@tula-tech/contract 0.0.0-stage → 0.1.0-alpha.1

package/dist/index.js

@@ -0,0 +1,3912 @@
+import {
+  ACTIVITY_TYPES2,
+  EVENT_SCHEMA_VERSION2,
+  EVENT_TARGET_TYPES2
+} from "./shared/chunk-7yqzghgm.js";
+import {
+  COMMON_PASSWORDS2,
+  DEFAULT_SPECIAL_CHARS2,
+  normalizePassword2,
+  evaluatePassword2
+} from "./shared/chunk-sc6qg3d2.js";
+import {
+  CUSTOM_CLAIMS_CLAIM2,
+  RESERVED_CLAIM_NAMES2,
+  MAX_CUSTOM_CLAIMS_BYTES2,
+  MAX_JWT_TEMPLATES2,
+  MAX_JWT_TEMPLATE_CLAIMS2,
+  MAX_CUSTOM_CLAIM_KEY_LENGTH2,
+  MAX_CUSTOM_CLAIM_CONSTANT_LENGTH2,
+  isCustomClaimKey2,
+  isCustomClaimValue2,
+  customClaimsBytes2,
+  checkCustomClaims2,
+  readCustomClaims2
+} from "./shared/chunk-4rb5jsfz.js";
+import {
+  DPOP_HEADER2,
+  DPOP_NONCE_HEADER2,
+  DPOP_PROOF_TYPE2,
+  DPOP_ALGORITHMS2,
+  MAX_DPOP_PROOF_LENGTH2,
+  isDevicePublicJwk2,
+  isKeyThumbprint2,
+  jwkThumbprint2,
+  createDpopProof2,
+  generateSoftwareDeviceKey2
+} from "./shared/chunk-4stpmame.js";
+import {
+  EMAIL_TEMPLATE_KINDS2,
+  EMAIL_TEMPLATE_PLACEHOLDERS2,
+  EMAIL_TEMPLATE_DIGIT_PLACEHOLDERS2,
+  EMAIL_TEMPLATE_RULES2,
+  MAX_EMAIL_SUBJECT_LENGTH2,
+  MAX_EMAIL_BODY_LENGTH2,
+  MAX_EMAIL_TEMPLATES_BYTES2,
+  parseEmailTemplate2,
+  emailTemplateParagraphs2,
+  hasHiddenCharacter2,
+  withoutHiddenCharacters2,
+  visibleEmailText2,
+  withoutInvisibleCharacters2,
+  hasInvisibleCharacter2,
+  EMAIL_LINK_SCHEMES2,
+  readsAsLink2,
+  emailTemplateProblems2,
+  isEmailTemplateKind2,
+  emailTemplatesBytes2,
+  readStoredEmailTemplates2,
+  REDIRECT_SCHEMES_NEVER_CUSTOM2,
+  REDIRECT_SCHEME_FAMILIES_NEVER_CUSTOM2,
+  hasForbiddenRedirectCharacter2,
+  redirectUrlKind2,
+  isRedirectUrl2,
+  isCustomSchemeRedirectUrl2,
+  OAUTH_PROVIDERS_WITH_PKCE2,
+  OAUTH_PROVIDERS_WITHOUT_PKCE2,
+  bindsCodeWithPkce2,
+  CUSTOM_SCHEME_REDIRECT_REFUSALS2,
+  customSchemeRedirectRefusal2
+} from "./shared/chunk-r202nxfw.js";
+import {
+  ERROR_DEFINITIONS2,
+  ERROR_CODES2,
+  errorDefinition2
+} from "./shared/chunk-cce3bhet.js";
+import {
+  environmentIssuer2,
+  jwksUrl2
+} from "./shared/chunk-9pvdavrw.js";
+import {
+  PUBLISHABLE_KEY_HEADER2,
+  CLIENT_HEADER2,
+  SESSION_PROFILE_HEADER2,
+  FLOW_ATTEMPT_HEADER2,
+  CAN_STILL_SIGN_IN_HEADER2,
+  CONFIG_MANAGED_BY_HEADER2,
+  CONFIG_HASH_HEADER2,
+  CONFIG_UNMANAGED2,
+  DASHBOARD_HEADER2,
+  DASHBOARD_HEADER_VALUE2,
+  ENVIRONMENT_HEADER2,
+  DASHBOARD_SESSION_COOKIE2,
+  EMAIL_LINK_TOKEN_PARAM2,
+  EMAIL_LINK_ATTEMPT_PARAM2,
+  OAUTH_TICKET_PARAM2,
+  OAUTH_ERROR_PARAM2
+} from "./shared/chunk-q309e9bk.js";
+import {
+  THEME_TOKENS2,
+  DEFAULT_THEME2,
+  darkCssVariable2,
+  isValidThemeValue2,
+  themeToCssVariables2,
+  contrastRatio2
+} from "./shared/chunk-pcn6ax54.js";
+import {
+  WEBHOOK_ID_HEADER2,
+  WEBHOOK_TIMESTAMP_HEADER2,
+  WEBHOOK_SIGNATURE_HEADER2,
+  WEBHOOK_SECRET_PREFIX2,
+  WEBHOOK_SIGNATURE_VERSION2,
+  WEBHOOK_TOLERANCE_SECONDS2,
+  webhookSecretBytes2,
+  formatWebhookSecret2,
+  signWebhook2
+} from "./shared/chunk-2xak18qy.js";
+
+// src/audit.ts
+import { z as z3 } from "zod";
+
+// src/user.ts
+import { z as z2 } from "zod";
+
+// src/passkey.ts
+import { z } from "zod";
+var MAX_PASSKEYS_PER_USER = 10;
+var MAX_PASSKEY_NAME_LENGTH = 64;
+var PASSKEY_CHALLENGE_TTL_MS = 300000;
+var PASSKEY_ALGORITHMS = [-7, -8, -257];
+var Base64Url = z.string().min(1).max(16384).regex(/^[A-Za-z0-9_-]+$/);
+var Transports = z.array(z.string().max(32)).max(16);
+var CredentialDescriptor = z.object({
+  type: z.literal("public-key"),
+  id: z.string(),
+  transports: z.array(z.string()).optional()
+});
+var PasskeySchema = z.object({
+  id: z.string(),
+  name: z.string(),
+  synced: z.boolean(),
+  createdAt: z.iso.datetime(),
+  lastUsedAt: z.iso.datetime().nullable()
+}).meta({ ref: "Passkey" });
+var PasskeyListSchema = z.object({ passkeys: z.array(PasskeySchema) }).meta({ ref: "PasskeyList" });
+var PasskeyCreationOptionsSchema = z.object({
+  rp: z.object({ id: z.string(), name: z.string() }),
+  user: z.object({ id: z.string(), name: z.string(), displayName: z.string() }),
+  challenge: z.string(),
+  pubKeyCredParams: z.array(z.object({ type: z.literal("public-key"), alg: z.number().int() })),
+  timeout: z.number().int(),
+  excludeCredentials: z.array(CredentialDescriptor),
+  authenticatorSelection: z.object({
+    residentKey: z.literal("required"),
+    requireResidentKey: z.literal(true),
+    userVerification: z.literal("required")
+  }),
+  attestation: z.literal("none")
+}).meta({ ref: "PasskeyCreationOptions" });
+var PasskeyRequestOptionsSchema = z.object({
+  challenge: z.string(),
+  timeout: z.number().int(),
+  rpId: z.string(),
+  userVerification: z.literal("required"),
+  allowCredentials: z.array(CredentialDescriptor).optional()
+}).meta({ ref: "PasskeyRequestOptions" });
+var PasskeyRegistrationCredentialSchema = z.looseObject({
+  id: Base64Url.max(1366),
+  rawId: Base64Url.max(1366),
+  type: z.literal("public-key"),
+  response: z.looseObject({
+    clientDataJSON: Base64Url,
+    attestationObject: Base64Url,
+    transports: Transports.optional()
+  })
+}).meta({ ref: "PasskeyRegistrationCredential" });
+var PasskeyAssertionCredentialSchema = z.looseObject({
+  id: Base64Url.max(1366),
+  rawId: Base64Url.max(1366),
+  type: z.literal("public-key"),
+  response: z.looseObject({
+    clientDataJSON: Base64Url,
+    authenticatorData: Base64Url,
+    signature: Base64Url,
+    userHandle: Base64Url.max(128).nullish()
+  })
+}).meta({ ref: "PasskeyAssertionCredential" });
+var PasskeyName = z.string().trim().min(1).max(MAX_PASSKEY_NAME_LENGTH);
+var PasskeyRegisterRequestSchema = z.object({ credential: PasskeyRegistrationCredentialSchema, name: PasskeyName.optional() }).meta({ ref: "PasskeyRegisterRequest" });
+var PasskeyRenameRequestSchema = z.object({ name: PasskeyName }).meta({ ref: "PasskeyRenameRequest" });
+var PasskeySignInRequestSchema = z.object({ credential: PasskeyAssertionCredentialSchema }).meta({ ref: "PasskeySignInRequest" });
+
+// src/user.ts
+var MAX_PAGE_SIZE = 100;
+var DEFAULT_PAGE_SIZE = 20;
+var PaginationMetaSchema = z2.object({
+  totalCount: z2.number().int().min(0),
+  totalPages: z2.number().int().min(0),
+  page: z2.number().int().min(1),
+  perPage: z2.number().int().min(1)
+}).meta({ ref: "PaginationMeta" });
+var UserSchema = z2.object({
+  id: z2.string(),
+  email: z2.string().nullable(),
+  emailVerifiedAt: z2.iso.datetime().nullable(),
+  firstName: z2.string().nullable(),
+  lastName: z2.string().nullable(),
+  bannedAt: z2.iso.datetime().nullable(),
+  lastSignInAt: z2.iso.datetime().nullable(),
+  createdAt: z2.iso.datetime(),
+  phoneNumber: z2.string().nullable().optional(),
+  phoneNumberVerifiedAt: z2.iso.datetime().nullable().optional()
+}).meta({ ref: "User" });
+var CurrentUserSchema = UserSchema.extend({
+  hasPassword: z2.boolean()
+}).meta({ ref: "CurrentUser" });
+var UserAuthenticationSchema = z2.object({
+  hasPassword: z2.boolean(),
+  emailVerified: z2.boolean(),
+  identities: z2.array(z2.object({ provider: z2.string(), linkedAt: z2.iso.datetime() })),
+  factors: z2.array(z2.object({ type: z2.string(), confirmedAt: z2.iso.datetime() })),
+  backupCodesRemaining: z2.number().int().min(0),
+  passkeys: z2.array(PasskeySchema),
+  canSignInWithoutPasskeys: z2.boolean()
+}).meta({ ref: "UserAuthentication" });
+var UserListSchema = z2.object({ meta: PaginationMetaSchema, data: z2.array(UserSchema) }).meta({ ref: "UserList" });
+var UserSortSchema = z2.enum(["createdAt", "-createdAt", "email", "-email", "lastSignInAt", "-lastSignInAt"]).meta({ ref: "UserSort" });
+var CreateUserRequestSchema = z2.object({
+  email: z2.string().max(320),
+  password: z2.string().max(1024).optional(),
+  firstName: z2.string().trim().max(100).optional(),
+  lastName: z2.string().trim().max(100).optional(),
+  emailVerified: z2.boolean().optional()
+}).meta({ ref: "CreateUserRequest" });
+var SetPasswordRequestSchema = z2.object({ password: z2.string().max(1024) }).meta({ ref: "SetPasswordRequest" });
+var ChangePasswordRequestSchema = z2.object({
+  currentPassword: z2.string().max(1024),
+  newPassword: z2.string().max(1024)
+}).meta({ ref: "ChangePasswordRequest" });
+var PhoneNumberRequestSchema = z2.object({ phoneNumber: z2.string().max(64) }).meta({ ref: "PhoneNumberRequest" });
+var PhoneCodeSentSchema = z2.object({
+  destination: z2.string(),
+  expiresAt: z2.iso.datetime()
+}).meta({ ref: "PhoneCodeSent" });
+var PhoneNumberVerifyRequestSchema = z2.object({ code: z2.string().regex(/^\d{6}$/) }).meta({ ref: "PhoneNumberVerifyRequest" });
+var EmailAddressRequestSchema = z2.object({ email: z2.string().max(320) }).meta({ ref: "EmailAddressRequest" });
+var EmailCodeSentSchema = z2.object({
+  destination: z2.string(),
+  expiresAt: z2.iso.datetime()
+}).meta({ ref: "EmailCodeSent" });
+var EmailAddressVerifyRequestSchema = z2.object({ code: z2.string().regex(/^\d{6}$/) }).meta({ ref: "EmailAddressVerifyRequest" });
+var SetUserEmailRequestSchema = z2.strictObject({ email: z2.string().max(320) }).meta({ ref: "SetUserEmailRequest" });
+
+// src/audit.ts
+var ActivityTypeSchema = z3.enum(ACTIVITY_TYPES2).meta({ ref: "ActivityType" });
+var AUDIT_ACTOR_TYPES = ["user", "admin", "system", "agent", "instance_admin"];
+var INSTANCE_ACTIVITY_TYPES = [
+  "instance.signed_in",
+  "instance.sign_in_failed",
+  "instance.signed_out",
+  "workspace.created",
+  "project.created",
+  "project.renamed",
+  "environment.created"
+];
+var InstanceActivityTypeSchema = z3.enum(INSTANCE_ACTIVITY_TYPES).meta({ ref: "InstanceActivityType" });
+var INSTANCE_AUDIT_TARGET_TYPES = ["workspace", "project", "environment"];
+var AUDIT_TARGET_TYPES = [
+  "user",
+  "session",
+  "api_key",
+  "signing_key",
+  "environment",
+  "webhook_endpoint",
+  "hook",
+  "native_app",
+  "proposal"
+];
+var AuditLogSchema = z3.object({
+  id: z3.string(),
+  action: z3.string(),
+  actor: z3.object({
+    type: z3.string(),
+    id: z3.string().nullable()
+  }),
+  target: z3.object({ type: z3.string(), id: z3.string() }).nullable(),
+  ipAddress: z3.string().nullable(),
+  userAgent: z3.string().nullable(),
+  metadata: z3.record(z3.string(), z3.unknown()),
+  occurredAt: z3.iso.datetime()
+}).meta({ ref: "AuditLog" });
+var AuditLogListSchema = z3.object({ meta: PaginationMetaSchema, data: z3.array(AuditLogSchema) }).meta({ ref: "AuditLogList" });
+// src/duration.ts
+import { z as z4 } from "zod";
+var UNIT_MS = { s: 1000, m: 60000, h: 3600000, d: 86400000 };
+var MAX_DURATION_MS = 3650 * UNIT_MS.d;
+var DURATION_PATTERN = /^([1-9]\d{0,6})(s|m|h|d)$/;
+function parse(duration) {
+  const match = DURATION_PATTERN.exec(duration);
+  if (!match) {
+    return null;
+  }
+  const [, amount, unit] = match;
+  const ms = Number(amount) * UNIT_MS[unit];
+  return ms <= MAX_DURATION_MS ? ms : null;
+}
+var DurationSchema = z4.string().refine((value) => parse(value) !== null, {
+  message: 'Use a positive number followed by s, m, h or d, up to 3650d (e.g. "30d")'
+}).meta({ ref: "Duration" });
+function durationToMs(duration) {
+  const ms = parse(duration);
+  if (ms === null) {
+    throw new Error(`Invalid duration "${duration}"`);
+  }
+  return ms;
+}
+// src/email-template-schema.ts
+import { z as z5 } from "zod";
+var EmailTemplateSchema = z5.strictObject({
+  subject: z5.string().max(MAX_EMAIL_SUBJECT_LENGTH2).optional(),
+  body: z5.string().max(MAX_EMAIL_BODY_LENGTH2).optional()
+}).refine((template) => template.subject !== undefined || template.body !== undefined, {
+  message: "a template sets a subject, a body or both"
+}).meta({ ref: "EmailTemplate" });
+var shape = Object.fromEntries(EMAIL_TEMPLATE_KINDS2.map((kind) => [kind, EmailTemplateSchema.optional()]));
+var EmailTemplatesSchema = z5.strictObject(shape).superRefine((templates, context) => {
+  for (const kind of EMAIL_TEMPLATE_KINDS2) {
+    const template = templates[kind];
+    if (template === undefined) {
+      continue;
+    }
+    for (const problem of emailTemplateProblems2(kind, template)) {
+      context.addIssue({
+        code: "custom",
+        path: [kind, problem.field],
+        message: problem.message
+      });
+    }
+  }
+  if (emailTemplatesBytes2(templates) > MAX_EMAIL_TEMPLATES_BYTES2) {
+    context.addIssue({
+      code: "custom",
+      path: [],
+      message: `the templates together must take at most ${MAX_EMAIL_TEMPLATES_BYTES2} bytes`
+    });
+  }
+}).meta({ ref: "EmailTemplates" });
+var EmailSettingsSchema = z5.strictObject({ templates: EmailTemplatesSchema.default({}) }).meta({ ref: "EmailSettings" });
+// src/environment-settings.ts
+import { z as z11 } from "zod";
+
+// src/password-policy.ts
+import { z as z6 } from "zod";
+var MAX_PASSWORD_HISTORY = 24;
+var PasswordPolicySchema = z6.object({
+  preset: z6.enum(["recommended", "strict", "legacy", "custom"]),
+  minLength: z6.number().int().min(1).max(256),
+  maxLength: z6.number().int().min(8).max(1024),
+  requireLowercase: z6.boolean(),
+  requireUppercase: z6.boolean(),
+  requireNumber: z6.boolean(),
+  requireSpecial: z6.boolean(),
+  minCharacterClasses: z6.number().int().min(0).max(4),
+  specialChars: z6.string().min(1),
+  disallowUserInfo: z6.boolean(),
+  disallowCommon: z6.boolean(),
+  breachCheck: z6.enum(["off", "warn", "block"]),
+  maxRepeatedChars: z6.number().int().min(1).nullable(),
+  blockSequences: z6.boolean(),
+  history: z6.number().int().min(0).max(MAX_PASSWORD_HISTORY),
+  expiryDays: z6.number().int().min(1).nullable()
+}).refine((p) => p.maxLength >= p.minLength, {
+  message: "maxLength must be at least minLength",
+  path: ["maxLength"]
+}).meta({ ref: "PasswordPolicy" });
+var BASE = {
+  minLength: 10,
+  maxLength: 128,
+  requireLowercase: false,
+  requireUppercase: false,
+  requireNumber: false,
+  requireSpecial: false,
+  minCharacterClasses: 0,
+  specialChars: DEFAULT_SPECIAL_CHARS2,
+  disallowUserInfo: true,
+  disallowCommon: true,
+  breachCheck: "block",
+  maxRepeatedChars: null,
+  blockSequences: false,
+  history: 0,
+  expiryDays: null
+};
+var PASSWORD_POLICY_PRESETS = {
+  recommended: { ...BASE, preset: "recommended" },
+  strict: {
+    ...BASE,
+    preset: "strict",
+    minLength: 12,
+    requireLowercase: true,
+    requireUppercase: true,
+    requireNumber: true,
+    requireSpecial: true,
+    maxRepeatedChars: 3,
+    blockSequences: true,
+    history: 5
+  },
+  legacy: {
+    ...BASE,
+    preset: "legacy",
+    minLength: 8,
+    requireLowercase: true,
+    requireUppercase: true,
+    requireNumber: true,
+    requireSpecial: true,
+    breachCheck: "warn",
+    expiryDays: 90
+  }
+};
+
+// src/phone.ts
+var MIN_PHONE_NUMBER_DIGITS = 8;
+var MAX_PHONE_NUMBER_DIGITS = 15;
+var E164 = new RegExp(`^\\+[1-9][0-9]{${MIN_PHONE_NUMBER_DIGITS - 1},${MAX_PHONE_NUMBER_DIGITS - 1}}$`);
+var SEPARATORS = /[ ()-]/g;
+function parsePhoneNumber(input) {
+  const number = input.replace(SEPARATORS, "");
+  return E164.test(number) ? number : null;
+}
+function maskPhoneNumber(phoneNumber) {
+  return `***${phoneNumber.slice(-2)}`;
+}
+var COUNTRY_CALLING_PREFIXES = {
+  AD: ["376"],
+  AE: ["971"],
+  AF: ["93"],
+  AG: ["1268"],
+  AI: ["1264"],
+  AL: ["355"],
+  AM: ["374"],
+  AO: ["244"],
+  AR: ["54"],
+  AS: ["1684"],
+  AT: ["43"],
+  AU: ["61"],
+  AW: ["297"],
+  AX: ["358"],
+  AZ: ["994"],
+  BA: ["387"],
+  BB: ["1246"],
+  BD: ["880"],
+  BE: ["32"],
+  BF: ["226"],
+  BG: ["359"],
+  BH: ["973"],
+  BI: ["257"],
+  BJ: ["229"],
+  BL: ["590"],
+  BM: ["1441"],
+  BN: ["673"],
+  BO: ["591"],
+  BQ: ["5993", "5994", "5997"],
+  BR: ["55"],
+  BS: ["1242"],
+  BT: ["975"],
+  BW: ["267"],
+  BY: ["375"],
+  BZ: ["501"],
+  CA: ["1"],
+  CC: ["61"],
+  CD: ["243"],
+  CF: ["236"],
+  CG: ["242"],
+  CH: ["41"],
+  CI: ["225"],
+  CK: ["682"],
+  CL: ["56"],
+  CM: ["237"],
+  CN: ["86"],
+  CO: ["57"],
+  CR: ["506"],
+  CU: ["53"],
+  CV: ["238"],
+  CW: ["5999"],
+  CX: ["61"],
+  CY: ["357"],
+  CZ: ["420"],
+  DE: ["49"],
+  DJ: ["253"],
+  DK: ["45"],
+  DM: ["1767"],
+  DO: ["1809", "1829", "1849"],
+  DZ: ["213"],
+  EC: ["593"],
+  EE: ["372"],
+  EG: ["20"],
+  EH: ["212"],
+  ER: ["291"],
+  ES: ["34"],
+  ET: ["251"],
+  FI: ["358"],
+  FJ: ["679"],
+  FK: ["500"],
+  FM: ["691"],
+  FO: ["298"],
+  FR: ["33"],
+  GA: ["241"],
+  GB: ["44"],
+  GD: ["1473"],
+  GE: ["995"],
+  GF: ["594"],
+  GG: ["44"],
+  GH: ["233"],
+  GI: ["350"],
+  GL: ["299"],
+  GM: ["220"],
+  GN: ["224"],
+  GP: ["590"],
+  GQ: ["240"],
+  GR: ["30"],
+  GT: ["502"],
+  GU: ["1671"],
+  GW: ["245"],
+  GY: ["592"],
+  HK: ["852"],
+  HN: ["504"],
+  HR: ["385"],
+  HT: ["509"],
+  HU: ["36"],
+  ID: ["62"],
+  IE: ["353"],
+  IL: ["972"],
+  IM: ["44"],
+  IN: ["91"],
+  IO: ["246"],
+  IQ: ["964"],
+  IR: ["98"],
+  IS: ["354"],
+  IT: ["39"],
+  JE: ["44"],
+  JM: ["1658", "1876"],
+  JO: ["962"],
+  JP: ["81"],
+  KE: ["254"],
+  KG: ["996"],
+  KH: ["855"],
+  KI: ["686"],
+  KM: ["269"],
+  KN: ["1869"],
+  KP: ["850"],
+  KR: ["82"],
+  KW: ["965"],
+  KY: ["1345"],
+  KZ: ["76", "77"],
+  LA: ["856"],
+  LB: ["961"],
+  LC: ["1758"],
+  LI: ["423"],
+  LK: ["94"],
+  LR: ["231"],
+  LS: ["266"],
+  LT: ["370"],
+  LU: ["352"],
+  LV: ["371"],
+  LY: ["218"],
+  MA: ["212"],
+  MC: ["377"],
+  MD: ["373"],
+  ME: ["382"],
+  MF: ["590"],
+  MG: ["261"],
+  MH: ["692"],
+  MK: ["389"],
+  ML: ["223"],
+  MM: ["95"],
+  MN: ["976"],
+  MO: ["853"],
+  MP: ["1670"],
+  MQ: ["596"],
+  MR: ["222"],
+  MS: ["1664"],
+  MT: ["356"],
+  MU: ["230"],
+  MV: ["960"],
+  MW: ["265"],
+  MX: ["52"],
+  MY: ["60"],
+  MZ: ["258"],
+  NA: ["264"],
+  NC: ["687"],
+  NE: ["227"],
+  NF: ["672"],
+  NG: ["234"],
+  NI: ["505"],
+  NL: ["31"],
+  NO: ["47"],
+  NP: ["977"],
+  NR: ["674"],
+  NU: ["683"],
+  NZ: ["64"],
+  OM: ["968"],
+  PA: ["507"],
+  PE: ["51"],
+  PF: ["689"],
+  PG: ["675"],
+  PH: ["63"],
+  PK: ["92"],
+  PL: ["48"],
+  PM: ["508"],
+  PR: ["1787", "1939"],
+  PS: ["970"],
+  PT: ["351"],
+  PW: ["680"],
+  PY: ["595"],
+  QA: ["974"],
+  RE: ["262"],
+  RO: ["40"],
+  RS: ["381"],
+  RU: ["7"],
+  RW: ["250"],
+  SA: ["966"],
+  SB: ["677"],
+  SC: ["248"],
+  SD: ["249"],
+  SE: ["46"],
+  SG: ["65"],
+  SH: ["290"],
+  SI: ["386"],
+  SJ: ["47"],
+  SK: ["421"],
+  SL: ["232"],
+  SM: ["378"],
+  SN: ["221"],
+  SO: ["252"],
+  SR: ["597"],
+  SS: ["211"],
+  ST: ["239"],
+  SV: ["503"],
+  SX: ["1721"],
+  SY: ["963"],
+  SZ: ["268"],
+  TC: ["1649"],
+  TD: ["235"],
+  TG: ["228"],
+  TH: ["66"],
+  TJ: ["992"],
+  TK: ["690"],
+  TL: ["670"],
+  TM: ["993"],
+  TN: ["216"],
+  TO: ["676"],
+  TR: ["90"],
+  TT: ["1868"],
+  TV: ["688"],
+  TW: ["886"],
+  TZ: ["255"],
+  UA: ["380"],
+  UG: ["256"],
+  US: ["1"],
+  UY: ["598"],
+  UZ: ["998"],
+  VA: ["39"],
+  VC: ["1784"],
+  VE: ["58"],
+  VG: ["1284"],
+  VI: ["1340"],
+  VN: ["84"],
+  VU: ["678"],
+  WF: ["681"],
+  WS: ["685"],
+  XK: ["383"],
+  YE: ["967"],
+  YT: ["262"],
+  ZA: ["27"],
+  ZM: ["260"],
+  ZW: ["263"]
+};
+var SMS_COUNTRIES = Object.keys(COUNTRY_CALLING_PREFIXES).sort();
+var COUNTRIES_BY_PREFIX = (() => {
+  const byPrefix = new Map;
+  for (const country of SMS_COUNTRIES) {
+    for (const prefix of COUNTRY_CALLING_PREFIXES[country] ?? []) {
+      byPrefix.set(prefix, [...byPrefix.get(prefix) ?? [], country]);
+    }
+  }
+  return byPrefix;
+})();
+var LONGEST_PREFIX = Math.max(...[...COUNTRIES_BY_PREFIX.keys()].map((prefix) => prefix.length));
+function isSmsCountry(value) {
+  return Object.hasOwn(COUNTRY_CALLING_PREFIXES, value);
+}
+function phoneNumberCountries(phoneNumber) {
+  const prefix = longestPrefix(phoneNumber);
+  return prefix === null ? [] : COUNTRIES_BY_PREFIX.get(prefix) ?? [];
+}
+function longestPrefix(phoneNumber) {
+  const digits = phoneNumber.replace(/^\+/, "");
+  for (let length = LONGEST_PREFIX;length > 0; length -= 1) {
+    const prefix = digits.slice(0, length);
+    if (COUNTRIES_BY_PREFIX.has(prefix)) {
+      return prefix;
+    }
+  }
+  return null;
+}
+function isPhoneNumberAllowed(phoneNumber, allowedCountries) {
+  return phoneNumberCountries(phoneNumber).some((country) => allowedCountries.includes(country));
+}
+var DEFAULT_SMS_DAILY_MESSAGE_LIMIT = 500;
+var MAX_SMS_DAILY_MESSAGE_LIMIT = 1e6;
+var SMS_PREFIX_MAX_DIGITS = 4;
+function smsPrefixCountries(prefix) {
+  return COUNTRIES_BY_PREFIX.get(prefix.replace(/^\+/, "")) ?? [];
+}
+var SMS_PREFIX_HOURLY_SHARE = 10;
+var SMS_ENVIRONMENT_HOURLY_SHARE = 4;
+function smsCostLimits(dailyMessageLimit) {
+  const perDay = Number.isInteger(dailyMessageLimit) && dailyMessageLimit >= 1 ? dailyMessageLimit : 1;
+  return {
+    prefixPerHour: Math.ceil(perDay / SMS_PREFIX_HOURLY_SHARE),
+    environmentPerHour: Math.ceil(perDay / SMS_ENVIRONMENT_HOURLY_SHARE),
+    perDay
+  };
+}
+function phoneNumberPrefix(phoneNumber) {
+  const prefix = longestPrefix(phoneNumber);
+  return prefix === null ? null : `+${prefix}`;
+}
+
+// src/session-profile.ts
+import { z as z9 } from "zod";
+
+// src/jwt-template.ts
+import { z as z8 } from "zod";
+
+// src/session.ts
+import { z as z7 } from "zod";
+var REFRESH_TOKEN_PREFIX = "tula_rt_";
+var SessionClientSchema = z7.enum(["web", "ios", "android", "server"]).meta({ ref: "SessionClient" });
+var SessionSchema = z7.object({
+  id: z7.string(),
+  client: SessionClientSchema,
+  userAgent: z7.string().nullable(),
+  ipAddress: z7.string().nullable(),
+  createdAt: z7.iso.datetime(),
+  lastActiveAt: z7.iso.datetime(),
+  expiresAt: z7.iso.datetime(),
+  current: z7.boolean(),
+  deviceBound: z7.boolean()
+}).meta({ ref: "Session" });
+var AdminSessionSchema = SessionSchema.extend({
+  userId: z7.string(),
+  active: z7.boolean()
+}).meta({ ref: "AdminSession" });
+var SessionListSchema = z7.object({ data: z7.array(SessionSchema) }).meta({ ref: "SessionList" });
+var RefreshTokenRequestSchema = z7.object({ refreshToken: z7.string().max(512).optional() }).meta({ ref: "RefreshTokenRequest" });
+var MAX_VERIFIED_TOKEN_LENGTH = 4096;
+var VerifySessionRequestSchema = z7.object({ token: z7.string().min(1).max(MAX_VERIFIED_TOKEN_LENGTH) }).meta({ ref: "VerifySessionRequest" });
+var RevokedSessionsSchema = z7.object({ revoked: z7.number().int().min(0) }).meta({ ref: "RevokedSessions" });
+
+// src/jwt-template.ts
+var JWT_TEMPLATE_SOURCES = [
+  "user.email",
+  "user.email_verified",
+  "user.created_at",
+  "session.client",
+  "session.created_at"
+];
+var JwtTemplateSourceSchema = z8.enum(JWT_TEMPLATE_SOURCES).meta({ ref: "JwtTemplateSource" });
+var MAX_EMAIL_LENGTH = 320;
+var MAX_EMAIL_CLAIM_BYTES = 2 * MAX_EMAIL_LENGTH + 2;
+var MAX_BOOLEAN_BYTES = 5;
+var MAX_TIME_BYTES = String(Number.MAX_SAFE_INTEGER).length;
+var MAX_CLIENT_BYTES = Math.max(...SessionClientSchema.options.map((kind) => kind.length)) + 2;
+var SOURCE_MAX_BYTES = {
+  "user.email": MAX_EMAIL_CLAIM_BYTES,
+  "user.email_verified": MAX_BOOLEAN_BYTES,
+  "user.created_at": MAX_TIME_BYTES,
+  "session.client": MAX_CLIENT_BYTES,
+  "session.created_at": MAX_TIME_BYTES
+};
+var UNPRINTABLE = /[\p{Cc}\p{Zl}\p{Zp}]/u;
+var Constant = z8.union([
+  z8.string().max(MAX_CUSTOM_CLAIM_CONSTANT_LENGTH2).refine((value) => !UNPRINTABLE.test(value), {
+    message: "must not contain control characters or line breaks"
+  }),
+  z8.number(),
+  z8.boolean()
+]);
+var JwtTemplateClaimSchema = z8.union([z8.strictObject({ from: JwtTemplateSourceSchema }), z8.strictObject({ value: Constant })]).meta({ ref: "JwtTemplateClaim" });
+var CLAIM_KEY_RULE = `a claim key is ASCII letters, digits and underscores, not starting with a digit, at most ${MAX_CUSTOM_CLAIM_KEY_LENGTH2} characters, and not a reserved claim name`;
+function keyBytes(key) {
+  return customClaimsBytes2({ [key]: 0 }) - 3;
+}
+function valueMaxBytes(claim) {
+  if ("from" in claim) {
+    return SOURCE_MAX_BYTES[claim.from];
+  }
+  const constant = claim.value;
+  return customClaimsBytes2({ k: constant }) - '{"k":}'.length;
+}
+function jwtTemplateMaxBytes(template) {
+  const claims = Object.entries(template.claims);
+  const separators = Math.max(0, claims.length - 1);
+  return claims.reduce((bytes, [key, claim]) => bytes + keyBytes(key) + valueMaxBytes(claim), 2 + separators);
+}
+var fields = {
+  claims: z8.record(z8.string().refine(isCustomClaimKey2, { message: CLAIM_KEY_RULE }), JwtTemplateClaimSchema).default({})
+};
+function fewEnough(template) {
+  return Object.keys(template.claims).length <= MAX_JWT_TEMPLATE_CLAIMS2;
+}
+function smallEnough(template) {
+  return jwtTemplateMaxBytes(template) <= MAX_CUSTOM_CLAIMS_BYTES2;
+}
+var JwtTemplateSchema = z8.strictObject(fields).refine(fewEnough, {
+  message: `at most ${MAX_JWT_TEMPLATE_CLAIMS2} claims`,
+  path: ["claims"]
+}).refine(smallEnough, {
+  message: `the claims could take more than ${MAX_CUSTOM_CLAIMS_BYTES2} bytes`,
+  path: ["claims"]
+}).meta({ ref: "JwtTemplate" });
+function readStoredJwtTemplate(stored) {
+  if (typeof stored !== "object" || stored === null || Array.isArray(stored)) {
+    return null;
+  }
+  const { claims: raw } = stored;
+  const claims = {};
+  if (typeof raw === "object" && raw !== null && !Array.isArray(raw)) {
+    for (const key of Object.keys(raw)) {
+      const claim = JwtTemplateClaimSchema.safeParse(raw[key]);
+      if (isCustomClaimKey2(key) && claim.success) {
+        claims[key] = claim.data;
+      }
+    }
+  }
+  const template = { claims };
+  return fewEnough(template) && smallEnough(template) ? template : null;
+}
+function jwtTemplateOfProfile(settings, profile) {
+  const name = profile.jwtTemplate;
+  if (name === null || !Object.hasOwn(settings.jwtTemplates, name)) {
+    return null;
+  }
+  const template = settings.jwtTemplates[name];
+  return template ? { name, template } : null;
+}
+
+// src/session-profile.ts
+var SessionTypeSchema = z9.enum(["hybrid", "stateful"]).meta({ ref: "SessionType" });
+var MIN_ACCESS_TOKEN_TTL = "30s";
+var MAX_ACCESS_TOKEN_TTL = "15m";
+var MIN_IDLE_TIMEOUT = "1m";
+var MAX_SESSION_TIMEOUT = "365d";
+var MIN_REUSE_GRACE_PERIOD = "10s";
+var MAX_REUSE_GRACE_PERIOD = "60s";
+var MIN_STEP_UP_AFTER = "1m";
+var MAX_STEP_UP_AFTER = "24h";
+var DEFAULT_STEP_UP_AFTER = "10m";
+var MAX_CUSTOM_SESSION_PROFILES = 10;
+var MAX_SESSION_PROFILE_NAME_LENGTH = 32;
+var MAX_SESSIONS_PER_USER = 100;
+var DeviceBindingPolicySchema = z9.enum(["none", "optional", "required"]).meta({ ref: "DeviceBindingPolicy" });
+var BUILT_IN_SESSION_PROFILES = ["web", "mobile"];
+function defaultDeviceBinding(name) {
+  return name === "web" ? "none" : "optional";
+}
+var PROFILE_NAME = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+function isSessionProfileName(name) {
+  return typeof name === "string" && name.length <= MAX_SESSION_PROFILE_NAME_LENGTH && PROFILE_NAME.test(name);
+}
+var SessionProfileNameSchema = z9.string().max(MAX_SESSION_PROFILE_NAME_LENGTH).regex(PROFILE_NAME).meta({ ref: "SessionProfileName" });
+function ms(value) {
+  return DurationSchema.safeParse(value).success ? durationToMs(value) : Number.NaN;
+}
+function within(value, min, max) {
+  return ms(value) >= durationToMs(min) && ms(value) <= durationToMs(max);
+}
+function bounded(min, max) {
+  return DurationSchema.refine((value) => within(value, min, max), {
+    message: `must be between ${min} and ${max}`
+  });
+}
+var profileFields = {
+  type: SessionTypeSchema.default("hybrid"),
+  accessTokenTtl: bounded(MIN_ACCESS_TOKEN_TTL, MAX_ACCESS_TOKEN_TTL).default("60s"),
+  idleTimeout: bounded(MIN_IDLE_TIMEOUT, MAX_SESSION_TIMEOUT).default("7d"),
+  absoluteTimeout: bounded(MIN_IDLE_TIMEOUT, MAX_SESSION_TIMEOUT).nullable().default("30d"),
+  stepUpAfter: bounded(MIN_STEP_UP_AFTER, MAX_STEP_UP_AFTER).nullable().default(null),
+  clientSelectable: z9.boolean().default(false),
+  jwtTemplate: SessionProfileNameSchema.nullable().default(null),
+  deviceBinding: DeviceBindingPolicySchema.default("optional")
+};
+var webProfileFields = {
+  ...profileFields,
+  deviceBinding: DeviceBindingPolicySchema.default("none")
+};
+var refreshFields = {
+  reuseGracePeriod: bounded(MIN_REUSE_GRACE_PERIOD, MAX_REUSE_GRACE_PERIOD).nullable().default("10s")
+};
+var idleWithinAbsolute = {
+  message: "must not be shorter than idleTimeout",
+  path: ["absoluteTimeout"]
+};
+function idleFits(profile) {
+  return profile.absoluteTimeout === null || !(ms(profile.idleTimeout) > ms(profile.absoluteTimeout));
+}
+var accessWithinIdle = {
+  message: "must not be longer than idleTimeout",
+  path: ["accessTokenTtl"]
+};
+function accessFits(profile) {
+  return !(ms(profile.accessTokenTtl) > ms(profile.idleTimeout));
+}
+var SessionProfileSchema = z9.strictObject({ ...profileFields, refresh: z9.strictObject(refreshFields).prefault({}) }).refine(idleFits, idleWithinAbsolute).refine(accessFits, accessWithinIdle).meta({ ref: "SessionProfile" });
+var WebSessionProfileSchema = z9.strictObject({ ...webProfileFields, refresh: z9.strictObject(refreshFields).prefault({}) }).refine(idleFits, idleWithinAbsolute).refine(accessFits, accessWithinIdle).meta({ ref: "WebSessionProfile" });
+var StoredProfile = z9.object({ ...profileFields, refresh: z9.object(refreshFields).prefault({}) }).refine(idleFits, idleWithinAbsolute);
+var StoredWebProfile = z9.object({ ...webProfileFields, refresh: z9.object(refreshFields).prefault({}) }).refine(idleFits, idleWithinAbsolute);
+var DEFAULT_WEB_SESSION_PROFILE = WebSessionProfileSchema.parse({});
+var DEFAULT_MOBILE_SESSION_PROFILE = SessionProfileSchema.parse({});
+var SessionLimitActionSchema = z9.enum(["end_oldest", "refuse_newest"]).meta({ ref: "SessionLimitAction" });
+function isBuiltIn(name) {
+  return BUILT_IN_SESSION_PROFILES.includes(name);
+}
+function customNames(profiles) {
+  return Object.keys(profiles).filter((name) => !isBuiltIn(name));
+}
+var PROFILE_SCHEMAS = {
+  strict: { web: WebSessionProfileSchema, other: SessionProfileSchema },
+  stored: { web: StoredWebProfile, other: StoredProfile }
+};
+function profilesOf(kind) {
+  const { web, other } = PROFILE_SCHEMAS[kind];
+  return z9.object({ web: web.prefault({}), mobile: other.prefault({}) }).catchall(other).refine((profiles) => customNames(profiles).every(isSessionProfileName), {
+    message: `a profile name is lowercase letters, digits and single hyphens, starting with a letter, at most ${MAX_SESSION_PROFILE_NAME_LENGTH} characters`
+  }).refine((profiles) => customNames(profiles).length <= MAX_CUSTOM_SESSION_PROFILES, {
+    message: `at most ${MAX_CUSTOM_SESSION_PROFILES} profiles besides web and mobile`
+  }).refine((profiles) => profiles.mobile.type === "hybrid", {
+    message: "the mobile profile must be hybrid: a stateful session is a browser cookie",
+    path: ["mobile", "type"]
+  });
+}
+var TEMPLATE_NAME_RULE = `a template name is lowercase letters, digits and single hyphens, starting with a letter, at most ${MAX_SESSION_PROFILE_NAME_LENGTH} characters`;
+var JwtTemplates = z9.record(z9.string().refine(isSessionProfileName, { message: TEMPLATE_NAME_RULE }), JwtTemplateSchema).refine((templates) => Object.keys(templates).length <= MAX_JWT_TEMPLATES2, {
+  message: `at most ${MAX_JWT_TEMPLATES2} templates`
+}).default({});
+var StoredJwtTemplates = z9.unknown().optional().transform((stored) => {
+  const templates = {};
+  if (typeof stored !== "object" || stored === null || Array.isArray(stored)) {
+    return templates;
+  }
+  for (const name of Object.keys(stored)) {
+    const template = readStoredJwtTemplate(stored[name]);
+    if (template && isSessionProfileName(name) && Object.keys(templates).length < MAX_JWT_TEMPLATES2) {
+      templates[name] = template;
+    }
+  }
+  return templates;
+});
+function templatesExist(settings, context) {
+  for (const [name, profile] of Object.entries(settings.profiles)) {
+    const { jwtTemplate } = profile;
+    if (jwtTemplate !== null && !jwtTemplateOfProfile(settings, { jwtTemplate })) {
+      context.addIssue({
+        code: "custom",
+        message: "names a JWT template that does not exist",
+        path: ["profiles", name, "jwtTemplate"]
+      });
+    }
+  }
+}
+var limitFields = {
+  maxPerUser: z9.number().int().min(1).max(MAX_SESSIONS_PER_USER).nullable().default(null),
+  onLimit: SessionLimitActionSchema.default("end_oldest")
+};
+var SessionSettingsSchema = z9.strictObject({
+  profiles: profilesOf("strict").prefault({}),
+  ...limitFields,
+  jwtTemplates: JwtTemplates
+}).superRefine(templatesExist).meta({ ref: "SessionSettings" });
+var StoredSessionSettingsSchema = z9.object({
+  profiles: profilesOf("stored").prefault({}),
+  ...limitFields,
+  jwtTemplates: StoredJwtTemplates
+});
+function builtInSessionProfile(client) {
+  return client === "web" ? "web" : "mobile";
+}
+function named(settings, name) {
+  const profile = Object.hasOwn(settings.profiles, name) ? settings.profiles[name] : undefined;
+  return profile ? { name, profile } : null;
+}
+function builtIn(settings, client) {
+  const name = builtInSessionProfile(client);
+  return { name, profile: settings.profiles[name] };
+}
+function resolveSessionProfile(settings, request) {
+  const fallback = builtIn(settings, request.client);
+  if (!request.requested || isBuiltIn(request.requested)) {
+    return fallback;
+  }
+  const asked = named(settings, request.requested);
+  if (!asked?.profile.clientSelectable) {
+    return fallback;
+  }
+  return asked.profile.type === "stateful" && request.client !== "web" ? fallback : asked;
+}
+function profileOfSession(settings, session) {
+  if (isBuiltIn(session.profile)) {
+    return builtIn(settings, session.client);
+  }
+  return named(settings, session.profile) ?? builtIn(settings, session.client);
+}
+function stepUpWindowSeconds(settings, profileName) {
+  const profile = profileName === undefined ? null : named(settings, profileName)?.profile;
+  return durationToMs(profile?.stepUpAfter ?? DEFAULT_STEP_UP_AFTER) / 1000;
+}
+
+// src/sms-template.ts
+var SMS_TEMPLATE_KINDS = ["phone_verification", "sign_in", "second_factor"];
+var SMS_TEMPLATE_PLACEHOLDERS = ["appName", "code"];
+var CODE = { required: ["code"], optional: ["appName"] };
+var SMS_TEMPLATE_RULES = {
+  phone_verification: CODE,
+  sign_in: CODE,
+  second_factor: CODE
+};
+var MAX_SMS_TEMPLATE_LENGTH = 140;
+var UNPRINTABLE2 = /[\p{Cc}\p{Zl}\p{Zp}]/u;
+var DIGIT_RUN = /\p{Nd}{4}/u;
+var CODE_LINE_MARK = /(?:^|[^\p{L}\p{N}])[@#]/u;
+var WORD_CHARACTER = /[\p{L}\p{N}\p{M}]/u;
+var LETTER = /^\p{L}/u;
+var MAX_REPORTED_NAME_LENGTH = 40;
+function smsTemplateProblems(kind, template) {
+  const { text } = template;
+  const rules = SMS_TEMPLATE_RULES[kind];
+  const problem = (code, message, placeholder) => ({
+    field: "text",
+    code,
+    message,
+    ...placeholder !== undefined && { placeholder }
+  });
+  if (text.length > MAX_SMS_TEMPLATE_LENGTH) {
+    return [problem("too_long", `must be at most ${MAX_SMS_TEMPLATE_LENGTH} characters`)];
+  }
+  const seen = withoutInvisibleCharacters2(text);
+  if (seen.trim() === "") {
+    return [problem("empty", "must not be empty")];
+  }
+  if (UNPRINTABLE2.test(text)) {
+    return [problem("control_character", "must be one line, with no control characters")];
+  }
+  if (hasHiddenCharacter2(text)) {
+    return [
+      problem("hidden_character", "must not contain text-direction controls, private-use or unassigned characters, or half a surrogate pair")
+    ];
+  }
+  const tokens = parseEmailTemplate2(seen);
+  if (parseEmailTemplate2(text) === null || tokens === null) {
+    return [
+      problem("malformed_braces", "a brace must be part of a placeholder written as {{name}}, with no space inside")
+    ];
+  }
+  const problems = [];
+  const allowed = new Set([...rules.required, ...rules.optional]);
+  const counts = new Map;
+  for (const token of tokens) {
+    if ("placeholder" in token) {
+      counts.set(token.placeholder, (counts.get(token.placeholder) ?? 0) + 1);
+    }
+  }
+  for (const [written, count] of counts) {
+    if (!allowed.has(written)) {
+      const name = written.length > MAX_REPORTED_NAME_LENGTH ? `${written.slice(0, MAX_REPORTED_NAME_LENGTH)}…` : written;
+      problems.push(problem("unknown_placeholder", `{{${name}}} is not a placeholder of this message`, name));
+    } else if (count > 1) {
+      problems.push(problem("repeated_placeholder", `{{${written}}} must be written only once`, written));
+    }
+  }
+  for (const name of rules.required) {
+    if (!counts.has(name)) {
+      problems.push(problem("missing_placeholder", `the text must contain {{${name}}}`, name));
+    }
+  }
+  const touches = tokens.some((token, index) => {
+    if (!("placeholder" in token)) {
+      return false;
+    }
+    const [before, after] = [tokens[index - 1], tokens[index + 1]];
+    return before !== undefined && (!("text" in before) || WORD_CHARACTER.test(lastOf(before.text))) || after !== undefined && (!("text" in after) || WORD_CHARACTER.test(firstOf(after.text)));
+  });
+  if (touches) {
+    problems.push(problem("placeholder_touches_text", "a placeholder must stand alone: no letter, digit, combining mark or other placeholder directly before or after it"));
+  }
+  const standIns = tokens.map((token) => ("text" in token) ? token.text : "x").join("");
+  if (DIGIT_RUN.test(standIns)) {
+    problems.push(problem("digit_run", "must not contain four or more digits in a row: only the code may"));
+  }
+  if (CODE_LINE_MARK.test(standIns.normalize("NFKC"))) {
+    problems.push(problem("imitates_code_line", "a word must not start with @ or #: that is how the line the server adds is recognised"));
+  }
+  if (readsAsLink2(standIns)) {
+    problems.push(problem("reads_as_link", "must not contain a link, an address or a domain name (put a space after a full stop)"));
+  }
+  const [first] = tokens;
+  if (first === undefined || !("text" in first) || !LETTER.test(first.text)) {
+    problems.push(problem("leading_non_letter", "must start with a letter of its own, not with a placeholder"));
+  }
+  return problems;
+}
+function firstOf(text) {
+  return String.fromCodePoint(text.codePointAt(0) ?? 32);
+}
+function lastOf(text) {
+  return [...text.slice(-2)].at(-1) ?? " ";
+}
+function isSmsTemplateKind(value) {
+  return SMS_TEMPLATE_KINDS.includes(value);
+}
+function readStoredSmsTemplates(stored) {
+  const templates = {};
+  const dropped = [];
+  if (typeof stored !== "object" || stored === null || Array.isArray(stored)) {
+    return { templates, dropped, unknown: stored === undefined || stored === null ? 0 : 1 };
+  }
+  const unknown = Object.keys(stored).filter((key) => !isSmsTemplateKind(key)).length;
+  for (const kind of SMS_TEMPLATE_KINDS) {
+    if (!Object.hasOwn(stored, kind)) {
+      continue;
+    }
+    const written = stored[kind];
+    const text = typeof written === "object" && written !== null && !Array.isArray(written) ? written.text : undefined;
+    if (typeof text === "string" && smsTemplateProblems(kind, { text }).length === 0) {
+      templates[kind] = { text };
+    } else {
+      dropped.push(kind);
+    }
+  }
+  return { templates, dropped, unknown };
+}
+var GSM7_BASIC = `@£$¥èéùìòÇ
+Øø\rÅåΔ_ΦΓΛΩΠΨΣΘΞ ÆæßÉ!"#¤%&'()*+,-./0123456789:;<=>?` + "¡ABCDEFGHIJKLMNOPQRSTUVWXYZÄÖÑܧ¿abcdefghijklmnopqrstuvwxyzäöñüà";
+var GSM7_EXTENDED = "\f^{}\\[~]|€";
+function smsSegments(text) {
+  let septets = 0;
+  let gsm = true;
+  for (const character of text) {
+    if (GSM7_BASIC.includes(character)) {
+      septets += 1;
+    } else if (GSM7_EXTENDED.includes(character)) {
+      septets += 2;
+    } else {
+      gsm = false;
+      break;
+    }
+  }
+  if (gsm) {
+    return {
+      encoding: "gsm7",
+      units: septets,
+      segments: septets <= 160 ? 1 : Math.ceil(septets / 153)
+    };
+  }
+  const units = text.length;
+  return { encoding: "ucs2", units, segments: units <= 70 ? 1 : Math.ceil(units / 67) };
+}
+
+// src/sms-template-schema.ts
+import { z as z10 } from "zod";
+var SmsTemplateSchema = z10.strictObject({ text: z10.string().max(MAX_SMS_TEMPLATE_LENGTH) }).meta({ ref: "SmsTemplate" });
+var shape2 = Object.fromEntries(SMS_TEMPLATE_KINDS.map((kind) => [kind, SmsTemplateSchema.optional()]));
+var SmsTemplatesSchema = z10.strictObject(shape2).superRefine((templates, context) => {
+  for (const kind of SMS_TEMPLATE_KINDS) {
+    const template = templates[kind];
+    if (template === undefined) {
+      continue;
+    }
+    for (const problem of smsTemplateProblems(kind, template)) {
+      context.addIssue({
+        code: "custom",
+        path: [kind, problem.field],
+        message: problem.message
+      });
+    }
+  }
+}).meta({ ref: "SmsTemplates" });
+
+// src/environment-settings.ts
+var DEFAULT_APP_NAME = "Tula";
+var MAX_APP_NAME_LENGTH = 64;
+var MAX_ALLOWED_ORIGINS = 50;
+var MAX_ALLOWED_REDIRECT_URLS = 100;
+var MIN_PASSWORD_MIN_LENGTH = 8;
+var MAX_AUDIT_RETENTION_DAYS = 3650;
+var UNPRINTABLE3 = /[\p{Cc}\p{Zl}\p{Zp}]/u;
+var LABEL = "[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?";
+var HOST = `(?:${LABEL}(?:\\.${LABEL})*|\\[[0-9a-f:.]{2,45}\\])`;
+var PORT = "(?::([1-9][0-9]{0,4}))?";
+var HTTPS_ORIGIN = new RegExp(`^https://${HOST}${PORT}$`);
+var LOOPBACK_ORIGIN = new RegExp(`^http://(?:localhost|127\\.0\\.0\\.1|\\[::1\\])${PORT}$`);
+function isWebOrigin(value) {
+  const matched = HTTPS_ORIGIN.exec(value) ?? LOOPBACK_ORIGIN.exec(value);
+  if (!matched) {
+    return false;
+  }
+  const port = matched[1] === undefined ? null : Number(matched[1]);
+  const defaultPort = value.startsWith("https://") ? 443 : 80;
+  return port === null || port <= 65535 && port !== defaultPort;
+}
+function distinct(values) {
+  return new Set(values).size === values.length;
+}
+var WebOriginSchema = z11.string().max(255).refine(isWebOrigin, {
+  message: "must be an origin such as https://app.example.com (lowercase, no path, no wildcard; http only for localhost)"
+}).meta({ ref: "WebOrigin" });
+var RedirectUrlSchema = z11.string().max(2048).refine(isRedirectUrl2, {
+  message: "must be an absolute https URL (http only for localhost) with no credentials, fragment or wildcard, or a custom scheme with a full stop such as com.example.app:/oauth (no query, no fragment)"
+}).meta({ ref: "RedirectUrl" });
+var App = z11.object({
+  name: z11.string().trim().min(1).max(MAX_APP_NAME_LENGTH).refine((name) => !UNPRINTABLE3.test(name), {
+    message: "must not contain control characters or line breaks"
+  }).default(DEFAULT_APP_NAME),
+  supportEmail: z11.email().max(254).nullable().default(null)
+});
+var AppInput = App.strict().refine((app) => !hasHiddenCharacter2(app.name), {
+  path: ["name"],
+  message: "must not contain text-direction controls, private-use or unassigned characters, or half a surrogate pair"
+});
+var PasswordMethod = z11.object({ enabled: z11.boolean().default(true) });
+var OptionalMethod = z11.object({ enabled: z11.boolean().default(false) });
+var SIGN_IN_METHODS_WITHOUT_SIGN_UP = ["smsCode"];
+var AT_LEAST_ONE_SIGN_IN_METHOD = "at least one sign-in method must stay enabled";
+function hasEnabledSignInMethod(settings) {
+  return Object.entries(settings.signIn.methods).some(([name, method]) => method.enabled && !SIGN_IN_METHODS_WITHOUT_SIGN_UP.includes(name));
+}
+var linkNeedsCode = {
+  message: "emailLink needs emailCode to be enabled as well",
+  path: ["emailLink", "enabled"]
+};
+function linkHasCode(methods) {
+  return !methods.emailLink.enabled || methods.emailCode.enabled;
+}
+var SignUpPasswordModeSchema = z11.enum(["required", "optional"]).meta({ ref: "SignUpPasswordMode" });
+var SignUp = z11.object({
+  password: SignUpPasswordModeSchema.default("required")
+});
+var passwordlessNeedsCode = {
+  message: "an optional sign-up password needs signIn.methods.emailCode to be enabled",
+  path: ["signUp", "password"]
+};
+function passwordlessHasCode(settings) {
+  return settings.signUp.password === "required" || settings.signIn.methods.emailCode.enabled;
+}
+var AllowedOrigins = z11.array(WebOriginSchema).max(MAX_ALLOWED_ORIGINS).refine(distinct, { message: "must not list an origin twice" });
+var Urls = z11.object({
+  allowedOrigins: AllowedOrigins.default([]),
+  allowedRedirectUrls: z11.array(RedirectUrlSchema).max(MAX_ALLOWED_REDIRECT_URLS).refine(distinct, { message: "must not list a URL twice" }).default([])
+});
+var Audit = z11.object({
+  retentionDays: z11.number().int().min(1).max(MAX_AUDIT_RETENTION_DAYS).nullable().default(null)
+});
+var Agents = z11.object({
+  proposalsInProduction: z11.boolean().default(false),
+  testSignIn: z11.boolean().nullable().default(null)
+});
+var Notifications = z11.object({
+  passwordChanged: z11.boolean().default(true),
+  newSignIn: z11.boolean().default(true),
+  mfaChanged: z11.boolean().default(true),
+  identityChanged: z11.boolean().default(true)
+});
+var MfaPolicySchema = z11.enum(["off", "optional", "required"]).meta({ ref: "MfaPolicy" });
+var Mfa = z11.object({
+  policy: MfaPolicySchema.default("optional"),
+  smsCode: z11.object({ enabled: z11.boolean().default(false) }).prefault({})
+});
+var MfaInput = Mfa.extend({
+  smsCode: z11.strictObject({ enabled: z11.boolean().default(false) }).prefault({})
+}).strict();
+var RP_ID = new RegExp(`^(?:localhost|${LABEL}(?:\\.${LABEL})+)$`);
+function isRelyingPartyId(value) {
+  return value.length <= 253 && RP_ID.test(value) && !/(?:^|\.)[0-9]+$/.test(value);
+}
+function originMatchesRelyingParty(origin, rpId) {
+  let host;
+  try {
+    host = new URL(origin).hostname;
+  } catch {
+    return false;
+  }
+  return host === rpId || host.endsWith(`.${rpId}`);
+}
+var Passkeys = z11.object({
+  rpId: z11.string().refine(isRelyingPartyId, {
+    message: "must be a domain such as example.com, or localhost (no scheme, port or path)"
+  }).nullable().default(null)
+});
+var passkeyNeedsRpId = {
+  message: "passkey needs passkeys.rpId to be set",
+  path: ["signIn", "methods", "passkey", "enabled"]
+};
+function passkeyHasRpId(settings) {
+  return !settings.signIn.methods.passkey.enabled || settings.passkeys.rpId !== null;
+}
+var SmsCountrySchema = z11.string().refine(isSmsCountry, {
+  message: "must be an ISO 3166-1 alpha-2 country code in upper case, such as DE"
+}).meta({ ref: "SmsCountry" });
+var SmsCountries = z11.array(SmsCountrySchema).max(SMS_COUNTRIES.length).refine(distinct, { message: "must not list a country twice" });
+var Sms = z11.object({
+  enabled: z11.boolean().default(false),
+  allowedCountries: SmsCountries.default([]),
+  dailyMessageLimit: z11.number().int().min(1).max(MAX_SMS_DAILY_MESSAGE_LIMIT).default(DEFAULT_SMS_DAILY_MESSAGE_LIMIT),
+  templates: SmsTemplatesSchema.default({})
+});
+var password = PasswordPolicySchema.default(PASSWORD_POLICY_PRESETS.recommended);
+var version = z11.literal(1).default(1);
+var SignIn = z11.strictObject({
+  methods: z11.strictObject({
+    password: PasswordMethod.strict().prefault({}),
+    emailCode: OptionalMethod.strict().prefault({}),
+    emailLink: OptionalMethod.strict().prefault({}),
+    passkey: OptionalMethod.strict().prefault({}),
+    smsCode: OptionalMethod.strict().prefault({})
+  }).refine(linkHasCode, linkNeedsCode).prefault({})
+}).prefault({});
+var minLengthFloor = {
+  message: `must be at least ${MIN_PASSWORD_MIN_LENGTH}`,
+  path: ["password", "minLength"]
+};
+var EnvironmentSettingsSchema = z11.strictObject({
+  version,
+  app: App.strict().prefault({}),
+  password,
+  signIn: SignIn,
+  signUp: SignUp.strict().prefault({}),
+  urls: Urls.strict().prefault({}),
+  audit: Audit.strict().prefault({}),
+  agents: Agents.strict().prefault({}),
+  notifications: Notifications.strict().prefault({}),
+  mfa: MfaInput.prefault({}),
+  passkeys: Passkeys.strict().prefault({}),
+  sessions: SessionSettingsSchema.prefault({}),
+  sms: Sms.strict().prefault({}),
+  emails: EmailSettingsSchema.prefault({})
+}).refine((settings) => settings.password.minLength >= MIN_PASSWORD_MIN_LENGTH, minLengthFloor).refine(passwordlessHasCode, passwordlessNeedsCode).refine(passkeyHasRpId, passkeyNeedsRpId).meta({ ref: "EnvironmentSettings" });
+var EnvironmentSettingsInputSchema = z11.strictObject({
+  version,
+  app: AppInput.prefault({}),
+  password: PasswordPolicySchema.optional(),
+  signIn: SignIn,
+  signUp: SignUp.strict().prefault({}),
+  urls: z11.strictObject({
+    allowedOrigins: AllowedOrigins.optional(),
+    allowedRedirectUrls: Urls.shape.allowedRedirectUrls
+  }).prefault({}),
+  audit: Audit.strict().prefault({}),
+  agents: Agents.strict().prefault({}),
+  notifications: Notifications.strict().prefault({}),
+  mfa: MfaInput.prefault({}),
+  passkeys: Passkeys.strict().prefault({}),
+  sessions: SessionSettingsSchema.prefault({}),
+  sms: Sms.strict().prefault({}),
+  emails: EmailSettingsSchema.prefault({})
+}).refine((settings) => settings.password === undefined || settings.password.minLength >= MIN_PASSWORD_MIN_LENGTH, minLengthFloor).refine(passwordlessHasCode, passwordlessNeedsCode).refine(passkeyHasRpId, passkeyNeedsRpId).meta({ ref: "EnvironmentSettingsInput" });
+var Stored = z11.object({
+  version,
+  app: App.prefault({}),
+  password,
+  signIn: z11.object({
+    methods: z11.object({
+      password: PasswordMethod.prefault({}),
+      emailCode: OptionalMethod.prefault({}),
+      emailLink: OptionalMethod.prefault({}),
+      passkey: OptionalMethod.prefault({}),
+      smsCode: OptionalMethod.prefault({})
+    }).prefault({})
+  }).prefault({}),
+  signUp: SignUp.prefault({}),
+  urls: Urls.prefault({}),
+  audit: Audit.prefault({}),
+  agents: Agents.prefault({}),
+  notifications: Notifications.prefault({}),
+  mfa: Mfa.prefault({}),
+  passkeys: Passkeys.prefault({}),
+  sessions: StoredSessionSettingsSchema.prefault({}),
+  sms: Sms.prefault({}),
+  emails: EmailSettingsSchema.prefault({})
+});
+var DEFAULT_ENVIRONMENT_SETTINGS = EnvironmentSettingsSchema.parse({});
+var LIST_RULES = {
+  urls: {
+    allowedOrigins: { entry: WebOriginSchema, max: MAX_ALLOWED_ORIGINS },
+    allowedRedirectUrls: { entry: RedirectUrlSchema, max: MAX_ALLOWED_REDIRECT_URLS }
+  },
+  sms: {
+    allowedCountries: { entry: SmsCountrySchema, max: SMS_COUNTRIES.length }
+  }
+};
+function usable(list, rule) {
+  if (!Array.isArray(list)) {
+    return { kept: [], dropped: 1 };
+  }
+  const kept = new Set;
+  for (const entry of list) {
+    if (kept.size < rule.max && rule.entry.safeParse(entry).success) {
+      kept.add(entry);
+    }
+  }
+  return { kept: [...kept], dropped: list.length - kept.size };
+}
+function readStoredEnvironmentSettings(stored) {
+  if (typeof stored !== "object" || stored === null) {
+    return {
+      settings: Stored.parse(stored),
+      dropped: 0,
+      droppedEmailTemplates: [],
+      unknownEmailTemplates: 0,
+      droppedSmsTemplates: [],
+      unknownSmsTemplates: 0
+    };
+  }
+  const emails = readStoredEmailTemplates2(stored.emails?.templates);
+  const sections = {};
+  let dropped = 0;
+  for (const [name, rules] of Object.entries(LIST_RULES)) {
+    const section = stored[name];
+    if (typeof section !== "object" || section === null) {
+      sections[name] = undefined;
+      continue;
+    }
+    const lists = {};
+    for (const [key, rule] of Object.entries(rules)) {
+      const list = section[key];
+      if (list !== undefined) {
+        const result = usable(list, rule);
+        lists[key] = result.kept;
+        dropped += result.dropped;
+      }
+    }
+    sections[name] = { ...section, ...lists };
+  }
+  const smsSection = sections.sms;
+  const sms = readStoredSmsTemplates(smsSection?.templates);
+  if (smsSection !== undefined) {
+    sections.sms = { ...smsSection, templates: sms.templates };
+  }
+  return {
+    settings: Stored.parse({ ...stored, ...sections, emails: { templates: emails.templates } }),
+    dropped,
+    droppedEmailTemplates: emails.dropped,
+    unknownEmailTemplates: emails.unknown,
+    droppedSmsTemplates: sms.dropped,
+    unknownSmsTemplates: sms.unknown
+  };
+}
+function parseStoredEnvironmentSettings(stored) {
+  return readStoredEnvironmentSettings(stored).settings;
+}
+var CONFIG_TOOL_PATTERN = /^[a-z0-9][a-z0-9._-]{0,31}$/;
+var CONFIG_HASH_PATTERN = /^sha256:[0-9a-f]{64}$/;
+var SettingsManagedBySchema = z11.object({
+  tool: z11.string().regex(CONFIG_TOOL_PATTERN),
+  configHash: z11.string().regex(CONFIG_HASH_PATTERN),
+  at: z11.iso.datetime(),
+  revision: z11.number().int().min(1),
+  drifted: z11.boolean()
+}).meta({ ref: "SettingsManagedBy" });
+var ClientConfigSchema = z11.object({
+  app: z11.object({ name: z11.string(), supportEmail: z11.string().nullable() }),
+  signIn: z11.object({
+    methods: z11.array(z11.string()),
+    oauth: z11.array(z11.string()).optional()
+  }),
+  signUp: z11.object({ password: SignUpPasswordModeSchema }).optional(),
+  password: PasswordPolicySchema,
+  mfa: z11.object({ policy: MfaPolicySchema, smsCode: z11.boolean().optional() }).optional(),
+  phone: z11.object({ enabled: z11.boolean() }).optional()
+}).meta({ ref: "ClientConfig" });
+// src/errors.ts
+import { z as z12 } from "zod";
+var ErrorCodeSchema = z12.enum(ERROR_CODES2).meta({ ref: "ErrorCode" });
+var ErrorParamsSchema = z12.record(z12.string(), z12.union([z12.string(), z12.number(), z12.boolean()])).meta({ ref: "ErrorParams" });
+var FieldErrorSchema = z12.object({
+  field: z12.string(),
+  code: ErrorCodeSchema,
+  message: z12.string(),
+  params: ErrorParamsSchema.optional()
+}).meta({ ref: "FieldError" });
+var ErrorEnvelopeSchema = z12.object({
+  status: z12.number().int(),
+  code: ErrorCodeSchema,
+  detail: z12.string(),
+  params: ErrorParamsSchema.optional(),
+  errors: z12.array(FieldErrorSchema).optional()
+}).meta({ ref: "ErrorEnvelope" });
+// src/event-fixtures.ts
+var USER = "0199c2f4-7a10-7c3e-9b1a-5d2e8f4a6c01";
+var SESSION = "0199c2f4-7a11-7d42-8e0b-1c9a3b7d5e02";
+var API_KEY = "0199c2f4-7a12-7a55-b3c4-6f1e2d8a9b03";
+var ENVIRONMENT = "0199c2f4-7a13-7b66-a4d5-7e2f3c9b0a04";
+var PASSKEY = "0199c2f4-7a14-7c77-95e6-8f3a4d0c1b05";
+var SIGNING_KEY = "0199c2f4-7a15-7d88-86f7-9a4b5e1d2c06";
+var WEBHOOK_ENDPOINT = "0199c2f4-7a18-7abb-99ca-cd7e8b4a5f09";
+var HOOK = "0199c2f4-7a19-7bcc-8adb-de8f9c5b6a10";
+var NATIVE_APP = "0199c2f4-7a1a-7cdd-9bec-ef9a0d6c7b11";
+var PROPOSAL = "0199c2f4-7a1b-7dee-8cfd-f0ab1e7d8c12";
+var AGENT = "0199c2f4-7a1c-7eff-9d0e-01bc2f8e9d13";
+var schemaVersion = EVENT_SCHEMA_VERSION2;
+var occurredAt = "2026-10-08T09:30:00.000Z";
+var user = { type: "user", id: USER };
+var admin = { type: "admin", id: API_KEY };
+var system = { type: "system", id: null };
+var agent = { type: "agent", id: AGENT };
+var aboutUser = { type: "user", id: USER };
+var aboutSession = { type: "session", id: SESSION };
+var aboutApiKey = { type: "api_key", id: API_KEY };
+var aboutEnvironment = { type: "environment", id: ENVIRONMENT };
+var aboutWebhookEndpoint = { type: "webhook_endpoint", id: WEBHOOK_ENDPOINT };
+var aboutHook = { type: "hook", id: HOOK };
+var aboutNativeApp = { type: "native_app", id: NATIVE_APP };
+var aboutProposal = { type: "proposal", id: PROPOSAL };
+var proposed = { operation: "ban_user", targetType: "user", targetId: USER };
+function eventId(n) {
+  return `0199c2f5-0000-7000-8000-${String(n).padStart(12, "0")}`;
+}
+var EVENT_FIXTURES = {
+  "user.created": {
+    id: eventId(1),
+    type: "user.created",
+    schemaVersion,
+    occurredAt,
+    actor: user,
+    target: aboutUser,
+    data: {
+      method: "sign_up",
+      emailVerified: true,
+      passwordless: true,
+      hookBypassed: true,
+      test: true
+    }
+  },
+  "user.email_verified": {
+    id: eventId(2),
+    type: "user.email_verified",
+    schemaVersion,
+    occurredAt,
+    actor: user,
+    target: aboutUser,
+    data: {}
+  },
+  "user.banned": {
+    id: eventId(3),
+    type: "user.banned",
+    schemaVersion,
+    occurredAt,
+    actor: agent,
+    target: aboutUser,
+    data: { proposalId: PROPOSAL, approvedBy: admin }
+  },
+  "user.unbanned": {
+    id: eventId(4),
+    type: "user.unbanned",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutUser,
+    data: {}
+  },
+  "user.deleted": {
+    id: eventId(5),
+    type: "user.deleted",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutUser,
+    data: {}
+  },
+  "user.password_changed": {
+    id: eventId(6),
+    type: "user.password_changed",
+    schemaVersion,
+    occurredAt,
+    actor: user,
+    target: aboutUser,
+    data: { method: "email_verification", created: false, removed: true }
+  },
+  "user.mfa_enabled": {
+    id: eventId(7),
+    type: "user.mfa_enabled",
+    schemaVersion,
+    occurredAt,
+    actor: user,
+    target: aboutUser,
+    data: { method: "totp" }
+  },
+  "user.mfa_disabled": {
+    id: eventId(8),
+    type: "user.mfa_disabled",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutUser,
+    data: { method: "admin_reset" }
+  },
+  "user.backup_codes_regenerated": {
+    id: eventId(9),
+    type: "user.backup_codes_regenerated",
+    schemaVersion,
+    occurredAt,
+    actor: user,
+    target: aboutUser,
+    data: {}
+  },
+  "user.backup_code_used": {
+    id: eventId(10),
+    type: "user.backup_code_used",
+    schemaVersion,
+    occurredAt,
+    actor: user,
+    target: aboutUser,
+    data: {}
+  },
+  "user.identity_linked": {
+    id: eventId(11),
+    type: "user.identity_linked",
+    schemaVersion,
+    occurredAt,
+    actor: user,
+    target: aboutUser,
+    data: { provider: "google", method: "auto" }
+  },
+  "user.identity_unlinked": {
+    id: eventId(12),
+    type: "user.identity_unlinked",
+    schemaVersion,
+    occurredAt,
+    actor: user,
+    target: aboutUser,
+    data: { provider: "github" }
+  },
+  "user.passkey_added": {
+    id: eventId(13),
+    type: "user.passkey_added",
+    schemaVersion,
+    occurredAt,
+    actor: user,
+    target: aboutUser,
+    data: { passkeyId: PASSKEY, synced: true }
+  },
+  "user.passkey_renamed": {
+    id: eventId(14),
+    type: "user.passkey_renamed",
+    schemaVersion,
+    occurredAt,
+    actor: user,
+    target: aboutUser,
+    data: { passkeyId: PASSKEY }
+  },
+  "user.passkey_removed": {
+    id: eventId(15),
+    type: "user.passkey_removed",
+    schemaVersion,
+    occurredAt,
+    actor: user,
+    target: aboutUser,
+    data: { passkeyId: PASSKEY, method: "user" }
+  },
+  "user.passkey_counter_regressed": {
+    id: eventId(16),
+    type: "user.passkey_counter_regressed",
+    schemaVersion,
+    occurredAt,
+    actor: system,
+    target: aboutUser,
+    data: { passkeyId: PASSKEY }
+  },
+  "user.email_added": {
+    id: eventId(44),
+    type: "user.email_added",
+    schemaVersion,
+    occurredAt,
+    actor: user,
+    target: aboutUser,
+    data: { method: "self", verified: true }
+  },
+  "user.phone_number_added": {
+    id: eventId(36),
+    type: "user.phone_number_added",
+    schemaVersion,
+    occurredAt,
+    actor: user,
+    target: aboutUser,
+    data: {}
+  },
+  "user.phone_number_removed": {
+    id: eventId(37),
+    type: "user.phone_number_removed",
+    schemaVersion,
+    occurredAt,
+    actor: user,
+    target: aboutUser,
+    data: {}
+  },
+  "user.sms_factor_enabled": {
+    id: eventId(39),
+    type: "user.sms_factor_enabled",
+    schemaVersion,
+    occurredAt,
+    actor: user,
+    target: aboutUser,
+    data: {}
+  },
+  "user.sms_factor_removed": {
+    id: eventId(40),
+    type: "user.sms_factor_removed",
+    schemaVersion,
+    occurredAt,
+    actor: user,
+    target: aboutUser,
+    data: { method: "phone_number_removed" }
+  },
+  "session.created": {
+    id: eventId(17),
+    type: "session.created",
+    schemaVersion,
+    occurredAt,
+    actor: user,
+    target: aboutSession,
+    data: {
+      userId: USER,
+      client: "web",
+      hookBypassed: true,
+      claimsHookBypassed: true,
+      deviceBound: true
+    }
+  },
+  "session.revoked": {
+    id: eventId(18),
+    type: "session.revoked",
+    schemaVersion,
+    occurredAt,
+    actor: user,
+    target: aboutSession,
+    data: { userId: USER, reason: "sign_out" }
+  },
+  "session.reuse_detected": {
+    id: eventId(19),
+    type: "session.reuse_detected",
+    schemaVersion,
+    occurredAt,
+    actor: system,
+    target: aboutSession,
+    data: { userId: USER, reason: "reuse_detected" }
+  },
+  "session.stepped_up": {
+    id: eventId(20),
+    type: "session.stepped_up",
+    schemaVersion,
+    occurredAt,
+    actor: user,
+    target: aboutSession,
+    data: { userId: USER, methods: ["otp", "mfa"], claimsHookBypassed: true }
+  },
+  "api_key.created": {
+    id: eventId(21),
+    type: "api_key.created",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutApiKey,
+    data: { kind: "secret" }
+  },
+  "api_key.revoked": {
+    id: eventId(22),
+    type: "api_key.revoked",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutApiKey,
+    data: {}
+  },
+  "signing_key.rotated": {
+    id: eventId(23),
+    type: "signing_key.rotated",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: { type: "signing_key", id: SIGNING_KEY },
+    data: {
+      retiredKeyId: "0199c2f4-7a16-7e99-97a8-ab5c6f2e3d07",
+      nextKeyId: "0199c2f4-7a17-7faa-88b9-bc6d7a3f4e08"
+    }
+  },
+  "environment.settings_updated": {
+    id: eventId(24),
+    type: "environment.settings_updated",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutEnvironment,
+    data: {
+      revision: 4,
+      changed: ["password.minLength", "urls.allowedOrigins"],
+      weakened: true,
+      managedBy: "tula-apply",
+      outsideConfig: false
+    }
+  },
+  "oauth_provider.updated": {
+    id: eventId(25),
+    type: "oauth_provider.updated",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutEnvironment,
+    data: {
+      provider: "google",
+      changed: ["clientId", "secret", "additionalClientIds", "enabled"],
+      created: true,
+      additionalClientIdCount: 2,
+      weakened: true,
+      dependentAccounts: 12,
+      dependentAccountsIncomplete: true
+    }
+  },
+  "oauth_provider.deleted": {
+    id: eventId(26),
+    type: "oauth_provider.deleted",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutEnvironment,
+    data: {
+      provider: "apple",
+      weakened: true,
+      dependentAccounts: 3,
+      dependentAccountsIncomplete: true
+    }
+  },
+  "webhook_endpoint.created": {
+    id: eventId(27),
+    type: "webhook_endpoint.created",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutWebhookEndpoint,
+    data: { eventTypes: 3, enabled: true }
+  },
+  "webhook_endpoint.updated": {
+    id: eventId(28),
+    type: "webhook_endpoint.updated",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutWebhookEndpoint,
+    data: { changed: ["url", "eventTypes", "enabled"] }
+  },
+  "webhook_endpoint.deleted": {
+    id: eventId(29),
+    type: "webhook_endpoint.deleted",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutWebhookEndpoint,
+    data: {}
+  },
+  "webhook_endpoint.disabled": {
+    id: eventId(30),
+    type: "webhook_endpoint.disabled",
+    schemaVersion,
+    occurredAt,
+    actor: system,
+    target: aboutWebhookEndpoint,
+    data: { reason: "failing" }
+  },
+  "webhook_endpoint.secret_rotated": {
+    id: eventId(31),
+    type: "webhook_endpoint.secret_rotated",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutWebhookEndpoint,
+    data: { rotationOverlapEndsAt: "2026-10-09T09:30:00.000Z" }
+  },
+  "webhook_endpoint.previous_secret_revoked": {
+    id: eventId(32),
+    type: "webhook_endpoint.previous_secret_revoked",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutWebhookEndpoint,
+    data: {}
+  },
+  "hook.created": {
+    id: eventId(33),
+    type: "hook.created",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutHook,
+    data: { point: "before_sign_up", enabled: true, failureMode: "allow", weakened: true }
+  },
+  "hook.updated": {
+    id: eventId(34),
+    type: "hook.updated",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutHook,
+    data: { point: "before_sign_up", changed: ["enabled", "failureMode"], weakened: true }
+  },
+  "hook.deleted": {
+    id: eventId(35),
+    type: "hook.deleted",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutHook,
+    data: { point: "before_sign_up", weakened: true }
+  },
+  "native_app.created": {
+    id: eventId(36),
+    type: "native_app.created",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutNativeApp,
+    data: { platform: "android", fingerprints: 1, appLinkPaths: 1, weakened: true }
+  },
+  "native_app.updated": {
+    id: eventId(37),
+    type: "native_app.updated",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutNativeApp,
+    data: {
+      platform: "android",
+      changed: ["sha256CertFingerprints"],
+      fingerprints: 2,
+      appLinkPaths: 1,
+      weakened: true
+    }
+  },
+  "native_app.deleted": {
+    id: eventId(38),
+    type: "native_app.deleted",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutNativeApp,
+    data: { platform: "android" }
+  },
+  "session.refresh_proof_refused": {
+    id: eventId(39),
+    type: "session.refresh_proof_refused",
+    schemaVersion,
+    occurredAt,
+    actor: system,
+    target: aboutSession,
+    data: { userId: USER, reason: "wrong_key", suppressedInPreviousMinute: 3 }
+  },
+  "proposal.created": {
+    id: eventId(40),
+    type: "proposal.created",
+    schemaVersion,
+    occurredAt,
+    actor: agent,
+    target: aboutProposal,
+    data: proposed
+  },
+  "proposal.approved": {
+    id: eventId(41),
+    type: "proposal.approved",
+    schemaVersion,
+    occurredAt,
+    actor: admin,
+    target: aboutProposal,
+    data: { ...proposed, proposedBy: AGENT }
+  },
+  "proposal.executed": {
+    id: eventId(42),
+    type: "proposal.executed",
+    schemaVersion,
+    occurredAt,
+    actor: agent,
+    target: aboutProposal,
+    data: { ...proposed, approvedBy: admin, changed: true }
+  },
+  "proposal.failed": {
+    id: eventId(43),
+    type: "proposal.failed",
+    schemaVersion,
+    occurredAt,
+    actor: agent,
+    target: aboutProposal,
+    data: { ...proposed, approvedBy: admin, reason: "target_not_found" }
+  },
+  "sign_in_test.started": {
+    id: eventId(44),
+    type: "sign_in_test.started",
+    schemaVersion,
+    occurredAt,
+    actor: agent,
+    target: aboutEnvironment,
+    data: {}
+  },
+  "sign_in_test.finished": {
+    id: eventId(45),
+    type: "sign_in_test.finished",
+    schemaVersion,
+    occurredAt,
+    actor: agent,
+    target: aboutEnvironment,
+    data: { outcome: "passed", cleanup: "deleted", userId: USER }
+  }
+};
+// src/events.ts
+import { z as z20 } from "zod";
+
+// src/hook.ts
+import { z as z16 } from "zod";
+
+// src/oauth.ts
+import { z as z14 } from "zod";
+
+// src/flow.ts
+import { z as z13 } from "zod";
+var SecondFactorMethodSchema = z13.enum(["totp", "passkey", "backup_code", "sms_code"]).meta({ ref: "SecondFactorMethod" });
+var PreparedSecondFactorMethodSchema = z13.enum(["sms_code"]).meta({ ref: "PreparedSecondFactorMethod" });
+var FirstFactorStrategySchema = z13.enum([
+  "password",
+  "email_code",
+  "email_link",
+  "passkey",
+  "sms_code",
+  "oauth_google",
+  "oauth_github",
+  "oauth_apple",
+  "oauth_microsoft",
+  "oauth_discord",
+  "oauth_linkedin",
+  "oauth_x",
+  "oauth_facebook"
+]).meta({ ref: "FirstFactorStrategy" });
+var FactorEnrolmentMethodSchema = z13.enum(["totp"]).meta({ ref: "FactorEnrolmentMethod" });
+var EmailVerificationStrategySchema = z13.enum(["email_code", "email_link"]).meta({ ref: "EmailVerificationStrategy" });
+var PreparedFirstFactorStrategySchema = z13.enum(["email_code", "email_link", "sms_code"]).meta({ ref: "PreparedFirstFactorStrategy" });
+var NewPasswordReasonSchema = z13.enum(["expired"]).meta({ ref: "NewPasswordReason" });
+var FlowStepSchema = z13.discriminatedUnion("status", [
+  z13.object({ status: z13.literal("needs_identifier") }),
+  z13.object({ status: z13.literal("needs_password") }),
+  z13.object({
+    status: z13.literal("needs_first_factor"),
+    strategies: z13.array(FirstFactorStrategySchema).min(1),
+    prepared: z13.object({ strategy: PreparedFirstFactorStrategySchema, destination: z13.string() }).optional()
+  }),
+  z13.object({
+    status: z13.literal("needs_email_verification"),
+    destination: z13.string(),
+    strategies: z13.array(EmailVerificationStrategySchema).min(1)
+  }),
+  z13.object({
+    status: z13.literal("needs_new_password"),
+    destination: z13.string(),
+    strategies: z13.array(EmailVerificationStrategySchema),
+    reason: NewPasswordReasonSchema.optional()
+  }).refine((step) => step.reason === undefined === step.strategies.length > 0, {
+    message: "strategies is empty exactly when a reason is given",
+    path: ["strategies"]
+  }),
+  z13.object({
+    status: z13.literal("needs_second_factor"),
+    options: z13.array(SecondFactorMethodSchema).min(1),
+    prepared: z13.object({ method: PreparedSecondFactorMethodSchema, destination: z13.string() }).optional()
+  }),
+  z13.object({
+    status: z13.literal("needs_factor_enrolment"),
+    methods: z13.array(FactorEnrolmentMethodSchema).min(1)
+  }),
+  z13.object({
+    status: z13.literal("complete"),
+    userId: z13.string(),
+    sessionId: z13.string()
+  })
+]).meta({ ref: "FlowStep" });
+var FlowKindSchema = z13.enum(["sign_in", "sign_up", "password_reset"]).meta({ ref: "FlowKind" });
+var SessionTokensSchema = z13.object({
+  sessionId: z13.string(),
+  accessToken: z13.string().optional(),
+  accessTokenExpiresAt: z13.iso.datetime().optional(),
+  refreshToken: z13.string().optional()
+}).meta({ ref: "SessionTokens" });
+var FlowAttemptSchema = z13.object({
+  id: z13.string(),
+  kind: FlowKindSchema,
+  expiresAt: z13.iso.datetime(),
+  step: FlowStepSchema,
+  attemptSecret: z13.string().optional(),
+  linkBinding: z13.string().optional(),
+  session: SessionTokensSchema.optional(),
+  backupCodes: z13.array(z13.string()).optional(),
+  backupCodesRemaining: z13.number().int().min(0).optional()
+}).meta({ ref: "FlowAttempt" });
+var SignUpRequestSchema = z13.object({
+  email: z13.string().max(320),
+  password: z13.string().max(1024).optional(),
+  firstName: z13.string().trim().max(100).optional(),
+  lastName: z13.string().trim().max(100).optional()
+}).meta({ ref: "SignUpRequest" });
+var SignInStartRequestSchema = z13.object({ identifier: z13.string().max(320) }).meta({ ref: "SignInStartRequest" });
+var PasswordAttemptRequestSchema = z13.object({ password: z13.string().max(1024) }).meta({ ref: "PasswordAttemptRequest" });
+var MAX_LINK_FIELD_LENGTH = 2048;
+var FirstFactorPrepareRequestSchema = z13.object({
+  strategy: PreparedFirstFactorStrategySchema,
+  redirectUrl: z13.string().max(MAX_LINK_FIELD_LENGTH).optional()
+}).meta({ ref: "FirstFactorPrepareRequest" });
+var FirstFactorAttemptRequestSchema = z13.discriminatedUnion("strategy", [
+  z13.object({ strategy: z13.literal("email_code"), code: z13.string().regex(/^\d{6}$/) }),
+  z13.object({ strategy: z13.literal("email_link") }),
+  z13.object({ strategy: z13.literal("sms_code"), code: z13.string().regex(/^\d{6}$/) })
+]).meta({ ref: "FirstFactorAttemptRequest" });
+var EmailLinkRequestSchema = z13.object({
+  token: z13.string().min(1).max(MAX_LINK_FIELD_LENGTH),
+  attemptId: z13.uuid(),
+  binding: z13.string().max(MAX_LINK_FIELD_LENGTH).optional()
+}).meta({ ref: "EmailLinkRequest" });
+var EmailLinkResultSchema = z13.object({ status: z13.literal("verified") }).meta({ ref: "EmailLinkResult" });
+var VerifyEmailRequestSchema = z13.object({ code: z13.string().regex(/^\d{6}$/) }).meta({ ref: "VerifyEmailRequest" });
+var MAX_BACKUP_CODE_INPUT_LENGTH = 64;
+var SecondFactorRequestSchema = z13.discriminatedUnion("method", [
+  z13.object({ method: z13.literal("totp"), code: z13.string().regex(/^\d{6}$/) }),
+  z13.object({ method: z13.literal("sms_code"), code: z13.string().regex(/^\d{6}$/) }),
+  z13.object({
+    method: z13.literal("backup_code"),
+    code: z13.string().min(1).max(MAX_BACKUP_CODE_INPUT_LENGTH)
+  }),
+  z13.object({ method: z13.literal("passkey"), credential: PasskeyAssertionCredentialSchema })
+]).meta({ ref: "SecondFactorRequest" });
+var SecondFactorPrepareRequestSchema = z13.object({ method: PreparedSecondFactorMethodSchema }).meta({ ref: "SecondFactorPrepareRequest" });
+var PasskeySignInStartSchema = z13.object({ attempt: FlowAttemptSchema, options: PasskeyRequestOptionsSchema }).meta({ ref: "PasskeySignInStart" });
+var PasswordResetStartRequestSchema = z13.object({ email: z13.string().max(320) }).meta({ ref: "PasswordResetStartRequest" });
+var PasswordResetRequestSchema = z13.object({ code: z13.string().regex(/^\d{6}$/), password: z13.string().max(1024) }).meta({ ref: "PasswordResetRequest" });
+var NewPasswordRequestSchema = z13.object({ password: z13.string().max(1024) }).meta({ ref: "NewPasswordRequest" });
+
+// src/oauth.ts
+var OAUTH_PROVIDERS = [
+  "google",
+  "github",
+  "apple",
+  "microsoft",
+  "discord",
+  "linkedin",
+  "x",
+  "facebook"
+];
+var OAuthProviderSchema = z14.enum(OAUTH_PROVIDERS).meta({ ref: "OAuthProvider" });
+var OAUTH_PROVIDERS_WITHOUT_ADDRESS = [
+  "x",
+  "facebook"
+];
+function givesNoAddress(provider) {
+  return OAUTH_PROVIDERS_WITHOUT_ADDRESS.includes(provider);
+}
+var MICROSOFT_TENANT_ALIASES = ["common", "organizations", "consumers"];
+var GUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+var MicrosoftTenantSchema = z14.string().trim().toLowerCase().refine((value) => MICROSOFT_TENANT_ALIASES.includes(value) || GUID.test(value), { message: "must be common, organizations, consumers or a tenant id (a GUID)" }).meta({ ref: "MicrosoftTenant" });
+var ID_TOKEN_PROVIDERS = [
+  "google",
+  "apple"
+];
+var ID_TOKEN_CLIENT_KINDS = {
+  google: ["ios", "android"],
+  apple: ["ios"]
+};
+function takesAdditionalClientIds(provider) {
+  return provider === "google";
+}
+var IdTokenProviderSchema = z14.enum(ID_TOKEN_PROVIDERS).meta({ ref: "IdTokenProvider" });
+var MAX_ADDITIONAL_CLIENT_IDS = 8;
+var GOOGLE_CLIENT_ID = /^[0-9]{1,32}(-[0-9a-z]{1,64})?\.apps\.googleusercontent\.com$/;
+function isGoogleClientId(value) {
+  return value.length <= 128 && GOOGLE_CLIENT_ID.test(value);
+}
+var AdditionalClientIdsSchema = z14.array(z14.string().refine(isGoogleClientId, {
+  message: "must be a Google OAuth client id (…apps.googleusercontent.com)"
+})).max(MAX_ADDITIONAL_CLIENT_IDS).refine((ids) => new Set(ids).size === ids.length, { message: "must not repeat a client id" }).meta({ ref: "AdditionalClientIds" });
+function ownClientIdAmong(clientId, additionalClientIds) {
+  return additionalClientIds.indexOf(clientId);
+}
+var DEPENDENT_ACCOUNTS_SCAN_LIMIT = 1000;
+var OAuthProviderDependentsSchema = z14.object({
+  provider: OAuthProviderSchema,
+  accounts: z14.number().int().min(0).max(DEPENDENT_ACCOUNTS_SCAN_LIMIT),
+  more: z14.boolean()
+}).meta({ ref: "OAuthProviderDependents" });
+function oauthProviderWeakenings(before, after) {
+  const weakened = [];
+  const had = new Set(before?.additionalClientIds ?? []);
+  if ((after?.additionalClientIds ?? []).some((id) => !had.has(id))) {
+    weakened.push("additionalClientIds");
+  }
+  const dependents = before?.dependents;
+  if (before?.enabled === true && (after === null || after.enabled === false) && dependents !== undefined && (dependents.accounts > 0 || dependents.more)) {
+    weakened.push("enabled");
+  }
+  return weakened;
+}
+var MAX_ID_TOKEN_LENGTH = 8192;
+var MAX_ID_TOKEN_NAME_LENGTH = 100;
+var IdTokenStartRequestSchema = z14.strictObject({ provider: IdTokenProviderSchema }).meta({ ref: "IdTokenStartRequest" });
+var IdTokenStartSchema = z14.object({ attempt: FlowAttemptSchema, nonce: z14.string() }).meta({ ref: "IdTokenStart" });
+var IdTokenExchangeRequestSchema = z14.strictObject({
+  idToken: z14.string().min(1).max(MAX_ID_TOKEN_LENGTH),
+  givenName: z14.string().max(MAX_ID_TOKEN_NAME_LENGTH).optional(),
+  familyName: z14.string().max(MAX_ID_TOKEN_NAME_LENGTH).optional()
+}).meta({ ref: "IdTokenExchangeRequest" });
+var MAX_OAUTH_FIELD_LENGTH = 2048;
+var OAuthStartRequestSchema = z14.object({
+  provider: OAuthProviderSchema,
+  redirectUrl: z14.string().max(MAX_OAUTH_FIELD_LENGTH)
+}).meta({ ref: "OAuthStartRequest" });
+var OAuthStartSchema = z14.object({
+  attempt: FlowAttemptSchema,
+  authorizationUrl: z14.url(),
+  binding: z14.string()
+}).meta({ ref: "OAuthStart" });
+var OAuthExchangeRequestSchema = z14.object({
+  ticket: z14.string().min(1).max(MAX_OAUTH_FIELD_LENGTH),
+  attemptId: z14.uuid(),
+  binding: z14.string().max(MAX_OAUTH_FIELD_LENGTH).optional()
+}).meta({ ref: "OAuthExchangeRequest" });
+var IdentitySchema = z14.object({
+  id: z14.string(),
+  provider: z14.string(),
+  createdAt: z14.iso.datetime()
+}).meta({ ref: "Identity" });
+var IdentityListSchema = z14.object({ data: z14.array(IdentitySchema) }).meta({ ref: "IdentityList" });
+var IdentityLinkStartSchema = z14.object({
+  attemptId: z14.string(),
+  expiresAt: z14.iso.datetime(),
+  authorizationUrl: z14.url(),
+  binding: z14.string()
+}).meta({ ref: "IdentityLinkStart" });
+var OAuthProviderSettingsSchema = z14.object({
+  provider: OAuthProviderSchema,
+  configured: z14.boolean(),
+  enabled: z14.boolean(),
+  clientId: z14.string().nullable(),
+  teamId: z14.string().nullable(),
+  keyId: z14.string().nullable(),
+  tenant: z14.string().nullable(),
+  additionalClientIds: z14.array(z14.string()).default([]),
+  callbackUrl: z14.url(),
+  updatedAt: z14.iso.datetime().nullable()
+}).meta({ ref: "OAuthProviderSettings" });
+var OAuthProviderSettingsListSchema = z14.object({ data: z14.array(OAuthProviderSettingsSchema) }).meta({ ref: "OAuthProviderSettingsList" });
+var credential = (max) => z14.string().trim().min(1).max(max);
+var OAuthProviderUpdateSchema = z14.strictObject({
+  clientId: credential(512),
+  clientSecret: credential(2048).optional(),
+  teamId: credential(64).optional(),
+  keyId: credential(64).optional(),
+  privateKey: credential(8192).optional(),
+  tenant: MicrosoftTenantSchema.optional(),
+  additionalClientIds: AdditionalClientIdsSchema.optional(),
+  enabled: z14.boolean().default(true)
+}).meta({ ref: "OAuthProviderUpdate" });
+
+// src/webhook.ts
+import { z as z15 } from "zod";
+var MAX_WEBHOOK_URL_LENGTH = 2048;
+var MAX_WEBHOOK_ENDPOINTS = 10;
+var url = () => z15.string().min(1).max(MAX_WEBHOOK_URL_LENGTH).regex(/^[^\s\u0000-\u001f\u007f]+$/, "Must not contain spaces or control characters.");
+var eventTypes = () => z15.array(z15.enum(ACTIVITY_TYPES2)).min(1).max(ACTIVITY_TYPES2.length).refine((types) => new Set(types).size === types.length, {
+  message: "An event type is listed more than once."
+});
+var WebhookEndpointSchema = z15.object({
+  id: z15.uuid(),
+  url: z15.string(),
+  eventTypes: z15.array(z15.string()),
+  enabled: z15.boolean(),
+  disabledReason: z15.string().nullable(),
+  failingSince: z15.iso.datetime().nullable(),
+  lastFailedAt: z15.iso.datetime().nullable(),
+  rotationOverlapEndsAt: z15.iso.datetime().nullable(),
+  createdAt: z15.iso.datetime(),
+  updatedAt: z15.iso.datetime()
+}).meta({ ref: "WebhookEndpoint" });
+var CreatedWebhookEndpointSchema = WebhookEndpointSchema.extend({
+  secret: z15.string().describe("The signing secret. Store it now: it is shown only once.")
+}).meta({ ref: "CreatedWebhookEndpoint" });
+var RotatedWebhookSecretSchema = WebhookEndpointSchema.extend({
+  secret: z15.string().describe("The new signing secret. Store it now: it is shown only once."),
+  rotationOverlapEndsAt: z15.iso.datetime().describe("When the previous secret stops signing. Until then deliveries carry both signatures.")
+}).meta({ ref: "RotatedWebhookSecret" });
+var WEBHOOK_ROTATION_REFUSALS = [
+  "rotation_in_progress",
+  "no_rotation_in_progress",
+  "secret_unreadable"
+];
+var WebhookEndpointListSchema = z15.object({ data: z15.array(WebhookEndpointSchema) }).meta({ ref: "WebhookEndpointList" });
+var CreateWebhookEndpointRequestSchema = z15.strictObject({
+  url: url(),
+  eventTypes: eventTypes(),
+  enabled: z15.boolean().default(true)
+}).meta({ ref: "CreateWebhookEndpointRequest" });
+var UpdateWebhookEndpointRequestSchema = z15.strictObject({
+  url: url().optional(),
+  eventTypes: eventTypes().optional(),
+  enabled: z15.boolean().optional()
+}).refine((update) => Object.values(update).some((value) => value !== undefined), {
+  message: "Name at least one field to change."
+}).meta({ ref: "UpdateWebhookEndpointRequest" });
+var WEBHOOK_REDELIVER_REFUSALS = [
+  "delivery_pending",
+  "endpoint_disabled",
+  "event_gone",
+  "attempt_limit"
+];
+var WEBHOOK_DELIVERY_STATES = ["pending", "delivered", "failed"];
+var WebhookDeliveryAttemptSchema = z15.object({
+  attempt: z15.number().int().min(1),
+  attemptedAt: z15.iso.datetime(),
+  statusCode: z15.number().int().nullable(),
+  durationMs: z15.number().int().min(0),
+  failureReason: z15.string().nullable()
+}).meta({ ref: "WebhookDeliveryAttempt" });
+var WebhookDeliverySchema = z15.object({
+  id: z15.uuid(),
+  endpointId: z15.uuid(),
+  eventId: z15.uuid().nullable(),
+  eventType: z15.string(),
+  test: z15.boolean(),
+  state: z15.string(),
+  attemptCount: z15.number().int().min(0),
+  nextAttemptAt: z15.iso.datetime().nullable(),
+  lastAttemptAt: z15.iso.datetime().nullable(),
+  statusCode: z15.number().int().nullable(),
+  failureReason: z15.string().nullable(),
+  completedAt: z15.iso.datetime().nullable(),
+  createdAt: z15.iso.datetime()
+}).meta({ ref: "WebhookDelivery" });
+var WebhookDeliveryDetailSchema = WebhookDeliverySchema.extend({
+  attempts: z15.array(WebhookDeliveryAttemptSchema)
+}).meta({ ref: "WebhookDeliveryDetail" });
+var WebhookDeliveryListSchema = z15.object({ meta: PaginationMetaSchema, data: z15.array(WebhookDeliverySchema) }).meta({ ref: "WebhookDeliveryList" });
+var SendTestWebhookRequestSchema = z15.strictObject({ eventType: z15.enum(ACTIVITY_TYPES2) }).meta({ ref: "SendTestWebhookRequest" });
+var WebhookSendResultSchema = z15.object({
+  deliveryId: z15.uuid(),
+  outcome: z15.enum(["delivered", "failed"]),
+  statusCode: z15.number().int().nullable(),
+  durationMs: z15.number().int().min(0),
+  failureReason: z15.string().nullable()
+}).meta({ ref: "WebhookSendResult" });
+
+// src/hook.ts
+var HOOK_POINTS = ["before_sign_up", "before_session", "before_token"];
+var HookPointSchema = z16.enum(HOOK_POINTS).meta({ ref: "HookPoint" });
+var HOOK_QUESTION_TYPES = {
+  before_sign_up: "hook.before_sign_up",
+  before_session: "hook.before_session",
+  before_token: "hook.before_token"
+};
+var HOOK_ANSWER_KINDS = {
+  before_sign_up: "decision",
+  before_session: "decision",
+  before_token: "claims"
+};
+var HOOK_SCHEMA_VERSION = 1;
+var HOOK_DEFAULT_DEADLINE_MS = 2000;
+var HOOK_MIN_DEADLINE_MS = 100;
+var HOOK_MAX_DEADLINE_MS = 5000;
+var HOOK_FAILURE_MODES = ["deny", "allow"];
+var HOOK_FAILURE_REASONS = [
+  "invalid_url",
+  "invalid_request",
+  "scheme_not_allowed",
+  "resolve_failed",
+  "address_not_allowed",
+  "connection_failed",
+  "timeout",
+  "response_too_large",
+  "status_not_ok",
+  "answer_invalid",
+  "secret_unreadable",
+  "claims_invalid",
+  "claims_too_large"
+];
+var HOOK_OUTCOMES = ["allowed", "denied", "failed", "timed_out"];
+var HOOK_OUTCOME_WINDOW_HOURS = 24;
+function hookFailureOutcome(reason) {
+  return reason === "timeout" ? "timed_out" : "failed";
+}
+function hookLastCallFailed(lastOutcome) {
+  return lastOutcome === "failed" || lastOutcome === "timed_out";
+}
+var HOOK_FIELDS = ["url", "enabled", "deadlineMs", "failureMode"];
+var HOOK_MAX_DENIAL_CODE_LENGTH = 64;
+var HOOK_DENIAL_CODE_PATTERN = /^[a-z0-9_]{1,64}$/;
+var url2 = () => z16.string().min(1).max(MAX_WEBHOOK_URL_LENGTH).regex(/^[^\s\u0000-\u001f\u007f]+$/, "Must not contain spaces or control characters.");
+var deadlineMs = () => z16.number().int().min(HOOK_MIN_DEADLINE_MS).max(HOOK_MAX_DEADLINE_MS);
+var HookRecentOutcomesSchema = z16.object({
+  since: z16.iso.datetime(),
+  allowed: z16.number().int().min(0),
+  denied: z16.number().int().min(0),
+  failed: z16.number().int().min(0),
+  timedOut: z16.number().int().min(0),
+  lastCallAt: z16.iso.datetime().nullable(),
+  lastOutcome: z16.string().nullable()
+}).meta({ ref: "HookRecentOutcomes" });
+var HookSchema = z16.object({
+  id: z16.uuid(),
+  point: z16.string(),
+  url: z16.string(),
+  enabled: z16.boolean(),
+  deadlineMs: z16.number().int(),
+  failureMode: z16.string(),
+  lastFailedAt: z16.iso.datetime().nullable(),
+  lastFailureReason: z16.string().nullable(),
+  recentOutcomes: HookRecentOutcomesSchema,
+  createdAt: z16.iso.datetime(),
+  updatedAt: z16.iso.datetime()
+}).meta({ ref: "Hook" });
+var CreatedHookSchema = HookSchema.extend({
+  secret: z16.string().describe("The signing secret. Store it now: it is shown only once.")
+}).meta({ ref: "CreatedHook" });
+var HookListSchema = z16.object({ data: z16.array(HookSchema) }).meta({ ref: "HookList" });
+var CreateHookRequestSchema = z16.strictObject({
+  point: z16.enum(HOOK_POINTS),
+  url: url2(),
+  enabled: z16.boolean().default(true),
+  deadlineMs: deadlineMs().default(HOOK_DEFAULT_DEADLINE_MS),
+  failureMode: z16.enum(HOOK_FAILURE_MODES).default("deny")
+}).meta({ ref: "CreateHookRequest" });
+var UpdateHookRequestSchema = z16.strictObject({
+  url: url2().optional(),
+  enabled: z16.boolean().optional(),
+  deadlineMs: deadlineMs().optional(),
+  failureMode: z16.enum(HOOK_FAILURE_MODES).optional()
+}).refine((update) => Object.values(update).some((value) => value !== undefined), {
+  message: "Name at least one field to change."
+}).meta({ ref: "UpdateHookRequest" });
+var HOOK_SIGN_UP_METHODS = [
+  "password",
+  "passwordless",
+  ...OAUTH_PROVIDERS.map((provider) => `oauth_${provider}`)
+];
+var HookBeforeSignUpDataSchema = z16.strictObject({
+  email: z16.string().min(3).max(320).nullable(),
+  method: z16.enum(HOOK_SIGN_UP_METHODS),
+  client: SessionClientSchema,
+  ipAddress: z16.string().max(64).nullable()
+}).meta({
+  ref: "HookBeforeSignUpData",
+  description: "What a hook is told about a sign-up before the account is created."
+});
+var id = () => z16.uuid();
+var profile = () => z16.string().min(1).max(32);
+var amr = () => z16.array(z16.string().regex(/^[a-z][a-z0-9_]{0,31}$/)).max(16);
+var HookBeforeSessionDataSchema = z16.strictObject({
+  userId: id(),
+  client: SessionClientSchema,
+  profile: profile(),
+  amr: amr(),
+  signUp: z16.boolean(),
+  ipAddress: z16.string().max(64).nullable()
+}).meta({
+  ref: "HookBeforeSessionData",
+  description: "What a hook is told about a sign-in before its session is created."
+});
+var HookBeforeTokenDataSchema = z16.strictObject({
+  userId: id(),
+  sessionId: id(),
+  client: SessionClientSchema,
+  profile: profile(),
+  amr: amr()
+}).meta({
+  ref: "HookBeforeTokenData",
+  description: "What a hook is told about a session before its token is issued."
+});
+function question(point, data, meta) {
+  return z16.strictObject({
+    id: z16.uuid(),
+    type: z16.literal(HOOK_QUESTION_TYPES[point]),
+    schemaVersion: z16.literal(HOOK_SCHEMA_VERSION),
+    occurredAt: z16.iso.datetime(),
+    data
+  }).meta(meta);
+}
+var HOOK_QUESTION_SCHEMAS = {
+  before_sign_up: question("before_sign_up", HookBeforeSignUpDataSchema, {
+    ref: "HookBeforeSignUpQuestion",
+    description: "What the server posts, signed, to the hook registered for `before_sign_up`, before it creates an account by a sign-up. Not an event: nothing has happened yet."
+  }),
+  before_session: question("before_session", HookBeforeSessionDataSchema, {
+    ref: "HookBeforeSessionQuestion",
+    description: "What the server posts, signed, to the hook registered for `before_session`, after every factor of a sign-in was proven and before it creates the session. Not an event: nothing has happened yet."
+  }),
+  before_token: question("before_token", HookBeforeTokenDataSchema, {
+    ref: "HookBeforeTokenQuestion",
+    description: "What the server posts, signed, to the hook registered for `before_token`, when a session is created and each time its user proves a factor again. The answer is the claims the session’s tokens carry until the next question. Not an event."
+  })
+};
+var HookQuestionSchema = z16.discriminatedUnion("type", [
+  HOOK_QUESTION_SCHEMAS.before_sign_up,
+  HOOK_QUESTION_SCHEMAS.before_session,
+  HOOK_QUESTION_SCHEMAS.before_token
+]).meta({ ref: "HookQuestion" });
+var HOOK_QUESTION_FIXTURES = {
+  before_sign_up: {
+    id: "0199c2f6-0000-7000-8000-000000000001",
+    type: "hook.before_sign_up",
+    schemaVersion: HOOK_SCHEMA_VERSION,
+    occurredAt: "2026-10-08T09:30:00.000Z",
+    data: {
+      email: "ada@example.com",
+      method: "password",
+      client: "web",
+      ipAddress: "203.0.113.7"
+    }
+  },
+  before_session: {
+    id: "0199c2f6-0000-7000-8000-000000000002",
+    type: "hook.before_session",
+    schemaVersion: HOOK_SCHEMA_VERSION,
+    occurredAt: "2026-10-08T09:30:00.000Z",
+    data: {
+      userId: "0199c2f4-7a10-7c3e-9b1a-5d2e8f4a6c01",
+      client: "web",
+      profile: "web",
+      amr: ["pwd", "otp", "mfa"],
+      signUp: false,
+      ipAddress: "203.0.113.7"
+    }
+  },
+  before_token: {
+    id: "0199c2f6-0000-7000-8000-000000000003",
+    type: "hook.before_token",
+    schemaVersion: HOOK_SCHEMA_VERSION,
+    occurredAt: "2026-10-08T09:30:00.000Z",
+    data: {
+      userId: "0199c2f4-7a10-7c3e-9b1a-5d2e8f4a6c01",
+      sessionId: "0199c2f4-7a12-7d4f-8c2b-6e3f9a5b7d02",
+      client: "web",
+      profile: "web",
+      amr: ["pwd", "otp", "mfa"]
+    }
+  }
+};
+var HookAnswerSchema = z16.discriminatedUnion("decision", [
+  z16.strictObject({ decision: z16.literal("allow") }),
+  z16.strictObject({
+    decision: z16.literal("deny"),
+    code: z16.string().regex(HOOK_DENIAL_CODE_PATTERN).optional()
+  })
+]).meta({ ref: "HookAnswer" });
+var HookClaimsAnswerSchema = z16.strictObject({
+  claims: z16.record(z16.string(), z16.union([z16.string(), z16.number(), z16.boolean()])).refine((claims) => ("claims" in checkCustomClaims2(claims)), {
+    message: `Every key must be a custom claim key that is not reserved, every value one string, number or boolean, and the whole at most ${MAX_CUSTOM_CLAIMS_BYTES2} bytes as JSON.`
+  })
+}).meta({ ref: "HookClaimsAnswer" });
+function readHookClaimsAnswer(body) {
+  if (typeof body !== "object" || body === null || Array.isArray(body)) {
+    return { problem: "answer_invalid" };
+  }
+  const keys = Object.keys(body);
+  if (keys.length !== 1 || keys[0] !== "claims") {
+    return { problem: "answer_invalid" };
+  }
+  const { claims } = body;
+  if (typeof claims !== "object" || claims === null || Array.isArray(claims)) {
+    return { problem: "answer_invalid" };
+  }
+  const checked = checkCustomClaims2(claims);
+  if ("claims" in checked) {
+    return checked;
+  }
+  return { problem: checked.problem === "too_large" ? "claims_too_large" : "claims_invalid" };
+}
+function hookWeakenings(was, is) {
+  const weakened = [];
+  if (was?.enabled && !is?.enabled) {
+    weakened.push("enabled");
+  }
+  if (is?.failureMode === "allow" && was?.failureMode !== "allow") {
+    weakened.push("failureMode");
+  }
+  return weakened;
+}
+
+// src/native-app.ts
+import { z as z17 } from "zod";
+var NATIVE_APP_PLATFORMS = ["ios", "android"];
+var MAX_NATIVE_APPS = 20;
+var MAX_CERT_FINGERPRINTS = 10;
+var MAX_BUNDLE_ID_LENGTH = 155;
+var MAX_PACKAGE_NAME_LENGTH = 255;
+var MAX_APP_LINK_PATHS = 10;
+var MAX_APP_LINK_PATH_LENGTH = 255;
+var APP_LINK_PATH_PATTERN = /^(?:\/[A-Za-z0-9._~-]+)+$/;
+function isAppLinkPath(path) {
+  return path.length <= MAX_APP_LINK_PATH_LENGTH && APP_LINK_PATH_PATTERN.test(path) && !path.split("/").some((segment) => segment === "." || segment === "..");
+}
+function normalizeAppLinkPaths(paths) {
+  return [...new Set(paths.filter(isAppLinkPath))].sort();
+}
+var APPLE_TEAM_ID_PATTERN = /^[A-Z0-9]{10}$/;
+var BUNDLE_ID_PATTERN = /^[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)+$/;
+var PACKAGE_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9_]*(?:\.[A-Za-z][A-Za-z0-9_]*)+$/;
+var CERT_FINGERPRINT_PATTERN = /^(?:[0-9A-F]{2}:){31}[0-9A-F]{2}$/;
+var CERT_FINGERPRINT_INPUT_PATTERN = /^(?:(?:[0-9A-Fa-f]{2}:){31}[0-9A-Fa-f]{2}|[0-9A-Fa-f]{64})$/;
+function normalizeCertFingerprint(input) {
+  if (!CERT_FINGERPRINT_INPUT_PATTERN.test(input)) {
+    return null;
+  }
+  const hex = input.replaceAll(":", "").toUpperCase();
+  return (hex.match(/.{2}/g) ?? []).join(":");
+}
+function normalizeCertFingerprints(fingerprints) {
+  const set = new Set;
+  for (const fingerprint of fingerprints) {
+    const normal = normalizeCertFingerprint(fingerprint);
+    if (normal) {
+      set.add(normal);
+    }
+  }
+  return [...set].sort();
+}
+var ANDROID_APK_KEY_HASH_PREFIX = "android:apk-key-hash:";
+function androidApkKeyHashOrigin(fingerprint) {
+  const normal = normalizeCertFingerprint(fingerprint);
+  if (normal === null) {
+    return null;
+  }
+  const bytes = normal.split(":").map((pair) => Number.parseInt(pair, 16));
+  const base64 = btoa(String.fromCharCode(...bytes));
+  const base64url = base64.replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+  return `${ANDROID_APK_KEY_HASH_PREFIX}${base64url}`;
+}
+var teamId = () => z17.string().regex(APPLE_TEAM_ID_PATTERN, "Must be the ten upper-case letters and digits of an Apple team.");
+var bundleId = () => z17.string().max(MAX_BUNDLE_ID_LENGTH).regex(BUNDLE_ID_PATTERN, "Must be a bundle id such as com.example.app: letters, digits and hyphens in segments joined by periods.");
+var packageName = () => z17.string().max(MAX_PACKAGE_NAME_LENGTH).regex(PACKAGE_NAME_PATTERN, "Must be a package name such as com.example.app: two or more segments joined by periods, each starting with a letter.");
+var fingerprints = () => z17.array(z17.string().max(95).regex(CERT_FINGERPRINT_INPUT_PATTERN, "Must be a SHA-256 fingerprint: 32 bytes as hex, with or without colons.")).min(1).max(MAX_CERT_FINGERPRINTS).refine((list) => normalizeCertFingerprints(list).length === list.length, {
+  message: "Name each fingerprint once."
+});
+var appLinkPaths = () => z17.array(z17.string().max(MAX_APP_LINK_PATH_LENGTH).refine(isAppLinkPath, {
+  message: "Must be one exact path such as /oauth/callback: letters, digits and . _ ~ - in segments after a slash, with no wildcard, query or trailing slash."
+})).max(MAX_APP_LINK_PATHS).refine((list) => new Set(list).size === list.length, { message: "Name each path once." });
+var NATIVE_APP_FIELDS = ["teamId", "sha256CertFingerprints", "appLinkPaths"];
+var stamps = { id: z17.uuid(), createdAt: z17.iso.datetime(), updatedAt: z17.iso.datetime() };
+var IosAppSchema = z17.object({
+  ...stamps,
+  platform: z17.literal("ios"),
+  teamId: z17.string(),
+  bundleId: z17.string(),
+  appLinkPaths: z17.array(z17.string())
+}).meta({ ref: "IosApp" });
+var AndroidAppSchema = z17.object({
+  ...stamps,
+  platform: z17.literal("android"),
+  packageName: z17.string(),
+  sha256CertFingerprints: z17.array(z17.string()),
+  appLinkPaths: z17.array(z17.string())
+}).meta({ ref: "AndroidApp" });
+var NativeAppSchema = z17.discriminatedUnion("platform", [IosAppSchema, AndroidAppSchema]).meta({ ref: "NativeApp" });
+var NativeAppListSchema = z17.object({ data: z17.array(NativeAppSchema) }).meta({ ref: "NativeAppList" });
+var IosAppIdentitySchema = z17.strictObject({
+  platform: z17.literal("ios"),
+  teamId: teamId(),
+  bundleId: bundleId(),
+  appLinkPaths: appLinkPaths().optional()
+}).meta({ ref: "IosAppIdentity" });
+var AndroidAppIdentitySchema = z17.strictObject({
+  platform: z17.literal("android"),
+  packageName: packageName(),
+  sha256CertFingerprints: fingerprints(),
+  appLinkPaths: appLinkPaths().optional()
+}).meta({ ref: "AndroidAppIdentity" });
+var CreateNativeAppRequestSchema = z17.discriminatedUnion("platform", [IosAppIdentitySchema, AndroidAppIdentitySchema]).meta({ ref: "CreateNativeAppRequest" });
+var UpdateNativeAppRequestSchema = z17.strictObject({
+  teamId: teamId().optional(),
+  sha256CertFingerprints: fingerprints().optional(),
+  appLinkPaths: appLinkPaths().optional()
+}).refine((update) => Object.values(update).some((value) => value !== undefined), {
+  message: "Name at least one field to change."
+}).meta({ ref: "UpdateNativeAppRequest" });
+var ASSET_LINKS_RELATIONS = ["delegate_permission/common.get_login_creds"];
+var ASSET_LINKS_APP_LINK_RELATION = "delegate_permission/common.handle_all_urls";
+var AppleAppSiteAssociationSchema = z17.strictObject({
+  webcredentials: z17.strictObject({
+    apps: z17.array(z17.string()).min(1)
+  }).optional(),
+  applinks: z17.strictObject({
+    details: z17.array(z17.strictObject({
+      appIDs: z17.array(z17.string()).length(1),
+      components: z17.array(z17.strictObject({ "/": z17.string() })).min(1)
+    })).min(1)
+  }).optional()
+}).meta({ ref: "AppleAppSiteAssociation" });
+var AssetLinksSchema = z17.array(z17.strictObject({
+  relation: z17.array(z17.string()).min(1),
+  target: z17.strictObject({
+    namespace: z17.literal("android_app"),
+    package_name: z17.string(),
+    sha256_cert_fingerprints: z17.array(z17.string()).min(1)
+  })
+})).meta({ ref: "AssetLinks" });
+function nativeAppIdentifier(app) {
+  return app.platform === "ios" ? app.bundleId : app.packageName;
+}
+function appleAppSiteAssociation(apps) {
+  const ios = apps.filter((app) => app.platform === "ios").map((app) => ({
+    id: `${app.teamId}.${app.bundleId}`,
+    paths: normalizeAppLinkPaths(app.appLinkPaths ?? [])
+  })).sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
+  if (ios.length === 0) {
+    return {};
+  }
+  const details = ios.filter((app) => app.paths.length > 0).map((app) => ({ appIDs: [app.id], components: app.paths.map((path) => ({ "/": path })) }));
+  return {
+    webcredentials: { apps: ios.map((app) => app.id) },
+    ...details.length > 0 && { applinks: { details } }
+  };
+}
+function assetLinks(apps) {
+  return apps.filter((app) => app.platform === "android").sort((a, b) => a.packageName < b.packageName ? -1 : a.packageName > b.packageName ? 1 : 0).map((app) => ({
+    relation: [
+      ...ASSET_LINKS_RELATIONS,
+      ...normalizeAppLinkPaths(app.appLinkPaths ?? []).length > 0 ? [ASSET_LINKS_APP_LINK_RELATION] : []
+    ],
+    target: {
+      namespace: "android_app",
+      package_name: app.packageName,
+      sha256_cert_fingerprints: [...app.sha256CertFingerprints]
+    }
+  }));
+}
+function gainedAppLinkPath(was, is) {
+  const before = new Set(normalizeAppLinkPaths(was?.appLinkPaths ?? []));
+  return normalizeAppLinkPaths(is.appLinkPaths ?? []).some((path) => !before.has(path));
+}
+function nativeAppWeakenings(was, is) {
+  if (!is) {
+    return [];
+  }
+  const paths = gainedAppLinkPath(was, is) ? ["appLinkPaths"] : [];
+  if (!was) {
+    return ["app", ...paths];
+  }
+  if (was.platform === "ios" && is.platform === "ios") {
+    return [...was.teamId === is.teamId ? [] : ["teamId"], ...paths];
+  }
+  if (was.platform === "android" && is.platform === "android") {
+    const before = new Set(normalizeCertFingerprints(was.sha256CertFingerprints));
+    const gained = normalizeCertFingerprints(is.sha256CertFingerprints).some((fingerprint) => !before.has(fingerprint));
+    return [...gained ? ["sha256CertFingerprints"] : [], ...paths];
+  }
+  return ["app"];
+}
+
+// src/proposal.ts
+import { z as z18 } from "zod";
+var PROPOSAL_OPERATIONS = [
+  "ban_user",
+  "unban_user",
+  "end_session",
+  "disable_oauth_provider"
+];
+var PROPOSAL_TARGET_TYPES = ["user", "session", "oauth_provider"];
+var PROPOSAL_OPERATION_TARGETS = {
+  ban_user: "user",
+  unban_user: "user",
+  end_session: "session",
+  disable_oauth_provider: "oauth_provider"
+};
+var PROPOSAL_STATUSES = ["pending", "expired", "approved", "executed", "failed"];
+var PROPOSAL_FAILURE_REASONS = [
+  "target_not_found",
+  "error",
+  "incomplete",
+  "last_sign_in_method"
+];
+var PROPOSAL_EXPIRY_REASONS = ["time", "agent_key_revoked"];
+var PROPOSAL_APPROVAL_REFUSALS = [
+  "expired",
+  "already_decided",
+  "mismatch",
+  "agent_key_revoked",
+  "production_environment"
+];
+var PROPOSAL_CREATION_REFUSALS = ["production_environment"];
+var PROPOSAL_APPROVER_TYPES = ["admin", "instance_admin"];
+var ProposalOperationSchema = z18.enum(PROPOSAL_OPERATIONS).meta({ ref: "ProposalOperation" });
+var ProposalStatusSchema = z18.enum(PROPOSAL_STATUSES).meta({ ref: "ProposalStatus" });
+function isProposalTargetId(type, id) {
+  const providers = OAUTH_PROVIDERS;
+  if (type === "oauth_provider") {
+    return providers.includes(id);
+  }
+  return id === id.toLowerCase() && z18.uuid().safeParse(id).success;
+}
+var ProposalTargetSchema = z18.strictObject({
+  type: z18.enum(PROPOSAL_TARGET_TYPES),
+  id: z18.union([z18.uuid(), z18.enum(OAUTH_PROVIDERS)])
+}).refine((target) => isProposalTargetId(target.type, target.id), {
+  path: ["id"],
+  message: "must name a target of that type"
+}).meta({ ref: "ProposalTarget" });
+var ProposalApproverSchema = z18.object({
+  type: z18.enum(PROPOSAL_APPROVER_TYPES),
+  id: z18.string().min(1).max(128).nullable()
+}).meta({ ref: "ProposalApprover" });
+function targetIsOfOperation(request) {
+  return PROPOSAL_OPERATION_TARGETS[request.operation] === request.target.type;
+}
+var TARGET_OF_OPERATION = {
+  path: ["target", "type"],
+  message: "must be the kind of target the operation acts on"
+};
+var CreateProposalRequestSchema = z18.strictObject({ operation: ProposalOperationSchema, target: ProposalTargetSchema }).refine(targetIsOfOperation, TARGET_OF_OPERATION).meta({ ref: "CreateProposalRequest" });
+var ApproveProposalRequestSchema = z18.strictObject({ operation: ProposalOperationSchema, target: ProposalTargetSchema }).refine(targetIsOfOperation, TARGET_OF_OPERATION).meta({ ref: "ApproveProposalRequest" });
+var ProposalSchema = z18.object({
+  id: z18.uuid(),
+  operation: ProposalOperationSchema,
+  target: ProposalTargetSchema,
+  summary: z18.string(),
+  status: ProposalStatusSchema,
+  proposedBy: z18.object({ type: z18.literal("agent"), id: z18.uuid() }),
+  createdAt: z18.iso.datetime(),
+  expiresAt: z18.iso.datetime(),
+  approvedBy: ProposalApproverSchema.nullable(),
+  approvedAt: z18.iso.datetime().nullable(),
+  failureReason: z18.enum(PROPOSAL_FAILURE_REASONS).nullable(),
+  expiryReason: z18.enum(PROPOSAL_EXPIRY_REASONS).nullable(),
+  changed: z18.boolean().optional()
+}).meta({ ref: "Proposal" });
+var ProposalListSchema = z18.object({ data: z18.array(ProposalSchema) }).meta({ ref: "ProposalList" });
+var SUMMARIES = {
+  ban_user: (id) => `Ban the user ${id}: every session of theirs ends now, and they cannot sign in until an administrator lifts the ban.`,
+  unban_user: (id) => `Lift the ban on the user ${id}: they can sign in again. The sessions that ended when they were banned stay ended.`,
+  end_session: (id) => `End the session ${id}: whoever holds it is signed out now and has to sign in again. The user’s other sessions and the account are left as they are.`,
+  disable_oauth_provider: (id) => `Switch off sign-in with the provider ${id}: nobody can sign in or sign up with it until an administrator switches it on again. Its credentials are kept and nothing is removed. It is refused if it would leave the environment with no way to sign in.`
+};
+function proposalSummary(operation, target) {
+  if (PROPOSAL_OPERATION_TARGETS[operation] !== target.type || !isProposalTargetId(target.type, target.id)) {
+    throw new TypeError("a proposal’s target is named by its id");
+  }
+  return SUMMARIES[operation](target.id);
+}
+
+// src/test-address.ts
+var TEST_ADDRESS_DOMAIN = "test.tula.invalid";
+var TEST_ADDRESS_LOCAL_PREFIX = "tula-test-";
+function isTestAddress(address) {
+  const at = address.lastIndexOf("@");
+  if (at < 0) {
+    return false;
+  }
+  const domain = address.slice(at + 1).trim().toLowerCase().replace(/\.$/, "");
+  return domain === TEST_ADDRESS_DOMAIN || domain.endsWith(`.${TEST_ADDRESS_DOMAIN}`);
+}
+function testAddress(hex) {
+  if (!/^[0-9a-f]{32}$/.test(hex)) {
+    throw new Error("a test address is made from 32 hexadecimal characters");
+  }
+  return `${TEST_ADDRESS_LOCAL_PREFIX}${hex}@${TEST_ADDRESS_DOMAIN}`;
+}
+var SIGN_IN_TEST_STEPS = [
+  "sign_up",
+  "verify_email",
+  "sign_out",
+  "sign_in",
+  "first_factor",
+  "revoke_session",
+  "delete_user"
+];
+var SIGN_IN_TEST_STEP_OUTCOMES = ["passed", "failed", "not_run"];
+var SIGN_IN_TEST_REASONS = [
+  "earlier_step",
+  "second_factor_required",
+  "email_cooldown",
+  "no_provable_method",
+  "no_session",
+  "timeout",
+  "cancelled"
+];
+var SIGN_IN_TEST_OUTCOMES = ["passed", "failed", "incomplete"];
+var SIGN_IN_TEST_CLEANUPS = ["deleted", "failed", "none"];
+var SIGN_IN_TEST_REFUSALS = ["test_sign_in_disabled"];
+function testSignInAllowed(setting, kind) {
+  return setting ?? kind !== "production";
+}
+
+// src/tokens.ts
+import { z as z19 } from "zod";
+var ACCESS_TOKEN_VERSION = 1;
+var ACCESS_TOKEN_ALGORITHM = "EdDSA";
+var PUBLISHABLE_KEY_PREFIX = "tula_pk_";
+var SECRET_KEY_PREFIX = "tula_sk_";
+var AGENT_KEY_PREFIX = "tula_ak_";
+var AUTHENTICATION_METHODS = [
+  "pwd",
+  "email",
+  "sms",
+  "otp",
+  "backup_code",
+  "mfa",
+  "hwk",
+  "swk",
+  "user"
+];
+var STEP_UP_MAX_AGE_SECONDS = 600;
+var AccessTokenClaimsSchema = z19.object({
+  iss: z19.string(),
+  sub: z19.string(),
+  aud: z19.string(),
+  sid: z19.string(),
+  pid: z19.string(),
+  eid: z19.string(),
+  iat: z19.number().int(),
+  exp: z19.number().int(),
+  v: z19.literal(ACCESS_TOKEN_VERSION),
+  auth_time: z19.number().int().optional(),
+  amr: z19.array(z19.string()).optional(),
+  sp: z19.string().optional(),
+  cnf: z19.object({ jkt: z19.string() }).optional(),
+  [CUSTOM_CLAIMS_CLAIM2]: z19.record(z19.string(), z19.union([z19.string(), z19.number(), z19.boolean()])).optional()
+}).meta({ ref: "AccessTokenClaims" });
+var JwkSchema = z19.object({
+  kty: z19.literal("OKP"),
+  crv: z19.literal("Ed25519"),
+  x: z19.string(),
+  kid: z19.string(),
+  alg: z19.literal(ACCESS_TOKEN_ALGORITHM),
+  use: z19.literal("sig")
+}).meta({ ref: "Jwk" });
+var JwksSchema = z19.object({ keys: z19.array(JwkSchema) }).meta({ ref: "Jwks" });
+
+// src/events.ts
+var id2 = () => z20.uuid();
+function data(name, description, shape) {
+  return z20.object(shape).meta({ ref: `${name}EventData`, description });
+}
+function proposalIsWhole(change) {
+  return change.proposalId === undefined === (change.approvedBy === undefined);
+}
+var PROPOSAL_IS_WHOLE = { message: "`proposalId` and `approvedBy` go together" };
+var carriedOut = () => ({
+  proposalId: id2().optional(),
+  approvedBy: ProposalApproverSchema.optional()
+});
+function passkeyRemovalIsWhole(removal) {
+  const named = removal.passkeyId !== undefined;
+  const outcome = removal.canStillSignIn !== undefined;
+  return removal.method === "user" ? named && !outcome : outcome && !named;
+}
+var provider = OAuthProviderSchema;
+var dependentAccounts = z20.number().int().min(0).max(DEPENDENT_ACCOUNTS_SCAN_LIMIT);
+var proposed2 = {
+  operation: z20.enum(PROPOSAL_OPERATIONS),
+  targetType: z20.enum(PROPOSAL_TARGET_TYPES),
+  targetId: z20.union([id2(), provider])
+};
+var WEBHOOK_ENDPOINT_FIELDS = ["url", "eventTypes", "enabled"];
+var WEBHOOK_DISABLED_REASONS = ["failing", "gone"];
+var MAX_CHANGED_SETTINGS = 256;
+var MAX_SETTING_NAME_LENGTH = 128;
+var EVENT_DATA_SCHEMAS = {
+  "user.created": data("UserCreated", "A user account was created.", {
+    method: z20.enum([
+      "admin",
+      "sign_up",
+      "oauth_google",
+      "oauth_github",
+      "oauth_apple",
+      "oauth_microsoft",
+      "oauth_discord",
+      "oauth_linkedin",
+      "oauth_x",
+      "oauth_facebook"
+    ]),
+    emailVerified: z20.boolean(),
+    passwordless: z20.boolean().optional(),
+    hookBypassed: z20.boolean().optional(),
+    test: z20.boolean().optional()
+  }),
+  "user.email_verified": data("UserEmailVerified", "A user proved their email address.", {}),
+  "user.banned": z20.object({
+    proposalId: id2().optional(),
+    approvedBy: ProposalApproverSchema.optional()
+  }).refine(proposalIsWhole, PROPOSAL_IS_WHOLE).meta({
+    ref: "UserBannedEventData",
+    description: "A user was banned; their sessions end. With `proposalId` and `approvedBy` (both or neither) when the ban carried out an agent’s proposal a human approved."
+  }),
+  "user.unbanned": z20.object(carriedOut()).refine(proposalIsWhole, PROPOSAL_IS_WHOLE).meta({
+    ref: "UserUnbannedEventData",
+    description: "A user’s ban was lifted. With `proposalId` and `approvedBy` (both or neither) when that carried out an agent’s proposal a human approved."
+  }),
+  "user.deleted": data("UserDeleted", "A user account was deleted.", {}),
+  "user.password_changed": data("UserPasswordChanged", "A user’s password was set, replaced or removed.", {
+    method: z20.enum(["admin_reset", "self", "reset", "email_verification"]),
+    created: z20.boolean().optional(),
+    removed: z20.boolean().optional()
+  }),
+  "user.mfa_enabled": data("UserMfaEnabled", "A user turned two-step verification on.", {
+    method: z20.enum(["totp"])
+  }),
+  "user.mfa_disabled": data("UserMfaDisabled", "A user’s two-step verification was removed.", {
+    method: z20.enum(["self", "admin_reset", "enrolment_incomplete"])
+  }),
+  "user.backup_codes_regenerated": data("UserBackupCodesRegenerated", "A user replaced their backup codes; the earlier set no longer works.", {}),
+  "user.backup_code_used": data("UserBackupCodeUsed", "A user proved their second factor with a backup code.", {}),
+  "user.identity_linked": data("UserIdentityLinked", "A provider account was connected to a user.", {
+    provider,
+    method: z20.enum(["auto", "profile"])
+  }),
+  "user.identity_unlinked": data("UserIdentityUnlinked", "A provider account was disconnected from a user.", { provider }),
+  "user.passkey_added": data("UserPasskeyAdded", "A user registered a passkey.", {
+    passkeyId: id2(),
+    synced: z20.boolean()
+  }),
+  "user.passkey_renamed": data("UserPasskeyRenamed", "A user renamed a passkey.", {
+    passkeyId: id2()
+  }),
+  "user.passkey_removed": z20.object({
+    method: z20.enum(["user", "admin_reset"]),
+    passkeyId: id2().optional(),
+    canStillSignIn: z20.boolean().optional()
+  }).refine(passkeyRemovalIsWhole, {
+    message: "`passkeyId` goes with `user`, `canStillSignIn` with `admin_reset`"
+  }).meta({
+    ref: "UserPasskeyRemovedEventData",
+    description: "A passkey was removed by its owner (`method: user`, with `passkeyId`), or every passkey of a user by an admin reset (`method: admin_reset`, with `canStillSignIn`)."
+  }),
+  "user.passkey_counter_regressed": data("UserPasskeyCounterRegressed", "A passkey’s signature counter did not grow: it may have been cloned. The sign-in was refused.", { passkeyId: id2() }),
+  "user.email_added": data("UserEmailAdded", "An email address was stored on a user who had none. The address is not in the event.", {
+    method: z20.enum(["self", "admin"]),
+    verified: z20.boolean()
+  }),
+  "user.phone_number_added": data("UserPhoneNumberAdded", "A user verified a phone number, which is now the account’s (replacing an earlier one).", {}),
+  "user.phone_number_removed": data("UserPhoneNumberRemoved", "A user took the phone number off their account.", {}),
+  "user.sms_factor_enabled": data("UserSmsFactorEnabled", "A user made a code texted to their phone number their second factor.", {}),
+  "user.sms_factor_removed": data("UserSmsFactorRemoved", "A texted code is no longer a user’s second factor.", {
+    method: z20.enum(["self", "admin_reset", "phone_number_removed", "phone_number_changed"])
+  }),
+  "session.created": data("SessionCreated", "A user signed in.", {
+    userId: id2(),
+    client: SessionClientSchema,
+    hookBypassed: z20.boolean().optional(),
+    claimsHookBypassed: z20.boolean().optional(),
+    deviceBound: z20.boolean().optional()
+  }),
+  "session.revoked": z20.object({
+    userId: id2(),
+    reason: z20.enum([
+      "sign_out",
+      "revoked_by_user",
+      "revoked_by_admin",
+      "password_changed",
+      "user_banned",
+      "mfa_changed",
+      "session_limit"
+    ]),
+    ...carriedOut()
+  }).refine(proposalIsWhole, PROPOSAL_IS_WHOLE).meta({
+    ref: "SessionRevokedEventData",
+    description: "A session was ended before it expired. With `proposalId` and `approvedBy` (both or neither) when ending it carried out an agent’s proposal a human approved."
+  }),
+  "session.reuse_detected": data("SessionReuseDetected", "A rotated refresh token was presented again: the session was ended as possibly stolen.", { userId: id2(), reason: z20.literal("reuse_detected") }),
+  "session.stepped_up": data("SessionSteppedUp", "A signed-in user proved a factor again for a session.", {
+    userId: id2(),
+    methods: z20.array(z20.enum(AUTHENTICATION_METHODS)).max(AUTHENTICATION_METHODS.length),
+    claimsHookBypassed: z20.boolean().optional()
+  }),
+  "session.refresh_proof_refused": data("SessionRefreshProofRefused", "A refresh of a device-bound session came without a valid proof of its key. The session was not ended and no token was rotated.", {
+    userId: id2(),
+    reason: z20.enum(["missing", "invalid", "wrong_key", "replayed"]),
+    suppressedInPreviousMinute: z20.number().int().min(0)
+  }),
+  "api_key.created": data("ApiKeyCreated", "An API key was created.", {
+    kind: z20.enum(["publishable", "secret", "agent"])
+  }),
+  "api_key.revoked": data("ApiKeyRevoked", "An API key was revoked.", {}),
+  "signing_key.rotated": data("SigningKeyRotated", "An environment’s access-token signing keys were rotated. The target is the new active key.", { retiredKeyId: id2(), nextKeyId: id2() }),
+  "environment.settings_updated": data("EnvironmentSettingsUpdated", "An environment’s settings were replaced.", {
+    revision: z20.number().int().positive(),
+    changed: z20.array(z20.string().max(MAX_SETTING_NAME_LENGTH).regex(/^[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)*$/)).max(MAX_CHANGED_SETTINGS),
+    weakened: z20.boolean().optional(),
+    managedBy: z20.string().regex(CONFIG_TOOL_PATTERN).nullable().optional(),
+    outsideConfig: z20.boolean().optional()
+  }),
+  "oauth_provider.updated": z20.object({
+    provider,
+    changed: z20.array(z20.enum([
+      "clientId",
+      "secret",
+      "teamId",
+      "keyId",
+      "tenant",
+      "additionalClientIds",
+      "enabled"
+    ])).max(7),
+    created: z20.boolean().optional(),
+    additionalClientIdCount: z20.number().int().min(0).max(MAX_ADDITIONAL_CLIENT_IDS).optional(),
+    weakened: z20.boolean().optional(),
+    dependentAccounts: dependentAccounts.optional(),
+    dependentAccountsIncomplete: z20.boolean().optional(),
+    ...carriedOut()
+  }).refine(proposalIsWhole, PROPOSAL_IS_WHOLE).meta({
+    ref: "OAuthProviderUpdatedEventData",
+    description: "An OAuth provider’s credentials were set or changed, or it was switched on or off. With `proposalId` and `approvedBy` (both or neither) when switching it off carried out an agent’s proposal a human approved."
+  }),
+  "oauth_provider.deleted": data("OAuthProviderDeleted", "An OAuth provider’s credentials were removed.", {
+    provider,
+    weakened: z20.boolean().optional(),
+    dependentAccounts: dependentAccounts.optional(),
+    dependentAccountsIncomplete: z20.boolean().optional()
+  }),
+  "webhook_endpoint.created": data("WebhookEndpointCreated", "A webhook endpoint was registered. Its address and signing secret are not in the event.", {
+    eventTypes: z20.number().int().min(1).max(ACTIVITY_TYPES2.length),
+    enabled: z20.boolean()
+  }),
+  "webhook_endpoint.updated": data("WebhookEndpointUpdated", "A webhook endpoint was changed.", {
+    changed: z20.array(z20.enum(WEBHOOK_ENDPOINT_FIELDS)).min(1).max(WEBHOOK_ENDPOINT_FIELDS.length)
+  }),
+  "webhook_endpoint.deleted": data("WebhookEndpointDeleted", "A webhook endpoint was removed; nothing more is delivered to it.", {}),
+  "webhook_endpoint.disabled": data("WebhookEndpointDisabled", "The server switched a webhook endpoint off: its deliveries kept failing, or it answered 410 Gone. Nothing is delivered to it until it is switched on again.", {
+    reason: z20.enum(WEBHOOK_DISABLED_REASONS)
+  }),
+  "webhook_endpoint.secret_rotated": data("WebhookEndpointSecretRotated", "A webhook endpoint’s signing secret was replaced. Deliveries carry a signature for the new secret and one for the previous secret until the time given; after it, for the new one only. Neither secret, nor any part of one, is in the event.", {
+    rotationOverlapEndsAt: z20.iso.datetime()
+  }),
+  "webhook_endpoint.previous_secret_revoked": data("WebhookEndpointPreviousSecretRevoked", "An administrator ended the overlap of a secret rotation early: the endpoint’s previous signing secret stopped signing at once and was deleted. Deliveries carry a signature for the current secret only.", {}),
+  "hook.created": data("HookCreated", "A hook was registered. Its address and signing secret are not in the event.", {
+    point: z20.enum(HOOK_POINTS),
+    enabled: z20.boolean(),
+    failureMode: z20.enum(HOOK_FAILURE_MODES),
+    weakened: z20.boolean().optional()
+  }),
+  "hook.updated": data("HookUpdated", "A hook was changed.", {
+    point: z20.enum(HOOK_POINTS),
+    changed: z20.array(z20.enum(HOOK_FIELDS)).min(1).max(HOOK_FIELDS.length),
+    weakened: z20.boolean().optional()
+  }),
+  "hook.deleted": data("HookDeleted", "A hook was removed; it is not asked any more.", {
+    point: z20.enum(HOOK_POINTS),
+    weakened: z20.boolean().optional()
+  }),
+  "native_app.created": data("NativeAppCreated", "A native app was registered: the association files served for the environment name it from now on. Its bundle id or package name, its team and its fingerprints are not in the event.", {
+    platform: z20.enum(NATIVE_APP_PLATFORMS),
+    fingerprints: z20.number().int().min(0).max(MAX_CERT_FINGERPRINTS),
+    appLinkPaths: z20.number().int().min(0).max(MAX_APP_LINK_PATHS).optional(),
+    weakened: z20.boolean().optional()
+  }),
+  "native_app.updated": data("NativeAppUpdated", "A registered native app was changed.", {
+    platform: z20.enum(NATIVE_APP_PLATFORMS),
+    changed: z20.array(z20.enum(NATIVE_APP_FIELDS)).min(1).max(NATIVE_APP_FIELDS.length),
+    fingerprints: z20.number().int().min(0).max(MAX_CERT_FINGERPRINTS),
+    appLinkPaths: z20.number().int().min(0).max(MAX_APP_LINK_PATHS).optional(),
+    weakened: z20.boolean().optional()
+  }),
+  "native_app.deleted": data("NativeAppDeleted", "A registered native app was removed: the association files no longer name it.", { platform: z20.enum(NATIVE_APP_PLATFORMS) }),
+  "proposal.created": data("ProposalCreated", "An agent asked for a change as a proposal. Nothing has changed: a human has to approve it.", proposed2),
+  "proposal.approved": data("ProposalApproved", "A human approved an agent’s proposal. The actor is the human; the operation follows.", {
+    ...proposed2,
+    proposedBy: id2()
+  }),
+  "proposal.executed": data("ProposalExecuted", "An approved proposal’s operation was carried out. The actor is the agent that asked.", {
+    ...proposed2,
+    approvedBy: ProposalApproverSchema,
+    changed: z20.boolean().optional()
+  }),
+  "proposal.failed": data("ProposalFailed", "An approved proposal’s operation was not carried out. The proposal is spent all the same.", {
+    ...proposed2,
+    approvedBy: ProposalApproverSchema,
+    reason: z20.enum(PROPOSAL_FAILURE_REASONS)
+  }),
+  "sign_in_test.started": data("SignInTestStarted", "A sign-in test began: the server is about to sign a throwaway user up and in through the environment’s flow, and delete it.", {}),
+  "sign_in_test.finished": data("SignInTestFinished", "A sign-in test ended. `userId` is the throwaway user it made (absent when no account was made); `cleanup` says whether that user was deleted.", {
+    outcome: z20.enum(SIGN_IN_TEST_OUTCOMES),
+    cleanup: z20.enum(SIGN_IN_TEST_CLEANUPS),
+    userId: id2().optional()
+  })
+};
+var EventActorSchema = z20.object({ type: z20.enum(AUDIT_ACTOR_TYPES), id: z20.string().min(1).max(128).nullable() }).meta({ ref: "EventActor" });
+function envelope(type) {
+  const details = EVENT_DATA_SCHEMAS[type];
+  const { ref, description } = z20.globalRegistry.get(details) ?? {};
+  return z20.object({
+    id: id2(),
+    type: z20.literal(type),
+    schemaVersion: z20.literal(EVENT_SCHEMA_VERSION2),
+    occurredAt: z20.iso.datetime(),
+    actor: EventActorSchema,
+    target: z20.object({ type: z20.literal(EVENT_TARGET_TYPES2[type]), id: id2() }),
+    data: details,
+    test: z20.literal(true).optional()
+  }).meta({ ref: String(ref).replace(/Data$/, ""), description });
+}
+var envelopes = ACTIVITY_TYPES2.map((type) => [type, envelope(type)]);
+var EVENT_SCHEMAS = Object.fromEntries(envelopes);
+var TulaEventSchema = z20.discriminatedUnion("type", envelopes.map(([, schema]) => schema)).meta({ ref: "TulaEvent" });
+// src/mfa.ts
+import { z as z21 } from "zod";
+var TOTP_DIGITS = 6;
+var TOTP_PERIOD_SECONDS = 30;
+var BACKUP_CODE_COUNT = 10;
+var FactorsSchema = z21.object({
+  totp: z21.object({ enabled: z21.boolean(), confirmedAt: z21.iso.datetime().nullable() }),
+  backupCodes: z21.object({ remaining: z21.number().int().min(0) }),
+  sms: z21.object({
+    enabled: z21.boolean(),
+    enabledAt: z21.iso.datetime().nullable(),
+    inUse: z21.boolean(),
+    available: z21.boolean()
+  }).optional()
+}).meta({ ref: "Factors" });
+var SmsFactorCodeSchema = z21.object({
+  method: z21.literal("sms_code"),
+  destination: z21.string(),
+  expiresAt: z21.iso.datetime()
+}).meta({ ref: "SmsFactorCode" });
+var SmsFactorConfirmRequestSchema = z21.object({ code: z21.string().regex(/^\d{6}$/) }).meta({ ref: "SmsFactorConfirmRequest" });
+var TotpEnrolmentSchema = z21.object({ secret: z21.string(), uri: z21.string() }).meta({ ref: "TotpEnrolment" });
+var TotpConfirmRequestSchema = z21.object({ code: z21.string().regex(/^\d{6}$/) }).meta({ ref: "TotpConfirmRequest" });
+var BackupCodesSchema = z21.object({ codes: z21.array(z21.string()) }).meta({ ref: "BackupCodes" });
+var StepUpMethodSchema = z21.enum(["password", "totp", "backup_code", "email_code", "passkey", "sms_code"]).meta({ ref: "StepUpMethod" });
+var StepUpRequestSchema = z21.discriminatedUnion("method", [
+  z21.object({ method: z21.literal("password"), password: z21.string().max(1024) }),
+  z21.object({ method: z21.literal("totp"), code: z21.string().regex(/^\d{6}$/) }),
+  z21.object({ method: z21.literal("backup_code"), code: z21.string().min(1).max(64) }),
+  z21.object({ method: z21.literal("email_code"), code: z21.string().regex(/^\d{6}$/) }),
+  z21.object({ method: z21.literal("passkey"), credential: PasskeyAssertionCredentialSchema }),
+  z21.object({ method: z21.literal("sms_code"), code: z21.string().regex(/^\d{6}$/) })
+]).meta({ ref: "StepUpRequest" });
+var StepUpEmailCodeSchema = z21.object({
+  method: z21.literal("email_code"),
+  destination: z21.string(),
+  expiresAt: z21.iso.datetime()
+}).meta({ ref: "StepUpEmailCode" });
+// src/settings-weakening.ts
+var SWITCHED_RULES = [
+  "requireLowercase",
+  "requireUppercase",
+  "requireNumber",
+  "requireSpecial",
+  "disallowUserInfo",
+  "disallowCommon",
+  "blockSequences"
+];
+var BREACH_CHECK_STRENGTH = {
+  off: 0,
+  warn: 1,
+  block: 2
+};
+var NOTICES = [
+  "passwordChanged",
+  "newSignIn",
+  "mfaChanged",
+  "identityChanged"
+];
+var MFA_POLICY_STRENGTH = {
+  off: 0,
+  optional: 1,
+  required: 2
+};
+var DEVICE_BINDING_STRENGTH = {
+  none: 0,
+  optional: 1,
+  required: 2
+};
+function bindsLess(is, than) {
+  return DEVICE_BINDING_STRENGTH[is.deviceBinding] < DEVICE_BINDING_STRENGTH[than.deviceBinding];
+}
+function span(duration, none) {
+  return duration === null ? none : durationToMs(duration);
+}
+function looser(is, than) {
+  const never = Number.POSITIVE_INFINITY;
+  const stepUp = durationToMs(DEFAULT_STEP_UP_AFTER);
+  return span(is.idleTimeout, never) > span(than.idleTimeout, never) || span(is.absoluteTimeout, never) > span(than.absoluteTimeout, never) || span(is.accessTokenTtl, never) > span(than.accessTokenTtl, never) || span(is.refresh.reuseGracePeriod, 0) > span(than.refresh.reuseGracePeriod, 0) || span(is.stepUpAfter, stepUp) > span(than.stepUpAfter, stepUp);
+}
+function passwordWeakenings(was, is) {
+  const repeats = (policy) => policy.maxRepeatedChars ?? Number.POSITIVE_INFINITY;
+  const fields = [];
+  if (is.minLength < was.minLength) {
+    fields.push("minLength");
+  }
+  if (BREACH_CHECK_STRENGTH[is.breachCheck] < BREACH_CHECK_STRENGTH[was.breachCheck]) {
+    fields.push("breachCheck");
+  }
+  fields.push(...SWITCHED_RULES.filter((rule) => was[rule] && !is[rule]));
+  if (is.minCharacterClasses < was.minCharacterClasses) {
+    fields.push("minCharacterClasses");
+  }
+  if (repeats(is) > repeats(was)) {
+    fields.push("maxRepeatedChars");
+  }
+  if (is.history < was.history) {
+    fields.push("history");
+  }
+  return fields.map((field) => `password.${field}`);
+}
+function shorterRetention(was, is) {
+  return is !== null && (was === null || is < was);
+}
+function claimsOf(settings, profile) {
+  return jwtTemplateOfProfile(settings, profile)?.template.claims ?? {};
+}
+function claimsLost(was, is) {
+  return Object.entries(was).some(([key, claim]) => !Object.hasOwn(is, key) || JSON.stringify(is[key]) !== JSON.stringify(claim));
+}
+function sessionWeakenings(before, after) {
+  const paths = [];
+  if (before.maxPerUser !== null && (after.maxPerUser === null || after.maxPerUser > before.maxPerUser)) {
+    paths.push("sessions.maxPerUser");
+  }
+  for (const [name, was] of Object.entries(before.profiles)) {
+    const is = Object.hasOwn(after.profiles, name) ? after.profiles[name] ?? was : null;
+    const weaker = is ? looser(is, was) || is.clientSelectable && !was.clientSelectable : looser(after.profiles.web, was);
+    if (weaker) {
+      paths.push(`sessions.profiles.${name}`);
+    }
+    if (claimsLost(claimsOf(before, was), claimsOf(after, is ?? after.profiles.web))) {
+      paths.push(`sessions.profiles.${name}.jwtTemplate`);
+    }
+    if (bindsLess(is ?? after.profiles.mobile, was)) {
+      paths.push(`sessions.profiles.${name}.deviceBinding`);
+    }
+  }
+  for (const [name, is] of Object.entries(after.profiles)) {
+    if (Object.hasOwn(before.profiles, name) || !is.clientSelectable) {
+      continue;
+    }
+    if (looser(is, after.profiles.web)) {
+      paths.push(`sessions.profiles.${name}`);
+    }
+    if (after.profiles.mobile.deviceBinding === "required" && bindsLess(is, after.profiles.mobile)) {
+      paths.push(`sessions.profiles.${name}.deviceBinding`);
+    }
+  }
+  return paths;
+}
+function smsWeakenings(before, after) {
+  return after.dailyMessageLimit > before.dailyMessageLimit ? ["sms.dailyMessageLimit"] : [];
+}
+function textsGo(settings) {
+  return settings.sms.enabled && settings.sms.allowedCountries.length > 0;
+}
+function countryAdded(before, after) {
+  const had = new Set(before.sms.allowedCountries);
+  return after.sms.allowedCountries.some((country) => !had.has(country));
+}
+function smsSignsIn(settings) {
+  return settings.signIn.methods.smsCode.enabled && textsGo(settings);
+}
+function smsSignInWeakenings(before, after) {
+  if (!smsSignsIn(after)) {
+    return [];
+  }
+  if (!smsSignsIn(before)) {
+    return ["signIn.methods.smsCode"];
+  }
+  return countryAdded(before, after) ? ["sms.allowedCountries"] : [];
+}
+function smsSecondStepWeakenings(before, after) {
+  if (!after.mfa.smsCode.enabled || after.mfa.policy !== "required") {
+    return [];
+  }
+  if (!before.mfa.smsCode.enabled) {
+    return ["mfa.smsCode"];
+  }
+  if (!textsGo(after)) {
+    return [];
+  }
+  if (!textsGo(before)) {
+    return ["mfa.smsCode"];
+  }
+  return countryAdded(before, after) ? ["sms.allowedCountries"] : [];
+}
+function redirectWeakenings(before, after) {
+  const had = new Set(before.allowedRedirectUrls);
+  return after.allowedRedirectUrls.some((url) => !had.has(url) && isCustomSchemeRedirectUrl2(url)) ? ["urls.allowedRedirectUrls"] : [];
+}
+function settingsWeakenings(before, after) {
+  const paths = passwordWeakenings(before.password, after.password);
+  if (shorterRetention(before.audit.retentionDays, after.audit.retentionDays)) {
+    paths.push("audit.retentionDays");
+  }
+  if (!before.agents.proposalsInProduction && after.agents.proposalsInProduction) {
+    paths.push("agents.proposalsInProduction");
+  }
+  for (const notice of NOTICES) {
+    if (before.notifications[notice] && !after.notifications[notice]) {
+      paths.push(`notifications.${notice}`);
+    }
+  }
+  if (MFA_POLICY_STRENGTH[after.mfa.policy] < MFA_POLICY_STRENGTH[before.mfa.policy]) {
+    paths.push("mfa.policy");
+  }
+  const secondStep = smsSecondStepWeakenings(before, after);
+  paths.push(...secondStep.filter((path) => path === "mfa.smsCode"));
+  paths.push(...sessionWeakenings(before.sessions, after.sessions));
+  paths.push(...smsWeakenings(before.sms, after.sms));
+  const signIn = smsSignInWeakenings(before, after);
+  paths.push(...signIn);
+  if (secondStep.includes("sms.allowedCountries") && !signIn.includes("sms.allowedCountries")) {
+    paths.push("sms.allowedCountries");
+  }
+  paths.push(...redirectWeakenings(before.urls, after.urls));
+  const wasAllowed = before.agents.testSignIn;
+  const isAllowed = after.agents.testSignIn;
+  if (isAllowed === true && wasAllowed !== true || isAllowed === null && wasAllowed === false) {
+    paths.push("agents.testSignIn");
+  }
+  return paths;
+}
+// src/sign-in-test.ts
+import * as z22 from "zod";
+var SignInTestStepResultSchema = z22.strictObject({
+  step: z22.enum(SIGN_IN_TEST_STEPS),
+  outcome: z22.enum(SIGN_IN_TEST_STEP_OUTCOMES),
+  durationMs: z22.number().int().min(0),
+  code: ErrorCodeSchema.optional(),
+  reason: z22.enum(SIGN_IN_TEST_REASONS).optional()
+}).meta({ ref: "SignInTestStepResult" });
+var SignInTestReportSchema = z22.strictObject({
+  outcome: z22.enum(SIGN_IN_TEST_OUTCOMES),
+  steps: z22.array(SignInTestStepResultSchema).length(SIGN_IN_TEST_STEPS.length),
+  userId: z22.uuid().nullable(),
+  cleanup: z22.enum(SIGN_IN_TEST_CLEANUPS)
+}).meta({ ref: "SignInTestReport" });
+// src/sms.ts
+import { z as z23 } from "zod";
+var SMS_USAGE_MAX_DAYS = 30;
+var SMS_USAGE_DEFAULT_DAYS = 7;
+var SMS_USAGE_MAX_PREFIXES = 100;
+var count = z23.number().int().min(0);
+var SmsPrefixUsageSchema = z23.object({
+  prefix: z23.string().regex(new RegExp(`^\\+[0-9]{1,${SMS_PREFIX_MAX_DIGITS}}$`)),
+  sent: count,
+  used: count,
+  unused: count
+}).meta({ ref: "SmsPrefixUsage" });
+var SmsUsageSchema = z23.object({
+  since: z23.iso.date(),
+  days: z23.number().int().min(1).max(SMS_USAGE_MAX_DAYS),
+  sent: count,
+  used: count,
+  unused: count,
+  prefixes: z23.array(SmsPrefixUsageSchema).max(SMS_USAGE_MAX_PREFIXES),
+  truncated: z23.boolean()
+}).meta({ ref: "SmsUsage" });
+export {
+  ACCESS_TOKEN_ALGORITHM,
+  ACCESS_TOKEN_VERSION,
+  ACTIVITY_TYPES2 as ACTIVITY_TYPES,
+  AGENT_KEY_PREFIX,
+  ANDROID_APK_KEY_HASH_PREFIX,
+  APPLE_TEAM_ID_PATTERN,
+  APP_LINK_PATH_PATTERN,
+  ASSET_LINKS_APP_LINK_RELATION,
+  ASSET_LINKS_RELATIONS,
+  AT_LEAST_ONE_SIGN_IN_METHOD,
+  AUDIT_ACTOR_TYPES,
+  AUDIT_TARGET_TYPES,
+  AUTHENTICATION_METHODS,
+  AccessTokenClaimsSchema,
+  ActivityTypeSchema,
+  AdditionalClientIdsSchema,
+  AdminSessionSchema,
+  AndroidAppIdentitySchema,
+  AndroidAppSchema,
+  AppleAppSiteAssociationSchema,
+  ApproveProposalRequestSchema,
+  AssetLinksSchema,
+  AuditLogListSchema,
+  AuditLogSchema,
+  BACKUP_CODE_COUNT,
+  BUILT_IN_SESSION_PROFILES,
+  BUNDLE_ID_PATTERN,
+  BackupCodesSchema,
+  CAN_STILL_SIGN_IN_HEADER2 as CAN_STILL_SIGN_IN_HEADER,
+  CERT_FINGERPRINT_PATTERN,
+  CLIENT_HEADER2 as CLIENT_HEADER,
+  COMMON_PASSWORDS2 as COMMON_PASSWORDS,
+  CONFIG_HASH_HEADER2 as CONFIG_HASH_HEADER,
+  CONFIG_HASH_PATTERN,
+  CONFIG_MANAGED_BY_HEADER2 as CONFIG_MANAGED_BY_HEADER,
+  CONFIG_TOOL_PATTERN,
+  CONFIG_UNMANAGED2 as CONFIG_UNMANAGED,
+  COUNTRY_CALLING_PREFIXES,
+  CUSTOM_CLAIMS_CLAIM2 as CUSTOM_CLAIMS_CLAIM,
+  CUSTOM_SCHEME_REDIRECT_REFUSALS2 as CUSTOM_SCHEME_REDIRECT_REFUSALS,
+  ChangePasswordRequestSchema,
+  ClientConfigSchema,
+  CreateHookRequestSchema,
+  CreateNativeAppRequestSchema,
+  CreateProposalRequestSchema,
+  CreateUserRequestSchema,
+  CreateWebhookEndpointRequestSchema,
+  CreatedHookSchema,
+  CreatedWebhookEndpointSchema,
+  CurrentUserSchema,
+  DASHBOARD_HEADER2 as DASHBOARD_HEADER,
+  DASHBOARD_HEADER_VALUE2 as DASHBOARD_HEADER_VALUE,
+  DASHBOARD_SESSION_COOKIE2 as DASHBOARD_SESSION_COOKIE,
+  DEFAULT_APP_NAME,
+  DEFAULT_ENVIRONMENT_SETTINGS,
+  DEFAULT_MOBILE_SESSION_PROFILE,
+  DEFAULT_PAGE_SIZE,
+  DEFAULT_SMS_DAILY_MESSAGE_LIMIT,
+  DEFAULT_SPECIAL_CHARS2 as DEFAULT_SPECIAL_CHARS,
+  DEFAULT_STEP_UP_AFTER,
+  DEFAULT_THEME2 as DEFAULT_THEME,
+  DEFAULT_WEB_SESSION_PROFILE,
+  DEPENDENT_ACCOUNTS_SCAN_LIMIT,
+  DPOP_ALGORITHMS2 as DPOP_ALGORITHMS,
+  DPOP_HEADER2 as DPOP_HEADER,
+  DPOP_NONCE_HEADER2 as DPOP_NONCE_HEADER,
+  DPOP_PROOF_TYPE2 as DPOP_PROOF_TYPE,
+  DeviceBindingPolicySchema,
+  DurationSchema,
+  EMAIL_LINK_ATTEMPT_PARAM2 as EMAIL_LINK_ATTEMPT_PARAM,
+  EMAIL_LINK_SCHEMES2 as EMAIL_LINK_SCHEMES,
+  EMAIL_LINK_TOKEN_PARAM2 as EMAIL_LINK_TOKEN_PARAM,
+  EMAIL_TEMPLATE_DIGIT_PLACEHOLDERS2 as EMAIL_TEMPLATE_DIGIT_PLACEHOLDERS,
+  EMAIL_TEMPLATE_KINDS2 as EMAIL_TEMPLATE_KINDS,
+  EMAIL_TEMPLATE_PLACEHOLDERS2 as EMAIL_TEMPLATE_PLACEHOLDERS,
+  EMAIL_TEMPLATE_RULES2 as EMAIL_TEMPLATE_RULES,
+  ENVIRONMENT_HEADER2 as ENVIRONMENT_HEADER,
+  ERROR_CODES2 as ERROR_CODES,
+  ERROR_DEFINITIONS2 as ERROR_DEFINITIONS,
+  EVENT_DATA_SCHEMAS,
+  EVENT_FIXTURES,
+  EVENT_SCHEMAS,
+  EVENT_SCHEMA_VERSION2 as EVENT_SCHEMA_VERSION,
+  EVENT_TARGET_TYPES2 as EVENT_TARGET_TYPES,
+  EmailAddressRequestSchema,
+  EmailAddressVerifyRequestSchema,
+  EmailCodeSentSchema,
+  EmailLinkRequestSchema,
+  EmailLinkResultSchema,
+  EmailSettingsSchema,
+  EmailTemplateSchema,
+  EmailTemplatesSchema,
+  EmailVerificationStrategySchema,
+  EnvironmentSettingsInputSchema,
+  EnvironmentSettingsSchema,
+  ErrorCodeSchema,
+  ErrorEnvelopeSchema,
+  ErrorParamsSchema,
+  EventActorSchema,
+  FLOW_ATTEMPT_HEADER2 as FLOW_ATTEMPT_HEADER,
+  FactorEnrolmentMethodSchema,
+  FactorsSchema,
+  FieldErrorSchema,
+  FirstFactorAttemptRequestSchema,
+  FirstFactorPrepareRequestSchema,
+  FirstFactorStrategySchema,
+  FlowAttemptSchema,
+  FlowKindSchema,
+  FlowStepSchema,
+  HOOK_ANSWER_KINDS,
+  HOOK_DEFAULT_DEADLINE_MS,
+  HOOK_DENIAL_CODE_PATTERN,
+  HOOK_FAILURE_MODES,
+  HOOK_FAILURE_REASONS,
+  HOOK_FIELDS,
+  HOOK_MAX_DEADLINE_MS,
+  HOOK_MAX_DENIAL_CODE_LENGTH,
+  HOOK_MIN_DEADLINE_MS,
+  HOOK_OUTCOMES,
+  HOOK_OUTCOME_WINDOW_HOURS,
+  HOOK_POINTS,
+  HOOK_QUESTION_FIXTURES,
+  HOOK_QUESTION_SCHEMAS,
+  HOOK_QUESTION_TYPES,
+  HOOK_SCHEMA_VERSION,
+  HOOK_SIGN_UP_METHODS,
+  HookAnswerSchema,
+  HookBeforeSessionDataSchema,
+  HookBeforeSignUpDataSchema,
+  HookBeforeTokenDataSchema,
+  HookClaimsAnswerSchema,
+  HookListSchema,
+  HookPointSchema,
+  HookQuestionSchema,
+  HookRecentOutcomesSchema,
+  HookSchema,
+  ID_TOKEN_CLIENT_KINDS,
+  ID_TOKEN_PROVIDERS,
+  INSTANCE_ACTIVITY_TYPES,
+  INSTANCE_AUDIT_TARGET_TYPES,
+  IdTokenExchangeRequestSchema,
+  IdTokenProviderSchema,
+  IdTokenStartRequestSchema,
+  IdTokenStartSchema,
+  IdentityLinkStartSchema,
+  IdentityListSchema,
+  IdentitySchema,
+  InstanceActivityTypeSchema,
+  IosAppIdentitySchema,
+  IosAppSchema,
+  JWT_TEMPLATE_SOURCES,
+  JwkSchema,
+  JwksSchema,
+  JwtTemplateClaimSchema,
+  JwtTemplateSchema,
+  JwtTemplateSourceSchema,
+  MAX_ACCESS_TOKEN_TTL,
+  MAX_ADDITIONAL_CLIENT_IDS,
+  MAX_ALLOWED_ORIGINS,
+  MAX_ALLOWED_REDIRECT_URLS,
+  MAX_APP_LINK_PATHS,
+  MAX_APP_LINK_PATH_LENGTH,
+  MAX_APP_NAME_LENGTH,
+  MAX_AUDIT_RETENTION_DAYS,
+  MAX_BUNDLE_ID_LENGTH,
+  MAX_CERT_FINGERPRINTS,
+  MAX_CHANGED_SETTINGS,
+  MAX_CUSTOM_CLAIMS_BYTES2 as MAX_CUSTOM_CLAIMS_BYTES,
+  MAX_CUSTOM_CLAIM_CONSTANT_LENGTH2 as MAX_CUSTOM_CLAIM_CONSTANT_LENGTH,
+  MAX_CUSTOM_CLAIM_KEY_LENGTH2 as MAX_CUSTOM_CLAIM_KEY_LENGTH,
+  MAX_CUSTOM_SESSION_PROFILES,
+  MAX_DPOP_PROOF_LENGTH2 as MAX_DPOP_PROOF_LENGTH,
+  MAX_DURATION_MS,
+  MAX_EMAIL_BODY_LENGTH2 as MAX_EMAIL_BODY_LENGTH,
+  MAX_EMAIL_CLAIM_BYTES,
+  MAX_EMAIL_SUBJECT_LENGTH2 as MAX_EMAIL_SUBJECT_LENGTH,
+  MAX_EMAIL_TEMPLATES_BYTES2 as MAX_EMAIL_TEMPLATES_BYTES,
+  MAX_ID_TOKEN_LENGTH,
+  MAX_ID_TOKEN_NAME_LENGTH,
+  MAX_JWT_TEMPLATES2 as MAX_JWT_TEMPLATES,
+  MAX_JWT_TEMPLATE_CLAIMS2 as MAX_JWT_TEMPLATE_CLAIMS,
+  MAX_NATIVE_APPS,
+  MAX_PACKAGE_NAME_LENGTH,
+  MAX_PAGE_SIZE,
+  MAX_PASSKEYS_PER_USER,
+  MAX_PASSKEY_NAME_LENGTH,
+  MAX_PASSWORD_HISTORY,
+  MAX_PHONE_NUMBER_DIGITS,
+  MAX_REUSE_GRACE_PERIOD,
+  MAX_SESSIONS_PER_USER,
+  MAX_SESSION_PROFILE_NAME_LENGTH,
+  MAX_SESSION_TIMEOUT,
+  MAX_SETTING_NAME_LENGTH,
+  MAX_SMS_DAILY_MESSAGE_LIMIT,
+  MAX_SMS_TEMPLATE_LENGTH,
+  MAX_STEP_UP_AFTER,
+  MAX_VERIFIED_TOKEN_LENGTH,
+  MAX_WEBHOOK_ENDPOINTS,
+  MAX_WEBHOOK_URL_LENGTH,
+  MICROSOFT_TENANT_ALIASES,
+  MIN_ACCESS_TOKEN_TTL,
+  MIN_IDLE_TIMEOUT,
+  MIN_PASSWORD_MIN_LENGTH,
+  MIN_PHONE_NUMBER_DIGITS,
+  MIN_REUSE_GRACE_PERIOD,
+  MIN_STEP_UP_AFTER,
+  MfaPolicySchema,
+  MicrosoftTenantSchema,
+  NATIVE_APP_FIELDS,
+  NATIVE_APP_PLATFORMS,
+  NativeAppListSchema,
+  NativeAppSchema,
+  NewPasswordReasonSchema,
+  NewPasswordRequestSchema,
+  OAUTH_ERROR_PARAM2 as OAUTH_ERROR_PARAM,
+  OAUTH_PROVIDERS,
+  OAUTH_PROVIDERS_WITHOUT_ADDRESS,
+  OAUTH_PROVIDERS_WITHOUT_PKCE2 as OAUTH_PROVIDERS_WITHOUT_PKCE,
+  OAUTH_PROVIDERS_WITH_PKCE2 as OAUTH_PROVIDERS_WITH_PKCE,
+  OAUTH_TICKET_PARAM2 as OAUTH_TICKET_PARAM,
+  OAuthExchangeRequestSchema,
+  OAuthProviderDependentsSchema,
+  OAuthProviderSchema,
+  OAuthProviderSettingsListSchema,
+  OAuthProviderSettingsSchema,
+  OAuthProviderUpdateSchema,
+  OAuthStartRequestSchema,
+  OAuthStartSchema,
+  PACKAGE_NAME_PATTERN,
+  PASSKEY_ALGORITHMS,
+  PASSKEY_CHALLENGE_TTL_MS,
+  PASSWORD_POLICY_PRESETS,
+  PROPOSAL_APPROVAL_REFUSALS,
+  PROPOSAL_APPROVER_TYPES,
+  PROPOSAL_CREATION_REFUSALS,
+  PROPOSAL_EXPIRY_REASONS,
+  PROPOSAL_FAILURE_REASONS,
+  PROPOSAL_OPERATIONS,
+  PROPOSAL_OPERATION_TARGETS,
+  PROPOSAL_STATUSES,
+  PROPOSAL_TARGET_TYPES,
+  PUBLISHABLE_KEY_HEADER2 as PUBLISHABLE_KEY_HEADER,
+  PUBLISHABLE_KEY_PREFIX,
+  PaginationMetaSchema,
+  PasskeyAssertionCredentialSchema,
+  PasskeyCreationOptionsSchema,
+  PasskeyListSchema,
+  PasskeyRegisterRequestSchema,
+  PasskeyRegistrationCredentialSchema,
+  PasskeyRenameRequestSchema,
+  PasskeyRequestOptionsSchema,
+  PasskeySchema,
+  PasskeySignInRequestSchema,
+  PasskeySignInStartSchema,
+  PasswordAttemptRequestSchema,
+  PasswordPolicySchema,
+  PasswordResetRequestSchema,
+  PasswordResetStartRequestSchema,
+  PhoneCodeSentSchema,
+  PhoneNumberRequestSchema,
+  PhoneNumberVerifyRequestSchema,
+  PreparedFirstFactorStrategySchema,
+  PreparedSecondFactorMethodSchema,
+  ProposalApproverSchema,
+  ProposalListSchema,
+  ProposalOperationSchema,
+  ProposalSchema,
+  ProposalStatusSchema,
+  ProposalTargetSchema,
+  REDIRECT_SCHEMES_NEVER_CUSTOM2 as REDIRECT_SCHEMES_NEVER_CUSTOM,
+  REDIRECT_SCHEME_FAMILIES_NEVER_CUSTOM2 as REDIRECT_SCHEME_FAMILIES_NEVER_CUSTOM,
+  REFRESH_TOKEN_PREFIX,
+  RESERVED_CLAIM_NAMES2 as RESERVED_CLAIM_NAMES,
+  RedirectUrlSchema,
+  RefreshTokenRequestSchema,
+  RevokedSessionsSchema,
+  RotatedWebhookSecretSchema,
+  SECRET_KEY_PREFIX,
+  SESSION_PROFILE_HEADER2 as SESSION_PROFILE_HEADER,
+  SIGN_IN_METHODS_WITHOUT_SIGN_UP,
+  SIGN_IN_TEST_CLEANUPS,
+  SIGN_IN_TEST_OUTCOMES,
+  SIGN_IN_TEST_REASONS,
+  SIGN_IN_TEST_REFUSALS,
+  SIGN_IN_TEST_STEPS,
+  SIGN_IN_TEST_STEP_OUTCOMES,
+  SMS_COUNTRIES,
+  SMS_ENVIRONMENT_HOURLY_SHARE,
+  SMS_PREFIX_HOURLY_SHARE,
+  SMS_PREFIX_MAX_DIGITS,
+  SMS_TEMPLATE_KINDS,
+  SMS_TEMPLATE_PLACEHOLDERS,
+  SMS_TEMPLATE_RULES,
+  SMS_USAGE_DEFAULT_DAYS,
+  SMS_USAGE_MAX_DAYS,
+  SMS_USAGE_MAX_PREFIXES,
+  STEP_UP_MAX_AGE_SECONDS,
+  SecondFactorMethodSchema,
+  SecondFactorPrepareRequestSchema,
+  SecondFactorRequestSchema,
+  SendTestWebhookRequestSchema,
+  SessionClientSchema,
+  SessionLimitActionSchema,
+  SessionListSchema,
+  SessionProfileNameSchema,
+  SessionProfileSchema,
+  SessionSchema,
+  SessionSettingsSchema,
+  SessionTokensSchema,
+  SessionTypeSchema,
+  SetPasswordRequestSchema,
+  SetUserEmailRequestSchema,
+  SettingsManagedBySchema,
+  SignInStartRequestSchema,
+  SignInTestReportSchema,
+  SignInTestStepResultSchema,
+  SignUpPasswordModeSchema,
+  SignUpRequestSchema,
+  SmsCountrySchema,
+  SmsFactorCodeSchema,
+  SmsFactorConfirmRequestSchema,
+  SmsPrefixUsageSchema,
+  SmsTemplateSchema,
+  SmsTemplatesSchema,
+  SmsUsageSchema,
+  StepUpEmailCodeSchema,
+  StepUpMethodSchema,
+  StepUpRequestSchema,
+  StoredSessionSettingsSchema,
+  TEST_ADDRESS_DOMAIN,
+  TEST_ADDRESS_LOCAL_PREFIX,
+  THEME_TOKENS2 as THEME_TOKENS,
+  TOTP_DIGITS,
+  TOTP_PERIOD_SECONDS,
+  TotpConfirmRequestSchema,
+  TotpEnrolmentSchema,
+  TulaEventSchema,
+  UpdateHookRequestSchema,
+  UpdateNativeAppRequestSchema,
+  UpdateWebhookEndpointRequestSchema,
+  UserAuthenticationSchema,
+  UserListSchema,
+  UserSchema,
+  UserSortSchema,
+  VerifyEmailRequestSchema,
+  VerifySessionRequestSchema,
+  WEBHOOK_DELIVERY_STATES,
+  WEBHOOK_DISABLED_REASONS,
+  WEBHOOK_ENDPOINT_FIELDS,
+  WEBHOOK_ID_HEADER2 as WEBHOOK_ID_HEADER,
+  WEBHOOK_REDELIVER_REFUSALS,
+  WEBHOOK_ROTATION_REFUSALS,
+  WEBHOOK_SECRET_PREFIX2 as WEBHOOK_SECRET_PREFIX,
+  WEBHOOK_SIGNATURE_HEADER2 as WEBHOOK_SIGNATURE_HEADER,
+  WEBHOOK_SIGNATURE_VERSION2 as WEBHOOK_SIGNATURE_VERSION,
+  WEBHOOK_TIMESTAMP_HEADER2 as WEBHOOK_TIMESTAMP_HEADER,
+  WEBHOOK_TOLERANCE_SECONDS2 as WEBHOOK_TOLERANCE_SECONDS,
+  WebOriginSchema,
+  WebSessionProfileSchema,
+  WebhookDeliveryAttemptSchema,
+  WebhookDeliveryDetailSchema,
+  WebhookDeliveryListSchema,
+  WebhookDeliverySchema,
+  WebhookEndpointListSchema,
+  WebhookEndpointSchema,
+  WebhookSendResultSchema,
+  androidApkKeyHashOrigin,
+  appleAppSiteAssociation,
+  assetLinks,
+  bindsCodeWithPkce2 as bindsCodeWithPkce,
+  builtInSessionProfile,
+  checkCustomClaims2 as checkCustomClaims,
+  contrastRatio2 as contrastRatio,
+  createDpopProof2 as createDpopProof,
+  customClaimsBytes2 as customClaimsBytes,
+  customSchemeRedirectRefusal2 as customSchemeRedirectRefusal,
+  darkCssVariable2 as darkCssVariable,
+  defaultDeviceBinding,
+  durationToMs,
+  emailTemplateParagraphs2 as emailTemplateParagraphs,
+  emailTemplateProblems2 as emailTemplateProblems,
+  emailTemplatesBytes2 as emailTemplatesBytes,
+  environmentIssuer2 as environmentIssuer,
+  errorDefinition2 as errorDefinition,
+  evaluatePassword2 as evaluatePassword,
+  formatWebhookSecret2 as formatWebhookSecret,
+  generateSoftwareDeviceKey2 as generateSoftwareDeviceKey,
+  givesNoAddress,
+  hasEnabledSignInMethod,
+  hasForbiddenRedirectCharacter2 as hasForbiddenRedirectCharacter,
+  hasHiddenCharacter2 as hasHiddenCharacter,
+  hasInvisibleCharacter2 as hasInvisibleCharacter,
+  hookFailureOutcome,
+  hookLastCallFailed,
+  hookWeakenings,
+  isAppLinkPath,
+  isCustomClaimKey2 as isCustomClaimKey,
+  isCustomClaimValue2 as isCustomClaimValue,
+  isCustomSchemeRedirectUrl2 as isCustomSchemeRedirectUrl,
+  isDevicePublicJwk2 as isDevicePublicJwk,
+  isEmailTemplateKind2 as isEmailTemplateKind,
+  isGoogleClientId,
+  isKeyThumbprint2 as isKeyThumbprint,
+  isPhoneNumberAllowed,
+  isProposalTargetId,
+  isRedirectUrl2 as isRedirectUrl,
+  isRelyingPartyId,
+  isSessionProfileName,
+  isSmsCountry,
+  isSmsTemplateKind,
+  isTestAddress,
+  isValidThemeValue2 as isValidThemeValue,
+  jwkThumbprint2 as jwkThumbprint,
+  jwksUrl2 as jwksUrl,
+  jwtTemplateMaxBytes,
+  jwtTemplateOfProfile,
+  maskPhoneNumber,
+  nativeAppIdentifier,
+  nativeAppWeakenings,
+  normalizeAppLinkPaths,
+  normalizeCertFingerprint,
+  normalizeCertFingerprints,
+  normalizePassword2 as normalizePassword,
+  oauthProviderWeakenings,
+  originMatchesRelyingParty,
+  ownClientIdAmong,
+  parseEmailTemplate2 as parseEmailTemplate,
+  parsePhoneNumber,
+  parseStoredEnvironmentSettings,
+  phoneNumberCountries,
+  phoneNumberPrefix,
+  profileOfSession,
+  proposalSummary,
+  readCustomClaims2 as readCustomClaims,
+  readHookClaimsAnswer,
+  readStoredEmailTemplates2 as readStoredEmailTemplates,
+  readStoredEnvironmentSettings,
+  readStoredJwtTemplate,
+  readStoredSmsTemplates,
+  readsAsLink2 as readsAsLink,
+  redirectUrlKind2 as redirectUrlKind,
+  resolveSessionProfile,
+  settingsWeakenings,
+  signWebhook2 as signWebhook,
+  smsCostLimits,
+  smsPrefixCountries,
+  smsSegments,
+  smsTemplateProblems,
+  stepUpWindowSeconds,
+  takesAdditionalClientIds,
+  testAddress,
+  testSignInAllowed,
+  themeToCssVariables2 as themeToCssVariables,
+  visibleEmailText2 as visibleEmailText,
+  webhookSecretBytes2 as webhookSecretBytes,
+  withoutHiddenCharacters2 as withoutHiddenCharacters,
+  withoutInvisibleCharacters2 as withoutInvisibleCharacters
+};