@authowl/core 0.11.0 → 0.13.0

package/dist/server.d.ts

@@ -1,5 +1,6 @@
-import { O as OrganizationMembership, a as TransportErrorKind, H as HasParams } from './transport-BObDKlIh.js';
-export { A as AuthConfig, R as ResolvedAuthConfig, r as resolveConfig, s as sessionCookieName } from './transport-BObDKlIh.js';
+import { O as OrganizationMembership, H as HasParams } from './organization-membership-B3m6PbmO.js';
+export { A as AuthConfig, R as ResolvedAuthConfig, r as resolveConfig, s as sessionCookieName } from './organization-membership-B3m6PbmO.js';
+import { a as TransportErrorKind } from './transport-DcWDTRd4.js';
 
 /**
  * Stateless verification of an AuthOwl project JWT for SERVER-side authorization
@@ -89,7 +90,10 @@ interface paths {
         };
         readonly get?: never;
         readonly put?: never;
-        /** Start a project user export */
+        /**
+         * Start an ordinary project user export
+         * @description Creates a queued CSV or NDJSON export without password hashes. The artifact is generated by the user-export processor and expires after 24 hours.
+         */
         readonly post: operations["startUserExport"];
         readonly delete?: never;
         readonly options?: never;
@@ -97,6 +101,180 @@ interface paths {
         readonly patch?: never;
         readonly trace?: never;
     };
+    readonly "/users/export/{exportId}": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly exportId: components["parameters"]["ExportId"];
+            };
+            readonly cookie?: never;
+        };
+        /** Get an ordinary user export */
+        readonly get: operations["getUserExport"];
+        readonly put?: never;
+        readonly post?: never;
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/users/export/{exportId}/download": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly exportId: components["parameters"]["ExportId"];
+            };
+            readonly cookie?: never;
+        };
+        /** Download an ordinary user export */
+        readonly get: operations["downloadUserExport"];
+        readonly put?: never;
+        readonly post?: never;
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/users/export/hashes": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly get?: never;
+        readonly put?: never;
+        /**
+         * Start a password-hash user export
+         * @description Requires a dedicated secret key whose only scope is users:export_hashes plus a one-time approval created by a freshly reauthenticated workspace owner.
+         */
+        readonly post: operations["startPasswordHashUserExport"];
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/users/export/hashes/{exportId}": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly exportId: components["parameters"]["ExportId"];
+            };
+            readonly cookie?: never;
+        };
+        /** Get a password-hash export */
+        readonly get: operations["getPasswordHashUserExport"];
+        readonly put?: never;
+        readonly post?: never;
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/users/export/hashes/{exportId}/download": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly exportId: components["parameters"]["ExportId"];
+            };
+            readonly cookie?: never;
+        };
+        /** Download a password-hash export */
+        readonly get: operations["downloadPasswordHashUserExport"];
+        readonly put?: never;
+        readonly post?: never;
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/imports/dry-run": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly get?: never;
+        readonly put?: never;
+        /**
+         * Validate a canonical user import stream without writing users
+         * @description The first NDJSON line must be an authowl.user-import.v1 manifest. Every following line must be one canonical user record. Provider-specific exports must be converted by a CLI or dashboard adapter before reaching this endpoint.
+         */
+        readonly post: operations["dryRunUserImport"];
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/imports": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly get?: never;
+        readonly put?: never;
+        /**
+         * Import a canonical user stream
+         * @description Valid rows are written under row-level savepoints. Validation and identity conflicts are retained in the downloadable report. Reusing the same source provider, namespace, and external id updates the same AuthOwl user.
+         */
+        readonly post: operations["createUserImport"];
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/imports/{importId}": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly importId: components["parameters"]["ImportId"];
+            };
+            readonly cookie?: never;
+        };
+        /** Get an import batch */
+        readonly get: operations["getUserImport"];
+        readonly put?: never;
+        readonly post?: never;
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/imports/{importId}/report": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly importId: components["parameters"]["ImportId"];
+            };
+            readonly cookie?: never;
+        };
+        /** Download an import result report */
+        readonly get: operations["downloadUserImportReport"];
+        readonly put?: never;
+        readonly post?: never;
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
     readonly "/users/{userId}": {
         readonly parameters: {
             readonly query?: never;
@@ -354,6 +532,46 @@ interface paths {
         readonly patch?: never;
         readonly trace?: never;
     };
+    readonly "/messages": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        /** List privacy-safe message deliveries */
+        readonly get: operations["listMessages"];
+        readonly put?: never;
+        /**
+         * Queue one transactional message
+         * @description Requires a dedicated secret key whose only scope is messages:send. The provider and credential ownership remain server-side routing concerns.
+         */
+        readonly post: operations["sendMessage"];
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
+    readonly "/messages/{messageId}": {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly messageId: string;
+            };
+            readonly cookie?: never;
+        };
+        /** Get one privacy-safe message delivery */
+        readonly get: operations["getMessage"];
+        readonly put?: never;
+        readonly post?: never;
+        readonly delete?: never;
+        readonly options?: never;
+        readonly head?: never;
+        readonly patch?: never;
+        readonly trace?: never;
+    };
     readonly "/events": {
         readonly parameters: {
             readonly query?: never;
@@ -618,6 +836,73 @@ interface components {
             readonly phone?: string | null;
             readonly banned?: boolean;
         };
+        readonly ImportDryRun: {
+            /** Format: uuid */
+            readonly id: string;
+            /** @constant */
+            readonly mode: "dry_run";
+            /** @constant */
+            readonly status: "validated";
+            /** @constant */
+            readonly schema_version: "authowl.user-import.v1";
+            readonly source: {
+                /** @enum {string} */
+                readonly provider: "clerk" | "auth0" | "firebase" | "supabase" | "authowl" | "custom";
+                readonly namespace: string;
+                readonly version: string | null;
+            };
+            readonly counts: {
+                readonly total: number;
+                readonly valid: number;
+                readonly invalid: number;
+            };
+            readonly bytes_received: number;
+            readonly errors_truncated: boolean;
+            readonly errors: readonly {
+                readonly line: number;
+                /** @enum {string} */
+                readonly code: "INVALID_JSON" | "UNEXPECTED_RECORD" | "INVALID_USER" | "DUPLICATE_EXTERNAL_ID";
+                readonly path: string | null;
+                readonly message: string;
+            }[];
+            /** Format: date-time */
+            readonly created_at: string;
+            /** Format: date-time */
+            readonly completed_at: string;
+        };
+        readonly ImportBatch: {
+            /** Format: uuid */
+            readonly id: string;
+            /** @constant */
+            readonly mode: "commit";
+            /** @constant */
+            readonly status: "completed";
+            /** @constant */
+            readonly schema_version: "authowl.user-import.v1";
+            readonly source: {
+                /** @enum {string} */
+                readonly provider: "clerk" | "auth0" | "firebase" | "supabase" | "authowl" | "custom";
+                readonly namespace: string;
+                readonly version: string | null;
+            };
+            readonly counts: {
+                readonly total: number;
+                readonly valid: number;
+                readonly invalid: number;
+                readonly created: number;
+                readonly updated: number;
+                readonly unchanged: number;
+                readonly failed: number;
+            };
+            readonly bytes_received: number;
+            readonly errors_truncated: boolean;
+            /** Format: date-time */
+            readonly report_expires_at: string;
+            /** Format: date-time */
+            readonly created_at: string;
+            /** Format: date-time */
+            readonly completed_at: string;
+        };
         /** @description JSON metadata object. Reserved prototype keys and the authowl_ prefix are rejected at every depth. Encoded object size is limited to 8192 bytes. */
         readonly MetadataObject: {
             readonly [key: string]: unknown;
@@ -737,10 +1022,71 @@ interface components {
             readonly description?: string;
             readonly events: readonly components["schemas"]["WebhookSubscriptionEventType"][];
         };
+        readonly SendMessage: {
+            readonly to: string;
+            /**
+             * @description Defaults to auto.
+             * @enum {string}
+             */
+            readonly channel?: "sms" | "whatsapp" | "auto";
+            /**
+             * @description Defaults to transactional.
+             * @enum {string}
+             */
+            readonly purpose?: "transactional";
+            readonly template: string;
+            /**
+             * @description Defaults to en.
+             * @enum {string}
+             */
+            readonly locale?: "en" | "ar";
+            readonly variables: {
+                readonly [key: string]: string;
+            };
+            readonly customerReference?: string;
+        };
         /** @enum {string} */
-        readonly WebhookSubscriptionEventType: "user.created" | "user.updated" | "user.deleted" | "user.banned" | "session.created" | "session.updated" | "session.revoked" | "organization.created" | "organization.updated" | "organization.deleted" | "organization_membership.created" | "organization_membership.deleted" | "mfa.enrolled" | "mfa.reset";
+        readonly MessageState: "preparing" | "queued" | "accepted" | "skipped" | "delivered" | "failed" | "unknown" | "canceled";
+        readonly Message: {
+            /** Format: uuid */
+            readonly id: string;
+            readonly state: components["schemas"]["MessageState"];
+            /** @enum {string} */
+            readonly purpose: "transactional" | "auth_otp";
+            /** @enum {string} */
+            readonly requested_channel: "sms" | "whatsapp" | "auto";
+            /** @enum {string|null} */
+            readonly actual_channel: "sms" | "whatsapp" | null;
+            readonly customer_reference: string | null;
+            readonly masked_recipient: string;
+            readonly sms: null | {
+                /** @enum {string|null} */
+                readonly encoding: "gsm7" | "ucs2" | null;
+                readonly segments: number | null;
+            };
+            readonly billing: {
+                /** @enum {string} */
+                readonly credential_mode: "managed" | "byok";
+                readonly unit: string | null;
+                readonly units: number | null;
+                readonly charged_piasters: number;
+                readonly reserved_piasters: number;
+            };
+            readonly failure: null | {
+                readonly code: string;
+                readonly retryable: boolean;
+            };
+            /** Format: date-time */
+            readonly created_at: string;
+            /** Format: date-time */
+            readonly updated_at: string;
+            /** Format: date-time */
+            readonly delivered_at: string | null;
+        };
         /** @enum {string} */
-        readonly WebhookEventType: "user.created" | "user.updated" | "user.deleted" | "user.banned" | "session.created" | "session.updated" | "session.revoked" | "organization.created" | "organization.updated" | "organization.deleted" | "organization_membership.created" | "organization_membership.deleted" | "mfa.enrolled" | "mfa.reset" | "webhook.test";
+        readonly WebhookSubscriptionEventType: "user.created" | "user.updated" | "user.deleted" | "user.banned" | "session.created" | "session.updated" | "session.revoked" | "organization.created" | "organization.updated" | "organization.deleted" | "organization_membership.created" | "organization_membership.deleted" | "mfa.enrolled" | "mfa.reset" | "message.accepted" | "message.skipped" | "message.delivered" | "message.failed";
+        /** @enum {string} */
+        readonly WebhookEventType: "user.created" | "user.updated" | "user.deleted" | "user.banned" | "session.created" | "session.updated" | "session.revoked" | "organization.created" | "organization.updated" | "organization.deleted" | "organization_membership.created" | "organization_membership.deleted" | "mfa.enrolled" | "mfa.reset" | "message.accepted" | "message.skipped" | "message.delivered" | "message.failed" | "webhook.test";
         readonly WebhookEndpoint: {
             /** Format: uuid */
             readonly id: string;
@@ -789,9 +1135,35 @@ interface components {
             /** Format: uuid */
             readonly id: string;
             /** @enum {string} */
+            readonly format: "ndjson" | "csv";
+            /** @enum {string} */
             readonly status: "pending" | "processing" | "completed" | "failed";
+            readonly includes_password_hashes: boolean;
+            readonly total_rows: number;
+            readonly artifact_bytes: number;
+            readonly failure_code: string | null;
             /** Format: date-time */
             readonly created_at: string;
+            /** Format: date-time */
+            readonly completed_at: string | null;
+            /** Format: date-time */
+            readonly expires_at: string | null;
+            readonly download_url: string | null;
+        };
+        readonly ExportRequest: {
+            /**
+             * @default ndjson
+             * @enum {string}
+             */
+            readonly format: "ndjson" | "csv";
+        };
+        readonly HashExportRequest: {
+            /**
+             * @default ndjson
+             * @enum {string}
+             */
+            readonly format: "ndjson" | "csv";
+            readonly approval_token: string;
         };
         readonly Page: {
             readonly data: readonly unknown[];
@@ -824,6 +1196,9 @@ interface components {
         readonly DeliveryPage: components["schemas"]["Page"] & {
             readonly data?: readonly components["schemas"]["WebhookDelivery"][];
         };
+        readonly MessagePage: components["schemas"]["Page"] & {
+            readonly data?: readonly components["schemas"]["Message"][];
+        };
     };
     responses: {
         /** @description Invalid request */
@@ -873,6 +1248,15 @@ interface components {
                 readonly "application/problem+json": components["schemas"]["Problem"];
             };
         };
+        /** @description The request conflicts with an existing resource or idempotency record */
+        readonly Conflict: {
+            headers: {
+                readonly [name: string]: unknown;
+            };
+            content: {
+                readonly "application/problem+json": components["schemas"]["Problem"];
+            };
+        };
         /** @description Plan rate limit exceeded */
         readonly RateLimited: {
             headers: {
@@ -886,6 +1270,15 @@ interface components {
                 readonly "application/problem+json": components["schemas"]["Problem"];
             };
         };
+        /** @description The canonical stream envelope, encoding, or hard limits are invalid */
+        readonly ImportValidationFailed: {
+            headers: {
+                readonly [name: string]: unknown;
+            };
+            content: {
+                readonly "application/problem+json": components["schemas"]["Problem"];
+            };
+        };
         /** @description User page */
         readonly UserPage: {
             headers: {
@@ -958,73 +1351,293 @@ interface components {
                 readonly "application/json": components["schemas"]["WebhookPage"];
             };
         };
-        /** @description Webhook delivery page */
-        readonly DeliveryPage: {
-            headers: {
-                readonly [name: string]: unknown;
-            };
-            content: {
-                readonly "application/json": components["schemas"]["DeliveryPage"];
+        /** @description Webhook delivery page */
+        readonly DeliveryPage: {
+            headers: {
+                readonly [name: string]: unknown;
+            };
+            content: {
+                readonly "application/json": components["schemas"]["DeliveryPage"];
+            };
+        };
+    };
+    parameters: {
+        readonly Limit: number;
+        readonly Cursor: string;
+        readonly UserId: string;
+        readonly ImportId: string;
+        readonly ExportId: string;
+        readonly SessionId: string;
+        readonly OrganizationId: string;
+        readonly RoleId: string;
+        readonly InvitationId: string;
+        readonly WebhookId: string;
+        readonly DeliveryId: string;
+    };
+    requestBodies: never;
+    headers: never;
+    pathItems: never;
+}
+interface operations {
+    readonly getOpenApiDocument: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description OpenAPI document */
+            readonly 200: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": Record<string, never>;
+                };
+            };
+        };
+    };
+    readonly listUsers: {
+        readonly parameters: {
+            readonly query?: {
+                readonly limit?: components["parameters"]["Limit"];
+                readonly cursor?: components["parameters"]["Cursor"];
+                readonly query?: string;
+            };
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            readonly 200: components["responses"]["UserPage"];
+            readonly 400: components["responses"]["InvalidRequest"];
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly createUser: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly requestBody: {
+            readonly content: {
+                readonly "application/json": components["schemas"]["CreateUser"];
+            };
+        };
+        readonly responses: {
+            /** @description User created */
+            readonly 201: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["User"];
+                };
+            };
+            readonly 400: components["responses"]["InvalidRequest"];
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly startUserExport: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly requestBody?: {
+            readonly content: {
+                readonly "application/json": components["schemas"]["ExportRequest"];
+            };
+        };
+        readonly responses: {
+            /** @description Export accepted */
+            readonly 202: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["ExportJob"];
+                };
+            };
+            readonly 400: components["responses"]["InvalidRequest"];
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly getUserExport: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly exportId: components["parameters"]["ExportId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description Export job */
+            readonly 200: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["ExportJob"];
+                };
+            };
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly downloadUserExport: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly exportId: components["parameters"]["ExportId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description CSV or NDJSON export stream */
+            readonly 200: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "text/csv": string;
+                    readonly "application/x-ndjson": string;
+                };
+            };
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly startPasswordHashUserExport: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly requestBody: {
+            readonly content: {
+                readonly "application/json": components["schemas"]["HashExportRequest"];
+            };
+        };
+        readonly responses: {
+            /** @description Privileged export accepted */
+            readonly 202: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["ExportJob"];
+                };
+            };
+            readonly 400: components["responses"]["InvalidRequest"];
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly getPasswordHashUserExport: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly exportId: components["parameters"]["ExportId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description Privileged export job */
+            readonly 200: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["ExportJob"];
+                };
             };
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
         };
     };
-    parameters: {
-        readonly Limit: number;
-        readonly Cursor: string;
-        readonly UserId: string;
-        readonly SessionId: string;
-        readonly OrganizationId: string;
-        readonly RoleId: string;
-        readonly InvitationId: string;
-        readonly WebhookId: string;
-        readonly DeliveryId: string;
-    };
-    requestBodies: never;
-    headers: never;
-    pathItems: never;
-}
-interface operations {
-    readonly getOpenApiDocument: {
+    readonly downloadPasswordHashUserExport: {
         readonly parameters: {
             readonly query?: never;
             readonly header?: never;
-            readonly path?: never;
+            readonly path: {
+                readonly exportId: components["parameters"]["ExportId"];
+            };
             readonly cookie?: never;
         };
         readonly requestBody?: never;
         readonly responses: {
-            /** @description OpenAPI document */
+            /** @description Encrypted-at-rest CSV or NDJSON export stream */
             readonly 200: {
                 headers: {
                     readonly [name: string]: unknown;
                 };
                 content: {
-                    readonly "application/json": Record<string, never>;
+                    readonly "text/csv": string;
+                    readonly "application/x-ndjson": string;
                 };
             };
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
         };
     };
-    readonly listUsers: {
+    readonly dryRunUserImport: {
         readonly parameters: {
-            readonly query?: {
-                readonly limit?: components["parameters"]["Limit"];
-                readonly cursor?: components["parameters"]["Cursor"];
-                readonly query?: string;
-            };
+            readonly query?: never;
             readonly header?: never;
             readonly path?: never;
             readonly cookie?: never;
         };
-        readonly requestBody?: never;
+        readonly requestBody: {
+            readonly content: {
+                readonly "application/x-ndjson": string;
+            };
+        };
         readonly responses: {
-            readonly 200: components["responses"]["UserPage"];
-            readonly 400: components["responses"]["InvalidRequest"];
+            /** @description Validation batch completed */
+            readonly 201: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["ImportDryRun"];
+                };
+            };
             readonly 401: components["responses"]["Unauthorized"];
             readonly 403: components["responses"]["Forbidden"];
+            readonly 422: components["responses"]["ImportValidationFailed"];
             readonly 429: components["responses"]["RateLimited"];
         };
     };
-    readonly createUser: {
+    readonly createUserImport: {
         readonly parameters: {
             readonly query?: never;
             readonly header?: never;
@@ -1033,45 +1646,75 @@ interface operations {
         };
         readonly requestBody: {
             readonly content: {
-                readonly "application/json": components["schemas"]["CreateUser"];
+                readonly "application/x-ndjson": string;
             };
         };
         readonly responses: {
-            /** @description User created */
+            /** @description Import batch completed */
             readonly 201: {
                 headers: {
                     readonly [name: string]: unknown;
                 };
                 content: {
-                    readonly "application/json": components["schemas"]["User"];
+                    readonly "application/json": components["schemas"]["ImportBatch"];
                 };
             };
-            readonly 400: components["responses"]["InvalidRequest"];
             readonly 401: components["responses"]["Unauthorized"];
             readonly 403: components["responses"]["Forbidden"];
+            readonly 422: components["responses"]["ImportValidationFailed"];
             readonly 429: components["responses"]["RateLimited"];
         };
     };
-    readonly startUserExport: {
+    readonly getUserImport: {
         readonly parameters: {
             readonly query?: never;
             readonly header?: never;
-            readonly path?: never;
+            readonly path: {
+                readonly importId: components["parameters"]["ImportId"];
+            };
             readonly cookie?: never;
         };
         readonly requestBody?: never;
         readonly responses: {
-            /** @description Export accepted */
-            readonly 202: {
+            /** @description Import batch */
+            readonly 200: {
                 headers: {
                     readonly [name: string]: unknown;
                 };
                 content: {
-                    readonly "application/json": components["schemas"]["ExportJob"];
+                    readonly "application/json": components["schemas"]["ImportBatch"];
+                };
+            };
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly downloadUserImportReport: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly importId: components["parameters"]["ImportId"];
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description One NDJSON result per canonical user row */
+            readonly 200: {
+                headers: {
+                    readonly "Content-Disposition"?: string;
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/x-ndjson": string;
                 };
             };
             readonly 401: components["responses"]["Unauthorized"];
             readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
             readonly 429: components["responses"]["RateLimited"];
         };
     };
@@ -1796,6 +2439,92 @@ interface operations {
             readonly 429: components["responses"]["RateLimited"];
         };
     };
+    readonly listMessages: {
+        readonly parameters: {
+            readonly query?: {
+                readonly limit?: components["parameters"]["Limit"];
+                readonly cursor?: components["parameters"]["Cursor"];
+                readonly state?: components["schemas"]["MessageState"];
+                readonly channel?: "sms" | "whatsapp" | "auto";
+            };
+            readonly header?: never;
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description Message delivery page */
+            readonly 200: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["MessagePage"];
+                };
+            };
+            readonly 400: components["responses"]["InvalidRequest"];
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly sendMessage: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header: {
+                readonly "Idempotency-Key": string;
+            };
+            readonly path?: never;
+            readonly cookie?: never;
+        };
+        readonly requestBody: {
+            readonly content: {
+                readonly "application/json": components["schemas"]["SendMessage"];
+            };
+        };
+        readonly responses: {
+            /** @description Message durably queued */
+            readonly 202: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["Message"];
+                };
+            };
+            readonly 400: components["responses"]["InvalidRequest"];
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 409: components["responses"]["Conflict"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
+    readonly getMessage: {
+        readonly parameters: {
+            readonly query?: never;
+            readonly header?: never;
+            readonly path: {
+                readonly messageId: string;
+            };
+            readonly cookie?: never;
+        };
+        readonly requestBody?: never;
+        readonly responses: {
+            /** @description Message delivery */
+            readonly 200: {
+                headers: {
+                    readonly [name: string]: unknown;
+                };
+                content: {
+                    readonly "application/json": components["schemas"]["Message"];
+                };
+            };
+            readonly 401: components["responses"]["Unauthorized"];
+            readonly 403: components["responses"]["Forbidden"];
+            readonly 404: components["responses"]["NotFound"];
+            readonly 429: components["responses"]["RateLimited"];
+        };
+    };
     readonly listEvents: {
         readonly parameters: {
             readonly query?: {
@@ -2153,7 +2882,7 @@ interface operations {
  * Generated from packages/auth-core/openapi/v1.json.
  * Do not edit directly. Run `pnpm admin:generate`.
  */
-declare const ADMIN_API_SPEC_SHA256 = "dc1953d9d9b9e1f7002fa045f12788280e5865bacfda94b1d133e9580aa87d62";
+declare const ADMIN_API_SPEC_SHA256 = "3e6f30e32508bbe3d398e6add18d0cf88776b1da5bbc1535570999fc994f8d4d";
 declare const adminOperations: {
     readonly getOpenApiDocument: {
         readonly method: "GET";
@@ -2195,6 +2924,90 @@ declare const adminOperations: {
             };
         };
     };
+    readonly getUserExport: {
+        readonly method: "GET";
+        readonly path: "/users/export/{exportId}";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": {
+                readonly $ref: "#/components/schemas/ExportJob";
+            };
+        };
+    };
+    readonly downloadUserExport: {
+        readonly method: "GET";
+        readonly path: "/users/export/{exportId}/download";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": null;
+        };
+    };
+    readonly startPasswordHashUserExport: {
+        readonly method: "POST";
+        readonly path: "/users/export/hashes";
+        readonly successStatuses: readonly [202];
+        readonly responseSchemas: {
+            readonly "202": {
+                readonly $ref: "#/components/schemas/ExportJob";
+            };
+        };
+    };
+    readonly getPasswordHashUserExport: {
+        readonly method: "GET";
+        readonly path: "/users/export/hashes/{exportId}";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": {
+                readonly $ref: "#/components/schemas/ExportJob";
+            };
+        };
+    };
+    readonly downloadPasswordHashUserExport: {
+        readonly method: "GET";
+        readonly path: "/users/export/hashes/{exportId}/download";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": null;
+        };
+    };
+    readonly dryRunUserImport: {
+        readonly method: "POST";
+        readonly path: "/imports/dry-run";
+        readonly successStatuses: readonly [201];
+        readonly responseSchemas: {
+            readonly "201": {
+                readonly $ref: "#/components/schemas/ImportDryRun";
+            };
+        };
+    };
+    readonly createUserImport: {
+        readonly method: "POST";
+        readonly path: "/imports";
+        readonly successStatuses: readonly [201];
+        readonly responseSchemas: {
+            readonly "201": {
+                readonly $ref: "#/components/schemas/ImportBatch";
+            };
+        };
+    };
+    readonly getUserImport: {
+        readonly method: "GET";
+        readonly path: "/imports/{importId}";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": {
+                readonly $ref: "#/components/schemas/ImportBatch";
+            };
+        };
+    };
+    readonly downloadUserImportReport: {
+        readonly method: "GET";
+        readonly path: "/imports/{importId}/report";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": null;
+        };
+    };
     readonly getUser: {
         readonly method: "GET";
         readonly path: "/users/{userId}";
@@ -2460,6 +3273,36 @@ declare const adminOperations: {
             readonly "204": null;
         };
     };
+    readonly listMessages: {
+        readonly method: "GET";
+        readonly path: "/messages";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": {
+                readonly $ref: "#/components/schemas/MessagePage";
+            };
+        };
+    };
+    readonly sendMessage: {
+        readonly method: "POST";
+        readonly path: "/messages";
+        readonly successStatuses: readonly [202];
+        readonly responseSchemas: {
+            readonly "202": {
+                readonly $ref: "#/components/schemas/Message";
+            };
+        };
+    };
+    readonly getMessage: {
+        readonly method: "GET";
+        readonly path: "/messages/{messageId}";
+        readonly successStatuses: readonly [200];
+        readonly responseSchemas: {
+            readonly "200": {
+                readonly $ref: "#/components/schemas/Message";
+            };
+        };
+    };
     readonly listEvents: {
         readonly method: "GET";
         readonly path: "/events";
@@ -2602,7 +3445,7 @@ declare const adminOperations: {
 type AdminOperationId = keyof typeof adminOperations;
 
 type Operation = operations[AdminOperationId];
-type ParameterKind = 'query' | 'path';
+type ParameterKind = 'query' | 'path' | 'header';
 type ParameterInput<O extends Operation, K extends ParameterKind> = O extends {
     parameters: infer P;
 } ? K extends keyof P ? [NonNullable<P[K]>] extends [never] ? object : undefined extends P[K] ? {
@@ -2641,7 +3484,7 @@ type ResponseBody<Response> = Response extends {
 type Simplify<T> = {
     [K in keyof T]: T[K];
 } & object;
-type AdminOperationInput<Id extends AdminOperationId> = Simplify<ParameterInput<operations[Id], 'path'> & ParameterInput<operations[Id], 'query'> & BodyInput<operations[Id]> & {
+type AdminOperationInput<Id extends AdminOperationId> = Simplify<ParameterInput<operations[Id], 'path'> & ParameterInput<operations[Id], 'query'> & ParameterInput<operations[Id], 'header'> & BodyInput<operations[Id]> & {
     signal?: AbortSignal;
 }>;
 type AdminOperationResult<Id extends AdminOperationId> = ResponseBody<SuccessResponse<operations[Id]>>;