@authhero/saml 0.5.16 → 0.5.18

package/dist/saml.mjs

@@ -5181,7 +5181,14 @@ var bi = e.object({
 	text: e.string(),
 	href: e.string(),
 	linkText: e.string().optional()
-});
+}), Si = e.object({
+	"form-content-start": e.string().optional(),
+	"form-content-end": e.string().optional(),
+	"form-footer-start": e.string().optional(),
+	"form-footer-end": e.string().optional(),
+	"secondary-actions-start": e.string().optional(),
+	"secondary-actions-end": e.string().optional()
+}).strict();
 e.object({
 	name: e.string().optional(),
 	action: e.string(),
@@ -5191,9 +5198,10 @@ e.object({
 	components: e.array(mi),
 	messages: e.array(bi).optional(),
 	links: e.array(xi).optional(),
+	partials: Si.optional(),
 	footer: e.string().optional()
 });
-var Si = e.enum([
+var Ci = e.enum([
 	"pre-user-registration",
 	"post-user-registration",
 	"post-user-login",
@@ -5201,19 +5209,19 @@ var Si = e.enum([
 	"validate-registration-username",
 	"pre-user-deletion",
 	"post-user-deletion"
-]), Ci = e.enum(["post-user-login"]), wi = e.enum([
+]), wi = e.enum(["post-user-login"]), Ti = e.enum([
 	"post-user-login",
 	"post-user-registration",
 	"post-user-update",
 	"credentials-exchange"
-]), Ti = e.enum([
+]), Ei = e.enum([
 	"post-user-login",
 	"credentials-exchange",
 	"pre-user-registration",
 	"post-user-registration"
-]), Ei = e.enum(["post-user-login"]);
-Si.options, Ci.options, wi.options, Ti.options, Ei.options;
-var Di = e.enum(["impersonate"]), Oi = e.enum([
+]), Di = e.enum(["post-user-login"]);
+Ci.options, wi.options, Ti.options, Ei.options, Di.options;
+var Oi = e.enum(["impersonate"]), ki = e.enum([
 	"ensure-username",
 	"set-preferred-username",
 	"account-linking"
@@ -5223,73 +5231,73 @@ var Di = e.enum(["impersonate"]), Oi = e.enum([
 	priority: e.number().optional(),
 	hook_id: e.string().optional(),
 	metadata: e.record(e.string(), e.unknown()).optional()
-}, ki = e.object({
-	...Z,
-	trigger_id: Si,
-	url: e.string()
-}), Ai = e.object({
+}, Ai = e.object({
 	...Z,
 	trigger_id: Ci,
-	form_id: e.string()
+	url: e.string()
 }), ji = e.object({
 	...Z,
 	trigger_id: wi,
-	template_id: Oi
+	form_id: e.string()
 }), Mi = e.object({
 	...Z,
 	trigger_id: Ti,
-	code_id: e.string()
+	template_id: ki
 }), Ni = e.object({
 	...Z,
 	trigger_id: Ei,
-	page_id: Di,
+	code_id: e.string()
+}), Pi = e.object({
+	...Z,
+	trigger_id: Di,
+	page_id: Oi,
 	permission_required: e.string().optional()
 });
 e.union([
-	ki,
 	Ai,
 	ji,
 	Mi,
-	Ni
+	Ni,
+	Pi
 ]);
-var Pi = e.object({
-	...Z,
-	trigger_id: Si
-}).extend(G.shape).extend({
-	hook_id: e.string(),
-	url: e.string()
-}), Fi = e.object({
+var Fi = e.object({
 	...Z,
 	trigger_id: Ci
 }).extend(G.shape).extend({
 	hook_id: e.string(),
-	form_id: e.string()
+	url: e.string()
 }), Ii = e.object({
 	...Z,
 	trigger_id: wi
 }).extend(G.shape).extend({
 	hook_id: e.string(),
-	template_id: Oi
+	form_id: e.string()
 }), Li = e.object({
 	...Z,
 	trigger_id: Ti
 }).extend(G.shape).extend({
 	hook_id: e.string(),
-	code_id: e.string()
+	template_id: ki
 }), Ri = e.object({
 	...Z,
 	trigger_id: Ei
 }).extend(G.shape).extend({
 	hook_id: e.string(),
-	page_id: Di,
+	code_id: e.string()
+}), zi = e.object({
+	...Z,
+	trigger_id: Di
+}).extend(G.shape).extend({
+	hook_id: e.string(),
+	page_id: Oi,
 	permission_required: e.string().optional()
 });
 e.union([
-	Pi,
 	Fi,
 	Ii,
 	Li,
-	Ri
+	Ri,
+	zi
 ]), e.object({
 	code: e.string().max(1e5),
 	secrets: e.record(e.string(), e.string()).optional()
@@ -5297,11 +5305,11 @@ e.union([
 	id: e.string(),
 	tenant_id: e.string()
 }).extend(G.shape);
-var zi = e.object({ name: e.string().optional() }), Bi = e.object({ email: e.string().optional() }), Vi = e.object({
+var Bi = e.object({ name: e.string().optional() }), Vi = e.object({ email: e.string().optional() }), Hi = e.object({
 	id: e.string().optional(),
 	organization_id: e.string().max(50),
-	inviter: zi,
-	invitee: Bi,
+	inviter: Bi,
+	invitee: Vi,
 	invitation_url: e.string().url(),
 	client_id: e.string(),
 	connection_id: e.string().optional(),
@@ -5317,8 +5325,8 @@ e.object({
 	created_at: e.string().datetime(),
 	expires_at: e.string().datetime(),
 	ticket_id: e.string().optional()
-}).extend(Vi.omit({ id: !0 }).shape);
-var Hi = e.object({
+}).extend(Hi.omit({ id: !0 }).shape);
+var Ui = e.object({
 	alg: e.enum([
 		"RS256",
 		"RS384",
@@ -5360,7 +5368,7 @@ var Hi = e.object({
 		path: [r],
 		message: `EC JWK is missing required member '${r}'`
 	});
-}), Ui = e.object({ keys: e.array(Hi) });
+}), Wi = e.object({ keys: e.array(Ui) });
 e.object({
 	issuer: e.string(),
 	authorization_endpoint: e.string(),
@@ -5388,9 +5396,9 @@ e.object({
 	backchannel_logout_supported: e.boolean().optional(),
 	backchannel_logout_session_supported: e.boolean().optional()
 });
-var Wi = /* @__PURE__ */ function(e) {
+var Gi = /* @__PURE__ */ function(e) {
 	return e.PENDING = "pending", e.AUTHENTICATED = "authenticated", e.AWAITING_EMAIL_VERIFICATION = "awaiting_email_verification", e.AWAITING_MFA = "awaiting_mfa", e.AWAITING_HOOK = "awaiting_hook", e.AWAITING_CONTINUATION = "awaiting_continuation", e.AWAITING_CONSENT = "awaiting_consent", e.COMPLETED = "completed", e.FAILED = "failed", e.EXPIRED = "expired", e;
-}({}), Gi = e.nativeEnum(Wi), Ki = e.object({
+}({}), Ki = e.nativeEnum(Gi), qi = e.object({
 	strategy: e.string(),
 	strategy_type: e.string()
 });
@@ -5404,12 +5412,12 @@ e.object({
 	useragent: e.string().optional(),
 	session_id: e.string().optional(),
 	authorization_url: e.string().optional(),
-	state: Gi.optional().default("pending"),
+	state: Ki.optional().default("pending"),
 	state_data: e.string().optional(),
 	failure_reason: e.string().optional(),
 	user_id: e.string().optional(),
 	auth_connection: e.string().optional(),
-	auth_strategy: Ki.optional(),
+	auth_strategy: qi.optional(),
 	authenticated_at: e.string().optional()
 }).openapi({ description: "This represents a login sesion" }).extend({
 	id: e.string().openapi({ description: "This is is used as the state in the universal login" }),
@@ -5576,17 +5584,17 @@ var Q = {
 	WARNING_DURING_LOGIN: "w",
 	WARNING_SENDING_NOTIFICATION: "wn",
 	WARNING_USER_MANAGEMENT: "wum"
-}, qi = e.string().refine((e) => Object.values(Q).includes(e), { message: "Invalid log type" });
+}, Ji = e.string().refine((e) => Object.values(Q).includes(e), { message: "Invalid log type" });
 Q.ACLS_SUMMARY, Q.ACTIONS_EXECUTION_FAILED, Q.API_LIMIT, Q.API_LIMIT_WARNING, Q.APPI, Q.CIBA_EXCHANGE_FAILED, Q.CIBA_EXCHANGE_SUCCEEDED, Q.CIBA_START_FAILED, Q.CIBA_START_SUCCEEDED, Q.CODE_LINK_SENT, Q.CODE_SENT, Q.DEPRECATION_NOTICE, Q.FAILED_LOGIN, Q.FAILED_BY_CONNECTOR, Q.FAILED_CHANGE_EMAIL, Q.FAILED_BY_CORS, Q.FAILED_CROSS_ORIGIN_AUTHENTICATION, Q.FAILED_CHANGE_PASSWORD, Q.FAILED_POST_CHANGE_PASSWORD_HOOK, Q.FAILED_CHANGE_PHONE_NUMBER, Q.FAILED_CHANGE_PASSWORD_REQUEST, Q.FAILED_CONNECTOR_PROVISIONING, Q.FAILED_CHANGE_USERNAME, Q.FAILED_DELEGATION, Q.FAILED_DEVICE_ACTIVATION, Q.FAILED_DEVICE_AUTHORIZATION_REQUEST, Q.USER_CANCELED_DEVICE_CONFIRMATION, Q.FAILED_USER_DELETION, Q.FAILED_EXCHANGE_AUTHORIZATION_CODE_FOR_ACCESS_TOKEN, Q.FAILED_EXCHANGE_ACCESS_TOKEN_FOR_CLIENT_CREDENTIALS, Q.FAILED_EXCHANGE_CUSTOM_TOKEN, Q.FAILED_EXCHANGE_DEVICE_CODE_FOR_ACCESS_TOKEN, Q.FAILED_FEDERATED_LOGOUT, Q.FAILED_EXCHANGE_NATIVE_SOCIAL_LOGIN, Q.FAILED_EXCHANGE_PASSWORD_OOB_FOR_ACCESS_TOKEN, Q.FAILED_EXCHANGE_PASSWORD_OTP_FOR_ACCESS_TOKEN, Q.FAILED_EXCHANGE_PASSWORD_FOR_ACCESS_TOKEN, Q.FAILED_EXCHANGE_PASSWORDLESS_OTP_FOR_ACCESS_TOKEN, Q.FAILED_EXCHANGE_PASSWORD_MFA_RECOVERY_FOR_ACCESS_TOKEN, Q.FAILED_EXCHANGE_ROTATING_REFRESH_TOKEN, Q.FAILED_EXCHANGE_REFRESH_TOKEN_FOR_ACCESS_TOKEN, Q.FAILED_EXCHANGE_SUBJECT_TOKEN_FOR_ACCESS_TOKEN, Q.FAILED_HOOK, Q.FAILED_IMPERSONATION, Q.FAILED_INVITE_ACCEPT, Q.FAILED_LOGOUT, Q.FLOWS_EXECUTION_COMPLETED, Q.FLOWS_EXECUTION_FAILED, Q.FAILED_SENDING_NOTIFICATION, Q.FORMS_SUBMISSION_FAILED, Q.FORMS_SUBMISSION_SUCCEEDED, Q.FAILED_LOGIN_INCORRECT_PASSWORD, Q.FAILED_PUSHED_AUTHORIZATION_REQUEST, Q.FAILED_POST_USER_REGISTRATION_HOOK, Q.FAILED_SIGNUP, Q.FAILED_SILENT_AUTH, Q.FAILED_LOGIN_INVALID_EMAIL_USERNAME, Q.FAILED_USERS_IMPORT, Q.FAILED_VERIFICATION_EMAIL, Q.FAILED_VERIFICATION_EMAIL_REQUEST, Q.EMAIL_VERIFICATION_CONFIRMED, Q.EMAIL_VERIFICATION_FAILED, Q.MFA_AUTH_FAILED, Q.MFA_AUTH_REJECTED, Q.MFA_AUTH_SUCCESS, Q.MFA_ENROLLMENT_COMPLETE, Q.TOO_MANY_MFA_FAILURES, Q.MFA_RECOVERY_FAILED, Q.MFA_RECOVERY_RATE_LIMIT_EXCEED, Q.MFA_RECOVERY_SUCCESS, Q.MFA_EMAIL_SENT, Q.EMAIL_VERIFICATION_SENT, Q.EMAIL_VERIFICATION_SEND_FAILURE, Q.PUSH_NOTIFICATION_SENT, Q.ERROR_SENDING_MFA_PUSH_NOTIFICATION, Q.MFA_SMS_SENT, Q.ERROR_SENDING_MFA_SMS, Q.MFA_VOICE_CALL_SUCCESS, Q.MFA_VOICE_CALL_FAILED, Q.SECOND_FACTOR_STARTED, Q.MFA_ENROLL_STARTED, Q.MFA_ENROLLMENT_FAILED, Q.GUARDIAN_TENANT_UPDATE, Q.UNENROLL_DEVICE_ACCOUNT, Q.UPDATE_DEVICE_ACCOUNT, Q.WEBAUTHN_CHALLENGE_FAILED, Q.WEBAUTHN_ENROLLMENT_FAILED, Q.FAILED_KMS_API_OPERATION, Q.SUCCESS_KMS_API_OPERATION, Q.KMS_KEY_STATE_CHANGED, Q.TOO_MANY_CALLS_TO_DELEGATION, Q.BLOCKED_IP_ADDRESS, Q.BLOCKED_ACCOUNT_IP, Q.BLOCKED_ACCOUNT_EMAIL, Q.INFORMATION, Q.MFA_REQUIRED, Q.MANAGEMENT_API_READ_OPERATION, Q.FAILED_AUTHENTICATION_METHOD_OPERATION_MY_ACCOUNT, Q.SUCCESSFUL_AUTHENTICATION_METHOD_OPERATION_MY_ACCOUNT, Q.FAILED_OIDC_BACKCHANNEL_LOGOUT, Q.SUCCESSFUL_OIDC_BACKCHANNEL_LOGOUT, Q.ORGANIZATION_MEMBER_ADDED, Q.PASSKEY_CHALLENGE_FAILED, Q.PASSKEY_CHALLENGE_STARTED, Q.PRE_LOGIN_ASSESSMENT, Q.BREACHED_PASSWORD, Q.BREACHED_PASSWORD_ON_RESET, Q.SUCCESS_RESOURCE_CLEANUP, Q.RICH_CONSENTS_ACCESS_ERROR, Q.SUCCESS_LOGIN, Q.SUCCESS_API_OPERATION, Q.FAILED_API_OPERATION, Q.SUCCESS_CHANGE_EMAIL, Q.SUCCESS_CROSS_ORIGIN_AUTHENTICATION, Q.SUCCESS_CHANGE_PASSWORD, Q.SUCCESS_CHANGE_PHONE_NUMBER, Q.SUCCESS_CHANGE_PASSWORD_REQUEST, Q.SUCCESS_CHANGE_USERNAME, Q.SUCCESS_CREDENTIAL_VALIDATION, Q.SUCCESS_DELEGATION, Q.SUCCESS_USER_DELETION, Q.SUCCESS_EXCHANGE_AUTHORIZATION_CODE_FOR_ACCESS_TOKEN, Q.SUCCESS_EXCHANGE_ACCESS_TOKEN_FOR_CLIENT_CREDENTIALS, Q.SUCCESS_EXCHANGE_CUSTOM_TOKEN, Q.SUCCESS_EXCHANGE_DEVICE_CODE_FOR_ACCESS_TOKEN, Q.SUCCESS_EXCHANGE_NATIVE_SOCIAL_LOGIN, Q.SUCCESS_EXCHANGE_PASSWORD_OOB_FOR_ACCESS_TOKEN, Q.SUCCESS_EXCHANGE_PASSWORD_OTP_FOR_ACCESS_TOKEN, Q.SUCCESS_EXCHANGE_PASSWORDLESS_OTP_FOR_ACCESS_TOKEN, Q.SUCCESS_EXCHANGE_PASSWORD_FOR_ACCESS_TOKEN, Q.SUCCESS_EXCHANGE_PASSKEY_OOB_FOR_ACCESS_TOKEN, Q.SUCCESS_EXCHANGE_PASSKEY_OTP_FOR_ACCESS_TOKEN, Q.SUCCESS_EXCHANGE_PASSKEY_MFA_RECOVERY_FOR_ACCESS_TOKEN, Q.SUCCESS_EXCHANGE_PASSWORD_MFA_RECOVERY_FOR_ACCESS_TOKEN, Q.SUCCESS_EXCHANGE_REFRESH_TOKEN_FOR_ACCESS_TOKEN, Q.SUCCESS_EXCHANGE_SUBJECT_TOKEN_FOR_ACCESS_TOKEN, Q.SUCCESS_IMPERSONATION, Q.SUCCESSFULLY_ACCEPTED_USER_INVITE, Q.BREACHED_PASSWORD_ON_SIGNUP, Q.SUCCESS_LOGOUT, Q.SUCCESS_HOOK, Q.SUCCESS_PASSWORD_MIGRATION, Q.SUCCESS_REVOCATION, Q.SUCCESS_SIGNUP, Q.FAILED_SS_SSO_OPERATION, Q.INFORMATION_FROM_SS_SSO_OPERATION, Q.SUCCESS_SS_SSO_OPERATION, Q.SUCCESS_SILENT_AUTH, Q.SUCCESSFUL_SCIM_OPERATION, Q.SUCCESSFULLY_IMPORTED_USERS, Q.SUCCESS_VERIFICATION_EMAIL, Q.SUCCESS_VERIFICATION_EMAIL_REQUEST, Q.MAX_AMOUNT_OF_AUTHENTICATORS, Q.USER_LOGIN_BLOCK_RELEASED, Q.FAILED_UNIVERSAL_LOGOUT, Q.SUCCESSFUL_UNIVERSAL_LOGOUT, Q.WARNING_DURING_LOGIN, Q.WARNING_SENDING_NOTIFICATION, Q.WARNING_USER_MANAGEMENT, (() => {
 	let e = {};
 	for (let [t, n] of Object.entries(Q)) t.startsWith("SUCCESS_") || t.startsWith("SUCCESSFUL_") || t.startsWith("SUCCESSFULLY_") || t.endsWith("_SUCCEEDED") || t.endsWith("_COMPLETED") ? e[n] = "success" : t.startsWith("FAILED_") || t.startsWith("ERROR_") || t.startsWith("BREACHED_") || t.startsWith("BLOCKED_") || t === "MFA_AUTH_FAILED" || t === "MFA_AUTH_REJECTED" || t === "MFA_RECOVERY_FAILED" || t === "MFA_ENROLLMENT_FAILED" || t === "EMAIL_VERIFICATION_FAILED" || t === "WEBAUTHN_CHALLENGE_FAILED" || t === "WEBAUTHN_ENROLLMENT_FAILED" || t === "PASSKEY_CHALLENGE_FAILED" || t === "FLOWS_EXECUTION_FAILED" || t === "FORMS_SUBMISSION_FAILED" || t === "CIBA_EXCHANGE_FAILED" || t === "CIBA_START_FAILED" || t === "ACTIONS_EXECUTION_FAILED" || t === "RICH_CONSENTS_ACCESS_ERROR" || t === "USER_CANCELED_DEVICE_CONFIRMATION" || t === "TOO_MANY_MFA_FAILURES" || t === "MFA_RECOVERY_RATE_LIMIT_EXCEED" || t === "API_LIMIT" || t === "MAX_AMOUNT_OF_AUTHENTICATORS" ? e[n] = "failure" : t.startsWith("WARNING_") || t === "API_LIMIT_WARNING" || t === "DEPRECATION_NOTICE" || t === "PRE_LOGIN_ASSESSMENT" ? e[n] = "warning" : t === "CODE_SENT" || t === "CODE_LINK_SENT" || t === "MFA_EMAIL_SENT" || t === "MFA_SMS_SENT" || t === "EMAIL_VERIFICATION_SENT" || t === "PUSH_NOTIFICATION_SENT" ? e[n] = "code_sent" : t === "INFORMATION" || t === "INFORMATION_FROM_SS_SSO_OPERATION" || t === "MANAGEMENT_API_READ_OPERATION" || t === "APPI" || t === "ACLS_SUMMARY" || t === "ORGANIZATION_MEMBER_ADDED" ? e[n] = "info" : e[n] = "other";
 	return e;
 })();
-var Ji = e.object({
+var Yi = e.object({
 	name: e.string(),
 	version: e.string(),
 	env: e.object({ node: e.string().optional() }).optional()
-}), Yi = e.object({
+}), Xi = e.object({
 	country_code: e.string().length(2),
 	city_name: e.string(),
 	latitude: e.string(),
@@ -5595,7 +5603,7 @@ var Ji = e.object({
 	continent_code: e.string()
 });
 e.object({
-	type: qi,
+	type: Ji,
 	date: e.string(),
 	description: e.string().optional(),
 	ip: e.string().optional(),
@@ -5613,63 +5621,63 @@ e.object({
 	strategy: e.string().optional(),
 	strategy_type: e.string().optional(),
 	hostname: e.string().optional(),
-	auth0_client: Ji.optional(),
+	auth0_client: Yi.optional(),
 	log_id: e.string().optional(),
-	location_info: Yi.optional()
+	location_info: Xi.optional()
 }).extend({ log_id: e.string() });
-var Xi = e.enum([
+var Zi = e.enum([
 	"http",
 	"eventbridge",
 	"eventgrid",
 	"splunk",
 	"datadog",
 	"sumo"
-]), Zi = e.enum([
+]), Qi = e.enum([
 	"active",
 	"paused",
 	"suspended"
-]), Qi = e.object({
+]), $i = e.object({
 	type: e.string(),
 	name: e.string()
 });
 e.object({
 	name: e.string(),
-	type: Xi,
-	status: Zi.optional(),
+	type: Zi,
+	status: Qi.optional(),
 	sink: e.record(e.string(), e.unknown()),
-	filters: e.array(Qi).optional(),
+	filters: e.array($i).optional(),
 	isPriority: e.boolean().optional()
 }).extend({
 	id: e.string(),
-	status: Zi,
+	status: Qi,
 	created_at: e.string().optional(),
 	updated_at: e.string().optional()
 });
-var $i = e.enum([
+var ea = e.enum([
 	"auth0",
 	"cognito",
 	"okta",
 	"oidc"
-]), ea = e.object({
+]), ta = e.object({
 	domain: e.string(),
 	client_id: e.string(),
 	client_secret: e.string(),
 	audience: e.string().optional(),
 	scope: e.string().optional()
-}), ta = e.object({
+}), na = e.object({
 	id: e.string().optional(),
 	name: e.string(),
-	provider: $i,
+	provider: ea,
 	connection: e.string(),
 	enabled: e.boolean().default(!0),
-	credentials: ea
+	credentials: ta
 });
 e.object({
 	id: e.string(),
 	created_at: e.string(),
 	updated_at: e.string()
-}).extend(ta.shape);
-var na = e.object({
+}).extend(na.shape);
+var ra = e.object({
 	enabled: e.boolean().optional(),
 	shields: e.array(e.string()).optional(),
 	admin_notification_frequency: e.array(e.string()).optional(),
@@ -5678,13 +5686,13 @@ var na = e.object({
 		"pre-user-registration": e.object({ shields: e.array(e.string()).optional() }).optional(),
 		"pre-change-password": e.object({ shields: e.array(e.string()).optional() }).optional()
 	}).optional()
-}), ra = e.object({
+}), ia = e.object({
 	enabled: e.boolean().optional(),
 	shields: e.array(e.string()).optional(),
 	allowlist: e.array(e.string()).optional(),
 	mode: e.string().optional(),
 	max_attempts: e.number().optional()
-}), ia = e.object({
+}), aa = e.object({
 	enabled: e.boolean().optional(),
 	shields: e.array(e.string()).optional(),
 	allowlist: e.array(e.string()).optional(),
@@ -5698,10 +5706,10 @@ var na = e.object({
 			rate: e.number().optional()
 		}).optional()
 	}).optional()
-}), aa = e.object({
-	breached_password_detection: na.optional(),
-	brute_force_protection: ra.optional(),
-	suspicious_ip_throttling: ia.optional()
+}), oa = e.object({
+	breached_password_detection: ra.optional(),
+	brute_force_protection: ia.optional(),
+	suspicious_ip_throttling: aa.optional()
 });
 e.object({
 	id: e.string().optional(),
@@ -5714,14 +5722,14 @@ e.object({
 	created_at: e.string(),
 	updated_at: e.string()
 });
-var oa = e.object({
+var sa = e.object({
 	initial_user_agent: e.string().describe("First user agent of the device from which this user logged in"),
 	initial_ip: e.string().describe("First IP address associated with this session"),
 	initial_asn: e.string().describe("First autonomous system number associated with this session"),
 	last_user_agent: e.string().describe("Last user agent of the device from which this user logged in"),
 	last_ip: e.string().describe("Last IP address from which this user logged in"),
 	last_asn: e.string().describe("Last autonomous system number from which this user logged in")
-}), sa = e.object({
+}), ca = e.object({
 	id: e.string(),
 	revoked_at: e.string().optional(),
 	used_at: e.string().optional(),
@@ -5729,7 +5737,7 @@ var oa = e.object({
 	expires_at: e.string().optional(),
 	login_session_id: e.string(),
 	idle_expires_at: e.string().optional(),
-	device: oa.describe("Metadata related to the device used in the session"),
+	device: sa.describe("Metadata related to the device used in the session"),
 	clients: e.array(e.string()).describe("List of client details for the session")
 });
 e.object({
@@ -5737,7 +5745,7 @@ e.object({
 	updated_at: e.string(),
 	authenticated_at: e.string(),
 	last_interaction_at: e.string()
-}).extend(sa.shape), e.object({
+}).extend(ca.shape), e.object({
 	kid: e.string().openapi({ description: "The key id of the signing key" }),
 	tenant_id: e.string().optional().openapi({ description: "The tenant the key belongs to. Omitted means the key is shared / control-plane scoped." }),
 	cert: e.string().openapi({ description: "The public certificate of the signing key" }),
@@ -5754,7 +5762,7 @@ e.object({
 	connection: e.string().optional().openapi({ description: "The connection identifier associated with the key" }),
 	type: e.enum(["jwt_signing", "saml_encryption"]).openapi({ description: "The type of the signing key" })
 });
-var ca = e.object({
+var la = e.object({
 	id: e.string().optional(),
 	audience: e.string().optional(),
 	friendly_name: e.string(),
@@ -5872,7 +5880,7 @@ var ca = e.object({
 		"shared_planetscale"
 	]).optional(),
 	d1_database_id: e.string().max(64).optional(),
-	attack_protection: aa.optional(),
+	attack_protection: oa.optional(),
 	mfa: e.object({
 		policy: e.enum(["never", "always"]).default("never").optional(),
 		factors: e.object({
@@ -5903,29 +5911,29 @@ var ca = e.object({
 e.object({
 	created_at: e.string().nullable().transform((e) => e ?? ""),
 	updated_at: e.string().nullable().transform((e) => e ?? "")
-}).extend(ca.shape).extend({
+}).extend(la.shape).extend({
 	id: e.string(),
 	is_control_plane: e.boolean().optional()
 });
-var la = e.enum([
+var ua = e.enum([
 	"provision",
 	"seed",
 	"upgrade",
 	"backup",
 	"deprovision",
 	"users_import"
-]), ua = e.enum([
+]), da = e.enum([
 	"pending",
 	"running",
 	"succeeded",
 	"failed",
 	"cancelled"
-]), da = e.string().max(64);
+]), fa = e.string().max(64);
 e.object({
 	tenant_id: e.string().max(255).nullable().default(null),
 	rollout_id: e.string().max(255).nullable().optional(),
-	kind: la,
-	engine: da,
+	kind: ua,
+	engine: fa,
 	engine_instance_id: e.string().max(100).nullable().optional(),
 	target_worker_version: e.string().max(255).nullable().optional(),
 	target_database_version: e.string().max(255).nullable().optional(),
@@ -5933,7 +5941,7 @@ e.object({
 	input: e.record(e.string(), e.unknown()).nullable().optional()
 }).extend({
 	id: e.string(),
-	status: ua,
+	status: da,
 	current_step: e.string().max(255).nullable().optional(),
 	error: e.string().nullable().optional(),
 	result: e.record(e.string(), e.unknown()).nullable().optional(),
@@ -5954,7 +5962,7 @@ e.object({
 	claim_expires_at: !0,
 	finished_at: !0
 }).partial();
-var fa = e.enum([
+var pa = e.enum([
 	"started",
 	"succeeded",
 	"failed",
@@ -5965,14 +5973,14 @@ var fa = e.enum([
 e.object({
 	operation_id: e.string().max(255),
 	step: e.string().max(255),
-	outcome: fa,
+	outcome: pa,
 	detail: e.record(e.string(), e.unknown()).nullable().optional(),
 	attempt: e.number().int().min(1).default(1)
 }).extend({
 	id: e.string(),
 	created_at: e.string()
 });
-var pa = e.enum([
+var ma = e.enum([
 	"pending",
 	"inserted",
 	"updated",
@@ -5983,28 +5991,28 @@ e.object({
 	operation_id: e.string().max(255),
 	seq: e.number().int().min(0),
 	payload: e.record(e.string(), e.unknown()),
-	status: pa.default("pending"),
+	status: ma.default("pending"),
 	error_code: e.string().max(64).nullable().optional(),
 	error_message: e.string().nullable().optional(),
 	error_path: e.string().max(255).nullable().optional(),
 	entity_id: e.string().max(255).nullable().optional()
 }).extend({
-	status: pa,
+	status: ma,
 	created_at: e.string(),
 	updated_at: e.string()
 }), e.object({
 	seq: e.number().int().min(0),
-	status: pa,
+	status: ma,
 	error_code: e.string().max(64).nullable().optional(),
 	error_message: e.string().nullable().optional(),
 	error_path: e.string().max(255).nullable().optional(),
 	entity_id: e.string().max(255).nullable().optional()
 });
-var ma = e.enum([
+var ha = e.enum([
 	"upgrade",
 	"reseed",
 	"backup"
-]), ha = e.enum([
+]), ga = e.enum([
 	"pending",
 	"canary",
 	"rolling",
@@ -6013,7 +6021,7 @@ var ma = e.enum([
 	"failed"
 ]);
 e.object({
-	kind: ma,
+	kind: ha,
 	target_worker_version: e.string().max(255).nullable().optional(),
 	target_database_version: e.string().max(255).nullable().optional(),
 	wave_size: e.number().int().min(1).default(10),
@@ -6022,7 +6030,7 @@ e.object({
 	initiated_by: e.string().max(255).nullable().optional()
 }).extend({
 	id: e.string(),
-	status: ha,
+	status: ga,
 	created_at: e.string(),
 	updated_at: e.string(),
 	finished_at: e.string().nullable().optional()
@@ -6044,7 +6052,7 @@ e.object({
 	code: e.string(),
 	state: e.string().optional()
 });
-var ga = e.object({
+var _a = e.object({
 	button_border_radius: e.number(),
 	button_border_weight: e.number(),
 	buttons_style: e.enum([
@@ -6062,7 +6070,7 @@ var ga = e.object({
 	show_widget_shadow: e.boolean(),
 	widget_border_weight: e.number(),
 	widget_corner_radius: e.number()
-}), _a = e.object({
+}), va = e.object({
 	base_focus_color: e.string(),
 	base_hover_color: e.string(),
 	body_text: e.string(),
@@ -6089,7 +6097,7 @@ var ga = e.object({
 }), $ = e.object({
 	bold: e.boolean(),
 	size: e.number()
-}), va = e.object({
+}), ya = e.object({
 	body_text: $,
 	buttons_text: $,
 	font_url: e.string(),
@@ -6099,7 +6107,7 @@ var ga = e.object({
 	reference_text_size: e.number(),
 	subtitle: $,
 	title: $
-}), ya = e.object({
+}), ba = e.object({
 	background_color: e.string(),
 	background_image_url: e.string(),
 	page_layout: e.enum([
@@ -6112,7 +6120,7 @@ var ga = e.object({
 		"chip",
 		"none"
 	]).optional()
-}), ba = e.object({
+}), xa = e.object({
 	header_text_alignment: e.enum([
 		"center",
 		"left",
@@ -6129,12 +6137,12 @@ var ga = e.object({
 	social_buttons_layout: e.enum(["bottom", "top"])
 });
 e.object({
-	borders: ga,
-	colors: _a,
+	borders: _a,
+	colors: va,
 	displayName: e.string(),
-	fonts: va,
-	page_background: ya,
-	widget: ba
+	fonts: ya,
+	page_background: ba,
+	widget: xa
 }).extend({ themeId: e.string() }), e.object({
 	universal_login_experience: e.enum(["new", "classic"]).default("new"),
 	identifier_first: e.boolean().default(!0),
@@ -6142,32 +6150,32 @@ e.object({
 	show_last_used_connection: e.boolean().default(!1),
 	webauthn_platform_first_factor: e.boolean()
 });
-var xa = e.object({
+var Sa = e.object({
 	hosts: e.array(e.string()).optional(),
 	methods: e.array(e.string()).optional(),
 	path: e.string().default("/*"),
 	headers: e.record(e.string(), e.string()).optional(),
 	query: e.record(e.string(), e.string()).optional()
-}), Sa = e.object({
+}), Ca = e.object({
 	type: e.string(),
 	options: e.record(e.string(), e.unknown()).default({})
-}), Ca = e.object({
+}), wa = e.object({
 	id: e.string().optional(),
 	custom_domain_id: e.string(),
 	priority: e.number().int().default(100),
-	match: xa,
-	handlers: e.array(Sa).min(1)
+	match: Sa,
+	handlers: e.array(Ca).min(1)
 });
-Ca.extend({
+wa.extend({
 	id: e.string(),
 	tenant_id: e.string(),
 	created_at: e.string(),
 	updated_at: e.string()
-}), Ca.partial().omit({
+}), wa.partial().omit({
 	id: !0,
 	custom_domain_id: !0
 });
-var wa = "custom_authentication", Ta = [
+var Ta = "custom_authentication", Ea = [
 	"urn:ietf:params:oauth:",
 	"urn:auth0",
 	"urn:okta",
@@ -6175,56 +6183,56 @@ var wa = "custom_authentication", Ta = [
 	"https://auth0.com",
 	"http://okta.com",
 	"https://okta.com"
-], Ea = e.string().min(1).max(200).refine((e) => e.startsWith("https://") || e.startsWith("urn:"), { message: "subject_token_type must be a URI starting with https:// or urn:" }).refine((e) => !Ta.some((t) => e.toLowerCase().startsWith(t)), { message: "subject_token_type uses a reserved namespace" }), Da = e.enum([
+], Da = e.string().min(1).max(200).refine((e) => e.startsWith("https://") || e.startsWith("urn:"), { message: "subject_token_type must be a URI starting with https:// or urn:" }).refine((e) => !Ea.some((t) => e.toLowerCase().startsWith(t)), { message: "subject_token_type uses a reserved namespace" }), Oa = e.enum([
 	"RS256",
 	"RS384",
 	"RS512",
 	"ES256",
 	"ES384",
 	"ES512"
-]), Oa = e.discriminatedUnion("type", [e.object({
+]), ka = e.discriminatedUnion("type", [e.object({
 	type: e.literal("connection"),
 	connection: e.string().min(1),
 	create_if_not_exists: e.boolean().default(!0),
 	trust_email_verified: e.boolean().default(!1)
-}), e.object({ type: e.literal("user_id") })]), ka = e.object({
+}), e.object({ type: e.literal("user_id") })]), Aa = e.object({
 	issuer: e.string().min(1).max(2048),
-	jwks: Ui.optional(),
+	jwks: Wi.optional(),
 	jwks_uri: e.string().url().optional(),
 	audience: e.array(e.string().min(1)).min(1).optional(),
-	algorithms: e.array(Da).min(1).optional(),
+	algorithms: e.array(Oa).min(1).optional(),
 	max_lifetime_seconds: e.number().int().min(1).max(3600).default(300),
 	require_jti: e.boolean().default(!0),
-	user_mapping: Oa
+	user_mapping: ka
 });
 e.object({
 	name: e.string().min(1).max(255),
-	subject_token_type: Ea,
+	subject_token_type: Da,
 	action_id: e.string().min(1).optional(),
-	type: e.literal(wa),
-	jwt_verification: ka.optional()
+	type: e.literal(Ta),
+	jwt_verification: Aa.optional()
 }).extend({
 	id: e.string(),
 	created_at: e.string(),
 	updated_at: e.string()
 }), e.object({
 	name: e.string().min(1).max(255).optional(),
-	subject_token_type: Ea.optional(),
-	jwt_verification: ka.optional()
+	subject_token_type: Da.optional(),
+	jwt_verification: Aa.optional()
 });
-var Aa = e.object({
+var ja = e.object({
 	scim: e.string(),
 	auth0: e.string()
-}), ja = e.object({
+}), Ma = e.object({
 	connection_id: e.string(),
 	user_id_attribute: e.string().default("externalId"),
-	mapping: e.array(Aa).default([])
+	mapping: e.array(ja).default([])
 });
 e.object({
 	created_at: e.string(),
 	updated_at: e.string()
-}).extend(ja.shape);
-var Ma = e.object({
+}).extend(Ma.shape);
+var Na = e.object({
 	token_id: e.string(),
 	connection_id: e.string(),
 	token_hash: e.string(),
@@ -6234,20 +6242,20 @@ var Ma = e.object({
 e.object({
 	created_at: e.string(),
 	last_used_at: e.string().optional()
-}).extend(Ma.shape);
-var Na = e.object({
+}).extend(Na.shape);
+var Pa = e.object({
 	connection_id: e.string(),
 	external_id: e.string(),
 	user_id: e.string()
 });
-e.object({ created_at: e.string() }).extend(Na.shape), e.object({
+e.object({ created_at: e.string() }).extend(Pa.shape), e.object({
 	name: e.string(),
 	enabled: e.boolean().optional().default(!0),
 	default_from_address: e.string().optional(),
 	credentials: e.record(e.string(), e.unknown()),
 	settings: e.object({}).optional()
 });
-var Pa = e.enum([
+var Fa = e.enum([
 	"verify_email",
 	"verify_email_by_code",
 	"reset_email",
@@ -6262,7 +6270,7 @@ var Pa = e.enum([
 	"user_invitation"
 ]);
 e.object({
-	template: Pa,
+	template: Fa,
 	body: e.string(),
 	from: e.string(),
 	subject: e.string(),
@@ -6277,13 +6285,13 @@ e.object({
 	session_id: e.string().optional(),
 	organization: e.string().optional(),
 	auth_connection: e.string().optional(),
-	auth_strategy: Ki.optional(),
+	auth_strategy: qi.optional(),
 	user_id: e.string(),
 	client_id: e.string(),
 	expires_at: e.string().optional(),
 	idle_expires_at: e.string().optional(),
 	last_exchanged_at: e.string().optional(),
-	device: oa,
+	device: sa,
 	resource_servers: e.array(e.object({
 		audience: e.string(),
 		scopes: e.string()
@@ -6304,10 +6312,10 @@ e.object({
 	name: e.string(),
 	options: e.object({})
 });
-var Fa = e.object({
+var Ia = e.object({
 	value: e.string(),
 	description: e.string().optional()
-}), Ia = e.object({
+}), La = e.object({
 	token_dialect: e.enum(["access_token", "access_token_authz"]).optional(),
 	enforce_policies: e.boolean().optional(),
 	allow_skipping_userinfo: e.boolean().optional(),
@@ -6315,11 +6323,11 @@ var Fa = e.object({
 	persist_client_authorization: e.boolean().optional(),
 	enable_introspection_endpoint: e.boolean().optional(),
 	mtls: e.object({ bound_access_tokens: e.boolean().optional() }).optional()
-}), La = e.object({
+}), Ra = e.object({
 	id: e.string().optional(),
 	name: e.string(),
 	identifier: e.string(),
-	scopes: e.array(Fa).optional(),
+	scopes: e.array(Ia).optional(),
 	signing_alg: e.string().optional(),
 	signing_secret: e.string().optional(),
 	token_lifetime: e.number().default(86400),
@@ -6327,20 +6335,20 @@ var Fa = e.object({
 	skip_consent_for_verifiable_first_party_clients: e.boolean().optional(),
 	allow_offline_access: e.boolean().optional(),
 	verificationKey: e.string().optional(),
-	options: Ia.optional(),
+	options: La.optional(),
 	is_system: e.boolean().optional(),
 	metadata: e.record(e.string(), e.any()).optional()
 }).extend({
 	created_at: e.string().optional(),
 	updated_at: e.string().optional()
 });
-e.array(La);
-var Ra = e.object({
+e.array(Ra);
+var za = e.object({
 	role_id: e.string(),
 	resource_server_identifier: e.string(),
 	permission_name: e.string()
 }).extend({ created_at: e.string() });
-e.array(Ra), e.object({
+e.array(za), e.object({
 	user_id: e.string().openapi({ description: "The id of the user that granted the consent" }),
 	clientID: e.string().openapi({ description: "The id of the client the grant was issued to" }),
 	audience: e.string().optional().openapi({ description: "The audience the grant applies to" }),
@@ -6353,7 +6361,7 @@ e.array(Ra), e.object({
 	failed_logins: e.array(e.string()).optional(),
 	last_password_reset: e.string().optional()
 });
-var za = e.object({
+var Ba = e.object({
 	user_id: e.string(),
 	resource_server_identifier: e.string(),
 	permission_name: e.string(),
@@ -6362,8 +6370,8 @@ var za = e.object({
 	tenant_id: e.string(),
 	created_at: e.string().optional()
 });
-e.array(za);
-var Ba = e.object({
+e.array(Ba);
+var Va = e.object({
 	user_id: e.string(),
 	resource_server_identifier: e.string(),
 	resource_server_name: e.string(),
@@ -6372,8 +6380,8 @@ var Ba = e.object({
 	created_at: e.string().optional(),
 	organization_id: e.string().optional()
 });
-e.array(Ba);
-var Va = e.object({
+e.array(Va);
+var Ha = e.object({
 	user_id: e.string(),
 	role_id: e.string(),
 	organization_id: e.string().optional()
@@ -6381,8 +6389,8 @@ var Va = e.object({
 	tenant_id: e.string(),
 	created_at: e.string().optional()
 });
-e.array(Va);
-var Ha = e.object({
+e.array(Ha);
+var Ua = e.object({
 	id: e.string().optional().openapi({ description: "The unique identifier of the role. If not provided, one will be generated." }),
 	name: e.string().min(1).max(50).openapi({ description: "The name of the role. Cannot include '<' or '>'" }),
 	description: e.string().max(255).optional().openapi({ description: "The description of the role" }),
@@ -6393,19 +6401,19 @@ var Ha = e.object({
 	created_at: e.string().optional(),
 	updated_at: e.string().optional()
 });
-e.array(Ha);
-var Ua = e.object({
+e.array(Ua);
+var Wa = e.object({
 	logo_url: e.string().optional().openapi({ description: "URL of the organization's logo" }),
 	colors: e.object({
 		primary: e.string().optional().openapi({ description: "Primary color in hex format (e.g., #FF0000)" }),
 		page_background: e.string().optional().openapi({ description: "Page background color in hex format (e.g., #FFFFFF)" })
 	}).optional()
-}).optional(), Wa = e.object({
+}).optional(), Ga = e.object({
 	connection_id: e.string().openapi({ description: "ID of the connection" }),
 	assign_membership_on_login: e.boolean().default(!1).openapi({ description: "Whether to assign membership to the organization on login" }),
 	show_as_button: e.boolean().default(!0).openapi({ description: "Whether to show this connection as a button in the login screen" }),
 	is_signup_enabled: e.boolean().default(!0).openapi({ description: "Whether signup is enabled for this connection" })
-}), Ga = e.object({ client_credentials: e.object({
+}), Ka = e.object({ client_credentials: e.object({
 	enforce: e.boolean().default(!1).openapi({ description: "Whether to enforce token quota limits" }),
 	per_day: e.number().min(0).default(0).openapi({ description: "Maximum tokens per day (0 = unlimited)" }),
 	per_hour: e.number().min(0).default(0).openapi({ description: "Maximum tokens per hour (0 = unlimited)" })
@@ -6414,15 +6422,15 @@ e.object({
 	id: e.string().optional(),
 	name: e.string().min(1).regex(/^[a-z0-9_-]+$/, { message: "Organization name must be lowercase and can only contain letters, numbers, hyphens, and underscores" }).openapi({ description: "The name of the organization. Must be lowercase and can only contain letters, numbers, hyphens, and underscores." }),
 	display_name: e.string().optional().openapi({ description: "The display name of the organization" }),
-	branding: Ua,
+	branding: Wa,
 	metadata: e.record(e.string(), e.any()).default({}).optional().openapi({ description: "Custom metadata for the organization" }),
-	enabled_connections: e.array(Wa).default([]).optional().openapi({ description: "List of enabled connections for the organization" }),
-	token_quota: Ga
+	enabled_connections: e.array(Ga).default([]).optional().openapi({ description: "List of enabled connections for the organization" }),
+	token_quota: Ka
 }).extend(G.shape).extend({
 	id: e.string(),
 	name: e.string().min(1).openapi({ description: "The name of the organization" })
 });
-var Ka = e.object({
+var qa = e.object({
 	connection_id: e.string().openapi({ description: "ID of the tenant-level connection to enable for the org." }),
 	assign_membership_on_login: e.boolean().optional().default(!1),
 	show_as_button: e.boolean().optional().default(!0),
@@ -6435,7 +6443,7 @@ var Ka = e.object({
 	created_at: e.string().optional(),
 	updated_at: e.string().optional()
 });
-e.array(Ka), e.object({
+e.array(qa), e.object({
 	user_id: e.string().openapi({ description: "ID of the user" }),
 	organization_id: e.string().openapi({ description: "ID of the organization" })
 }).extend(G.shape).extend({ id: e.string() }), e.object({
@@ -6574,7 +6582,7 @@ e.array(Ka), e.object({
 	"passwordless",
 	"enterprise"
 ]);
-var qa = e.object({
+var Ja = e.object({
 	cohort: e.string(),
 	sessions: e.number(),
 	active: e.array(e.number())
@@ -6583,9 +6591,9 @@ e.object({
 	interval: e.literal("week"),
 	from: e.string(),
 	to: e.string(),
-	cohorts: e.array(qa)
+	cohorts: e.array(Ja)
 });
-var Ja = e.object({
+var Ya = e.object({
 	cohort: e.string(),
 	tokens: e.number(),
 	active: e.array(e.number())
@@ -6594,24 +6602,24 @@ e.object({
 	interval: e.literal("week"),
 	from: e.string(),
 	to: e.string(),
-	cohorts: e.array(Ja)
+	cohorts: e.array(Ya)
 });
-var Ya = e.object({
+var Xa = e.object({
 	name: e.string(),
 	type: e.string()
-}), Xa = e.object({
+}), Za = e.object({
 	elapsed: e.number(),
 	rows_read: e.number().optional(),
 	bytes_read: e.number().optional()
 });
 e.object({
-	meta: e.array(Ya),
+	meta: e.array(Xa),
 	data: e.array(e.record(e.string(), e.any())),
 	rows: e.number(),
 	rows_before_limit_at_least: e.number().optional(),
-	statistics: Xa.optional()
+	statistics: Za.optional()
 });
-var Za = e.enum(/* @__PURE__ */ "login.login-id.login-password.signup.signup-id.signup-password.reset-password.consent.mfa.mfa-push.mfa-otp.mfa-voice.mfa-phone.mfa-webauthn.mfa-email.mfa-recovery-code.status.device-flow.email-verification.email-otp-challenge.organizations.invitation.common.passkeys.captcha.custom-form.login-passwordless.mfa-login-options".split(".")), Qa = e.record(e.string(), e.record(e.string(), e.string())).openapi({
+var Qa = e.enum(/* @__PURE__ */ "login.login-id.login-password.signup.signup-id.signup-password.reset-password.consent.mfa.mfa-push.mfa-otp.mfa-voice.mfa-phone.mfa-webauthn.mfa-email.mfa-recovery-code.status.device-flow.email-verification.email-otp-challenge.organizations.invitation.common.passkeys.captcha.custom-form.login-passwordless.mfa-login-options".split(".")), $a = e.record(e.string(), e.record(e.string(), e.string())).openapi({
 	type: "object",
 	additionalProperties: {
 		type: "object",
@@ -6619,11 +6627,23 @@ var Za = e.enum(/* @__PURE__ */ "login.login-id.login-password.signup.signup-id.
 	}
 });
 e.object({
-	prompt: Za,
+	prompt: Qa,
 	language: e.string(),
-	custom_text: Qa
+	custom_text: $a
+});
+var eo = e.object({
+	"form-content-start": e.string().optional(),
+	"form-content-end": e.string().optional(),
+	"form-footer-start": e.string().optional(),
+	"form-footer-end": e.string().optional(),
+	"secondary-actions-start": e.string().optional(),
+	"secondary-actions-end": e.string().optional()
+}).strict(), to = e.record(e.string(), eo);
+e.object({
+	prompt: e.string(),
+	partials: to
 });
-var $a = e.enum([
+var no = e.enum([
 	"phone",
 	"totp",
 	"email",
@@ -6631,9 +6651,9 @@ var $a = e.enum([
 	"webauthn-roaming",
 	"webauthn-platform",
 	"passkey"
-]), eo = e.object({
+]), ro = e.object({
 	user_id: e.string(),
-	type: $a,
+	type: no,
 	phone_number: e.string().optional(),
 	totp_secret: e.string().optional(),
 	credential_id: e.string().optional(),
@@ -6644,7 +6664,7 @@ var $a = e.enum([
 	friendly_name: e.string().optional(),
 	confirmed: e.boolean().default(!1)
 });
-function to(t, n) {
+function io(t, n) {
 	t.type === "phone" && !t.phone_number && n.addIssue({
 		code: e.ZodIssueCode.custom,
 		message: "phone_number is required when type is 'phone'",
@@ -6667,51 +6687,51 @@ function to(t, n) {
 		path: ["public_key"]
 	}));
 }
-eo.superRefine(to), eo.extend({
+ro.superRefine(io), ro.extend({
 	id: e.string(),
 	created_at: e.string(),
 	updated_at: e.string()
-}).superRefine(to), e.object({
+}).superRefine(io), e.object({
 	id: e.string().optional(),
 	created_at: e.string().datetime({ offset: !0 }).optional(),
 	updated_at: e.string().datetime({ offset: !0 }).optional()
 });
-function no(e) {
+function ao(e) {
 	let t = atob(e), n = new Uint8Array(t.length);
 	for (let e = 0; e < t.length; e++) n[e] = t.charCodeAt(e);
 	return n;
 }
 //#endregion
 //#region ../../node_modules/.pnpm/nanoid@5.1.11/node_modules/nanoid/url-alphabet/index.js
-var ro = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict", io = (e = 21) => {
+var oo = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict", so = (e = 21) => {
 	let t = "", n = crypto.getRandomValues(new Uint8Array(e |= 0));
-	for (; e--;) t += ro[n[e] & 63];
+	for (; e--;) t += oo[n[e] & 63];
 	return t;
 };
 //#endregion
 //#region src/helpers.ts
-async function ao(e) {
+async function co(e) {
 	let t = new DecompressionStream("deflate-raw"), n = new Uint8Array(e), r = new Blob([n]).stream().pipeThrough(t);
 	return new Uint8Array(await new Response(r).arrayBuffer());
 }
-async function oo(e) {
-	let t = no(e.replace(/ /g, "+"));
+async function lo(e) {
+	let t = ao(e.replace(/ /g, "+"));
 	try {
-		let e = await ao(t);
+		let e = await co(t);
 		return new TextDecoder().decode(e);
 	} catch (e) {
 		return console.warn("Decompression failed, assuming data is not compressed:", e), new TextDecoder().decode(t);
 	}
 }
-async function so(e) {
-	let t = await oo(e), n = new tn({
+async function uo(e) {
+	let t = await lo(e), n = new tn({
 		attributeNamePrefix: "@_",
 		alwaysCreateTextNode: !0,
 		ignoreAttributes: !1
 	}).parse(t);
 	return r.parse(n);
 }
-function co(e) {
+function fo(e) {
 	let t = e.certificates.map((e) => ({
 		"@_use": "signing",
 		KeyInfo: {
@@ -6785,8 +6805,8 @@ function co(e) {
 		attributeNamePrefix: "@_"
 	}).build(n);
 }
-async function lo(e, t) {
-	let n = e.notBefore || (/* @__PURE__ */ new Date()).toISOString(), r = e.notAfter || new Date(new Date(n).getTime() + 600 * 1e3).toISOString(), i = e.issueInstant || n, a = e.sessionNotOnOrAfter || r, o = e.responseId || `_${io()}`, s = e.assertionId || `_${io()}`, c = [{
+async function po(e, t) {
+	let n = e.notBefore || (/* @__PURE__ */ new Date()).toISOString(), r = e.notAfter || new Date(new Date(n).getTime() + 600 * 1e3).toISOString(), i = e.issueInstant || n, a = e.sessionNotOnOrAfter || r, o = e.responseId || `_${so()}`, s = e.assertionId || `_${so()}`, c = [{
 		"samlp:Response": [
 			{ "saml:Issuer": [{ "#text": e.issuer }] },
 			{ "samlp:Status": [{
@@ -6967,7 +6987,7 @@ async function lo(e, t) {
 }
 //#endregion
 //#region src/signers/local.ts
-var uo = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256", fo = "http://www.w3.org/2001/04/xmlenc#sha256", po = "http://www.w3.org/2001/10/xml-exc-c14n#", mo = class {
+var mo = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256", ho = "http://www.w3.org/2001/04/xmlenc#sha256", go = "http://www.w3.org/2001/10/xml-exc-c14n#", _o = class {
 	async signSAML(e, t, n) {
 		try {
 			let r = await import("xml-crypto"), i = r.SignedXml || r.default?.SignedXml;
@@ -6976,11 +6996,11 @@ var uo = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256", fo = "http://www.w
 				privateKey: t,
 				publicCert: n
 			});
-			a.canonicalizationAlgorithm = po, a.addReference({
+			a.canonicalizationAlgorithm = go, a.addReference({
 				xpath: "(/*[local-name()='Response']/*[local-name()='Assertion'])[1]",
-				digestAlgorithm: fo,
-				transforms: ["http://www.w3.org/2000/09/xmldsig#enveloped-signature", po]
-			}), a.signatureAlgorithm = uo;
+				digestAlgorithm: ho,
+				transforms: ["http://www.w3.org/2000/09/xmldsig#enveloped-signature", go]
+			}), a.signatureAlgorithm = mo;
 			let o = n.replace(/-----BEGIN CERTIFICATE-----|-----END CERTIFICATE-----/g, "").replace(/\s/g, "");
 			return a.keyInfoProvider = { getKeyInfo: () => `<X509Data><X509Certificate>${o}</X509Certificate></X509Data>` }, a.computeSignature(e, { location: {
 				reference: "/*[local-name()='Response']/*[local-name()='Assertion']/*[local-name()='Issuer']",
@@ -6990,7 +7010,7 @@ var uo = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256", fo = "http://www.w
 			throw Error(`Failed to sign SAML locally. Make sure xml-crypto is installed. Error: ${e}`);
 		}
 	}
-}, ho = class {
+}, vo = class {
 	signUrl;
 	constructor(e) {
 		this.signUrl = e;
@@ -7010,4 +7030,4 @@ var uo = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256", fo = "http://www.w
 	}
 };
 //#endregion
-export { ho as HttpSamlSigner, mo as LocalSamlSigner, co as createSamlMetadata, lo as createSamlResponse, s as dsSignatureSchema, oo as inflateDecompress, ao as inflateRaw, so as parseSamlRequestQuery, n as samlIssuerSchema, i as samlMetadataResponseSchema, r as samlRequestSchema, c as samlResponseJsonSchema };
+export { vo as HttpSamlSigner, _o as LocalSamlSigner, fo as createSamlMetadata, po as createSamlResponse, s as dsSignatureSchema, lo as inflateDecompress, co as inflateRaw, uo as parseSamlRequestQuery, n as samlIssuerSchema, i as samlMetadataResponseSchema, r as samlRequestSchema, c as samlResponseJsonSchema };