@workos-inc/node 10.7.0 → 10.9.0

package/lib/{factory-7zoKcOC2.d.cts → factory-DmBBe791.d.cts}

@@ -76,6 +76,11 @@ type RequestHeaders = Record<string, string | number | string[]>;
 type RequestOptions = {
   params?: Record<string, any>;
   headers?: RequestHeaders;
+  /**
+   * Maximum number of retries for this request, overriding the client-wide
+   * `maxRetries`. Set to `0` to disable retries for this request.
+   */
+  maxRetries?: number;
 };
 type ResponseHeaderValue = string | string[];
 type ResponseHeaders = Record<string, ResponseHeaderValue>;
@@ -93,14 +98,24 @@ interface HttpClientResponseInterface {
 }
 //#endregion
 //#region src/common/net/http-client.d.ts
+interface HttpClientOptions extends RequestInit {
+  /** Per-request timeout in milliseconds. */
+  timeout?: number;
+  /**
+   * Maximum number of retries for transient failures. Set to `0` to disable
+   * automatic retries entirely. Defaults to {@link DEFAULT_MAX_RETRY_ATTEMPTS}.
+   */
+  maxRetries?: number;
+}
 declare abstract class HttpClient implements HttpClientInterface {
   readonly baseURL: string;
-  readonly options?: RequestInit | undefined;
-  readonly MAX_RETRY_ATTEMPTS = 3;
+  readonly options?: HttpClientOptions | undefined;
+  readonly MAX_RETRY_ATTEMPTS: number;
   readonly BACKOFF_MULTIPLIER = 1.5;
   readonly MINIMUM_SLEEP_TIME_IN_MILLISECONDS = 500;
+  readonly MAXIMUM_SLEEP_TIME_IN_MILLISECONDS = 8000;
   readonly RETRY_STATUS_CODES: number[];
-  constructor(baseURL: string, options?: RequestInit | undefined);
+  constructor(baseURL: string, options?: HttpClientOptions | undefined);
   abstract get(path: string, options: RequestOptions): Promise<HttpClientResponseInterface>;
   abstract post<Entity = any>(path: string, entity: Entity, options: RequestOptions): Promise<HttpClientResponseInterface>;
   abstract put<Entity = any>(path: string, entity: Entity, options: RequestOptions): Promise<HttpClientResponseInterface>;
@@ -111,9 +126,23 @@ declare abstract class HttpClient implements HttpClientInterface {
   static getQueryString(queryObj?: Record<string, any>): string | undefined;
   static getContentTypeHeader(entity: any): RequestHeaders | undefined;
   static getBody(entity: any): BodyInit | null | undefined;
-  static isPathRetryable(path: string): boolean;
+  /**
+   * Generate a random idempotency key used to make retried write requests
+   * safe. Mirrors the behavior of the other WorkOS SDKs (Kotlin, Go), which
+   * attach an `Idempotency-Key` header to POST requests that did not already
+   * specify one, so a retried request is not applied more than once.
+   */
+  static generateIdempotencyKey(): string;
+  /**
+   * Parse a `Retry-After` header value into milliseconds. Supports both the
+   * delay-seconds form (e.g. `120`) and the HTTP-date form. The result is
+   * capped at {@link MAXIMUM_RETRY_AFTER_TIME_IN_MILLISECONDS}. Returns
+   * `null` when the value is absent or unparseable so the caller falls back
+   * to the computed exponential backoff.
+   */
+  static parseRetryAfter(headerValue: string | null | undefined): number | null;
   private getSleepTimeInMilliseconds;
-  sleep: (retryAttempt: number) => Promise<unknown>;
+  sleep: (retryAttempt: number, retryAfterMs?: number | null) => Promise<unknown>;
 }
 //#endregion
 //#region src/common/crypto/decode-payload.d.ts
@@ -1588,6 +1617,14 @@ interface AuthenticationEventResponse {
   user_id: string | null;
 }
 //#endregion
+//#region src/multi-factor-auth/interfaces/sms.interface.d.ts
+interface Sms {
+  phoneNumber: string;
+}
+interface SmsResponse {
+  phone_number: string;
+}
+//#endregion
 //#region src/multi-factor-auth/interfaces/totp.interface.d.ts
 interface Totp {
   issuer: string;
@@ -1608,14 +1645,55 @@ interface TotpWithSecretsResponse extends TotpResponse {
   uri: string;
 }
 //#endregion
+//#region src/multi-factor-auth/interfaces/factor.interface.d.ts
+type FactorType = 'sms' | 'totp' | 'generic_otp';
+interface Factor {
+  object: 'authentication_factor';
+  id: string;
+  createdAt: string;
+  updatedAt: string;
+  type: FactorType;
+  sms?: Sms;
+  totp?: Totp;
+}
+interface FactorWithSecrets {
+  object: 'authentication_factor';
+  id: string;
+  createdAt: string;
+  updatedAt: string;
+  type: FactorType;
+  sms?: Sms;
+  totp?: TotpWithSecrets;
+}
+interface FactorResponse {
+  object: 'authentication_factor';
+  id: string;
+  created_at: string;
+  updated_at: string;
+  type: FactorType;
+  sms?: SmsResponse;
+  totp?: TotpResponse;
+}
+interface FactorWithSecretsResponse {
+  object: 'authentication_factor';
+  id: string;
+  created_at: string;
+  updated_at: string;
+  type: FactorType;
+  sms?: SmsResponse;
+  totp?: TotpWithSecretsResponse;
+}
+//#endregion
 //#region src/user-management/interfaces/authentication-factor.interface.d.ts
+type AuthenticationFactorType = FactorType;
 interface AuthenticationFactor {
   object: 'authentication_factor';
   id: string;
   createdAt: string;
   updatedAt: string;
-  type: 'totp';
-  totp: Totp;
+  type: AuthenticationFactorType;
+  sms?: Sms;
+  totp?: Totp;
   userId: string;
 }
 interface AuthenticationFactorWithSecrets {
@@ -1632,8 +1710,9 @@ interface AuthenticationFactorResponse {
   id: string;
   created_at: string;
   updated_at: string;
-  type: 'totp';
-  totp: TotpResponse;
+  type: AuthenticationFactorType;
+  sms?: SmsResponse;
+  totp?: TotpResponse;
   user_id: string;
 }
 interface AuthenticationFactorWithSecretsResponse {
@@ -1757,6 +1836,21 @@ interface SerializedCreatePasswordResetOptions {
   email: string;
 }
 //#endregion
+//#region src/user-management/interfaces/create-user-api-key-options.interface.d.ts
+interface CreateUserApiKeyOptions {
+  name: string;
+  organizationId: string;
+  permissions?: string[];
+  expiresAt?: Date;
+}
+interface SerializedCreateUserApiKeyOptions {
+  name: string;
+  organization_id: string;
+  permissions?: string[];
+  expires_at?: string;
+}
+interface CreateUserApiKeyRequestOptions extends Pick<PostOptions, 'idempotencyKey'> {}
+//#endregion
 //#region src/user-management/interfaces/password-hash-type.interface.d.ts
 type PasswordHashType = 'bcrypt' | 'firebase-scrypt' | 'ssha' | 'scrypt' | 'argon2';
 //#endregion
@@ -2029,6 +2123,14 @@ interface ListUserFeatureFlagsOptions extends PaginationOptions {
   userId: string;
 }
 //#endregion
+//#region src/user-management/interfaces/list-user-api-keys-options.interface.d.ts
+interface ListUserApiKeysOptions extends PaginationOptions {
+  organizationId?: string;
+}
+interface SerializedListUserApiKeysOptions extends PaginationOptions {
+  organization_id?: string;
+}
+//#endregion
 //#region src/user-management/interfaces/list-users-options.interface.d.ts
 interface ListUsersOptions extends PaginationOptions {
   /** Filter users by their email address. */
@@ -2156,12 +2258,43 @@ declare enum RefreshSessionFailureReason {
   NO_SESSION_COOKIE_PROVIDED = "no_session_cookie_provided",
   INVALID_GRANT = "invalid_grant",
   MFA_ENROLLMENT = "mfa_enrollment",
-  SSO_REQUIRED = "sso_required"
-}
-type RefreshSessionFailedResponse = {
+  SSO_REQUIRED = "sso_required",
+  RATE_LIMIT_EXCEEDED = "rate_limit_exceeded",
+  TIMEOUT = "timeout",
+  SERVER_ERROR = "server_error",
+  NETWORK_ERROR = "network_error"
+}
+type TerminalRefreshSessionFailureReason = RefreshSessionFailureReason.INVALID_SESSION_COOKIE | RefreshSessionFailureReason.NO_SESSION_COOKIE_PROVIDED | RefreshSessionFailureReason.INVALID_GRANT | RefreshSessionFailureReason.MFA_ENROLLMENT | RefreshSessionFailureReason.SSO_REQUIRED;
+type RetryableRefreshSessionFailureReason = RefreshSessionFailureReason.RATE_LIMIT_EXCEEDED | RefreshSessionFailureReason.TIMEOUT | RefreshSessionFailureReason.SERVER_ERROR | RefreshSessionFailureReason.NETWORK_ERROR;
+/**
+ * A terminal refresh failure: the session is over (e.g. `invalid_grant`) and
+ * the user should be redirected to sign in.
+ */
+type RefreshSessionTerminalFailedResponse = {
+  authenticated: false;
+  reason: TerminalRefreshSessionFailureReason;
+  retryable: false;
+};
+/**
+ * A transient refresh failure: the refresh token is likely still valid (e.g. a
+ * timeout, `5xx`, or `429`), so keep the existing session and retry later.
+ */
+type RefreshSessionRetryableFailedResponse = {
   authenticated: false;
-  reason: RefreshSessionFailureReason;
+  reason: RetryableRefreshSessionFailureReason;
+  retryable: true;
+  /**
+   * Seconds the server asked the client to wait before retrying, parsed from
+   * the `Retry-After` response header. Only present for some retryable
+   * failures (e.g. a `429`).
+   */
+  retryAfter?: number;
+  /**
+   * The underlying error, exposed for logging.
+   */
+  error?: unknown;
 };
+type RefreshSessionFailedResponse = RefreshSessionTerminalFailedResponse | RefreshSessionRetryableFailedResponse;
 type RefreshSessionSuccessResponse = Omit<AuthenticateWithSessionCookieSuccessResponse, 'accessToken'> & {
   authenticated: true;
   session?: AuthenticationResponse;
@@ -2325,6 +2458,48 @@ interface SerializedUpdateUserPasswordOptions {
   password: string;
 }
 //#endregion
+//#region src/user-management/interfaces/user-api-key.interface.d.ts
+interface UserApiKey {
+  object: 'api_key';
+  id: string;
+  owner: {
+    type: 'user';
+    id: string;
+    organizationId: string;
+  };
+  name: string;
+  obfuscatedValue: string;
+  lastUsedAt: string | null;
+  expiresAt: string | null;
+  permissions: string[];
+  createdAt: string;
+  updatedAt: string;
+}
+interface SerializedUserApiKey {
+  object: 'api_key';
+  id: string;
+  owner: {
+    type: 'user';
+    id: string;
+    organization_id: string;
+  };
+  name: string;
+  obfuscated_value: string;
+  last_used_at: string | null;
+  expires_at: string | null;
+  permissions: string[];
+  created_at: string;
+  updated_at: string;
+}
+//#endregion
+//#region src/user-management/interfaces/user-api-key-with-value.interface.d.ts
+interface UserApiKeyWithValue extends UserApiKey {
+  value: string;
+}
+interface SerializedUserApiKeyWithValue extends SerializedUserApiKey {
+  value: string;
+}
+//#endregion
 //#region src/user-management/interfaces/verify-email-options.interface.d.ts
 interface VerifyEmailOptions {
   code: string;
@@ -2410,6 +2585,10 @@ interface ApiKey {
   owner: {
     type: 'organization';
     id: string;
+  } | {
+    type: 'user';
+    id: string;
+    organizationId: string;
   };
   /** A descriptive name for the API Key. */
   name: string;
@@ -2430,6 +2609,10 @@ interface SerializedApiKey {
   owner: {
     type: 'organization';
     id: string;
+  } | {
+    type: 'user';
+    id: string;
+    organization_id: string;
   };
   name: string;
   obfuscated_value: string;
@@ -2494,9 +2677,15 @@ interface ValidateApiKeyOptions {
 }
 interface ValidateApiKeyResponse {
   apiKey: ApiKey | null;
+  /**
+   * The ID of the agent registration this API key was issued for. Present only
+   * when the API key is assigned to an agent registration.
+   */
+  agentRegistrationId?: string;
 }
 interface SerializedValidateApiKeyResponse {
   api_key: SerializedApiKey | null;
+  agent_registration_id?: string;
 }
 //#endregion
 //#region src/feature-flags/interfaces/add-flag-target-options.interface.d.ts
@@ -3491,6 +3680,8 @@ interface GetOptions {
   warrantToken?: string;
   /** Skip API key requirement check (for PKCE-safe methods) */
   skipApiKeyCheck?: boolean;
+  /** Maximum number of retries for this request, overriding the client-wide `maxRetries`. */
+  maxRetries?: number;
 }
 //#endregion
 //#region src/common/interfaces/list.interface.d.ts
@@ -3519,6 +3710,8 @@ interface PatchOptions {
   idempotencyKey?: string;
   /** Skip API key requirement check (for PKCE-safe methods) */
   skipApiKeyCheck?: boolean;
+  /** Maximum number of retries for this request, overriding the client-wide `maxRetries`. */
+  maxRetries?: number;
 }
 //#endregion
 //#region src/common/interfaces/post-options.interface.d.ts
@@ -3530,6 +3723,8 @@ interface PostOptions {
   warrantToken?: string;
   /** Skip API key requirement check (for PKCE-safe methods) */
   skipApiKeyCheck?: boolean;
+  /** Maximum number of retries for this request, overriding the client-wide `maxRetries`. */
+  maxRetries?: number;
 }
 //#endregion
 //#region src/common/interfaces/put-options.interface.d.ts
@@ -3540,6 +3735,8 @@ interface PutOptions {
   idempotencyKey?: string;
   /** Skip API key requirement check (for PKCE-safe methods) */
   skipApiKeyCheck?: boolean;
+  /** Maximum number of retries for this request, overriding the client-wide `maxRetries`. */
+  maxRetries?: number;
 }
 //#endregion
 //#region src/common/interfaces/unprocessable-entity-error.interface.d.ts
@@ -3565,6 +3762,13 @@ interface WorkOSOptions {
   fetchFn?: typeof fetch;
   clientId?: string;
   timeout?: number;
+  /**
+   * Maximum number of automatic retries for transient failures (network
+   * errors and 408/429/5xx responses). Retries use exponential backoff with
+   * jitter and honor the `Retry-After` header (capped at 60 seconds).
+   * Defaults to 3. Set to `0` to disable automatic retries.
+   */
+  maxRetries?: number;
 }
 //#endregion
 //#region src/common/interfaces/workos-response-error.interface.d.ts
@@ -3756,12 +3960,7 @@ declare class Actions {
   private signatureProvider;
   constructor(cryptoProvider: CryptoProvider);
   private get computeSignature();
-  get verifyHeader(): ({
-    payload,
-    sigHeader,
-    secret,
-    tolerance
-  }: {
+  get verifyHeader(): ({ payload, sigHeader, secret, tolerance }: {
     payload: WebhookPayload;
     sigHeader: string;
     secret: string;
@@ -3773,12 +3972,7 @@ declare class Actions {
     payload: ResponsePayload;
     signature: string;
   }>;
-  constructAction({
-    payload,
-    sigHeader,
-    secret,
-    tolerance
-  }: {
+  constructAction({ payload, sigHeader, secret, tolerance }: {
     payload: WebhookPayload;
     sigHeader: string;
     secret: string;
@@ -3822,6 +4016,328 @@ declare class PKCE {
   private base64UrlEncode;
 }
 //#endregion
+//#region src/agents/interfaces/agent-registration.interface.d.ts
+/** The lifecycle status of an agent registration. */
+type AgentRegistrationStatus = 'unverified' | 'verified' | 'expired' | 'revoked';
+/** The kind of agent registration, derived from its authentication method. */
+type AgentRegistrationKind = 'anonymous' | 'service_auth' | 'identity_assertion';
+/** The agent identity an agent registration belongs to. */
+interface AgentIdentity {
+  /** Unique identifier of the agent identity. */
+  id: string;
+  /** The Userland user the agent identity is associated with, if any. */
+  userlandUserId: string | null;
+  /** An ISO 8601 timestamp. */
+  createdAt: string;
+  /** An ISO 8601 timestamp. */
+  updatedAt: string;
+}
+interface SerializedAgentIdentity {
+  id: string;
+  userland_user_id: string | null;
+  created_at: string;
+  updated_at: string;
+}
+/** The completion of an agent registration claim. */
+interface AgentRegistrationClaimCompletion {
+  /** Unique identifier of the claim completion. */
+  id: string;
+  /** An ISO 8601 timestamp. */
+  createdAt: string;
+  /** An ISO 8601 timestamp. */
+  updatedAt: string;
+  /** An ISO 8601 timestamp. */
+  expiresAt: string;
+  /** An ISO 8601 timestamp of when the registration was claimed. */
+  claimedAt: string;
+}
+interface SerializedAgentRegistrationClaimCompletion {
+  id: string;
+  created_at: string;
+  updated_at: string;
+  expires_at: string;
+  claimed_at: string;
+}
+/** The claim state of an agent registration. */
+interface AgentRegistrationClaim {
+  /** Unique identifier of the claim. */
+  id: string;
+  /** The completion of the claim, or `null` if it has not been claimed. */
+  claimCompletion: AgentRegistrationClaimCompletion | null;
+  /** An ISO 8601 timestamp. */
+  createdAt: string;
+  /** An ISO 8601 timestamp. */
+  updatedAt: string;
+  /** An ISO 8601 timestamp. */
+  expiresAt: string;
+}
+interface SerializedAgentRegistrationClaim {
+  id: string;
+  claim_completion: SerializedAgentRegistrationClaimCompletion | null;
+  created_at: string;
+  updated_at: string;
+  expires_at: string;
+}
+/** A single agent registration. */
+interface AgentRegistration {
+  /** Unique identifier of the agent registration. */
+  id: string;
+  /** The agent identity the registration belongs to. */
+  agentIdentity: AgentIdentity;
+  /** Unique identifier of the Organization the registration belongs to. */
+  organizationId: string;
+  /** The lifecycle status of the registration. */
+  status: AgentRegistrationStatus;
+  /** The kind of registration. */
+  kind: AgentRegistrationKind;
+  /** The claim state of the registration, or `null` if it has none. */
+  claim: AgentRegistrationClaim | null;
+  /** An ISO 8601 timestamp. */
+  createdAt: string;
+  /** An ISO 8601 timestamp. */
+  updatedAt: string;
+}
+interface SerializedAgentRegistration {
+  id: string;
+  agent_identity: SerializedAgentIdentity;
+  organization_id: string;
+  status: AgentRegistrationStatus;
+  kind: AgentRegistrationKind;
+  claim: SerializedAgentRegistrationClaim | null;
+  created_at: string;
+  updated_at: string;
+}
+//#endregion
+//#region src/agents/interfaces/claim-attempt.interface.d.ts
+/** Options for linking an external user to a claim attempt via the admin API. */
+interface LinkClaimAttemptToExternalUserOptions {
+  /** The claim attempt token identifying the pending claim. */
+  claimAttemptToken: string;
+  /** The user to attach to the claim attempt. */
+  user: {
+    /** The email address of the user. */
+    email: string;
+    /** The external ID of the user. */
+    externalId: string;
+  };
+  /** The organization to place the agent in. Required when the user belongs to multiple organizations. */
+  organizationId?: string;
+}
+interface SerializedLinkClaimAttemptToExternalUserOptions {
+  type: 'link_external_user';
+  claim_attempt_token: string;
+  user: {
+    email: string;
+    external_id: string;
+  };
+  organization_id?: string;
+}
+/** An organization the confirming user belongs to, offered as a placement choice. */
+interface ClaimAttemptOrganization {
+  /** The organization ID. */
+  id: string;
+  /** The organization name. */
+  name: string;
+}
+/** The result of linking an external user to a claim attempt. */
+interface ClaimAttemptResponse {
+  /** The agent registration ID. */
+  id: string;
+  /** Current status of the agent registration. */
+  status: AgentRegistrationStatus;
+  /** The user code the agent needs to complete the claim. */
+  userCode: string;
+  /** Organizations the user belongs to, offered as placement choices. */
+  organizations: ClaimAttemptOrganization[];
+}
+interface SerializedClaimAttemptResponse {
+  id: string;
+  status: AgentRegistrationStatus;
+  user_code: string;
+  organizations: ClaimAttemptOrganization[];
+}
+//#endregion
+//#region src/agents/interfaces/validate-agent-credential.interface.d.ts
+/** The type of agent credential to validate. */
+type AgentCredentialType = 'api_key' | 'access_token';
+interface ValidateAgentApiKeyOptions {
+  type: 'api_key';
+  /** The opaque API key value to validate. */
+  credential: string;
+}
+interface ValidateAgentAccessTokenOptions {
+  type: 'access_token';
+  /** The access token (JWT) to validate. */
+  credential: string;
+  /**
+   * When `true`, additionally calls the WorkOS API to check whether the token
+   * has been revoked. When `false` or omitted, the token is only decoded and
+   * verified locally against the environment's JWKS — a revoked but
+   * not-yet-expired token will still report as valid.
+   */
+  checkForRevoked?: boolean;
+  /**
+   * The expected token audience (`aud`). Defaults to the client ID the WorkOS
+   * client was initialized with. Pass the resource indicator for
+   * resource-scoped tokens, whose audience is the resource rather than the
+   * client ID. When `checkForRevoked` is set, this is also forwarded to the
+   * WorkOS API so the server verifies the `aud` claim against the same value.
+   */
+  audience?: string;
+}
+/**
+ * Options for validating an agent credential. `checkForRevoked` and `audience`
+ * are only available for `access_token` credentials.
+ */
+type ValidateAgentCredentialOptions = ValidateAgentApiKeyOptions | ValidateAgentAccessTokenOptions;
+interface SerializedValidateAgentCredentialOptions {
+  type: AgentCredentialType;
+  credential: string;
+  audience?: string;
+}
+/**
+ * The decoded claims of an agent access token. The required fields are
+ * guaranteed present: the SDK rejects a token that is missing any of them
+ * rather than returning a partial result.
+ */
+interface AgentAccessTokenClaims {
+  /** The token issuer (`iss`). */
+  issuer: string;
+  /** The token audience (`aud`). */
+  audience: string | string[];
+  /** Unique identifier of the agent registration the token was issued for (`sub`). */
+  registrationId: string;
+  /** The token's unique identifier (`jti`). */
+  jti: string;
+  /** Unique identifier of the Organization the registration belongs to. */
+  organizationId: string;
+  /** The space-separated scopes granted to the token, if any (`scope`). */
+  scope?: string;
+  /** The actor the token acts on behalf of, if any (`act`). */
+  actor?: {
+    sub: string;
+  };
+  /** The time the token expires, in seconds since the epoch (`exp`). */
+  expiresAt: number;
+  /** The time the token was issued, in seconds since the epoch (`iat`). */
+  issuedAt: number;
+}
+/**
+ * A verified agent access token payload. The required claims are the ones the
+ * SDK guarantees on a valid agent credential; `scope` and `act` are genuinely
+ * optional on the token. A decoded payload missing any required claim is
+ * rejected as invalid before it reaches this shape.
+ */
+interface SerializedAgentAccessTokenClaims {
+  iss: string;
+  aud: string | string[];
+  sub: string;
+  jti: string;
+  org_id: string;
+  exp: number;
+  iat: number;
+  scope?: string;
+  act?: {
+    sub: string;
+  };
+  [claim: string]: unknown;
+}
+/** A valid agent credential. */
+interface ValidAgentCredential {
+  valid: true;
+  /** Unique identifier of the agent registration the credential was issued for. */
+  registrationId: string;
+  /**
+   * An ISO 8601 timestamp of when the credential expires, or `null` when it
+   * does not expire.
+   */
+  expiresAt: string | null;
+  /**
+   * The decoded claims of the access token. Populated for `access_token`
+   * credentials; `null` for API keys.
+   */
+  claims: AgentAccessTokenClaims | null;
+}
+/** An invalid agent credential. */
+interface InvalidAgentCredential {
+  valid: false;
+  registrationId: null;
+  expiresAt: null;
+  claims: null;
+}
+/** The result of validating an agent credential. */
+type AgentCredentialValidation = ValidAgentCredential | InvalidAgentCredential;
+interface SerializedAgentCredentialValidation {
+  valid: boolean;
+  registration_id: string | null;
+  expires_at: string | null;
+}
+//#endregion
+//#region src/agents/agents.d.ts
+declare class Agents {
+  private readonly workos;
+  private _jwks?;
+  constructor(workos: WorkOS);
+  /**
+   * Link a claim attempt to an external user
+   *
+   * Link an external user to a claim attempt and retrieve the code needed
+   * for the agent to complete the claim. The user is looked up by external
+   * ID; if no user exists, one is created. When the user belongs to multiple
+   * organizations, an explicit organization must be provided.
+   *
+   * @param options - Object containing the claim attempt token, user details, and optional organization ID.
+   * @returns {Promise<ClaimAttemptResponse>}
+   * @throws {BadRequestException} 400 - Invalid request, email mismatch, or wrong account.
+   * @throws {ForbiddenException} 403 - Claim denied or auth method disabled.
+   * @throws {ConflictException} 409 - Organization selection required, external ID conflict, or already claimed.
+   * @throws {GoneException} 410 - Claim or user code expired.
+   */
+  linkClaimAttemptToExternalUser(options: LinkClaimAttemptToExternalUserOptions): Promise<ClaimAttemptResponse>;
+  /**
+   * Get an agent registration
+   *
+   * Retrieve a single agent registration scoped to the API key's environment.
+   * @param id - Unique identifier of the agent registration.
+   *
+   * @example
+   * "agent_reg_01EHZNVPK3SFK441A1RGBFSHRT"
+   *
+   * @returns {Promise<AgentRegistration>}
+   * @throws {NotFoundException} 404
+   */
+  getRegistration(id: string): Promise<AgentRegistration>;
+  /**
+   * Validate an agent credential
+   *
+   * For `access_token` credentials, the token is decoded and verified locally
+   * against the environment's JWKS and its claims are returned — no network
+   * request is made unless `checkForRevoked` is set, in which case the WorkOS
+   * API is also called to confirm the token has not been revoked.
+   *
+   * For `api_key` credentials, the WorkOS API is always called to validate the
+   * key against the environment.
+   *
+   * @param options - Object containing the credential type and value.
+   * @returns {Promise<AgentCredentialValidation>}
+   */
+  validateCredential(options: ValidateAgentCredentialOptions): Promise<AgentCredentialValidation>;
+  private validateAccessToken;
+  private validateCredentialRemotely;
+  /**
+   * Verifies an access token's signature, audience, and time claims against the
+   * environment's JWKS and returns its decoded claims, or `null` when the token
+   * is invalid (bad signature, wrong audience, expired, malformed, or missing
+   * the agent identity claims). Errors that are not JWT validation failures
+   * (e.g. network errors fetching the JWKS) propagate.
+   *
+   * The audience defaults to the client ID; resource-scoped tokens carry the
+   * resource as their audience and require it to be passed explicitly.
+   */
+  private verifyAccessTokenClaims;
+  private getJWKS;
+}
+//#endregion
 //#region src/common/utils/pagination.d.ts
 declare class AutoPaginatable<ResourceType, ParametersType extends PaginationOptions = PaginationOptions> {
   protected list: List<ResourceType>;
@@ -4707,68 +5223,940 @@ interface SendSessionResponse {
 declare class Passwordless {
   private readonly workos;
   constructor(workos: WorkOS);
-  createSession({
-    redirectURI,
-    expiresIn,
-    ...options
-  }: CreatePasswordlessSessionOptions): Promise<PasswordlessSession>;
+  createSession({ redirectURI, expiresIn, ...options }: CreatePasswordlessSessionOptions): Promise<PasswordlessSession>;
   sendSession(sessionId: string): Promise<SendSessionResponse>;
 }
 //#endregion
-//#region src/pipes/interfaces/access-token.interface.d.ts
-interface AccessToken {
-  object: 'access_token';
-  accessToken: string;
-  expiresAt: Date | null;
-  scopes: string[];
-  missingScopes: string[];
+//#region src/pipes/interfaces/data-integration-credentials-type.interface.d.ts
+declare const DataIntegrationCredentialsType: {
+  readonly Custom: "custom";
+  readonly Organization: "organization";
+};
+type DataIntegrationCredentialsType = (typeof DataIntegrationCredentialsType)[keyof typeof DataIntegrationCredentialsType];
+//#endregion
+//#region src/pipes/interfaces/data-integration-credentials-dto.interface.d.ts
+interface DataIntegrationCredentialsDto {
+  /** The credentials type. `custom` uses your own OAuth app credentials; `organization` has each organization supply its own credentials (configured per-organization). */
+  type: DataIntegrationCredentialsType;
+  /** OAuth client ID for the provider app. Required when `type` is `custom`; omit for `organization`. */
+  clientId?: string;
+  /** OAuth client secret for the provider app. Required when `type` is `custom`; omit for `organization`. */
+  clientSecret?: string;
 }
-interface SerializedAccessToken {
-  object: 'access_token';
-  access_token: string;
-  expires_at: string | null;
-  scopes: string[];
-  missing_scopes: string[];
+interface DataIntegrationCredentialsDtoResponse {
+  type: DataIntegrationCredentialsType;
+  client_id?: string;
+  client_secret?: string;
 }
 //#endregion
-//#region src/pipes/interfaces/get-access-token.interface.d.ts
-interface GetAccessTokenOptions {
+//#region src/pipes/interfaces/custom-provider-definition-authenticate-via.interface.d.ts
+declare const CustomProviderDefinitionAuthenticateVia: {
+  readonly RequestBody: "request_body";
+  readonly BasicAuthHeader: "basic_auth_header";
+};
+type CustomProviderDefinitionAuthenticateVia = (typeof CustomProviderDefinitionAuthenticateVia)[keyof typeof CustomProviderDefinitionAuthenticateVia];
+//#endregion
+//#region src/pipes/interfaces/custom-provider-definition.interface.d.ts
+interface CustomProviderDefinition {
+  /** A descriptive name for the custom provider. */
+  name: string;
+  /** The provider's OAuth authorization endpoint. */
+  authorizationUrl: string;
+  /** The provider's OAuth token endpoint. */
+  tokenUrl: string;
+  /** The endpoint used to refresh tokens, if different from the token endpoint. */
+  refreshTokenUrl?: string | null;
+  /** Whether PKCE is used during the authorization code flow. Defaults to `true`. */
+  pkceEnabled?: boolean;
+  /** The separator used to join requested scopes. Defaults to a space. */
+  requestScopeSeparator?: string;
+  /** Whether at least one scope must be selected when connecting an account. Defaults to `false`. */
+  scopesRequired?: boolean;
+  /** Whether a client secret is required for this provider. Defaults to `true`. */
+  clientSecretRequired?: boolean;
+  /** Additional static query parameters appended to the authorization request. */
+  additionalAuthorizationParameters?: Record<string, string>;
+  /** The Content-Type used when exchanging the token request. */
+  tokenBodyContentType?: string;
+  /** How client credentials are sent when exchanging authorization codes and refreshing tokens. */
+  authenticateVia?: CustomProviderDefinitionAuthenticateVia;
+}
+interface CustomProviderDefinitionResponse {
+  name: string;
+  authorization_url: string;
+  token_url: string;
+  refresh_token_url?: string | null;
+  pkce_enabled?: boolean;
+  request_scope_separator?: string;
+  scopes_required?: boolean;
+  client_secret_required?: boolean;
+  additional_authorization_parameters?: Record<string, string>;
+  token_body_content_type?: string;
+  authenticate_via?: CustomProviderDefinitionAuthenticateVia;
+}
+//#endregion
+//#region src/pipes/interfaces/create-data-integration-options.interface.d.ts
+interface CreateDataIntegrationOptions {
+  /** The provider to create a Data Integration for. For a built-in provider use its slug (e.g. `github`, `slack`). For a custom provider, this is the new provider slug and `custom_provider` must be supplied. A custom provider slug cannot shadow an existing global provider slug. */
+  provider: string;
+  /** An optional description of the Data Integration. */
+  description?: string | null;
+  /** Whether the Data Integration is enabled. Defaults to `false`. */
+  enabled?: boolean;
+  /** The OAuth scopes to request for the Data Integration. Defaults to the provider's configured scopes when omitted. */
+  scopes?: string[] | null;
+  /** The credentials to configure for the Data Integration. Required for both built-in and custom providers. */
+  credentials?: DataIntegrationCredentialsDto;
+  /** The OAuth definition for a custom provider. Supply this to define a custom provider; omit it to create an integration for a built-in provider. */
+  customProvider?: CustomProviderDefinition;
+}
+//#endregion
+//#region src/pipes/interfaces/get-data-integration-options.interface.d.ts
+interface GetDataIntegrationOptions {
+  /** The slug identifier of the data integration. */
+  slug: string;
+}
+//#endregion
+//#region src/pipes/interfaces/update-custom-provider-definition-authenticate-via.interface.d.ts
+declare const UpdateCustomProviderDefinitionAuthenticateVia: {
+  readonly RequestBody: "request_body";
+  readonly BasicAuthHeader: "basic_auth_header";
+};
+type UpdateCustomProviderDefinitionAuthenticateVia = (typeof UpdateCustomProviderDefinitionAuthenticateVia)[keyof typeof UpdateCustomProviderDefinitionAuthenticateVia];
+//#endregion
+//#region src/pipes/interfaces/update-custom-provider-definition.interface.d.ts
+interface UpdateCustomProviderDefinition {
+  /** A descriptive name for the custom provider. */
+  name?: string;
+  /** The provider's OAuth authorization endpoint. */
+  authorizationUrl?: string;
+  /** The provider's OAuth token endpoint. */
+  tokenUrl?: string;
+  /** The endpoint used to refresh tokens, if different from the token endpoint. */
+  refreshTokenUrl?: string | null;
+  /** Whether PKCE is used during the authorization code flow. */
+  pkceEnabled?: boolean;
+  /** The separator used to join requested scopes. */
+  requestScopeSeparator?: string;
+  /** Whether at least one scope must be selected when connecting an account. */
+  scopesRequired?: boolean;
+  /** Whether a client secret is required for this provider. */
+  clientSecretRequired?: boolean;
+  /** Additional static query parameters appended to the authorization request. */
+  additionalAuthorizationParameters?: Record<string, string>;
+  /** The Content-Type used when exchanging the token request. */
+  tokenBodyContentType?: string;
+  /** How client credentials are sent when exchanging authorization codes and refreshing tokens. */
+  authenticateVia?: UpdateCustomProviderDefinitionAuthenticateVia;
+}
+interface UpdateCustomProviderDefinitionResponse {
+  name?: string;
+  authorization_url?: string;
+  token_url?: string;
+  refresh_token_url?: string | null;
+  pkce_enabled?: boolean;
+  request_scope_separator?: string;
+  scopes_required?: boolean;
+  client_secret_required?: boolean;
+  additional_authorization_parameters?: Record<string, string>;
+  token_body_content_type?: string;
+  authenticate_via?: UpdateCustomProviderDefinitionAuthenticateVia;
+}
+//#endregion
+//#region src/pipes/interfaces/update-data-integration-options.interface.d.ts
+interface UpdateDataIntegrationOptions {
+  /** The slug identifier of the data integration. */
+  slug: string;
+  /** An optional description of the Data Integration. */
+  description?: string | null;
+  /** Whether the Data Integration is enabled. */
+  enabled?: boolean;
+  /** The OAuth scopes to request for the Data Integration. Pass `null` to reset to the provider's configured scopes. */
+  scopes?: string[] | null;
+  /** New credentials for the Data Integration. When provided, rotates the stored client secret. */
+  credentials?: DataIntegrationCredentialsDto;
+  /** Updates to a custom provider's OAuth definition. Only valid for custom-provider integrations. */
+  customProvider?: UpdateCustomProviderDefinition;
+}
+//#endregion
+//#region src/pipes/interfaces/delete-data-integration-options.interface.d.ts
+interface DeleteDataIntegrationOptions {
+  /** The slug identifier of the data integration. */
+  slug: string;
+}
+//#endregion
+//#region src/pipes/interfaces/update-data-integration-api-key-options.interface.d.ts
+interface UpdateDataIntegrationApiKeyOptions {
+  /** The identifier of the integration. */
+  slug: string;
+  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
+  userId: string;
+  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. */
+  organizationId?: string;
+  /** The API key secret to store for this integration. */
+  secret: string;
+}
+//#endregion
+//#region src/pipes/interfaces/authorize-data-integration-options.interface.d.ts
+interface AuthorizeDataIntegrationOptions {
+  /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
+  slug: string;
+  /** The ID of the user to authorize. */
+  userId: string;
+  /** An organization ID to scope the authorization to a specific organization. */
+  organizationId?: string;
+  /** The URL to redirect the user to after authorization. */
+  returnTo?: string;
+}
+//#endregion
+//#region src/pipes/interfaces/create-data-integration-credential-options.interface.d.ts
+interface CreateDataIntegrationCredentialOptions {
+  /** The identifier of the integration. */
+  slug: string;
+  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
+  userId: string;
+  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. */
+  organizationId?: string;
+}
+//#endregion
+//#region src/pipes/interfaces/get-access-token-options.interface.d.ts
+interface GetAccessTokenOptions {
+  /** The identifier of the integration. */
+  provider: string;
+  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
   userId: string;
+  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization. */
   organizationId?: string | null;
 }
-interface SerializedGetAccessTokenOptions {
-  user_id: string;
-  organization_id?: string | null;
+//#endregion
+//#region src/pipes/interfaces/get-user-connected-account-options.interface.d.ts
+interface GetUserConnectedAccountOptions {
+  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
+  userId: string;
+  /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
+  slug: string;
+  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization. */
+  organizationId?: string;
 }
-interface GetAccessTokenSuccessResponse {
-  active: true;
-  accessToken: AccessToken;
+//#endregion
+//#region src/pipes/interfaces/connected-account-state.interface.d.ts
+declare const ConnectedAccountState: {
+  readonly Connected: "connected";
+  readonly NeedsReauthorization: "needs_reauthorization";
+};
+type ConnectedAccountState = (typeof ConnectedAccountState)[keyof typeof ConnectedAccountState];
+//#endregion
+//#region src/pipes/interfaces/create-user-connected-account-options.interface.d.ts
+interface CreateUserConnectedAccountOptions {
+  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
+  userId: string;
+  /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
+  slug: string;
+  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization. */
+  organizationId?: string;
+  /** The OAuth access token for the connected account. */
+  accessToken?: string;
+  /** The OAuth refresh token for the connected account. */
+  refreshToken?: string;
+  /** The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire. */
+  expiresAt?: Date;
+  /** The OAuth scopes granted for this connection. */
+  scopes?: string[];
+  /** Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided. */
+  state?: ConnectedAccountState;
+}
+//#endregion
+//#region src/pipes/interfaces/update-user-connected-account-options.interface.d.ts
+interface UpdateUserConnectedAccountOptions {
+  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
+  userId: string;
+  /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
+  slug: string;
+  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization. */
+  organizationId?: string;
+  /** The OAuth access token for the connected account. */
+  accessToken?: string;
+  /** The OAuth refresh token for the connected account. */
+  refreshToken?: string;
+  /** The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire. */
+  expiresAt?: Date;
+  /** The OAuth scopes granted for this connection. */
+  scopes?: string[];
+  /** Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided. */
+  state?: ConnectedAccountState;
+}
+//#endregion
+//#region src/pipes/interfaces/delete-user-connected-account-options.interface.d.ts
+interface DeleteUserConnectedAccountOptions {
+  /** A [User](https://workos.com/docs/reference/authkit/user) identifier. */
+  userId: string;
+  /** The slug identifier of the provider (e.g., `github`, `slack`, `notion`). */
+  slug: string;
+  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization. */
+  organizationId?: string;
 }
-interface GetAccessTokenFailureResponse {
-  active: false;
-  error: 'not_installed' | 'needs_reauthorization';
+//#endregion
+//#region src/pipes/interfaces/list-user-data-providers-options.interface.d.ts
+interface ListUserDataProvidersOptions {
+  /** A [User](https://workos.com/docs/reference/authkit/user) identifier to list providers and connected accounts for. */
+  userId: string;
+  /** An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to filter connections for a specific organization. */
+  organizationId?: string;
 }
-type GetAccessTokenResponse = GetAccessTokenSuccessResponse | GetAccessTokenFailureResponse;
-interface SerializedGetAccessTokenSuccessResponse {
-  active: true;
-  access_token: SerializedAccessToken;
+//#endregion
+//#region src/pipes/interfaces/data-integration-credential-type.interface.d.ts
+declare const DataIntegrationCredentialType: {
+  readonly Custom: "custom";
+  readonly Organization: "organization";
+};
+type DataIntegrationCredentialType = (typeof DataIntegrationCredentialType)[keyof typeof DataIntegrationCredentialType];
+//#endregion
+//#region src/pipes/interfaces/data-integration-credential.interface.d.ts
+/** The credentials configured for the Data Integration. */
+interface DataIntegrationCredential {
+  /** The credentials type. `custom` uses your own OAuth app credentials; `organization` has each organization supply its own credentials (so `client_id`/`redacted_client_secret` are null on the integration itself). */
+  type: DataIntegrationCredentialType;
+  /** The OAuth client ID configured for the provider app. Null for `organization` credentials. */
+  clientId: string | null;
+  /** The last four characters of the OAuth client secret. The full secret is never returned. Null for `organization` credentials. */
+  redactedClientSecret: string | null;
+}
+interface DataIntegrationCredentialResponse {
+  type: DataIntegrationCredentialType;
+  client_id: string | null;
+  redacted_client_secret: string | null;
+}
+//#endregion
+//#region src/pipes/interfaces/data-integration-custom-provider-authenticate-via.interface.d.ts
+declare const DataIntegrationCustomProviderAuthenticateVia: {
+  readonly RequestBody: "request_body";
+  readonly BasicAuthHeader: "basic_auth_header";
+};
+type DataIntegrationCustomProviderAuthenticateVia = (typeof DataIntegrationCustomProviderAuthenticateVia)[keyof typeof DataIntegrationCustomProviderAuthenticateVia];
+//#endregion
+//#region src/pipes/interfaces/data-integration-custom-provider.interface.d.ts
+interface DataIntegrationCustomProvider {
+  /** A descriptive name for the custom provider. */
+  name: string;
+  /** The provider's OAuth authorization endpoint. */
+  authorizationUrl: string | null;
+  /** The provider's OAuth token endpoint. */
+  tokenUrl: string | null;
+  /** The endpoint used to refresh tokens, if different from the token endpoint. */
+  refreshTokenUrl: string | null;
+  /** Whether PKCE is used during the authorization code flow. */
+  pkceEnabled: boolean;
+  /** The separator used to join requested scopes. */
+  requestScopeSeparator: string;
+  /** Whether at least one scope must be selected when connecting an account. */
+  scopesRequired: boolean;
+  /** Whether a client secret is required for this provider. */
+  clientSecretRequired: boolean;
+  /** Additional static query parameters appended to the authorization request. */
+  additionalAuthorizationParameters: Record<string, string>;
+  /** The Content-Type used when exchanging the token request. */
+  tokenBodyContentType: string;
+  /** How client credentials are sent when exchanging authorization codes and refreshing tokens. */
+  authenticateVia: DataIntegrationCustomProviderAuthenticateVia;
+}
+interface DataIntegrationCustomProviderResponse {
+  name: string;
+  authorization_url: string | null;
+  token_url: string | null;
+  refresh_token_url: string | null;
+  pkce_enabled: boolean;
+  request_scope_separator: string;
+  scopes_required: boolean;
+  client_secret_required: boolean;
+  additional_authorization_parameters: Record<string, string>;
+  token_body_content_type: string;
+  authenticate_via: DataIntegrationCustomProviderAuthenticateVia;
+}
+//#endregion
+//#region src/pipes/interfaces/data-integration-state.interface.d.ts
+declare const DataIntegrationState: {
+  readonly Valid: "valid";
+  readonly Invalid: "invalid";
+  readonly Requested: "requested";
+};
+type DataIntegrationState = (typeof DataIntegrationState)[keyof typeof DataIntegrationState];
+//#endregion
+//#region src/pipes/interfaces/data-integration.interface.d.ts
+interface DataIntegration {
+  /** Distinguishes the Data Integration object. */
+  object: 'data_integration';
+  /** Unique identifier of the Data Integration. */
+  id: string;
+  /** The provider slug for this Data Integration. */
+  slug: string;
+  /** The integration type derived from the provider. */
+  integrationType: string;
+  /** An optional description of the Data Integration. */
+  description: string | null;
+  /** Whether the Data Integration is enabled. */
+  enabled: boolean;
+  /** The state of the Data Integration. */
+  state: DataIntegrationState;
+  /** The OAuth scopes configured for the Data Integration. `null` when the provider's configured scopes are used. */
+  scopes: string[] | null;
+  /** The OAuth redirect URI to register with the provider when configuring the custom application. */
+  redirectUri: string;
+  /** The credentials configured for the Data Integration. */
+  credentials: DataIntegrationCredential;
+  /** The OAuth definition when this is a custom provider; `null` for built-in providers. */
+  customProvider: DataIntegrationCustomProvider | null;
+  /** An ISO 8601 timestamp. */
+  createdAt: Date;
+  /** An ISO 8601 timestamp. */
+  updatedAt: Date;
 }
-interface SerializedGetAccessTokenFailureResponse {
+interface DataIntegrationResponse {
+  object: 'data_integration';
+  id: string;
+  slug: string;
+  integration_type: string;
+  description: string | null;
+  enabled: boolean;
+  state: DataIntegrationState;
+  scopes: string[] | null;
+  redirect_uri: string;
+  credentials: DataIntegrationCredentialResponse;
+  custom_provider: DataIntegrationCustomProviderResponse | null;
+  created_at: string;
+  updated_at: string;
+}
+//#endregion
+//#region src/pipes/interfaces/connected-account-auth-method.interface.d.ts
+declare const ConnectedAccountAuthMethod: {
+  readonly OAuth: "oauth";
+  readonly ApiKey: "api_key";
+};
+type ConnectedAccountAuthMethod = (typeof ConnectedAccountAuthMethod)[keyof typeof ConnectedAccountAuthMethod];
+//#endregion
+//#region src/pipes/interfaces/connected-account.interface.d.ts
+interface ConnectedAccount {
+  /** Distinguishes the connected account object. */
+  object: 'connected_account';
+  /** The unique identifier of the connected account. */
+  id: string;
+  /** The [User](https://workos.com/docs/reference/authkit/user) identifier associated with this connection. */
+  userId: string | null;
+  /** The [Organization](https://workos.com/docs/reference/organization) identifier associated with this connection, or `null` if not scoped to an organization. */
+  organizationId: string | null;
+  /** The OAuth scopes granted for this connection. */
+  scopes: string[];
+  /** The authentication method used for this connection (`oauth` or `api_key`). Defaults to `oauth` if absent. */
+  authMethod?: ConnectedAccountAuthMethod;
+  /** The last four characters of the API key, or `null` for OAuth connections. */
+  apiKeyLast4?: string | null;
+  /**
+   * The state of the connected account:
+   * - `connected`: The connection is active and tokens are valid.
+   * - `needs_reauthorization`: The user needs to reauthorize the connection, typically because required scopes have changed.
+   * - `disconnected`: The connection has been disconnected.
+   */
+  state: ConnectedAccountState;
+  /** The timestamp when the connection was created. */
+  createdAt: string;
+  /** The timestamp when the connection was last updated. */
+  updatedAt: string;
+}
+interface ConnectedAccountResponse {
+  object: 'connected_account';
+  id: string;
+  user_id: string | null;
+  organization_id: string | null;
+  scopes: string[];
+  auth_method?: ConnectedAccountAuthMethod;
+  api_key_last_4?: string | null;
+  state: ConnectedAccountState;
+  created_at: string;
+  updated_at: string;
+}
+//#endregion
+//#region src/pipes/interfaces/data-integration-authorize-url-response.interface.d.ts
+interface DataIntegrationAuthorizeUrlResponse {
+  /** The OAuth authorization URL to redirect the user to. */
+  url: string;
+}
+interface DataIntegrationAuthorizeUrlResponseWire {
+  url: string;
+}
+//#endregion
+//#region src/pipes/interfaces/data-integration-credentials-response-credential.interface.d.ts
+/** The credential object containing the vended secret. */
+interface DataIntegrationCredentialsResponseCredential {
+  /** Distinguishes the credential object. */
+  object: 'credential';
+  /** The authentication method for this credential. Additional values may be added in the future; handle unknown values gracefully. */
+  authMethod: 'oauth';
+  /** The OAuth access token. */
+  value: string;
+  /** The ISO-8601 formatted timestamp indicating when the credential expires. */
+  expiresAt: string | null;
+  /** The scopes granted to the access token. */
+  scopes: string[];
+  /** If the integration has requested scopes that aren't present on the access token, they're listed here. */
+  missingScopes: string[];
+}
+interface DataIntegrationCredentialsResponseCredentialResponse {
+  object: 'credential';
+  auth_method: 'oauth';
+  value: string;
+  expires_at: string | null;
+  scopes: string[];
+  missing_scopes: string[];
+}
+//#endregion
+//#region src/pipes/interfaces/data-integration-credentials-response-error.interface.d.ts
+declare const DataIntegrationCredentialsResponseError: {
+  readonly NotInstalled: "not_installed";
+  readonly NeedsReauthorization: "needs_reauthorization";
+};
+type DataIntegrationCredentialsResponseError = (typeof DataIntegrationCredentialsResponseError)[keyof typeof DataIntegrationCredentialsResponseError];
+//#endregion
+//#region src/pipes/interfaces/data-integration-credentials-response.interface.d.ts
+interface DataIntegrationCredentialsResponse {
+  /** Indicates credentials are available. */
+  active?: true;
+  /** The credential object containing the vended secret. */
+  credential?: DataIntegrationCredentialsResponseCredential;
+  /**
+   * The reason credentials are unavailable. Additional values may be added in the future; handle unknown values gracefully.
+   * - `"not_installed"`: The user does not have the integration installed.
+   * - `"needs_reauthorization"`: The user needs to reauthorize the integration.
+   */
+  error?: DataIntegrationCredentialsResponseError;
+}
+//#endregion
+//#region src/pipes/interfaces/data-integration-access-token-response-access-token.interface.d.ts
+/** The [access token](https://workos.com/docs/reference/pipes/access-token) object, present when `active` is `true`. */
+interface DataIntegrationAccessTokenResponseAccessToken {
+  /** Distinguishes the access token object. */
+  object: 'access_token';
+  /** The OAuth access token for the connected integration. */
+  accessToken: string;
+  /** The ISO-8601 formatted timestamp indicating when the access token expires. */
+  expiresAt: Date | null;
+  /** The scopes granted to the access token. */
+  scopes: string[];
+  /** If the integration has requested scopes that aren't present on the access token, they're listed here. */
+  missingScopes: string[];
+}
+interface DataIntegrationAccessTokenResponseAccessTokenResponse {
+  object: 'access_token';
+  access_token: string;
+  expires_at: string | null;
+  scopes: string[];
+  missing_scopes: string[];
+}
+//#endregion
+//#region src/pipes/interfaces/data-integration-access-token-response.interface.d.ts
+type DataIntegrationAccessTokenResponse = {
+  active: true;
+  accessToken: DataIntegrationAccessTokenResponseAccessToken;
+} | {
   active: false;
-  error: 'not_installed' | 'needs_reauthorization';
+  error: 'needs_reauthorization' | 'not_installed';
+};
+type DataIntegrationAccessTokenResponseWire = {
+  active: true;
+  access_token: DataIntegrationAccessTokenResponseAccessTokenResponse;
+} | {
+  active: false;
+  error: 'needs_reauthorization' | 'not_installed';
+};
+//#endregion
+//#region src/pipes/interfaces/data-integrations-list-response-data-connected-account-auth-method.interface.d.ts
+declare const DataIntegrationsListResponseDataConnectedAccountAuthMethod: {
+  readonly OAuth: "oauth";
+  readonly ApiKey: "api_key";
+};
+type DataIntegrationsListResponseDataConnectedAccountAuthMethod = (typeof DataIntegrationsListResponseDataConnectedAccountAuthMethod)[keyof typeof DataIntegrationsListResponseDataConnectedAccountAuthMethod];
+//#endregion
+//#region src/pipes/interfaces/data-integrations-list-response-data-connected-account-state.interface.d.ts
+declare const DataIntegrationsListResponseDataConnectedAccountState: {
+  readonly Connected: "connected";
+  readonly NeedsReauthorization: "needs_reauthorization";
+  readonly Disconnected: "disconnected";
+};
+type DataIntegrationsListResponseDataConnectedAccountState = (typeof DataIntegrationsListResponseDataConnectedAccountState)[keyof typeof DataIntegrationsListResponseDataConnectedAccountState];
+//#endregion
+//#region src/pipes/interfaces/data-integrations-list-response-data-connected-account.interface.d.ts
+interface DataIntegrationsListResponseDataConnectedAccount {
+  /** Distinguishes the connected account object. */
+  object: 'connected_account';
+  /** The unique identifier of the connected account. */
+  id: string;
+  /** The [User](https://workos.com/docs/reference/authkit/user) identifier associated with this connection. */
+  userId: string | null;
+  /** The [Organization](https://workos.com/docs/reference/organization) identifier associated with this connection, or `null` if not scoped to an organization. */
+  organizationId: string | null;
+  /** The OAuth scopes granted for this connection. */
+  scopes: string[];
+  /** The authentication method used for this connection (`oauth` or `api_key`). Defaults to `oauth` if absent. */
+  authMethod?: DataIntegrationsListResponseDataConnectedAccountAuthMethod;
+  /** The last four characters of the API key, or `null` for OAuth connections. */
+  apiKeyLast4?: string | null;
+  /**
+   * The state of the connected account:
+   * - `connected`: The connection is active and tokens are valid.
+   * - `needs_reauthorization`: The user needs to reauthorize the connection, typically because required scopes have changed.
+   * - `disconnected`: The connection has been disconnected.
+   */
+  state: DataIntegrationsListResponseDataConnectedAccountState;
+  /** The timestamp when the connection was created. */
+  createdAt: string;
+  /** The timestamp when the connection was last updated. */
+  updatedAt: string;
+  /**
+   * Use `user_id` instead.
+   * @deprecated
+   */
+  userlandUserId: string | null;
+}
+interface DataIntegrationsListResponseDataConnectedAccountResponse {
+  object: 'connected_account';
+  id: string;
+  user_id: string | null;
+  organization_id: string | null;
+  scopes: string[];
+  auth_method?: DataIntegrationsListResponseDataConnectedAccountAuthMethod;
+  api_key_last_4?: string | null;
+  state: DataIntegrationsListResponseDataConnectedAccountState;
+  created_at: string;
+  updated_at: string;
+  userland_user_id: string | null;
+}
+//#endregion
+//#region src/pipes/interfaces/data-integrations-list-response-data-auth-methods.interface.d.ts
+declare const DataIntegrationsListResponseDataAuthMethods: {
+  readonly OAuth: "oauth";
+  readonly ApiKey: "api_key";
+};
+type DataIntegrationsListResponseDataAuthMethods = (typeof DataIntegrationsListResponseDataAuthMethods)[keyof typeof DataIntegrationsListResponseDataAuthMethods];
+//#endregion
+//#region src/pipes/interfaces/data-integrations-list-response-data-ownership.interface.d.ts
+declare const DataIntegrationsListResponseDataOwnership: {
+  readonly UserlandUser: "userland_user";
+  readonly Organization: "organization";
+};
+type DataIntegrationsListResponseDataOwnership = (typeof DataIntegrationsListResponseDataOwnership)[keyof typeof DataIntegrationsListResponseDataOwnership];
+//#endregion
+//#region src/pipes/interfaces/data-integrations-list-response-data.interface.d.ts
+interface DataIntegrationsListResponseData {
+  /** Distinguishes the data provider object. */
+  object: 'data_provider';
+  /** The unique identifier of the provider. */
+  id: string;
+  /** The display name of the provider (e.g., "GitHub", "Slack"). */
+  name: string;
+  /** A description of the provider explaining how it will be used, if configured. */
+  description: string | null;
+  /** The slug identifier used in API calls (e.g., `github`, `slack`, `notion`). */
+  slug: string;
+  /** The type of integration (e.g., `github`, `slack`). */
+  integrationType: string;
+  /** The type of credentials used by the provider (e.g., `oauth2`). */
+  credentialsType: string;
+  /** The OAuth scopes configured for this provider, or `null` if none are configured. */
+  scopes: string[] | null;
+  /** The authentication methods supported by this provider (`oauth`, `api_key`, or both). Defaults to `["oauth"]` if absent. */
+  authMethods?: DataIntegrationsListResponseDataAuthMethods[];
+  /** Whether the provider is owned by a user or organization. */
+  ownership: DataIntegrationsListResponseDataOwnership;
+  /** The timestamp when the provider was created. */
+  createdAt: string;
+  /** The timestamp when the provider was last updated. */
+  updatedAt: string;
+  /** The user's [connected account](https://workos.com/docs/reference/pipes/connected-account) for this provider, or `null` if the user has not connected. */
+  connectedAccount: DataIntegrationsListResponseDataConnectedAccount | null;
+}
+interface DataIntegrationsListResponseDataResponse {
+  object: 'data_provider';
+  id: string;
+  name: string;
+  description: string | null;
+  slug: string;
+  integration_type: string;
+  credentials_type: string;
+  scopes: string[] | null;
+  auth_methods?: DataIntegrationsListResponseDataAuthMethods[];
+  ownership: DataIntegrationsListResponseDataOwnership;
+  created_at: string;
+  updated_at: string;
+  connected_account: DataIntegrationsListResponseDataConnectedAccountResponse | null;
+}
+//#endregion
+//#region src/pipes/interfaces/data-integrations-list-response.interface.d.ts
+interface DataIntegrationsListResponse {
+  /** Indicates this is a list response. */
+  object: 'list';
+  /** A list of [providers](https://workos.com/docs/reference/pipes/provider), each including a [`connected_account`](https://workos.com/docs/reference/pipes/connected-account) field with the user's connection status. */
+  data: DataIntegrationsListResponseData[];
+}
+interface DataIntegrationsListResponseWire {
+  object: 'list';
+  data: DataIntegrationsListResponseDataResponse[];
 }
-type SerializedGetAccessTokenResponse = SerializedGetAccessTokenSuccessResponse | SerializedGetAccessTokenFailureResponse;
 //#endregion
 //#region src/pipes/pipes.d.ts
 declare class Pipes {
   private readonly workos;
   constructor(workos: WorkOS);
-  getAccessToken({
-    provider,
-    ...options
-  }: GetAccessTokenOptions & {
-    provider: string;
-  }): Promise<GetAccessTokenResponse>;
+  /**
+   * List data integrations
+   *
+   * Lists the environment's data integrations configured with `custom` or `organization` credentials, including custom providers.
+   * @param options - Pagination and filter options.
+   * @returns {Promise<AutoPaginatable<DataIntegration, PaginationOptions>>}
+   * @throws {UnauthorizedException} 401
+   */
+  listDataIntegrations(options?: PaginationOptions): Promise<AutoPaginatable<DataIntegration, PaginationOptions>>;
+  /**
+   * Create a data integration
+   *
+   * Creates a data integration for a provider. Set `credentials.type` to `custom` to use your own OAuth app credentials, or `organization` to have each organization supply its own. For a built-in provider, pass its slug as `provider`. For a custom provider, pass a new slug plus a `custom_provider` definition.
+   * @param options - Object containing provider.
+   * @param options.provider - The provider to create a Data Integration for. For a built-in provider use its slug (e.g. `github`, `slack`). For a custom provider, this is the new provider slug and `custom_provider` must be supplied. A custom provider slug cannot shadow an existing global provider slug.
+   * @example "github"
+   * @param options.description - An optional description of the Data Integration.
+   * @example "Production GitHub app"
+   * @param options.enabled - Whether the Data Integration is enabled. Defaults to `false`.
+   * @example true
+   * @param options.scopes - The OAuth scopes to request for the Data Integration. Defaults to the provider's configured scopes when omitted.
+   * @example ["repo","read:org"]
+   * @param options.credentials - The credentials to configure for the Data Integration. Required for both built-in and custom providers.
+   * @param options.customProvider - The OAuth definition for a custom provider. Supply this to define a custom provider; omit it to create an integration for a built-in provider.
+   * @returns {Promise<DataIntegration>}
+   * @throws {BadRequestException} 400
+   * @throws {UnauthorizedException} 401
+   * @throws {NotFoundException} 404
+   * @throws {UnprocessableEntityException} 422
+   */
+  createDataIntegration(options: CreateDataIntegrationOptions): Promise<DataIntegration>;
+  /**
+   * Get a data integration
+   *
+   * Retrieves a data integration by its slug.
+   * @param options - The request options.
+   * @param options.slug - The slug identifier of the data integration.
+   * @example "github"
+   * @returns {Promise<DataIntegration>}
+   * @throws {UnauthorizedException} 401
+   * @throws {NotFoundException} 404
+   */
+  getDataIntegration(options: GetDataIntegrationOptions): Promise<DataIntegration>;
+  /**
+   * Update a data integration
+   *
+   * Updates the description, enabled state, or custom credentials of a data integration. For custom providers, `custom_provider` updates the OAuth definition.
+   * @param options - The request body.
+   * @param options.slug - The slug identifier of the data integration.
+   * @example "github"
+   * @param options.description - An optional description of the Data Integration.
+   * @example "Production GitHub app"
+   * @param options.enabled - Whether the Data Integration is enabled.
+   * @example true
+   * @param options.scopes - The OAuth scopes to request for the Data Integration. Pass `null` to reset to the provider's configured scopes.
+   * @example ["repo","read:org"]
+   * @param options.credentials - New credentials for the Data Integration. When provided, rotates the stored client secret.
+   * @param options.customProvider - Updates to a custom provider's OAuth definition. Only valid for custom-provider integrations.
+   * @returns {Promise<DataIntegration>}
+   * @throws {BadRequestException} 400
+   * @throws {UnauthorizedException} 401
+   * @throws {NotFoundException} 404
+   * @throws {UnprocessableEntityException} 422
+   */
+  updateDataIntegration(options: UpdateDataIntegrationOptions): Promise<DataIntegration>;
+  /**
+   * Delete a data integration
+   *
+   * Deletes a data integration and all of its connected installations. For a custom provider, also deletes the custom provider definition.
+   * @param options - The request options.
+   * @param options.slug - The slug identifier of the data integration.
+   * @example "github"
+   * @returns {Promise<void>}
+   * @throws {UnauthorizedException} 401
+   * @throws {NotFoundException} 404
+   */
+  deleteDataIntegration(options: DeleteDataIntegrationOptions): Promise<void>;
+  /**
+   * Upsert an API key for a connected account
+   *
+   * Creates or updates an API-key-based installation for the specified integration and user. If an installation already exists, the stored API key is rotated to the new value.
+   * @param options - Object containing userId, secret.
+   * @param options.slug - The identifier of the integration.
+   * @example "github"
+   * @param options.userId - A [User](https://workos.com/docs/reference/authkit/user) identifier.
+   * @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @param options.organizationId - An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization.
+   * @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @param options.secret - The API key secret to store for this integration.
+   * @example "sk-1234567890abcdef"
+   * @returns {Promise<ConnectedAccount>}
+   * @throws {BadRequestException} 400
+   * @throws {UnauthorizedException} 401
+   * @throws {AuthorizationException} 403
+   * @throws {NotFoundException} 404
+   * @throws {UnprocessableEntityException} 422
+   */
+  updateDataIntegrationApiKey(options: UpdateDataIntegrationApiKeyOptions): Promise<ConnectedAccount>;
+  /**
+   * Get authorization URL
+   *
+   * Generates an OAuth authorization URL to initiate the connection flow for a user. Redirect the user to the returned URL to begin the OAuth flow with the third-party provider.
+   * @param options - Object containing userId.
+   * @param options.slug - The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
+   * @example "github"
+   * @param options.userId - The ID of the user to authorize.
+   * @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @param options.organizationId - An organization ID to scope the authorization to a specific organization.
+   * @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @param options.returnTo - The URL to redirect the user to after authorization.
+   * @example "https://example.com/callback"
+   * @returns {Promise<DataIntegrationAuthorizeUrlResponse>}
+   * @throws {BadRequestException} 400
+   * @throws {UnauthorizedException} 401
+   * @throws {AuthorizationException} 403
+   * @throws {NotFoundException} 404
+   */
+  authorizeDataIntegration(options: AuthorizeDataIntegrationOptions): Promise<DataIntegrationAuthorizeUrlResponse>;
+  /**
+   * Vend credentials for a connected account
+   *
+   * Returns credentials for a user's connected account. Branches on the installation's `auth_method`: OAuth installations return an access token (refreshed if needed); API-key installations return the stored secret.
+   * @param options - Object containing userId.
+   * @param options.slug - The identifier of the integration.
+   * @example "github"
+   * @param options.userId - A [User](https://workos.com/docs/reference/authkit/user) identifier.
+   * @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @param options.organizationId - An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization.
+   * @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @returns {Promise<DataIntegrationCredentialsResponse>}
+   * @throws {BadRequestException} 400
+   * @throws {UnauthorizedException} 401
+   * @throws {NotFoundException} 404
+   */
+  createDataIntegrationCredential(options: CreateDataIntegrationCredentialOptions): Promise<DataIntegrationCredentialsResponse>;
+  /**
+   * Get an access token for a connected account
+   *
+   * Fetches a valid OAuth access token for a user's connected account. WorkOS automatically handles token refresh, ensuring you always receive a valid, non-expired token.
+   * @param options - Object containing userId.
+   * @param options.provider - The identifier of the integration.
+   * @example "github"
+   * @param options.userId - A [User](https://workos.com/docs/reference/authkit/user) identifier.
+   * @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @param options.organizationId - An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to scope the connection to a specific organization.
+   * @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @returns {Promise<DataIntegrationAccessTokenResponse>}
+   * @throws {BadRequestException} 400
+   * @throws {UnauthorizedException} 401
+   * @throws {NotFoundException} 404
+   * @throws {UnprocessableEntityException} 422
+   */
+  getAccessToken(options: GetAccessTokenOptions): Promise<DataIntegrationAccessTokenResponse>;
+  /**
+   * Get a connected account
+   *
+   * Retrieves a user's [connected account](https://workos.com/docs/reference/pipes/connected-account) for a specific provider.
+   * @param options - Additional query options.
+   * @param options.userId - A [User](https://workos.com/docs/reference/authkit/user) identifier.
+   * @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @param options.slug - The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
+   * @example "github"
+   * @param options.organizationId - An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization.
+   * @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @returns {Promise<ConnectedAccount>}
+   * @throws {UnauthorizedException} 401
+   * @throws {NotFoundException} 404
+   */
+  getUserConnectedAccount(options: GetUserConnectedAccountOptions): Promise<ConnectedAccount>;
+  /**
+   * Import a connected account
+   *
+   * Imports a [connected account](https://workos.com/docs/reference/pipes/connected-account) for a user by providing OAuth tokens directly. Use this to migrate existing connections or set up connections without going through the OAuth flow.
+   * @param options - The request body.
+   * @param options.userId - A [User](https://workos.com/docs/reference/authkit/user) identifier.
+   * @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @param options.slug - The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
+   * @example "github"
+   * @param options.organizationId - An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization.
+   * @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @param options.accessToken - The OAuth access token for the connected account.
+   * @example "gho_16C7e42F292c6912E7710c838347Ae178B4a"
+   * @param options.refreshToken - The OAuth refresh token for the connected account.
+   * @example "ghr_xxxxxxxxxxxxxxxxxxxx"
+   * @param options.expiresAt - The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire.
+   * @example "2025-12-31T23:59:59.000Z"
+   * @param options.scopes - The OAuth scopes granted for this connection.
+   * @example ["repo","user:email"]
+   * @param options.state - Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided.
+   * @example "connected"
+   * @returns {Promise<ConnectedAccount>}
+   * @throws {UnauthorizedException} 401
+   * @throws {NotFoundException} 404
+   * @throws {ConflictException} 409
+   * @throws {UnprocessableEntityException} 422
+   */
+  createUserConnectedAccount(options: CreateUserConnectedAccountOptions): Promise<ConnectedAccount>;
+  /**
+   * Update a connected account
+   *
+   * Updates a user's [connected account](https://workos.com/docs/reference/pipes/connected-account) tokens, scopes, or state for a specific provider.
+   * @param options - The request body.
+   * @param options.userId - A [User](https://workos.com/docs/reference/authkit/user) identifier.
+   * @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @param options.slug - The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
+   * @example "github"
+   * @param options.organizationId - An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization.
+   * @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @param options.accessToken - The OAuth access token for the connected account.
+   * @example "gho_16C7e42F292c6912E7710c838347Ae178B4a"
+   * @param options.refreshToken - The OAuth refresh token for the connected account.
+   * @example "ghr_xxxxxxxxxxxxxxxxxxxx"
+   * @param options.expiresAt - The ISO-8601 timestamp when the access token expires. Required when `access_token` is provided for tokens that expire.
+   * @example "2025-12-31T23:59:59.000Z"
+   * @param options.scopes - The OAuth scopes granted for this connection.
+   * @example ["repo","user:email"]
+   * @param options.state - Explicitly set the state of the connected account. When omitted, the state is derived from the token combination provided.
+   * @example "connected"
+   * @returns {Promise<ConnectedAccount>}
+   * @throws {UnauthorizedException} 401
+   * @throws {NotFoundException} 404
+   */
+  updateUserConnectedAccount(options: UpdateUserConnectedAccountOptions): Promise<ConnectedAccount>;
+  /**
+   * Delete a connected account
+   *
+   * Disconnects WorkOS's account for the user, including removing any stored access and refresh tokens. The user will need to reauthorize if they want to reconnect. This does not revoke access on the provider side.
+   * @param options - Additional query options.
+   * @param options.userId - A [User](https://workos.com/docs/reference/authkit/user) identifier.
+   * @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @param options.slug - The slug identifier of the provider (e.g., `github`, `slack`, `notion`).
+   * @example "github"
+   * @param options.organizationId - An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter if the connection is scoped to an organization.
+   * @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @returns {Promise<void>}
+   * @throws {UnauthorizedException} 401
+   * @throws {NotFoundException} 404
+   */
+  deleteUserConnectedAccount(options: DeleteUserConnectedAccountOptions): Promise<void>;
+  /**
+   * List providers for a user
+   *
+   * Retrieves a list of available providers and the user's connection status for each. Returns all providers configured for your environment, along with the user's [connected account](https://workos.com/docs/reference/pipes/connected-account) information where applicable.
+   * @param options - Additional query options.
+   * @param options.userId - A [User](https://workos.com/docs/reference/authkit/user) identifier to list providers and connected accounts for.
+   * @example "user_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @param options.organizationId - An [Organization](https://workos.com/docs/reference/organization) identifier. Optional parameter to filter connections for a specific organization.
+   * @example "org_01EHZNVPK3SFK441A1RGBFSHRT"
+   * @returns {Promise<DataIntegrationsListResponse>}
+   * @throws {UnauthorizedException} 401
+   * @throws {NotFoundException} 404
+   */
+  listUserDataProviders(options: ListUserDataProvidersOptions): Promise<DataIntegrationsListResponse>;
 }
 //#endregion
 //#region src/radar/interfaces/radar-standalone-assess-request-auth-method.interface.d.ts
@@ -5004,14 +6392,7 @@ declare class AdminPortal {
    * @throws {NotFoundException} 404
    * @throws {UnprocessableEntityException} 422
    */
-  generateLink({
-    intent,
-    organization,
-    returnUrl,
-    successUrl,
-    intentOptions,
-    adminEmails
-  }: {
+  generateLink({ intent, organization, returnUrl, successUrl, intentOptions, adminEmails }: {
     intent?: GenerateLinkIntent;
     organization: string;
     returnUrl?: string;
@@ -5109,11 +6490,7 @@ declare class SSO {
    *
    * @throws Error if neither codeVerifier nor API key is available
    */
-  getProfileAndToken<CustomAttributesType extends UnknownRecord = UnknownRecord>({
-    code,
-    clientId,
-    codeVerifier
-  }: GetProfileAndTokenOptions): Promise<ProfileAndToken<CustomAttributesType>>;
+  getProfileAndToken<CustomAttributesType extends UnknownRecord = UnknownRecord>({ code, clientId, codeVerifier }: GetProfileAndTokenOptions): Promise<ProfileAndToken<CustomAttributesType>>;
   /**
    * Get a User Profile
    *
@@ -5122,9 +6499,7 @@ declare class SSO {
    * @throws {UnauthorizedException} 401
    * @throws {NotFoundException} 404
    */
-  getProfile<CustomAttributesType extends UnknownRecord = UnknownRecord>({
-    accessToken
-  }: GetProfileOptions): Promise<Profile<CustomAttributesType>>;
+  getProfile<CustomAttributesType extends UnknownRecord = UnknownRecord>({ accessToken }: GetProfileOptions): Promise<Profile<CustomAttributesType>>;
 }
 //#endregion
 //#region src/multi-factor-auth/interfaces/challenge-factor-options.d.ts
@@ -5167,53 +6542,6 @@ type EnrollFactorOptions = {
   type: 'generic_otp';
 };
 //#endregion
-//#region src/multi-factor-auth/interfaces/sms.interface.d.ts
-interface Sms {
-  phoneNumber: string;
-}
-interface SmsResponse {
-  phone_number: string;
-}
-//#endregion
-//#region src/multi-factor-auth/interfaces/factor.interface.d.ts
-type FactorType = 'sms' | 'totp' | 'generic_otp';
-interface Factor {
-  object: 'authentication_factor';
-  id: string;
-  createdAt: string;
-  updatedAt: string;
-  type: FactorType;
-  sms?: Sms;
-  totp?: Totp;
-}
-interface FactorWithSecrets {
-  object: 'authentication_factor';
-  id: string;
-  createdAt: string;
-  updatedAt: string;
-  type: FactorType;
-  sms?: Sms;
-  totp?: TotpWithSecrets;
-}
-interface FactorResponse {
-  object: 'authentication_factor';
-  id: string;
-  created_at: string;
-  updated_at: string;
-  type: FactorType;
-  sms?: SmsResponse;
-  totp?: TotpResponse;
-}
-interface FactorWithSecretsResponse {
-  object: 'authentication_factor';
-  id: string;
-  created_at: string;
-  updated_at: string;
-  type: FactorType;
-  sms?: SmsResponse;
-  totp?: TotpWithSecretsResponse;
-}
-//#endregion
 //#region src/multi-factor-auth/interfaces/verify-challenge-options.d.ts
 interface VerifyChallengeOptions {
   authenticationChallengeId: string;
@@ -5775,13 +7103,16 @@ type CryptoKey = Extract<Awaited<ReturnType<typeof crypto.subtle.generateKey>>,
  */
 declare const customFetch: unique symbol;
 /** See {@link customFetch}. */
-type FetchImplementation = (/** URL the request is being made sent to {@link !fetch} as the `resource` argument */
-
-url: string, /** Options otherwise sent to {@link !fetch} as the `options` argument */
-
+type FetchImplementation = (
+/** URL the request is being made sent to {@link !fetch} as the `resource` argument */
+url: string,
+/** Options otherwise sent to {@link !fetch} as the `options` argument */
 options: {
-  /** HTTP Headers */headers: Headers; /** The {@link https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods request method} */
-  method: 'GET'; /** See {@link !Request.redirect} */
+  /** HTTP Headers */
+  headers: Headers;
+  /** The {@link https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods request method} */
+  method: 'GET';
+  /** See {@link !Request.redirect} */
   redirect: 'manual';
   signal: AbortSignal;
 }) => Promise<Response>;
@@ -5896,11 +7227,16 @@ type JWKSCacheInput = ExportedJWKSCache | Record<string, never>;
  * @param options Options for the remote JSON Web Key Set.
  */
 declare function createRemoteJWKSet(url: URL, options?: RemoteJWKSetOptions): {
-  (protectedHeader?: JWSHeaderParameters, token?: FlattenedJWSInput): Promise<CryptoKey>; /** @ignore */
-  coolingDown: boolean; /** @ignore */
-  fresh: boolean; /** @ignore */
-  reloading: boolean; /** @ignore */
-  reload: () => Promise<void>; /** @ignore */
+  (protectedHeader?: JWSHeaderParameters, token?: FlattenedJWSInput): Promise<CryptoKey>;
+  /** @ignore */
+  coolingDown: boolean;
+  /** @ignore */
+  fresh: boolean;
+  /** @ignore */
+  reloading: boolean;
+  /** @ignore */
+  reload: () => Promise<void>;
+  /** @ignore */
   jwks: () => JSONWebKeySet | undefined;
 };
 //#endregion
@@ -5941,9 +7277,7 @@ declare class CookieSession {
    *
    * @returns The URL to redirect the user to for logging out.
    */
-  getLogoutUrl({
-    returnTo
-  }?: {
+  getLogoutUrl({ returnTo }?: {
     returnTo?: string;
   }): Promise<string>;
   private isValidJwt;
@@ -6061,17 +7395,11 @@ declare class UserManagement {
   authenticateWithRadarSmsChallenge(payload: AuthenticateWithRadarSmsChallengeOptions): Promise<AuthenticationResponse>;
   /** Authenticate with Radar email challenge. */
   authenticateWithRadarEmailChallenge(payload: AuthenticateWithRadarEmailChallengeOptions): Promise<AuthenticationResponse>;
-  authenticateWithSessionCookie({
-    sessionData,
-    cookiePassword
-  }: AuthenticateWithSessionCookieOptions): Promise<AuthenticateWithSessionCookieSuccessResponse | AuthenticateWithSessionCookieFailedResponse>;
+  authenticateWithSessionCookie({ sessionData, cookiePassword }: AuthenticateWithSessionCookieOptions): Promise<AuthenticateWithSessionCookieSuccessResponse | AuthenticateWithSessionCookieFailedResponse>;
   private isValidJwt;
   private prepareAuthenticationResponse;
   private sealSessionDataFromAuthenticationResponse;
-  getSessionFromCookie({
-    sessionData,
-    cookiePassword
-  }: SessionHandlerOptions): Promise<SessionCookieData | undefined>;
+  getSessionFromCookie({ sessionData, cookiePassword }: SessionHandlerOptions): Promise<SessionCookieData | undefined>;
   /**
    * Get an email verification code
    *
@@ -6089,9 +7417,7 @@ declare class UserManagement {
    * @throws {NotFoundException} 404
    * @throws {RateLimitExceededException} 429
    */
-  sendVerificationEmail({
-    userId
-  }: SendVerificationEmailOptions): Promise<{
+  sendVerificationEmail({ userId }: SendVerificationEmailOptions): Promise<{
     user: User;
   }>;
   /**
@@ -6123,10 +7449,7 @@ declare class UserManagement {
    * @throws {NotFoundException} 404
    * @throws {UnprocessableEntityException} 422
    */
-  verifyEmail({
-    code,
-    userId
-  }: VerifyEmailOptions): Promise<{
+  verifyEmail({ code, userId }: VerifyEmailOptions): Promise<{
     user: User;
   }>;
   /**
@@ -6182,6 +7505,28 @@ declare class UserManagement {
    * @throws {NotFoundException} 404
    */
   deleteUser(userId: string): Promise<void>;
+  /**
+   * List API keys for a user
+   *
+   * Get a list of API keys owned by a specific user.
+   * @param userId - Unique identifier of the user.
+   * @param options - Pagination and filter options.
+   * @returns {Promise<AutoPaginatable<UserApiKey, SerializedListUserApiKeysOptions>>}
+   * @throws {NotFoundException} 404
+   */
+  listUserApiKeys(userId: string, options?: ListUserApiKeysOptions): Promise<AutoPaginatable<UserApiKey, SerializedListUserApiKeysOptions>>;
+  /**
+   * Create an API key for a user
+   *
+   * Create a new API key owned by a user. The user must have an active membership in the specified organization.
+   * @param userId - Unique identifier of the user.
+   * @param options - Object containing the API key properties.
+   * @returns {Promise<UserApiKeyWithValue>}
+   * @throws {BadRequestException} 400
+   * @throws {NotFoundException} 404
+   * @throws {UnprocessableEntityException} 422
+   */
+  createUserApiKey(userId: string, options: CreateUserApiKeyOptions, requestOptions?: CreateUserApiKeyRequestOptions): Promise<UserApiKeyWithValue>;
   /**
    * Get user identities
    *
@@ -7872,6 +9217,7 @@ declare class WorkOS {
   readonly pkce: PKCE;
   private readonly hasApiKey;
   readonly actions: Actions;
+  readonly agents: Agents;
   readonly apiKeys: ApiKeys;
   readonly auditLogs: AuditLogs;
   readonly authorization: Authorization;
@@ -7935,7 +9281,7 @@ declare class WorkOS {
   patch<Result = any, Entity = any>(path: string, entity: Entity, options?: PatchOptions): Promise<{
     data: Result;
   }>;
-  delete(path: string, query?: any): Promise<void>;
+  delete(path: string, query?: Record<string, string | number | boolean | undefined>): Promise<void>;
   deleteWithBody<Entity = any>(path: string, entity: Entity): Promise<void>;
   emitWarning(warning: string): void;
   private handleHttpError;
@@ -8242,12 +9588,7 @@ declare class Webhooks {
   deleteWebhookEndpoint(options: DeleteWebhookEndpointOptions): Promise<void>;
   private _signatureProvider?;
   private get signatureProvider();
-  get verifyHeader(): ({
-    payload,
-    sigHeader,
-    secret,
-    tolerance
-  }: {
+  get verifyHeader(): ({ payload, sigHeader, secret, tolerance }: {
     payload: WebhookPayload;
     sigHeader: string;
     secret: string;
@@ -8255,12 +9596,7 @@ declare class Webhooks {
   }) => Promise<boolean>;
   get computeSignature(): (timestamp: any, payload: WebhookPayload, secret: string) => Promise<string>;
   get getTimestampAndSignatureHash(): (sigHeader: string) => [string, string];
-  constructEvent({
-    payload,
-    sigHeader,
-    secret,
-    tolerance
-  }: {
+  constructEvent({ payload, sigHeader, secret, tolerance }: {
     payload: WebhookPayload;
     sigHeader: string;
     secret: string;
@@ -8336,12 +9672,7 @@ declare class BadRequestException extends Error implements RequestException {
   readonly code?: string;
   readonly errors?: unknown[];
   readonly requestID: string;
-  constructor({
-    code,
-    errors,
-    message,
-    requestID
-  }: {
+  constructor({ code, errors, message, requestID }: {
     code?: string;
     errors?: unknown[];
     message?: string;
@@ -8355,12 +9686,7 @@ declare class ConflictException extends Error implements RequestException {
   readonly name = "ConflictException";
   readonly requestID: string;
   readonly code?: string;
-  constructor({
-    error,
-    message,
-    requestID,
-    code
-  }: {
+  constructor({ error, message, requestID, code }: {
     error?: string;
     message?: string;
     requestID: string;
@@ -8382,12 +9708,7 @@ declare class NotFoundException extends Error implements RequestException {
   readonly message: string;
   readonly code?: string;
   readonly requestID: string;
-  constructor({
-    code,
-    message,
-    path,
-    requestID
-  }: {
+  constructor({ code, message, path, requestID }: {
     code?: string;
     message?: string;
     path: string;
@@ -8417,7 +9738,6 @@ declare class RateLimitExceededException extends GenericServerException {
   /**
    * The number of seconds to wait before retrying the request.
    */
-
   retryAfter: number | null);
 }
 //#endregion
@@ -8443,12 +9763,7 @@ declare class UnprocessableEntityException extends Error implements RequestExcep
   readonly message: string;
   readonly code?: string;
   readonly requestID: string;
-  constructor({
-    code,
-    errors,
-    message,
-    requestID
-  }: {
+  constructor({ code, errors, message, requestID }: {
     code?: string;
     errors?: UnprocessableEntityError[];
     message?: string;
@@ -8594,5 +9909,5 @@ interface ConfidentialClientOptions extends WorkOSOptions {
 declare function createWorkOS(options: PublicClientOptions): PublicWorkOS;
 declare function createWorkOS(options: ConfidentialClientOptions): WorkOS;
 //#endregion
-export { ReadObjectMetadataResponse as $, PermissionUpdatedEventResponse as $a, SerializedCreateMagicAuthOptions as $c, ListAuthorizationResourcesOptions as $d, ResponseHeaderValue as $f, GroupMemberAddedEventResponse as $i, AuthenticateUserWithEmailVerificationCredentials as $l, AutoPaginatable as $n, RuntimeClientStats as $o, AuthenticationPasswordFailedEventResponse as $r, ResetPasswordOptions as $s, RadarStandaloneAssessRequestAction as $t, RemoveGroupRoleAssignmentsOptions as $u, ApiKeyRequiredException as A, OrganizationMembershipCreated as Aa, OrganizationMembershipStatus as Ac, SerializedListRoleAssignmentsOptions as Ad, EnvironmentRole as Af, DsyncUserDeletedEvent as Ai, UserResponse as Al, ExternalAuthCompleteResponse as An, VaultDekReadEventResponse as Ao, GetOptions as Ar, SerializedCreateOrganizationDomainOptions as As, SerializedAuditLogExportOptions as At, DirectoryUserResponse as Au, ObjectSummaryResponse as B, OrganizationRoleUpdatedEvent as Ba, EnrollAuthFactorOptions as Bc, ListResourcesForMembershipOptions as Bd, DirectoryGroupResponse as Bf, FlagCreatedEvent as Bi, SerializedAuthenticateWithPasswordOptions as Bl, CreateM2MApplicationResponse as Bn, SerializedUpdateGroupOptions as Bo, AuthenticationMagicAuthSucceededEvent as Br, Session as Bs, EnrollFactorOptions as Bt, RoleList as Bu, BadRequestException as C, OrganizationDomainDeletedEventResponse as Ca, SerializedListOrganizationMembershipsOptions as Cc, AssignRoleOptionsWithResourceId as Cd, OrganizationRole as Cf, DsyncGroupUpdatedEventResponse as Ci, SessionCookieData as Cl, ConnectApplicationM2M as Cn, VaultDataReadEvent as Co, WorkOSOptions as Cr, OrganizationDomainVerificationFailed as Cs, AuditLogSchema as Ct, ConnectionDomain as Cu, isAuthenticationErrorData as D, OrganizationDomainVerificationFailedEventResponse as Da, BaseOrganizationMembershipResponse as Dc, ListRoleAssignmentsForResourceOptions as Dd, UpdateEnvironmentRoleOptions as Df, DsyncGroupUserRemovedEventResponse as Di, CreateUserResponse as Dl, ConnectApplicationResponse as Dn, VaultDekDecryptedEvent as Do, PatchOptions as Dr, OrganizationDomainState as Ds, AuditLogExport as Dt, SSOPKCEAuthorizationURLResult as Du, AuthenticationException as E, OrganizationDomainVerificationFailedEvent as Ea, BaseOrganizationMembership as Ec, ListRoleAssignmentsForResourceByExternalIdOptions as Ed, SerializedUpdateEnvironmentRoleOptions as Ef, DsyncGroupUserRemovedEvent as Ei, AuthenticationResponseResponse as El, ConnectApplicationOAuthResponse as En, VaultDataUpdatedEventResponse as Eo, PostOptions as Er, OrganizationDomainResponse as Es, AuditLogTargetSchema as Et, SSOAuthorizationURLOptions as Eu, UpdateWebhookEndpointEvents as F, OrganizationMembershipUpdatedResponse as Fa, Invitation as Fc, RoleAssignmentRole as Fd, ListDirectoryGroupsOptions as Ff, EmailVerificationCreatedEventResponse as Fi, AuthenticateUserWithRefreshTokenCredentials as Fl, DeleteApplicationOptions as Fn, VaultNamesListedEvent as Fo, ApiKeyRevokedEventResponse as Fr, SerializedUpdateUserOptions as Fs, FactorResponse as Ft, OrganizationRoleEventResponse as Fu, ObjectMetadata as G, PasswordResetCreatedEventResponse as Ga, EmailVerificationResponse as Gc, AuthorizationCheckOptionsWithResourceExternalId as Gd, DirectoryType as Gf, FlagRuleUpdatedEventResponse as Gi, AuthenticateWithRadarSmsChallengeOptions as Gl, ListApplicationsOptions as Gn, Group as Go, AuthenticationOAuthFailedEventResponse as Gr, SendRadarSmsChallengeResponse as Gs, RadarListEntryAlreadyPresentResponseWire as Gt, GroupRoleAssignmentEntry as Gu, ObjectVersionResponse as H, OrganizationUpdatedEvent as Ha, EmailVerification as Hc, ListResourcesForMembershipOptionsWithParentId as Hd, DirectoryResponse as Hf, FlagDeletedEvent as Hi, AuthenticateWithOrganizationSelectionOptions as Hl, CreateOAuthApplicationResponse as Hn, RemoveGroupOrganizationMembershipOptions as Ho, AuthenticationMfaSucceededEvent as Hr, SessionStatus as Hs, ChallengeResponse as Ht, ListEffectivePermissionsByExternalIdOptions as Hu, UpdateWebhookEndpointStatus as I, OrganizationRoleCreatedEvent as Ia, InvitationEvent as Ic, RoleAssignmentSource as Id, ListDirectoriesOptions as If, Event as Ii, AuthenticateWithRefreshTokenOptions as Il, UpdateApplicationOptions as In, VaultNamesListedEventResponse as Io, AuthenticationEmailVerificationSucceededEvent as Ir, UpdateUserOptions as Is, FactorWithSecrets as It, OrganizationRoleResponse as Iu, ActorResponse as J, PermissionCreatedEvent as Ja, CreatePasswordResetOptions as Jc, SerializedAuthorizationCheckOptions as Jd, HttpClient as Jf, GroupCreatedEvent as Ji, AuthenticateWithRadarEmailChallengeOptions as Jl, UserConsentOptionResponse as Jn, DeleteGroupOptions as Jo, AuthenticationPasskeyFailedEvent as Jr, SendInvitationOptions as Js, RadarStandaloneResponseBlocklistType as Jt, GroupRoleAssignmentEntryWithResourceId as Ju, ObjectMetadataResponse as K, PasswordResetSucceededEvent as Ka, CreateUserOptions as Kc, AuthorizationCheckOptionsWithResourceId as Kd, EventDirectory as Kf, FlagUpdatedEvent as Ki, SerializedAuthenticateWithRadarSmsChallengeOptions as Kl, CompleteOAuth2Options as Kn, GroupResponse as Ko, AuthenticationOAuthSucceededEvent as Kr, SendRadarSmsChallengeResponseResponse as Ks, RadarStandaloneResponse as Kt, GroupRoleAssignmentEntryForOrganization as Ku, CreateWebhookEndpointEvents as L, OrganizationRoleCreatedEventResponse as La, InvitationEventResponse as Lc, RoleAssignmentSourceResponse as Ld, SerializedListDirectoriesOptions as Lf, EventBase as Li, SerializedAuthenticateWithRefreshTokenOptions as Ll, GetApplicationOptions as Ln, DataKey as Lo, AuthenticationEmailVerificationSucceededEventResponse as Lr, SerializedUpdateOrganizationMembershipOptions as Ls, FactorWithSecretsResponse as Lt, Role as Lu, WebhookEndpoint as M, OrganizationMembershipDeleted as Ma, SerializedListInvitationsOptions as Mc, RoleAssignmentResource as Md, EnvironmentRoleListResponse as Mf, DsyncUserUpdatedEvent as Mi, ImpersonatorResponse as Ml, DeleteClientSecretOptions as Mn, VaultKekCreatedEventResponse as Mo, ApiKeyCreatedEvent as Mr, VerifyEmailOptions as Ms, VerifyResponseResponse as Mt, DirectoryUserWithGroupsResponse as Mu, WebhookEndpointResponse as N, OrganizationMembershipDeletedResponse as Na, ListGroupsForOrganizationMembershipOptions as Nc, RoleAssignmentResourceResponse as Nd, EnvironmentRoleResponse as Nf, DsyncUserUpdatedEventResponse as Ni, AuthenticateWithRefreshTokenPublicClientOptions as Nl, CreateApplicationClientSecretOptions as Nn, VaultMetadataReadEvent as No, ApiKeyCreatedEventResponse as Nr, SerializedUpdateUserPasswordOptions as Ns, VerifyChallengeOptions as Nt, ListOrganizationRolesResponse as Nu, GenericServerException as O, OrganizationDomainVerifiedEvent as Oa, OrganizationMembership as Oc, SerializedListRoleAssignmentsForResourceOptions as Od, CreateEnvironmentRoleOptions as Of, DsyncUserCreatedEvent as Oi, CreateUserResponseResponse as Ol, ConnectApplicationRedirectUri as On, VaultDekDecryptedEventResponse as Oo, List as Or, OrganizationDomainVerificationStrategy as Os, AuditLogExportResponse as Ot, DefaultCustomAttributes as Ou, WebhookEndpointStatus as P, OrganizationMembershipUpdated as Pa, ListAuthFactorsOptions as Pc, RoleAssignmentResponse as Pd, ListDirectoryUsersOptions as Pf, EmailVerificationCreatedEvent as Pi, SerializedAuthenticateWithRefreshTokenPublicClientOptions as Pl, ListApplicationClientSecretsOptions as Pn, VaultMetadataReadEventResponse as Po, ApiKeyRevokedEvent as Pr, UpdateUserPasswordOptions as Ps, Factor as Pt, OrganizationRoleEvent as Pu, UpdateObjectOptions as Q, PermissionUpdatedEvent as Qa, CreateMagicAuthOptions as Qc, GetAuthorizationResourceByExternalIdOptions as Qd, RequestOptions as Qf, GroupMemberAddedEvent as Qi, SerializedAuthenticateWithMagicAuthOptions as Ql, UserObjectResponse as Qn, SerializedAddGroupOrganizationMembershipOptions as Qo, AuthenticationPasswordFailedEvent as Qr, serializeRevokeSessionOptions as Qs, RadarListType as Qt, BaseRemoveGroupRoleAssignmentsOptions as Qu, WorkOS as R, OrganizationRoleDeletedEvent as Ra, InvitationResponse as Rc, ListMembershipsForResourceByExternalIdOptions as Rd, PaginationOptions as Rf, EventName as Ri, AuthenticateUserWithPasswordCredentials as Rl, CreateApplicationOptions as Rn, DataKeyPair as Ro, AuthenticationMagicAuthFailedEvent as Rr, UpdateOrganizationMembershipOptions as Rs, Sms as Rt, RoleEvent as Ru, ConflictException as S, OrganizationDomainDeletedEvent as Sa, ListOrganizationMembershipsOptions as Sc, AssignRoleOptionsWithResourceExternalId as Sd, SerializedCreateOrganizationRoleOptions as Sf, DsyncGroupUpdatedEvent as Si, AuthenticateWithSessionCookieSuccessResponse as Sl, ConnectApplication as Sn, VaultDataDeletedEventResponse as So, WorkOSResponseError as Sr, SerializedApiKey as Ss, AuditLogActorSchema as St, Connection as Su, AuthenticationErrorData as T, OrganizationDomainUpdatedEventResponse as Ta, AuthorizationOrganizationMembershipResponse as Tc, SerializedAssignRoleOptions as Td, SetEnvironmentRolePermissionsOptions as Tf, DsyncGroupUserAddedEventResponse as Ti, AuthenticationResponse as Tl, ConnectApplicationOAuth as Tn, VaultDataUpdatedEvent as To, PutOptions as Tr, OrganizationDomain as Ts, AuditLogSchemaResponse as Tt, ConnectionType as Tu, VaultObject as U, OrganizationUpdatedResponse as Ua, EmailVerificationEvent as Uc, SerializedListResourcesForMembershipOptions as Ud, DirectoryState as Uf, FlagDeletedEventResponse as Ui, SerializedAuthenticateWithOrganizationSelectionOptions as Ul, RedirectUriInput as Un, ListGroupsOptions as Uo, AuthenticationMfaSucceededEventResponse as Ur, SendVerificationEmailOptions as Us, ChallengeFactorOptions as Ut, ListEffectivePermissionsOptions as Uu, ObjectVersion as V, OrganizationRoleUpdatedEventResponse as Va, SerializedEnrollUserInMfaFactorOptions as Vc, ListResourcesForMembershipOptionsWithParentExternalId as Vd, Directory as Vf, FlagCreatedEventResponse as Vi, AuthenticateUserWithOrganizationSelectionCredentials as Vl, CreateOAuthApplication as Vn, UpdateGroupOptions as Vo, AuthenticationMagicAuthSucceededEventResponse as Vr, SessionResponse as Vs, Challenge as Vt, RoleResponse as Vu, VaultObjectResponse as W, PasswordResetCreatedEvent as Wa, EmailVerificationEventResponse as Wc, AuthorizationCheckOptions as Wd, DirectoryStateResponse as Wf, FlagRuleUpdatedEvent as Wi, AuthenticateUserWithRadarSmsChallengeCredentials as Wl, RedirectUriInputResponse as Wn, ListGroupOrganizationMembershipsOptions as Wo, AuthenticationOAuthFailedEvent as Wr, SendRadarSmsChallengeOptions as Ws, RadarListEntryAlreadyPresentResponse as Wt, BaseGroupRoleAssignmentEntry as Wu, CreateDataKeyResponseWire as X, PermissionDeletedEvent as Xa, CreateOrganizationMembershipOptions as Xc, DeleteAuthorizationResourceByExternalIdOptions as Xd, HttpClientResponseInterface as Xf, GroupDeletedEvent as Xi, AuthenticateUserWithMagicAuthCredentials as Xl, UserConsentOptionChoiceResponse as Xn, SerializedCreateGroupOptions as Xo, AuthenticationPasskeySucceededEvent as Xr, RevokeSessionOptions as Xs, RadarStandaloneResponseVerdict as Xt, SerializedGroupRoleAssignmentEntry as Xu, CreateDataKeyResponse as Y, PermissionCreatedEventResponse as Ya, SerializedCreatePasswordResetOptions as Yc, DeleteAuthorizationResourceOptions as Yd, HttpClientInterface as Yf, GroupCreatedEventResponse as Yi, SerializedAuthenticateWithRadarEmailChallengeOptions as Yl, UserConsentOptionChoice as Yn, CreateGroupOptions as Yo, AuthenticationPasskeyFailedEventResponse as Yr, SerializedSendInvitationOptions as Ys, RadarStandaloneResponseControl as Yt, ReplaceGroupRoleAssignmentsOptions as Yu, UpdateObjectEntity as Z, PermissionDeletedEventResponse as Za, SerializedCreateOrganizationMembershipOptions as Zc, UpdateAuthorizationResourceByExternalIdOptions as Zd, RequestHeaders as Zf, GroupDeletedEventResponse as Zi, AuthenticateWithMagicAuthOptions as Zl, UserObject as Zn, AddGroupOrganizationMembershipOptions as Zo, AuthenticationPasskeySucceededEventResponse as Zr, SerializedRevokeSessionOptions as Zs, RadarListAction as Zt, SerializedReplaceGroupRoleAssignmentsOptions as Zu, SignatureVerificationException as _, OrganizationCreatedResponse as _a, ListUsersOptions as _c, RemoveRoleOptions as _d, AddOrganizationRolePermissionOptions as _f, DsyncDeletedEventResponse as _i, AuthenticateWithTotpOptions as _l, SerializedListEventOptions as _n, VaultByokKeyVerificationCompletedEvent as _o, CreateOrganizationOptions as _r, SerializedCreatedApiKey as _s, AuditLogActor as _t, OauthTokensResponse as _u, PublicWorkOS as a, GroupUpdatedEventResponse as aa, PasswordReset as ac, BaseCreateGroupRoleAssignmentOptions as ad, CreateOptionsWithParentResourceId as af, AuthenticationSSOFailedEventResponse as ai, AuthenticationFactorResponse as al, SerializedGetAccessTokenFailureResponse as an, RoleUpdatedEventResponse as ao, UserRegistrationActionResponseData as ar, FlagPollEntry as as, DecryptDataKeyResponse as at, AuthenticateWithCodeOptions as au, NotFoundException as b, OrganizationDomainCreatedEvent as ba, ListSessionsOptions as bc, SerializedRemoveRoleOptions as bd, UpdateOrganizationRoleOptions as bf, DsyncGroupDeletedEvent as bi, AuthenticateWithSessionCookieFailureReason as bl, ApplicationCredentialsListItem as bn, VaultDataCreatedEventResponse as bo, DomainData as br, SerializedCreateOrganizationApiKeyOptions as bs, CreateAuditLogEventRequestOptions as bt, GetProfileAndTokenOptions as bu, PortalLinkResponseWire as c, InvitationCreatedEvent as ca, PasswordResetResponse as cc, CreateGroupRoleAssignmentOptionsWithResourceExternalId as cd, UpdateAuthorizationResourceOptions as cf, ConnectionActivatedEvent as ci, Totp as cl, SerializedGetAccessTokenSuccessResponse as cn, SessionRevokedEvent as co, UserData as cr, FeatureFlag as cs, WidgetSessionTokenResponseWire as ct, AuthenticateWithSessionOptions as cu, IntentOptions as d, InvitationResentEventResponse as da, MagicAuth as dc, GetGroupRoleAssignmentOptions as dd, UpdatePermissionOptions as df, ConnectionDeactivatedEventResponse as di, TotpWithSecretsResponse as dl, SendSessionResponse as dn, UserCreatedEvent as do, SerializedUpdateOrganizationOptions as dr, AddFlagTargetOptions as ds, FeatureFlagsRuntimeClient as dt, WithResolvedClientId as du, GroupMemberEventData as ea, SerializedResetPasswordOptions as ec, RemoveGroupRoleAssignmentsOptionsForOrganization as ed, SerializedListAuthorizationResourcesOptions as ef, AuthenticationPasswordSucceededEvent as ei, PKCEAuthorizationURLResult as el, RadarStandaloneAssessRequestAuthMethod as en, RoleCreatedEvent as eo, ResponseHeaders as ep, PKCE as er, RuntimeClientLogger as es, ReadObjectOptions as et, AuthenticateWithEmailVerificationOptions as eu, IntentOptionsResponse as f, InvitationRevokedEvent as fa, MagicAuthEvent as fc, ListGroupRoleAssignmentsOptions as fd, CreatePermissionOptions as ff, ConnectionDeletedEvent as fi, AuthenticationEvent as fl, CreatePasswordlessSessionOptions as fn, UserCreatedEventResponse as fo, UpdateOrganizationOptions as fr, SerializedValidateApiKeyResponse as fs, CookieSession as ft, ProfileAndToken as fu, UnauthorizedException as g, OrganizationCreatedEvent as ga, Locale as gc, BaseRemoveRoleOptions as gd, RemoveOrganizationRolePermissionOptions as gf, DsyncDeletedEvent as gi, AuthenticateUserWithTotpCredentials as gl, ListEventOptions as gn, UserUpdatedEventResponse as go, ListOrganizationFeatureFlagsOptions as gr, CreatedApiKey as gs, SerializedCreateAuditLogSchemaOptions as gt, OauthTokens as gu, UnprocessableEntityException as h, MagicAuthCreatedEventResponse as ha, LogoutURLOptions as hc, RemoveRoleAssignmentOptions as hd, PermissionResponse as hf, DsyncActivatedEventResponse as hi, AuthenticationEventSsoResponse as hl, PasswordlessSessionResponse as hn, UserUpdatedEvent as ho, ListOrganizationsOptions as hr, ListOrganizationApiKeysOptions as hs, CreateAuditLogSchemaResponse as ht, ProfileResponse as hu, PublicUserManagement as i, GroupUpdatedEvent as ia, RefreshSessionResponse as ic, RemoveGroupRoleAssignmentOptions as id, CreateOptionsWithParentExternalId as if, AuthenticationSSOFailedEvent as ii, AuthenticationFactor as il, GetAccessTokenSuccessResponse as in, RoleUpdatedEvent as io, ResponsePayload as ir, FlagChange as is, DecryptDataKeyOptions as it, AuthenticateUserWithCodeCredentials as iu, Webhooks as j, OrganizationMembershipCreatedResponse as ja, ListInvitationsOptions as jc, RoleAssignment as jd, EnvironmentRoleList as jf, DsyncUserDeletedEventResponse as ji, Impersonator as jl, ExternalAuthCompleteResponseWire as jn, VaultKekCreatedEvent as jo, GenerateLinkIntent as jr, SerializedVerifyEmailOptions as js, VerifyResponse as jt, DirectoryUserWithGroups as ju, WorkOSErrorData as k, OrganizationDomainVerifiedEventResponse as ka, OrganizationMembershipResponse as kc, ListRoleAssignmentsOptions as kd, SerializedCreateEnvironmentRoleOptions as kf, DsyncUserCreatedEventResponse as ki, User as kl, ConnectApplicationRedirectUriResponse as kn, VaultDekReadEvent as ko, ListResponse as kr, CreateOrganizationDomainOptions as ks, AuditLogExportOptions as kt, DirectoryUser as ku, GenerateLink as l, InvitationCreatedEventResponse as la, CreateMagicAuthResponse as lc, CreateGroupRoleAssignmentOptionsWithResourceId as ld, ListPermissionsOptions as lf, ConnectionActivatedEventResponse as li, TotpResponse as ll, AccessToken as ln, SessionRevokedEventResponse as lo, UserDataPayload as lr, FeatureFlagResponse as ls, CreateTokenOptions as lt, SerializedAuthenticatePublicClientBase as lu, SSOIntentOptionsResponse as m, MagicAuthCreatedEvent as ma, MagicAuthResponse as mc, GroupRoleAssignmentResponse as md, Permission as mf, DsyncActivatedEvent as mi, AuthenticationEventSso as ml, PasswordlessSession as mn, UserDeletedEventResponse as mo, OrganizationResponse as mr, ValidateApiKeyResponse as ms, CreateAuditLogSchemaRequestOptions as mt, Profile as mu, PublicClientOptions as n, GroupMemberRemovedEvent as na, SerializedResendInvitationOptions as nc, RemoveGroupRoleAssignmentsOptionsWithResourceId as nd, AuthorizationResourceResponse as nf, AuthenticationRadarRiskDetectedEvent as ni, AuthenticationRadarRiskDetectedEventData as nl, GetAccessTokenOptions as nn, RoleDeletedEvent as no, Actions as nr, RemoveFlagTargetOptions as ns, CreateObjectEntity as nt, AuthenticateWithCodeAndVerifierOptions as nu, createWorkOS as o, InvitationAcceptedEvent as oa, PasswordResetEvent as oc, CreateGroupRoleAssignmentOptions as od, SerializedCreateAuthorizationResourceOptions as of, AuthenticationSSOSucceededEvent as oi, AuthenticationFactorWithSecrets as ol, SerializedGetAccessTokenOptions as on, SessionCreatedEvent as oo, ActionContext as or, FlagPollResponse as os, CreateDataKeyOptions as ot, SerializedAuthenticateWithCodeOptions as ou, SSOIntentOptions as p, InvitationRevokedEventResponse as pa, MagicAuthEventResponse as pc, GroupRoleAssignment as pd, SerializedCreatePermissionOptions as pf, ConnectionDeletedEventResponse as pi, AuthenticationEventResponse as pl, SerializedCreatePasswordlessSessionOptions as pn, UserDeletedEvent as po, Organization as pr, ValidateApiKeyOptions as ps, CreateAuditLogSchemaOptions as pt, ProfileAndTokenResponse as pu, Actor as q, PasswordResetSucceededEventResponse as qa, SerializedCreateUserOptions as qc, AuthorizationCheckResult as qd, EventDirectoryResponse as qf, FlagUpdatedEventResponse as qi, AuthenticateUserWithRadarEmailChallengeCredentials as ql, UserConsentOption as qn, GetGroupOptions as qo, AuthenticationOAuthSucceededEventResponse as qr, SerializedSendRadarSmsChallengeOptions as qs, RadarStandaloneResponseWire as qt, GroupRoleAssignmentEntryWithResourceExternalId as qu, PublicSSO as r, GroupMemberRemovedEventResponse as ra, RefreshSessionFailureReason as rc, SerializedRemoveGroupRoleAssignmentsOptions as rd, CreateAuthorizationResourceOptions as rf, AuthenticationRadarRiskDetectedEventResponse as ri, AuthenticationRadarRiskDetectedEventResponseData as rl, GetAccessTokenResponse as rn, RoleDeletedEventResponse as ro, AuthenticationActionResponseData as rr, ListFeatureFlagsOptions as rs, CreateObjectOptions as rt, SerializedAuthenticateWithCodeAndVerifierOptions as ru, PortalLinkResponse as s, InvitationAcceptedEventResponse as sa, PasswordResetEventResponse as sc, CreateGroupRoleAssignmentOptionsForOrganization as sd, SerializedUpdateAuthorizationResourceOptions as sf, AuthenticationSSOSucceededEventResponse as si, AuthenticationFactorWithSecretsResponse as sl, SerializedGetAccessTokenResponse as sn, SessionCreatedEventResponse as so, ActionPayload as sr, FlagTarget as ss, WidgetSessionTokenResponse as st, AuthenticateWithOptionsBase as su, ConfidentialClientOptions as t, GroupMemberEventResponseData as ta, ResendInvitationOptions as tc, RemoveGroupRoleAssignmentsOptionsWithResourceExternalId as td, AuthorizationResource as tf, AuthenticationPasswordSucceededEventResponse as ti, UserManagementAuthorizationURLOptions as tl, GetAccessTokenFailureResponse as tn, RoleCreatedEventResponse as to, CryptoProvider as tp, PKCEPair as tr, RuntimeClientOptions as ts, ReadObjectResponse as tt, SerializedAuthenticateWithEmailVerificationOptions as tu, GenerateLinkResponse as u, InvitationResentEvent as ua, CreateMagicAuthResponseResponse as uc, SerializedCreateGroupRoleAssignmentOptions as ud, SerializedUpdatePermissionOptions as uf, ConnectionDeactivatedEvent as ui, TotpWithSecrets as ul, SerializedAccessToken as un, UnknownEvent as uo, UserRegistrationActionPayload as ur, EvaluationContext as us, WidgetSessionTokenScopes as ut, SerializedAuthenticateWithOptionsBase as uu, RateLimitExceededException as v, OrganizationDeletedEvent as va, SerializedListUsersOptions as vc, RemoveRoleOptionsWithResourceExternalId as vd, SetOrganizationRolePermissionsOptions as vf, DsyncGroupCreatedEvent as vi, SerializedAuthenticateWithTotpOptions as vl, NewConnectApplicationSecret as vn, VaultByokKeyVerificationCompletedEventResponse as vo, CreateOrganizationRequestOptions as vr, CreateOrganizationApiKeyOptions as vs, AuditLogTarget as vt, ListConnectionsOptions as vu, AuthenticationErrorCode as w, OrganizationDomainUpdatedEvent as wa, AuthorizationOrganizationMembership as wc, BaseAssignRoleOptions as wd, AddEnvironmentRolePermissionOptions as wf, DsyncGroupUserAddedEvent as wi, UserManagementAccessToken as wl, ConnectApplicationM2MResponse as wn, VaultDataReadEventResponse as wo, UnprocessableEntityError as wr, OrganizationDomainVerificationFailedResponse as ws, AuditLogSchemaMetadata as wt, ConnectionResponse as wu, NoApiKeyProvidedException as x, OrganizationDomainCreatedEventResponse as xa, SerializedListSessionsOptions as xc, AssignRoleOptions as xd, CreateOrganizationRoleOptions as xf, DsyncGroupDeletedEventResponse as xi, AuthenticateWithSessionCookieOptions as xl, ApplicationCredentialsListItemResponse as xn, VaultDataDeletedEvent as xo, DomainDataState as xr, ApiKey as xs, SerializedCreateAuditLogEventOptions as xt, GetProfileOptions as xu, OauthException as y, OrganizationDeletedResponse as ya, ListUserFeatureFlagsOptions as yc, RemoveRoleOptionsWithResourceId as yd, SerializedUpdateOrganizationRoleOptions as yf, DsyncGroupCreatedEventResponse as yi, AuthenticateWithSessionCookieFailedResponse as yl, NewConnectApplicationSecretResponse as yn, VaultDataCreatedEvent as yo, SerializedCreateOrganizationOptions as yr, CreateOrganizationApiKeyRequestOptions as ys, CreateAuditLogEventOptions as yt, SerializedListConnectionsOptions as yu, ObjectSummary as z, OrganizationRoleDeletedEventResponse as za, Identity as zc, ListMembershipsForResourceOptions as zd, DirectoryGroup as zf, EventResponse as zi, AuthenticateWithPasswordOptions as zl, CreateM2MApplication as zn, KeyContext as zo, AuthenticationMagicAuthFailedEventResponse as zr, AuthMethod as zs, SmsResponse as zt, RoleEventResponse as zu };
-//# sourceMappingURL=factory-7zoKcOC2.d.cts.map
+export { ReadObjectMetadataResponse as $, FlagDeletedEventResponse as $a, AuthMethod as $c, ConnectionResponse as $d, BaseAssignRoleOptions as $f, AuthenticationMfaSucceededEventResponse as $i, Invitation as $l, PasswordlessSessionResponse as $n, OrganizationUpdatedResponse as $o, AddEnvironmentRolePermissionOptions as $p, SerializedLinkClaimAttemptToExternalUserOptions as $r, ListGroupsOptions as $s, DataIntegrationsListResponseDataOwnership as $t, UserManagementAccessToken as $u, ApiKeyRequiredException as A, DsyncGroupDeletedEvent as Aa, SerializedCreateOrganizationApiKeyOptions as Ac, SerializedAuthenticateWithEmailVerificationOptions as Ad, RemoveGroupRoleAssignmentsOptionsWithResourceExternalId as Af, DomainData as Ai, MagicAuthResponse as Al, CryptoProvider as Am, ConnectedAccountState as An, OrganizationDomainCreatedEvent as Ao, AuthorizationResource as Ap, CompleteOAuth2Options as Ar, VaultDataCreatedEventResponse as As, SerializedAuditLogExportOptions as At, Factor as Au, ObjectSummaryResponse as B, DsyncUserDeletedEvent as Ba, SerializedCreateOrganizationDomainOptions as Bc, WithResolvedClientId as Bd, GetGroupRoleAssignmentOptions as Bf, GetOptions as Bi, ListOrganizationMembershipsOptions as Bl, UpdateCustomProviderDefinitionAuthenticateVia as Bn, OrganizationMembershipCreated as Bo, UpdatePermissionOptions as Bp, AgentCredentialValidation as Br, VaultDekReadEventResponse as Bs, RadarStandaloneResponse as Bt, SmsResponse as Bu, BadRequestException as C, ConnectionDeletedEventResponse as Ca, ValidateApiKeyOptions as Cc, AuthenticateWithRadarEmailChallengeOptions as Cd, GroupRoleAssignmentEntryWithResourceId as Cf, Organization as Ci, PasswordResetEventResponse as Cl, HttpClient as Cm, DataIntegrationCredential as Cn, InvitationRevokedEventResponse as Co, SerializedAuthorizationCheckOptions as Cp, CreateM2MApplication as Cr, UserDeletedEvent as Cs, AuditLogSchema as Ct, AuthenticationRadarRiskDetectedEventData as Cu, isAuthenticationErrorData as D, DsyncDeletedEventResponse as Da, SerializedCreatedApiKey as Dc, SerializedAuthenticateWithMagicAuthOptions as Dd, BaseRemoveGroupRoleAssignmentsOptions as Df, CreateOrganizationOptions as Di, MagicAuth as Dl, RequestOptions as Dm, DeleteUserConnectedAccountOptions as Dn, OrganizationCreatedResponse as Do, GetAuthorizationResourceByExternalIdOptions as Dp, RedirectUriInput as Dr, VaultByokKeyVerificationCompletedEvent as Ds, AuditLogExport as Dt, AuthenticationFactorType as Du, AuthenticationException as E, DsyncDeletedEvent as Ea, CreatedApiKey as Ec, AuthenticateWithMagicAuthOptions as Ed, SerializedReplaceGroupRoleAssignmentsOptions as Ef, ListOrganizationFeatureFlagsOptions as Ei, CreateMagicAuthResponseResponse as El, RequestHeaders as Em, ListUserDataProvidersOptions as En, OrganizationCreatedEvent as Eo, UpdateAuthorizationResourceByExternalIdOptions as Ep, CreateOAuthApplicationResponse as Er, UserUpdatedEventResponse as Es, AuditLogTargetSchema as Et, AuthenticationFactorResponse as Eu, UpdateWebhookEndpointEvents as F, DsyncGroupUserAddedEventResponse as Fa, OrganizationDomain as Fc, SerializedAuthenticateWithCodeOptions as Fd, CreateGroupRoleAssignmentOptions as Ff, PutOptions as Fi, ListUserApiKeysOptions as Fl, UpdateDataIntegrationApiKeyOptions as Fn, OrganizationDomainUpdatedEventResponse as Fo, SerializedCreateAuthorizationResourceOptions as Fp, UserObject as Fr, VaultDataUpdatedEvent as Fs, Challenge as Ft, Totp as Fu, ObjectMetadata as G, EmailVerificationCreatedEventResponse as Ga, SerializedUserApiKey as Gc, OauthTokens as Gd, BaseRemoveRoleOptions as Gf, ApiKeyRevokedEventResponse as Gi, BaseOrganizationMembershipResponse as Gl, CustomProviderDefinitionAuthenticateVia as Gn, OrganizationMembershipUpdatedResponse as Go, RemoveOrganizationRolePermissionOptions as Gp, ValidAgentCredential as Gr, VaultNamesListedEvent as Gs, RadarListAction as Gt, AuthenticateUserWithTotpCredentials as Gu, ObjectVersionResponse as H, DsyncUserUpdatedEvent as Ha, VerifyEmailOptions as Hc, ProfileAndTokenResponse as Hd, GroupRoleAssignment as Hf, ApiKeyCreatedEvent as Hi, AuthorizationOrganizationMembership as Hl, CreateDataIntegrationOptions as Hn, OrganizationMembershipDeleted as Ho, SerializedCreatePermissionOptions as Hp, SerializedAgentAccessTokenClaims as Hr, VaultKekCreatedEventResponse as Hs, RadarStandaloneResponseBlocklistType as Ht, AuthenticationEventResponse as Hu, UpdateWebhookEndpointStatus as I, DsyncGroupUserRemovedEvent as Ia, OrganizationDomainResponse as Ic, AuthenticateWithOptionsBase as Id, CreateGroupRoleAssignmentOptionsForOrganization as If, PostOptions as Ii, SerializedListUserApiKeysOptions as Il, DeleteDataIntegrationOptions as In, OrganizationDomainVerificationFailedEvent as Io, SerializedUpdateAuthorizationResourceOptions as Ip, UserObjectResponse as Ir, VaultDataUpdatedEventResponse as Is, ChallengeResponse as It, TotpResponse as Iu, ActorResponse as J, EventName as Ja, UpdateUserPasswordOptions as Jc, SerializedListConnectionsOptions as Jd, RemoveRoleOptionsWithResourceId as Jf, AuthenticationMagicAuthFailedEvent as Ji, OrganizationMembershipStatus as Jl, DataIntegrationCredentialsType as Jn, OrganizationRoleDeletedEvent as Jo, SerializedUpdateOrganizationRoleOptions as Jp, ValidateAgentCredentialOptions as Jr, DataKeyPair as Js, RadarStandaloneAssessRequestAuthMethod as Jt, AuthenticateWithSessionCookieFailedResponse as Ju, ObjectMetadataResponse as K, Event as Ka, UserApiKey as Kc, OauthTokensResponse as Kd, RemoveRoleOptions as Kf, AuthenticationEmailVerificationSucceededEvent as Ki, OrganizationMembership as Kl, DataIntegrationCredentialsDto as Kn, OrganizationRoleCreatedEvent as Ko, AddOrganizationRolePermissionOptions as Kp, ValidateAgentAccessTokenOptions as Kr, VaultNamesListedEventResponse as Ks, RadarListType as Kt, AuthenticateWithTotpOptions as Ku, CreateWebhookEndpointEvents as L, DsyncGroupUserRemovedEventResponse as La, OrganizationDomainState as Lc, AuthenticateWithSessionOptions as Ld, CreateGroupRoleAssignmentOptionsWithResourceExternalId as Lf, PatchOptions as Li, ListUserFeatureFlagsOptions as Ll, UpdateDataIntegrationOptions as Ln, OrganizationDomainVerificationFailedEventResponse as Lo, UpdateAuthorizationResourceOptions as Lp, AutoPaginatable as Lr, VaultDekDecryptedEvent as Ls, ChallengeFactorOptions as Lt, TotpWithSecrets as Lu, WebhookEndpoint as M, DsyncGroupUpdatedEvent as Ma, SerializedApiKey as Mc, SerializedAuthenticateWithCodeAndVerifierOptions as Md, SerializedRemoveGroupRoleAssignmentsOptions as Mf, WorkOSResponseError as Mi, Locale as Ml, GetAccessTokenOptions as Mn, OrganizationDomainDeletedEvent as Mo, CreateAuthorizationResourceOptions as Mp, UserConsentOptionResponse as Mr, VaultDataDeletedEventResponse as Ms, VerifyResponseResponse as Mt, FactorType as Mu, WebhookEndpointResponse as N, DsyncGroupUpdatedEventResponse as Na, OrganizationDomainVerificationFailed as Nc, AuthenticateUserWithCodeCredentials as Nd, RemoveGroupRoleAssignmentOptions as Nf, WorkOSOptions as Ni, ListUsersOptions as Nl, CreateDataIntegrationCredentialOptions as Nn, OrganizationDomainDeletedEventResponse as No, CreateOptionsWithParentExternalId as Np, UserConsentOptionChoice as Nr, VaultDataReadEvent as Ns, VerifyChallengeOptions as Nt, FactorWithSecrets as Nu, GenericServerException as O, DsyncGroupCreatedEvent as Oa, CreateOrganizationApiKeyOptions as Oc, AuthenticateUserWithEmailVerificationCredentials as Od, RemoveGroupRoleAssignmentsOptions as Of, CreateOrganizationRequestOptions as Oi, MagicAuthEvent as Ol, ResponseHeaderValue as Om, UpdateUserConnectedAccountOptions as On, OrganizationDeletedEvent as Oo, ListAuthorizationResourcesOptions as Op, RedirectUriInputResponse as Or, VaultByokKeyVerificationCompletedEventResponse as Os, AuditLogExportResponse as Ot, AuthenticationFactorWithSecrets as Ou, WebhookEndpointStatus as P, DsyncGroupUserAddedEvent as Pa, OrganizationDomainVerificationFailedResponse as Pc, AuthenticateWithCodeOptions as Pd, BaseCreateGroupRoleAssignmentOptions as Pf, UnprocessableEntityError as Pi, SerializedListUsersOptions as Pl, AuthorizeDataIntegrationOptions as Pn, OrganizationDomainUpdatedEvent as Po, CreateOptionsWithParentResourceId as Pp, UserConsentOptionChoiceResponse as Pr, VaultDataReadEventResponse as Ps, EnrollFactorOptions as Pt, FactorWithSecretsResponse as Pu, UpdateObjectOptions as Q, FlagDeletedEvent as Qa, UpdateOrganizationMembershipOptions as Qc, ConnectionDomain as Qd, AssignRoleOptionsWithResourceId as Qf, AuthenticationMfaSucceededEvent as Qi, ListAuthFactorsOptions as Ql, PasswordlessSession as Qn, OrganizationUpdatedEvent as Qo, OrganizationRole as Qp, SerializedClaimAttemptResponse as Qr, RemoveGroupOrganizationMembershipOptions as Qs, DataIntegrationsListResponseDataResponse as Qt, SessionCookieData as Qu, WorkOS as R, DsyncUserCreatedEvent as Ra, OrganizationDomainVerificationStrategy as Rc, SerializedAuthenticatePublicClientBase as Rd, CreateGroupRoleAssignmentOptionsWithResourceId as Rf, List as Ri, ListSessionsOptions as Rl, UpdateCustomProviderDefinition as Rn, OrganizationDomainVerifiedEvent as Ro, ListPermissionsOptions as Rp, AgentAccessTokenClaims as Rr, VaultDekDecryptedEventResponse as Rs, RadarListEntryAlreadyPresentResponse as Rt, TotpWithSecretsResponse as Ru, ConflictException as S, ConnectionDeletedEvent as Sa, SerializedValidateApiKeyResponse as Sc, AuthenticateUserWithRadarEmailChallengeCredentials as Sd, GroupRoleAssignmentEntryWithResourceExternalId as Sf, UpdateOrganizationOptions as Si, PasswordResetEvent as Sl, EventDirectoryResponse as Sm, DataIntegrationCustomProviderAuthenticateVia as Sn, InvitationRevokedEvent as So, AuthorizationCheckResult as Sp, CreateApplicationOptions as Sr, UserCreatedEventResponse as Ss, AuditLogActorSchema as St, UserManagementAuthorizationURLOptions as Su, AuthenticationErrorData as T, DsyncActivatedEventResponse as Ta, ListOrganizationApiKeysOptions as Tc, AuthenticateUserWithMagicAuthCredentials as Td, SerializedGroupRoleAssignmentEntry as Tf, ListOrganizationsOptions as Ti, CreateMagicAuthResponse as Tl, HttpClientResponseInterface as Tm, DataIntegrationCredentialType as Tn, MagicAuthCreatedEventResponse as To, DeleteAuthorizationResourceByExternalIdOptions as Tp, CreateOAuthApplication as Tr, UserUpdatedEvent as Ts, AuditLogSchemaResponse as Tt, AuthenticationFactor as Tu, VaultObject as U, DsyncUserUpdatedEventResponse as Ua, SerializedUserApiKeyWithValue as Uc, Profile as Ud, GroupRoleAssignmentResponse as Uf, ApiKeyCreatedEventResponse as Ui, AuthorizationOrganizationMembershipResponse as Ul, CustomProviderDefinition as Un, OrganizationMembershipDeletedResponse as Uo, Permission as Up, SerializedAgentCredentialValidation as Ur, VaultMetadataReadEvent as Us, RadarStandaloneResponseControl as Ut, AuthenticationEventSso as Uu, ObjectVersion as V, DsyncUserDeletedEventResponse as Va, SerializedVerifyEmailOptions as Vc, ProfileAndToken as Vd, ListGroupRoleAssignmentsOptions as Vf, GenerateLinkIntent as Vi, SerializedListOrganizationMembershipsOptions as Vl, GetDataIntegrationOptions as Vn, OrganizationMembershipCreatedResponse as Vo, CreatePermissionOptions as Vp, InvalidAgentCredential as Vr, VaultKekCreatedEvent as Vs, RadarStandaloneResponseWire as Vt, AuthenticationEvent as Vu, VaultObjectResponse as W, EmailVerificationCreatedEvent as Wa, UserApiKeyWithValue as Wc, ProfileResponse as Wd, RemoveRoleAssignmentOptions as Wf, ApiKeyRevokedEvent as Wi, BaseOrganizationMembership as Wl, CustomProviderDefinitionResponse as Wn, OrganizationMembershipUpdated as Wo, PermissionResponse as Wp, SerializedValidateAgentCredentialOptions as Wr, VaultMetadataReadEventResponse as Ws, RadarStandaloneResponseVerdict as Wt, AuthenticationEventSsoResponse as Wu, CreateDataKeyResponseWire as X, FlagCreatedEvent as Xa, UpdateUserOptions as Xc, GetProfileOptions as Xd, AssignRoleOptions as Xf, AuthenticationMagicAuthSucceededEvent as Xi, SerializedListInvitationsOptions as Xl, CreatePasswordlessSessionOptions as Xn, OrganizationRoleUpdatedEvent as Xo, CreateOrganizationRoleOptions as Xp, ClaimAttemptResponse as Xr, SerializedUpdateGroupOptions as Xs, DataIntegrationsListResponseWire as Xt, AuthenticateWithSessionCookieOptions as Xu, CreateDataKeyResponse as Y, EventResponse as Ya, SerializedUpdateUserOptions as Yc, GetProfileAndTokenOptions as Yd, SerializedRemoveRoleOptions as Yf, AuthenticationMagicAuthFailedEventResponse as Yi, ListInvitationsOptions as Yl, SendSessionResponse as Yn, OrganizationRoleDeletedEventResponse as Yo, UpdateOrganizationRoleOptions as Yp, ClaimAttemptOrganization as Yr, KeyContext as Ys, DataIntegrationsListResponse as Yt, AuthenticateWithSessionCookieFailureReason as Yu, UpdateObjectEntity as Z, FlagCreatedEventResponse as Za, SerializedUpdateOrganizationMembershipOptions as Zc, Connection as Zd, AssignRoleOptionsWithResourceExternalId as Zf, AuthenticationMagicAuthSucceededEventResponse as Zi, ListGroupsForOrganizationMembershipOptions as Zl, SerializedCreatePasswordlessSessionOptions as Zn, OrganizationRoleUpdatedEventResponse as Zo, SerializedCreateOrganizationRoleOptions as Zp, LinkClaimAttemptToExternalUserOptions as Zr, UpdateGroupOptions as Zs, DataIntegrationsListResponseData as Zt, AuthenticateWithSessionCookieSuccessResponse as Zu, SignatureVerificationException as _, AuthenticationSSOSucceededEventResponse as _a, FlagTarget as _c, AuthenticateWithOrganizationSelectionOptions as _d, ListEffectivePermissionsByExternalIdOptions as _f, ActionPayload as _i, RefreshSessionFailureReason as _l, DirectoryResponse as _m, DataIntegration as _n, InvitationAcceptedEventResponse as _o, ListResourcesForMembershipOptionsWithParentId as _p, CreateApplicationClientSecretOptions as _r, SessionCreatedEventResponse as _s, AuditLogActor as _t, CreateOrganizationMembershipOptions as _u, PublicWorkOS as a, AuthenticationPasskeyFailedEventResponse as aa, CreateGroupOptions as ac, UserResponse as ad, DirectoryUserResponse as af, AgentRegistrationStatus as ai, SendRadarSmsChallengeResponse as al, EnvironmentRole as am, DataIntegrationAccessTokenResponse as an, GroupCreatedEventResponse as ao, SerializedListRoleAssignmentsOptions as ap, ApplicationCredentialsListItemResponse as ar, PermissionCreatedEventResponse as as, DecryptDataKeyResponse as at, SerializedEnrollUserInMfaFactorOptions as au, NotFoundException as b, ConnectionDeactivatedEvent as ba, EvaluationContext as bc, AuthenticateWithRadarSmsChallengeOptions as bd, GroupRoleAssignmentEntry as bf, UserRegistrationActionPayload as bi, TerminalRefreshSessionFailureReason as bl, DirectoryType as bm, DataIntegrationCustomProvider as bn, InvitationResentEvent as bo, AuthorizationCheckOptionsWithResourceExternalId as bp, UpdateApplicationOptions as br, UnknownEvent as bs, CreateAuditLogEventRequestOptions as bt, SerializedCreateMagicAuthOptions as bu, PortalLinkResponseWire as c, AuthenticationPasswordFailedEvent as ca, SerializedAddGroupOrganizationMembershipOptions as cc, AuthenticateWithRefreshTokenPublicClientOptions as cd, ListOrganizationRolesResponse as cf, SerializedAgentRegistrationClaim as ci, SendInvitationOptions as cl, EnvironmentRoleResponse as cm, DataIntegrationAccessTokenResponseAccessTokenResponse as cn, GroupMemberAddedEvent as co, RoleAssignmentResourceResponse as cp, ConnectApplicationM2MResponse as cr, PermissionUpdatedEvent as cs, WidgetSessionTokenResponseWire as ct, EmailVerificationEventResponse as cu, IntentOptions as d, AuthenticationPasswordSucceededEventResponse as da, RuntimeClientOptions as dc, AuthenticateWithRefreshTokenOptions as dd, OrganizationRoleResponse as df, PKCEPair as di, SerializedRevokeSessionOptions as dl, ListDirectoriesOptions as dm, DataIntegrationCredentialsResponseCredentialResponse as dn, GroupMemberEventResponseData as do, RoleAssignmentSource as dp, ConnectApplicationResponse as dr, RoleCreatedEventResponse as ds, FeatureFlagsRuntimeClient as dt, SerializedCreateUserOptions as du, AuthenticationOAuthFailedEvent as ea, ListGroupOrganizationMembershipsOptions as ec, AuthenticationResponse as ed, ConnectionType as ef, AgentIdentity as ei, Session as el, SetEnvironmentRolePermissionsOptions as em, DataIntegrationsListResponseDataAuthMethods as en, FlagRuleUpdatedEvent as eo, SerializedAssignRoleOptions as ep, ListEventOptions as er, PasswordResetCreatedEvent as es, ReadObjectOptions as et, InvitationEvent as eu, IntentOptionsResponse as f, AuthenticationRadarRiskDetectedEvent as fa, RemoveFlagTargetOptions as fc, SerializedAuthenticateWithRefreshTokenOptions as fd, Role as ff, Actions as fi, serializeRevokeSessionOptions as fl, SerializedListDirectoriesOptions as fm, DataIntegrationAuthorizeUrlResponse as fn, GroupMemberRemovedEvent as fo, RoleAssignmentSourceResponse as fp, ConnectApplicationRedirectUri as fr, RoleDeletedEvent as fs, CookieSession as ft, CreateUserApiKeyOptions as fu, UnauthorizedException as g, AuthenticationSSOSucceededEvent as ga, FlagPollResponse as gc, AuthenticateUserWithOrganizationSelectionCredentials as gd, RoleResponse as gf, ActionContext as gi, SerializedResendInvitationOptions as gl, Directory as gm, ConnectedAccountAuthMethod as gn, InvitationAcceptedEvent as go, ListResourcesForMembershipOptionsWithParentExternalId as gp, DeleteClientSecretOptions as gr, SessionCreatedEvent as gs, SerializedCreateAuditLogSchemaOptions as gt, SerializedCreatePasswordResetOptions as gu, UnprocessableEntityException as h, AuthenticationSSOFailedEventResponse as ha, FlagPollEntry as hc, SerializedAuthenticateWithPasswordOptions as hd, RoleList as hf, UserRegistrationActionResponseData as hi, ResendInvitationOptions as hl, DirectoryGroupResponse as hm, ConnectedAccountResponse as hn, GroupUpdatedEventResponse as ho, ListResourcesForMembershipOptions as hp, ExternalAuthCompleteResponseWire as hr, RoleUpdatedEventResponse as hs, CreateAuditLogSchemaResponse as ht, CreatePasswordResetOptions as hu, PublicUserManagement as i, AuthenticationPasskeyFailedEvent as ia, DeleteGroupOptions as ic, User as id, DirectoryUser as if, AgentRegistrationKind as ii, SendRadarSmsChallengeOptions as il, SerializedCreateEnvironmentRoleOptions as im, DataIntegrationsListResponseDataConnectedAccountAuthMethod as in, GroupCreatedEvent as io, ListRoleAssignmentsOptions as ip, ApplicationCredentialsListItem as ir, PermissionCreatedEvent as is, DecryptDataKeyOptions as it, EnrollAuthFactorOptions as iu, Webhooks as j, DsyncGroupDeletedEventResponse as ja, ApiKey as jc, AuthenticateWithCodeAndVerifierOptions as jd, RemoveGroupRoleAssignmentsOptionsWithResourceId as jf, DomainDataState as ji, LogoutURLOptions as jl, GetUserConnectedAccountOptions as jn, OrganizationDomainCreatedEventResponse as jo, AuthorizationResourceResponse as jp, UserConsentOption as jr, VaultDataDeletedEvent as js, VerifyResponse as jt, FactorResponse as ju, WorkOSErrorData as k, DsyncGroupCreatedEventResponse as ka, CreateOrganizationApiKeyRequestOptions as kc, AuthenticateWithEmailVerificationOptions as kd, RemoveGroupRoleAssignmentsOptionsForOrganization as kf, SerializedCreateOrganizationOptions as ki, MagicAuthEventResponse as kl, ResponseHeaders as km, CreateUserConnectedAccountOptions as kn, OrganizationDeletedResponse as ko, SerializedListAuthorizationResourcesOptions as kp, ListApplicationsOptions as kr, VaultDataCreatedEvent as ks, AuditLogExportOptions as kt, AuthenticationFactorWithSecretsResponse as ku, GenerateLink as l, AuthenticationPasswordFailedEventResponse as la, RuntimeClientStats as lc, SerializedAuthenticateWithRefreshTokenPublicClientOptions as ld, OrganizationRoleEvent as lf, SerializedAgentRegistrationClaimCompletion as li, SerializedSendInvitationOptions as ll, ListDirectoryUsersOptions as lm, DataIntegrationCredentialsResponseError as ln, GroupMemberAddedEventResponse as lo, RoleAssignmentResponse as lp, ConnectApplicationOAuth as lr, PermissionUpdatedEventResponse as ls, CreateTokenOptions as lt, EmailVerificationResponse as lu, SSOIntentOptionsResponse as m, AuthenticationSSOFailedEvent as ma, FlagChange as mc, AuthenticateWithPasswordOptions as md, RoleEventResponse as mf, ResponsePayload as mi, SerializedResetPasswordOptions as ml, DirectoryGroup as mm, ConnectedAccount as mn, GroupUpdatedEvent as mo, ListMembershipsForResourceOptions as mp, ExternalAuthCompleteResponse as mr, RoleUpdatedEvent as ms, CreateAuditLogSchemaRequestOptions as mt, SerializedCreateUserApiKeyOptions as mu, PublicClientOptions as n, AuthenticationOAuthSucceededEvent as na, GroupResponse as nc, CreateUserResponse as nd, SSOPKCEAuthorizationURLResult as nf, AgentRegistrationClaim as ni, SessionStatus as nl, UpdateEnvironmentRoleOptions as nm, DataIntegrationsListResponseDataConnectedAccountResponse as nn, FlagUpdatedEvent as no, ListRoleAssignmentsForResourceOptions as np, NewConnectApplicationSecret as nr, PasswordResetSucceededEvent as ns, CreateObjectEntity as nt, InvitationResponse as nu, createWorkOS as o, AuthenticationPasskeySucceededEvent as oa, SerializedCreateGroupOptions as oc, Impersonator as od, DirectoryUserWithGroups as of, SerializedAgentIdentity as oi, SendRadarSmsChallengeResponseResponse as ol, EnvironmentRoleList as om, DataIntegrationAccessTokenResponseWire as on, GroupDeletedEvent as oo, RoleAssignment as op, ConnectApplication as or, PermissionDeletedEvent as os, CreateDataKeyOptions as ot, EmailVerification as ou, SSOIntentOptions as p, AuthenticationRadarRiskDetectedEventResponse as pa, ListFeatureFlagsOptions as pc, AuthenticateUserWithPasswordCredentials as pd, RoleEvent as pf, AuthenticationActionResponseData as pi, ResetPasswordOptions as pl, PaginationOptions as pm, DataIntegrationAuthorizeUrlResponseWire as pn, GroupMemberRemovedEventResponse as po, ListMembershipsForResourceByExternalIdOptions as pp, ConnectApplicationRedirectUriResponse as pr, RoleDeletedEventResponse as ps, CreateAuditLogSchemaOptions as pt, CreateUserApiKeyRequestOptions as pu, Actor as q, EventBase as qa, SerializedUpdateUserPasswordOptions as qc, ListConnectionsOptions as qd, RemoveRoleOptionsWithResourceExternalId as qf, AuthenticationEmailVerificationSucceededEventResponse as qi, OrganizationMembershipResponse as ql, DataIntegrationCredentialsDtoResponse as qn, OrganizationRoleCreatedEventResponse as qo, SetOrganizationRolePermissionsOptions as qp, ValidateAgentApiKeyOptions as qr, DataKey as qs, RadarStandaloneAssessRequestAction as qt, SerializedAuthenticateWithTotpOptions as qu, PublicSSO as r, AuthenticationOAuthSucceededEventResponse as ra, GetGroupOptions as rc, CreateUserResponseResponse as rd, DefaultCustomAttributes as rf, AgentRegistrationClaimCompletion as ri, SendVerificationEmailOptions as rl, CreateEnvironmentRoleOptions as rm, DataIntegrationsListResponseDataConnectedAccountState as rn, FlagUpdatedEventResponse as ro, SerializedListRoleAssignmentsForResourceOptions as rp, NewConnectApplicationSecretResponse as rr, PasswordResetSucceededEventResponse as rs, CreateObjectOptions as rt, Identity as ru, PortalLinkResponse as s, AuthenticationPasskeySucceededEventResponse as sa, AddGroupOrganizationMembershipOptions as sc, ImpersonatorResponse as sd, DirectoryUserWithGroupsResponse as sf, SerializedAgentRegistration as si, SerializedSendRadarSmsChallengeOptions as sl, EnvironmentRoleListResponse as sm, DataIntegrationAccessTokenResponseAccessToken as sn, GroupDeletedEventResponse as so, RoleAssignmentResource as sp, ConnectApplicationM2M as sr, PermissionDeletedEventResponse as ss, WidgetSessionTokenResponse as st, EmailVerificationEvent as su, ConfidentialClientOptions as t, AuthenticationOAuthFailedEventResponse as ta, Group as tc, AuthenticationResponseResponse as td, SSOAuthorizationURLOptions as tf, AgentRegistration as ti, SessionResponse as tl, SerializedUpdateEnvironmentRoleOptions as tm, DataIntegrationsListResponseDataConnectedAccount as tn, FlagRuleUpdatedEventResponse as to, ListRoleAssignmentsForResourceByExternalIdOptions as tp, SerializedListEventOptions as tr, PasswordResetCreatedEventResponse as ts, ReadObjectResponse as tt, InvitationEventResponse as tu, GenerateLinkResponse as u, AuthenticationPasswordSucceededEvent as ua, RuntimeClientLogger as uc, AuthenticateUserWithRefreshTokenCredentials as ud, OrganizationRoleEventResponse as uf, PKCE as ui, RevokeSessionOptions as ul, ListDirectoryGroupsOptions as um, DataIntegrationCredentialsResponseCredential as un, GroupMemberEventData as uo, RoleAssignmentRole as up, ConnectApplicationOAuthResponse as ur, RoleCreatedEvent as us, WidgetSessionTokenScopes as ut, CreateUserOptions as uu, RateLimitExceededException as v, ConnectionActivatedEvent as va, FeatureFlag as vc, SerializedAuthenticateWithOrganizationSelectionOptions as vd, ListEffectivePermissionsOptions as vf, UserData as vi, RefreshSessionResponse as vl, DirectoryState as vm, DataIntegrationResponse as vn, InvitationCreatedEvent as vo, SerializedListResourcesForMembershipOptions as vp, ListApplicationClientSecretsOptions as vr, SessionRevokedEvent as vs, AuditLogTarget as vt, SerializedCreateOrganizationMembershipOptions as vu, AuthenticationErrorCode as w, DsyncActivatedEvent as wa, ValidateApiKeyResponse as wc, SerializedAuthenticateWithRadarEmailChallengeOptions as wd, ReplaceGroupRoleAssignmentsOptions as wf, OrganizationResponse as wi, PasswordResetResponse as wl, HttpClientInterface as wm, DataIntegrationCredentialResponse as wn, MagicAuthCreatedEvent as wo, DeleteAuthorizationResourceOptions as wp, CreateM2MApplicationResponse as wr, UserDeletedEventResponse as ws, AuditLogSchemaMetadata as wt, AuthenticationRadarRiskDetectedEventResponseData as wu, NoApiKeyProvidedException as x, ConnectionDeactivatedEventResponse as xa, AddFlagTargetOptions as xc, SerializedAuthenticateWithRadarSmsChallengeOptions as xd, GroupRoleAssignmentEntryForOrganization as xf, SerializedUpdateOrganizationOptions as xi, PasswordReset as xl, EventDirectory as xm, DataIntegrationCustomProviderResponse as xn, InvitationResentEventResponse as xo, AuthorizationCheckOptionsWithResourceId as xp, GetApplicationOptions as xr, UserCreatedEvent as xs, SerializedCreateAuditLogEventOptions as xt, PKCEAuthorizationURLResult as xu, OauthException as y, ConnectionActivatedEventResponse as ya, FeatureFlagResponse as yc, AuthenticateUserWithRadarSmsChallengeCredentials as yd, BaseGroupRoleAssignmentEntry as yf, UserDataPayload as yi, RetryableRefreshSessionFailureReason as yl, DirectoryStateResponse as ym, DataIntegrationState as yn, InvitationCreatedEventResponse as yo, AuthorizationCheckOptions as yp, DeleteApplicationOptions as yr, SessionRevokedEventResponse as ys, CreateAuditLogEventOptions as yt, CreateMagicAuthOptions as yu, ObjectSummary as z, DsyncUserCreatedEventResponse as za, CreateOrganizationDomainOptions as zc, SerializedAuthenticateWithOptionsBase as zd, SerializedCreateGroupRoleAssignmentOptions as zf, ListResponse as zi, SerializedListSessionsOptions as zl, UpdateCustomProviderDefinitionResponse as zn, OrganizationDomainVerifiedEventResponse as zo, SerializedUpdatePermissionOptions as zp, AgentCredentialType as zr, VaultDekReadEvent as zs, RadarListEntryAlreadyPresentResponseWire as zt, Sms as zu };
+//# sourceMappingURL=factory-DmBBe791.d.cts.map