@cboxdk/id-js 0.18.0 → 0.20.0

package/dist/management.js

@@ -563,6 +563,10 @@ var environmentOperations = {
   "apis.scopes.define": { action: "apis.scopes.define", operationId: "apis_scopes_define", method: "PUT", path: "/apis/{id}/scopes/{key}", pathParams: ["id", "key"], scope: "apis:write", danger: "write", approval: true, body: true, pagination: null },
   "apis.scopes.remove": { action: "apis.scopes.remove", operationId: "apis_scopes_remove", method: "DELETE", path: "/apis/{id}/scopes/{key}", pathParams: ["id", "key"], scope: "apis:write", danger: "destructive", approval: true, body: false, pagination: null },
   "apis.update": { action: "apis.update", operationId: null, method: "PATCH", path: "/apis/{id}", pathParams: ["id"], scope: "apis:write", danger: "write", approval: true, body: true, pagination: null },
+  "app_catalog.delete": { action: "app_catalog.delete", operationId: "app_catalog_delete", method: "DELETE", path: "/app-catalog/{key}", pathParams: ["key"], scope: "app_catalog:write", danger: "destructive", approval: true, body: true, pagination: null },
+  "app_catalog.list": { action: "app_catalog.list", operationId: "app_catalog_list", method: "GET", path: "/app-catalog", pathParams: [], scope: "app_catalog:read", danger: "read", approval: true, body: false, pagination: null },
+  "app_catalog.save": { action: "app_catalog.save", operationId: "app_catalog_save", method: "PUT", path: "/app-catalog/{key}", pathParams: ["key"], scope: "app_catalog:write", danger: "write", approval: true, body: true, pagination: null },
+  "app_catalog.show": { action: "app_catalog.show", operationId: "app_catalog_show", method: "GET", path: "/app-catalog/{key}", pathParams: ["key"], scope: "app_catalog:read", danger: "read", approval: true, body: false, pagination: null },
   "approvals.deny": { action: "approvals.deny", operationId: "approvals_deny", method: "POST", path: "/agent-requests/{request_id}/deny", pathParams: ["request_id"], scope: "approvals:write", danger: "destructive", approval: true, body: false, pagination: null },
   "approvals.list": { action: "approvals.list", operationId: "approvals_list", method: "GET", path: "/agent-requests", pathParams: [], scope: "approvals:read", danger: "read", approval: true, body: false, pagination: "cursor" },
   "apps.blueprint": { action: "apps.blueprint", operationId: "apps_blueprint", method: "GET", path: "/apps/{id}/blueprint", pathParams: ["id"], scope: "apps:read", danger: "read", approval: true, body: false, pagination: null },
@@ -579,6 +583,7 @@ var environmentOperations = {
   "apps.secrets.rotate": { action: "apps.secrets.rotate", operationId: "apps_secrets_rotate", method: "POST", path: "/apps/{id}/secrets", pathParams: ["id"], scope: "apps:write", danger: "critical", approval: true, body: true, pagination: null },
   "apps.settings.api_key_prefix": { action: "apps.settings.api_key_prefix", operationId: "apps_settings_api_key_prefix", method: "PUT", path: "/apps/{id}/settings/api-key-prefix", pathParams: ["id"], scope: "apps:write", danger: "write", approval: true, body: true, pagination: null },
   "apps.settings.backchannel_logout": { action: "apps.settings.backchannel_logout", operationId: "apps_settings_backchannel_logout", method: "PUT", path: "/apps/{id}/settings/backchannel-logout", pathParams: ["id"], scope: "apps:write", danger: "write", approval: true, body: true, pagination: null },
+  "apps.settings.client_credentials": { action: "apps.settings.client_credentials", operationId: "apps_settings_client_credentials", method: "PUT", path: "/apps/{id}/settings/client-credentials", pathParams: ["id"], scope: "apps:write", danger: "write", approval: true, body: true, pagination: null },
   "apps.settings.token_exchange": { action: "apps.settings.token_exchange", operationId: "apps_settings_token_exchange", method: "PUT", path: "/apps/{id}/settings/token-exchange", pathParams: ["id"], scope: "apps:write", danger: "write", approval: true, body: true, pagination: null },
   "apps.settings.token_lifetime": { action: "apps.settings.token_lifetime", operationId: "apps_settings_token_lifetime", method: "PUT", path: "/apps/{id}/settings/token-lifetime", pathParams: ["id"], scope: "apps:write", danger: "write", approval: true, body: true, pagination: null },
   "apps.update": { action: "apps.update", operationId: "apps_update", method: "PATCH", path: "/apps/{id}", pathParams: ["id"], scope: "apps:write", danger: "write", approval: true, body: true, pagination: null },
@@ -595,18 +600,23 @@ var environmentOperations = {
   "audit_logs.settings.update": { action: "audit_logs.settings.update", operationId: "audit_logs_settings_update", method: "PATCH", path: "/audit-logs/settings", pathParams: [], scope: "audit_logs:manage", danger: "destructive", approval: true, body: true, pagination: null },
   "audit_logs.verify": { action: "audit_logs.verify", operationId: "audit_logs_verify", method: "GET", path: "/audit-logs/verify", pathParams: [], scope: "audit_logs:read", danger: "read", approval: true, body: false, pagination: null },
   "audit.list": { action: "audit.list", operationId: "audit_list", method: "GET", path: "/audit-log", pathParams: [], scope: "audit:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "authenticator.me.list": { action: null, operationId: "authenticatorIdentity", method: "GET", path: "/authenticator/me", pathParams: [], scope: null, danger: null, approval: false, body: false, pagination: null },
   "branding.appearance.get": { action: "branding.appearance.get", operationId: "branding_appearance_get", method: "GET", path: "/branding/appearance", pathParams: [], scope: "branding:read", danger: "read", approval: true, body: false, pagination: null },
   "branding.appearance.set": { action: "branding.appearance.set", operationId: "branding_appearance_set", method: "PUT", path: "/branding/appearance", pathParams: [], scope: "branding:write", danger: "write", approval: true, body: true, pagination: null },
   "branding.whitelabel.get": { action: "branding.whitelabel.get", operationId: "branding_whitelabel_get", method: "GET", path: "/branding/whitelabel", pathParams: [], scope: "branding:read", danger: "read", approval: true, body: false, pagination: null },
   "branding.whitelabel.set": { action: "branding.whitelabel.set", operationId: "branding_whitelabel_set", method: "PUT", path: "/branding/whitelabel", pathParams: [], scope: "branding:write", danger: "write", approval: true, body: true, pagination: null },
   "directories.connect": { action: "directories.connect", operationId: "directories_connect", method: "POST", path: "/directories/connect", pathParams: [], scope: "directory_sync:write", danger: "critical", approval: true, body: true, pagination: null },
   "directories.create": { action: "directories.create", operationId: "directories_create", method: "POST", path: "/directories", pathParams: [], scope: "directory_sync:write", danger: "critical", approval: true, body: true, pagination: null },
+  "directories.credentials.replace": { action: "directories.credentials.replace", operationId: "directories_credentials_replace", method: "PUT", path: "/directories/{id}/credentials", pathParams: ["id"], scope: "directory_sync:write", danger: "critical", approval: true, body: true, pagination: null },
   "directories.delete": { action: "directories.delete", operationId: "directories_delete", method: "DELETE", path: "/directories/{id}", pathParams: ["id"], scope: "directory_sync:write", danger: "destructive", approval: true, body: true, pagination: null },
   "directories.get": { action: "directories.get", operationId: "directories_get", method: "GET", path: "/directories/{id}", pathParams: ["id"], scope: "directory_sync:read", danger: "read", approval: true, body: false, pagination: null },
   "directories.groups.list": { action: "directories.groups.list", operationId: "directories_groups_list", method: "GET", path: "/directories/{id}/groups", pathParams: ["id"], scope: "directory_sync:read", danger: "read", approval: true, body: false, pagination: "cursor" },
   "directories.groups.map": { action: "directories.groups.map", operationId: "directories_groups_map", method: "POST", path: "/directories/{id}/group-roles", pathParams: ["id"], scope: "directory_sync:write", danger: "write", approval: true, body: true, pagination: null },
+  "directories.hris.connect": { action: "directories.hris.connect", operationId: "directories_hris_connect", method: "POST", path: "/directories/hris", pathParams: [], scope: "directory_sync:write", danger: "critical", approval: true, body: true, pagination: null },
   "directories.list": { action: "directories.list", operationId: "directories_list", method: "GET", path: "/directories", pathParams: [], scope: "directory_sync:read", danger: "read", approval: true, body: false, pagination: "cursor" },
   "directories.status.set": { action: "directories.status.set", operationId: "directories_status_set", method: "POST", path: "/directories/{id}/status", pathParams: ["id"], scope: "directory_sync:write", danger: "write", approval: true, body: true, pagination: null },
+  "directories.sync": { action: "directories.sync", operationId: "directories_sync", method: "POST", path: "/directories/{id}/sync", pathParams: ["id"], scope: "directory_sync:write", danger: "write", approval: true, body: true, pagination: null },
+  "directories.sync_settings.update": { action: "directories.sync_settings.update", operationId: "directories_sync_settings_update", method: "PATCH", path: "/directories/{id}/sync-settings", pathParams: ["id"], scope: "directory_sync:write", danger: "write", approval: true, body: true, pagination: null },
   "directories.token.rotate": { action: "directories.token.rotate", operationId: "directories_token_rotate", method: "POST", path: "/directories/{id}/rotate", pathParams: ["id"], scope: "directory_sync:write", danger: "critical", approval: true, body: true, pagination: null },
   "directories.update": { action: "directories.update", operationId: "directories_update", method: "PATCH", path: "/directories/{id}", pathParams: ["id"], scope: "directory_sync:write", danger: "write", approval: true, body: true, pagination: null },
   "domains.add": { action: "domains.add", operationId: "domains_add", method: "POST", path: "/domains", pathParams: [], scope: "domains:write", danger: "write", approval: true, body: true, pagination: null },
@@ -614,6 +624,22 @@ var environmentOperations = {
   "domains.remove": { action: "domains.remove", operationId: "domains_remove", method: "DELETE", path: "/domains", pathParams: [], scope: "domains:write", danger: "destructive", approval: true, body: false, pagination: null },
   "domains.verify": { action: "domains.verify", operationId: "domains_verify", method: "POST", path: "/domains/verify", pathParams: [], scope: "domains:write", danger: "write", approval: true, body: false, pagination: null },
   "events.list": { action: "events.list", operationId: "events_list", method: "GET", path: "/events", pathParams: [], scope: "events:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "feature_flags.create": { action: "feature_flags.create", operationId: "feature_flags_create", method: "POST", path: "/feature-flags", pathParams: [], scope: "feature_flags:write", danger: "write", approval: true, body: true, pagination: null },
+  "feature_flags.delete": { action: "feature_flags.delete", operationId: "feature_flags_delete", method: "DELETE", path: "/feature-flags/{id}", pathParams: ["id"], scope: "feature_flags:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "feature_flags.evaluate": { action: "feature_flags.evaluate", operationId: "feature_flags_evaluate", method: "GET", path: "/feature-flags/evaluate", pathParams: [], scope: "feature_flags:read", danger: "read", approval: true, body: false, pagination: null },
+  "feature_flags.get": { action: "feature_flags.get", operationId: "feature_flags_get", method: "GET", path: "/feature-flags/{id}", pathParams: ["id"], scope: "feature_flags:read", danger: "read", approval: true, body: false, pagination: null },
+  "feature_flags.list": { action: "feature_flags.list", operationId: "feature_flags_list", method: "GET", path: "/feature-flags", pathParams: [], scope: "feature_flags:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "feature_flags.update": { action: "feature_flags.update", operationId: "feature_flags_update", method: "PATCH", path: "/feature-flags/{id}", pathParams: ["id"], scope: "feature_flags:write", danger: "write", approval: true, body: true, pagination: null },
+  "fga.check": { action: "fga.check", operationId: "fga_check", method: "GET", path: "/fga/check", pathParams: [], scope: "fga:read", danger: "read", approval: true, body: false, pagination: null },
+  "fga.check_batch": { action: "fga.check_batch", operationId: "fga_check_batch", method: "GET", path: "/fga/check/batch", pathParams: [], scope: "fga:read", danger: "read", approval: true, body: false, pagination: null },
+  "fga.resources.list": { action: "fga.resources.list", operationId: "fga_resources_list", method: "GET", path: "/fga/resources", pathParams: [], scope: "fga:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "fga.schema.get": { action: "fga.schema.get", operationId: "fga_schema_get", method: "GET", path: "/fga/schema", pathParams: [], scope: "fga:read", danger: "read", approval: true, body: false, pagination: null },
+  "fga.schema.update": { action: "fga.schema.update", operationId: "fga_schema_update", method: "PUT", path: "/fga/schema", pathParams: [], scope: "fga:schema", danger: "critical", approval: true, body: true, pagination: null },
+  "fga.schema.validate": { action: "fga.schema.validate", operationId: "fga_schema_validate", method: "GET", path: "/fga/schema/validate", pathParams: [], scope: "fga:read", danger: "read", approval: true, body: false, pagination: null },
+  "fga.subjects.list": { action: "fga.subjects.list", operationId: "fga_subjects_list", method: "GET", path: "/fga/subjects", pathParams: [], scope: "fga:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "fga.tuples.delete": { action: "fga.tuples.delete", operationId: "fga_tuples_delete", method: "POST", path: "/fga/tuples/delete", pathParams: [], scope: "fga:write", danger: "destructive", approval: true, body: true, pagination: null },
+  "fga.tuples.list": { action: "fga.tuples.list", operationId: "fga_tuples_list", method: "GET", path: "/fga/tuples", pathParams: [], scope: "fga:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "fga.tuples.write": { action: "fga.tuples.write", operationId: "fga_tuples_write", method: "POST", path: "/fga/tuples", pathParams: [], scope: "fga:write", danger: "write", approval: true, body: true, pagination: null },
   "frontend_keys.create": { action: "frontend_keys.create", operationId: "frontend_keys_create", method: "POST", path: "/frontend-keys", pathParams: [], scope: "frontend_keys:write", danger: "write", approval: true, body: true, pagination: null },
   "frontend_keys.list": { action: "frontend_keys.list", operationId: "frontend_keys_list", method: "GET", path: "/frontend-keys", pathParams: [], scope: "frontend_keys:read", danger: "read", approval: true, body: false, pagination: "cursor" },
   "frontend_keys.revoke": { action: "frontend_keys.revoke", operationId: "frontend_keys_revoke", method: "DELETE", path: "/frontend-keys/{id}", pathParams: ["id"], scope: "frontend_keys:write", danger: "destructive", approval: true, body: false, pagination: null },
@@ -623,6 +649,7 @@ var environmentOperations = {
   "hooks.get": { action: "hooks.get", operationId: "hooks_get", method: "GET", path: "/hooks/{id}", pathParams: ["id"], scope: "hooks:read", danger: "read", approval: true, body: false, pagination: null },
   "hooks.list": { action: "hooks.list", operationId: "hooks_list", method: "GET", path: "/hooks", pathParams: [], scope: "hooks:read", danger: "read", approval: true, body: false, pagination: "cursor" },
   "hooks.update": { action: "hooks.update", operationId: "hooks_update", method: "PATCH", path: "/hooks/{id}", pathParams: ["id"], scope: "hooks:write", danger: "critical", approval: true, body: true, pagination: null },
+  "invitations.get": { action: "invitations.get", operationId: "invitations_get", method: "GET", path: "/organizations/{organization_id}/invitations/{invitation_id}", pathParams: ["organization_id", "invitation_id"], scope: "invitations:read", danger: "read", approval: true, body: false, pagination: null },
   "invitations.list": { action: "invitations.list", operationId: "invitations_list", method: "GET", path: "/organizations/{organization_id}/invitations", pathParams: ["organization_id"], scope: "invitations:read", danger: "read", approval: true, body: false, pagination: "cursor" },
   "invitations.resend": { action: "invitations.resend", operationId: "invitations_resend", method: "POST", path: "/organizations/{organization_id}/invitations/{invitation_id}/resend", pathParams: ["organization_id", "invitation_id"], scope: "invitations:write", danger: "write", approval: true, body: false, pagination: null },
   "invitations.revoke": { action: "invitations.revoke", operationId: "invitations_revoke", method: "DELETE", path: "/organizations/{organization_id}/invitations/{invitation_id}", pathParams: ["organization_id", "invitation_id"], scope: "invitations:write", danger: "destructive", approval: true, body: false, pagination: null },
@@ -642,6 +669,7 @@ var environmentOperations = {
   "log_streams.test": { action: "log_streams.test", operationId: "log_streams_test", method: "POST", path: "/log-streams/{id}/test", pathParams: ["id"], scope: "log_streams:write", danger: "write", approval: true, body: false, pagination: null },
   "log_streams.update": { action: "log_streams.update", operationId: "log_streams_update", method: "PATCH", path: "/log-streams/{id}", pathParams: ["id"], scope: "log_streams:write", danger: "critical", approval: true, body: true, pagination: null },
   "members.add": { action: "members.add", operationId: "members_add", method: "POST", path: "/organizations/{organization_id}/members", pathParams: ["organization_id"], scope: "members:write", danger: "write", approval: true, body: true, pagination: null },
+  "members.apps.roles.replace": { action: "members.apps.roles.replace", operationId: "members_apps_roles_replace", method: "PUT", path: "/organizations/{organization_id}/members/{user_id}/apps/{client_id}/roles", pathParams: ["organization_id", "user_id", "client_id"], scope: "roles:write", danger: "write", approval: true, body: true, pagination: null },
   "members.list": { action: "members.list", operationId: "members_list", method: "GET", path: "/organizations/{organization_id}/members", pathParams: ["organization_id"], scope: "members:read", danger: "read", approval: true, body: false, pagination: "cursor" },
   "members.remove": { action: "members.remove", operationId: "members_remove", method: "DELETE", path: "/organizations/{organization_id}/members/{user_id}", pathParams: ["organization_id", "user_id"], scope: "members:write", danger: "destructive", approval: true, body: false, pagination: null },
   "members.roles.grant": { action: "members.roles.grant", operationId: "members_roles_grant", method: "PUT", path: "/organizations/{organization_id}/members/{user_id}/roles/{role_id}", pathParams: ["organization_id", "user_id", "role_id"], scope: "roles:write", danger: "write", approval: true, body: false, pagination: null },
@@ -668,12 +696,36 @@ var environmentOperations = {
   "permissions.delete": { action: "permissions.delete", operationId: "permissions_delete", method: "DELETE", path: "/permissions/{id}", pathParams: ["id"], scope: "role_definitions:write", danger: "destructive", approval: true, body: false, pagination: null },
   "permissions.list": { action: "permissions.list", operationId: "permissions_list", method: "GET", path: "/permissions", pathParams: [], scope: "roles:read", danger: "read", approval: true, body: false, pagination: "cursor" },
   "permissions.update": { action: "permissions.update", operationId: "permissions_update", method: "PATCH", path: "/permissions/{id}", pathParams: ["id"], scope: "role_definitions:write", danger: "write", approval: true, body: true, pagination: null },
+  "pipes.connections.delete": { action: "pipes.connections.delete", operationId: "pipes_connections_delete", method: "DELETE", path: "/pipes/{id}/connections/{connection_id}", pathParams: ["id", "connection_id"], scope: "pipes:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "pipes.connections.list": { action: "pipes.connections.list", operationId: "pipes_connections_list", method: "GET", path: "/pipes/{id}/connections", pathParams: ["id"], scope: "pipes:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "pipes.create": { action: "pipes.create", operationId: "pipes_create", method: "POST", path: "/pipes", pathParams: [], scope: "pipes:write", danger: "write", approval: true, body: true, pagination: null },
+  "pipes.delete": { action: "pipes.delete", operationId: "pipes_delete", method: "DELETE", path: "/pipes/{id}", pathParams: ["id"], scope: "pipes:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "pipes.get": { action: "pipes.get", operationId: "pipes_get", method: "GET", path: "/pipes/{id}", pathParams: ["id"], scope: "pipes:read", danger: "read", approval: true, body: false, pagination: null },
+  "pipes.grants.create": { action: "pipes.grants.create", operationId: "pipes_grants_create", method: "POST", path: "/pipes/{id}/grants", pathParams: ["id"], scope: "pipes:write", danger: "critical", approval: true, body: true, pagination: null },
+  "pipes.grants.delete": { action: "pipes.grants.delete", operationId: "pipes_grants_delete", method: "DELETE", path: "/pipes/{id}/grants/{client_id}", pathParams: ["id", "client_id"], scope: "pipes:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "pipes.list": { action: "pipes.list", operationId: "pipes_list", method: "GET", path: "/pipes", pathParams: [], scope: "pipes:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "pipes.update": { action: "pipes.update", operationId: "pipes_update", method: "PATCH", path: "/pipes/{id}", pathParams: ["id"], scope: "pipes:write", danger: "write", approval: true, body: true, pagination: null },
   "provisioning.targets.create": { action: "provisioning.targets.create", operationId: "provisioning_targets_create", method: "POST", path: "/provisioning-targets", pathParams: [], scope: "provisioning:write", danger: "critical", approval: true, body: true, pagination: null },
   "provisioning.targets.delete": { action: "provisioning.targets.delete", operationId: "provisioning_targets_delete", method: "DELETE", path: "/provisioning-targets/{id}", pathParams: ["id"], scope: "provisioning:write", danger: "destructive", approval: true, body: true, pagination: null },
   "provisioning.targets.get": { action: "provisioning.targets.get", operationId: "provisioning_targets_get", method: "GET", path: "/provisioning-targets/{id}", pathParams: ["id"], scope: "provisioning:read", danger: "read", approval: true, body: false, pagination: null },
   "provisioning.targets.list": { action: "provisioning.targets.list", operationId: "provisioning_targets_list", method: "GET", path: "/provisioning-targets", pathParams: [], scope: "provisioning:read", danger: "read", approval: true, body: false, pagination: "cursor" },
   "provisioning.targets.status.set": { action: "provisioning.targets.status.set", operationId: "provisioning_targets_status_set", method: "POST", path: "/provisioning-targets/{id}/status", pathParams: ["id"], scope: "provisioning:write", danger: "write", approval: true, body: true, pagination: null },
+  "radar.decisions.get": { action: "radar.decisions.get", operationId: "radar_decisions_get", method: "GET", path: "/radar/decisions/{id}", pathParams: ["id"], scope: "radar:read", danger: "read", approval: true, body: false, pagination: null },
+  "radar.decisions.list": { action: "radar.decisions.list", operationId: "radar_decisions_list", method: "GET", path: "/radar/decisions", pathParams: [], scope: "radar:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "radar.lists.add": { action: "radar.lists.add", operationId: "radar_lists_add", method: "POST", path: "/radar/lists", pathParams: [], scope: "radar:write", danger: "write", approval: true, body: true, pagination: null },
+  "radar.lists.list": { action: "radar.lists.list", operationId: "radar_lists_list", method: "GET", path: "/radar/lists", pathParams: [], scope: "radar:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "radar.lists.remove": { action: "radar.lists.remove", operationId: "radar_lists_remove", method: "DELETE", path: "/radar/lists/{id}", pathParams: ["id"], scope: "radar:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "radar.mode.set": { action: "radar.mode.set", operationId: "radar_mode_set", method: "PUT", path: "/radar/mode", pathParams: [], scope: "radar:manage", danger: "critical", approval: true, body: true, pagination: null },
+  "radar.rules.create": { action: "radar.rules.create", operationId: "radar_rules_create", method: "POST", path: "/radar/rules", pathParams: [], scope: "radar:write", danger: "write", approval: true, body: true, pagination: null },
+  "radar.rules.delete": { action: "radar.rules.delete", operationId: "radar_rules_delete", method: "DELETE", path: "/radar/rules/{id}", pathParams: ["id"], scope: "radar:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "radar.rules.get": { action: "radar.rules.get", operationId: "radar_rules_get", method: "GET", path: "/radar/rules/{id}", pathParams: ["id"], scope: "radar:read", danger: "read", approval: true, body: false, pagination: null },
+  "radar.rules.list": { action: "radar.rules.list", operationId: "radar_rules_list", method: "GET", path: "/radar/rules", pathParams: [], scope: "radar:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "radar.rules.reorder": { action: "radar.rules.reorder", operationId: "radar_rules_reorder", method: "PUT", path: "/radar/rules/order", pathParams: [], scope: "radar:write", danger: "write", approval: true, body: true, pagination: null },
+  "radar.rules.update": { action: "radar.rules.update", operationId: "radar_rules_update", method: "PATCH", path: "/radar/rules/{id}", pathParams: ["id"], scope: "radar:write", danger: "write", approval: true, body: true, pagination: null },
+  "radar.settings.get": { action: "radar.settings.get", operationId: "radar_settings_get", method: "GET", path: "/radar/settings", pathParams: [], scope: "radar:read", danger: "read", approval: true, body: false, pagination: null },
+  "radar.settings.update": { action: "radar.settings.update", operationId: "radar_settings_update", method: "PATCH", path: "/radar/settings", pathParams: [], scope: "radar:write", danger: "write", approval: true, body: true, pagination: null },
   "roles.create": { action: "roles.create", operationId: "roles_create", method: "POST", path: "/roles", pathParams: [], scope: "role_definitions:write", danger: "write", approval: true, body: true, pagination: null },
+  "roles.definition.activate": { action: "roles.definition.activate", operationId: "roles_definition_activate", method: "POST", path: "/roles/{id}/definition/activate", pathParams: ["id"], scope: "role_definitions:write", danger: "destructive", approval: true, body: true, pagination: null },
   "roles.delete": { action: "roles.delete", operationId: "roles_delete", method: "DELETE", path: "/roles/{id}", pathParams: ["id"], scope: "role_definitions:write", danger: "destructive", approval: true, body: false, pagination: null },
   "roles.get": { action: "roles.get", operationId: "roles_get", method: "GET", path: "/roles/{id}", pathParams: ["id"], scope: "roles:read", danger: "read", approval: true, body: false, pagination: null },
   "roles.list": { action: "roles.list", operationId: "roles_list", method: "GET", path: "/roles", pathParams: [], scope: "roles:read", danger: "read", approval: true, body: false, pagination: null },
@@ -685,13 +737,22 @@ var environmentOperations = {
   "saml_apps.get": { action: "saml_apps.get", operationId: "saml_apps_get", method: "GET", path: "/saml-apps/{id}", pathParams: ["id"], scope: "saml_apps:read", danger: "read", approval: true, body: false, pagination: null },
   "saml_apps.list": { action: "saml_apps.list", operationId: "saml_apps_list", method: "GET", path: "/saml-apps", pathParams: [], scope: "saml_apps:read", danger: "read", approval: true, body: false, pagination: "cursor" },
   "saml_apps.update": { action: "saml_apps.update", operationId: "saml_apps_update", method: "PATCH", path: "/saml-apps/{id}", pathParams: ["id"], scope: "saml_apps:write", danger: "critical", approval: true, body: true, pagination: null },
+  "signals.source.erasures.list": { action: null, operationId: "signals_source_erasures", method: "GET", path: "/signals/source/erasures", pathParams: [], scope: null, danger: null, approval: false, body: false, pagination: "cursor" },
+  "signals.source.list": { action: null, operationId: "signals_source_list", method: "GET", path: "/signals/source", pathParams: [], scope: null, danger: null, approval: false, body: false, pagination: "cursor" },
   "signin.policy.get": { action: "signin.policy.get", operationId: "signin_policy_get", method: "GET", path: "/sign-in/policy", pathParams: [], scope: "signin:read", danger: "read", approval: true, body: false, pagination: null },
   "signin.policy.inherit": { action: "signin.policy.inherit", operationId: "signin_policy_inherit", method: "DELETE", path: "/sign-in/policy/organizations/{organization_id}", pathParams: ["organization_id"], scope: "signin:write", danger: "critical", approval: true, body: false, pagination: null },
   "signin.policy.update": { action: "signin.policy.update", operationId: "signin_policy_update", method: "PATCH", path: "/sign-in/policy", pathParams: [], scope: "signin:write", danger: "critical", approval: true, body: true, pagination: null },
   "signin.self_service_signup.set": { action: "signin.self_service_signup.set", operationId: "signin_self_service_signup_set", method: "PUT", path: "/sign-in/self-service-signup", pathParams: [], scope: "signin:write", danger: "critical", approval: true, body: true, pagination: null },
+  "signin.sms.get": { action: "signin.sms.get", operationId: "signin_sms_get", method: "GET", path: "/sign-in/sms", pathParams: [], scope: "signin:read", danger: "read", approval: true, body: false, pagination: null },
+  "signin.sms.update": { action: "signin.sms.update", operationId: "signin_sms_update", method: "PATCH", path: "/sign-in/sms", pathParams: [], scope: "signin:write", danger: "critical", approval: true, body: true, pagination: null },
   "signin.social.delete": { action: "signin.social.delete", operationId: "signin_social_delete", method: "DELETE", path: "/sign-in/social-providers/{id}", pathParams: ["id"], scope: "signin:write", danger: "critical", approval: true, body: true, pagination: null },
+  "signin.social.disable": { action: "signin.social.disable", operationId: "signin_social_disable", method: "POST", path: "/sign-in/social-providers/{id}/disable", pathParams: ["id"], scope: "signin:write", danger: "critical", approval: true, body: true, pagination: null },
+  "signin.social.enable": { action: "signin.social.enable", operationId: "signin_social_enable", method: "POST", path: "/sign-in/social-providers/{id}/enable", pathParams: ["id"], scope: "signin:write", danger: "write", approval: true, body: true, pagination: null },
+  "signin.social.inherit": { action: "signin.social.inherit", operationId: "signin_social_inherit", method: "PUT", path: "/sign-in/social-providers/inherited/{provider}", pathParams: ["provider"], scope: "signin:write", danger: "write", approval: true, body: true, pagination: null },
   "signin.social.list": { action: "signin.social.list", operationId: "signin_social_list", method: "GET", path: "/sign-in/social-providers", pathParams: [], scope: "signin:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "signin.social.offered": { action: "signin.social.offered", operationId: "signin_social_offered", method: "GET", path: "/sign-in/social-providers/offered", pathParams: [], scope: "signin:read", danger: "read", approval: true, body: false, pagination: null },
   "signin.social.set": { action: "signin.social.set", operationId: "signin_social_set", method: "POST", path: "/sign-in/social-providers", pathParams: [], scope: "signin:write", danger: "critical", approval: true, body: true, pagination: null },
+  "signin.social.update": { action: "signin.social.update", operationId: "signin_social_update", method: "PATCH", path: "/sign-in/social-providers/{id}", pathParams: ["id"], scope: "signin:write", danger: "critical", approval: true, body: true, pagination: null },
   "sod_policies.create": { action: "sod_policies.create", operationId: "sod_policies_create", method: "POST", path: "/sod-policies", pathParams: [], scope: "governance:write", danger: "write", approval: true, body: true, pagination: null },
   "sod_policies.delete": { action: "sod_policies.delete", operationId: "sod_policies_delete", method: "DELETE", path: "/sod-policies/{id}", pathParams: ["id"], scope: "governance:write", danger: "critical", approval: true, body: true, pagination: null },
   "sod_policies.get": { action: "sod_policies.get", operationId: "sod_policies_get", method: "GET", path: "/sod-policies/{id}", pathParams: ["id"], scope: "governance:read", danger: "read", approval: true, body: false, pagination: null },
@@ -723,6 +784,8 @@ var environmentOperations = {
   "token_vault.secrets.list": { action: "token_vault.secrets.list", operationId: "token_vault_secrets_list", method: "GET", path: "/token-vault/secrets", pathParams: [], scope: "token_vault:read", danger: "read", approval: true, body: false, pagination: "cursor" },
   "token_vault.secrets.revoke": { action: "token_vault.secrets.revoke", operationId: "token_vault_secrets_revoke", method: "POST", path: "/token-vault/secrets/{id}/revoke", pathParams: ["id"], scope: "token_vault:write", danger: "destructive", approval: true, body: true, pagination: null },
   "token_vault.secrets.rotate": { action: "token_vault.secrets.rotate", operationId: "token_vault_secrets_rotate", method: "POST", path: "/token-vault/secrets/{id}/rotate", pathParams: ["id"], scope: "token_vault:write", danger: "critical", approval: true, body: true, pagination: null },
+  "user_property_namespaces.configure": { action: "user_property_namespaces.configure", operationId: "user_property_namespaces_configure", method: "PUT", path: "/user-property-namespaces/{name}", pathParams: ["name"], scope: "user_property_namespaces:write", danger: "critical", approval: true, body: true, pagination: null },
+  "user_property_namespaces.show": { action: "user_property_namespaces.show", operationId: "user_property_namespaces_show", method: "GET", path: "/user-property-namespaces/{name}", pathParams: ["name"], scope: "user_property_namespaces:read", danger: "read", approval: true, body: false, pagination: null },
   "users.create": { action: "users.create", operationId: "users_create", method: "POST", path: "/users", pathParams: [], scope: "users:write", danger: "write", approval: true, body: true, pagination: null },
   "users.deactivate": { action: "users.deactivate", operationId: "users_deactivate", method: "DELETE", path: "/users/{id}", pathParams: ["id"], scope: "users:write", danger: "destructive", approval: true, body: false, pagination: null },
   "users.environment_roles.get": { action: "users.environment_roles.get", operationId: "users_environment_roles_get", method: "GET", path: "/users/{id}/environment-roles/{role_id}", pathParams: ["id", "role_id"], scope: "roles:read", danger: "read", approval: true, body: false, pagination: null },
@@ -733,6 +796,7 @@ var environmentOperations = {
   "users.get": { action: "users.get", operationId: "users_get", method: "GET", path: "/users/{id}", pathParams: ["id"], scope: "users:read", danger: "read", approval: true, body: false, pagination: null },
   "users.list": { action: "users.list", operationId: "users_list", method: "GET", path: "/users", pathParams: [], scope: "users:read", danger: "read", approval: true, body: false, pagination: "cursor" },
   "users.mfa.reset": { action: "users.mfa.reset", operationId: "users_mfa_reset", method: "DELETE", path: "/users/{id}/mfa", pathParams: ["id"], scope: "users:write", danger: "critical", approval: true, body: false, pagination: null },
+  "users.mfa.sms.remove": { action: "users.mfa.sms.remove", operationId: "users_mfa_sms_remove", method: "DELETE", path: "/users/{id}/mfa/sms", pathParams: ["id"], scope: "users:write", danger: "critical", approval: true, body: false, pagination: null },
   "users.password_reset.send": { action: "users.password_reset.send", operationId: "users_password_reset_send", method: "POST", path: "/users/{id}/password-reset", pathParams: ["id"], scope: "users:write", danger: "write", approval: true, body: false, pagination: null },
   "users.password.set": { action: "users.password.set", operationId: "users_password_set", method: "POST", path: "/users/{id}/password", pathParams: ["id"], scope: "users:write", danger: "critical", approval: true, body: true, pagination: null },
   "users.reactivate": { action: "users.reactivate", operationId: "users_reactivate", method: "POST", path: "/users/{id}/reactivate", pathParams: ["id"], scope: "users:write", danger: "write", approval: true, body: false, pagination: null },
@@ -968,6 +1032,52 @@ var EnvironmentClient = class {
       remove: (id, key, options) => this.transport.call(environmentOperations["apis.scopes.remove"], [id, key], void 0, options)
     }
   };
+  appCatalog = {
+    /**
+     * Remove a catalog app without deleting its OAuth clients or user data.
+     *
+     * Requires scope `app_catalog:write`. Danger: destructive.
+     *
+     * `DELETE /app-catalog/{key}` · action `app_catalog.delete`
+     * @scope `app_catalog:write`
+     * @danger destructive
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    delete: (key, body, options) => this.transport.call(environmentOperations["app_catalog.delete"], [key], body, options),
+    /**
+     * List catalog apps, including drafts and visibility settings.
+     *
+     * Requires scope `app_catalog:read`. Danger: read.
+     *
+     * `GET /app-catalog` · action `app_catalog.list`
+     * @scope `app_catalog:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    list: (options) => this.transport.call(environmentOperations["app_catalog.list"], [], void 0, options),
+    /**
+     * Create or replace a catalog app, its icon and visibility. Version zero creates; a stale version conflicts.
+     *
+     * Requires scope `app_catalog:write`. Danger: write.
+     *
+     * `PUT /app-catalog/{key}` · action `app_catalog.save`
+     * @scope `app_catalog:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    save: (key, body, options) => this.transport.call(environmentOperations["app_catalog.save"], [key], body, options),
+    /**
+     * Read a catalog app and its publication settings.
+     *
+     * Requires scope `app_catalog:read`. Danger: read.
+     *
+     * `GET /app-catalog/{key}` · action `app_catalog.show`
+     * @scope `app_catalog:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    show: (key, options) => this.transport.call(environmentOperations["app_catalog.show"], [key], void 0, options)
+  };
   approvals = {
     /**
      * Deny a pending approval request (CIBA) for the person it was raised for: the agent gets access_denied and no token.
@@ -1191,6 +1301,17 @@ var EnvironmentClient = class {
        * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
        */
       backchannelLogout: (id, body, options) => this.transport.call(environmentOperations["apps.settings.backchannel_logout"], [id], body, options),
+      /**
+       * Turn client-credentials authentication on or off for a confidential app; other grants and scopes stay unchanged.
+       *
+       * Requires scope `apps:write`. Danger: write.
+       *
+       * `PUT /apps/{id}/settings/client-credentials` · action `apps.settings.client_credentials`
+       * @scope `apps:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      clientCredentials: (id, body, options) => this.transport.call(environmentOperations["apps.settings.client_credentials"], [id], body, options),
       /**
        * Turn token exchange (RFC 8693) on or off for a confidential app.
        *
@@ -1376,6 +1497,18 @@ var EnvironmentClient = class {
     /** Every item of `audit.list`, fetching pages as the iteration reaches them. */
     listAll: (query, options) => this.transport.paginate(environmentOperations["audit.list"], [], query, options)
   };
+  authenticator = {
+    me: {
+      /**
+       * Verified identity for the authenticator
+       *
+       * Requires the provisioned public authenticator client, devices.manage and a DPoP proof. Available before device registration; revoked keys are refused.
+       *
+       * `GET /authenticator/me`
+       */
+      list: (options) => this.transport.call(environmentOperations["authenticator.me.list"], [], void 0, options)
+    }
+  };
   branding = {
     appearance: {
       /**
@@ -1390,7 +1523,7 @@ var EnvironmentClient = class {
        */
       get: (query, options) => this.transport.call(environmentOperations["branding.appearance.get"], [], query, options),
       /**
-       * Set the hosted sign-in theme (preset, colours, corners, type, logo) for the environment default or one organization.
+       * Set the hosted sign-in theme (preset, colours, corners, type, uploaded logo and favicon) for the environment default or one organization.
        *
        * Requires scope `branding:write`. Danger: write.
        *
@@ -1484,6 +1617,17 @@ var EnvironmentClient = class {
     list: (query, options) => this.transport.call(environmentOperations["directories.list"], [], query, options),
     /** Every item of `directories.list`, fetching pages as the iteration reaches them. */
     listAll: (query, options) => this.transport.paginate(environmentOperations["directories.list"], [], query, options),
+    /**
+     * Pull a Google Workspace, Microsoft Entra or HR-system directory now, on a worker. `full` asks an HR system for everybody rather than what changed.
+     *
+     * Requires scope `directory_sync:write`. Danger: write.
+     *
+     * `POST /directories/{id}/sync` · action `directories.sync`
+     * @scope `directory_sync:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    sync: (id, body, options) => this.transport.call(environmentOperations["directories.sync"], [id], body, options),
     /**
      * Rename an inbound directory.
      *
@@ -1495,6 +1639,19 @@ var EnvironmentClient = class {
      * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
      */
     update: (id, body, options) => this.transport.call(environmentOperations["directories.update"], [id], body, options),
+    credentials: {
+      /**
+       * Replace a pull directory's provider credentials, verifying the new ones first. Write-only; never returned.
+       *
+       * Requires scope `directory_sync:write`. Danger: critical.
+       *
+       * `PUT /directories/{id}/credentials` · action `directories.credentials.replace`
+       * @scope `directory_sync:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      replace: (id, body, options) => this.transport.call(environmentOperations["directories.credentials.replace"], [id], body, options)
+    },
     groups: {
       /**
        * List the groups a directory has synced, with the role ids each group is mapped onto.
@@ -1521,6 +1678,19 @@ var EnvironmentClient = class {
        */
       map: (id, body, options) => this.transport.call(environmentOperations["directories.groups.map"], [id], body, options)
     },
+    hris: {
+      /**
+       * Connect an HR system (Workday, BambooHR, Rippling, HiBob or Personio) to sync an organization's people from, verifying the credentials first. The first sync is queued.
+       *
+       * Requires scope `directory_sync:write`. Danger: critical.
+       *
+       * `POST /directories/hris` · action `directories.hris.connect`
+       * @scope `directory_sync:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      connect: (body, options) => this.transport.call(environmentOperations["directories.hris.connect"], [], body, options)
+    },
     status: {
       /**
        * Pause or resume an inbound directory's provisioning.
@@ -1534,6 +1704,19 @@ var EnvironmentClient = class {
        */
       set: (id, body, options) => this.transport.call(environmentOperations["directories.status.set"], [id], body, options)
     },
+    syncSettings: {
+      /**
+       * Set how often a pull directory syncs, and for an HR system which of its fields pass through onto people.
+       *
+       * Requires scope `directory_sync:write`. Danger: write.
+       *
+       * `PATCH /directories/{id}/sync-settings` · action `directories.sync_settings.update`
+       * @scope `directory_sync:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      update: (id, body, options) => this.transport.call(environmentOperations["directories.sync_settings.update"], [id], body, options)
+    },
     token: {
       /**
        * Issue a new bearer token for a SCIM directory, returned once. The old token stops working immediately.
@@ -1609,6 +1792,202 @@ var EnvironmentClient = class {
     /** Every item of `events.list`, fetching pages as the iteration reaches them. */
     listAll: (query, options) => this.transport.paginate(environmentOperations["events.list"], [], query, options)
   };
+  featureFlags = {
+    /**
+     * Define a feature flag: a key apps ask about, its default, and who it is on for — named users, named organizations, a rollout percentage.
+     *
+     * Requires scope `feature_flags:write`. Danger: write.
+     *
+     * `POST /feature-flags` · action `feature_flags.create`
+     * @scope `feature_flags:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    create: (body, options) => this.transport.call(environmentOperations["feature_flags.create"], [], body, options),
+    /**
+     * Delete a feature flag and its rules. Its key evaluates to off from now on; tokens already minted keep it until they expire.
+     *
+     * Requires scope `feature_flags:write`. Danger: destructive.
+     *
+     * `DELETE /feature-flags/{id}` · action `feature_flags.delete`
+     * @scope `feature_flags:write`
+     * @danger destructive
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    delete: (id, options) => this.transport.call(environmentOperations["feature_flags.delete"], [id], void 0, options),
+    /**
+     * Evaluate every feature flag for a user in an organization: whether each is on, and the rule that decided. For app backends without a token in hand.
+     *
+     * Requires scope `feature_flags:read`. Danger: read.
+     *
+     * `GET /feature-flags/evaluate` · action `feature_flags.evaluate`
+     * @scope `feature_flags:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    evaluate: (query, options) => this.transport.call(environmentOperations["feature_flags.evaluate"], [], query, options),
+    /**
+     * Read one feature flag: its default, whether it is switched on, and every user, organization and rollout rule.
+     *
+     * Requires scope `feature_flags:read`. Danger: read.
+     *
+     * `GET /feature-flags/{id}` · action `feature_flags.get`
+     * @scope `feature_flags:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    get: (id, options) => this.transport.call(environmentOperations["feature_flags.get"], [id], void 0, options),
+    /**
+     * List this environment's feature flags with their default, kill switch and targeting rules.
+     *
+     * Requires scope `feature_flags:read`. Danger: read.
+     *
+     * `GET /feature-flags` · action `feature_flags.list`
+     * @scope `feature_flags:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    list: (query, options) => this.transport.call(environmentOperations["feature_flags.list"], [], query, options),
+    /** Every item of `feature_flags.list`, fetching pages as the iteration reaches them. */
+    listAll: (query, options) => this.transport.paginate(environmentOperations["feature_flags.list"], [], query, options),
+    /**
+     * Change a feature flag: switch it on or off for everyone, change its default, or replace its user rules, organization rules or rollout percentage.
+     *
+     * Requires scope `feature_flags:write`. Danger: write.
+     *
+     * `PATCH /feature-flags/{id}` · action `feature_flags.update`
+     * @scope `feature_flags:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    update: (id, body, options) => this.transport.call(environmentOperations["feature_flags.update"], [id], body, options)
+  };
+  fga = {
+    /**
+     * Check whether a subject has a relation on a resource — directly, through computed relations, parents or nested groups. Optionally at least as fresh as a consistency_token.
+     *
+     * Requires scope `fga:read`. Danger: read.
+     *
+     * `GET /fga/check` · action `fga.check`
+     * @scope `fga:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    check: (query, options) => this.transport.call(environmentOperations["fga.check"], [], query, options),
+    /**
+     * Run 1–100 checks in one round trip, each written resource#relation@subject (document:readme#viewer@user:alice), all at the same revision, answered in order.
+     *
+     * Requires scope `fga:read`. Danger: read.
+     *
+     * `GET /fga/check/batch` · action `fga.check_batch`
+     * @scope `fga:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    checkBatch: (query, options) => this.transport.call(environmentOperations["fga.check_batch"], [], query, options),
+    resources: {
+      /**
+       * List the resources of one type a subject has a relation on (e.g. every document alice can view), through all inheritance; sorted ids, paged with after.
+       *
+       * Requires scope `fga:read`. Danger: read.
+       *
+       * `GET /fga/resources` · action `fga.resources.list`
+       * @scope `fga:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      list: (query, options) => this.transport.call(environmentOperations["fga.resources.list"], [], query, options),
+      /** Every item of `fga.resources.list`, fetching pages as the iteration reaches them. */
+      listAll: (query, options) => this.transport.paginate(environmentOperations["fga.resources.list"], [], query, options)
+    },
+    schema: {
+      /**
+       * Read this environment's fine-grained authorization schema: the source text, its parsed types and relations, its version, and the current consistency token.
+       *
+       * Requires scope `fga:read`. Danger: read.
+       *
+       * `GET /fga/schema` · action `fga.schema.get`
+       * @scope `fga:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      get: (options) => this.transport.call(environmentOperations["fga.schema.get"], [], void 0, options),
+      /**
+       * Replace this environment's fine-grained authorization schema (types, relations and how each is decided). Changes the answer to every check at once; refused if invalid or if existing tuples would no longer fit.
+       *
+       * Requires scope `fga:schema`. Danger: critical.
+       *
+       * `PUT /fga/schema` · action `fga.schema.update`
+       * @scope `fga:schema`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      update: (body, options) => this.transport.call(environmentOperations["fga.schema.update"], [], body, options),
+      /**
+       * Check a fine-grained authorization schema without saving it: every error by line, or the parsed types and canonical text.
+       *
+       * Requires scope `fga:read`. Danger: read.
+       *
+       * `GET /fga/schema/validate` · action `fga.schema.validate`
+       * @scope `fga:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      validate: (query, options) => this.transport.call(environmentOperations["fga.schema.validate"], [], query, options)
+    },
+    subjects: {
+      /**
+       * List the subjects of one type that have a relation on a resource (e.g. every user who can view the readme), groups and inheritance expanded; sorted ids, paged with after.
+       *
+       * Requires scope `fga:read`. Danger: read.
+       *
+       * `GET /fga/subjects` · action `fga.subjects.list`
+       * @scope `fga:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      list: (query, options) => this.transport.call(environmentOperations["fga.subjects.list"], [], query, options),
+      /** Every item of `fga.subjects.list`, fetching pages as the iteration reaches them. */
+      listAll: (query, options) => this.transport.paginate(environmentOperations["fga.subjects.list"], [], query, options)
+    },
+    tuples: {
+      /**
+       * Delete 1–100 relationship tuples in one atomic batch. Revokes the access they granted, and everything inherited through them, at once.
+       *
+       * Requires scope `fga:write`. Danger: destructive.
+       *
+       * `POST /fga/tuples/delete` · action `fga.tuples.delete`
+       * @scope `fga:write`
+       * @danger destructive
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      delete: (body, options) => this.transport.call(environmentOperations["fga.tuples.delete"], [], body, options),
+      /**
+       * List stored relationship tuples oldest first, filtered by resource type and id, relation and subject; pass next_cursor as after to page.
+       *
+       * Requires scope `fga:read`. Danger: read.
+       *
+       * `GET /fga/tuples` · action `fga.tuples.list`
+       * @scope `fga:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      list: (query, options) => this.transport.call(environmentOperations["fga.tuples.list"], [], query, options),
+      /** Every item of `fga.tuples.list`, fetching pages as the iteration reaches them. */
+      listAll: (query, options) => this.transport.paginate(environmentOperations["fga.tuples.list"], [], query, options),
+      /**
+       * Write 1–100 relationship tuples (resource#relation@subject) in one atomic batch, each checked against the schema. Grants access at once; returns a consistency_token for checks that must see it.
+       *
+       * Requires scope `fga:write`. Danger: write.
+       *
+       * `POST /fga/tuples` · action `fga.tuples.write`
+       * @scope `fga:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      write: (body, options) => this.transport.call(environmentOperations["fga.tuples.write"], [], body, options)
+    }
+  };
   frontendKeys = {
     /**
      * Create a publishable frontend key for a browser app, usable only from the origins listed. The key is public by design.
@@ -1717,6 +2096,17 @@ var EnvironmentClient = class {
     update: (id, body, options) => this.transport.call(environmentOperations["hooks.update"], [id], body, options)
   };
   invitations = {
+    /**
+     * Get an invitation and its acceptance receipt, confined to its organization.
+     *
+     * Requires scope `invitations:read`. Danger: read.
+     *
+     * `GET /organizations/{organization_id}/invitations/{invitation_id}` · action `invitations.get`
+     * @scope `invitations:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    get: (organizationId, invitationId, options) => this.transport.call(environmentOperations["invitations.get"], [organizationId, invitationId], void 0, options),
     /**
      * List an organization's pending invitations
      *
@@ -2016,6 +2406,21 @@ var EnvironmentClient = class {
      * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
      */
     update: (organizationId, userId, body, options) => this.transport.call(environmentOperations["members.update"], [organizationId, userId], body, options),
+    apps: {
+      roles: {
+        /**
+         * Replace one app's member roles atomically. Other apps and the organization membership remain unchanged. An empty role list removes this app's access only.
+         *
+         * Requires scope `roles:write`. Danger: write.
+         *
+         * `PUT /organizations/{organization_id}/members/{user_id}/apps/{client_id}/roles` · action `members.apps.roles.replace`
+         * @scope `roles:write`
+         * @danger write
+         * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+         */
+        replace: (organizationId, userId, clientId, body, options) => this.transport.call(environmentOperations["members.apps.roles.replace"], [organizationId, userId, clientId], body, options)
+      }
+    },
     roles: {
       /**
        * Grant a member a role in the organization
@@ -2317,67 +2722,348 @@ var EnvironmentClient = class {
      */
     update: (id, body, options) => this.transport.call(environmentOperations["permissions.update"], [id], body, options)
   };
+  pipes = {
+    /**
+     * Configure a pipe: the environment's OAuth app at a third-party provider (GitHub, Google, Microsoft 365, Slack, Salesforce, HubSpot, Linear, Notion), so people can connect their accounts. The client secret is sealed and never returned.
+     *
+     * Requires scope `pipes:write`. Danger: write.
+     *
+     * `POST /pipes` · action `pipes.create`
+     * @scope `pipes:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    create: (body, options) => this.transport.call(environmentOperations["pipes.create"], [], body, options),
+    /**
+     * Remove a pipe and every connection through it. Their tokens are revoked here, not at the provider — disconnect people first if that matters.
+     *
+     * Requires scope `pipes:write`. Danger: destructive.
+     *
+     * `DELETE /pipes/{id}` · action `pipes.delete`
+     * @scope `pipes:write`
+     * @danger destructive
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    delete: (id, options) => this.transport.call(environmentOperations["pipes.delete"], [id], void 0, options),
+    /**
+     * Show one pipe: its provider, OAuth client id, scopes, the redirect URI to register at the provider, and the apps granted its tokens.
+     *
+     * Requires scope `pipes:read`. Danger: read.
+     *
+     * `GET /pipes/{id}` · action `pipes.get`
+     * @scope `pipes:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    get: (id, options) => this.transport.call(environmentOperations["pipes.get"], [id], void 0, options),
+    /**
+     * List the pipes — the third-party providers people can connect their accounts to — with their scopes and the apps granted their tokens. Never a client secret.
+     *
+     * Requires scope `pipes:read`. Danger: read.
+     *
+     * `GET /pipes` · action `pipes.list`
+     * @scope `pipes:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    list: (query, options) => this.transport.call(environmentOperations["pipes.list"], [], query, options),
+    /** Every item of `pipes.list`, fetching pages as the iteration reaches them. */
+    listAll: (query, options) => this.transport.paginate(environmentOperations["pipes.list"], [], query, options),
+    /**
+     * Change a pipe — client id, client secret (sealed), scopes, parameters, or whether it is enabled. Only what is sent changes.
+     *
+     * Requires scope `pipes:write`. Danger: write.
+     *
+     * `PATCH /pipes/{id}` · action `pipes.update`
+     * @scope `pipes:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    update: (id, body, options) => this.transport.call(environmentOperations["pipes.update"], [id], body, options),
+    connections: {
+      /**
+       * Disconnect a person's connected account: revoke it at the provider where supported, revoke its tokens here, and forget it.
+       *
+       * Requires scope `pipes:write`. Danger: destructive.
+       *
+       * `DELETE /pipes/{id}/connections/{connection_id}` · action `pipes.connections.delete`
+       * @scope `pipes:write`
+       * @danger destructive
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      delete: (id, connectionId, options) => this.transport.call(environmentOperations["pipes.connections.delete"], [id, connectionId], void 0, options),
+      /**
+       * List the accounts people connected through a pipe: who, which account, granted scopes, status (active / needs_reauth) and when the token expires. Never a token.
+       *
+       * Requires scope `pipes:read`. Danger: read.
+       *
+       * `GET /pipes/{id}/connections` · action `pipes.connections.list`
+       * @scope `pipes:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      list: (id, query, options) => this.transport.call(environmentOperations["pipes.connections.list"], [id], query, options),
+      /** Every item of `pipes.connections.list`, fetching pages as the iteration reaches them. */
+      listAll: (id, query, options) => this.transport.paginate(environmentOperations["pipes.connections.list"], [id], query, options)
+    },
+    grants: {
+      /**
+       * Grant an app (by OAuth client id) the right to lease fresh access tokens for the accounts people connected through this pipe.
+       *
+       * Requires scope `pipes:write`. Danger: critical.
+       *
+       * `POST /pipes/{id}/grants` · action `pipes.grants.create`
+       * @scope `pipes:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      create: (id, body, options) => this.transport.call(environmentOperations["pipes.grants.create"], [id], body, options),
+      /**
+       * Withdraw an app's right to lease the tokens people connected through this pipe.
+       *
+       * Requires scope `pipes:write`. Danger: destructive.
+       *
+       * `DELETE /pipes/{id}/grants/{client_id}` · action `pipes.grants.delete`
+       * @scope `pipes:write`
+       * @danger destructive
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      delete: (id, clientId, options) => this.transport.call(environmentOperations["pipes.grants.delete"], [id, clientId], void 0, options)
+    }
+  };
   provisioning = {
     targets: {
       /**
-       * Register a downstream app this platform pushes an organization's people to over SCIM, or every organization's with environment_wide.
+       * Register a downstream app this platform pushes an organization's people to over SCIM, or every organization's with environment_wide.
+       *
+       * Requires scope `provisioning:write`. Danger: critical.
+       *
+       * `POST /provisioning-targets` · action `provisioning.targets.create`
+       * @scope `provisioning:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      create: (body, options) => this.transport.call(environmentOperations["provisioning.targets.create"], [], body, options),
+      /**
+       * Delete a downstream SCIM target. Nothing more is pushed to it.
+       *
+       * Requires scope `provisioning:write`. Danger: destructive.
+       *
+       * `DELETE /provisioning-targets/{id}` · action `provisioning.targets.delete`
+       * @scope `provisioning:write`
+       * @danger destructive
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      delete: (id, body, options) => this.transport.call(environmentOperations["provisioning.targets.delete"], [id], body, options),
+      /**
+       * Read one downstream SCIM target: its URL, auth scheme, status and last error. Never its credential.
+       *
+       * Requires scope `provisioning:read`. Danger: read.
+       *
+       * `GET /provisioning-targets/{id}` · action `provisioning.targets.get`
+       * @scope `provisioning:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      get: (id, query, options) => this.transport.call(environmentOperations["provisioning.targets.get"], [id], query, options),
+      /**
+       * List the downstream SCIM targets people are provisioned to, optionally for one organization, with their failures. Never their credentials.
+       *
+       * Requires scope `provisioning:read`. Danger: read.
+       *
+       * `GET /provisioning-targets` · action `provisioning.targets.list`
+       * @scope `provisioning:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      list: (query, options) => this.transport.call(environmentOperations["provisioning.targets.list"], [], query, options),
+      /** Every item of `provisioning.targets.list`, fetching pages as the iteration reaches them. */
+      listAll: (query, options) => this.transport.paginate(environmentOperations["provisioning.targets.list"], [], query, options),
+      status: {
+        /**
+         * Pause or resume pushing people to a downstream SCIM target.
+         *
+         * Requires scope `provisioning:write`. Danger: write.
+         *
+         * `POST /provisioning-targets/{id}/status` · action `provisioning.targets.status.set`
+         * @scope `provisioning:write`
+         * @danger write
+         * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+         */
+        set: (id, body, options) => this.transport.call(environmentOperations["provisioning.targets.status.set"], [id], body, options)
+      }
+    }
+  };
+  radar = {
+    decisions: {
+      /**
+       * Read one Radar decision: the verdict, whether it was enforced, the deciding rule, every rule that fired, the reasons, the risk score and the facts it was decided on.
+       *
+       * Requires scope `radar:read`. Danger: read.
+       *
+       * `GET /radar/decisions/{id}` · action `radar.decisions.get`
+       * @scope `radar:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      get: (id, options) => this.transport.call(environmentOperations["radar.decisions.get"], [id], void 0, options),
+      /**
+       * List this environment's Radar decisions newest first — verdict, deciding rule, every rule that fired, reasons and facts — filtered by verdict, flow, rule, country, email, IP, device or time; pass `next_cursor` as `after` to page. Email and IP are matched by keyed pseudonym and never returned.
+       *
+       * Requires scope `radar:read`. Danger: read.
+       *
+       * `GET /radar/decisions` · action `radar.decisions.list`
+       * @scope `radar:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      list: (query, options) => this.transport.call(environmentOperations["radar.decisions.list"], [], query, options),
+      /** Every item of `radar.decisions.list`, fetching pages as the iteration reaches them. */
+      listAll: (query, options) => this.transport.paginate(environmentOperations["radar.decisions.list"], [], query, options)
+    },
+    lists: {
+      /**
+       * Add an entry to this environment's Radar allow or deny list: an IP or CIDR range, an email address, a mail domain (and its subdomains), or a device id from the decisions explorer. Deny blocks before every rule; allow skips every rule.
+       *
+       * Requires scope `radar:write`. Danger: write.
+       *
+       * `POST /radar/lists` · action `radar.lists.add`
+       * @scope `radar:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      add: (body, options) => this.transport.call(environmentOperations["radar.lists.add"], [], body, options),
+      /**
+       * List this environment's Radar allow and deny entries — IPs and CIDR ranges, addresses, mail domains, devices — optionally one list or one kind.
+       *
+       * Requires scope `radar:read`. Danger: read.
+       *
+       * `GET /radar/lists` · action `radar.lists.list`
+       * @scope `radar:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      list: (query, options) => this.transport.call(environmentOperations["radar.lists.list"], [], query, options),
+      /** Every item of `radar.lists.list`, fetching pages as the iteration reaches them. */
+      listAll: (query, options) => this.transport.paginate(environmentOperations["radar.lists.list"], [], query, options),
+      /**
+       * Remove an entry from this environment's Radar allow or deny list.
+       *
+       * Requires scope `radar:write`. Danger: destructive.
+       *
+       * `DELETE /radar/lists/{id}` · action `radar.lists.remove`
+       * @scope `radar:write`
+       * @danger destructive
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      remove: (id, options) => this.transport.call(environmentOperations["radar.lists.remove"], [id], void 0, options)
+    },
+    mode: {
+      /**
+       * Switch this environment's Radar between `monitor` (verdicts recorded, never acted on) and `enforce` (blocks refuse sign-ins and sign-ups, challenges demand a second factor). Changes the environment's security posture.
+       *
+       * Requires scope `radar:manage`. Danger: critical.
+       *
+       * `PUT /radar/mode` · action `radar.mode.set`
+       * @scope `radar:manage`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      set: (body, options) => this.transport.call(environmentOperations["radar.mode.set"], [], body, options)
+    },
+    rules: {
+      /**
+       * Add a Radar rule: when EVERY condition (field, operator, value) holds, allow, challenge or block. Rules run in order after the allow/deny lists and before the built-in rules; the first match decides. Example: country not_in [DK, SE] → challenge.
+       *
+       * Requires scope `radar:write`. Danger: write.
+       *
+       * `POST /radar/rules` · action `radar.rules.create`
+       * @scope `radar:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      create: (body, options) => this.transport.call(environmentOperations["radar.rules.create"], [], body, options),
+      /**
+       * Delete a Radar rule. Attempts it decided are decided by the next matching rule, or the built-in rules, from then on.
        *
-       * Requires scope `provisioning:write`. Danger: critical.
+       * Requires scope `radar:write`. Danger: destructive.
        *
-       * `POST /provisioning-targets` · action `provisioning.targets.create`
-       * @scope `provisioning:write`
-       * @danger critical
+       * `DELETE /radar/rules/{id}` · action `radar.rules.delete`
+       * @scope `radar:write`
+       * @danger destructive
        * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
        */
-      create: (body, options) => this.transport.call(environmentOperations["provisioning.targets.create"], [], body, options),
+      delete: (id, options) => this.transport.call(environmentOperations["radar.rules.delete"], [id], void 0, options),
       /**
-       * Delete a downstream SCIM target. Nothing more is pushed to it.
+       * Read one Radar rule: its action, the flows it applies to, its position and its conditions.
        *
-       * Requires scope `provisioning:write`. Danger: destructive.
+       * Requires scope `radar:read`. Danger: read.
        *
-       * `DELETE /provisioning-targets/{id}` · action `provisioning.targets.delete`
-       * @scope `provisioning:write`
-       * @danger destructive
+       * `GET /radar/rules/{id}` · action `radar.rules.get`
+       * @scope `radar:read`
+       * @danger read
        * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
        */
-      delete: (id, body, options) => this.transport.call(environmentOperations["provisioning.targets.delete"], [id], body, options),
+      get: (id, options) => this.transport.call(environmentOperations["radar.rules.get"], [id], void 0, options),
       /**
-       * Read one downstream SCIM target: its URL, auth scheme, status and last error. Never its credential.
+       * List this environment's own Radar rules in evaluation order (the first whose conditions all hold decides), with their conditions and a readable summary of each.
        *
-       * Requires scope `provisioning:read`. Danger: read.
+       * Requires scope `radar:read`. Danger: read.
        *
-       * `GET /provisioning-targets/{id}` · action `provisioning.targets.get`
-       * @scope `provisioning:read`
+       * `GET /radar/rules` · action `radar.rules.list`
+       * @scope `radar:read`
        * @danger read
        * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
        */
-      get: (id, query, options) => this.transport.call(environmentOperations["provisioning.targets.get"], [id], query, options),
+      list: (query, options) => this.transport.call(environmentOperations["radar.rules.list"], [], query, options),
+      /** Every item of `radar.rules.list`, fetching pages as the iteration reaches them. */
+      listAll: (query, options) => this.transport.paginate(environmentOperations["radar.rules.list"], [], query, options),
       /**
-       * List the downstream SCIM targets people are provisioned to, optionally for one organization, with their failures. Never their credentials.
+       * Set the order Radar rules are evaluated in: `rule_ids` lists every rule of the environment exactly once, first evaluated first.
        *
-       * Requires scope `provisioning:read`. Danger: read.
+       * Requires scope `radar:write`. Danger: write.
        *
-       * `GET /provisioning-targets` · action `provisioning.targets.list`
-       * @scope `provisioning:read`
+       * `PUT /radar/rules/order` · action `radar.rules.reorder`
+       * @scope `radar:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      reorder: (body, options) => this.transport.call(environmentOperations["radar.rules.reorder"], [], body, options),
+      /**
+       * Change a Radar rule: its name, description, action, flows, enabled state, position, or (replaced whole) its conditions.
+       *
+       * Requires scope `radar:write`. Danger: write.
+       *
+       * `PATCH /radar/rules/{id}` · action `radar.rules.update`
+       * @scope `radar:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      update: (id, body, options) => this.transport.call(environmentOperations["radar.rules.update"], [id], body, options)
+    },
+    settings: {
+      /**
+       * Read this environment's Radar settings: the mode (monitor or enforce, and whether it is inherited from the deployment), the IP intelligence source, and every built-in rule with its action and threshold.
+       *
+       * Requires scope `radar:read`. Danger: read.
+       *
+       * `GET /radar/settings` · action `radar.settings.get`
+       * @scope `radar:read`
        * @danger read
        * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
        */
-      list: (query, options) => this.transport.call(environmentOperations["provisioning.targets.list"], [], query, options),
-      /** Every item of `provisioning.targets.list`, fetching pages as the iteration reaches them. */
-      listAll: (query, options) => this.transport.paginate(environmentOperations["provisioning.targets.list"], [], query, options),
-      status: {
-        /**
-         * Pause or resume pushing people to a downstream SCIM target.
-         *
-         * Requires scope `provisioning:write`. Danger: write.
-         *
-         * `POST /provisioning-targets/{id}/status` · action `provisioning.targets.status.set`
-         * @scope `provisioning:write`
-         * @danger write
-         * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
-         */
-        set: (id, body, options) => this.transport.call(environmentOperations["provisioning.targets.status.set"], [id], body, options)
-      }
+      get: (options) => this.transport.call(environmentOperations["radar.settings.get"], [], void 0, options),
+      /**
+       * Tune this environment's built-in Radar rules: `builtin_rules` maps a rule key (credential_stuffing, bot_velocity, account_attack, impossible_travel, new_device, anonymous_network, hosting_network, disposable_email, risk_score_reject, risk_score_elevated) to any of enabled, action and threshold.
+       *
+       * Requires scope `radar:write`. Danger: write.
+       *
+       * `PATCH /radar/settings` · action `radar.settings.update`
+       * @scope `radar:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      update: (body, options) => this.transport.call(environmentOperations["radar.settings.update"], [], body, options)
     }
   };
   roles = {
@@ -2438,6 +3124,19 @@ var EnvironmentClient = class {
      * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
      */
     update: (id, body, options) => this.transport.call(environmentOperations["roles.update"], [id], body, options),
+    definition: {
+      /**
+       * Activate a reviewed application role definition for its existing holders.
+       *
+       * Requires scope `role_definitions:write`. Danger: destructive.
+       *
+       * `POST /roles/{id}/definition/activate` · action `roles.definition.activate`
+       * @scope `role_definitions:write`
+       * @danger destructive
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      activate: (id, body, options) => this.transport.call(environmentOperations["roles.definition.activate"], [id], body, options)
+    },
     permissions: {
       /**
        * Add a permission to a role: everyone holding the role gains it. The permission must be unscoped or declared by the role's own app.
@@ -2522,6 +3221,45 @@ var EnvironmentClient = class {
      */
     update: (id, body, options) => this.transport.call(environmentOperations["saml_apps.update"], [id], body, options)
   };
+  signals = {
+    source: {
+      /**
+       * Read the environment-owner identity source
+       *
+       * Requires an environment key with `signals_source:read` and explicit operator
+       * opt-in for this environment. Organization grants and delegated user tokens
+       * cannot read this source. Records include pre-organization authentication.
+       * The cursor follows committed sequence order and is bound to the source generation.
+       * Follow `next_cursor`, including on empty pages; a stale generation or purged
+       * cursor requires an explicit restart. Pages are at most 1000 records / 1 MiB.
+       * Data follows the Signals 2.0.0 identity event contracts. Scope is attached by
+       * the consumer's explicit grant; producer_environment is always host-bound.
+       * Replay is limited to seven days, including raw-IP retention. A heartbeat
+       * proves exporter maintenance, not complete coverage of every identity flow.
+       *
+       * `GET /signals/source`
+       */
+      list: (query, options) => this.transport.call(environmentOperations["signals.source.list"], [], query, options),
+      /** Every item of `signals.source.list`, fetching pages as the iteration reaches them. */
+      listAll: (query, options) => this.transport.paginate(environmentOperations["signals.source.list"], [], query, options),
+      erasures: {
+        /**
+         * Replay source deletion receipts
+         *
+         * Requires `signals_source:read` on an environment-owner key. Replay this stream
+         * before making a restored or newly backfilled consumer eligible. It retains only
+         * opaque subject references and deletion facts beyond the raw-event replay window.
+         * Publication order and cursor integrity match the event source. The credential
+         * is checked on every page. Ordinary tenant grants cannot access this stream.
+         *
+         * `GET /signals/source/erasures`
+         */
+        list: (query, options) => this.transport.call(environmentOperations["signals.source.erasures.list"], [], query, options),
+        /** Every item of `signals.source.erasures.list`, fetching pages as the iteration reaches them. */
+        listAll: (query, options) => this.transport.paginate(environmentOperations["signals.source.erasures.list"], [], query, options)
+      }
+    }
+  };
   signin = {
     policy: {
       /**
@@ -2547,7 +3285,7 @@ var EnvironmentClient = class {
        */
       inherit: (organizationId, options) => this.transport.call(environmentOperations["signin.policy.inherit"], [organizationId], void 0, options),
       /**
-       * Change the authentication policy of the environment baseline, or tighten one organization's override. Requiring SSO signs out password sessions.
+       * Change the authentication policy of the environment baseline — including whether passkeys and magic links are offered and how long sessions last — or tighten one organization's override. Requiring SSO signs out password sessions.
        *
        * Requires scope `signin:write`. Danger: critical.
        *
@@ -2571,6 +3309,30 @@ var EnvironmentClient = class {
        */
       set: (body, options) => this.transport.call(environmentOperations["signin.self_service_signup.set"], [], body, options)
     },
+    sms: {
+      /**
+       * Read the SMS second-factor policy: whether text-message codes are accepted, for which countries, and the administrator rule.
+       *
+       * Requires scope `signin:read`. Danger: read.
+       *
+       * `GET /sign-in/sms` · action `signin.sms.get`
+       * @scope `signin:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      get: (options) => this.transport.call(environmentOperations["signin.sms.get"], [], void 0, options),
+      /**
+       * Change the SMS second-factor policy: accept text-message codes or not, the countries they may go to, and whether SMS may be an administrator's only factor.
+       *
+       * Requires scope `signin:write`. Danger: critical.
+       *
+       * `PATCH /sign-in/sms` · action `signin.sms.update`
+       * @scope `signin:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      update: (body, options) => this.transport.call(environmentOperations["signin.sms.update"], [], body, options)
+    },
     social: {
       /**
        * Stop offering a social login provider. People who used it keep their accounts.
@@ -2584,7 +3346,40 @@ var EnvironmentClient = class {
        */
       delete: (id, body, options) => this.transport.call(environmentOperations["signin.social.delete"], [id], body, options),
       /**
-       * List the social login providers (Google, GitHub, Apple…) enabled in this environment, optionally for one organization.
+       * Turn a social login provider off without removing it. People who used it keep their accounts.
+       *
+       * Requires scope `signin:write`. Danger: critical.
+       *
+       * `POST /sign-in/social-providers/{id}/disable` · action `signin.social.disable`
+       * @scope `signin:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      disable: (id, body, options) => this.transport.call(environmentOperations["signin.social.disable"], [id], body, options),
+      /**
+       * Turn a social login provider that was turned off back on, with the credentials it already has.
+       *
+       * Requires scope `signin:write`. Danger: write.
+       *
+       * `POST /sign-in/social-providers/{id}/enable` · action `signin.social.enable`
+       * @scope `signin:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      enable: (id, body, options) => this.transport.call(environmentOperations["signin.social.enable"], [id], body, options),
+      /**
+       * Turn one of the environment's social login providers off (or back on) for one organization's sign-in page.
+       *
+       * Requires scope `signin:write`. Danger: write.
+       *
+       * `PUT /sign-in/social-providers/inherited/{provider}` · action `signin.social.inherit`
+       * @scope `signin:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      inherit: (provider, body, options) => this.transport.call(environmentOperations["signin.social.inherit"], [provider], body, options),
+      /**
+       * List the social login providers (Google, GitHub, Apple…) set up in this environment — the environment's own and organizations' — optionally for one organization.
        *
        * Requires scope `signin:read`. Danger: read.
        *
@@ -2597,7 +3392,18 @@ var EnvironmentClient = class {
       /** Every item of `signin.social.list`, fetching pages as the iteration reaches them. */
       listAll: (query, options) => this.transport.paginate(environmentOperations["signin.social.list"], [], query, options),
       /**
-       * Enable a social login provider (Google, GitHub, Apple…) for one organization with its client credentials. The secret is never returned.
+       * The social login buttons one organization's sign-in page shows (or the plain sign-in page's), after inheritance from the environment, with where each comes from.
+       *
+       * Requires scope `signin:read`. Danger: read.
+       *
+       * `GET /sign-in/social-providers/offered` · action `signin.social.offered`
+       * @scope `signin:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      offered: (query, options) => this.transport.call(environmentOperations["signin.social.offered"], [], query, options),
+      /**
+       * Enable a social login provider (Google, GitHub, Apple…) for the whole environment or for one organization, with its client credentials. The secret is never returned.
        *
        * Requires scope `signin:write`. Danger: critical.
        *
@@ -2606,7 +3412,18 @@ var EnvironmentClient = class {
        * @danger critical
        * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
        */
-      set: (body, options) => this.transport.call(environmentOperations["signin.social.set"], [], body, options)
+      set: (body, options) => this.transport.call(environmentOperations["signin.social.set"], [], body, options),
+      /**
+       * Change a social login provider's client credentials, provider values or extra scopes. Secrets left out keep the ones on file.
+       *
+       * Requires scope `signin:write`. Danger: critical.
+       *
+       * `PATCH /sign-in/social-providers/{id}` · action `signin.social.update`
+       * @scope `signin:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      update: (id, body, options) => this.transport.call(environmentOperations["signin.social.update"], [id], body, options)
     }
   };
   sodPolicies = {
@@ -3002,6 +3819,30 @@ var EnvironmentClient = class {
       rotate: (id, body, options) => this.transport.call(environmentOperations["token_vault.secrets.rotate"], [id], body, options)
     }
   };
+  userPropertyNamespaces = {
+    /**
+     * Create or replace the app and webhook grants for a user-property namespace. Empty grants revoke access without deleting user data.
+     *
+     * Requires scope `user_property_namespaces:write`. Danger: critical.
+     *
+     * `PUT /user-property-namespaces/{name}` · action `user_property_namespaces.configure`
+     * @scope `user_property_namespaces:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    configure: (name, body, options) => this.transport.call(environmentOperations["user_property_namespaces.configure"], [name], body, options),
+    /**
+     * Read the app and webhook grants for a user-property namespace.
+     *
+     * Requires scope `user_property_namespaces:read`. Danger: read.
+     *
+     * `GET /user-property-namespaces/{name}` · action `user_property_namespaces.show`
+     * @scope `user_property_namespaces:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    show: (name, options) => this.transport.call(environmentOperations["user_property_namespaces.show"], [name], void 0, options)
+  };
   users = {
     /**
      * Create a user
@@ -3160,7 +4001,20 @@ var EnvironmentClient = class {
        * @danger critical
        * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
        */
-      reset: (id, options) => this.transport.call(environmentOperations["users.mfa.reset"], [id], void 0, options)
+      reset: (id, options) => this.transport.call(environmentOperations["users.mfa.reset"], [id], void 0, options),
+      sms: {
+        /**
+         * Remove a user's phone number for text-message sign-in codes. Their other factors and recovery codes stay.
+         *
+         * Requires scope `users:write`. Danger: critical.
+         *
+         * `DELETE /users/{id}/mfa/sms` · action `users.mfa.sms.remove`
+         * @scope `users:write`
+         * @danger critical
+         * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+         */
+        remove: (id, options) => this.transport.call(environmentOperations["users.mfa.sms.remove"], [id], void 0, options)
+      }
     },
     passwordReset: {
       /**
@@ -3351,6 +4205,9 @@ var EnvironmentClient = class {
 // src/management/generated/workspace.ts
 var workspaceOperations = {
   "action_approvals.get": { action: null, operationId: null, method: "GET", path: "/workspace/action-approvals/{id}", pathParams: ["id"], scope: null, danger: null, approval: false, body: false, pagination: null },
+  "billing.account.update": { action: "billing.account.update", operationId: "billing_account_update", method: "PATCH", path: "/workspace/billing/account", pathParams: [], scope: "billing:write", danger: "write", approval: true, body: true, pagination: null },
+  "billing.payment_method.default": { action: "billing.payment_method.default", operationId: "billing_payment_method_default", method: "PATCH", path: "/workspace/billing/payment-methods/{id}/default", pathParams: ["id"], scope: "billing:write", danger: "write", approval: true, body: false, pagination: null },
+  "billing.payment_method.remove": { action: "billing.payment_method.remove", operationId: "billing_payment_method_remove", method: "DELETE", path: "/workspace/billing/payment-methods/{id}", pathParams: ["id"], scope: "billing:write", danger: "write", approval: true, body: false, pagination: null },
   "environments.create": { action: "environments.create", operationId: "environments_create", method: "POST", path: "/workspace/environments", pathParams: [], scope: "environments:write", danger: "critical", approval: true, body: true, pagination: null },
   "environments.domain.remove": { action: "environments.domain.remove", operationId: "environments_domain_remove", method: "DELETE", path: "/workspace/environments/{environment_id}/domain", pathParams: ["environment_id"], scope: "environments:write", danger: "destructive", approval: true, body: false, pagination: null },
   "environments.domain.request": { action: "environments.domain.request", operationId: "environments_domain_request", method: "POST", path: "/workspace/environments/{environment_id}/domain", pathParams: ["environment_id"], scope: "environments:write", danger: "write", approval: true, body: true, pagination: null },
@@ -3373,7 +4230,7 @@ var workspaceOperations = {
   "team.invitations.revoke": { action: "team.invitations.revoke", operationId: "team_invitations_revoke", method: "DELETE", path: "/workspace/invitations/{id}", pathParams: ["id"], scope: "team:write", danger: "destructive", approval: true, body: false, pagination: null },
   "team.invite": { action: "team.invite", operationId: "team_invite", method: "POST", path: "/workspace/members", pathParams: [], scope: "team:write", danger: "write", approval: true, body: true, pagination: null },
   "team.list": { action: "team.list", operationId: "team_list", method: "GET", path: "/workspace/members", pathParams: [], scope: "team:read", danger: "read", approval: true, body: false, pagination: "page" },
-  "team.remove": { action: "team.remove", operationId: "team_remove", method: "DELETE", path: "/workspace/members/{id}", pathParams: ["id"], scope: "team:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "team.remove": { action: "team.remove", operationId: "team_remove", method: "DELETE", path: "/workspace/members/{id}", pathParams: ["id"], scope: "team:write", danger: "destructive", approval: true, body: true, pagination: null },
   "team.role": { action: "team.role", operationId: "team_role", method: "PATCH", path: "/workspace/members/{id}/role", pathParams: ["id"], scope: "team:write", danger: "write", approval: true, body: true, pagination: null },
   "team.transfer_ownership": { action: "team.transfer_ownership", operationId: "team_transfer_ownership", method: "POST", path: "/workspace/members/{id}/transfer-ownership", pathParams: ["id"], scope: "team:write", danger: "critical", approval: true, body: false, pagination: null },
   "workspace.get": { action: "workspace.get", operationId: "workspace_get", method: "GET", path: "/workspace", pathParams: [], scope: "workspace:read", danger: "read", approval: true, body: false, pagination: null },
@@ -3400,12 +4257,51 @@ var WorkspaceClient = class {
      */
     get: (id, options) => this.transport.call(workspaceOperations["action_approvals.get"], [id], void 0, options)
   };
+  billing = {
+    account: {
+      /**
+       * Update the workspace billing contact and invoice address.
+       *
+       * Requires scope `billing:write` and a role that may `manage-billing`. Danger: write.
+       *
+       * `PATCH /workspace/billing/account` · action `billing.account.update`
+       * @scope `billing:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      update: (body, options) => this.transport.call(workspaceOperations["billing.account.update"], [], body, options)
+    },
+    paymentMethod: {
+      /**
+       * Choose the workspace default payment card.
+       *
+       * Requires scope `billing:write` and a role that may `manage-billing`. Danger: write.
+       *
+       * `PATCH /workspace/billing/payment-methods/{id}/default` · action `billing.payment_method.default`
+       * @scope `billing:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      default: (id, options) => this.transport.call(workspaceOperations["billing.payment_method.default"], [id], void 0, options),
+      /**
+       * Remove an unneeded payment card from this workspace.
+       *
+       * Requires scope `billing:write` and a role that may `manage-billing`. Danger: write.
+       *
+       * `DELETE /workspace/billing/payment-methods/{id}` · action `billing.payment_method.remove`
+       * @scope `billing:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      remove: (id, options) => this.transport.call(workspaceOperations["billing.payment_method.remove"], [id], void 0, options)
+    }
+  };
   environments = {
     /**
      * Create an environment
      *
      * Requires scope `environments:write` and the `manage-environments` capability
-     * (owner/admin/developer). Danger: critical — with `initial_key` it mints a credential.
+     * (`id:write` for human members, or current ownership). Danger: critical — with `initial_key` it mints a credential.
      *
      * With `initial_key`, the environment's first management key is minted in the same
      * call and returned once as `initial_key.token` — enough for an agent holding one
@@ -3421,7 +4317,7 @@ var WorkspaceClient = class {
     /**
      * List environments
      *
-     * Requires scope `workspace:read` (any role).
+     * Requires scope `workspace:read` and permission to read environments. Returns only currently permitted environments; Billing-only members cannot list them.
      *
      * `GET /workspace/environments` · action `environments.list`
      * @scope `workspace:read`
@@ -3534,7 +4430,7 @@ var WorkspaceClient = class {
     /**
      * Create a project
      *
-     * Stand up another independently-billed IdP product. Requires scope `projects:write` and the `manage-environments` capability (owner/admin/developer).
+     * Stand up another independently-billed IdP product. Requires scope `projects:write` and the `manage-environments` capability (`id:write` for human members, or current ownership).
      *
      * `POST /workspace/projects` · action `projects.create`
      * @scope `projects:write`
@@ -3545,7 +4441,7 @@ var WorkspaceClient = class {
     /**
      * List projects
      *
-     * Requires scope `workspace:read` (any role). The workspace's projects (IdP products). Each carries its own plan and environment allowance.
+     * Requires scope `workspace:read` and permission to read environments. Human callers see only projects containing environments they may access; environment counts include only those environments. Billing-only members cannot list projects.
      *
      * `GET /workspace/projects` · action `projects.list`
      * @scope `workspace:read`
@@ -3615,11 +4511,10 @@ var WorkspaceClient = class {
     /**
      * Invite a member
      *
-     * Requires scope `team:write` and the `manage-members` capability (owner/admin). Invites the address onto the
-     * workspace's team — the same invitation the console's Team page sends: a mail naming
-     * this key as the inviter and the role, with a signed link on which the invitee sets a
-     * password and is signed in. Owner is never invited; ownership is transferred. An
-     * earlier pending invitation for the same address is superseded. List, re-send and
+     * Requires scope `team:write` and the `manage-members` capability (`members:manage` for human members, or current ownership). Invites the address onto the
+     * ID product team with the selected app roles. Existing shared membership and other
+     * apps are preserved. Owner is never invited; ownership is transferred separately. An
+     * earlier pending invitation for the same address and this app is superseded. List, re-send and
      * withdraw it under `/workspace/invitations`.
      *
      * `POST /workspace/members` · action `team.invite`
@@ -3631,7 +4526,7 @@ var WorkspaceClient = class {
     /**
      * List members
      *
-     * Requires scope `team:read` and the `read-members` capability (owner/admin/viewer). The roster is PII — a developer key is refused.
+     * Requires scope `team:read` and the `read-members` capability (`members:read` for human members, or current ownership). The roster contains personal information; a machine key also needs an explicit role allowing member reads.
      *
      * `GET /workspace/members` · action `team.list`
      * @scope `team:read`
@@ -3642,7 +4537,7 @@ var WorkspaceClient = class {
     /** Every item of `team.list`, fetching pages as the iteration reaches them. */
     listAll: (query, options) => this.transport.paginate(workspaceOperations["team.list"], [], query, options),
     /**
-     * Remove a member from the workspace's team. The owner is never removed; transfer ownership first.
+     * Remove native ID app roles while preserving shared organization membership and other apps. The current owner cannot be removed.
      *
      * Requires scope `team:write` and a role that may `manage-members`. Danger: destructive.
      *
@@ -3651,9 +4546,9 @@ var WorkspaceClient = class {
      * @danger destructive
      * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
      */
-    remove: (id, options) => this.transport.call(workspaceOperations["team.remove"], [id], void 0, options),
+    remove: (id, body, options) => this.transport.call(workspaceOperations["team.remove"], [id], body, options),
     /**
-     * Change a team member's role (admin, developer, member or viewer). The owner's role changes only by transferring ownership.
+     * Replace native ID app roles atomically. Shared organization membership is preserved.
      *
      * Requires scope `team:write` and a role that may `manage-members`. Danger: write.
      *
@@ -3664,7 +4559,7 @@ var WorkspaceClient = class {
      */
     role: (id, body, options) => this.transport.call(workspaceOperations["team.role"], [id], body, options),
     /**
-     * Make another member the workspace's owner; the current owner stays on as an admin. Only the owner, signed in, may do this.
+     * Transfer shared organization ownership. Existing app roles are preserved; the previous owner may lose native ID access. Only the current owner, signed in, may do this.
      *
      * Requires scope `team:write` and a role that may `manage-members`. Danger: critical.
      *
@@ -3716,7 +4611,7 @@ var WorkspaceClient = class {
     /**
      * Get the workspace
      *
-     * Requires scope `workspace:read` (any role). Returns the workspace's identity. The `projects` block (each project's plan/allowance) is included only for keys whose role can read billing (owner/admin/viewer — not developer).
+     * Requires scope `workspace:read` and current workspace access. Returns only the workspace identity and status, including for members with only the Billing app role.
      *
      * `GET /workspace` · action `workspace.get`
      * @scope `workspace:read`
@@ -3728,7 +4623,7 @@ var WorkspaceClient = class {
       /**
        * Rename the workspace.
        *
-       * Requires scope `settings:write` and a role that may `manage-members`. Danger: write.
+       * Requires scope `settings:write` and a role that may `own-organization` and `manage-members`. Danger: write.
        *
        * `PATCH /workspace` · action `workspace.settings.update`
        * @scope `settings:write`
@@ -3888,13 +4783,23 @@ var accountOperations = {
   "account.api_keys.create": { action: "account.api_keys.create", operationId: "account_api_keys_create", method: "POST", path: "/me/organizations/{organization_id}/api-keys", pathParams: ["organization_id"], scope: "account:api_keys:write", danger: "critical", approval: true, body: true, pagination: null },
   "account.api_keys.revoke": { action: "account.api_keys.revoke", operationId: "account_api_keys_revoke", method: "DELETE", path: "/me/organizations/{organization_id}/api-keys/{key_id}", pathParams: ["organization_id", "key_id"], scope: "account:api_keys:write", danger: "destructive", approval: true, body: false, pagination: null },
   "account.applications.revoke": { action: "account.applications.revoke", operationId: "account_applications_revoke", method: "DELETE", path: "/me/applications/{client_id}", pathParams: ["client_id"], scope: "account:applications:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "account.apps.list": { action: "account.apps.list", operationId: "account_apps_list", method: "GET", path: "/me/apps", pathParams: [], scope: "account:apps:read", danger: "read", approval: true, body: false, pagination: null },
   "account.devices.remove": { action: "account.devices.remove", operationId: "account_devices_remove", method: "DELETE", path: "/me/devices/{device_id}", pathParams: ["device_id"], scope: "account:devices:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "account.email.confirmation.send": { action: "account.email.confirmation.send", operationId: "account_email_confirmation_send", method: "POST", path: "/me/email/confirmation", pathParams: [], scope: "account:profile:write", danger: "write", approval: true, body: false, pagination: null },
+  "account.mfa.sms.remove": { action: "account.mfa.sms.remove", operationId: "account_mfa_sms_remove", method: "DELETE", path: "/me/mfa/sms", pathParams: [], scope: "account:sign_in:write", danger: "critical", approval: true, body: false, pagination: null },
   "account.organizations.leave": { action: "account.organizations.leave", operationId: "account_organizations_leave", method: "POST", path: "/me/organizations/{organization_id}/leave", pathParams: ["organization_id"], scope: "account:organizations:write", danger: "destructive", approval: true, body: false, pagination: null },
   "account.passkeys.remove": { action: "account.passkeys.remove", operationId: "account_passkeys_remove", method: "DELETE", path: "/me/passkeys/{passkey_id}", pathParams: ["passkey_id"], scope: "account:sign_in:write", danger: "critical", approval: true, body: false, pagination: null },
+  "account.passkeys.rename": { action: "account.passkeys.rename", operationId: "account_passkeys_rename", method: "PATCH", path: "/me/passkeys/{passkey_id}", pathParams: ["passkey_id"], scope: "account:sign_in:write", danger: "write", approval: true, body: true, pagination: null },
+  "account.pipes.disconnect": { action: "account.pipes.disconnect", operationId: "account_pipes_disconnect", method: "DELETE", path: "/me/pipes/{provider}", pathParams: ["provider"], scope: "account:pipes:write", danger: "destructive", approval: true, body: false, pagination: null },
   "account.profile.update": { action: "account.profile.update", operationId: "account_profile_update", method: "PATCH", path: "/me/profile", pathParams: [], scope: "account:profile:write", danger: "write", approval: true, body: true, pagination: null },
   "account.sessions.revoke": { action: "account.sessions.revoke", operationId: "account_sessions_revoke", method: "DELETE", path: "/me/sessions/{session_id}", pathParams: ["session_id"], scope: "account:sessions:write", danger: "destructive", approval: true, body: false, pagination: null },
   "account.sessions.revoke_others": { action: "account.sessions.revoke_others", operationId: "account_sessions_revoke_others", method: "POST", path: "/me/sessions/revoke-others", pathParams: [], scope: "account:sessions:write", danger: "critical", approval: true, body: false, pagination: null },
-  "account.social.unlink": { action: "account.social.unlink", operationId: "account_social_unlink", method: "DELETE", path: "/me/social/{provider}", pathParams: ["provider"], scope: "account:sign_in:write", danger: "critical", approval: true, body: false, pagination: null }
+  "account.sign_in_methods.disconnect": { action: "account.sign_in_methods.disconnect", operationId: "account_sign_in_methods_disconnect", method: "DELETE", path: "/me/sign-in-methods/{identity_id}", pathParams: ["identity_id"], scope: "account:sign_in:write", danger: "critical", approval: true, body: false, pagination: null },
+  "account.social.unlink": { action: "account.social.unlink", operationId: "account_social_unlink", method: "DELETE", path: "/me/social/{provider}", pathParams: ["provider"], scope: "account:sign_in:write", danger: "critical", approval: true, body: false, pagination: null },
+  "account.totp.remove": { action: "account.totp.remove", operationId: "account_totp_remove", method: "DELETE", path: "/me/two-factor/apps/{factor_id}", pathParams: ["factor_id"], scope: "account:sign_in:write", danger: "critical", approval: true, body: false, pagination: null },
+  "account.totp.rename": { action: "account.totp.rename", operationId: "account_totp_rename", method: "PATCH", path: "/me/two-factor/apps/{factor_id}", pathParams: ["factor_id"], scope: "account:sign_in:write", danger: "write", approval: true, body: true, pagination: null },
+  "account.waitlists.join": { action: "account.waitlists.join", operationId: "account_waitlists_join", method: "POST", path: "/me/services/{program}/waitlist", pathParams: ["program"], scope: "account:waitlists:write", danger: "write", approval: true, body: true, pagination: null },
+  "account.waitlists.leave": { action: "account.waitlists.leave", operationId: "account_waitlists_leave", method: "POST", path: "/me/services/{program}/waitlist/leave", pathParams: ["program"], scope: "account:waitlists:write", danger: "write", approval: true, body: true, pagination: null }
 };
 var AccountClient = class {
   /** The transport every method runs on — authentication, retries, approvals. */
@@ -3953,6 +4858,19 @@ var AccountClient = class {
      */
     revoke: (clientId, options) => this.transport.call(accountOperations["account.applications.revoke"], [clientId], void 0, options)
   };
+  apps = {
+    /**
+     * List the published apps visible to you in this environment. Optional organization context must be one you actively belong to.
+     *
+     * Requires scope `account:apps:read` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: read.
+     *
+     * `GET /me/apps` · action `account.apps.list`
+     * @scope `account:apps:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    list: (query, options) => this.transport.call(accountOperations["account.apps.list"], [], query, options)
+  };
   devices = {
     /**
      * Remove one of your trusted devices; it is no longer asked to approve anything.
@@ -3966,6 +4884,36 @@ var AccountClient = class {
      */
     remove: (deviceId, options) => this.transport.call(accountOperations["account.devices.remove"], [deviceId], void 0, options)
   };
+  email = {
+    confirmation: {
+      /**
+       * Mail yourself a link that confirms your email address.
+       *
+       * Requires scope `account:profile:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: write.
+       *
+       * `POST /me/email/confirmation` · action `account.email.confirmation.send`
+       * @scope `account:profile:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      send: (options) => this.transport.call(accountOperations["account.email.confirmation.send"], [], void 0, options)
+    }
+  };
+  mfa = {
+    sms: {
+      /**
+       * Remove your phone number for text-message sign-in codes.
+       *
+       * Requires scope `account:sign_in:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: critical.
+       *
+       * `DELETE /me/mfa/sms` · action `account.mfa.sms.remove`
+       * @scope `account:sign_in:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      remove: (options) => this.transport.call(accountOperations["account.mfa.sms.remove"], [], void 0, options)
+    }
+  };
   organizations = {
     /**
      * Leave one of your own organizations. The last owner cannot leave — transfer ownership first.
@@ -3990,7 +4938,31 @@ var AccountClient = class {
      * @danger critical
      * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
      */
-    remove: (passkeyId, options) => this.transport.call(accountOperations["account.passkeys.remove"], [passkeyId], void 0, options)
+    remove: (passkeyId, options) => this.transport.call(accountOperations["account.passkeys.remove"], [passkeyId], void 0, options),
+    /**
+     * Rename one of your passkeys.
+     *
+     * Requires scope `account:sign_in:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: write.
+     *
+     * `PATCH /me/passkeys/{passkey_id}` · action `account.passkeys.rename`
+     * @scope `account:sign_in:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    rename: (passkeyId, body, options) => this.transport.call(accountOperations["account.passkeys.rename"], [passkeyId], body, options)
+  };
+  pipes = {
+    /**
+     * Disconnect one of your connected services, revoking the access you gave it.
+     *
+     * Requires scope `account:pipes:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: destructive.
+     *
+     * `DELETE /me/pipes/{provider}` · action `account.pipes.disconnect`
+     * @scope `account:pipes:write`
+     * @danger destructive
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    disconnect: (provider, options) => this.transport.call(accountOperations["account.pipes.disconnect"], [provider], void 0, options)
   };
   profile = {
     /**
@@ -4029,6 +5001,19 @@ var AccountClient = class {
      */
     revokeOthers: (options) => this.transport.call(accountOperations["account.sessions.revoke_others"], [], void 0, options)
   };
+  signInMethods = {
+    /**
+     * Disconnect one linked sign-in identity (Google, GitHub, …) from your account — never the last way you can sign in.
+     *
+     * Requires scope `account:sign_in:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: critical.
+     *
+     * `DELETE /me/sign-in-methods/{identity_id}` · action `account.sign_in_methods.disconnect`
+     * @scope `account:sign_in:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    disconnect: (identityId, options) => this.transport.call(accountOperations["account.sign_in_methods.disconnect"], [identityId], void 0, options)
+  };
   social = {
     /**
      * Disconnect a social account from yours — never the last way you can sign in.
@@ -4042,6 +5027,54 @@ var AccountClient = class {
      */
     unlink: (provider, options) => this.transport.call(accountOperations["account.social.unlink"], [provider], void 0, options)
   };
+  totp = {
+    /**
+     * Remove one of your authenticator apps.
+     *
+     * Requires scope `account:sign_in:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: critical.
+     *
+     * `DELETE /me/two-factor/apps/{factor_id}` · action `account.totp.remove`
+     * @scope `account:sign_in:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    remove: (factorId, options) => this.transport.call(accountOperations["account.totp.remove"], [factorId], void 0, options),
+    /**
+     * Rename one of your authenticator apps.
+     *
+     * Requires scope `account:sign_in:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: write.
+     *
+     * `PATCH /me/two-factor/apps/{factor_id}` · action `account.totp.rename`
+     * @scope `account:sign_in:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    rename: (factorId, body, options) => this.transport.call(accountOperations["account.totp.rename"], [factorId], body, options)
+  };
+  waitlists = {
+    /**
+     * Join a published service waitlist with your verified email. Does not buy a plan or grant access.
+     *
+     * Requires scope `account:waitlists:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: write.
+     *
+     * `POST /me/services/{program}/waitlist` · action `account.waitlists.join`
+     * @scope `account:waitlists:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    join: (program, body, options) => this.transport.call(accountOperations["account.waitlists.join"], [program], body, options),
+    /**
+     * Withdraw your own feature interest or beta application for a team. Active grants are managed by the service.
+     *
+     * Requires scope `account:waitlists:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: write.
+     *
+     * `POST /me/services/{program}/waitlist/leave` · action `account.waitlists.leave`
+     * @scope `account:waitlists:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    leave: (program, body, options) => this.transport.call(accountOperations["account.waitlists.leave"], [program], body, options)
+  };
 };
 
 // src/management/dpop.ts
@@ -4330,6 +5363,25 @@ async function verifyAuditLogChain(client, query, options = {}) {
   return verifyAuditChain(client.auditLogs.events.listAll({ ...query, order: "asc" }), options);
 }
 
-export { AUDIT_CHAIN_GENESIS, AccountClient, ApprovalDeniedError, ApprovalError, ApprovalExpiredError, AuditLogExportError, AuditLogger, CboxIdApiError, EnvironmentClient, MAX_AUDIT_BATCH, ManagementNetworkError, ManagementTransport, PlatformClient, WorkspaceClient, accountOperations, auditEventDocument, auditEventHash, canonicalJson, createDPoPSigner, environmentOperations, exportAuditLogs, generateDPoPKeyPair, platformOperations, retryAfterMs, verifyAuditChain, verifyAuditLogChain, workspaceOperations };
+// src/management/fga.ts
+function fgaTuple(tuple) {
+  const name = (value, what) => {
+    if (value === "" || /[\s#@:]/.test(value)) {
+      throw new TypeError(`An FGA ${what} cannot be empty or contain whitespace, '#', '@' or ':': ${JSON.stringify(value)}`);
+    }
+    return value;
+  };
+  const id = (value, what) => {
+    if (value === "" || /[\s#@]/.test(value)) {
+      throw new TypeError(`An FGA ${what} cannot be empty or contain whitespace, '#' or '@': ${JSON.stringify(value)}`);
+    }
+    return value;
+  };
+  const subject = `${name(tuple.subject.type, "subject type")}:${id(tuple.subject.id, "subject id")}`;
+  const userset = tuple.subject.relation ? `#${name(tuple.subject.relation, "subject relation")}` : "";
+  return `${name(tuple.resource_type, "resource type")}:${id(tuple.resource_id, "resource id")}#${name(tuple.relation, "relation")}@${subject}${userset}`;
+}
+
+export { AUDIT_CHAIN_GENESIS, AccountClient, ApprovalDeniedError, ApprovalError, ApprovalExpiredError, AuditLogExportError, AuditLogger, CboxIdApiError, EnvironmentClient, MAX_AUDIT_BATCH, ManagementNetworkError, ManagementTransport, PlatformClient, WorkspaceClient, accountOperations, auditEventDocument, auditEventHash, canonicalJson, createDPoPSigner, environmentOperations, exportAuditLogs, fgaTuple, generateDPoPKeyPair, platformOperations, retryAfterMs, verifyAuditChain, verifyAuditLogChain, workspaceOperations };
 //# sourceMappingURL=management.js.map
 //# sourceMappingURL=management.js.map