
 	t.type === "phone" && !t.phone_number && n.addIssue({
 		code: e.ZodIssueCode.custom,
 		message: "phone_number is required when type is 'phone'",
@@ -6612,51 +6665,51 @@ function Ja(t, n) {
 		path: ["public_key"]
 	}));
 }
-qa.superRefine(Ja), qa.extend({
+eo.superRefine(to), eo.extend({
 	id: e.string(),
 	created_at: e.string(),
 	updated_at: e.string()
-}).superRefine(Ja), e.object({
+}).superRefine(to), e.object({
 	id: e.string().optional(),
 	created_at: e.string().datetime({ offset: !0 }).optional(),
 	updated_at: e.string().datetime({ offset: !0 }).optional()
 });
-function Ya(e) {
+function no(e) {
 	let t = atob(e), n = new Uint8Array(t.length);
 	for (let e = 0; e < t.length; e++) n[e] = t.charCodeAt(e);
 	return n;
 }
 //#endregion
 //#region ../../node_modules/.pnpm/nanoid@5.1.11/node_modules/nanoid/url-alphabet/index.js
-var Xa = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict", Za = (e = 21) => {
+var ro = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict", io = (e = 21) => {
 	let t = "", n = crypto.getRandomValues(new Uint8Array(e |= 0));
-	for (; e--;) t += Xa[n[e] & 63];
+	for (; e--;) t += ro[n[e] & 63];
 	return t;
 };
 //#endregion
 //#region src/helpers.ts
-async function Qa(e) {
+async function ao(e) {
 	let t = new DecompressionStream("deflate-raw"), n = new Uint8Array(e), r = new Blob([n]).stream().pipeThrough(t);
 	return new Uint8Array(await new Response(r).arrayBuffer());
 }
-async function $a(e) {
-	let t = Ya(e.replace(/ /g, "+"));
+async function oo(e) {
+	let t = no(e.replace(/ /g, "+"));
 	try {
-		let e = await Qa(t);
+		let e = await ao(t);
 		return new TextDecoder().decode(e);
 	} catch (e) {
 		return console.warn("Decompression failed, assuming data is not compressed:", e), new TextDecoder().decode(t);
 	}
 }
-async function eo(e) {
-	let t = await $a(e), n = new tn({
+async function so(e) {
+	let t = await oo(e), n = new tn({
 		attributeNamePrefix: "@_",
 		alwaysCreateTextNode: !0,
 		ignoreAttributes: !1
 	}).parse(t);
 	return r.parse(n);
 }
-function to(e) {
+function co(e) {
 	let t = e.certificates.map((e) => ({
 		"@_use": "signing",
 		KeyInfo: {
@@ -6730,8 +6783,8 @@ function to(e) {
 		attributeNamePrefix: "@_"
 	}).build(n);
 }
-async function no(e, t) {
-	let n = e.notBefore || (/* @__PURE__ */ new Date()).toISOString(), r = e.notAfter || new Date(new Date(n).getTime() + 600 * 1e3).toISOString(), i = e.issueInstant || n, a = e.sessionNotOnOrAfter || r, o = e.responseId || `_${Za()}`, s = e.assertionId || `_${Za()}`, c = [{
+async function lo(e, t) {
+	let n = e.notBefore || (/* @__PURE__ */ new Date()).toISOString(), r = e.notAfter || new Date(new Date(n).getTime() + 600 * 1e3).toISOString(), i = e.issueInstant || n, a = e.sessionNotOnOrAfter || r, o = e.responseId || `_${io()}`, s = e.assertionId || `_${io()}`, c = [{
 		"samlp:Response": [
 			{ "saml:Issuer": [{ "#text": e.issuer }] },
 			{ "samlp:Status": [{
@@ -6912,7 +6965,7 @@ async function no(e, t) {
 }
 //#endregion
 //#region src/signers/local.ts
-var ro = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256", io = "http://www.w3.org/2001/04/xmlenc#sha256", ao = "http://www.w3.org/2001/10/xml-exc-c14n#", oo = class {
+var uo = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256", fo = "http://www.w3.org/2001/04/xmlenc#sha256", po = "http://www.w3.org/2001/10/xml-exc-c14n#", mo = class {
 	async signSAML(e, t, n) {
 		try {
 			let r = await import("xml-crypto"), i = r.SignedXml || r.default?.SignedXml;
@@ -6921,11 +6974,11 @@ var ro = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256", io = "http://www.w
 				privateKey: t,
 				publicCert: n
 			});
-			a.canonicalizationAlgorithm = ao, a.addReference({
+			a.canonicalizationAlgorithm = po, a.addReference({
 				xpath: "(/*[local-name()='Response']/*[local-name()='Assertion'])[1]",
-				digestAlgorithm: io,
-				transforms: ["http://www.w3.org/2000/09/xmldsig#enveloped-signature", ao]
-			}), a.signatureAlgorithm = ro;
+				digestAlgorithm: fo,
+				transforms: ["http://www.w3.org/2000/09/xmldsig#enveloped-signature", po]
+			}), a.signatureAlgorithm = uo;
 			let o = n.replace(/-----BEGIN CERTIFICATE-----|-----END CERTIFICATE-----/g, "").replace(/\s/g, "");
 			return a.keyInfoProvider = { getKeyInfo: () => `<X509Data><X509Certificate>${o}</X509Certificate></X509Data>` }, a.computeSignature(e, { location: {
 				reference: "/*[local-name()='Response']/*[local-name()='Assertion']/*[local-name()='Issuer']",
@@ -6935,7 +6988,7 @@ var ro = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256", io = "http://www.w
 			throw Error(`Failed to sign SAML locally. Make sure xml-crypto is installed. Error: ${e}`);
 		}
 	}
-}, so = class {
+}, ho = class {
 	signUrl;
 	constructor(e) {
 		this.signUrl = e;
@@ -6955,4 +7008,4 @@ var ro = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256", io = "http://www.w
 	}
 };
 //#endregion
-export { so as HttpSamlSigner, oo as LocalSamlSigner, to as createSamlMetadata, no as createSamlResponse, s as dsSignatureSchema, $a as inflateDecompress, Qa as inflateRaw, eo as parseSamlRequestQuery, n as samlIssuerSchema, i as samlMetadataResponseSchema, r as samlRequestSchema, c as samlResponseJsonSchema };
+export { ho as HttpSamlSigner, mo as LocalSamlSigner, co as createSamlMetadata, lo as createSamlResponse, s as dsSignatureSchema, oo as inflateDecompress, ao as inflateRaw, so as parseSamlRequestQuery, n as samlIssuerSchema, i as samlMetadataResponseSchema, r as samlRequestSchema, c as samlResponseJsonSchema };