align blueprint import schema with 200 result response

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Marc 'risson' Schmitt <marc.schmitt@risson.space>

.github/actions/setup/action.yml

@@ -49,7 +49,7 @@ runs:
       if: ${{ contains(inputs.dependencies, 'python') }}
       shell: bash
       working-directory: ${{ inputs.working-directory }}
-      run: uv sync --all-extras --dev --frozen
+      run: uv sync --all-extras --dev --locked
     - name: Setup rust (stable)
       if: ${{ contains(inputs.dependencies, 'rust') && !contains(inputs.dependencies, 'rust-nightly') }}
       uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1
@@ -64,7 +64,7 @@ runs:
         rustflags: ""
     - name: Setup rust dependencies
       if: ${{ contains(inputs.dependencies, 'rust') }}
-      uses: taiki-e/install-action@b5fddbb5361bce8a06fb168c9d403a6cc552b084 # v2
+      uses: taiki-e/install-action@db5fb34fa772531a3ece57ca434f579eb334e0fb # v2
       with:
         tool: cargo-deny cargo-machete cargo-llvm-cov nextest
     - name: Setup node (web)

AGENTS.md

@@ -1,109 +0,0 @@
-# AGENTS.md
-
-This is **authentik** — an open-source Identity Provider. The codebase spans a
-Django backend, Go outposts, Rust components, and a Lit/TS web UI, with pieces
-wired together through Django signals, Channels, blueprints, flow plans, and a
-generated API client. It's a lot of moving parts. Before changing something
-non-trivial, pause to think about what else touches it: a model edit can ripple
-through serializers, signals, blueprints, and the generated TS client.
-
-## Commits
-
-Format the subject as `area: short message`. Skip the long body unless
-something genuinely needs explaining. The `area` is wherever you worked, e.g.:
-
-- `root:` — repo-wide changes
-- `core:` — `authentik/core` and dependency bumps
-- `api:` — API surface
-- `web:`, `web/admin:`, `web/flows:`, `web/stages:` — frontend
-- `website:`, `website/docs:`, `website/integrations:`
-- `stages/invitation:`, `providers/oauth2:`, `providers/oauth:` — feature modules
-- `enterprise/providers/ssf:`
-- `lifecycle/worker_process:`
-- `tenants:`, `ci:`, `docs:`, `translate:`
-
-When the user gives you a PR or issue for the bug being fixed, add a
-`Closes: #NNN` trailer on its own line — don't tack `(#NNN)` onto the subject.
-
-**Never** include customer information or any potentially sensitive *content*
-taken from internal sources — verbatim or reworded — anywhere in the repo
-(code, comments, commit messages, PR descriptions, docs) unless explicitly
-allowed. This covers customer names, support ticket contents, quoted Slack
-messages, private incident details, and similar.
-
-Links are fine. A Slack permalink, a GitHub issue link, or an internal ticket
-URL in a commit message or PR description is good context — it's the
-sensitive *content* that must not be copied into the repo. When in doubt,
-leave the content out and link instead.
-
-A commit should be a finished, working unit. Don't commit half-done work.
-Before committing, run whatever applies:
-
-- `make lint-fix`
-- `make gen` if you touched models or serializers
-- `make web` if you touched `web/`
-- `make docs` if you touched `website/docs/`
-- `make integrations` if you touched `website/integrations/`
-- `./manage.py makemigrations --check` — no pending migrations
-
-The `Makefile` has more targets per area (tests, Go, Rust) — use them when
-relevant.
-
-## Don't hand-edit generated or vendored files
-
-Run `make gen` instead. Off-limits:
-
-- `schema.yml` (OpenAPI)
-- `gen-ts-api/`
-- `packages/client-go/`, `packages/client-ts/`, `packages/client-rust/`
-- `schemas/` — these are upstream SAML / SCIM / WS-* specs, not ours
-
-If the output looks wrong, fix the source (models, serializers, generator
-config) and regenerate.
-
-## Migrations
-
-Generate them with `./manage.py makemigrations`. Don't hand-write or hand-edit
-migration files unless the user specifically asks (data migrations, squashes,
-or repairing a bad one). Read what Django produced before committing — autogen
-sometimes catches more than you intended.
-
-## Localization
-
-Anything user-visible needs to be translatable:
-
-- Python: `from django.utils.translation import gettext_lazy as _`, then `_("...")`
-- TS / Lit: `msg("...")` from `@lit/localize`
-- Django templates: `{% trans %}` / `{% blocktrans %}`
-
-No raw English strings in user-facing surfaces.
-
-## Tests, proportionate
-
-Size tests to the code. A 28-line function doesn't need a 400-line test file.
-Cover meaningful behavior and obvious edge cases; don't pad for coverage or
-re-test the framework. Mechanical changes (renames, type tweaks) usually ride
-on existing tests.
-
-## Reuse what's already there
-
-There's a large pool of helpers — find them before writing new ones.
-
-- **Django first.** `django.utils`, `django.shortcuts`, the ORM, the auth
-  framework — most generic things already exist there.
-- **Then authentik.** `authentik/lib/`, `authentik/core/`, and the feature
-  module you're working in.
-- **Call helpers, don't inline them.** If `plan.to_redirect()` exists, use it
-  instead of rebuilding the redirect at every call site. Same goes for
-  permission checks, flow plan helpers, event logging, serializer mixins, etc.
-
-## DRY, with judgment
-
-Deduplicate behavior, not boilerplate. Some things are cheap to restate and
-often clearer that way — serializers, simple model definitions, view glue,
-short config blocks — don't twist them through inheritance or shared bases
-just to save lines. But duplicated *behavior* — a function body copy-pasted
-across modules, a permission check reimplemented inline, a redirect built from
-scratch next to a helper that already does it — should collapse to one place.
-If changing the logic later would mean hunting down every copy, it belongs in
-one spot.

CLAUDE.md

@@ -1 +0,0 @@
-AGENTS.md

Cargo.lock

@@ -2057,7 +2057,7 @@ dependencies = [
  "hashbrown 0.16.1",
  "metrics",
  "quanta",
- "rand 0.9.2",
+ "rand 0.9.4",
  "rand_xoshiro",
  "sketches-ddsketch",
 ]
@@ -2744,7 +2744,7 @@ dependencies = [
  "bytes",
  "getrandom 0.3.4",
  "lru-slab",
- "rand 0.9.2",
+ "rand 0.9.4",
  "ring",
  "rustc-hash",
  "rustls",
@@ -2804,9 +2804,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.9.2"
+version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
+checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
 dependencies = [
  "rand_chacha 0.9.0",
  "rand_core 0.9.5",
@@ -3203,9 +3203,9 @@ checksum = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"
 
 [[package]]
 name = "sentry"
-version = "0.47.0"
+version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb25f439f97d26fea01d717fa626167ceffcd981addaa670001e70505b72acbb"
+checksum = "e8ac94aab850a23d7507307cc505332ed2bafd36c65930dfc5c43610f9e9b477"
 dependencies = [
  "cfg_aliases",
  "httpdate",
@@ -3224,9 +3224,9 @@ dependencies = [
 
 [[package]]
 name = "sentry-backtrace"
-version = "0.47.0"
+version = "0.48.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46a8c2c1bd5c1f735e84f28b48e7d72efcaafc362b7541bc8253e60e8fcdffc6"
+checksum = "dc84c325ace9ca2388e510fe7d6672b5d60cd8b3bd0eb4bb4ee8314c323cd686"
 dependencies = [
  "backtrace",
  "regex",
@@ -3235,9 +3235,9 @@ dependencies = [
 
 [[package]]
 name = "sentry-contexts"
-version = "0.47.0"
+version = "0.48.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b88a90baa654d7f0e1f4b667f6b434293d9f72c71bef16b197c76af5b7d5803"
+checksum = "896c1ab62dbfe1746fb262bbf72e6feb2fb9dfb2c14709077bf71beb532e44b2"
 dependencies = [
  "hostname",
  "libc",
@@ -3249,11 +3249,11 @@ dependencies = [
 
 [[package]]
 name = "sentry-core"
-version = "0.47.0"
+version = "0.48.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ac170a5bba8bec6e3339c90432569d89641fa7a3d3e4f44987d24f0762e6adf"
+checksum = "d5f5abf20c42cb1593ec1638976e2647da55f79bccac956444c1707b6cce259a"
 dependencies = [
- "rand 0.9.2",
+ "rand 0.9.4",
  "sentry-types",
  "serde",
  "serde_json",
@@ -3262,9 +3262,9 @@ dependencies = [
 
 [[package]]
 name = "sentry-debug-images"
-version = "0.47.0"
+version = "0.48.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd9646a972b57896d4a92ed200cf76139f8e30b3cfd03b6662ae59926d26633c"
+checksum = "4b88bbe6a760d5724bb40689827e82e8db1e275947df2c59abe171bfc30bb671"
 dependencies = [
  "findshlibs",
  "sentry-core",
@@ -3272,9 +3272,9 @@ dependencies = [
 
 [[package]]
 name = "sentry-panic"
-version = "0.47.0"
+version = "0.48.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6127d3d304ba5ce0409401e85aae538e303a569f8dbb031bf64f9ba0f7174346"
+checksum = "0260dcb52562b6a79ae7702312a26dba94b79fb5baee7301087529e5ca4e872e"
 dependencies = [
  "sentry-backtrace",
  "sentry-core",
@@ -3282,9 +3282,9 @@ dependencies = [
 
 [[package]]
 name = "sentry-tower"
-version = "0.47.0"
+version = "0.48.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61c5253dc4ad89863a866b93aeaaac1c9d60f2f774663b5024afe2d57e0a101c"
+checksum = "d669616d5d5279b5712febfc80c343acc3695e499de0d101ed70fceacadf37f2"
 dependencies = [
  "sentry-core",
  "tower-layer",
@@ -3293,9 +3293,9 @@ dependencies = [
 
 [[package]]
 name = "sentry-tracing"
-version = "0.47.0"
+version = "0.48.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "27701acc51e68db5281802b709010395bfcbcb128b1d0a4e5873680d3b47ff0c"
+checksum = "a1c035f3a0a8671ae1a231c5b457abb68b71acba2bf3054dab2a09a9d4ea487e"
 dependencies = [
  "bitflags 2.11.0",
  "sentry-backtrace",
@@ -3306,13 +3306,13 @@ dependencies = [
 
 [[package]]
 name = "sentry-types"
-version = "0.47.0"
+version = "0.48.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56780cb5597d676bf22e6c11d1f062eb4def46390ea3bfb047bcbcf7dfd19bdb"
+checksum = "82d8e81058ec155992191f61c7b29bfa7b2cf12012131e7cdc0678020898a7c9"
 dependencies = [
  "debugid",
  "hex",
- "rand 0.9.2",
+ "rand 0.9.4",
  "serde",
  "serde_json",
  "thiserror 2.0.18",
@@ -4214,7 +4214,7 @@ dependencies = [
  "http",
  "httparse",
  "log",
- "rand 0.9.2",
+ "rand 0.9.4",
  "sha1",
  "thiserror 2.0.18",
 ]

Cargo.toml

@@ -67,7 +67,7 @@ reqwest-middleware = { version = "= 0.5.1", features = [
   "rustls",
 ] }
 rustls = { version = "= 0.23.40", features = ["fips"] }
-sentry = { version = "= 0.47.0", default-features = false, features = [
+sentry = { version = "= 0.48.0", default-features = false, features = [
   "backtrace",
   "contexts",
   "debug-images",

authentik/blueprints/api.py

@@ -217,10 +217,7 @@ class BlueprintInstanceViewSet(UsedByMixin, ModelViewSet):
 
     @extend_schema(
         request={"multipart/form-data": BlueprintUploadSerializer},
-        responses={
-            204: BlueprintImportResultSerializer,
-            400: BlueprintImportResultSerializer,
-        },
+        responses={200: BlueprintImportResultSerializer},
     )
     @action(url_path="import", detail=False, methods=["POST"], parser_classes=(MultiPartParser,))
     @validate(
@@ -247,21 +244,13 @@ class BlueprintInstanceViewSet(UsedByMixin, ModelViewSet):
 
         import_response = self.BlueprintImportResultSerializer(
             data={
-                "logs": [],
-                "success": False,
+                "logs": [LogEventSerializer(log).data for log in logs],
+                "success": valid,
             }
         )
         import_response.is_valid(raise_exception=True)
 
-        import_response.initial_data["logs"] = [LogEventSerializer(log).data for log in logs]
-        import_response.initial_data["success"] = valid
-        import_response.is_valid()
-        if not valid:
-            return Response(data=import_response.initial_data, status=200)
-
-        successful = importer.apply()
-        import_response.initial_data["success"] = successful
-        import_response.is_valid()
-        if not successful:
-            return Response(data=import_response.initial_data, status=200)
+        if valid:
+            import_response.initial_data["success"] = importer.apply()
+            import_response.is_valid()
         return Response(data=import_response.initial_data, status=200)

authentik/blueprints/tests/test_v1_api.py

@@ -3,6 +3,7 @@
 from json import dumps, loads
 from tempfile import NamedTemporaryFile, mkdtemp
 
+from django.core.files.uploadedfile import SimpleUploadedFile
 from django.urls import reverse
 from rest_framework.test import APITestCase
 from yaml import dump
@@ -141,6 +142,20 @@ class TestBlueprintsV1API(APITestCase):
             )
         self.assertEqual(res.status_code, 200)
 
+    def test_api_import_invalid_blueprint_returns_result_payload(self):
+        """Invalid blueprint content returns a result payload instead of a 400 response."""
+        file = SimpleUploadedFile("invalid-blueprint.yaml", b'{"version": 3}')
+
+        res = self.client.post(
+            reverse("authentik_api:blueprintinstance-import-"),
+            data={"file": file},
+            format="multipart",
+        )
+
+        self.assertEqual(res.status_code, 200)
+        self.assertFalse(res.json()["success"])
+        self.assertGreater(len(res.json()["logs"]), 0)
+
     def test_api_import_unknown_path(self):
         """Path not in available blueprints is rejected (covers api.py:56)."""
         res = self.client.post(

authentik/tasks/test.py

@@ -7,7 +7,7 @@ from dramatiq.broker import Broker, MessageProxy, get_broker
 from dramatiq.middleware.middleware import Middleware
 from dramatiq.middleware.retries import Retries
 from dramatiq.results.middleware import Results
-from dramatiq.worker import Worker, _ConsumerThread, _WorkerThread
+from dramatiq.worker import ConsumerThread, Worker, WorkerThread
 
 from authentik.tasks.broker import PostgresBroker
 
@@ -20,7 +20,7 @@ class TestWorker(Worker):
         self.worker_id = 1000
         self.work_queue = PriorityQueue()
         self.consumers = {
-            TESTING_QUEUE: _ConsumerThread(
+            TESTING_QUEUE: ConsumerThread(
                 broker=self.broker,
                 queue_name=TESTING_QUEUE,
                 prefetch=2,
@@ -33,7 +33,7 @@ class TestWorker(Worker):
             prefetch=2,
             timeout=1,
         )
-        self._worker = _WorkerThread(
+        self._worker = WorkerThread(
             broker=self.broker,
             consumers=self.consumers,
             work_queue=self.work_queue,
@@ -78,17 +78,18 @@ def use_test_broker():
         actor.broker = broker
         actor.broker.declare_actor(actor)
 
-    for middleware_class, middleware_kwargs in Conf().middlewares:
-        middleware: Middleware = import_string(middleware_class)(
+    for middleware_class_path, middleware_kwargs in Conf().middlewares:
+        middleware_class = import_string(middleware_class_path)
+        if issubclass(middleware_class, Results):
+            middleware_kwargs["backend"] = import_string(Conf().result_backend)(
+                *Conf().result_backend_args,
+                **Conf().result_backend_kwargs,
+            )
+        middleware: Middleware = middleware_class(
             **middleware_kwargs,
         )
         if isinstance(middleware, Retries):
             middleware.max_retries = 0
-        if isinstance(middleware, Results):
-            middleware.backend = import_string(Conf().result_backend)(
-                *Conf().result_backend_args,
-                **Conf().result_backend_kwargs,
-            )
         broker.add_middleware(middleware)
 
     broker.start()

lifecycle/ak

@@ -79,7 +79,7 @@ function prepare_debug {
     apt-get update
     apt-get install -y --no-install-recommends krb5-kdc krb5-user krb5-admin-server libkrb5-dev gcc
     source "${VENV_PATH}/bin/activate"
-    uv sync --active --frozen
+    uv sync --active --locked
     touch /unittest.xml
     chown authentik:authentik /unittest.xml
 }

lifecycle/container/Dockerfile

@@ -200,7 +200,7 @@ RUN --mount=type=bind,target=pyproject.toml,src=pyproject.toml \
     --mount=type=bind,target=packages/django-postgres-cache,src=packages/django-postgres-cache \
     --mount=type=bind,target=rust-toolchain.toml,src=rust-toolchain.toml \
     --mount=type=cache,id=uv-python-deps-$TARGETARCH$TARGETVARIANT,target=/root/.cache/uv \
-    uv sync --frozen --no-install-project --no-dev
+    uv sync --locked --no-install-project --no-dev
 
 # Stage: Run
 FROM python-base AS final-image

lifecycle/worker_process.py

@@ -28,12 +28,7 @@ class HttpHandler(BaseHTTPRequestHandler):
             _ = db_conn.cursor()
 
     def do_GET(self):
-        from django.db import (
-            DatabaseError,
-            InterfaceError,
-            OperationalError,
-            connections,
-        )
+        from django.db import DatabaseError, InterfaceError, OperationalError, connections
         from psycopg.errors import AdminShutdown
 
         from authentik.root.monitoring import monitoring_set
@@ -42,7 +37,6 @@ class HttpHandler(BaseHTTPRequestHandler):
             AdminShutdown,
             InterfaceError,
             DatabaseError,
-            ConnectionError,
             OperationalError,
         )
 

locale/en/LC_MESSAGES/django.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-05-01 03:47+0000\n"
+"POT-Creation-Date: 2026-05-06 00:27+0000\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -101,6 +101,14 @@ msgstr ""
 msgid "Blueprint file does not exist"
 msgstr ""
 
+#: authentik/blueprints/api.py
+msgid "Context must be valid JSON"
+msgstr ""
+
+#: authentik/blueprints/api.py
+msgid "Context must be a JSON object"
+msgstr ""
+
 #: authentik/blueprints/api.py
 msgid "Failed to validate blueprint"
 msgstr ""

packages/client-ts/package.json

@@ -8,7 +8,8 @@
         "url": "https://github.com/goauthentik/authentik.git"
     },
     "scripts": {
-        "build": "tsc && tsc -p tsconfig.esm.json",
+        "build": "npm run clean && tsc -b tsconfig.json tsconfig.esm.json",
+        "clean": "tsc -b --clean tsconfig.json tsconfig.esm.json",
         "prepare": "npm run build"
     },
     "main": "./dist/index.js",

packages/client-ts/templates/tsconfig.mustache

@@ -1,9 +1,7 @@
 {
     "$schema": "https://json.schemastore.org/tsconfig",
     "compilerOptions": {
-        "composite": true,
         "isolatedModules": true,
-        "incremental": true,
         "rootDir": "src",
         "strict": true,
         "newLine": "lf",

packages/client-ts/tsconfig.json

@@ -1,9 +1,7 @@
 {
     "$schema": "https://json.schemastore.org/tsconfig",
     "compilerOptions": {
-        "composite": true,
         "isolatedModules": true,
-        "incremental": true,
         "rootDir": "src",
         "strict": true,
         "newLine": "lf",

packages/django-dramatiq-postgres/django_dramatiq_postgres/apps.py

@@ -32,16 +32,17 @@ class DjangoDramatiqPostgres(AppConfig):
             middleware=[],
         )
 
-        for middleware_class, middleware_kwargs in Conf().middlewares:
-            middleware: dramatiq.middleware.middleware.Middleware = import_string(middleware_class)(
-                **middleware_kwargs,
-            )
-            if isinstance(middleware, Results):
-                middleware.backend = import_string(Conf().result_backend)(
+        for middleware_class_path, middleware_kwargs in Conf().middlewares:
+            middleware_class = import_string(middleware_class_path)
+            if issubclass(middleware_class, Results):
+                middleware_kwargs["backend"] = import_string(Conf().result_backend)(
                     *Conf().result_backend_args,
                     **Conf().result_backend_kwargs,
                 )
-            broker.add_middleware(middleware)  # type: ignore[no-untyped-call]
+            middleware: dramatiq.middleware.middleware.Middleware = middleware_class(
+                **middleware_kwargs,
+            )
+            broker.add_middleware(middleware)
 
         dramatiq.set_broker(broker)
 

packages/django-dramatiq-postgres/django_dramatiq_postgres/broker.py

@@ -23,11 +23,9 @@ from django.utils.functional import cached_property
 from django.utils.module_loading import import_string
 from dramatiq.broker import Broker, Consumer, MessageProxy
 from dramatiq.common import compute_backoff, current_millis, dq_name, q_name, xq_name
-from dramatiq.errors import ConnectionError, QueueJoinTimeout
+from dramatiq.errors import BrokerConnectionError, QueueJoinTimeout
 from dramatiq.message import Message
-from dramatiq.middleware import (
-    Middleware,
-)
+from dramatiq.middleware import Middleware
 from pglock.core import _cast_lock_id
 from psycopg import sql
 from psycopg.errors import AdminShutdown
@@ -46,7 +44,6 @@ DATABASE_ERRORS = (
     AdminShutdown,
     InterfaceError,
     DatabaseError,
-    ConnectionError,
     OperationalError,
 )
 
@@ -55,7 +52,7 @@ def channel_name(queue_name: str, identifier: ChannelIdentifier) -> str:
     return f"{CHANNEL_PREFIX}.{queue_name}.{identifier.value}"
 
 
-def raise_connection_error(func: Callable[P, R]) -> Callable[P, R]:  # noqa: UP047
+def raise_broker_connection_error(func: Callable[P, R]) -> Callable[P, R]:  # noqa: UP047
     @functools.wraps(func)
     def wrapper(*args: P.args, **kwargs: P.kwargs) -> R:
         try:
@@ -66,13 +63,13 @@ def raise_connection_error(func: Callable[P, R]) -> Callable[P, R]:  # noqa: UP0
                 connections.close_all()
             except DATABASE_ERRORS:
                 pass
-            raise ConnectionError(str(exc)) from exc  # type: ignore[no-untyped-call]
+            raise BrokerConnectionError(str(exc)) from exc  # type: ignore[no-untyped-call]
 
     return wrapper
 
 
 class PostgresBroker(Broker):
-    queues: set[str]  # type: ignore[assignment]
+    queues: set[str]
 
     def __init__(
         self,
@@ -81,7 +78,7 @@ class PostgresBroker(Broker):
         db_alias: str = DEFAULT_DB_ALIAS,
         **kwargs: Any,
     ) -> None:
-        super().__init__(*args, middleware=[], **kwargs)  # type: ignore[no-untyped-call,misc]
+        super().__init__(*args, middleware=[], **kwargs)  # type: ignore[misc]
         self.logger = get_logger(__name__, type(self))
 
         self.queues = set()
@@ -122,10 +119,10 @@ class PostgresBroker(Broker):
 
     def declare_queue(self, queue_name: str) -> None:
         if queue_name not in self.queues:
-            self.emit_before("declare_queue", queue_name)  # type: ignore[no-untyped-call]
+            self.emit_before("declare_queue", queue_name)
             self.queues.add(queue_name)
             # Nothing more to do, all queues are in the same table
-            self.emit_after("declare_queue", queue_name)  # type: ignore[no-untyped-call]
+            self.emit_after("declare_queue", queue_name)
 
     def model_defaults(self, message: Message[Any]) -> dict[str, Any]:
         eta = None
@@ -141,7 +138,7 @@ class PostgresBroker(Broker):
         }
 
     @tenacity.retry(
-        retry=tenacity.retry_if_exception_type(ConnectionError),
+        retry=tenacity.retry_if_exception_type(BrokerConnectionError),
         reraise=True,
         wait=tenacity.wait_random_exponential(multiplier=1, max=5),
         stop=tenacity.stop_after_attempt(3),
@@ -149,11 +146,11 @@ class PostgresBroker(Broker):
             cast(logging.Logger, logger), logging.INFO, exc_info=True
         ),
     )
-    @raise_connection_error
+    @raise_broker_connection_error
     def enqueue(self, message: Message[Any], *, delay: int | None = None) -> Message[Any]:
-        queue_name = q_name(message.queue_name)  # type: ignore[no-untyped-call]
+        queue_name = q_name(message.queue_name)
         if delay:
-            message_eta = current_millis() + delay  # type: ignore[no-untyped-call]
+            message_eta = current_millis() + delay
             message.options["eta"] = message_eta
 
         self.declare_queue(queue_name)
@@ -163,7 +160,7 @@ class PostgresBroker(Broker):
 
         message.options["model_defaults"] = self.model_defaults(message)
         message.options["model_create_defaults"] = {}
-        self.emit_before("enqueue", message, delay)  # type: ignore[no-untyped-call]
+        self.emit_before("enqueue", message, delay)
 
         with transaction.atomic(using=self.db_alias):
             query = {
@@ -185,7 +182,7 @@ class PostgresBroker(Broker):
             message.options["task"] = task
             message.options["task_created"] = created
 
-            self.emit_after("enqueue", message, delay)  # type: ignore[no-untyped-call]
+            self.emit_after("enqueue", message, delay)
         return message
 
     def get_declared_queues(self) -> set[str]:
@@ -193,7 +190,7 @@ class PostgresBroker(Broker):
 
     def flush(self, queue_name: str) -> None:
         self.query_set.filter(
-            queue_name__in=(queue_name, dq_name(queue_name), xq_name(queue_name))  # type: ignore[no-untyped-call]
+            queue_name__in=(queue_name, dq_name(queue_name), xq_name(queue_name))
         ).delete()
 
     def flush_all(self) -> None:
@@ -375,7 +372,7 @@ class _PostgresConsumer(Consumer):
         self.in_processing.add(str(message_id))
         return message
 
-    @raise_connection_error
+    @raise_broker_connection_error
     def __next__(self) -> MessageProxy | None:
         # This method is called every second
 
@@ -395,7 +392,7 @@ class _PostgresConsumer(Consumer):
         if processing >= self.prefetch:
             # If we have too many messages already processing, wait and don't consume a message
             # straight away, other workers will be faster.
-            self.misses, backoff_ms = compute_backoff(self.misses, max_backoff=1000)  # type: ignore[no-untyped-call]
+            self.misses, backoff_ms = compute_backoff(self.misses, max_backoff=1000)
             self.logger.debug(
                 "Too many messages in processing, Sleeping",
                 processing=processing,
@@ -420,7 +417,7 @@ class _PostgresConsumer(Consumer):
                 break
             message = self._consume_one(str(message_id))
             if message is not None:
-                return MessageProxy(message)  # type: ignore[no-untyped-call]
+                return MessageProxy(message)
             else:
                 self.logger.debug("Message already consumed. Skipping.", message_id=message_id)
                 continue
@@ -444,7 +441,7 @@ class _PostgresConsumer(Consumer):
             self.to_unlock.add(str(message_id))
             return False
 
-    def _post_process_message(self, message: Message[Any], state: TaskState) -> None:
+    def _post_process_message(self, message: MessageProxy, state: TaskState) -> None:
         self.logger.debug("Post-processing message", message=message.message_id, state=state)
         try:
             self.in_processing.remove(str(message.message_id))
@@ -466,16 +463,16 @@ class _PostgresConsumer(Consumer):
         )
         message.options["task"] = task
 
-    @raise_connection_error
-    def ack(self, message: Message[Any]) -> None:
+    @raise_broker_connection_error
+    def ack(self, message: MessageProxy) -> None:
         self._post_process_message(message, TaskState.DONE)
 
-    @raise_connection_error
-    def nack(self, message: Message[Any]) -> None:
+    @raise_broker_connection_error
+    def nack(self, message: MessageProxy) -> None:
         self._post_process_message(message, TaskState.REJECTED)
 
-    @raise_connection_error
-    def requeue(self, messages: Iterable[Message[Any]]) -> None:
+    @raise_broker_connection_error
+    def requeue(self, messages: Iterable[MessageProxy]) -> None:
         self.query_set.filter(
             message_id__in=[message.message_id for message in messages],
         ).update(
@@ -514,7 +511,7 @@ class _PostgresConsumer(Consumer):
         self.logger.info("Purged messages in all queues", count=count)
         self.task_purge_last_run = timezone.now()
 
-    @raise_connection_error
+    @raise_broker_connection_error
     def close(self) -> None:
         try:
             self._purge_locks()

packages/django-dramatiq-postgres/django_dramatiq_postgres/forks.py

@@ -5,7 +5,7 @@ from signal import pause
 from django_dramatiq_postgres.conf import Conf
 
 
-def worker_metrics() -> None:
+def worker_metrics() -> int:
     import_module(Conf().autodiscovery["setup_module"])
 
     from django_dramatiq_postgres.middleware import MetricsMiddleware
@@ -15,3 +15,4 @@ def worker_metrics() -> None:
         int(os.getenv("dramatiq_prom_port", "9191")),
     )
     pause()
+    return 0

packages/django-dramatiq-postgres/django_dramatiq_postgres/middleware.py

@@ -10,7 +10,7 @@ from typing import TYPE_CHECKING, Any, cast
 
 from django.db import DatabaseError, close_old_connections, connections
 from dramatiq.actor import Actor
-from dramatiq.broker import Broker
+from dramatiq.broker import Broker, MessageProxy
 from dramatiq.common import current_millis
 from dramatiq.message import Message
 from dramatiq.middleware.middleware import Middleware
@@ -79,7 +79,7 @@ class DbConnectionMiddleware(Middleware):
 
 
 class TaskStateBeforeMiddleware(Middleware):
-    def before_process_message(self, broker: PostgresBroker, message: Message[Any]) -> None:
+    def before_process_message(self, broker: PostgresBroker, message: Message[Any]) -> None:  # type: ignore[override]
         broker.query_set.filter(
             message_id=message.message_id,
             queue_name=message.queue_name,
@@ -90,7 +90,7 @@ class TaskStateBeforeMiddleware(Middleware):
 
 
 class TaskStateAfterMiddleware(Middleware):
-    def before_process_message(self, broker: PostgresBroker, message: Message[Any]) -> None:
+    def before_process_message(self, broker: PostgresBroker, message: MessageProxy) -> None:  # type: ignore[override]
         broker.query_set.filter(
             message_id=message.message_id,
             queue_name=message.queue_name,
@@ -99,7 +99,7 @@ class TaskStateAfterMiddleware(Middleware):
             state=TaskState.RUNNING,
         )
 
-    def after_skip_message(self, broker: PostgresBroker, message: Message[Any]) -> None:
+    def after_skip_message(self, broker: PostgresBroker, message: MessageProxy) -> None:  # type: ignore[override]
         broker.query_set.filter(
             message_id=message.message_id,
             queue_name=message.queue_name,
@@ -110,11 +110,11 @@ class TaskStateAfterMiddleware(Middleware):
 
     def after_process_message(
         self,
-        broker: PostgresBroker,
-        message: Message[Any],
+        broker: PostgresBroker,  # type: ignore[override]
+        message: MessageProxy,
         *,
         result: Any | None = None,
-        exception: Exception | None = None,
+        exception: BaseException | None = None,
     ) -> None:
         self.after_skip_message(broker, message)
 
@@ -147,7 +147,7 @@ class CurrentTask(Middleware):
             raise CurrentTaskNotFound()
         return task[-1]
 
-    def before_process_message(self, broker: Broker, message: Message[Any]) -> None:
+    def before_process_message(self, broker: Broker, message: MessageProxy) -> None:
         tasks = self._TASKS.get()
         if tasks is None:
             tasks = []
@@ -157,10 +157,10 @@ class CurrentTask(Middleware):
     def after_process_message(
         self,
         broker: Broker,
-        message: Message[Any],
+        message: MessageProxy,
         *,
         result: Any | None = None,
-        exception: Exception | None = None,
+        exception: BaseException | None = None,
     ) -> None:
         tasks: list[TaskBase] | None = self._TASKS.get()
         if tasks is None or len(tasks) == 0:
@@ -194,7 +194,7 @@ class CurrentTask(Middleware):
                 pass
         self._TASKS.set(tasks[:-1])
 
-    def after_skip_message(self, broker: Broker, message: Message[Any]) -> None:
+    def after_skip_message(self, broker: Broker, message: MessageProxy) -> None:
         self.after_process_message(broker, message)
 
 
@@ -236,7 +236,7 @@ class MetricsMiddleware(Middleware):
         self.message_start_times: dict[str, int] = {}
 
     @property
-    def forks(self) -> list[Callable[[], None]]:
+    def forks(self) -> list[Callable[[], int]]:
         from django_dramatiq_postgres.forks import worker_metrics
 
         return [worker_metrics]
@@ -310,41 +310,41 @@ class MetricsMiddleware(Middleware):
         # TODO: worker_id
         multiprocess.mark_process_dead(os.getpid())  # type: ignore[no-untyped-call]
 
-    def _make_labels(self, message: Message[Any]) -> list[str]:
+    def _make_labels(self, message: MessageProxy | Message[Any]) -> list[str]:
         return [message.queue_name, message.actor_name]
 
-    def after_nack(self, broker: Broker, message: Message[Any]) -> None:
+    def after_nack(self, broker: Broker, message: MessageProxy) -> None:
         self.total_rejected_messages.labels(*self._make_labels(message)).inc()
 
     def after_enqueue(self, broker: Broker, message: Message[Any], delay: int) -> None:
         if "retries" in message.options:
             self.total_retried_messages.labels(*self._make_labels(message)).inc()
 
-    def before_delay_message(self, broker: Broker, message: Message[Any]) -> None:
+    def before_delay_message(self, broker: Broker, message: MessageProxy) -> None:
         self.delayed_messages.add(message.message_id)
         self.in_progress_delayed_messages.labels(*self._make_labels(message)).inc()
 
-    def before_process_message(self, broker: Broker, message: Message[Any]) -> None:
+    def before_process_message(self, broker: Broker, message: MessageProxy) -> None:
         labels = self._make_labels(message)
         if message.message_id in self.delayed_messages:
             self.delayed_messages.remove(message.message_id)
             self.in_progress_delayed_messages.labels(*labels).dec()
 
         self.in_progress_messages.labels(*labels).inc()
-        self.message_start_times[message.message_id] = current_millis()  # type: ignore[no-untyped-call]
+        self.message_start_times[message.message_id] = current_millis()
 
     def after_process_message(
         self,
         broker: Broker,
-        message: Message[Any],
+        message: MessageProxy,
         *,
         result: Any | None = None,
-        exception: Exception | None = None,
+        exception: BaseException | None = None,
     ) -> None:
         labels = self._make_labels(message)
 
-        message_start_time = self.message_start_times.pop(message.message_id, current_millis())  # type: ignore[no-untyped-call]
-        message_duration = current_millis() - message_start_time  # type: ignore[no-untyped-call]
+        message_start_time = self.message_start_times.pop(message.message_id, current_millis())
+        message_duration = current_millis() - message_start_time
         self.messages_durations.labels(*labels).observe(message_duration)
 
         self.in_progress_messages.labels(*labels).dec()

packages/django-dramatiq-postgres/django_dramatiq_postgres/models.py

@@ -159,7 +159,7 @@ class ScheduleBase(models.Model):
 
     def send(self, broker: Broker | None = None) -> Message[Any]:
         broker = broker or get_broker()
-        actor: Actor[Any, Any] = broker.get_actor(self.actor_name)  # type: ignore[no-untyped-call]
+        actor: Actor[Any, Any] = broker.get_actor(self.actor_name)
         return actor.send_with_options(
             args=pickle.loads(self.args),  # nosec
             kwargs=pickle.loads(self.kwargs),  # nosec

packages/django-dramatiq-postgres/pyproject.toml

@@ -36,7 +36,7 @@ dependencies = [
   "django >=4.2,<6.0",
   "django-pglock >=1.7,<2",
   "django-pgtrigger >=4,<5",
-  "dramatiq >=1.17,<1.18",
+  "dramatiq >=2,<3",
   "tenacity >=9,<10",
   "structlog >=25,<26",
 ]

schema.yml

@@ -9678,18 +9678,14 @@ paths:
       security:
       - authentik: []
       responses:
-        '204':
+        '200':
           content:
             application/json:
               schema:
                 $ref: '#/components/schemas/BlueprintImportResult'
           description: ''
         '400':
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/BlueprintImportResult'
-          description: ''
+          $ref: '#/components/responses/ValidationErrorResponse'
         '403':
           $ref: '#/components/responses/GenericErrorResponse'
   /oauth2/access_tokens/:

tests/e2e/test_flows_enroll.py

@@ -111,8 +111,12 @@ class TestFlowsEnroll(SeleniumTestCase):
         identification_stage = self.get_shadow_root("ak-stage-identification", flow_executor)
         wait = WebDriverWait(identification_stage, self.wait_timeout)
 
-        wait.until(ec.presence_of_element_located((By.CSS_SELECTOR, "a[ouiaId='enroll']")))
-        identification_stage.find_element(By.CSS_SELECTOR, "a[ouiaId='enroll']").click()
+        wait.until(
+            ec.presence_of_element_located((By.CSS_SELECTOR, "a[data-ouia-component-id='enroll']"))
+        )
+        identification_stage.find_element(
+            By.CSS_SELECTOR, "a[data-ouia-component-id='enroll']"
+        ).click()
 
         # First prompt stage
         flow_executor = self.get_shadow_root("ak-flow-executor")

tests/e2e/test_flows_recovery.py

@@ -27,8 +27,14 @@ class TestFlowsRecovery(SeleniumTestCase):
         identification_stage = self.get_shadow_root("ak-stage-identification", flow_executor)
         wait = WebDriverWait(identification_stage, self.wait_timeout)
 
-        wait.until(ec.presence_of_element_located((By.CSS_SELECTOR, "a[ouiaId='recovery']")))
-        identification_stage.find_element(By.CSS_SELECTOR, "a[ouiaId='recovery']").click()
+        wait.until(
+            ec.presence_of_element_located(
+                (By.CSS_SELECTOR, "a[data-ouia-component-id='recovery']")
+            )
+        )
+        identification_stage.find_element(
+            By.CSS_SELECTOR, "a[data-ouia-component-id='recovery']"
+        ).click()
 
         # First prompt stage
         flow_executor = self.get_shadow_root("ak-flow-executor")

uv.lock

@@ -1143,7 +1143,7 @@ requires-dist = [
     { name = "django", specifier = ">=4.2,<6.0" },
     { name = "django-pglock", specifier = ">=1.7,<2" },
     { name = "django-pgtrigger", specifier = ">=4,<5" },
-    { name = "dramatiq", specifier = ">=1.17,<1.18" },
+    { name = "dramatiq", specifier = ">=2,<3" },
     { name = "structlog", specifier = ">=25,<26" },
     { name = "tenacity", specifier = ">=9,<10" },
 ]
@@ -1381,14 +1381,11 @@ wheels = [
 
 [[package]]
 name = "dramatiq"
-version = "1.17.1"
+version = "2.1.0"
 source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "prometheus-client" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/c6/7a/6792ddc64a77d22bfd97261b751a7a76cf2f9d62edc59aafb679ac48b77d/dramatiq-1.17.1.tar.gz", hash = "sha256:2675d2f57e0d82db3a7d2a60f1f9c536365349db78c7f8d80a63e4c54697647a", size = 99071, upload-time = "2024-10-26T05:09:28.283Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/22/69/02b54e3fc4fe75721b322bc578054b4f03cec258ba614fa98a1a5bbe1efe/dramatiq-2.1.0.tar.gz", hash = "sha256:cf81550729de6cf64234b05bd63970645654aaf38967faa7a2b6e401384bb090", size = 105444, upload-time = "2026-03-03T11:22:10.067Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/ee/36/925c7afd5db4f1a3f00676b9c3c58f31ff7ae29a347282d86c8d429280a5/dramatiq-1.17.1-py3-none-any.whl", hash = "sha256:951cdc334478dff8e5150bb02a6f7a947d215ee24b5aedaf738eff20e17913df", size = 120382, upload-time = "2024-10-26T05:09:26.436Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/91/422960c8c415fd31ca1519d71d6f7e4bcabb2cdcc5872f784467e9fe7237/dramatiq-2.1.0-py3-none-any.whl", hash = "sha256:3ef940c2815722d3679aed79ef96c805f02fd33d4361529b2de30f01511ca44d", size = 125543, upload-time = "2026-03-03T11:22:08.664Z" },
 ]
 
 [[package]]

web/package-lock.json

@@ -66,7 +66,7 @@
                 "chartjs-adapter-date-fns": "^3.0.0",
                 "codemirror": "^6.0.2",
                 "core-js": "^3.49.0",
-                "country-flag-icons": "^1.6.16",
+                "country-flag-icons": "^1.6.17",
                 "date-fns": "^4.1.0",
                 "deepmerge-ts": "^7.1.5",
                 "dompurify": "^3.4.2",
@@ -118,7 +118,7 @@
                 "vitest": "^4.1.1",
                 "webcomponent-qr-code": "^1.3.0",
                 "wireit": "^0.14.12",
-                "yaml": "^2.8.3"
+                "yaml": "^2.8.4"
             },
             "engines": {
                 "node": ">=24",
@@ -4577,9 +4577,9 @@
             }
         },
         "node_modules/@swc/core": {
-            "version": "1.15.32",
-            "resolved": "https://registry.npmjs.org/@swc/core/-/core-1.15.32.tgz",
-            "integrity": "sha512-/eWL0n43D64QWEUHLtTE+jDqjkJhyidjkDhv6f0uJohOUAhywxQ9wXYp845DNNds0JpCdI4Uo0a9bl+vbXf+ew==",
+            "version": "1.15.33",
+            "resolved": "https://registry.npmjs.org/@swc/core/-/core-1.15.33.tgz",
+            "integrity": "sha512-jOlwnFV2xhuuZeAUILGFULeR6vDPfijEJ57evfocwznQldLU3w2cZ9bSDryY9ip+AsM3r1NJKzf47V2NXebkeQ==",
             "hasInstallScript": true,
             "license": "Apache-2.0",
             "dependencies": {
@@ -4594,18 +4594,18 @@
                 "url": "https://opencollective.com/swc"
             },
             "optionalDependencies": {
-                "@swc/core-darwin-arm64": "1.15.32",
-                "@swc/core-darwin-x64": "1.15.32",
-                "@swc/core-linux-arm-gnueabihf": "1.15.32",
-                "@swc/core-linux-arm64-gnu": "1.15.32",
-                "@swc/core-linux-arm64-musl": "1.15.32",
-                "@swc/core-linux-ppc64-gnu": "1.15.32",
-                "@swc/core-linux-s390x-gnu": "1.15.32",
-                "@swc/core-linux-x64-gnu": "1.15.32",
-                "@swc/core-linux-x64-musl": "1.15.32",
-                "@swc/core-win32-arm64-msvc": "1.15.32",
-                "@swc/core-win32-ia32-msvc": "1.15.32",
-                "@swc/core-win32-x64-msvc": "1.15.32"
+                "@swc/core-darwin-arm64": "1.15.33",
+                "@swc/core-darwin-x64": "1.15.33",
+                "@swc/core-linux-arm-gnueabihf": "1.15.33",
+                "@swc/core-linux-arm64-gnu": "1.15.33",
+                "@swc/core-linux-arm64-musl": "1.15.33",
+                "@swc/core-linux-ppc64-gnu": "1.15.33",
+                "@swc/core-linux-s390x-gnu": "1.15.33",
+                "@swc/core-linux-x64-gnu": "1.15.33",
+                "@swc/core-linux-x64-musl": "1.15.33",
+                "@swc/core-win32-arm64-msvc": "1.15.33",
+                "@swc/core-win32-ia32-msvc": "1.15.33",
+                "@swc/core-win32-x64-msvc": "1.15.33"
             },
             "peerDependencies": {
                 "@swc/helpers": ">=0.5.17"
@@ -4617,9 +4617,9 @@
             }
         },
         "node_modules/@swc/core-darwin-arm64": {
-            "version": "1.15.32",
-            "resolved": "https://registry.npmjs.org/@swc/core-darwin-arm64/-/core-darwin-arm64-1.15.32.tgz",
-            "integrity": "sha512-/YWMvJDPu+AAwuUsM2G+DNQ/7zhodURGzdQyewEqcvgklAdDHs3LwQmLLnyn6SJl8DT8UOxkbzK+D1PmPeelRg==",
+            "version": "1.15.33",
+            "resolved": "https://registry.npmjs.org/@swc/core-darwin-arm64/-/core-darwin-arm64-1.15.33.tgz",
+            "integrity": "sha512-N+L0uXhuO7FIfzqwgxmzv0zIpV0qEp8wPX3QQs2p4atjMoywup2JTeDlXPw+z9pWJGCae3JjM+tZ6myclI+2gA==",
             "cpu": [
                 "arm64"
             ],
@@ -4633,9 +4633,9 @@
             }
         },
         "node_modules/@swc/core-darwin-x64": {
-            "version": "1.15.32",
-            "resolved": "https://registry.npmjs.org/@swc/core-darwin-x64/-/core-darwin-x64-1.15.32.tgz",
-            "integrity": "sha512-KOTXJXdAhWL+hZ77MYP3z+4pcMFaQhQ74yqyN1uz093q0YnbxpqMtYpPISbYvMHzVRNNx5kN+9RZAXEaadhWVA==",
+            "version": "1.15.33",
+            "resolved": "https://registry.npmjs.org/@swc/core-darwin-x64/-/core-darwin-x64-1.15.33.tgz",
+            "integrity": "sha512-/Il4QHSOhV4FekbsDtkrNmKbsX26oSysvgrRswa/RYOHXAkwXDbB4jaeKq6PsJLSPkzJ2KzQ061gtBnk0vNHfA==",
             "cpu": [
                 "x64"
             ],
@@ -4649,9 +4649,9 @@
             }
         },
         "node_modules/@swc/core-linux-arm-gnueabihf": {
-            "version": "1.15.32",
-            "resolved": "https://registry.npmjs.org/@swc/core-linux-arm-gnueabihf/-/core-linux-arm-gnueabihf-1.15.32.tgz",
-            "integrity": "sha512-oOoxLweljlc0A4X8ybsgxV7cVaYTwBOg2iMDJcFR3Sr48C+lsv9VzSmqdK/IVIXF4W4GjLc3VqTAdSMXlfVLuQ==",
+            "version": "1.15.33",
+            "resolved": "https://registry.npmjs.org/@swc/core-linux-arm-gnueabihf/-/core-linux-arm-gnueabihf-1.15.33.tgz",
+            "integrity": "sha512-C64hBnBxq4viOPQ8hlx+2lJ23bzZBGnjw7ryALmS+0Q3zHmwO8lw1/DArLENw4Q18/0w5wdEO1k3m1wWNtKGqQ==",
             "cpu": [
                 "arm"
             ],
@@ -4665,9 +4665,9 @@
             }
         },
         "node_modules/@swc/core-linux-arm64-gnu": {
-            "version": "1.15.32",
-            "resolved": "https://registry.npmjs.org/@swc/core-linux-arm64-gnu/-/core-linux-arm64-gnu-1.15.32.tgz",
-            "integrity": "sha512-oDzEkdl6D6BAWdMtU5KGO7y3HR5fJcvByNLyEk9+ugj8nP5Ovb7P4kBcStBXc4MPExFGQryehiINMlmY8HlclA==",
+            "version": "1.15.33",
+            "resolved": "https://registry.npmjs.org/@swc/core-linux-arm64-gnu/-/core-linux-arm64-gnu-1.15.33.tgz",
+            "integrity": "sha512-TRJfnJbX3jqpxRDRoieMzRiCBS5jOmXNb3iQXmcgjFEHKLnAgK1RZRU8Cq1MsPqO4jAJp/ld1G4O3fXuxv85uw==",
             "cpu": [
                 "arm64"
             ],
@@ -4681,9 +4681,9 @@
             }
         },
         "node_modules/@swc/core-linux-arm64-musl": {
-            "version": "1.15.32",
-            "resolved": "https://registry.npmjs.org/@swc/core-linux-arm64-musl/-/core-linux-arm64-musl-1.15.32.tgz",
-            "integrity": "sha512-omcqjoZP/b8D8PuczVoRwJieC6ibj7qIxTftNYokz4/aSmKFHvsd7nIFfPk5ZvtzncbH4AY7+Dkr/Lp2gWxYeA==",
+            "version": "1.15.33",
+            "resolved": "https://registry.npmjs.org/@swc/core-linux-arm64-musl/-/core-linux-arm64-musl-1.15.33.tgz",
+            "integrity": "sha512-il7tYM+CpUNzieQbwAjFT1P8zqAhmGWNAGhQZBnxurXZ0aNn+5nqYFTEUKNZl7QibtT0uQXzTZrNGHCIj6Y1Og==",
             "cpu": [
                 "arm64"
             ],
@@ -4697,9 +4697,9 @@
             }
         },
         "node_modules/@swc/core-linux-ppc64-gnu": {
-            "version": "1.15.32",
-            "resolved": "https://registry.npmjs.org/@swc/core-linux-ppc64-gnu/-/core-linux-ppc64-gnu-1.15.32.tgz",
-            "integrity": "sha512-KGkTMyz/Tbn3PBNu0AVZ4GTDFKnICrYcTiNPZq8DrvK42pnFsf3GNDrIG9E5AtQlTmC0YigkWKmu0eMcfTrmgA==",
+            "version": "1.15.33",
+            "resolved": "https://registry.npmjs.org/@swc/core-linux-ppc64-gnu/-/core-linux-ppc64-gnu-1.15.33.tgz",
+            "integrity": "sha512-ZtNBwN0Z7CFj9Il0FcPaKdjgP7URyKu/3RfH46vq+0paOBqLj4NYldD6Qo//Duif/7IOtAraUfDOmp0PLAufog==",
             "cpu": [
                 "ppc64"
             ],
@@ -4713,9 +4713,9 @@
             }
         },
         "node_modules/@swc/core-linux-s390x-gnu": {
-            "version": "1.15.32",
-            "resolved": "https://registry.npmjs.org/@swc/core-linux-s390x-gnu/-/core-linux-s390x-gnu-1.15.32.tgz",
-            "integrity": "sha512-G3Aa4tVS/3OGZBkoNIwUF9F6RAy+Osb4GOlo62SinLmDiErz/ykmM7KH0wkz6l9kM8jJq1HyAM6atJTUEbBk7g==",
+            "version": "1.15.33",
+            "resolved": "https://registry.npmjs.org/@swc/core-linux-s390x-gnu/-/core-linux-s390x-gnu-1.15.33.tgz",
+            "integrity": "sha512-De1IyajoOmhOYYjw/lx66bKlyDpHZTueqwpDrWgf5O7T6d1ODeJJO9/OqMBmrBQc5C+dNnlmIufHsp4QVCWufA==",
             "cpu": [
                 "s390x"
             ],
@@ -4729,9 +4729,9 @@
             }
         },
         "node_modules/@swc/core-linux-x64-gnu": {
-            "version": "1.15.32",
-            "resolved": "https://registry.npmjs.org/@swc/core-linux-x64-gnu/-/core-linux-x64-gnu-1.15.32.tgz",
-            "integrity": "sha512-ERsjfGcj6CBmj3vJnGDO8m8rTvw6RqMcWo1dogOtNx3/+/0+NNpJiXDobJrr1GwInI/BHAEkvSFIH6d2LqPcUQ==",
+            "version": "1.15.33",
+            "resolved": "https://registry.npmjs.org/@swc/core-linux-x64-gnu/-/core-linux-x64-gnu-1.15.33.tgz",
+            "integrity": "sha512-mGTH0YxmUN+x6vRN/I6NOk5X0ogNktkwPnJ94IMvR7QjhRDwL0O8RXEDhyUM0YtwWrryBOqaJQBX4zruxEPRGw==",
             "cpu": [
                 "x64"
             ],
@@ -4745,9 +4745,9 @@
             }
         },
         "node_modules/@swc/core-linux-x64-musl": {
-            "version": "1.15.32",
-            "resolved": "https://registry.npmjs.org/@swc/core-linux-x64-musl/-/core-linux-x64-musl-1.15.32.tgz",
-            "integrity": "sha512-N4Ggahe/8SUbTX50P6EdhbW9YWcgbZVb52R4cq6MK+zsoMjRq7rGvV5ztA05QnbaCYqMYx8rTY7KAIA3Crdo4Q==",
+            "version": "1.15.33",
+            "resolved": "https://registry.npmjs.org/@swc/core-linux-x64-musl/-/core-linux-x64-musl-1.15.33.tgz",
+            "integrity": "sha512-hj628ZkSEJf6zMf5VMbYrG2O6QqyTIp2qwY6VlCjvIa9lAEZ5c2lfPblCLVGYubTeLJDxadLB/CxqQYOQABeEQ==",
             "cpu": [
                 "x64"
             ],
@@ -4761,9 +4761,9 @@
             }
         },
         "node_modules/@swc/core-win32-arm64-msvc": {
-            "version": "1.15.32",
-            "resolved": "https://registry.npmjs.org/@swc/core-win32-arm64-msvc/-/core-win32-arm64-msvc-1.15.32.tgz",
-            "integrity": "sha512-01yN0o9jvo8xBTP12aPK2wW8b41jmOlGbDDlAnoynotc4pO6xA0zby9f1z6j++qXDpGBttLySq1omgVrlQKYcw==",
+            "version": "1.15.33",
+            "resolved": "https://registry.npmjs.org/@swc/core-win32-arm64-msvc/-/core-win32-arm64-msvc-1.15.33.tgz",
+            "integrity": "sha512-GV2oohtN2/5+KSccl86VULu3aT+LrISC8uzgSq0FRnikpD+Zwc+sBlXmoKQ+Db6jI57ITUOIB8jRkdGMABC29g==",
             "cpu": [
                 "arm64"
             ],
@@ -4777,9 +4777,9 @@
             }
         },
         "node_modules/@swc/core-win32-ia32-msvc": {
-            "version": "1.15.32",
-            "resolved": "https://registry.npmjs.org/@swc/core-win32-ia32-msvc/-/core-win32-ia32-msvc-1.15.32.tgz",
-            "integrity": "sha512-fLagI9XZYNpTcmlqAcp3KBtmj7E19WCmYD80Jxj1Kn5tGNa7yxNLd3NNdWxuZGUPl5iC0/KqZru7g08gF6Fsrw==",
+            "version": "1.15.33",
+            "resolved": "https://registry.npmjs.org/@swc/core-win32-ia32-msvc/-/core-win32-ia32-msvc-1.15.33.tgz",
+            "integrity": "sha512-gtyvzSNR8DHKfFEA2uqb8Ld1myqi6uEg2jyeUq3ikn5ytYs7H8RpZYC8mdy4NXr8hfcdJfCLXPlYaqqfBXpoEQ==",
             "cpu": [
                 "ia32"
             ],
@@ -4793,9 +4793,9 @@
             }
         },
         "node_modules/@swc/core-win32-x64-msvc": {
-            "version": "1.15.32",
-            "resolved": "https://registry.npmjs.org/@swc/core-win32-x64-msvc/-/core-win32-x64-msvc-1.15.32.tgz",
-            "integrity": "sha512-gbc2bQ/T2CiR+w0OvcVKwLOFAcPZBvmWmolbwpg1E8UrpeC03DGtyMUApOHNXNYWA3SHFrYXCQtosrcMza1YFg==",
+            "version": "1.15.33",
+            "resolved": "https://registry.npmjs.org/@swc/core-win32-x64-msvc/-/core-win32-x64-msvc-1.15.33.tgz",
+            "integrity": "sha512-d6fRqQSkJI+kmMEBWaDQ7TMl8+YjLYbwRUPZQ9DY0ORBJeTzOrG0twvfvlZ2xgw6jA0ScQKgfBm4vHLSLl5Hqg==",
             "cpu": [
                 "x64"
             ],
@@ -7475,9 +7475,9 @@
             }
         },
         "node_modules/country-flag-icons": {
-            "version": "1.6.16",
-            "resolved": "https://registry.npmjs.org/country-flag-icons/-/country-flag-icons-1.6.16.tgz",
-            "integrity": "sha512-HxJVoE/aaZGcUMx1vK/u9430uKGB3ODZDDZJJOqVJQzoHk5v42c0fSp1rk4tDfyr1dVOJjwxRiaBPliBMo2Liw==",
+            "version": "1.6.17",
+            "resolved": "https://registry.npmjs.org/country-flag-icons/-/country-flag-icons-1.6.17.tgz",
+            "integrity": "sha512-Nmik0289ZVZSI3c7mJR/amg6DyY7Z59b0sTFSKayeX72mHfPzCPJygwJs2pYgQULzuAyWeCUgwAJ+Dq8OR+JFw==",
             "license": "MIT"
         },
         "node_modules/crelt": {
@@ -10748,9 +10748,9 @@
             }
         },
         "node_modules/ip-address": {
-            "version": "10.1.0",
-            "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.1.0.tgz",
-            "integrity": "sha512-XXADHxXmvT9+CRxhXg56LJovE+bmWnEWB78LB83VZTprKTmaC5QfruXocxzTZ2Kl0DNwKuBdlIhjL8LeY8Sf8Q==",
+            "version": "10.2.0",
+            "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz",
+            "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==",
             "license": "MIT",
             "optional": true,
             "engines": {
@@ -19093,9 +19093,9 @@
             "license": "ISC"
         },
         "node_modules/yaml": {
-            "version": "2.8.3",
-            "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.3.tgz",
-            "integrity": "sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg==",
+            "version": "2.8.4",
+            "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.4.tgz",
+            "integrity": "sha512-ml/JPOj9fOQK8RNnWojA67GbZ0ApXAUlN2UQclwv2eVgTgn7O9gg9o7paZWKMp4g0H3nTLtS9LVzhkpOFIKzog==",
             "license": "ISC",
             "bin": {
                 "yaml": "bin.mjs"
@@ -19280,7 +19280,7 @@
                 "@rollup/plugin-node-resolve": "^16.0.3",
                 "@rollup/plugin-swc": "^0.4.0",
                 "@swc/cli": "^0.8.1",
-                "@swc/core": "^1.15.32",
+                "@swc/core": "^1.15.33",
                 "@webcomponents/template": "^1.5.1",
                 "base64-js": "^1.5.1",
                 "core-js": "^3.49.0",

web/package.json

@@ -142,7 +142,7 @@
         "chartjs-adapter-date-fns": "^3.0.0",
         "codemirror": "^6.0.2",
         "core-js": "^3.49.0",
-        "country-flag-icons": "^1.6.16",
+        "country-flag-icons": "^1.6.17",
         "date-fns": "^4.1.0",
         "deepmerge-ts": "^7.1.5",
         "dompurify": "^3.4.2",
@@ -194,7 +194,7 @@
         "vitest": "^4.1.1",
         "webcomponent-qr-code": "^1.3.0",
         "wireit": "^0.14.12",
-        "yaml": "^2.8.3"
+        "yaml": "^2.8.4"
     },
     "optionalDependencies": {
         "@esbuild/darwin-arm64": "^0.28.0",

web/packages/lex/index.js

@@ -7,152 +7,186 @@
  */
 
 /**
- * @typedef {(this: Lexer, chr: string) => any} DefunctFunction
+ * A token produced by a {@link LexerAction}. The lexer is agnostic to the
+ * concrete token shape; consumers pick whatever representation suits them.
+ *
+ * @typedef {unknown} Token
  */
 
 /**
- * @typedef {(this: Lexer, ...args: RegExpExecArray) => string | string[] | undefined} RuleAction
+ * A rule action. Invoked with the regex match (full match followed by capture
+ * groups) bound to the owning {@link Lexer} so it can read or set `state`,
+ * `index`, and `reject`.
+ *
+ * Return values:
+ * - `null` (or `undefined` from an implicit return) — discard the match and continue scanning.
+ * - a single token — yield it from {@link Lexer.lex}.
+ * - an array of tokens — yield the first; queue the rest for subsequent calls.
+ *
+ * @callback LexerAction
+ * @this {Lexer}
+ * @param {...string} match
+ * @returns {Token | Token[] | null | void}
  */
 
 /**
- * @typedef {Object} Rule
- * @property {RegExp} pattern
- * @property {boolean} global
- * @property {RuleAction} action
- * @property {number[]} start
+ * @typedef {object} LexerRule
+ * @property {RegExp} pattern Sticky-compiled pattern used to probe the input.
+ * @property {boolean} global Whether the user-supplied pattern was global.
+ * @property {LexerAction} action
+ * @property {number[]} start States in which the rule is active. `[0]` is the default state; an empty array means "any state".
  */
 
 /**
- * @typedef {Object} Match
+ * @typedef {object} LexerMatch
  * @property {RegExpExecArray} result
- * @property {RuleAction} action
+ * @property {LexerAction} action
  * @property {number} length
+ * @property {boolean} global Whether the producing rule was declared with the `g` flag.
  */
 
+/**
+ * Handler invoked when no rule matches at the current position.
+ *
+ * @callback DefunctHandler
+ * @this {Lexer}
+ * @param {string} chr The unexpected character.
+ * @returns {Token | Token[] | null | void}
+ */
+
+/**
+ * @type {DefunctHandler}
+ */
+function defaultDefunct(chr) {
+    throw new Error(`Unexpected character at index ${this.index - 1}: ${chr}`);
+}
+
 /**
  * Lexer class for tokenizing input strings.
  */
 export class Lexer {
     /**
-     * @type {string[]}
-     */
-    tokens = [];
-    /**
-     * @type {Rule[]}
-     */
-    rules = [];
-    /**
-     * @type {number}
-     */
-    remove = 0;
-    /**
+     * Current lexer state. Rules whose `start` array contains this value (or
+     * is empty) are eligible to match. Odd-numbered states are also matched
+     * by rules declared with `start: [0]`, mirroring flex's inclusive states.
+     *
      * @type {number}
      */
     state = 0;
-    /**
-     * @type {number}
-     */
+
+    /** @type {number} */
     index = 0;
-    /**
-     * @type {string}
-     */
+
+    /** @type {string} */
     input = "";
 
     /**
-     * @param {DefunctFunction} [defunct]
+     * When set to `true` from inside an action, the current match is rolled
+     * back and the next-best match is tried instead.
+     *
+     * @type {boolean}
+     */
+    reject = false;
+
+    /** @type {LexerRule[]} */
+    #rules = [];
+
+    /** @type {Token[]} */
+    #tokens = [];
+
+    /** @type {number} */
+    #remove = 0;
+
+    /** @type {DefunctHandler} */
+    #defunct;
+
+    /**
+     * @param {DefunctHandler} [defunct] Optional handler for unexpected characters.
      */
     constructor(defunct) {
-        defunct ||= function (chr) {
-            throw new Error("Unexpected character at index " + (this.index - 1) + ": " + chr);
-        };
-
-        this.defunct = defunct;
+        this.#defunct = typeof defunct === "function" ? defunct : defaultDefunct;
     }
 
     /**
-     * Add a lexing rule.
+     * Register a tokenization rule.
      *
      * @param {RegExp} pattern
-     * @param {RuleAction} action
-     * @param {number[]} [start]
-     * @returns {Lexer}
+     * @param {LexerAction} action
+     * @param {number[]} [start] States in which the rule is active. Defaults to `[0]`.
+     * @returns {this}
      */
-    addRule = (pattern, action, start) => {
+    addRule(pattern, action, start) {
         const global = pattern.global;
 
         if (!global || !pattern.sticky) {
             let flags = "gy";
-
             if (pattern.multiline) flags += "m";
             if (pattern.ignoreCase) flags += "i";
             if (pattern.unicode) flags += "u";
             pattern = new RegExp(pattern.source, flags);
         }
 
-        if (!Array.isArray(start)) start = [0];
-
-        this.rules.push({
-            pattern: pattern,
-            global: global,
-            action: action,
-            start: start,
+        this.#rules.push({
+            pattern,
+            global,
+            action,
+            start: Array.isArray(start) ? start : [0],
         });
 
         return this;
-    };
+    }
 
     /**
-     * Set the input string for lexing.
+     * Reset the lexer and load a new input string.
      *
      * @param {string} input
-     * @returns {Lexer}
+     * @returns {this}
      */
-    setInput = (input) => {
-        this.remove = 0;
+    setInput(input) {
+        this.#remove = 0;
         this.state = 0;
         this.index = 0;
-        this.tokens.length = 0;
+        this.#tokens.length = 0;
         this.input = input;
         return this;
-    };
+    }
 
     /**
-     * Lex the next token from the input.
+     * Produce the next token from the input, or `null` once exhausted.
      *
-     * @returns {string | string[] | undefined}
+     * @returns {Token | null}
      */
-    lex = () => {
-        if (this.tokens.length) return this.tokens.shift();
+    lex() {
+        if (this.#tokens.length) return /** @type {Token} */ (this.#tokens.shift());
 
         this.reject = true;
 
         while (this.index <= this.input.length) {
-            const matches = this.scan().splice(this.remove);
+            const matches = this.#scan().splice(this.#remove);
             const index = this.index;
 
             while (matches.length) {
-                if (!this.reject) {
-                    break;
-                }
-                const match = matches.shift();
+                if (!this.reject) break;
 
-                if (!match) break;
-
-                const result = match.result;
-                const length = match.length;
+                const match = /** @type {LexerMatch} */ (matches.shift());
+                const { result, length } = match;
                 this.index += length;
                 this.reject = false;
-                this.remove++;
+                this.#remove++;
 
-                let token = match.action.apply(this, result);
+                let token = match.action.apply(
+                    this,
+                    /** @type {string[]} */ (/** @type {unknown} */ (result)),
+                );
 
                 if (this.reject) {
                     this.index = result.index;
-                } else if (Array.isArray(token)) {
-                    this.tokens = token.slice(1);
-                    token = token[0];
-                } else {
-                    if (length) this.remove = 0;
+                } else if (token !== null && token !== undefined) {
+                    if (Array.isArray(token)) {
+                        this.#tokens = token.slice(1);
+                        token = token[0];
+                    }
+                    if (length) this.#remove = 0;
                     return token;
                 }
             }
@@ -161,79 +195,82 @@ export class Lexer {
 
             if (index < input.length) {
                 if (this.reject) {
-                    this.remove = 0;
-                    const token = this.defunct(input.charAt(this.index++));
-                    if (typeof token !== "undefined") {
+                    this.#remove = 0;
+                    const token = this.#defunct(input.charAt(this.index++));
+                    if (token !== null && token !== undefined) {
                         if (Array.isArray(token)) {
-                            this.tokens = token.slice(1);
+                            this.#tokens = token.slice(1);
                             return token[0];
                         }
-
                         return token;
                     }
                 } else {
-                    if (this.index !== index) this.remove = 0;
+                    if (this.index !== index) this.#remove = 0;
                     this.reject = true;
                 }
-            } else if (matches.length) this.reject = true;
-            else break;
+            } else if (matches.length) {
+                this.reject = true;
+            } else {
+                break;
+            }
         }
-    };
+
+        return null;
+    }
 
     /**
-     * Scan the input for matches.
+     * Probe every state-eligible rule at the current position, returning the
+     * matches sorted by length (longest first), with global rules pinned
+     * after non-global ones to preserve flex's "longest non-global wins"
+     * tie-breaking.
      *
-     * @returns {Match[]}
+     * @returns {LexerMatch[]}
      */
-    scan = () => {
-        /**
-         * @type {Match[]}
-         */
+    #scan() {
+        /** @type {LexerMatch[]} */
         const matches = [];
-        let index = 0;
 
         const state = this.state;
         const lastIndex = this.index;
         const input = this.input;
 
-        for (let i = 0, length = this.rules.length; i < length; i++) {
-            const rule = this.rules[i];
+        for (const rule of this.#rules) {
             const start = rule.start;
             const states = start.length;
+            const eligible =
+                !states || start.indexOf(state) >= 0 || (state % 2 && states === 1 && !start[0]);
 
-            if (!states || start.indexOf(state) >= 0 || (state % 2 && states === 1 && !start[0])) {
-                const pattern = rule.pattern;
-                pattern.lastIndex = lastIndex;
-                const result = pattern.exec(input);
+            if (!eligible) continue;
 
-                if (!result || result.index !== lastIndex) {
-                    continue;
-                }
+            const pattern = rule.pattern;
+            pattern.lastIndex = lastIndex;
+            const result = pattern.exec(input);
 
-                let j = matches.push({
-                    result: result,
-                    action: rule.action,
-                    length: result[0].length,
-                });
+            if (!result || result.index !== lastIndex) continue;
 
-                if (rule.global) {
-                    index = j;
-                }
+            let j = matches.push({
+                result,
+                action: rule.action,
+                length: result[0].length,
+                global: rule.global,
+            });
 
-                while (--j > index) {
-                    const k = j - 1;
+            while (--j > 0) {
+                const k = j - 1;
+                const cur = matches[j];
+                const prev = matches[k];
+                const longer = cur.length > prev.length;
+                const tieFavorsCur = cur.length === prev.length && prev.global && !cur.global;
 
-                    if (matches[j].length > matches[k].length) {
-                        const temple = matches[j];
-                        matches[j] = matches[k];
-                        matches[k] = temple;
-                    }
-                }
+                if (!longer && !tieFavorsCur) break;
+
+                matches[j] = prev;
+                matches[k] = cur;
             }
         }
 
         return matches;
-    };
+    }
 }
 
 export default Lexer;

web/packages/sfe/package.json

@@ -20,7 +20,7 @@
         "@rollup/plugin-node-resolve": "^16.0.3",
         "@rollup/plugin-swc": "^0.4.0",
         "@swc/cli": "^0.8.1",
-        "@swc/core": "^1.15.32",
+        "@swc/core": "^1.15.33",
         "@webcomponents/template": "^1.5.1",
         "base64-js": "^1.5.1",
         "core-js": "^3.49.0",

web/src/admin/brands/BrandForm.ts

@@ -23,6 +23,7 @@ import { certificateProvider, certificateSelector } from "#admin/brands/Certific
 
 import {
     Application,
+    AuthenticationEnum,
     Brand,
     CoreApi,
     CoreApplicationsListRequest,
@@ -31,7 +32,6 @@ import {
     FlowsApi,
     UsageEnum,
 } from "@goauthentik/api";
-import { AuthenticationEnum } from "@goauthentik/api/dist/models/AuthenticationEnum.js";
 
 import YAML from "yaml";
 

web/src/admin/flows/FlowForm.ts

@@ -17,6 +17,7 @@ import { DesignationToLabel, LayoutToLabel } from "#admin/flows/utils";
 import { policyEngineModes } from "#admin/policies/PolicyEngineModes";
 
 import {
+    AuthenticationEnum,
     DeniedActionEnum,
     Flow,
     FlowDesignationEnum,
@@ -24,7 +25,6 @@ import {
     FlowsApi,
     UsageEnum,
 } from "@goauthentik/api";
-import { AuthenticationEnum } from "@goauthentik/api/dist/models/AuthenticationEnum.js";
 
 import { msg } from "@lit/localize";
 import { html, TemplateResult } from "lit";

web/src/admin/stages/BaseStageForm.ts

@@ -1,6 +1,6 @@
 import { ModelForm } from "#elements/forms/ModelForm";
 
-import type { Stage } from "@goauthentik/api/dist/models/Stage";
+import type { Stage } from "@goauthentik/api";
 
 import { msg } from "@lit/localize";
 

web/src/admin/stages/user_write/UserWriteStageForm.ts

@@ -19,10 +19,10 @@ import {
     CoreGroupsListRequest,
     Group,
     StagesApi,
+    UserCreationModeEnum,
     UserTypeEnum,
     UserWriteStage,
 } from "@goauthentik/api";
-import { UserCreationModeEnum } from "@goauthentik/api/dist/models/UserCreationModeEnum.js";
 
 import { msg } from "@lit/localize";
 import { html, TemplateResult } from "lit";

web/src/flow/stages/identification/IdentificationStage.ts

@@ -386,7 +386,7 @@ export class IdentificationStage extends BaseStage<
         return html`<a
             href=${url}
             class="pf-c-button pf-m-secondary pf-m-block"
-            ouiaId="passwordless"
+            data-ouia-component-id="passwordless"
         >
             ${msg("Use a security key")}
         </a> `;
@@ -475,12 +475,12 @@ export class IdentificationStage extends BaseStage<
             ${enrollUrl
                 ? html`<div class="pf-c-login__main-footer-band-item">
                       ${msg("Need an account?")}
-                      <a href="${enrollUrl}" ouiaId="enroll">${msg("Sign up.")}</a>
+                      <a href="${enrollUrl}" data-ouia-component-id="enroll">${msg("Sign up.")}</a>
                   </div>`
                 : nothing}
             ${recoveryUrl
                 ? html`<div class="pf-c-login__main-footer-band-item">
-                      <a href="${recoveryUrl}" ouiaId="recovery"
+                      <a href="${recoveryUrl}" data-ouia-component-id="recovery"
                           >${msg("Forgot username or password?")}</a
                       >
                   </div>`

web/test/unit/lexer.test.ts

@@ -0,0 +1,317 @@
+/* eslint-disable func-names */
+import { Lexer } from "lex";
+import { describe, expect, it, vi } from "vitest";
+
+const drain = (lexer: Lexer): unknown[] => {
+    const out: unknown[] = [];
+    let token: unknown;
+
+    while ((token = lexer.lex()) !== null) {
+        out.push(token);
+    }
+    return out;
+};
+
+describe("Lexer", () => {
+    describe("addRule", () => {
+        it("returns the lexer for chaining", () => {
+            const lexer = new Lexer();
+            expect(lexer.addRule(/a/, () => "a")).toBe(lexer);
+        });
+
+        it("preserves multiline, ignoreCase, and unicode flags when re-compiling", () => {
+            const lexer = new Lexer(() => null);
+            const seen: string[] = [];
+
+            lexer.addRule(/^a/im, (m) => {
+                seen.push(m);
+            });
+            lexer.setInput("A\nA");
+
+            drain(lexer);
+            expect(seen).toEqual(["A", "A"]);
+        });
+
+        it("matches unicode patterns", () => {
+            const lexer = new Lexer();
+            lexer.addRule(/\p{Letter}+/u, (m) => m);
+            lexer.setInput("café");
+
+            expect(lexer.lex()).toBe("café");
+        });
+    });
+
+    describe("setInput", () => {
+        it("resets state, index, and pending tokens", () => {
+            const lexer = new Lexer();
+            lexer.addRule(/./, (c) => c);
+
+            lexer.setInput("ab");
+            expect(lexer.lex()).toBe("a");
+            lexer.state = 7;
+
+            lexer.setInput("xy");
+            expect(lexer.state).toBe(0);
+            expect(lexer.index).toBe(0);
+            expect(lexer.lex()).toBe("x");
+            expect(lexer.lex()).toBe("y");
+        });
+
+        it("returns the lexer for chaining", () => {
+            const lexer = new Lexer();
+            expect(lexer.setInput("")).toBe(lexer);
+        });
+    });
+
+    describe("tokenization", () => {
+        it("tokenizes a simple expression", () => {
+            const lexer = new Lexer();
+            lexer
+                .addRule(/\s+/, () => null)
+                .addRule(/[a-zA-Z]+/, (m) => ({ type: "ident", value: m }))
+                .addRule(/\d+/, (m) => ({ type: "num", value: Number(m) }))
+                .addRule(/[+\-*/]/, (m) => ({ type: "op", value: m }));
+
+            lexer.setInput("foo + 12 * bar");
+            expect(drain(lexer)).toEqual([
+                { type: "ident", value: "foo" },
+                { type: "op", value: "+" },
+                { type: "num", value: 12 },
+                { type: "op", value: "*" },
+                { type: "ident", value: "bar" },
+            ]);
+        });
+
+        it("skips matches whose action returns null", () => {
+            const lexer = new Lexer();
+            lexer.addRule(/\s+/, () => null).addRule(/\S+/, (m) => m);
+
+            lexer.setInput("   foo   bar   ");
+            expect(drain(lexer)).toEqual(["foo", "bar"]);
+        });
+
+        it("returns null once the input is exhausted", () => {
+            const lexer = new Lexer();
+            lexer.addRule(/./, (c) => c);
+            lexer.setInput("a");
+
+            expect(lexer.lex()).toBe("a");
+            expect(lexer.lex()).toBeNull();
+            expect(lexer.lex()).toBeNull();
+        });
+
+        it("passes capture groups to the action", () => {
+            const lexer = new Lexer();
+            const calls: string[][] = [];
+
+            lexer.addRule(/(\w+)=(\w+)/, (...args) => {
+                calls.push(args);
+                return args[0];
+            });
+
+            lexer.setInput("foo=bar");
+            lexer.lex();
+            expect(calls).toEqual([["foo=bar", "foo", "bar"]]);
+        });
+
+        it("binds `this` to the lexer inside the action", () => {
+            const lexer = new Lexer();
+            let captured: Lexer | undefined;
+
+            lexer.addRule(/a/, function () {
+                // eslint-disable-next-line consistent-this, @typescript-eslint/no-this-alias
+                captured = this;
+                return "a";
+            });
+
+            lexer.setInput("a");
+            lexer.lex();
+            expect(captured).toBe(lexer);
+        });
+    });
+
+    describe("longest-match tie-breaking", () => {
+        it("prefers the longer non-global match", () => {
+            const lexer = new Lexer();
+            lexer.addRule(/if/, () => "KW_IF").addRule(/iffy/, () => "IDENT_IFFY");
+
+            lexer.setInput("iffy");
+            expect(lexer.lex()).toBe("IDENT_IFFY");
+        });
+
+        it("treats global rules as fallbacks behind non-global rules of the same length", () => {
+            const lexer = new Lexer();
+            lexer.addRule(/[a-z]+/g, (m) => `g:${m}`).addRule(/foo/, (m) => `s:${m}`);
+
+            lexer.setInput("foo");
+            expect(lexer.lex()).toBe("s:foo");
+        });
+    });
+
+    describe("multi-token return", () => {
+        it("yields the first token immediately and queues the rest", () => {
+            const lexer = new Lexer();
+            lexer.addRule(/a/, () => ["A1", "A2", "A3"]);
+
+            lexer.setInput("a");
+            expect(lexer.lex()).toBe("A1");
+            expect(lexer.lex()).toBe("A2");
+            expect(lexer.lex()).toBe("A3");
+            expect(lexer.lex()).toBeNull();
+        });
+
+        it("drains the queue before scanning further input", () => {
+            const lexer = new Lexer();
+            lexer.addRule(/a/, () => ["A1", "A2"]).addRule(/b/, () => "B");
+
+            lexer.setInput("ab");
+            expect(drain(lexer)).toEqual(["A1", "A2", "B"]);
+        });
+    });
+
+    describe("reject", () => {
+        it("falls through to the next-best match when an action sets reject", () => {
+            const lexer = new Lexer();
+            const order: string[] = [];
+
+            lexer
+                .addRule(/foo/, function () {
+                    order.push("first");
+                    this.reject = true;
+                })
+                .addRule(/foo/, () => {
+                    order.push("second");
+                    return "FOO";
+                });
+
+            lexer.setInput("foo");
+            expect(lexer.lex()).toBe("FOO");
+            expect(order).toEqual(["first", "second"]);
+        });
+
+        it("rolls back the lexer index when an action rejects", () => {
+            const lexer = new Lexer();
+
+            lexer
+                .addRule(/abc/, function () {
+                    this.reject = true;
+                })
+                .addRule(/a/, (m) => m);
+
+            lexer.setInput("abc");
+            expect(lexer.lex()).toBe("a");
+            expect(lexer.index).toBe(1);
+        });
+    });
+
+    describe("defunct handling", () => {
+        it("throws by default on unexpected characters", () => {
+            const lexer = new Lexer();
+            lexer.addRule(/a/, (m) => m);
+
+            lexer.setInput("a@");
+            expect(lexer.lex()).toBe("a");
+            expect(() => lexer.lex()).toThrow(/Unexpected character at index 1: @/);
+        });
+
+        it("invokes a custom defunct handler with the offending character", () => {
+            const defunct = vi.fn((chr: string) => `?${chr}`);
+            const lexer = new Lexer(defunct);
+            lexer.addRule(/a/, (m) => m);
+
+            lexer.setInput("a@b");
+            expect(drain(lexer)).toEqual(["a", "?@", "?b"]);
+            expect(defunct).toHaveBeenCalledTimes(2);
+            expect(defunct.mock.calls[0]?.[0]).toBe("@");
+        });
+
+        it("ignores defunct return values that are null", () => {
+            const lexer = new Lexer((_chr) => null);
+            lexer.addRule(/a/, (m) => m);
+
+            lexer.setInput("@@a");
+            expect(lexer.lex()).toBe("a");
+            expect(lexer.lex()).toBeNull();
+        });
+
+        it("supports array returns from the defunct handler", () => {
+            const lexer = new Lexer((chr) => [`bad:${chr}`, "extra"]);
+            lexer.addRule(/a/, (m) => m);
+
+            lexer.setInput("@");
+            expect(lexer.lex()).toBe("bad:@");
+            expect(lexer.lex()).toBe("extra");
+        });
+
+        it("falls back to the default handler when given a non-function", () => {
+            // @ts-expect-error — exercising the runtime guard
+            const lexer = new Lexer("not a function");
+            lexer.setInput("@");
+            expect(() => lexer.lex()).toThrow(/Unexpected character/);
+        });
+    });
+
+    describe("states", () => {
+        it("only fires rules whose start array includes the current state", () => {
+            const lexer = new Lexer();
+
+            lexer
+                .addRule(/"/, function () {
+                    this.state = 2;
+                })
+                .addRule(
+                    /"/,
+                    function () {
+                        this.state = 0;
+                    },
+                    [2],
+                )
+                .addRule(/[^"]+/, (m) => `STR:${m}`, [2])
+                .addRule(/[a-z]+/, (m) => `ID:${m}`);
+
+            lexer.setInput('foo"hello"bar');
+            expect(drain(lexer)).toEqual(["ID:foo", "STR:hello", "ID:bar"]);
+        });
+
+        it("treats an empty start array as 'active in any state'", () => {
+            const lexer = new Lexer();
+
+            lexer
+                .addRule(/!/, function () {
+                    this.state = 5;
+                    return "BANG";
+                })
+                .addRule(/./, (m) => m, []);
+
+            lexer.setInput("a!b");
+            expect(drain(lexer)).toEqual(["a", "BANG", "b"]);
+        });
+
+        it("matches inclusive `[0]` rules from odd-numbered states", () => {
+            const lexer = new Lexer();
+
+            lexer
+                .addRule(/#/, function () {
+                    this.state = 1;
+                })
+                .addRule(/[a-z]+/, (m) => m);
+
+            lexer.setInput("ab#cd");
+            expect(drain(lexer)).toEqual(["ab", "cd"]);
+        });
+
+        it("does not match `[0]` rules from even non-zero states", () => {
+            const lexer = new Lexer();
+
+            lexer
+                .addRule(/#/, function () {
+                    this.state = 2;
+                })
+                .addRule(/[a-z]+/, (m) => m);
+
+            lexer.setInput("ab#cd");
+            expect(lexer.lex()).toBe("ab");
+            expect(() => lexer.lex()).toThrow(/Unexpected character/);
+        });
+    });
+});

web/test/unit/tsconfig.json

@@ -0,0 +1,35 @@
+// @file TSConfig used by the web package during development.
+{
+    "extends": "@goauthentik/tsconfig",
+    "compilerOptions": {
+        "types": ["node"],
+        "checkJs": true,
+        "allowJs": true,
+        "composite": true,
+        "resolveJsonModule": true,
+        "allowSyntheticDefaultImports": true,
+        "emitDeclarationOnly": true,
+        "target": "esnext",
+        "module": "preserve",
+        "moduleResolution": "bundler",
+        "lib": ["DOM", "DOM.Iterable", "ESNext"],
+
+        "noUncheckedIndexedAccess": true
+    },
+    "include": ["./**/*", "../**/*"],
+    "exclude": [
+        // ---
+        "**/out/**/*",
+        "**/dist/**/*",
+        "storybook-static",
+        // TODO: @lit/localize-tools v0.8.0 has a nullish coalescing typing error.
+        // Remove when we upgrade past that.
+        "scripts/pseudolocalize.mjs",
+        "scripts/build-locales.mjs"
+    ],
+    "references": [
+        {
+            "path": "../.."
+        }
+    ]
+}

web/vite.config.js

@@ -41,9 +41,12 @@ export default defineConfig({
         projects: [
             {
                 test: {
-                    include: ["./unit/**/*.{test,spec}.ts", "**/*.unit.{test,spec}.ts"],
-                    name: "unit",
+                    include: ["./test/unit/**/*.{test,spec}.ts", "**/*.unit.{test,spec}.ts"],
+                    name: "Unit Tests",
                     environment: "node",
+                    typecheck: {
+                        tsconfig: "./tsconfig.unit.json",
+                    },
                 },
             },
             {
@@ -51,7 +54,7 @@ export default defineConfig({
                     setupFiles: ["./test/lit/setup.js"],
 
                     include: ["./browser/**/*.{test,spec}.ts", "**/*.browser.{test,spec}.ts"],
-                    name: "browser",
+                    name: "Browser Tests",
                     browser: {
                         enabled: true,
                         provider: playwright(),

web/xliff/cs-CZ.xlf

@@ -6255,18 +6255,6 @@ neprojde, když jedna nebo obě z vybraných možností jsou rovny nebo nad prah
   <source>Authenticator Attachment</source>
   <target>Příloha autentikátoru</target>
 </trans-unit>
-<trans-unit id="s502d2473587032e1">
-  <source>No preference is sent</source>
-  <target>Není odesílána žádná preference</target>
-</trans-unit>
-<trans-unit id="s60cc554fde2676cb">
-  <source>A non-removable authenticator, like TouchID or Windows Hello</source>
-  <target>Neodstranitelný autentikátor, jako TouchID nebo Windows Hello</target>
-</trans-unit>
-<trans-unit id="sdf1d8edef27236f0">
-  <source>A "roaming" authenticator, like a YubiKey</source>
-  <target>„Roamingový" autentikátor, jako YubiKey</target>
-</trans-unit>
 <trans-unit id="sbd65aeeb8a3b9bbc">
   <source>Maximum registration attempts</source>
   <target>Maximální počet pokusů o registraci</target>
@@ -6602,10 +6590,6 @@ neprojde, když jedna nebo obě z vybraných možností jsou rovny nebo nad prah
   <source>Selected policies are executed when the stage is submitted to validate the data.</source>
   <target>Vybrané zásady jsou provedeny při odeslání kroku k ověření dat.</target>
 </trans-unit>
-<trans-unit id="sc487e11d5987dbb4">
-  <source>Redirect the user to another flow, potentially with all gathered context</source>
-  <target>Přesměrovat uživatele na jiný tok, potenciálně se všemi shromážděnými kontextovými informacemi</target>
-</trans-unit>
 <trans-unit id="sad9d5481474d4f5b">
   <source>Static</source>
   <target>Statický</target>
@@ -11064,15 +11048,6 @@ Vazby na skupiny/uživatele jsou kontrolovány vůči uživateli události.</tar
 <trans-unit id="sdcd1a9744efdbd7e">
   <source>Choose Policy Type</source>
 </trans-unit>
-<trans-unit id="sf4eb7c0c8e92e6b2">
-  <source>Whether the launch URL will open in a new browser tab or window from the user's application library.</source>
-</trans-unit>
-<trans-unit id="s8ab0176c9cf77b1a">
-  <source>Hide from User Dashboard</source>
-</trans-unit>
-<trans-unit id="s0b5847edb7150911">
-  <source>Whether this application will be shown on the User Dashboard.</source>
-</trans-unit>
 <trans-unit id="saa5ed8446baaba70">
   <source>Negate Result</source>
 </trans-unit>
@@ -11085,11 +11060,140 @@ Vazby na skupiny/uživatele jsou kontrolovány vůči uživateli události.</tar
 <trans-unit id="s41938ae69656ef53">
   <source>User Fields</source>
 </trans-unit>
-<trans-unit id="s977b2dff8b9def14">
-  <source>User Dashboard - Applications</source>
+<trans-unit id="s02b73793e5b4e1ba">
+  <source>This flag is deprecated.</source>
 </trans-unit>
-<trans-unit id="s190cbdd5b62e4746">
-  <source>User Dashboard</source>
+<trans-unit id="s8655c52824caac63">
+  <source>If checked, the launch URL will open in a new browser tab or window from the user's application library.</source>
+</trans-unit>
+<trans-unit id="s9eda7101f63a8652">
+  <source>Hide from My applications</source>
+</trans-unit>
+<trans-unit id="s30f30e9c42594a33">
+  <source>If checked, this application will not be shown on the user's My applications page.</source>
+</trans-unit>
+<trans-unit id="sc98037ccab57d329">
+  <source>No preference: the browser may offer any available authenticator</source>
+</trans-unit>
+<trans-unit id="s4611c85865abcba9">
+  <source>Platform: a non-removable authenticator built into the device, such as Touch ID, Face ID, or Windows Hello</source>
+</trans-unit>
+<trans-unit id="s0003d0e3fcdacabc">
+  <source>Cross-platform: a roaming authenticator, such as a YubiKey or Google Titan</source>
+</trans-unit>
+<trans-unit id="sc157c7dcb3d1b096">
+  <source>Controls the authenticatorAttachment parameter sent to the browser during WebAuthn registration. If Hints are configured and this is left as 'No preference', a value is inferred from the selected hints for backward compatibility with older browsers.</source>
+</trans-unit>
+<trans-unit id="s1baea1b8ac34d554">
+  <source>New Invitation</source>
+</trans-unit>
+<trans-unit id="s03eef6107e28d042">
+  <source>New Invitation options</source>
+</trans-unit>
+<trans-unit id="s0832ff81b9665e6f">
+  <source>Opens the new invitation wizard and binds the invitation to an existing enrollment flow.</source>
+</trans-unit>
+<trans-unit id="sc0819dc3d82d9320">
+  <source>with Existing Enrollment Flow...</source>
+</trans-unit>
+<trans-unit id="s79108cb25e7bf07b">
+  <source>Opens the new invitation wizard, which will create a new enrollment flow and invitation stage.</source>
+</trans-unit>
+<trans-unit id="sb7809157a3ccf613">
+  <source>with New Enrollment Flow and Invitation Stage...</source>
+</trans-unit>
+<trans-unit id="seb418067e7d6c6e2">
+  <source>Create a new invitation with an enrollment flow.</source>
+</trans-unit>
+<trans-unit id="sfd74a380e957d0d3">
+  <source>Enrollment Flow</source>
+</trans-unit>
+<trans-unit id="scc869d556216d748">
+  <source>Invitation Details</source>
+</trans-unit>
+<trans-unit id="se1fba44a9b284052">
+  <source>Invitation Link</source>
+</trans-unit>
+<trans-unit id="s967a2db7049dc90e">
+  <source><x id="0" equiv-text="${step}"/> failed</source>
+</trans-unit>
+<trans-unit id="s971d4cc0ecd106b7">
+  <source>Importing enrollment flow blueprint</source>
+</trans-unit>
+<trans-unit id="sf3b89a70e20af6c8">
+  <source>Blueprint validation failed</source>
+</trans-unit>
+<trans-unit id="sa04b7204708f4f74">
+  <source>Flow with slug "<x id="0" equiv-text="${slugToLookup}"/>" not found after import</source>
+</trans-unit>
+<trans-unit id="s3354be88ad29d171">
+  <source>Creating invitation</source>
+</trans-unit>
+<trans-unit id="s07f41353777196ea">
+  <source>The flow selected in the previous step. The invitation will be bound to this flow.</source>
+</trans-unit>
+<trans-unit id="s7209a11f97da9aff">
+  <source>No invitation available to send</source>
+</trans-unit>
+<trans-unit id="s2772d8285b905006">
+  <source>Failed to queue invitation emails</source>
+</trans-unit>
+<trans-unit id="s3b7910ab9c47a2e3">
+  <source>No enrollment flows with invitation stages found</source>
+</trans-unit>
+<trans-unit id="sa3ca03297e00591c">
+  <source>You can create a new enrollment flow and invitation stage right here, or cancel and bind an invitation stage to an existing flow manually.</source>
+</trans-unit>
+<trans-unit id="s06db43e56ca76be8">
+  <source>Create a new enrollment flow</source>
+</trans-unit>
+<trans-unit id="s8acc687c55e8ccbf">
+  <source>Only enrollment flows that have an invitation stage bound to them are listed here.</source>
+</trans-unit>
+<trans-unit id="s5b3bafd8ffe553ec">
+  <source>Flow name</source>
+</trans-unit>
+<trans-unit id="s699cd34b0dcb4c56">
+  <source>Name for the new enrollment flow.</source>
+</trans-unit>
+<trans-unit id="s8fb6d1bb698d32a0">
+  <source>Flow slug</source>
+</trans-unit>
+<trans-unit id="s0211c07612cf8c97">
+  <source>Invitation stage name</source>
+</trans-unit>
+<trans-unit id="s42b97ef63fb1a795">
+  <source>Name for the new invitation stage.</source>
+</trans-unit>
+<trans-unit id="saaa9fd0d3ebc35aa">
+  <source>Enrolled users are created as external (e.g. customers, guests). New users will be placed under users/external.</source>
+</trans-unit>
+<trans-unit id="s726dff63487da085">
+  <source>Enrolled users are created as internal (e.g. employees). New users will be placed under users/internal.</source>
+</trans-unit>
+<trans-unit id="sc1358130ac327120">
+  <source>If enabled, the stage will jump to the next stage when no invitation is given. If disabled, the flow will be cancelled without a valid invitation.</source>
+</trans-unit>
+<trans-unit id="s09fdd952c6eaf7da">
+  <source>No invitation was created.</source>
+</trans-unit>
+<trans-unit id="s00febd85a4889bb1">
+  <source>Redirect the user to a static URL or another flow, optionally with all gathered context.</source>
+</trans-unit>
+<trans-unit id="sdbc1d47f0f0ed54d">
+  <source>The element could not be loaded. This may be due to a missing import or a version mismatch.</source>
+</trans-unit>
+<trans-unit id="scf8a3d48f9969535">
+  <source>An element could not be loaded. Please try refreshing the page or clearing your cache.</source>
+</trans-unit>
+<trans-unit id="se2f00b2619675217">
+  <source>Failed to load element</source>
+</trans-unit>
+<trans-unit id="s1cf2298d92c327a6">
+  <source>My Applications</source>
+</trans-unit>
+<trans-unit id="s2656433a3b1f7e86">
+  <source>My applications</source>
 </trans-unit>
 </body>
 </file>

web/xliff/de-DE.xlf

@@ -6281,18 +6281,6 @@ Beim Erstellen eines festen Auswahlfelds aktiviere „Als Ausdruck interpretiere
   <source>Authenticator Attachment</source>
   <target>Authenticator-Anhang</target>
 </trans-unit>
-<trans-unit id="s502d2473587032e1">
-  <source>No preference is sent</source>
-  <target>Keine Präferenz wird gesendet</target>
-</trans-unit>
-<trans-unit id="s60cc554fde2676cb">
-  <source>A non-removable authenticator, like TouchID or Windows Hello</source>
-  <target>Ein nicht abnehmbarer Authentifikator, wie TouchID oder Windows Hello</target>
-</trans-unit>
-<trans-unit id="sdf1d8edef27236f0">
-  <source>A "roaming" authenticator, like a YubiKey</source>
-  <target>Ein "Roaming"-Authentifikator, wie ein YubiKey</target>
-</trans-unit>
 <trans-unit id="sbd65aeeb8a3b9bbc">
   <source>Maximum registration attempts</source>
   <target>Maximale Registrierungsversuche</target>
@@ -6628,10 +6616,6 @@ Beim Erstellen eines festen Auswahlfelds aktiviere „Als Ausdruck interpretiere
   <source>Selected policies are executed when the stage is submitted to validate the data.</source>
   <target>Ausgewählte Richtlinien werden ausgeführt, wenn die Stage abgeschickt wird, um die Daten zu validieren.</target>
 </trans-unit>
-<trans-unit id="sc487e11d5987dbb4">
-  <source>Redirect the user to another flow, potentially with all gathered context</source>
-  <target>Leitet den Benutzer zu einem anderen Flow weiter, ggf. mit dem gesamten gesammelten Kontext.</target>
-</trans-unit>
 <trans-unit id="sad9d5481474d4f5b">
   <source>Static</source>
   <target>Statisch</target>
@@ -11096,15 +11080,6 @@ Bindings zu Gruppen/Benutzern werden mit dem Benutzer des Ereignisses abgegliche
 <trans-unit id="sdcd1a9744efdbd7e">
   <source>Choose Policy Type</source>
 </trans-unit>
-<trans-unit id="sf4eb7c0c8e92e6b2">
-  <source>Whether the launch URL will open in a new browser tab or window from the user's application library.</source>
-</trans-unit>
-<trans-unit id="s8ab0176c9cf77b1a">
-  <source>Hide from User Dashboard</source>
-</trans-unit>
-<trans-unit id="s0b5847edb7150911">
-  <source>Whether this application will be shown on the User Dashboard.</source>
-</trans-unit>
 <trans-unit id="saa5ed8446baaba70">
   <source>Negate Result</source>
 </trans-unit>
@@ -11117,11 +11092,140 @@ Bindings zu Gruppen/Benutzern werden mit dem Benutzer des Ereignisses abgegliche
 <trans-unit id="s41938ae69656ef53">
   <source>User Fields</source>
 </trans-unit>
-<trans-unit id="s977b2dff8b9def14">
-  <source>User Dashboard - Applications</source>
+<trans-unit id="s02b73793e5b4e1ba">
+  <source>This flag is deprecated.</source>
 </trans-unit>
-<trans-unit id="s190cbdd5b62e4746">
-  <source>User Dashboard</source>
+<trans-unit id="s8655c52824caac63">
+  <source>If checked, the launch URL will open in a new browser tab or window from the user's application library.</source>
+</trans-unit>
+<trans-unit id="s9eda7101f63a8652">
+  <source>Hide from My applications</source>
+</trans-unit>
+<trans-unit id="s30f30e9c42594a33">
+  <source>If checked, this application will not be shown on the user's My applications page.</source>
+</trans-unit>
+<trans-unit id="sc98037ccab57d329">
+  <source>No preference: the browser may offer any available authenticator</source>
+</trans-unit>
+<trans-unit id="s4611c85865abcba9">
+  <source>Platform: a non-removable authenticator built into the device, such as Touch ID, Face ID, or Windows Hello</source>
+</trans-unit>
+<trans-unit id="s0003d0e3fcdacabc">
+  <source>Cross-platform: a roaming authenticator, such as a YubiKey or Google Titan</source>
+</trans-unit>
+<trans-unit id="sc157c7dcb3d1b096">
+  <source>Controls the authenticatorAttachment parameter sent to the browser during WebAuthn registration. If Hints are configured and this is left as 'No preference', a value is inferred from the selected hints for backward compatibility with older browsers.</source>
+</trans-unit>
+<trans-unit id="s1baea1b8ac34d554">
+  <source>New Invitation</source>
+</trans-unit>
+<trans-unit id="s03eef6107e28d042">
+  <source>New Invitation options</source>
+</trans-unit>
+<trans-unit id="s0832ff81b9665e6f">
+  <source>Opens the new invitation wizard and binds the invitation to an existing enrollment flow.</source>
+</trans-unit>
+<trans-unit id="sc0819dc3d82d9320">
+  <source>with Existing Enrollment Flow...</source>
+</trans-unit>
+<trans-unit id="s79108cb25e7bf07b">
+  <source>Opens the new invitation wizard, which will create a new enrollment flow and invitation stage.</source>
+</trans-unit>
+<trans-unit id="sb7809157a3ccf613">
+  <source>with New Enrollment Flow and Invitation Stage...</source>
+</trans-unit>
+<trans-unit id="seb418067e7d6c6e2">
+  <source>Create a new invitation with an enrollment flow.</source>
+</trans-unit>
+<trans-unit id="sfd74a380e957d0d3">
+  <source>Enrollment Flow</source>
+</trans-unit>
+<trans-unit id="scc869d556216d748">
+  <source>Invitation Details</source>
+</trans-unit>
+<trans-unit id="se1fba44a9b284052">
+  <source>Invitation Link</source>
+</trans-unit>
+<trans-unit id="s967a2db7049dc90e">
+  <source><x id="0" equiv-text="${step}"/> failed</source>
+</trans-unit>
+<trans-unit id="s971d4cc0ecd106b7">
+  <source>Importing enrollment flow blueprint</source>
+</trans-unit>
+<trans-unit id="sf3b89a70e20af6c8">
+  <source>Blueprint validation failed</source>
+</trans-unit>
+<trans-unit id="sa04b7204708f4f74">
+  <source>Flow with slug "<x id="0" equiv-text="${slugToLookup}"/>" not found after import</source>
+</trans-unit>
+<trans-unit id="s3354be88ad29d171">
+  <source>Creating invitation</source>
+</trans-unit>
+<trans-unit id="s07f41353777196ea">
+  <source>The flow selected in the previous step. The invitation will be bound to this flow.</source>
+</trans-unit>
+<trans-unit id="s7209a11f97da9aff">
+  <source>No invitation available to send</source>
+</trans-unit>
+<trans-unit id="s2772d8285b905006">
+  <source>Failed to queue invitation emails</source>
+</trans-unit>
+<trans-unit id="s3b7910ab9c47a2e3">
+  <source>No enrollment flows with invitation stages found</source>
+</trans-unit>
+<trans-unit id="sa3ca03297e00591c">
+  <source>You can create a new enrollment flow and invitation stage right here, or cancel and bind an invitation stage to an existing flow manually.</source>
+</trans-unit>
+<trans-unit id="s06db43e56ca76be8">
+  <source>Create a new enrollment flow</source>
+</trans-unit>
+<trans-unit id="s8acc687c55e8ccbf">
+  <source>Only enrollment flows that have an invitation stage bound to them are listed here.</source>
+</trans-unit>
+<trans-unit id="s5b3bafd8ffe553ec">
+  <source>Flow name</source>
+</trans-unit>
+<trans-unit id="s699cd34b0dcb4c56">
+  <source>Name for the new enrollment flow.</source>
+</trans-unit>
+<trans-unit id="s8fb6d1bb698d32a0">
+  <source>Flow slug</source>
+</trans-unit>
+<trans-unit id="s0211c07612cf8c97">
+  <source>Invitation stage name</source>
+</trans-unit>
+<trans-unit id="s42b97ef63fb1a795">
+  <source>Name for the new invitation stage.</source>
+</trans-unit>
+<trans-unit id="saaa9fd0d3ebc35aa">
+  <source>Enrolled users are created as external (e.g. customers, guests). New users will be placed under users/external.</source>
+</trans-unit>
+<trans-unit id="s726dff63487da085">
+  <source>Enrolled users are created as internal (e.g. employees). New users will be placed under users/internal.</source>
+</trans-unit>
+<trans-unit id="sc1358130ac327120">
+  <source>If enabled, the stage will jump to the next stage when no invitation is given. If disabled, the flow will be cancelled without a valid invitation.</source>
+</trans-unit>
+<trans-unit id="s09fdd952c6eaf7da">
+  <source>No invitation was created.</source>
+</trans-unit>
+<trans-unit id="s00febd85a4889bb1">
+  <source>Redirect the user to a static URL or another flow, optionally with all gathered context.</source>
+</trans-unit>
+<trans-unit id="sdbc1d47f0f0ed54d">
+  <source>The element could not be loaded. This may be due to a missing import or a version mismatch.</source>
+</trans-unit>
+<trans-unit id="scf8a3d48f9969535">
+  <source>An element could not be loaded. Please try refreshing the page or clearing your cache.</source>
+</trans-unit>
+<trans-unit id="se2f00b2619675217">
+  <source>Failed to load element</source>
+</trans-unit>
+<trans-unit id="s1cf2298d92c327a6">
+  <source>My Applications</source>
+</trans-unit>
+<trans-unit id="s2656433a3b1f7e86">
+  <source>My applications</source>
 </trans-unit>
 </body>
 </file>

web/xliff/en.xlf

@@ -4832,15 +4832,6 @@ doesn't pass when either or both of the selected options are equal or above the
 <trans-unit id="s5fbaeb14f42815e5">
   <source>Authenticator Attachment</source>
 </trans-unit>
-<trans-unit id="s502d2473587032e1">
-  <source>No preference is sent</source>
-</trans-unit>
-<trans-unit id="s60cc554fde2676cb">
-  <source>A non-removable authenticator, like TouchID or Windows Hello</source>
-</trans-unit>
-<trans-unit id="sdf1d8edef27236f0">
-  <source>A "roaming" authenticator, like a YubiKey</source>
-</trans-unit>
 <trans-unit id="sbd65aeeb8a3b9bbc">
   <source>Maximum registration attempts</source>
 </trans-unit>
@@ -5093,9 +5084,6 @@ doesn't pass when either or both of the selected options are equal or above the
 <trans-unit id="s59691290a232c687">
   <source>Selected policies are executed when the stage is submitted to validate the data.</source>
 </trans-unit>
-<trans-unit id="sc487e11d5987dbb4">
-  <source>Redirect the user to another flow, potentially with all gathered context</source>
-</trans-unit>
 <trans-unit id="sad9d5481474d4f5b">
   <source>Static</source>
 </trans-unit>
@@ -9077,15 +9065,6 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="sdcd1a9744efdbd7e">
   <source>Choose Policy Type</source>
 </trans-unit>
-<trans-unit id="sf4eb7c0c8e92e6b2">
-  <source>Whether the launch URL will open in a new browser tab or window from the user's application library.</source>
-</trans-unit>
-<trans-unit id="s8ab0176c9cf77b1a">
-  <source>Hide from User Dashboard</source>
-</trans-unit>
-<trans-unit id="s0b5847edb7150911">
-  <source>Whether this application will be shown on the User Dashboard.</source>
-</trans-unit>
 <trans-unit id="saa5ed8446baaba70">
   <source>Negate Result</source>
 </trans-unit>
@@ -9098,11 +9077,140 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="s41938ae69656ef53">
   <source>User Fields</source>
 </trans-unit>
-<trans-unit id="s977b2dff8b9def14">
-  <source>User Dashboard - Applications</source>
+<trans-unit id="s02b73793e5b4e1ba">
+  <source>This flag is deprecated.</source>
 </trans-unit>
-<trans-unit id="s190cbdd5b62e4746">
-  <source>User Dashboard</source>
+<trans-unit id="s8655c52824caac63">
+  <source>If checked, the launch URL will open in a new browser tab or window from the user's application library.</source>
+</trans-unit>
+<trans-unit id="s9eda7101f63a8652">
+  <source>Hide from My applications</source>
+</trans-unit>
+<trans-unit id="s30f30e9c42594a33">
+  <source>If checked, this application will not be shown on the user's My applications page.</source>
+</trans-unit>
+<trans-unit id="sc98037ccab57d329">
+  <source>No preference: the browser may offer any available authenticator</source>
+</trans-unit>
+<trans-unit id="s4611c85865abcba9">
+  <source>Platform: a non-removable authenticator built into the device, such as Touch ID, Face ID, or Windows Hello</source>
+</trans-unit>
+<trans-unit id="s0003d0e3fcdacabc">
+  <source>Cross-platform: a roaming authenticator, such as a YubiKey or Google Titan</source>
+</trans-unit>
+<trans-unit id="sc157c7dcb3d1b096">
+  <source>Controls the authenticatorAttachment parameter sent to the browser during WebAuthn registration. If Hints are configured and this is left as 'No preference', a value is inferred from the selected hints for backward compatibility with older browsers.</source>
+</trans-unit>
+<trans-unit id="s1baea1b8ac34d554">
+  <source>New Invitation</source>
+</trans-unit>
+<trans-unit id="s03eef6107e28d042">
+  <source>New Invitation options</source>
+</trans-unit>
+<trans-unit id="s0832ff81b9665e6f">
+  <source>Opens the new invitation wizard and binds the invitation to an existing enrollment flow.</source>
+</trans-unit>
+<trans-unit id="sc0819dc3d82d9320">
+  <source>with Existing Enrollment Flow...</source>
+</trans-unit>
+<trans-unit id="s79108cb25e7bf07b">
+  <source>Opens the new invitation wizard, which will create a new enrollment flow and invitation stage.</source>
+</trans-unit>
+<trans-unit id="sb7809157a3ccf613">
+  <source>with New Enrollment Flow and Invitation Stage...</source>
+</trans-unit>
+<trans-unit id="seb418067e7d6c6e2">
+  <source>Create a new invitation with an enrollment flow.</source>
+</trans-unit>
+<trans-unit id="sfd74a380e957d0d3">
+  <source>Enrollment Flow</source>
+</trans-unit>
+<trans-unit id="scc869d556216d748">
+  <source>Invitation Details</source>
+</trans-unit>
+<trans-unit id="se1fba44a9b284052">
+  <source>Invitation Link</source>
+</trans-unit>
+<trans-unit id="s967a2db7049dc90e">
+  <source><x id="0" equiv-text="${step}"/> failed</source>
+</trans-unit>
+<trans-unit id="s971d4cc0ecd106b7">
+  <source>Importing enrollment flow blueprint</source>
+</trans-unit>
+<trans-unit id="sf3b89a70e20af6c8">
+  <source>Blueprint validation failed</source>
+</trans-unit>
+<trans-unit id="sa04b7204708f4f74">
+  <source>Flow with slug "<x id="0" equiv-text="${slugToLookup}"/>" not found after import</source>
+</trans-unit>
+<trans-unit id="s3354be88ad29d171">
+  <source>Creating invitation</source>
+</trans-unit>
+<trans-unit id="s07f41353777196ea">
+  <source>The flow selected in the previous step. The invitation will be bound to this flow.</source>
+</trans-unit>
+<trans-unit id="s7209a11f97da9aff">
+  <source>No invitation available to send</source>
+</trans-unit>
+<trans-unit id="s2772d8285b905006">
+  <source>Failed to queue invitation emails</source>
+</trans-unit>
+<trans-unit id="s3b7910ab9c47a2e3">
+  <source>No enrollment flows with invitation stages found</source>
+</trans-unit>
+<trans-unit id="sa3ca03297e00591c">
+  <source>You can create a new enrollment flow and invitation stage right here, or cancel and bind an invitation stage to an existing flow manually.</source>
+</trans-unit>
+<trans-unit id="s06db43e56ca76be8">
+  <source>Create a new enrollment flow</source>
+</trans-unit>
+<trans-unit id="s8acc687c55e8ccbf">
+  <source>Only enrollment flows that have an invitation stage bound to them are listed here.</source>
+</trans-unit>
+<trans-unit id="s5b3bafd8ffe553ec">
+  <source>Flow name</source>
+</trans-unit>
+<trans-unit id="s699cd34b0dcb4c56">
+  <source>Name for the new enrollment flow.</source>
+</trans-unit>
+<trans-unit id="s8fb6d1bb698d32a0">
+  <source>Flow slug</source>
+</trans-unit>
+<trans-unit id="s0211c07612cf8c97">
+  <source>Invitation stage name</source>
+</trans-unit>
+<trans-unit id="s42b97ef63fb1a795">
+  <source>Name for the new invitation stage.</source>
+</trans-unit>
+<trans-unit id="saaa9fd0d3ebc35aa">
+  <source>Enrolled users are created as external (e.g. customers, guests). New users will be placed under users/external.</source>
+</trans-unit>
+<trans-unit id="s726dff63487da085">
+  <source>Enrolled users are created as internal (e.g. employees). New users will be placed under users/internal.</source>
+</trans-unit>
+<trans-unit id="sc1358130ac327120">
+  <source>If enabled, the stage will jump to the next stage when no invitation is given. If disabled, the flow will be cancelled without a valid invitation.</source>
+</trans-unit>
+<trans-unit id="s09fdd952c6eaf7da">
+  <source>No invitation was created.</source>
+</trans-unit>
+<trans-unit id="s00febd85a4889bb1">
+  <source>Redirect the user to a static URL or another flow, optionally with all gathered context.</source>
+</trans-unit>
+<trans-unit id="sdbc1d47f0f0ed54d">
+  <source>The element could not be loaded. This may be due to a missing import or a version mismatch.</source>
+</trans-unit>
+<trans-unit id="scf8a3d48f9969535">
+  <source>An element could not be loaded. Please try refreshing the page or clearing your cache.</source>
+</trans-unit>
+<trans-unit id="se2f00b2619675217">
+  <source>Failed to load element</source>
+</trans-unit>
+<trans-unit id="s1cf2298d92c327a6">
+  <source>My Applications</source>
+</trans-unit>
+<trans-unit id="s2656433a3b1f7e86">
+  <source>My applications</source>
 </trans-unit>
 </body>
 </file>

web/xliff/es-ES.xlf

@@ -6219,18 +6219,6 @@ El valor de este campo se compara con el atributo de pertenencia del usuario.</t
   <source>Authenticator Attachment</source>
   <target>Adjunto de Autenticador</target>
 </trans-unit>
-<trans-unit id="s502d2473587032e1">
-  <source>No preference is sent</source>
-  <target>No se envía ninguna preferencia</target>
-</trans-unit>
-<trans-unit id="s60cc554fde2676cb">
-  <source>A non-removable authenticator, like TouchID or Windows Hello</source>
-  <target>Un autenticador no extraíble, como TouchID o Windows Hello</target>
-</trans-unit>
-<trans-unit id="sdf1d8edef27236f0">
-  <source>A "roaming" authenticator, like a YubiKey</source>
-  <target>Un autenticador "roaming", como una YubiKey</target>
-</trans-unit>
 <trans-unit id="sbd65aeeb8a3b9bbc">
   <source>Maximum registration attempts</source>
   <target>Intentos máximos de registro</target>
@@ -6564,10 +6552,6 @@ El valor de este campo se compara con el atributo de pertenencia del usuario.</t
   <source>Selected policies are executed when the stage is submitted to validate the data.</source>
   <target>Las políticas seleccionadas se ejecutan cuando se envía la etapa para validar los datos.</target>
 </trans-unit>
-<trans-unit id="sc487e11d5987dbb4">
-  <source>Redirect the user to another flow, potentially with all gathered context</source>
-  <target>Redirigir al usuario a otro flujo, potencialmente con todo el contexto recopilado</target>
-</trans-unit>
 <trans-unit id="sad9d5481474d4f5b">
   <source>Static</source>
   <target>Estático</target>
@@ -11021,15 +11005,6 @@ Las vinculaciones a grupos/usuarios se verifican en función del usuario del eve
 <trans-unit id="sdcd1a9744efdbd7e">
   <source>Choose Policy Type</source>
 </trans-unit>
-<trans-unit id="sf4eb7c0c8e92e6b2">
-  <source>Whether the launch URL will open in a new browser tab or window from the user's application library.</source>
-</trans-unit>
-<trans-unit id="s8ab0176c9cf77b1a">
-  <source>Hide from User Dashboard</source>
-</trans-unit>
-<trans-unit id="s0b5847edb7150911">
-  <source>Whether this application will be shown on the User Dashboard.</source>
-</trans-unit>
 <trans-unit id="saa5ed8446baaba70">
   <source>Negate Result</source>
 </trans-unit>
@@ -11042,11 +11017,140 @@ Las vinculaciones a grupos/usuarios se verifican en función del usuario del eve
 <trans-unit id="s41938ae69656ef53">
   <source>User Fields</source>
 </trans-unit>
-<trans-unit id="s977b2dff8b9def14">
-  <source>User Dashboard - Applications</source>
+<trans-unit id="s02b73793e5b4e1ba">
+  <source>This flag is deprecated.</source>
 </trans-unit>
-<trans-unit id="s190cbdd5b62e4746">
-  <source>User Dashboard</source>
+<trans-unit id="s8655c52824caac63">
+  <source>If checked, the launch URL will open in a new browser tab or window from the user's application library.</source>
+</trans-unit>
+<trans-unit id="s9eda7101f63a8652">
+  <source>Hide from My applications</source>
+</trans-unit>
+<trans-unit id="s30f30e9c42594a33">
+  <source>If checked, this application will not be shown on the user's My applications page.</source>
+</trans-unit>
+<trans-unit id="sc98037ccab57d329">
+  <source>No preference: the browser may offer any available authenticator</source>
+</trans-unit>
+<trans-unit id="s4611c85865abcba9">
+  <source>Platform: a non-removable authenticator built into the device, such as Touch ID, Face ID, or Windows Hello</source>
+</trans-unit>
+<trans-unit id="s0003d0e3fcdacabc">
+  <source>Cross-platform: a roaming authenticator, such as a YubiKey or Google Titan</source>
+</trans-unit>
+<trans-unit id="sc157c7dcb3d1b096">
+  <source>Controls the authenticatorAttachment parameter sent to the browser during WebAuthn registration. If Hints are configured and this is left as 'No preference', a value is inferred from the selected hints for backward compatibility with older browsers.</source>
+</trans-unit>
+<trans-unit id="s1baea1b8ac34d554">
+  <source>New Invitation</source>
+</trans-unit>
+<trans-unit id="s03eef6107e28d042">
+  <source>New Invitation options</source>
+</trans-unit>
+<trans-unit id="s0832ff81b9665e6f">
+  <source>Opens the new invitation wizard and binds the invitation to an existing enrollment flow.</source>
+</trans-unit>
+<trans-unit id="sc0819dc3d82d9320">
+  <source>with Existing Enrollment Flow...</source>
+</trans-unit>
+<trans-unit id="s79108cb25e7bf07b">
+  <source>Opens the new invitation wizard, which will create a new enrollment flow and invitation stage.</source>
+</trans-unit>
+<trans-unit id="sb7809157a3ccf613">
+  <source>with New Enrollment Flow and Invitation Stage...</source>
+</trans-unit>
+<trans-unit id="seb418067e7d6c6e2">
+  <source>Create a new invitation with an enrollment flow.</source>
+</trans-unit>
+<trans-unit id="sfd74a380e957d0d3">
+  <source>Enrollment Flow</source>
+</trans-unit>
+<trans-unit id="scc869d556216d748">
+  <source>Invitation Details</source>
+</trans-unit>
+<trans-unit id="se1fba44a9b284052">
+  <source>Invitation Link</source>
+</trans-unit>
+<trans-unit id="s967a2db7049dc90e">
+  <source><x id="0" equiv-text="${step}"/> failed</source>
+</trans-unit>
+<trans-unit id="s971d4cc0ecd106b7">
+  <source>Importing enrollment flow blueprint</source>
+</trans-unit>
+<trans-unit id="sf3b89a70e20af6c8">
+  <source>Blueprint validation failed</source>
+</trans-unit>
+<trans-unit id="sa04b7204708f4f74">
+  <source>Flow with slug "<x id="0" equiv-text="${slugToLookup}"/>" not found after import</source>
+</trans-unit>
+<trans-unit id="s3354be88ad29d171">
+  <source>Creating invitation</source>
+</trans-unit>
+<trans-unit id="s07f41353777196ea">
+  <source>The flow selected in the previous step. The invitation will be bound to this flow.</source>
+</trans-unit>
+<trans-unit id="s7209a11f97da9aff">
+  <source>No invitation available to send</source>
+</trans-unit>
+<trans-unit id="s2772d8285b905006">
+  <source>Failed to queue invitation emails</source>
+</trans-unit>
+<trans-unit id="s3b7910ab9c47a2e3">
+  <source>No enrollment flows with invitation stages found</source>
+</trans-unit>
+<trans-unit id="sa3ca03297e00591c">
+  <source>You can create a new enrollment flow and invitation stage right here, or cancel and bind an invitation stage to an existing flow manually.</source>
+</trans-unit>
+<trans-unit id="s06db43e56ca76be8">
+  <source>Create a new enrollment flow</source>
+</trans-unit>
+<trans-unit id="s8acc687c55e8ccbf">
+  <source>Only enrollment flows that have an invitation stage bound to them are listed here.</source>
+</trans-unit>
+<trans-unit id="s5b3bafd8ffe553ec">
+  <source>Flow name</source>
+</trans-unit>
+<trans-unit id="s699cd34b0dcb4c56">
+  <source>Name for the new enrollment flow.</source>
+</trans-unit>
+<trans-unit id="s8fb6d1bb698d32a0">
+  <source>Flow slug</source>
+</trans-unit>
+<trans-unit id="s0211c07612cf8c97">
+  <source>Invitation stage name</source>
+</trans-unit>
+<trans-unit id="s42b97ef63fb1a795">
+  <source>Name for the new invitation stage.</source>
+</trans-unit>
+<trans-unit id="saaa9fd0d3ebc35aa">
+  <source>Enrolled users are created as external (e.g. customers, guests). New users will be placed under users/external.</source>
+</trans-unit>
+<trans-unit id="s726dff63487da085">
+  <source>Enrolled users are created as internal (e.g. employees). New users will be placed under users/internal.</source>
+</trans-unit>
+<trans-unit id="sc1358130ac327120">
+  <source>If enabled, the stage will jump to the next stage when no invitation is given. If disabled, the flow will be cancelled without a valid invitation.</source>
+</trans-unit>
+<trans-unit id="s09fdd952c6eaf7da">
+  <source>No invitation was created.</source>
+</trans-unit>
+<trans-unit id="s00febd85a4889bb1">
+  <source>Redirect the user to a static URL or another flow, optionally with all gathered context.</source>
+</trans-unit>
+<trans-unit id="sdbc1d47f0f0ed54d">
+  <source>The element could not be loaded. This may be due to a missing import or a version mismatch.</source>
+</trans-unit>
+<trans-unit id="scf8a3d48f9969535">
+  <source>An element could not be loaded. Please try refreshing the page or clearing your cache.</source>
+</trans-unit>
+<trans-unit id="se2f00b2619675217">
+  <source>Failed to load element</source>
+</trans-unit>
+<trans-unit id="s1cf2298d92c327a6">
+  <source>My Applications</source>
+</trans-unit>
+<trans-unit id="s2656433a3b1f7e86">
+  <source>My applications</source>
 </trans-unit>
 </body>
 </file>

web/xliff/fi-FI.xlf

@@ -6396,18 +6396,6 @@ läpäisy estyy kun jompi kumpi tai molemmat vaihtoehdot ylittävät raja-arvon.
   <source>Authenticator Attachment</source>
   <target>Todentajan kytkentä</target>
 </trans-unit>
-<trans-unit id="s502d2473587032e1">
-  <source>No preference is sent</source>
-  <target>Etusijaisuutta ei lähetetä</target>
-</trans-unit>
-<trans-unit id="s60cc554fde2676cb">
-  <source>A non-removable authenticator, like TouchID or Windows Hello</source>
-  <target>Sisäänrakennettu todentaja, joten TouchID tai Windows Hello.</target>
-</trans-unit>
-<trans-unit id="sdf1d8edef27236f0">
-  <source>A "roaming" authenticator, like a YubiKey</source>
-  <target>"Roaming"-tyyppinen todentaja, kuten YubiKey.</target>
-</trans-unit>
 <trans-unit id="sbd65aeeb8a3b9bbc">
   <source>Maximum registration attempts</source>
   <target>Rekisteröintiyritysten enimmäismäärä</target>
@@ -6743,10 +6731,6 @@ läpäisy estyy kun jompi kumpi tai molemmat vaihtoehdot ylittävät raja-arvon.
   <source>Selected policies are executed when the stage is submitted to validate the data.</source>
   <target>Valitut käytännöt suoritetaan vaiheen lähettämisen yhteydessä tietojen validoimiseksi</target>
 </trans-unit>
-<trans-unit id="sc487e11d5987dbb4">
-  <source>Redirect the user to another flow, potentially with all gathered context</source>
-  <target>Ohjaa käyttäjä toiseen prosessiin, mahdollisesti kaiken kerätyn kontekstin kanssa.</target>
-</trans-unit>
 <trans-unit id="sad9d5481474d4f5b">
   <source>Static</source>
   <target>Staattinen</target>
@@ -11262,15 +11246,6 @@ Liitokset käyttäjiin/ryhmiin tarkistetaan tapahtuman käyttäjästä.</target>
 <trans-unit id="sdcd1a9744efdbd7e">
   <source>Choose Policy Type</source>
 </trans-unit>
-<trans-unit id="sf4eb7c0c8e92e6b2">
-  <source>Whether the launch URL will open in a new browser tab or window from the user's application library.</source>
-</trans-unit>
-<trans-unit id="s8ab0176c9cf77b1a">
-  <source>Hide from User Dashboard</source>
-</trans-unit>
-<trans-unit id="s0b5847edb7150911">
-  <source>Whether this application will be shown on the User Dashboard.</source>
-</trans-unit>
 <trans-unit id="saa5ed8446baaba70">
   <source>Negate Result</source>
 </trans-unit>
@@ -11283,11 +11258,140 @@ Liitokset käyttäjiin/ryhmiin tarkistetaan tapahtuman käyttäjästä.</target>
 <trans-unit id="s41938ae69656ef53">
   <source>User Fields</source>
 </trans-unit>
-<trans-unit id="s977b2dff8b9def14">
-  <source>User Dashboard - Applications</source>
+<trans-unit id="s02b73793e5b4e1ba">
+  <source>This flag is deprecated.</source>
 </trans-unit>
-<trans-unit id="s190cbdd5b62e4746">
-  <source>User Dashboard</source>
+<trans-unit id="s8655c52824caac63">
+  <source>If checked, the launch URL will open in a new browser tab or window from the user's application library.</source>
+</trans-unit>
+<trans-unit id="s9eda7101f63a8652">
+  <source>Hide from My applications</source>
+</trans-unit>
+<trans-unit id="s30f30e9c42594a33">
+  <source>If checked, this application will not be shown on the user's My applications page.</source>
+</trans-unit>
+<trans-unit id="sc98037ccab57d329">
+  <source>No preference: the browser may offer any available authenticator</source>
+</trans-unit>
+<trans-unit id="s4611c85865abcba9">
+  <source>Platform: a non-removable authenticator built into the device, such as Touch ID, Face ID, or Windows Hello</source>
+</trans-unit>
+<trans-unit id="s0003d0e3fcdacabc">
+  <source>Cross-platform: a roaming authenticator, such as a YubiKey or Google Titan</source>
+</trans-unit>
+<trans-unit id="sc157c7dcb3d1b096">
+  <source>Controls the authenticatorAttachment parameter sent to the browser during WebAuthn registration. If Hints are configured and this is left as 'No preference', a value is inferred from the selected hints for backward compatibility with older browsers.</source>
+</trans-unit>
+<trans-unit id="s1baea1b8ac34d554">
+  <source>New Invitation</source>
+</trans-unit>
+<trans-unit id="s03eef6107e28d042">
+  <source>New Invitation options</source>
+</trans-unit>
+<trans-unit id="s0832ff81b9665e6f">
+  <source>Opens the new invitation wizard and binds the invitation to an existing enrollment flow.</source>
+</trans-unit>
+<trans-unit id="sc0819dc3d82d9320">
+  <source>with Existing Enrollment Flow...</source>
+</trans-unit>
+<trans-unit id="s79108cb25e7bf07b">
+  <source>Opens the new invitation wizard, which will create a new enrollment flow and invitation stage.</source>
+</trans-unit>
+<trans-unit id="sb7809157a3ccf613">
+  <source>with New Enrollment Flow and Invitation Stage...</source>
+</trans-unit>
+<trans-unit id="seb418067e7d6c6e2">
+  <source>Create a new invitation with an enrollment flow.</source>
+</trans-unit>
+<trans-unit id="sfd74a380e957d0d3">
+  <source>Enrollment Flow</source>
+</trans-unit>
+<trans-unit id="scc869d556216d748">
+  <source>Invitation Details</source>
+</trans-unit>
+<trans-unit id="se1fba44a9b284052">
+  <source>Invitation Link</source>
+</trans-unit>
+<trans-unit id="s967a2db7049dc90e">
+  <source><x id="0" equiv-text="${step}"/> failed</source>
+</trans-unit>
+<trans-unit id="s971d4cc0ecd106b7">
+  <source>Importing enrollment flow blueprint</source>
+</trans-unit>
+<trans-unit id="sf3b89a70e20af6c8">
+  <source>Blueprint validation failed</source>
+</trans-unit>
+<trans-unit id="sa04b7204708f4f74">
+  <source>Flow with slug "<x id="0" equiv-text="${slugToLookup}"/>" not found after import</source>
+</trans-unit>
+<trans-unit id="s3354be88ad29d171">
+  <source>Creating invitation</source>
+</trans-unit>
+<trans-unit id="s07f41353777196ea">
+  <source>The flow selected in the previous step. The invitation will be bound to this flow.</source>
+</trans-unit>
+<trans-unit id="s7209a11f97da9aff">
+  <source>No invitation available to send</source>
+</trans-unit>
+<trans-unit id="s2772d8285b905006">
+  <source>Failed to queue invitation emails</source>
+</trans-unit>
+<trans-unit id="s3b7910ab9c47a2e3">
+  <source>No enrollment flows with invitation stages found</source>
+</trans-unit>
+<trans-unit id="sa3ca03297e00591c">
+  <source>You can create a new enrollment flow and invitation stage right here, or cancel and bind an invitation stage to an existing flow manually.</source>
+</trans-unit>
+<trans-unit id="s06db43e56ca76be8">
+  <source>Create a new enrollment flow</source>
+</trans-unit>
+<trans-unit id="s8acc687c55e8ccbf">
+  <source>Only enrollment flows that have an invitation stage bound to them are listed here.</source>
+</trans-unit>
+<trans-unit id="s5b3bafd8ffe553ec">
+  <source>Flow name</source>
+</trans-unit>
+<trans-unit id="s699cd34b0dcb4c56">
+  <source>Name for the new enrollment flow.</source>
+</trans-unit>
+<trans-unit id="s8fb6d1bb698d32a0">
+  <source>Flow slug</source>
+</trans-unit>
+<trans-unit id="s0211c07612cf8c97">
+  <source>Invitation stage name</source>
+</trans-unit>
+<trans-unit id="s42b97ef63fb1a795">
+  <source>Name for the new invitation stage.</source>
+</trans-unit>
+<trans-unit id="saaa9fd0d3ebc35aa">
+  <source>Enrolled users are created as external (e.g. customers, guests). New users will be placed under users/external.</source>
+</trans-unit>
+<trans-unit id="s726dff63487da085">
+  <source>Enrolled users are created as internal (e.g. employees). New users will be placed under users/internal.</source>
+</trans-unit>
+<trans-unit id="sc1358130ac327120">
+  <source>If enabled, the stage will jump to the next stage when no invitation is given. If disabled, the flow will be cancelled without a valid invitation.</source>
+</trans-unit>
+<trans-unit id="s09fdd952c6eaf7da">
+  <source>No invitation was created.</source>
+</trans-unit>
+<trans-unit id="s00febd85a4889bb1">
+  <source>Redirect the user to a static URL or another flow, optionally with all gathered context.</source>
+</trans-unit>
+<trans-unit id="sdbc1d47f0f0ed54d">
+  <source>The element could not be loaded. This may be due to a missing import or a version mismatch.</source>
+</trans-unit>
+<trans-unit id="scf8a3d48f9969535">
+  <source>An element could not be loaded. Please try refreshing the page or clearing your cache.</source>
+</trans-unit>
+<trans-unit id="se2f00b2619675217">
+  <source>Failed to load element</source>
+</trans-unit>
+<trans-unit id="s1cf2298d92c327a6">
+  <source>My Applications</source>
+</trans-unit>
+<trans-unit id="s2656433a3b1f7e86">
+  <source>My applications</source>
 </trans-unit>
 </body>
 </file>

web/xliff/fr-FR.xlf

@@ -6386,18 +6386,6 @@ doesn't pass when either or both of the selected options are equal or above the
   <source>Authenticator Attachment</source>
   <target>Lien à l'authentificateur</target>
 </trans-unit>
-<trans-unit id="s502d2473587032e1">
-  <source>No preference is sent</source>
-  <target>Aucune préférence n'est envoyée</target>
-</trans-unit>
-<trans-unit id="s60cc554fde2676cb">
-  <source>A non-removable authenticator, like TouchID or Windows Hello</source>
-  <target>Un authentificateur inamovible, comme TouchID ou Windows Hello</target>
-</trans-unit>
-<trans-unit id="sdf1d8edef27236f0">
-  <source>A "roaming" authenticator, like a YubiKey</source>
-  <target>Un authentificateur "itinérant", comme une YubiKey</target>
-</trans-unit>
 <trans-unit id="sbd65aeeb8a3b9bbc">
   <source>Maximum registration attempts</source>
   <target>Nombre maximal de tentatives d'inscription</target>
@@ -6733,10 +6721,6 @@ doesn't pass when either or both of the selected options are equal or above the
   <source>Selected policies are executed when the stage is submitted to validate the data.</source>
   <target>Les politiques sélectionnées sont exécutées lorsque l'étape est soumise pour valider les données.</target>
 </trans-unit>
-<trans-unit id="sc487e11d5987dbb4">
-  <source>Redirect the user to another flow, potentially with all gathered context</source>
-  <target>Rediriger l'utilisateur vers un autre flux, éventuellement avec le contexte</target>
-</trans-unit>
 <trans-unit id="sad9d5481474d4f5b">
   <source>Static</source>
   <target>Statique</target>
@@ -11251,15 +11235,6 @@ Les liaisons avec les groupes/utilisateurs sont vérifiées par rapport à l'uti
 <trans-unit id="sdcd1a9744efdbd7e">
   <source>Choose Policy Type</source>
 </trans-unit>
-<trans-unit id="sf4eb7c0c8e92e6b2">
-  <source>Whether the launch URL will open in a new browser tab or window from the user's application library.</source>
-</trans-unit>
-<trans-unit id="s8ab0176c9cf77b1a">
-  <source>Hide from User Dashboard</source>
-</trans-unit>
-<trans-unit id="s0b5847edb7150911">
-  <source>Whether this application will be shown on the User Dashboard.</source>
-</trans-unit>
 <trans-unit id="saa5ed8446baaba70">
   <source>Negate Result</source>
 </trans-unit>
@@ -11272,11 +11247,140 @@ Les liaisons avec les groupes/utilisateurs sont vérifiées par rapport à l'uti
 <trans-unit id="s41938ae69656ef53">
   <source>User Fields</source>
 </trans-unit>
-<trans-unit id="s977b2dff8b9def14">
-  <source>User Dashboard - Applications</source>
+<trans-unit id="s02b73793e5b4e1ba">
+  <source>This flag is deprecated.</source>
 </trans-unit>
-<trans-unit id="s190cbdd5b62e4746">
-  <source>User Dashboard</source>
+<trans-unit id="s8655c52824caac63">
+  <source>If checked, the launch URL will open in a new browser tab or window from the user's application library.</source>
+</trans-unit>
+<trans-unit id="s9eda7101f63a8652">
+  <source>Hide from My applications</source>
+</trans-unit>
+<trans-unit id="s30f30e9c42594a33">
+  <source>If checked, this application will not be shown on the user's My applications page.</source>
+</trans-unit>
+<trans-unit id="sc98037ccab57d329">
+  <source>No preference: the browser may offer any available authenticator</source>
+</trans-unit>
+<trans-unit id="s4611c85865abcba9">
+  <source>Platform: a non-removable authenticator built into the device, such as Touch ID, Face ID, or Windows Hello</source>
+</trans-unit>
+<trans-unit id="s0003d0e3fcdacabc">
+  <source>Cross-platform: a roaming authenticator, such as a YubiKey or Google Titan</source>
+</trans-unit>
+<trans-unit id="sc157c7dcb3d1b096">
+  <source>Controls the authenticatorAttachment parameter sent to the browser during WebAuthn registration. If Hints are configured and this is left as 'No preference', a value is inferred from the selected hints for backward compatibility with older browsers.</source>
+</trans-unit>
+<trans-unit id="s1baea1b8ac34d554">
+  <source>New Invitation</source>
+</trans-unit>
+<trans-unit id="s03eef6107e28d042">
+  <source>New Invitation options</source>
+</trans-unit>
+<trans-unit id="s0832ff81b9665e6f">
+  <source>Opens the new invitation wizard and binds the invitation to an existing enrollment flow.</source>
+</trans-unit>
+<trans-unit id="sc0819dc3d82d9320">
+  <source>with Existing Enrollment Flow...</source>
+</trans-unit>
+<trans-unit id="s79108cb25e7bf07b">
+  <source>Opens the new invitation wizard, which will create a new enrollment flow and invitation stage.</source>
+</trans-unit>
+<trans-unit id="sb7809157a3ccf613">
+  <source>with New Enrollment Flow and Invitation Stage...</source>
+</trans-unit>
+<trans-unit id="seb418067e7d6c6e2">
+  <source>Create a new invitation with an enrollment flow.</source>
+</trans-unit>
+<trans-unit id="sfd74a380e957d0d3">
+  <source>Enrollment Flow</source>
+</trans-unit>
+<trans-unit id="scc869d556216d748">
+  <source>Invitation Details</source>
+</trans-unit>
+<trans-unit id="se1fba44a9b284052">
+  <source>Invitation Link</source>
+</trans-unit>
+<trans-unit id="s967a2db7049dc90e">
+  <source><x id="0" equiv-text="${step}"/> failed</source>
+</trans-unit>
+<trans-unit id="s971d4cc0ecd106b7">
+  <source>Importing enrollment flow blueprint</source>
+</trans-unit>
+<trans-unit id="sf3b89a70e20af6c8">
+  <source>Blueprint validation failed</source>
+</trans-unit>
+<trans-unit id="sa04b7204708f4f74">
+  <source>Flow with slug "<x id="0" equiv-text="${slugToLookup}"/>" not found after import</source>
+</trans-unit>
+<trans-unit id="s3354be88ad29d171">
+  <source>Creating invitation</source>
+</trans-unit>
+<trans-unit id="s07f41353777196ea">
+  <source>The flow selected in the previous step. The invitation will be bound to this flow.</source>
+</trans-unit>
+<trans-unit id="s7209a11f97da9aff">
+  <source>No invitation available to send</source>
+</trans-unit>
+<trans-unit id="s2772d8285b905006">
+  <source>Failed to queue invitation emails</source>
+</trans-unit>
+<trans-unit id="s3b7910ab9c47a2e3">
+  <source>No enrollment flows with invitation stages found</source>
+</trans-unit>
+<trans-unit id="sa3ca03297e00591c">
+  <source>You can create a new enrollment flow and invitation stage right here, or cancel and bind an invitation stage to an existing flow manually.</source>
+</trans-unit>
+<trans-unit id="s06db43e56ca76be8">
+  <source>Create a new enrollment flow</source>
+</trans-unit>
+<trans-unit id="s8acc687c55e8ccbf">
+  <source>Only enrollment flows that have an invitation stage bound to them are listed here.</source>
+</trans-unit>
+<trans-unit id="s5b3bafd8ffe553ec">
+  <source>Flow name</source>
+</trans-unit>
+<trans-unit id="s699cd34b0dcb4c56">
+  <source>Name for the new enrollment flow.</source>
+</trans-unit>
+<trans-unit id="s8fb6d1bb698d32a0">
+  <source>Flow slug</source>
+</trans-unit>
+<trans-unit id="s0211c07612cf8c97">
+  <source>Invitation stage name</source>
+</trans-unit>
+<trans-unit id="s42b97ef63fb1a795">
+  <source>Name for the new invitation stage.</source>
+</trans-unit>
+<trans-unit id="saaa9fd0d3ebc35aa">
+  <source>Enrolled users are created as external (e.g. customers, guests). New users will be placed under users/external.</source>
+</trans-unit>
+<trans-unit id="s726dff63487da085">
+  <source>Enrolled users are created as internal (e.g. employees). New users will be placed under users/internal.</source>
+</trans-unit>
+<trans-unit id="sc1358130ac327120">
+  <source>If enabled, the stage will jump to the next stage when no invitation is given. If disabled, the flow will be cancelled without a valid invitation.</source>
+</trans-unit>
+<trans-unit id="s09fdd952c6eaf7da">
+  <source>No invitation was created.</source>
+</trans-unit>
+<trans-unit id="s00febd85a4889bb1">
+  <source>Redirect the user to a static URL or another flow, optionally with all gathered context.</source>
+</trans-unit>
+<trans-unit id="sdbc1d47f0f0ed54d">
+  <source>The element could not be loaded. This may be due to a missing import or a version mismatch.</source>
+</trans-unit>
+<trans-unit id="scf8a3d48f9969535">
+  <source>An element could not be loaded. Please try refreshing the page or clearing your cache.</source>
+</trans-unit>
+<trans-unit id="se2f00b2619675217">
+  <source>Failed to load element</source>
+</trans-unit>
+<trans-unit id="s1cf2298d92c327a6">
+  <source>My Applications</source>
+</trans-unit>
+<trans-unit id="s2656433a3b1f7e86">
+  <source>My applications</source>
 </trans-unit>
 </body>
 </file>

web/xliff/it-IT.xlf

@@ -6176,18 +6176,6 @@ doesn't pass when either or both of the selected options are equal or above the
   <source>Authenticator Attachment</source>
   <target>Allegato Autenticatore</target>
 </trans-unit>
-<trans-unit id="s502d2473587032e1">
-  <source>No preference is sent</source>
-  <target>Nessuna preferenza viene inviata</target>
-</trans-unit>
-<trans-unit id="s60cc554fde2676cb">
-  <source>A non-removable authenticator, like TouchID or Windows Hello</source>
-  <target>Un autenticatore non rimovibile, come TouchID o Windows Hello</target>
-</trans-unit>
-<trans-unit id="sdf1d8edef27236f0">
-  <source>A "roaming" authenticator, like a YubiKey</source>
-  <target>Un autenticatore "roaming", come un YubiKey</target>
-</trans-unit>
 <trans-unit id="sbd65aeeb8a3b9bbc">
   <source>Maximum registration attempts</source>
   <target>Numero massimo di tentativi di registrazione</target>
@@ -6520,10 +6508,6 @@ doesn't pass when either or both of the selected options are equal or above the
   <source>Selected policies are executed when the stage is submitted to validate the data.</source>
   <target>Le politiche selezionate vengono eseguite quando la fase viene inviata per convalidare i dati.</target>
 </trans-unit>
-<trans-unit id="sc487e11d5987dbb4">
-  <source>Redirect the user to another flow, potentially with all gathered context</source>
-  <target>Reindirizza l'utente a un altro flusso, potenzialmente con tutto il contesto raccolto</target>
-</trans-unit>
 <trans-unit id="sad9d5481474d4f5b">
   <source>Static</source>
   <target>Statico</target>
@@ -10970,15 +10954,6 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="sdcd1a9744efdbd7e">
   <source>Choose Policy Type</source>
 </trans-unit>
-<trans-unit id="sf4eb7c0c8e92e6b2">
-  <source>Whether the launch URL will open in a new browser tab or window from the user's application library.</source>
-</trans-unit>
-<trans-unit id="s8ab0176c9cf77b1a">
-  <source>Hide from User Dashboard</source>
-</trans-unit>
-<trans-unit id="s0b5847edb7150911">
-  <source>Whether this application will be shown on the User Dashboard.</source>
-</trans-unit>
 <trans-unit id="saa5ed8446baaba70">
   <source>Negate Result</source>
 </trans-unit>
@@ -10991,11 +10966,140 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="s41938ae69656ef53">
   <source>User Fields</source>
 </trans-unit>
-<trans-unit id="s977b2dff8b9def14">
-  <source>User Dashboard - Applications</source>
+<trans-unit id="s02b73793e5b4e1ba">
+  <source>This flag is deprecated.</source>
 </trans-unit>
-<trans-unit id="s190cbdd5b62e4746">
-  <source>User Dashboard</source>
+<trans-unit id="s8655c52824caac63">
+  <source>If checked, the launch URL will open in a new browser tab or window from the user's application library.</source>
+</trans-unit>
+<trans-unit id="s9eda7101f63a8652">
+  <source>Hide from My applications</source>
+</trans-unit>
+<trans-unit id="s30f30e9c42594a33">
+  <source>If checked, this application will not be shown on the user's My applications page.</source>
+</trans-unit>
+<trans-unit id="sc98037ccab57d329">
+  <source>No preference: the browser may offer any available authenticator</source>
+</trans-unit>
+<trans-unit id="s4611c85865abcba9">
+  <source>Platform: a non-removable authenticator built into the device, such as Touch ID, Face ID, or Windows Hello</source>
+</trans-unit>
+<trans-unit id="s0003d0e3fcdacabc">
+  <source>Cross-platform: a roaming authenticator, such as a YubiKey or Google Titan</source>
+</trans-unit>
+<trans-unit id="sc157c7dcb3d1b096">
+  <source>Controls the authenticatorAttachment parameter sent to the browser during WebAuthn registration. If Hints are configured and this is left as 'No preference', a value is inferred from the selected hints for backward compatibility with older browsers.</source>
+</trans-unit>
+<trans-unit id="s1baea1b8ac34d554">
+  <source>New Invitation</source>
+</trans-unit>
+<trans-unit id="s03eef6107e28d042">
+  <source>New Invitation options</source>
+</trans-unit>
+<trans-unit id="s0832ff81b9665e6f">
+  <source>Opens the new invitation wizard and binds the invitation to an existing enrollment flow.</source>
+</trans-unit>
+<trans-unit id="sc0819dc3d82d9320">
+  <source>with Existing Enrollment Flow...</source>
+</trans-unit>
+<trans-unit id="s79108cb25e7bf07b">
+  <source>Opens the new invitation wizard, which will create a new enrollment flow and invitation stage.</source>
+</trans-unit>
+<trans-unit id="sb7809157a3ccf613">
+  <source>with New Enrollment Flow and Invitation Stage...</source>
+</trans-unit>
+<trans-unit id="seb418067e7d6c6e2">
+  <source>Create a new invitation with an enrollment flow.</source>
+</trans-unit>
+<trans-unit id="sfd74a380e957d0d3">
+  <source>Enrollment Flow</source>
+</trans-unit>
+<trans-unit id="scc869d556216d748">
+  <source>Invitation Details</source>
+</trans-unit>
+<trans-unit id="se1fba44a9b284052">
+  <source>Invitation Link</source>
+</trans-unit>
+<trans-unit id="s967a2db7049dc90e">
+  <source><x id="0" equiv-text="${step}"/> failed</source>
+</trans-unit>
+<trans-unit id="s971d4cc0ecd106b7">
+  <source>Importing enrollment flow blueprint</source>
+</trans-unit>
+<trans-unit id="sf3b89a70e20af6c8">
+  <source>Blueprint validation failed</source>
+</trans-unit>
+<trans-unit id="sa04b7204708f4f74">
+  <source>Flow with slug "<x id="0" equiv-text="${slugToLookup}"/>" not found after import</source>
+</trans-unit>
+<trans-unit id="s3354be88ad29d171">
+  <source>Creating invitation</source>
+</trans-unit>
+<trans-unit id="s07f41353777196ea">
+  <source>The flow selected in the previous step. The invitation will be bound to this flow.</source>
+</trans-unit>
+<trans-unit id="s7209a11f97da9aff">
+  <source>No invitation available to send</source>
+</trans-unit>
+<trans-unit id="s2772d8285b905006">
+  <source>Failed to queue invitation emails</source>
+</trans-unit>
+<trans-unit id="s3b7910ab9c47a2e3">
+  <source>No enrollment flows with invitation stages found</source>
+</trans-unit>
+<trans-unit id="sa3ca03297e00591c">
+  <source>You can create a new enrollment flow and invitation stage right here, or cancel and bind an invitation stage to an existing flow manually.</source>
+</trans-unit>
+<trans-unit id="s06db43e56ca76be8">
+  <source>Create a new enrollment flow</source>
+</trans-unit>
+<trans-unit id="s8acc687c55e8ccbf">
+  <source>Only enrollment flows that have an invitation stage bound to them are listed here.</source>
+</trans-unit>
+<trans-unit id="s5b3bafd8ffe553ec">
+  <source>Flow name</source>
+</trans-unit>
+<trans-unit id="s699cd34b0dcb4c56">
+  <source>Name for the new enrollment flow.</source>
+</trans-unit>
+<trans-unit id="s8fb6d1bb698d32a0">
+  <source>Flow slug</source>
+</trans-unit>
+<trans-unit id="s0211c07612cf8c97">
+  <source>Invitation stage name</source>
+</trans-unit>
+<trans-unit id="s42b97ef63fb1a795">
+  <source>Name for the new invitation stage.</source>
+</trans-unit>
+<trans-unit id="saaa9fd0d3ebc35aa">
+  <source>Enrolled users are created as external (e.g. customers, guests). New users will be placed under users/external.</source>
+</trans-unit>
+<trans-unit id="s726dff63487da085">
+  <source>Enrolled users are created as internal (e.g. employees). New users will be placed under users/internal.</source>
+</trans-unit>
+<trans-unit id="sc1358130ac327120">
+  <source>If enabled, the stage will jump to the next stage when no invitation is given. If disabled, the flow will be cancelled without a valid invitation.</source>
+</trans-unit>
+<trans-unit id="s09fdd952c6eaf7da">
+  <source>No invitation was created.</source>
+</trans-unit>
+<trans-unit id="s00febd85a4889bb1">
+  <source>Redirect the user to a static URL or another flow, optionally with all gathered context.</source>
+</trans-unit>
+<trans-unit id="sdbc1d47f0f0ed54d">
+  <source>The element could not be loaded. This may be due to a missing import or a version mismatch.</source>
+</trans-unit>
+<trans-unit id="scf8a3d48f9969535">
+  <source>An element could not be loaded. Please try refreshing the page or clearing your cache.</source>
+</trans-unit>
+<trans-unit id="se2f00b2619675217">
+  <source>Failed to load element</source>
+</trans-unit>
+<trans-unit id="s1cf2298d92c327a6">
+  <source>My Applications</source>
+</trans-unit>
+<trans-unit id="s2656433a3b1f7e86">
+  <source>My applications</source>
 </trans-unit>
 </body>
 </file>

web/xliff/ja-JP.xlf

@@ -6390,18 +6390,6 @@ doesn't pass when either or both of the selected options are equal or above the
   <source>Authenticator Attachment</source>
   <target>認証器の接続方法</target>
 </trans-unit>
-<trans-unit id="s502d2473587032e1">
-  <source>No preference is sent</source>
-  <target>希望は送信されません</target>
-</trans-unit>
-<trans-unit id="s60cc554fde2676cb">
-  <source>A non-removable authenticator, like TouchID or Windows Hello</source>
-  <target>TouchID や Windows Hello のような取り外せない認証器</target>
-</trans-unit>
-<trans-unit id="sdf1d8edef27236f0">
-  <source>A "roaming" authenticator, like a YubiKey</source>
-  <target>YubiKey のようなローミング認証器</target>
-</trans-unit>
 <trans-unit id="sbd65aeeb8a3b9bbc">
   <source>Maximum registration attempts</source>
   <target>登録試行の最大数</target>
@@ -6740,10 +6728,6 @@ doesn't pass when either or both of the selected options are equal or above the
   <source>Selected policies are executed when the stage is submitted to validate the data.</source>
   <target>選択されたポリシーは、ステージが送信されてデータを検証するときに実行されます。</target>
 </trans-unit>
-<trans-unit id="sc487e11d5987dbb4">
-  <source>Redirect the user to another flow, potentially with all gathered context</source>
-  <target>ユーザーを別のフローにリダイレクトします。可能であれば、集められたすべてのコンテキストを含めます。</target>
-</trans-unit>
 <trans-unit id="sad9d5481474d4f5b">
   <source>Static</source>
   <target>スタティック</target>
@@ -11252,15 +11236,6 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="sdcd1a9744efdbd7e">
   <source>Choose Policy Type</source>
 </trans-unit>
-<trans-unit id="sf4eb7c0c8e92e6b2">
-  <source>Whether the launch URL will open in a new browser tab or window from the user's application library.</source>
-</trans-unit>
-<trans-unit id="s8ab0176c9cf77b1a">
-  <source>Hide from User Dashboard</source>
-</trans-unit>
-<trans-unit id="s0b5847edb7150911">
-  <source>Whether this application will be shown on the User Dashboard.</source>
-</trans-unit>
 <trans-unit id="saa5ed8446baaba70">
   <source>Negate Result</source>
 </trans-unit>
@@ -11273,11 +11248,140 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="s41938ae69656ef53">
   <source>User Fields</source>
 </trans-unit>
-<trans-unit id="s977b2dff8b9def14">
-  <source>User Dashboard - Applications</source>
+<trans-unit id="s02b73793e5b4e1ba">
+  <source>This flag is deprecated.</source>
 </trans-unit>
-<trans-unit id="s190cbdd5b62e4746">
-  <source>User Dashboard</source>
+<trans-unit id="s8655c52824caac63">
+  <source>If checked, the launch URL will open in a new browser tab or window from the user's application library.</source>
+</trans-unit>
+<trans-unit id="s9eda7101f63a8652">
+  <source>Hide from My applications</source>
+</trans-unit>
+<trans-unit id="s30f30e9c42594a33">
+  <source>If checked, this application will not be shown on the user's My applications page.</source>
+</trans-unit>
+<trans-unit id="sc98037ccab57d329">
+  <source>No preference: the browser may offer any available authenticator</source>
+</trans-unit>
+<trans-unit id="s4611c85865abcba9">
+  <source>Platform: a non-removable authenticator built into the device, such as Touch ID, Face ID, or Windows Hello</source>
+</trans-unit>
+<trans-unit id="s0003d0e3fcdacabc">
+  <source>Cross-platform: a roaming authenticator, such as a YubiKey or Google Titan</source>
+</trans-unit>
+<trans-unit id="sc157c7dcb3d1b096">
+  <source>Controls the authenticatorAttachment parameter sent to the browser during WebAuthn registration. If Hints are configured and this is left as 'No preference', a value is inferred from the selected hints for backward compatibility with older browsers.</source>
+</trans-unit>
+<trans-unit id="s1baea1b8ac34d554">
+  <source>New Invitation</source>
+</trans-unit>
+<trans-unit id="s03eef6107e28d042">
+  <source>New Invitation options</source>
+</trans-unit>
+<trans-unit id="s0832ff81b9665e6f">
+  <source>Opens the new invitation wizard and binds the invitation to an existing enrollment flow.</source>
+</trans-unit>
+<trans-unit id="sc0819dc3d82d9320">
+  <source>with Existing Enrollment Flow...</source>
+</trans-unit>
+<trans-unit id="s79108cb25e7bf07b">
+  <source>Opens the new invitation wizard, which will create a new enrollment flow and invitation stage.</source>
+</trans-unit>
+<trans-unit id="sb7809157a3ccf613">
+  <source>with New Enrollment Flow and Invitation Stage...</source>
+</trans-unit>
+<trans-unit id="seb418067e7d6c6e2">
+  <source>Create a new invitation with an enrollment flow.</source>
+</trans-unit>
+<trans-unit id="sfd74a380e957d0d3">
+  <source>Enrollment Flow</source>
+</trans-unit>
+<trans-unit id="scc869d556216d748">
+  <source>Invitation Details</source>
+</trans-unit>
+<trans-unit id="se1fba44a9b284052">
+  <source>Invitation Link</source>
+</trans-unit>
+<trans-unit id="s967a2db7049dc90e">
+  <source><x id="0" equiv-text="${step}"/> failed</source>
+</trans-unit>
+<trans-unit id="s971d4cc0ecd106b7">
+  <source>Importing enrollment flow blueprint</source>
+</trans-unit>
+<trans-unit id="sf3b89a70e20af6c8">
+  <source>Blueprint validation failed</source>
+</trans-unit>
+<trans-unit id="sa04b7204708f4f74">
+  <source>Flow with slug "<x id="0" equiv-text="${slugToLookup}"/>" not found after import</source>
+</trans-unit>
+<trans-unit id="s3354be88ad29d171">
+  <source>Creating invitation</source>
+</trans-unit>
+<trans-unit id="s07f41353777196ea">
+  <source>The flow selected in the previous step. The invitation will be bound to this flow.</source>
+</trans-unit>
+<trans-unit id="s7209a11f97da9aff">
+  <source>No invitation available to send</source>
+</trans-unit>
+<trans-unit id="s2772d8285b905006">
+  <source>Failed to queue invitation emails</source>
+</trans-unit>
+<trans-unit id="s3b7910ab9c47a2e3">
+  <source>No enrollment flows with invitation stages found</source>
+</trans-unit>
+<trans-unit id="sa3ca03297e00591c">
+  <source>You can create a new enrollment flow and invitation stage right here, or cancel and bind an invitation stage to an existing flow manually.</source>
+</trans-unit>
+<trans-unit id="s06db43e56ca76be8">
+  <source>Create a new enrollment flow</source>
+</trans-unit>
+<trans-unit id="s8acc687c55e8ccbf">
+  <source>Only enrollment flows that have an invitation stage bound to them are listed here.</source>
+</trans-unit>
+<trans-unit id="s5b3bafd8ffe553ec">
+  <source>Flow name</source>
+</trans-unit>
+<trans-unit id="s699cd34b0dcb4c56">
+  <source>Name for the new enrollment flow.</source>
+</trans-unit>
+<trans-unit id="s8fb6d1bb698d32a0">
+  <source>Flow slug</source>
+</trans-unit>
+<trans-unit id="s0211c07612cf8c97">
+  <source>Invitation stage name</source>
+</trans-unit>
+<trans-unit id="s42b97ef63fb1a795">
+  <source>Name for the new invitation stage.</source>
+</trans-unit>
+<trans-unit id="saaa9fd0d3ebc35aa">
+  <source>Enrolled users are created as external (e.g. customers, guests). New users will be placed under users/external.</source>
+</trans-unit>
+<trans-unit id="s726dff63487da085">
+  <source>Enrolled users are created as internal (e.g. employees). New users will be placed under users/internal.</source>
+</trans-unit>
+<trans-unit id="sc1358130ac327120">
+  <source>If enabled, the stage will jump to the next stage when no invitation is given. If disabled, the flow will be cancelled without a valid invitation.</source>
+</trans-unit>
+<trans-unit id="s09fdd952c6eaf7da">
+  <source>No invitation was created.</source>
+</trans-unit>
+<trans-unit id="s00febd85a4889bb1">
+  <source>Redirect the user to a static URL or another flow, optionally with all gathered context.</source>
+</trans-unit>
+<trans-unit id="sdbc1d47f0f0ed54d">
+  <source>The element could not be loaded. This may be due to a missing import or a version mismatch.</source>
+</trans-unit>
+<trans-unit id="scf8a3d48f9969535">
+  <source>An element could not be loaded. Please try refreshing the page or clearing your cache.</source>
+</trans-unit>
+<trans-unit id="se2f00b2619675217">
+  <source>Failed to load element</source>
+</trans-unit>
+<trans-unit id="s1cf2298d92c327a6">
+  <source>My Applications</source>
+</trans-unit>
+<trans-unit id="s2656433a3b1f7e86">
+  <source>My applications</source>
 </trans-unit>
 </body>
 </file>

web/xliff/ko-KR.xlf

@@ -5946,18 +5946,6 @@ doesn't pass when either or both of the selected options are equal or above the
   <source>Authenticator Attachment</source>
   <target>인증기 첨부</target>
 </trans-unit>
-<trans-unit id="s502d2473587032e1">
-  <source>No preference is sent</source>
-  <target>기본 설정이 전송되지 않음</target>
-</trans-unit>
-<trans-unit id="s60cc554fde2676cb">
-  <source>A non-removable authenticator, like TouchID or Windows Hello</source>
-  <target>TouchID 또는 Windows Hello와 같은 제거할 수 없는 인증기</target>
-</trans-unit>
-<trans-unit id="sdf1d8edef27236f0">
-  <source>A "roaming" authenticator, like a YubiKey</source>
-  <target>YubiKey 같은 "로밍" 인증기</target>
-</trans-unit>
 <trans-unit id="sbd65aeeb8a3b9bbc">
   <source>Maximum registration attempts</source>
   <target>최대 등록 시도</target>
@@ -6270,9 +6258,6 @@ doesn't pass when either or both of the selected options are equal or above the
   <source>Selected policies are executed when the stage is submitted to validate the data.</source>
   <target>데이터 유효성 검사를 위해 스테이지가 제출될 때 선택한 정책이 실행됩니다.</target>
 </trans-unit>
-<trans-unit id="sc487e11d5987dbb4">
-  <source>Redirect the user to another flow, potentially with all gathered context</source>
-</trans-unit>
 <trans-unit id="sad9d5481474d4f5b">
   <source>Static</source>
   <target>정적</target>
@@ -10621,15 +10606,6 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="sdcd1a9744efdbd7e">
   <source>Choose Policy Type</source>
 </trans-unit>
-<trans-unit id="sf4eb7c0c8e92e6b2">
-  <source>Whether the launch URL will open in a new browser tab or window from the user's application library.</source>
-</trans-unit>
-<trans-unit id="s8ab0176c9cf77b1a">
-  <source>Hide from User Dashboard</source>
-</trans-unit>
-<trans-unit id="s0b5847edb7150911">
-  <source>Whether this application will be shown on the User Dashboard.</source>
-</trans-unit>
 <trans-unit id="saa5ed8446baaba70">
   <source>Negate Result</source>
 </trans-unit>
@@ -10642,11 +10618,140 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="s41938ae69656ef53">
   <source>User Fields</source>
 </trans-unit>
-<trans-unit id="s977b2dff8b9def14">
-  <source>User Dashboard - Applications</source>
+<trans-unit id="s02b73793e5b4e1ba">
+  <source>This flag is deprecated.</source>
 </trans-unit>
-<trans-unit id="s190cbdd5b62e4746">
-  <source>User Dashboard</source>
+<trans-unit id="s8655c52824caac63">
+  <source>If checked, the launch URL will open in a new browser tab or window from the user's application library.</source>
+</trans-unit>
+<trans-unit id="s9eda7101f63a8652">
+  <source>Hide from My applications</source>
+</trans-unit>
+<trans-unit id="s30f30e9c42594a33">
+  <source>If checked, this application will not be shown on the user's My applications page.</source>
+</trans-unit>
+<trans-unit id="sc98037ccab57d329">
+  <source>No preference: the browser may offer any available authenticator</source>
+</trans-unit>
+<trans-unit id="s4611c85865abcba9">
+  <source>Platform: a non-removable authenticator built into the device, such as Touch ID, Face ID, or Windows Hello</source>
+</trans-unit>
+<trans-unit id="s0003d0e3fcdacabc">
+  <source>Cross-platform: a roaming authenticator, such as a YubiKey or Google Titan</source>
+</trans-unit>
+<trans-unit id="sc157c7dcb3d1b096">
+  <source>Controls the authenticatorAttachment parameter sent to the browser during WebAuthn registration. If Hints are configured and this is left as 'No preference', a value is inferred from the selected hints for backward compatibility with older browsers.</source>
+</trans-unit>
+<trans-unit id="s1baea1b8ac34d554">
+  <source>New Invitation</source>
+</trans-unit>
+<trans-unit id="s03eef6107e28d042">
+  <source>New Invitation options</source>
+</trans-unit>
+<trans-unit id="s0832ff81b9665e6f">
+  <source>Opens the new invitation wizard and binds the invitation to an existing enrollment flow.</source>
+</trans-unit>
+<trans-unit id="sc0819dc3d82d9320">
+  <source>with Existing Enrollment Flow...</source>
+</trans-unit>
+<trans-unit id="s79108cb25e7bf07b">
+  <source>Opens the new invitation wizard, which will create a new enrollment flow and invitation stage.</source>
+</trans-unit>
+<trans-unit id="sb7809157a3ccf613">
+  <source>with New Enrollment Flow and Invitation Stage...</source>
+</trans-unit>
+<trans-unit id="seb418067e7d6c6e2">
+  <source>Create a new invitation with an enrollment flow.</source>
+</trans-unit>
+<trans-unit id="sfd74a380e957d0d3">
+  <source>Enrollment Flow</source>
+</trans-unit>
+<trans-unit id="scc869d556216d748">
+  <source>Invitation Details</source>
+</trans-unit>
+<trans-unit id="se1fba44a9b284052">
+  <source>Invitation Link</source>
+</trans-unit>
+<trans-unit id="s967a2db7049dc90e">
+  <source><x id="0" equiv-text="${step}"/> failed</source>
+</trans-unit>
+<trans-unit id="s971d4cc0ecd106b7">
+  <source>Importing enrollment flow blueprint</source>
+</trans-unit>
+<trans-unit id="sf3b89a70e20af6c8">
+  <source>Blueprint validation failed</source>
+</trans-unit>
+<trans-unit id="sa04b7204708f4f74">
+  <source>Flow with slug "<x id="0" equiv-text="${slugToLookup}"/>" not found after import</source>
+</trans-unit>
+<trans-unit id="s3354be88ad29d171">
+  <source>Creating invitation</source>
+</trans-unit>
+<trans-unit id="s07f41353777196ea">
+  <source>The flow selected in the previous step. The invitation will be bound to this flow.</source>
+</trans-unit>
+<trans-unit id="s7209a11f97da9aff">
+  <source>No invitation available to send</source>
+</trans-unit>
+<trans-unit id="s2772d8285b905006">
+  <source>Failed to queue invitation emails</source>
+</trans-unit>
+<trans-unit id="s3b7910ab9c47a2e3">
+  <source>No enrollment flows with invitation stages found</source>
+</trans-unit>
+<trans-unit id="sa3ca03297e00591c">
+  <source>You can create a new enrollment flow and invitation stage right here, or cancel and bind an invitation stage to an existing flow manually.</source>
+</trans-unit>
+<trans-unit id="s06db43e56ca76be8">
+  <source>Create a new enrollment flow</source>
+</trans-unit>
+<trans-unit id="s8acc687c55e8ccbf">
+  <source>Only enrollment flows that have an invitation stage bound to them are listed here.</source>
+</trans-unit>
+<trans-unit id="s5b3bafd8ffe553ec">
+  <source>Flow name</source>
+</trans-unit>
+<trans-unit id="s699cd34b0dcb4c56">
+  <source>Name for the new enrollment flow.</source>
+</trans-unit>
+<trans-unit id="s8fb6d1bb698d32a0">
+  <source>Flow slug</source>
+</trans-unit>
+<trans-unit id="s0211c07612cf8c97">
+  <source>Invitation stage name</source>
+</trans-unit>
+<trans-unit id="s42b97ef63fb1a795">
+  <source>Name for the new invitation stage.</source>
+</trans-unit>
+<trans-unit id="saaa9fd0d3ebc35aa">
+  <source>Enrolled users are created as external (e.g. customers, guests). New users will be placed under users/external.</source>
+</trans-unit>
+<trans-unit id="s726dff63487da085">
+  <source>Enrolled users are created as internal (e.g. employees). New users will be placed under users/internal.</source>
+</trans-unit>
+<trans-unit id="sc1358130ac327120">
+  <source>If enabled, the stage will jump to the next stage when no invitation is given. If disabled, the flow will be cancelled without a valid invitation.</source>
+</trans-unit>
+<trans-unit id="s09fdd952c6eaf7da">
+  <source>No invitation was created.</source>
+</trans-unit>
+<trans-unit id="s00febd85a4889bb1">
+  <source>Redirect the user to a static URL or another flow, optionally with all gathered context.</source>
+</trans-unit>
+<trans-unit id="sdbc1d47f0f0ed54d">
+  <source>The element could not be loaded. This may be due to a missing import or a version mismatch.</source>
+</trans-unit>
+<trans-unit id="scf8a3d48f9969535">
+  <source>An element could not be loaded. Please try refreshing the page or clearing your cache.</source>
+</trans-unit>
+<trans-unit id="se2f00b2619675217">
+  <source>Failed to load element</source>
+</trans-unit>
+<trans-unit id="s1cf2298d92c327a6">
+  <source>My Applications</source>
+</trans-unit>
+<trans-unit id="s2656433a3b1f7e86">
+  <source>My applications</source>
 </trans-unit>
 </body>
 </file>

web/xliff/nl-NL.xlf

@@ -5723,18 +5723,6 @@ slaagt niet wanneer een of beide geselecteerde opties gelijk zijn aan of boven d
   <source>Authenticator Attachment</source>
   <target>Authenticatorbijlage</target>
 </trans-unit>
-<trans-unit id="s502d2473587032e1">
-  <source>No preference is sent</source>
-  <target>Geen voorkeur wordt verzonden</target>
-</trans-unit>
-<trans-unit id="s60cc554fde2676cb">
-  <source>A non-removable authenticator, like TouchID or Windows Hello</source>
-  <target>Een niet-verwijderbare authenticator, zoals TouchID of Windows Hello</target>
-</trans-unit>
-<trans-unit id="sdf1d8edef27236f0">
-  <source>A "roaming" authenticator, like a YubiKey</source>
-  <target>Een "roaming" authenticator, zoals een YubiKey</target>
-</trans-unit>
 <trans-unit id="sbd65aeeb8a3b9bbc">
   <source>Maximum registration attempts</source>
 </trans-unit>
@@ -6033,9 +6021,6 @@ slaagt niet wanneer een of beide geselecteerde opties gelijk zijn aan of boven d
   <source>Selected policies are executed when the stage is submitted to validate the data.</source>
   <target>Geselecteerde beleidsregels worden uitgevoerd wanneer de fase wordt ingediend om de gegevens te valideren.</target>
 </trans-unit>
-<trans-unit id="sc487e11d5987dbb4">
-  <source>Redirect the user to another flow, potentially with all gathered context</source>
-</trans-unit>
 <trans-unit id="sad9d5481474d4f5b">
   <source>Static</source>
 </trans-unit>
@@ -10306,15 +10291,6 @@ Bindingen naar groepen/gebruikers worden gecontroleerd tegen de gebruiker van de
 <trans-unit id="sdcd1a9744efdbd7e">
   <source>Choose Policy Type</source>
 </trans-unit>
-<trans-unit id="sf4eb7c0c8e92e6b2">
-  <source>Whether the launch URL will open in a new browser tab or window from the user's application library.</source>
-</trans-unit>
-<trans-unit id="s8ab0176c9cf77b1a">
-  <source>Hide from User Dashboard</source>
-</trans-unit>
-<trans-unit id="s0b5847edb7150911">
-  <source>Whether this application will be shown on the User Dashboard.</source>
-</trans-unit>
 <trans-unit id="saa5ed8446baaba70">
   <source>Negate Result</source>
 </trans-unit>
@@ -10327,11 +10303,140 @@ Bindingen naar groepen/gebruikers worden gecontroleerd tegen de gebruiker van de
 <trans-unit id="s41938ae69656ef53">
   <source>User Fields</source>
 </trans-unit>
-<trans-unit id="s977b2dff8b9def14">
-  <source>User Dashboard - Applications</source>
+<trans-unit id="s02b73793e5b4e1ba">
+  <source>This flag is deprecated.</source>
 </trans-unit>
-<trans-unit id="s190cbdd5b62e4746">
-  <source>User Dashboard</source>
+<trans-unit id="s8655c52824caac63">
+  <source>If checked, the launch URL will open in a new browser tab or window from the user's application library.</source>
+</trans-unit>
+<trans-unit id="s9eda7101f63a8652">
+  <source>Hide from My applications</source>
+</trans-unit>
+<trans-unit id="s30f30e9c42594a33">
+  <source>If checked, this application will not be shown on the user's My applications page.</source>
+</trans-unit>
+<trans-unit id="sc98037ccab57d329">
+  <source>No preference: the browser may offer any available authenticator</source>
+</trans-unit>
+<trans-unit id="s4611c85865abcba9">
+  <source>Platform: a non-removable authenticator built into the device, such as Touch ID, Face ID, or Windows Hello</source>
+</trans-unit>
+<trans-unit id="s0003d0e3fcdacabc">
+  <source>Cross-platform: a roaming authenticator, such as a YubiKey or Google Titan</source>
+</trans-unit>
+<trans-unit id="sc157c7dcb3d1b096">
+  <source>Controls the authenticatorAttachment parameter sent to the browser during WebAuthn registration. If Hints are configured and this is left as 'No preference', a value is inferred from the selected hints for backward compatibility with older browsers.</source>
+</trans-unit>
+<trans-unit id="s1baea1b8ac34d554">
+  <source>New Invitation</source>
+</trans-unit>
+<trans-unit id="s03eef6107e28d042">
+  <source>New Invitation options</source>
+</trans-unit>
+<trans-unit id="s0832ff81b9665e6f">
+  <source>Opens the new invitation wizard and binds the invitation to an existing enrollment flow.</source>
+</trans-unit>
+<trans-unit id="sc0819dc3d82d9320">
+  <source>with Existing Enrollment Flow...</source>
+</trans-unit>
+<trans-unit id="s79108cb25e7bf07b">
+  <source>Opens the new invitation wizard, which will create a new enrollment flow and invitation stage.</source>
+</trans-unit>
+<trans-unit id="sb7809157a3ccf613">
+  <source>with New Enrollment Flow and Invitation Stage...</source>
+</trans-unit>
+<trans-unit id="seb418067e7d6c6e2">
+  <source>Create a new invitation with an enrollment flow.</source>
+</trans-unit>
+<trans-unit id="sfd74a380e957d0d3">
+  <source>Enrollment Flow</source>
+</trans-unit>
+<trans-unit id="scc869d556216d748">
+  <source>Invitation Details</source>
+</trans-unit>
+<trans-unit id="se1fba44a9b284052">
+  <source>Invitation Link</source>
+</trans-unit>
+<trans-unit id="s967a2db7049dc90e">
+  <source><x id="0" equiv-text="${step}"/> failed</source>
+</trans-unit>
+<trans-unit id="s971d4cc0ecd106b7">
+  <source>Importing enrollment flow blueprint</source>
+</trans-unit>
+<trans-unit id="sf3b89a70e20af6c8">
+  <source>Blueprint validation failed</source>
+</trans-unit>
+<trans-unit id="sa04b7204708f4f74">
+  <source>Flow with slug "<x id="0" equiv-text="${slugToLookup}"/>" not found after import</source>
+</trans-unit>
+<trans-unit id="s3354be88ad29d171">
+  <source>Creating invitation</source>
+</trans-unit>
+<trans-unit id="s07f41353777196ea">
+  <source>The flow selected in the previous step. The invitation will be bound to this flow.</source>
+</trans-unit>
+<trans-unit id="s7209a11f97da9aff">
+  <source>No invitation available to send</source>
+</trans-unit>
+<trans-unit id="s2772d8285b905006">
+  <source>Failed to queue invitation emails</source>
+</trans-unit>
+<trans-unit id="s3b7910ab9c47a2e3">
+  <source>No enrollment flows with invitation stages found</source>
+</trans-unit>
+<trans-unit id="sa3ca03297e00591c">
+  <source>You can create a new enrollment flow and invitation stage right here, or cancel and bind an invitation stage to an existing flow manually.</source>
+</trans-unit>
+<trans-unit id="s06db43e56ca76be8">
+  <source>Create a new enrollment flow</source>
+</trans-unit>
+<trans-unit id="s8acc687c55e8ccbf">
+  <source>Only enrollment flows that have an invitation stage bound to them are listed here.</source>
+</trans-unit>
+<trans-unit id="s5b3bafd8ffe553ec">
+  <source>Flow name</source>
+</trans-unit>
+<trans-unit id="s699cd34b0dcb4c56">
+  <source>Name for the new enrollment flow.</source>
+</trans-unit>
+<trans-unit id="s8fb6d1bb698d32a0">
+  <source>Flow slug</source>
+</trans-unit>
+<trans-unit id="s0211c07612cf8c97">
+  <source>Invitation stage name</source>
+</trans-unit>
+<trans-unit id="s42b97ef63fb1a795">
+  <source>Name for the new invitation stage.</source>
+</trans-unit>
+<trans-unit id="saaa9fd0d3ebc35aa">
+  <source>Enrolled users are created as external (e.g. customers, guests). New users will be placed under users/external.</source>
+</trans-unit>
+<trans-unit id="s726dff63487da085">
+  <source>Enrolled users are created as internal (e.g. employees). New users will be placed under users/internal.</source>
+</trans-unit>
+<trans-unit id="sc1358130ac327120">
+  <source>If enabled, the stage will jump to the next stage when no invitation is given. If disabled, the flow will be cancelled without a valid invitation.</source>
+</trans-unit>
+<trans-unit id="s09fdd952c6eaf7da">
+  <source>No invitation was created.</source>
+</trans-unit>
+<trans-unit id="s00febd85a4889bb1">
+  <source>Redirect the user to a static URL or another flow, optionally with all gathered context.</source>
+</trans-unit>
+<trans-unit id="sdbc1d47f0f0ed54d">
+  <source>The element could not be loaded. This may be due to a missing import or a version mismatch.</source>
+</trans-unit>
+<trans-unit id="scf8a3d48f9969535">
+  <source>An element could not be loaded. Please try refreshing the page or clearing your cache.</source>
+</trans-unit>
+<trans-unit id="se2f00b2619675217">
+  <source>Failed to load element</source>
+</trans-unit>
+<trans-unit id="s1cf2298d92c327a6">
+  <source>My Applications</source>
+</trans-unit>
+<trans-unit id="s2656433a3b1f7e86">
+  <source>My applications</source>
 </trans-unit>
 </body>
 </file>

web/xliff/pl-PL.xlf

@@ -5962,18 +5962,6 @@ Można tu używać tylko zasad, ponieważ dostęp jest sprawdzany przed uwierzyt
   <source>Authenticator Attachment</source>
   <target>Załącznik uwierzytelniający</target>
 </trans-unit>
-<trans-unit id="s502d2473587032e1">
-  <source>No preference is sent</source>
-  <target>Żadne preferencje nie są wysyłane</target>
-</trans-unit>
-<trans-unit id="s60cc554fde2676cb">
-  <source>A non-removable authenticator, like TouchID or Windows Hello</source>
-  <target>Nieusuwalny token uwierzytelniający, taki jak TouchID lub Windows Hello</target>
-</trans-unit>
-<trans-unit id="sdf1d8edef27236f0">
-  <source>A "roaming" authenticator, like a YubiKey</source>
-  <target>„Mobilne” uwierzytelniacz, taki jak YubiKey</target>
-</trans-unit>
 <trans-unit id="sbd65aeeb8a3b9bbc">
   <source>Maximum registration attempts</source>
 </trans-unit>
@@ -6279,9 +6267,6 @@ Można tu używać tylko zasad, ponieważ dostęp jest sprawdzany przed uwierzyt
   <source>Selected policies are executed when the stage is submitted to validate the data.</source>
   <target>Wybrane zasady są wykonywane po przesłaniu etapu w celu weryfikacji danych.</target>
 </trans-unit>
-<trans-unit id="sc487e11d5987dbb4">
-  <source>Redirect the user to another flow, potentially with all gathered context</source>
-</trans-unit>
 <trans-unit id="sad9d5481474d4f5b">
   <source>Static</source>
 </trans-unit>
@@ -10645,15 +10630,6 @@ Powiązania z grupami/użytkownikami są sprawdzane względem użytkownika zdarz
 <trans-unit id="sdcd1a9744efdbd7e">
   <source>Choose Policy Type</source>
 </trans-unit>
-<trans-unit id="sf4eb7c0c8e92e6b2">
-  <source>Whether the launch URL will open in a new browser tab or window from the user's application library.</source>
-</trans-unit>
-<trans-unit id="s8ab0176c9cf77b1a">
-  <source>Hide from User Dashboard</source>
-</trans-unit>
-<trans-unit id="s0b5847edb7150911">
-  <source>Whether this application will be shown on the User Dashboard.</source>
-</trans-unit>
 <trans-unit id="saa5ed8446baaba70">
   <source>Negate Result</source>
 </trans-unit>
@@ -10666,11 +10642,140 @@ Powiązania z grupami/użytkownikami są sprawdzane względem użytkownika zdarz
 <trans-unit id="s41938ae69656ef53">
   <source>User Fields</source>
 </trans-unit>
-<trans-unit id="s977b2dff8b9def14">
-  <source>User Dashboard - Applications</source>
+<trans-unit id="s02b73793e5b4e1ba">
+  <source>This flag is deprecated.</source>
 </trans-unit>
-<trans-unit id="s190cbdd5b62e4746">
-  <source>User Dashboard</source>
+<trans-unit id="s8655c52824caac63">
+  <source>If checked, the launch URL will open in a new browser tab or window from the user's application library.</source>
+</trans-unit>
+<trans-unit id="s9eda7101f63a8652">
+  <source>Hide from My applications</source>
+</trans-unit>
+<trans-unit id="s30f30e9c42594a33">
+  <source>If checked, this application will not be shown on the user's My applications page.</source>
+</trans-unit>
+<trans-unit id="sc98037ccab57d329">
+  <source>No preference: the browser may offer any available authenticator</source>
+</trans-unit>
+<trans-unit id="s4611c85865abcba9">
+  <source>Platform: a non-removable authenticator built into the device, such as Touch ID, Face ID, or Windows Hello</source>
+</trans-unit>
+<trans-unit id="s0003d0e3fcdacabc">
+  <source>Cross-platform: a roaming authenticator, such as a YubiKey or Google Titan</source>
+</trans-unit>
+<trans-unit id="sc157c7dcb3d1b096">
+  <source>Controls the authenticatorAttachment parameter sent to the browser during WebAuthn registration. If Hints are configured and this is left as 'No preference', a value is inferred from the selected hints for backward compatibility with older browsers.</source>
+</trans-unit>
+<trans-unit id="s1baea1b8ac34d554">
+  <source>New Invitation</source>
+</trans-unit>
+<trans-unit id="s03eef6107e28d042">
+  <source>New Invitation options</source>
+</trans-unit>
+<trans-unit id="s0832ff81b9665e6f">
+  <source>Opens the new invitation wizard and binds the invitation to an existing enrollment flow.</source>
+</trans-unit>
+<trans-unit id="sc0819dc3d82d9320">
+  <source>with Existing Enrollment Flow...</source>
+</trans-unit>
+<trans-unit id="s79108cb25e7bf07b">
+  <source>Opens the new invitation wizard, which will create a new enrollment flow and invitation stage.</source>
+</trans-unit>
+<trans-unit id="sb7809157a3ccf613">
+  <source>with New Enrollment Flow and Invitation Stage...</source>
+</trans-unit>
+<trans-unit id="seb418067e7d6c6e2">
+  <source>Create a new invitation with an enrollment flow.</source>
+</trans-unit>
+<trans-unit id="sfd74a380e957d0d3">
+  <source>Enrollment Flow</source>
+</trans-unit>
+<trans-unit id="scc869d556216d748">
+  <source>Invitation Details</source>
+</trans-unit>
+<trans-unit id="se1fba44a9b284052">
+  <source>Invitation Link</source>
+</trans-unit>
+<trans-unit id="s967a2db7049dc90e">
+  <source><x id="0" equiv-text="${step}"/> failed</source>
+</trans-unit>
+<trans-unit id="s971d4cc0ecd106b7">
+  <source>Importing enrollment flow blueprint</source>
+</trans-unit>
+<trans-unit id="sf3b89a70e20af6c8">
+  <source>Blueprint validation failed</source>
+</trans-unit>
+<trans-unit id="sa04b7204708f4f74">
+  <source>Flow with slug "<x id="0" equiv-text="${slugToLookup}"/>" not found after import</source>
+</trans-unit>
+<trans-unit id="s3354be88ad29d171">
+  <source>Creating invitation</source>
+</trans-unit>
+<trans-unit id="s07f41353777196ea">
+  <source>The flow selected in the previous step. The invitation will be bound to this flow.</source>
+</trans-unit>
+<trans-unit id="s7209a11f97da9aff">
+  <source>No invitation available to send</source>
+</trans-unit>
+<trans-unit id="s2772d8285b905006">
+  <source>Failed to queue invitation emails</source>
+</trans-unit>
+<trans-unit id="s3b7910ab9c47a2e3">
+  <source>No enrollment flows with invitation stages found</source>
+</trans-unit>
+<trans-unit id="sa3ca03297e00591c">
+  <source>You can create a new enrollment flow and invitation stage right here, or cancel and bind an invitation stage to an existing flow manually.</source>
+</trans-unit>
+<trans-unit id="s06db43e56ca76be8">
+  <source>Create a new enrollment flow</source>
+</trans-unit>
+<trans-unit id="s8acc687c55e8ccbf">
+  <source>Only enrollment flows that have an invitation stage bound to them are listed here.</source>
+</trans-unit>
+<trans-unit id="s5b3bafd8ffe553ec">
+  <source>Flow name</source>
+</trans-unit>
+<trans-unit id="s699cd34b0dcb4c56">
+  <source>Name for the new enrollment flow.</source>
+</trans-unit>
+<trans-unit id="s8fb6d1bb698d32a0">
+  <source>Flow slug</source>
+</trans-unit>
+<trans-unit id="s0211c07612cf8c97">
+  <source>Invitation stage name</source>
+</trans-unit>
+<trans-unit id="s42b97ef63fb1a795">
+  <source>Name for the new invitation stage.</source>
+</trans-unit>
+<trans-unit id="saaa9fd0d3ebc35aa">
+  <source>Enrolled users are created as external (e.g. customers, guests). New users will be placed under users/external.</source>
+</trans-unit>
+<trans-unit id="s726dff63487da085">
+  <source>Enrolled users are created as internal (e.g. employees). New users will be placed under users/internal.</source>
+</trans-unit>
+<trans-unit id="sc1358130ac327120">
+  <source>If enabled, the stage will jump to the next stage when no invitation is given. If disabled, the flow will be cancelled without a valid invitation.</source>
+</trans-unit>
+<trans-unit id="s09fdd952c6eaf7da">
+  <source>No invitation was created.</source>
+</trans-unit>
+<trans-unit id="s00febd85a4889bb1">
+  <source>Redirect the user to a static URL or another flow, optionally with all gathered context.</source>
+</trans-unit>
+<trans-unit id="sdbc1d47f0f0ed54d">
+  <source>The element could not be loaded. This may be due to a missing import or a version mismatch.</source>
+</trans-unit>
+<trans-unit id="scf8a3d48f9969535">
+  <source>An element could not be loaded. Please try refreshing the page or clearing your cache.</source>
+</trans-unit>
+<trans-unit id="se2f00b2619675217">
+  <source>Failed to load element</source>
+</trans-unit>
+<trans-unit id="s1cf2298d92c327a6">
+  <source>My Applications</source>
+</trans-unit>
+<trans-unit id="s2656433a3b1f7e86">
+  <source>My applications</source>
 </trans-unit>
 </body>
 </file>

web/xliff/pt-BR.xlf

@@ -6390,18 +6390,6 @@ retorne uma lista para fornecer várias opções padrão.</target>
   <source>Authenticator Attachment</source>
   <target>Anexação do autenticador</target>
 </trans-unit>
-<trans-unit id="s502d2473587032e1">
-  <source>No preference is sent</source>
-  <target>Nenhuma preferência é enviada</target>
-</trans-unit>
-<trans-unit id="s60cc554fde2676cb">
-  <source>A non-removable authenticator, like TouchID or Windows Hello</source>
-  <target>Um autenticador não removível, como TouchID ou Windows Hello</target>
-</trans-unit>
-<trans-unit id="sdf1d8edef27236f0">
-  <source>A "roaming" authenticator, like a YubiKey</source>
-  <target>Um autenticador "itinerante", como um YubiKey</target>
-</trans-unit>
 <trans-unit id="sbd65aeeb8a3b9bbc">
   <source>Maximum registration attempts</source>
   <target>Máximo de tentativas de registro</target>
@@ -6737,10 +6725,6 @@ retorne uma lista para fornecer várias opções padrão.</target>
   <source>Selected policies are executed when the stage is submitted to validate the data.</source>
   <target>As políticas selecionadas são executadas quando o estágio é enviado para validar os dados.</target>
 </trans-unit>
-<trans-unit id="sc487e11d5987dbb4">
-  <source>Redirect the user to another flow, potentially with all gathered context</source>
-  <target>Redirecionar o usuário para outro fluxo, potencialmente com todo o contexto reunido</target>
-</trans-unit>
 <trans-unit id="sad9d5481474d4f5b">
   <source>Static</source>
   <target>Estático</target>
@@ -11244,15 +11228,6 @@ por exemplo: <x id="0" equiv-text="&lt;code&gt;"/>oci://registry.domain.tld/path
 <trans-unit id="sdcd1a9744efdbd7e">
   <source>Choose Policy Type</source>
 </trans-unit>
-<trans-unit id="sf4eb7c0c8e92e6b2">
-  <source>Whether the launch URL will open in a new browser tab or window from the user's application library.</source>
-</trans-unit>
-<trans-unit id="s8ab0176c9cf77b1a">
-  <source>Hide from User Dashboard</source>
-</trans-unit>
-<trans-unit id="s0b5847edb7150911">
-  <source>Whether this application will be shown on the User Dashboard.</source>
-</trans-unit>
 <trans-unit id="saa5ed8446baaba70">
   <source>Negate Result</source>
 </trans-unit>
@@ -11265,11 +11240,140 @@ por exemplo: <x id="0" equiv-text="&lt;code&gt;"/>oci://registry.domain.tld/path
 <trans-unit id="s41938ae69656ef53">
   <source>User Fields</source>
 </trans-unit>
-<trans-unit id="s977b2dff8b9def14">
-  <source>User Dashboard - Applications</source>
+<trans-unit id="s02b73793e5b4e1ba">
+  <source>This flag is deprecated.</source>
 </trans-unit>
-<trans-unit id="s190cbdd5b62e4746">
-  <source>User Dashboard</source>
+<trans-unit id="s8655c52824caac63">
+  <source>If checked, the launch URL will open in a new browser tab or window from the user's application library.</source>
+</trans-unit>
+<trans-unit id="s9eda7101f63a8652">
+  <source>Hide from My applications</source>
+</trans-unit>
+<trans-unit id="s30f30e9c42594a33">
+  <source>If checked, this application will not be shown on the user's My applications page.</source>
+</trans-unit>
+<trans-unit id="sc98037ccab57d329">
+  <source>No preference: the browser may offer any available authenticator</source>
+</trans-unit>
+<trans-unit id="s4611c85865abcba9">
+  <source>Platform: a non-removable authenticator built into the device, such as Touch ID, Face ID, or Windows Hello</source>
+</trans-unit>
+<trans-unit id="s0003d0e3fcdacabc">
+  <source>Cross-platform: a roaming authenticator, such as a YubiKey or Google Titan</source>
+</trans-unit>
+<trans-unit id="sc157c7dcb3d1b096">
+  <source>Controls the authenticatorAttachment parameter sent to the browser during WebAuthn registration. If Hints are configured and this is left as 'No preference', a value is inferred from the selected hints for backward compatibility with older browsers.</source>
+</trans-unit>
+<trans-unit id="s1baea1b8ac34d554">
+  <source>New Invitation</source>
+</trans-unit>
+<trans-unit id="s03eef6107e28d042">
+  <source>New Invitation options</source>
+</trans-unit>
+<trans-unit id="s0832ff81b9665e6f">
+  <source>Opens the new invitation wizard and binds the invitation to an existing enrollment flow.</source>
+</trans-unit>
+<trans-unit id="sc0819dc3d82d9320">
+  <source>with Existing Enrollment Flow...</source>
+</trans-unit>
+<trans-unit id="s79108cb25e7bf07b">
+  <source>Opens the new invitation wizard, which will create a new enrollment flow and invitation stage.</source>
+</trans-unit>
+<trans-unit id="sb7809157a3ccf613">
+  <source>with New Enrollment Flow and Invitation Stage...</source>
+</trans-unit>
+<trans-unit id="seb418067e7d6c6e2">
+  <source>Create a new invitation with an enrollment flow.</source>
+</trans-unit>
+<trans-unit id="sfd74a380e957d0d3">
+  <source>Enrollment Flow</source>
+</trans-unit>
+<trans-unit id="scc869d556216d748">
+  <source>Invitation Details</source>
+</trans-unit>
+<trans-unit id="se1fba44a9b284052">
+  <source>Invitation Link</source>
+</trans-unit>
+<trans-unit id="s967a2db7049dc90e">
+  <source><x id="0" equiv-text="${step}"/> failed</source>
+</trans-unit>
+<trans-unit id="s971d4cc0ecd106b7">
+  <source>Importing enrollment flow blueprint</source>
+</trans-unit>
+<trans-unit id="sf3b89a70e20af6c8">
+  <source>Blueprint validation failed</source>
+</trans-unit>
+<trans-unit id="sa04b7204708f4f74">
+  <source>Flow with slug "<x id="0" equiv-text="${slugToLookup}"/>" not found after import</source>
+</trans-unit>
+<trans-unit id="s3354be88ad29d171">
+  <source>Creating invitation</source>
+</trans-unit>
+<trans-unit id="s07f41353777196ea">
+  <source>The flow selected in the previous step. The invitation will be bound to this flow.</source>
+</trans-unit>
+<trans-unit id="s7209a11f97da9aff">
+  <source>No invitation available to send</source>
+</trans-unit>
+<trans-unit id="s2772d8285b905006">
+  <source>Failed to queue invitation emails</source>
+</trans-unit>
+<trans-unit id="s3b7910ab9c47a2e3">
+  <source>No enrollment flows with invitation stages found</source>
+</trans-unit>
+<trans-unit id="sa3ca03297e00591c">
+  <source>You can create a new enrollment flow and invitation stage right here, or cancel and bind an invitation stage to an existing flow manually.</source>
+</trans-unit>
+<trans-unit id="s06db43e56ca76be8">
+  <source>Create a new enrollment flow</source>
+</trans-unit>
+<trans-unit id="s8acc687c55e8ccbf">
+  <source>Only enrollment flows that have an invitation stage bound to them are listed here.</source>
+</trans-unit>
+<trans-unit id="s5b3bafd8ffe553ec">
+  <source>Flow name</source>
+</trans-unit>
+<trans-unit id="s699cd34b0dcb4c56">
+  <source>Name for the new enrollment flow.</source>
+</trans-unit>
+<trans-unit id="s8fb6d1bb698d32a0">
+  <source>Flow slug</source>
+</trans-unit>
+<trans-unit id="s0211c07612cf8c97">
+  <source>Invitation stage name</source>
+</trans-unit>
+<trans-unit id="s42b97ef63fb1a795">
+  <source>Name for the new invitation stage.</source>
+</trans-unit>
+<trans-unit id="saaa9fd0d3ebc35aa">
+  <source>Enrolled users are created as external (e.g. customers, guests). New users will be placed under users/external.</source>
+</trans-unit>
+<trans-unit id="s726dff63487da085">
+  <source>Enrolled users are created as internal (e.g. employees). New users will be placed under users/internal.</source>
+</trans-unit>
+<trans-unit id="sc1358130ac327120">
+  <source>If enabled, the stage will jump to the next stage when no invitation is given. If disabled, the flow will be cancelled without a valid invitation.</source>
+</trans-unit>
+<trans-unit id="s09fdd952c6eaf7da">
+  <source>No invitation was created.</source>
+</trans-unit>
+<trans-unit id="s00febd85a4889bb1">
+  <source>Redirect the user to a static URL or another flow, optionally with all gathered context.</source>
+</trans-unit>
+<trans-unit id="sdbc1d47f0f0ed54d">
+  <source>The element could not be loaded. This may be due to a missing import or a version mismatch.</source>
+</trans-unit>
+<trans-unit id="scf8a3d48f9969535">
+  <source>An element could not be loaded. Please try refreshing the page or clearing your cache.</source>
+</trans-unit>
+<trans-unit id="se2f00b2619675217">
+  <source>Failed to load element</source>
+</trans-unit>
+<trans-unit id="s1cf2298d92c327a6">
+  <source>My Applications</source>
+</trans-unit>
+<trans-unit id="s2656433a3b1f7e86">
+  <source>My applications</source>
 </trans-unit>
 </body>
 </file>

web/xliff/ru-RU.xlf

@@ -6012,18 +6012,6 @@ doesn't pass when either or both of the selected options are equal or above the
   <source>Authenticator Attachment</source>
   <target>Вложения аутентификатора</target>
 </trans-unit>
-<trans-unit id="s502d2473587032e1">
-  <source>No preference is sent</source>
-  <target>Предпочтения не отправляются</target>
-</trans-unit>
-<trans-unit id="s60cc554fde2676cb">
-  <source>A non-removable authenticator, like TouchID or Windows Hello</source>
-  <target>Несъемный аутентификатор, например TouchID или Windows Hello</target>
-</trans-unit>
-<trans-unit id="sdf1d8edef27236f0">
-  <source>A "roaming" authenticator, like a YubiKey</source>
-  <target>Переносной аутентификатор, например YubiKey</target>
-</trans-unit>
 <trans-unit id="sbd65aeeb8a3b9bbc">
   <source>Maximum registration attempts</source>
 </trans-unit>
@@ -6332,9 +6320,6 @@ doesn't pass when either or both of the selected options are equal or above the
   <source>Selected policies are executed when the stage is submitted to validate the data.</source>
   <target>Выбранные политики выполняются при отправке этапа для проверки данных.</target>
 </trans-unit>
-<trans-unit id="sc487e11d5987dbb4">
-  <source>Redirect the user to another flow, potentially with all gathered context</source>
-</trans-unit>
 <trans-unit id="sad9d5481474d4f5b">
   <source>Static</source>
 </trans-unit>
@@ -10731,15 +10716,6 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="sdcd1a9744efdbd7e">
   <source>Choose Policy Type</source>
 </trans-unit>
-<trans-unit id="sf4eb7c0c8e92e6b2">
-  <source>Whether the launch URL will open in a new browser tab or window from the user's application library.</source>
-</trans-unit>
-<trans-unit id="s8ab0176c9cf77b1a">
-  <source>Hide from User Dashboard</source>
-</trans-unit>
-<trans-unit id="s0b5847edb7150911">
-  <source>Whether this application will be shown on the User Dashboard.</source>
-</trans-unit>
 <trans-unit id="saa5ed8446baaba70">
   <source>Negate Result</source>
 </trans-unit>
@@ -10752,11 +10728,140 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="s41938ae69656ef53">
   <source>User Fields</source>
 </trans-unit>
-<trans-unit id="s977b2dff8b9def14">
-  <source>User Dashboard - Applications</source>
+<trans-unit id="s02b73793e5b4e1ba">
+  <source>This flag is deprecated.</source>
 </trans-unit>
-<trans-unit id="s190cbdd5b62e4746">
-  <source>User Dashboard</source>
+<trans-unit id="s8655c52824caac63">
+  <source>If checked, the launch URL will open in a new browser tab or window from the user's application library.</source>
+</trans-unit>
+<trans-unit id="s9eda7101f63a8652">
+  <source>Hide from My applications</source>
+</trans-unit>
+<trans-unit id="s30f30e9c42594a33">
+  <source>If checked, this application will not be shown on the user's My applications page.</source>
+</trans-unit>
+<trans-unit id="sc98037ccab57d329">
+  <source>No preference: the browser may offer any available authenticator</source>
+</trans-unit>
+<trans-unit id="s4611c85865abcba9">
+  <source>Platform: a non-removable authenticator built into the device, such as Touch ID, Face ID, or Windows Hello</source>
+</trans-unit>
+<trans-unit id="s0003d0e3fcdacabc">
+  <source>Cross-platform: a roaming authenticator, such as a YubiKey or Google Titan</source>
+</trans-unit>
+<trans-unit id="sc157c7dcb3d1b096">
+  <source>Controls the authenticatorAttachment parameter sent to the browser during WebAuthn registration. If Hints are configured and this is left as 'No preference', a value is inferred from the selected hints for backward compatibility with older browsers.</source>
+</trans-unit>
+<trans-unit id="s1baea1b8ac34d554">
+  <source>New Invitation</source>
+</trans-unit>
+<trans-unit id="s03eef6107e28d042">
+  <source>New Invitation options</source>
+</trans-unit>
+<trans-unit id="s0832ff81b9665e6f">
+  <source>Opens the new invitation wizard and binds the invitation to an existing enrollment flow.</source>
+</trans-unit>
+<trans-unit id="sc0819dc3d82d9320">
+  <source>with Existing Enrollment Flow...</source>
+</trans-unit>
+<trans-unit id="s79108cb25e7bf07b">
+  <source>Opens the new invitation wizard, which will create a new enrollment flow and invitation stage.</source>
+</trans-unit>
+<trans-unit id="sb7809157a3ccf613">
+  <source>with New Enrollment Flow and Invitation Stage...</source>
+</trans-unit>
+<trans-unit id="seb418067e7d6c6e2">
+  <source>Create a new invitation with an enrollment flow.</source>
+</trans-unit>
+<trans-unit id="sfd74a380e957d0d3">
+  <source>Enrollment Flow</source>
+</trans-unit>
+<trans-unit id="scc869d556216d748">
+  <source>Invitation Details</source>
+</trans-unit>
+<trans-unit id="se1fba44a9b284052">
+  <source>Invitation Link</source>
+</trans-unit>
+<trans-unit id="s967a2db7049dc90e">
+  <source><x id="0" equiv-text="${step}"/> failed</source>
+</trans-unit>
+<trans-unit id="s971d4cc0ecd106b7">
+  <source>Importing enrollment flow blueprint</source>
+</trans-unit>
+<trans-unit id="sf3b89a70e20af6c8">
+  <source>Blueprint validation failed</source>
+</trans-unit>
+<trans-unit id="sa04b7204708f4f74">
+  <source>Flow with slug "<x id="0" equiv-text="${slugToLookup}"/>" not found after import</source>
+</trans-unit>
+<trans-unit id="s3354be88ad29d171">
+  <source>Creating invitation</source>
+</trans-unit>
+<trans-unit id="s07f41353777196ea">
+  <source>The flow selected in the previous step. The invitation will be bound to this flow.</source>
+</trans-unit>
+<trans-unit id="s7209a11f97da9aff">
+  <source>No invitation available to send</source>
+</trans-unit>
+<trans-unit id="s2772d8285b905006">
+  <source>Failed to queue invitation emails</source>
+</trans-unit>
+<trans-unit id="s3b7910ab9c47a2e3">
+  <source>No enrollment flows with invitation stages found</source>
+</trans-unit>
+<trans-unit id="sa3ca03297e00591c">
+  <source>You can create a new enrollment flow and invitation stage right here, or cancel and bind an invitation stage to an existing flow manually.</source>
+</trans-unit>
+<trans-unit id="s06db43e56ca76be8">
+  <source>Create a new enrollment flow</source>
+</trans-unit>
+<trans-unit id="s8acc687c55e8ccbf">
+  <source>Only enrollment flows that have an invitation stage bound to them are listed here.</source>
+</trans-unit>
+<trans-unit id="s5b3bafd8ffe553ec">
+  <source>Flow name</source>
+</trans-unit>
+<trans-unit id="s699cd34b0dcb4c56">
+  <source>Name for the new enrollment flow.</source>
+</trans-unit>
+<trans-unit id="s8fb6d1bb698d32a0">
+  <source>Flow slug</source>
+</trans-unit>
+<trans-unit id="s0211c07612cf8c97">
+  <source>Invitation stage name</source>
+</trans-unit>
+<trans-unit id="s42b97ef63fb1a795">
+  <source>Name for the new invitation stage.</source>
+</trans-unit>
+<trans-unit id="saaa9fd0d3ebc35aa">
+  <source>Enrolled users are created as external (e.g. customers, guests). New users will be placed under users/external.</source>
+</trans-unit>
+<trans-unit id="s726dff63487da085">
+  <source>Enrolled users are created as internal (e.g. employees). New users will be placed under users/internal.</source>
+</trans-unit>
+<trans-unit id="sc1358130ac327120">
+  <source>If enabled, the stage will jump to the next stage when no invitation is given. If disabled, the flow will be cancelled without a valid invitation.</source>
+</trans-unit>
+<trans-unit id="s09fdd952c6eaf7da">
+  <source>No invitation was created.</source>
+</trans-unit>
+<trans-unit id="s00febd85a4889bb1">
+  <source>Redirect the user to a static URL or another flow, optionally with all gathered context.</source>
+</trans-unit>
+<trans-unit id="sdbc1d47f0f0ed54d">
+  <source>The element could not be loaded. This may be due to a missing import or a version mismatch.</source>
+</trans-unit>
+<trans-unit id="scf8a3d48f9969535">
+  <source>An element could not be loaded. Please try refreshing the page or clearing your cache.</source>
+</trans-unit>
+<trans-unit id="se2f00b2619675217">
+  <source>Failed to load element</source>
+</trans-unit>
+<trans-unit id="s1cf2298d92c327a6">
+  <source>My Applications</source>
+</trans-unit>
+<trans-unit id="s2656433a3b1f7e86">
+  <source>My applications</source>
 </trans-unit>
 </body>
 </file>

web/xliff/tr-TR.xlf

@@ -6010,18 +6010,6 @@ Belirlenen seçeneklerden biri veya her ikisi de eşiğe eşit veya eşiğin üz
   <source>Authenticator Attachment</source>
   <target>Kimlik Doğrulayıcı Eki</target>
 </trans-unit>
-<trans-unit id="s502d2473587032e1">
-  <source>No preference is sent</source>
-  <target>Tercih gönderilmez</target>
-</trans-unit>
-<trans-unit id="s60cc554fde2676cb">
-  <source>A non-removable authenticator, like TouchID or Windows Hello</source>
-  <target>TouchID veya Windows Hello gibi çıkarılamayan bir kimlik doğrulayıcı</target>
-</trans-unit>
-<trans-unit id="sdf1d8edef27236f0">
-  <source>A "roaming" authenticator, like a YubiKey</source>
-  <target>YubiKey gibi bir "dolaşımda" kimlik doğrulayıcı</target>
-</trans-unit>
 <trans-unit id="sbd65aeeb8a3b9bbc">
   <source>Maximum registration attempts</source>
 </trans-unit>
@@ -6332,9 +6320,6 @@ Belirlenen seçeneklerden biri veya her ikisi de eşiğe eşit veya eşiğin üz
   <source>Selected policies are executed when the stage is submitted to validate the data.</source>
   <target>Seçilen ilkeler, verileri doğrulamak için aşama gönderildiğinde yürütülür.</target>
 </trans-unit>
-<trans-unit id="sc487e11d5987dbb4">
-  <source>Redirect the user to another flow, potentially with all gathered context</source>
-</trans-unit>
 <trans-unit id="sad9d5481474d4f5b">
   <source>Static</source>
 </trans-unit>
@@ -10721,15 +10706,6 @@ Gruplara/kullanıcılara yapılan bağlamalar, etkinliğin kullanıcısına kar
 <trans-unit id="sdcd1a9744efdbd7e">
   <source>Choose Policy Type</source>
 </trans-unit>
-<trans-unit id="sf4eb7c0c8e92e6b2">
-  <source>Whether the launch URL will open in a new browser tab or window from the user's application library.</source>
-</trans-unit>
-<trans-unit id="s8ab0176c9cf77b1a">
-  <source>Hide from User Dashboard</source>
-</trans-unit>
-<trans-unit id="s0b5847edb7150911">
-  <source>Whether this application will be shown on the User Dashboard.</source>
-</trans-unit>
 <trans-unit id="saa5ed8446baaba70">
   <source>Negate Result</source>
 </trans-unit>
@@ -10742,11 +10718,140 @@ Gruplara/kullanıcılara yapılan bağlamalar, etkinliğin kullanıcısına kar
 <trans-unit id="s41938ae69656ef53">
   <source>User Fields</source>
 </trans-unit>
-<trans-unit id="s977b2dff8b9def14">
-  <source>User Dashboard - Applications</source>
+<trans-unit id="s02b73793e5b4e1ba">
+  <source>This flag is deprecated.</source>
 </trans-unit>
-<trans-unit id="s190cbdd5b62e4746">
-  <source>User Dashboard</source>
+<trans-unit id="s8655c52824caac63">
+  <source>If checked, the launch URL will open in a new browser tab or window from the user's application library.</source>
+</trans-unit>
+<trans-unit id="s9eda7101f63a8652">
+  <source>Hide from My applications</source>
+</trans-unit>
+<trans-unit id="s30f30e9c42594a33">
+  <source>If checked, this application will not be shown on the user's My applications page.</source>
+</trans-unit>
+<trans-unit id="sc98037ccab57d329">
+  <source>No preference: the browser may offer any available authenticator</source>
+</trans-unit>
+<trans-unit id="s4611c85865abcba9">
+  <source>Platform: a non-removable authenticator built into the device, such as Touch ID, Face ID, or Windows Hello</source>
+</trans-unit>
+<trans-unit id="s0003d0e3fcdacabc">
+  <source>Cross-platform: a roaming authenticator, such as a YubiKey or Google Titan</source>
+</trans-unit>
+<trans-unit id="sc157c7dcb3d1b096">
+  <source>Controls the authenticatorAttachment parameter sent to the browser during WebAuthn registration. If Hints are configured and this is left as 'No preference', a value is inferred from the selected hints for backward compatibility with older browsers.</source>
+</trans-unit>
+<trans-unit id="s1baea1b8ac34d554">
+  <source>New Invitation</source>
+</trans-unit>
+<trans-unit id="s03eef6107e28d042">
+  <source>New Invitation options</source>
+</trans-unit>
+<trans-unit id="s0832ff81b9665e6f">
+  <source>Opens the new invitation wizard and binds the invitation to an existing enrollment flow.</source>
+</trans-unit>
+<trans-unit id="sc0819dc3d82d9320">
+  <source>with Existing Enrollment Flow...</source>
+</trans-unit>
+<trans-unit id="s79108cb25e7bf07b">
+  <source>Opens the new invitation wizard, which will create a new enrollment flow and invitation stage.</source>
+</trans-unit>
+<trans-unit id="sb7809157a3ccf613">
+  <source>with New Enrollment Flow and Invitation Stage...</source>
+</trans-unit>
+<trans-unit id="seb418067e7d6c6e2">
+  <source>Create a new invitation with an enrollment flow.</source>
+</trans-unit>
+<trans-unit id="sfd74a380e957d0d3">
+  <source>Enrollment Flow</source>
+</trans-unit>
+<trans-unit id="scc869d556216d748">
+  <source>Invitation Details</source>
+</trans-unit>
+<trans-unit id="se1fba44a9b284052">
+  <source>Invitation Link</source>
+</trans-unit>
+<trans-unit id="s967a2db7049dc90e">
+  <source><x id="0" equiv-text="${step}"/> failed</source>
+</trans-unit>
+<trans-unit id="s971d4cc0ecd106b7">
+  <source>Importing enrollment flow blueprint</source>
+</trans-unit>
+<trans-unit id="sf3b89a70e20af6c8">
+  <source>Blueprint validation failed</source>
+</trans-unit>
+<trans-unit id="sa04b7204708f4f74">
+  <source>Flow with slug "<x id="0" equiv-text="${slugToLookup}"/>" not found after import</source>
+</trans-unit>
+<trans-unit id="s3354be88ad29d171">
+  <source>Creating invitation</source>
+</trans-unit>
+<trans-unit id="s07f41353777196ea">
+  <source>The flow selected in the previous step. The invitation will be bound to this flow.</source>
+</trans-unit>
+<trans-unit id="s7209a11f97da9aff">
+  <source>No invitation available to send</source>
+</trans-unit>
+<trans-unit id="s2772d8285b905006">
+  <source>Failed to queue invitation emails</source>
+</trans-unit>
+<trans-unit id="s3b7910ab9c47a2e3">
+  <source>No enrollment flows with invitation stages found</source>
+</trans-unit>
+<trans-unit id="sa3ca03297e00591c">
+  <source>You can create a new enrollment flow and invitation stage right here, or cancel and bind an invitation stage to an existing flow manually.</source>
+</trans-unit>
+<trans-unit id="s06db43e56ca76be8">
+  <source>Create a new enrollment flow</source>
+</trans-unit>
+<trans-unit id="s8acc687c55e8ccbf">
+  <source>Only enrollment flows that have an invitation stage bound to them are listed here.</source>
+</trans-unit>
+<trans-unit id="s5b3bafd8ffe553ec">
+  <source>Flow name</source>
+</trans-unit>
+<trans-unit id="s699cd34b0dcb4c56">
+  <source>Name for the new enrollment flow.</source>
+</trans-unit>
+<trans-unit id="s8fb6d1bb698d32a0">
+  <source>Flow slug</source>
+</trans-unit>
+<trans-unit id="s0211c07612cf8c97">
+  <source>Invitation stage name</source>
+</trans-unit>
+<trans-unit id="s42b97ef63fb1a795">
+  <source>Name for the new invitation stage.</source>
+</trans-unit>
+<trans-unit id="saaa9fd0d3ebc35aa">
+  <source>Enrolled users are created as external (e.g. customers, guests). New users will be placed under users/external.</source>
+</trans-unit>
+<trans-unit id="s726dff63487da085">
+  <source>Enrolled users are created as internal (e.g. employees). New users will be placed under users/internal.</source>
+</trans-unit>
+<trans-unit id="sc1358130ac327120">
+  <source>If enabled, the stage will jump to the next stage when no invitation is given. If disabled, the flow will be cancelled without a valid invitation.</source>
+</trans-unit>
+<trans-unit id="s09fdd952c6eaf7da">
+  <source>No invitation was created.</source>
+</trans-unit>
+<trans-unit id="s00febd85a4889bb1">
+  <source>Redirect the user to a static URL or another flow, optionally with all gathered context.</source>
+</trans-unit>
+<trans-unit id="sdbc1d47f0f0ed54d">
+  <source>The element could not be loaded. This may be due to a missing import or a version mismatch.</source>
+</trans-unit>
+<trans-unit id="scf8a3d48f9969535">
+  <source>An element could not be loaded. Please try refreshing the page or clearing your cache.</source>
+</trans-unit>
+<trans-unit id="se2f00b2619675217">
+  <source>Failed to load element</source>
+</trans-unit>
+<trans-unit id="s1cf2298d92c327a6">
+  <source>My Applications</source>
+</trans-unit>
+<trans-unit id="s2656433a3b1f7e86">
+  <source>My applications</source>
 </trans-unit>
 </body>
 </file>

web/xliff/zh-Hans.xlf

@@ -6459,18 +6459,6 @@ doesn't pass when either or both of the selected options are equal or above the
   <source>Authenticator Attachment</source>
   <target>身份验证器附件</target>
 </trans-unit>
-<trans-unit id="s502d2473587032e1">
-  <source>No preference is sent</source>
-  <target>不发送偏好</target>
-</trans-unit>
-<trans-unit id="s60cc554fde2676cb">
-  <source>A non-removable authenticator, like TouchID or Windows Hello</source>
-  <target>不可移除的身份验证器，例如 TouchID 或 Windows Hello</target>
-</trans-unit>
-<trans-unit id="sdf1d8edef27236f0">
-  <source>A "roaming" authenticator, like a YubiKey</source>
-  <target>像 YubiKey 这样的“漫游”身份验证器</target>
-</trans-unit>
 <trans-unit id="sbd65aeeb8a3b9bbc">
   <source>Maximum registration attempts</source>
   <target>最大注册尝试次数</target>
@@ -6807,10 +6795,6 @@ doesn't pass when either or both of the selected options are equal or above the
   <source>Selected policies are executed when the stage is submitted to validate the data.</source>
   <target>当阶段被提交以验证数据时，执行选定的策略。</target>
 </trans-unit>
-<trans-unit id="sc487e11d5987dbb4">
-  <source>Redirect the user to another flow, potentially with all gathered context</source>
-  <target>将用户重定向到另一个流程，可能包含所有已收集的上下文</target>
-</trans-unit>
 <trans-unit id="sad9d5481474d4f5b">
   <source>Static</source>
   <target>静态</target>
@@ -11520,15 +11504,6 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="sdcd1a9744efdbd7e">
   <source>Choose Policy Type</source>
 </trans-unit>
-<trans-unit id="sf4eb7c0c8e92e6b2">
-  <source>Whether the launch URL will open in a new browser tab or window from the user's application library.</source>
-</trans-unit>
-<trans-unit id="s8ab0176c9cf77b1a">
-  <source>Hide from User Dashboard</source>
-</trans-unit>
-<trans-unit id="s0b5847edb7150911">
-  <source>Whether this application will be shown on the User Dashboard.</source>
-</trans-unit>
 <trans-unit id="saa5ed8446baaba70">
   <source>Negate Result</source>
 </trans-unit>
@@ -11541,11 +11516,140 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="s41938ae69656ef53">
   <source>User Fields</source>
 </trans-unit>
-<trans-unit id="s977b2dff8b9def14">
-  <source>User Dashboard - Applications</source>
+<trans-unit id="s02b73793e5b4e1ba">
+  <source>This flag is deprecated.</source>
 </trans-unit>
-<trans-unit id="s190cbdd5b62e4746">
-  <source>User Dashboard</source>
+<trans-unit id="s8655c52824caac63">
+  <source>If checked, the launch URL will open in a new browser tab or window from the user's application library.</source>
+</trans-unit>
+<trans-unit id="s9eda7101f63a8652">
+  <source>Hide from My applications</source>
+</trans-unit>
+<trans-unit id="s30f30e9c42594a33">
+  <source>If checked, this application will not be shown on the user's My applications page.</source>
+</trans-unit>
+<trans-unit id="sc98037ccab57d329">
+  <source>No preference: the browser may offer any available authenticator</source>
+</trans-unit>
+<trans-unit id="s4611c85865abcba9">
+  <source>Platform: a non-removable authenticator built into the device, such as Touch ID, Face ID, or Windows Hello</source>
+</trans-unit>
+<trans-unit id="s0003d0e3fcdacabc">
+  <source>Cross-platform: a roaming authenticator, such as a YubiKey or Google Titan</source>
+</trans-unit>
+<trans-unit id="sc157c7dcb3d1b096">
+  <source>Controls the authenticatorAttachment parameter sent to the browser during WebAuthn registration. If Hints are configured and this is left as 'No preference', a value is inferred from the selected hints for backward compatibility with older browsers.</source>
+</trans-unit>
+<trans-unit id="s1baea1b8ac34d554">
+  <source>New Invitation</source>
+</trans-unit>
+<trans-unit id="s03eef6107e28d042">
+  <source>New Invitation options</source>
+</trans-unit>
+<trans-unit id="s0832ff81b9665e6f">
+  <source>Opens the new invitation wizard and binds the invitation to an existing enrollment flow.</source>
+</trans-unit>
+<trans-unit id="sc0819dc3d82d9320">
+  <source>with Existing Enrollment Flow...</source>
+</trans-unit>
+<trans-unit id="s79108cb25e7bf07b">
+  <source>Opens the new invitation wizard, which will create a new enrollment flow and invitation stage.</source>
+</trans-unit>
+<trans-unit id="sb7809157a3ccf613">
+  <source>with New Enrollment Flow and Invitation Stage...</source>
+</trans-unit>
+<trans-unit id="seb418067e7d6c6e2">
+  <source>Create a new invitation with an enrollment flow.</source>
+</trans-unit>
+<trans-unit id="sfd74a380e957d0d3">
+  <source>Enrollment Flow</source>
+</trans-unit>
+<trans-unit id="scc869d556216d748">
+  <source>Invitation Details</source>
+</trans-unit>
+<trans-unit id="se1fba44a9b284052">
+  <source>Invitation Link</source>
+</trans-unit>
+<trans-unit id="s967a2db7049dc90e">
+  <source><x id="0" equiv-text="${step}"/> failed</source>
+</trans-unit>
+<trans-unit id="s971d4cc0ecd106b7">
+  <source>Importing enrollment flow blueprint</source>
+</trans-unit>
+<trans-unit id="sf3b89a70e20af6c8">
+  <source>Blueprint validation failed</source>
+</trans-unit>
+<trans-unit id="sa04b7204708f4f74">
+  <source>Flow with slug "<x id="0" equiv-text="${slugToLookup}"/>" not found after import</source>
+</trans-unit>
+<trans-unit id="s3354be88ad29d171">
+  <source>Creating invitation</source>
+</trans-unit>
+<trans-unit id="s07f41353777196ea">
+  <source>The flow selected in the previous step. The invitation will be bound to this flow.</source>
+</trans-unit>
+<trans-unit id="s7209a11f97da9aff">
+  <source>No invitation available to send</source>
+</trans-unit>
+<trans-unit id="s2772d8285b905006">
+  <source>Failed to queue invitation emails</source>
+</trans-unit>
+<trans-unit id="s3b7910ab9c47a2e3">
+  <source>No enrollment flows with invitation stages found</source>
+</trans-unit>
+<trans-unit id="sa3ca03297e00591c">
+  <source>You can create a new enrollment flow and invitation stage right here, or cancel and bind an invitation stage to an existing flow manually.</source>
+</trans-unit>
+<trans-unit id="s06db43e56ca76be8">
+  <source>Create a new enrollment flow</source>
+</trans-unit>
+<trans-unit id="s8acc687c55e8ccbf">
+  <source>Only enrollment flows that have an invitation stage bound to them are listed here.</source>
+</trans-unit>
+<trans-unit id="s5b3bafd8ffe553ec">
+  <source>Flow name</source>
+</trans-unit>
+<trans-unit id="s699cd34b0dcb4c56">
+  <source>Name for the new enrollment flow.</source>
+</trans-unit>
+<trans-unit id="s8fb6d1bb698d32a0">
+  <source>Flow slug</source>
+</trans-unit>
+<trans-unit id="s0211c07612cf8c97">
+  <source>Invitation stage name</source>
+</trans-unit>
+<trans-unit id="s42b97ef63fb1a795">
+  <source>Name for the new invitation stage.</source>
+</trans-unit>
+<trans-unit id="saaa9fd0d3ebc35aa">
+  <source>Enrolled users are created as external (e.g. customers, guests). New users will be placed under users/external.</source>
+</trans-unit>
+<trans-unit id="s726dff63487da085">
+  <source>Enrolled users are created as internal (e.g. employees). New users will be placed under users/internal.</source>
+</trans-unit>
+<trans-unit id="sc1358130ac327120">
+  <source>If enabled, the stage will jump to the next stage when no invitation is given. If disabled, the flow will be cancelled without a valid invitation.</source>
+</trans-unit>
+<trans-unit id="s09fdd952c6eaf7da">
+  <source>No invitation was created.</source>
+</trans-unit>
+<trans-unit id="s00febd85a4889bb1">
+  <source>Redirect the user to a static URL or another flow, optionally with all gathered context.</source>
+</trans-unit>
+<trans-unit id="sdbc1d47f0f0ed54d">
+  <source>The element could not be loaded. This may be due to a missing import or a version mismatch.</source>
+</trans-unit>
+<trans-unit id="scf8a3d48f9969535">
+  <source>An element could not be loaded. Please try refreshing the page or clearing your cache.</source>
+</trans-unit>
+<trans-unit id="se2f00b2619675217">
+  <source>Failed to load element</source>
+</trans-unit>
+<trans-unit id="s1cf2298d92c327a6">
+  <source>My Applications</source>
+</trans-unit>
+<trans-unit id="s2656433a3b1f7e86">
+  <source>My applications</source>
 </trans-unit>
 </body>
 </file>

web/xliff/zh-Hant.xlf

@@ -5772,18 +5772,6 @@ doesn't pass when either or both of the selected options are equal or above the
   <source>Authenticator Attachment</source>
   <target>身分認證器外接裝置</target>
 </trans-unit>
-<trans-unit id="s502d2473587032e1">
-  <source>No preference is sent</source>
-  <target>不傳送建議選項</target>
-</trans-unit>
-<trans-unit id="s60cc554fde2676cb">
-  <source>A non-removable authenticator, like TouchID or Windows Hello</source>
-  <target>不可移除的身分認證器，例如 TouchID 或 Windows Hello</target>
-</trans-unit>
-<trans-unit id="sdf1d8edef27236f0">
-  <source>A "roaming" authenticator, like a YubiKey</source>
-  <target>外接式的身分認證器，例如 YubiKey</target>
-</trans-unit>
 <trans-unit id="sbd65aeeb8a3b9bbc">
   <source>Maximum registration attempts</source>
 </trans-unit>
@@ -6086,9 +6074,6 @@ doesn't pass when either or both of the selected options are equal or above the
   <source>Selected policies are executed when the stage is submitted to validate the data.</source>
   <target>當階段提交時，將執行所選政策以驗證資料。</target>
 </trans-unit>
-<trans-unit id="sc487e11d5987dbb4">
-  <source>Redirect the user to another flow, potentially with all gathered context</source>
-</trans-unit>
 <trans-unit id="sad9d5481474d4f5b">
   <source>Static</source>
 </trans-unit>
@@ -10358,15 +10343,6 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="sdcd1a9744efdbd7e">
   <source>Choose Policy Type</source>
 </trans-unit>
-<trans-unit id="sf4eb7c0c8e92e6b2">
-  <source>Whether the launch URL will open in a new browser tab or window from the user's application library.</source>
-</trans-unit>
-<trans-unit id="s8ab0176c9cf77b1a">
-  <source>Hide from User Dashboard</source>
-</trans-unit>
-<trans-unit id="s0b5847edb7150911">
-  <source>Whether this application will be shown on the User Dashboard.</source>
-</trans-unit>
 <trans-unit id="saa5ed8446baaba70">
   <source>Negate Result</source>
 </trans-unit>
@@ -10379,11 +10355,140 @@ Bindings to groups/users are checked against the user of the event.</source>
 <trans-unit id="s41938ae69656ef53">
   <source>User Fields</source>
 </trans-unit>
-<trans-unit id="s977b2dff8b9def14">
-  <source>User Dashboard - Applications</source>
+<trans-unit id="s02b73793e5b4e1ba">
+  <source>This flag is deprecated.</source>
 </trans-unit>
-<trans-unit id="s190cbdd5b62e4746">
-  <source>User Dashboard</source>
+<trans-unit id="s8655c52824caac63">
+  <source>If checked, the launch URL will open in a new browser tab or window from the user's application library.</source>
+</trans-unit>
+<trans-unit id="s9eda7101f63a8652">
+  <source>Hide from My applications</source>
+</trans-unit>
+<trans-unit id="s30f30e9c42594a33">
+  <source>If checked, this application will not be shown on the user's My applications page.</source>
+</trans-unit>
+<trans-unit id="sc98037ccab57d329">
+  <source>No preference: the browser may offer any available authenticator</source>
+</trans-unit>
+<trans-unit id="s4611c85865abcba9">
+  <source>Platform: a non-removable authenticator built into the device, such as Touch ID, Face ID, or Windows Hello</source>
+</trans-unit>
+<trans-unit id="s0003d0e3fcdacabc">
+  <source>Cross-platform: a roaming authenticator, such as a YubiKey or Google Titan</source>
+</trans-unit>
+<trans-unit id="sc157c7dcb3d1b096">
+  <source>Controls the authenticatorAttachment parameter sent to the browser during WebAuthn registration. If Hints are configured and this is left as 'No preference', a value is inferred from the selected hints for backward compatibility with older browsers.</source>
+</trans-unit>
+<trans-unit id="s1baea1b8ac34d554">
+  <source>New Invitation</source>
+</trans-unit>
+<trans-unit id="s03eef6107e28d042">
+  <source>New Invitation options</source>
+</trans-unit>
+<trans-unit id="s0832ff81b9665e6f">
+  <source>Opens the new invitation wizard and binds the invitation to an existing enrollment flow.</source>
+</trans-unit>
+<trans-unit id="sc0819dc3d82d9320">
+  <source>with Existing Enrollment Flow...</source>
+</trans-unit>
+<trans-unit id="s79108cb25e7bf07b">
+  <source>Opens the new invitation wizard, which will create a new enrollment flow and invitation stage.</source>
+</trans-unit>
+<trans-unit id="sb7809157a3ccf613">
+  <source>with New Enrollment Flow and Invitation Stage...</source>
+</trans-unit>
+<trans-unit id="seb418067e7d6c6e2">
+  <source>Create a new invitation with an enrollment flow.</source>
+</trans-unit>
+<trans-unit id="sfd74a380e957d0d3">
+  <source>Enrollment Flow</source>
+</trans-unit>
+<trans-unit id="scc869d556216d748">
+  <source>Invitation Details</source>
+</trans-unit>
+<trans-unit id="se1fba44a9b284052">
+  <source>Invitation Link</source>
+</trans-unit>
+<trans-unit id="s967a2db7049dc90e">
+  <source><x id="0" equiv-text="${step}"/> failed</source>
+</trans-unit>
+<trans-unit id="s971d4cc0ecd106b7">
+  <source>Importing enrollment flow blueprint</source>
+</trans-unit>
+<trans-unit id="sf3b89a70e20af6c8">
+  <source>Blueprint validation failed</source>
+</trans-unit>
+<trans-unit id="sa04b7204708f4f74">
+  <source>Flow with slug "<x id="0" equiv-text="${slugToLookup}"/>" not found after import</source>
+</trans-unit>
+<trans-unit id="s3354be88ad29d171">
+  <source>Creating invitation</source>
+</trans-unit>
+<trans-unit id="s07f41353777196ea">
+  <source>The flow selected in the previous step. The invitation will be bound to this flow.</source>
+</trans-unit>
+<trans-unit id="s7209a11f97da9aff">
+  <source>No invitation available to send</source>
+</trans-unit>
+<trans-unit id="s2772d8285b905006">
+  <source>Failed to queue invitation emails</source>
+</trans-unit>
+<trans-unit id="s3b7910ab9c47a2e3">
+  <source>No enrollment flows with invitation stages found</source>
+</trans-unit>
+<trans-unit id="sa3ca03297e00591c">
+  <source>You can create a new enrollment flow and invitation stage right here, or cancel and bind an invitation stage to an existing flow manually.</source>
+</trans-unit>
+<trans-unit id="s06db43e56ca76be8">
+  <source>Create a new enrollment flow</source>
+</trans-unit>
+<trans-unit id="s8acc687c55e8ccbf">
+  <source>Only enrollment flows that have an invitation stage bound to them are listed here.</source>
+</trans-unit>
+<trans-unit id="s5b3bafd8ffe553ec">
+  <source>Flow name</source>
+</trans-unit>
+<trans-unit id="s699cd34b0dcb4c56">
+  <source>Name for the new enrollment flow.</source>
+</trans-unit>
+<trans-unit id="s8fb6d1bb698d32a0">
+  <source>Flow slug</source>
+</trans-unit>
+<trans-unit id="s0211c07612cf8c97">
+  <source>Invitation stage name</source>
+</trans-unit>
+<trans-unit id="s42b97ef63fb1a795">
+  <source>Name for the new invitation stage.</source>
+</trans-unit>
+<trans-unit id="saaa9fd0d3ebc35aa">
+  <source>Enrolled users are created as external (e.g. customers, guests). New users will be placed under users/external.</source>
+</trans-unit>
+<trans-unit id="s726dff63487da085">
+  <source>Enrolled users are created as internal (e.g. employees). New users will be placed under users/internal.</source>
+</trans-unit>
+<trans-unit id="sc1358130ac327120">
+  <source>If enabled, the stage will jump to the next stage when no invitation is given. If disabled, the flow will be cancelled without a valid invitation.</source>
+</trans-unit>
+<trans-unit id="s09fdd952c6eaf7da">
+  <source>No invitation was created.</source>
+</trans-unit>
+<trans-unit id="s00febd85a4889bb1">
+  <source>Redirect the user to a static URL or another flow, optionally with all gathered context.</source>
+</trans-unit>
+<trans-unit id="sdbc1d47f0f0ed54d">
+  <source>The element could not be loaded. This may be due to a missing import or a version mismatch.</source>
+</trans-unit>
+<trans-unit id="scf8a3d48f9969535">
+  <source>An element could not be loaded. Please try refreshing the page or clearing your cache.</source>
+</trans-unit>
+<trans-unit id="se2f00b2619675217">
+  <source>Failed to load element</source>
+</trans-unit>
+<trans-unit id="s1cf2298d92c327a6">
+  <source>My Applications</source>
+</trans-unit>
+<trans-unit id="s2656433a3b1f7e86">
+  <source>My applications</source>
 </trans-unit>
 </body>
 </file>

website/api/package.json

@@ -51,12 +51,12 @@
         "@rspack/binding-darwin-arm64": "1.7.11",
         "@rspack/binding-linux-arm64-gnu": "1.7.11",
         "@rspack/binding-linux-x64-gnu": "1.7.11",
-        "@swc/core-darwin-arm64": "1.15.32",
-        "@swc/core-linux-arm64-gnu": "1.15.32",
-        "@swc/core-linux-x64-gnu": "1.15.32",
-        "@swc/html-darwin-arm64": "1.15.32",
-        "@swc/html-linux-arm64-gnu": "1.15.32",
-        "@swc/html-linux-x64-gnu": "1.15.32",
+        "@swc/core-darwin-arm64": "1.15.33",
+        "@swc/core-linux-arm64-gnu": "1.15.33",
+        "@swc/core-linux-x64-gnu": "1.15.33",
+        "@swc/html-darwin-arm64": "1.15.33",
+        "@swc/html-linux-arm64-gnu": "1.15.33",
+        "@swc/html-linux-x64-gnu": "1.15.33",
         "lightningcss-darwin-arm64": "1.32.0",
         "lightningcss-linux-arm64-gnu": "1.32.0",
         "lightningcss-linux-x64-gnu": "1.32.0"

website/package-lock.json

@@ -41,12 +41,12 @@
                 "@rspack/binding-darwin-arm64": "1.7.11",
                 "@rspack/binding-linux-arm64-gnu": "1.7.11",
                 "@rspack/binding-linux-x64-gnu": "1.7.11",
-                "@swc/core-darwin-arm64": "1.15.32",
-                "@swc/core-linux-arm64-gnu": "1.15.32",
-                "@swc/core-linux-x64-gnu": "1.15.32",
-                "@swc/html-darwin-arm64": "1.15.32",
-                "@swc/html-linux-arm64-gnu": "1.15.32",
-                "@swc/html-linux-x64-gnu": "1.15.32",
+                "@swc/core-darwin-arm64": "1.15.33",
+                "@swc/core-linux-arm64-gnu": "1.15.33",
+                "@swc/core-linux-x64-gnu": "1.15.33",
+                "@swc/html-darwin-arm64": "1.15.33",
+                "@swc/html-linux-arm64-gnu": "1.15.33",
+                "@swc/html-linux-x64-gnu": "1.15.33",
                 "lightningcss-darwin-arm64": "1.32.0",
                 "lightningcss-linux-arm64-gnu": "1.32.0",
                 "lightningcss-linux-x64-gnu": "1.32.0"
@@ -163,12 +163,12 @@
                 "@rspack/binding-darwin-arm64": "1.7.11",
                 "@rspack/binding-linux-arm64-gnu": "1.7.11",
                 "@rspack/binding-linux-x64-gnu": "1.7.11",
-                "@swc/core-darwin-arm64": "1.15.32",
-                "@swc/core-linux-arm64-gnu": "1.15.32",
-                "@swc/core-linux-x64-gnu": "1.15.32",
-                "@swc/html-darwin-arm64": "1.15.32",
-                "@swc/html-linux-arm64-gnu": "1.15.32",
-                "@swc/html-linux-x64-gnu": "1.15.32",
+                "@swc/core-darwin-arm64": "1.15.33",
+                "@swc/core-linux-arm64-gnu": "1.15.33",
+                "@swc/core-linux-x64-gnu": "1.15.33",
+                "@swc/html-darwin-arm64": "1.15.33",
+                "@swc/html-linux-arm64-gnu": "1.15.33",
+                "@swc/html-linux-x64-gnu": "1.15.33",
                 "lightningcss-darwin-arm64": "1.32.0",
                 "lightningcss-linux-arm64-gnu": "1.32.0",
                 "lightningcss-linux-x64-gnu": "1.32.0"
@@ -6849,9 +6849,9 @@
             }
         },
         "node_modules/@swc/core-darwin-arm64": {
-            "version": "1.15.32",
-            "resolved": "https://registry.npmjs.org/@swc/core-darwin-arm64/-/core-darwin-arm64-1.15.32.tgz",
-            "integrity": "sha512-/YWMvJDPu+AAwuUsM2G+DNQ/7zhodURGzdQyewEqcvgklAdDHs3LwQmLLnyn6SJl8DT8UOxkbzK+D1PmPeelRg==",
+            "version": "1.15.33",
+            "resolved": "https://registry.npmjs.org/@swc/core-darwin-arm64/-/core-darwin-arm64-1.15.33.tgz",
+            "integrity": "sha512-N+L0uXhuO7FIfzqwgxmzv0zIpV0qEp8wPX3QQs2p4atjMoywup2JTeDlXPw+z9pWJGCae3JjM+tZ6myclI+2gA==",
             "cpu": [
                 "arm64"
             ],
@@ -6897,9 +6897,9 @@
             }
         },
         "node_modules/@swc/core-linux-arm64-gnu": {
-            "version": "1.15.32",
-            "resolved": "https://registry.npmjs.org/@swc/core-linux-arm64-gnu/-/core-linux-arm64-gnu-1.15.32.tgz",
-            "integrity": "sha512-oDzEkdl6D6BAWdMtU5KGO7y3HR5fJcvByNLyEk9+ugj8nP5Ovb7P4kBcStBXc4MPExFGQryehiINMlmY8HlclA==",
+            "version": "1.15.33",
+            "resolved": "https://registry.npmjs.org/@swc/core-linux-arm64-gnu/-/core-linux-arm64-gnu-1.15.33.tgz",
+            "integrity": "sha512-TRJfnJbX3jqpxRDRoieMzRiCBS5jOmXNb3iQXmcgjFEHKLnAgK1RZRU8Cq1MsPqO4jAJp/ld1G4O3fXuxv85uw==",
             "cpu": [
                 "arm64"
             ],
@@ -6964,9 +6964,9 @@
             }
         },
         "node_modules/@swc/core-linux-x64-gnu": {
-            "version": "1.15.32",
-            "resolved": "https://registry.npmjs.org/@swc/core-linux-x64-gnu/-/core-linux-x64-gnu-1.15.32.tgz",
-            "integrity": "sha512-ERsjfGcj6CBmj3vJnGDO8m8rTvw6RqMcWo1dogOtNx3/+/0+NNpJiXDobJrr1GwInI/BHAEkvSFIH6d2LqPcUQ==",
+            "version": "1.15.33",
+            "resolved": "https://registry.npmjs.org/@swc/core-linux-x64-gnu/-/core-linux-x64-gnu-1.15.33.tgz",
+            "integrity": "sha512-mGTH0YxmUN+x6vRN/I6NOk5X0ogNktkwPnJ94IMvR7QjhRDwL0O8RXEDhyUM0YtwWrryBOqaJQBX4zruxEPRGw==",
             "cpu": [
                 "x64"
             ],
@@ -7127,9 +7127,9 @@
             }
         },
         "node_modules/@swc/html-darwin-arm64": {
-            "version": "1.15.32",
-            "resolved": "https://registry.npmjs.org/@swc/html-darwin-arm64/-/html-darwin-arm64-1.15.32.tgz",
-            "integrity": "sha512-WgY386nwyz24cTJ+Nztd4cKvfPJexLYAzurSYDmuYxS3HihWoTFZWMDomTfM8yr2UCi8SwW+zTNAWxJxUaKESg==",
+            "version": "1.15.33",
+            "resolved": "https://registry.npmjs.org/@swc/html-darwin-arm64/-/html-darwin-arm64-1.15.33.tgz",
+            "integrity": "sha512-zyO6uMBfLyCh55wundAxKX+8P/f98ecuyir4VX6nTmn6y7x37ndB8f01LUrd9Tiq6eEAvDXLiqEUvuGjEc7Pmg==",
             "cpu": [
                 "arm64"
             ],
@@ -7175,9 +7175,9 @@
             }
         },
         "node_modules/@swc/html-linux-arm64-gnu": {
-            "version": "1.15.32",
-            "resolved": "https://registry.npmjs.org/@swc/html-linux-arm64-gnu/-/html-linux-arm64-gnu-1.15.32.tgz",
-            "integrity": "sha512-gvlByySjNDWX2FUIGVBWOhd00rySz0AOydQpuXCK0ldYbFVMby9oXbp2JVmE5UsB6J4YZqZh4ajmmqCGvFHi4Q==",
+            "version": "1.15.33",
+            "resolved": "https://registry.npmjs.org/@swc/html-linux-arm64-gnu/-/html-linux-arm64-gnu-1.15.33.tgz",
+            "integrity": "sha512-7tZ0IgmUslI9Extu/TpxJS0GjJoDx0j9zeq2cIidPdM/njSBpyRB7n4B292Q5WFVh7PcZl7WXqqqMczibQ27aA==",
             "cpu": [
                 "arm64"
             ],
@@ -7242,9 +7242,9 @@
             }
         },
         "node_modules/@swc/html-linux-x64-gnu": {
-            "version": "1.15.32",
-            "resolved": "https://registry.npmjs.org/@swc/html-linux-x64-gnu/-/html-linux-x64-gnu-1.15.32.tgz",
-            "integrity": "sha512-IveuScZfAwDZEBs6pTvdG/MwGyMPuxp74l9ngp2PbUboVBIfUS894kATBaBuSBYXajZ4v4wqv01PGM81rUhGQg==",
+            "version": "1.15.33",
+            "resolved": "https://registry.npmjs.org/@swc/html-linux-x64-gnu/-/html-linux-x64-gnu-1.15.33.tgz",
+            "integrity": "sha512-JDNb4Uq+7g+23QuOtwWnP0/EqztWIHFFdQdeBIS5zx83YBG2dYRMdPAjnHJWh2YRZxdepd8q6S9MUIxpSrouAg==",
             "cpu": [
                 "x64"
             ],

website/package.json

@@ -39,12 +39,12 @@
         "@rspack/binding-darwin-arm64": "1.7.11",
         "@rspack/binding-linux-arm64-gnu": "1.7.11",
         "@rspack/binding-linux-x64-gnu": "1.7.11",
-        "@swc/core-darwin-arm64": "1.15.32",
-        "@swc/core-linux-arm64-gnu": "1.15.32",
-        "@swc/core-linux-x64-gnu": "1.15.32",
-        "@swc/html-darwin-arm64": "1.15.32",
-        "@swc/html-linux-arm64-gnu": "1.15.32",
-        "@swc/html-linux-x64-gnu": "1.15.32",
+        "@swc/core-darwin-arm64": "1.15.33",
+        "@swc/core-linux-arm64-gnu": "1.15.33",
+        "@swc/core-linux-x64-gnu": "1.15.33",
+        "@swc/html-darwin-arm64": "1.15.33",
+        "@swc/html-linux-arm64-gnu": "1.15.33",
+        "@swc/html-linux-x64-gnu": "1.15.33",
         "lightningcss-darwin-arm64": "1.32.0",
         "lightningcss-linux-arm64-gnu": "1.32.0",
         "lightningcss-linux-x64-gnu": "1.32.0"