@cboxdk/id-js 0.18.0 → 0.19.0

package/dist/management.d.ts

@@ -275,6 +275,16 @@ interface ManifestSync {
     orphaned_role_keys: string[];
     orphaned_permission_keys: string[];
 }
+interface SmsFactorPolicy {
+    /** Text-message codes are accepted as a second factor. Off by default. */
+    enabled: boolean;
+    /** ISO 3166-1 alpha-2 countries whose numbers may enrol and be texted. Re-checked at every send. */
+    allowed_countries: string[];
+    /** Administrators may add SMS only beside an authenticator app or a passkey. */
+    privileged_need_stronger_factor: boolean;
+    /** The deployment's ceiling (CBOX_ID_SMS_ALLOWED_COUNTRIES). Empty: no deployment restriction. A listed country outside it is never texted. */
+    deployment_countries: string[];
+}
 interface SelfServiceSignup {
     enabled: boolean;
     /** False on a single-tenant install, where sign-up follows CBOX_ID_SIGNUP_MODE and the switch changes nothing. */
@@ -714,6 +724,24 @@ interface SignInRules {
     sso: 'off' | 'preferred' | 'required';
     /** Failed attempts before a lockout; null for none. */
     lockout_threshold: number | null;
+    /** Environment-wide. Whether passkeys may be used to sign in and be added. An organization's override never changes it. */
+    passkeys: boolean;
+    /** Environment-wide. Whether a one-time sign-in link may be emailed. */
+    magic_link: boolean;
+    /** Environment-wide. Minutes of inactivity before a session ends; null for the deployment's. */
+    session_idle_minutes: number | null;
+    /** Environment-wide. Minutes a session lasts at most; null for the deployment's. */
+    session_absolute_minutes: number | null;
+    /** Environment-wide. Whether a sign-up Radar flags is challenged with Turnstile, where the deployment has keys. */
+    bot_challenge: boolean;
+}
+interface SignInMethodsInForce {
+    passkeys: boolean;
+    magic_link: boolean;
+    /** 0 for no idle timeout. */
+    session_idle_minutes: number;
+    session_absolute_minutes: number;
+    bot_challenge: boolean;
 }
 interface SignInPolicy {
     /** null for the environment baseline. */
@@ -725,11 +753,21 @@ interface SignInPolicy {
     override: SignInRules | null;
     /** True for an organization with no override of its own. */
     inheriting: boolean;
+    /** The environment-wide methods and session lengths actually in force, after the deployment's ceiling. */
+    in_force: SignInMethodsInForce;
+    /** The deployment's ceiling: which methods it offers at all, the longest sessions it allows, and whether it has Turnstile keys. */
+    deployment: SignInMethodsInForce;
 }
-/** Its client secret and private key are write-only and never returned. */
+/** Its client secret and private key are write-only and never returned. An environment provider (`level: environment`) is offered on every organization's sign-in page unless the organization has its own for the same provider or turned it off. */
 interface SocialProvider {
     id: string;
+    /** null for the environment's own provider. */
     organization_id: string | null;
+    level: 'environment' | 'organization';
+    /** False when it is turned off; its credentials are kept. */
+    enabled: boolean;
+    /** Extra scopes requested on top of the ones sign-in needs. */
+    scopes: string[];
     /** The catalogue key: google, github, apple… */
     provider: string | null;
     name: string;
@@ -739,6 +777,21 @@ interface SocialProvider {
     callback_uri: string;
     created_at?: string | null;
 }
+/** The social login buttons one sign-in page shows, after inheritance. */
+interface OfferedSocialProviders {
+    /** null for the plain sign-in page, before anybody has said who they are. */
+    organization_id: string | null;
+    providers: Array<{
+        id: string;
+        provider: string | null;
+        name: string;
+        /** `environment` when inherited; `organization` when the organization's own stands in its place. */
+        source: 'environment' | 'organization';
+        callback_uri: string;
+    }>;
+    /** The environment's providers this organization turned off for its page. */
+    not_inherited: string[];
+}
 /** A publishable key. Returned in full: it is public by design; the origins are the control. */
 interface FrontendKey {
     id: string;
@@ -822,7 +875,12 @@ interface Appearance {
         light?: ThemeMode;
         dark?: ThemeMode;
     };
+    /** The uploaded logo, served by this application at /brand-assets/…; null when none is uploaded at this level. Never a remote URL. */
     logo: string | null;
+    /** The uploaded favicon, served the same way; null when none. */
+    favicon: string | null;
+    /** A remote logo URL saved before logos became uploads is still stored at this level. It is never fetched and no longer shown on any hosted page; upload a logo (or send `logo: null`) to clear it. */
+    remote_logo_ignored: boolean;
 }
 interface WhitelabelBranding {
     /** null for the environment default. */
@@ -833,9 +891,9 @@ interface WhitelabelBranding {
     app_name: string | null;
     email_from_name: string | null;
     email_template: string | null;
-    /** Uploaded from the console. */
+    /** Uploaded with `PUT /branding/appearance` (the console's Branding page). */
     logo_url: string | null;
-    /** Uploaded from the console. */
+    /** Uploaded with `PUT /branding/appearance` (the console's Branding page). */
     favicon_url: string | null;
 }
 interface CustomDomain$1 {
@@ -945,8 +1003,14 @@ interface PortalLink {
     organization_id: string;
     /** What the link may set up. */
     intents: Array<'sso' | 'dsync' | 'domain_verification' | 'log_streams' | 'certificate_renewal' | 'audit_logs'>;
-    /** The address the link was mailed to, or null when it was not sent. */
+    /** The address the link was mailed to, or null when it was not sent — none was asked for, or the mail was suppressed (see email_suppressed). */
     emailed_to: string | null;
+    /**
+     * True when an `email` was asked for and NOT sent because this is a sandbox
+     * environment, which sends no mail. `emailed_to` is then null, and the `url` in this
+     * answer is the only way to the link — share it yourself.
+     */
+    email_suppressed: boolean;
     /**
      * The one-time setup link — the whole credential. Shown once; `null` on an
      * idempotent replay of this answer.
@@ -1059,12 +1123,175 @@ interface AuditLogExport {
     /** When the file is deleted. */
     expires_at: string | null;
 }
+interface FgaSubject {
+    /** The subject's type: `user`, or `group` for a userset. */
+    type: string;
+    id: string;
+    /** For a userset — everybody with this relation on the subject (`member` of `group:eng`). null for one subject. */
+    relation: string | null;
+}
+interface FgaTuple {
+    resource_type: string;
+    resource_id: string;
+    relation: string;
+    subject: FgaSubject;
+    /** The same tuple in the notation: `document:readme#viewer@group:eng#member`. */
+    tuple: string;
+}
+interface FgaSchema {
+    /** false until a schema is first saved. */
+    defined: boolean;
+    /** The source as it was written, comments and all. */
+    schema: string | null;
+    /** How many times the schema has been replaced. */
+    version: number;
+    /** The parsed types, each with its relations and how each is decided. */
+    types: FgaType[];
+    updated_at: string | null;
+    /** The revision the model is at. */
+    consistency_token: string;
+}
+interface FgaType {
+    name: string;
+    relations: Array<{
+        name: string;
+        /**
+         * How the relation is decided, as a tree of one-key objects: `direct` (a list of
+         * `{type, relation?}`), `computed` (a relation name), `from` (`{tupleset, relation}`),
+         * `union` and `intersection` (lists of rewrites), `exclusion` (`{base, subtract}`).
+         */
+        rewrite: Record<string, unknown>;
+        /** The subjects a tuple may name on this relation; empty for a relation that is only computed. */
+        directly_related: Array<{
+            type: string;
+            relation?: string;
+        }>;
+    }>;
+}
+interface FgaSchemaValidation {
+    valid: boolean;
+    errors: Array<{
+        /** 0 when the problem is about the whole schema. */
+        line: number;
+        message: string;
+    }>;
+    types: FgaType[];
+    /** The schema as the platform prints it, when valid. */
+    canonical: string | null;
+}
+interface FgaTupleWrite {
+    /** Tuples that were new. Re-writing an existing one is not counted. */
+    written: number;
+    /** Tuples that were there to delete. */
+    deleted: number;
+    /** Pass to a check that must see this write. */
+    consistency_token: string;
+}
+interface FgaCheck {
+    allowed: boolean;
+    resource_type: string;
+    resource_id: string;
+    relation: string;
+    subject: FgaSubject;
+    /** The revision the answer was decided at. */
+    consistency_token: string;
+}
+interface FgaCheckBatch {
+    /** One answer per check, in the order asked. */
+    results: FgaCheck[];
+    consistency_token: string | null;
+}
+interface FgaObject {
+    type: string;
+    id: string;
+}
 interface AuditLogSettings {
     /** Events are kept this many days after they arrive. */
     retention_days: number;
     /** Whether an action with no schema is refused. */
     strict_schemas: boolean;
 }
+interface RadarSettings {
+    /** monitor records every verdict and acts on none; enforce blocks and challenges. */
+    mode: 'monitor' | 'enforce';
+    /** True while the environment follows the deployment's default (RISK_MODE) rather than a mode it chose. */
+    mode_inherited: boolean;
+    deployment_mode: 'monitor' | 'enforce';
+    /** The configured IP intelligence source. With none, country, network and travel facts are unknown and the rules on them never fire. */
+    ip_intelligence: 'none' | 'maxmind' | 'ipinfo';
+    builtin_rules: Array<{
+        key: 'credential_stuffing' | 'bot_velocity' | 'account_attack' | 'impossible_travel' | 'new_device' | 'anonymous_network' | 'hosting_network' | 'disposable_email' | 'risk_score_reject' | 'risk_score_elevated';
+        name: string;
+        description: string;
+        applies_to: 'all' | 'sign_in' | 'sign_up';
+        enabled: boolean;
+        action: 'allow' | 'challenge' | 'block';
+        /** null for a rule that counts nothing. */
+        threshold: number | null;
+        threshold_unit: string | null;
+        threshold_min: number | null;
+        threshold_max: number | null;
+    }>;
+}
+interface RadarRule {
+    id: string;
+    name: string;
+    description: string | null;
+    /** 1 is evaluated first; the first rule whose conditions all hold decides. */
+    position: number;
+    enabled: boolean;
+    applies_to: 'all' | 'sign_in' | 'sign_up';
+    action: 'allow' | 'challenge' | 'block';
+    conditions: Array<{
+        field: string;
+        operator: 'eq' | 'neq' | 'in' | 'not_in' | 'gt' | 'gte' | 'lt' | 'lte' | 'contains' | 'not_contains' | 'starts_with' | 'ends_with' | 'in_cidr' | 'not_in_cidr';
+        /** Normalised: a string, a number, true/false, or a list for the list operators. */
+        value: string | number | boolean | Array<string | number>;
+    }>;
+    /** The conditions as a person reads them. */
+    summary: string;
+    created_at: string;
+    updated_at: string;
+}
+interface RadarListEntry {
+    id: string;
+    list: 'allow' | 'deny';
+    kind: 'ip' | 'email' | 'email_domain' | 'device';
+    /** Normalised: an IP or CIDR range, a lower-case address or domain, or a device id. */
+    value: string;
+    note: string | null;
+    expires_at: string | null;
+    active: boolean;
+    created_at: string;
+}
+interface RadarDecision {
+    id: string;
+    assessed_at: string;
+    flow: 'sign_in' | 'sign_up';
+    method: 'password' | 'magic_link' | 'passkey' | 'sign_up' | null;
+    verdict: 'allow' | 'challenge' | 'block';
+    /** Whether the verdict was acted on; false under monitor. */
+    enforced: boolean;
+    mode: 'monitor' | 'enforce';
+    /** What decided it: deny_list:<kind>, allow_list:<kind>, rule:<id>, builtin:<key>; null when nothing matched. */
+    rule: string | null;
+    rule_name: string | null;
+    /** Every rule that fired, the deciding one included. */
+    triggered: Array<{
+        rule: string;
+        name: string;
+    }>;
+    reasons: string[];
+    risk_score: number;
+    risk_outcome: 'allow' | 'flag' | 'challenge' | 'step_up' | 'reject';
+    country: string | null;
+    asn: number | null;
+    email_domain: string | null;
+    /** The device id (a pseudonym of the device cookie), for a returning device. */
+    device: string | null;
+    /** The facts the rules were evaluated on — never the IP, the address or the user agent. */
+    facts: Record<string, unknown>;
+}
 interface AuditLogVerification {
     organization_id: string;
     /** Every event checked is unchanged and in place. */
@@ -1083,15 +1310,41 @@ interface Directory {
     id: string;
     organization_id: string;
     name: string;
-    provider: 'scim' | 'google_workspace' | 'microsoft_entra';
+    provider: 'scim' | 'google_workspace' | 'microsoft_entra' | 'workday' | 'bamboohr' | 'rippling' | 'hibob' | 'personio';
     /** true when this platform fetches from the provider; false for a SCIM endpoint the provider posts to. */
     pull: boolean;
+    /** true for an HR system (Workday, BambooHR, Rippling, HiBob, Personio): employment dates decide access and departments become groups. */
+    hris?: boolean;
     active: boolean;
     status: 'active' | 'paused';
     /** Where the identity provider sends SCIM requests. null for a pull directory. */
     scim_base_url?: string | null;
     last_synced_at?: string | null;
+    /** Why the last pull failed, or for a partial one how many records could not be synced and the first reason. Never names a person. */
     last_sync_error?: string | null;
+    /** When the last pull started. null for a SCIM directory. */
+    last_sync_started_at?: string | null;
+    /** How the last pull went. partial: the provider answered but some records could not be reconciled, or a mass deprovisioning was refused. */
+    last_sync_status?: 'running' | 'succeeded' | 'partial' | 'failed' | null;
+    /** The last pull's counts, and up to 50 records it could not reconcile — by the provider's own id, never by name or email. */
+    last_sync_stats?: {
+        mode?: 'full' | 'incremental';
+        provisioned?: number;
+        deprovisioned?: number;
+        groups?: number;
+        /** Leavers and people who have not started, who never had an account. */
+        skipped?: number;
+        failed?: number;
+        failures?: Array<{
+            external_id?: string | null;
+            reason?: string;
+        }>;
+    } | null;
+    /** Minutes between scheduled pulls. null for a SCIM directory. */
+    sync_interval_minutes?: number | null;
+    next_sync_at?: string | null;
+    /** HR systems only: the HR system's own field names copied onto each person. */
+    custom_attributes?: string[] | null;
     created_at?: string | null;
     /**
      * The SCIM bearer token, on the create and rotate answers only — shown once, never
@@ -1135,6 +1388,44 @@ interface SodPolicy {
     active: boolean;
     created_at?: string | null;
 }
+/** A switch apps ask about per user and organization. First match wins: switched off, then a user rule, then an organization rule, then the rollout, then the default. */
+interface FeatureFlag {
+    id: string;
+    /** What code asks for and the `feature_flags` claim carries. Fixed once created. */
+    key: string;
+    description?: string | null;
+    /** The kill switch: false is off for everyone. */
+    enabled: boolean;
+    /** The answer when no rule matches. */
+    default_value: boolean;
+    /** On for this share of everyone else, by a stable hash of the user id (the organization id without one). */
+    rollout_percentage?: number | null;
+    /** Rules for named users; they outrank every other rule. */
+    users: FeatureFlagRule[];
+    /** Rules for named organizations; they outrank the rollout and the default. */
+    organizations: FeatureFlagRule[];
+    created_at?: string | null;
+    updated_at?: string | null;
+}
+interface FeatureFlagRule {
+    /** The user's or organization's id. */
+    id: string;
+    /** On or off for them. */
+    enabled: boolean;
+}
+/** Every flag's answer for the user and organization asked about. */
+interface FeatureFlagEvaluation {
+    user_id: string | null;
+    organization_id: string | null;
+    /** The keys of the flags that are on, sorted — exactly what the token's `feature_flags` claim would carry. */
+    feature_flags: string[];
+    evaluations: Array<{
+        key: string;
+        enabled: boolean;
+        /** The rule that decided. */
+        reason: 'disabled' | 'user_target' | 'organization_target' | 'rollout' | 'default';
+    }>;
+}
 interface AccessReview {
     id: string;
     /** null for a staff review of environment-wide grants. */
@@ -1184,6 +1475,58 @@ interface TokenVaultSecret {
     /** The OAuth client ids that may lease it. Not on lists. */
     grants?: string[];
 }
+/** A pipe: this environment's OAuth app at a third-party provider, through which people connect their own accounts. The client secret is write-only. */
+interface Pipe {
+    id: string;
+    provider: 'github' | 'google' | 'microsoft' | 'slack' | 'salesforce' | 'hubspot' | 'linear' | 'notion';
+    name: string;
+    /** Your app's OAuth client id at the provider. */
+    client_id: string;
+    /** What people are asked for when they connect. */
+    scopes: string[];
+    /** Per-installation values: Microsoft's `tenant`, Salesforce's `domain`. */
+    parameters?: {
+        [key: string]: string;
+    };
+    enabled: boolean;
+    /** The callback URL to register at the provider. */
+    redirect_uri: string;
+    /** The OAuth client ids of the apps that may lease its tokens. */
+    grants: string[];
+    /** How many people have connected an account through it. */
+    connections: number;
+    created_at?: string | null;
+    updated_at?: string | null;
+}
+/** One person's connected account at a pipe's provider. Never a token. */
+interface PipeConnection {
+    id: string;
+    pipe_id: string;
+    provider: string;
+    user_id: string;
+    status: 'active' | 'needs_reauth';
+    /** The account's name at the provider, when it says (a GitHub login, an email, a workspace). */
+    account?: string | null;
+    scopes: string[];
+    metadata?: {
+        [key: string]: string;
+    };
+    /** When the current access token expires. Null when it does not. */
+    expires_at?: string | null;
+    connected_at?: string | null;
+    last_refreshed_at?: string | null;
+    /** Consecutive transient refresh failures. */
+    refresh_failures?: number;
+    last_error?: string | null;
+    /** Why it needs reconnecting: the provider's error code, or `no_refresh_token`. */
+    reauth_reason?: string | null;
+}
+interface PipeConnectRequired {
+    error: 'not_connected' | 'reauthorization_required';
+    message: string;
+    /** Where to send the person to connect. Add `?client_id=…&return_to=…` to bring them back to your app. */
+    connect_url: string;
+}
 /** A pending request from an agent to act as one of this environment's people (OIDC CIBA). */
 interface AgentRequest {
     id: string;
@@ -1745,7 +2088,7 @@ interface BrandingAppearanceSetBody {
         preset?: string;
         /** Corner radius: 0rem, 0.25rem, 0.375rem, 0.5rem, 0.75rem, 1rem. */
         radius?: string;
-        /** Type family: system, geometric, serif. */
+        /** Type family: system, inter, geometric, rounded, serif. */
         font?: string;
         /** Colours as #rrggbb. One left out takes the preset's. */
         light?: {
@@ -1762,8 +2105,10 @@ interface BrandingAppearanceSetBody {
             muted?: string;
         };
     };
-    /** An https URL for the logo; null removes it, left out keeps it. */
+    /** The logo as a base64 data: URI (data:image/png;base64,…): PNG, JPEG or WebP, at most 1024 KB and 4096px on the longest side. SVG and remote URLs are refused. Null removes it; left out keeps it. */
     logo?: string | null;
+    /** The favicon as a base64 data: URI (data:image/png;base64,…): PNG, ICO or WebP, at most 256 KB and 1024px on the longest side. SVG and remote URLs are refused. Null removes it; left out keeps it. */
+    favicon?: string | null;
 }
 /** Response body of `branding.appearance.set`. */
 type BrandingAppearanceSetResponse = {
@@ -1836,6 +2181,32 @@ interface DirectoriesCreateBody {
 type DirectoriesCreateResponse = {
     data: Directory;
 };
+/** Request body of `directories.credentials.replace`. */
+interface DirectoriesCredentialsReplaceBody {
+    /** Only if it is this organization's; anything else is a 404. */
+    organization_id?: string | null;
+    /** The new credentials, in the keys the provider's setup names (Google: service_account_json, admin_email; Entra: tenant_id, client_id, client_secret). Write-only. */
+    credentials: {
+        report_url?: string;
+        username?: string;
+        password?: string;
+        client_id?: string;
+        client_secret?: string;
+        refresh_token?: string;
+        subdomain?: string;
+        api_key?: string;
+        api_token?: string;
+        service_user_id?: string;
+        service_user_token?: string;
+        service_account_json?: string;
+        admin_email?: string;
+        tenant_id?: string;
+    };
+}
+/** Response body of `directories.credentials.replace`. */
+type DirectoriesCredentialsReplaceResponse = {
+    data: Directory;
+};
 /** Request body of `directories.delete`. */
 interface DirectoriesDeleteBody {
     /** Only if it is this organization's; anything else is a 404. */
@@ -1881,6 +2252,48 @@ interface DirectoriesGroupsMapBody {
 type DirectoriesGroupsMapResponse = {
     data: DirectoryGroup;
 };
+/** Request body of `directories.hris.connect`. */
+interface DirectoriesHrisConnectBody {
+    /** The organization whose people it provisions. */
+    organization_id: string;
+    /** workday, bamboohr, rippling, hibob or personio. */
+    provider: 'workday' | 'bamboohr' | 'rippling' | 'hibob' | 'personio';
+    /** What administrators call it. Defaults to the HR system's name. */
+    name?: string;
+    /** The HR system's credentials, in the keys its setup guide names. Write-only: sealed, never returned. */
+    credentials: {
+        /** Workday: Report web-service URL. */
+        report_url?: string;
+        /** Workday: Integration system user. */
+        username?: string;
+        /** Workday: Integration system user password (secret). */
+        password?: string;
+        /** Workday: API client ID; Personio: Client ID. */
+        client_id?: string;
+        /** Workday: API client secret (secret); Personio: Client secret (secret). */
+        client_secret?: string;
+        /** Workday: Refresh token (secret). */
+        refresh_token?: string;
+        /** BambooHR: Company subdomain. */
+        subdomain?: string;
+        /** BambooHR: API key (secret). */
+        api_key?: string;
+        /** Rippling: API token (secret). */
+        api_token?: string;
+        /** HiBob: Service user ID. */
+        service_user_id?: string;
+        /** HiBob: Service user token (secret). */
+        service_user_token?: string;
+    };
+    /** The HR system's own field names to copy onto each person, verbatim. */
+    custom_attributes?: string[];
+    /** Minutes between scheduled pulls, 15 to 1440. Omitted or null: the platform default (hourly). */
+    sync_interval_minutes?: number | null;
+}
+/** Response body of `directories.hris.connect`. */
+type DirectoriesHrisConnectResponse = {
+    data: Directory;
+};
 /** Query parameters of `directories.list`. */
 interface DirectoriesListQuery {
     /** Only this organization's. */
@@ -1906,6 +2319,59 @@ interface DirectoriesStatusSetBody {
 type DirectoriesStatusSetResponse = {
     data: Directory;
 };
+/** Request body of `directories.sync`. */
+interface DirectoriesSyncBody {
+    /** Only if it is this organization's; anything else is a 404. */
+    organization_id?: string | null;
+    /** Ask an HR system that syncs incrementally for everybody, not only what changed. Ignored by other providers. */
+    full?: boolean;
+}
+/** Response body of `directories.sync`. */
+type DirectoriesSyncResponse = {
+    data: Directory;
+};
+/** Request body of `directories.sync_settings.update`. */
+interface DirectoriesSyncSettingsUpdateBody {
+    /** Only if it is this organization's; anything else is a 404. */
+    organization_id?: string | null;
+    /** Minutes between scheduled pulls, 15 to 1440. null returns to the platform default (hourly). */
+    sync_interval_minutes?: number | null;
+    /** HR systems only: the HR system's own field names to copy onto each person, verbatim. */
+    custom_attributes?: string[];
+    /** Workday only: the report column holding each field, where it is not the default name. */
+    field_map?: {
+        /** The report column holding id. Default: Employee_ID. */
+        id?: string;
+        /** The report column holding email. Default: Work_Email. */
+        email?: string;
+        /** The report column holding first_name. Default: Legal_First_Name. */
+        first_name?: string;
+        /** The report column holding last_name. Default: Legal_Last_Name. */
+        last_name?: string;
+        /** The report column holding display_name. Default: Preferred_Name. */
+        display_name?: string;
+        /** The report column holding active. Default: Active_Status. */
+        active?: string;
+        /** The report column holding on_leave. Default: On_Leave. */
+        on_leave?: string;
+        /** The report column holding hire_date. Default: Hire_Date. */
+        hire_date?: string;
+        /** The report column holding termination_date. Default: Termination_Date. */
+        termination_date?: string;
+        /** The report column holding department_id. Default: Supervisory_Organization_ID. */
+        department_id?: string;
+        /** The report column holding department. Default: Supervisory_Organization. */
+        department?: string;
+        /** The report column holding manager_id. Default: Manager_Employee_ID. */
+        manager_id?: string;
+        /** The report column holding title. Default: Business_Title. */
+        title?: string;
+    };
+}
+/** Response body of `directories.sync_settings.update`. */
+type DirectoriesSyncSettingsUpdateResponse = {
+    data: Directory;
+};
 /** Request body of `directories.token.rotate`. */
 interface DirectoriesTokenRotateBody {
     /** Only if it is this organization's; anything else is a 404. */
@@ -1961,6 +2427,268 @@ type EventsListResponse = {
     data: DomainEvent[];
     meta: PageMeta$1;
 };
+/** Request body of `feature_flags.create`. */
+interface FeatureFlagsCreateBody {
+    /** What code asks for and the `feature_flags` claim carries: lowercase letters and digits, with `-`, `_` or `.` between them. Fixed once created. */
+    key: string;
+    description?: string | null;
+    /** The kill switch: off means off for everyone, whatever the rules say. Defaults to true. */
+    enabled?: boolean;
+    /** The answer when no rule matches. Defaults to false. */
+    default_value?: boolean;
+    /** Rules for named users — they outrank every other rule. The COMPLETE list when sent. */
+    users?: Array<{
+        /** The user's id. */
+        id: string;
+        /** On (true, the default) or off for them, whatever the organization, rollout or default say. */
+        enabled?: boolean;
+    }>;
+    /** Rules for named organizations — they outrank the rollout and the default. The COMPLETE list when sent. */
+    organizations?: Array<{
+        /** The organization's id. */
+        id: string;
+        /** On (true, the default) or off for them, whatever the organization, rollout or default say. */
+        enabled?: boolean;
+    }>;
+    /** On for this percentage of everyone else, by a stable hash of the user id (or the organization id without one). null for no rollout. */
+    rollout_percentage?: number | null;
+}
+/** Response body of `feature_flags.create`. */
+type FeatureFlagsCreateResponse = {
+    data: FeatureFlag;
+};
+/** Response body of `feature_flags.delete`. */
+type FeatureFlagsDeleteResponse = void;
+/** Query parameters of `feature_flags.evaluate`. */
+interface FeatureFlagsEvaluateQuery {
+    /** The user to evaluate for. Left out, only organization rules, an organization-bucketed rollout and defaults apply. */
+    user_id?: string;
+    /** The organization the question is asked in. */
+    organization_id?: string;
+}
+/** Response body of `feature_flags.evaluate`. */
+type FeatureFlagsEvaluateResponse = {
+    data: FeatureFlagEvaluation;
+};
+/** Response body of `feature_flags.get`. */
+type FeatureFlagsGetResponse = {
+    data: FeatureFlag;
+};
+/** Query parameters of `feature_flags.list`. */
+interface FeatureFlagsListQuery {
+    /** Items per page, 1–100. Default 50. */
+    limit?: number;
+    /** The `next_cursor` of the previous page. */
+    after?: string;
+}
+/** Response body of `feature_flags.list`. */
+type FeatureFlagsListResponse = {
+    data: FeatureFlag[];
+    meta: PageMeta$1;
+};
+/** Request body of `feature_flags.update`. */
+interface FeatureFlagsUpdateBody {
+    /** Null or empty clears it. */
+    description?: string | null;
+    /** The kill switch: off means off for everyone. */
+    enabled?: boolean;
+    /** The answer when no rule matches. */
+    default_value?: boolean;
+    /** Rules for named users — they outrank every other rule. The COMPLETE list when sent. */
+    users?: Array<{
+        /** The user's id. */
+        id: string;
+        /** On (true, the default) or off for them, whatever the organization, rollout or default say. */
+        enabled?: boolean;
+    }>;
+    /** Rules for named organizations — they outrank the rollout and the default. The COMPLETE list when sent. */
+    organizations?: Array<{
+        /** The organization's id. */
+        id: string;
+        /** On (true, the default) or off for them, whatever the organization, rollout or default say. */
+        enabled?: boolean;
+    }>;
+    /** On for this percentage of everyone else, by a stable hash of the user id (or the organization id without one). null for no rollout. */
+    rollout_percentage?: number | null;
+}
+/** Response body of `feature_flags.update`. */
+type FeatureFlagsUpdateResponse = {
+    data: FeatureFlag;
+};
+/** Query parameters of `fga.check`. */
+interface FgaCheckQuery {
+    /** The resource's type: `document`. */
+    resource_type: string;
+    /** The resource's id: `readme`. */
+    resource_id: string;
+    /** The relation to check: `viewer`. */
+    relation: string;
+    /** The subject's type: `user`, or `group` for a userset. */
+    subject_type: string;
+    /** The subject's id: `alice`. */
+    subject_id: string;
+    /** For a userset subject — `member` with `group`/`eng` asks about every member of eng. */
+    subject_relation?: string;
+    /** A `consistency_token` a write returned: the answer is then at least as fresh as that write. */
+    consistency_token?: string | null;
+}
+/** Response body of `fga.check`. */
+type FgaCheckResponse = {
+    data: FgaCheck;
+};
+/** Query parameters of `fga.check_batch`. */
+interface FgaCheckBatchQuery {
+    /** 1–100 checks, each `resource_type:resource_id#relation@subject_type:subject_id[#subject_relation]`. */
+    checks: string[];
+    /** A `consistency_token` a write returned: the answer is then at least as fresh as that write. */
+    consistency_token?: string | null;
+}
+/** Response body of `fga.check_batch`. */
+type FgaCheckBatchResponse = {
+    data: FgaCheckBatch;
+};
+/** Query parameters of `fga.resources.list`. */
+interface FgaResourcesListQuery {
+    /** Which type of resource to list: `document`. */
+    resource_type: string;
+    /** The relation the subject must have: `viewer`. */
+    relation: string;
+    /** The subject's type: `user`. */
+    subject_type: string;
+    /** The subject's id: `alice`. */
+    subject_id: string;
+    /** For a userset subject: `member` with `group`/`eng`. */
+    subject_relation?: string;
+    /** A `consistency_token` a write returned: the answer is then at least as fresh as that write. */
+    consistency_token?: string | null;
+    /** Ids per page, 1–1000. Default 100. */
+    limit?: number;
+    /** The `next_cursor` of the previous page. */
+    after?: string;
+}
+/** Response body of `fga.resources.list`. */
+type FgaResourcesListResponse = {
+    data: FgaObject[];
+    meta: PageMeta$1;
+};
+/** Response body of `fga.schema.get`. */
+type FgaSchemaGetResponse = {
+    data: FgaSchema;
+};
+/** Request body of `fga.schema.update`. */
+interface FgaSchemaUpdateBody {
+    /** The schema, in the schema language: `type document` then `  relation viewer: [user, group#member] or editor or viewer from parent`. */
+    schema: string;
+}
+/** Response body of `fga.schema.update`. */
+type FgaSchemaUpdateResponse = {
+    data: FgaSchema;
+};
+/** Query parameters of `fga.schema.validate`. */
+interface FgaSchemaValidateQuery {
+    /** The schema to check, in the schema language. */
+    schema: string;
+}
+/** Response body of `fga.schema.validate`. */
+type FgaSchemaValidateResponse = {
+    data: FgaSchemaValidation;
+};
+/** Query parameters of `fga.subjects.list`. */
+interface FgaSubjectsListQuery {
+    /** The resource's type: `document`. */
+    resource_type: string;
+    /** The resource's id: `readme`. */
+    resource_id: string;
+    /** The relation: `viewer`. */
+    relation: string;
+    /** Which type of subject to list: `user`. */
+    subject_type: string;
+    /** A `consistency_token` a write returned: the answer is then at least as fresh as that write. */
+    consistency_token?: string | null;
+    /** Ids per page, 1–1000. Default 100. */
+    limit?: number;
+    /** The `next_cursor` of the previous page. */
+    after?: string;
+}
+/** Response body of `fga.subjects.list`. */
+type FgaSubjectsListResponse = {
+    data: FgaObject[];
+    meta: PageMeta$1;
+};
+/** Request body of `fga.tuples.delete`. */
+interface FgaTuplesDeleteBody {
+    /** 1–100 tuples to delete, all together or none. */
+    tuples: Array<{
+        /** The resource's type, as the schema names it: `document`. */
+        resource_type: string;
+        /** Your id for the resource: `readme`. */
+        resource_id: string;
+        /** The relation: `viewer`. */
+        relation: string;
+        /** Who: one subject (`user:alice`), or a userset (`group:eng#member`). */
+        subject: {
+            /** The subject's type: `user`, or `group` for a userset. */
+            type: string;
+            /** Your id for the subject: `alice`, `eng`. */
+            id: string;
+            /** For a userset — everybody with this relation on the subject: `member` of `group:eng`. Omit for one subject. */
+            relation?: string | null;
+        };
+    }>;
+}
+/** Response body of `fga.tuples.delete`. */
+type FgaTuplesDeleteResponse = {
+    data: FgaTupleWrite;
+};
+/** Query parameters of `fga.tuples.list`. */
+interface FgaTuplesListQuery {
+    /** Only tuples on this resource type. */
+    resource_type?: string;
+    /** Only tuples on this resource. */
+    resource_id?: string;
+    /** Only tuples of this relation. */
+    relation?: string;
+    /** Only tuples naming this subject type. */
+    subject_type?: string;
+    /** Only tuples naming this subject. */
+    subject_id?: string;
+    /** Only tuples naming a userset with this relation. */
+    subject_relation?: string;
+    /** Tuples per page, 1–100. Default 50. */
+    limit?: number;
+    /** The `next_cursor` of the previous page. */
+    after?: string;
+}
+/** Response body of `fga.tuples.list`. */
+type FgaTuplesListResponse = {
+    data: FgaTuple[];
+    meta: PageMeta$1;
+};
+/** Request body of `fga.tuples.write`. */
+interface FgaTuplesWriteBody {
+    /** 1–100 tuples to write, all together or none. */
+    tuples: Array<{
+        /** The resource's type, as the schema names it: `document`. */
+        resource_type: string;
+        /** Your id for the resource: `readme`. */
+        resource_id: string;
+        /** The relation: `viewer`. */
+        relation: string;
+        /** Who: one subject (`user:alice`), or a userset (`group:eng#member`). */
+        subject: {
+            /** The subject's type: `user`, or `group` for a userset. */
+            type: string;
+            /** Your id for the subject: `alice`, `eng`. */
+            id: string;
+            /** For a userset — everybody with this relation on the subject: `member` of `group:eng`. Omit for one subject. */
+            relation?: string | null;
+        };
+    }>;
+}
+/** Response body of `fga.tuples.write`. */
+type FgaTuplesWriteResponse = {
+    data: FgaTupleWrite;
+};
 /** Request body of `frontend_keys.create`. */
 interface FrontendKeysCreateBody {
     /** What the key is for, so a person recognises it later. */
@@ -2484,6 +3212,95 @@ interface PermissionsUpdateBody {
 type PermissionsUpdateResponse = {
     data: Permission;
 };
+/** Response body of `pipes.connections.delete`. */
+type PipesConnectionsDeleteResponse = void;
+/** Query parameters of `pipes.connections.list`. */
+interface PipesConnectionsListQuery {
+    /** Only this person's connection. */
+    user_id?: string;
+    /** Items per page, 1–100. Default 50. */
+    limit?: number;
+    /** The `next_cursor` of the previous page. */
+    after?: string;
+}
+/** Response body of `pipes.connections.list`. */
+type PipesConnectionsListResponse = {
+    data: PipeConnection[];
+    meta: PageMeta$1;
+};
+/** Request body of `pipes.create`. */
+interface PipesCreateBody {
+    /** The provider's key. */
+    provider: 'github' | 'google' | 'microsoft' | 'slack' | 'salesforce' | 'hubspot' | 'linear' | 'notion';
+    /** The OAuth client id of your app at the provider. */
+    client_id: string;
+    /** Its client secret. Write-only: sealed, never returned. */
+    client_secret: string;
+    /** The OAuth scopes to ask people for. Left out: the provider's defaults. */
+    scopes?: string[];
+    /** Per-installation values some providers need. Left out: the provider's defaults. */
+    parameters?: {
+        /** Microsoft 365 only: `common` (default), `organizations`, or one directory's tenant id or domain. */
+        tenant?: string;
+        /** Salesforce only: `login.salesforce.com` (default), `test.salesforce.com`, or your My Domain host. */
+        domain?: string;
+    };
+}
+/** Response body of `pipes.create`. */
+type PipesCreateResponse = {
+    data: Pipe;
+};
+/** Response body of `pipes.delete`. */
+type PipesDeleteResponse = void;
+/** Response body of `pipes.get`. */
+type PipesGetResponse = {
+    data: Pipe;
+};
+/** Request body of `pipes.grants.create`. */
+interface PipesGrantsCreateBody {
+    /** The OAuth client id of an app in this environment. */
+    client_id: string;
+}
+/** Response body of `pipes.grants.create`. */
+type PipesGrantsCreateResponse = {
+    data: Pipe;
+};
+/** Response body of `pipes.grants.delete`. */
+type PipesGrantsDeleteResponse = void;
+/** Query parameters of `pipes.list`. */
+interface PipesListQuery {
+    /** Items per page, 1–100. Default 50. */
+    limit?: number;
+    /** The `next_cursor` of the previous page. */
+    after?: string;
+}
+/** Response body of `pipes.list`. */
+type PipesListResponse = {
+    data: Pipe[];
+    meta: PageMeta$1;
+};
+/** Request body of `pipes.update`. */
+interface PipesUpdateBody {
+    /** A new OAuth client id. Left out, unchanged. */
+    client_id?: string;
+    /** A new client secret, sealed. Left out, unchanged. */
+    client_secret?: string;
+    /** The OAuth scopes to ask people for. Left out: the provider's defaults. */
+    scopes?: string[];
+    /** Per-installation values some providers need. Left out: the provider's defaults. */
+    parameters?: {
+        /** Microsoft 365 only: `common` (default), `organizations`, or one directory's tenant id or domain. */
+        tenant?: string;
+        /** Salesforce only: `login.salesforce.com` (default), `test.salesforce.com`, or your My Domain host. */
+        domain?: string;
+    };
+    /** False refuses new connections and every lease. Left out, unchanged. */
+    enabled?: boolean;
+}
+/** Response body of `pipes.update`. */
+type PipesUpdateResponse = {
+    data: Pipe;
+};
 /** Request body of `provisioning.targets.create`. */
 interface ProvisioningTargetsCreateBody {
     /** The organization the target belongs to. Send this or environment_wide. */
@@ -2550,6 +3367,184 @@ interface ProvisioningTargetsStatusSetBody {
 type ProvisioningTargetsStatusSetResponse = {
     data: ProvisioningTarget;
 };
+/** Response body of `radar.decisions.get`. */
+type RadarDecisionsGetResponse = {
+    data: RadarDecision;
+};
+/** Query parameters of `radar.decisions.list`. */
+interface RadarDecisionsListQuery {
+    /** `allow`, `challenge` or `block`. */
+    verdict?: 'allow' | 'challenge' | 'block';
+    /** `sign_in` or `sign_up`. */
+    flow?: 'sign_in' | 'sign_up';
+    /** A rule key — `builtin:credential_stuffing`, `rule:<id>`, `deny_list:ip` — that decided or fired. */
+    rule?: string;
+    /** Two-letter country code. */
+    country?: string;
+    /** Attempts with this address (matched by pseudonym). */
+    email?: string;
+    /** Attempts from this IP (matched by pseudonym). */
+    ip?: string;
+    /** Attempts from this device id. */
+    device?: string;
+    /** Only decisions that were (true) or were not (false) acted on. */
+    enforced?: boolean;
+    /** On or after this time (ISO 8601). */
+    from?: string;
+    /** On or before this time (ISO 8601). */
+    to?: string;
+    /** Decisions per page, 1–100. Default 50. */
+    limit?: number;
+    /** The `next_cursor` of the previous page: the decisions older than it. */
+    after?: string;
+}
+/** Response body of `radar.decisions.list`. */
+type RadarDecisionsListResponse = {
+    data: RadarDecision[];
+    meta: PageMeta$1;
+};
+/** Request body of `radar.lists.add`. */
+interface RadarListsAddBody {
+    /** `allow` or `deny`. */
+    list: 'allow' | 'deny';
+    /** `ip` (an address or CIDR range), `email`, `email_domain` or `device`. */
+    kind: 'ip' | 'email' | 'email_domain' | 'device';
+    /** The IP, range, address, domain or device id. */
+    value: string;
+    /** Why it is listed. */
+    note?: string | null;
+    /** When the entry stops applying (ISO 8601). Never, when omitted. */
+    expires_at?: string | null;
+}
+/** Response body of `radar.lists.add`. */
+type RadarListsAddResponse = {
+    data: RadarListEntry;
+};
+/** Query parameters of `radar.lists.list`. */
+interface RadarListsListQuery {
+    /** `allow` or `deny`; both when omitted. */
+    list?: 'allow' | 'deny';
+    /** Only entries of this kind. */
+    kind?: 'ip' | 'email' | 'email_domain' | 'device';
+    /** Items per page, 1–100. Default 50. */
+    limit?: number;
+    /** The `next_cursor` of the previous page. */
+    after?: string;
+}
+/** Response body of `radar.lists.list`. */
+type RadarListsListResponse = {
+    data: RadarListEntry[];
+    meta: PageMeta$1;
+};
+/** Response body of `radar.lists.remove`. */
+type RadarListsRemoveResponse = void;
+/** Request body of `radar.mode.set`. */
+interface RadarModeSetBody {
+    /** `monitor` or `enforce`. */
+    mode: 'monitor' | 'enforce';
+}
+/** Response body of `radar.mode.set`. */
+type RadarModeSetResponse = {
+    data: RadarSettings;
+};
+/** Request body of `radar.rules.create`. */
+interface RadarRulesCreateBody {
+    /** What the rule is for, as the console lists it. */
+    name: string;
+    /** Why the rule exists, for whoever reads it next. */
+    description?: string | null;
+    /** What happens when every condition holds: `allow` (skip every rule after this one), `challenge` (a second factor on sign-in; a CAPTCHA or an emailed code on sign-up) or `block`. */
+    action: 'allow' | 'challenge' | 'block';
+    /** `all` (the default), `sign_in` or `sign_up`. */
+    applies_to?: 'all' | 'sign_in' | 'sign_up';
+    /** Up to 10 conditions; the rule matches when EVERY one holds. A fact that is unknown (no IP intelligence, no address on a passkey sign-in) matches no condition. */
+    conditions: Array<{
+        /** The fact to test. */
+        field: 'ip' | 'country' | 'asn' | 'as_organization' | 'is_hosting' | 'is_vpn' | 'is_proxy' | 'is_tor' | 'email' | 'email_domain' | 'disposable_email' | 'user_agent' | 'method' | 'new_device' | 'impossible_travel' | 'travel_kmh' | 'risk_score' | 'ip_attempts_1m' | 'ip_attempts_1h' | 'ip_distinct_emails_10m' | 'ip_failures_1h' | 'email_attempts_1h' | 'email_failures_1h' | 'device_attempts_1h';
+        /** How to compare it. Which operators a field takes depends on its type. */
+        operator: 'eq' | 'neq' | 'in' | 'not_in' | 'gt' | 'gte' | 'lt' | 'lte' | 'contains' | 'not_contains' | 'starts_with' | 'ends_with' | 'in_cidr' | 'not_in_cidr';
+        /** The one value to compare with, as text — `DK`, `20`, `true`. For every operator except the list ones. */
+        value?: string;
+        /** The values to compare with, for `in`, `not_in`, `in_cidr` and `not_in_cidr`. */
+        values?: string[];
+    }>;
+    /** Whether the rule is evaluated. Default true. */
+    enabled?: boolean;
+    /** Where in the order to put it: 1 is evaluated first. Default: last. */
+    position?: number;
+}
+/** Response body of `radar.rules.create`. */
+type RadarRulesCreateResponse = {
+    data: RadarRule;
+};
+/** Response body of `radar.rules.delete`. */
+type RadarRulesDeleteResponse = void;
+/** Response body of `radar.rules.get`. */
+type RadarRulesGetResponse = {
+    data: RadarRule;
+};
+/** Query parameters of `radar.rules.list`. */
+interface RadarRulesListQuery {
+    /** Rules per page, 1–100. Default 100 — an environment holds at most 100, so one page is all of them. */
+    limit?: number;
+    /** The `next_cursor` of the previous page. */
+    after?: string;
+}
+/** Response body of `radar.rules.list`. */
+type RadarRulesListResponse = {
+    data: RadarRule[];
+    meta: PageMeta$1;
+};
+/** Request body of `radar.rules.reorder`. */
+interface RadarRulesReorderBody {
+    /** Every rule id, in the new order. */
+    rule_ids: string[];
+}
+/** Response body of `radar.rules.reorder`. */
+type RadarRulesReorderResponse = void;
+/** Request body of `radar.rules.update`. */
+interface RadarRulesUpdateBody {
+    /** What the rule is for, as the console lists it. */
+    name?: string;
+    /** Why the rule exists, for whoever reads it next. */
+    description?: string | null;
+    /** What happens when every condition holds: `allow` (skip every rule after this one), `challenge` (a second factor on sign-in; a CAPTCHA or an emailed code on sign-up) or `block`. */
+    action?: 'allow' | 'challenge' | 'block';
+    /** `all` (the default), `sign_in` or `sign_up`. */
+    applies_to?: 'all' | 'sign_in' | 'sign_up';
+    /** Up to 10 conditions; the rule matches when EVERY one holds. A fact that is unknown (no IP intelligence, no address on a passkey sign-in) matches no condition. */
+    conditions?: Array<{
+        /** The fact to test. */
+        field: 'ip' | 'country' | 'asn' | 'as_organization' | 'is_hosting' | 'is_vpn' | 'is_proxy' | 'is_tor' | 'email' | 'email_domain' | 'disposable_email' | 'user_agent' | 'method' | 'new_device' | 'impossible_travel' | 'travel_kmh' | 'risk_score' | 'ip_attempts_1m' | 'ip_attempts_1h' | 'ip_distinct_emails_10m' | 'ip_failures_1h' | 'email_attempts_1h' | 'email_failures_1h' | 'device_attempts_1h';
+        /** How to compare it. Which operators a field takes depends on its type. */
+        operator: 'eq' | 'neq' | 'in' | 'not_in' | 'gt' | 'gte' | 'lt' | 'lte' | 'contains' | 'not_contains' | 'starts_with' | 'ends_with' | 'in_cidr' | 'not_in_cidr';
+        /** The one value to compare with, as text — `DK`, `20`, `true`. For every operator except the list ones. */
+        value?: string;
+        /** The values to compare with, for `in`, `not_in`, `in_cidr` and `not_in_cidr`. */
+        values?: string[];
+    }>;
+    /** Whether the rule is evaluated. Default true. */
+    enabled?: boolean;
+    /** Where in the order to put it: 1 is evaluated first. Default: last. */
+    position?: number;
+}
+/** Response body of `radar.rules.update`. */
+type RadarRulesUpdateResponse = {
+    data: RadarRule;
+};
+/** Response body of `radar.settings.get`. */
+type RadarSettingsGetResponse = {
+    data: RadarSettings;
+};
+/** Request body of `radar.settings.update`. */
+interface RadarSettingsUpdateBody {
+    /** Rule key => `{"enabled": bool, "action": "allow"|"challenge"|"block", "threshold": int}`, each part optional. Keys: credential_stuffing, bot_velocity, account_attack, impossible_travel, new_device, anonymous_network, hosting_network, disposable_email, risk_score_reject, risk_score_elevated. */
+    builtin_rules: Record<string, unknown>;
+}
+/** Response body of `radar.settings.update`. */
+type RadarSettingsUpdateResponse = {
+    data: RadarSettings;
+};
 /** Request body of `roles.create`. */
 interface RolesCreateBody {
     name: string;
@@ -2705,6 +3700,16 @@ interface SigninPolicyUpdateBody {
     sso?: 'off' | 'preferred' | 'required';
     /** Failed attempts before an account is locked; null for the deployment default (10 inside 15 minutes unless CBOX_ID_LOCKOUT_THRESHOLD says otherwise). */
     lockout_threshold?: number | null;
+    /** Environment only. Whether people may sign in with a passkey, and add one. Off at the deployment (CBOX_ID_PASSKEYS_ENABLED=false) stays off. */
+    passkeys?: boolean;
+    /** Environment only. Whether a one-time sign-in link may be emailed. Off at the deployment (CBOX_ID_MAGIC_LINK_ENABLED=false) stays off. */
+    magic_link?: boolean;
+    /** Environment only. Minutes of inactivity before a session ends; null for the deployment's. No more than the deployment allows (CBOX_ID_SESSION_IDLE_MINUTES). */
+    session_idle_minutes?: number | null;
+    /** Environment only. Minutes a session lasts at most, however active; null for the deployment's. No more than the deployment allows (CBOX_ID_SESSION_TTL_MINUTES). */
+    session_absolute_minutes?: number | null;
+    /** Environment only. Whether a sign-up Radar flags is asked to prove it is a person (Cloudflare Turnstile). Has no effect where the deployment has no Turnstile keys. */
+    bot_challenge?: boolean;
 }
 /** Response body of `signin.policy.update`. */
 type SigninPolicyUpdateResponse = {
@@ -2719,6 +3724,23 @@ interface SigninSelfServiceSignupSetBody {
 type SigninSelfServiceSignupSetResponse = {
     data: SelfServiceSignup;
 };
+/** Response body of `signin.sms.get`. */
+type SigninSmsGetResponse = {
+    data: SmsFactorPolicy;
+};
+/** Request body of `signin.sms.update`. */
+interface SigninSmsUpdateBody {
+    /** Accept text messages as a second factor in this environment. Off by default: SMS is the weakest factor offered. */
+    enabled?: boolean;
+    /** ISO 3166-1 alpha-2 countries whose numbers may enrol and be texted. Required to be non-empty while SMS is on: which countries you text is your toll-fraud exposure. */
+    allowed_countries?: Array<'AC' | 'AD' | 'AE' | 'AF' | 'AG' | 'AI' | 'AL' | 'AM' | 'AO' | 'AR' | 'AS' | 'AT' | 'AU' | 'AW' | 'AZ' | 'BA' | 'BB' | 'BD' | 'BE' | 'BF' | 'BG' | 'BH' | 'BI' | 'BJ' | 'BM' | 'BN' | 'BO' | 'BR' | 'BS' | 'BT' | 'BW' | 'BY' | 'BZ' | 'CA' | 'CD' | 'CF' | 'CG' | 'CH' | 'CI' | 'CK' | 'CL' | 'CM' | 'CN' | 'CO' | 'CR' | 'CU' | 'CV' | 'CW' | 'CY' | 'CZ' | 'DE' | 'DJ' | 'DK' | 'DM' | 'DO' | 'DZ' | 'EC' | 'EE' | 'EG' | 'ER' | 'ES' | 'ET' | 'FI' | 'FJ' | 'FK' | 'FM' | 'FO' | 'FR' | 'GA' | 'GB' | 'GD' | 'GE' | 'GF' | 'GH' | 'GI' | 'GL' | 'GM' | 'GN' | 'GP' | 'GQ' | 'GR' | 'GT' | 'GU' | 'GW' | 'GY' | 'HK' | 'HN' | 'HR' | 'HT' | 'HU' | 'ID' | 'IE' | 'IL' | 'IN' | 'IO' | 'IQ' | 'IR' | 'IS' | 'IT' | 'JM' | 'JO' | 'JP' | 'KE' | 'KG' | 'KH' | 'KI' | 'KM' | 'KN' | 'KP' | 'KR' | 'KW' | 'KY' | 'KZ' | 'LA' | 'LB' | 'LC' | 'LI' | 'LK' | 'LR' | 'LS' | 'LT' | 'LU' | 'LV' | 'LY' | 'MA' | 'MC' | 'MD' | 'ME' | 'MG' | 'MH' | 'MK' | 'ML' | 'MM' | 'MN' | 'MO' | 'MP' | 'MQ' | 'MR' | 'MS' | 'MT' | 'MU' | 'MV' | 'MW' | 'MX' | 'MY' | 'MZ' | 'NA' | 'NC' | 'NE' | 'NF' | 'NG' | 'NI' | 'NL' | 'NO' | 'NP' | 'NR' | 'NU' | 'NZ' | 'OM' | 'PA' | 'PE' | 'PF' | 'PG' | 'PH' | 'PK' | 'PL' | 'PM' | 'PR' | 'PS' | 'PT' | 'PW' | 'PY' | 'QA' | 'RE' | 'RO' | 'RS' | 'RU' | 'RW' | 'SA' | 'SB' | 'SC' | 'SD' | 'SE' | 'SG' | 'SH' | 'SI' | 'SK' | 'SL' | 'SM' | 'SN' | 'SO' | 'SR' | 'SS' | 'ST' | 'SV' | 'SX' | 'SY' | 'SZ' | 'TC' | 'TD' | 'TG' | 'TH' | 'TJ' | 'TK' | 'TL' | 'TM' | 'TN' | 'TO' | 'TR' | 'TT' | 'TV' | 'TW' | 'TZ' | 'UA' | 'UG' | 'US' | 'UY' | 'UZ' | 'VC' | 'VE' | 'VG' | 'VI' | 'VN' | 'VU' | 'WF' | 'WS' | 'XK' | 'YE' | 'ZA' | 'ZM' | 'ZW'>;
+    /** Administrators may add SMS only beside an authenticator app or a passkey, and are asked to enrol one if SMS is all they hold. On by default. */
+    privileged_need_stronger_factor?: boolean;
+}
+/** Response body of `signin.sms.update`. */
+type SigninSmsUpdateResponse = {
+    data: SmsFactorPolicy;
+};
 /** Request body of `signin.social.delete`. */
 interface SigninSocialDeleteBody {
     /** Only remove it if it is this organization's. */
@@ -2726,24 +3748,66 @@ interface SigninSocialDeleteBody {
 }
 /** Response body of `signin.social.delete`. */
 type SigninSocialDeleteResponse = void;
-/** Query parameters of `signin.social.list`. */
-interface SigninSocialListQuery {
-    /** Only this organization's providers. */
-    organization_id?: string;
-    /** Items per page, 1–100. Default 50. */
-    limit?: number;
-    /** The `next_cursor` of the previous page. */
-    after?: string;
+/** Request body of `signin.social.disable`. */
+interface SigninSocialDisableBody {
+    /** Only if it is this organization's; anything else is a 404. */
+    organization_id?: string | null;
 }
-/** Response body of `signin.social.list`. */
+/** Response body of `signin.social.disable`. */
+type SigninSocialDisableResponse = {
+    data: SocialProvider;
+};
+/** Request body of `signin.social.enable`. */
+interface SigninSocialEnableBody {
+    /** Only if it is this organization's; anything else is a 404. */
+    organization_id?: string | null;
+}
+/** Response body of `signin.social.enable`. */
+type SigninSocialEnableResponse = {
+    data: SocialProvider;
+};
+/** Request body of `signin.social.inherit`. */
+interface SigninSocialInheritBody {
+    /** The organization whose sign-in page this is about. */
+    organization_id: string;
+    /** False to stop offering the environment's provider on this organization's page; true to offer it again. */
+    offered: boolean;
+}
+/** Response body of `signin.social.inherit`. */
+type SigninSocialInheritResponse = {
+    data: OfferedSocialProviders;
+};
+/** Query parameters of `signin.social.list`. */
+interface SigninSocialListQuery {
+    /** Only this organization's own providers (not the ones it inherits — see signin.social.offered). */
+    organization_id?: string;
+    /** Only the environment's providers, which every organization inherits, or only organizations' own. */
+    level?: 'environment' | 'organization';
+    /** Items per page, 1–100. Default 50. */
+    limit?: number;
+    /** The `next_cursor` of the previous page. */
+    after?: string;
+}
+/** Response body of `signin.social.list`. */
 type SigninSocialListResponse = {
     data: SocialProvider[];
     meta: PageMeta$1;
 };
+/** Query parameters of `signin.social.offered`. */
+interface SigninSocialOfferedQuery {
+    /** The organization whose sign-in page to resolve. Left out, the plain sign-in page, before anybody has said who they are. */
+    organization_id?: string;
+}
+/** Response body of `signin.social.offered`. */
+type SigninSocialOfferedResponse = {
+    data: OfferedSocialProviders;
+};
 /** Request body of `signin.social.set`. */
 interface SigninSocialSetBody {
-    /** The organization whose sign-in page offers it. */
-    organization_id: string;
+    /** The organization the provider belongs to. Send this or environment_wide. */
+    organization_id?: string | null;
+    /** True to make the provider the environment's own rather than one organization's. Send this or organization_id. */
+    environment_wide?: boolean;
     /** The catalogue key: google, microsoft, okta, auth0, keycloak, gitlab, slack, github, discord, apple, facebook, linkedin, bitbucket, xero, intuit. */
     provider: string;
     /** The client id from your own account with the provider. For Apple, the Services ID. */
@@ -2767,11 +3831,47 @@ interface SigninSocialSetBody {
         /** Team ID (Apple). */
         team_id?: string | null;
     };
+    /** Extra scopes to request beyond the ones sign-in needs (for example `read:org` on GitHub). Replaces any extra scopes already set; an empty list removes them. */
+    scopes?: string[];
+    /** A ULID to create the provider under, so its redirect URI (which contains the id) can be registered with the provider first. Left out, one is minted. */
+    reserved_id?: string | null;
 }
 /** Response body of `signin.social.set`. */
 type SigninSocialSetResponse = {
     data: SocialProvider;
 };
+/** Request body of `signin.social.update`. */
+interface SigninSocialUpdateBody {
+    /** Only change it if it is this organization's; anything else is a 404. */
+    organization_id?: string | null;
+    /** A new client id. For Apple, the Services ID. */
+    client_id?: string;
+    /** A new client secret. Write-only; left out or blank keeps the one on file. */
+    client_secret?: string | null;
+    /** What the chosen provider needs besides its client credentials — Microsoft's directory, Okta's domain, Apple's team id, key id and private key. */
+    parameters?: {
+        /** Directory (tenant) ID (Microsoft Entra ID). */
+        directory?: string | null;
+        /** Okta domain (Okta). */
+        domain?: string | null;
+        /** Keycloak host (Keycloak). */
+        host?: string | null;
+        /** Key ID (Apple). */
+        key_id?: string | null;
+        /** Private key (.p8) (Apple). */
+        private_key?: string | null;
+        /** Realm (Keycloak). */
+        realm?: string | null;
+        /** Team ID (Apple). */
+        team_id?: string | null;
+    };
+    /** Extra scopes to request beyond the ones sign-in needs (for example `read:org` on GitHub). Replaces any extra scopes already set; an empty list removes them. */
+    scopes?: string[];
+}
+/** Response body of `signin.social.update`. */
+type SigninSocialUpdateResponse = {
+    data: SocialProvider;
+};
 /** Request body of `sod_policies.create`. */
 interface SodPoliciesCreateBody {
     /** The organization the rule belongs to. Send this or environment_wide. */
@@ -3216,6 +4316,8 @@ type UsersListResponse = {
 };
 /** Response body of `users.mfa.reset`. */
 type UsersMfaResetResponse = void;
+/** Response body of `users.mfa.sms.remove`. */
+type UsersMfaSmsRemoveResponse = void;
 /** Response body of `users.password_reset.send`. */
 type UsersPasswordResetSendResponse = void;
 /** Request body of `users.password.set`. */
@@ -3270,7 +4372,7 @@ interface WebhooksCreateBody {
     /** A public HTTPS URL. Signed deliveries are POSTed here. */
     url: string;
     /** The events it receives. */
-    event_types: Array<'user.created' | 'user.updated' | 'user.deactivated' | 'user.login' | 'user.reactivated' | 'identity.linked' | 'user.erased' | 'organization.created' | 'organization.suspended' | 'organization.reactivated' | 'organization.updated' | 'organization.deleted' | 'membership.created' | 'membership.updated' | 'membership.deleted' | 'invitation.created' | 'invitation.accepted' | 'invitation.revoked' | 'role.assigned' | 'role.unassigned' | 'role.assigned_everywhere' | 'role.unassigned_everywhere' | 'api_key.created' | 'api_key.revoked' | 'support_session.started' | 'directory.user.provisioned' | 'directory.user.deprovisioned' | 'directory.user.deactivated' | 'directory.group.membership_changed' | 'domain.added' | 'domain.removed' | 'domain.verified' | 'connection.activated' | 'connection.certificate_expiring' | 'entitlement.set' | 'entitlement.updated' | 'entitlement.revoked' | 'vault.grant.created' | 'vault.grant.revoked' | 'vault.secret.revoked' | 'governance.access.revoked'>;
+    event_types: Array<'user.created' | 'user.updated' | 'user.deactivated' | 'user.login' | 'user.reactivated' | 'identity.linked' | 'user.erased' | 'organization.created' | 'organization.suspended' | 'organization.reactivated' | 'organization.updated' | 'organization.deleted' | 'membership.created' | 'membership.updated' | 'membership.deleted' | 'invitation.created' | 'invitation.accepted' | 'invitation.revoked' | 'role.assigned' | 'role.unassigned' | 'role.assigned_everywhere' | 'role.unassigned_everywhere' | 'api_key.created' | 'api_key.revoked' | 'support_session.started' | 'directory.user.provisioned' | 'directory.user.deprovisioned' | 'directory.user.deactivated' | 'directory.group.membership_changed' | 'domain.added' | 'domain.removed' | 'domain.verified' | 'connection.activated' | 'connection.certificate_expiring' | 'entitlement.set' | 'entitlement.updated' | 'entitlement.revoked' | 'vault.grant.created' | 'vault.grant.revoked' | 'vault.secret.revoked' | 'pipe.connection.connected' | 'pipe.connection.needs_reauth' | 'pipe.connection.disconnected' | 'governance.access.revoked' | 'feature_flag.created' | 'feature_flag.updated' | 'feature_flag.deleted'>;
     /** How deliveries are signed: `cbox` (X-Cbox-Signature, the default) or `standard_webhooks` (webhook-id / webhook-timestamp / webhook-signature, verifiable with any Standard Webhooks library; the secret is a `whsec_` secret). */
     signature_scheme?: 'cbox' | 'standard_webhooks';
     /** The organization it belongs to; it carries that organization's traffic only. Send this or environment_wide. */
@@ -3982,6 +5084,18 @@ declare const environmentOperations: {
         readonly body: true;
         readonly pagination: null;
     };
+    readonly 'directories.credentials.replace': {
+        readonly action: "directories.credentials.replace";
+        readonly operationId: "directories_credentials_replace";
+        readonly method: "PUT";
+        readonly path: "/directories/{id}/credentials";
+        readonly pathParams: readonly ["id"];
+        readonly scope: "directory_sync:write";
+        readonly danger: "critical";
+        readonly approval: true;
+        readonly body: true;
+        readonly pagination: null;
+    };
     readonly 'directories.delete': {
         readonly action: "directories.delete";
         readonly operationId: "directories_delete";
@@ -4030,6 +5144,18 @@ declare const environmentOperations: {
         readonly body: true;
         readonly pagination: null;
     };
+    readonly 'directories.hris.connect': {
+        readonly action: "directories.hris.connect";
+        readonly operationId: "directories_hris_connect";
+        readonly method: "POST";
+        readonly path: "/directories/hris";
+        readonly pathParams: readonly [];
+        readonly scope: "directory_sync:write";
+        readonly danger: "critical";
+        readonly approval: true;
+        readonly body: true;
+        readonly pagination: null;
+    };
     readonly 'directories.list': {
         readonly action: "directories.list";
         readonly operationId: "directories_list";
@@ -4054,6 +5180,30 @@ declare const environmentOperations: {
         readonly body: true;
         readonly pagination: null;
     };
+    readonly 'directories.sync': {
+        readonly action: "directories.sync";
+        readonly operationId: "directories_sync";
+        readonly method: "POST";
+        readonly path: "/directories/{id}/sync";
+        readonly pathParams: readonly ["id"];
+        readonly scope: "directory_sync:write";
+        readonly danger: "write";
+        readonly approval: true;
+        readonly body: true;
+        readonly pagination: null;
+    };
+    readonly 'directories.sync_settings.update': {
+        readonly action: "directories.sync_settings.update";
+        readonly operationId: "directories_sync_settings_update";
+        readonly method: "PATCH";
+        readonly path: "/directories/{id}/sync-settings";
+        readonly pathParams: readonly ["id"];
+        readonly scope: "directory_sync:write";
+        readonly danger: "write";
+        readonly approval: true;
+        readonly body: true;
+        readonly pagination: null;
+    };
     readonly 'directories.token.rotate': {
         readonly action: "directories.token.rotate";
         readonly operationId: "directories_token_rotate";
@@ -4138,6 +5288,198 @@ declare const environmentOperations: {
         readonly body: false;
         readonly pagination: "cursor";
     };
+    readonly 'feature_flags.create': {
+        readonly action: "feature_flags.create";
+        readonly operationId: "feature_flags_create";
+        readonly method: "POST";
+        readonly path: "/feature-flags";
+        readonly pathParams: readonly [];
+        readonly scope: "feature_flags:write";
+        readonly danger: "write";
+        readonly approval: true;
+        readonly body: true;
+        readonly pagination: null;
+    };
+    readonly 'feature_flags.delete': {
+        readonly action: "feature_flags.delete";
+        readonly operationId: "feature_flags_delete";
+        readonly method: "DELETE";
+        readonly path: "/feature-flags/{id}";
+        readonly pathParams: readonly ["id"];
+        readonly scope: "feature_flags:write";
+        readonly danger: "destructive";
+        readonly approval: true;
+        readonly body: false;
+        readonly pagination: null;
+    };
+    readonly 'feature_flags.evaluate': {
+        readonly action: "feature_flags.evaluate";
+        readonly operationId: "feature_flags_evaluate";
+        readonly method: "GET";
+        readonly path: "/feature-flags/evaluate";
+        readonly pathParams: readonly [];
+        readonly scope: "feature_flags:read";
+        readonly danger: "read";
+        readonly approval: true;
+        readonly body: false;
+        readonly pagination: null;
+    };
+    readonly 'feature_flags.get': {
+        readonly action: "feature_flags.get";
+        readonly operationId: "feature_flags_get";
+        readonly method: "GET";
+        readonly path: "/feature-flags/{id}";
+        readonly pathParams: readonly ["id"];
+        readonly scope: "feature_flags:read";
+        readonly danger: "read";
+        readonly approval: true;
+        readonly body: false;
+        readonly pagination: null;
+    };
+    readonly 'feature_flags.list': {
+        readonly action: "feature_flags.list";
+        readonly operationId: "feature_flags_list";
+        readonly method: "GET";
+        readonly path: "/feature-flags";
+        readonly pathParams: readonly [];
+        readonly scope: "feature_flags:read";
+        readonly danger: "read";
+        readonly approval: true;
+        readonly body: false;
+        readonly pagination: "cursor";
+    };
+    readonly 'feature_flags.update': {
+        readonly action: "feature_flags.update";
+        readonly operationId: "feature_flags_update";
+        readonly method: "PATCH";
+        readonly path: "/feature-flags/{id}";
+        readonly pathParams: readonly ["id"];
+        readonly scope: "feature_flags:write";
+        readonly danger: "write";
+        readonly approval: true;
+        readonly body: true;
+        readonly pagination: null;
+    };
+    readonly 'fga.check': {
+        readonly action: "fga.check";
+        readonly operationId: "fga_check";
+        readonly method: "GET";
+        readonly path: "/fga/check";
+        readonly pathParams: readonly [];
+        readonly scope: "fga:read";
+        readonly danger: "read";
+        readonly approval: true;
+        readonly body: false;
+        readonly pagination: null;
+    };
+    readonly 'fga.check_batch': {
+        readonly action: "fga.check_batch";
+        readonly operationId: "fga_check_batch";
+        readonly method: "GET";
+        readonly path: "/fga/check/batch";
+        readonly pathParams: readonly [];
+        readonly scope: "fga:read";
+        readonly danger: "read";
+        readonly approval: true;
+        readonly body: false;
+        readonly pagination: null;
+    };
+    readonly 'fga.resources.list': {
+        readonly action: "fga.resources.list";
+        readonly operationId: "fga_resources_list";
+        readonly method: "GET";
+        readonly path: "/fga/resources";
+        readonly pathParams: readonly [];
+        readonly scope: "fga:read";
+        readonly danger: "read";
+        readonly approval: true;
+        readonly body: false;
+        readonly pagination: "cursor";
+    };
+    readonly 'fga.schema.get': {
+        readonly action: "fga.schema.get";
+        readonly operationId: "fga_schema_get";
+        readonly method: "GET";
+        readonly path: "/fga/schema";
+        readonly pathParams: readonly [];
+        readonly scope: "fga:read";
+        readonly danger: "read";
+        readonly approval: true;
+        readonly body: false;
+        readonly pagination: null;
+    };
+    readonly 'fga.schema.update': {
+        readonly action: "fga.schema.update";
+        readonly operationId: "fga_schema_update";
+        readonly method: "PUT";
+        readonly path: "/fga/schema";
+        readonly pathParams: readonly [];
+        readonly scope: "fga:schema";
+        readonly danger: "critical";
+        readonly approval: true;
+        readonly body: true;
+        readonly pagination: null;
+    };
+    readonly 'fga.schema.validate': {
+        readonly action: "fga.schema.validate";
+        readonly operationId: "fga_schema_validate";
+        readonly method: "GET";
+        readonly path: "/fga/schema/validate";
+        readonly pathParams: readonly [];
+        readonly scope: "fga:read";
+        readonly danger: "read";
+        readonly approval: true;
+        readonly body: false;
+        readonly pagination: null;
+    };
+    readonly 'fga.subjects.list': {
+        readonly action: "fga.subjects.list";
+        readonly operationId: "fga_subjects_list";
+        readonly method: "GET";
+        readonly path: "/fga/subjects";
+        readonly pathParams: readonly [];
+        readonly scope: "fga:read";
+        readonly danger: "read";
+        readonly approval: true;
+        readonly body: false;
+        readonly pagination: "cursor";
+    };
+    readonly 'fga.tuples.delete': {
+        readonly action: "fga.tuples.delete";
+        readonly operationId: "fga_tuples_delete";
+        readonly method: "POST";
+        readonly path: "/fga/tuples/delete";
+        readonly pathParams: readonly [];
+        readonly scope: "fga:write";
+        readonly danger: "destructive";
+        readonly approval: true;
+        readonly body: true;
+        readonly pagination: null;
+    };
+    readonly 'fga.tuples.list': {
+        readonly action: "fga.tuples.list";
+        readonly operationId: "fga_tuples_list";
+        readonly method: "GET";
+        readonly path: "/fga/tuples";
+        readonly pathParams: readonly [];
+        readonly scope: "fga:read";
+        readonly danger: "read";
+        readonly approval: true;
+        readonly body: false;
+        readonly pagination: "cursor";
+    };
+    readonly 'fga.tuples.write': {
+        readonly action: "fga.tuples.write";
+        readonly operationId: "fga_tuples_write";
+        readonly method: "POST";
+        readonly path: "/fga/tuples";
+        readonly pathParams: readonly [];
+        readonly scope: "fga:write";
+        readonly danger: "write";
+        readonly approval: true;
+        readonly body: true;
+        readonly pagination: null;
+    };
     readonly 'frontend_keys.create': {
         readonly action: "frontend_keys.create";
         readonly operationId: "frontend_keys_create";
@@ -4786,6 +6128,114 @@ declare const environmentOperations: {
         readonly body: true;
         readonly pagination: null;
     };
+    readonly 'pipes.connections.delete': {
+        readonly action: "pipes.connections.delete";
+        readonly operationId: "pipes_connections_delete";
+        readonly method: "DELETE";
+        readonly path: "/pipes/{id}/connections/{connection_id}";
+        readonly pathParams: readonly ["id", "connection_id"];
+        readonly scope: "pipes:write";
+        readonly danger: "destructive";
+        readonly approval: true;
+        readonly body: false;
+        readonly pagination: null;
+    };
+    readonly 'pipes.connections.list': {
+        readonly action: "pipes.connections.list";
+        readonly operationId: "pipes_connections_list";
+        readonly method: "GET";
+        readonly path: "/pipes/{id}/connections";
+        readonly pathParams: readonly ["id"];
+        readonly scope: "pipes:read";
+        readonly danger: "read";
+        readonly approval: true;
+        readonly body: false;
+        readonly pagination: "cursor";
+    };
+    readonly 'pipes.create': {
+        readonly action: "pipes.create";
+        readonly operationId: "pipes_create";
+        readonly method: "POST";
+        readonly path: "/pipes";
+        readonly pathParams: readonly [];
+        readonly scope: "pipes:write";
+        readonly danger: "write";
+        readonly approval: true;
+        readonly body: true;
+        readonly pagination: null;
+    };
+    readonly 'pipes.delete': {
+        readonly action: "pipes.delete";
+        readonly operationId: "pipes_delete";
+        readonly method: "DELETE";
+        readonly path: "/pipes/{id}";
+        readonly pathParams: readonly ["id"];
+        readonly scope: "pipes:write";
+        readonly danger: "destructive";
+        readonly approval: true;
+        readonly body: false;
+        readonly pagination: null;
+    };
+    readonly 'pipes.get': {
+        readonly action: "pipes.get";
+        readonly operationId: "pipes_get";
+        readonly method: "GET";
+        readonly path: "/pipes/{id}";
+        readonly pathParams: readonly ["id"];
+        readonly scope: "pipes:read";
+        readonly danger: "read";
+        readonly approval: true;
+        readonly body: false;
+        readonly pagination: null;
+    };
+    readonly 'pipes.grants.create': {
+        readonly action: "pipes.grants.create";
+        readonly operationId: "pipes_grants_create";
+        readonly method: "POST";
+        readonly path: "/pipes/{id}/grants";
+        readonly pathParams: readonly ["id"];
+        readonly scope: "pipes:write";
+        readonly danger: "critical";
+        readonly approval: true;
+        readonly body: true;
+        readonly pagination: null;
+    };
+    readonly 'pipes.grants.delete': {
+        readonly action: "pipes.grants.delete";
+        readonly operationId: "pipes_grants_delete";
+        readonly method: "DELETE";
+        readonly path: "/pipes/{id}/grants/{client_id}";
+        readonly pathParams: readonly ["id", "client_id"];
+        readonly scope: "pipes:write";
+        readonly danger: "destructive";
+        readonly approval: true;
+        readonly body: false;
+        readonly pagination: null;
+    };
+    readonly 'pipes.list': {
+        readonly action: "pipes.list";
+        readonly operationId: "pipes_list";
+        readonly method: "GET";
+        readonly path: "/pipes";
+        readonly pathParams: readonly [];
+        readonly scope: "pipes:read";
+        readonly danger: "read";
+        readonly approval: true;
+        readonly body: false;
+        readonly pagination: "cursor";
+    };
+    readonly 'pipes.update': {
+        readonly action: "pipes.update";
+        readonly operationId: "pipes_update";
+        readonly method: "PATCH";
+        readonly path: "/pipes/{id}";
+        readonly pathParams: readonly ["id"];
+        readonly scope: "pipes:write";
+        readonly danger: "write";
+        readonly approval: true;
+        readonly body: true;
+        readonly pagination: null;
+    };
     readonly 'provisioning.targets.create': {
         readonly action: "provisioning.targets.create";
         readonly operationId: "provisioning_targets_create";
@@ -4846,6 +6296,174 @@ declare const environmentOperations: {
         readonly body: true;
         readonly pagination: null;
     };
+    readonly 'radar.decisions.get': {
+        readonly action: "radar.decisions.get";
+        readonly operationId: "radar_decisions_get";
+        readonly method: "GET";
+        readonly path: "/radar/decisions/{id}";
+        readonly pathParams: readonly ["id"];
+        readonly scope: "radar:read";
+        readonly danger: "read";
+        readonly approval: true;
+        readonly body: false;
+        readonly pagination: null;
+    };
+    readonly 'radar.decisions.list': {
+        readonly action: "radar.decisions.list";
+        readonly operationId: "radar_decisions_list";
+        readonly method: "GET";
+        readonly path: "/radar/decisions";
+        readonly pathParams: readonly [];
+        readonly scope: "radar:read";
+        readonly danger: "read";
+        readonly approval: true;
+        readonly body: false;
+        readonly pagination: "cursor";
+    };
+    readonly 'radar.lists.add': {
+        readonly action: "radar.lists.add";
+        readonly operationId: "radar_lists_add";
+        readonly method: "POST";
+        readonly path: "/radar/lists";
+        readonly pathParams: readonly [];
+        readonly scope: "radar:write";
+        readonly danger: "write";
+        readonly approval: true;
+        readonly body: true;
+        readonly pagination: null;
+    };
+    readonly 'radar.lists.list': {
+        readonly action: "radar.lists.list";
+        readonly operationId: "radar_lists_list";
+        readonly method: "GET";
+        readonly path: "/radar/lists";
+        readonly pathParams: readonly [];
+        readonly scope: "radar:read";
+        readonly danger: "read";
+        readonly approval: true;
+        readonly body: false;
+        readonly pagination: "cursor";
+    };
+    readonly 'radar.lists.remove': {
+        readonly action: "radar.lists.remove";
+        readonly operationId: "radar_lists_remove";
+        readonly method: "DELETE";
+        readonly path: "/radar/lists/{id}";
+        readonly pathParams: readonly ["id"];
+        readonly scope: "radar:write";
+        readonly danger: "destructive";
+        readonly approval: true;
+        readonly body: false;
+        readonly pagination: null;
+    };
+    readonly 'radar.mode.set': {
+        readonly action: "radar.mode.set";
+        readonly operationId: "radar_mode_set";
+        readonly method: "PUT";
+        readonly path: "/radar/mode";
+        readonly pathParams: readonly [];
+        readonly scope: "radar:manage";
+        readonly danger: "critical";
+        readonly approval: true;
+        readonly body: true;
+        readonly pagination: null;
+    };
+    readonly 'radar.rules.create': {
+        readonly action: "radar.rules.create";
+        readonly operationId: "radar_rules_create";
+        readonly method: "POST";
+        readonly path: "/radar/rules";
+        readonly pathParams: readonly [];
+        readonly scope: "radar:write";
+        readonly danger: "write";
+        readonly approval: true;
+        readonly body: true;
+        readonly pagination: null;
+    };
+    readonly 'radar.rules.delete': {
+        readonly action: "radar.rules.delete";
+        readonly operationId: "radar_rules_delete";
+        readonly method: "DELETE";
+        readonly path: "/radar/rules/{id}";
+        readonly pathParams: readonly ["id"];
+        readonly scope: "radar:write";
+        readonly danger: "destructive";
+        readonly approval: true;
+        readonly body: false;
+        readonly pagination: null;
+    };
+    readonly 'radar.rules.get': {
+        readonly action: "radar.rules.get";
+        readonly operationId: "radar_rules_get";
+        readonly method: "GET";
+        readonly path: "/radar/rules/{id}";
+        readonly pathParams: readonly ["id"];
+        readonly scope: "radar:read";
+        readonly danger: "read";
+        readonly approval: true;
+        readonly body: false;
+        readonly pagination: null;
+    };
+    readonly 'radar.rules.list': {
+        readonly action: "radar.rules.list";
+        readonly operationId: "radar_rules_list";
+        readonly method: "GET";
+        readonly path: "/radar/rules";
+        readonly pathParams: readonly [];
+        readonly scope: "radar:read";
+        readonly danger: "read";
+        readonly approval: true;
+        readonly body: false;
+        readonly pagination: "cursor";
+    };
+    readonly 'radar.rules.reorder': {
+        readonly action: "radar.rules.reorder";
+        readonly operationId: "radar_rules_reorder";
+        readonly method: "PUT";
+        readonly path: "/radar/rules/order";
+        readonly pathParams: readonly [];
+        readonly scope: "radar:write";
+        readonly danger: "write";
+        readonly approval: true;
+        readonly body: true;
+        readonly pagination: null;
+    };
+    readonly 'radar.rules.update': {
+        readonly action: "radar.rules.update";
+        readonly operationId: "radar_rules_update";
+        readonly method: "PATCH";
+        readonly path: "/radar/rules/{id}";
+        readonly pathParams: readonly ["id"];
+        readonly scope: "radar:write";
+        readonly danger: "write";
+        readonly approval: true;
+        readonly body: true;
+        readonly pagination: null;
+    };
+    readonly 'radar.settings.get': {
+        readonly action: "radar.settings.get";
+        readonly operationId: "radar_settings_get";
+        readonly method: "GET";
+        readonly path: "/radar/settings";
+        readonly pathParams: readonly [];
+        readonly scope: "radar:read";
+        readonly danger: "read";
+        readonly approval: true;
+        readonly body: false;
+        readonly pagination: null;
+    };
+    readonly 'radar.settings.update': {
+        readonly action: "radar.settings.update";
+        readonly operationId: "radar_settings_update";
+        readonly method: "PATCH";
+        readonly path: "/radar/settings";
+        readonly pathParams: readonly [];
+        readonly scope: "radar:write";
+        readonly danger: "write";
+        readonly approval: true;
+        readonly body: true;
+        readonly pagination: null;
+    };
     readonly 'roles.create': {
         readonly action: "roles.create";
         readonly operationId: "roles_create";
@@ -5038,6 +6656,30 @@ declare const environmentOperations: {
         readonly body: true;
         readonly pagination: null;
     };
+    readonly 'signin.sms.get': {
+        readonly action: "signin.sms.get";
+        readonly operationId: "signin_sms_get";
+        readonly method: "GET";
+        readonly path: "/sign-in/sms";
+        readonly pathParams: readonly [];
+        readonly scope: "signin:read";
+        readonly danger: "read";
+        readonly approval: true;
+        readonly body: false;
+        readonly pagination: null;
+    };
+    readonly 'signin.sms.update': {
+        readonly action: "signin.sms.update";
+        readonly operationId: "signin_sms_update";
+        readonly method: "PATCH";
+        readonly path: "/sign-in/sms";
+        readonly pathParams: readonly [];
+        readonly scope: "signin:write";
+        readonly danger: "critical";
+        readonly approval: true;
+        readonly body: true;
+        readonly pagination: null;
+    };
     readonly 'signin.social.delete': {
         readonly action: "signin.social.delete";
         readonly operationId: "signin_social_delete";
@@ -5050,6 +6692,42 @@ declare const environmentOperations: {
         readonly body: true;
         readonly pagination: null;
     };
+    readonly 'signin.social.disable': {
+        readonly action: "signin.social.disable";
+        readonly operationId: "signin_social_disable";
+        readonly method: "POST";
+        readonly path: "/sign-in/social-providers/{id}/disable";
+        readonly pathParams: readonly ["id"];
+        readonly scope: "signin:write";
+        readonly danger: "critical";
+        readonly approval: true;
+        readonly body: true;
+        readonly pagination: null;
+    };
+    readonly 'signin.social.enable': {
+        readonly action: "signin.social.enable";
+        readonly operationId: "signin_social_enable";
+        readonly method: "POST";
+        readonly path: "/sign-in/social-providers/{id}/enable";
+        readonly pathParams: readonly ["id"];
+        readonly scope: "signin:write";
+        readonly danger: "write";
+        readonly approval: true;
+        readonly body: true;
+        readonly pagination: null;
+    };
+    readonly 'signin.social.inherit': {
+        readonly action: "signin.social.inherit";
+        readonly operationId: "signin_social_inherit";
+        readonly method: "PUT";
+        readonly path: "/sign-in/social-providers/inherited/{provider}";
+        readonly pathParams: readonly ["provider"];
+        readonly scope: "signin:write";
+        readonly danger: "write";
+        readonly approval: true;
+        readonly body: true;
+        readonly pagination: null;
+    };
     readonly 'signin.social.list': {
         readonly action: "signin.social.list";
         readonly operationId: "signin_social_list";
@@ -5062,6 +6740,18 @@ declare const environmentOperations: {
         readonly body: false;
         readonly pagination: "cursor";
     };
+    readonly 'signin.social.offered': {
+        readonly action: "signin.social.offered";
+        readonly operationId: "signin_social_offered";
+        readonly method: "GET";
+        readonly path: "/sign-in/social-providers/offered";
+        readonly pathParams: readonly [];
+        readonly scope: "signin:read";
+        readonly danger: "read";
+        readonly approval: true;
+        readonly body: false;
+        readonly pagination: null;
+    };
     readonly 'signin.social.set': {
         readonly action: "signin.social.set";
         readonly operationId: "signin_social_set";
@@ -5074,6 +6764,18 @@ declare const environmentOperations: {
         readonly body: true;
         readonly pagination: null;
     };
+    readonly 'signin.social.update': {
+        readonly action: "signin.social.update";
+        readonly operationId: "signin_social_update";
+        readonly method: "PATCH";
+        readonly path: "/sign-in/social-providers/{id}";
+        readonly pathParams: readonly ["id"];
+        readonly scope: "signin:write";
+        readonly danger: "critical";
+        readonly approval: true;
+        readonly body: true;
+        readonly pagination: null;
+    };
     readonly 'sod_policies.create': {
         readonly action: "sod_policies.create";
         readonly operationId: "sod_policies_create";
@@ -5566,6 +7268,18 @@ declare const environmentOperations: {
         readonly body: false;
         readonly pagination: null;
     };
+    readonly 'users.mfa.sms.remove': {
+        readonly action: "users.mfa.sms.remove";
+        readonly operationId: "users_mfa_sms_remove";
+        readonly method: "DELETE";
+        readonly path: "/users/{id}/mfa/sms";
+        readonly pathParams: readonly ["id"];
+        readonly scope: "users:write";
+        readonly danger: "critical";
+        readonly approval: true;
+        readonly body: false;
+        readonly pagination: null;
+    };
     readonly 'users.password_reset.send': {
         readonly action: "users.password_reset.send";
         readonly operationId: "users_password_reset_send";
@@ -6435,7 +8149,7 @@ declare class EnvironmentClient {
              */
             get: <O extends CallOptions = CallOptions>(query?: BrandingAppearanceGetQuery, options?: O) => Promise<Outcome<BrandingAppearanceGetResponse, O>>;
             /**
-             * Set the hosted sign-in theme (preset, colours, corners, type, logo) for the environment default or one organization.
+             * Set the hosted sign-in theme (preset, colours, corners, type, uploaded logo and favicon) for the environment default or one organization.
              *
              * Requires scope `branding:write`. Danger: write.
              *
@@ -6529,6 +8243,17 @@ declare class EnvironmentClient {
         list: <O extends CallOptions = CallOptions>(query?: DirectoriesListQuery, options?: O) => Promise<Outcome<DirectoriesListResponse, O>>;
         /** Every item of `directories.list`, fetching pages as the iteration reaches them. */
         listAll: (query?: Omit<DirectoriesListQuery, "after">, options?: Omit<CallOptions, "approval">) => AsyncGenerator<Directory, void, undefined>;
+        /**
+         * Pull a Google Workspace, Microsoft Entra or HR-system directory now, on a worker. `full` asks an HR system for everybody rather than what changed.
+         *
+         * Requires scope `directory_sync:write`. Danger: write.
+         *
+         * `POST /directories/{id}/sync` · action `directories.sync`
+         * @scope `directory_sync:write`
+         * @danger write
+         * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+         */
+        sync: <O extends CallOptions = CallOptions>(id: string, body?: DirectoriesSyncBody, options?: O) => Promise<Outcome<DirectoriesSyncResponse, O>>;
         /**
          * Rename an inbound directory.
          *
@@ -6540,6 +8265,19 @@ declare class EnvironmentClient {
          * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
          */
         update: <O extends CallOptions = CallOptions>(id: string, body: DirectoriesUpdateBody, options?: O) => Promise<Outcome<DirectoriesUpdateResponse, O>>;
+        credentials: {
+            /**
+             * Replace a pull directory's provider credentials, verifying the new ones first. Write-only; never returned.
+             *
+             * Requires scope `directory_sync:write`. Danger: critical.
+             *
+             * `PUT /directories/{id}/credentials` · action `directories.credentials.replace`
+             * @scope `directory_sync:write`
+             * @danger critical
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            replace: <O extends CallOptions = CallOptions>(id: string, body: DirectoriesCredentialsReplaceBody, options?: O) => Promise<Outcome<DirectoriesCredentialsReplaceResponse, O>>;
+        };
         groups: {
             /**
              * List the groups a directory has synced, with the role ids each group is mapped onto.
@@ -6566,6 +8304,19 @@ declare class EnvironmentClient {
              */
             map: <O extends CallOptions = CallOptions>(id: string, body: DirectoriesGroupsMapBody, options?: O) => Promise<Outcome<DirectoriesGroupsMapResponse, O>>;
         };
+        hris: {
+            /**
+             * Connect an HR system (Workday, BambooHR, Rippling, HiBob or Personio) to sync an organization's people from, verifying the credentials first. The first sync is queued.
+             *
+             * Requires scope `directory_sync:write`. Danger: critical.
+             *
+             * `POST /directories/hris` · action `directories.hris.connect`
+             * @scope `directory_sync:write`
+             * @danger critical
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            connect: <O extends CallOptions = CallOptions>(body: DirectoriesHrisConnectBody, options?: O) => Promise<Outcome<DirectoriesHrisConnectResponse, O>>;
+        };
         status: {
             /**
              * Pause or resume an inbound directory's provisioning.
@@ -6579,6 +8330,19 @@ declare class EnvironmentClient {
              */
             set: <O extends CallOptions = CallOptions>(id: string, body: DirectoriesStatusSetBody, options?: O) => Promise<Outcome<DirectoriesStatusSetResponse, O>>;
         };
+        syncSettings: {
+            /**
+             * Set how often a pull directory syncs, and for an HR system which of its fields pass through onto people.
+             *
+             * Requires scope `directory_sync:write`. Danger: write.
+             *
+             * `PATCH /directories/{id}/sync-settings` · action `directories.sync_settings.update`
+             * @scope `directory_sync:write`
+             * @danger write
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            update: <O extends CallOptions = CallOptions>(id: string, body?: DirectoriesSyncSettingsUpdateBody, options?: O) => Promise<Outcome<DirectoriesSyncSettingsUpdateResponse, O>>;
+        };
         token: {
             /**
              * Issue a new bearer token for a SCIM directory, returned once. The old token stops working immediately.
@@ -6654,6 +8418,202 @@ declare class EnvironmentClient {
         /** Every item of `events.list`, fetching pages as the iteration reaches them. */
         listAll: (query?: Omit<EventsListQuery, "after">, options?: Omit<CallOptions, "approval">) => AsyncGenerator<DomainEvent, void, undefined>;
     };
+    readonly featureFlags: {
+        /**
+         * Define a feature flag: a key apps ask about, its default, and who it is on for — named users, named organizations, a rollout percentage.
+         *
+         * Requires scope `feature_flags:write`. Danger: write.
+         *
+         * `POST /feature-flags` · action `feature_flags.create`
+         * @scope `feature_flags:write`
+         * @danger write
+         * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+         */
+        create: <O extends CallOptions = CallOptions>(body: FeatureFlagsCreateBody, options?: O) => Promise<Outcome<FeatureFlagsCreateResponse, O>>;
+        /**
+         * Delete a feature flag and its rules. Its key evaluates to off from now on; tokens already minted keep it until they expire.
+         *
+         * Requires scope `feature_flags:write`. Danger: destructive.
+         *
+         * `DELETE /feature-flags/{id}` · action `feature_flags.delete`
+         * @scope `feature_flags:write`
+         * @danger destructive
+         * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+         */
+        delete: <O extends CallOptions = CallOptions>(id: string, options?: O) => Promise<Outcome<FeatureFlagsDeleteResponse, O>>;
+        /**
+         * Evaluate every feature flag for a user in an organization: whether each is on, and the rule that decided. For app backends without a token in hand.
+         *
+         * Requires scope `feature_flags:read`. Danger: read.
+         *
+         * `GET /feature-flags/evaluate` · action `feature_flags.evaluate`
+         * @scope `feature_flags:read`
+         * @danger read
+         * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+         */
+        evaluate: <O extends CallOptions = CallOptions>(query?: FeatureFlagsEvaluateQuery, options?: O) => Promise<Outcome<FeatureFlagsEvaluateResponse, O>>;
+        /**
+         * Read one feature flag: its default, whether it is switched on, and every user, organization and rollout rule.
+         *
+         * Requires scope `feature_flags:read`. Danger: read.
+         *
+         * `GET /feature-flags/{id}` · action `feature_flags.get`
+         * @scope `feature_flags:read`
+         * @danger read
+         * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+         */
+        get: <O extends CallOptions = CallOptions>(id: string, options?: O) => Promise<Outcome<FeatureFlagsGetResponse, O>>;
+        /**
+         * List this environment's feature flags with their default, kill switch and targeting rules.
+         *
+         * Requires scope `feature_flags:read`. Danger: read.
+         *
+         * `GET /feature-flags` · action `feature_flags.list`
+         * @scope `feature_flags:read`
+         * @danger read
+         * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+         */
+        list: <O extends CallOptions = CallOptions>(query?: FeatureFlagsListQuery, options?: O) => Promise<Outcome<FeatureFlagsListResponse, O>>;
+        /** Every item of `feature_flags.list`, fetching pages as the iteration reaches them. */
+        listAll: (query?: Omit<FeatureFlagsListQuery, "after">, options?: Omit<CallOptions, "approval">) => AsyncGenerator<FeatureFlag, void, undefined>;
+        /**
+         * Change a feature flag: switch it on or off for everyone, change its default, or replace its user rules, organization rules or rollout percentage.
+         *
+         * Requires scope `feature_flags:write`. Danger: write.
+         *
+         * `PATCH /feature-flags/{id}` · action `feature_flags.update`
+         * @scope `feature_flags:write`
+         * @danger write
+         * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+         */
+        update: <O extends CallOptions = CallOptions>(id: string, body?: FeatureFlagsUpdateBody, options?: O) => Promise<Outcome<FeatureFlagsUpdateResponse, O>>;
+    };
+    readonly fga: {
+        /**
+         * Check whether a subject has a relation on a resource — directly, through computed relations, parents or nested groups. Optionally at least as fresh as a consistency_token.
+         *
+         * Requires scope `fga:read`. Danger: read.
+         *
+         * `GET /fga/check` · action `fga.check`
+         * @scope `fga:read`
+         * @danger read
+         * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+         */
+        check: <O extends CallOptions = CallOptions>(query: FgaCheckQuery, options?: O) => Promise<Outcome<FgaCheckResponse, O>>;
+        /**
+         * Run 1–100 checks in one round trip, each written resource#relation@subject (document:readme#viewer@user:alice), all at the same revision, answered in order.
+         *
+         * Requires scope `fga:read`. Danger: read.
+         *
+         * `GET /fga/check/batch` · action `fga.check_batch`
+         * @scope `fga:read`
+         * @danger read
+         * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+         */
+        checkBatch: <O extends CallOptions = CallOptions>(query: FgaCheckBatchQuery, options?: O) => Promise<Outcome<FgaCheckBatchResponse, O>>;
+        resources: {
+            /**
+             * List the resources of one type a subject has a relation on (e.g. every document alice can view), through all inheritance; sorted ids, paged with after.
+             *
+             * Requires scope `fga:read`. Danger: read.
+             *
+             * `GET /fga/resources` · action `fga.resources.list`
+             * @scope `fga:read`
+             * @danger read
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            list: <O extends CallOptions = CallOptions>(query: FgaResourcesListQuery, options?: O) => Promise<Outcome<FgaResourcesListResponse, O>>;
+            /** Every item of `fga.resources.list`, fetching pages as the iteration reaches them. */
+            listAll: (query?: Omit<FgaResourcesListQuery, "after">, options?: Omit<CallOptions, "approval">) => AsyncGenerator<FgaObject, void, undefined>;
+        };
+        schema: {
+            /**
+             * Read this environment's fine-grained authorization schema: the source text, its parsed types and relations, its version, and the current consistency token.
+             *
+             * Requires scope `fga:read`. Danger: read.
+             *
+             * `GET /fga/schema` · action `fga.schema.get`
+             * @scope `fga:read`
+             * @danger read
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            get: <O extends CallOptions = CallOptions>(options?: O) => Promise<Outcome<FgaSchemaGetResponse, O>>;
+            /**
+             * Replace this environment's fine-grained authorization schema (types, relations and how each is decided). Changes the answer to every check at once; refused if invalid or if existing tuples would no longer fit.
+             *
+             * Requires scope `fga:schema`. Danger: critical.
+             *
+             * `PUT /fga/schema` · action `fga.schema.update`
+             * @scope `fga:schema`
+             * @danger critical
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            update: <O extends CallOptions = CallOptions>(body: FgaSchemaUpdateBody, options?: O) => Promise<Outcome<FgaSchemaUpdateResponse, O>>;
+            /**
+             * Check a fine-grained authorization schema without saving it: every error by line, or the parsed types and canonical text.
+             *
+             * Requires scope `fga:read`. Danger: read.
+             *
+             * `GET /fga/schema/validate` · action `fga.schema.validate`
+             * @scope `fga:read`
+             * @danger read
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            validate: <O extends CallOptions = CallOptions>(query: FgaSchemaValidateQuery, options?: O) => Promise<Outcome<FgaSchemaValidateResponse, O>>;
+        };
+        subjects: {
+            /**
+             * List the subjects of one type that have a relation on a resource (e.g. every user who can view the readme), groups and inheritance expanded; sorted ids, paged with after.
+             *
+             * Requires scope `fga:read`. Danger: read.
+             *
+             * `GET /fga/subjects` · action `fga.subjects.list`
+             * @scope `fga:read`
+             * @danger read
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            list: <O extends CallOptions = CallOptions>(query: FgaSubjectsListQuery, options?: O) => Promise<Outcome<FgaSubjectsListResponse, O>>;
+            /** Every item of `fga.subjects.list`, fetching pages as the iteration reaches them. */
+            listAll: (query?: Omit<FgaSubjectsListQuery, "after">, options?: Omit<CallOptions, "approval">) => AsyncGenerator<FgaObject, void, undefined>;
+        };
+        tuples: {
+            /**
+             * Delete 1–100 relationship tuples in one atomic batch. Revokes the access they granted, and everything inherited through them, at once.
+             *
+             * Requires scope `fga:write`. Danger: destructive.
+             *
+             * `POST /fga/tuples/delete` · action `fga.tuples.delete`
+             * @scope `fga:write`
+             * @danger destructive
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            delete: <O extends CallOptions = CallOptions>(body: FgaTuplesDeleteBody, options?: O) => Promise<Outcome<FgaTuplesDeleteResponse, O>>;
+            /**
+             * List stored relationship tuples oldest first, filtered by resource type and id, relation and subject; pass next_cursor as after to page.
+             *
+             * Requires scope `fga:read`. Danger: read.
+             *
+             * `GET /fga/tuples` · action `fga.tuples.list`
+             * @scope `fga:read`
+             * @danger read
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            list: <O extends CallOptions = CallOptions>(query?: FgaTuplesListQuery, options?: O) => Promise<Outcome<FgaTuplesListResponse, O>>;
+            /** Every item of `fga.tuples.list`, fetching pages as the iteration reaches them. */
+            listAll: (query?: Omit<FgaTuplesListQuery, "after">, options?: Omit<CallOptions, "approval">) => AsyncGenerator<FgaTuple, void, undefined>;
+            /**
+             * Write 1–100 relationship tuples (resource#relation@subject) in one atomic batch, each checked against the schema. Grants access at once; returns a consistency_token for checks that must see it.
+             *
+             * Requires scope `fga:write`. Danger: write.
+             *
+             * `POST /fga/tuples` · action `fga.tuples.write`
+             * @scope `fga:write`
+             * @danger write
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            write: <O extends CallOptions = CallOptions>(body: FgaTuplesWriteBody, options?: O) => Promise<Outcome<FgaTuplesWriteResponse, O>>;
+        };
+    };
     readonly frontendKeys: {
         /**
          * Create a publishable frontend key for a browser app, usable only from the origins listed. The key is public by design.
@@ -7362,6 +9322,115 @@ declare class EnvironmentClient {
          */
         update: <O extends CallOptions = CallOptions>(id: string, body?: PermissionsUpdateBody, options?: O) => Promise<Outcome<PermissionsUpdateResponse, O>>;
     };
+    readonly pipes: {
+        /**
+         * Configure a pipe: the environment's OAuth app at a third-party provider (GitHub, Google, Microsoft 365, Slack, Salesforce, HubSpot, Linear, Notion), so people can connect their accounts. The client secret is sealed and never returned.
+         *
+         * Requires scope `pipes:write`. Danger: write.
+         *
+         * `POST /pipes` · action `pipes.create`
+         * @scope `pipes:write`
+         * @danger write
+         * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+         */
+        create: <O extends CallOptions = CallOptions>(body: PipesCreateBody, options?: O) => Promise<Outcome<PipesCreateResponse, O>>;
+        /**
+         * Remove a pipe and every connection through it. Their tokens are revoked here, not at the provider — disconnect people first if that matters.
+         *
+         * Requires scope `pipes:write`. Danger: destructive.
+         *
+         * `DELETE /pipes/{id}` · action `pipes.delete`
+         * @scope `pipes:write`
+         * @danger destructive
+         * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+         */
+        delete: <O extends CallOptions = CallOptions>(id: string, options?: O) => Promise<Outcome<PipesDeleteResponse, O>>;
+        /**
+         * Show one pipe: its provider, OAuth client id, scopes, the redirect URI to register at the provider, and the apps granted its tokens.
+         *
+         * Requires scope `pipes:read`. Danger: read.
+         *
+         * `GET /pipes/{id}` · action `pipes.get`
+         * @scope `pipes:read`
+         * @danger read
+         * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+         */
+        get: <O extends CallOptions = CallOptions>(id: string, options?: O) => Promise<Outcome<PipesGetResponse, O>>;
+        /**
+         * List the pipes — the third-party providers people can connect their accounts to — with their scopes and the apps granted their tokens. Never a client secret.
+         *
+         * Requires scope `pipes:read`. Danger: read.
+         *
+         * `GET /pipes` · action `pipes.list`
+         * @scope `pipes:read`
+         * @danger read
+         * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+         */
+        list: <O extends CallOptions = CallOptions>(query?: PipesListQuery, options?: O) => Promise<Outcome<PipesListResponse, O>>;
+        /** Every item of `pipes.list`, fetching pages as the iteration reaches them. */
+        listAll: (query?: Omit<PipesListQuery, "after">, options?: Omit<CallOptions, "approval">) => AsyncGenerator<Pipe, void, undefined>;
+        /**
+         * Change a pipe — client id, client secret (sealed), scopes, parameters, or whether it is enabled. Only what is sent changes.
+         *
+         * Requires scope `pipes:write`. Danger: write.
+         *
+         * `PATCH /pipes/{id}` · action `pipes.update`
+         * @scope `pipes:write`
+         * @danger write
+         * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+         */
+        update: <O extends CallOptions = CallOptions>(id: string, body?: PipesUpdateBody, options?: O) => Promise<Outcome<PipesUpdateResponse, O>>;
+        connections: {
+            /**
+             * Disconnect a person's connected account: revoke it at the provider where supported, revoke its tokens here, and forget it.
+             *
+             * Requires scope `pipes:write`. Danger: destructive.
+             *
+             * `DELETE /pipes/{id}/connections/{connection_id}` · action `pipes.connections.delete`
+             * @scope `pipes:write`
+             * @danger destructive
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            delete: <O extends CallOptions = CallOptions>(id: string, connectionId: string, options?: O) => Promise<Outcome<PipesConnectionsDeleteResponse, O>>;
+            /**
+             * List the accounts people connected through a pipe: who, which account, granted scopes, status (active / needs_reauth) and when the token expires. Never a token.
+             *
+             * Requires scope `pipes:read`. Danger: read.
+             *
+             * `GET /pipes/{id}/connections` · action `pipes.connections.list`
+             * @scope `pipes:read`
+             * @danger read
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            list: <O extends CallOptions = CallOptions>(id: string, query?: PipesConnectionsListQuery, options?: O) => Promise<Outcome<PipesConnectionsListResponse, O>>;
+            /** Every item of `pipes.connections.list`, fetching pages as the iteration reaches them. */
+            listAll: (id: string, query?: Omit<PipesConnectionsListQuery, "after">, options?: Omit<CallOptions, "approval">) => AsyncGenerator<PipeConnection, void, undefined>;
+        };
+        grants: {
+            /**
+             * Grant an app (by OAuth client id) the right to lease fresh access tokens for the accounts people connected through this pipe.
+             *
+             * Requires scope `pipes:write`. Danger: critical.
+             *
+             * `POST /pipes/{id}/grants` · action `pipes.grants.create`
+             * @scope `pipes:write`
+             * @danger critical
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            create: <O extends CallOptions = CallOptions>(id: string, body: PipesGrantsCreateBody, options?: O) => Promise<Outcome<PipesGrantsCreateResponse, O>>;
+            /**
+             * Withdraw an app's right to lease the tokens people connected through this pipe.
+             *
+             * Requires scope `pipes:write`. Danger: destructive.
+             *
+             * `DELETE /pipes/{id}/grants/{client_id}` · action `pipes.grants.delete`
+             * @scope `pipes:write`
+             * @danger destructive
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            delete: <O extends CallOptions = CallOptions>(id: string, clientId: string, options?: O) => Promise<Outcome<PipesGrantsDeleteResponse, O>>;
+        };
+    };
     readonly provisioning: {
         targets: {
             /**
@@ -7425,6 +9494,178 @@ declare class EnvironmentClient {
             };
         };
     };
+    readonly radar: {
+        decisions: {
+            /**
+             * Read one Radar decision: the verdict, whether it was enforced, the deciding rule, every rule that fired, the reasons, the risk score and the facts it was decided on.
+             *
+             * Requires scope `radar:read`. Danger: read.
+             *
+             * `GET /radar/decisions/{id}` · action `radar.decisions.get`
+             * @scope `radar:read`
+             * @danger read
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            get: <O extends CallOptions = CallOptions>(id: string, options?: O) => Promise<Outcome<RadarDecisionsGetResponse, O>>;
+            /**
+             * List this environment's Radar decisions newest first — verdict, deciding rule, every rule that fired, reasons and facts — filtered by verdict, flow, rule, country, email, IP, device or time; pass `next_cursor` as `after` to page. Email and IP are matched by keyed pseudonym and never returned.
+             *
+             * Requires scope `radar:read`. Danger: read.
+             *
+             * `GET /radar/decisions` · action `radar.decisions.list`
+             * @scope `radar:read`
+             * @danger read
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            list: <O extends CallOptions = CallOptions>(query?: RadarDecisionsListQuery, options?: O) => Promise<Outcome<RadarDecisionsListResponse, O>>;
+            /** Every item of `radar.decisions.list`, fetching pages as the iteration reaches them. */
+            listAll: (query?: Omit<RadarDecisionsListQuery, "after">, options?: Omit<CallOptions, "approval">) => AsyncGenerator<RadarDecision, void, undefined>;
+        };
+        lists: {
+            /**
+             * Add an entry to this environment's Radar allow or deny list: an IP or CIDR range, an email address, a mail domain (and its subdomains), or a device id from the decisions explorer. Deny blocks before every rule; allow skips every rule.
+             *
+             * Requires scope `radar:write`. Danger: write.
+             *
+             * `POST /radar/lists` · action `radar.lists.add`
+             * @scope `radar:write`
+             * @danger write
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            add: <O extends CallOptions = CallOptions>(body: RadarListsAddBody, options?: O) => Promise<Outcome<RadarListsAddResponse, O>>;
+            /**
+             * List this environment's Radar allow and deny entries — IPs and CIDR ranges, addresses, mail domains, devices — optionally one list or one kind.
+             *
+             * Requires scope `radar:read`. Danger: read.
+             *
+             * `GET /radar/lists` · action `radar.lists.list`
+             * @scope `radar:read`
+             * @danger read
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            list: <O extends CallOptions = CallOptions>(query?: RadarListsListQuery, options?: O) => Promise<Outcome<RadarListsListResponse, O>>;
+            /** Every item of `radar.lists.list`, fetching pages as the iteration reaches them. */
+            listAll: (query?: Omit<RadarListsListQuery, "after">, options?: Omit<CallOptions, "approval">) => AsyncGenerator<RadarListEntry, void, undefined>;
+            /**
+             * Remove an entry from this environment's Radar allow or deny list.
+             *
+             * Requires scope `radar:write`. Danger: destructive.
+             *
+             * `DELETE /radar/lists/{id}` · action `radar.lists.remove`
+             * @scope `radar:write`
+             * @danger destructive
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            remove: <O extends CallOptions = CallOptions>(id: string, options?: O) => Promise<Outcome<RadarListsRemoveResponse, O>>;
+        };
+        mode: {
+            /**
+             * Switch this environment's Radar between `monitor` (verdicts recorded, never acted on) and `enforce` (blocks refuse sign-ins and sign-ups, challenges demand a second factor). Changes the environment's security posture.
+             *
+             * Requires scope `radar:manage`. Danger: critical.
+             *
+             * `PUT /radar/mode` · action `radar.mode.set`
+             * @scope `radar:manage`
+             * @danger critical
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            set: <O extends CallOptions = CallOptions>(body: RadarModeSetBody, options?: O) => Promise<Outcome<RadarModeSetResponse, O>>;
+        };
+        rules: {
+            /**
+             * Add a Radar rule: when EVERY condition (field, operator, value) holds, allow, challenge or block. Rules run in order after the allow/deny lists and before the built-in rules; the first match decides. Example: country not_in [DK, SE] → challenge.
+             *
+             * Requires scope `radar:write`. Danger: write.
+             *
+             * `POST /radar/rules` · action `radar.rules.create`
+             * @scope `radar:write`
+             * @danger write
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            create: <O extends CallOptions = CallOptions>(body: RadarRulesCreateBody, options?: O) => Promise<Outcome<RadarRulesCreateResponse, O>>;
+            /**
+             * Delete a Radar rule. Attempts it decided are decided by the next matching rule, or the built-in rules, from then on.
+             *
+             * Requires scope `radar:write`. Danger: destructive.
+             *
+             * `DELETE /radar/rules/{id}` · action `radar.rules.delete`
+             * @scope `radar:write`
+             * @danger destructive
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            delete: <O extends CallOptions = CallOptions>(id: string, options?: O) => Promise<Outcome<RadarRulesDeleteResponse, O>>;
+            /**
+             * Read one Radar rule: its action, the flows it applies to, its position and its conditions.
+             *
+             * Requires scope `radar:read`. Danger: read.
+             *
+             * `GET /radar/rules/{id}` · action `radar.rules.get`
+             * @scope `radar:read`
+             * @danger read
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            get: <O extends CallOptions = CallOptions>(id: string, options?: O) => Promise<Outcome<RadarRulesGetResponse, O>>;
+            /**
+             * List this environment's own Radar rules in evaluation order (the first whose conditions all hold decides), with their conditions and a readable summary of each.
+             *
+             * Requires scope `radar:read`. Danger: read.
+             *
+             * `GET /radar/rules` · action `radar.rules.list`
+             * @scope `radar:read`
+             * @danger read
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            list: <O extends CallOptions = CallOptions>(query?: RadarRulesListQuery, options?: O) => Promise<Outcome<RadarRulesListResponse, O>>;
+            /** Every item of `radar.rules.list`, fetching pages as the iteration reaches them. */
+            listAll: (query?: Omit<RadarRulesListQuery, "after">, options?: Omit<CallOptions, "approval">) => AsyncGenerator<RadarRule, void, undefined>;
+            /**
+             * Set the order Radar rules are evaluated in: `rule_ids` lists every rule of the environment exactly once, first evaluated first.
+             *
+             * Requires scope `radar:write`. Danger: write.
+             *
+             * `PUT /radar/rules/order` · action `radar.rules.reorder`
+             * @scope `radar:write`
+             * @danger write
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            reorder: <O extends CallOptions = CallOptions>(body: RadarRulesReorderBody, options?: O) => Promise<Outcome<RadarRulesReorderResponse, O>>;
+            /**
+             * Change a Radar rule: its name, description, action, flows, enabled state, position, or (replaced whole) its conditions.
+             *
+             * Requires scope `radar:write`. Danger: write.
+             *
+             * `PATCH /radar/rules/{id}` · action `radar.rules.update`
+             * @scope `radar:write`
+             * @danger write
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            update: <O extends CallOptions = CallOptions>(id: string, body?: RadarRulesUpdateBody, options?: O) => Promise<Outcome<RadarRulesUpdateResponse, O>>;
+        };
+        settings: {
+            /**
+             * Read this environment's Radar settings: the mode (monitor or enforce, and whether it is inherited from the deployment), the IP intelligence source, and every built-in rule with its action and threshold.
+             *
+             * Requires scope `radar:read`. Danger: read.
+             *
+             * `GET /radar/settings` · action `radar.settings.get`
+             * @scope `radar:read`
+             * @danger read
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            get: <O extends CallOptions = CallOptions>(options?: O) => Promise<Outcome<RadarSettingsGetResponse, O>>;
+            /**
+             * Tune this environment's built-in Radar rules: `builtin_rules` maps a rule key (credential_stuffing, bot_velocity, account_attack, impossible_travel, new_device, anonymous_network, hosting_network, disposable_email, risk_score_reject, risk_score_elevated) to any of enabled, action and threshold.
+             *
+             * Requires scope `radar:write`. Danger: write.
+             *
+             * `PATCH /radar/settings` · action `radar.settings.update`
+             * @scope `radar:write`
+             * @danger write
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            update: <O extends CallOptions = CallOptions>(body: RadarSettingsUpdateBody, options?: O) => Promise<Outcome<RadarSettingsUpdateResponse, O>>;
+        };
+    };
     readonly roles: {
         /**
          * Define a role for one organization, or (organization_id null) for the whole environment, optionally scoped to one app, with its opening permissions.
@@ -7592,7 +9833,7 @@ declare class EnvironmentClient {
              */
             inherit: <O extends CallOptions = CallOptions>(organizationId: string, options?: O) => Promise<Outcome<SigninPolicyInheritResponse, O>>;
             /**
-             * Change the authentication policy of the environment baseline, or tighten one organization's override. Requiring SSO signs out password sessions.
+             * Change the authentication policy of the environment baseline — including whether passkeys and magic links are offered and how long sessions last — or tighten one organization's override. Requiring SSO signs out password sessions.
              *
              * Requires scope `signin:write`. Danger: critical.
              *
@@ -7616,6 +9857,30 @@ declare class EnvironmentClient {
              */
             set: <O extends CallOptions = CallOptions>(body: SigninSelfServiceSignupSetBody, options?: O) => Promise<Outcome<SigninSelfServiceSignupSetResponse, O>>;
         };
+        sms: {
+            /**
+             * Read the SMS second-factor policy: whether text-message codes are accepted, for which countries, and the administrator rule.
+             *
+             * Requires scope `signin:read`. Danger: read.
+             *
+             * `GET /sign-in/sms` · action `signin.sms.get`
+             * @scope `signin:read`
+             * @danger read
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            get: <O extends CallOptions = CallOptions>(options?: O) => Promise<Outcome<SigninSmsGetResponse, O>>;
+            /**
+             * Change the SMS second-factor policy: accept text-message codes or not, the countries they may go to, and whether SMS may be an administrator's only factor.
+             *
+             * Requires scope `signin:write`. Danger: critical.
+             *
+             * `PATCH /sign-in/sms` · action `signin.sms.update`
+             * @scope `signin:write`
+             * @danger critical
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            update: <O extends CallOptions = CallOptions>(body?: SigninSmsUpdateBody, options?: O) => Promise<Outcome<SigninSmsUpdateResponse, O>>;
+        };
         social: {
             /**
              * Stop offering a social login provider. People who used it keep their accounts.
@@ -7629,7 +9894,40 @@ declare class EnvironmentClient {
              */
             delete: <O extends CallOptions = CallOptions>(id: string, body?: SigninSocialDeleteBody, options?: O) => Promise<Outcome<SigninSocialDeleteResponse, O>>;
             /**
-             * List the social login providers (Google, GitHub, Apple…) enabled in this environment, optionally for one organization.
+             * Turn a social login provider off without removing it. People who used it keep their accounts.
+             *
+             * Requires scope `signin:write`. Danger: critical.
+             *
+             * `POST /sign-in/social-providers/{id}/disable` · action `signin.social.disable`
+             * @scope `signin:write`
+             * @danger critical
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            disable: <O extends CallOptions = CallOptions>(id: string, body?: SigninSocialDisableBody, options?: O) => Promise<Outcome<SigninSocialDisableResponse, O>>;
+            /**
+             * Turn a social login provider that was turned off back on, with the credentials it already has.
+             *
+             * Requires scope `signin:write`. Danger: write.
+             *
+             * `POST /sign-in/social-providers/{id}/enable` · action `signin.social.enable`
+             * @scope `signin:write`
+             * @danger write
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            enable: <O extends CallOptions = CallOptions>(id: string, body?: SigninSocialEnableBody, options?: O) => Promise<Outcome<SigninSocialEnableResponse, O>>;
+            /**
+             * Turn one of the environment's social login providers off (or back on) for one organization's sign-in page.
+             *
+             * Requires scope `signin:write`. Danger: write.
+             *
+             * `PUT /sign-in/social-providers/inherited/{provider}` · action `signin.social.inherit`
+             * @scope `signin:write`
+             * @danger write
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            inherit: <O extends CallOptions = CallOptions>(provider: string, body: SigninSocialInheritBody, options?: O) => Promise<Outcome<SigninSocialInheritResponse, O>>;
+            /**
+             * List the social login providers (Google, GitHub, Apple…) set up in this environment — the environment's own and organizations' — optionally for one organization.
              *
              * Requires scope `signin:read`. Danger: read.
              *
@@ -7642,7 +9940,18 @@ declare class EnvironmentClient {
             /** Every item of `signin.social.list`, fetching pages as the iteration reaches them. */
             listAll: (query?: Omit<SigninSocialListQuery, "after">, options?: Omit<CallOptions, "approval">) => AsyncGenerator<SocialProvider, void, undefined>;
             /**
-             * Enable a social login provider (Google, GitHub, Apple…) for one organization with its client credentials. The secret is never returned.
+             * The social login buttons one organization's sign-in page shows (or the plain sign-in page's), after inheritance from the environment, with where each comes from.
+             *
+             * Requires scope `signin:read`. Danger: read.
+             *
+             * `GET /sign-in/social-providers/offered` · action `signin.social.offered`
+             * @scope `signin:read`
+             * @danger read
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            offered: <O extends CallOptions = CallOptions>(query?: SigninSocialOfferedQuery, options?: O) => Promise<Outcome<SigninSocialOfferedResponse, O>>;
+            /**
+             * Enable a social login provider (Google, GitHub, Apple…) for the whole environment or for one organization, with its client credentials. The secret is never returned.
              *
              * Requires scope `signin:write`. Danger: critical.
              *
@@ -7652,6 +9961,17 @@ declare class EnvironmentClient {
              * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
              */
             set: <O extends CallOptions = CallOptions>(body: SigninSocialSetBody, options?: O) => Promise<Outcome<SigninSocialSetResponse, O>>;
+            /**
+             * Change a social login provider's client credentials, provider values or extra scopes. Secrets left out keep the ones on file.
+             *
+             * Requires scope `signin:write`. Danger: critical.
+             *
+             * `PATCH /sign-in/social-providers/{id}` · action `signin.social.update`
+             * @scope `signin:write`
+             * @danger critical
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            update: <O extends CallOptions = CallOptions>(id: string, body?: SigninSocialUpdateBody, options?: O) => Promise<Outcome<SigninSocialUpdateResponse, O>>;
         };
     };
     readonly sodPolicies: {
@@ -8206,6 +10526,19 @@ declare class EnvironmentClient {
              * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
              */
             reset: <O extends CallOptions = CallOptions>(id: string, options?: O) => Promise<Outcome<UsersMfaResetResponse, O>>;
+            sms: {
+                /**
+                 * Remove a user's phone number for text-message sign-in codes. Their other factors and recovery codes stay.
+                 *
+                 * Requires scope `users:write`. Danger: critical.
+                 *
+                 * `DELETE /users/{id}/mfa/sms` · action `users.mfa.sms.remove`
+                 * @scope `users:write`
+                 * @danger critical
+                 * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+                 */
+                remove: <O extends CallOptions = CallOptions>(id: string, options?: O) => Promise<Outcome<UsersMfaSmsRemoveResponse, O>>;
+            };
         };
         passwordReset: {
             /**
@@ -8507,6 +10840,8 @@ type environment_DirectoriesConnectBody = DirectoriesConnectBody;
 type environment_DirectoriesConnectResponse = DirectoriesConnectResponse;
 type environment_DirectoriesCreateBody = DirectoriesCreateBody;
 type environment_DirectoriesCreateResponse = DirectoriesCreateResponse;
+type environment_DirectoriesCredentialsReplaceBody = DirectoriesCredentialsReplaceBody;
+type environment_DirectoriesCredentialsReplaceResponse = DirectoriesCredentialsReplaceResponse;
 type environment_DirectoriesDeleteBody = DirectoriesDeleteBody;
 type environment_DirectoriesDeleteResponse = DirectoriesDeleteResponse;
 type environment_DirectoriesGetQuery = DirectoriesGetQuery;
@@ -8515,10 +10850,16 @@ type environment_DirectoriesGroupsListQuery = DirectoriesGroupsListQuery;
 type environment_DirectoriesGroupsListResponse = DirectoriesGroupsListResponse;
 type environment_DirectoriesGroupsMapBody = DirectoriesGroupsMapBody;
 type environment_DirectoriesGroupsMapResponse = DirectoriesGroupsMapResponse;
+type environment_DirectoriesHrisConnectBody = DirectoriesHrisConnectBody;
+type environment_DirectoriesHrisConnectResponse = DirectoriesHrisConnectResponse;
 type environment_DirectoriesListQuery = DirectoriesListQuery;
 type environment_DirectoriesListResponse = DirectoriesListResponse;
 type environment_DirectoriesStatusSetBody = DirectoriesStatusSetBody;
 type environment_DirectoriesStatusSetResponse = DirectoriesStatusSetResponse;
+type environment_DirectoriesSyncBody = DirectoriesSyncBody;
+type environment_DirectoriesSyncResponse = DirectoriesSyncResponse;
+type environment_DirectoriesSyncSettingsUpdateBody = DirectoriesSyncSettingsUpdateBody;
+type environment_DirectoriesSyncSettingsUpdateResponse = DirectoriesSyncSettingsUpdateResponse;
 type environment_DirectoriesTokenRotateBody = DirectoriesTokenRotateBody;
 type environment_DirectoriesTokenRotateResponse = DirectoriesTokenRotateResponse;
 type environment_DirectoriesUpdateBody = DirectoriesUpdateBody;
@@ -8537,6 +10878,47 @@ type environment_EnvironmentClientOptions = EnvironmentClientOptions;
 type environment_ErasureReceipt = ErasureReceipt;
 type environment_EventsListQuery = EventsListQuery;
 type environment_EventsListResponse = EventsListResponse;
+type environment_FeatureFlag = FeatureFlag;
+type environment_FeatureFlagEvaluation = FeatureFlagEvaluation;
+type environment_FeatureFlagRule = FeatureFlagRule;
+type environment_FeatureFlagsCreateBody = FeatureFlagsCreateBody;
+type environment_FeatureFlagsCreateResponse = FeatureFlagsCreateResponse;
+type environment_FeatureFlagsDeleteResponse = FeatureFlagsDeleteResponse;
+type environment_FeatureFlagsEvaluateQuery = FeatureFlagsEvaluateQuery;
+type environment_FeatureFlagsEvaluateResponse = FeatureFlagsEvaluateResponse;
+type environment_FeatureFlagsGetResponse = FeatureFlagsGetResponse;
+type environment_FeatureFlagsListQuery = FeatureFlagsListQuery;
+type environment_FeatureFlagsListResponse = FeatureFlagsListResponse;
+type environment_FeatureFlagsUpdateBody = FeatureFlagsUpdateBody;
+type environment_FeatureFlagsUpdateResponse = FeatureFlagsUpdateResponse;
+type environment_FgaCheck = FgaCheck;
+type environment_FgaCheckBatch = FgaCheckBatch;
+type environment_FgaCheckBatchQuery = FgaCheckBatchQuery;
+type environment_FgaCheckBatchResponse = FgaCheckBatchResponse;
+type environment_FgaCheckQuery = FgaCheckQuery;
+type environment_FgaCheckResponse = FgaCheckResponse;
+type environment_FgaObject = FgaObject;
+type environment_FgaResourcesListQuery = FgaResourcesListQuery;
+type environment_FgaResourcesListResponse = FgaResourcesListResponse;
+type environment_FgaSchema = FgaSchema;
+type environment_FgaSchemaGetResponse = FgaSchemaGetResponse;
+type environment_FgaSchemaUpdateBody = FgaSchemaUpdateBody;
+type environment_FgaSchemaUpdateResponse = FgaSchemaUpdateResponse;
+type environment_FgaSchemaValidateQuery = FgaSchemaValidateQuery;
+type environment_FgaSchemaValidateResponse = FgaSchemaValidateResponse;
+type environment_FgaSchemaValidation = FgaSchemaValidation;
+type environment_FgaSubject = FgaSubject;
+type environment_FgaSubjectsListQuery = FgaSubjectsListQuery;
+type environment_FgaSubjectsListResponse = FgaSubjectsListResponse;
+type environment_FgaTuple = FgaTuple;
+type environment_FgaTupleWrite = FgaTupleWrite;
+type environment_FgaTuplesDeleteBody = FgaTuplesDeleteBody;
+type environment_FgaTuplesDeleteResponse = FgaTuplesDeleteResponse;
+type environment_FgaTuplesListQuery = FgaTuplesListQuery;
+type environment_FgaTuplesListResponse = FgaTuplesListResponse;
+type environment_FgaTuplesWriteBody = FgaTuplesWriteBody;
+type environment_FgaTuplesWriteResponse = FgaTuplesWriteResponse;
+type environment_FgaType = FgaType;
 type environment_FrontendKey = FrontendKey;
 type environment_FrontendKeysCreateBody = FrontendKeysCreateBody;
 type environment_FrontendKeysCreateResponse = FrontendKeysCreateResponse;
@@ -8601,6 +10983,7 @@ type environment_MembersRolesRevokeResponse = MembersRolesRevokeResponse;
 type environment_MembersUpdateBody = MembersUpdateBody;
 type environment_MembersUpdateResponse = MembersUpdateResponse;
 type environment_OAuthClientError = OAuthClientError;
+type environment_OfferedSocialProviders = OfferedSocialProviders;
 type environment_OrganizationDomain = OrganizationDomain;
 type environment_OrganizationsDeleteResponse = OrganizationsDeleteResponse;
 type environment_OrganizationsDomainsAddBody = OrganizationsDomainsAddBody;
@@ -8631,6 +11014,23 @@ type environment_PermissionsListQuery = PermissionsListQuery;
 type environment_PermissionsListResponse = PermissionsListResponse;
 type environment_PermissionsUpdateBody = PermissionsUpdateBody;
 type environment_PermissionsUpdateResponse = PermissionsUpdateResponse;
+type environment_Pipe = Pipe;
+type environment_PipeConnectRequired = PipeConnectRequired;
+type environment_PipeConnection = PipeConnection;
+type environment_PipesConnectionsDeleteResponse = PipesConnectionsDeleteResponse;
+type environment_PipesConnectionsListQuery = PipesConnectionsListQuery;
+type environment_PipesConnectionsListResponse = PipesConnectionsListResponse;
+type environment_PipesCreateBody = PipesCreateBody;
+type environment_PipesCreateResponse = PipesCreateResponse;
+type environment_PipesDeleteResponse = PipesDeleteResponse;
+type environment_PipesGetResponse = PipesGetResponse;
+type environment_PipesGrantsCreateBody = PipesGrantsCreateBody;
+type environment_PipesGrantsCreateResponse = PipesGrantsCreateResponse;
+type environment_PipesGrantsDeleteResponse = PipesGrantsDeleteResponse;
+type environment_PipesListQuery = PipesListQuery;
+type environment_PipesListResponse = PipesListResponse;
+type environment_PipesUpdateBody = PipesUpdateBody;
+type environment_PipesUpdateResponse = PipesUpdateResponse;
 type environment_PortalLink = PortalLink;
 type environment_PortalLinkRecord = PortalLinkRecord;
 type environment_ProvisioningTarget = ProvisioningTarget;
@@ -8644,6 +11044,33 @@ type environment_ProvisioningTargetsListQuery = ProvisioningTargetsListQuery;
 type environment_ProvisioningTargetsListResponse = ProvisioningTargetsListResponse;
 type environment_ProvisioningTargetsStatusSetBody = ProvisioningTargetsStatusSetBody;
 type environment_ProvisioningTargetsStatusSetResponse = ProvisioningTargetsStatusSetResponse;
+type environment_RadarDecision = RadarDecision;
+type environment_RadarDecisionsGetResponse = RadarDecisionsGetResponse;
+type environment_RadarDecisionsListQuery = RadarDecisionsListQuery;
+type environment_RadarDecisionsListResponse = RadarDecisionsListResponse;
+type environment_RadarListEntry = RadarListEntry;
+type environment_RadarListsAddBody = RadarListsAddBody;
+type environment_RadarListsAddResponse = RadarListsAddResponse;
+type environment_RadarListsListQuery = RadarListsListQuery;
+type environment_RadarListsListResponse = RadarListsListResponse;
+type environment_RadarListsRemoveResponse = RadarListsRemoveResponse;
+type environment_RadarModeSetBody = RadarModeSetBody;
+type environment_RadarModeSetResponse = RadarModeSetResponse;
+type environment_RadarRule = RadarRule;
+type environment_RadarRulesCreateBody = RadarRulesCreateBody;
+type environment_RadarRulesCreateResponse = RadarRulesCreateResponse;
+type environment_RadarRulesDeleteResponse = RadarRulesDeleteResponse;
+type environment_RadarRulesGetResponse = RadarRulesGetResponse;
+type environment_RadarRulesListQuery = RadarRulesListQuery;
+type environment_RadarRulesListResponse = RadarRulesListResponse;
+type environment_RadarRulesReorderBody = RadarRulesReorderBody;
+type environment_RadarRulesReorderResponse = RadarRulesReorderResponse;
+type environment_RadarRulesUpdateBody = RadarRulesUpdateBody;
+type environment_RadarRulesUpdateResponse = RadarRulesUpdateResponse;
+type environment_RadarSettings = RadarSettings;
+type environment_RadarSettingsGetResponse = RadarSettingsGetResponse;
+type environment_RadarSettingsUpdateBody = RadarSettingsUpdateBody;
+type environment_RadarSettingsUpdateResponse = RadarSettingsUpdateResponse;
 type environment_Role = Role;
 type environment_RoleAssignment = RoleAssignment;
 type environment_RolesCreateBody = RolesCreateBody;
@@ -8668,6 +11095,7 @@ type environment_SamlAppsUpdateBody = SamlAppsUpdateBody;
 type environment_SamlAppsUpdateResponse = SamlAppsUpdateResponse;
 type environment_SamlMetadata = SamlMetadata;
 type environment_SelfServiceSignup = SelfServiceSignup;
+type environment_SignInMethodsInForce = SignInMethodsInForce;
 type environment_SignInPolicy = SignInPolicy;
 type environment_SignInRules = SignInRules;
 type environment_SigninPolicyGetQuery = SigninPolicyGetQuery;
@@ -8677,12 +11105,26 @@ type environment_SigninPolicyUpdateBody = SigninPolicyUpdateBody;
 type environment_SigninPolicyUpdateResponse = SigninPolicyUpdateResponse;
 type environment_SigninSelfServiceSignupSetBody = SigninSelfServiceSignupSetBody;
 type environment_SigninSelfServiceSignupSetResponse = SigninSelfServiceSignupSetResponse;
+type environment_SigninSmsGetResponse = SigninSmsGetResponse;
+type environment_SigninSmsUpdateBody = SigninSmsUpdateBody;
+type environment_SigninSmsUpdateResponse = SigninSmsUpdateResponse;
 type environment_SigninSocialDeleteBody = SigninSocialDeleteBody;
 type environment_SigninSocialDeleteResponse = SigninSocialDeleteResponse;
+type environment_SigninSocialDisableBody = SigninSocialDisableBody;
+type environment_SigninSocialDisableResponse = SigninSocialDisableResponse;
+type environment_SigninSocialEnableBody = SigninSocialEnableBody;
+type environment_SigninSocialEnableResponse = SigninSocialEnableResponse;
+type environment_SigninSocialInheritBody = SigninSocialInheritBody;
+type environment_SigninSocialInheritResponse = SigninSocialInheritResponse;
 type environment_SigninSocialListQuery = SigninSocialListQuery;
 type environment_SigninSocialListResponse = SigninSocialListResponse;
+type environment_SigninSocialOfferedQuery = SigninSocialOfferedQuery;
+type environment_SigninSocialOfferedResponse = SigninSocialOfferedResponse;
 type environment_SigninSocialSetBody = SigninSocialSetBody;
 type environment_SigninSocialSetResponse = SigninSocialSetResponse;
+type environment_SigninSocialUpdateBody = SigninSocialUpdateBody;
+type environment_SigninSocialUpdateResponse = SigninSocialUpdateResponse;
+type environment_SmsFactorPolicy = SmsFactorPolicy;
 type environment_SocialProvider = SocialProvider;
 type environment_SodPoliciesCreateBody = SodPoliciesCreateBody;
 type environment_SodPoliciesCreateResponse = SodPoliciesCreateResponse;
@@ -8769,6 +11211,7 @@ type environment_UsersGetResponse = UsersGetResponse;
 type environment_UsersListQuery = UsersListQuery;
 type environment_UsersListResponse = UsersListResponse;
 type environment_UsersMfaResetResponse = UsersMfaResetResponse;
+type environment_UsersMfaSmsRemoveResponse = UsersMfaSmsRemoveResponse;
 type environment_UsersPasswordResetSendResponse = UsersPasswordResetSendResponse;
 type environment_UsersPasswordSetBody = UsersPasswordSetBody;
 type environment_UsersPasswordSetResponse = UsersPasswordSetResponse;
@@ -8798,7 +11241,7 @@ type environment_WebhooksUpdateResponse = WebhooksUpdateResponse;
 type environment_WhitelabelBranding = WhitelabelBranding;
 declare const environment_environmentOperations: typeof environmentOperations;
 declare namespace environment {
-  export { type environment_AccessReview as AccessReview, type environment_AccessReviewItem as AccessReviewItem, type environment_AccessReviewsCloseBody as AccessReviewsCloseBody, type environment_AccessReviewsCloseResponse as AccessReviewsCloseResponse, type environment_AccessReviewsCreateBody as AccessReviewsCreateBody, type environment_AccessReviewsCreateResponse as AccessReviewsCreateResponse, type environment_AccessReviewsGetQuery as AccessReviewsGetQuery, type environment_AccessReviewsGetResponse as AccessReviewsGetResponse, type environment_AccessReviewsItemsDecideBody as AccessReviewsItemsDecideBody, type environment_AccessReviewsItemsDecideResponse as AccessReviewsItemsDecideResponse, type environment_AccessReviewsItemsListQuery as AccessReviewsItemsListQuery, type environment_AccessReviewsItemsListResponse as AccessReviewsItemsListResponse, type environment_AccessReviewsListQuery as AccessReviewsListQuery, type environment_AccessReviewsListResponse as AccessReviewsListResponse, type ActionApprovalsGetResponse$3 as ActionApprovalsGetResponse, type environment_AgentRequest as AgentRequest, type environment_Api as Api, type environment_ApiKey as ApiKey, type environment_ApiKeyVerification as ApiKeyVerification, type environment_ApiKeyVerificationRequest as ApiKeyVerificationRequest, type environment_ApiKeysListQuery as ApiKeysListQuery, type environment_ApiKeysListResponse as ApiKeysListResponse, type ApiKeysRevokeResponse$1 as ApiKeysRevokeResponse, type environment_ApiScope as ApiScope, type environment_ApisCreateBody as ApisCreateBody, type environment_ApisCreateResponse as ApisCreateResponse, type environment_ApisDeleteResponse as ApisDeleteResponse, type environment_ApisGetResponse as ApisGetResponse, type environment_ApisListQuery as ApisListQuery, type environment_ApisListResponse as ApisListResponse, type environment_ApisScopesDefineBody as ApisScopesDefineBody, type environment_ApisScopesDefineResponse as ApisScopesDefineResponse, type environment_ApisScopesRemoveResponse as ApisScopesRemoveResponse, type environment_ApisUpdateBody as ApisUpdateBody, type environment_ApisUpdateResponse as ApisUpdateResponse, type environment_App as App, type environment_AppBlueprint as AppBlueprint, type environment_AppSecret as AppSecret, type environment_Appearance as Appearance, type environment_Approval as Approval, type environment_ApprovalDecision as ApprovalDecision, type environment_ApprovalsDenyResponse as ApprovalsDenyResponse, type environment_ApprovalsListQuery as ApprovalsListQuery, type environment_ApprovalsListResponse as ApprovalsListResponse, type environment_AppsBlueprintResponse as AppsBlueprintResponse, type environment_AppsCopyBody as AppsCopyBody, type environment_AppsCopyResponse as AppsCopyResponse, type environment_AppsCreateBody as AppsCreateBody, type environment_AppsCreateResponse as AppsCreateResponse, type environment_AppsDeleteResponse as AppsDeleteResponse, type environment_AppsGetResponse as AppsGetResponse, type environment_AppsListQuery as AppsListQuery, type environment_AppsListResponse as AppsListResponse, type environment_AppsManifestSetBody as AppsManifestSetBody, type environment_AppsManifestSetResponse as AppsManifestSetResponse, type environment_AppsManifestSyncResponse as AppsManifestSyncResponse, type environment_AppsScopesSetBody as AppsScopesSetBody, type environment_AppsScopesSetResponse as AppsScopesSetResponse, type environment_AppsSecretsListResponse as AppsSecretsListResponse, type environment_AppsSecretsRevokeResponse as AppsSecretsRevokeResponse, type environment_AppsSecretsRotateBody as AppsSecretsRotateBody, type environment_AppsSecretsRotateResponse as AppsSecretsRotateResponse, type environment_AppsSettingsApiKeyPrefixBody as AppsSettingsApiKeyPrefixBody, type environment_AppsSettingsApiKeyPrefixResponse as AppsSettingsApiKeyPrefixResponse, type environment_AppsSettingsBackchannelLogoutBody as AppsSettingsBackchannelLogoutBody, type environment_AppsSettingsBackchannelLogoutResponse as AppsSettingsBackchannelLogoutResponse, type environment_AppsSettingsTokenExchangeBody as AppsSettingsTokenExchangeBody, type environment_AppsSettingsTokenExchangeResponse as AppsSettingsTokenExchangeResponse, type environment_AppsSettingsTokenLifetimeBody as AppsSettingsTokenLifetimeBody, type environment_AppsSettingsTokenLifetimeResponse as AppsSettingsTokenLifetimeResponse, type environment_AppsUpdateBody as AppsUpdateBody, type environment_AppsUpdateResponse as AppsUpdateResponse, type environment_AssignableMemberRole as AssignableMemberRole, type environment_AuditEntry as AuditEntry, type environment_AuditListQuery as AuditListQuery, type environment_AuditListResponse as AuditListResponse, type environment_AuditLogEvent as AuditLogEvent, type environment_AuditLogEventBatch as AuditLogEventBatch, type environment_AuditLogExport as AuditLogExport, type environment_AuditLogSchema as AuditLogSchema, type environment_AuditLogSettings as AuditLogSettings, type environment_AuditLogVerification as AuditLogVerification, type environment_AuditLogsEventsCreateBody as AuditLogsEventsCreateBody, type environment_AuditLogsEventsCreateResponse as AuditLogsEventsCreateResponse, type environment_AuditLogsEventsListQuery as AuditLogsEventsListQuery, type environment_AuditLogsEventsListResponse as AuditLogsEventsListResponse, type environment_AuditLogsExportsCreateBody as AuditLogsExportsCreateBody, type environment_AuditLogsExportsCreateResponse as AuditLogsExportsCreateResponse, type environment_AuditLogsExportsGetResponse as AuditLogsExportsGetResponse, type environment_AuditLogsSchemasCreateBody as AuditLogsSchemasCreateBody, type environment_AuditLogsSchemasCreateResponse as AuditLogsSchemasCreateResponse, type environment_AuditLogsSchemasDeleteResponse as AuditLogsSchemasDeleteResponse, type environment_AuditLogsSchemasGetResponse as AuditLogsSchemasGetResponse, type environment_AuditLogsSchemasListQuery as AuditLogsSchemasListQuery, type environment_AuditLogsSchemasListResponse as AuditLogsSchemasListResponse, type environment_AuditLogsSchemasUpdateBody as AuditLogsSchemasUpdateBody, type environment_AuditLogsSchemasUpdateResponse as AuditLogsSchemasUpdateResponse, type environment_AuditLogsSettingsGetResponse as AuditLogsSettingsGetResponse, type environment_AuditLogsSettingsUpdateBody as AuditLogsSettingsUpdateBody, type environment_AuditLogsSettingsUpdateResponse as AuditLogsSettingsUpdateResponse, type environment_AuditLogsVerifyQuery as AuditLogsVerifyQuery, type environment_AuditLogsVerifyResponse as AuditLogsVerifyResponse, type environment_BearerChallenge as BearerChallenge, type environment_BrandingAppearanceGetQuery as BrandingAppearanceGetQuery, type environment_BrandingAppearanceGetResponse as BrandingAppearanceGetResponse, type environment_BrandingAppearanceSetBody as BrandingAppearanceSetBody, type environment_BrandingAppearanceSetResponse as BrandingAppearanceSetResponse, type environment_BrandingWhitelabelGetQuery as BrandingWhitelabelGetQuery, type environment_BrandingWhitelabelGetResponse as BrandingWhitelabelGetResponse, type environment_BrandingWhitelabelSetBody as BrandingWhitelabelSetBody, type environment_BrandingWhitelabelSetResponse as BrandingWhitelabelSetResponse, type CustomDomain$1 as CustomDomain, type environment_Device as Device, type environment_DirectoriesConnectBody as DirectoriesConnectBody, type environment_DirectoriesConnectResponse as DirectoriesConnectResponse, type environment_DirectoriesCreateBody as DirectoriesCreateBody, type environment_DirectoriesCreateResponse as DirectoriesCreateResponse, type environment_DirectoriesDeleteBody as DirectoriesDeleteBody, type environment_DirectoriesDeleteResponse as DirectoriesDeleteResponse, type environment_DirectoriesGetQuery as DirectoriesGetQuery, type environment_DirectoriesGetResponse as DirectoriesGetResponse, type environment_DirectoriesGroupsListQuery as DirectoriesGroupsListQuery, type environment_DirectoriesGroupsListResponse as DirectoriesGroupsListResponse, type environment_DirectoriesGroupsMapBody as DirectoriesGroupsMapBody, type environment_DirectoriesGroupsMapResponse as DirectoriesGroupsMapResponse, type environment_DirectoriesListQuery as DirectoriesListQuery, type environment_DirectoriesListResponse as DirectoriesListResponse, type environment_DirectoriesStatusSetBody as DirectoriesStatusSetBody, type environment_DirectoriesStatusSetResponse as DirectoriesStatusSetResponse, type environment_DirectoriesTokenRotateBody as DirectoriesTokenRotateBody, type environment_DirectoriesTokenRotateResponse as DirectoriesTokenRotateResponse, type environment_DirectoriesUpdateBody as DirectoriesUpdateBody, type environment_DirectoriesUpdateResponse as DirectoriesUpdateResponse, type environment_Directory as Directory, type environment_DirectoryGroup as DirectoryGroup, type environment_DomainEvent as DomainEvent, type environment_DomainsAddBody as DomainsAddBody, type environment_DomainsAddResponse as DomainsAddResponse, type environment_DomainsGetResponse as DomainsGetResponse, type environment_DomainsRemoveResponse as DomainsRemoveResponse, type environment_DomainsVerifyResponse as DomainsVerifyResponse, environment_EnvironmentClient as EnvironmentClient, type environment_EnvironmentClientOptions as EnvironmentClientOptions, type environment_ErasureReceipt as ErasureReceipt, type ErrorSchema$3 as ErrorSchema, type environment_EventsListQuery as EventsListQuery, type environment_EventsListResponse as EventsListResponse, type environment_FrontendKey as FrontendKey, type environment_FrontendKeysCreateBody as FrontendKeysCreateBody, type environment_FrontendKeysCreateResponse as FrontendKeysCreateResponse, type environment_FrontendKeysListQuery as FrontendKeysListQuery, type environment_FrontendKeysListResponse as FrontendKeysListResponse, type environment_FrontendKeysRevokeResponse as FrontendKeysRevokeResponse, type environment_FrontendKeysSetOriginsBody as FrontendKeysSetOriginsBody, type environment_FrontendKeysSetOriginsResponse as FrontendKeysSetOriginsResponse, type environment_HooksCreateBody as HooksCreateBody, type environment_HooksCreateResponse as HooksCreateResponse, type environment_HooksDeleteResponse as HooksDeleteResponse, type environment_HooksGetResponse as HooksGetResponse, type environment_HooksListQuery as HooksListQuery, type environment_HooksListResponse as HooksListResponse, type environment_HooksUpdateBody as HooksUpdateBody, type environment_HooksUpdateResponse as HooksUpdateResponse, type environment_InlineHook as InlineHook, type environment_Invitation as Invitation, type environment_InvitationsListQuery as InvitationsListQuery, type environment_InvitationsListResponse as InvitationsListResponse, type environment_InvitationsResendResponse as InvitationsResendResponse, type environment_InvitationsRevokeResponse as InvitationsRevokeResponse, type environment_InvitationsSendBody as InvitationsSendBody, type environment_InvitationsSendResponse as InvitationsSendResponse, type environment_KeysCreateBody as KeysCreateBody, type environment_KeysCreateResponse as KeysCreateResponse, type environment_KeysListQuery as KeysListQuery, type environment_KeysListResponse as KeysListResponse, type environment_KeysRevokeResponse as KeysRevokeResponse, type environment_KeysRotateBody as KeysRotateBody, type environment_KeysRotateResponse as KeysRotateResponse, type environment_LegacyLogin as LegacyLogin, type environment_LegacyLoginApproveResponse as LegacyLoginApproveResponse, type environment_LegacyLoginGetResponse as LegacyLoginGetResponse, type environment_LegacyLoginProbe as LegacyLoginProbe, type environment_LegacyLoginProbeBody as LegacyLoginProbeBody, type environment_LegacyLoginProbeResponse as LegacyLoginProbeResponse, type environment_LegacyLoginRevokeResponse as LegacyLoginRevokeResponse, type environment_LogStream as LogStream, type environment_LogStreamTest as LogStreamTest, type environment_LogStreamsCreateBody as LogStreamsCreateBody, type environment_LogStreamsCreateResponse as LogStreamsCreateResponse, type environment_LogStreamsDeleteResponse as LogStreamsDeleteResponse, type environment_LogStreamsGetResponse as LogStreamsGetResponse, type environment_LogStreamsListQuery as LogStreamsListQuery, type environment_LogStreamsListResponse as LogStreamsListResponse, type environment_LogStreamsTestResponse as LogStreamsTestResponse, type environment_LogStreamsUpdateBody as LogStreamsUpdateBody, type environment_LogStreamsUpdateResponse as LogStreamsUpdateResponse, type environment_ManagementKey as ManagementKey, type environment_ManifestSync as ManifestSync, type Member$1 as Member, type environment_MembersAddBody as MembersAddBody, type environment_MembersAddResponse as MembersAddResponse, type environment_MembersListQuery as MembersListQuery, type environment_MembersListResponse as MembersListResponse, type environment_MembersRemoveResponse as MembersRemoveResponse, type environment_MembersRolesGrantQuery as MembersRolesGrantQuery, type environment_MembersRolesGrantResponse as MembersRolesGrantResponse, type environment_MembersRolesListResponse as MembersRolesListResponse, type environment_MembersRolesRevokeQuery as MembersRolesRevokeQuery, type environment_MembersRolesRevokeResponse as MembersRolesRevokeResponse, type environment_MembersUpdateBody as MembersUpdateBody, type environment_MembersUpdateResponse as MembersUpdateResponse, type environment_OAuthClientError as OAuthClientError, type Organization$1 as Organization, type environment_OrganizationDomain as OrganizationDomain, type OrganizationsCreateBody$1 as OrganizationsCreateBody, type OrganizationsCreateResponse$1 as OrganizationsCreateResponse, type environment_OrganizationsDeleteResponse as OrganizationsDeleteResponse, type environment_OrganizationsDomainsAddBody as OrganizationsDomainsAddBody, type environment_OrganizationsDomainsAddResponse as OrganizationsDomainsAddResponse, type environment_OrganizationsDomainsCaptureBody as OrganizationsDomainsCaptureBody, type environment_OrganizationsDomainsCaptureResponse as OrganizationsDomainsCaptureResponse, type environment_OrganizationsDomainsListResponse as OrganizationsDomainsListResponse, type environment_OrganizationsDomainsRemoveResponse as OrganizationsDomainsRemoveResponse, type environment_OrganizationsDomainsVerifyResponse as OrganizationsDomainsVerifyResponse, type environment_OrganizationsGetResponse as OrganizationsGetResponse, type environment_OrganizationsListQuery as OrganizationsListQuery, type environment_OrganizationsListResponse as OrganizationsListResponse, type environment_OrganizationsPortalLinksCreateBody as OrganizationsPortalLinksCreateBody, type environment_OrganizationsPortalLinksCreateResponse as OrganizationsPortalLinksCreateResponse, type environment_OrganizationsPortalLinksListResponse as OrganizationsPortalLinksListResponse, type environment_OrganizationsPortalLinksRevokeResponse as OrganizationsPortalLinksRevokeResponse, type environment_OrganizationsReactivateResponse as OrganizationsReactivateResponse, type environment_OrganizationsSuspendResponse as OrganizationsSuspendResponse, type environment_OrganizationsTransferOwnershipBody as OrganizationsTransferOwnershipBody, type environment_OrganizationsTransferOwnershipResponse as OrganizationsTransferOwnershipResponse, type environment_OrganizationsUpdateBody as OrganizationsUpdateBody, type environment_OrganizationsUpdateResponse as OrganizationsUpdateResponse, type PageMeta$1 as PageMeta, type environment_Permission as Permission, type environment_PermissionsCreateBody as PermissionsCreateBody, type environment_PermissionsCreateResponse as PermissionsCreateResponse, type environment_PermissionsDeleteResponse as PermissionsDeleteResponse, type environment_PermissionsListQuery as PermissionsListQuery, type environment_PermissionsListResponse as PermissionsListResponse, type environment_PermissionsUpdateBody as PermissionsUpdateBody, type environment_PermissionsUpdateResponse as PermissionsUpdateResponse, type environment_PortalLink as PortalLink, type environment_PortalLinkRecord as PortalLinkRecord, type environment_ProvisioningTarget as ProvisioningTarget, type environment_ProvisioningTargetsCreateBody as ProvisioningTargetsCreateBody, type environment_ProvisioningTargetsCreateResponse as ProvisioningTargetsCreateResponse, type environment_ProvisioningTargetsDeleteBody as ProvisioningTargetsDeleteBody, type environment_ProvisioningTargetsDeleteResponse as ProvisioningTargetsDeleteResponse, type environment_ProvisioningTargetsGetQuery as ProvisioningTargetsGetQuery, type environment_ProvisioningTargetsGetResponse as ProvisioningTargetsGetResponse, type environment_ProvisioningTargetsListQuery as ProvisioningTargetsListQuery, type environment_ProvisioningTargetsListResponse as ProvisioningTargetsListResponse, type environment_ProvisioningTargetsStatusSetBody as ProvisioningTargetsStatusSetBody, type environment_ProvisioningTargetsStatusSetResponse as ProvisioningTargetsStatusSetResponse, type environment_Role as Role, type environment_RoleAssignment as RoleAssignment, type environment_RolesCreateBody as RolesCreateBody, type environment_RolesCreateResponse as RolesCreateResponse, type environment_RolesDeleteResponse as RolesDeleteResponse, type environment_RolesGetQuery as RolesGetQuery, type environment_RolesGetResponse as RolesGetResponse, type environment_RolesListQuery as RolesListQuery, type environment_RolesListResponse as RolesListResponse, type environment_RolesPermissionsGrantResponse as RolesPermissionsGrantResponse, type environment_RolesPermissionsRevokeResponse as RolesPermissionsRevokeResponse, type environment_RolesUpdateBody as RolesUpdateBody, type environment_RolesUpdateResponse as RolesUpdateResponse, type environment_SamlApp as SamlApp, type environment_SamlAppsCreateBody as SamlAppsCreateBody, type environment_SamlAppsCreateResponse as SamlAppsCreateResponse, type environment_SamlAppsDeleteResponse as SamlAppsDeleteResponse, type environment_SamlAppsGetResponse as SamlAppsGetResponse, type environment_SamlAppsListQuery as SamlAppsListQuery, type environment_SamlAppsListResponse as SamlAppsListResponse, type environment_SamlAppsUpdateBody as SamlAppsUpdateBody, type environment_SamlAppsUpdateResponse as SamlAppsUpdateResponse, type environment_SamlMetadata as SamlMetadata, type environment_SelfServiceSignup as SelfServiceSignup, type environment_SignInPolicy as SignInPolicy, type environment_SignInRules as SignInRules, type environment_SigninPolicyGetQuery as SigninPolicyGetQuery, type environment_SigninPolicyGetResponse as SigninPolicyGetResponse, type environment_SigninPolicyInheritResponse as SigninPolicyInheritResponse, type environment_SigninPolicyUpdateBody as SigninPolicyUpdateBody, type environment_SigninPolicyUpdateResponse as SigninPolicyUpdateResponse, type environment_SigninSelfServiceSignupSetBody as SigninSelfServiceSignupSetBody, type environment_SigninSelfServiceSignupSetResponse as SigninSelfServiceSignupSetResponse, type environment_SigninSocialDeleteBody as SigninSocialDeleteBody, type environment_SigninSocialDeleteResponse as SigninSocialDeleteResponse, type environment_SigninSocialListQuery as SigninSocialListQuery, type environment_SigninSocialListResponse as SigninSocialListResponse, type environment_SigninSocialSetBody as SigninSocialSetBody, type environment_SigninSocialSetResponse as SigninSocialSetResponse, type environment_SocialProvider as SocialProvider, type environment_SodPoliciesCreateBody as SodPoliciesCreateBody, type environment_SodPoliciesCreateResponse as SodPoliciesCreateResponse, type environment_SodPoliciesDeleteBody as SodPoliciesDeleteBody, type environment_SodPoliciesDeleteResponse as SodPoliciesDeleteResponse, type environment_SodPoliciesGetQuery as SodPoliciesGetQuery, type environment_SodPoliciesGetResponse as SodPoliciesGetResponse, type environment_SodPoliciesListQuery as SodPoliciesListQuery, type environment_SodPoliciesListResponse as SodPoliciesListResponse, type environment_SodPoliciesStatusSetBody as SodPoliciesStatusSetBody, type environment_SodPoliciesStatusSetResponse as SodPoliciesStatusSetResponse, type environment_SodPolicy as SodPolicy, type environment_SsoCertificates as SsoCertificates, type environment_SsoConnection as SsoConnection, type environment_SsoConnectionsActivateBody as SsoConnectionsActivateBody, type environment_SsoConnectionsActivateResponse as SsoConnectionsActivateResponse, type environment_SsoConnectionsCertificatesActivateBody as SsoConnectionsCertificatesActivateBody, type environment_SsoConnectionsCertificatesActivateResponse as SsoConnectionsCertificatesActivateResponse, type environment_SsoConnectionsCertificatesListQuery as SsoConnectionsCertificatesListQuery, type environment_SsoConnectionsCertificatesListResponse as SsoConnectionsCertificatesListResponse, type environment_SsoConnectionsCertificatesStageBody as SsoConnectionsCertificatesStageBody, type environment_SsoConnectionsCertificatesStageResponse as SsoConnectionsCertificatesStageResponse, type environment_SsoConnectionsCreateBody as SsoConnectionsCreateBody, type environment_SsoConnectionsCreateResponse as SsoConnectionsCreateResponse, type environment_SsoConnectionsDeleteBody as SsoConnectionsDeleteBody, type environment_SsoConnectionsDeleteResponse as SsoConnectionsDeleteResponse, type environment_SsoConnectionsDisableBody as SsoConnectionsDisableBody, type environment_SsoConnectionsDisableResponse as SsoConnectionsDisableResponse, type environment_SsoConnectionsGetQuery as SsoConnectionsGetQuery, type environment_SsoConnectionsGetResponse as SsoConnectionsGetResponse, type environment_SsoConnectionsListQuery as SsoConnectionsListQuery, type environment_SsoConnectionsListResponse as SsoConnectionsListResponse, type environment_SsoConnectionsRequireSsoBody as SsoConnectionsRequireSsoBody, type environment_SsoConnectionsRequireSsoResponse as SsoConnectionsRequireSsoResponse, type environment_SsoConnectionsUpdateBody as SsoConnectionsUpdateBody, type environment_SsoConnectionsUpdateResponse as SsoConnectionsUpdateResponse, type environment_SsoDomain as SsoDomain, type environment_SsoDomainsCaptureBody as SsoDomainsCaptureBody, type environment_SsoDomainsCaptureResponse as SsoDomainsCaptureResponse, type environment_SsoDomainsCreateBody as SsoDomainsCreateBody, type environment_SsoDomainsCreateResponse as SsoDomainsCreateResponse, type environment_SsoDomainsDeleteBody as SsoDomainsDeleteBody, type environment_SsoDomainsDeleteResponse as SsoDomainsDeleteResponse, type environment_SsoDomainsListQuery as SsoDomainsListQuery, type environment_SsoDomainsListResponse as SsoDomainsListResponse, type environment_SsoDomainsVerifyBody as SsoDomainsVerifyBody, type environment_SsoDomainsVerifyResponse as SsoDomainsVerifyResponse, type environment_SsoSamlMetadataImportBody as SsoSamlMetadataImportBody, type environment_SsoSamlMetadataImportResponse as SsoSamlMetadataImportResponse, type environment_SupportSession as SupportSession, type environment_SupportSessionsEndResponse as SupportSessionsEndResponse, type environment_SupportSessionsStartBody as SupportSessionsStartBody, type environment_SupportSessionsStartResponse as SupportSessionsStartResponse, type environment_ThemeMode as ThemeMode, type environment_TokenVaultGrantsCreateBody as TokenVaultGrantsCreateBody, type environment_TokenVaultGrantsCreateResponse as TokenVaultGrantsCreateResponse, type environment_TokenVaultGrantsDeleteBody as TokenVaultGrantsDeleteBody, type environment_TokenVaultGrantsDeleteResponse as TokenVaultGrantsDeleteResponse, type environment_TokenVaultSecret as TokenVaultSecret, type environment_TokenVaultSecretsCreateBody as TokenVaultSecretsCreateBody, type environment_TokenVaultSecretsCreateResponse as TokenVaultSecretsCreateResponse, type environment_TokenVaultSecretsGetQuery as TokenVaultSecretsGetQuery, type environment_TokenVaultSecretsGetResponse as TokenVaultSecretsGetResponse, type environment_TokenVaultSecretsListQuery as TokenVaultSecretsListQuery, type environment_TokenVaultSecretsListResponse as TokenVaultSecretsListResponse, type environment_TokenVaultSecretsRevokeBody as TokenVaultSecretsRevokeBody, type environment_TokenVaultSecretsRevokeResponse as TokenVaultSecretsRevokeResponse, type environment_TokenVaultSecretsRotateBody as TokenVaultSecretsRotateBody, type environment_TokenVaultSecretsRotateResponse as TokenVaultSecretsRotateResponse, type environment_User as User, type environment_UserSession as UserSession, type environment_UsersCreateBody as UsersCreateBody, type environment_UsersCreateResponse as UsersCreateResponse, type environment_UsersDeactivateResponse as UsersDeactivateResponse, type environment_UsersEnvironmentRolesGetQuery as UsersEnvironmentRolesGetQuery, type environment_UsersEnvironmentRolesGetResponse as UsersEnvironmentRolesGetResponse, type environment_UsersEnvironmentRolesGrantQuery as UsersEnvironmentRolesGrantQuery, type environment_UsersEnvironmentRolesGrantResponse as UsersEnvironmentRolesGrantResponse, type environment_UsersEnvironmentRolesListResponse as UsersEnvironmentRolesListResponse, type environment_UsersEnvironmentRolesRevokeQuery as UsersEnvironmentRolesRevokeQuery, type environment_UsersEnvironmentRolesRevokeResponse as UsersEnvironmentRolesRevokeResponse, type environment_UsersEraseResponse as UsersEraseResponse, type environment_UsersGetResponse as UsersGetResponse, type environment_UsersListQuery as UsersListQuery, type environment_UsersListResponse as UsersListResponse, type environment_UsersMfaResetResponse as UsersMfaResetResponse, type environment_UsersPasswordResetSendResponse as UsersPasswordResetSendResponse, type environment_UsersPasswordSetBody as UsersPasswordSetBody, type environment_UsersPasswordSetResponse as UsersPasswordSetResponse, type environment_UsersReactivateResponse as UsersReactivateResponse, type environment_UsersSessionsListResponse as UsersSessionsListResponse, type environment_UsersSessionsRevokeAllResponse as UsersSessionsRevokeAllResponse, type environment_UsersSessionsRevokeResponse as UsersSessionsRevokeResponse, type environment_UsersUpdateBody as UsersUpdateBody, type environment_UsersUpdateResponse as UsersUpdateResponse, type environment_UsersVerificationSendResponse as UsersVerificationSendResponse, type environment_UsersVerifyResponse as UsersVerifyResponse, type environment_VaultSecret as VaultSecret, type environment_Webhook as Webhook, type environment_WebhooksCreateBody as WebhooksCreateBody, type environment_WebhooksCreateResponse as WebhooksCreateResponse, type environment_WebhooksDeleteResponse as WebhooksDeleteResponse, type environment_WebhooksGetResponse as WebhooksGetResponse, type environment_WebhooksListQuery as WebhooksListQuery, type environment_WebhooksListResponse as WebhooksListResponse, type environment_WebhooksPauseResponse as WebhooksPauseResponse, type environment_WebhooksResumeResponse as WebhooksResumeResponse, type environment_WebhooksSecretRotateResponse as WebhooksSecretRotateResponse, type environment_WebhooksSignatureSchemeChangeBody as WebhooksSignatureSchemeChangeBody, type environment_WebhooksSignatureSchemeChangeResponse as WebhooksSignatureSchemeChangeResponse, type environment_WebhooksUpdateBody as WebhooksUpdateBody, type environment_WebhooksUpdateResponse as WebhooksUpdateResponse, type environment_WhitelabelBranding as WhitelabelBranding, environment_environmentOperations as environmentOperations };
+  export { type environment_AccessReview as AccessReview, type environment_AccessReviewItem as AccessReviewItem, type environment_AccessReviewsCloseBody as AccessReviewsCloseBody, type environment_AccessReviewsCloseResponse as AccessReviewsCloseResponse, type environment_AccessReviewsCreateBody as AccessReviewsCreateBody, type environment_AccessReviewsCreateResponse as AccessReviewsCreateResponse, type environment_AccessReviewsGetQuery as AccessReviewsGetQuery, type environment_AccessReviewsGetResponse as AccessReviewsGetResponse, type environment_AccessReviewsItemsDecideBody as AccessReviewsItemsDecideBody, type environment_AccessReviewsItemsDecideResponse as AccessReviewsItemsDecideResponse, type environment_AccessReviewsItemsListQuery as AccessReviewsItemsListQuery, type environment_AccessReviewsItemsListResponse as AccessReviewsItemsListResponse, type environment_AccessReviewsListQuery as AccessReviewsListQuery, type environment_AccessReviewsListResponse as AccessReviewsListResponse, type ActionApprovalsGetResponse$3 as ActionApprovalsGetResponse, type environment_AgentRequest as AgentRequest, type environment_Api as Api, type environment_ApiKey as ApiKey, type environment_ApiKeyVerification as ApiKeyVerification, type environment_ApiKeyVerificationRequest as ApiKeyVerificationRequest, type environment_ApiKeysListQuery as ApiKeysListQuery, type environment_ApiKeysListResponse as ApiKeysListResponse, type ApiKeysRevokeResponse$1 as ApiKeysRevokeResponse, type environment_ApiScope as ApiScope, type environment_ApisCreateBody as ApisCreateBody, type environment_ApisCreateResponse as ApisCreateResponse, type environment_ApisDeleteResponse as ApisDeleteResponse, type environment_ApisGetResponse as ApisGetResponse, type environment_ApisListQuery as ApisListQuery, type environment_ApisListResponse as ApisListResponse, type environment_ApisScopesDefineBody as ApisScopesDefineBody, type environment_ApisScopesDefineResponse as ApisScopesDefineResponse, type environment_ApisScopesRemoveResponse as ApisScopesRemoveResponse, type environment_ApisUpdateBody as ApisUpdateBody, type environment_ApisUpdateResponse as ApisUpdateResponse, type environment_App as App, type environment_AppBlueprint as AppBlueprint, type environment_AppSecret as AppSecret, type environment_Appearance as Appearance, type environment_Approval as Approval, type environment_ApprovalDecision as ApprovalDecision, type environment_ApprovalsDenyResponse as ApprovalsDenyResponse, type environment_ApprovalsListQuery as ApprovalsListQuery, type environment_ApprovalsListResponse as ApprovalsListResponse, type environment_AppsBlueprintResponse as AppsBlueprintResponse, type environment_AppsCopyBody as AppsCopyBody, type environment_AppsCopyResponse as AppsCopyResponse, type environment_AppsCreateBody as AppsCreateBody, type environment_AppsCreateResponse as AppsCreateResponse, type environment_AppsDeleteResponse as AppsDeleteResponse, type environment_AppsGetResponse as AppsGetResponse, type environment_AppsListQuery as AppsListQuery, type environment_AppsListResponse as AppsListResponse, type environment_AppsManifestSetBody as AppsManifestSetBody, type environment_AppsManifestSetResponse as AppsManifestSetResponse, type environment_AppsManifestSyncResponse as AppsManifestSyncResponse, type environment_AppsScopesSetBody as AppsScopesSetBody, type environment_AppsScopesSetResponse as AppsScopesSetResponse, type environment_AppsSecretsListResponse as AppsSecretsListResponse, type environment_AppsSecretsRevokeResponse as AppsSecretsRevokeResponse, type environment_AppsSecretsRotateBody as AppsSecretsRotateBody, type environment_AppsSecretsRotateResponse as AppsSecretsRotateResponse, type environment_AppsSettingsApiKeyPrefixBody as AppsSettingsApiKeyPrefixBody, type environment_AppsSettingsApiKeyPrefixResponse as AppsSettingsApiKeyPrefixResponse, type environment_AppsSettingsBackchannelLogoutBody as AppsSettingsBackchannelLogoutBody, type environment_AppsSettingsBackchannelLogoutResponse as AppsSettingsBackchannelLogoutResponse, type environment_AppsSettingsTokenExchangeBody as AppsSettingsTokenExchangeBody, type environment_AppsSettingsTokenExchangeResponse as AppsSettingsTokenExchangeResponse, type environment_AppsSettingsTokenLifetimeBody as AppsSettingsTokenLifetimeBody, type environment_AppsSettingsTokenLifetimeResponse as AppsSettingsTokenLifetimeResponse, type environment_AppsUpdateBody as AppsUpdateBody, type environment_AppsUpdateResponse as AppsUpdateResponse, type environment_AssignableMemberRole as AssignableMemberRole, type environment_AuditEntry as AuditEntry, type environment_AuditListQuery as AuditListQuery, type environment_AuditListResponse as AuditListResponse, type environment_AuditLogEvent as AuditLogEvent, type environment_AuditLogEventBatch as AuditLogEventBatch, type environment_AuditLogExport as AuditLogExport, type environment_AuditLogSchema as AuditLogSchema, type environment_AuditLogSettings as AuditLogSettings, type environment_AuditLogVerification as AuditLogVerification, type environment_AuditLogsEventsCreateBody as AuditLogsEventsCreateBody, type environment_AuditLogsEventsCreateResponse as AuditLogsEventsCreateResponse, type environment_AuditLogsEventsListQuery as AuditLogsEventsListQuery, type environment_AuditLogsEventsListResponse as AuditLogsEventsListResponse, type environment_AuditLogsExportsCreateBody as AuditLogsExportsCreateBody, type environment_AuditLogsExportsCreateResponse as AuditLogsExportsCreateResponse, type environment_AuditLogsExportsGetResponse as AuditLogsExportsGetResponse, type environment_AuditLogsSchemasCreateBody as AuditLogsSchemasCreateBody, type environment_AuditLogsSchemasCreateResponse as AuditLogsSchemasCreateResponse, type environment_AuditLogsSchemasDeleteResponse as AuditLogsSchemasDeleteResponse, type environment_AuditLogsSchemasGetResponse as AuditLogsSchemasGetResponse, type environment_AuditLogsSchemasListQuery as AuditLogsSchemasListQuery, type environment_AuditLogsSchemasListResponse as AuditLogsSchemasListResponse, type environment_AuditLogsSchemasUpdateBody as AuditLogsSchemasUpdateBody, type environment_AuditLogsSchemasUpdateResponse as AuditLogsSchemasUpdateResponse, type environment_AuditLogsSettingsGetResponse as AuditLogsSettingsGetResponse, type environment_AuditLogsSettingsUpdateBody as AuditLogsSettingsUpdateBody, type environment_AuditLogsSettingsUpdateResponse as AuditLogsSettingsUpdateResponse, type environment_AuditLogsVerifyQuery as AuditLogsVerifyQuery, type environment_AuditLogsVerifyResponse as AuditLogsVerifyResponse, type environment_BearerChallenge as BearerChallenge, type environment_BrandingAppearanceGetQuery as BrandingAppearanceGetQuery, type environment_BrandingAppearanceGetResponse as BrandingAppearanceGetResponse, type environment_BrandingAppearanceSetBody as BrandingAppearanceSetBody, type environment_BrandingAppearanceSetResponse as BrandingAppearanceSetResponse, type environment_BrandingWhitelabelGetQuery as BrandingWhitelabelGetQuery, type environment_BrandingWhitelabelGetResponse as BrandingWhitelabelGetResponse, type environment_BrandingWhitelabelSetBody as BrandingWhitelabelSetBody, type environment_BrandingWhitelabelSetResponse as BrandingWhitelabelSetResponse, type CustomDomain$1 as CustomDomain, type environment_Device as Device, type environment_DirectoriesConnectBody as DirectoriesConnectBody, type environment_DirectoriesConnectResponse as DirectoriesConnectResponse, type environment_DirectoriesCreateBody as DirectoriesCreateBody, type environment_DirectoriesCreateResponse as DirectoriesCreateResponse, type environment_DirectoriesCredentialsReplaceBody as DirectoriesCredentialsReplaceBody, type environment_DirectoriesCredentialsReplaceResponse as DirectoriesCredentialsReplaceResponse, type environment_DirectoriesDeleteBody as DirectoriesDeleteBody, type environment_DirectoriesDeleteResponse as DirectoriesDeleteResponse, type environment_DirectoriesGetQuery as DirectoriesGetQuery, type environment_DirectoriesGetResponse as DirectoriesGetResponse, type environment_DirectoriesGroupsListQuery as DirectoriesGroupsListQuery, type environment_DirectoriesGroupsListResponse as DirectoriesGroupsListResponse, type environment_DirectoriesGroupsMapBody as DirectoriesGroupsMapBody, type environment_DirectoriesGroupsMapResponse as DirectoriesGroupsMapResponse, type environment_DirectoriesHrisConnectBody as DirectoriesHrisConnectBody, type environment_DirectoriesHrisConnectResponse as DirectoriesHrisConnectResponse, type environment_DirectoriesListQuery as DirectoriesListQuery, type environment_DirectoriesListResponse as DirectoriesListResponse, type environment_DirectoriesStatusSetBody as DirectoriesStatusSetBody, type environment_DirectoriesStatusSetResponse as DirectoriesStatusSetResponse, type environment_DirectoriesSyncBody as DirectoriesSyncBody, type environment_DirectoriesSyncResponse as DirectoriesSyncResponse, type environment_DirectoriesSyncSettingsUpdateBody as DirectoriesSyncSettingsUpdateBody, type environment_DirectoriesSyncSettingsUpdateResponse as DirectoriesSyncSettingsUpdateResponse, type environment_DirectoriesTokenRotateBody as DirectoriesTokenRotateBody, type environment_DirectoriesTokenRotateResponse as DirectoriesTokenRotateResponse, type environment_DirectoriesUpdateBody as DirectoriesUpdateBody, type environment_DirectoriesUpdateResponse as DirectoriesUpdateResponse, type environment_Directory as Directory, type environment_DirectoryGroup as DirectoryGroup, type environment_DomainEvent as DomainEvent, type environment_DomainsAddBody as DomainsAddBody, type environment_DomainsAddResponse as DomainsAddResponse, type environment_DomainsGetResponse as DomainsGetResponse, type environment_DomainsRemoveResponse as DomainsRemoveResponse, type environment_DomainsVerifyResponse as DomainsVerifyResponse, environment_EnvironmentClient as EnvironmentClient, type environment_EnvironmentClientOptions as EnvironmentClientOptions, type environment_ErasureReceipt as ErasureReceipt, type ErrorSchema$3 as ErrorSchema, type environment_EventsListQuery as EventsListQuery, type environment_EventsListResponse as EventsListResponse, type environment_FeatureFlag as FeatureFlag, type environment_FeatureFlagEvaluation as FeatureFlagEvaluation, type environment_FeatureFlagRule as FeatureFlagRule, type environment_FeatureFlagsCreateBody as FeatureFlagsCreateBody, type environment_FeatureFlagsCreateResponse as FeatureFlagsCreateResponse, type environment_FeatureFlagsDeleteResponse as FeatureFlagsDeleteResponse, type environment_FeatureFlagsEvaluateQuery as FeatureFlagsEvaluateQuery, type environment_FeatureFlagsEvaluateResponse as FeatureFlagsEvaluateResponse, type environment_FeatureFlagsGetResponse as FeatureFlagsGetResponse, type environment_FeatureFlagsListQuery as FeatureFlagsListQuery, type environment_FeatureFlagsListResponse as FeatureFlagsListResponse, type environment_FeatureFlagsUpdateBody as FeatureFlagsUpdateBody, type environment_FeatureFlagsUpdateResponse as FeatureFlagsUpdateResponse, type environment_FgaCheck as FgaCheck, type environment_FgaCheckBatch as FgaCheckBatch, type environment_FgaCheckBatchQuery as FgaCheckBatchQuery, type environment_FgaCheckBatchResponse as FgaCheckBatchResponse, type environment_FgaCheckQuery as FgaCheckQuery, type environment_FgaCheckResponse as FgaCheckResponse, type environment_FgaObject as FgaObject, type environment_FgaResourcesListQuery as FgaResourcesListQuery, type environment_FgaResourcesListResponse as FgaResourcesListResponse, type environment_FgaSchema as FgaSchema, type environment_FgaSchemaGetResponse as FgaSchemaGetResponse, type environment_FgaSchemaUpdateBody as FgaSchemaUpdateBody, type environment_FgaSchemaUpdateResponse as FgaSchemaUpdateResponse, type environment_FgaSchemaValidateQuery as FgaSchemaValidateQuery, type environment_FgaSchemaValidateResponse as FgaSchemaValidateResponse, type environment_FgaSchemaValidation as FgaSchemaValidation, type environment_FgaSubject as FgaSubject, type environment_FgaSubjectsListQuery as FgaSubjectsListQuery, type environment_FgaSubjectsListResponse as FgaSubjectsListResponse, type environment_FgaTuple as FgaTuple, type environment_FgaTupleWrite as FgaTupleWrite, type environment_FgaTuplesDeleteBody as FgaTuplesDeleteBody, type environment_FgaTuplesDeleteResponse as FgaTuplesDeleteResponse, type environment_FgaTuplesListQuery as FgaTuplesListQuery, type environment_FgaTuplesListResponse as FgaTuplesListResponse, type environment_FgaTuplesWriteBody as FgaTuplesWriteBody, type environment_FgaTuplesWriteResponse as FgaTuplesWriteResponse, type environment_FgaType as FgaType, type environment_FrontendKey as FrontendKey, type environment_FrontendKeysCreateBody as FrontendKeysCreateBody, type environment_FrontendKeysCreateResponse as FrontendKeysCreateResponse, type environment_FrontendKeysListQuery as FrontendKeysListQuery, type environment_FrontendKeysListResponse as FrontendKeysListResponse, type environment_FrontendKeysRevokeResponse as FrontendKeysRevokeResponse, type environment_FrontendKeysSetOriginsBody as FrontendKeysSetOriginsBody, type environment_FrontendKeysSetOriginsResponse as FrontendKeysSetOriginsResponse, type environment_HooksCreateBody as HooksCreateBody, type environment_HooksCreateResponse as HooksCreateResponse, type environment_HooksDeleteResponse as HooksDeleteResponse, type environment_HooksGetResponse as HooksGetResponse, type environment_HooksListQuery as HooksListQuery, type environment_HooksListResponse as HooksListResponse, type environment_HooksUpdateBody as HooksUpdateBody, type environment_HooksUpdateResponse as HooksUpdateResponse, type environment_InlineHook as InlineHook, type environment_Invitation as Invitation, type environment_InvitationsListQuery as InvitationsListQuery, type environment_InvitationsListResponse as InvitationsListResponse, type environment_InvitationsResendResponse as InvitationsResendResponse, type environment_InvitationsRevokeResponse as InvitationsRevokeResponse, type environment_InvitationsSendBody as InvitationsSendBody, type environment_InvitationsSendResponse as InvitationsSendResponse, type environment_KeysCreateBody as KeysCreateBody, type environment_KeysCreateResponse as KeysCreateResponse, type environment_KeysListQuery as KeysListQuery, type environment_KeysListResponse as KeysListResponse, type environment_KeysRevokeResponse as KeysRevokeResponse, type environment_KeysRotateBody as KeysRotateBody, type environment_KeysRotateResponse as KeysRotateResponse, type environment_LegacyLogin as LegacyLogin, type environment_LegacyLoginApproveResponse as LegacyLoginApproveResponse, type environment_LegacyLoginGetResponse as LegacyLoginGetResponse, type environment_LegacyLoginProbe as LegacyLoginProbe, type environment_LegacyLoginProbeBody as LegacyLoginProbeBody, type environment_LegacyLoginProbeResponse as LegacyLoginProbeResponse, type environment_LegacyLoginRevokeResponse as LegacyLoginRevokeResponse, type environment_LogStream as LogStream, type environment_LogStreamTest as LogStreamTest, type environment_LogStreamsCreateBody as LogStreamsCreateBody, type environment_LogStreamsCreateResponse as LogStreamsCreateResponse, type environment_LogStreamsDeleteResponse as LogStreamsDeleteResponse, type environment_LogStreamsGetResponse as LogStreamsGetResponse, type environment_LogStreamsListQuery as LogStreamsListQuery, type environment_LogStreamsListResponse as LogStreamsListResponse, type environment_LogStreamsTestResponse as LogStreamsTestResponse, type environment_LogStreamsUpdateBody as LogStreamsUpdateBody, type environment_LogStreamsUpdateResponse as LogStreamsUpdateResponse, type environment_ManagementKey as ManagementKey, type environment_ManifestSync as ManifestSync, type Member$1 as Member, type environment_MembersAddBody as MembersAddBody, type environment_MembersAddResponse as MembersAddResponse, type environment_MembersListQuery as MembersListQuery, type environment_MembersListResponse as MembersListResponse, type environment_MembersRemoveResponse as MembersRemoveResponse, type environment_MembersRolesGrantQuery as MembersRolesGrantQuery, type environment_MembersRolesGrantResponse as MembersRolesGrantResponse, type environment_MembersRolesListResponse as MembersRolesListResponse, type environment_MembersRolesRevokeQuery as MembersRolesRevokeQuery, type environment_MembersRolesRevokeResponse as MembersRolesRevokeResponse, type environment_MembersUpdateBody as MembersUpdateBody, type environment_MembersUpdateResponse as MembersUpdateResponse, type environment_OAuthClientError as OAuthClientError, type environment_OfferedSocialProviders as OfferedSocialProviders, type Organization$1 as Organization, type environment_OrganizationDomain as OrganizationDomain, type OrganizationsCreateBody$1 as OrganizationsCreateBody, type OrganizationsCreateResponse$1 as OrganizationsCreateResponse, type environment_OrganizationsDeleteResponse as OrganizationsDeleteResponse, type environment_OrganizationsDomainsAddBody as OrganizationsDomainsAddBody, type environment_OrganizationsDomainsAddResponse as OrganizationsDomainsAddResponse, type environment_OrganizationsDomainsCaptureBody as OrganizationsDomainsCaptureBody, type environment_OrganizationsDomainsCaptureResponse as OrganizationsDomainsCaptureResponse, type environment_OrganizationsDomainsListResponse as OrganizationsDomainsListResponse, type environment_OrganizationsDomainsRemoveResponse as OrganizationsDomainsRemoveResponse, type environment_OrganizationsDomainsVerifyResponse as OrganizationsDomainsVerifyResponse, type environment_OrganizationsGetResponse as OrganizationsGetResponse, type environment_OrganizationsListQuery as OrganizationsListQuery, type environment_OrganizationsListResponse as OrganizationsListResponse, type environment_OrganizationsPortalLinksCreateBody as OrganizationsPortalLinksCreateBody, type environment_OrganizationsPortalLinksCreateResponse as OrganizationsPortalLinksCreateResponse, type environment_OrganizationsPortalLinksListResponse as OrganizationsPortalLinksListResponse, type environment_OrganizationsPortalLinksRevokeResponse as OrganizationsPortalLinksRevokeResponse, type environment_OrganizationsReactivateResponse as OrganizationsReactivateResponse, type environment_OrganizationsSuspendResponse as OrganizationsSuspendResponse, type environment_OrganizationsTransferOwnershipBody as OrganizationsTransferOwnershipBody, type environment_OrganizationsTransferOwnershipResponse as OrganizationsTransferOwnershipResponse, type environment_OrganizationsUpdateBody as OrganizationsUpdateBody, type environment_OrganizationsUpdateResponse as OrganizationsUpdateResponse, type PageMeta$1 as PageMeta, type environment_Permission as Permission, type environment_PermissionsCreateBody as PermissionsCreateBody, type environment_PermissionsCreateResponse as PermissionsCreateResponse, type environment_PermissionsDeleteResponse as PermissionsDeleteResponse, type environment_PermissionsListQuery as PermissionsListQuery, type environment_PermissionsListResponse as PermissionsListResponse, type environment_PermissionsUpdateBody as PermissionsUpdateBody, type environment_PermissionsUpdateResponse as PermissionsUpdateResponse, type environment_Pipe as Pipe, type environment_PipeConnectRequired as PipeConnectRequired, type environment_PipeConnection as PipeConnection, type environment_PipesConnectionsDeleteResponse as PipesConnectionsDeleteResponse, type environment_PipesConnectionsListQuery as PipesConnectionsListQuery, type environment_PipesConnectionsListResponse as PipesConnectionsListResponse, type environment_PipesCreateBody as PipesCreateBody, type environment_PipesCreateResponse as PipesCreateResponse, type environment_PipesDeleteResponse as PipesDeleteResponse, type environment_PipesGetResponse as PipesGetResponse, type environment_PipesGrantsCreateBody as PipesGrantsCreateBody, type environment_PipesGrantsCreateResponse as PipesGrantsCreateResponse, type environment_PipesGrantsDeleteResponse as PipesGrantsDeleteResponse, type environment_PipesListQuery as PipesListQuery, type environment_PipesListResponse as PipesListResponse, type environment_PipesUpdateBody as PipesUpdateBody, type environment_PipesUpdateResponse as PipesUpdateResponse, type environment_PortalLink as PortalLink, type environment_PortalLinkRecord as PortalLinkRecord, type environment_ProvisioningTarget as ProvisioningTarget, type environment_ProvisioningTargetsCreateBody as ProvisioningTargetsCreateBody, type environment_ProvisioningTargetsCreateResponse as ProvisioningTargetsCreateResponse, type environment_ProvisioningTargetsDeleteBody as ProvisioningTargetsDeleteBody, type environment_ProvisioningTargetsDeleteResponse as ProvisioningTargetsDeleteResponse, type environment_ProvisioningTargetsGetQuery as ProvisioningTargetsGetQuery, type environment_ProvisioningTargetsGetResponse as ProvisioningTargetsGetResponse, type environment_ProvisioningTargetsListQuery as ProvisioningTargetsListQuery, type environment_ProvisioningTargetsListResponse as ProvisioningTargetsListResponse, type environment_ProvisioningTargetsStatusSetBody as ProvisioningTargetsStatusSetBody, type environment_ProvisioningTargetsStatusSetResponse as ProvisioningTargetsStatusSetResponse, type environment_RadarDecision as RadarDecision, type environment_RadarDecisionsGetResponse as RadarDecisionsGetResponse, type environment_RadarDecisionsListQuery as RadarDecisionsListQuery, type environment_RadarDecisionsListResponse as RadarDecisionsListResponse, type environment_RadarListEntry as RadarListEntry, type environment_RadarListsAddBody as RadarListsAddBody, type environment_RadarListsAddResponse as RadarListsAddResponse, type environment_RadarListsListQuery as RadarListsListQuery, type environment_RadarListsListResponse as RadarListsListResponse, type environment_RadarListsRemoveResponse as RadarListsRemoveResponse, type environment_RadarModeSetBody as RadarModeSetBody, type environment_RadarModeSetResponse as RadarModeSetResponse, type environment_RadarRule as RadarRule, type environment_RadarRulesCreateBody as RadarRulesCreateBody, type environment_RadarRulesCreateResponse as RadarRulesCreateResponse, type environment_RadarRulesDeleteResponse as RadarRulesDeleteResponse, type environment_RadarRulesGetResponse as RadarRulesGetResponse, type environment_RadarRulesListQuery as RadarRulesListQuery, type environment_RadarRulesListResponse as RadarRulesListResponse, type environment_RadarRulesReorderBody as RadarRulesReorderBody, type environment_RadarRulesReorderResponse as RadarRulesReorderResponse, type environment_RadarRulesUpdateBody as RadarRulesUpdateBody, type environment_RadarRulesUpdateResponse as RadarRulesUpdateResponse, type environment_RadarSettings as RadarSettings, type environment_RadarSettingsGetResponse as RadarSettingsGetResponse, type environment_RadarSettingsUpdateBody as RadarSettingsUpdateBody, type environment_RadarSettingsUpdateResponse as RadarSettingsUpdateResponse, type environment_Role as Role, type environment_RoleAssignment as RoleAssignment, type environment_RolesCreateBody as RolesCreateBody, type environment_RolesCreateResponse as RolesCreateResponse, type environment_RolesDeleteResponse as RolesDeleteResponse, type environment_RolesGetQuery as RolesGetQuery, type environment_RolesGetResponse as RolesGetResponse, type environment_RolesListQuery as RolesListQuery, type environment_RolesListResponse as RolesListResponse, type environment_RolesPermissionsGrantResponse as RolesPermissionsGrantResponse, type environment_RolesPermissionsRevokeResponse as RolesPermissionsRevokeResponse, type environment_RolesUpdateBody as RolesUpdateBody, type environment_RolesUpdateResponse as RolesUpdateResponse, type environment_SamlApp as SamlApp, type environment_SamlAppsCreateBody as SamlAppsCreateBody, type environment_SamlAppsCreateResponse as SamlAppsCreateResponse, type environment_SamlAppsDeleteResponse as SamlAppsDeleteResponse, type environment_SamlAppsGetResponse as SamlAppsGetResponse, type environment_SamlAppsListQuery as SamlAppsListQuery, type environment_SamlAppsListResponse as SamlAppsListResponse, type environment_SamlAppsUpdateBody as SamlAppsUpdateBody, type environment_SamlAppsUpdateResponse as SamlAppsUpdateResponse, type environment_SamlMetadata as SamlMetadata, type environment_SelfServiceSignup as SelfServiceSignup, type environment_SignInMethodsInForce as SignInMethodsInForce, type environment_SignInPolicy as SignInPolicy, type environment_SignInRules as SignInRules, type environment_SigninPolicyGetQuery as SigninPolicyGetQuery, type environment_SigninPolicyGetResponse as SigninPolicyGetResponse, type environment_SigninPolicyInheritResponse as SigninPolicyInheritResponse, type environment_SigninPolicyUpdateBody as SigninPolicyUpdateBody, type environment_SigninPolicyUpdateResponse as SigninPolicyUpdateResponse, type environment_SigninSelfServiceSignupSetBody as SigninSelfServiceSignupSetBody, type environment_SigninSelfServiceSignupSetResponse as SigninSelfServiceSignupSetResponse, type environment_SigninSmsGetResponse as SigninSmsGetResponse, type environment_SigninSmsUpdateBody as SigninSmsUpdateBody, type environment_SigninSmsUpdateResponse as SigninSmsUpdateResponse, type environment_SigninSocialDeleteBody as SigninSocialDeleteBody, type environment_SigninSocialDeleteResponse as SigninSocialDeleteResponse, type environment_SigninSocialDisableBody as SigninSocialDisableBody, type environment_SigninSocialDisableResponse as SigninSocialDisableResponse, type environment_SigninSocialEnableBody as SigninSocialEnableBody, type environment_SigninSocialEnableResponse as SigninSocialEnableResponse, type environment_SigninSocialInheritBody as SigninSocialInheritBody, type environment_SigninSocialInheritResponse as SigninSocialInheritResponse, type environment_SigninSocialListQuery as SigninSocialListQuery, type environment_SigninSocialListResponse as SigninSocialListResponse, type environment_SigninSocialOfferedQuery as SigninSocialOfferedQuery, type environment_SigninSocialOfferedResponse as SigninSocialOfferedResponse, type environment_SigninSocialSetBody as SigninSocialSetBody, type environment_SigninSocialSetResponse as SigninSocialSetResponse, type environment_SigninSocialUpdateBody as SigninSocialUpdateBody, type environment_SigninSocialUpdateResponse as SigninSocialUpdateResponse, type environment_SmsFactorPolicy as SmsFactorPolicy, type environment_SocialProvider as SocialProvider, type environment_SodPoliciesCreateBody as SodPoliciesCreateBody, type environment_SodPoliciesCreateResponse as SodPoliciesCreateResponse, type environment_SodPoliciesDeleteBody as SodPoliciesDeleteBody, type environment_SodPoliciesDeleteResponse as SodPoliciesDeleteResponse, type environment_SodPoliciesGetQuery as SodPoliciesGetQuery, type environment_SodPoliciesGetResponse as SodPoliciesGetResponse, type environment_SodPoliciesListQuery as SodPoliciesListQuery, type environment_SodPoliciesListResponse as SodPoliciesListResponse, type environment_SodPoliciesStatusSetBody as SodPoliciesStatusSetBody, type environment_SodPoliciesStatusSetResponse as SodPoliciesStatusSetResponse, type environment_SodPolicy as SodPolicy, type environment_SsoCertificates as SsoCertificates, type environment_SsoConnection as SsoConnection, type environment_SsoConnectionsActivateBody as SsoConnectionsActivateBody, type environment_SsoConnectionsActivateResponse as SsoConnectionsActivateResponse, type environment_SsoConnectionsCertificatesActivateBody as SsoConnectionsCertificatesActivateBody, type environment_SsoConnectionsCertificatesActivateResponse as SsoConnectionsCertificatesActivateResponse, type environment_SsoConnectionsCertificatesListQuery as SsoConnectionsCertificatesListQuery, type environment_SsoConnectionsCertificatesListResponse as SsoConnectionsCertificatesListResponse, type environment_SsoConnectionsCertificatesStageBody as SsoConnectionsCertificatesStageBody, type environment_SsoConnectionsCertificatesStageResponse as SsoConnectionsCertificatesStageResponse, type environment_SsoConnectionsCreateBody as SsoConnectionsCreateBody, type environment_SsoConnectionsCreateResponse as SsoConnectionsCreateResponse, type environment_SsoConnectionsDeleteBody as SsoConnectionsDeleteBody, type environment_SsoConnectionsDeleteResponse as SsoConnectionsDeleteResponse, type environment_SsoConnectionsDisableBody as SsoConnectionsDisableBody, type environment_SsoConnectionsDisableResponse as SsoConnectionsDisableResponse, type environment_SsoConnectionsGetQuery as SsoConnectionsGetQuery, type environment_SsoConnectionsGetResponse as SsoConnectionsGetResponse, type environment_SsoConnectionsListQuery as SsoConnectionsListQuery, type environment_SsoConnectionsListResponse as SsoConnectionsListResponse, type environment_SsoConnectionsRequireSsoBody as SsoConnectionsRequireSsoBody, type environment_SsoConnectionsRequireSsoResponse as SsoConnectionsRequireSsoResponse, type environment_SsoConnectionsUpdateBody as SsoConnectionsUpdateBody, type environment_SsoConnectionsUpdateResponse as SsoConnectionsUpdateResponse, type environment_SsoDomain as SsoDomain, type environment_SsoDomainsCaptureBody as SsoDomainsCaptureBody, type environment_SsoDomainsCaptureResponse as SsoDomainsCaptureResponse, type environment_SsoDomainsCreateBody as SsoDomainsCreateBody, type environment_SsoDomainsCreateResponse as SsoDomainsCreateResponse, type environment_SsoDomainsDeleteBody as SsoDomainsDeleteBody, type environment_SsoDomainsDeleteResponse as SsoDomainsDeleteResponse, type environment_SsoDomainsListQuery as SsoDomainsListQuery, type environment_SsoDomainsListResponse as SsoDomainsListResponse, type environment_SsoDomainsVerifyBody as SsoDomainsVerifyBody, type environment_SsoDomainsVerifyResponse as SsoDomainsVerifyResponse, type environment_SsoSamlMetadataImportBody as SsoSamlMetadataImportBody, type environment_SsoSamlMetadataImportResponse as SsoSamlMetadataImportResponse, type environment_SupportSession as SupportSession, type environment_SupportSessionsEndResponse as SupportSessionsEndResponse, type environment_SupportSessionsStartBody as SupportSessionsStartBody, type environment_SupportSessionsStartResponse as SupportSessionsStartResponse, type environment_ThemeMode as ThemeMode, type environment_TokenVaultGrantsCreateBody as TokenVaultGrantsCreateBody, type environment_TokenVaultGrantsCreateResponse as TokenVaultGrantsCreateResponse, type environment_TokenVaultGrantsDeleteBody as TokenVaultGrantsDeleteBody, type environment_TokenVaultGrantsDeleteResponse as TokenVaultGrantsDeleteResponse, type environment_TokenVaultSecret as TokenVaultSecret, type environment_TokenVaultSecretsCreateBody as TokenVaultSecretsCreateBody, type environment_TokenVaultSecretsCreateResponse as TokenVaultSecretsCreateResponse, type environment_TokenVaultSecretsGetQuery as TokenVaultSecretsGetQuery, type environment_TokenVaultSecretsGetResponse as TokenVaultSecretsGetResponse, type environment_TokenVaultSecretsListQuery as TokenVaultSecretsListQuery, type environment_TokenVaultSecretsListResponse as TokenVaultSecretsListResponse, type environment_TokenVaultSecretsRevokeBody as TokenVaultSecretsRevokeBody, type environment_TokenVaultSecretsRevokeResponse as TokenVaultSecretsRevokeResponse, type environment_TokenVaultSecretsRotateBody as TokenVaultSecretsRotateBody, type environment_TokenVaultSecretsRotateResponse as TokenVaultSecretsRotateResponse, type environment_User as User, type environment_UserSession as UserSession, type environment_UsersCreateBody as UsersCreateBody, type environment_UsersCreateResponse as UsersCreateResponse, type environment_UsersDeactivateResponse as UsersDeactivateResponse, type environment_UsersEnvironmentRolesGetQuery as UsersEnvironmentRolesGetQuery, type environment_UsersEnvironmentRolesGetResponse as UsersEnvironmentRolesGetResponse, type environment_UsersEnvironmentRolesGrantQuery as UsersEnvironmentRolesGrantQuery, type environment_UsersEnvironmentRolesGrantResponse as UsersEnvironmentRolesGrantResponse, type environment_UsersEnvironmentRolesListResponse as UsersEnvironmentRolesListResponse, type environment_UsersEnvironmentRolesRevokeQuery as UsersEnvironmentRolesRevokeQuery, type environment_UsersEnvironmentRolesRevokeResponse as UsersEnvironmentRolesRevokeResponse, type environment_UsersEraseResponse as UsersEraseResponse, type environment_UsersGetResponse as UsersGetResponse, type environment_UsersListQuery as UsersListQuery, type environment_UsersListResponse as UsersListResponse, type environment_UsersMfaResetResponse as UsersMfaResetResponse, type environment_UsersMfaSmsRemoveResponse as UsersMfaSmsRemoveResponse, type environment_UsersPasswordResetSendResponse as UsersPasswordResetSendResponse, type environment_UsersPasswordSetBody as UsersPasswordSetBody, type environment_UsersPasswordSetResponse as UsersPasswordSetResponse, type environment_UsersReactivateResponse as UsersReactivateResponse, type environment_UsersSessionsListResponse as UsersSessionsListResponse, type environment_UsersSessionsRevokeAllResponse as UsersSessionsRevokeAllResponse, type environment_UsersSessionsRevokeResponse as UsersSessionsRevokeResponse, type environment_UsersUpdateBody as UsersUpdateBody, type environment_UsersUpdateResponse as UsersUpdateResponse, type environment_UsersVerificationSendResponse as UsersVerificationSendResponse, type environment_UsersVerifyResponse as UsersVerifyResponse, type environment_VaultSecret as VaultSecret, type environment_Webhook as Webhook, type environment_WebhooksCreateBody as WebhooksCreateBody, type environment_WebhooksCreateResponse as WebhooksCreateResponse, type environment_WebhooksDeleteResponse as WebhooksDeleteResponse, type environment_WebhooksGetResponse as WebhooksGetResponse, type environment_WebhooksListQuery as WebhooksListQuery, type environment_WebhooksListResponse as WebhooksListResponse, type environment_WebhooksPauseResponse as WebhooksPauseResponse, type environment_WebhooksResumeResponse as WebhooksResumeResponse, type environment_WebhooksSecretRotateResponse as WebhooksSecretRotateResponse, type environment_WebhooksSignatureSchemeChangeBody as WebhooksSignatureSchemeChangeBody, type environment_WebhooksSignatureSchemeChangeResponse as WebhooksSignatureSchemeChangeResponse, type environment_WebhooksUpdateBody as WebhooksUpdateBody, type environment_WebhooksUpdateResponse as WebhooksUpdateResponse, type environment_WhitelabelBranding as WhitelabelBranding, environment_environmentOperations as environmentOperations };
 }
 
 interface VerificationResend {
@@ -10387,10 +12830,14 @@ type ApiKeysRevokeResponse = void;
 type ApplicationsRevokeResponse = void;
 /** Response body of `devices.remove`. */
 type DevicesRemoveResponse = void;
+/** Response body of `mfa.sms.remove`. */
+type MfaSmsRemoveResponse = void;
 /** Response body of `organizations.leave`. */
 type OrganizationsLeaveResponse = void;
 /** Response body of `passkeys.remove`. */
 type PasskeysRemoveResponse = void;
+/** Response body of `pipes.disconnect`. */
+type PipesDisconnectResponse = void;
 /** Request body of `profile.update`. */
 interface ProfileUpdateBody {
     /** Your display name. */
@@ -10470,6 +12917,18 @@ declare const accountOperations: {
         readonly body: false;
         readonly pagination: null;
     };
+    readonly 'account.mfa.sms.remove': {
+        readonly action: "account.mfa.sms.remove";
+        readonly operationId: "account_mfa_sms_remove";
+        readonly method: "DELETE";
+        readonly path: "/me/mfa/sms";
+        readonly pathParams: readonly [];
+        readonly scope: "account:sign_in:write";
+        readonly danger: "critical";
+        readonly approval: true;
+        readonly body: false;
+        readonly pagination: null;
+    };
     readonly 'account.organizations.leave': {
         readonly action: "account.organizations.leave";
         readonly operationId: "account_organizations_leave";
@@ -10494,6 +12953,18 @@ declare const accountOperations: {
         readonly body: false;
         readonly pagination: null;
     };
+    readonly 'account.pipes.disconnect': {
+        readonly action: "account.pipes.disconnect";
+        readonly operationId: "account_pipes_disconnect";
+        readonly method: "DELETE";
+        readonly path: "/me/pipes/{provider}";
+        readonly pathParams: readonly ["provider"];
+        readonly scope: "account:pipes:write";
+        readonly danger: "destructive";
+        readonly approval: true;
+        readonly body: false;
+        readonly pagination: null;
+    };
     readonly 'account.profile.update': {
         readonly action: "account.profile.update";
         readonly operationId: "account_profile_update";
@@ -10625,6 +13096,21 @@ declare class AccountClient {
          */
         remove: <O extends CallOptions = CallOptions>(deviceId: string, options?: O) => Promise<Outcome<DevicesRemoveResponse, O>>;
     };
+    readonly mfa: {
+        sms: {
+            /**
+             * Remove your phone number for text-message sign-in codes.
+             *
+             * Requires scope `account:sign_in:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: critical.
+             *
+             * `DELETE /me/mfa/sms` · action `account.mfa.sms.remove`
+             * @scope `account:sign_in:write`
+             * @danger critical
+             * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+             */
+            remove: <O extends CallOptions = CallOptions>(options?: O) => Promise<Outcome<MfaSmsRemoveResponse, O>>;
+        };
+    };
     readonly organizations: {
         /**
          * Leave one of your own organizations. The last owner cannot leave — transfer ownership first.
@@ -10651,6 +13137,19 @@ declare class AccountClient {
          */
         remove: <O extends CallOptions = CallOptions>(passkeyId: string, options?: O) => Promise<Outcome<PasskeysRemoveResponse, O>>;
     };
+    readonly pipes: {
+        /**
+         * Disconnect one of your connected services, revoking the access you gave it.
+         *
+         * Requires scope `account:pipes:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: destructive.
+         *
+         * `DELETE /me/pipes/{provider}` · action `account.pipes.disconnect`
+         * @scope `account:pipes:write`
+         * @danger destructive
+         * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+         */
+        disconnect: <O extends CallOptions = CallOptions>(provider: string, options?: O) => Promise<Outcome<PipesDisconnectResponse, O>>;
+    };
     readonly profile: {
         /**
          * Change the display name on your own account.
@@ -10713,9 +13212,11 @@ type account_ApiKeysRevokeResponse = ApiKeysRevokeResponse;
 type account_ApplicationsRevokeResponse = ApplicationsRevokeResponse;
 type account_DevicesRemoveResponse = DevicesRemoveResponse;
 type account_ErrorSchema = ErrorSchema;
+type account_MfaSmsRemoveResponse = MfaSmsRemoveResponse;
 type account_OrganizationsLeaveResponse = OrganizationsLeaveResponse;
 type account_PasskeysRemoveResponse = PasskeysRemoveResponse;
 type account_PersonalApiKey = PersonalApiKey;
+type account_PipesDisconnectResponse = PipesDisconnectResponse;
 type account_Profile = Profile;
 type account_ProfileUpdateBody = ProfileUpdateBody;
 type account_ProfileUpdateResponse = ProfileUpdateResponse;
@@ -10725,7 +13226,7 @@ type account_SessionsRevoked = SessionsRevoked;
 type account_SocialUnlinkResponse = SocialUnlinkResponse;
 declare const account_accountOperations: typeof accountOperations;
 declare namespace account {
-  export { account_AccountClient as AccountClient, type account_AccountClientOptions as AccountClientOptions, type account_ActionApprovalsGetResponse as ActionApprovalsGetResponse, type account_ApiKeysCreateBody as ApiKeysCreateBody, type account_ApiKeysCreateResponse as ApiKeysCreateResponse, type account_ApiKeysRevokeResponse as ApiKeysRevokeResponse, type account_ApplicationsRevokeResponse as ApplicationsRevokeResponse, type account_DevicesRemoveResponse as DevicesRemoveResponse, type account_ErrorSchema as ErrorSchema, type account_OrganizationsLeaveResponse as OrganizationsLeaveResponse, type account_PasskeysRemoveResponse as PasskeysRemoveResponse, type account_PersonalApiKey as PersonalApiKey, type account_Profile as Profile, type account_ProfileUpdateBody as ProfileUpdateBody, type account_ProfileUpdateResponse as ProfileUpdateResponse, type account_SessionsRevokeOthersResponse as SessionsRevokeOthersResponse, type account_SessionsRevokeResponse as SessionsRevokeResponse, type account_SessionsRevoked as SessionsRevoked, type account_SocialUnlinkResponse as SocialUnlinkResponse, account_accountOperations as accountOperations };
+  export { account_AccountClient as AccountClient, type account_AccountClientOptions as AccountClientOptions, type account_ActionApprovalsGetResponse as ActionApprovalsGetResponse, type account_ApiKeysCreateBody as ApiKeysCreateBody, type account_ApiKeysCreateResponse as ApiKeysCreateResponse, type account_ApiKeysRevokeResponse as ApiKeysRevokeResponse, type account_ApplicationsRevokeResponse as ApplicationsRevokeResponse, type account_DevicesRemoveResponse as DevicesRemoveResponse, type account_ErrorSchema as ErrorSchema, type account_MfaSmsRemoveResponse as MfaSmsRemoveResponse, type account_OrganizationsLeaveResponse as OrganizationsLeaveResponse, type account_PasskeysRemoveResponse as PasskeysRemoveResponse, type account_PersonalApiKey as PersonalApiKey, type account_PipesDisconnectResponse as PipesDisconnectResponse, type account_Profile as Profile, type account_ProfileUpdateBody as ProfileUpdateBody, type account_ProfileUpdateResponse as ProfileUpdateResponse, type account_SessionsRevokeOthersResponse as SessionsRevokeOthersResponse, type account_SessionsRevokeResponse as SessionsRevokeResponse, type account_SessionsRevoked as SessionsRevoked, type account_SocialUnlinkResponse as SocialUnlinkResponse, account_accountOperations as accountOperations };
 }
 
 /**
@@ -10920,4 +13421,34 @@ declare function verifyAuditLogChain(client: EnvironmentClient, query: {
     limit?: number;
 }, options?: VerifyAuditChainOptions): Promise<AuditChainVerification>;
 
-export { AUDIT_CHAIN_GENESIS, account as AccountApi, AccountClient, type AccountClientOptions, type ApiResponse, type ApprovalContext, ApprovalDeniedError, ApprovalError, ApprovalExpiredError, type AuditChainVerification, type AuditEventHashInput, type AuditLogEventInput, AuditLogExportError, type AuditLogExportOptions, type AuditLogRecord, AuditLogger, type AuditLoggerOptions, type CallOptions, CboxIdApiError, CboxIdError, type CursorPageMeta, type DPoPSigner, type Danger, environment as EnvironmentApi, EnvironmentClient, type EnvironmentClientOptions, MAX_AUDIT_BATCH, type ManagementClientOptions, ManagementNetworkError, ManagementTransport, type NumberedPageMeta, type OperationSpec, type Outcome, type Pagination, type PendingApproval, type PendingApprovalResult, type Plane, platform as PlatformApi, PlatformClient, type PlatformClientOptions, type RetryOptions, type VerifyAuditChainOptions, workspace as WorkspaceApi, WorkspaceClient, type WorkspaceClientOptions, accountOperations, auditEventDocument, auditEventHash, canonicalJson, createDPoPSigner, environmentOperations, exportAuditLogs, generateDPoPKeyPair, platformOperations, retryAfterMs, verifyAuditChain, verifyAuditLogChain, workspaceOperations };
+/**
+ * Fine-grained authorization helpers for `env.fga.*`.
+ *
+ * The batch check (`env.fga.checkBatch({ checks })`) takes each check in the tuple notation
+ * — `document:readme#viewer@user:alice`, or `folder:policies#viewer@group:eng#member` for a
+ * userset. {@link fgaTuple} writes that notation from the same object `env.fga.tuples.write`
+ * takes, so a page that writes tuples and checks them speaks one shape.
+ */
+/** A subject: one user (`{ type: 'user', id: 'alice' }`) or a userset (`relation: 'member'`). */
+interface FgaSubjectRef {
+    type: string;
+    id: string;
+    relation?: string | null;
+}
+/** One relationship: `resource_type:resource_id#relation@subject`. */
+interface FgaTupleRef {
+    resource_type: string;
+    resource_id: string;
+    relation: string;
+    subject: FgaSubjectRef;
+}
+/**
+ * Write a tuple in the notation the batch check and the console use:
+ * `document:readme#viewer@user:alice`, `folder:policies#viewer@group:eng#member`.
+ *
+ * Refuses a part that contains `#`, `@`, `:` (in a type or relation) or whitespace — the
+ * notation has no escaping, so such a part would be read back as a different tuple.
+ */
+declare function fgaTuple(tuple: FgaTupleRef): string;
+
+export { AUDIT_CHAIN_GENESIS, account as AccountApi, AccountClient, type AccountClientOptions, type ApiResponse, type ApprovalContext, ApprovalDeniedError, ApprovalError, ApprovalExpiredError, type AuditChainVerification, type AuditEventHashInput, type AuditLogEventInput, AuditLogExportError, type AuditLogExportOptions, type AuditLogRecord, AuditLogger, type AuditLoggerOptions, type CallOptions, CboxIdApiError, CboxIdError, type CursorPageMeta, type DPoPSigner, type Danger, environment as EnvironmentApi, EnvironmentClient, type EnvironmentClientOptions, type FgaSubjectRef, type FgaTupleRef, MAX_AUDIT_BATCH, type ManagementClientOptions, ManagementNetworkError, ManagementTransport, type NumberedPageMeta, type OperationSpec, type Outcome, type Pagination, type PendingApproval, type PendingApprovalResult, type Plane, platform as PlatformApi, PlatformClient, type PlatformClientOptions, type RetryOptions, type VerifyAuditChainOptions, workspace as WorkspaceApi, WorkspaceClient, type WorkspaceClientOptions, accountOperations, auditEventDocument, auditEventHash, canonicalJson, createDPoPSigner, environmentOperations, exportAuditLogs, fgaTuple, generateDPoPKeyPair, platformOperations, retryAfterMs, verifyAuditChain, verifyAuditLogChain, workspaceOperations };