@workos-inc/node 10.10.0 → 10.12.0

package/lib/{factory-vzr4nni7.d.mts → factory-CCkRzS83.d.mts}

@@ -2695,10 +2695,38 @@ interface AddFlagTargetOptions {
 }
 //#endregion
 //#region src/feature-flags/interfaces/evaluation-context.interface.d.ts
-interface EvaluationContext {
+/**
+ * A single resource in a typed evaluation context. V1 carries only the exact
+ * resource ID; attribute matching is a future capability layered onto this
+ * same shape.
+ */
+interface EvaluationResource {
+  id: string;
+}
+/**
+ * Legacy evaluation context, accepted for backward compatibility and
+ * normalized internally to the typed form: `userId` matches `user` targets
+ * and `organizationId` matches `organization` targets.
+ */
+type LegacyEvaluationContext = {
   userId?: string;
   organizationId?: string;
-}
+};
+/**
+ * Typed evaluation context: a direct map of target type slug to the resource
+ * being evaluated, e.g.
+ * `{ user: { id: 'user_123' }, workspace: { id: 'ws_1' } }`.
+ * A context contains at most one resource of each type; callers needing a
+ * decision per resource should evaluate once per resource.
+ */
+type TypedEvaluationContext = Record<string, EvaluationResource>;
+/**
+ * Either evaluation context form. The two shapes cannot be mixed in a single
+ * call: a hybrid context (a legacy key alongside a typed resource entry) is
+ * rejected at evaluation time with a logged warning and matches no targets,
+ * so the flag falls back to its default value.
+ */
+type EvaluationContext = LegacyEvaluationContext | TypedEvaluationContext;
 //#endregion
 //#region src/feature-flags/interfaces/feature-flag.interface.d.ts
 interface FeatureFlag {
@@ -2741,6 +2769,11 @@ interface FlagTarget {
   id: string;
   enabled: boolean;
 }
+interface FlagCustomTarget {
+  type: string;
+  id: string;
+  enabled: boolean;
+}
 interface FlagPollEntry {
   slug: string;
   enabled: boolean;
@@ -2748,6 +2781,8 @@ interface FlagPollEntry {
   targets: {
     users: FlagTarget[];
     organizations: FlagTarget[];
+    /** Absent until the API's custom-targets rollout flag is enabled. */
+    custom_targets?: FlagCustomTarget[];
   };
 }
 type FlagPollResponse = Record<string, FlagPollEntry>;
@@ -2882,188 +2917,847 @@ interface SerializedUpdateGroupOptions {
   description?: string | null;
 }
 //#endregion
-//#region src/vault/interfaces/key.interface.d.ts
-interface KeyContext {
-  [key: string]: any;
+//#region src/pipes/interfaces/authorize-data-integration-options.interface.d.ts
+interface AuthorizeDataIntegrationOptions {
+  /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
+  slug: string;
+  /** The ID of the user to authorize. */
+  userId: string;
+  /** An organization ID to scope the authorization to a specific organization. */
+  organizationId?: string;
+  /** The URL to redirect the user to after authorization. */
+  returnTo?: string;
 }
-interface DataKeyPair {
-  context: KeyContext;
-  dataKey: DataKey;
-  encryptedKeys: string;
+//#endregion
+//#region src/pipes/interfaces/connected-account-auth-method.interface.d.ts
+declare const ConnectedAccountAuthMethod: {
+  readonly OAuth: "oauth";
+  readonly ApiKey: "api_key";
+};
+type ConnectedAccountAuthMethod = (typeof ConnectedAccountAuthMethod)[keyof typeof ConnectedAccountAuthMethod];
+//#endregion
+//#region src/pipes/interfaces/connected-account-state.interface.d.ts
+declare const ConnectedAccountState: {
+  readonly Connected: "connected";
+  readonly NeedsReauthorization: "needs_reauthorization";
+};
+type ConnectedAccountState = (typeof ConnectedAccountState)[keyof typeof ConnectedAccountState];
+//#endregion
+//#region src/pipes/interfaces/connected-account.interface.d.ts
+interface ConnectedAccount {
+  /** Distinguishes the connected account object. */
+  object: 'connected_account';
+  /** The unique identifier of the connected account. */
+  id: string;
+  /** The [User](https://workos.com/docs/reference/authkit/user) identifier associated with this connection. */
+  userId: string | null;
+  /** The [Organization](https://workos.com/docs/reference/organization) identifier associated with this connection, or `null` if not scoped to an organization. */
+  organizationId: string | null;
+  /** The OAuth scopes granted for this connection. */
+  scopes: string[];
+  /** The authentication method used for this connection (`oauth` or `api_key`). Defaults to `oauth` if absent. */
+  authMethod?: ConnectedAccountAuthMethod;
+  /** The last four characters of the API key, or `null` for OAuth connections. */
+  apiKeyLast4?: string | null;
+  /**
+   * The state of the connected account:
+   * - `connected`: The connection is active and tokens are valid.
+   * - `needs_reauthorization`: The user needs to reauthorize the connection, typically because required scopes have changed.
+   * - `disconnected`: The connection has been disconnected.
+   */
+  state: ConnectedAccountState;
+  /** The timestamp when the connection was created. */
+  createdAt: string;
+  /** The timestamp when the connection was last updated. */
+  updatedAt: string;
 }
-interface DataKey {
-  key: string;
+interface ConnectedAccountResponse {
+  object: 'connected_account';
   id: string;
+  user_id: string | null;
+  organization_id: string | null;
+  scopes: string[];
+  auth_method?: ConnectedAccountAuthMethod;
+  api_key_last_4?: string | null;
+  state: ConnectedAccountState;
+  created_at: string;
+  updated_at: string;
 }
 //#endregion
-//#region src/vault/interfaces/vault-event.interface.d.ts
-type VaultActorSource = 'api' | 'dashboard';
-interface VaultActor {
-  actorId: string;
-  actorSource: VaultActorSource;
-  actorName: string;
-}
-interface VaultActorResponse {
-  actor_id: string;
-  actor_source: VaultActorSource;
-  actor_name: string;
-}
-interface VaultDataMutatedEventData extends VaultActor {
-  kvName: string;
-  keyId: string;
-  keyContext: KeyContext;
+//#region src/pipes/interfaces/create-data-integration-credential-options.interface.d.ts
+interface CreateDataIntegrationCredentialOptions {
+  /** The identifier of the integration. */
+  slug: string;
+  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
+  userId: string;
+  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. */
+  organizationId?: string;
 }
-interface VaultDataMutatedEventResponseData extends VaultActorResponse {
-  kv_name: string;
-  key_id: string;
-  key_context: KeyContext;
+//#endregion
+//#region src/pipes/interfaces/data-integration-credentials-type.interface.d.ts
+declare const DataIntegrationCredentialsType: {
+  readonly Custom: "custom";
+  readonly Organization: "organization";
+};
+type DataIntegrationCredentialsType = (typeof DataIntegrationCredentialsType)[keyof typeof DataIntegrationCredentialsType];
+//#endregion
+//#region src/pipes/interfaces/data-integration-credentials-dto.interface.d.ts
+interface DataIntegrationCredentialsDto {
+  /** The credentials type. `custom` uses your own OAuth app credentials; `organization` has each organization supply its own credentials (configured per-organization). */
+  type: DataIntegrationCredentialsType;
+  /** OAuth client ID for the provider app. Required when `type` is `custom`; omit for `organization`. */
+  clientId?: string;
+  /** OAuth client secret for the provider app. Required when `type` is `custom`; omit for `organization`. */
+  clientSecret?: string;
 }
-type VaultDataCreatedEventData = VaultDataMutatedEventData;
-type VaultDataUpdatedEventData = VaultDataMutatedEventData;
-type VaultDataCreatedEventResponseData = VaultDataMutatedEventResponseData;
-type VaultDataUpdatedEventResponseData = VaultDataMutatedEventResponseData;
-interface VaultDataReadEventData extends VaultActor {
-  kvName: string;
-  keyId: string;
+interface DataIntegrationCredentialsDtoResponse {
+  type: DataIntegrationCredentialsType;
+  client_id?: string;
+  client_secret?: string;
 }
-interface VaultDataReadEventResponseData extends VaultActorResponse {
-  kv_name: string;
-  key_id: string;
+//#endregion
+//#region src/pipes/interfaces/custom-provider-definition-authenticate-via.interface.d.ts
+declare const CustomProviderDefinitionAuthenticateVia: {
+  readonly RequestBody: "request_body";
+  readonly BasicAuthHeader: "basic_auth_header";
+};
+type CustomProviderDefinitionAuthenticateVia = (typeof CustomProviderDefinitionAuthenticateVia)[keyof typeof CustomProviderDefinitionAuthenticateVia];
+//#endregion
+//#region src/pipes/interfaces/custom-provider-definition.interface.d.ts
+interface CustomProviderDefinition {
+  /** A descriptive name for the custom provider. */
+  name: string;
+  /** The provider's OAuth authorization endpoint. */
+  authorizationUrl: string;
+  /** The provider's OAuth token endpoint. */
+  tokenUrl: string;
+  /** The endpoint used to refresh tokens, if different from the token endpoint. */
+  refreshTokenUrl?: string | null;
+  /** Whether PKCE is used during the authorization code flow. Defaults to `true`. */
+  pkceEnabled?: boolean;
+  /** The separator used to join requested scopes. Defaults to a space. */
+  requestScopeSeparator?: string;
+  /** Whether at least one scope must be selected when connecting an account. Defaults to `false`. */
+  scopesRequired?: boolean;
+  /** Whether a client secret is required for this provider. Defaults to `true`. */
+  clientSecretRequired?: boolean;
+  /** Additional static query parameters appended to the authorization request. */
+  additionalAuthorizationParameters?: Record<string, string>;
+  /** The Content-Type used when exchanging the token request. */
+  tokenBodyContentType?: string;
+  /** How client credentials are sent when exchanging authorization codes and refreshing tokens. */
+  authenticateVia?: CustomProviderDefinitionAuthenticateVia;
 }
-interface VaultDataDeletedEventData extends VaultActor {
-  kvName: string;
+interface CustomProviderDefinitionResponse {
+  name: string;
+  authorization_url: string;
+  token_url: string;
+  refresh_token_url?: string | null;
+  pkce_enabled?: boolean;
+  request_scope_separator?: string;
+  scopes_required?: boolean;
+  client_secret_required?: boolean;
+  additional_authorization_parameters?: Record<string, string>;
+  token_body_content_type?: string;
+  authenticate_via?: CustomProviderDefinitionAuthenticateVia;
 }
-interface VaultDataDeletedEventResponseData extends VaultActorResponse {
-  kv_name: string;
+//#endregion
+//#region src/pipes/interfaces/create-data-integration-options.interface.d.ts
+interface CreateDataIntegrationOptions {
+  /** The provider to create a Data Integration for. For a built-in provider use its slug (e.g. `github`, `slack`). For a custom provider, this is the new provider slug and `custom_provider` must be supplied. A custom provider slug cannot shadow an existing global provider slug. */
+  provider: string;
+  /** An optional description of the Data Integration. */
+  description?: string | null;
+  /** Whether the Data Integration is enabled. Defaults to `false`. */
+  enabled?: boolean;
+  /** The OAuth scopes to request for the Data Integration. Defaults to the provider's configured scopes when omitted. */
+  scopes?: string[] | null;
+  /** The credentials to configure for the Data Integration. Required for both built-in and custom providers. */
+  credentials?: DataIntegrationCredentialsDto;
+  /** The OAuth definition for a custom provider. Supply this to define a custom provider; omit it to create an integration for a built-in provider. */
+  customProvider?: CustomProviderDefinition;
 }
-interface VaultMetadataReadEventData extends VaultActor {
-  kvName: string;
+//#endregion
+//#region src/pipes/interfaces/create-user-connected-account-options.interface.d.ts
+interface CreateUserConnectedAccountOptions {
+  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
+  userId: string;
+  /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
+  slug: string;
+  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization. */
+  organizationId?: string;
+  /** The OAuth access token for the connected account. */
+  accessToken?: string;
+  /** The OAuth refresh token for the connected account. */
+  refreshToken?: string;
+  /** The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire. */
+  expiresAt?: Date;
+  /** The OAuth scopes granted for this connection. */
+  scopes?: string[];
+  /** Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided. */
+  state?: ConnectedAccountState;
 }
-interface VaultMetadataReadEventResponseData extends VaultActorResponse {
-  kv_name: string;
+//#endregion
+//#region src/pipes/interfaces/data-integration-access-token-response-access-token.interface.d.ts
+/** The [access token](https://workos.com/docs/reference/pipes/access-token) object, present when `active` is `true`. */
+interface DataIntegrationAccessTokenResponseAccessToken {
+  /** Distinguishes the access token object. */
+  object: 'access_token';
+  /** The OAuth access token for the connected integration. */
+  accessToken: string;
+  /** The ISO-8601 formatted timestamp indicating when the access token expires. */
+  expiresAt: Date | null;
+  /** The scopes granted to the access token. */
+  scopes: string[];
+  /** If the integration has requested scopes that aren't present on the access token, they're listed here. */
+  missingScopes: string[];
 }
-type VaultNamesListedEventData = VaultActor;
-type VaultNamesListedEventResponseData = VaultActorResponse;
-interface VaultKekCreatedEventData extends VaultActor {
-  keyName: string;
-  keyId: string;
+interface DataIntegrationAccessTokenResponseAccessTokenResponse {
+  object: 'access_token';
+  access_token: string;
+  expires_at: string | null;
+  scopes: string[];
+  missing_scopes: string[];
 }
-interface VaultKekCreatedEventResponseData extends VaultActorResponse {
-  key_name: string;
-  key_id: string;
+//#endregion
+//#region src/pipes/interfaces/data-integration-access-token-response.interface.d.ts
+type DataIntegrationAccessTokenResponse = {
+  active: true;
+  accessToken: DataIntegrationAccessTokenResponseAccessToken;
+} | {
+  active: false;
+  error: 'needs_reauthorization' | 'not_installed';
+};
+type DataIntegrationAccessTokenResponseWire = {
+  active: true;
+  access_token: DataIntegrationAccessTokenResponseAccessTokenResponse;
+} | {
+  active: false;
+  error: 'needs_reauthorization' | 'not_installed';
+};
+//#endregion
+//#region src/pipes/interfaces/data-integration-authorize-url-response.interface.d.ts
+interface DataIntegrationAuthorizeUrlResponse {
+  /** The OAuth authorization URL to redirect the user to. */
+  url: string;
 }
-interface VaultDekReadEventData extends VaultActor {
-  keyIds: string[];
-  keyContext: KeyContext;
+interface DataIntegrationAuthorizeUrlResponseWire {
+  url: string;
 }
-interface VaultDekReadEventResponseData extends VaultActorResponse {
-  key_ids: string[];
-  key_context: KeyContext;
+//#endregion
+//#region src/pipes/interfaces/data-integration-credential-type.interface.d.ts
+declare const DataIntegrationCredentialType: {
+  readonly Custom: "custom";
+  readonly Organization: "organization";
+};
+type DataIntegrationCredentialType = (typeof DataIntegrationCredentialType)[keyof typeof DataIntegrationCredentialType];
+//#endregion
+//#region src/pipes/interfaces/data-integration-credential.interface.d.ts
+/** The credentials configured for the Data Integration. */
+interface DataIntegrationCredential {
+  /** The credentials type. `custom` uses your own OAuth app credentials; `organization` has each organization supply its own credentials (so `client_id`/`redacted_client_secret` are null on the integration itself). */
+  type: DataIntegrationCredentialType;
+  /** The OAuth client ID configured for the provider app. Null for `organization` credentials. */
+  clientId: string | null;
+  /** The last four characters of the OAuth client secret. The full secret is never returned. Null for `organization` credentials. */
+  redactedClientSecret: string | null;
 }
-interface VaultDekDecryptedEventData extends VaultActor {
-  keyId: string;
+interface DataIntegrationCredentialResponse {
+  type: DataIntegrationCredentialType;
+  client_id: string | null;
+  redacted_client_secret: string | null;
 }
-interface VaultDekDecryptedEventResponseData extends VaultActorResponse {
-  key_id: string;
+//#endregion
+//#region src/pipes/interfaces/data-integration-credentials-response-credential.interface.d.ts
+/** The credential object containing the vended secret. */
+interface DataIntegrationCredentialsResponseCredential {
+  /** Distinguishes the credential object. */
+  object: 'credential';
+  /** The authentication method for this credential. Additional values may be added in the future; handle unknown values gracefully. */
+  authMethod: 'oauth';
+  /** The OAuth access token. */
+  value: string;
+  /** The ISO-8601 formatted timestamp indicating when the credential expires. */
+  expiresAt: string | null;
+  /** The scopes granted to the access token. */
+  scopes: string[];
+  /** If the integration has requested scopes that aren't present on the access token, they're listed here. */
+  missingScopes: string[];
 }
-type VaultByokKeyProvider = 'AWS_KMS' | 'GCP_KMS' | 'AZURE_KEY_VAULT';
-interface VaultByokKeyVerificationCompletedEventData {
-  organizationId: string;
-  keyProvider: VaultByokKeyProvider;
-  verified: boolean;
+interface DataIntegrationCredentialsResponseCredentialResponse {
+  object: 'credential';
+  auth_method: 'oauth';
+  value: string;
+  expires_at: string | null;
+  scopes: string[];
+  missing_scopes: string[];
 }
-interface VaultByokKeyVerificationCompletedEventResponseData {
-  organization_id: string;
-  key_provider: VaultByokKeyProvider;
-  verified: boolean;
+//#endregion
+//#region src/pipes/interfaces/data-integration-credentials-response-error.interface.d.ts
+declare const DataIntegrationCredentialsResponseError: {
+  readonly NotInstalled: "not_installed";
+  readonly NeedsReauthorization: "needs_reauthorization";
+};
+type DataIntegrationCredentialsResponseError = (typeof DataIntegrationCredentialsResponseError)[keyof typeof DataIntegrationCredentialsResponseError];
+//#endregion
+//#region src/pipes/interfaces/data-integration-custom-provider-authenticate-via.interface.d.ts
+declare const DataIntegrationCustomProviderAuthenticateVia: {
+  readonly RequestBody: "request_body";
+  readonly BasicAuthHeader: "basic_auth_header";
+};
+type DataIntegrationCustomProviderAuthenticateVia = (typeof DataIntegrationCustomProviderAuthenticateVia)[keyof typeof DataIntegrationCustomProviderAuthenticateVia];
+//#endregion
+//#region src/pipes/interfaces/data-integration-custom-provider.interface.d.ts
+interface DataIntegrationCustomProvider {
+  /** A descriptive name for the custom provider. */
+  name: string;
+  /** The provider's OAuth authorization endpoint. */
+  authorizationUrl: string | null;
+  /** The provider's OAuth token endpoint. */
+  tokenUrl: string | null;
+  /** The endpoint used to refresh tokens, if different from the token endpoint. */
+  refreshTokenUrl: string | null;
+  /** Whether PKCE is used during the authorization code flow. */
+  pkceEnabled: boolean;
+  /** The separator used to join requested scopes. */
+  requestScopeSeparator: string;
+  /** Whether at least one scope must be selected when connecting an account. */
+  scopesRequired: boolean;
+  /** Whether a client secret is required for this provider. */
+  clientSecretRequired: boolean;
+  /** Additional static query parameters appended to the authorization request. */
+  additionalAuthorizationParameters: Record<string, string>;
+  /** The Content-Type used when exchanging the token request. */
+  tokenBodyContentType: string;
+  /** How client credentials are sent when exchanging authorization codes and refreshing tokens. */
+  authenticateVia: DataIntegrationCustomProviderAuthenticateVia;
+}
+interface DataIntegrationCustomProviderResponse {
+  name: string;
+  authorization_url: string | null;
+  token_url: string | null;
+  refresh_token_url: string | null;
+  pkce_enabled: boolean;
+  request_scope_separator: string;
+  scopes_required: boolean;
+  client_secret_required: boolean;
+  additional_authorization_parameters: Record<string, string>;
+  token_body_content_type: string;
+  authenticate_via: DataIntegrationCustomProviderAuthenticateVia;
 }
 //#endregion
-//#region src/common/interfaces/event.interface.d.ts
-interface EventBase {
+//#region src/pipes/interfaces/data-integration-state.interface.d.ts
+declare const DataIntegrationState: {
+  readonly Valid: "valid";
+  readonly Invalid: "invalid";
+  readonly Requested: "requested";
+};
+type DataIntegrationState = (typeof DataIntegrationState)[keyof typeof DataIntegrationState];
+//#endregion
+//#region src/pipes/interfaces/data-integration.interface.d.ts
+interface DataIntegration {
+  /** Distinguishes the Data Integration object. */
+  object: 'data_integration';
+  /** Unique identifier of the Data Integration. */
   id: string;
-  createdAt: string;
-  context: Record<string, unknown> | undefined;
+  /** The provider slug for this Data Integration. */
+  slug: string;
+  /** The integration type derived from the provider. */
+  integrationType: string;
+  /** An optional description of the Data Integration. */
+  description: string | null;
+  /** Whether the Data Integration is enabled. */
+  enabled: boolean;
+  /** The state of the Data Integration. */
+  state: DataIntegrationState;
+  /** The OAuth scopes configured for the Data Integration. `null` when the provider's configured scopes are used. */
+  scopes: string[] | null;
+  /** The OAuth redirect URI to register with the provider when configuring the custom application. */
+  redirectUri: string;
+  /** The credentials configured for the Data Integration. */
+  credentials: DataIntegrationCredential;
+  /** The OAuth definition when this is a custom provider; `null` for built-in providers. */
+  customProvider: DataIntegrationCustomProvider | null;
+  /** An ISO 8601 timestamp. */
+  createdAt: Date;
+  /** An ISO 8601 timestamp. */
+  updatedAt: Date;
 }
-interface EventResponseBase {
+interface DataIntegrationResponse {
+  object: 'data_integration';
   id: string;
+  slug: string;
+  integration_type: string;
+  description: string | null;
+  enabled: boolean;
+  state: DataIntegrationState;
+  scopes: string[] | null;
+  redirect_uri: string;
+  credentials: DataIntegrationCredentialResponse;
+  custom_provider: DataIntegrationCustomProviderResponse | null;
   created_at: string;
-  context?: Record<string, unknown>;
-}
-interface AuthenticationEmailVerificationSucceededEvent extends EventBase {
-  event: 'authentication.email_verification_succeeded';
-  data: AuthenticationEvent;
+  updated_at: string;
 }
-interface AuthenticationEmailVerificationSucceededEventResponse extends EventResponseBase {
-  event: 'authentication.email_verification_succeeded';
-  data: AuthenticationEventResponse;
+//#endregion
+//#region src/pipes/interfaces/data-integrations-list-response-data-auth-methods.interface.d.ts
+declare const DataIntegrationsListResponseDataAuthMethods: {
+  readonly OAuth: "oauth";
+  readonly ApiKey: "api_key";
+};
+type DataIntegrationsListResponseDataAuthMethods = (typeof DataIntegrationsListResponseDataAuthMethods)[keyof typeof DataIntegrationsListResponseDataAuthMethods];
+//#endregion
+//#region src/pipes/interfaces/data-integrations-list-response-data-connected-account-auth-method.interface.d.ts
+declare const DataIntegrationsListResponseDataConnectedAccountAuthMethod: {
+  readonly OAuth: "oauth";
+  readonly ApiKey: "api_key";
+};
+type DataIntegrationsListResponseDataConnectedAccountAuthMethod = (typeof DataIntegrationsListResponseDataConnectedAccountAuthMethod)[keyof typeof DataIntegrationsListResponseDataConnectedAccountAuthMethod];
+//#endregion
+//#region src/pipes/interfaces/data-integrations-list-response-data-connected-account-state.interface.d.ts
+declare const DataIntegrationsListResponseDataConnectedAccountState: {
+  readonly Connected: "connected";
+  readonly NeedsReauthorization: "needs_reauthorization";
+  readonly Disconnected: "disconnected";
+};
+type DataIntegrationsListResponseDataConnectedAccountState = (typeof DataIntegrationsListResponseDataConnectedAccountState)[keyof typeof DataIntegrationsListResponseDataConnectedAccountState];
+//#endregion
+//#region src/pipes/interfaces/data-integrations-list-response-data-connected-account.interface.d.ts
+interface DataIntegrationsListResponseDataConnectedAccount {
+  /** Distinguishes the connected account object. */
+  object: 'connected_account';
+  /** The unique identifier of the connected account. */
+  id: string;
+  /** The [User](https://workos.com/docs/reference/authkit/user) identifier associated with this connection. */
+  userId: string | null;
+  /** The [Organization](https://workos.com/docs/reference/organization) identifier associated with this connection, or `null` if not scoped to an organization. */
+  organizationId: string | null;
+  /** The OAuth scopes granted for this connection. */
+  scopes: string[];
+  /** The authentication method used for this connection (`oauth` or `api_key`). Defaults to `oauth` if absent. */
+  authMethod?: DataIntegrationsListResponseDataConnectedAccountAuthMethod;
+  /** The last four characters of the API key, or `null` for OAuth connections. */
+  apiKeyLast4?: string | null;
+  /**
+   * The state of the connected account:
+   * - `connected`: The connection is active and tokens are valid.
+   * - `needs_reauthorization`: The user needs to reauthorize the connection, typically because required scopes have changed.
+   * - `disconnected`: The connection has been disconnected.
+   */
+  state: DataIntegrationsListResponseDataConnectedAccountState;
+  /** The timestamp when the connection was created. */
+  createdAt: string;
+  /** The timestamp when the connection was last updated. */
+  updatedAt: string;
+  /**
+   * Use `user_id` instead.
+   * @deprecated
+   */
+  userlandUserId: string | null;
 }
-interface AuthenticationMagicAuthFailedEvent extends EventBase {
-  event: 'authentication.magic_auth_failed';
-  data: AuthenticationEvent;
+interface DataIntegrationsListResponseDataConnectedAccountResponse {
+  object: 'connected_account';
+  id: string;
+  user_id: string | null;
+  organization_id: string | null;
+  scopes: string[];
+  auth_method?: DataIntegrationsListResponseDataConnectedAccountAuthMethod;
+  api_key_last_4?: string | null;
+  state: DataIntegrationsListResponseDataConnectedAccountState;
+  created_at: string;
+  updated_at: string;
+  userland_user_id: string | null;
 }
-interface AuthenticationMagicAuthFailedEventResponse extends EventResponseBase {
-  event: 'authentication.magic_auth_failed';
-  data: AuthenticationEventResponse;
+//#endregion
+//#region src/pipes/interfaces/data-integrations-list-response-data-ownership.interface.d.ts
+declare const DataIntegrationsListResponseDataOwnership: {
+  readonly UserlandUser: "userland_user";
+  readonly Organization: "organization";
+};
+type DataIntegrationsListResponseDataOwnership = (typeof DataIntegrationsListResponseDataOwnership)[keyof typeof DataIntegrationsListResponseDataOwnership];
+//#endregion
+//#region src/pipes/interfaces/data-integrations-list-response-data.interface.d.ts
+interface DataIntegrationsListResponseData {
+  /** Distinguishes the data provider object. */
+  object: 'data_provider';
+  /** The unique identifier of the provider. */
+  id: string;
+  /** The display name of the provider (e.g., "GitHub", "Slack"). */
+  name: string;
+  /** A description of the provider explaining how it will be used, if configured. */
+  description: string | null;
+  /** The slug identifier used in API calls (e.g., `github`, `slack`, `notion`). */
+  slug: string;
+  /** The type of integration (e.g., `github`, `slack`). */
+  integrationType: string;
+  /** The type of credentials used by the provider (e.g., `oauth2`). */
+  credentialsType: string;
+  /** The OAuth scopes configured for this provider, or `null` if none are configured. */
+  scopes: string[] | null;
+  /** The authentication methods supported by this provider (`oauth`, `api_key`, or both). Defaults to `["oauth"]` if absent. */
+  authMethods?: DataIntegrationsListResponseDataAuthMethods[];
+  /** Whether the provider is owned by a user or organization. */
+  ownership: DataIntegrationsListResponseDataOwnership;
+  /** The timestamp when the provider was created. */
+  createdAt: string;
+  /** The timestamp when the provider was last updated. */
+  updatedAt: string;
+  /** The user's [connected account](https://workos.com/docs/reference/pipes/connected-account) for this provider, or `null` if the user has not connected. */
+  connectedAccount: DataIntegrationsListResponseDataConnectedAccount | null;
 }
-interface AuthenticationMagicAuthSucceededEvent extends EventBase {
-  event: 'authentication.magic_auth_succeeded';
-  data: AuthenticationEvent;
+interface DataIntegrationsListResponseDataResponse {
+  object: 'data_provider';
+  id: string;
+  name: string;
+  description: string | null;
+  slug: string;
+  integration_type: string;
+  credentials_type: string;
+  scopes: string[] | null;
+  auth_methods?: DataIntegrationsListResponseDataAuthMethods[];
+  ownership: DataIntegrationsListResponseDataOwnership;
+  created_at: string;
+  updated_at: string;
+  connected_account: DataIntegrationsListResponseDataConnectedAccountResponse | null;
 }
-interface AuthenticationMagicAuthSucceededEventResponse extends EventResponseBase {
-  event: 'authentication.magic_auth_succeeded';
-  data: AuthenticationEventResponse;
+//#endregion
+//#region src/pipes/interfaces/data-integrations-list-response.interface.d.ts
+interface DataIntegrationsListResponse {
+  /** Indicates this is a list response. */
+  object: 'list';
+  /** A list of [providers](https://workos.com/docs/reference/pipes/provider), each including a [`connected_account`](https://workos.com/docs/reference/pipes/connected-account) field with the user's connection status. */
+  data: DataIntegrationsListResponseData[];
 }
-interface AuthenticationMfaSucceededEvent extends EventBase {
-  event: 'authentication.mfa_succeeded';
-  data: AuthenticationEvent;
+interface DataIntegrationsListResponseWire {
+  object: 'list';
+  data: DataIntegrationsListResponseDataResponse[];
 }
-interface AuthenticationMfaSucceededEventResponse extends EventResponseBase {
-  event: 'authentication.mfa_succeeded';
-  data: AuthenticationEventResponse;
+//#endregion
+//#region src/pipes/interfaces/delete-data-integration-options.interface.d.ts
+interface DeleteDataIntegrationOptions {
+  /** The slug identifier of the data integration. */
+  slug: string;
 }
-interface AuthenticationOAuthFailedEvent extends EventBase {
-  event: 'authentication.oauth_failed';
-  data: AuthenticationEvent;
+//#endregion
+//#region src/pipes/interfaces/delete-user-connected-account-options.interface.d.ts
+interface DeleteUserConnectedAccountOptions {
+  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
+  userId: string;
+  /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
+  slug: string;
+  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization. */
+  organizationId?: string;
 }
-interface AuthenticationOAuthFailedEventResponse extends EventResponseBase {
-  event: 'authentication.oauth_failed';
-  data: AuthenticationEventResponse;
+//#endregion
+//#region src/pipes/interfaces/get-access-token-options.interface.d.ts
+interface GetAccessTokenOptions {
+  /** The identifier of the integration. */
+  provider: string;
+  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
+  userId: string;
+  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. */
+  organizationId?: string | null;
 }
-interface AuthenticationOAuthSucceededEvent extends EventBase {
-  event: 'authentication.oauth_succeeded';
-  data: AuthenticationEvent;
+//#endregion
+//#region src/pipes/interfaces/get-data-integration-options.interface.d.ts
+interface GetDataIntegrationOptions {
+  /** The slug identifier of the data integration. */
+  slug: string;
 }
-interface AuthenticationOAuthSucceededEventResponse extends EventResponseBase {
-  event: 'authentication.oauth_succeeded';
-  data: AuthenticationEventResponse;
+//#endregion
+//#region src/pipes/interfaces/get-user-connected-account-options.interface.d.ts
+interface GetUserConnectedAccountOptions {
+  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
+  userId: string;
+  /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
+  slug: string;
+  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization. */
+  organizationId?: string;
 }
-interface AuthenticationPasskeyFailedEvent extends EventBase {
-  event: 'authentication.passkey_failed';
-  data: AuthenticationEvent;
+//#endregion
+//#region src/pipes/interfaces/list-user-data-providers-options.interface.d.ts
+interface ListUserDataProvidersOptions {
+  /** A [User](https://workos.com/docs/reference/authkit/user) identifier to list providers and connected accounts for. */
+  userId: string;
+  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to filter connections for a specific organization. */
+  organizationId?: string;
 }
-interface AuthenticationPasskeyFailedEventResponse extends EventResponseBase {
-  event: 'authentication.passkey_failed';
-  data: AuthenticationEventResponse;
+//#endregion
+//#region src/pipes/interfaces/update-custom-provider-definition-authenticate-via.interface.d.ts
+declare const UpdateCustomProviderDefinitionAuthenticateVia: {
+  readonly RequestBody: "request_body";
+  readonly BasicAuthHeader: "basic_auth_header";
+};
+type UpdateCustomProviderDefinitionAuthenticateVia = (typeof UpdateCustomProviderDefinitionAuthenticateVia)[keyof typeof UpdateCustomProviderDefinitionAuthenticateVia];
+//#endregion
+//#region src/pipes/interfaces/update-custom-provider-definition.interface.d.ts
+interface UpdateCustomProviderDefinition {
+  /** A descriptive name for the custom provider. */
+  name?: string;
+  /** The provider's OAuth authorization endpoint. */
+  authorizationUrl?: string;
+  /** The provider's OAuth token endpoint. */
+  tokenUrl?: string;
+  /** The endpoint used to refresh tokens, if different from the token endpoint. */
+  refreshTokenUrl?: string | null;
+  /** Whether PKCE is used during the authorization code flow. */
+  pkceEnabled?: boolean;
+  /** The separator used to join requested scopes. */
+  requestScopeSeparator?: string;
+  /** Whether at least one scope must be selected when connecting an account. */
+  scopesRequired?: boolean;
+  /** Whether a client secret is required for this provider. */
+  clientSecretRequired?: boolean;
+  /** Additional static query parameters appended to the authorization request. */
+  additionalAuthorizationParameters?: Record<string, string>;
+  /** The Content-Type used when exchanging the token request. */
+  tokenBodyContentType?: string;
+  /** How client credentials are sent when exchanging authorization codes and refreshing tokens. */
+  authenticateVia?: UpdateCustomProviderDefinitionAuthenticateVia;
 }
-interface AuthenticationPasskeySucceededEvent extends EventBase {
-  event: 'authentication.passkey_succeeded';
-  data: AuthenticationEvent;
+interface UpdateCustomProviderDefinitionResponse {
+  name?: string;
+  authorization_url?: string;
+  token_url?: string;
+  refresh_token_url?: string | null;
+  pkce_enabled?: boolean;
+  request_scope_separator?: string;
+  scopes_required?: boolean;
+  client_secret_required?: boolean;
+  additional_authorization_parameters?: Record<string, string>;
+  token_body_content_type?: string;
+  authenticate_via?: UpdateCustomProviderDefinitionAuthenticateVia;
 }
-interface AuthenticationPasskeySucceededEventResponse extends EventResponseBase {
-  event: 'authentication.passkey_succeeded';
-  data: AuthenticationEventResponse;
+//#endregion
+//#region src/pipes/interfaces/update-data-integration-api-key-options.interface.d.ts
+interface UpdateDataIntegrationApiKeyOptions {
+  /** The identifier of the integration. */
+  slug: string;
+  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
+  userId: string;
+  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. */
+  organizationId?: string;
+  /** The API key secret to store for this integration. */
+  secret: string;
 }
-interface AuthenticationPasswordFailedEvent extends EventBase {
-  event: 'authentication.password_failed';
-  data: AuthenticationEvent;
+//#endregion
+//#region src/pipes/interfaces/update-data-integration-options.interface.d.ts
+interface UpdateDataIntegrationOptions {
+  /** The slug identifier of the data integration. */
+  slug: string;
+  /** An optional description of the Data Integration. */
+  description?: string | null;
+  /** Whether the Data Integration is enabled. */
+  enabled?: boolean;
+  /** The OAuth scopes to request for the Data Integration. Pass `null` to reset to the provider's configured scopes. */
+  scopes?: string[] | null;
+  /** New credentials for the Data Integration. When provided, rotates the stored client secret. */
+  credentials?: DataIntegrationCredentialsDto;
+  /** Updates to a custom provider's OAuth definition. Only valid for custom-provider integrations. */
+  customProvider?: UpdateCustomProviderDefinition;
 }
-interface AuthenticationPasswordFailedEventResponse extends EventResponseBase {
-  event: 'authentication.password_failed';
-  data: AuthenticationEventResponse;
+//#endregion
+//#region src/pipes/interfaces/update-user-connected-account-options.interface.d.ts
+interface UpdateUserConnectedAccountOptions {
+  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
+  userId: string;
+  /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
+  slug: string;
+  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization. */
+  organizationId?: string;
+  /** The OAuth access token for the connected account. */
+  accessToken?: string;
+  /** The OAuth refresh token for the connected account. */
+  refreshToken?: string;
+  /** The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire. */
+  expiresAt?: Date;
+  /** The OAuth scopes granted for this connection. */
+  scopes?: string[];
+  /** Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided. */
+  state?: ConnectedAccountState;
 }
-interface AuthenticationPasswordSucceededEvent extends EventBase {
-  event: 'authentication.password_succeeded';
-  data: AuthenticationEvent;
+//#endregion
+//#region src/vault/interfaces/key.interface.d.ts
+interface KeyContext {
+  [key: string]: any;
+}
+interface DataKeyPair {
+  context: KeyContext;
+  dataKey: DataKey;
+  encryptedKeys: string;
+}
+interface DataKey {
+  key: string;
+  id: string;
+}
+//#endregion
+//#region src/vault/interfaces/vault-event.interface.d.ts
+type VaultActorSource = 'api' | 'dashboard';
+interface VaultActor {
+  actorId: string;
+  actorSource: VaultActorSource;
+  actorName: string;
+}
+interface VaultActorResponse {
+  actor_id: string;
+  actor_source: VaultActorSource;
+  actor_name: string;
+}
+interface VaultDataMutatedEventData extends VaultActor {
+  kvName: string;
+  keyId: string;
+  keyContext: KeyContext;
+}
+interface VaultDataMutatedEventResponseData extends VaultActorResponse {
+  kv_name: string;
+  key_id: string;
+  key_context: KeyContext;
+}
+type VaultDataCreatedEventData = VaultDataMutatedEventData;
+type VaultDataUpdatedEventData = VaultDataMutatedEventData;
+type VaultDataCreatedEventResponseData = VaultDataMutatedEventResponseData;
+type VaultDataUpdatedEventResponseData = VaultDataMutatedEventResponseData;
+interface VaultDataReadEventData extends VaultActor {
+  kvName: string;
+  keyId: string;
+}
+interface VaultDataReadEventResponseData extends VaultActorResponse {
+  kv_name: string;
+  key_id: string;
+}
+interface VaultDataDeletedEventData extends VaultActor {
+  kvName: string;
+}
+interface VaultDataDeletedEventResponseData extends VaultActorResponse {
+  kv_name: string;
+}
+interface VaultMetadataReadEventData extends VaultActor {
+  kvName: string;
+}
+interface VaultMetadataReadEventResponseData extends VaultActorResponse {
+  kv_name: string;
+}
+type VaultNamesListedEventData = VaultActor;
+type VaultNamesListedEventResponseData = VaultActorResponse;
+interface VaultKekCreatedEventData extends VaultActor {
+  keyName: string;
+  keyId: string;
+}
+interface VaultKekCreatedEventResponseData extends VaultActorResponse {
+  key_name: string;
+  key_id: string;
+}
+interface VaultDekReadEventData extends VaultActor {
+  keyIds: string[];
+  keyContext: KeyContext;
+}
+interface VaultDekReadEventResponseData extends VaultActorResponse {
+  key_ids: string[];
+  key_context: KeyContext;
+}
+interface VaultDekDecryptedEventData extends VaultActor {
+  keyId: string;
+}
+interface VaultDekDecryptedEventResponseData extends VaultActorResponse {
+  key_id: string;
+}
+type VaultByokKeyProvider = 'AWS_KMS' | 'GCP_KMS' | 'AZURE_KEY_VAULT';
+interface VaultByokKeyVerificationCompletedEventData {
+  organizationId: string;
+  keyProvider: VaultByokKeyProvider;
+  verified: boolean;
+}
+interface VaultByokKeyVerificationCompletedEventResponseData {
+  organization_id: string;
+  key_provider: VaultByokKeyProvider;
+  verified: boolean;
+}
+//#endregion
+//#region src/common/interfaces/event.interface.d.ts
+interface EventBase {
+  id: string;
+  createdAt: string;
+  context: Record<string, unknown> | undefined;
+}
+interface EventResponseBase {
+  id: string;
+  created_at: string;
+  context?: Record<string, unknown>;
+}
+interface AuthenticationEmailVerificationSucceededEvent extends EventBase {
+  event: 'authentication.email_verification_succeeded';
+  data: AuthenticationEvent;
+}
+interface AuthenticationEmailVerificationSucceededEventResponse extends EventResponseBase {
+  event: 'authentication.email_verification_succeeded';
+  data: AuthenticationEventResponse;
+}
+interface AuthenticationMagicAuthFailedEvent extends EventBase {
+  event: 'authentication.magic_auth_failed';
+  data: AuthenticationEvent;
+}
+interface AuthenticationMagicAuthFailedEventResponse extends EventResponseBase {
+  event: 'authentication.magic_auth_failed';
+  data: AuthenticationEventResponse;
+}
+interface AuthenticationMagicAuthSucceededEvent extends EventBase {
+  event: 'authentication.magic_auth_succeeded';
+  data: AuthenticationEvent;
+}
+interface AuthenticationMagicAuthSucceededEventResponse extends EventResponseBase {
+  event: 'authentication.magic_auth_succeeded';
+  data: AuthenticationEventResponse;
+}
+interface AuthenticationMfaSucceededEvent extends EventBase {
+  event: 'authentication.mfa_succeeded';
+  data: AuthenticationEvent;
+}
+interface AuthenticationMfaSucceededEventResponse extends EventResponseBase {
+  event: 'authentication.mfa_succeeded';
+  data: AuthenticationEventResponse;
+}
+interface AuthenticationOAuthFailedEvent extends EventBase {
+  event: 'authentication.oauth_failed';
+  data: AuthenticationEvent;
+}
+interface AuthenticationOAuthFailedEventResponse extends EventResponseBase {
+  event: 'authentication.oauth_failed';
+  data: AuthenticationEventResponse;
+}
+interface AuthenticationOAuthSucceededEvent extends EventBase {
+  event: 'authentication.oauth_succeeded';
+  data: AuthenticationEvent;
+}
+interface AuthenticationOAuthSucceededEventResponse extends EventResponseBase {
+  event: 'authentication.oauth_succeeded';
+  data: AuthenticationEventResponse;
+}
+interface AuthenticationPasskeyFailedEvent extends EventBase {
+  event: 'authentication.passkey_failed';
+  data: AuthenticationEvent;
+}
+interface AuthenticationPasskeyFailedEventResponse extends EventResponseBase {
+  event: 'authentication.passkey_failed';
+  data: AuthenticationEventResponse;
+}
+interface AuthenticationPasskeySucceededEvent extends EventBase {
+  event: 'authentication.passkey_succeeded';
+  data: AuthenticationEvent;
+}
+interface AuthenticationPasskeySucceededEventResponse extends EventResponseBase {
+  event: 'authentication.passkey_succeeded';
+  data: AuthenticationEventResponse;
+}
+interface AuthenticationPasswordFailedEvent extends EventBase {
+  event: 'authentication.password_failed';
+  data: AuthenticationEvent;
+}
+interface AuthenticationPasswordFailedEventResponse extends EventResponseBase {
+  event: 'authentication.password_failed';
+  data: AuthenticationEventResponse;
+}
+interface AuthenticationPasswordSucceededEvent extends EventBase {
+  event: 'authentication.password_succeeded';
+  data: AuthenticationEvent;
 }
 interface AuthenticationPasswordSucceededEventResponse extends EventResponseBase {
   event: 'authentication.password_succeeded';
@@ -3573,6 +4267,87 @@ interface GroupMemberRemovedEventResponse extends EventResponseBase {
   event: 'group.member_removed';
   data: GroupMemberEventResponseData;
 }
+type PipesConnectedAccountState = ConnectedAccountState | 'disconnected';
+interface PipesConnectedAccount {
+  object: 'connected_account';
+  id: string;
+  dataIntegrationId: string;
+  providerSlug: string;
+  userId: string | null;
+  organizationId: string | null;
+  scopes: string[];
+  state: PipesConnectedAccountState;
+  createdAt: string;
+  updatedAt: string;
+}
+interface PipesConnectedAccountResponse {
+  object: 'connected_account';
+  id: string;
+  data_integration_id: string;
+  provider_slug: string;
+  user_id: string | null;
+  organization_id: string | null;
+  scopes: string[];
+  state: PipesConnectedAccountState;
+  created_at: string;
+  updated_at: string;
+}
+interface PipesConnectionFailed {
+  object: 'connection_failed';
+  dataIntegrationId: string;
+  providerSlug: string;
+  userId: string | null;
+  organizationId: string | null;
+  errorCode: string;
+  errorReason: string | null;
+  providerError: string | null;
+  providerErrorDescription: string | null;
+  createdAt: string;
+}
+interface PipesConnectionFailedResponse {
+  object: 'connection_failed';
+  data_integration_id: string;
+  provider_slug: string;
+  user_id: string | null;
+  organization_id: string | null;
+  error_code: string;
+  error_reason: string | null;
+  provider_error: string | null;
+  provider_error_description: string | null;
+  created_at: string;
+}
+interface PipesConnectedAccountConnectedEvent extends EventBase {
+  event: 'pipes.connected_account.connected';
+  data: PipesConnectedAccount;
+}
+interface PipesConnectedAccountConnectedEventResponse extends EventResponseBase {
+  event: 'pipes.connected_account.connected';
+  data: PipesConnectedAccountResponse;
+}
+interface PipesConnectedAccountConnectionFailedEvent extends EventBase {
+  event: 'pipes.connected_account.connection_failed';
+  data: PipesConnectionFailed;
+}
+interface PipesConnectedAccountConnectionFailedEventResponse extends EventResponseBase {
+  event: 'pipes.connected_account.connection_failed';
+  data: PipesConnectionFailedResponse;
+}
+interface PipesConnectedAccountDisconnectedEvent extends EventBase {
+  event: 'pipes.connected_account.disconnected';
+  data: PipesConnectedAccount;
+}
+interface PipesConnectedAccountDisconnectedEventResponse extends EventResponseBase {
+  event: 'pipes.connected_account.disconnected';
+  data: PipesConnectedAccountResponse;
+}
+interface PipesConnectedAccountReauthorizationNeededEvent extends EventBase {
+  event: 'pipes.connected_account.reauthorization_needed';
+  data: PipesConnectedAccount;
+}
+interface PipesConnectedAccountReauthorizationNeededEventResponse extends EventResponseBase {
+  event: 'pipes.connected_account.reauthorization_needed';
+  data: PipesConnectedAccountResponse;
+}
 interface VaultDataCreatedEvent extends EventBase {
   event: 'vault.data.created';
   data: VaultDataCreatedEventData;
@@ -3657,8 +4432,8 @@ interface UnknownEvent extends EventBase {
   event: string;
   data: Record<string, unknown>;
 }
-type Event = AuthenticationEmailVerificationSucceededEvent | AuthenticationMfaSucceededEvent | AuthenticationOAuthFailedEvent | AuthenticationOAuthSucceededEvent | AuthenticationSSOFailedEvent | AuthenticationSSOSucceededEvent | AuthenticationPasskeyFailedEvent | AuthenticationPasskeySucceededEvent | AuthenticationPasswordFailedEvent | AuthenticationPasswordSucceededEvent | AuthenticationMagicAuthFailedEvent | AuthenticationMagicAuthSucceededEvent | AuthenticationRadarRiskDetectedEvent | ConnectionActivatedEvent | ConnectionDeactivatedEvent | ConnectionDeletedEvent | DsyncActivatedEvent | DsyncDeletedEvent | DsyncGroupCreatedEvent | DsyncGroupUpdatedEvent | DsyncGroupDeletedEvent | DsyncGroupUserAddedEvent | DsyncGroupUserRemovedEvent | DsyncUserCreatedEvent | DsyncUserUpdatedEvent | DsyncUserDeletedEvent | EmailVerificationCreatedEvent | InvitationAcceptedEvent | InvitationCreatedEvent | InvitationRevokedEvent | InvitationResentEvent | MagicAuthCreatedEvent | PasswordResetCreatedEvent | PasswordResetSucceededEvent | UserCreatedEvent | UserUpdatedEvent | UserDeletedEvent | OrganizationMembershipCreated | OrganizationMembershipDeleted | OrganizationMembershipUpdated | RoleCreatedEvent | RoleDeletedEvent | RoleUpdatedEvent | OrganizationRoleCreatedEvent | OrganizationRoleUpdatedEvent | OrganizationRoleDeletedEvent | PermissionCreatedEvent | PermissionUpdatedEvent | PermissionDeletedEvent | SessionCreatedEvent | SessionRevokedEvent | OrganizationCreatedEvent | OrganizationUpdatedEvent | OrganizationDeletedEvent | OrganizationDomainVerifiedEvent | OrganizationDomainVerificationFailedEvent | OrganizationDomainCreatedEvent | OrganizationDomainUpdatedEvent | OrganizationDomainDeletedEvent | ApiKeyCreatedEvent | ApiKeyRevokedEvent | FlagCreatedEvent | FlagUpdatedEvent | FlagDeletedEvent | FlagRuleUpdatedEvent | GroupCreatedEvent | GroupUpdatedEvent | GroupDeletedEvent | GroupMemberAddedEvent | GroupMemberRemovedEvent | VaultDataCreatedEvent | VaultDataUpdatedEvent | VaultDataReadEvent | VaultDataDeletedEvent | VaultNamesListedEvent | VaultMetadataReadEvent | VaultKekCreatedEvent | VaultDekReadEvent | VaultDekDecryptedEvent | VaultByokKeyVerificationCompletedEvent;
-type EventResponse = AuthenticationEmailVerificationSucceededEventResponse | AuthenticationMagicAuthFailedEventResponse | AuthenticationMagicAuthSucceededEventResponse | AuthenticationMfaSucceededEventResponse | AuthenticationOAuthFailedEventResponse | AuthenticationOAuthSucceededEventResponse | AuthenticationPasskeyFailedEventResponse | AuthenticationPasskeySucceededEventResponse | AuthenticationPasswordFailedEventResponse | AuthenticationPasswordSucceededEventResponse | AuthenticationSSOFailedEventResponse | AuthenticationSSOSucceededEventResponse | AuthenticationRadarRiskDetectedEventResponse | ConnectionActivatedEventResponse | ConnectionDeactivatedEventResponse | ConnectionDeletedEventResponse | DsyncActivatedEventResponse | DsyncDeletedEventResponse | DsyncGroupCreatedEventResponse | DsyncGroupUpdatedEventResponse | DsyncGroupDeletedEventResponse | DsyncGroupUserAddedEventResponse | DsyncGroupUserRemovedEventResponse | DsyncUserCreatedEventResponse | DsyncUserUpdatedEventResponse | DsyncUserDeletedEventResponse | EmailVerificationCreatedEventResponse | InvitationAcceptedEventResponse | InvitationCreatedEventResponse | InvitationRevokedEventResponse | InvitationResentEventResponse | MagicAuthCreatedEventResponse | PasswordResetCreatedEventResponse | PasswordResetSucceededEventResponse | UserCreatedEventResponse | UserUpdatedEventResponse | UserDeletedEventResponse | OrganizationMembershipCreatedResponse | OrganizationMembershipDeletedResponse | OrganizationMembershipUpdatedResponse | RoleCreatedEventResponse | RoleDeletedEventResponse | RoleUpdatedEventResponse | OrganizationRoleCreatedEventResponse | OrganizationRoleUpdatedEventResponse | OrganizationRoleDeletedEventResponse | PermissionCreatedEventResponse | PermissionUpdatedEventResponse | PermissionDeletedEventResponse | SessionCreatedEventResponse | SessionRevokedEventResponse | OrganizationCreatedResponse | OrganizationUpdatedResponse | OrganizationDeletedResponse | OrganizationDomainVerifiedEventResponse | OrganizationDomainVerificationFailedEventResponse | OrganizationDomainCreatedEventResponse | OrganizationDomainUpdatedEventResponse | OrganizationDomainDeletedEventResponse | ApiKeyCreatedEventResponse | ApiKeyRevokedEventResponse | FlagCreatedEventResponse | FlagUpdatedEventResponse | FlagDeletedEventResponse | FlagRuleUpdatedEventResponse | GroupCreatedEventResponse | GroupUpdatedEventResponse | GroupDeletedEventResponse | GroupMemberAddedEventResponse | GroupMemberRemovedEventResponse | VaultDataCreatedEventResponse | VaultDataUpdatedEventResponse | VaultDataReadEventResponse | VaultDataDeletedEventResponse | VaultNamesListedEventResponse | VaultMetadataReadEventResponse | VaultKekCreatedEventResponse | VaultDekReadEventResponse | VaultDekDecryptedEventResponse | VaultByokKeyVerificationCompletedEventResponse;
+type Event = AuthenticationEmailVerificationSucceededEvent | AuthenticationMfaSucceededEvent | AuthenticationOAuthFailedEvent | AuthenticationOAuthSucceededEvent | AuthenticationSSOFailedEvent | AuthenticationSSOSucceededEvent | AuthenticationPasskeyFailedEvent | AuthenticationPasskeySucceededEvent | AuthenticationPasswordFailedEvent | AuthenticationPasswordSucceededEvent | AuthenticationMagicAuthFailedEvent | AuthenticationMagicAuthSucceededEvent | AuthenticationRadarRiskDetectedEvent | ConnectionActivatedEvent | ConnectionDeactivatedEvent | ConnectionDeletedEvent | DsyncActivatedEvent | DsyncDeletedEvent | DsyncGroupCreatedEvent | DsyncGroupUpdatedEvent | DsyncGroupDeletedEvent | DsyncGroupUserAddedEvent | DsyncGroupUserRemovedEvent | DsyncUserCreatedEvent | DsyncUserUpdatedEvent | DsyncUserDeletedEvent | EmailVerificationCreatedEvent | InvitationAcceptedEvent | InvitationCreatedEvent | InvitationRevokedEvent | InvitationResentEvent | MagicAuthCreatedEvent | PasswordResetCreatedEvent | PasswordResetSucceededEvent | UserCreatedEvent | UserUpdatedEvent | UserDeletedEvent | OrganizationMembershipCreated | OrganizationMembershipDeleted | OrganizationMembershipUpdated | RoleCreatedEvent | RoleDeletedEvent | RoleUpdatedEvent | OrganizationRoleCreatedEvent | OrganizationRoleUpdatedEvent | OrganizationRoleDeletedEvent | PermissionCreatedEvent | PermissionUpdatedEvent | PermissionDeletedEvent | SessionCreatedEvent | SessionRevokedEvent | OrganizationCreatedEvent | OrganizationUpdatedEvent | OrganizationDeletedEvent | OrganizationDomainVerifiedEvent | OrganizationDomainVerificationFailedEvent | OrganizationDomainCreatedEvent | OrganizationDomainUpdatedEvent | OrganizationDomainDeletedEvent | ApiKeyCreatedEvent | ApiKeyRevokedEvent | FlagCreatedEvent | FlagUpdatedEvent | FlagDeletedEvent | FlagRuleUpdatedEvent | GroupCreatedEvent | GroupUpdatedEvent | GroupDeletedEvent | GroupMemberAddedEvent | GroupMemberRemovedEvent | PipesConnectedAccountConnectedEvent | PipesConnectedAccountConnectionFailedEvent | PipesConnectedAccountDisconnectedEvent | PipesConnectedAccountReauthorizationNeededEvent | VaultDataCreatedEvent | VaultDataUpdatedEvent | VaultDataReadEvent | VaultDataDeletedEvent | VaultNamesListedEvent | VaultMetadataReadEvent | VaultKekCreatedEvent | VaultDekReadEvent | VaultDekDecryptedEvent | VaultByokKeyVerificationCompletedEvent;
+type EventResponse = AuthenticationEmailVerificationSucceededEventResponse | AuthenticationMagicAuthFailedEventResponse | AuthenticationMagicAuthSucceededEventResponse | AuthenticationMfaSucceededEventResponse | AuthenticationOAuthFailedEventResponse | AuthenticationOAuthSucceededEventResponse | AuthenticationPasskeyFailedEventResponse | AuthenticationPasskeySucceededEventResponse | AuthenticationPasswordFailedEventResponse | AuthenticationPasswordSucceededEventResponse | AuthenticationSSOFailedEventResponse | AuthenticationSSOSucceededEventResponse | AuthenticationRadarRiskDetectedEventResponse | ConnectionActivatedEventResponse | ConnectionDeactivatedEventResponse | ConnectionDeletedEventResponse | DsyncActivatedEventResponse | DsyncDeletedEventResponse | DsyncGroupCreatedEventResponse | DsyncGroupUpdatedEventResponse | DsyncGroupDeletedEventResponse | DsyncGroupUserAddedEventResponse | DsyncGroupUserRemovedEventResponse | DsyncUserCreatedEventResponse | DsyncUserUpdatedEventResponse | DsyncUserDeletedEventResponse | EmailVerificationCreatedEventResponse | InvitationAcceptedEventResponse | InvitationCreatedEventResponse | InvitationRevokedEventResponse | InvitationResentEventResponse | MagicAuthCreatedEventResponse | PasswordResetCreatedEventResponse | PasswordResetSucceededEventResponse | UserCreatedEventResponse | UserUpdatedEventResponse | UserDeletedEventResponse | OrganizationMembershipCreatedResponse | OrganizationMembershipDeletedResponse | OrganizationMembershipUpdatedResponse | RoleCreatedEventResponse | RoleDeletedEventResponse | RoleUpdatedEventResponse | OrganizationRoleCreatedEventResponse | OrganizationRoleUpdatedEventResponse | OrganizationRoleDeletedEventResponse | PermissionCreatedEventResponse | PermissionUpdatedEventResponse | PermissionDeletedEventResponse | SessionCreatedEventResponse | SessionRevokedEventResponse | OrganizationCreatedResponse | OrganizationUpdatedResponse | OrganizationDeletedResponse | OrganizationDomainVerifiedEventResponse | OrganizationDomainVerificationFailedEventResponse | OrganizationDomainCreatedEventResponse | OrganizationDomainUpdatedEventResponse | OrganizationDomainDeletedEventResponse | ApiKeyCreatedEventResponse | ApiKeyRevokedEventResponse | FlagCreatedEventResponse | FlagUpdatedEventResponse | FlagDeletedEventResponse | FlagRuleUpdatedEventResponse | GroupCreatedEventResponse | GroupUpdatedEventResponse | GroupDeletedEventResponse | GroupMemberAddedEventResponse | GroupMemberRemovedEventResponse | PipesConnectedAccountConnectedEventResponse | PipesConnectedAccountConnectionFailedEventResponse | PipesConnectedAccountDisconnectedEventResponse | PipesConnectedAccountReauthorizationNeededEventResponse | VaultDataCreatedEventResponse | VaultDataUpdatedEventResponse | VaultDataReadEventResponse | VaultDataDeletedEventResponse | VaultNamesListedEventResponse | VaultMetadataReadEventResponse | VaultKekCreatedEventResponse | VaultDekReadEventResponse | VaultDekDecryptedEventResponse | VaultByokKeyVerificationCompletedEventResponse;
 type EventName = Event['event'];
 //#endregion
 //#region src/common/interfaces/generate-link-intent.interface.d.ts
@@ -3806,6 +4581,73 @@ interface SerializedCreateOrganizationOptions {
 }
 type CreateOrganizationRequestOptions = Pick<PostOptions, 'idempotencyKey'>;
 //#endregion
+//#region src/organizations/interfaces/it-contact-options.interface.d.ts
+declare const ItContactIntent: {
+  readonly SSO: "sso";
+  readonly DirectorySync: "directory_sync";
+  readonly LogStreams: "log_streams";
+  readonly DomainVerification: "domain_verification";
+  readonly BringYourOwnKey: "bring_your_own_key";
+};
+type ItContactIntent = (typeof ItContactIntent)[keyof typeof ItContactIntent];
+interface ListItContactsOptions {
+  /** Unique identifier of the Organization. */
+  organizationId: string;
+}
+interface CreateItContactOptions {
+  /** Unique identifier of the Organization. */
+  organizationId: string;
+  /** The email address of the IT Contact. */
+  email: string;
+}
+interface SerializedCreateItContactOptions {
+  email: string;
+}
+interface DeleteItContactOptions {
+  /** Unique identifier of the Organization. */
+  organizationId: string;
+  /** Unique identifier of the IT Contact. */
+  contactId: string;
+}
+interface InviteItContactOptions {
+  /** Unique identifier of the Organization. */
+  organizationId: string;
+  /** Unique identifier of the IT Contact. */
+  contactId: string;
+  /** The Admin Portal features that the IT Contact can configure. */
+  intents: ItContactIntent[];
+}
+interface SerializedInviteItContactOptions {
+  intents: ItContactIntent[];
+}
+interface RevokeItContactOptions {
+  /** Unique identifier of the Organization. */
+  organizationId: string;
+  /** Unique identifier of the IT Contact. */
+  contactId: string;
+}
+//#endregion
+//#region src/organizations/interfaces/it-contact.interface.d.ts
+interface ItContact {
+  /** Distinguishes the IT Contact object. */
+  object: 'it_contact';
+  /** Unique identifier of the IT Contact. */
+  id: string;
+  /** The email address of the IT Contact. */
+  email: string;
+  /** An ISO 8601 timestamp. */
+  createdAt: string;
+  /** An ISO 8601 timestamp. */
+  updatedAt: string;
+}
+interface ItContactResponse {
+  object: 'it_contact';
+  id: string;
+  email: string;
+  created_at: string;
+  updated_at: string;
+}
+//#endregion
 //#region src/organizations/interfaces/list-organization-feature-flags-options.interface.d.ts
 interface ListOrganizationFeatureFlagsOptions extends PaginationOptions {
   organizationId: string;
@@ -5115,609 +5957,179 @@ declare class Organizations {
    */
   getOrganizationByExternalId(externalId: string): Promise<Organization>;
   /**
-   * Update an Organization
-   *
-   * Updates an organization in the current environment.
-   * @param payload - The request body.
-   * @returns {Promise<Organization>}
-   * @throws {BadRequestException} 400
-   * @throws 403 response from the API.
-   * @throws {NotFoundException} 404
-   * @throws {ConflictException} 409
-   * @throws {UnprocessableEntityException} 422
-   */
-  updateOrganization(options: UpdateOrganizationOptions): Promise<Organization>;
-}
-//#endregion
-//#region src/organization-domains/organization-domains.d.ts
-declare class OrganizationDomains {
-  private readonly workos;
-  constructor(workos: WorkOS);
-  /**
-   * Get an Organization Domain
-   *
-   * Get the details of an existing organization domain.
-   * @param id - Unique identifier of the organization domain.
-   *
-   * @example
-   * "org_domain_01EHZNVPK2QXHMVWCEDQEKY69A"
-   *
-   * @returns {Promise<OrganizationDomain>}
-   * @throws {NotFoundException} 404
-   */
-  getOrganizationDomain(id: string): Promise<OrganizationDomain>;
-  /**
-   * Verify an Organization Domain
-   *
-   * Initiates verification process for an Organization Domain.
-   * @param id - Unique identifier of the organization domain.
-   *
-   * @example
-   * "org_domain_01EHZNVPK2QXHMVWCEDQEKY69A"
-   *
-   * @returns {Promise<OrganizationDomain>}
-   * @throws {BadRequestException} 400
-   */
-  verifyOrganizationDomain(id: string): Promise<OrganizationDomain>;
-  /**
-   * Create an Organization Domain
-   *
-   * Creates a new Organization Domain.
-   * @param payload - Object containing domain, organizationId.
-   * @returns {Promise<OrganizationDomain>}
-   * @throws {ConflictException} 409
-   */
-  createOrganizationDomain(payload: CreateOrganizationDomainOptions): Promise<OrganizationDomain>;
-  /**
-   * Delete an Organization Domain
-   *
-   * Permanently deletes an organization domain. It cannot be undone.
-   * @param id - Unique identifier of the organization domain.
-   *
-   * @example
-   * "org_domain_01EHZNVPK2QXHMVWCEDQEKY69A"
-   *
-   * @returns {Promise<void>}
-   * @throws {NotFoundException} 404
-   */
-  deleteOrganizationDomain(id: string): Promise<void>;
-}
-//#endregion
-//#region src/passwordless/interfaces/passwordless-session.interface.d.ts
-interface PasswordlessSession {
-  id: string;
-  email: string;
-  expiresAt: Date;
-  link: string;
-  object: 'passwordless_session';
-}
-interface PasswordlessSessionResponse {
-  id: string;
-  email: string;
-  expires_at: Date;
-  link: string;
-  object: 'passwordless_session';
-}
-//#endregion
-//#region src/passwordless/interfaces/create-passwordless-session-options.interface.d.ts
-interface CreatePasswordlessSessionOptions {
-  type: 'MagicLink';
-  email: string;
-  redirectURI?: string;
-  state?: string;
-  connection?: string;
-  expiresIn?: number;
-}
-interface SerializedCreatePasswordlessSessionOptions {
-  type: 'MagicLink';
-  email: string;
-  redirect_uri?: string;
-  state?: string;
-  connection?: string;
-  expires_in?: number;
-}
-//#endregion
-//#region src/passwordless/interfaces/send-session-response.interface.d.ts
-interface SendSessionResponse {
-  message?: string;
-  success?: boolean;
-}
-//#endregion
-//#region src/passwordless/passwordless.d.ts
-declare class Passwordless {
-  private readonly workos;
-  constructor(workos: WorkOS);
-  createSession({ redirectURI, expiresIn, ...options }: CreatePasswordlessSessionOptions): Promise<PasswordlessSession>;
-  sendSession(sessionId: string): Promise<SendSessionResponse>;
-}
-//#endregion
-//#region src/pipes/interfaces/data-integration-credentials-type.interface.d.ts
-declare const DataIntegrationCredentialsType: {
-  readonly Custom: "custom";
-  readonly Organization: "organization";
-};
-type DataIntegrationCredentialsType = (typeof DataIntegrationCredentialsType)[keyof typeof DataIntegrationCredentialsType];
-//#endregion
-//#region src/pipes/interfaces/data-integration-credentials-dto.interface.d.ts
-interface DataIntegrationCredentialsDto {
-  /** The credentials type. `custom` uses your own OAuth app credentials; `organization` has each organization supply its own credentials (configured per-organization). */
-  type: DataIntegrationCredentialsType;
-  /** OAuth client ID for the provider app. Required when `type` is `custom`; omit for `organization`. */
-  clientId?: string;
-  /** OAuth client secret for the provider app. Required when `type` is `custom`; omit for `organization`. */
-  clientSecret?: string;
-}
-interface DataIntegrationCredentialsDtoResponse {
-  type: DataIntegrationCredentialsType;
-  client_id?: string;
-  client_secret?: string;
-}
-//#endregion
-//#region src/pipes/interfaces/custom-provider-definition-authenticate-via.interface.d.ts
-declare const CustomProviderDefinitionAuthenticateVia: {
-  readonly RequestBody: "request_body";
-  readonly BasicAuthHeader: "basic_auth_header";
-};
-type CustomProviderDefinitionAuthenticateVia = (typeof CustomProviderDefinitionAuthenticateVia)[keyof typeof CustomProviderDefinitionAuthenticateVia];
-//#endregion
-//#region src/pipes/interfaces/custom-provider-definition.interface.d.ts
-interface CustomProviderDefinition {
-  /** A descriptive name for the custom provider. */
-  name: string;
-  /** The provider's OAuth authorization endpoint. */
-  authorizationUrl: string;
-  /** The provider's OAuth token endpoint. */
-  tokenUrl: string;
-  /** The endpoint used to refresh tokens, if different from the token endpoint. */
-  refreshTokenUrl?: string | null;
-  /** Whether PKCE is used during the authorization code flow. Defaults to `true`. */
-  pkceEnabled?: boolean;
-  /** The separator used to join requested scopes. Defaults to a space. */
-  requestScopeSeparator?: string;
-  /** Whether at least one scope must be selected when connecting an account. Defaults to `false`. */
-  scopesRequired?: boolean;
-  /** Whether a client secret is required for this provider. Defaults to `true`. */
-  clientSecretRequired?: boolean;
-  /** Additional static query parameters appended to the authorization request. */
-  additionalAuthorizationParameters?: Record<string, string>;
-  /** The Content-Type used when exchanging the token request. */
-  tokenBodyContentType?: string;
-  /** How client credentials are sent when exchanging authorization codes and refreshing tokens. */
-  authenticateVia?: CustomProviderDefinitionAuthenticateVia;
-}
-interface CustomProviderDefinitionResponse {
-  name: string;
-  authorization_url: string;
-  token_url: string;
-  refresh_token_url?: string | null;
-  pkce_enabled?: boolean;
-  request_scope_separator?: string;
-  scopes_required?: boolean;
-  client_secret_required?: boolean;
-  additional_authorization_parameters?: Record<string, string>;
-  token_body_content_type?: string;
-  authenticate_via?: CustomProviderDefinitionAuthenticateVia;
-}
-//#endregion
-//#region src/pipes/interfaces/create-data-integration-options.interface.d.ts
-interface CreateDataIntegrationOptions {
-  /** The provider to create a Data Integration for. For a built-in provider use its slug (e.g. `github`, `slack`). For a custom provider, this is the new provider slug and `custom_provider` must be supplied. A custom provider slug cannot shadow an existing global provider slug. */
-  provider: string;
-  /** An optional description of the Data Integration. */
-  description?: string | null;
-  /** Whether the Data Integration is enabled. Defaults to `false`. */
-  enabled?: boolean;
-  /** The OAuth scopes to request for the Data Integration. Defaults to the provider's configured scopes when omitted. */
-  scopes?: string[] | null;
-  /** The credentials to configure for the Data Integration. Required for both built-in and custom providers. */
-  credentials?: DataIntegrationCredentialsDto;
-  /** The OAuth definition for a custom provider. Supply this to define a custom provider; omit it to create an integration for a built-in provider. */
-  customProvider?: CustomProviderDefinition;
-}
-//#endregion
-//#region src/pipes/interfaces/get-data-integration-options.interface.d.ts
-interface GetDataIntegrationOptions {
-  /** The slug identifier of the data integration. */
-  slug: string;
-}
-//#endregion
-//#region src/pipes/interfaces/update-custom-provider-definition-authenticate-via.interface.d.ts
-declare const UpdateCustomProviderDefinitionAuthenticateVia: {
-  readonly RequestBody: "request_body";
-  readonly BasicAuthHeader: "basic_auth_header";
-};
-type UpdateCustomProviderDefinitionAuthenticateVia = (typeof UpdateCustomProviderDefinitionAuthenticateVia)[keyof typeof UpdateCustomProviderDefinitionAuthenticateVia];
-//#endregion
-//#region src/pipes/interfaces/update-custom-provider-definition.interface.d.ts
-interface UpdateCustomProviderDefinition {
-  /** A descriptive name for the custom provider. */
-  name?: string;
-  /** The provider's OAuth authorization endpoint. */
-  authorizationUrl?: string;
-  /** The provider's OAuth token endpoint. */
-  tokenUrl?: string;
-  /** The endpoint used to refresh tokens, if different from the token endpoint. */
-  refreshTokenUrl?: string | null;
-  /** Whether PKCE is used during the authorization code flow. */
-  pkceEnabled?: boolean;
-  /** The separator used to join requested scopes. */
-  requestScopeSeparator?: string;
-  /** Whether at least one scope must be selected when connecting an account. */
-  scopesRequired?: boolean;
-  /** Whether a client secret is required for this provider. */
-  clientSecretRequired?: boolean;
-  /** Additional static query parameters appended to the authorization request. */
-  additionalAuthorizationParameters?: Record<string, string>;
-  /** The Content-Type used when exchanging the token request. */
-  tokenBodyContentType?: string;
-  /** How client credentials are sent when exchanging authorization codes and refreshing tokens. */
-  authenticateVia?: UpdateCustomProviderDefinitionAuthenticateVia;
-}
-interface UpdateCustomProviderDefinitionResponse {
-  name?: string;
-  authorization_url?: string;
-  token_url?: string;
-  refresh_token_url?: string | null;
-  pkce_enabled?: boolean;
-  request_scope_separator?: string;
-  scopes_required?: boolean;
-  client_secret_required?: boolean;
-  additional_authorization_parameters?: Record<string, string>;
-  token_body_content_type?: string;
-  authenticate_via?: UpdateCustomProviderDefinitionAuthenticateVia;
-}
-//#endregion
-//#region src/pipes/interfaces/update-data-integration-options.interface.d.ts
-interface UpdateDataIntegrationOptions {
-  /** The slug identifier of the data integration. */
-  slug: string;
-  /** An optional description of the Data Integration. */
-  description?: string | null;
-  /** Whether the Data Integration is enabled. */
-  enabled?: boolean;
-  /** The OAuth scopes to request for the Data Integration. Pass `null` to reset to the provider's configured scopes. */
-  scopes?: string[] | null;
-  /** New credentials for the Data Integration. When provided, rotates the stored client secret. */
-  credentials?: DataIntegrationCredentialsDto;
-  /** Updates to a custom provider's OAuth definition. Only valid for custom-provider integrations. */
-  customProvider?: UpdateCustomProviderDefinition;
-}
-//#endregion
-//#region src/pipes/interfaces/delete-data-integration-options.interface.d.ts
-interface DeleteDataIntegrationOptions {
-  /** The slug identifier of the data integration. */
-  slug: string;
-}
-//#endregion
-//#region src/pipes/interfaces/update-data-integration-api-key-options.interface.d.ts
-interface UpdateDataIntegrationApiKeyOptions {
-  /** The identifier of the integration. */
-  slug: string;
-  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
-  userId: string;
-  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. */
-  organizationId?: string;
-  /** The API key secret to store for this integration. */
-  secret: string;
-}
-//#endregion
-//#region src/pipes/interfaces/authorize-data-integration-options.interface.d.ts
-interface AuthorizeDataIntegrationOptions {
-  /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
-  slug: string;
-  /** The ID of the user to authorize. */
-  userId: string;
-  /** An organization ID to scope the authorization to a specific organization. */
-  organizationId?: string;
-  /** The URL to redirect the user to after authorization. */
-  returnTo?: string;
-}
-//#endregion
-//#region src/pipes/interfaces/create-data-integration-credential-options.interface.d.ts
-interface CreateDataIntegrationCredentialOptions {
-  /** The identifier of the integration. */
-  slug: string;
-  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
-  userId: string;
-  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. */
-  organizationId?: string;
-}
-//#endregion
-//#region src/pipes/interfaces/get-access-token-options.interface.d.ts
-interface GetAccessTokenOptions {
-  /** The identifier of the integration. */
-  provider: string;
-  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
-  userId: string;
-  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. */
-  organizationId?: string | null;
-}
-//#endregion
-//#region src/pipes/interfaces/get-user-connected-account-options.interface.d.ts
-interface GetUserConnectedAccountOptions {
-  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
-  userId: string;
-  /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
-  slug: string;
-  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization. */
-  organizationId?: string;
-}
-//#endregion
-//#region src/pipes/interfaces/connected-account-state.interface.d.ts
-declare const ConnectedAccountState: {
-  readonly Connected: "connected";
-  readonly NeedsReauthorization: "needs_reauthorization";
-};
-type ConnectedAccountState = (typeof ConnectedAccountState)[keyof typeof ConnectedAccountState];
-//#endregion
-//#region src/pipes/interfaces/create-user-connected-account-options.interface.d.ts
-interface CreateUserConnectedAccountOptions {
-  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
-  userId: string;
-  /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
-  slug: string;
-  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization. */
-  organizationId?: string;
-  /** The OAuth access token for the connected account. */
-  accessToken?: string;
-  /** The OAuth refresh token for the connected account. */
-  refreshToken?: string;
-  /** The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire. */
-  expiresAt?: Date;
-  /** The OAuth scopes granted for this connection. */
-  scopes?: string[];
-  /** Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided. */
-  state?: ConnectedAccountState;
-}
-//#endregion
-//#region src/pipes/interfaces/update-user-connected-account-options.interface.d.ts
-interface UpdateUserConnectedAccountOptions {
-  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
-  userId: string;
-  /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
-  slug: string;
-  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization. */
-  organizationId?: string;
-  /** The OAuth access token for the connected account. */
-  accessToken?: string;
-  /** The OAuth refresh token for the connected account. */
-  refreshToken?: string;
-  /** The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire. */
-  expiresAt?: Date;
-  /** The OAuth scopes granted for this connection. */
-  scopes?: string[];
-  /** Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided. */
-  state?: ConnectedAccountState;
-}
-//#endregion
-//#region src/pipes/interfaces/delete-user-connected-account-options.interface.d.ts
-interface DeleteUserConnectedAccountOptions {
-  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
-  userId: string;
-  /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
-  slug: string;
-  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization. */
-  organizationId?: string;
-}
-//#endregion
-//#region src/pipes/interfaces/list-user-data-providers-options.interface.d.ts
-interface ListUserDataProvidersOptions {
-  /** A [User](https://workos.com/docs/reference/authkit/user) identifier to list providers and connected accounts for. */
-  userId: string;
-  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to filter connections for a specific organization. */
-  organizationId?: string;
-}
-//#endregion
-//#region src/pipes/interfaces/data-integration-credential-type.interface.d.ts
-declare const DataIntegrationCredentialType: {
-  readonly Custom: "custom";
-  readonly Organization: "organization";
-};
-type DataIntegrationCredentialType = (typeof DataIntegrationCredentialType)[keyof typeof DataIntegrationCredentialType];
-//#endregion
-//#region src/pipes/interfaces/data-integration-credential.interface.d.ts
-/** The credentials configured for the Data Integration. */
-interface DataIntegrationCredential {
-  /** The credentials type. `custom` uses your own OAuth app credentials; `organization` has each organization supply its own credentials (so `client_id`/`redacted_client_secret` are null on the integration itself). */
-  type: DataIntegrationCredentialType;
-  /** The OAuth client ID configured for the provider app. Null for `organization` credentials. */
-  clientId: string | null;
-  /** The last four characters of the OAuth client secret. The full secret is never returned. Null for `organization` credentials. */
-  redactedClientSecret: string | null;
-}
-interface DataIntegrationCredentialResponse {
-  type: DataIntegrationCredentialType;
-  client_id: string | null;
-  redacted_client_secret: string | null;
-}
-//#endregion
-//#region src/pipes/interfaces/data-integration-custom-provider-authenticate-via.interface.d.ts
-declare const DataIntegrationCustomProviderAuthenticateVia: {
-  readonly RequestBody: "request_body";
-  readonly BasicAuthHeader: "basic_auth_header";
-};
-type DataIntegrationCustomProviderAuthenticateVia = (typeof DataIntegrationCustomProviderAuthenticateVia)[keyof typeof DataIntegrationCustomProviderAuthenticateVia];
-//#endregion
-//#region src/pipes/interfaces/data-integration-custom-provider.interface.d.ts
-interface DataIntegrationCustomProvider {
-  /** A descriptive name for the custom provider. */
-  name: string;
-  /** The provider's OAuth authorization endpoint. */
-  authorizationUrl: string | null;
-  /** The provider's OAuth token endpoint. */
-  tokenUrl: string | null;
-  /** The endpoint used to refresh tokens, if different from the token endpoint. */
-  refreshTokenUrl: string | null;
-  /** Whether PKCE is used during the authorization code flow. */
-  pkceEnabled: boolean;
-  /** The separator used to join requested scopes. */
-  requestScopeSeparator: string;
-  /** Whether at least one scope must be selected when connecting an account. */
-  scopesRequired: boolean;
-  /** Whether a client secret is required for this provider. */
-  clientSecretRequired: boolean;
-  /** Additional static query parameters appended to the authorization request. */
-  additionalAuthorizationParameters: Record<string, string>;
-  /** The Content-Type used when exchanging the token request. */
-  tokenBodyContentType: string;
-  /** How client credentials are sent when exchanging authorization codes and refreshing tokens. */
-  authenticateVia: DataIntegrationCustomProviderAuthenticateVia;
-}
-interface DataIntegrationCustomProviderResponse {
-  name: string;
-  authorization_url: string | null;
-  token_url: string | null;
-  refresh_token_url: string | null;
-  pkce_enabled: boolean;
-  request_scope_separator: string;
-  scopes_required: boolean;
-  client_secret_required: boolean;
-  additional_authorization_parameters: Record<string, string>;
-  token_body_content_type: string;
-  authenticate_via: DataIntegrationCustomProviderAuthenticateVia;
+   * Update an Organization
+   *
+   * Updates an organization in the current environment.
+   * @param payload - The request body.
+   * @returns {Promise<Organization>}
+   * @throws {BadRequestException} 400
+   * @throws 403 response from the API.
+   * @throws {NotFoundException} 404
+   * @throws {ConflictException} 409
+   * @throws {UnprocessableEntityException} 422
+   */
+  updateOrganization(options: UpdateOrganizationOptions): Promise<Organization>;
+  /**
+   * List IT Contacts
+   *
+   * Get the IT Contacts for an Organization.
+   * @param options - Object containing the Organization ID.
+   * @returns {Promise<List<ItContact>>}
+   * @throws {AuthorizationException} 403
+   * @throws {NotFoundException} 404
+   */
+  listItContacts(options: ListItContactsOptions): Promise<List<ItContact>>;
+  /**
+   * Create an IT Contact
+   *
+   * Add an IT Contact to an Organization. No Admin Portal invitation is sent,
+   * though the contact is notified if the Organization has a connection
+   * certificate nearing expiry.
+   * @param options - Object containing the Organization ID and the email address.
+   * @returns {Promise<ItContact>}
+   * @throws {AuthorizationException} 403
+   * @throws {NotFoundException} 404
+   * @throws {ConflictException} 409
+   * @throws {UnprocessableEntityException} 422
+   */
+  createItContact(options: CreateItContactOptions): Promise<ItContact>;
+  /**
+   * Delete an IT Contact
+   *
+   * Remove an IT Contact from an Organization and revoke the contact's active
+   * setup links.
+   * @param options - Object containing the Organization ID and the IT Contact ID.
+   * @returns {Promise<void>}
+   * @throws {AuthorizationException} 403
+   * @throws {NotFoundException} 404
+   */
+  deleteItContact(options: DeleteItContactOptions): Promise<void>;
+  /**
+   * Invite an IT Contact
+   *
+   * Create an Admin Portal setup link and email it to the IT Contact. An
+   * Organization can have at most one active invitation.
+   * @param options - Object containing the Organization ID, the IT Contact ID and the intents.
+   * @returns {Promise<void>}
+   * @throws {AuthorizationException} 403
+   * @throws {NotFoundException} 404
+   * @throws {ConflictException} 409
+   * @throws {UnprocessableEntityException} 422
+   */
+  inviteItContact(options: InviteItContactOptions): Promise<void>;
+  /**
+   * Revoke an IT Contact's invitation
+   *
+   * Revoke the Organization's active Admin Portal invitation.
+   * @param options - Object containing the Organization ID and the IT Contact ID.
+   * @returns {Promise<void>}
+   * @throws {AuthorizationException} 403
+   * @throws {NotFoundException} 404
+   */
+  revokeItContact(options: RevokeItContactOptions): Promise<void>;
 }
 //#endregion
-//#region src/pipes/interfaces/data-integration-state.interface.d.ts
-declare const DataIntegrationState: {
-  readonly Valid: "valid";
-  readonly Invalid: "invalid";
-  readonly Requested: "requested";
-};
-type DataIntegrationState = (typeof DataIntegrationState)[keyof typeof DataIntegrationState];
-//#endregion
-//#region src/pipes/interfaces/data-integration.interface.d.ts
-interface DataIntegration {
-  /** Distinguishes the Data Integration object. */
-  object: 'data_integration';
-  /** Unique identifier of the Data Integration. */
-  id: string;
-  /** The provider slug for this Data Integration. */
-  slug: string;
-  /** The integration type derived from the provider. */
-  integrationType: string;
-  /** An optional description of the Data Integration. */
-  description: string | null;
-  /** Whether the Data Integration is enabled. */
-  enabled: boolean;
-  /** The state of the Data Integration. */
-  state: DataIntegrationState;
-  /** The OAuth scopes configured for the Data Integration. `null` when the provider's configured scopes are used. */
-  scopes: string[] | null;
-  /** The OAuth redirect URI to register with the provider when configuring the custom application. */
-  redirectUri: string;
-  /** The credentials configured for the Data Integration. */
-  credentials: DataIntegrationCredential;
-  /** The OAuth definition when this is a custom provider; `null` for built-in providers. */
-  customProvider: DataIntegrationCustomProvider | null;
-  /** An ISO 8601 timestamp. */
-  createdAt: Date;
-  /** An ISO 8601 timestamp. */
-  updatedAt: Date;
-}
-interface DataIntegrationResponse {
-  object: 'data_integration';
-  id: string;
-  slug: string;
-  integration_type: string;
-  description: string | null;
-  enabled: boolean;
-  state: DataIntegrationState;
-  scopes: string[] | null;
-  redirect_uri: string;
-  credentials: DataIntegrationCredentialResponse;
-  custom_provider: DataIntegrationCustomProviderResponse | null;
-  created_at: string;
-  updated_at: string;
+//#region src/organization-domains/organization-domains.d.ts
+declare class OrganizationDomains {
+  private readonly workos;
+  constructor(workos: WorkOS);
+  /**
+   * Get an Organization Domain
+   *
+   * Get the details of an existing organization domain.
+   * @param id - Unique identifier of the organization domain.
+   *
+   * @example
+   * "org_domain_01EHZNVPK2QXHMVWCEDQEKY69A"
+   *
+   * @returns {Promise<OrganizationDomain>}
+   * @throws {NotFoundException} 404
+   */
+  getOrganizationDomain(id: string): Promise<OrganizationDomain>;
+  /**
+   * Verify an Organization Domain
+   *
+   * Initiates verification process for an Organization Domain.
+   * @param id - Unique identifier of the organization domain.
+   *
+   * @example
+   * "org_domain_01EHZNVPK2QXHMVWCEDQEKY69A"
+   *
+   * @returns {Promise<OrganizationDomain>}
+   * @throws {BadRequestException} 400
+   */
+  verifyOrganizationDomain(id: string): Promise<OrganizationDomain>;
+  /**
+   * Create an Organization Domain
+   *
+   * Creates a new Organization Domain.
+   * @param payload - Object containing domain, organizationId.
+   * @returns {Promise<OrganizationDomain>}
+   * @throws {ConflictException} 409
+   */
+  createOrganizationDomain(payload: CreateOrganizationDomainOptions): Promise<OrganizationDomain>;
+  /**
+   * Delete an Organization Domain
+   *
+   * Permanently deletes an organization domain. It cannot be undone.
+   * @param id - Unique identifier of the organization domain.
+   *
+   * @example
+   * "org_domain_01EHZNVPK2QXHMVWCEDQEKY69A"
+   *
+   * @returns {Promise<void>}
+   * @throws {NotFoundException} 404
+   */
+  deleteOrganizationDomain(id: string): Promise<void>;
 }
 //#endregion
-//#region src/pipes/interfaces/connected-account-auth-method.interface.d.ts
-declare const ConnectedAccountAuthMethod: {
-  readonly OAuth: "oauth";
-  readonly ApiKey: "api_key";
-};
-type ConnectedAccountAuthMethod = (typeof ConnectedAccountAuthMethod)[keyof typeof ConnectedAccountAuthMethod];
-//#endregion
-//#region src/pipes/interfaces/connected-account.interface.d.ts
-interface ConnectedAccount {
-  /** Distinguishes the connected account object. */
-  object: 'connected_account';
-  /** The unique identifier of the connected account. */
+//#region src/passwordless/interfaces/passwordless-session.interface.d.ts
+interface PasswordlessSession {
   id: string;
-  /** The [User](https://workos.com/docs/reference/authkit/user) identifier associated with this connection. */
-  userId: string | null;
-  /** The [Organization](https://workos.com/docs/reference/organization) identifier associated with this connection, or `null` if not scoped to an organization. */
-  organizationId: string | null;
-  /** The OAuth scopes granted for this connection. */
-  scopes: string[];
-  /** The authentication method used for this connection (`oauth` or `api_key`). Defaults to `oauth` if absent. */
-  authMethod?: ConnectedAccountAuthMethod;
-  /** The last four characters of the API key, or `null` for OAuth connections. */
-  apiKeyLast4?: string | null;
-  /**
-   * The state of the connected account:
-   * - `connected`: The connection is active and tokens are valid.
-   * - `needs_reauthorization`: The user needs to reauthorize the connection, typically because required scopes have changed.
-   * - `disconnected`: The connection has been disconnected.
-   */
-  state: ConnectedAccountState;
-  /** The timestamp when the connection was created. */
-  createdAt: string;
-  /** The timestamp when the connection was last updated. */
-  updatedAt: string;
+  email: string;
+  expiresAt: Date;
+  link: string;
+  object: 'passwordless_session';
 }
-interface ConnectedAccountResponse {
-  object: 'connected_account';
+interface PasswordlessSessionResponse {
   id: string;
-  user_id: string | null;
-  organization_id: string | null;
-  scopes: string[];
-  auth_method?: ConnectedAccountAuthMethod;
-  api_key_last_4?: string | null;
-  state: ConnectedAccountState;
-  created_at: string;
-  updated_at: string;
+  email: string;
+  expires_at: Date;
+  link: string;
+  object: 'passwordless_session';
 }
 //#endregion
-//#region src/pipes/interfaces/data-integration-authorize-url-response.interface.d.ts
-interface DataIntegrationAuthorizeUrlResponse {
-  /** The OAuth authorization URL to redirect the user to. */
-  url: string;
+//#region src/passwordless/interfaces/create-passwordless-session-options.interface.d.ts
+interface CreatePasswordlessSessionOptions {
+  type: 'MagicLink';
+  email: string;
+  redirectURI?: string;
+  state?: string;
+  connection?: string;
+  expiresIn?: number;
 }
-interface DataIntegrationAuthorizeUrlResponseWire {
-  url: string;
+interface SerializedCreatePasswordlessSessionOptions {
+  type: 'MagicLink';
+  email: string;
+  redirect_uri?: string;
+  state?: string;
+  connection?: string;
+  expires_in?: number;
 }
 //#endregion
-//#region src/pipes/interfaces/data-integration-credentials-response-credential.interface.d.ts
-/** The credential object containing the vended secret. */
-interface DataIntegrationCredentialsResponseCredential {
-  /** Distinguishes the credential object. */
-  object: 'credential';
-  /** The authentication method for this credential. Additional values may be added in the future; handle unknown values gracefully. */
-  authMethod: 'oauth';
-  /** The OAuth access token. */
-  value: string;
-  /** The ISO-8601 formatted timestamp indicating when the credential expires. */
-  expiresAt: string | null;
-  /** The scopes granted to the access token. */
-  scopes: string[];
-  /** If the integration has requested scopes that aren't present on the access token, they're listed here. */
-  missingScopes: string[];
-}
-interface DataIntegrationCredentialsResponseCredentialResponse {
-  object: 'credential';
-  auth_method: 'oauth';
-  value: string;
-  expires_at: string | null;
-  scopes: string[];
-  missing_scopes: string[];
+//#region src/passwordless/interfaces/send-session-response.interface.d.ts
+interface SendSessionResponse {
+  message?: string;
+  success?: boolean;
 }
 //#endregion
-//#region src/pipes/interfaces/data-integration-credentials-response-error.interface.d.ts
-declare const DataIntegrationCredentialsResponseError: {
-  readonly NotInstalled: "not_installed";
-  readonly NeedsReauthorization: "needs_reauthorization";
-};
-type DataIntegrationCredentialsResponseError = (typeof DataIntegrationCredentialsResponseError)[keyof typeof DataIntegrationCredentialsResponseError];
+//#region src/passwordless/passwordless.d.ts
+declare class Passwordless {
+  private readonly workos;
+  constructor(workos: WorkOS);
+  createSession({ redirectURI, expiresIn, ...options }: CreatePasswordlessSessionOptions): Promise<PasswordlessSession>;
+  sendSession(sessionId: string): Promise<SendSessionResponse>;
+}
 //#endregion
 //#region src/pipes/interfaces/data-integration-credentials-response.interface.d.ts
 interface DataIntegrationCredentialsResponse {
@@ -5733,177 +6145,6 @@ interface DataIntegrationCredentialsResponse {
   error?: DataIntegrationCredentialsResponseError;
 }
 //#endregion
-//#region src/pipes/interfaces/data-integration-access-token-response-access-token.interface.d.ts
-/** The [access token](https://workos.com/docs/reference/pipes/access-token) object, present when `active` is `true`. */
-interface DataIntegrationAccessTokenResponseAccessToken {
-  /** Distinguishes the access token object. */
-  object: 'access_token';
-  /** The OAuth access token for the connected integration. */
-  accessToken: string;
-  /** The ISO-8601 formatted timestamp indicating when the access token expires. */
-  expiresAt: Date | null;
-  /** The scopes granted to the access token. */
-  scopes: string[];
-  /** If the integration has requested scopes that aren't present on the access token, they're listed here. */
-  missingScopes: string[];
-}
-interface DataIntegrationAccessTokenResponseAccessTokenResponse {
-  object: 'access_token';
-  access_token: string;
-  expires_at: string | null;
-  scopes: string[];
-  missing_scopes: string[];
-}
-//#endregion
-//#region src/pipes/interfaces/data-integration-access-token-response.interface.d.ts
-type DataIntegrationAccessTokenResponse = {
-  active: true;
-  accessToken: DataIntegrationAccessTokenResponseAccessToken;
-} | {
-  active: false;
-  error: 'needs_reauthorization' | 'not_installed';
-};
-type DataIntegrationAccessTokenResponseWire = {
-  active: true;
-  access_token: DataIntegrationAccessTokenResponseAccessTokenResponse;
-} | {
-  active: false;
-  error: 'needs_reauthorization' | 'not_installed';
-};
-//#endregion
-//#region src/pipes/interfaces/data-integrations-list-response-data-connected-account-auth-method.interface.d.ts
-declare const DataIntegrationsListResponseDataConnectedAccountAuthMethod: {
-  readonly OAuth: "oauth";
-  readonly ApiKey: "api_key";
-};
-type DataIntegrationsListResponseDataConnectedAccountAuthMethod = (typeof DataIntegrationsListResponseDataConnectedAccountAuthMethod)[keyof typeof DataIntegrationsListResponseDataConnectedAccountAuthMethod];
-//#endregion
-//#region src/pipes/interfaces/data-integrations-list-response-data-connected-account-state.interface.d.ts
-declare const DataIntegrationsListResponseDataConnectedAccountState: {
-  readonly Connected: "connected";
-  readonly NeedsReauthorization: "needs_reauthorization";
-  readonly Disconnected: "disconnected";
-};
-type DataIntegrationsListResponseDataConnectedAccountState = (typeof DataIntegrationsListResponseDataConnectedAccountState)[keyof typeof DataIntegrationsListResponseDataConnectedAccountState];
-//#endregion
-//#region src/pipes/interfaces/data-integrations-list-response-data-connected-account.interface.d.ts
-interface DataIntegrationsListResponseDataConnectedAccount {
-  /** Distinguishes the connected account object. */
-  object: 'connected_account';
-  /** The unique identifier of the connected account. */
-  id: string;
-  /** The [User](https://workos.com/docs/reference/authkit/user) identifier associated with this connection. */
-  userId: string | null;
-  /** The [Organization](https://workos.com/docs/reference/organization) identifier associated with this connection, or `null` if not scoped to an organization. */
-  organizationId: string | null;
-  /** The OAuth scopes granted for this connection. */
-  scopes: string[];
-  /** The authentication method used for this connection (`oauth` or `api_key`). Defaults to `oauth` if absent. */
-  authMethod?: DataIntegrationsListResponseDataConnectedAccountAuthMethod;
-  /** The last four characters of the API key, or `null` for OAuth connections. */
-  apiKeyLast4?: string | null;
-  /**
-   * The state of the connected account:
-   * - `connected`: The connection is active and tokens are valid.
-   * - `needs_reauthorization`: The user needs to reauthorize the connection, typically because required scopes have changed.
-   * - `disconnected`: The connection has been disconnected.
-   */
-  state: DataIntegrationsListResponseDataConnectedAccountState;
-  /** The timestamp when the connection was created. */
-  createdAt: string;
-  /** The timestamp when the connection was last updated. */
-  updatedAt: string;
-  /**
-   * Use `user_id` instead.
-   * @deprecated
-   */
-  userlandUserId: string | null;
-}
-interface DataIntegrationsListResponseDataConnectedAccountResponse {
-  object: 'connected_account';
-  id: string;
-  user_id: string | null;
-  organization_id: string | null;
-  scopes: string[];
-  auth_method?: DataIntegrationsListResponseDataConnectedAccountAuthMethod;
-  api_key_last_4?: string | null;
-  state: DataIntegrationsListResponseDataConnectedAccountState;
-  created_at: string;
-  updated_at: string;
-  userland_user_id: string | null;
-}
-//#endregion
-//#region src/pipes/interfaces/data-integrations-list-response-data-auth-methods.interface.d.ts
-declare const DataIntegrationsListResponseDataAuthMethods: {
-  readonly OAuth: "oauth";
-  readonly ApiKey: "api_key";
-};
-type DataIntegrationsListResponseDataAuthMethods = (typeof DataIntegrationsListResponseDataAuthMethods)[keyof typeof DataIntegrationsListResponseDataAuthMethods];
-//#endregion
-//#region src/pipes/interfaces/data-integrations-list-response-data-ownership.interface.d.ts
-declare const DataIntegrationsListResponseDataOwnership: {
-  readonly UserlandUser: "userland_user";
-  readonly Organization: "organization";
-};
-type DataIntegrationsListResponseDataOwnership = (typeof DataIntegrationsListResponseDataOwnership)[keyof typeof DataIntegrationsListResponseDataOwnership];
-//#endregion
-//#region src/pipes/interfaces/data-integrations-list-response-data.interface.d.ts
-interface DataIntegrationsListResponseData {
-  /** Distinguishes the data provider object. */
-  object: 'data_provider';
-  /** The unique identifier of the provider. */
-  id: string;
-  /** The display name of the provider (e.g., "GitHub", "Slack"). */
-  name: string;
-  /** A description of the provider explaining how it will be used, if configured. */
-  description: string | null;
-  /** The slug identifier used in API calls (e.g., `github`, `slack`, `notion`). */
-  slug: string;
-  /** The type of integration (e.g., `github`, `slack`). */
-  integrationType: string;
-  /** The type of credentials used by the provider (e.g., `oauth2`). */
-  credentialsType: string;
-  /** The OAuth scopes configured for this provider, or `null` if none are configured. */
-  scopes: string[] | null;
-  /** The authentication methods supported by this provider (`oauth`, `api_key`, or both). Defaults to `["oauth"]` if absent. */
-  authMethods?: DataIntegrationsListResponseDataAuthMethods[];
-  /** Whether the provider is owned by a user or organization. */
-  ownership: DataIntegrationsListResponseDataOwnership;
-  /** The timestamp when the provider was created. */
-  createdAt: string;
-  /** The timestamp when the provider was last updated. */
-  updatedAt: string;
-  /** The user's [connected account](https://workos.com/docs/reference/pipes/connected-account) for this provider, or `null` if the user has not connected. */
-  connectedAccount: DataIntegrationsListResponseDataConnectedAccount | null;
-}
-interface DataIntegrationsListResponseDataResponse {
-  object: 'data_provider';
-  id: string;
-  name: string;
-  description: string | null;
-  slug: string;
-  integration_type: string;
-  credentials_type: string;
-  scopes: string[] | null;
-  auth_methods?: DataIntegrationsListResponseDataAuthMethods[];
-  ownership: DataIntegrationsListResponseDataOwnership;
-  created_at: string;
-  updated_at: string;
-  connected_account: DataIntegrationsListResponseDataConnectedAccountResponse | null;
-}
-//#endregion
-//#region src/pipes/interfaces/data-integrations-list-response.interface.d.ts
-interface DataIntegrationsListResponse {
-  /** Indicates this is a list response. */
-  object: 'list';
-  /** A list of [providers](https://workos.com/docs/reference/pipes/provider), each including a [`connected_account`](https://workos.com/docs/reference/pipes/connected-account) field with the user's connection status. */
-  data: DataIntegrationsListResponseData[];
-}
-interface DataIntegrationsListResponseWire {
-  object: 'list';
-  data: DataIntegrationsListResponseDataResponse[];
-}
-//#endregion
 //#region src/pipes/pipes.d.ts
 declare class Pipes {
   private readonly workos;
@@ -6853,22 +7094,43 @@ declare class AuditLogs {
 }
 //#endregion
 //#region node_modules/jose/dist/types/types.d.ts
-/** Generic JSON Web Key Parameters. */
-interface JWKParameters {
+/**
+ * JWS "alg" (Algorithm) Header Parameter values supported by this module. Availability of a given
+ * identifier additionally depends on the runtime.
+ */
+type JWSAlgorithm = 'HS256' | 'HS384' | 'HS512' | 'RS256' | 'RS384' | 'RS512' | 'PS256' | 'PS384' | 'PS512' | 'ES256' | 'ES384' | 'ES512' | 'EdDSA' | 'Ed25519' | 'ML-DSA-44' | 'ML-DSA-65' | 'ML-DSA-87' | (string & {});
+/**
+ * JWE "alg" (Algorithm) Header Parameter values supported by this module. Availability of a given
+ * identifier additionally depends on the runtime.
+ */
+type JWEKeyManagementAlgorithm = 'dir' | 'A128KW' | 'A192KW' | 'A256KW' | 'A128GCMKW' | 'A192GCMKW' | 'A256GCMKW' | 'ECDH-ES' | 'ECDH-ES+A128KW' | 'ECDH-ES+A192KW' | 'ECDH-ES+A256KW' | 'RSA-OAEP' | 'RSA-OAEP-256' | 'RSA-OAEP-384' | 'RSA-OAEP-512' | 'PBES2-HS256+A128KW' | 'PBES2-HS384+A192KW' | 'PBES2-HS512+A256KW' | (string & {});
+/**
+ * JWE "enc" (Encryption Algorithm) Header Parameter values supported by this module. Availability
+ * of a given identifier additionally depends on the runtime.
+ */
+type JWEContentEncryptionAlgorithm = 'A128CBC-HS256' | 'A192CBC-HS384' | 'A256CBC-HS512' | 'A128GCM' | 'A192GCM' | 'A256GCM' | (string & {});
+/** JWK "kty" (Key Type) Parameter values supported by this module. */
+type JWKKeyType = 'EC' | 'RSA' | 'OKP' | 'AKP' | 'oct' | (string & {});
+/**
+ * JSON Web Key ({@link https://www.rfc-editor.org/info/rfc7517/ JWK}). "RSA", "EC", "OKP", "AKP",
+ * and "oct" key types are supported.
+ *
+ * > Note: This is declared as a type alias rather than an interface so that it satisfies the implicit index
+ * > signature of the `JsonWebKey` types shipped by `@types/node` and `lib.dom`. It spells out the
+ * > {@link JWKParameters} members rather than intersecting them so that every JWK member is documented
+ * > in one place.
+ */
+type JWK = {
   /** JWK "kty" (Key Type) Parameter */
-  kty?: string;
-  /**
-   * JWK "alg" (Algorithm) Parameter
-   *
-   * @see {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}
-   */
-  alg?: string;
+  kty?: JWKKeyType;
+  /** JWK "alg" (Algorithm) Parameter */
+  alg?: JWSAlgorithm | JWEKeyManagementAlgorithm | JWEContentEncryptionAlgorithm;
   /** JWK "key_ops" (Key Operations) Parameter */
   key_ops?: string[];
   /** JWK "ext" (Extractable) Parameter */
   ext?: boolean;
   /** JWK "use" (Public Key Use) Parameter */
-  use?: string;
+  use?: 'sig' | 'enc' | (string & {});
   /** JWK "x5c" (X.509 Certificate Chain) Parameter */
   x5c?: string[];
   /** JWK "x5t" (X.509 Certificate SHA-1 Thumbprint) Parameter */
@@ -6879,22 +7141,6 @@ interface JWKParameters {
   x5u?: string;
   /** JWK "kid" (Key ID) Parameter */
   kid?: string;
-}
-/**
- * JSON Web Key ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK}). "RSA", "EC", "OKP", "AKP", and
- * "oct" key types are supported.
- *
- * @see {@link JWK_AKP_Public}
- * @see {@link JWK_AKP_Private}
- * @see {@link JWK_OKP_Public}
- * @see {@link JWK_OKP_Private}
- * @see {@link JWK_EC_Public}
- * @see {@link JWK_EC_Private}
- * @see {@link JWK_RSA_Public}
- * @see {@link JWK_RSA_Private}
- * @see {@link JWK_oct}
- */
-interface JWK extends JWKParameters {
   /**
    * - EC JWK "crv" (Curve) Parameter
    * - OKP JWK "crv" (The Subtype of Key Pair) Parameter
@@ -6933,7 +7179,20 @@ interface JWK extends JWKParameters {
   pub?: string;
   /** AKP JWK "priv" (Private key) Parameter */
   priv?: string;
-}
+  /**
+   * RSA JWK "oth" (Other Primes Info) Parameter
+   *
+   * > Note: Multi-prime RSA keys are not supported; importing a JWK with this parameter present throws.
+   */
+  oth?: Array<{
+    /** The Factor CRT Exponent */
+    d?: string;
+    /** The Prime Factor */
+    r?: string;
+    /** The Factor CRT Coefficient */
+    t?: string;
+  }>;
+};
 /**
  * Flattened JWS definition for verify function inputs, allows payload as {@link !Uint8Array} for
  * detached signature validation.
@@ -6972,8 +7231,11 @@ interface JoseHeaderParameters {
   x5u?: string;
   /** "jku" (JWK Set URL) Header Parameter */
   jku?: string;
-  /** "jwk" (JSON Web Key) Header Parameter */
-  jwk?: Pick<JWK, 'kty' | 'crv' | 'x' | 'y' | 'e' | 'n' | 'alg' | 'pub'>;
+  /**
+   * "jwk" (JSON Web Key) Header Parameter. This must be a public JSON Web Key; private and
+   * symmetric key parameters are not permitted.
+   */
+  jwk?: Omit<JWK, 'd' | 'dp' | 'dq' | 'k' | 'p' | 'q' | 'qi' | 'priv' | 'oth'>;
   /** "typ" (Type) Header Parameter */
   typ?: string;
   /** "cty" (Content Type) Header Parameter */
@@ -6981,15 +7243,11 @@ interface JoseHeaderParameters {
 }
 /** Recognized JWS Header Parameters, any other Header Members may also be present. */
 interface JWSHeaderParameters extends JoseHeaderParameters {
-  /**
-   * JWS "alg" (Algorithm) Header Parameter
-   *
-   * @see {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}
-   */
-  alg?: string;
+  /** JWS "alg" (Algorithm) Header Parameter */
+  alg?: JWSAlgorithm;
   /**
    * This JWS Extension Header Parameter modifies the JWS Payload representation and the JWS Signing
-   * Input computation as per {@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}.
+   * Input computation as per {@link https://www.rfc-editor.org/info/rfc7797/ RFC7797}.
    */
   b64?: boolean;
   /** JWS "crit" (Critical) Header Parameter */
@@ -7007,103 +7265,37 @@ interface JSONWebKeySet {
  * {@link !SubtleCrypto.importKey} API to obtain a {@link !CryptoKey} from your existing key
  * material.
  */
-type CryptoKey = Extract<Awaited<ReturnType<typeof crypto.subtle.generateKey>>, {
+type CryptoKey = typeof globalThis extends {
+  crypto: {
+    subtle: {
+      generateKey(...args: any[]): Promise<infer R>;
+    };
+  };
+} ? Extract<R, {
   type: string;
-}>;
+}> : CryptoKeyStructuralFallback;
+/**
+ * Used as {@link CryptoKey} when the host runtime's `crypto` global is not exposed on `typeof
+ * globalThis`, including when it is absent from ambient types or declared with `const` or `let`. It
+ * remains structurally compatible with host {@link !CryptoKey} declarations so values flow freely to
+ * and from {@link !SubtleCrypto} APIs.
+ */
+interface CryptoKeyStructuralFallback {
+  readonly algorithm: {
+    name: string;
+  };
+  readonly extractable: boolean;
+  readonly type: string;
+  readonly usages: string[];
+}
 //#endregion
 //#region node_modules/jose/dist/types/jwks/remote.d.ts
 /**
  * When passed to {@link jwks/remote.createRemoteJWKSet createRemoteJWKSet} this allows the resolver
  * to make use of advanced fetch configurations, HTTP Proxies, retry on network errors, etc.
  *
- * > [!NOTE]\
- * > Known caveat: Expect Type-related issues when passing the inputs through to fetch-like modules,
+ * > Note: Known caveat: Expect Type-related issues when passing the inputs through to fetch-like modules,
  * > they hardly ever get their typings inline with actual fetch, you should `@ts-expect-error` them.
- *
- * import ky from 'ky'
- *
- * let logRequest!: (request: Request) => void
- * let logResponse!: (request: Request, response: Response) => void
- * let logRetry!: (request: Request, error: Error, retryCount: number) => void
- *
- * const JWKS = jose.createRemoteJWKSet(url, {
- *   [jose.customFetch]: (...args) =>
- *     ky(args[0], {
- *       ...args[1],
- *       hooks: {
- *         beforeRequest: [
- *           (request) => {
- *             logRequest(request)
- *           },
- *         ],
- *         beforeRetry: [
- *           ({ request, error, retryCount }) => {
- *             logRetry(request, error, retryCount)
- *           },
- *         ],
- *         afterResponse: [
- *           (request, _, response) => {
- *             logResponse(request, response)
- *           },
- *         ],
- *       },
- *     }),
- * })
- * ```
- *
- * import * as undici from 'undici'
- *
- * // see https://undici.nodejs.org/#/docs/api/EnvHttpProxyAgent
- * let envHttpProxyAgent = new undici.EnvHttpProxyAgent()
- *
- * // @ts-ignore
- * const JWKS = jose.createRemoteJWKSet(url, {
- *   [jose.customFetch]: (...args) => {
- *     // @ts-ignore
- *     return undici.fetch(args[0], { ...args[1], dispatcher: envHttpProxyAgent }) // prettier-ignore
- *   },
- * })
- * ```
- *
- * import * as undici from 'undici'
- *
- * // see https://undici.nodejs.org/#/docs/api/RetryAgent
- * let retryAgent = new undici.RetryAgent(new undici.Agent(), {
- *   statusCodes: [],
- *   errorCodes: [
- *     'ECONNRESET',
- *     'ECONNREFUSED',
- *     'ENOTFOUND',
- *     'ENETDOWN',
- *     'ENETUNREACH',
- *     'EHOSTDOWN',
- *     'UND_ERR_SOCKET',
- *   ],
- * })
- *
- * // @ts-ignore
- * const JWKS = jose.createRemoteJWKSet(url, {
- *   [jose.customFetch]: (...args) => {
- *     // @ts-ignore
- *     return undici.fetch(args[0], { ...args[1], dispatcher: retryAgent }) // prettier-ignore
- *   },
- * })
- * ```
- *
- * import * as undici from 'undici'
- *
- * // see https://undici.nodejs.org/#/docs/api/MockAgent
- * let mockAgent = new undici.MockAgent()
- * mockAgent.disableNetConnect()
- *
- * // @ts-ignore
- * const JWKS = jose.createRemoteJWKSet(url, {
- *   [jose.customFetch]: (...args) => {
- *     // @ts-ignore
- *     return undici.fetch(args[0], { ...args[1], dispatcher: mockAgent }) // prettier-ignore
- *   },
- * })
- * ```
  */
 declare const customFetch: unique symbol;
 /** See {@link customFetch}. */
@@ -7121,55 +7313,14 @@ options: {
   signal: AbortSignal;
 }) => Promise<Response>;
 /**
- * > [!WARNING]\
- * > This option has security implications that must be understood, assessed for applicability, and
+ * > Warning: This option has security implications that must be understood, assessed for applicability, and
  * > accepted before use. It is critical that the JSON Web Key Set cache only be writable by your own
  * > code.
  *
  * This option is intended for cloud computing runtimes that cannot keep an in memory cache between
- * their code's invocations. Use in runtimes where an in memory cache between requests is available
- * is not desirable.
- *
- * When passed to {@link jwks/remote.createRemoteJWKSet createRemoteJWKSet} this allows the passed in
- * object to:
- *
- * - Serve as an initial value for the JSON Web Key Set that the module would otherwise need to
- *   trigger an HTTP request for
- * - Have the JSON Web Key Set the function optionally ended up triggering an HTTP request for
- *   assigned to it as properties
- *
- * The intended use pattern is:
- *
- * - Before verifying with {@link jwks/remote.createRemoteJWKSet createRemoteJWKSet} you pull the
- *   previously cached object from a low-latency key-value store offered by the cloud computing
- *   runtime it is executed on;
- * - Default to an empty object `{}` instead when there's no previously cached value;
- * - Pass it in as {@link RemoteJWKSetOptions[jwksCache]};
- * - Afterwards, update the key-value storage if the {@link ExportedJWKSCache.uat `uat`} property of
- *   the object has changed.
- *
- * // Prerequisites
- * let url!: URL
- * let jwt!: string
- * let getPreviouslyCachedJWKS!: () => Promise<jose.ExportedJWKSCache>
- * let storeNewJWKScache!: (cache: jose.ExportedJWKSCache) => Promise<void>
- *
- * // Load JSON Web Key Set cache
- * const jwksCache: jose.JWKSCacheInput = (await getPreviouslyCachedJWKS()) || {}
- * const { uat } = jwksCache
- *
- * const JWKS = jose.createRemoteJWKSet(url, {
- *   [jose.jwksCache]: jwksCache,
- * })
- *
- * // Use JSON Web Key Set cache
- * await jose.jwtVerify(jwt, JWKS)
- *
- * if (uat !== jwksCache.uat) {
- *   // Update JSON Web Key Set cache
- *   await storeNewJWKScache(jwksCache)
- * }
- * ```
+ * their code's invocations. The supplied writable object seeds the resolver's cache and is updated
+ * with `jwks` and `uat` after a successful fetch; persist it whenever `uat` changes. Using this in
+ * runtimes that can keep an in-memory cache between requests is not desirable.
  */
 declare const jwksCache: unique symbol;
 /** Options for the remote JSON Web Key Set. */
@@ -7205,44 +7356,45 @@ interface ExportedJWKSCache {
 }
 /** See {@link jwksCache}. */
 type JWKSCacheInput = ExportedJWKSCache | Record<string, never>;
+/** The key resolution function returned by {@link createRemoteJWKSet}. */
+interface RemoteJWKSet {
+  (protectedHeader?: JWSHeaderParameters, token?: FlattenedJWSInput): Promise<CryptoKey>;
+  /** Whether the cooldown window following the last successful fetch is still in effect. */
+  readonly coolingDown: boolean;
+  /**
+   * Whether the currently cached JSON Web Key Set is within its
+   * {@link RemoteJWKSetOptions.cacheMaxAge}.
+   */
+  readonly fresh: boolean;
+  /** Whether a JSON Web Key Set fetch is currently in flight. */
+  readonly reloading: boolean;
+  /**
+   * Triggers a JSON Web Key Set fetch, bypassing
+   * {@link RemoteJWKSetOptions.cooldownDuration the cooldown}.
+   */
+  reload: () => Promise<void>;
+  /**
+   * The currently cached JSON Web Key Set, or `undefined` when none has been fetched or seeded via
+   * {@link jwksCache} yet.
+   */
+  jwks: () => JSONWebKeySet | undefined;
+}
 /**
  * Returns a function that resolves a JWS JOSE Header to a public key object downloaded from a
  * remote endpoint returning a JSON Web Key Set, that is, for example, an OAuth 2.0 or OIDC
  * jwks_uri. The JSON Web Key Set is fetched when no key matches the selection process but only as
- * frequently as the `cooldownDuration` option allows to prevent abuse.
- *
- * It uses the "alg" (JWS Algorithm) Header Parameter to determine the right JWK "kty" (Key Type),
- * then proceeds to match the JWK "kid" (Key ID) with one found in the JWS Header Parameters (if
- * there is one) while also respecting the JWK "use" (Public Key Use) and JWK "key_ops" (Key
- * Operations) Parameters (if they are present on the JWK).
+ * frequently as the `cooldownDuration` option allows to prevent abuse. Selection respects the
+ * header's "alg" (Algorithm) and "kid" (Key ID) as well as the JWK's "use" (Public Key Use) and
+ * "key_ops" (Key Operations). Exactly one key must match; if multiple keys match, the thrown
+ * `JWKSMultipleMatchingKeys` can be iterated.
  *
- * Only a single public key must match the selection process. As shown in the example below when
- * multiple keys get matched it is possible to opt-in to iterate over the matched keys and attempt
- * verification in an iterative manner.
- *
- * > [!NOTE]\
- * > The function's purpose is to resolve public keys used for verifying signatures and will not work
+ * > Note: The function's purpose is to resolve public keys used for verifying signatures and will not work
  * > for public encryption keys.
  *
- * This function is exported (as a named export) from the main `'jose'` module entry point as well
- * as from its subpath export `'jose/jwks/remote'`.
- *
  * @param url URL to fetch the JSON Web Key Set from.
  * @param options Options for the remote JSON Web Key Set.
  */
-declare function createRemoteJWKSet(url: URL, options?: RemoteJWKSetOptions): {
-  (protectedHeader?: JWSHeaderParameters, token?: FlattenedJWSInput): Promise<CryptoKey>;
-  /** @ignore */
-  coolingDown: boolean;
-  /** @ignore */
-  fresh: boolean;
-  /** @ignore */
-  reloading: boolean;
-  /** @ignore */
-  reload: () => Promise<void>;
-  /** @ignore */
-  jwks: () => JSONWebKeySet | undefined;
-};
+declare function createRemoteJWKSet(url: URL, options?: RemoteJWKSetOptions): RemoteJWKSet;
 //#endregion
 //#region src/user-management/interfaces/session-handler-options.interface.d.ts
 interface SessionHandlerOptions {
@@ -9369,6 +9521,7 @@ declare const CreateWebhookEndpointEvents: {
   readonly PermissionDeleted: "permission.deleted";
   readonly PermissionUpdated: "permission.updated";
   readonly PipesConnectedAccountConnected: "pipes.connected_account.connected";
+  readonly PipesConnectedAccountConnectionFailed: "pipes.connected_account.connection_failed";
   readonly PipesConnectedAccountDisconnected: "pipes.connected_account.disconnected";
   readonly PipesConnectedAccountReauthorizationNeeded: "pipes.connected_account.reauthorization_needed";
   readonly SessionCreated: "session.created";
@@ -9469,6 +9622,7 @@ declare const UpdateWebhookEndpointEvents: {
   readonly PermissionDeleted: "permission.deleted";
   readonly PermissionUpdated: "permission.updated";
   readonly PipesConnectedAccountConnected: "pipes.connected_account.connected";
+  readonly PipesConnectedAccountConnectionFailed: "pipes.connected_account.connection_failed";
   readonly PipesConnectedAccountDisconnected: "pipes.connected_account.disconnected";
   readonly PipesConnectedAccountReauthorizationNeeded: "pipes.connected_account.reauthorization_needed";
   readonly SessionCreated: "session.created";
@@ -9767,8 +9921,9 @@ declare class UnprocessableEntityException extends Error implements RequestExcep
   readonly message: string;
   readonly code?: string;
   readonly requestID: string;
-  constructor({ code, errors, message, requestID }: {
+  constructor({ code, error, errors, message, requestID }: {
     code?: string;
+    error?: string;
     errors?: UnprocessableEntityError[];
     message?: string;
     requestID: string;
@@ -9913,5 +10068,5 @@ interface ConfidentialClientOptions extends WorkOSOptions {
 declare function createWorkOS(options: PublicClientOptions): PublicWorkOS;
 declare function createWorkOS(options: ConfidentialClientOptions): WorkOS;
 //#endregion
-export { ReadObjectMetadataResponse as $, FlagDeletedEventResponse as $a, AuthMethod as $c, ConnectionDomain as $d, AssignRoleOptionsWithResourceId as $f, AuthenticationMfaSucceededEventResponse as $i, Invitation as $l, PasswordlessSessionResponse as $n, OrganizationUpdatedResponse as $o, OrganizationRole as $p, SerializedLinkClaimAttemptToExternalUserOptions as $r, ListGroupsOptions as $s, DataIntegrationsListResponseDataOwnership as $t, UserManagementAccessToken as $u, ApiKeyRequiredException as A, DsyncGroupDeletedEvent as Aa, SerializedCreateOrganizationApiKeyOptions as Ac, AuthenticateWithEmailVerificationOptions as Ad, RemoveGroupRoleAssignmentsOptionsForOrganization as Af, DomainData as Ai, MagicAuthResponse as Al, ResponseHeaders as Am, ConnectedAccountState as An, OrganizationDomainCreatedEvent as Ao, SerializedListAuthorizationResourcesOptions as Ap, CompleteOAuth2Options as Ar, VaultDataCreatedEventResponse as As, SerializedAuditLogExportOptions as At, Factor as Au, ObjectSummaryResponse as B, DsyncUserDeletedEvent as Ba, SerializedCreateOrganizationDomainOptions as Bc, SerializedAuthenticateWithOptionsBase as Bd, SerializedCreateGroupRoleAssignmentOptions as Bf, GetOptions as Bi, ListOrganizationMembershipsOptions as Bl, UpdateCustomProviderDefinitionAuthenticateVia as Bn, OrganizationMembershipCreated as Bo, SerializedUpdatePermissionOptions as Bp, AgentCredentialValidation as Br, VaultDekReadEventResponse as Bs, RadarStandaloneResponse as Bt, SmsResponse as Bu, BadRequestException as C, ConnectionDeletedEventResponse as Ca, ValidateApiKeyOptions as Cc, AuthenticateUserWithRadarEmailChallengeCredentials as Cd, GroupRoleAssignmentEntryWithResourceExternalId as Cf, Organization as Ci, PasswordResetEventResponse as Cl, EventDirectoryResponse as Cm, DataIntegrationCredential as Cn, InvitationRevokedEventResponse as Co, AuthorizationCheckResult as Cp, CreateM2MApplication as Cr, UserDeletedEvent as Cs, AuditLogSchema as Ct, AuthenticationRadarRiskDetectedEventData as Cu, isAuthenticationErrorData as D, DsyncDeletedEventResponse as Da, SerializedCreatedApiKey as Dc, AuthenticateWithMagicAuthOptions as Dd, SerializedReplaceGroupRoleAssignmentsOptions as Df, CreateOrganizationOptions as Di, MagicAuth as Dl, RequestHeaders as Dm, DeleteUserConnectedAccountOptions as Dn, OrganizationCreatedResponse as Do, UpdateAuthorizationResourceByExternalIdOptions as Dp, RedirectUriInput as Dr, VaultByokKeyVerificationCompletedEvent as Ds, AuditLogExport as Dt, AuthenticationFactorType as Du, AuthenticationException as E, DsyncDeletedEvent as Ea, CreatedApiKey as Ec, AuthenticateUserWithMagicAuthCredentials as Ed, SerializedGroupRoleAssignmentEntry as Ef, ListOrganizationFeatureFlagsOptions as Ei, CreateMagicAuthResponseResponse as El, HttpClientResponseInterface as Em, ListUserDataProvidersOptions as En, OrganizationCreatedEvent as Eo, DeleteAuthorizationResourceByExternalIdOptions as Ep, CreateOAuthApplicationResponse as Er, UserUpdatedEventResponse as Es, AuditLogTargetSchema as Et, AuthenticationFactorResponse as Eu, UpdateWebhookEndpointEvents as F, DsyncGroupUserAddedEventResponse as Fa, OrganizationDomain as Fc, AuthenticateWithCodeOptions as Fd, BaseCreateGroupRoleAssignmentOptions as Ff, PutOptions as Fi, ListUserApiKeysOptions as Fl, UpdateDataIntegrationApiKeyOptions as Fn, OrganizationDomainUpdatedEventResponse as Fo, CreateOptionsWithParentResourceId as Fp, UserObject as Fr, VaultDataUpdatedEvent as Fs, Challenge as Ft, Totp as Fu, ObjectMetadata as G, EmailVerificationCreatedEventResponse as Ga, SerializedUserApiKey as Gc, ProfileResponse as Gd, RemoveRoleAssignmentOptions as Gf, ApiKeyRevokedEventResponse as Gi, BaseOrganizationMembershipResponse as Gl, CustomProviderDefinitionAuthenticateVia as Gn, OrganizationMembershipUpdatedResponse as Go, PermissionResponse as Gp, ValidAgentCredential as Gr, VaultNamesListedEvent as Gs, RadarListAction as Gt, AuthenticateUserWithTotpCredentials as Gu, ObjectVersionResponse as H, DsyncUserUpdatedEvent as Ha, VerifyEmailOptions as Hc, ProfileAndToken as Hd, ListGroupRoleAssignmentsOptions as Hf, ApiKeyCreatedEvent as Hi, AuthorizationOrganizationMembership as Hl, CreateDataIntegrationOptions as Hn, OrganizationMembershipDeleted as Ho, CreatePermissionOptions as Hp, SerializedAgentAccessTokenClaims as Hr, VaultKekCreatedEventResponse as Hs, RadarStandaloneResponseBlocklistType as Ht, AuthenticationEventResponse as Hu, UpdateWebhookEndpointStatus as I, DsyncGroupUserRemovedEvent as Ia, OrganizationDomainResponse as Ic, SerializedAuthenticateWithCodeOptions as Id, CreateGroupRoleAssignmentOptions as If, PostOptions as Ii, SerializedListUserApiKeysOptions as Il, DeleteDataIntegrationOptions as In, OrganizationDomainVerificationFailedEvent as Io, SerializedCreateAuthorizationResourceOptions as Ip, UserObjectResponse as Ir, VaultDataUpdatedEventResponse as Is, ChallengeResponse as It, TotpResponse as Iu, ActorResponse as J, EventName as Ja, UpdateUserPasswordOptions as Jc, ListConnectionsOptions as Jd, RemoveRoleOptionsWithResourceExternalId as Jf, AuthenticationMagicAuthFailedEvent as Ji, OrganizationMembershipStatus as Jl, DataIntegrationCredentialsType as Jn, OrganizationRoleDeletedEvent as Jo, SetOrganizationRolePermissionsOptions as Jp, ValidateAgentCredentialOptions as Jr, DataKeyPair as Js, RadarStandaloneAssessRequestAuthMethod as Jt, AuthenticateWithSessionCookieFailedResponse as Ju, ObjectMetadataResponse as K, Event as Ka, UserApiKey as Kc, OauthTokens as Kd, BaseRemoveRoleOptions as Kf, AuthenticationEmailVerificationSucceededEvent as Ki, OrganizationMembership as Kl, DataIntegrationCredentialsDto as Kn, OrganizationRoleCreatedEvent as Ko, RemoveOrganizationRolePermissionOptions as Kp, ValidateAgentAccessTokenOptions as Kr, VaultNamesListedEventResponse as Ks, RadarListType as Kt, AuthenticateWithTotpOptions as Ku, CreateWebhookEndpointEvents as L, DsyncGroupUserRemovedEventResponse as La, OrganizationDomainState as Lc, AuthenticateWithOptionsBase as Ld, CreateGroupRoleAssignmentOptionsForOrganization as Lf, PatchOptions as Li, ListUserFeatureFlagsOptions as Ll, UpdateDataIntegrationOptions as Ln, OrganizationDomainVerificationFailedEventResponse as Lo, SerializedUpdateAuthorizationResourceOptions as Lp, AutoPaginatable as Lr, VaultDekDecryptedEvent as Ls, ChallengeFactorOptions as Lt, TotpWithSecrets as Lu, WebhookEndpoint as M, DsyncGroupUpdatedEvent as Ma, SerializedApiKey as Mc, AuthenticateWithCodeAndVerifierOptions as Md, RemoveGroupRoleAssignmentsOptionsWithResourceId as Mf, WorkOSResponseError as Mi, Locale as Ml, GetAccessTokenOptions as Mn, OrganizationDomainDeletedEvent as Mo, AuthorizationResourceResponse as Mp, UserConsentOptionResponse as Mr, VaultDataDeletedEventResponse as Ms, VerifyResponseResponse as Mt, FactorType as Mu, WebhookEndpointResponse as N, DsyncGroupUpdatedEventResponse as Na, OrganizationDomainVerificationFailed as Nc, SerializedAuthenticateWithCodeAndVerifierOptions as Nd, SerializedRemoveGroupRoleAssignmentsOptions as Nf, WorkOSOptions as Ni, ListUsersOptions as Nl, CreateDataIntegrationCredentialOptions as Nn, OrganizationDomainDeletedEventResponse as No, CreateAuthorizationResourceOptions as Np, UserConsentOptionChoice as Nr, VaultDataReadEvent as Ns, VerifyChallengeOptions as Nt, FactorWithSecrets as Nu, GenericServerException as O, DsyncGroupCreatedEvent as Oa, CreateOrganizationApiKeyOptions as Oc, SerializedAuthenticateWithMagicAuthOptions as Od, BaseRemoveGroupRoleAssignmentsOptions as Of, CreateOrganizationRequestOptions as Oi, MagicAuthEvent as Ol, RequestOptions as Om, UpdateUserConnectedAccountOptions as On, OrganizationDeletedEvent as Oo, GetAuthorizationResourceByExternalIdOptions as Op, RedirectUriInputResponse as Or, VaultByokKeyVerificationCompletedEventResponse as Os, AuditLogExportResponse as Ot, AuthenticationFactorWithSecrets as Ou, WebhookEndpointStatus as P, DsyncGroupUserAddedEvent as Pa, OrganizationDomainVerificationFailedResponse as Pc, AuthenticateUserWithCodeCredentials as Pd, RemoveGroupRoleAssignmentOptions as Pf, UnprocessableEntityError as Pi, SerializedListUsersOptions as Pl, AuthorizeDataIntegrationOptions as Pn, OrganizationDomainUpdatedEvent as Po, CreateOptionsWithParentExternalId as Pp, UserConsentOptionChoiceResponse as Pr, VaultDataReadEventResponse as Ps, EnrollFactorOptions as Pt, FactorWithSecretsResponse as Pu, UpdateObjectOptions as Q, FlagDeletedEvent as Qa, UpdateOrganizationMembershipOptions as Qc, Connection as Qd, AssignRoleOptionsWithResourceExternalId as Qf, AuthenticationMfaSucceededEvent as Qi, ListAuthFactorsOptions as Ql, PasswordlessSession as Qn, OrganizationUpdatedEvent as Qo, SerializedCreateOrganizationRoleOptions as Qp, SerializedClaimAttemptResponse as Qr, RemoveGroupOrganizationMembershipOptions as Qs, DataIntegrationsListResponseDataResponse as Qt, SessionCookieData as Qu, WorkOS as R, DsyncUserCreatedEvent as Ra, OrganizationDomainVerificationStrategy as Rc, AuthenticateWithSessionOptions as Rd, CreateGroupRoleAssignmentOptionsWithResourceExternalId as Rf, List as Ri, ListSessionsOptions as Rl, UpdateCustomProviderDefinition as Rn, OrganizationDomainVerifiedEvent as Ro, UpdateAuthorizationResourceOptions as Rp, AgentAccessTokenClaims as Rr, VaultDekDecryptedEventResponse as Rs, RadarListEntryAlreadyPresentResponse as Rt, TotpWithSecretsResponse as Ru, ConflictException as S, ConnectionDeletedEvent as Sa, SerializedValidateApiKeyResponse as Sc, SerializedAuthenticateWithRadarSmsChallengeOptions as Sd, GroupRoleAssignmentEntryForOrganization as Sf, UpdateOrganizationOptions as Si, PasswordResetEvent as Sl, EventDirectory as Sm, DataIntegrationCustomProviderAuthenticateVia as Sn, InvitationRevokedEvent as So, AuthorizationCheckOptionsWithResourceId as Sp, CreateApplicationOptions as Sr, UserCreatedEventResponse as Ss, AuditLogActorSchema as St, UserManagementAuthorizationURLOptions as Su, AuthenticationErrorData as T, DsyncActivatedEventResponse as Ta, ListOrganizationApiKeysOptions as Tc, SerializedAuthenticateWithRadarEmailChallengeOptions as Td, ReplaceGroupRoleAssignmentsOptions as Tf, ListOrganizationsOptions as Ti, CreateMagicAuthResponse as Tl, HttpClientInterface as Tm, DataIntegrationCredentialType as Tn, MagicAuthCreatedEventResponse as To, DeleteAuthorizationResourceOptions as Tp, CreateOAuthApplication as Tr, UserUpdatedEvent as Ts, AuditLogSchemaResponse as Tt, AuthenticationFactor as Tu, VaultObject as U, DsyncUserUpdatedEventResponse as Ua, SerializedUserApiKeyWithValue as Uc, ProfileAndTokenResponse as Ud, GroupRoleAssignment as Uf, ApiKeyCreatedEventResponse as Ui, AuthorizationOrganizationMembershipResponse as Ul, CustomProviderDefinition as Un, OrganizationMembershipDeletedResponse as Uo, SerializedCreatePermissionOptions as Up, SerializedAgentCredentialValidation as Ur, VaultMetadataReadEvent as Us, RadarStandaloneResponseControl as Ut, AuthenticationEventSso as Uu, ObjectVersion as V, DsyncUserDeletedEventResponse as Va, SerializedVerifyEmailOptions as Vc, WithResolvedClientId as Vd, GetGroupRoleAssignmentOptions as Vf, GenerateLinkIntent as Vi, SerializedListOrganizationMembershipsOptions as Vl, GetDataIntegrationOptions as Vn, OrganizationMembershipCreatedResponse as Vo, UpdatePermissionOptions as Vp, InvalidAgentCredential as Vr, VaultKekCreatedEvent as Vs, RadarStandaloneResponseWire as Vt, AuthenticationEvent as Vu, VaultObjectResponse as W, EmailVerificationCreatedEvent as Wa, UserApiKeyWithValue as Wc, Profile as Wd, GroupRoleAssignmentResponse as Wf, ApiKeyRevokedEvent as Wi, BaseOrganizationMembership as Wl, CustomProviderDefinitionResponse as Wn, OrganizationMembershipUpdated as Wo, Permission as Wp, SerializedValidateAgentCredentialOptions as Wr, VaultMetadataReadEventResponse as Ws, RadarStandaloneResponseVerdict as Wt, AuthenticationEventSsoResponse as Wu, CreateDataKeyResponseWire as X, FlagCreatedEvent as Xa, UpdateUserOptions as Xc, GetProfileAndTokenOptions as Xd, SerializedRemoveRoleOptions as Xf, AuthenticationMagicAuthSucceededEvent as Xi, SerializedListInvitationsOptions as Xl, CreatePasswordlessSessionOptions as Xn, OrganizationRoleUpdatedEvent as Xo, UpdateOrganizationRoleOptions as Xp, ClaimAttemptResponse as Xr, SerializedUpdateGroupOptions as Xs, DataIntegrationsListResponseWire as Xt, AuthenticateWithSessionCookieOptions as Xu, CreateDataKeyResponse as Y, EventResponse as Ya, SerializedUpdateUserOptions as Yc, SerializedListConnectionsOptions as Yd, RemoveRoleOptionsWithResourceId as Yf, AuthenticationMagicAuthFailedEventResponse as Yi, ListInvitationsOptions as Yl, SendSessionResponse as Yn, OrganizationRoleDeletedEventResponse as Yo, SerializedUpdateOrganizationRoleOptions as Yp, ClaimAttemptOrganization as Yr, KeyContext as Ys, DataIntegrationsListResponse as Yt, AuthenticateWithSessionCookieFailureReason as Yu, UpdateObjectEntity as Z, FlagCreatedEventResponse as Za, SerializedUpdateOrganizationMembershipOptions as Zc, GetProfileOptions as Zd, AssignRoleOptions as Zf, AuthenticationMagicAuthSucceededEventResponse as Zi, ListGroupsForOrganizationMembershipOptions as Zl, SerializedCreatePasswordlessSessionOptions as Zn, OrganizationRoleUpdatedEventResponse as Zo, CreateOrganizationRoleOptions as Zp, LinkClaimAttemptToExternalUserOptions as Zr, UpdateGroupOptions as Zs, DataIntegrationsListResponseData as Zt, AuthenticateWithSessionCookieSuccessResponse as Zu, SignatureVerificationException as _, AuthenticationSSOSucceededEventResponse as _a, FlagTarget as _c, AuthenticateUserWithOrganizationSelectionCredentials as _d, RoleResponse as _f, ActionPayload as _i, RefreshSessionFailureReason as _l, Directory as _m, DataIntegration as _n, InvitationAcceptedEventResponse as _o, ListResourcesForMembershipOptionsWithParentExternalId as _p, CreateApplicationClientSecretOptions as _r, SessionCreatedEventResponse as _s, AuditLogActor as _t, CreateOrganizationMembershipOptions as _u, PublicWorkOS as a, AuthenticationPasskeyFailedEventResponse as aa, CreateGroupOptions as ac, User as ad, DirectoryUser as af, AgentRegistrationStatus as ai, SendRadarSmsChallengeResponse as al, SerializedCreateEnvironmentRoleOptions as am, DataIntegrationAccessTokenResponse as an, GroupCreatedEventResponse as ao, ListRoleAssignmentsOptions as ap, ApplicationCredentialsListItemResponse as ar, PermissionCreatedEventResponse as as, DecryptDataKeyResponse as at, SerializedEnrollUserInMfaFactorOptions as au, NotFoundException as b, ConnectionDeactivatedEvent as ba, EvaluationContext as bc, AuthenticateUserWithRadarSmsChallengeCredentials as bd, BaseGroupRoleAssignmentEntry as bf, UserRegistrationActionPayload as bi, TerminalRefreshSessionFailureReason as bl, DirectoryStateResponse as bm, DataIntegrationCustomProvider as bn, InvitationResentEvent as bo, AuthorizationCheckOptions as bp, UpdateApplicationOptions as br, UnknownEvent as bs, CreateAuditLogEventRequestOptions as bt, SerializedCreateMagicAuthOptions as bu, PortalLinkResponseWire as c, AuthenticationPasswordFailedEvent as ca, SerializedAddGroupOrganizationMembershipOptions as cc, ImpersonatorResponse as cd, DirectoryUserWithGroupsResponse as cf, SerializedAgentRegistrationClaim as ci, SendInvitationOptions as cl, EnvironmentRoleListResponse as cm, DataIntegrationAccessTokenResponseAccessTokenResponse as cn, GroupMemberAddedEvent as co, RoleAssignmentResource as cp, ConnectApplicationM2MResponse as cr, PermissionUpdatedEvent as cs, WidgetSessionTokenResponseWire as ct, EmailVerificationEventResponse as cu, IntentOptions as d, AuthenticationPasswordSucceededEventResponse as da, RuntimeClientOptions as dc, AuthenticateUserWithRefreshTokenCredentials as dd, OrganizationRoleEventResponse as df, PKCEPair as di, SerializedRevokeSessionOptions as dl, ListDirectoryGroupsOptions as dm, DataIntegrationCredentialsResponseCredentialResponse as dn, GroupMemberEventResponseData as do, RoleAssignmentRole as dp, ConnectApplicationResponse as dr, RoleCreatedEventResponse as ds, FeatureFlagsRuntimeClient as dt, SerializedCreateUserOptions as du, AuthenticationOAuthFailedEvent as ea, ListGroupOrganizationMembershipsOptions as ec, AuthenticationMethod as ed, ConnectionResponse as ef, AgentIdentity as ei, Session as el, AddEnvironmentRolePermissionOptions as em, DataIntegrationsListResponseDataAuthMethods as en, FlagRuleUpdatedEvent as eo, BaseAssignRoleOptions as ep, ListEventOptions as er, PasswordResetCreatedEvent as es, ReadObjectOptions as et, InvitationEvent as eu, IntentOptionsResponse as f, AuthenticationRadarRiskDetectedEvent as fa, RemoveFlagTargetOptions as fc, AuthenticateWithRefreshTokenOptions as fd, OrganizationRoleResponse as ff, Actions as fi, serializeRevokeSessionOptions as fl, ListDirectoriesOptions as fm, DataIntegrationAuthorizeUrlResponse as fn, GroupMemberRemovedEvent as fo, RoleAssignmentSource as fp, ConnectApplicationRedirectUri as fr, RoleDeletedEvent as fs, CookieSession as ft, CreateUserApiKeyOptions as fu, UnauthorizedException as g, AuthenticationSSOSucceededEvent as ga, FlagPollResponse as gc, SerializedAuthenticateWithPasswordOptions as gd, RoleList as gf, ActionContext as gi, SerializedResendInvitationOptions as gl, DirectoryGroupResponse as gm, ConnectedAccountAuthMethod as gn, InvitationAcceptedEvent as go, ListResourcesForMembershipOptions as gp, DeleteClientSecretOptions as gr, SessionCreatedEvent as gs, SerializedCreateAuditLogSchemaOptions as gt, SerializedCreatePasswordResetOptions as gu, UnprocessableEntityException as h, AuthenticationSSOFailedEventResponse as ha, FlagPollEntry as hc, AuthenticateWithPasswordOptions as hd, RoleEventResponse as hf, UserRegistrationActionResponseData as hi, ResendInvitationOptions as hl, DirectoryGroup as hm, ConnectedAccountResponse as hn, GroupUpdatedEventResponse as ho, ListMembershipsForResourceOptions as hp, ExternalAuthCompleteResponseWire as hr, RoleUpdatedEventResponse as hs, CreateAuditLogSchemaResponse as ht, CreatePasswordResetOptions as hu, PublicUserManagement as i, AuthenticationPasskeyFailedEvent as ia, DeleteGroupOptions as ic, CreateUserResponseResponse as id, DefaultCustomAttributes as if, AgentRegistrationKind as ii, SendRadarSmsChallengeOptions as il, CreateEnvironmentRoleOptions as im, DataIntegrationsListResponseDataConnectedAccountAuthMethod as in, GroupCreatedEvent as io, SerializedListRoleAssignmentsForResourceOptions as ip, ApplicationCredentialsListItem as ir, PermissionCreatedEvent as is, DecryptDataKeyOptions as it, EnrollAuthFactorOptions as iu, Webhooks as j, DsyncGroupDeletedEventResponse as ja, ApiKey as jc, SerializedAuthenticateWithEmailVerificationOptions as jd, RemoveGroupRoleAssignmentsOptionsWithResourceExternalId as jf, DomainDataState as ji, LogoutURLOptions as jl, CryptoProvider as jm, GetUserConnectedAccountOptions as jn, OrganizationDomainCreatedEventResponse as jo, AuthorizationResource as jp, UserConsentOption as jr, VaultDataDeletedEvent as js, VerifyResponse as jt, FactorResponse as ju, WorkOSErrorData as k, DsyncGroupCreatedEventResponse as ka, CreateOrganizationApiKeyRequestOptions as kc, AuthenticateUserWithEmailVerificationCredentials as kd, RemoveGroupRoleAssignmentsOptions as kf, SerializedCreateOrganizationOptions as ki, MagicAuthEventResponse as kl, ResponseHeaderValue as km, CreateUserConnectedAccountOptions as kn, OrganizationDeletedResponse as ko, ListAuthorizationResourcesOptions as kp, ListApplicationsOptions as kr, VaultDataCreatedEvent as ks, AuditLogExportOptions as kt, AuthenticationFactorWithSecretsResponse as ku, GenerateLink as l, AuthenticationPasswordFailedEventResponse as la, RuntimeClientStats as lc, AuthenticateWithRefreshTokenPublicClientOptions as ld, ListOrganizationRolesResponse as lf, SerializedAgentRegistrationClaimCompletion as li, SerializedSendInvitationOptions as ll, EnvironmentRoleResponse as lm, DataIntegrationCredentialsResponseError as ln, GroupMemberAddedEventResponse as lo, RoleAssignmentResourceResponse as lp, ConnectApplicationOAuth as lr, PermissionUpdatedEventResponse as ls, CreateTokenOptions as lt, EmailVerificationResponse as lu, SSOIntentOptionsResponse as m, AuthenticationSSOFailedEvent as ma, FlagChange as mc, AuthenticateUserWithPasswordCredentials as md, RoleEvent as mf, ResponsePayload as mi, SerializedResetPasswordOptions as ml, PaginationOptions as mm, ConnectedAccount as mn, GroupUpdatedEvent as mo, ListMembershipsForResourceByExternalIdOptions as mp, ExternalAuthCompleteResponse as mr, RoleUpdatedEvent as ms, CreateAuditLogSchemaRequestOptions as mt, SerializedCreateUserApiKeyOptions as mu, PublicClientOptions as n, AuthenticationOAuthSucceededEvent as na, GroupResponse as nc, AuthenticationResponseResponse as nd, SSOAuthorizationURLOptions as nf, AgentRegistrationClaim as ni, SessionStatus as nl, SerializedUpdateEnvironmentRoleOptions as nm, DataIntegrationsListResponseDataConnectedAccountResponse as nn, FlagUpdatedEvent as no, ListRoleAssignmentsForResourceByExternalIdOptions as np, NewConnectApplicationSecret as nr, PasswordResetSucceededEvent as ns, CreateObjectEntity as nt, InvitationResponse as nu, createWorkOS as o, AuthenticationPasskeySucceededEvent as oa, SerializedCreateGroupOptions as oc, UserResponse as od, DirectoryUserResponse as of, SerializedAgentIdentity as oi, SendRadarSmsChallengeResponseResponse as ol, EnvironmentRole as om, DataIntegrationAccessTokenResponseWire as on, GroupDeletedEvent as oo, SerializedListRoleAssignmentsOptions as op, ConnectApplication as or, PermissionDeletedEvent as os, CreateDataKeyOptions as ot, EmailVerification as ou, SSOIntentOptions as p, AuthenticationRadarRiskDetectedEventResponse as pa, ListFeatureFlagsOptions as pc, SerializedAuthenticateWithRefreshTokenOptions as pd, Role as pf, AuthenticationActionResponseData as pi, ResetPasswordOptions as pl, SerializedListDirectoriesOptions as pm, DataIntegrationAuthorizeUrlResponseWire as pn, GroupMemberRemovedEventResponse as po, RoleAssignmentSourceResponse as pp, ConnectApplicationRedirectUriResponse as pr, RoleDeletedEventResponse as ps, CreateAuditLogSchemaOptions as pt, CreateUserApiKeyRequestOptions as pu, Actor as q, EventBase as qa, SerializedUpdateUserPasswordOptions as qc, OauthTokensResponse as qd, RemoveRoleOptions as qf, AuthenticationEmailVerificationSucceededEventResponse as qi, OrganizationMembershipResponse as ql, DataIntegrationCredentialsDtoResponse as qn, OrganizationRoleCreatedEventResponse as qo, AddOrganizationRolePermissionOptions as qp, ValidateAgentApiKeyOptions as qr, DataKey as qs, RadarStandaloneAssessRequestAction as qt, SerializedAuthenticateWithTotpOptions as qu, PublicSSO as r, AuthenticationOAuthSucceededEventResponse as ra, GetGroupOptions as rc, CreateUserResponse as rd, SSOPKCEAuthorizationURLResult as rf, AgentRegistrationClaimCompletion as ri, SendVerificationEmailOptions as rl, UpdateEnvironmentRoleOptions as rm, DataIntegrationsListResponseDataConnectedAccountState as rn, FlagUpdatedEventResponse as ro, ListRoleAssignmentsForResourceOptions as rp, NewConnectApplicationSecretResponse as rr, PasswordResetSucceededEventResponse as rs, CreateObjectOptions as rt, Identity as ru, PortalLinkResponse as s, AuthenticationPasskeySucceededEventResponse as sa, AddGroupOrganizationMembershipOptions as sc, Impersonator as sd, DirectoryUserWithGroups as sf, SerializedAgentRegistration as si, SerializedSendRadarSmsChallengeOptions as sl, EnvironmentRoleList as sm, DataIntegrationAccessTokenResponseAccessToken as sn, GroupDeletedEventResponse as so, RoleAssignment as sp, ConnectApplicationM2M as sr, PermissionDeletedEventResponse as ss, WidgetSessionTokenResponse as st, EmailVerificationEvent as su, ConfidentialClientOptions as t, AuthenticationOAuthFailedEventResponse as ta, Group as tc, AuthenticationResponse as td, ConnectionType as tf, AgentRegistration as ti, SessionResponse as tl, SetEnvironmentRolePermissionsOptions as tm, DataIntegrationsListResponseDataConnectedAccount as tn, FlagRuleUpdatedEventResponse as to, SerializedAssignRoleOptions as tp, SerializedListEventOptions as tr, PasswordResetCreatedEventResponse as ts, ReadObjectResponse as tt, InvitationEventResponse as tu, GenerateLinkResponse as u, AuthenticationPasswordSucceededEvent as ua, RuntimeClientLogger as uc, SerializedAuthenticateWithRefreshTokenPublicClientOptions as ud, OrganizationRoleEvent as uf, PKCE as ui, RevokeSessionOptions as ul, ListDirectoryUsersOptions as um, DataIntegrationCredentialsResponseCredential as un, GroupMemberEventData as uo, RoleAssignmentResponse as up, ConnectApplicationOAuthResponse as ur, RoleCreatedEvent as us, WidgetSessionTokenScopes as ut, CreateUserOptions as uu, RateLimitExceededException as v, ConnectionActivatedEvent as va, FeatureFlag as vc, AuthenticateWithOrganizationSelectionOptions as vd, ListEffectivePermissionsByExternalIdOptions as vf, UserData as vi, RefreshSessionResponse as vl, DirectoryResponse as vm, DataIntegrationResponse as vn, InvitationCreatedEvent as vo, ListResourcesForMembershipOptionsWithParentId as vp, ListApplicationClientSecretsOptions as vr, SessionRevokedEvent as vs, AuditLogTarget as vt, SerializedCreateOrganizationMembershipOptions as vu, AuthenticationErrorCode as w, DsyncActivatedEvent as wa, ValidateApiKeyResponse as wc, AuthenticateWithRadarEmailChallengeOptions as wd, GroupRoleAssignmentEntryWithResourceId as wf, OrganizationResponse as wi, PasswordResetResponse as wl, HttpClient as wm, DataIntegrationCredentialResponse as wn, MagicAuthCreatedEvent as wo, SerializedAuthorizationCheckOptions as wp, CreateM2MApplicationResponse as wr, UserDeletedEventResponse as ws, AuditLogSchemaMetadata as wt, AuthenticationRadarRiskDetectedEventResponseData as wu, NoApiKeyProvidedException as x, ConnectionDeactivatedEventResponse as xa, AddFlagTargetOptions as xc, AuthenticateWithRadarSmsChallengeOptions as xd, GroupRoleAssignmentEntry as xf, SerializedUpdateOrganizationOptions as xi, PasswordReset as xl, DirectoryType as xm, DataIntegrationCustomProviderResponse as xn, InvitationResentEventResponse as xo, AuthorizationCheckOptionsWithResourceExternalId as xp, GetApplicationOptions as xr, UserCreatedEvent as xs, SerializedCreateAuditLogEventOptions as xt, PKCEAuthorizationURLResult as xu, OauthException as y, ConnectionActivatedEventResponse as ya, FeatureFlagResponse as yc, SerializedAuthenticateWithOrganizationSelectionOptions as yd, ListEffectivePermissionsOptions as yf, UserDataPayload as yi, RetryableRefreshSessionFailureReason as yl, DirectoryState as ym, DataIntegrationState as yn, InvitationCreatedEventResponse as yo, SerializedListResourcesForMembershipOptions as yp, DeleteApplicationOptions as yr, SessionRevokedEventResponse as ys, CreateAuditLogEventOptions as yt, CreateMagicAuthOptions as yu, ObjectSummary as z, DsyncUserCreatedEventResponse as za, CreateOrganizationDomainOptions as zc, SerializedAuthenticatePublicClientBase as zd, CreateGroupRoleAssignmentOptionsWithResourceId as zf, ListResponse as zi, SerializedListSessionsOptions as zl, UpdateCustomProviderDefinitionResponse as zn, OrganizationDomainVerifiedEventResponse as zo, ListPermissionsOptions as zp, AgentCredentialType as zr, VaultDekReadEvent as zs, RadarListEntryAlreadyPresentResponseWire as zt, Sms as zu };
-//# sourceMappingURL=factory-vzr4nni7.d.mts.map
+export { ReadObjectMetadataResponse as $, OrganizationMembershipDeletedResponse as $a, CreatedApiKey as $c, AuthenticateUserWithMagicAuthCredentials as $d, SerializedGroupRoleAssignmentEntry as $f, DsyncUserUpdatedEventResponse as $i, CreateMagicAuthResponseResponse as $l, HttpClientResponseInterface as $m, SerializedLinkClaimAttemptToExternalUserOptions as $n, VaultDataCreatedEventResponse as $o, DeleteAuthorizationResourceByExternalIdOptions as $p, ApiKeyCreatedEventResponse as $r, DataIntegrationAuthorizeUrlResponse as $s, PasswordlessSessionResponse as $t, AuthenticationFactorResponse as $u, ApiKeyRequiredException as A, InvitationResentEvent as Aa, AddGroupOrganizationMembershipOptions as Ac, CreateUserResponse as Ad, SSOPKCEAuthorizationURLResult as Af, ConnectionDeactivatedEvent as Ai, SendVerificationEmailOptions as Al, UpdateEnvironmentRoleOptions as Am, CompleteOAuth2Options as An, PipesConnectedAccountState as Ao, ListRoleAssignmentsForResourceOptions as Ap, DeleteItContactOptions as Ar, DeleteDataIntegrationOptions as As, SerializedAuditLogExportOptions as At, Identity as Au, ObjectSummaryResponse as B, OrganizationDomainCreatedEvent as Ba, FlagPollResponse as Bc, SerializedAuthenticateWithRefreshTokenOptions as Bd, Role as Bf, DsyncGroupDeletedEvent as Bi, ResetPasswordOptions as Bl, SerializedListDirectoriesOptions as Bm, AgentCredentialValidation as Bn, SessionCreatedEventResponse as Bo, RoleAssignmentSourceResponse as Bp, DomainData as Br, DataIntegrationsListResponseDataAuthMethods as Bs, RadarStandaloneResponse as Bt, CreateUserApiKeyRequestOptions as Bu, BadRequestException as C, GroupMemberRemovedEventResponse as Ca, ListGroupOrganizationMembershipsOptions as Cc, AuthenticateWithSessionCookieOptions as Cd, GetProfileAndTokenOptions as Cf, AuthenticationRadarRiskDetectedEventResponse as Ci, UpdateUserOptions as Cl, UpdateOrganizationRoleOptions as Cm, CreateM2MApplication as Cn, PipesConnectedAccountConnectionFailedEvent as Co, SerializedRemoveRoleOptions as Cp, Organization as Cr, UpdateCustomProviderDefinitionResponse as Cs, AuditLogSchema as Ct, SerializedListInvitationsOptions as Cu, isAuthenticationErrorData as D, InvitationAcceptedEventResponse as Da, DeleteGroupOptions as Dc, AuthenticationMethod as Dd, ConnectionResponse as Df, AuthenticationSSOSucceededEventResponse as Di, Session as Dl, AddEnvironmentRolePermissionOptions as Dm, RedirectUriInput as Dn, PipesConnectedAccountReauthorizationNeededEvent as Do, BaseAssignRoleOptions as Dp, ItContact as Dr, GetDataIntegrationOptions as Ds, AuditLogExport as Dt, InvitationEvent as Du, AuthenticationException as E, InvitationAcceptedEvent as Ea, GetGroupOptions as Ec, UserManagementAccessToken as Ed, ConnectionDomain as Ef, AuthenticationSSOSucceededEvent as Ei, AuthMethod as El, OrganizationRole as Em, CreateOAuthApplicationResponse as En, PipesConnectedAccountDisconnectedEventResponse as Eo, AssignRoleOptionsWithResourceId as Ep, ListOrganizationFeatureFlagsOptions as Er, GetUserConnectedAccountOptions as Es, AuditLogTargetSchema as Et, Invitation as Eu, UpdateWebhookEndpointEvents as F, MagicAuthCreatedEventResponse as Fa, RemoveFlagTargetOptions as Fc, ImpersonatorResponse as Fd, DirectoryUserWithGroupsResponse as Ff, DsyncActivatedEventResponse as Fi, SendInvitationOptions as Fl, EnvironmentRoleListResponse as Fm, UserObject as Fn, RoleDeletedEvent as Fo, RoleAssignmentResource as Fp, SerializedCreateItContactOptions as Fr, DataIntegrationsListResponseDataOwnership as Fs, Challenge as Ft, EmailVerificationEventResponse as Fu, ObjectMetadata as G, OrganizationDomainUpdatedEventResponse as Ga, EvaluationResource as Gc, AuthenticateWithOrganizationSelectionOptions as Gd, ListEffectivePermissionsByExternalIdOptions as Gf, DsyncGroupUserAddedEventResponse as Gi, RefreshSessionResponse as Gl, DirectoryResponse as Gm, ValidAgentCredential as Gn, UserCreatedEventResponse as Go, ListResourcesForMembershipOptionsWithParentId as Gp, PutOptions as Gr, DataIntegrationCustomProviderResponse as Gs, RadarListAction as Gt, SerializedCreateOrganizationMembershipOptions as Gu, ObjectVersionResponse as H, OrganizationDomainDeletedEvent as Ha, FeatureFlag as Hc, AuthenticateWithPasswordOptions as Hd, RoleEventResponse as Hf, DsyncGroupUpdatedEvent as Hi, ResendInvitationOptions as Hl, DirectoryGroup as Hm, SerializedAgentAccessTokenClaims as Hn, SessionRevokedEventResponse as Ho, ListMembershipsForResourceOptions as Hp, WorkOSResponseError as Hr, DataIntegrationResponse as Hs, RadarStandaloneResponseBlocklistType as Ht, CreatePasswordResetOptions as Hu, UpdateWebhookEndpointStatus as I, OrganizationCreatedEvent as Ia, ListFeatureFlagsOptions as Ic, AuthenticateWithRefreshTokenPublicClientOptions as Id, ListOrganizationRolesResponse as If, DsyncDeletedEvent as Ii, SerializedSendInvitationOptions as Il, EnvironmentRoleResponse as Im, UserObjectResponse as In, RoleDeletedEventResponse as Io, RoleAssignmentResourceResponse as Ip, SerializedInviteItContactOptions as Ir, DataIntegrationsListResponseDataConnectedAccount as Is, ChallengeResponse as It, EmailVerificationResponse as Iu, ActorResponse as J, OrganizationDomainVerifiedEvent as Ja, AddFlagTargetOptions as Jc, AuthenticateWithRadarSmsChallengeOptions as Jd, GroupRoleAssignmentEntry as Jf, DsyncUserCreatedEvent as Ji, PasswordReset as Jl, DirectoryType as Jm, ValidateAgentCredentialOptions as Jn, UserUpdatedEvent as Jo, AuthorizationCheckOptionsWithResourceExternalId as Jp, List as Jr, DataIntegrationCredentialsResponseCredential as Js, RadarStandaloneAssessRequestAuthMethod as Jt, PKCEAuthorizationURLResult as Ju, ObjectMetadataResponse as K, OrganizationDomainVerificationFailedEvent as Ka, LegacyEvaluationContext as Kc, SerializedAuthenticateWithOrganizationSelectionOptions as Kd, ListEffectivePermissionsOptions as Kf, DsyncGroupUserRemovedEvent as Ki, RetryableRefreshSessionFailureReason as Kl, DirectoryState as Km, ValidateAgentAccessTokenOptions as Kn, UserDeletedEvent as Ko, SerializedListResourcesForMembershipOptions as Kp, PostOptions as Kr, DataIntegrationCustomProviderAuthenticateVia as Ks, RadarListType as Kt, CreateMagicAuthOptions as Ku, CreateWebhookEndpointEvents as L, OrganizationCreatedResponse as La, FlagChange as Lc, SerializedAuthenticateWithRefreshTokenPublicClientOptions as Ld, OrganizationRoleEvent as Lf, DsyncDeletedEventResponse as Li, RevokeSessionOptions as Ll, ListDirectoryUsersOptions as Lm, AutoPaginatable as Ln, RoleUpdatedEvent as Lo, RoleAssignmentResponse as Lp, CreateOrganizationOptions as Lr, DataIntegrationsListResponseDataConnectedAccountResponse as Ls, ChallengeFactorOptions as Lt, CreateUserOptions as Lu, WebhookEndpoint as M, InvitationRevokedEvent as Ma, RuntimeClientStats as Mc, User as Md, DirectoryUser as Mf, ConnectionDeletedEvent as Mi, SendRadarSmsChallengeResponse as Ml, SerializedCreateEnvironmentRoleOptions as Mm, UserConsentOptionResponse as Mn, PipesConnectionFailedResponse as Mo, ListRoleAssignmentsOptions as Mp, ItContactIntent as Mr, DataIntegrationsListResponseWire as Ms, VerifyResponseResponse as Mt, SerializedEnrollUserInMfaFactorOptions as Mu, WebhookEndpointResponse as N, InvitationRevokedEventResponse as Na, RuntimeClientLogger as Nc, UserResponse as Nd, DirectoryUserResponse as Nf, ConnectionDeletedEventResponse as Ni, SendRadarSmsChallengeResponseResponse as Nl, EnvironmentRole as Nm, UserConsentOptionChoice as Nn, RoleCreatedEvent as No, SerializedListRoleAssignmentsOptions as Np, ListItContactsOptions as Nr, DataIntegrationsListResponseData as Ns, VerifyChallengeOptions as Nt, EmailVerification as Nu, GenericServerException as O, InvitationCreatedEvent as Oa, CreateGroupOptions as Oc, AuthenticationResponse as Od, ConnectionType as Of, ConnectionActivatedEvent as Oi, SessionResponse as Ol, SetEnvironmentRolePermissionsOptions as Om, RedirectUriInputResponse as On, PipesConnectedAccountReauthorizationNeededEventResponse as Oo, SerializedAssignRoleOptions as Op, ItContactResponse as Or, GetAccessTokenOptions as Os, AuditLogExportResponse as Ot, InvitationEventResponse as Ou, WebhookEndpointStatus as P, MagicAuthCreatedEvent as Pa, RuntimeClientOptions as Pc, Impersonator as Pd, DirectoryUserWithGroups as Pf, DsyncActivatedEvent as Pi, SerializedSendRadarSmsChallengeOptions as Pl, EnvironmentRoleList as Pm, UserConsentOptionChoiceResponse as Pn, RoleCreatedEventResponse as Po, RoleAssignment as Pp, RevokeItContactOptions as Pr, DataIntegrationsListResponseDataResponse as Ps, EnrollFactorOptions as Pt, EmailVerificationEvent as Pu, UpdateObjectOptions as Q, OrganizationMembershipDeleted as Qa, ListOrganizationApiKeysOptions as Qc, SerializedAuthenticateWithRadarEmailChallengeOptions as Qd, ReplaceGroupRoleAssignmentsOptions as Qf, DsyncUserUpdatedEvent as Qi, CreateMagicAuthResponse as Ql, HttpClientInterface as Qm, SerializedClaimAttemptResponse as Qn, VaultDataCreatedEvent as Qo, DeleteAuthorizationResourceOptions as Qp, ApiKeyCreatedEvent as Qr, DataIntegrationCredentialType as Qs, PasswordlessSession as Qt, AuthenticationFactor as Qu, WorkOS as R, OrganizationDeletedEvent as Ra, FlagCustomTarget as Rc, AuthenticateUserWithRefreshTokenCredentials as Rd, OrganizationRoleEventResponse as Rf, DsyncGroupCreatedEvent as Ri, SerializedRevokeSessionOptions as Rl, ListDirectoryGroupsOptions as Rm, AgentAccessTokenClaims as Rn, RoleUpdatedEventResponse as Ro, RoleAssignmentRole as Rp, CreateOrganizationRequestOptions as Rr, DataIntegrationsListResponseDataConnectedAccountState as Rs, RadarListEntryAlreadyPresentResponse as Rt, SerializedCreateUserOptions as Ru, ConflictException as S, GroupMemberRemovedEvent as Sa, ListGroupsOptions as Sc, AuthenticateWithSessionCookieFailureReason as Sd, SerializedListConnectionsOptions as Sf, AuthenticationRadarRiskDetectedEvent as Si, SerializedUpdateUserOptions as Sl, SerializedUpdateOrganizationRoleOptions as Sm, CreateApplicationOptions as Sn, PipesConnectedAccountConnectedEventResponse as So, RemoveRoleOptionsWithResourceId as Sp, UpdateOrganizationOptions as Sr, UpdateCustomProviderDefinition as Ss, AuditLogActorSchema as St, ListInvitationsOptions as Su, AuthenticationErrorData as T, GroupUpdatedEventResponse as Ta, GroupResponse as Tc, SessionCookieData as Td, Connection as Tf, AuthenticationSSOFailedEventResponse as Ti, UpdateOrganizationMembershipOptions as Tl, SerializedCreateOrganizationRoleOptions as Tm, CreateOAuthApplication as Tn, PipesConnectedAccountDisconnectedEvent as To, AssignRoleOptionsWithResourceExternalId as Tp, ListOrganizationsOptions as Tr, ListUserDataProvidersOptions as Ts, AuditLogSchemaResponse as Tt, ListAuthFactorsOptions as Tu, VaultObject as U, OrganizationDomainDeletedEventResponse as Ua, FeatureFlagResponse as Uc, SerializedAuthenticateWithPasswordOptions as Ud, RoleList as Uf, DsyncGroupUpdatedEventResponse as Ui, SerializedResendInvitationOptions as Ul, DirectoryGroupResponse as Um, SerializedAgentCredentialValidation as Un, UnknownEvent as Uo, ListResourcesForMembershipOptions as Up, WorkOSOptions as Ur, DataIntegrationState as Us, RadarStandaloneResponseControl as Ut, SerializedCreatePasswordResetOptions as Uu, ObjectVersion as V, OrganizationDomainCreatedEventResponse as Va, FlagTarget as Vc, AuthenticateUserWithPasswordCredentials as Vd, RoleEvent as Vf, DsyncGroupDeletedEventResponse as Vi, SerializedResetPasswordOptions as Vl, PaginationOptions as Vm, InvalidAgentCredential as Vn, SessionRevokedEvent as Vo, ListMembershipsForResourceByExternalIdOptions as Vp, DomainDataState as Vr, DataIntegration as Vs, RadarStandaloneResponseWire as Vt, SerializedCreateUserApiKeyOptions as Vu, VaultObjectResponse as W, OrganizationDomainUpdatedEvent as Wa, EvaluationContext as Wc, AuthenticateUserWithOrganizationSelectionCredentials as Wd, RoleResponse as Wf, DsyncGroupUserAddedEvent as Wi, RefreshSessionFailureReason as Wl, Directory as Wm, SerializedValidateAgentCredentialOptions as Wn, UserCreatedEvent as Wo, ListResourcesForMembershipOptionsWithParentExternalId as Wp, UnprocessableEntityError as Wr, DataIntegrationCustomProvider as Ws, RadarStandaloneResponseVerdict as Wt, CreateOrganizationMembershipOptions as Wu, CreateDataKeyResponseWire as X, OrganizationMembershipCreated as Xa, ValidateApiKeyOptions as Xc, AuthenticateUserWithRadarEmailChallengeCredentials as Xd, GroupRoleAssignmentEntryWithResourceExternalId as Xf, DsyncUserDeletedEvent as Xi, PasswordResetEventResponse as Xl, EventDirectoryResponse as Xm, ClaimAttemptResponse as Xn, VaultByokKeyVerificationCompletedEvent as Xo, AuthorizationCheckResult as Xp, GetOptions as Xr, DataIntegrationCredential as Xs, CreatePasswordlessSessionOptions as Xt, AuthenticationRadarRiskDetectedEventData as Xu, CreateDataKeyResponse as Y, OrganizationDomainVerifiedEventResponse as Ya, SerializedValidateApiKeyResponse as Yc, SerializedAuthenticateWithRadarSmsChallengeOptions as Yd, GroupRoleAssignmentEntryForOrganization as Yf, DsyncUserCreatedEventResponse as Yi, PasswordResetEvent as Yl, EventDirectory as Ym, ClaimAttemptOrganization as Yn, UserUpdatedEventResponse as Yo, AuthorizationCheckOptionsWithResourceId as Yp, ListResponse as Yr, DataIntegrationCredentialsResponseCredentialResponse as Ys, SendSessionResponse as Yt, UserManagementAuthorizationURLOptions as Yu, UpdateObjectEntity as Z, OrganizationMembershipCreatedResponse as Za, ValidateApiKeyResponse as Zc, AuthenticateWithRadarEmailChallengeOptions as Zd, GroupRoleAssignmentEntryWithResourceId as Zf, DsyncUserDeletedEventResponse as Zi, PasswordResetResponse as Zl, HttpClient as Zm, LinkClaimAttemptToExternalUserOptions as Zn, VaultByokKeyVerificationCompletedEventResponse as Zo, SerializedAuthorizationCheckOptions as Zp, GenerateLinkIntent as Zr, DataIntegrationCredentialResponse as Zs, SerializedCreatePasswordlessSessionOptions as Zt, AuthenticationRadarRiskDetectedEventResponseData as Zu, SignatureVerificationException as _, GroupDeletedEventResponse as _a, ConnectedAccountAuthMethod as _c, AuthenticationEventSsoResponse as _d, Profile as _f, AuthenticationPasskeySucceededEventResponse as _i, UserApiKeyWithValue as _l, Permission as _m, CreateApplicationClientSecretOptions as _n, PermissionDeletedEventResponse as _o, GroupRoleAssignmentResponse as _p, ActionPayload as _r, DataKeyPair as _s, AuditLogActor as _t, BaseOrganizationMembership as _u, PublicWorkOS as a, EventResponse as aa, CreateUserConnectedAccountOptions as ac, FactorType as ad, AuthenticateWithCodeAndVerifierOptions as af, AuthenticationMagicAuthFailedEventResponse as ai, SerializedApiKey as al, AuthorizationResourceResponse as am, ApplicationCredentialsListItemResponse as an, OrganizationRoleDeletedEventResponse as ao, RemoveGroupRoleAssignmentsOptionsWithResourceId as ap, AgentRegistrationStatus as ar, VaultDataUpdatedEventResponse as as, DecryptDataKeyResponse as at, Locale as au, NotFoundException as b, GroupMemberEventData as ba, UpdateGroupOptions as bc, SerializedAuthenticateWithTotpOptions as bd, OauthTokensResponse as bf, AuthenticationPasswordSucceededEvent as bi, SerializedUpdateUserPasswordOptions as bl, AddOrganizationRolePermissionOptions as bm, UpdateApplicationOptions as bn, PipesConnectedAccount as bo, RemoveRoleOptions as bp, UserRegistrationActionPayload as br, UpdateDataIntegrationOptions as bs, CreateAuditLogEventRequestOptions as bt, OrganizationMembershipResponse as bu, PortalLinkResponseWire as c, FlagDeletedEvent as ca, CustomProviderDefinitionResponse as cc, Totp as cd, AuthenticateWithCodeOptions as cf, AuthenticationMfaSucceededEvent as ci, OrganizationDomain as cl, CreateOptionsWithParentResourceId as cm, ConnectApplicationM2MResponse as cn, OrganizationUpdatedEvent as co, BaseCreateGroupRoleAssignmentOptions as cp, SerializedAgentRegistrationClaim as cr, VaultDekReadEvent as cs, WidgetSessionTokenResponseWire as ct, ListUserApiKeysOptions as cu, IntentOptions as d, FlagRuleUpdatedEventResponse as da, DataIntegrationCredentialsDtoResponse as dc, TotpWithSecretsResponse as dd, AuthenticateWithSessionOptions as df, AuthenticationOAuthFailedEventResponse as di, OrganizationDomainVerificationStrategy as dl, UpdateAuthorizationResourceOptions as dm, ConnectApplicationResponse as dn, PasswordResetCreatedEventResponse as do, CreateGroupRoleAssignmentOptionsWithResourceExternalId as dp, PKCEPair as dr, VaultKekCreatedEventResponse as ds, FeatureFlagsRuntimeClient as dt, ListSessionsOptions as du, EmailVerificationCreatedEvent as ea, DataIntegrationAuthorizeUrlResponseWire as ec, AuthenticationFactorType as ed, AuthenticateWithMagicAuthOptions as ef, RequestHeaders as eh, ApiKeyRevokedEvent as ei, SerializedCreatedApiKey as el, UpdateAuthorizationResourceByExternalIdOptions as em, ListEventOptions as en, OrganizationMembershipUpdated as eo, SerializedReplaceGroupRoleAssignmentsOptions as ep, AgentIdentity as er, VaultDataDeletedEvent as es, ReadObjectOptions as et, MagicAuth as eu, IntentOptionsResponse as f, FlagUpdatedEvent as fa, DataIntegrationCredentialsType as fc, Sms as fd, SerializedAuthenticatePublicClientBase as ff, AuthenticationOAuthSucceededEvent as fi, CreateOrganizationDomainOptions as fl, ListPermissionsOptions as fm, ConnectApplicationRedirectUri as fn, PasswordResetSucceededEvent as fo, CreateGroupRoleAssignmentOptionsWithResourceId as fp, Actions as fr, VaultMetadataReadEvent as fs, CookieSession as ft, SerializedListSessionsOptions as fu, UnauthorizedException as g, GroupDeletedEvent as ga, ConnectedAccountState as gc, AuthenticationEventSso as gd, ProfileAndTokenResponse as gf, AuthenticationPasskeySucceededEvent as gi, SerializedUserApiKeyWithValue as gl, SerializedCreatePermissionOptions as gm, DeleteClientSecretOptions as gn, PermissionDeletedEvent as go, GroupRoleAssignment as gp, ActionContext as gr, DataKey as gs, SerializedCreateAuditLogSchemaOptions as gt, AuthorizationOrganizationMembershipResponse as gu, UnprocessableEntityException as h, GroupCreatedEventResponse as ha, ConnectedAccountResponse as hc, AuthenticationEventResponse as hd, ProfileAndToken as hf, AuthenticationPasskeyFailedEventResponse as hi, VerifyEmailOptions as hl, CreatePermissionOptions as hm, ExternalAuthCompleteResponseWire as hn, PermissionCreatedEventResponse as ho, ListGroupRoleAssignmentsOptions as hp, UserRegistrationActionResponseData as hr, VaultNamesListedEventResponse as hs, CreateAuditLogSchemaResponse as ht, AuthorizationOrganizationMembership as hu, PublicUserManagement as i, EventName as ia, DataIntegrationAccessTokenResponseAccessTokenResponse as ic, FactorResponse as id, SerializedAuthenticateWithEmailVerificationOptions as if, CryptoProvider as ih, AuthenticationMagicAuthFailedEvent as ii, ApiKey as il, AuthorizationResource as im, ApplicationCredentialsListItem as in, OrganizationRoleDeletedEvent as io, RemoveGroupRoleAssignmentsOptionsWithResourceExternalId as ip, AgentRegistrationKind as ir, VaultDataUpdatedEvent as is, DecryptDataKeyOptions as it, LogoutURLOptions as iu, Webhooks as j, InvitationResentEventResponse as ja, SerializedAddGroupOrganizationMembershipOptions as jc, CreateUserResponseResponse as jd, DefaultCustomAttributes as jf, ConnectionDeactivatedEventResponse as ji, SendRadarSmsChallengeOptions as jl, CreateEnvironmentRoleOptions as jm, UserConsentOption as jn, PipesConnectionFailed as jo, SerializedListRoleAssignmentsForResourceOptions as jp, InviteItContactOptions as jr, DataIntegrationsListResponse as js, VerifyResponse as jt, EnrollAuthFactorOptions as ju, WorkOSErrorData as k, InvitationCreatedEventResponse as ka, SerializedCreateGroupOptions as kc, AuthenticationResponseResponse as kd, SSOAuthorizationURLOptions as kf, ConnectionActivatedEventResponse as ki, SessionStatus as kl, SerializedUpdateEnvironmentRoleOptions as km, ListApplicationsOptions as kn, PipesConnectedAccountResponse as ko, ListRoleAssignmentsForResourceByExternalIdOptions as kp, CreateItContactOptions as kr, DeleteUserConnectedAccountOptions as ks, AuditLogExportOptions as kt, InvitationResponse as ku, GenerateLink as l, FlagDeletedEventResponse as la, CustomProviderDefinitionAuthenticateVia as lc, TotpResponse as ld, SerializedAuthenticateWithCodeOptions as lf, AuthenticationMfaSucceededEventResponse as li, OrganizationDomainResponse as ll, SerializedCreateAuthorizationResourceOptions as lm, ConnectApplicationOAuth as ln, OrganizationUpdatedResponse as lo, CreateGroupRoleAssignmentOptions as lp, SerializedAgentRegistrationClaimCompletion as lr, VaultDekReadEventResponse as ls, CreateTokenOptions as lt, SerializedListUserApiKeysOptions as lu, SSOIntentOptionsResponse as m, GroupCreatedEvent as ma, ConnectedAccount as mc, AuthenticationEvent as md, WithResolvedClientId as mf, AuthenticationPasskeyFailedEvent as mi, SerializedVerifyEmailOptions as ml, UpdatePermissionOptions as mm, ExternalAuthCompleteResponse as mn, PermissionCreatedEvent as mo, GetGroupRoleAssignmentOptions as mp, ResponsePayload as mr, VaultNamesListedEvent as ms, CreateAuditLogSchemaRequestOptions as mt, SerializedListOrganizationMembershipsOptions as mu, PublicClientOptions as n, Event as na, DataIntegrationAccessTokenResponseWire as nc, AuthenticationFactorWithSecretsResponse as nd, AuthenticateUserWithEmailVerificationCredentials as nf, ResponseHeaderValue as nh, AuthenticationEmailVerificationSucceededEvent as ni, CreateOrganizationApiKeyRequestOptions as nl, ListAuthorizationResourcesOptions as nm, NewConnectApplicationSecret as nn, OrganizationRoleCreatedEvent as no, RemoveGroupRoleAssignmentsOptions as np, AgentRegistrationClaim as nr, VaultDataReadEvent as ns, CreateObjectEntity as nt, MagicAuthEventResponse as nu, createWorkOS as o, FlagCreatedEvent as oa, CreateDataIntegrationOptions as oc, FactorWithSecrets as od, SerializedAuthenticateWithCodeAndVerifierOptions as of, AuthenticationMagicAuthSucceededEvent as oi, OrganizationDomainVerificationFailed as ol, CreateAuthorizationResourceOptions as om, ConnectApplication as on, OrganizationRoleUpdatedEvent as oo, SerializedRemoveGroupRoleAssignmentsOptions as op, SerializedAgentIdentity as or, VaultDekDecryptedEvent as os, CreateDataKeyOptions as ot, ListUsersOptions as ou, SSOIntentOptions as p, FlagUpdatedEventResponse as pa, CreateDataIntegrationCredentialOptions as pc, SmsResponse as pd, SerializedAuthenticateWithOptionsBase as pf, AuthenticationOAuthSucceededEventResponse as pi, SerializedCreateOrganizationDomainOptions as pl, SerializedUpdatePermissionOptions as pm, ConnectApplicationRedirectUriResponse as pn, PasswordResetSucceededEventResponse as po, SerializedCreateGroupRoleAssignmentOptions as pp, AuthenticationActionResponseData as pr, VaultMetadataReadEventResponse as ps, CreateAuditLogSchemaOptions as pt, ListOrganizationMembershipsOptions as pu, Actor as q, OrganizationDomainVerificationFailedEventResponse as qa, TypedEvaluationContext as qc, AuthenticateUserWithRadarSmsChallengeCredentials as qd, BaseGroupRoleAssignmentEntry as qf, DsyncGroupUserRemovedEventResponse as qi, TerminalRefreshSessionFailureReason as ql, DirectoryStateResponse as qm, ValidateAgentApiKeyOptions as qn, UserDeletedEventResponse as qo, AuthorizationCheckOptions as qp, PatchOptions as qr, DataIntegrationCredentialsResponseError as qs, RadarStandaloneAssessRequestAction as qt, SerializedCreateMagicAuthOptions as qu, PublicSSO as r, EventBase as ra, DataIntegrationAccessTokenResponseAccessToken as rc, Factor as rd, AuthenticateWithEmailVerificationOptions as rf, ResponseHeaders as rh, AuthenticationEmailVerificationSucceededEventResponse as ri, SerializedCreateOrganizationApiKeyOptions as rl, SerializedListAuthorizationResourcesOptions as rm, NewConnectApplicationSecretResponse as rn, OrganizationRoleCreatedEventResponse as ro, RemoveGroupRoleAssignmentsOptionsForOrganization as rp, AgentRegistrationClaimCompletion as rr, VaultDataReadEventResponse as rs, CreateObjectOptions as rt, MagicAuthResponse as ru, PortalLinkResponse as s, FlagCreatedEventResponse as sa, CustomProviderDefinition as sc, FactorWithSecretsResponse as sd, AuthenticateUserWithCodeCredentials as sf, AuthenticationMagicAuthSucceededEventResponse as si, OrganizationDomainVerificationFailedResponse as sl, CreateOptionsWithParentExternalId as sm, ConnectApplicationM2M as sn, OrganizationRoleUpdatedEventResponse as so, RemoveGroupRoleAssignmentOptions as sp, SerializedAgentRegistration as sr, VaultDekDecryptedEventResponse as ss, WidgetSessionTokenResponse as st, SerializedListUsersOptions as su, ConfidentialClientOptions as t, EmailVerificationCreatedEventResponse as ta, DataIntegrationAccessTokenResponse as tc, AuthenticationFactorWithSecrets as td, SerializedAuthenticateWithMagicAuthOptions as tf, RequestOptions as th, ApiKeyRevokedEventResponse as ti, CreateOrganizationApiKeyOptions as tl, GetAuthorizationResourceByExternalIdOptions as tm, SerializedListEventOptions as tn, OrganizationMembershipUpdatedResponse as to, BaseRemoveGroupRoleAssignmentsOptions as tp, AgentRegistration as tr, VaultDataDeletedEventResponse as ts, ReadObjectResponse as tt, MagicAuthEvent as tu, GenerateLinkResponse as u, FlagRuleUpdatedEvent as ua, DataIntegrationCredentialsDto as uc, TotpWithSecrets as ud, AuthenticateWithOptionsBase as uf, AuthenticationOAuthFailedEvent as ui, OrganizationDomainState as ul, SerializedUpdateAuthorizationResourceOptions as um, ConnectApplicationOAuthResponse as un, PasswordResetCreatedEvent as uo, CreateGroupRoleAssignmentOptionsForOrganization as up, PKCE as ur, VaultKekCreatedEvent as us, WidgetSessionTokenScopes as ut, ListUserFeatureFlagsOptions as uu, RateLimitExceededException as v, GroupMemberAddedEvent as va, AuthorizeDataIntegrationOptions as vc, AuthenticateUserWithTotpCredentials as vd, ProfileResponse as vf, AuthenticationPasswordFailedEvent as vi, SerializedUserApiKey as vl, PermissionResponse as vm, ListApplicationClientSecretsOptions as vn, PermissionUpdatedEvent as vo, RemoveRoleAssignmentOptions as vp, UserData as vr, KeyContext as vs, AuditLogTarget as vt, BaseOrganizationMembershipResponse as vu, AuthenticationErrorCode as w, GroupUpdatedEvent as wa, Group as wc, AuthenticateWithSessionCookieSuccessResponse as wd, GetProfileOptions as wf, AuthenticationSSOFailedEvent as wi, SerializedUpdateOrganizationMembershipOptions as wl, CreateOrganizationRoleOptions as wm, CreateM2MApplicationResponse as wn, PipesConnectedAccountConnectionFailedEventResponse as wo, AssignRoleOptions as wp, OrganizationResponse as wr, UpdateCustomProviderDefinitionAuthenticateVia as ws, AuditLogSchemaMetadata as wt, ListGroupsForOrganizationMembershipOptions as wu, NoApiKeyProvidedException as x, GroupMemberEventResponseData as xa, RemoveGroupOrganizationMembershipOptions as xc, AuthenticateWithSessionCookieFailedResponse as xd, ListConnectionsOptions as xf, AuthenticationPasswordSucceededEventResponse as xi, UpdateUserPasswordOptions as xl, SetOrganizationRolePermissionsOptions as xm, GetApplicationOptions as xn, PipesConnectedAccountConnectedEvent as xo, RemoveRoleOptionsWithResourceExternalId as xp, SerializedUpdateOrganizationOptions as xr, UpdateDataIntegrationApiKeyOptions as xs, SerializedCreateAuditLogEventOptions as xt, OrganizationMembershipStatus as xu, OauthException as y, GroupMemberAddedEventResponse as ya, SerializedUpdateGroupOptions as yc, AuthenticateWithTotpOptions as yd, OauthTokens as yf, AuthenticationPasswordFailedEventResponse as yi, UserApiKey as yl, RemoveOrganizationRolePermissionOptions as ym, DeleteApplicationOptions as yn, PermissionUpdatedEventResponse as yo, BaseRemoveRoleOptions as yp, UserDataPayload as yr, UpdateUserConnectedAccountOptions as ys, CreateAuditLogEventOptions as yt, OrganizationMembership as yu, ObjectSummary as z, OrganizationDeletedResponse as za, FlagPollEntry as zc, AuthenticateWithRefreshTokenOptions as zd, OrganizationRoleResponse as zf, DsyncGroupCreatedEventResponse as zi, serializeRevokeSessionOptions as zl, ListDirectoriesOptions as zm, AgentCredentialType as zn, SessionCreatedEvent as zo, RoleAssignmentSource as zp, SerializedCreateOrganizationOptions as zr, DataIntegrationsListResponseDataConnectedAccountAuthMethod as zs, RadarListEntryAlreadyPresentResponseWire as zt, CreateUserApiKeyOptions as zu };
+//# sourceMappingURL=factory-CCkRzS83.d.mts.map