@aurorajs.dev/catalyst-cli 1.0.1 → 1.1.3

package/dist/templates/frontend/application/src/app/aurora.types.ts

@@ -1,2671 +0,0 @@
-export type Maybe<T> = T | null;
-export type InputMaybe<T> = Maybe<T>;
-export type Exact<T extends { [key: string]: unknown }> = { [K in keyof T]: T[K] };
-export type MakeOptional<T, K extends keyof T> = Omit<T, K> & { [SubKey in K]?: Maybe<T[SubKey]> };
-export type MakeMaybe<T, K extends keyof T> = Omit<T, K> & { [SubKey in K]: Maybe<T[SubKey]> };
-export type MakeEmpty<T extends { [key: string]: unknown }, K extends keyof T> = { [_ in K]?: never };
-export type Incremental<T> = T | { [P in keyof T]?: P extends ' $fragmentName' | '__typename' ? T[P] : never };
-/** All built-in and custom scalars, mapped to their actual values */
-export type Scalars = {
-  ID: { input: string; output: string; }
-  String: { input: string; output: string; }
-  Boolean: { input: boolean; output: boolean; }
-  Int: { input: number; output: number; }
-  Float: { input: number; output: number; }
-  Any: { input: any; output: any; }
-  GraphQLBoolean: { input: boolean; output: boolean; }
-  GraphQLFloat: { input: number; output: number; }
-  GraphQLISODateTime: { input: string; output: string; }
-  GraphQLInt: { input: number; output: number; }
-  GraphQLString: { input: string; output: string; }
-  GraphQLTimestamp: { input: number; output: number; }
-  JSON: { input: any; output: any; }
-  Upload: { input: File; output: File; }
-};
-
-export type CoreLang = {
-  __typename?: 'CoreLang';
-  createdAt?: Maybe<Scalars['GraphQLString']['output']>;
-  customCode?: Maybe<Scalars['GraphQLString']['output']>;
-  deletedAt?: Maybe<Scalars['GraphQLString']['output']>;
-  dir: CoreLangDir;
-  id: Scalars['GraphQLString']['output'];
-  ietf: Scalars['GraphQLString']['output'];
-  image?: Maybe<Scalars['GraphQLString']['output']>;
-  isActive: Scalars['GraphQLBoolean']['output'];
-  iso6392: Scalars['GraphQLString']['output'];
-  iso6393: Scalars['GraphQLString']['output'];
-  name: Scalars['GraphQLString']['output'];
-  sort?: Maybe<Scalars['GraphQLInt']['output']>;
-  updatedAt?: Maybe<Scalars['GraphQLString']['output']>;
-};
-
-export enum CoreLangDir {
-  LTR = 'LTR',
-  RTL = 'RTL'
-}
-
-export enum CoreSearchKeyLang {
-  id = 'id',
-  ietf = 'ietf',
-  iso6392 = 'iso6392',
-  iso6393 = 'iso6393'
-}
-
-export type IamAccount = {
-  __typename?: 'IamAccount';
-  client?: Maybe<OAuthClient>;
-  /** Reference to the OAuth client application that this account belongs to. Each account must be associated with exactly one OAuth client for proper authentication and authorization scoping. The client determines available permissions and resources for the account. */
-  clientId: Scalars['ID']['output'];
-  /** Optional unique identifier code for the account, typically used for external system integrations or customer-facing account numbers. Must be unique across all accounts. Can be NULL for accounts that don't require external identification codes. */
-  code?: Maybe<Scalars['GraphQLString']['output']>;
-  /** Timestamp when the account was created. Automatically set on record insertion. Part of audit trail. */
-  createdAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** Denormalized array of application codes that this account has access to. Stored for query performance optimization to avoid joins. Should be kept in sync with the account's roles and permissions. Updated automatically when roles or permissions change. Required field - empty array indicates no application access. */
-  dApplicationCodes: Array<Maybe<Scalars['GraphQLString']['output']>>;
-  /** Denormalized JSON structure containing the flattened permission tree for this account. Combines permissions from all assigned roles for fast authorization checks. Structure: { "permission.key": true, "resource:action": true } Automatically recalculated when roles or role permissions change. Required field - empty object indicates no permissions granted. Uses JSONB for efficient querying and indexing in PostgreSQL. */
-  dPermissions: Scalars['JSON']['output'];
-  /** Denormalized array of tenant IDs that this account belongs to. Stored for query performance to quickly filter data by tenant access. Should match the many-to-many relationship in the tenants field. Updated automatically when tenant associations change. Required field - empty array indicates no tenant access. */
-  dTenants: Array<Maybe<Scalars['ID']['output']>>;
-  /** Soft delete timestamp. NULL indicates an active (non-deleted) account. When set, the account is excluded from normal queries but preserved for audit trail and potential recovery. Soft-deleted accounts cannot authenticate. This is different from isActive=false: deleted accounts are permanently removed from operations, while inactive accounts can be reactivated. */
-  deletedAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** Primary email address for the account. Used for authentication and notifications. Must be unique across all accounts. Can be NULL for service accounts that don't require email-based communication. Validated against RFC 5322 format. */
-  email?: Maybe<Scalars['GraphQLString']['output']>;
-  /** Unique identifier for the account. Used as primary key across the system. */
-  id: Scalars['ID']['output'];
-  /** Indicates whether the account is currently active and allowed to authenticate. Defaults to false (inactive) for security - accounts must be explicitly activated after creation, typically after email verification or admin approval. Inactive accounts cannot log in or access protected resources. This is separate from soft-delete (deletedAt) - inactive accounts can be reactivated. */
-  isActive: Scalars['GraphQLBoolean']['output'];
-  /** Optional JSON field for storing custom account metadata and properties. Use for application-specific data that doesn't warrant dedicated columns. Examples: UI preferences, feature flags, custom fields, integration metadata. NULL indicates no custom metadata. No schema validation - use carefully. */
-  meta?: Maybe<Scalars['JSON']['output']>;
-  /** Many-to-many relationship defining the roles assigned to this account. An account can have zero or more roles. Roles determine the permissions and access levels for the account. NULL or empty indicates no roles assigned (account has no permissions). When roles change, denormalizedPermissions and denormalizedApplicationCodes are automatically updated. */
-  roles?: Maybe<Array<Maybe<IamRole>>>;
-  /** Auto-incrementing sequential identifier for the account. Used for internal ordering and legacy system compatibility. Unlike the UUID 'id', this provides a human-readable sequential number. */
-  rowId: Scalars['GraphQLInt']['output'];
-  /** OAuth 2.0 scopes defining the access permissions for this account. Scopes limit what resources and operations the account can access. Each scope is a string up to 64 characters (e.g., "read:users", "write:posts"). NULL indicates default scope set. Used by OAuth authorization flows. */
-  scopes?: Maybe<Array<Maybe<Scalars['GraphQLString']['output']>>>;
-  /** Optional array of tags for categorizing and filtering accounts. Each tag is limited to 64 characters. Uses GIN index for efficient array search operations. Common uses: department tags, customer segments, feature flags, or custom organizational categories. NULL indicates no tags assigned. */
-  tags?: Maybe<Array<Maybe<Scalars['GraphQLString']['output']>>>;
-  /** Many-to-many relationship defining which tenants (organizations) this account belongs to. Enables multi-tenancy where one account can access multiple organizations. NULL or empty indicates no tenant associations. When tenants change, denormalizedTenantIds is automatically updated. Used for data isolation and access control in multi-tenant environments. */
-  tenants?: Maybe<Array<Maybe<IamTenant>>>;
-  /** Type of account determining authentication and authorization behavior. USER: Regular user account with login credentials, associated with a person. SERVICE: Service account for API integrations and automated systems, typically without login UI access. Service accounts may have different permission scopes. */
-  type: IamAccountTypeEnum;
-  /** Timestamp when the account was last updated. Automatically updated on any field modification. Part of audit trail. */
-  updatedAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** One-to-one relationship to the user profile containing personal information. For USER type accounts, this links to the associated user profile with name, surname, password, and other personal details. NULL for SERVICE type accounts which don't have user profiles. The user entity contains authentication credentials and personal data. */
-  user?: Maybe<IamUser>;
-  /** Unique username for account identification and login. Must be uniqueacross all accounts. Required for all account types. Typically followsnaming conventions: lowercase, alphanumeric with hyphens/underscores. */
-  username: Scalars['GraphQLString']['output'];
-};
-
-export enum IamAccountTypeEnum {
-  SERVICE = 'SERVICE',
-  USER = 'USER'
-}
-
-export type IamBoundedContext = {
-  __typename?: 'IamBoundedContext';
-  /** Timestamp when the bounded context was created. Automatically set on record creation. Used for audit trail and historical tracking. */
-  createdAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** Soft delete timestamp. NULL indicates active record. When set, the bounded context is excluded from normal queries but preserved for audit and recovery purposes. Cascade affects associated permissions. */
-  deletedAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** Unique identifier for the bounded context. UUID v4 format, generated automatically on creation. Used as primary key and for references. */
-  id: Scalars['ID']['output'];
-  /** Indicates if the bounded context is currently active and available. Inactive bounded contexts are hidden from UI and their permissions are not enforced. Use for temporary disabling without deletion. */
-  isActive: Scalars['GraphQLBoolean']['output'];
-  /** Human-readable name of the bounded context. Used for display purposes in UI and documentation. Should be unique and descriptive of the domain area it represents (e.g., 'Identity and Access Management', 'Library Management'). */
-  name: Scalars['GraphQLString']['output'];
-  /** Collection of permissions associated with this bounded context. Each permission defines access to specific operations within the bounded context's modules. Managed through the grid elements manager component. */
-  permissions?: Maybe<Array<Maybe<IamPermission>>>;
-  /** Root directory path where the bounded context code is located. Typically matches the module structure (e.g., 'iam', 'library', 'catalog'). Used by code generation tools and for file organization. Must match actual filesystem structure. */
-  root: Scalars['GraphQLString']['output'];
-  /** Auto-incremented sequential identifier for internal database indexing. Used for ordered retrieval and performance optimization. Unique across all bounded contexts. */
-  rowId: Scalars['GraphQLInt']['output'];
-  /** Display order for UI lists and navigation menus. Lower numbers appear first. NULL values are sorted last. Allows manual organization of bounded contexts in administrative interfaces. */
-  sort?: Maybe<Scalars['GraphQLInt']['output']>;
-  /** Timestamp when the bounded context was last updated. Automatically updated on any modification. Used for audit trail and change tracking. */
-  updatedAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-};
-
-export type IamCreateAccountInput = {
-  clientId: Scalars['ID']['input'];
-  code?: InputMaybe<Scalars['GraphQLString']['input']>;
-  dApplicationCodes: Array<InputMaybe<Scalars['GraphQLString']['input']>>;
-  dPermissions: Scalars['JSON']['input'];
-  dTenants: Array<InputMaybe<Scalars['ID']['input']>>;
-  email?: InputMaybe<Scalars['GraphQLString']['input']>;
-  hasAddChildTenants?: InputMaybe<Scalars['GraphQLBoolean']['input']>;
-  id: Scalars['ID']['input'];
-  isActive: Scalars['GraphQLBoolean']['input'];
-  meta?: InputMaybe<Scalars['JSON']['input']>;
-  roleIds?: InputMaybe<Array<InputMaybe<Scalars['ID']['input']>>>;
-  scopes?: InputMaybe<Array<InputMaybe<Scalars['GraphQLString']['input']>>>;
-  tags?: InputMaybe<Array<InputMaybe<Scalars['GraphQLString']['input']>>>;
-  tenantIds?: InputMaybe<Array<InputMaybe<Scalars['ID']['input']>>>;
-  type: IamAccountTypeEnum;
-  user?: InputMaybe<IamCreateUserInput>;
-  username: Scalars['GraphQLString']['input'];
-};
-
-export type IamCreateBoundedContextInput = {
-  id: Scalars['ID']['input'];
-  isActive: Scalars['GraphQLBoolean']['input'];
-  name: Scalars['GraphQLString']['input'];
-  root: Scalars['GraphQLString']['input'];
-  sort?: InputMaybe<Scalars['GraphQLInt']['input']>;
-};
-
-export type IamCreatePermissionInput = {
-  boundedContextId: Scalars['ID']['input'];
-  id: Scalars['ID']['input'];
-  name: Scalars['GraphQLString']['input'];
-  roleIds?: InputMaybe<Array<InputMaybe<Scalars['ID']['input']>>>;
-};
-
-export type IamCreatePermissionRoleInput = {
-  permissionId: Scalars['ID']['input'];
-  roleId: Scalars['ID']['input'];
-};
-
-export type IamCreateRoleAccountInput = {
-  accountId: Scalars['ID']['input'];
-  roleId: Scalars['ID']['input'];
-};
-
-export type IamCreateRoleInput = {
-  accountIds?: InputMaybe<Array<InputMaybe<Scalars['ID']['input']>>>;
-  code?: InputMaybe<Scalars['GraphQLString']['input']>;
-  defaultRedirection?: InputMaybe<Scalars['GraphQLString']['input']>;
-  hasHiddenVerticalNavigation?: InputMaybe<Scalars['GraphQLBoolean']['input']>;
-  id: Scalars['ID']['input'];
-  isMaster: Scalars['GraphQLBoolean']['input'];
-  name: Scalars['GraphQLString']['input'];
-  permissionIds?: InputMaybe<Array<InputMaybe<Scalars['ID']['input']>>>;
-};
-
-export type IamCreateTagInput = {
-  id: Scalars['ID']['input'];
-  name: Scalars['GraphQLString']['input'];
-};
-
-export type IamCreateTenantAccountInput = {
-  accountId: Scalars['ID']['input'];
-  tenantId: Scalars['ID']['input'];
-};
-
-export type IamCreateTenantInput = {
-  accountIds?: InputMaybe<Array<InputMaybe<Scalars['ID']['input']>>>;
-  code?: InputMaybe<Scalars['GraphQLString']['input']>;
-  id: Scalars['ID']['input'];
-  isActive: Scalars['GraphQLBoolean']['input'];
-  logo?: InputMaybe<Scalars['JSON']['input']>;
-  meta?: InputMaybe<Scalars['JSON']['input']>;
-  name: Scalars['GraphQLString']['input'];
-  parentId?: InputMaybe<Scalars['ID']['input']>;
-};
-
-export type IamCreateUserInput = {
-  accountId: Scalars['ID']['input'];
-  avatar?: InputMaybe<Scalars['GraphQLString']['input']>;
-  id: Scalars['ID']['input'];
-  isTwoFactorAuthenticationEnabled: Scalars['GraphQLBoolean']['input'];
-  langId?: InputMaybe<Scalars['ID']['input']>;
-  meta?: InputMaybe<Scalars['JSON']['input']>;
-  mobile?: InputMaybe<Scalars['GraphQLString']['input']>;
-  name: Scalars['GraphQLString']['input'];
-  password: Scalars['GraphQLString']['input'];
-  rememberToken?: InputMaybe<Scalars['GraphQLString']['input']>;
-  surname?: InputMaybe<Scalars['GraphQLString']['input']>;
-  twoFactorAuthenticationSecret?: InputMaybe<Scalars['GraphQLString']['input']>;
-};
-
-export type IamPermission = {
-  __typename?: 'IamPermission';
-  /** Bounded context object relationship to permission */
-  boundedContext?: Maybe<IamBoundedContext>;
-  /** Foreign key reference to the bounded context this permission belongs to. Each permission is scoped to a specific bounded context, grouping all permissions related to a particular business domain. Used to organize permissions by functional areas of the application. */
-  boundedContextId: Scalars['ID']['output'];
-  /** Timestamp when the permission was created. Automatically set on record creation. Part of the audit trail for tracking permission lifecycle. */
-  createdAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** Soft delete timestamp. NULL indicates an active permission. When set, the permission is hidden from normal queries but preserved for audit purposes. Permissions with deletedAt set cannot be assigned to new roles. */
-  deletedAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** Unique identifier for the permission. UUID v4 format, generated automatically on creation. Used as primary key for referencing this permission across the system. */
-  id: Scalars['ID']['output'];
-  /** Unique permission name used to evaluate authorization. Format follows convention: [BoundedContext].[Action][Resource] (e.g., 'Iam.CreateUser'). Used by the authorization system to check if a user can access specific resources or perform certain actions. */
-  name: Scalars['GraphQLString']['output'];
-  /** Many-to-many relationship with roles. Represents all roles that have been granted this permission. Used to determine which roles can perform the actions covered by this permission. */
-  roles?: Maybe<Array<Maybe<IamRole>>>;
-  /** Unique sequential identifier for internal database operations. Auto-incremented integer used for ordering and optimized queries. Not exposed in the API. */
-  rowId: Scalars['GraphQLInt']['output'];
-  /** Timestamp of the last modification to this permission. Automatically updated on any change. Used for tracking permission evolution and cache invalidation. */
-  updatedAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-};
-
-export type IamPermissionRole = {
-  __typename?: 'IamPermissionRole';
-  permission?: Maybe<IamPermission>;
-  permissionId: Scalars['ID']['output'];
-  role?: Maybe<IamRole>;
-  roleId: Scalars['ID']['output'];
-};
-
-export type IamRole = {
-  __typename?: 'IamRole';
-  /** Many-to-many relationship with accounts that have been assigned this role. An account can have multiple roles, and a role can be assigned to multiple accounts. This enables flexible RBAC where users inherit permissions from all their assigned roles. Managed through the iam_roles_accounts pivot table. When this relationship changes, the affected accounts' denormalized permission structures (denormalizedPermissions, denormalizedApplicationCodes) are automatically recalculated for fast authorization. NULL or empty indicates a role not yet assigned to any accounts. */
-  accounts?: Maybe<Array<Maybe<IamAccount>>>;
-  /** Optional unique identifier code for the role, typically used for short references, URL slugs, or integration identifiers. Must be unique across all roles when provided. Common formats: uppercase acronyms (e.g., "ADMIN"), lowercase slugs (e.g., "content-editor"), or external system IDs. NULL indicates no code assigned. Useful for API integrations, subdomain generation, or customer-facing role identification without exposing UUIDs. Maximum 64 characters for flexibility with various coding schemes. */
-  code?: Maybe<Scalars['GraphQLString']['output']>;
-  /** Timestamp when the role was created. Automatically set on record creation. Part of the audit trail for tracking role lifecycle and compliance requirements. Used for reporting on role creation patterns and security audits. */
-  createdAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** Default landing page URL after successful authentication. Users with this role will be redirected to this path after login. Must be a valid relative or absolute URL (max 2046 characters per RFC 3986 recommendations). NULL indicates system default redirection will be used. Used to create role-specific workflows and user experiences. Example values: /dashboard, /reports/overview, https://external-app.com/portal. */
-  defaultRedirection?: Maybe<Scalars['GraphQLString']['output']>;
-  /** Soft delete timestamp. NULL indicates an active role. When set, the role is hidden from normal queries but preserved for audit purposes and historical data integrity. Deleted roles cannot be assigned to new accounts, but existing assignments remain in the database for audit trails. Master roles (isMaster=true) are protected and cannot be deleted. Used for compliance with data retention policies while maintaining referential integrity. */
-  deletedAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** Controls visibility of the vertical navigation menu in the UI for users with this role. When true, the left sidebar navigation is hidden, creating a simplified interface. Useful for restricted roles that should only access specific pages via direct links or custom dashboards (e.g., kiosk mode, limited-access users). Defaults to false (navigation visible). NULL treated as false. */
-  hasHiddenVerticalNavigation?: Maybe<Scalars['GraphQLBoolean']['output']>;
-  /** Unique identifier for the role. UUID v4 format, generated automatically on creation. Used as primary key for referencing this role across the system. */
-  id: Scalars['ID']['output'];
-  /** Indicates if the role is created by default and cannot be deleted. Master roles are system-defined, typically created during application bootstrap (e.g., "SuperAdmin", "SystemAdmin"). They are protected from deletion to ensure system integrity and prevent lockout scenarios. Custom roles have isMaster=false and can be deleted if not in use. Required field, defaults to false. */
-  isMaster: Scalars['GraphQLBoolean']['output'];
-  /** Human-readable name for the role (e.g., "Administrator", "Content Editor"). Must be unique across all roles. Used in UI displays and audit logs. Should clearly indicate the role's purpose and permissions scope. Cannot be empty and must be meaningful for access control documentation. */
-  name: Scalars['GraphQLString']['output'];
-  /** Many-to-many relationship defining the permissions granted to this role. Each role can have zero or more permissions representing specific capabilities (e.g., "Iam.CreateUser", "Sales.ViewReports"). Users assigned this role inherit all associated permissions for authorization checks. Managed through the iam_permissions_roles pivot table. Changes to role permissions automatically trigger updates to denormalized permission data in all associated accounts. NULL or empty indicates a role with no permissions (no access granted). */
-  permissions?: Maybe<Array<Maybe<IamPermission>>>;
-  /** Auto-incrementing sequential identifier for the role. Used for internal ordering and optimized queries. Unlike the UUID 'id', this provides a human-readable sequential number for database operations. */
-  rowId: Scalars['GraphQLInt']['output'];
-  /** Timestamp of the last modification to this role. Automatically updated on any field change. Used for tracking role evolution, cache invalidation, and audit compliance. Particularly important for security audits to track when role permissions or settings were modified. Critical for compliance with access control change tracking requirements. */
-  updatedAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-};
-
-export type IamRoleAccount = {
-  __typename?: 'IamRoleAccount';
-  account?: Maybe<IamAccount>;
-  /** Reference to the account in this account-role association */
-  accountId: Scalars['ID']['output'];
-  role?: Maybe<IamRole>;
-  /** Reference to the role in this account-role association */
-  roleId: Scalars['ID']['output'];
-};
-
-export type IamTag = {
-  __typename?: 'IamTag';
-  /** Timestamp when the tag was created. Automatically set on record insertion. Part of the audit trail for tracking tag lifecycle and usage patterns. Used for reporting on tag creation and organizational metadata evolution. */
-  createdAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** Soft delete timestamp. NULL indicates an active tag. When set, the tag is excluded from normal queries but preserved for audit trail and historical data integrity. Soft-deleted tags remain referenced in account.tags arrays until those accounts are updated. Used for maintaining data consistency while allowing tag cleanup. Tags can be recovered by setting this to NULL. */
-  deletedAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** Unique identifier for the tag. UUID v4 format, generated automatically on creation. Used as primary key and for referencing this tag across the system. */
-  id: Scalars['ID']['output'];
-  /** The tag name or label (e.g., "VIP", "Beta-Tester", "EMEA-Region", "Finance-Department"). Limited to 64 characters for consistency with account.tags array elements. Should be descriptive and follow organizational naming conventions. Case-sensitive for precise matching. Recommended format: PascalCase or kebab-case for multi-word tags. Cannot be empty. Enforced as unique at database level to prevent duplicate tags and ensure consistent referencing across accounts. */
-  name: Scalars['GraphQLString']['output'];
-  /** Auto-incrementing sequential identifier for the tag. Used for internal ordering, efficient queries, and legacy system compatibility. Unlike the UUID "id", this provides a human-readable sequential number that maintains insertion order. Useful for pagination and sorting operations. */
-  rowId: Scalars['GraphQLInt']['output'];
-  /** Timestamp of the last modification to this tag. Automatically updated on any field change (typically name changes). Used for tracking tag evolution and cache invalidation. Helps identify recently modified tags for synchronization and audit purposes. */
-  updatedAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-};
-
-export type IamTenant = {
-  __typename?: 'IamTenant';
-  /** Many-to-many relationship defining which accounts (users/services) belong to this tenant. An account can be associated with multiple tenants, enabling cross-organizational access (e.g., consultants working with multiple clients, shared service accounts). A tenant typically has many accounts representing its users and service integrations. When accounts are added/removed from a tenant, the denormalizedTenantIds array in the account entity is automatically updated for query performance optimization. NULL or empty indicates a tenant with no assigned users (new or archived tenant). Critical for multi-tenancy data isolation and access control enforcement. */
-  accounts?: Maybe<Array<Maybe<IamAccount>>>;
-  /** Optional unique identifier code for the tenant, typically used for short references, URL slugs, or integration identifiers. Must be unique across all tenants when provided. Common formats: uppercase acronyms (e.g., "ACME"), lowercase slugs (e.g., "acme-corp"), or external system IDs. NULL indicates no code assigned. Useful for API integrations, subdomain generation, or customer-facing tenant identification without exposing UUIDs. Maximum 64 characters for flexibility with various coding schemes. */
-  code?: Maybe<Scalars['GraphQLString']['output']>;
-  /** Timestamp when the tenant was created. Automatically set on record creation. Part of the audit trail for tracking organizational onboarding and lifecycle. Used for tenant age calculations, subscription start dates, and compliance reporting. */
-  createdAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** Soft delete timestamp. NULL indicates an active tenant. When set, the tenant is hidden from normal queries but preserved for audit purposes, historical data integrity, and potential recovery. Deleted tenants cannot authenticate or be selected in tenant context switches, but their data remains accessible for administrative review and compliance audits. Accounts associated with deleted tenants retain the relationship for historical tracking. Used for compliance with data retention policies while maintaining multi-tenancy referential integrity. Consider data archival before deletion. */
-  deletedAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** Unique identifier for the tenant. UUID v4 format, generated automatically on creation. Used as primary key for referencing this tenant across the system and in all tenant-scoped data queries. Critical for data isolation and multi-tenancy enforcement. */
-  id: Scalars['ID']['output'];
-  /** Indicates whether the tenant is currently active and allowed to access the system. Defaults to false (inactive) for controlled onboarding - tenants must be explicitly activated after setup, typically after subscription verification or configuration completion. Inactive tenants cannot authenticate or access any resources, effectively suspending the entire organization's access. Used for subscription management, payment enforcement, or temporary suspension scenarios. This is separate from soft-delete (deletedAt) - inactive tenants can be reactivated without data restoration. */
-  isActive: Scalars['GraphQLBoolean']['output'];
-  /** Optional JSON structure storing tenant branding logo information. Typically contains image metadata such as file paths, URLs, dimensions, or base64 data. Example structure: { "url": "/assets/logos/tenant-123.png", "width": 200, "height": 60 }. Used for white-labeling and customizing the UI per tenant. NULL indicates default system logo should be used. JSONB format allows flexible storage of various image metadata formats while supporting efficient querying in PostgreSQL. */
-  logo?: Maybe<Scalars['JSON']['output']>;
-  /** Optional JSON field for storing custom tenant metadata and configuration properties. Use for tenant-specific settings that don't warrant dedicated columns. Examples: subscription tier, feature flags, billing information, contact details, time zone preferences, localization settings, custom branding colors, or integration configuration. NULL indicates no custom metadata. No schema validation enforced - use carefully with application-level validation. JSONB format enables efficient querying and indexing of specific metadata keys in PostgreSQL. */
-  meta?: Maybe<Scalars['JSON']['output']>;
-  /** Display name of the tenant organization (e.g., "Acme Corporation", "Sales Department"). Required field used throughout the UI for identifying the tenant context. Should be meaningful and recognizable to users. Used in tenant selection interfaces, headers, and audit logs. Maximum 128 characters to accommodate full legal names or descriptive departmental identifiers. */
-  name: Scalars['GraphQLString']['output'];
-  parent?: Maybe<IamTenant>;
-  /** Self-referential relationship to parent tenant, enabling hierarchical organizational structures. NULL indicates a root-level tenant with no parent. Non-null values create parent-child relationships for modeling company divisions, subsidiary organizations, or departmental hierarchies. Constraint avoided to prevent circular dependency issues during tenant creation and reorganization. Used for permission inheritance patterns and aggregated reporting across organizational hierarchies. */
-  parentId?: Maybe<Scalars['ID']['output']>;
-  /** Auto-incrementing sequential identifier for the tenant. Used for internal ordering, reporting, and legacy system compatibility. Unlike the UUID 'id', this provides a human-readable sequential number useful for tenant numbering schemes and administrative reference. */
-  rowId: Scalars['GraphQLInt']['output'];
-  /** Timestamp of the last modification to this tenant. Automatically updated on any field change (name, code, logo, isActive, meta, or relationship changes). Used for tracking tenant evolution, cache invalidation, and audit compliance. Important for monitoring organizational changes and maintaining synchronization with external systems. Critical for compliance with organizational change tracking. */
-  updatedAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-};
-
-export type IamTenantAccount = {
-  __typename?: 'IamTenantAccount';
-  account?: Maybe<IamAccount>;
-  /** Reference to the account in this account-tenant association */
-  accountId: Scalars['ID']['output'];
-  tenant?: Maybe<IamTenant>;
-  /** Reference to the tenant in this account-tenant association */
-  tenantId: Scalars['ID']['output'];
-};
-
-export type IamUpdateAccountByIdInput = {
-  clientId?: InputMaybe<Scalars['ID']['input']>;
-  code?: InputMaybe<Scalars['GraphQLString']['input']>;
-  dApplicationCodes?: InputMaybe<Array<InputMaybe<Scalars['GraphQLString']['input']>>>;
-  dPermissions?: InputMaybe<Scalars['JSON']['input']>;
-  dTenants?: InputMaybe<Array<InputMaybe<Scalars['ID']['input']>>>;
-  email?: InputMaybe<Scalars['GraphQLString']['input']>;
-  hasAddChildTenants?: InputMaybe<Scalars['GraphQLBoolean']['input']>;
-  id: Scalars['ID']['input'];
-  isActive?: InputMaybe<Scalars['GraphQLBoolean']['input']>;
-  meta?: InputMaybe<Scalars['JSON']['input']>;
-  roleIds?: InputMaybe<Array<InputMaybe<Scalars['ID']['input']>>>;
-  scopes?: InputMaybe<Array<InputMaybe<Scalars['GraphQLString']['input']>>>;
-  tags?: InputMaybe<Array<InputMaybe<Scalars['GraphQLString']['input']>>>;
-  tenantIds?: InputMaybe<Array<InputMaybe<Scalars['ID']['input']>>>;
-  type?: InputMaybe<IamAccountTypeEnum>;
-  user?: InputMaybe<IamUpdateUserByIdInput>;
-  username?: InputMaybe<Scalars['GraphQLString']['input']>;
-};
-
-export type IamUpdateAccountsInput = {
-  clientId?: InputMaybe<Scalars['ID']['input']>;
-  code?: InputMaybe<Scalars['GraphQLString']['input']>;
-  dApplicationCodes?: InputMaybe<Array<InputMaybe<Scalars['GraphQLString']['input']>>>;
-  dPermissions?: InputMaybe<Scalars['JSON']['input']>;
-  dTenants?: InputMaybe<Array<InputMaybe<Scalars['ID']['input']>>>;
-  email?: InputMaybe<Scalars['GraphQLString']['input']>;
-  id?: InputMaybe<Scalars['ID']['input']>;
-  isActive?: InputMaybe<Scalars['GraphQLBoolean']['input']>;
-  meta?: InputMaybe<Scalars['JSON']['input']>;
-  roleIds?: InputMaybe<Array<InputMaybe<Scalars['ID']['input']>>>;
-  scopes?: InputMaybe<Array<InputMaybe<Scalars['GraphQLString']['input']>>>;
-  tags?: InputMaybe<Array<InputMaybe<Scalars['GraphQLString']['input']>>>;
-  tenantIds?: InputMaybe<Array<InputMaybe<Scalars['ID']['input']>>>;
-  type?: InputMaybe<IamAccountTypeEnum>;
-  user?: InputMaybe<IamUpdateUsersInput>;
-  username?: InputMaybe<Scalars['GraphQLString']['input']>;
-};
-
-export type IamUpdateBoundedContextByIdInput = {
-  id: Scalars['ID']['input'];
-  isActive?: InputMaybe<Scalars['GraphQLBoolean']['input']>;
-  name?: InputMaybe<Scalars['GraphQLString']['input']>;
-  root?: InputMaybe<Scalars['GraphQLString']['input']>;
-  sort?: InputMaybe<Scalars['GraphQLInt']['input']>;
-};
-
-export type IamUpdateBoundedContextsInput = {
-  id?: InputMaybe<Scalars['ID']['input']>;
-  isActive?: InputMaybe<Scalars['GraphQLBoolean']['input']>;
-  name?: InputMaybe<Scalars['GraphQLString']['input']>;
-  root?: InputMaybe<Scalars['GraphQLString']['input']>;
-  sort?: InputMaybe<Scalars['GraphQLInt']['input']>;
-};
-
-export type IamUpdatePermissionByIdInput = {
-  boundedContextId?: InputMaybe<Scalars['ID']['input']>;
-  id: Scalars['ID']['input'];
-  name?: InputMaybe<Scalars['GraphQLString']['input']>;
-  roleIds?: InputMaybe<Array<InputMaybe<Scalars['ID']['input']>>>;
-};
-
-export type IamUpdatePermissionRoleByIdInput = {
-  permissionId: Scalars['ID']['input'];
-  roleId: Scalars['ID']['input'];
-};
-
-export type IamUpdatePermissionsInput = {
-  boundedContextId?: InputMaybe<Scalars['ID']['input']>;
-  id?: InputMaybe<Scalars['ID']['input']>;
-  name?: InputMaybe<Scalars['GraphQLString']['input']>;
-  roleIds?: InputMaybe<Array<InputMaybe<Scalars['ID']['input']>>>;
-};
-
-export type IamUpdatePermissionsRolesInput = {
-  permissionId?: InputMaybe<Scalars['ID']['input']>;
-  roleId?: InputMaybe<Scalars['ID']['input']>;
-};
-
-export type IamUpdateRoleAccountByIdInput = {
-  accountId: Scalars['ID']['input'];
-  roleId: Scalars['ID']['input'];
-};
-
-export type IamUpdateRoleByIdInput = {
-  accountIds?: InputMaybe<Array<InputMaybe<Scalars['ID']['input']>>>;
-  code?: InputMaybe<Scalars['GraphQLString']['input']>;
-  defaultRedirection?: InputMaybe<Scalars['GraphQLString']['input']>;
-  hasHiddenVerticalNavigation?: InputMaybe<Scalars['GraphQLBoolean']['input']>;
-  id: Scalars['ID']['input'];
-  isMaster?: InputMaybe<Scalars['GraphQLBoolean']['input']>;
-  name?: InputMaybe<Scalars['GraphQLString']['input']>;
-  permissionIds?: InputMaybe<Array<InputMaybe<Scalars['ID']['input']>>>;
-};
-
-export type IamUpdateRolesAccountsInput = {
-  accountId?: InputMaybe<Scalars['ID']['input']>;
-  roleId?: InputMaybe<Scalars['ID']['input']>;
-};
-
-export type IamUpdateRolesInput = {
-  accountIds?: InputMaybe<Array<InputMaybe<Scalars['ID']['input']>>>;
-  code?: InputMaybe<Scalars['GraphQLString']['input']>;
-  defaultRedirection?: InputMaybe<Scalars['GraphQLString']['input']>;
-  hasHiddenVerticalNavigation?: InputMaybe<Scalars['GraphQLBoolean']['input']>;
-  id?: InputMaybe<Scalars['ID']['input']>;
-  isMaster?: InputMaybe<Scalars['GraphQLBoolean']['input']>;
-  name?: InputMaybe<Scalars['GraphQLString']['input']>;
-  permissionIds?: InputMaybe<Array<InputMaybe<Scalars['ID']['input']>>>;
-};
-
-export type IamUpdateTagByIdInput = {
-  id: Scalars['ID']['input'];
-  name?: InputMaybe<Scalars['GraphQLString']['input']>;
-};
-
-export type IamUpdateTagsInput = {
-  id?: InputMaybe<Scalars['ID']['input']>;
-  name?: InputMaybe<Scalars['GraphQLString']['input']>;
-};
-
-export type IamUpdateTenantAccountByIdInput = {
-  accountId: Scalars['ID']['input'];
-  tenantId: Scalars['ID']['input'];
-};
-
-export type IamUpdateTenantByIdInput = {
-  accountIds?: InputMaybe<Array<InputMaybe<Scalars['ID']['input']>>>;
-  code?: InputMaybe<Scalars['GraphQLString']['input']>;
-  id: Scalars['ID']['input'];
-  isActive?: InputMaybe<Scalars['GraphQLBoolean']['input']>;
-  logo?: InputMaybe<Scalars['JSON']['input']>;
-  meta?: InputMaybe<Scalars['JSON']['input']>;
-  name?: InputMaybe<Scalars['GraphQLString']['input']>;
-  parentId?: InputMaybe<Scalars['ID']['input']>;
-};
-
-export type IamUpdateTenantsAccountsInput = {
-  accountId?: InputMaybe<Scalars['ID']['input']>;
-  tenantId?: InputMaybe<Scalars['ID']['input']>;
-};
-
-export type IamUpdateTenantsInput = {
-  accountIds?: InputMaybe<Array<InputMaybe<Scalars['ID']['input']>>>;
-  code?: InputMaybe<Scalars['GraphQLString']['input']>;
-  id?: InputMaybe<Scalars['ID']['input']>;
-  isActive?: InputMaybe<Scalars['GraphQLBoolean']['input']>;
-  logo?: InputMaybe<Scalars['JSON']['input']>;
-  meta?: InputMaybe<Scalars['JSON']['input']>;
-  name?: InputMaybe<Scalars['GraphQLString']['input']>;
-  parentId?: InputMaybe<Scalars['ID']['input']>;
-};
-
-export type IamUpdateUserByIdInput = {
-  accountId?: InputMaybe<Scalars['ID']['input']>;
-  avatar?: InputMaybe<Scalars['GraphQLString']['input']>;
-  id: Scalars['ID']['input'];
-  isTwoFactorAuthenticationEnabled?: InputMaybe<Scalars['GraphQLBoolean']['input']>;
-  langId?: InputMaybe<Scalars['ID']['input']>;
-  meta?: InputMaybe<Scalars['JSON']['input']>;
-  mobile?: InputMaybe<Scalars['GraphQLString']['input']>;
-  name?: InputMaybe<Scalars['GraphQLString']['input']>;
-  password?: InputMaybe<Scalars['GraphQLString']['input']>;
-  rememberToken?: InputMaybe<Scalars['GraphQLString']['input']>;
-  surname?: InputMaybe<Scalars['GraphQLString']['input']>;
-  twoFactorAuthenticationSecret?: InputMaybe<Scalars['GraphQLString']['input']>;
-};
-
-export type IamUpdateUsersInput = {
-  accountId?: InputMaybe<Scalars['ID']['input']>;
-  avatar?: InputMaybe<Scalars['GraphQLString']['input']>;
-  id?: InputMaybe<Scalars['ID']['input']>;
-  isTwoFactorAuthenticationEnabled?: InputMaybe<Scalars['GraphQLBoolean']['input']>;
-  langId?: InputMaybe<Scalars['ID']['input']>;
-  meta?: InputMaybe<Scalars['JSON']['input']>;
-  mobile?: InputMaybe<Scalars['GraphQLString']['input']>;
-  name?: InputMaybe<Scalars['GraphQLString']['input']>;
-  password?: InputMaybe<Scalars['GraphQLString']['input']>;
-  rememberToken?: InputMaybe<Scalars['GraphQLString']['input']>;
-  surname?: InputMaybe<Scalars['GraphQLString']['input']>;
-  twoFactorAuthenticationSecret?: InputMaybe<Scalars['GraphQLString']['input']>;
-};
-
-export type IamUser = {
-  __typename?: 'IamUser';
-  account?: Maybe<IamAccount>;
-  /** Reference to the associated account entity (one-to-one relationship). Each user must be linked to exactly one account, which handles authentication, authorization, and role assignments. The account contains type, email, username, and OAuth client information. This separation allows service accounts to exist without user profiles, while user accounts always have profile data. Must reference an existing active account. */
-  accountId: Scalars['ID']['output'];
-  /** URL or file path to the user's profile picture/avatar image. Maximum 255 characters for file path or URL. NULL indicates no avatar set (system should display default placeholder). Should reference secure storage (cloud storage bucket, CDN, or protected local path). For security, validate file type and size before storage. Used in UI headers, comments, and user listings. Example formats: /storage/avatars/uuid.jpg or https://cdn.example.com/avatars/uuid.png. */
-  avatar?: Maybe<Scalars['GraphQLString']['output']>;
-  /** Timestamp when the user profile was created. Automatically set on record insertion. Part of audit trail for compliance and user lifecycle tracking. Used for reporting on user registration patterns and account age calculations. Important for GDPR data retention policies and user activity analysis. */
-  createdAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** Soft delete timestamp for user accounts. NULL indicates an active user. When set, the user is excluded from normal queries but preserved for audit trail, legal compliance, and data retention policies. Soft-deleted users cannot authenticate or be assigned to new resources. Used for GDPR "right to be forgotten" compliance while maintaining referential integrity for historical records (orders, audit logs, etc.). Consider anonymization of PII data (name, email, mobile) after soft delete for privacy compliance. */
-  deletedAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** Unique identifier for the user. UUID v4 format, generated automatically on creation. Used as primary key for referencing this user across the system. */
-  id: Scalars['ID']['output'];
-  /** Indicates whether two-factor authentication (2FA/MFA) is enabled for this user. When true, login requires both password AND time-based one-time password (TOTP) from authenticator app. Defaults to false (2FA disabled) - users must explicitly enable and configure 2FA. When enabled, twoFactorAuthenticationSecret must be set. Enhances account security by requiring a second authentication factor. Cannot be disabled without proper identity verification to prevent account takeover. */
-  isTwoFactorAuthenticationEnabled: Scalars['GraphQLBoolean']['output'];
-  /** Reference to the user's preferred language/locale for UI and communications. Links to common/lang module for internationalization (i18n) support. NULL indicates system default language should be used. When set, all emails, notifications, and UI elements should be rendered in this language. Example: links to 'en-US', 'es-ES', 'fr-FR' language records. Used by frontend for locale selection and backend for localized email templates. */
-  langId?: Maybe<Scalars['ID']['output']>;
-  /** Optional JSONB field for storing custom user metadata and preferences. Use for application-specific data that doesn't warrant dedicated columns. Common uses: UI preferences (theme, layout), notification settings, onboarding status, feature flags, custom profile fields, integration metadata. NULL indicates no custom metadata. Uses JSONB (PostgreSQL) for efficient querying and indexing. No schema validation - structure determined by application. Example: {"theme": "dark", "emailNotifications": true, "onboardingComplete": true} Avoid storing sensitive data here - use dedicated encrypted fields instead. */
-  meta?: Maybe<Scalars['JSON']['output']>;
-  /** User's mobile phone number in international format. Optional field (NULL allowed). Maximum 64 characters to accommodate international numbers with country codes and extensions. Should be stored in E.164 format when possible (e.g., +14155552671) for consistency. Used for SMS notifications, 2FA via SMS, and emergency contact. NULL indicates no mobile number provided. Consider GDPR implications for storage. */
-  mobile?: Maybe<Scalars['GraphQLString']['output']>;
-  /** User's first name or given name. Required field for all user accounts. Used in UI displays, email communications, and audit logs. Maximum 128 characters to accommodate international names with special characters. Should be stored as provided by the user without normalization to respect cultural naming conventions. This is separate from the account username used for authentication. */
-  name: Scalars['GraphQLString']['output'];
-  /** Hashed password for user authentication. NEVER stored in plain text. Aurora automatically applies bcrypt hashing with salt (work factor 10-12). Maximum 255 characters to accommodate hashed output (bcrypt produces 60 chars, but allows room for future algorithm changes). Required field - users must set password on creation. Updated through secure password change flows with current password verification. Used in authentication middleware for login validation. Password reset flows bypass this through token-based validation (see rememberToken). Minimum requirements enforced at application layer: 8+ characters, complexity rules. */
-  password: Scalars['GraphQLString']['output'];
-  /** Secure token for "remember me" functionality and password reset workflows. NULL when not in use. Generated as cryptographically secure random string (recommended: 64+ characters, URL-safe). Used for two purposes: 1) Password reset: Temporary token sent via email, single-use, expires after 15-60 minutes. Invalidated after use or password change.2) Remember me: Long-lived token stored in browser cookie for auto-login, expires after 30-90 days of inactivity.Should be hashed before storage for security. Regenerated on each use or invalidated on security events (password change, logout from all devices). NEVER expose in logs or error messages. */
-  rememberToken?: Maybe<Scalars['GraphQLString']['output']>;
-  /** Auto-incrementing sequential identifier for the user. Used for internal ordering, optimized queries, and legacy system compatibility. Unlike the UUID 'id', this provides a human-readable sequential number. */
-  rowId: Scalars['GraphQLInt']['output'];
-  /** User's last name or family name. Optional field (NULL allowed) as some cultures may not use surnames. Maximum 255 characters to accommodate compound or hyphenated surnames. Used together with 'name' for full name display and formal communications. NULL indicates no surname provided or applicable. */
-  surname?: Maybe<Scalars['GraphQLString']['output']>;
-  /** Base32-encoded secret key for TOTP (Time-based One-Time Password) generation. Up to 32 characters in Base32 alphabet (A-Z, 2-7) per RFC 4648 and RFC 6238. Longer secrets (160+ bits) provide stronger security against brute-force attacks. NULL when 2FA is disabled. Generated during 2FA setup and shared with user via QR code for authenticator app (Google Authenticator, Authy, etc.). MUST be stored encrypted at rest for security. Used by authentication service to validate TOTP codes during login. Should NEVER be exposed in APIs or logs. If compromised, must be regenerated through 2FA reset flow. Paired with isTwoFactorAuthenticationEnabled. */
-  twoFactorAuthenticationSecret?: Maybe<Scalars['GraphQLString']['output']>;
-  /** Timestamp of the last modification to this user profile. Automatically updated on any field change. Used for tracking profile changes, cache invalidation, and security audits. Important for detecting suspicious account modifications and compliance with data change tracking requirements. Critical for audit logs when combined with hasAuditing=true for tracking who made changes. */
-  updatedAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-};
-
-export type LibraryBook = {
-  __typename?: 'LibraryBook';
-  /** Timestamp when the permission was created. Automatically set on record creation. Part of the audit trail for tracking permission lifecycle. */
-  createdAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** Soft delete timestamp. NULL indicates an active permission. When set, the permission is hidden from normal queries but preserved for audit purposes. Permissions with deletedAt set cannot be assigned to new roles. */
-  deletedAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** Unique identifier for the permission. UUID v4 format, generated automatically on creation. Used as primary key for referencing this permission across the system. */
-  id: Scalars['ID']['output'];
-  /** Unique permission name used to evaluate authorization. Format follows convention: [BoundedContext].[Action][Resource] (e.g., 'Iam.CreateUser'). Used by the authorization system to check if a user can access specific resources or perform certain actions. */
-  name: Scalars['GraphQLString']['output'];
-  /** Unique sequential identifier for internal database operations. Auto-incremented integer used for ordering and optimized queries. Not exposed in the API. */
-  rowId: Scalars['GraphQLInt']['output'];
-  /** Timestamp of the last modification to this permission. Automatically updated on any change. Used for tracking permission evolution and cache invalidation. */
-  updatedAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-};
-
-export type LibraryCreateBookInput = {
-  id: Scalars['ID']['input'];
-  name: Scalars['GraphQLString']['input'];
-};
-
-export type LibraryUpdateBookByIdInput = {
-  id: Scalars['ID']['input'];
-  name?: InputMaybe<Scalars['GraphQLString']['input']>;
-};
-
-export type LibraryUpdateBooksInput = {
-  id?: InputMaybe<Scalars['ID']['input']>;
-  name?: InputMaybe<Scalars['GraphQLString']['input']>;
-};
-
-export type Mutation = {
-  __typename?: 'Mutation';
-  iamCreateAccount?: Maybe<IamAccount>;
-  iamCreateBoundedContext?: Maybe<IamBoundedContext>;
-  iamCreateBoundedContexts: Scalars['Boolean']['output'];
-  iamCreatePermission?: Maybe<IamPermission>;
-  iamCreatePermissionRole?: Maybe<IamPermissionRole>;
-  iamCreatePermissions: Scalars['Boolean']['output'];
-  iamCreatePermissionsRoles: Scalars['Boolean']['output'];
-  iamCreateRole?: Maybe<IamRole>;
-  iamCreateRoleAccount?: Maybe<IamRoleAccount>;
-  iamCreateRoles: Scalars['Boolean']['output'];
-  iamCreateRolesAccounts: Scalars['Boolean']['output'];
-  iamCreateTag?: Maybe<IamTag>;
-  iamCreateTenant?: Maybe<IamTenant>;
-  iamCreateTenantAccount?: Maybe<IamTenantAccount>;
-  iamCreateTenants: Scalars['Boolean']['output'];
-  iamCreateTenantsAccounts: Scalars['Boolean']['output'];
-  iamDeleteAccountById?: Maybe<IamAccount>;
-  iamDeleteAccounts: Array<Maybe<IamAccount>>;
-  iamDeleteBoundedContextById?: Maybe<IamBoundedContext>;
-  iamDeleteBoundedContexts: Array<Maybe<IamBoundedContext>>;
-  iamDeletePermissionById?: Maybe<IamPermission>;
-  iamDeletePermissionRoleById?: Maybe<IamPermissionRole>;
-  iamDeletePermissions: Array<Maybe<IamPermission>>;
-  iamDeletePermissionsRoles: Array<Maybe<IamPermissionRole>>;
-  iamDeleteRoleAccountById?: Maybe<IamRoleAccount>;
-  iamDeleteRoleById?: Maybe<IamRole>;
-  iamDeleteRoles: Array<Maybe<IamRole>>;
-  iamDeleteRolesAccounts: Array<Maybe<IamRoleAccount>>;
-  iamDeleteTagById?: Maybe<IamTag>;
-  iamDeleteTenantAccountById?: Maybe<IamTenantAccount>;
-  iamDeleteTenantById?: Maybe<IamTenant>;
-  iamDeleteTenants: Array<Maybe<IamTenant>>;
-  iamDeleteTenantsAccounts: Array<Maybe<IamTenantAccount>>;
-  iamDeleteUserById?: Maybe<IamUser>;
-  iamDeleteUsers: Array<Maybe<IamUser>>;
-  iamForgotPasswordUser: Scalars['Boolean']['output'];
-  iamInheritPermissionsRoleRole: Scalars['Boolean']['output'];
-  iamResetPasswordUser: Scalars['Boolean']['output'];
-  iamUpdateAccountById?: Maybe<IamAccount>;
-  iamUpdateAccounts: Array<Maybe<IamAccount>>;
-  iamUpdateBoundedContextById?: Maybe<IamBoundedContext>;
-  iamUpdateBoundedContexts: Array<Maybe<IamBoundedContext>>;
-  iamUpdateMeAccount: Scalars['Boolean']['output'];
-  iamUpdatePermissionById?: Maybe<IamPermission>;
-  iamUpdatePermissionRoleById?: Maybe<IamPermissionRole>;
-  iamUpdatePermissions: Array<Maybe<IamPermission>>;
-  iamUpdatePermissionsRoles: Array<Maybe<IamPermissionRole>>;
-  iamUpdateRoleAccountById?: Maybe<IamRoleAccount>;
-  iamUpdateRoleById?: Maybe<IamRole>;
-  iamUpdateRoles: Array<Maybe<IamRole>>;
-  iamUpdateRolesAccounts: Array<Maybe<IamRoleAccount>>;
-  iamUpdateTagById?: Maybe<IamTag>;
-  iamUpdateTenantAccountById?: Maybe<IamTenantAccount>;
-  iamUpdateTenantById?: Maybe<IamTenant>;
-  iamUpdateTenants: Array<Maybe<IamTenant>>;
-  iamUpdateTenantsAccounts: Array<Maybe<IamTenantAccount>>;
-  iamUpdateUserById?: Maybe<IamUser>;
-  iamUpdateUsers: Array<Maybe<IamUser>>;
-  libraryCreateBook?: Maybe<LibraryBook>;
-  libraryCreateBooks: Scalars['Boolean']['output'];
-  libraryDeleteBookById?: Maybe<LibraryBook>;
-  libraryDeleteBooks: Array<Maybe<LibraryBook>>;
-  libraryUpdateBookById?: Maybe<LibraryBook>;
-  libraryUpdateBooks: Array<Maybe<LibraryBook>>;
-  libraryUpsertBook?: Maybe<LibraryBook>;
-  oAuthCreateApplication?: Maybe<OAuthApplication>;
-  oAuthCreateApplicationClient?: Maybe<OAuthApplicationClient>;
-  oAuthCreateApplicationsClients: Scalars['Boolean']['output'];
-  oAuthCreateAuthorizationCode?: Maybe<OAuthAuthorizationCode>;
-  oAuthCreateClient?: Maybe<OAuthClient>;
-  oAuthCreateScope?: Maybe<OAuthScope>;
-  /**
-   * GraphQL twin of `POST /api/o-auth/token`. Delegates to the same Phase 2 handlers
-   * (`OAuthCreateTokenPasswordService`, `OAuthCreateTokenRefreshService`,
-   * `OAuthCreateTokenAuthorizationCodeService`). Supports PASSWORD, REFRESH_TOKEN, and
-   * AUTHORIZATION_CODE grant types. External clients should prefer the REST endpoint with
-   * HTTP Basic auth.
-   */
-  oAuthCreateToken: OAuthTokens;
-  oAuthDeleteAccessTokenById?: Maybe<OAuthAccessToken>;
-  oAuthDeleteApplicationById?: Maybe<OAuthApplication>;
-  oAuthDeleteApplicationClientById?: Maybe<OAuthApplicationClient>;
-  oAuthDeleteApplicationsClients: Array<Maybe<OAuthApplicationClient>>;
-  oAuthDeleteAuthorizationCodeById?: Maybe<OAuthAuthorizationCode>;
-  oAuthDeleteAuthorizationCodes: Array<Maybe<OAuthAuthorizationCode>>;
-  oAuthDeleteClientById?: Maybe<OAuthClient>;
-  oAuthDeleteRefreshTokenById?: Maybe<OAuthRefreshToken>;
-  oAuthDeleteScopeById?: Maybe<OAuthScope>;
-  /**
-   * GraphQL twin of `POST /api/o-auth/revoke` (RFC 7009 token revocation). Delegates to
-   * `OAuthRevokeTokenHandler`. Always returns `true` (idempotent, non-enumerable per RFC 7009
-   * §2.2); raises `invalid_client` for an unauthenticated client and `invalid_request` for a
-   * missing token. External clients should prefer the REST endpoint with HTTP Basic auth.
-   */
-  oAuthRevokeToken: Scalars['Boolean']['output'];
-  oAuthUpdateApplicationById?: Maybe<OAuthApplication>;
-  oAuthUpdateApplicationClientById?: Maybe<OAuthApplicationClient>;
-  oAuthUpdateAuthorizationCodeById?: Maybe<OAuthAuthorizationCode>;
-  oAuthUpdateClientById?: Maybe<OAuthClient>;
-  oAuthUpdateScopeById?: Maybe<OAuthScope>;
-};
-
-
-export type MutationIamCreateAccountArgs = {
-  payload: IamCreateAccountInput;
-};
-
-
-export type MutationIamCreateBoundedContextArgs = {
-  payload: IamCreateBoundedContextInput;
-};
-
-
-export type MutationIamCreateBoundedContextsArgs = {
-  payload: Array<InputMaybe<IamCreateBoundedContextInput>>;
-};
-
-
-export type MutationIamCreatePermissionArgs = {
-  payload: IamCreatePermissionInput;
-};
-
-
-export type MutationIamCreatePermissionRoleArgs = {
-  payload: IamCreatePermissionRoleInput;
-};
-
-
-export type MutationIamCreatePermissionsArgs = {
-  payload: Array<InputMaybe<IamCreatePermissionInput>>;
-};
-
-
-export type MutationIamCreatePermissionsRolesArgs = {
-  payload: Array<InputMaybe<IamCreatePermissionRoleInput>>;
-};
-
-
-export type MutationIamCreateRoleArgs = {
-  payload: IamCreateRoleInput;
-};
-
-
-export type MutationIamCreateRoleAccountArgs = {
-  payload: IamCreateRoleAccountInput;
-};
-
-
-export type MutationIamCreateRolesArgs = {
-  payload: Array<InputMaybe<IamCreateRoleInput>>;
-};
-
-
-export type MutationIamCreateRolesAccountsArgs = {
-  payload: Array<InputMaybe<IamCreateRoleAccountInput>>;
-};
-
-
-export type MutationIamCreateTagArgs = {
-  payload: IamCreateTagInput;
-};
-
-
-export type MutationIamCreateTenantArgs = {
-  payload: IamCreateTenantInput;
-};
-
-
-export type MutationIamCreateTenantAccountArgs = {
-  payload: IamCreateTenantAccountInput;
-};
-
-
-export type MutationIamCreateTenantsArgs = {
-  payload: Array<InputMaybe<IamCreateTenantInput>>;
-};
-
-
-export type MutationIamCreateTenantsAccountsArgs = {
-  payload: Array<InputMaybe<IamCreateTenantAccountInput>>;
-};
-
-
-export type MutationIamDeleteAccountByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  id: Scalars['ID']['input'];
-};
-
-
-export type MutationIamDeleteAccountsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type MutationIamDeleteBoundedContextByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  id: Scalars['ID']['input'];
-};
-
-
-export type MutationIamDeleteBoundedContextsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type MutationIamDeletePermissionByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  id: Scalars['ID']['input'];
-};
-
-
-export type MutationIamDeletePermissionRoleByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  permissionId: Scalars['ID']['input'];
-  roleId: Scalars['ID']['input'];
-};
-
-
-export type MutationIamDeletePermissionsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type MutationIamDeletePermissionsRolesArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type MutationIamDeleteRoleAccountByIdArgs = {
-  accountId: Scalars['ID']['input'];
-  constraint?: InputMaybe<QueryStatement>;
-  roleId: Scalars['ID']['input'];
-};
-
-
-export type MutationIamDeleteRoleByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  id: Scalars['ID']['input'];
-};
-
-
-export type MutationIamDeleteRolesArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type MutationIamDeleteRolesAccountsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type MutationIamDeleteTagByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  id: Scalars['ID']['input'];
-};
-
-
-export type MutationIamDeleteTenantAccountByIdArgs = {
-  accountId: Scalars['ID']['input'];
-  constraint?: InputMaybe<QueryStatement>;
-  tenantId: Scalars['ID']['input'];
-};
-
-
-export type MutationIamDeleteTenantByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  id: Scalars['ID']['input'];
-};
-
-
-export type MutationIamDeleteTenantsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type MutationIamDeleteTenantsAccountsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type MutationIamDeleteUserByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  id: Scalars['ID']['input'];
-};
-
-
-export type MutationIamDeleteUsersArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type MutationIamForgotPasswordUserArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  payload: IamUpdateUserByIdInput;
-};
-
-
-export type MutationIamInheritPermissionsRoleRoleArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  payload: IamUpdateRoleByIdInput;
-};
-
-
-export type MutationIamResetPasswordUserArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  payload: IamUpdateUserByIdInput;
-};
-
-
-export type MutationIamUpdateAccountByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  payload: IamUpdateAccountByIdInput;
-};
-
-
-export type MutationIamUpdateAccountsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  payload: IamUpdateAccountsInput;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type MutationIamUpdateBoundedContextByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  payload: IamUpdateBoundedContextByIdInput;
-};
-
-
-export type MutationIamUpdateBoundedContextsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  payload: IamUpdateBoundedContextsInput;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type MutationIamUpdateMeAccountArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  payload: IamUpdateAccountByIdInput;
-};
-
-
-export type MutationIamUpdatePermissionByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  payload: IamUpdatePermissionByIdInput;
-};
-
-
-export type MutationIamUpdatePermissionRoleByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  payload: IamUpdatePermissionRoleByIdInput;
-};
-
-
-export type MutationIamUpdatePermissionsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  payload: IamUpdatePermissionsInput;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type MutationIamUpdatePermissionsRolesArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  payload: IamUpdatePermissionsRolesInput;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type MutationIamUpdateRoleAccountByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  payload: IamUpdateRoleAccountByIdInput;
-};
-
-
-export type MutationIamUpdateRoleByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  payload: IamUpdateRoleByIdInput;
-};
-
-
-export type MutationIamUpdateRolesArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  payload: IamUpdateRolesInput;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type MutationIamUpdateRolesAccountsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  payload: IamUpdateRolesAccountsInput;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type MutationIamUpdateTagByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  payload: IamUpdateTagByIdInput;
-};
-
-
-export type MutationIamUpdateTenantAccountByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  payload: IamUpdateTenantAccountByIdInput;
-};
-
-
-export type MutationIamUpdateTenantByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  payload: IamUpdateTenantByIdInput;
-};
-
-
-export type MutationIamUpdateTenantsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  payload: IamUpdateTenantsInput;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type MutationIamUpdateTenantsAccountsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  payload: IamUpdateTenantsAccountsInput;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type MutationIamUpdateUserByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  payload: IamUpdateUserByIdInput;
-};
-
-
-export type MutationIamUpdateUsersArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  payload: IamUpdateUsersInput;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type MutationLibraryCreateBookArgs = {
-  payload: LibraryCreateBookInput;
-};
-
-
-export type MutationLibraryCreateBooksArgs = {
-  payload: Array<InputMaybe<LibraryCreateBookInput>>;
-};
-
-
-export type MutationLibraryDeleteBookByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  id: Scalars['ID']['input'];
-};
-
-
-export type MutationLibraryDeleteBooksArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type MutationLibraryUpdateBookByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  payload: LibraryUpdateBookByIdInput;
-};
-
-
-export type MutationLibraryUpdateBooksArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  payload: LibraryUpdateBooksInput;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type MutationLibraryUpsertBookArgs = {
-  payload: LibraryUpdateBookByIdInput;
-};
-
-
-export type MutationOAuthCreateApplicationArgs = {
-  payload: OAuthCreateApplicationInput;
-};
-
-
-export type MutationOAuthCreateApplicationClientArgs = {
-  payload: OAuthCreateApplicationClientInput;
-};
-
-
-export type MutationOAuthCreateApplicationsClientsArgs = {
-  payload: Array<InputMaybe<OAuthCreateApplicationClientInput>>;
-};
-
-
-export type MutationOAuthCreateAuthorizationCodeArgs = {
-  payload: OAuthCreateAuthorizationCodeInput;
-};
-
-
-export type MutationOAuthCreateClientArgs = {
-  payload: OAuthCreateClientInput;
-};
-
-
-export type MutationOAuthCreateScopeArgs = {
-  payload: OAuthCreateScopeInput;
-};
-
-
-export type MutationOAuthCreateTokenArgs = {
-  payload: OAuthCreateTokenInput;
-};
-
-
-export type MutationOAuthDeleteAccessTokenByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  id: Scalars['ID']['input'];
-};
-
-
-export type MutationOAuthDeleteApplicationByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  id: Scalars['ID']['input'];
-};
-
-
-export type MutationOAuthDeleteApplicationClientByIdArgs = {
-  applicationId: Scalars['ID']['input'];
-  clientId: Scalars['ID']['input'];
-  constraint?: InputMaybe<QueryStatement>;
-};
-
-
-export type MutationOAuthDeleteApplicationsClientsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type MutationOAuthDeleteAuthorizationCodeByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  id: Scalars['ID']['input'];
-};
-
-
-export type MutationOAuthDeleteAuthorizationCodesArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type MutationOAuthDeleteClientByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  id: Scalars['ID']['input'];
-};
-
-
-export type MutationOAuthDeleteRefreshTokenByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  id: Scalars['ID']['input'];
-};
-
-
-export type MutationOAuthDeleteScopeByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  id: Scalars['ID']['input'];
-};
-
-
-export type MutationOAuthRevokeTokenArgs = {
-  payload: OAuthRevokeTokenInput;
-};
-
-
-export type MutationOAuthUpdateApplicationByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  payload: OAuthUpdateApplicationByIdInput;
-};
-
-
-export type MutationOAuthUpdateApplicationClientByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  payload: OAuthUpdateApplicationClientByIdInput;
-};
-
-
-export type MutationOAuthUpdateAuthorizationCodeByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  payload: OAuthUpdateAuthorizationCodeByIdInput;
-};
-
-
-export type MutationOAuthUpdateClientByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  payload: OAuthUpdateClientByIdInput;
-};
-
-
-export type MutationOAuthUpdateScopeByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  payload: OAuthUpdateScopeByIdInput;
-};
-
-export type OAuthAccessToken = {
-  __typename?: 'OAuthAccessToken';
-  /** ID of the account (user) associated with this token. NULL for client_credentials grants that don't represent a specific user. Used to link tokens to user identity. */
-  accountId?: Maybe<Scalars['ID']['output']>;
-  client?: Maybe<OAuthClient>;
-  /** ID of the OAuth client that owns this access token. Links the token to the application and grant type used for authorization. */
-  clientId: Scalars['ID']['output'];
-  /** Timestamp when the access token was created. Automatically set on creation. */
-  createdAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** Soft delete timestamp. NULL means active token. When set, token is excluded from normal queries but preserved for audit trail. */
-  deletedAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** Expiration timestamp for the access token. After this time, the token is invalid for API requests. Typically set to minutes or hours from creation for security. */
-  expiresAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** Unique identifier for the access token. UUID v4 format, generated automatically on creation. */
-  id: Scalars['ID']['output'];
-  /** Indicates whether the access token has been revoked. Revoked tokens are rejected for API authentication. Set to true on logout, security events, or manual revocation. */
-  isRevoked: Scalars['GraphQLBoolean']['output'];
-  /** Optional descriptive name for the access token. Useful for personal access tokens or long-lived tokens to identify their purpose (e.g., "Mobile App", "CI/CD Pipeline"). */
-  name?: Maybe<Scalars['GraphQLString']['output']>;
-  /** One-to-one relationship with a refresh token. When present, the refresh token can be used to obtain a new access token after this one expires. */
-  refreshToken?: Maybe<OAuthRefreshToken>;
-  /** Auto-incrementing row identifier. Used for internal ordering and as a numeric alternative to UUID. */
-  rowId: Scalars['GraphQLInt']['output'];
-  /** The access token string. JWT or opaque token value. SECURITY: Transmitted in Authorization headers for API authentication. Should be short-lived to minimize security risk. */
-  token: Scalars['GraphQLString']['output'];
-  /** Timestamp when the access token was last updated. Automatically updated on modification. */
-  updatedAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-};
-
-export type OAuthApplication = {
-  __typename?: 'OAuthApplication';
-  /** Many-to-many relationship with OAuth clients. An application can have multiple clients representing different grant types or deployment environments. */
-  clients?: Maybe<Array<Maybe<OAuthClient>>>;
-  /** Unique code identifier for the application. Used as the client_id in OAuth flows. Convention: Lowercase, hyphen-separated (e.g., my-app, mobile-client). */
-  code: Scalars['GraphQLString']['output'];
-  /** Timestamp when the application was created. Automatically set on creation. */
-  createdAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** Soft delete timestamp. NULL means active application. When set, application is excluded from normal queries but preserved for audit trail. */
-  deletedAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** Unique identifier for the application. UUID v4 format, generated automatically on creation. */
-  id: Scalars['ID']['output'];
-  /** Indicates whether this is a master application with elevated privileges. Master applications typically have access to all scopes and bypass certain restrictions. */
-  isMaster: Scalars['GraphQLBoolean']['output'];
-  /** Human-readable name for the application. Displayed in authorization prompts and admin interfaces. */
-  name: Scalars['GraphQLString']['output'];
-  /** Auto-incrementing row identifier. Used for internal ordering and as a numeric alternative to UUID. */
-  rowId: Scalars['GraphQLInt']['output'];
-  /** Application secret used for authentication. SECURITY: Must be stored securely, hashed, and never exposed to clients. Used as client_secret in confidential OAuth flows. */
-  secret: Scalars['GraphQLString']['output'];
-  /** Timestamp when the application was last updated. Automatically updated on modification. */
-  updatedAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-};
-
-export type OAuthApplicationClient = {
-  __typename?: 'OAuthApplicationClient';
-  application?: Maybe<OAuthApplication>;
-  applicationId: Scalars['ID']['output'];
-  client?: Maybe<OAuthClient>;
-  clientId: Scalars['ID']['output'];
-};
-
-export type OAuthAuthorizationCode = {
-  __typename?: 'OAuthAuthorizationCode';
-  /** ID of the authenticated account (user) who authorized this code. Used to associate the resulting tokens with the correct user identity. */
-  accountId: Scalars['ID']['output'];
-  client?: Maybe<OAuthClient>;
-  /** ID of the OAuth client that requested this authorization code. Links the code to the application initiating the authorization flow. */
-  clientId: Scalars['ID']['output'];
-  /** Opaque authorization code string. Cryptographically random, URL-safe. Presented to the client application for exchange via the token endpoint. Must be unique and single-use. */
-  code: Scalars['GraphQLString']['output'];
-  /** PKCE code challenge value. Reserved for future PKCE implementation. Will contain the S256 hash of the code verifier sent by public clients (RFC 7636). */
-  codeChallenge?: Maybe<Scalars['GraphQLString']['output']>;
-  /** PKCE code challenge method. Reserved for future PKCE implementation. Expected values: 'S256' or 'plain' (RFC 7636). S256 is strongly recommended. */
-  codeChallengeMethod?: Maybe<Scalars['GraphQLString']['output']>;
-  /** Timestamp when the authorization code was created. Automatically set on creation. */
-  createdAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** Soft delete timestamp. NULL means active code. When set, code is excluded from normal queries but preserved for audit trail. */
-  deletedAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** Expiration timestamp for the authorization code. Codes are very short-lived (typically 60 seconds) to minimize the window for interception. After expiration, the code cannot be exchanged. */
-  expiresAt: Scalars['GraphQLTimestamp']['output'];
-  /** Unique identifier for the authorization code record. UUID v4 format, generated automatically on creation. */
-  id: Scalars['ID']['output'];
-  /** Indicates whether the authorization code has already been exchanged for tokens. Codes are single-use; if a used code is presented again, all tokens issued from it must be revoked (RFC 6749 Section 4.1.2). */
-  isUsed: Scalars['GraphQLBoolean']['output'];
-  /** The redirect URI provided by the client in the authorization request. Must match exactly during code exchange to prevent authorization code interception attacks (RFC 6749 Section 4.1.3). */
-  redirectUri: Scalars['GraphQLString']['output'];
-  /** Auto-incrementing row identifier. Used for internal ordering and as a numeric alternative to UUID. */
-  rowId: Scalars['GraphQLInt']['output'];
-  /** JSON array of scope strings requested by the client during authorization. Defines the permissions granted for the resulting access token. NULL means default scopes. */
-  scopes?: Maybe<Scalars['JSON']['output']>;
-  /** Timestamp when the authorization code was last updated. Automatically updated on modification. */
-  updatedAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-};
-
-export type OAuthClient = {
-  __typename?: 'OAuthClient';
-  /** Lifetime of access tokens in seconds. Determines how long access tokens remain valid after creation. Typical values: 3600 (1 hour) to 86400 (24 hours). NULL uses system default. */
-  accessTokenLifetimeSeconds?: Maybe<Scalars['GraphQLInt']['output']>;
-  /** One-to-many relationship with access tokens. A client can have multiple active access tokens, each representing a different user session or API consumer. */
-  accessTokens?: Maybe<Array<Maybe<OAuthAccessToken>>>;
-  /** Many-to-many relationship with OAuth applications. A client can belong to multiple applications, allowing shared client configurations across different services. */
-  applications?: Maybe<Array<Maybe<OAuthApplication>>>;
-  /** Authorization URL for the OAuth flow. Used in authorization_code grant to redirect users for authentication. NULL for grant types that don't require user authorization. */
-  authUrl?: Maybe<Scalars['GraphQLString']['output']>;
-  /** Timestamp when the client was created. Automatically set on creation. */
-  createdAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** Soft delete timestamp. NULL means active client. When set, client is excluded from normal queries but preserved for audit trail. */
-  deletedAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** OAuth 2.0 grant type for this client. AUTHORIZATION_CODE: Web apps with server backend. CLIENT_CREDENTIALS: Machine-to-machine authentication. PASSWORD: Legacy username/password flow. REFRESH_TOKEN: Used to obtain new access tokens. */
-  grantType: OAuthClientGrantTypeEnum;
-  /** Unique identifier for the client. UUID v4 format, generated automatically on creation. */
-  id: Scalars['ID']['output'];
-  /** Indicates whether the client is currently active and can be used for authentication. Inactive clients are rejected in OAuth flows. Use to temporarily disable clients. */
-  isActive: Scalars['GraphQLBoolean']['output'];
-  /** Indicates whether this is a master client with elevated privileges. Master clients typically have access to all scopes and bypass certain restrictions. */
-  isMaster: Scalars['GraphQLBoolean']['output'];
-  /** Human-readable name for the client. Displayed in authorization prompts and admin interfaces. Example: "Web Application", "Mobile App - iOS". */
-  name: Scalars['GraphQLString']['output'];
-  /** Redirect URI where the authorization server sends the user after authorization. Must match exactly for security. Multiple URIs can be stored as JSON array in production systems. */
-  redirect?: Maybe<Scalars['GraphQLString']['output']>;
-  /** Lifetime of refresh tokens in seconds. Determines how long refresh tokens remain valid. Typically much longer than access tokens: 2592000 (30 days) to 31536000 (1 year). NULL uses system default. */
-  refreshTokenLifetimeSeconds?: Maybe<Scalars['GraphQLInt']['output']>;
-  /** Auto-incrementing row identifier. Used for internal ordering and as a numeric alternative to UUID. */
-  rowId: Scalars['GraphQLInt']['output'];
-  /** Array of available scope codes for this client. Defines which permissions can be requested. Example: ["read:users", "write:posts"]. NULL means all scopes available. */
-  scopeOptions?: Maybe<Array<Maybe<Scalars['GraphQLString']['output']>>>;
-  /** Client secret used for authentication. SECURITY: Must be stored securely, hashed, and only shared with confidential clients. Not used for public clients (e.g., mobile apps). */
-  secret: Scalars['GraphQLString']['output'];
-  /** Timestamp when the client was last updated. Automatically updated on modification. */
-  updatedAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-};
-
-export enum OAuthClientGrantTypeEnum {
-  AUTHORIZATION_CODE = 'AUTHORIZATION_CODE',
-  CLIENT_CREDENTIALS = 'CLIENT_CREDENTIALS',
-  PASSWORD = 'PASSWORD',
-  REFRESH_TOKEN = 'REFRESH_TOKEN'
-}
-
-export type OAuthCreateAccessTokenInput = {
-  accountId?: InputMaybe<Scalars['ID']['input']>;
-  clientId: Scalars['ID']['input'];
-  expiresAt?: InputMaybe<Scalars['GraphQLTimestamp']['input']>;
-  id: Scalars['ID']['input'];
-  isRevoked: Scalars['GraphQLBoolean']['input'];
-  name?: InputMaybe<Scalars['GraphQLString']['input']>;
-  refreshToken?: InputMaybe<OAuthCreateRefreshTokenInput>;
-  token: Scalars['GraphQLString']['input'];
-};
-
-export type OAuthCreateApplicationClientInput = {
-  applicationId: Scalars['ID']['input'];
-  clientId: Scalars['ID']['input'];
-};
-
-export type OAuthCreateApplicationInput = {
-  clientIds?: InputMaybe<Array<InputMaybe<Scalars['ID']['input']>>>;
-  code: Scalars['GraphQLString']['input'];
-  id: Scalars['ID']['input'];
-  isMaster: Scalars['GraphQLBoolean']['input'];
-  name: Scalars['GraphQLString']['input'];
-  secret: Scalars['GraphQLString']['input'];
-};
-
-export type OAuthCreateAuthorizationCodeInput = {
-  accountId: Scalars['ID']['input'];
-  clientId: Scalars['ID']['input'];
-  code: Scalars['GraphQLString']['input'];
-  codeChallenge?: InputMaybe<Scalars['GraphQLString']['input']>;
-  codeChallengeMethod?: InputMaybe<Scalars['GraphQLString']['input']>;
-  expiresAt: Scalars['GraphQLTimestamp']['input'];
-  id: Scalars['ID']['input'];
-  isUsed: Scalars['GraphQLBoolean']['input'];
-  redirectUri: Scalars['GraphQLString']['input'];
-  scopes?: InputMaybe<Scalars['JSON']['input']>;
-};
-
-export type OAuthCreateClientInput = {
-  accessTokenLifetimeSeconds?: InputMaybe<Scalars['GraphQLInt']['input']>;
-  applicationIds?: InputMaybe<Array<InputMaybe<Scalars['ID']['input']>>>;
-  authUrl?: InputMaybe<Scalars['GraphQLString']['input']>;
-  grantType: OAuthClientGrantTypeEnum;
-  id: Scalars['ID']['input'];
-  isActive: Scalars['GraphQLBoolean']['input'];
-  isMaster: Scalars['GraphQLBoolean']['input'];
-  name: Scalars['GraphQLString']['input'];
-  redirect?: InputMaybe<Scalars['GraphQLString']['input']>;
-  refreshTokenLifetimeSeconds?: InputMaybe<Scalars['GraphQLInt']['input']>;
-  scopeOptions?: InputMaybe<Array<InputMaybe<Scalars['GraphQLString']['input']>>>;
-  secret: Scalars['GraphQLString']['input'];
-};
-
-export type OAuthCreateRefreshTokenInput = {
-  accessTokenId: Scalars['ID']['input'];
-  expiresAt?: InputMaybe<Scalars['GraphQLTimestamp']['input']>;
-  id: Scalars['ID']['input'];
-  isRevoked: Scalars['GraphQLBoolean']['input'];
-  token: Scalars['GraphQLString']['input'];
-};
-
-export type OAuthCreateScopeInput = {
-  code: Scalars['GraphQLString']['input'];
-  id: Scalars['ID']['input'];
-  name: Scalars['GraphQLString']['input'];
-  roleIds?: InputMaybe<Array<InputMaybe<Scalars['ID']['input']>>>;
-};
-
-export type OAuthCreateTokenInput = {
-  /** Authorization code for AUTHORIZATION_CODE grant (RFC 6749 §4.1.3). Required when grantType is AUTHORIZATION_CODE. */
-  code?: InputMaybe<Scalars['String']['input']>;
-  /** PKCE code verifier (RFC 7636). Required when grantType is AUTHORIZATION_CODE. */
-  codeVerifier?: InputMaybe<Scalars['String']['input']>;
-  /**
-   * Grant type. PASSWORD requires `username` + `password`. REFRESH_TOKEN requires `refreshToken`.
-   * AUTHORIZATION_CODE requires `code`, `redirectUri`, `codeVerifier` (RFC 6749 §4.1.3 + RFC 7636).
-   */
-  grantType: OAuthCredentialGrantTypeEnum;
-  /** Password for PASSWORD grant. Required when grantType is PASSWORD. */
-  password?: InputMaybe<Scalars['String']['input']>;
-  /** Redirect URI for AUTHORIZATION_CODE grant. Must exactly match the URI bound at /authorize time. */
-  redirectUri?: InputMaybe<Scalars['String']['input']>;
-  /** Refresh token for REFRESH_TOKEN grant. Required when grantType is REFRESH_TOKEN. */
-  refreshToken?: InputMaybe<Scalars['String']['input']>;
-  /** Username for PASSWORD grant. Required when grantType is PASSWORD. */
-  username?: InputMaybe<Scalars['String']['input']>;
-};
-
-export type OAuthCredential = {
-  __typename?: 'OAuthCredential';
-  accessToken?: Maybe<OAuthAccessToken>;
-  /** Foreign key to the OAuthAccessToken row created by this issuance. One-to-one because each issuance creates exactly one access token. Nullable for safety (in degraded paths where access token persistence might fail after credential is logged), though current flow always persists both. */
-  accessTokenId?: Maybe<Scalars['ID']['output']>;
-  account?: Maybe<IamAccount>;
-  /** Reference to the IamAccount whose credentials produced this issuance. Indexed for "all logins for this account" forensic queries. Many-to-one because a single account can have many issuance events over time. */
-  accountId: Scalars['ID']['output'];
-  /** Timestamp when the credential row was created. Equivalent to the moment the token was issued. Indexed for time-range audit queries and for the retention purge job. */
-  createdAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** Soft-delete timestamp. NULL means active row. The retention job uses hard DELETE (not soft) for storage efficiency, but the column exists to allow ad-hoc soft-deletes by operators if needed before the retention window. */
-  deletedAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** OAuth2 grant type used in this issuance. PASSWORD = Resource Owner Password Credentials Grant (RFC 6749 §4.3). REFRESH_TOKEN = Refresh Token Grant (RFC 6749 §6). AUTHORIZATION_CODE is reserved for future Authorization Code Grant support; not used in the current MVP. Indexed for filtering audit queries by grant type. */
-  grantType: OAuthCredentialGrantTypeEnum;
-  /** Unique identifier for the credential log entry. UUID v4 format, generated automatically on creation. Primary key. */
-  id: Scalars['ID']['output'];
-  /** IP address of the client that sent the POST /api/oauth/token request. Stored as a string (not as inet) to keep cross-DB portability and to allow IPv6 representations. Maximum 45 characters covers IPv6 (max 39 chars) plus zone id suffix. */
-  ipAddress?: Maybe<Scalars['GraphQLString']['output']>;
-  refreshToken?: Maybe<OAuthRefreshToken>;
-  /** Foreign key to the OAuthRefreshToken row created by this issuance. One-to-one. Nullable because future grant types may issue access tokens without refresh tokens (e.g., Client Credentials Grant), and to allow degraded paths. */
-  refreshTokenId?: Maybe<Scalars['ID']['output']>;
-  /** Auto-incrementing row identifier. Used for internal ordering and as a numeric alternative to UUID. Useful for chronological audit queries (ORDER BY rowId DESC LIMIT N is faster than ORDER BY createdAt DESC). */
-  rowId: Scalars['GraphQLInt']['output'];
-  /** Timestamp when the credential row was last updated. Credential rows are typically write-once; this column is maintained by Aurora's standard timestamp lifecycle. */
-  updatedAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** User-Agent header sent with the token request. Truncated to 255 characters if longer. Nullable because some clients (curl, internal services) may not send it. Useful in forensics to identify the device or library origin of an issuance. */
-  userAgent?: Maybe<Scalars['GraphQLString']['output']>;
-};
-
-export enum OAuthCredentialGrantTypeEnum {
-  AUTHORIZATION_CODE = 'AUTHORIZATION_CODE',
-  PASSWORD = 'PASSWORD',
-  REFRESH_TOKEN = 'REFRESH_TOKEN'
-}
-
-export type OAuthRefreshToken = {
-  __typename?: 'OAuthRefreshToken';
-  accessToken?: Maybe<OAuthAccessToken>;
-  /** ID of the associated access token. One-to-one relationship ensures each refresh token is tied to a specific access token instance. */
-  accessTokenId: Scalars['ID']['output'];
-  /** Timestamp when the refresh token was created. Automatically set on creation. */
-  createdAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** Soft delete timestamp. NULL means active token. When set, token is excluded from normal queries but preserved for audit trail. */
-  deletedAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** Expiration timestamp for the refresh token. After this time, the token cannot be used to obtain new access tokens. NULL means no expiration (not recommended for security). */
-  expiresAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** Unique identifier for the refresh token. UUID v4 format, generated automatically on creation. */
-  id: Scalars['ID']['output'];
-  /** Indicates whether the refresh token has been revoked. Revoked tokens cannot be used to obtain new access tokens. Set to true on logout or security events. */
-  isRevoked: Scalars['GraphQLBoolean']['output'];
-  /** Auto-incrementing row identifier. Used for internal ordering and as a numeric alternative to UUID. */
-  rowId: Scalars['GraphQLInt']['output'];
-  /** The refresh token string. JWT or opaque token value. SECURITY: Must be stored securely and treated as a sensitive credential. Used to request new access tokens. */
-  token: Scalars['GraphQLString']['output'];
-  /** Timestamp when the refresh token was last updated. Automatically updated on modification. */
-  updatedAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-};
-
-/**
- * RFC 7009 token revocation input. `token` is the credential to revoke (the refresh token for
- * this provider). `tokenTypeHint` is accepted but optional. Client credentials travel in the
- * HTTP Basic `Authorization` header (RFC 7009 §2.1), not in this payload.
- */
-export type OAuthRevokeTokenInput = {
-  token: Scalars['String']['input'];
-  tokenTypeHint?: InputMaybe<Scalars['String']['input']>;
-};
-
-export type OAuthScope = {
-  __typename?: 'OAuthScope';
-  /** Unique code identifier for the scope. Used in OAuth flows to request specific permissions. Convention: Uppercase, underscore-separated (e.g., READ_USERS, EDIT_POSTS). */
-  code: Scalars['GraphQLString']['output'];
-  /** Timestamp when the scope was created. Automatically set on creation. */
-  createdAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** Soft delete timestamp. NULL means active scope. When set, scope is excluded from normal queries but preserved for audit trail. */
-  deletedAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-  /** Unique identifier for the scope. UUID v4 format, generated automatically on creation. */
-  id: Scalars['ID']['output'];
-  /** Human-readable name for the scope. Displayed in authorization prompts and admin interfaces. */
-  name: Scalars['GraphQLString']['output'];
-  /** Array of role IDs that have access to this scope. Links scopes to the IAM role system for permission management. NULL means no role restrictions. */
-  roleIds?: Maybe<Array<Maybe<Scalars['ID']['output']>>>;
-  /** Auto-incrementing row identifier. Used for internal ordering and as a numeric alternative to UUID. */
-  rowId: Scalars['GraphQLInt']['output'];
-  /** Timestamp when the scope was last updated. Automatically updated on modification. */
-  updatedAt?: Maybe<Scalars['GraphQLTimestamp']['output']>;
-};
-
-/** RFC 6749 §5.1 Successful Response payload, camelCase for GraphQL convention. */
-export type OAuthTokens = {
-  __typename?: 'OAuthTokens';
-  accessToken: Scalars['String']['output'];
-  expiresIn: Scalars['Int']['output'];
-  refreshToken: Scalars['String']['output'];
-  tokenType: Scalars['String']['output'];
-};
-
-export type OAuthUpdateAccessTokenByIdInput = {
-  accountId?: InputMaybe<Scalars['ID']['input']>;
-  clientId?: InputMaybe<Scalars['ID']['input']>;
-  expiresAt?: InputMaybe<Scalars['GraphQLTimestamp']['input']>;
-  id: Scalars['ID']['input'];
-  isRevoked?: InputMaybe<Scalars['GraphQLBoolean']['input']>;
-  name?: InputMaybe<Scalars['GraphQLString']['input']>;
-  refreshToken?: InputMaybe<OAuthUpdateRefreshTokenByIdInput>;
-  token?: InputMaybe<Scalars['GraphQLString']['input']>;
-};
-
-export type OAuthUpdateAccessTokensInput = {
-  accountId?: InputMaybe<Scalars['ID']['input']>;
-  clientId?: InputMaybe<Scalars['ID']['input']>;
-  expiresAt?: InputMaybe<Scalars['GraphQLTimestamp']['input']>;
-  id?: InputMaybe<Scalars['ID']['input']>;
-  isRevoked?: InputMaybe<Scalars['GraphQLBoolean']['input']>;
-  name?: InputMaybe<Scalars['GraphQLString']['input']>;
-  refreshToken?: InputMaybe<OAuthUpdateRefreshTokensInput>;
-  token?: InputMaybe<Scalars['GraphQLString']['input']>;
-};
-
-export type OAuthUpdateApplicationByIdInput = {
-  clientIds?: InputMaybe<Array<InputMaybe<Scalars['ID']['input']>>>;
-  code?: InputMaybe<Scalars['GraphQLString']['input']>;
-  id: Scalars['ID']['input'];
-  isMaster?: InputMaybe<Scalars['GraphQLBoolean']['input']>;
-  name?: InputMaybe<Scalars['GraphQLString']['input']>;
-  secret?: InputMaybe<Scalars['GraphQLString']['input']>;
-};
-
-export type OAuthUpdateApplicationClientByIdInput = {
-  applicationId: Scalars['ID']['input'];
-  clientId: Scalars['ID']['input'];
-};
-
-export type OAuthUpdateApplicationsClientsInput = {
-  applicationId?: InputMaybe<Scalars['ID']['input']>;
-  clientId?: InputMaybe<Scalars['ID']['input']>;
-};
-
-export type OAuthUpdateApplicationsInput = {
-  clientIds?: InputMaybe<Array<InputMaybe<Scalars['ID']['input']>>>;
-  code?: InputMaybe<Scalars['GraphQLString']['input']>;
-  id?: InputMaybe<Scalars['ID']['input']>;
-  isMaster?: InputMaybe<Scalars['GraphQLBoolean']['input']>;
-  name?: InputMaybe<Scalars['GraphQLString']['input']>;
-  secret?: InputMaybe<Scalars['GraphQLString']['input']>;
-};
-
-export type OAuthUpdateAuthorizationCodeByIdInput = {
-  accountId?: InputMaybe<Scalars['ID']['input']>;
-  clientId?: InputMaybe<Scalars['ID']['input']>;
-  code?: InputMaybe<Scalars['GraphQLString']['input']>;
-  codeChallenge?: InputMaybe<Scalars['GraphQLString']['input']>;
-  codeChallengeMethod?: InputMaybe<Scalars['GraphQLString']['input']>;
-  expiresAt?: InputMaybe<Scalars['GraphQLTimestamp']['input']>;
-  id: Scalars['ID']['input'];
-  isUsed?: InputMaybe<Scalars['GraphQLBoolean']['input']>;
-  redirectUri?: InputMaybe<Scalars['GraphQLString']['input']>;
-  scopes?: InputMaybe<Scalars['JSON']['input']>;
-};
-
-export type OAuthUpdateAuthorizationCodesInput = {
-  accountId?: InputMaybe<Scalars['ID']['input']>;
-  clientId?: InputMaybe<Scalars['ID']['input']>;
-  code?: InputMaybe<Scalars['GraphQLString']['input']>;
-  codeChallenge?: InputMaybe<Scalars['GraphQLString']['input']>;
-  codeChallengeMethod?: InputMaybe<Scalars['GraphQLString']['input']>;
-  expiresAt?: InputMaybe<Scalars['GraphQLTimestamp']['input']>;
-  id?: InputMaybe<Scalars['ID']['input']>;
-  isUsed?: InputMaybe<Scalars['GraphQLBoolean']['input']>;
-  redirectUri?: InputMaybe<Scalars['GraphQLString']['input']>;
-  scopes?: InputMaybe<Scalars['JSON']['input']>;
-};
-
-export type OAuthUpdateClientByIdInput = {
-  accessTokenLifetimeSeconds?: InputMaybe<Scalars['GraphQLInt']['input']>;
-  applicationIds?: InputMaybe<Array<InputMaybe<Scalars['ID']['input']>>>;
-  authUrl?: InputMaybe<Scalars['GraphQLString']['input']>;
-  grantType?: InputMaybe<OAuthClientGrantTypeEnum>;
-  id: Scalars['ID']['input'];
-  isActive?: InputMaybe<Scalars['GraphQLBoolean']['input']>;
-  isMaster?: InputMaybe<Scalars['GraphQLBoolean']['input']>;
-  name?: InputMaybe<Scalars['GraphQLString']['input']>;
-  redirect?: InputMaybe<Scalars['GraphQLString']['input']>;
-  refreshTokenLifetimeSeconds?: InputMaybe<Scalars['GraphQLInt']['input']>;
-  scopeOptions?: InputMaybe<Array<InputMaybe<Scalars['GraphQLString']['input']>>>;
-  secret?: InputMaybe<Scalars['GraphQLString']['input']>;
-};
-
-export type OAuthUpdateClientsInput = {
-  accessTokenLifetimeSeconds?: InputMaybe<Scalars['GraphQLInt']['input']>;
-  applicationIds?: InputMaybe<Array<InputMaybe<Scalars['ID']['input']>>>;
-  authUrl?: InputMaybe<Scalars['GraphQLString']['input']>;
-  grantType?: InputMaybe<OAuthClientGrantTypeEnum>;
-  id?: InputMaybe<Scalars['ID']['input']>;
-  isActive?: InputMaybe<Scalars['GraphQLBoolean']['input']>;
-  isMaster?: InputMaybe<Scalars['GraphQLBoolean']['input']>;
-  name?: InputMaybe<Scalars['GraphQLString']['input']>;
-  redirect?: InputMaybe<Scalars['GraphQLString']['input']>;
-  refreshTokenLifetimeSeconds?: InputMaybe<Scalars['GraphQLInt']['input']>;
-  scopeOptions?: InputMaybe<Array<InputMaybe<Scalars['GraphQLString']['input']>>>;
-  secret?: InputMaybe<Scalars['GraphQLString']['input']>;
-};
-
-export type OAuthUpdateRefreshTokenByIdInput = {
-  accessTokenId?: InputMaybe<Scalars['ID']['input']>;
-  expiresAt?: InputMaybe<Scalars['GraphQLTimestamp']['input']>;
-  id: Scalars['ID']['input'];
-  isRevoked?: InputMaybe<Scalars['GraphQLBoolean']['input']>;
-  token?: InputMaybe<Scalars['GraphQLString']['input']>;
-};
-
-export type OAuthUpdateRefreshTokensInput = {
-  accessTokenId?: InputMaybe<Scalars['ID']['input']>;
-  expiresAt?: InputMaybe<Scalars['GraphQLTimestamp']['input']>;
-  id?: InputMaybe<Scalars['ID']['input']>;
-  isRevoked?: InputMaybe<Scalars['GraphQLBoolean']['input']>;
-  token?: InputMaybe<Scalars['GraphQLString']['input']>;
-};
-
-export type OAuthUpdateScopeByIdInput = {
-  code?: InputMaybe<Scalars['GraphQLString']['input']>;
-  id: Scalars['ID']['input'];
-  name?: InputMaybe<Scalars['GraphQLString']['input']>;
-  roleIds?: InputMaybe<Array<InputMaybe<Scalars['ID']['input']>>>;
-};
-
-export type OAuthUpdateScopesInput = {
-  code?: InputMaybe<Scalars['GraphQLString']['input']>;
-  id?: InputMaybe<Scalars['ID']['input']>;
-  name?: InputMaybe<Scalars['GraphQLString']['input']>;
-  roleIds?: InputMaybe<Array<InputMaybe<Scalars['ID']['input']>>>;
-};
-
-export type Pagination = {
-  __typename?: 'Pagination';
-  /** Number of items filtered according to query */
-  count: Scalars['GraphQLInt']['output'];
-  /** Query object data */
-  rows: Array<Maybe<Scalars['JSON']['output']>>;
-  /** Total possible objects displayed */
-  total: Scalars['GraphQLInt']['output'];
-};
-
-export type Query = {
-  __typename?: 'Query';
-  coreGetBase64FromFile?: Maybe<Scalars['GraphQLString']['output']>;
-  coreGetFallbackLang?: Maybe<CoreLang>;
-  coreGetLangs: Array<Maybe<CoreLang>>;
-  coreGetSearchKeyLang?: Maybe<CoreSearchKeyLang>;
-  hello?: Maybe<Scalars['String']['output']>;
-  iamCheckPasswordMeAccount: Array<Maybe<IamAccount>>;
-  iamCheckUniqueEmailAccount: Scalars['Boolean']['output'];
-  iamCheckUniqueUsernameAccount: Scalars['Boolean']['output'];
-  iamFindAccount?: Maybe<IamAccount>;
-  iamFindAccountById?: Maybe<IamAccount>;
-  iamFindBoundedContext?: Maybe<IamBoundedContext>;
-  iamFindBoundedContextById?: Maybe<IamBoundedContext>;
-  iamFindPermission?: Maybe<IamPermission>;
-  iamFindPermissionById?: Maybe<IamPermission>;
-  iamFindPermissionRole?: Maybe<IamPermissionRole>;
-  iamFindPermissionRoleById?: Maybe<IamPermissionRole>;
-  iamFindRole?: Maybe<IamRole>;
-  iamFindRoleAccount?: Maybe<IamRoleAccount>;
-  iamFindRoleAccountById?: Maybe<IamRoleAccount>;
-  iamFindRoleById?: Maybe<IamRole>;
-  iamFindTag?: Maybe<IamTag>;
-  iamFindTagById?: Maybe<IamTag>;
-  iamFindTenant?: Maybe<IamTenant>;
-  iamFindTenantAccount?: Maybe<IamTenantAccount>;
-  iamFindTenantAccountById?: Maybe<IamTenantAccount>;
-  iamFindTenantById?: Maybe<IamTenant>;
-  iamFindUser?: Maybe<IamUser>;
-  iamFindUserById?: Maybe<IamUser>;
-  iamGetAccounts: Array<Maybe<IamAccount>>;
-  iamGetBoundedContexts: Array<Maybe<IamBoundedContext>>;
-  iamGetPermissions: Array<Maybe<IamPermission>>;
-  iamGetPermissionsRoles: Array<Maybe<IamPermissionRole>>;
-  iamGetRoles: Array<Maybe<IamRole>>;
-  iamGetRolesAccounts: Array<Maybe<IamRoleAccount>>;
-  iamGetTags: Array<Maybe<IamTag>>;
-  iamGetTenants: Array<Maybe<IamTenant>>;
-  iamGetTenantsAccounts: Array<Maybe<IamTenantAccount>>;
-  iamGetUsers: Array<Maybe<IamUser>>;
-  iamGetWithTenantConstraintTenants: Array<Maybe<IamTenant>>;
-  iamMeAccount: IamAccount;
-  iamPaginateAccounts: Pagination;
-  iamPaginateBoundedContexts: Pagination;
-  iamPaginatePermissions: Pagination;
-  iamPaginatePermissionsRoles: Pagination;
-  iamPaginateRoles: Pagination;
-  iamPaginateRolesAccounts: Pagination;
-  iamPaginateTags: Pagination;
-  iamPaginateTenants: Pagination;
-  iamPaginateTenantsAccounts: Pagination;
-  iamPaginateUsers: Pagination;
-  iamPaginateWithTenantConstraintAccounts: Array<Maybe<IamAccount>>;
-  iamPaginateWithTenantConstraintTenants: Array<Maybe<IamTenant>>;
-  libraryFindBook?: Maybe<LibraryBook>;
-  libraryFindBookById?: Maybe<LibraryBook>;
-  libraryGetBooks: Array<Maybe<LibraryBook>>;
-  libraryGetRawBooks?: Maybe<Scalars['Any']['output']>;
-  libraryPaginateBooks: Pagination;
-  oAuthFindAccessToken?: Maybe<OAuthAccessToken>;
-  oAuthFindAccessTokenById?: Maybe<OAuthAccessToken>;
-  oAuthFindApplication?: Maybe<OAuthApplication>;
-  oAuthFindApplicationById?: Maybe<OAuthApplication>;
-  oAuthFindApplicationClient?: Maybe<OAuthApplicationClient>;
-  oAuthFindApplicationClientById?: Maybe<OAuthApplicationClient>;
-  oAuthFindAuthorizationCode?: Maybe<OAuthAuthorizationCode>;
-  oAuthFindAuthorizationCodeById?: Maybe<OAuthAuthorizationCode>;
-  oAuthFindClient?: Maybe<OAuthClient>;
-  oAuthFindClientById?: Maybe<OAuthClient>;
-  oAuthFindCredential?: Maybe<OAuthCredential>;
-  oAuthFindCredentialById?: Maybe<OAuthCredential>;
-  oAuthFindRefreshToken?: Maybe<OAuthRefreshToken>;
-  oAuthFindRefreshTokenById?: Maybe<OAuthRefreshToken>;
-  oAuthFindScope?: Maybe<OAuthScope>;
-  oAuthFindScopeById?: Maybe<OAuthScope>;
-  oAuthGetAccessTokens: Array<Maybe<OAuthAccessToken>>;
-  oAuthGetApplications: Array<Maybe<OAuthApplication>>;
-  oAuthGetApplicationsClients: Array<Maybe<OAuthApplicationClient>>;
-  oAuthGetAuthorizationCodes: Array<Maybe<OAuthAuthorizationCode>>;
-  oAuthGetClients: Array<Maybe<OAuthClient>>;
-  oAuthGetCredentials: Array<Maybe<OAuthCredential>>;
-  oAuthGetRefreshTokens: Array<Maybe<OAuthRefreshToken>>;
-  oAuthGetScopes: Array<Maybe<OAuthScope>>;
-  oAuthPaginateAccessTokens: Pagination;
-  oAuthPaginateApplications: Pagination;
-  oAuthPaginateApplicationsClients: Pagination;
-  oAuthPaginateAuthorizationCodes: Pagination;
-  oAuthPaginateClients: Pagination;
-  oAuthPaginateCredentials: Pagination;
-  oAuthPaginateRefreshTokens: Pagination;
-  oAuthPaginateScopes: Pagination;
-};
-
-
-export type QueryCoreGetBase64FromFileArgs = {
-  filename: Scalars['GraphQLString']['input'];
-  relativePathSegments: Array<Scalars['GraphQLString']['input']>;
-};
-
-
-export type QueryIamCheckPasswordMeAccountArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryIamCheckUniqueEmailAccountArgs = {
-  avoidEmails?: InputMaybe<Array<Scalars['String']['input']>>;
-  email: Scalars['String']['input'];
-};
-
-
-export type QueryIamCheckUniqueUsernameAccountArgs = {
-  avoidUsernames?: InputMaybe<Array<Scalars['String']['input']>>;
-  username: Scalars['String']['input'];
-};
-
-
-export type QueryIamFindAccountArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryIamFindAccountByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  id?: InputMaybe<Scalars['ID']['input']>;
-};
-
-
-export type QueryIamFindBoundedContextArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryIamFindBoundedContextByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  id?: InputMaybe<Scalars['ID']['input']>;
-};
-
-
-export type QueryIamFindPermissionArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryIamFindPermissionByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  id?: InputMaybe<Scalars['ID']['input']>;
-};
-
-
-export type QueryIamFindPermissionRoleArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryIamFindPermissionRoleByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  permissionId?: InputMaybe<Scalars['ID']['input']>;
-  roleId?: InputMaybe<Scalars['ID']['input']>;
-};
-
-
-export type QueryIamFindRoleArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryIamFindRoleAccountArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryIamFindRoleAccountByIdArgs = {
-  accountId?: InputMaybe<Scalars['ID']['input']>;
-  constraint?: InputMaybe<QueryStatement>;
-  roleId?: InputMaybe<Scalars['ID']['input']>;
-};
-
-
-export type QueryIamFindRoleByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  id?: InputMaybe<Scalars['ID']['input']>;
-};
-
-
-export type QueryIamFindTagArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryIamFindTagByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  id?: InputMaybe<Scalars['ID']['input']>;
-};
-
-
-export type QueryIamFindTenantArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryIamFindTenantAccountArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryIamFindTenantAccountByIdArgs = {
-  accountId?: InputMaybe<Scalars['ID']['input']>;
-  constraint?: InputMaybe<QueryStatement>;
-  tenantId?: InputMaybe<Scalars['ID']['input']>;
-};
-
-
-export type QueryIamFindTenantByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  id?: InputMaybe<Scalars['ID']['input']>;
-};
-
-
-export type QueryIamFindUserArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryIamFindUserByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  id?: InputMaybe<Scalars['ID']['input']>;
-};
-
-
-export type QueryIamGetAccountsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryIamGetBoundedContextsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryIamGetPermissionsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryIamGetPermissionsRolesArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryIamGetRolesArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryIamGetRolesAccountsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryIamGetTagsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryIamGetTenantsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryIamGetTenantsAccountsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryIamGetUsersArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryIamGetWithTenantConstraintTenantsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryIamPaginateAccountsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryIamPaginateBoundedContextsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryIamPaginatePermissionsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryIamPaginatePermissionsRolesArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryIamPaginateRolesArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryIamPaginateRolesAccountsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryIamPaginateTagsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryIamPaginateTenantsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryIamPaginateTenantsAccountsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryIamPaginateUsersArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryIamPaginateWithTenantConstraintAccountsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryIamPaginateWithTenantConstraintTenantsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryLibraryFindBookArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryLibraryFindBookByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  id?: InputMaybe<Scalars['ID']['input']>;
-};
-
-
-export type QueryLibraryGetBooksArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryLibraryGetRawBooksArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryLibraryPaginateBooksArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryOAuthFindAccessTokenArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryOAuthFindAccessTokenByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  id?: InputMaybe<Scalars['ID']['input']>;
-};
-
-
-export type QueryOAuthFindApplicationArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryOAuthFindApplicationByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  id?: InputMaybe<Scalars['ID']['input']>;
-};
-
-
-export type QueryOAuthFindApplicationClientArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryOAuthFindApplicationClientByIdArgs = {
-  applicationId?: InputMaybe<Scalars['ID']['input']>;
-  clientId?: InputMaybe<Scalars['ID']['input']>;
-  constraint?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryOAuthFindAuthorizationCodeArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryOAuthFindAuthorizationCodeByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  id?: InputMaybe<Scalars['ID']['input']>;
-};
-
-
-export type QueryOAuthFindClientArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryOAuthFindClientByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  id?: InputMaybe<Scalars['ID']['input']>;
-};
-
-
-export type QueryOAuthFindCredentialArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryOAuthFindCredentialByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  id?: InputMaybe<Scalars['ID']['input']>;
-};
-
-
-export type QueryOAuthFindRefreshTokenArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryOAuthFindRefreshTokenByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  id?: InputMaybe<Scalars['ID']['input']>;
-};
-
-
-export type QueryOAuthFindScopeArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryOAuthFindScopeByIdArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  id?: InputMaybe<Scalars['ID']['input']>;
-};
-
-
-export type QueryOAuthGetAccessTokensArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryOAuthGetApplicationsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryOAuthGetApplicationsClientsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryOAuthGetAuthorizationCodesArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryOAuthGetClientsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryOAuthGetCredentialsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryOAuthGetRefreshTokensArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryOAuthGetScopesArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryOAuthPaginateAccessTokensArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryOAuthPaginateApplicationsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryOAuthPaginateApplicationsClientsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryOAuthPaginateAuthorizationCodesArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryOAuthPaginateClientsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryOAuthPaginateCredentialsArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryOAuthPaginateRefreshTokensArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-
-export type QueryOAuthPaginateScopesArgs = {
-  constraint?: InputMaybe<QueryStatement>;
-  query?: InputMaybe<QueryStatement>;
-};
-
-/**
- * -----------------------------------------------------------------------------
- * # QueryStatement → Query Options (How-To)
- * -----------------------------------------------------------------------------
- * It explains how to express Sequelize queries through your GraphQL input:
- *
- * ```graphql
- * input QueryStatement {
- *   where: JSON
- *   attributes: JSON
- *   include: [GraphQLString]
- *   order: JSON
- *   group: JSON
- *   limit: GraphQLInt
- *   offset: GraphQLInt
- *   distinct: GraphQLBoolean
- *   col: GraphQLString
- * }
- * ```
- *
- * ## GENERAL NOTES
- * - **WHERE operators**: Sequelize uses Symbol operators (e.g., `[Op.gte]`) but the API must use _stringified_ keys wrapped in brackets, e.g. `"[gte]"`, `"[or]"`.
- *   ```json
- *   { "where": { "age": { "[gte]": 18 } } }
- *   ```
- * - **INCLUDE**: Prefer association names:
- *   ```json
- *   { "include": [ { "association": "tableToRelate" } ] }
- *   ```
- *   You can nest includes, add `where`/`attributes`/`required` per-include, etc.
- * - **DIALECTS**: Some operators (`iLike`, `regexp`, array containment) are dialect-specific.
- *
- * # WHERE — Filtering
- * Combine field predicates and logical operators.
- *
- * ### Logical combinations
- * ```json
- * {
- *   "where": {
- *     "[and]": [
- *       { "status": "active" },
- *       { "age": { "[gte]": 18 } }
- *     ]
- *   }
- * }
- * ```
- *
- * Other forms:
- * ```json
- * { "where": { "[or]": [ { "role": "admin" }, { "role": "editor" } ] } }
- * { "where": { "[not]": { "deletedAt": { "[ne]": null } } } }
- * ```
- *
- * Supported: `[and]`, `[or]`, `[not]`.
- *
- * ### Filtering on included associations
- * When you use include to join related tables, you can filter on fields of the included association directly from the top-level where using path syntax.
- * This requires wrapping the association and field name in $...$.
- *
- * Example: filter by a field of an included association:
- * ```json
- * {
- *   "include": [ { "association": "tableToRelate" } ],
- *   "where": { "$tableToRelate.name$": "nameToSearch" }
- * }
- * ```
- * This will generate a condition on the name column of the tableToRelate join.
- *
- * ### Disambiguating columns with the same name
- * If both the root table and the included association contain columns with the same name, you must qualify the column with its table (or alias) inside $...$ to avoid ambiguity.
- *
- * Example:
- * ```json
- * {
- *   "include": [ { "association": "tableToRelate" } ],
- *   "where": { "$TableToRelate.name$": "nameToSearch" }
- * }
- * ```
- * This makes sure the condition applies to the name column of the TableToRelate table instead of the root table.
- *
- * Conclusion:
- * When performing queries with include joins, you can target columns of either the root table or the included tables by wrapping the table/association name and column in $...$.
- * Use the association alias defined in the include or the actual table name to fully control filtering across joined tables.
- *
- * ### Equality & nulls
- * ```json
- * { "where": { "id": 123 } }
- * { "where": { "id": { "[eq]": 123 } } }
- * { "where": { "tenantId": { "[ne]": "public" } } }
- * { "where": { "deletedAt": { "[is]": null } } }
- * ```
- *
- * Supported: `[eq]`, `[ne]`, `[is]`.
- *
- * ### Comparisons (numbers/dates)
- * ```json
- * { "where": { "price": { "[gt]": 10 } } }
- * { "where": { "price": { "[gte]": 10, "[lte]": 100 } } }
- * { "where": { "createdAt": { "[lt]": "2025-01-01T00:00:00Z" } } }
- * ```
- *
- * Supported: `[gt]`, `[gte]`, `[lt]`, `[lte]`.
- *
- * ### Ranges
- * ```json
- * { "where": { "score": { "[between]": [70, 90] } } }
- * { "where": { "score": { "[notBetween]": [0, 10] } } }
- * ```
- *
- * Supported: `[between]`, `[notBetween]`.
- *
- * ### Sets (IN / NOT IN)
- * ```json
- * { "where": { "status": { "[in]": ["draft", "published"] } } }
- * { "where": { "status": { "[notIn]": ["archived"] } } }
- * ```
- *
- * Supported: `[in]`, `[notIn]`.
- *
- * ### Pattern matching (strings)
- * ```json
- * { "where": { "name": { "[like]": "%desk%" } } }
- * { "where": { "name": { "[notLike]": "Admin%" } } }
- * { "where": { "name": { "[iLike]": "%madrid%" } } }
- * { "where": { "name": { "[notILike]": "TEST%" } } }
- * { "where": { "name": { "[startsWith]": "Pro" } } }
- * { "where": { "name": { "[endsWith]": "Max" } } }
- * { "where": { "name": { "[substring]": "Air" } } }
- * { "where": { "sku":  { "[regexp]": "^[A-Z]{3}-[0-9]+$" } } }
- * { "where": { "sku":  { "[notRegexp]": "test" } } }
- * { "where": { "sku":  { "[iRegexp]": "abc" } } }
- * { "where": { "sku":  { "[notIRegexp]": "xyz" } } }
- * ```
- *
- * Supported: `[like]`, `[notLike]`, `[iLike]`, `[notILike]`, `[startsWith]`, `[endsWith]`, `[substring]`, `[regexp]`, `[notRegexp]`, `[iRegexp]`, `[notIRegexp]`.
- *
- * ### Column vs column
- * ```json
- * { "where": { "updatedAt": { "[col]": "createdAt" } } }
- * ```
- *
- * ### Arrays
- * ```json
- * { "where": { "tags": { "[overlap]": ["react", "node"] } } }
- * { "where": { "tags": { "[contains]": ["graphql"] } } }
- * { "where": { "roles": { "[any]": ["admin", "editor"] } } }
- * ```
- *
- * # INCLUDE — Eager Loading Associations
- * Recommended shape:
- * ```json
- * { "include": [ { "association": "tableToRelate" } ] }
- * ```
- *
- * Include with filters:
- * ```json
- * {
- *   "include": [
- *     {
- *       "association": "fleetAircraft",
- *       "attributes": ["id", "registration"],
- *       "where": { "status": "active" },
- *       "required": true
- *     }
- *   ]
- * }
- * ```
- *
- * - where inside an include turns the join into a filter on the associated table.
- * - required: true makes it an INNER JOIN (exclude parents without a matching child, default is left join).
- * - attributes inside an include limits columns of the associated model.
- *
- * Nested includes:
- * ```json
- * {
- *   "include": [
- *     {
- *       "association": "fleetAircraft",
- *       "include": [
- *         { "association": "aircraftModel" }
- *       ]
- *     }
- *   ]
- * }
- * ```
- *
- * You can also rely on { "include": { "all": true, "nested": true } }
- * (when building queries in code) to include everything recursively.
- * In your API, prefer explicit association names for control and safety.
- *
- * Many-to-many specifics:
- * ```json
- * {
- *   "include": [
- *     {
- *       "association": "userRoles",
- *       "through": { "attributes": ["assignedAt"] }
- *     }
- *   ]
- * }
- * ```
- *
- * Ordering & limiting with includes
- * - You can order by included fields using top-level `order` with a path
- *   (see ORDER section below).
- * - Limiting rows inside a hasMany include requires `separate: true` on that
- *   include in Sequelize (code-level option). If you need this behavior, mirror
- *   it in your API contract; otherwise limits apply at the root result set.
- *
- * ---
- *
- * # ATTRIBUTES — Projection / computed fields
- * The attributes option defines which columns should be returned in the query result.
- * By default, Sequelize selects all columns from the model. With attributes, you can:
- * - Include only specific columns (whitelist).
- * - Exclude specific columns (blacklist).
- * - Rename (alias) columns.
- * - Add computed or aggregated fields using Sequelize functions (fn, col, literal).
- *
- * Select, alias, and compute:
- * ```json
- * {
- *   "attributes": [
- *     "id",
- *     "name",
- *     ["email", "contactEmail"],  // alias
- *     { "fn": "count", "col": "orders.id", "as": "orderCount" }, // aggregate
- *     { "literal": "NOW()", "as": "now" }  // raw SQL literal (use with care)
- *   ]
- * }
- * ```
- *
- * Exclude shape:
- * ```json
- * { "attributes": { "exclude": ["password", "secretToken"] } }
- * ```
- *
- * Notes
- * - `fn`, `col`, `cast`, and `literal` expressions are supported by Sequelize.
- * - Aggregates typically pair with `group`.
- *
- * ---
- *
- * # ORDER — Sorting
- * The order option defines the sort order of the query result set.
- * It accepts an array of sorting rules. Each rule specifies a column (or expression) and the direction (ASC for ascending, DESC for descending).
- *
- * Simple:
- * ```json
- * { "order": [["createdAt", "DESC"]] }
- * { "order": [["name", "ASC"], ["id", "DESC"]] }
- * ```
- * Order by an included model field (path syntax):
- * ```json
- * { "order": [["$fleetAircraft.registration$", "ASC"]] }
- * ```
- * Order by a function:
- * ```json
- * { "order": [[{ "fn": "lower", "col": "name" }, "ASC"]] }
- * ```
- *
- * ---
- *
- * # GROUP — Aggregation
- * The group option is used to aggregate rows in the result set, similar to the SQL GROUP BY clause.
- * It is typically combined with aggregate functions in the attributes field (e.g., COUNT, SUM, AVG).
- *
- * Group by columns/expressions (use with aggregates in attributes):
- * ```json
- * {
- *   "attributes": [
- *     "status",
- *     { "fn": "count", "col": "*", "as": "cnt" }
- *   ],
- *   "group": ["status"],
- *   "order": [["status", "ASC"]]
- * }
- * ```
- *
- * ---
- *
- * # LIMIT / OFFSET — Pagination
- * The limit and offset options are used to control pagination in query results.
- * They correspond to SQL’s LIMIT and OFFSET clauses.
- * - limit → maximum number of rows to return.
- * - offset → number of rows to skip before starting to return results.
- * ```json
- * { "limit": 20, "offset": 40 }
- * ```
- * Notes
- * - With hasMany includes, root rows can duplicate due to joins; use
- *   `"distinct": true` (and optionally `"col": "id"`) when counting.
- * - Per-include limiting needs `separate: true` on that include (code-level).
- *
- * ---
- *
- * # DISTINCT & COL — Counting
- * The distinct option ensures that query results (and counts) are unique, preventing duplicates that may appear when joining associated tables.
- * It corresponds to SQL DISTINCT keyword.
- * ```json
- * { "distinct": true, "col": "id" }
- * ```
- * Notes
- * - `distinct: true` applies COUNT(DISTINCT ...) on the PK (or on `col`).
- * - Use to avoid inflated counts caused by JOINs when using findAndCountAll.
- *
- * ---
- *
- * # END-TO-END EXAMPLES
- * ### Example 1, Active engines with aircraft ordered by registration
- * ```json
- * {
- *   "where": { "status": "active" },
- *   "include": [
- *     {
- *       "association": "fleetAircraft",
- *       "attributes": ["id", "registration"],
- *       "where": { "registration": { "[notLike]": "TEST%" } },
- *       "required": true
- *     }
- *   ],
- *   "order": [["$fleetAircraft.registration$", "ASC"]],
- *   "limit": 50,
- *   "offset": 0,
- *   "distinct": true
- * }
- * ```
- *
- * ### Example 2, Case-insensitive search + range + nested include
- * ```json
- * {
- *   "where": {
- *     "[and]": [
- *       { "name": { "[iLike]": "%aion%" } },
- *       { "createdAt": { "[between]": ["2025-01-01", "2025-12-31"] } }
- *     ]
- *   },
- *   "include": [
- *     { "association": "engineModel", "attributes": ["id", "name"] },
- *     {
- *       "association": "fleetAircraft",
- *       "include": [
- *         { "association": "aircraftModel", "attributes": ["code", "name"] }
- *       ]
- *     }
- *   ],
- *   "order": [["createdAt", "DESC"]]
- * }
- * ```
- *
- * ### Example 2, Aggregation with group
- * ```json
- * {
- *   "attributes": [
- *     "status",
- *     { "fn": "count", "col": "*", "as": "total" }
- *   ],
- *   "group": ["status"],
- *   "order": [["status", "ASC"]]
- * }
- * ```
- *
- * ---
- *
- * # OPERATOR REFERENCE
- * - **Logical**:      [and], [or], [not]
- * - **Equality**:     [eq], [ne], [is]
- * - **Comparison**:   [gt], [gte], [lt], [lte]
- * - **Ranges**:       [between], [notBetween]
- * - **Sets**:         [in], [notIn]
- * - **Patterns**:     [like], [notLike], [iLike], [notILike],
- *                     [startsWith], [endsWith], [substring],
- *                     [regexp], [notRegexp], [iRegexp], [notIRegexp]
- * - **Column ref**:   [col]
- * - **Arrays**:       [overlap], [contains], [contained], [any]
- */
-export type QueryStatement = {
-  attributes?: InputMaybe<Scalars['JSON']['input']>;
-  col?: InputMaybe<Scalars['GraphQLString']['input']>;
-  distinct?: InputMaybe<Scalars['GraphQLBoolean']['input']>;
-  group?: InputMaybe<Scalars['JSON']['input']>;
-  having?: InputMaybe<Scalars['Any']['input']>;
-  include?: InputMaybe<Scalars['JSON']['input']>;
-  indexHints?: InputMaybe<Scalars['JSON']['input']>;
-  limit?: InputMaybe<Scalars['GraphQLInt']['input']>;
-  lock?: InputMaybe<Scalars['Any']['input']>;
-  offset?: InputMaybe<Scalars['GraphQLInt']['input']>;
-  order?: InputMaybe<Scalars['JSON']['input']>;
-  raw?: InputMaybe<Scalars['GraphQLBoolean']['input']>;
-  skipLocked?: InputMaybe<Scalars['GraphQLBoolean']['input']>;
-  subQuery?: InputMaybe<Scalars['GraphQLBoolean']['input']>;
-  where?: InputMaybe<Scalars['JSON']['input']>;
-};