auth0 7.5.0 → 7.6.0

package/dist/esm/management/api/types/types.d.mts

@@ -1445,60 +1445,6 @@ export interface AttackProtectionCaptchaHcaptchaResponseContent {
     /** Accepts any additional properties */
     [key: string]: any;
 }
-/**
- * An attack protection policy override for CAPTCHA.
- */
-export interface AttackProtectionCaptchaPolicy {
-    /** System-generated identifier for the policy. */
-    id: string;
-    /** Human-readable policy name. */
-    name: string;
-    /** Description of the policy's purpose. */
-    description?: string | undefined;
-    /** Conflict resolution order. Lower number takes higher precedence. */
-    priority: number;
-    match: Management.AttackProtectionCaptchaPolicyMatch;
-    action: Management.AttackProtectionCaptchaPolicyAction;
-    /** ISO 8601 timestamp when the policy was created. */
-    created_at: string;
-    /** ISO 8601 timestamp when the policy was last updated. */
-    updated_at: string;
-}
-/**
- * CAPTCHA configuration override stored for this policy.
- */
-export interface AttackProtectionCaptchaPolicyAction {
-    active_provider_id?: Management.CaptchaActiveProviderEnum | undefined;
-    simple_captcha?: Management.CaptchaPolicyActionSimpleCaptcha | undefined;
-    auth_challenge?: Management.CaptchaPolicyActionAuthChallenge | undefined;
-    recaptcha_v2?: Management.CaptchaPolicyActionRecaptchaV2 | undefined;
-    recaptcha_enterprise?: Management.CaptchaPolicyActionRecaptchaEnterprise | undefined;
-    hcaptcha?: Management.CaptchaPolicyActionHcaptcha | undefined;
-    friendly_captcha?: Management.CaptchaPolicyActionFriendlyCaptcha | undefined;
-    arkose?: Management.CaptchaPolicyActionArkose | undefined;
-}
-/**
- * CAPTCHA configuration override for this policy.
- */
-export interface AttackProtectionCaptchaPolicyActionInput {
-    active_provider_id?: Management.CaptchaActiveProviderEnum | undefined;
-    simple_captcha?: Management.CaptchaPolicyActionSimpleCaptcha | undefined;
-    auth_challenge?: Management.CaptchaPolicyActionAuthChallenge | undefined;
-    recaptcha_v2?: Management.CaptchaPolicyActionRecaptchaV2Input | undefined;
-    recaptcha_enterprise?: Management.CaptchaPolicyActionRecaptchaEnterpriseInput | undefined;
-    hcaptcha?: Management.CaptchaPolicyActionHcaptchaInput | undefined;
-    friendly_captcha?: Management.CaptchaPolicyActionFriendlyCaptchaInput | undefined;
-    arkose?: Management.CaptchaPolicyActionArkoseInput | undefined;
-}
-/**
- * Traffic matching criteria for the policy. Exactly one of auth0_managed or geo_country_codes must be specified.
- */
-export interface AttackProtectionCaptchaPolicyMatch {
-    /** Match by Auth0-managed traffic identifiers. */
-    auth0_managed?: string[] | undefined;
-    /** Match by ISO 3166-1 alpha-2 country codes. */
-    geo_country_codes?: string[] | undefined;
-}
 /** The id of the active provider for the CAPTCHA. */
 export declare const AttackProtectionCaptchaProviderId: {
     readonly Arkose: "arkose";
@@ -2011,125 +1957,6 @@ export interface BulkUpdateAculResponseContent {
     /** Accepts any additional properties */
     [key: string]: any;
 }
-/** The CAPTCHA provider type. */
-export declare const CaptchaActiveProviderEnum: {
-    readonly SimpleCaptcha: "simple_captcha";
-    readonly AuthChallenge: "auth_challenge";
-    readonly RecaptchaV2: "recaptcha_v2";
-    readonly RecaptchaEnterprise: "recaptcha_enterprise";
-    readonly Hcaptcha: "hcaptcha";
-    readonly FriendlyCaptcha: "friendly_captcha";
-    readonly Arkose: "arkose";
-};
-export type CaptchaActiveProviderEnum = (typeof CaptchaActiveProviderEnum)[keyof typeof CaptchaActiveProviderEnum];
-/**
- * Arkose Labs provider configuration.
- */
-export interface CaptchaPolicyActionArkose {
-    /** The Arkose Labs site key. */
-    site_key?: string | undefined;
-    /** The Arkose Labs client subdomain. */
-    client_subdomain?: string | undefined;
-    /** The Arkose Labs verify subdomain. */
-    verify_subdomain?: string | undefined;
-    /** Whether to allow access when Arkose Labs is unavailable. */
-    fail_open?: boolean | undefined;
-}
-/**
- * Arkose Labs provider configuration.
- */
-export interface CaptchaPolicyActionArkoseInput {
-    /** The Arkose Labs site key. */
-    site_key?: string | undefined;
-    /** The Arkose Labs private key. Encrypted at rest. */
-    secret?: string | undefined;
-    /** The Arkose Labs client subdomain. */
-    client_subdomain?: string | undefined;
-    /** The Arkose Labs verify subdomain. */
-    verify_subdomain?: string | undefined;
-    /** Whether to allow access when Arkose Labs is unavailable. */
-    fail_open?: boolean | undefined;
-}
-/**
- * Auth Challenge CAPTCHA provider configuration.
- */
-export interface CaptchaPolicyActionAuthChallenge {
-    /** Whether to allow access when the challenge provider is unavailable. */
-    fail_open?: boolean | undefined;
-}
-/**
- * Friendly Captcha provider configuration.
- */
-export interface CaptchaPolicyActionFriendlyCaptcha {
-    /** The Friendly Captcha site key. */
-    site_key?: string | undefined;
-}
-/**
- * Friendly Captcha provider configuration.
- */
-export interface CaptchaPolicyActionFriendlyCaptchaInput {
-    /** The Friendly Captcha site key. */
-    site_key?: string | undefined;
-    /** The Friendly Captcha secret key. Encrypted at rest. */
-    secret?: string | undefined;
-}
-/**
- * hCaptcha provider configuration.
- */
-export interface CaptchaPolicyActionHcaptcha {
-    /** The hCaptcha site key. */
-    site_key?: string | undefined;
-}
-/**
- * hCaptcha provider configuration.
- */
-export interface CaptchaPolicyActionHcaptchaInput {
-    /** The hCaptcha site key. */
-    site_key?: string | undefined;
-    /** The hCaptcha secret key. Encrypted at rest. */
-    secret?: string | undefined;
-}
-/**
- * reCAPTCHA Enterprise provider configuration.
- */
-export interface CaptchaPolicyActionRecaptchaEnterprise {
-    /** The reCAPTCHA Enterprise site key. */
-    site_key?: string | undefined;
-    /** The Google Cloud project ID. */
-    project_id?: string | undefined;
-}
-/**
- * reCAPTCHA Enterprise provider configuration.
- */
-export interface CaptchaPolicyActionRecaptchaEnterpriseInput {
-    /** The reCAPTCHA Enterprise site key. */
-    site_key?: string | undefined;
-    /** The Google Cloud project ID. */
-    project_id?: string | undefined;
-    /** The reCAPTCHA Enterprise API key. Encrypted at rest. */
-    api_key?: string | undefined;
-}
-/**
- * reCAPTCHA v2 provider configuration.
- */
-export interface CaptchaPolicyActionRecaptchaV2 {
-    /** The reCAPTCHA v2 site key. */
-    site_key?: string | undefined;
-}
-/**
- * reCAPTCHA v2 provider configuration.
- */
-export interface CaptchaPolicyActionRecaptchaV2Input {
-    /** The reCAPTCHA v2 site key. */
-    site_key?: string | undefined;
-    /** The reCAPTCHA v2 secret key. Encrypted at rest. */
-    secret?: string | undefined;
-}
-/**
- * Simple CAPTCHA provider configuration.
- */
-export interface CaptchaPolicyActionSimpleCaptcha {
-}
 export interface CertificateSubjectDnCredential {
     credential_type: Management.CertificateSubjectDnCredentialTypeEnum;
     /** Friendly name for a credential. */
@@ -6301,7 +6128,7 @@ export interface ConnectionPropertiesOptions {
     /** Enable this if you have a legacy user store and you want to gradually migrate those users to the Auth0 user store */
     import_mode?: boolean | undefined;
     /** Stores encrypted string only configurations for connections */
-    configuration?: (Record<string, string | null> | null) | undefined;
+    configuration?: (Record<string, (string | null) | undefined> | null) | undefined;
     customScripts?: Management.ConnectionCustomScripts | undefined;
     authentication_methods?: (Management.ConnectionAuthenticationMethods | null) | undefined;
     passkey_options?: (Management.ConnectionPasskeyOptions | null) | undefined;
@@ -7611,7 +7438,7 @@ export type ConnectionUpstreamAliasEnum = (typeof ConnectionUpstreamAliasEnum)[k
 /**
  * Options for adding parameters in the request to the upstream IdP
  */
-export type ConnectionUpstreamParams = (Record<string, Management.ConnectionUpstreamAdditionalProperties | null> | null) | undefined;
+export type ConnectionUpstreamParams = (Record<string, (Management.ConnectionUpstreamAdditionalProperties | null) | undefined> | null) | undefined;
 /**
  * Options for adding parameters in the request to the upstream IdP. See https://auth0.com/docs/authenticate/identity-providers/pass-parameters-to-idps
  */
@@ -7688,7 +7515,7 @@ export type ConnectionsDiscoveryUrl = (string | null) | undefined;
 /**
  * Metadata associated with the connection in the form of an object with string values (max 255 chars).  Maximum of 10 metadata properties allowed.
  */
-export type ConnectionsMetadata = Record<string, string | null>;
+export type ConnectionsMetadata = Record<string, (string | null) | undefined>;
 /**
  * Additional OIDC metadata to include in the discovery document. Only applicable when strategy=oidc, okta, or samlp.
  */
@@ -8993,6 +8820,7 @@ export interface CreateExperimentResponseContent {
     authentication_flow: string;
     allocation_strategy: Management.AllocationStrategyEnum;
     status: Management.ExperimentStatusEnum;
+    /** Whether the experiment is valid and ready to activate, as of its last update. It can lag changes made later to related entities. Call POST /experiments/{id}/validate for the current result. */
     is_valid: boolean;
     default_config?: Management.DefaultConfigEnum | undefined;
     feature_flag_snapshot?: (Record<string, unknown> | null) | undefined;
@@ -10440,7 +10268,7 @@ export type DomainCertificateStatusEnum = (typeof DomainCertificateStatusEnum)[k
 /**
  * Domain metadata associated with the custom domain, in the form of an object with string values (max 255 chars). Maximum of 10 domain metadata properties allowed.
  */
-export type DomainMetadata = Record<string, string | null>;
+export type DomainMetadata = Record<string, (string | null) | undefined>;
 /**
  * Domain verification settings.
  */
@@ -19274,6 +19102,7 @@ export interface EventStreamCloudEventContext {
     connection?: Management.EventStreamCloudEventContextConnection | undefined;
     request?: Management.EventStreamCloudEventContextRequest | undefined;
     tenant: Management.EventStreamCloudEventContextTenant;
+    transaction?: Management.EventStreamCloudEventContextTransaction | undefined;
 }
 /**
  * The OAuth Client requesting or presenting an access token.
@@ -19346,6 +19175,64 @@ export interface EventStreamCloudEventContextTenant {
     /** User-provided tenant identifier. */
     id: string;
 }
+/**
+ * An auth transaction.
+ */
+export interface EventStreamCloudEventContextTransaction {
+    /** acr_values in the request. */
+    acr_values: string[];
+    /** The locale used for this transaction. */
+    locale: string;
+    /** Hint about the login identifier the user might use in this transaction. */
+    login_hint?: string | undefined;
+    /** Instructions indicating whether the user may be prompted for re-authentication and consent. */
+    prompt?: string[] | undefined;
+    protocol?: Management.EventStreamCloudEventContextTransactionProtocolEnum | undefined;
+    /** The URL to which the client will be redirected when the transaction completes. */
+    redirect_uri?: string | undefined;
+    /** The scopes requested. */
+    requested_scopes: string[];
+    response_mode?: Management.EventStreamCloudEventContextTransactionResponseModeEnum | undefined;
+    /** The kind of credential issued by this transaction. */
+    response_type?: Management.EventStreamCloudEventContextTransactionResponseTypeItemEnum[] | undefined;
+    /** The OAuth state parameter for this transaction. */
+    state?: string | undefined;
+    /** The ui_locales requested for this transaction. */
+    ui_locales: string[];
+}
+/** The protocol used for this transaction. */
+export declare const EventStreamCloudEventContextTransactionProtocolEnum: {
+    readonly OidcBasicProfile: "oidc-basic-profile";
+    readonly OidcImplicitProfile: "oidc-implicit-profile";
+    readonly Oauth2DeviceCode: "oauth2-device-code";
+    readonly Oauth2ResourceOwner: "oauth2-resource-owner";
+    readonly Oauth2ResourceOwnerJwtBearer: "oauth2-resource-owner-jwt-bearer";
+    readonly Oauth2Password: "oauth2-password";
+    readonly Oauth2Webauthn: "oauth2-webauthn";
+    readonly Oauth2AccessToken: "oauth2-access-token";
+    readonly Oauth2RefreshToken: "oauth2-refresh-token";
+    readonly Oauth2TokenExchange: "oauth2-token-exchange";
+    readonly OidcHybridProfile: "oidc-hybrid-profile";
+    readonly Samlp: "samlp";
+    readonly Wsfed: "wsfed";
+    readonly WstrustUsernamemixed: "wstrust-usernamemixed";
+};
+export type EventStreamCloudEventContextTransactionProtocolEnum = (typeof EventStreamCloudEventContextTransactionProtocolEnum)[keyof typeof EventStreamCloudEventContextTransactionProtocolEnum];
+/** This transaction's method for returning parameters from the Authorization Endpoint. */
+export declare const EventStreamCloudEventContextTransactionResponseModeEnum: {
+    readonly Query: "query";
+    readonly Fragment: "fragment";
+    readonly FormPost: "form_post";
+    readonly WebMessage: "web_message";
+};
+export type EventStreamCloudEventContextTransactionResponseModeEnum = (typeof EventStreamCloudEventContextTransactionResponseModeEnum)[keyof typeof EventStreamCloudEventContextTransactionResponseModeEnum];
+/** OAuth/OIDC response types. */
+export declare const EventStreamCloudEventContextTransactionResponseTypeItemEnum: {
+    readonly Code: "code";
+    readonly Token: "token";
+    readonly IdToken: "id_token";
+};
+export type EventStreamCloudEventContextTransactionResponseTypeItemEnum = (typeof EventStreamCloudEventContextTransactionResponseTypeItemEnum)[keyof typeof EventStreamCloudEventContextTransactionResponseTypeItemEnum];
 /**
  * Event contents.
  */
@@ -24988,6 +24875,7 @@ export interface ExperimentListItem {
     authentication_flow: string;
     allocation_strategy: Management.AllocationStrategyEnum;
     status: Management.ExperimentStatusEnum;
+    /** Whether the experiment is valid and ready to activate, as of its last update. It can lag changes made later to related entities. Call POST /experiments/{id}/validate for the current result. */
     is_valid: boolean;
     default_config?: Management.DefaultConfigEnum | undefined;
     feature_flag_snapshot?: (Record<string, unknown> | null) | undefined;
@@ -25422,7 +25310,7 @@ export type FlowActionAuth0SendRequestParamsCustomVars = Record<string, unknown>
 export type FlowActionAuth0SendRequestParamsHeaders = Record<string, unknown>;
 export type FlowActionAuth0SendRequestParamsPayload = string | unknown[] | Management.FlowActionAuth0SendRequestParamsPayloadObject;
 export type FlowActionAuth0SendRequestParamsPayloadObject = Record<string, unknown>;
-export type FlowActionAuth0SendRequestParamsQueryParams = Record<string, FlowActionAuth0SendRequestParamsQueryParams.Value | null>;
+export type FlowActionAuth0SendRequestParamsQueryParams = Record<string, (FlowActionAuth0SendRequestParamsQueryParams.Value | null) | undefined>;
 export declare namespace FlowActionAuth0SendRequestParamsQueryParams {
     type Value = number | string;
 }
@@ -25839,7 +25727,7 @@ export interface FlowActionHttpSendRequestParamsBasicAuth {
 export type FlowActionHttpSendRequestParamsHeaders = Record<string, unknown>;
 export type FlowActionHttpSendRequestParamsPayload = string | unknown[] | Management.FlowActionHttpSendRequestParamsPayloadObject;
 export type FlowActionHttpSendRequestParamsPayloadObject = Record<string, unknown>;
-export type FlowActionHttpSendRequestParamsQueryParams = Record<string, FlowActionHttpSendRequestParamsQueryParams.Value | null>;
+export type FlowActionHttpSendRequestParamsQueryParams = Record<string, (FlowActionHttpSendRequestParamsQueryParams.Value | null) | undefined>;
 export declare namespace FlowActionHttpSendRequestParamsQueryParams {
     type Value = number | string;
 }
@@ -28564,6 +28452,7 @@ export interface GetExperimentResponseContent {
     authentication_flow: string;
     allocation_strategy: Management.AllocationStrategyEnum;
     status: Management.ExperimentStatusEnum;
+    /** Whether the experiment is valid and ready to activate, as of its last update. It can lag changes made later to related entities. Call POST /experiments/{id}/validate for the current result. */
     is_valid: boolean;
     default_config?: Management.DefaultConfigEnum | undefined;
     feature_flag_snapshot?: (Record<string, unknown> | null) | undefined;
@@ -29625,7 +29514,7 @@ export interface GuardianFactor {
     name?: Management.GuardianFactorNameEnum | undefined;
     settings?: Management.GuardianFactorSettings | undefined;
 }
-/** Factor name. Can be `sms`, `push-notification`, `email`, `duo` `otp` `webauthn-roaming`, `webauthn-platform`, or `recovery-code`. */
+/** Factor name. Can be `sms`, `push-notification`, `email`, `duo`, `otp`, `webauthn-roaming`, `webauthn-platform`, `recovery-code`, or `passkey`. */
 export declare const GuardianFactorNameEnum: {
     readonly PushNotification: "push-notification";
     readonly Sms: "sms";
@@ -29635,6 +29524,7 @@ export declare const GuardianFactorNameEnum: {
     readonly WebauthnRoaming: "webauthn-roaming";
     readonly WebauthnPlatform: "webauthn-platform";
     readonly RecoveryCode: "recovery-code";
+    readonly Passkey: "passkey";
 };
 export type GuardianFactorNameEnum = (typeof GuardianFactorNameEnum)[keyof typeof GuardianFactorNameEnum];
 export declare const GuardianFactorPhoneFactorMessageTypeEnum: {
@@ -29991,10 +29881,6 @@ export interface ListAgentsResponseContent {
     /** A cursor to be used as the "from" query parameter for the next page of results. Omitted when there are no further results. */
     next?: string | undefined;
 }
-/**
- * List of CAPTCHA attack protection policies for the tenant, sorted by priority ascending.
- */
-export type ListAttackProtectionCaptchaPoliciesResponseContent = Management.AttackProtectionCaptchaPolicy[];
 export interface ListBrandingPhoneProvidersResponseContent {
     providers?: Management.PhoneProviderSchemaMasked[] | undefined;
 }
@@ -31387,7 +31273,7 @@ export interface OrganizationMemberRole {
 /**
  * Metadata associated with the organization, in the form of an object with string values (max 255 chars). Maximum of 25 metadata properties allowed.
  */
-export type OrganizationMetadata = Record<string, string | null>;
+export type OrganizationMetadata = Record<string, (string | null) | undefined>;
 /** Field name to sort results by in ascending order only. Defaults to insertion order (oldest first) if not provided. */
 export declare const OrganizationSortFieldEnum: {
     readonly Name: "name";
@@ -34219,7 +34105,7 @@ export interface UpdateConnectionOptions {
     /** Enable this if you have a legacy user store and you want to gradually migrate those users to the Auth0 user store */
     import_mode?: boolean | undefined;
     /** Stores encrypted string only configurations for connections */
-    configuration?: (Record<string, string | null> | null) | undefined;
+    configuration?: (Record<string, (string | null) | undefined> | null) | undefined;
     customScripts?: Management.ConnectionCustomScripts | undefined;
     authentication_methods?: (Management.ConnectionAuthenticationMethods | null) | undefined;
     passkey_options?: (Management.ConnectionPasskeyOptions | null) | undefined;
@@ -34772,6 +34658,7 @@ export interface UpdateExperimentResponseContent {
     authentication_flow: string;
     allocation_strategy: Management.AllocationStrategyEnum;
     status: Management.ExperimentStatusEnum;
+    /** Whether the experiment is valid and ready to activate, as of its last update. It can lag changes made later to related entities. Call POST /experiments/{id}/validate for the current result. */
     is_valid: boolean;
     default_config?: Management.DefaultConfigEnum | undefined;
     feature_flag_snapshot?: (Record<string, unknown> | null) | undefined;
@@ -35345,9 +35232,9 @@ export interface UpdateUserResponseContent {
     [key: string]: any;
 }
 /**
- * Configuration overrides for this variation; keys must exist in the parent flag parameters. Empty {} is the baseline (control) variation that overrides nothing.
+ * Top-level keys merge into the stored overrides. Set a key to `null` to remove it. Set `overrides` to `null` or `{}` to clear all. Keys must exist in the parent flag parameters.
  */
-export type UpdateVariationOverridesMap = Record<string, unknown>;
+export type UpdateVariationOverridesMap = (Record<string, unknown> | null) | undefined;
 export interface UpdateVariationResponseContent {
     id: string;
     feature_flag_id: string;

package/dist/esm/management/api/types/types.mjs

@@ -1059,16 +1059,6 @@ export const BruteForceProtectionShieldsEnum = {
     Block: "block",
     UserNotification: "user_notification",
 };
-/** The CAPTCHA provider type. */
-export const CaptchaActiveProviderEnum = {
-    SimpleCaptcha: "simple_captcha",
-    AuthChallenge: "auth_challenge",
-    RecaptchaV2: "recaptcha_v2",
-    RecaptchaEnterprise: "recaptcha_enterprise",
-    Hcaptcha: "hcaptcha",
-    FriendlyCaptcha: "friendly_captcha",
-    Arkose: "arkose",
-};
 export const CertificateSubjectDnCredentialTypeEnum = {
     CertSubjectDn: "cert_subject_dn",
 };
@@ -4231,6 +4221,36 @@ export const EventStreamCloudEventConnectionUpdatedPreviousObject7StrategyEnum =
 export const EventStreamCloudEventConnectionUpdatedTypeEnum = {
     ConnectionUpdated: "connection.updated",
 };
+/** The protocol used for this transaction. */
+export const EventStreamCloudEventContextTransactionProtocolEnum = {
+    OidcBasicProfile: "oidc-basic-profile",
+    OidcImplicitProfile: "oidc-implicit-profile",
+    Oauth2DeviceCode: "oauth2-device-code",
+    Oauth2ResourceOwner: "oauth2-resource-owner",
+    Oauth2ResourceOwnerJwtBearer: "oauth2-resource-owner-jwt-bearer",
+    Oauth2Password: "oauth2-password",
+    Oauth2Webauthn: "oauth2-webauthn",
+    Oauth2AccessToken: "oauth2-access-token",
+    Oauth2RefreshToken: "oauth2-refresh-token",
+    Oauth2TokenExchange: "oauth2-token-exchange",
+    OidcHybridProfile: "oidc-hybrid-profile",
+    Samlp: "samlp",
+    Wsfed: "wsfed",
+    WstrustUsernamemixed: "wstrust-usernamemixed",
+};
+/** This transaction's method for returning parameters from the Authorization Endpoint. */
+export const EventStreamCloudEventContextTransactionResponseModeEnum = {
+    Query: "query",
+    Fragment: "fragment",
+    FormPost: "form_post",
+    WebMessage: "web_message",
+};
+/** OAuth/OIDC response types. */
+export const EventStreamCloudEventContextTransactionResponseTypeItemEnum = {
+    Code: "code",
+    Token: "token",
+    IdToken: "id_token",
+};
 /** Machine-readable error code. */
 export const EventStreamCloudEventErrorCodeEnum = {
     InvalidCursor: "invalid_cursor",
@@ -6352,7 +6372,7 @@ export const GuardianEnrollmentStatus = {
     Pending: "pending",
     Confirmed: "confirmed",
 };
-/** Factor name. Can be `sms`, `push-notification`, `email`, `duo` `otp` `webauthn-roaming`, `webauthn-platform`, or `recovery-code`. */
+/** Factor name. Can be `sms`, `push-notification`, `email`, `duo`, `otp`, `webauthn-roaming`, `webauthn-platform`, `recovery-code`, or `passkey`. */
 export const GuardianFactorNameEnum = {
     PushNotification: "push-notification",
     Sms: "sms",
@@ -6362,6 +6382,7 @@ export const GuardianFactorNameEnum = {
     WebauthnRoaming: "webauthn-roaming",
     WebauthnPlatform: "webauthn-platform",
     RecoveryCode: "recovery-code",
+    Passkey: "passkey",
 };
 export const GuardianFactorPhoneFactorMessageTypeEnum = {
     Sms: "sms",

package/dist/esm/management/core/fetcher/Fetcher.mjs

@@ -14,11 +14,13 @@ import { EndpointSupplier } from "./EndpointSupplier.mjs";
 import { getErrorResponseBody } from "./getErrorResponseBody.mjs";
 import { getFetchFn } from "./getFetchFn.mjs";
 import { getRequestBody } from "./getRequestBody.mjs";
-import { getResponseBody } from "./getResponseBody.mjs";
+import { getResponseBody, isResponseBodyError } from "./getResponseBody.mjs";
 import { Headers } from "./Headers.mjs";
-import { makeRequest } from "./makeRequest.mjs";
+import { clearResponseTimeout, makeRequest } from "./makeRequest.mjs";
 import { abortRawResponse, toRawResponse, unknownRawResponse } from "./RawResponse.mjs";
+import { redactUrl, SENSITIVE_QUERY_PARAMS } from "./redactUrl.mjs";
 import { requestWithRetries } from "./requestWithRetries.mjs";
+import { TIMEOUT } from "./signals.mjs";
 const SENSITIVE_HEADERS = new Set([
     "authorization",
     "www-authenticate",
@@ -49,26 +51,6 @@ function redactHeaders(headers) {
     }
     return filtered;
 }
-const SENSITIVE_QUERY_PARAMS = new Set([
-    "api_key",
-    "api-key",
-    "apikey",
-    "token",
-    "access_token",
-    "access-token",
-    "auth_token",
-    "auth-token",
-    "password",
-    "passwd",
-    "secret",
-    "api_secret",
-    "api-secret",
-    "apisecret",
-    "key",
-    "session",
-    "session_id",
-    "session-id",
-]);
 function redactQueryParameters(queryParameters) {
     if (queryParameters == null) {
         return undefined;
@@ -79,70 +61,6 @@ function redactQueryParameters(queryParameters) {
     }
     return redacted;
 }
-function redactUrl(url) {
-    const protocolIndex = url.indexOf("://");
-    if (protocolIndex === -1)
-        return url;
-    const afterProtocol = protocolIndex + 3;
-    // Find the first delimiter that marks the end of the authority section
-    const pathStart = url.indexOf("/", afterProtocol);
-    let queryStart = url.indexOf("?", afterProtocol);
-    let fragmentStart = url.indexOf("#", afterProtocol);
-    const firstDelimiter = Math.min(pathStart === -1 ? url.length : pathStart, queryStart === -1 ? url.length : queryStart, fragmentStart === -1 ? url.length : fragmentStart);
-    // Find the LAST @ before the delimiter (handles multiple @ in credentials)
-    let atIndex = -1;
-    for (let i = afterProtocol; i < firstDelimiter; i++) {
-        if (url[i] === "@") {
-            atIndex = i;
-        }
-    }
-    if (atIndex !== -1) {
-        url = `${url.slice(0, afterProtocol)}[REDACTED]@${url.slice(atIndex + 1)}`;
-    }
-    // Recalculate queryStart since url might have changed
-    queryStart = url.indexOf("?");
-    if (queryStart === -1)
-        return url;
-    fragmentStart = url.indexOf("#", queryStart);
-    const queryEnd = fragmentStart !== -1 ? fragmentStart : url.length;
-    const queryString = url.slice(queryStart + 1, queryEnd);
-    if (queryString.length === 0)
-        return url;
-    // FAST PATH: Quick check if any sensitive keywords present
-    // Using indexOf is faster than regex for simple substring matching
-    const lower = queryString.toLowerCase();
-    const hasSensitive = lower.includes("token") ||
-        lower.includes("key") ||
-        lower.includes("password") ||
-        lower.includes("passwd") ||
-        lower.includes("secret") ||
-        lower.includes("session") ||
-        lower.includes("auth");
-    if (!hasSensitive) {
-        return url;
-    }
-    // SLOW PATH: Parse and redact
-    const redactedParams = [];
-    const params = queryString.split("&");
-    for (const param of params) {
-        const equalIndex = param.indexOf("=");
-        if (equalIndex === -1) {
-            redactedParams.push(param);
-            continue;
-        }
-        const key = param.slice(0, equalIndex);
-        let shouldRedact = SENSITIVE_QUERY_PARAMS.has(key.toLowerCase());
-        if (!shouldRedact && key.includes("%")) {
-            try {
-                const decodedKey = decodeURIComponent(key);
-                shouldRedact = SENSITIVE_QUERY_PARAMS.has(decodedKey.toLowerCase());
-            }
-            catch (_a) { }
-        }
-        redactedParams.push(shouldRedact ? `${key}=[REDACTED]` : param);
-    }
-    return url.slice(0, queryStart + 1) + redactedParams.join("&") + url.slice(queryEnd);
-}
 function getHeaders(args) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a;
@@ -174,6 +92,11 @@ function getHeaders(args) {
         return newHeaders;
     });
 }
+function isJsonContentType(contentType) {
+    var _a, _b;
+    const mediaType = (_b = (_a = contentType === null || contentType === void 0 ? void 0 : contentType.split(";")[0]) === null || _a === void 0 ? void 0 : _a.trim().toLowerCase()) !== null && _b !== void 0 ? _b : "";
+    return mediaType === "application/json" || mediaType === "text/json" || mediaType.endsWith("+json");
+}
 export function fetcherImpl(args) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a, _b, _c;
@@ -201,10 +124,19 @@ export function fetcherImpl(args) {
             };
             logger.debug("Making HTTP request", metadata);
         }
+        // Bodies that are read in full here stay covered by the timeout; streamed bodies are read by the caller.
+        const keepTimeoutUntilBodyRead = args.responseType !== "streaming" && args.responseType !== "sse" && args.responseType !== "binary-response";
+        const attemptResponses = [];
         try {
             const response = yield requestWithRetries(() => __awaiter(this, void 0, void 0, function* () {
-                return makeRequest(fetchFn, url, args.method, headers, requestBody, args.timeoutMs, args.abortSignal, args.withCredentials, args.duplex, args.responseType === "streaming" || args.responseType === "sse");
-            }), args.maxRetries);
+                // A retry means the previous attempt is over; stop its timer now rather than at the end.
+                for (const previousResponse of attemptResponses) {
+                    clearResponseTimeout(previousResponse);
+                }
+                const attemptResponse = yield makeRequest(fetchFn, url, args.method, headers, requestBody, args.timeoutMs, args.abortSignal, args.withCredentials, args.duplex, args.responseType === "streaming" || args.responseType === "sse", keepTimeoutUntilBodyRead);
+                attemptResponses.push(attemptResponse);
+                return attemptResponse;
+            }), args.maxRetries, args.abortSignal);
             if (response.status >= 200 && response.status < 400) {
                 if (logger.isDebug()) {
                     const metadata = {
@@ -216,6 +148,16 @@ export function fetcherImpl(args) {
                     logger.debug("HTTP request succeeded", metadata);
                 }
                 const body = yield getResponseBody(response, args.responseType);
+                // Only a body the server labelled as JSON is an error here; void endpoints may return plain text.
+                if (isResponseBodyError(body) &&
+                    body.error.reason === "non-json" &&
+                    isJsonContentType(response.headers.get("Content-Type"))) {
+                    return {
+                        ok: false,
+                        error: body.error,
+                        rawResponse: toRawResponse(response),
+                    };
+                }
                 return {
                     ok: true,
                     body: body,
@@ -263,7 +205,7 @@ export function fetcherImpl(args) {
                     rawResponse: abortRawResponse,
                 };
             }
-            else if (error instanceof Error && error.name === "AbortError") {
+            else if (error === TIMEOUT || (error instanceof Error && error.name === "AbortError")) {
                 if (logger.isError()) {
                     const metadata = {
                         method: args.method,
@@ -318,6 +260,11 @@ export function fetcherImpl(args) {
                 rawResponse: unknownRawResponse,
             };
         }
+        finally {
+            for (const attemptResponse of attemptResponses) {
+                clearResponseTimeout(attemptResponse);
+            }
+        }
     });
 }
 export const fetcher = fetcherImpl;