@constructive-sdk/cli 1.20.2 → 1.20.3

package/auth/orm/input-types.d.ts

@@ -238,6 +238,8 @@ export interface AuditLogAuth {
     /** User who performed the authentication action; NULL if user was deleted */
     actorId?: string | null;
     createdAt?: string | null;
+    /** Event-specific structured payload (e.g. preset slug and catalog commit id for create_principal_from_preset) */
+    details?: Record<string, unknown> | null;
     /** Type of authentication event (e.g. sign_in, sign_up, password_change, verify_email) */
     event?: string | null;
     /** Unique identifier for each audit event (uuidv7 provides temporal ordering) */
@@ -303,7 +305,7 @@ export interface OrgApiKeyList {
 }
 /** User phone numbers with country code, verification, and primary-number management */
 export interface PhoneNumber {
-    /** Country calling code (e.g. +1, +44) */
+    /** Country calling code the number was entered under (e.g. +1, +44). Display only: `number` already carries it, and sign-in matches `number`. */
     cc?: string | null;
     createdAt?: string | null;
     id: string;
@@ -313,16 +315,24 @@ export interface PhoneNumber {
     isVerified?: boolean | null;
     /** Optional user-provided label for this phone number (e.g. "Mobile", "Work"). */
     name?: string | null;
-    /** The phone number without country code */
+    /** The full number in E.164 form, country calling code included (e.g. +15551234567). This is the value SMS sign-in and MFA match, so it is unique across the table and constrained to that shape. */
     number?: string | null;
     ownerId?: string | null;
     updatedAt?: string | null;
 }
 /** Scoped sub-identities (API keys and agents) with precomputed SPRT */
 export interface Principal {
+    /** Upper bound on the lifetime of API keys minted for this principal; clamps expires_in below auth_settings.api_key_max_duration. NULL means no additional cap */
+    apiKeyMaxDuration?: string | null;
     /** Whether this principal bypasses MFA step-up requirements */
     bypassStepUp?: boolean | null;
     createdAt?: string | null;
+    /** Session that minted this child principal; NULL for principals created outside a session chain */
+    createdBySessionId?: string | null;
+    /** Depth of this principal below its owner-derived root (0 for standing principals), bounded by auth_settings.max_principal_depth */
+    depth?: number | null;
+    /** When this ephemeral child principal expires; NULL for standing principals */
+    expiresAt?: string | null;
     id: string;
     /** Whether this principal is restricted to read-only operations */
     isReadOnly?: boolean | null;
@@ -330,6 +340,8 @@ export interface Principal {
     name?: string | null;
     /** The human user who owns and manages this principal */
     ownerId?: string | null;
+    /** Principal this child principal derives its authority from; NULL for principals that derive from owner_id */
+    parentPrincipalId?: string | null;
     updatedAt?: string | null;
     /** Whether this principal inherits admin/owner privileges from the owner */
     useAdminOwner?: boolean | null;
@@ -348,9 +360,9 @@ export interface PrincipalEntity {
     principalId?: string | null;
     updatedAt?: string | null;
 }
-/** Per-scope permission overrides for principals. No row = full access; row exists = apply restrictions. */
+/** Per-scope capability overrides for principals. No row = full access; row exists = apply restrictions. */
 export interface PrincipalScopeOverride {
-    /** Optional permission mask; AND-masked with parent permissions during cascade. NULL means no extra mask. */
+    /** Optional capability mask; AND-masked with parent capabilities during cascade. NULL means no extra mask. */
     allowedMask?: string | null;
     createdAt?: string | null;
     id: string;
@@ -396,6 +408,32 @@ export interface User {
     updatedAt?: string | null;
     username?: string | null;
 }
+/** Per-user settings and preferences. Extended by other modules (i18n, notifications, MFA) via metaschema.create_field(). */
+export interface UserSetting {
+    createdAt?: string | null;
+    id: string;
+    ownerId?: string | null;
+    updatedAt?: string | null;
+}
+/** Per-user security settings for MFA configuration (separate from user_settings preferences) */
+export interface UserSettingsSecurity {
+    /** Number of remaining unused backup codes */
+    backupCodesCount?: number | null;
+    createdAt?: string | null;
+    /** Whether email-based MFA codes are active for this user */
+    emailMfaEnabled?: boolean | null;
+    id: string;
+    /** When the first MFA method was enabled */
+    mfaEnrolledAt?: string | null;
+    /** When MFA was last successfully verified */
+    mfaLastUsedAt?: string | null;
+    ownerId?: string | null;
+    /** Whether SMS-based MFA codes are active for this user */
+    smsMfaEnabled?: boolean | null;
+    /** Whether TOTP (authenticator app) MFA is active for this user */
+    totpEnabled?: boolean | null;
+    updatedAt?: string | null;
+}
 /** WebAuthn/passkey credentials owned by users. One row per registered authenticator (security key, device biometric, synced passkey). Schema mirrors SimpleWebAuthn's canonical Passkey object. */
 export interface WebauthnCredential {
     /** Whether this credential is eligible for backup (syncing) per the authenticator's flags at registration. */
@@ -452,7 +490,9 @@ export interface PhoneNumberRelations {
 }
 export interface PrincipalRelations {
     owner?: User | null;
+    parentPrincipal?: Principal | null;
     user?: User | null;
+    child_principals?: ConnectionResult<Principal>;
     principalEntities?: ConnectionResult<PrincipalEntity>;
     principalScopeOverrides?: ConnectionResult<PrincipalScopeOverride>;
 }
@@ -469,6 +509,8 @@ export interface RoleTypeRelations {
 export interface UserConnectedAccountRelations {
 }
 export interface UserRelations {
+    ownedUserSetting?: UserSetting | null;
+    ownedUserSettingsSecurity?: UserSettingsSecurity | null;
     roleType?: RoleType | null;
     authAuditLog?: ConnectionResult<AuditLogAuth>;
     cryptoAddresses?: ConnectionResult<CryptoAddress>;
@@ -478,6 +520,12 @@ export interface UserRelations {
     scopedPrincipals?: ConnectionResult<PrincipalEntity>;
     webauthnCredentials?: ConnectionResult<WebauthnCredential>;
 }
+export interface UserSettingRelations {
+    owner?: User | null;
+}
+export interface UserSettingsSecurityRelations {
+    owner?: User | null;
+}
 export interface WebauthnCredentialRelations {
     owner?: User | null;
 }
@@ -493,10 +541,13 @@ export type PrincipalScopeOverrideWithRelations = PrincipalScopeOverride & Princ
 export type RoleTypeWithRelations = RoleType & RoleTypeRelations;
 export type UserConnectedAccountWithRelations = UserConnectedAccount & UserConnectedAccountRelations;
 export type UserWithRelations = User & UserRelations;
+export type UserSettingWithRelations = UserSetting & UserSettingRelations;
+export type UserSettingsSecurityWithRelations = UserSettingsSecurity & UserSettingsSecurityRelations;
 export type WebauthnCredentialWithRelations = WebauthnCredential & WebauthnCredentialRelations;
 export type AuditLogAuthSelect = {
     actorId?: boolean;
     createdAt?: boolean;
+    details?: boolean;
     event?: boolean;
     id?: boolean;
     ipAddress?: boolean;
@@ -568,21 +619,35 @@ export type PhoneNumberSelect = {
     };
 };
 export type PrincipalSelect = {
+    apiKeyMaxDuration?: boolean;
     bypassStepUp?: boolean;
     createdAt?: boolean;
+    createdBySessionId?: boolean;
+    depth?: boolean;
+    expiresAt?: boolean;
     id?: boolean;
     isReadOnly?: boolean;
     name?: boolean;
     ownerId?: boolean;
+    parentPrincipalId?: boolean;
     updatedAt?: boolean;
     useAdminOwner?: boolean;
     userId?: boolean;
     owner?: {
         select: UserSelect;
     };
+    parentPrincipal?: {
+        select: PrincipalSelect;
+    };
     user?: {
         select: UserSelect;
     };
+    child_principals?: {
+        select: PrincipalSelect;
+        first?: number;
+        filter?: PrincipalFilter;
+        orderBy?: PrincipalOrderBy[];
+    };
     principalEntities?: {
         select: PrincipalEntitySelect;
         first?: number;
@@ -653,6 +718,12 @@ export type UserSelect = {
     type?: boolean;
     updatedAt?: boolean;
     username?: boolean;
+    ownedUserSetting?: {
+        select: UserSettingSelect;
+    };
+    ownedUserSettingsSecurity?: {
+        select: UserSettingsSecuritySelect;
+    };
     roleType?: {
         select: RoleTypeSelect;
     };
@@ -699,6 +770,30 @@ export type UserSelect = {
         orderBy?: WebauthnCredentialOrderBy[];
     };
 };
+export type UserSettingSelect = {
+    createdAt?: boolean;
+    id?: boolean;
+    ownerId?: boolean;
+    updatedAt?: boolean;
+    owner?: {
+        select: UserSelect;
+    };
+};
+export type UserSettingsSecuritySelect = {
+    backupCodesCount?: boolean;
+    createdAt?: boolean;
+    emailMfaEnabled?: boolean;
+    id?: boolean;
+    mfaEnrolledAt?: boolean;
+    mfaLastUsedAt?: boolean;
+    ownerId?: boolean;
+    smsMfaEnabled?: boolean;
+    totpEnabled?: boolean;
+    updatedAt?: boolean;
+    owner?: {
+        select: UserSelect;
+    };
+};
 export type WebauthnCredentialSelect = {
     backupEligible?: boolean;
     backupState?: boolean;
@@ -729,6 +824,8 @@ export interface AuditLogAuthFilter {
     and?: AuditLogAuthFilter[];
     /** Filter by the object’s `createdAt` field. */
     createdAt?: DatetimeFilter;
+    /** Filter by the object’s `details` field. */
+    details?: JSONFilter;
     /** Filter by the object’s `event` field. */
     event?: StringFilter;
     /** Filter by the object’s `id` field. */
@@ -877,10 +974,22 @@ export interface PhoneNumberFilter {
 export interface PrincipalFilter {
     /** Checks for all expressions in this list. */
     and?: PrincipalFilter[];
+    /** Filter by the object’s `apiKeyMaxDuration` field. */
+    apiKeyMaxDuration?: IntervalFilter;
     /** Filter by the object’s `bypassStepUp` field. */
     bypassStepUp?: BooleanFilter;
+    /** Filter by the object’s `child_principals` relation. */
+    child_principals?: PrincipalToManyPrincipalFilter;
+    /** `child_principals` exist. */
+    child_principalsExist?: boolean;
     /** Filter by the object’s `createdAt` field. */
     createdAt?: DatetimeFilter;
+    /** Filter by the object’s `createdBySessionId` field. */
+    createdBySessionId?: UUIDFilter;
+    /** Filter by the object’s `depth` field. */
+    depth?: IntFilter;
+    /** Filter by the object’s `expiresAt` field. */
+    expiresAt?: DatetimeFilter;
     /** Filter by the object’s `id` field. */
     id?: UUIDFilter;
     /** Filter by the object’s `isReadOnly` field. */
@@ -895,6 +1004,12 @@ export interface PrincipalFilter {
     owner?: UserFilter;
     /** Filter by the object’s `ownerId` field. */
     ownerId?: UUIDFilter;
+    /** Filter by the object’s `parentPrincipal` relation. */
+    parentPrincipal?: PrincipalFilter;
+    /** A related `parentPrincipal` exists. */
+    parentPrincipalExists?: boolean;
+    /** Filter by the object’s `parentPrincipalId` field. */
+    parentPrincipalId?: UUIDFilter;
     /** Filter by the object’s `principalEntities` relation. */
     principalEntities?: PrincipalToManyPrincipalEntityFilter;
     /** `principalEntities` exist. */
@@ -1027,6 +1142,14 @@ export interface UserFilter {
     not?: UserFilter;
     /** Checks for any expressions in this list. */
     or?: UserFilter[];
+    /** Filter by the object’s `ownedUserSetting` relation. */
+    ownedUserSetting?: UserSettingFilter;
+    /** A related `ownedUserSetting` exists. */
+    ownedUserSettingExists?: boolean;
+    /** Filter by the object’s `ownedUserSettingsSecurity` relation. */
+    ownedUserSettingsSecurity?: UserSettingsSecurityFilter;
+    /** A related `ownedUserSettingsSecurity` exists. */
+    ownedUserSettingsSecurityExists?: boolean;
     /** Filter by the object’s `phoneNumbers` relation. */
     phoneNumbers?: UserToManyPhoneNumberFilter;
     /** `phoneNumbers` exist. */
@@ -1068,6 +1191,54 @@ export interface UserFilter {
     /** `webauthnCredentials` exist. */
     webauthnCredentialsExist?: boolean;
 }
+export interface UserSettingFilter {
+    /** Checks for all expressions in this list. */
+    and?: UserSettingFilter[];
+    /** Filter by the object’s `createdAt` field. */
+    createdAt?: DatetimeFilter;
+    /** Filter by the object’s `id` field. */
+    id?: UUIDFilter;
+    /** Negates the expression. */
+    not?: UserSettingFilter;
+    /** Checks for any expressions in this list. */
+    or?: UserSettingFilter[];
+    /** Filter by the object’s `owner` relation. */
+    owner?: UserFilter;
+    /** Filter by the object’s `ownerId` field. */
+    ownerId?: UUIDFilter;
+    /** Filter by the object’s `updatedAt` field. */
+    updatedAt?: DatetimeFilter;
+}
+export interface UserSettingsSecurityFilter {
+    /** Checks for all expressions in this list. */
+    and?: UserSettingsSecurityFilter[];
+    /** Filter by the object’s `backupCodesCount` field. */
+    backupCodesCount?: IntFilter;
+    /** Filter by the object’s `createdAt` field. */
+    createdAt?: DatetimeFilter;
+    /** Filter by the object’s `emailMfaEnabled` field. */
+    emailMfaEnabled?: BooleanFilter;
+    /** Filter by the object’s `id` field. */
+    id?: UUIDFilter;
+    /** Filter by the object’s `mfaEnrolledAt` field. */
+    mfaEnrolledAt?: DatetimeFilter;
+    /** Filter by the object’s `mfaLastUsedAt` field. */
+    mfaLastUsedAt?: DatetimeFilter;
+    /** Negates the expression. */
+    not?: UserSettingsSecurityFilter;
+    /** Checks for any expressions in this list. */
+    or?: UserSettingsSecurityFilter[];
+    /** Filter by the object’s `owner` relation. */
+    owner?: UserFilter;
+    /** Filter by the object’s `ownerId` field. */
+    ownerId?: UUIDFilter;
+    /** Filter by the object’s `smsMfaEnabled` field. */
+    smsMfaEnabled?: BooleanFilter;
+    /** Filter by the object’s `totpEnabled` field. */
+    totpEnabled?: BooleanFilter;
+    /** Filter by the object’s `updatedAt` field. */
+    updatedAt?: DatetimeFilter;
+}
 export interface WebauthnCredentialFilter {
     /** Checks for all expressions in this list. */
     and?: WebauthnCredentialFilter[];
@@ -1106,23 +1277,26 @@ export interface WebauthnCredentialFilter {
     /** Filter by the object’s `webauthnUserId` field. */
     webauthnUserId?: StringFilter;
 }
-export type AuditLogAuthOrderBy = 'ACTOR_ID_ASC' | 'ACTOR_ID_DESC' | 'CREATED_AT_ASC' | 'CREATED_AT_DESC' | 'EVENT_ASC' | 'EVENT_DESC' | 'ID_ASC' | 'ID_DESC' | 'IP_ADDRESS_ASC' | 'IP_ADDRESS_DESC' | 'NATURAL' | 'ORIGIN_ASC' | 'ORIGIN_DESC' | 'PRIMARY_KEY_ASC' | 'PRIMARY_KEY_DESC' | 'SUCCESS_ASC' | 'SUCCESS_DESC' | 'USER_AGENT_ASC' | 'USER_AGENT_DESC';
+export type AuditLogAuthOrderBy = 'ACTOR_ID_ASC' | 'ACTOR_ID_DESC' | 'CREATED_AT_ASC' | 'CREATED_AT_DESC' | 'DETAILS_ASC' | 'DETAILS_DESC' | 'EVENT_ASC' | 'EVENT_DESC' | 'ID_ASC' | 'ID_DESC' | 'IP_ADDRESS_ASC' | 'IP_ADDRESS_DESC' | 'NATURAL' | 'ORIGIN_ASC' | 'ORIGIN_DESC' | 'PRIMARY_KEY_ASC' | 'PRIMARY_KEY_DESC' | 'SUCCESS_ASC' | 'SUCCESS_DESC' | 'USER_AGENT_ASC' | 'USER_AGENT_DESC';
 export type CryptoAddressOrderBy = 'ADDRESS_ASC' | 'ADDRESS_DESC' | 'CREATED_AT_ASC' | 'CREATED_AT_DESC' | 'ID_ASC' | 'ID_DESC' | 'IS_PRIMARY_ASC' | 'IS_PRIMARY_DESC' | 'IS_VERIFIED_ASC' | 'IS_VERIFIED_DESC' | 'NAME_ASC' | 'NAME_DESC' | 'NATURAL' | 'OWNER_ID_ASC' | 'OWNER_ID_DESC' | 'PRIMARY_KEY_ASC' | 'PRIMARY_KEY_DESC' | 'UPDATED_AT_ASC' | 'UPDATED_AT_DESC';
 export type EmailOrderBy = 'CREATED_AT_ASC' | 'CREATED_AT_DESC' | 'EMAIL_ASC' | 'EMAIL_DESC' | 'ID_ASC' | 'ID_DESC' | 'IS_PRIMARY_ASC' | 'IS_PRIMARY_DESC' | 'IS_VERIFIED_ASC' | 'IS_VERIFIED_DESC' | 'NAME_ASC' | 'NAME_DESC' | 'NATURAL' | 'OWNER_ID_ASC' | 'OWNER_ID_DESC' | 'PRIMARY_KEY_ASC' | 'PRIMARY_KEY_DESC' | 'UPDATED_AT_ASC' | 'UPDATED_AT_DESC';
 export type IdentityProviderOrderBy = 'DISPLAY_NAME_ASC' | 'DISPLAY_NAME_DESC' | 'ENABLED_ASC' | 'ENABLED_DESC' | 'KIND_ASC' | 'KIND_DESC' | 'NATURAL' | 'SLUG_ASC' | 'SLUG_DESC';
 export type OrgApiKeyListOrderBy = 'ACCESS_LEVEL_ASC' | 'ACCESS_LEVEL_DESC' | 'CREATED_AT_ASC' | 'CREATED_AT_DESC' | 'EXPIRES_AT_ASC' | 'EXPIRES_AT_DESC' | 'ID_ASC' | 'ID_DESC' | 'KEY_ID_ASC' | 'KEY_ID_DESC' | 'LAST_USED_AT_ASC' | 'LAST_USED_AT_DESC' | 'MFA_LEVEL_ASC' | 'MFA_LEVEL_DESC' | 'NAME_ASC' | 'NAME_DESC' | 'NATURAL' | 'ORG_ID_ASC' | 'ORG_ID_DESC' | 'PRINCIPAL_ID_ASC' | 'PRINCIPAL_ID_DESC' | 'REVOKED_AT_ASC' | 'REVOKED_AT_DESC' | 'UPDATED_AT_ASC' | 'UPDATED_AT_DESC';
 export type PhoneNumberOrderBy = 'CC_ASC' | 'CC_DESC' | 'CREATED_AT_ASC' | 'CREATED_AT_DESC' | 'ID_ASC' | 'ID_DESC' | 'IS_PRIMARY_ASC' | 'IS_PRIMARY_DESC' | 'IS_VERIFIED_ASC' | 'IS_VERIFIED_DESC' | 'NAME_ASC' | 'NAME_DESC' | 'NATURAL' | 'NUMBER_ASC' | 'NUMBER_DESC' | 'OWNER_ID_ASC' | 'OWNER_ID_DESC' | 'PRIMARY_KEY_ASC' | 'PRIMARY_KEY_DESC' | 'UPDATED_AT_ASC' | 'UPDATED_AT_DESC';
-export type PrincipalOrderBy = 'BYPASS_STEP_UP_ASC' | 'BYPASS_STEP_UP_DESC' | 'CREATED_AT_ASC' | 'CREATED_AT_DESC' | 'ID_ASC' | 'ID_DESC' | 'IS_READ_ONLY_ASC' | 'IS_READ_ONLY_DESC' | 'NAME_ASC' | 'NAME_DESC' | 'NATURAL' | 'OWNER_ID_ASC' | 'OWNER_ID_DESC' | 'PRIMARY_KEY_ASC' | 'PRIMARY_KEY_DESC' | 'UPDATED_AT_ASC' | 'UPDATED_AT_DESC' | 'USER_ID_ASC' | 'USER_ID_DESC' | 'USE_ADMIN_OWNER_ASC' | 'USE_ADMIN_OWNER_DESC';
+export type PrincipalOrderBy = 'API_KEY_MAX_DURATION_ASC' | 'API_KEY_MAX_DURATION_DESC' | 'BYPASS_STEP_UP_ASC' | 'BYPASS_STEP_UP_DESC' | 'CREATED_AT_ASC' | 'CREATED_AT_DESC' | 'CREATED_BY_SESSION_ID_ASC' | 'CREATED_BY_SESSION_ID_DESC' | 'DEPTH_ASC' | 'DEPTH_DESC' | 'EXPIRES_AT_ASC' | 'EXPIRES_AT_DESC' | 'ID_ASC' | 'ID_DESC' | 'IS_READ_ONLY_ASC' | 'IS_READ_ONLY_DESC' | 'NAME_ASC' | 'NAME_DESC' | 'NATURAL' | 'OWNER_ID_ASC' | 'OWNER_ID_DESC' | 'PARENT_PRINCIPAL_ID_ASC' | 'PARENT_PRINCIPAL_ID_DESC' | 'PRIMARY_KEY_ASC' | 'PRIMARY_KEY_DESC' | 'UPDATED_AT_ASC' | 'UPDATED_AT_DESC' | 'USER_ID_ASC' | 'USER_ID_DESC' | 'USE_ADMIN_OWNER_ASC' | 'USE_ADMIN_OWNER_DESC';
 export type PrincipalEntityOrderBy = 'CREATED_AT_ASC' | 'CREATED_AT_DESC' | 'ENTITY_ID_ASC' | 'ENTITY_ID_DESC' | 'ID_ASC' | 'ID_DESC' | 'NATURAL' | 'OWNER_ID_ASC' | 'OWNER_ID_DESC' | 'PRIMARY_KEY_ASC' | 'PRIMARY_KEY_DESC' | 'PRINCIPAL_ID_ASC' | 'PRINCIPAL_ID_DESC' | 'UPDATED_AT_ASC' | 'UPDATED_AT_DESC';
 export type PrincipalScopeOverrideOrderBy = 'ALLOWED_MASK_ASC' | 'ALLOWED_MASK_DESC' | 'CREATED_AT_ASC' | 'CREATED_AT_DESC' | 'ID_ASC' | 'ID_DESC' | 'IS_ACTIVE_ASC' | 'IS_ACTIVE_DESC' | 'IS_READ_ONLY_ASC' | 'IS_READ_ONLY_DESC' | 'MEMBERSHIP_TYPE_ASC' | 'MEMBERSHIP_TYPE_DESC' | 'NATURAL' | 'PRIMARY_KEY_ASC' | 'PRIMARY_KEY_DESC' | 'PRINCIPAL_ID_ASC' | 'PRINCIPAL_ID_DESC' | 'UPDATED_AT_ASC' | 'UPDATED_AT_DESC' | 'USE_ADMIN_OWNER_ASC' | 'USE_ADMIN_OWNER_DESC';
 export type RoleTypeOrderBy = 'ID_ASC' | 'ID_DESC' | 'NAME_ASC' | 'NAME_DESC' | 'NATURAL' | 'PRIMARY_KEY_ASC' | 'PRIMARY_KEY_DESC';
 export type UserConnectedAccountOrderBy = 'CREATED_AT_ASC' | 'CREATED_AT_DESC' | 'DETAILS_ASC' | 'DETAILS_DESC' | 'IDENTIFIER_ASC' | 'IDENTIFIER_DESC' | 'ID_ASC' | 'ID_DESC' | 'IS_VERIFIED_ASC' | 'IS_VERIFIED_DESC' | 'NATURAL' | 'OWNER_ID_ASC' | 'OWNER_ID_DESC' | 'SERVICE_ASC' | 'SERVICE_DESC' | 'UPDATED_AT_ASC' | 'UPDATED_AT_DESC';
 export type UserOrderBy = 'CREATED_AT_ASC' | 'CREATED_AT_DESC' | 'DISPLAY_NAME_ASC' | 'DISPLAY_NAME_DESC' | 'DISPLAY_NAME_TRGM_SIMILARITY_ASC' | 'DISPLAY_NAME_TRGM_SIMILARITY_DESC' | 'ID_ASC' | 'ID_DESC' | 'NATURAL' | 'PRIMARY_KEY_ASC' | 'PRIMARY_KEY_DESC' | 'PROFILE_PICTURE_ASC' | 'PROFILE_PICTURE_DESC' | 'SEARCH_SCORE_ASC' | 'SEARCH_SCORE_DESC' | 'SEARCH_TSV_ASC' | 'SEARCH_TSV_DESC' | 'SEARCH_TSV_RANK_ASC' | 'SEARCH_TSV_RANK_DESC' | 'TYPE_ASC' | 'TYPE_DESC' | 'UPDATED_AT_ASC' | 'UPDATED_AT_DESC' | 'USERNAME_ASC' | 'USERNAME_DESC';
+export type UserSettingOrderBy = 'CREATED_AT_ASC' | 'CREATED_AT_DESC' | 'ID_ASC' | 'ID_DESC' | 'NATURAL' | 'OWNER_ID_ASC' | 'OWNER_ID_DESC' | 'PRIMARY_KEY_ASC' | 'PRIMARY_KEY_DESC' | 'UPDATED_AT_ASC' | 'UPDATED_AT_DESC';
+export type UserSettingsSecurityOrderBy = 'BACKUP_CODES_COUNT_ASC' | 'BACKUP_CODES_COUNT_DESC' | 'CREATED_AT_ASC' | 'CREATED_AT_DESC' | 'EMAIL_MFA_ENABLED_ASC' | 'EMAIL_MFA_ENABLED_DESC' | 'ID_ASC' | 'ID_DESC' | 'MFA_ENROLLED_AT_ASC' | 'MFA_ENROLLED_AT_DESC' | 'MFA_LAST_USED_AT_ASC' | 'MFA_LAST_USED_AT_DESC' | 'NATURAL' | 'OWNER_ID_ASC' | 'OWNER_ID_DESC' | 'PRIMARY_KEY_ASC' | 'PRIMARY_KEY_DESC' | 'SMS_MFA_ENABLED_ASC' | 'SMS_MFA_ENABLED_DESC' | 'TOTP_ENABLED_ASC' | 'TOTP_ENABLED_DESC' | 'UPDATED_AT_ASC' | 'UPDATED_AT_DESC';
 export type WebauthnCredentialOrderBy = 'BACKUP_ELIGIBLE_ASC' | 'BACKUP_ELIGIBLE_DESC' | 'BACKUP_STATE_ASC' | 'BACKUP_STATE_DESC' | 'CREATED_AT_ASC' | 'CREATED_AT_DESC' | 'CREDENTIAL_DEVICE_TYPE_ASC' | 'CREDENTIAL_DEVICE_TYPE_DESC' | 'CREDENTIAL_ID_ASC' | 'CREDENTIAL_ID_DESC' | 'ID_ASC' | 'ID_DESC' | 'LAST_USED_AT_ASC' | 'LAST_USED_AT_DESC' | 'NAME_ASC' | 'NAME_DESC' | 'NATURAL' | 'OWNER_ID_ASC' | 'OWNER_ID_DESC' | 'PRIMARY_KEY_ASC' | 'PRIMARY_KEY_DESC' | 'PUBLIC_KEY_ASC' | 'PUBLIC_KEY_DESC' | 'SIGN_COUNT_ASC' | 'SIGN_COUNT_DESC' | 'TRANSPORTS_ASC' | 'TRANSPORTS_DESC' | 'UPDATED_AT_ASC' | 'UPDATED_AT_DESC' | 'WEBAUTHN_USER_ID_ASC' | 'WEBAUTHN_USER_ID_DESC';
 export interface CreateAuditLogAuthInput {
     clientMutationId?: string;
     auditLogAuth: {
         actorId?: string;
+        details?: Record<string, unknown>;
         event: string;
         ipAddress?: string;
         origin?: ConstructiveInternalTypeOrigin;
@@ -1132,6 +1306,7 @@ export interface CreateAuditLogAuthInput {
 }
 export interface AuditLogAuthPatch {
     actorId?: string | null;
+    details?: Record<string, unknown> | null;
     event?: string | null;
     ipAddress?: string | null;
     origin?: ConstructiveInternalTypeOrigin | null;
@@ -1288,19 +1463,29 @@ export interface DeletePhoneNumberInput {
 export interface CreatePrincipalInput {
     clientMutationId?: string;
     principal: {
+        apiKeyMaxDuration?: string;
         bypassStepUp?: boolean;
+        createdBySessionId: string;
+        depth?: number;
+        expiresAt?: string;
         isReadOnly?: boolean;
         name?: string;
         ownerId: string;
+        parentPrincipalId: string;
         useAdminOwner?: boolean;
         userId: string;
     };
 }
 export interface PrincipalPatch {
+    apiKeyMaxDuration?: string | null;
     bypassStepUp?: boolean | null;
+    createdBySessionId?: string | null;
+    depth?: number | null;
+    expiresAt?: string | null;
     isReadOnly?: boolean | null;
     name?: string | null;
     ownerId?: string | null;
+    parentPrincipalId?: string | null;
     useAdminOwner?: boolean | null;
     userId?: string | null;
 }
@@ -1432,6 +1617,54 @@ export interface DeleteUserInput {
     clientMutationId?: string;
     id: string;
 }
+export interface CreateUserSettingInput {
+    clientMutationId?: string;
+    userSetting: {
+        ownerId?: string;
+    };
+}
+export interface UserSettingPatch {
+    ownerId?: string | null;
+}
+export interface UpdateUserSettingInput {
+    clientMutationId?: string;
+    id: string;
+    userSettingPatch: UserSettingPatch;
+}
+export interface DeleteUserSettingInput {
+    clientMutationId?: string;
+    id: string;
+}
+export interface CreateUserSettingsSecurityInput {
+    clientMutationId?: string;
+    userSettingsSecurity: {
+        backupCodesCount?: number;
+        emailMfaEnabled?: boolean;
+        mfaEnrolledAt?: string;
+        mfaLastUsedAt?: string;
+        ownerId?: string;
+        smsMfaEnabled?: boolean;
+        totpEnabled?: boolean;
+    };
+}
+export interface UserSettingsSecurityPatch {
+    backupCodesCount?: number | null;
+    emailMfaEnabled?: boolean | null;
+    mfaEnrolledAt?: string | null;
+    mfaLastUsedAt?: string | null;
+    ownerId?: string | null;
+    smsMfaEnabled?: boolean | null;
+    totpEnabled?: boolean | null;
+}
+export interface UpdateUserSettingsSecurityInput {
+    clientMutationId?: string;
+    id: string;
+    userSettingsSecurityPatch: UserSettingsSecurityPatch;
+}
+export interface DeleteUserSettingsSecurityInput {
+    clientMutationId?: string;
+    id: string;
+}
 export interface CreateWebauthnCredentialInput {
     clientMutationId?: string;
     webauthnCredential: {
@@ -1471,15 +1704,35 @@ export interface DeleteWebauthnCredentialInput {
     id: string;
 }
 export declare const connectionFieldsMap: Record<string, Record<string, string>>;
+export interface ApproveDeviceInput {
+    approvalToken: string;
+    clientMutationId?: string;
+}
 export interface CheckPasswordInput {
     clientMutationId?: string;
     password?: string;
 }
+export interface CompleteMfaChallengeInput {
+    authMethod?: string;
+    clientMutationId?: string;
+    credentialKind?: string;
+    deviceToken?: string;
+    mfaChallengeToken?: string;
+    mfaMethod?: string;
+    rememberMe?: boolean;
+    totpCode?: string;
+    trustDevice?: boolean;
+    userId?: string;
+}
 export interface ConfirmDeleteAccountInput {
     clientMutationId?: string;
     token?: string;
     userId?: string;
 }
+export interface ConfirmTotpSetupInput {
+    clientMutationId?: string;
+    totpValue: string;
+}
 export interface CreateApiKeyInput {
     accessLevel?: string;
     clientMutationId?: string;
@@ -1488,6 +1741,16 @@ export interface CreateApiKeyInput {
     mfaLevel?: string;
     principalId?: string;
 }
+export interface CreateChildPrincipalInput {
+    allowedMask?: string;
+    clientMutationId?: string;
+    entityIds?: string[];
+    expiresAt?: string;
+    intent?: string;
+    isReadOnly?: boolean;
+    name?: string;
+    parentPrincipalId?: string;
+}
 export interface CreateOrgApiKeyInput {
     accessLevel?: string;
     clientMutationId?: string;
@@ -1505,14 +1768,40 @@ export interface CreateOrgPrincipalInput {
     orgId?: string;
     useAdminOwner?: boolean;
 }
+export interface CreatePrincipalFromPresetInput {
+    clientMutationId?: string;
+    entityIds?: string[];
+    name?: string;
+    overrides?: Record<string, unknown>;
+    slug?: string;
+}
 export interface DeleteOrgPrincipalInput {
     clientMutationId?: string;
     principalId?: string;
 }
+export interface DisableEmailMfaInput {
+    clientMutationId?: string;
+}
+export interface DisableSmsMfaInput {
+    clientMutationId?: string;
+}
+export interface DisableTotpInput {
+    clientMutationId?: string;
+    totpValue: string;
+}
 export interface DisconnectAccountInput {
     accountId: string;
     clientMutationId?: string;
 }
+export interface EnableEmailMfaInput {
+    clientMutationId?: string;
+}
+export interface EnableSmsMfaInput {
+    clientMutationId?: string;
+}
+export interface EnableTotpInput {
+    clientMutationId?: string;
+}
 export interface ExtendTokenExpiresInput {
     amount?: IntervalInput;
     clientMutationId?: string;
@@ -1521,12 +1810,21 @@ export interface ForgotPasswordInput {
     clientMutationId?: string;
     email?: ConstructiveInternalTypeEmail;
 }
+export interface GenerateBackupCodesInput {
+    clientMutationId?: string;
+}
 export interface LinkIdentityInput {
     clientMutationId?: string;
     details?: Record<string, unknown>;
     identifier: string;
     service: string;
 }
+export interface MintAccessTokenInput {
+    accessTtl?: IntervalInput;
+    clientMutationId?: string;
+    intent?: string;
+    principalId?: string;
+}
 export interface ProvisionBucketInput {
     /** The logical bucket key (e.g., "public", "private") */
     bucketKey: string;
@@ -1541,6 +1839,10 @@ export interface ProvisionNewUserInput {
     email?: string;
     password?: string;
 }
+export interface RefreshAccessTokenInput {
+    clientMutationId?: string;
+    token?: string;
+}
 export interface RequestCrossOriginTokenInput {
     clientMutationId?: string;
     email?: string;
@@ -1570,6 +1872,10 @@ export interface RevokeSessionInput {
 export interface SendAccountDeletionEmailInput {
     clientMutationId?: string;
 }
+export interface SendPhoneVerificationCodeInput {
+    clientMutationId?: string;
+    phone?: string;
+}
 export interface SendVerificationEmailInput {
     clientMutationId?: string;
     email?: ConstructiveInternalTypeEmail;
@@ -1579,6 +1885,20 @@ export interface SetPasswordInput {
     currentPassword?: string;
     newPassword?: string;
 }
+export interface SetPrincipalEntitiesInput {
+    clientMutationId?: string;
+    entityIds?: string[];
+    principalId?: string;
+}
+export interface SetPrincipalScopeInput {
+    allowedMask?: string;
+    clientMutationId?: string;
+    isActive?: boolean;
+    isReadOnly?: boolean;
+    membershipType?: number;
+    principalId?: string;
+    useAdminOwner?: boolean;
+}
 export interface SignInInput {
     clientMutationId?: string;
     credentialKind?: string;
@@ -1593,6 +1913,13 @@ export interface SignInCrossOriginInput {
     credentialKind?: string;
     token?: string;
 }
+export interface SignInMagicLinkInput {
+    clientMutationId?: string;
+    credentialKind?: string;
+    deviceToken?: string;
+    rememberMe?: boolean;
+    token?: string;
+}
 export interface SignInSmsOtpInput {
     clientMutationId?: string;
     code?: string;
@@ -1610,14 +1937,24 @@ export interface SignUpInput {
     csrfToken?: string;
     deviceToken?: string;
     email?: string;
+    inviteToken?: string;
     password?: string;
     rememberMe?: boolean;
 }
+export interface SignUpMagicLinkInput {
+    clientMutationId?: string;
+    credentialKind?: string;
+    deviceToken?: string;
+    inviteToken?: string;
+    rememberMe?: boolean;
+    token?: string;
+}
 export interface SignUpSmsInput {
     clientMutationId?: string;
     code?: string;
     credentialKind?: string;
     deviceToken?: string;
+    inviteToken?: string;
     phone?: string;
     rememberMe?: boolean;
 }
@@ -1630,6 +1967,11 @@ export interface VerifyPasswordInput {
     clientMutationId?: string;
     password: string;
 }
+export interface VerifyPhoneInput {
+    clientMutationId?: string;
+    code?: string;
+    phone?: string;
+}
 export interface VerifyTotpInput {
     clientMutationId?: string;
     totpValue: string;
@@ -1788,6 +2130,40 @@ export interface ConstructiveInternalTypeEmailFilter {
     /** Starts with the specified string (case-insensitive). */
     startsWithInsensitive?: ConstructiveInternalTypeEmail;
 }
+/** A filter to be used against Interval fields. All fields are combined with a logical ‘and.’ */
+export interface IntervalFilter {
+    /** Not equal to the specified value, treating null like an ordinary value. */
+    distinctFrom?: IntervalInput;
+    /** Equal to the specified value. */
+    equalTo?: IntervalInput;
+    /** Greater than the specified value. */
+    greaterThan?: IntervalInput;
+    /** Greater than or equal to the specified value. */
+    greaterThanOrEqualTo?: IntervalInput;
+    /** Included in the specified list. */
+    in?: IntervalInput[];
+    /** Is null (if `true` is specified) or is not null (if `false` is specified). */
+    isNull?: boolean;
+    /** Less than the specified value. */
+    lessThan?: IntervalInput;
+    /** Less than or equal to the specified value. */
+    lessThanOrEqualTo?: IntervalInput;
+    /** Equal to the specified value, treating null like an ordinary value. */
+    notDistinctFrom?: IntervalInput;
+    /** Not equal to the specified value. */
+    notEqualTo?: IntervalInput;
+    /** Not included in the specified list. */
+    notIn?: IntervalInput[];
+}
+/** A filter to be used against many `Principal` object types. All fields are combined with a logical ‘and.’ */
+export interface PrincipalToManyPrincipalFilter {
+    /** Filters to entities where every related entity matches. */
+    every?: PrincipalFilter;
+    /** Filters to entities where no related entity matches. */
+    none?: PrincipalFilter;
+    /** Filters to entities where at least one related entity matches. */
+    some?: PrincipalFilter;
+}
 /** A filter to be used against many `PrincipalEntity` object types. All fields are combined with a logical ‘and.’ */
 export interface PrincipalToManyPrincipalEntityFilter {
     /** Filters to entities where every related entity matches. */
@@ -2014,6 +2390,8 @@ export interface AuditLogAuthInput {
     /** User who performed the authentication action; NULL if user was deleted */
     actorId?: string;
     createdAt?: string;
+    /** Event-specific structured payload (e.g. preset slug and catalog commit id for create_principal_from_preset) */
+    details?: Record<string, unknown>;
     /** Type of authentication event (e.g. sign_in, sign_up, password_change, verify_email) */
     event: string;
     /** Unique identifier for each audit event (uuidv7 provides temporal ordering) */
@@ -2059,7 +2437,7 @@ export interface EmailInput {
 }
 /** An input for mutations affecting `PhoneNumber` */
 export interface PhoneNumberInput {
-    /** Country calling code (e.g. +1, +44) */
+    /** Country calling code the number was entered under (e.g. +1, +44). Display only: `number` already carries it, and sign-in matches `number`. */
     cc: string;
     createdAt?: string;
     id?: string;
@@ -2069,23 +2447,11 @@ export interface PhoneNumberInput {
     isVerified?: boolean;
     /** Optional user-provided label for this phone number (e.g. "Mobile", "Work"). */
     name?: string;
-    /** The phone number without country code */
+    /** The full number in E.164 form, country calling code included (e.g. +15551234567). This is the value SMS sign-in and MFA match, so it is unique across the table and constrained to that shape. */
     number: string;
     ownerId?: string;
     updatedAt?: string;
 }
-/** An input for mutations affecting `PrincipalEntity` */
-export interface PrincipalEntityInput {
-    createdAt?: string;
-    /** The organization this principal is scoped to */
-    entityId: string;
-    id?: string;
-    /** Denormalized owner_id from principals table for RLS */
-    ownerId: string;
-    /** The principal this scoping row belongs to */
-    principalId: string;
-    updatedAt?: string;
-}
 /** An input for mutations affecting `RoleType` */
 export interface RoleTypeInput {
     id: number;
@@ -2101,6 +2467,32 @@ export interface UserInput {
     updatedAt?: string;
     username?: string;
 }
+/** An input for mutations affecting `UserSetting` */
+export interface UserSettingInput {
+    createdAt?: string;
+    id?: string;
+    ownerId?: string;
+    updatedAt?: string;
+}
+/** An input for mutations affecting `UserSettingsSecurity` */
+export interface UserSettingsSecurityInput {
+    /** Number of remaining unused backup codes */
+    backupCodesCount?: number;
+    createdAt?: string;
+    /** Whether email-based MFA codes are active for this user */
+    emailMfaEnabled?: boolean;
+    id?: string;
+    /** When the first MFA method was enabled */
+    mfaEnrolledAt?: string;
+    /** When MFA was last successfully verified */
+    mfaLastUsedAt?: string;
+    ownerId?: string;
+    /** Whether SMS-based MFA codes are active for this user */
+    smsMfaEnabled?: boolean;
+    /** Whether TOTP (authenticator app) MFA is active for this user */
+    totpEnabled?: boolean;
+    updatedAt?: string;
+}
 /** An input for mutations affecting `WebauthnCredential` */
 export interface WebauthnCredentialInput {
     /** Whether this credential is eligible for backup (syncing) per the authenticator's flags at registration. */
@@ -2147,6 +2539,63 @@ export interface IntervalInput {
     /** A quantity of years. */
     years?: number;
 }
+/** A filter to be used against `Principal` object types. All fields are combined with a logical ‘and.’ */
+export interface PrincipalFilter {
+    /** Checks for all expressions in this list. */
+    and?: PrincipalFilter[];
+    /** Filter by the object’s `apiKeyMaxDuration` field. */
+    apiKeyMaxDuration?: IntervalFilter;
+    /** Filter by the object’s `bypassStepUp` field. */
+    bypassStepUp?: BooleanFilter;
+    /** Filter by the object’s `child_principals` relation. */
+    child_principals?: PrincipalToManyPrincipalFilter;
+    /** `child_principals` exist. */
+    child_principalsExist?: boolean;
+    /** Filter by the object’s `createdAt` field. */
+    createdAt?: DatetimeFilter;
+    /** Filter by the object’s `createdBySessionId` field. */
+    createdBySessionId?: UUIDFilter;
+    /** Filter by the object’s `depth` field. */
+    depth?: IntFilter;
+    /** Filter by the object’s `expiresAt` field. */
+    expiresAt?: DatetimeFilter;
+    /** Filter by the object’s `id` field. */
+    id?: UUIDFilter;
+    /** Filter by the object’s `isReadOnly` field. */
+    isReadOnly?: BooleanFilter;
+    /** Filter by the object’s `name` field. */
+    name?: StringFilter;
+    /** Negates the expression. */
+    not?: PrincipalFilter;
+    /** Checks for any expressions in this list. */
+    or?: PrincipalFilter[];
+    /** Filter by the object’s `owner` relation. */
+    owner?: UserFilter;
+    /** Filter by the object’s `ownerId` field. */
+    ownerId?: UUIDFilter;
+    /** Filter by the object’s `parentPrincipal` relation. */
+    parentPrincipal?: PrincipalFilter;
+    /** A related `parentPrincipal` exists. */
+    parentPrincipalExists?: boolean;
+    /** Filter by the object’s `parentPrincipalId` field. */
+    parentPrincipalId?: UUIDFilter;
+    /** Filter by the object’s `principalEntities` relation. */
+    principalEntities?: PrincipalToManyPrincipalEntityFilter;
+    /** `principalEntities` exist. */
+    principalEntitiesExist?: boolean;
+    /** Filter by the object’s `principalScopeOverrides` relation. */
+    principalScopeOverrides?: PrincipalToManyPrincipalScopeOverrideFilter;
+    /** `principalScopeOverrides` exist. */
+    principalScopeOverridesExist?: boolean;
+    /** Filter by the object’s `updatedAt` field. */
+    updatedAt?: DatetimeFilter;
+    /** Filter by the object’s `useAdminOwner` field. */
+    useAdminOwner?: BooleanFilter;
+    /** Filter by the object’s `user` relation. */
+    user?: UserFilter;
+    /** Filter by the object’s `userId` field. */
+    userId?: UUIDFilter;
+}
 /** A filter to be used against `PrincipalEntity` object types. All fields are combined with a logical ‘and.’ */
 export interface PrincipalEntityFilter {
     /** Checks for all expressions in this list. */
@@ -2215,7 +2664,9 @@ export interface AuditLogAuthFilter {
     and?: AuditLogAuthFilter[];
     /** Filter by the object’s `createdAt` field. */
     createdAt?: DatetimeFilter;
-    /** Filter by the object’s `event` field. */
+    /** Filter by the object’s `details` field. */
+    details?: JSONFilter;
+    /** Filter by the object’s `event` field. */
     event?: StringFilter;
     /** Filter by the object’s `id` field. */
     id?: UUIDFilter;
@@ -2315,45 +2766,6 @@ export interface PhoneNumberFilter {
     /** Filter by the object’s `updatedAt` field. */
     updatedAt?: DatetimeFilter;
 }
-/** A filter to be used against `Principal` object types. All fields are combined with a logical ‘and.’ */
-export interface PrincipalFilter {
-    /** Checks for all expressions in this list. */
-    and?: PrincipalFilter[];
-    /** Filter by the object’s `bypassStepUp` field. */
-    bypassStepUp?: BooleanFilter;
-    /** Filter by the object’s `createdAt` field. */
-    createdAt?: DatetimeFilter;
-    /** Filter by the object’s `id` field. */
-    id?: UUIDFilter;
-    /** Filter by the object’s `isReadOnly` field. */
-    isReadOnly?: BooleanFilter;
-    /** Filter by the object’s `name` field. */
-    name?: StringFilter;
-    /** Negates the expression. */
-    not?: PrincipalFilter;
-    /** Checks for any expressions in this list. */
-    or?: PrincipalFilter[];
-    /** Filter by the object’s `owner` relation. */
-    owner?: UserFilter;
-    /** Filter by the object’s `ownerId` field. */
-    ownerId?: UUIDFilter;
-    /** Filter by the object’s `principalEntities` relation. */
-    principalEntities?: PrincipalToManyPrincipalEntityFilter;
-    /** `principalEntities` exist. */
-    principalEntitiesExist?: boolean;
-    /** Filter by the object’s `principalScopeOverrides` relation. */
-    principalScopeOverrides?: PrincipalToManyPrincipalScopeOverrideFilter;
-    /** `principalScopeOverrides` exist. */
-    principalScopeOverridesExist?: boolean;
-    /** Filter by the object’s `updatedAt` field. */
-    updatedAt?: DatetimeFilter;
-    /** Filter by the object’s `useAdminOwner` field. */
-    useAdminOwner?: BooleanFilter;
-    /** Filter by the object’s `user` relation. */
-    user?: UserFilter;
-    /** Filter by the object’s `userId` field. */
-    userId?: UUIDFilter;
-}
 /** A filter to be used against `WebauthnCredential` object types. All fields are combined with a logical ‘and.’ */
 export interface WebauthnCredentialFilter {
     /** Checks for all expressions in this list. */
@@ -2393,100 +2805,33 @@ export interface WebauthnCredentialFilter {
     /** Filter by the object’s `webauthnUserId` field. */
     webauthnUserId?: StringFilter;
 }
-/** A filter to be used against Datetime fields. All fields are combined with a logical ‘and.’ */
-export interface DatetimeFilter {
+/** A filter to be used against Boolean fields. All fields are combined with a logical ‘and.’ */
+export interface BooleanFilter {
     /** Not equal to the specified value, treating null like an ordinary value. */
-    distinctFrom?: string;
+    distinctFrom?: boolean;
     /** Equal to the specified value. */
-    equalTo?: string;
+    equalTo?: boolean;
     /** Greater than the specified value. */
-    greaterThan?: string;
+    greaterThan?: boolean;
     /** Greater than or equal to the specified value. */
-    greaterThanOrEqualTo?: string;
+    greaterThanOrEqualTo?: boolean;
     /** Included in the specified list. */
-    in?: string[];
+    in?: boolean[];
     /** Is null (if `true` is specified) or is not null (if `false` is specified). */
     isNull?: boolean;
     /** Less than the specified value. */
-    lessThan?: string;
+    lessThan?: boolean;
     /** Less than or equal to the specified value. */
-    lessThanOrEqualTo?: string;
+    lessThanOrEqualTo?: boolean;
     /** Equal to the specified value, treating null like an ordinary value. */
-    notDistinctFrom?: string;
+    notDistinctFrom?: boolean;
     /** Not equal to the specified value. */
-    notEqualTo?: string;
+    notEqualTo?: boolean;
     /** Not included in the specified list. */
-    notIn?: string[];
-}
-/** A filter to be used against `User` object types. All fields are combined with a logical ‘and.’ */
-export interface UserFilter {
-    /** Checks for all expressions in this list. */
-    and?: UserFilter[];
-    /** Filter by the object’s `authAuditLog` relation. */
-    authAuditLog?: UserToManyAuditLogAuthFilter;
-    /** `authAuditLog` exist. */
-    authAuditLogExist?: boolean;
-    /** Filter by the object’s `createdAt` field. */
-    createdAt?: DatetimeFilter;
-    /** Filter by the object’s `cryptoAddresses` relation. */
-    cryptoAddresses?: UserToManyCryptoAddressFilter;
-    /** `cryptoAddresses` exist. */
-    cryptoAddressesExist?: boolean;
-    /** Filter by the object’s `displayName` field. */
-    displayName?: StringTrgmFilter;
-    /** Filter by the object’s `emails` relation. */
-    emails?: UserToManyEmailFilter;
-    /** `emails` exist. */
-    emailsExist?: boolean;
-    /** Filter by the object’s `id` field. */
-    id?: UUIDFilter;
-    /** Negates the expression. */
-    not?: UserFilter;
-    /** Checks for any expressions in this list. */
-    or?: UserFilter[];
-    /** Filter by the object’s `phoneNumbers` relation. */
-    phoneNumbers?: UserToManyPhoneNumberFilter;
-    /** `phoneNumbers` exist. */
-    phoneNumbersExist?: boolean;
-    /** Filter by the object’s `principals` relation. */
-    principals?: UserToManyPrincipalFilter;
-    /** `principals` exist. */
-    principalsExist?: boolean;
-    /** Filter by the object’s `profilePicture` field. */
-    profilePicture?: ConstructiveInternalTypeImageFilter;
-    /** Filter by the object’s `roleType` relation. */
-    roleType?: RoleTypeFilter;
-    /** Filter by the object’s `scopedPrincipals` relation. */
-    scopedPrincipals?: UserToManyPrincipalEntityFilter;
-    /** `scopedPrincipals` exist. */
-    scopedPrincipalsExist?: boolean;
-    /** Filter by the object’s `searchTsv` field. */
-    searchTsv?: FullTextFilter;
-    /** TRGM search on the `display_name` column. */
-    trgmDisplayName?: TrgmSearchInput;
-    /** TSV search on the `search_tsv` column. */
-    tsvSearchTsv?: string;
-    /** Filter by the object’s `type` field. */
-    type?: IntFilter;
-    /**
-     * Composite unified search. Provide a search string and it will be dispatched to
-     * all text-compatible search algorithms (tsvector, BM25, pg_trgm)
-     * simultaneously. When the LLM plugin is active, pgvector also participates via
-     * auto-embedding. Rows matching ANY algorithm are returned. All matching score
-     * fields are populated.
-     */
-    unifiedSearch?: string;
-    /** Filter by the object’s `updatedAt` field. */
-    updatedAt?: DatetimeFilter;
-    /** Filter by the object’s `username` field. */
-    username?: StringTrgmFilter;
-    /** Filter by the object’s `webauthnCredentials` relation. */
-    webauthnCredentials?: UserToManyWebauthnCredentialFilter;
-    /** `webauthnCredentials` exist. */
-    webauthnCredentialsExist?: boolean;
+    notIn?: boolean[];
 }
-/** A filter to be used against UUID fields. All fields are combined with a logical ‘and.’ */
-export interface UUIDFilter {
+/** A filter to be used against Datetime fields. All fields are combined with a logical ‘and.’ */
+export interface DatetimeFilter {
     /** Not equal to the specified value, treating null like an ordinary value. */
     distinctFrom?: string;
     /** Equal to the specified value. */
@@ -2510,8 +2855,8 @@ export interface UUIDFilter {
     /** Not included in the specified list. */
     notIn?: string[];
 }
-/** A filter to be used against BitString fields. All fields are combined with a logical ‘and.’ */
-export interface BitStringFilter {
+/** A filter to be used against UUID fields. All fields are combined with a logical ‘and.’ */
+export interface UUIDFilter {
     /** Not equal to the specified value, treating null like an ordinary value. */
     distinctFrom?: string;
     /** Equal to the specified value. */
@@ -2535,31 +2880,6 @@ export interface BitStringFilter {
     /** Not included in the specified list. */
     notIn?: string[];
 }
-/** A filter to be used against Boolean fields. All fields are combined with a logical ‘and.’ */
-export interface BooleanFilter {
-    /** Not equal to the specified value, treating null like an ordinary value. */
-    distinctFrom?: boolean;
-    /** Equal to the specified value. */
-    equalTo?: boolean;
-    /** Greater than the specified value. */
-    greaterThan?: boolean;
-    /** Greater than or equal to the specified value. */
-    greaterThanOrEqualTo?: boolean;
-    /** Included in the specified list. */
-    in?: boolean[];
-    /** Is null (if `true` is specified) or is not null (if `false` is specified). */
-    isNull?: boolean;
-    /** Less than the specified value. */
-    lessThan?: boolean;
-    /** Less than or equal to the specified value. */
-    lessThanOrEqualTo?: boolean;
-    /** Equal to the specified value, treating null like an ordinary value. */
-    notDistinctFrom?: boolean;
-    /** Not equal to the specified value. */
-    notEqualTo?: boolean;
-    /** Not included in the specified list. */
-    notIn?: boolean[];
-}
 /** A filter to be used against Int fields. All fields are combined with a logical ‘and.’ */
 export interface IntFilter {
     /** Not equal to the specified value, treating null like an ordinary value. */
@@ -2662,6 +2982,141 @@ export interface StringFilter {
     /** Starts with the specified string (case-insensitive). */
     startsWithInsensitive?: string;
 }
+/** A filter to be used against `User` object types. All fields are combined with a logical ‘and.’ */
+export interface UserFilter {
+    /** Checks for all expressions in this list. */
+    and?: UserFilter[];
+    /** Filter by the object’s `authAuditLog` relation. */
+    authAuditLog?: UserToManyAuditLogAuthFilter;
+    /** `authAuditLog` exist. */
+    authAuditLogExist?: boolean;
+    /** Filter by the object’s `createdAt` field. */
+    createdAt?: DatetimeFilter;
+    /** Filter by the object’s `cryptoAddresses` relation. */
+    cryptoAddresses?: UserToManyCryptoAddressFilter;
+    /** `cryptoAddresses` exist. */
+    cryptoAddressesExist?: boolean;
+    /** Filter by the object’s `displayName` field. */
+    displayName?: StringTrgmFilter;
+    /** Filter by the object’s `emails` relation. */
+    emails?: UserToManyEmailFilter;
+    /** `emails` exist. */
+    emailsExist?: boolean;
+    /** Filter by the object’s `id` field. */
+    id?: UUIDFilter;
+    /** Negates the expression. */
+    not?: UserFilter;
+    /** Checks for any expressions in this list. */
+    or?: UserFilter[];
+    /** Filter by the object’s `ownedUserSetting` relation. */
+    ownedUserSetting?: UserSettingFilter;
+    /** A related `ownedUserSetting` exists. */
+    ownedUserSettingExists?: boolean;
+    /** Filter by the object’s `ownedUserSettingsSecurity` relation. */
+    ownedUserSettingsSecurity?: UserSettingsSecurityFilter;
+    /** A related `ownedUserSettingsSecurity` exists. */
+    ownedUserSettingsSecurityExists?: boolean;
+    /** Filter by the object’s `phoneNumbers` relation. */
+    phoneNumbers?: UserToManyPhoneNumberFilter;
+    /** `phoneNumbers` exist. */
+    phoneNumbersExist?: boolean;
+    /** Filter by the object’s `principals` relation. */
+    principals?: UserToManyPrincipalFilter;
+    /** `principals` exist. */
+    principalsExist?: boolean;
+    /** Filter by the object’s `profilePicture` field. */
+    profilePicture?: ConstructiveInternalTypeImageFilter;
+    /** Filter by the object’s `roleType` relation. */
+    roleType?: RoleTypeFilter;
+    /** Filter by the object’s `scopedPrincipals` relation. */
+    scopedPrincipals?: UserToManyPrincipalEntityFilter;
+    /** `scopedPrincipals` exist. */
+    scopedPrincipalsExist?: boolean;
+    /** Filter by the object’s `searchTsv` field. */
+    searchTsv?: FullTextFilter;
+    /** TRGM search on the `display_name` column. */
+    trgmDisplayName?: TrgmSearchInput;
+    /** TSV search on the `search_tsv` column. */
+    tsvSearchTsv?: string;
+    /** Filter by the object’s `type` field. */
+    type?: IntFilter;
+    /**
+     * Composite unified search. Provide a search string and it will be dispatched to
+     * all text-compatible search algorithms (tsvector, BM25, pg_trgm)
+     * simultaneously. When the LLM plugin is active, pgvector also participates via
+     * auto-embedding. Rows matching ANY algorithm are returned. All matching score
+     * fields are populated.
+     */
+    unifiedSearch?: string;
+    /** Filter by the object’s `updatedAt` field. */
+    updatedAt?: DatetimeFilter;
+    /** Filter by the object’s `username` field. */
+    username?: StringTrgmFilter;
+    /** Filter by the object’s `webauthnCredentials` relation. */
+    webauthnCredentials?: UserToManyWebauthnCredentialFilter;
+    /** `webauthnCredentials` exist. */
+    webauthnCredentialsExist?: boolean;
+}
+/** A filter to be used against BitString fields. All fields are combined with a logical ‘and.’ */
+export interface BitStringFilter {
+    /** Not equal to the specified value, treating null like an ordinary value. */
+    distinctFrom?: string;
+    /** Equal to the specified value. */
+    equalTo?: string;
+    /** Greater than the specified value. */
+    greaterThan?: string;
+    /** Greater than or equal to the specified value. */
+    greaterThanOrEqualTo?: string;
+    /** Included in the specified list. */
+    in?: string[];
+    /** Is null (if `true` is specified) or is not null (if `false` is specified). */
+    isNull?: boolean;
+    /** Less than the specified value. */
+    lessThan?: string;
+    /** Less than or equal to the specified value. */
+    lessThanOrEqualTo?: string;
+    /** Equal to the specified value, treating null like an ordinary value. */
+    notDistinctFrom?: string;
+    /** Not equal to the specified value. */
+    notEqualTo?: string;
+    /** Not included in the specified list. */
+    notIn?: string[];
+}
+/** A filter to be used against JSON fields. All fields are combined with a logical ‘and.’ */
+export interface JSONFilter {
+    /** Contained by the specified JSON. */
+    containedBy?: Record<string, unknown>;
+    /** Contains the specified JSON. */
+    contains?: Record<string, unknown>;
+    /** Contains all of the specified keys. */
+    containsAllKeys?: string[];
+    /** Contains any of the specified keys. */
+    containsAnyKeys?: string[];
+    /** Contains the specified key. */
+    containsKey?: string;
+    /** Not equal to the specified value, treating null like an ordinary value. */
+    distinctFrom?: Record<string, unknown>;
+    /** Equal to the specified value. */
+    equalTo?: Record<string, unknown>;
+    /** Greater than the specified value. */
+    greaterThan?: Record<string, unknown>;
+    /** Greater than or equal to the specified value. */
+    greaterThanOrEqualTo?: Record<string, unknown>;
+    /** Included in the specified list. */
+    in?: Record<string, unknown>[];
+    /** Is null (if `true` is specified) or is not null (if `false` is specified). */
+    isNull?: boolean;
+    /** Less than the specified value. */
+    lessThan?: Record<string, unknown>;
+    /** Less than or equal to the specified value. */
+    lessThanOrEqualTo?: Record<string, unknown>;
+    /** Equal to the specified value, treating null like an ordinary value. */
+    notDistinctFrom?: Record<string, unknown>;
+    /** Not equal to the specified value. */
+    notEqualTo?: Record<string, unknown>;
+    /** Not included in the specified list. */
+    notIn?: Record<string, unknown>[];
+}
 /** A filter to be used against InternetAddress fields. All fields are combined with a logical ‘and.’ */
 export interface InternetAddressFilter {
     /** Contained by the specified internet address. */
@@ -2761,6 +3216,56 @@ export interface StringListFilter {
     /** Overlaps the specified list of values. */
     overlaps?: string[];
 }
+/** A filter to be used against `UserSetting` object types. All fields are combined with a logical ‘and.’ */
+export interface UserSettingFilter {
+    /** Checks for all expressions in this list. */
+    and?: UserSettingFilter[];
+    /** Filter by the object’s `createdAt` field. */
+    createdAt?: DatetimeFilter;
+    /** Filter by the object’s `id` field. */
+    id?: UUIDFilter;
+    /** Negates the expression. */
+    not?: UserSettingFilter;
+    /** Checks for any expressions in this list. */
+    or?: UserSettingFilter[];
+    /** Filter by the object’s `owner` relation. */
+    owner?: UserFilter;
+    /** Filter by the object’s `ownerId` field. */
+    ownerId?: UUIDFilter;
+    /** Filter by the object’s `updatedAt` field. */
+    updatedAt?: DatetimeFilter;
+}
+/** A filter to be used against `UserSettingsSecurity` object types. All fields are combined with a logical ‘and.’ */
+export interface UserSettingsSecurityFilter {
+    /** Checks for all expressions in this list. */
+    and?: UserSettingsSecurityFilter[];
+    /** Filter by the object’s `backupCodesCount` field. */
+    backupCodesCount?: IntFilter;
+    /** Filter by the object’s `createdAt` field. */
+    createdAt?: DatetimeFilter;
+    /** Filter by the object’s `emailMfaEnabled` field. */
+    emailMfaEnabled?: BooleanFilter;
+    /** Filter by the object’s `id` field. */
+    id?: UUIDFilter;
+    /** Filter by the object’s `mfaEnrolledAt` field. */
+    mfaEnrolledAt?: DatetimeFilter;
+    /** Filter by the object’s `mfaLastUsedAt` field. */
+    mfaLastUsedAt?: DatetimeFilter;
+    /** Negates the expression. */
+    not?: UserSettingsSecurityFilter;
+    /** Checks for any expressions in this list. */
+    or?: UserSettingsSecurityFilter[];
+    /** Filter by the object’s `owner` relation. */
+    owner?: UserFilter;
+    /** Filter by the object’s `ownerId` field. */
+    ownerId?: UUIDFilter;
+    /** Filter by the object’s `smsMfaEnabled` field. */
+    smsMfaEnabled?: BooleanFilter;
+    /** Filter by the object’s `totpEnabled` field. */
+    totpEnabled?: BooleanFilter;
+    /** Filter by the object’s `updatedAt` field. */
+    updatedAt?: DatetimeFilter;
+}
 /** A filter to be used against `RoleType` object types. All fields are combined with a logical ‘and.’ */
 export interface RoleTypeFilter {
     /** Checks for all expressions in this list. */
@@ -2793,12 +3298,42 @@ export interface FullTextFilter {
     /** Not included in the specified list. */
     notIn?: string[];
 }
+export interface GetMfaStatusRecord {
+    backupCodesCount?: number | null;
+    emailMfaEnabled?: boolean | null;
+    smsMfaEnabled?: boolean | null;
+    totpEnabled?: boolean | null;
+}
+export type GetMfaStatusRecordSelect = {
+    backupCodesCount?: boolean;
+    emailMfaEnabled?: boolean;
+    smsMfaEnabled?: boolean;
+    totpEnabled?: boolean;
+};
+export interface ApproveDevicePayload {
+    clientMutationId?: string | null;
+    result?: boolean | null;
+}
+export type ApproveDevicePayloadSelect = {
+    clientMutationId?: boolean;
+    result?: boolean;
+};
 export interface CheckPasswordPayload {
     clientMutationId?: string | null;
 }
 export type CheckPasswordPayloadSelect = {
     clientMutationId?: boolean;
 };
+export interface CompleteMfaChallengePayload {
+    clientMutationId?: string | null;
+    result?: CompleteMfaChallengeRecord | null;
+}
+export type CompleteMfaChallengePayloadSelect = {
+    clientMutationId?: boolean;
+    result?: {
+        select: CompleteMfaChallengeRecordSelect;
+    };
+};
 export interface ConfirmDeleteAccountPayload {
     clientMutationId?: string | null;
     result?: boolean | null;
@@ -2807,6 +3342,14 @@ export type ConfirmDeleteAccountPayloadSelect = {
     clientMutationId?: boolean;
     result?: boolean;
 };
+export interface ConfirmTotpSetupPayload {
+    clientMutationId?: string | null;
+    result?: boolean | null;
+}
+export type ConfirmTotpSetupPayloadSelect = {
+    clientMutationId?: boolean;
+    result?: boolean;
+};
 export interface CreateApiKeyPayload {
     clientMutationId?: string | null;
     result?: CreateApiKeyRecord | null;
@@ -2817,6 +3360,14 @@ export type CreateApiKeyPayloadSelect = {
         select: CreateApiKeyRecordSelect;
     };
 };
+export interface CreateChildPrincipalPayload {
+    clientMutationId?: string | null;
+    result?: string | null;
+}
+export type CreateChildPrincipalPayloadSelect = {
+    clientMutationId?: boolean;
+    result?: boolean;
+};
 export interface CreateOrgApiKeyPayload {
     clientMutationId?: string | null;
     result?: CreateOrgApiKeyRecord | null;
@@ -2835,6 +3386,14 @@ export type CreateOrgPrincipalPayloadSelect = {
     clientMutationId?: boolean;
     result?: boolean;
 };
+export interface CreatePrincipalFromPresetPayload {
+    clientMutationId?: string | null;
+    result?: string | null;
+}
+export type CreatePrincipalFromPresetPayloadSelect = {
+    clientMutationId?: boolean;
+    result?: boolean;
+};
 export interface DeleteOrgPrincipalPayload {
     clientMutationId?: string | null;
     result?: boolean | null;
@@ -2851,6 +3410,30 @@ export type DeletePrincipalPayloadSelect = {
     clientMutationId?: boolean;
     result?: boolean;
 };
+export interface DisableEmailMfaPayload {
+    clientMutationId?: string | null;
+    result?: boolean | null;
+}
+export type DisableEmailMfaPayloadSelect = {
+    clientMutationId?: boolean;
+    result?: boolean;
+};
+export interface DisableSmsMfaPayload {
+    clientMutationId?: string | null;
+    result?: boolean | null;
+}
+export type DisableSmsMfaPayloadSelect = {
+    clientMutationId?: boolean;
+    result?: boolean;
+};
+export interface DisableTotpPayload {
+    clientMutationId?: string | null;
+    result?: boolean | null;
+}
+export type DisableTotpPayloadSelect = {
+    clientMutationId?: boolean;
+    result?: boolean;
+};
 export interface DisconnectAccountPayload {
     clientMutationId?: string | null;
     result?: boolean | null;
@@ -2859,6 +3442,30 @@ export type DisconnectAccountPayloadSelect = {
     clientMutationId?: boolean;
     result?: boolean;
 };
+export interface EnableEmailMfaPayload {
+    clientMutationId?: string | null;
+    result?: boolean | null;
+}
+export type EnableEmailMfaPayloadSelect = {
+    clientMutationId?: boolean;
+    result?: boolean;
+};
+export interface EnableSmsMfaPayload {
+    clientMutationId?: string | null;
+    result?: boolean | null;
+}
+export type EnableSmsMfaPayloadSelect = {
+    clientMutationId?: boolean;
+    result?: boolean;
+};
+export interface EnableTotpPayload {
+    clientMutationId?: string | null;
+    result?: string | null;
+}
+export type EnableTotpPayloadSelect = {
+    clientMutationId?: boolean;
+    result?: boolean;
+};
 export interface ExtendTokenExpiresPayload {
     clientMutationId?: string | null;
     result?: ExtendTokenExpiresRecord[] | null;
@@ -2875,6 +3482,14 @@ export interface ForgotPasswordPayload {
 export type ForgotPasswordPayloadSelect = {
     clientMutationId?: boolean;
 };
+export interface GenerateBackupCodesPayload {
+    clientMutationId?: string | null;
+    result?: string | null;
+}
+export type GenerateBackupCodesPayloadSelect = {
+    clientMutationId?: boolean;
+    result?: boolean;
+};
 export interface LinkIdentityPayload {
     clientMutationId?: string | null;
     result?: boolean | null;
@@ -2883,27 +3498,30 @@ export type LinkIdentityPayloadSelect = {
     clientMutationId?: boolean;
     result?: boolean;
 };
+export interface MintAccessTokenPayload {
+    clientMutationId?: string | null;
+    result?: MintAccessTokenRecord | null;
+}
+export type MintAccessTokenPayloadSelect = {
+    clientMutationId?: boolean;
+    result?: {
+        select: MintAccessTokenRecordSelect;
+    };
+};
 export interface ProvisionBucketPayload {
-    /** The access type applied */
-    accessType: string;
-    /** The S3 bucket name that was provisioned */
-    bucketName: string;
-    /** The S3 endpoint (null for AWS S3 default) */
-    endpoint?: string | null;
-    /** Error message if provisioning failed */
-    error?: string | null;
-    /** The storage provider used */
-    provider: string;
-    /** Whether provisioning succeeded */
-    success: boolean;
+    /** The logical bucket row that was queued for reconciliation. */
+    bucketId: string;
+    bucketKey: string;
+    /** The reconciler job enqueued to provision this bucket. */
+    jobId: string;
+    /** The physical bucket name already recorded, or null when reconciliation has not completed. */
+    physicalName?: string | null;
 }
 export type ProvisionBucketPayloadSelect = {
-    accessType?: boolean;
-    bucketName?: boolean;
-    endpoint?: boolean;
-    error?: boolean;
-    provider?: boolean;
-    success?: boolean;
+    bucketId?: boolean;
+    bucketKey?: boolean;
+    jobId?: boolean;
+    physicalName?: boolean;
 };
 export interface ProvisionNewUserPayload {
     clientMutationId?: string | null;
@@ -2913,6 +3531,16 @@ export type ProvisionNewUserPayloadSelect = {
     clientMutationId?: boolean;
     result?: boolean;
 };
+export interface RefreshAccessTokenPayload {
+    clientMutationId?: string | null;
+    result?: RefreshAccessTokenRecord | null;
+}
+export type RefreshAccessTokenPayloadSelect = {
+    clientMutationId?: boolean;
+    result?: {
+        select: RefreshAccessTokenRecordSelect;
+    };
+};
 export interface RequestCrossOriginTokenPayload {
     clientMutationId?: string | null;
     result?: string | null;
@@ -2961,6 +3589,14 @@ export type SendAccountDeletionEmailPayloadSelect = {
     clientMutationId?: boolean;
     result?: boolean;
 };
+export interface SendPhoneVerificationCodePayload {
+    clientMutationId?: string | null;
+    result?: boolean | null;
+}
+export type SendPhoneVerificationCodePayloadSelect = {
+    clientMutationId?: boolean;
+    result?: boolean;
+};
 export interface SendVerificationEmailPayload {
     clientMutationId?: string | null;
     result?: boolean | null;
@@ -2977,6 +3613,22 @@ export type SetPasswordPayloadSelect = {
     clientMutationId?: boolean;
     result?: boolean;
 };
+export interface SetPrincipalEntitiesPayload {
+    clientMutationId?: string | null;
+    result?: boolean | null;
+}
+export type SetPrincipalEntitiesPayloadSelect = {
+    clientMutationId?: boolean;
+    result?: boolean;
+};
+export interface SetPrincipalScopePayload {
+    clientMutationId?: string | null;
+    result?: boolean | null;
+}
+export type SetPrincipalScopePayloadSelect = {
+    clientMutationId?: boolean;
+    result?: boolean;
+};
 export interface SignInPayload {
     clientMutationId?: string | null;
     result?: SignInRecord | null;
@@ -2997,6 +3649,16 @@ export type SignInCrossOriginPayloadSelect = {
         select: SignInCrossOriginRecordSelect;
     };
 };
+export interface SignInMagicLinkPayload {
+    clientMutationId?: string | null;
+    result?: SignInMagicLinkRecord | null;
+}
+export type SignInMagicLinkPayloadSelect = {
+    clientMutationId?: boolean;
+    result?: {
+        select: SignInMagicLinkRecordSelect;
+    };
+};
 export interface SignInSmsOtpPayload {
     clientMutationId?: string | null;
     result?: SignInSmsOtpRecord | null;
@@ -3023,6 +3685,16 @@ export type SignUpPayloadSelect = {
         select: SignUpRecordSelect;
     };
 };
+export interface SignUpMagicLinkPayload {
+    clientMutationId?: string | null;
+    result?: SignUpMagicLinkRecord | null;
+}
+export type SignUpMagicLinkPayloadSelect = {
+    clientMutationId?: boolean;
+    result?: {
+        select: SignUpMagicLinkRecordSelect;
+    };
+};
 export interface SignUpSmsPayload {
     clientMutationId?: string | null;
     result?: SignUpSmsRecord | null;
@@ -3033,6 +3705,14 @@ export type SignUpSmsPayloadSelect = {
         select: SignUpSmsRecordSelect;
     };
 };
+export interface UpdatePrincipalPayload {
+    clientMutationId?: string | null;
+    result?: boolean | null;
+}
+export type UpdatePrincipalPayloadSelect = {
+    clientMutationId?: boolean;
+    result?: boolean;
+};
 export interface VerifyEmailPayload {
     clientMutationId?: string | null;
     result?: boolean | null;
@@ -3049,6 +3729,14 @@ export type VerifyPasswordPayloadSelect = {
     clientMutationId?: boolean;
     result?: boolean;
 };
+export interface VerifyPhonePayload {
+    clientMutationId?: string | null;
+    result?: boolean | null;
+}
+export type VerifyPhonePayloadSelect = {
+    clientMutationId?: boolean;
+    result?: boolean;
+};
 export interface VerifyTotpPayload {
     clientMutationId?: string | null;
     result?: boolean | null;
@@ -3245,51 +3933,6 @@ export type CreatePrincipalPayloadSelect = {
     clientMutationId?: boolean;
     result?: boolean;
 };
-export interface CreatePrincipalEntityPayload {
-    clientMutationId?: string | null;
-    /** The `PrincipalEntity` that was created by this mutation. */
-    principalEntity?: PrincipalEntity | null;
-    principalEntityEdge?: PrincipalEntityEdge | null;
-}
-export type CreatePrincipalEntityPayloadSelect = {
-    clientMutationId?: boolean;
-    principalEntity?: {
-        select: PrincipalEntitySelect;
-    };
-    principalEntityEdge?: {
-        select: PrincipalEntityEdgeSelect;
-    };
-};
-export interface UpdatePrincipalEntityPayload {
-    clientMutationId?: string | null;
-    /** The `PrincipalEntity` that was updated by this mutation. */
-    principalEntity?: PrincipalEntity | null;
-    principalEntityEdge?: PrincipalEntityEdge | null;
-}
-export type UpdatePrincipalEntityPayloadSelect = {
-    clientMutationId?: boolean;
-    principalEntity?: {
-        select: PrincipalEntitySelect;
-    };
-    principalEntityEdge?: {
-        select: PrincipalEntityEdgeSelect;
-    };
-};
-export interface DeletePrincipalEntityPayload {
-    clientMutationId?: string | null;
-    /** The `PrincipalEntity` that was deleted by this mutation. */
-    principalEntity?: PrincipalEntity | null;
-    principalEntityEdge?: PrincipalEntityEdge | null;
-}
-export type DeletePrincipalEntityPayloadSelect = {
-    clientMutationId?: boolean;
-    principalEntity?: {
-        select: PrincipalEntitySelect;
-    };
-    principalEntityEdge?: {
-        select: PrincipalEntityEdgeSelect;
-    };
-};
 export interface CreateRoleTypePayload {
     clientMutationId?: string | null;
     /** The `RoleType` that was created by this mutation. */
@@ -3380,6 +4023,96 @@ export type DeleteUserPayloadSelect = {
         select: UserEdgeSelect;
     };
 };
+export interface CreateUserSettingPayload {
+    clientMutationId?: string | null;
+    /** The `UserSetting` that was created by this mutation. */
+    userSetting?: UserSetting | null;
+    userSettingEdge?: UserSettingEdge | null;
+}
+export type CreateUserSettingPayloadSelect = {
+    clientMutationId?: boolean;
+    userSetting?: {
+        select: UserSettingSelect;
+    };
+    userSettingEdge?: {
+        select: UserSettingEdgeSelect;
+    };
+};
+export interface UpdateUserSettingPayload {
+    clientMutationId?: string | null;
+    /** The `UserSetting` that was updated by this mutation. */
+    userSetting?: UserSetting | null;
+    userSettingEdge?: UserSettingEdge | null;
+}
+export type UpdateUserSettingPayloadSelect = {
+    clientMutationId?: boolean;
+    userSetting?: {
+        select: UserSettingSelect;
+    };
+    userSettingEdge?: {
+        select: UserSettingEdgeSelect;
+    };
+};
+export interface DeleteUserSettingPayload {
+    clientMutationId?: string | null;
+    /** The `UserSetting` that was deleted by this mutation. */
+    userSetting?: UserSetting | null;
+    userSettingEdge?: UserSettingEdge | null;
+}
+export type DeleteUserSettingPayloadSelect = {
+    clientMutationId?: boolean;
+    userSetting?: {
+        select: UserSettingSelect;
+    };
+    userSettingEdge?: {
+        select: UserSettingEdgeSelect;
+    };
+};
+export interface CreateUserSettingsSecurityPayload {
+    clientMutationId?: string | null;
+    /** The `UserSettingsSecurity` that was created by this mutation. */
+    userSettingsSecurity?: UserSettingsSecurity | null;
+    userSettingsSecurityEdge?: UserSettingsSecurityEdge | null;
+}
+export type CreateUserSettingsSecurityPayloadSelect = {
+    clientMutationId?: boolean;
+    userSettingsSecurity?: {
+        select: UserSettingsSecuritySelect;
+    };
+    userSettingsSecurityEdge?: {
+        select: UserSettingsSecurityEdgeSelect;
+    };
+};
+export interface UpdateUserSettingsSecurityPayload {
+    clientMutationId?: string | null;
+    /** The `UserSettingsSecurity` that was updated by this mutation. */
+    userSettingsSecurity?: UserSettingsSecurity | null;
+    userSettingsSecurityEdge?: UserSettingsSecurityEdge | null;
+}
+export type UpdateUserSettingsSecurityPayloadSelect = {
+    clientMutationId?: boolean;
+    userSettingsSecurity?: {
+        select: UserSettingsSecuritySelect;
+    };
+    userSettingsSecurityEdge?: {
+        select: UserSettingsSecurityEdgeSelect;
+    };
+};
+export interface DeleteUserSettingsSecurityPayload {
+    clientMutationId?: string | null;
+    /** The `UserSettingsSecurity` that was deleted by this mutation. */
+    userSettingsSecurity?: UserSettingsSecurity | null;
+    userSettingsSecurityEdge?: UserSettingsSecurityEdge | null;
+}
+export type DeleteUserSettingsSecurityPayloadSelect = {
+    clientMutationId?: boolean;
+    userSettingsSecurity?: {
+        select: UserSettingsSecuritySelect;
+    };
+    userSettingsSecurityEdge?: {
+        select: UserSettingsSecurityEdgeSelect;
+    };
+};
 export interface CreateWebauthnCredentialPayload {
     clientMutationId?: string | null;
     /** The `WebauthnCredential` that was created by this mutation. */
@@ -3425,6 +4158,24 @@ export type DeleteWebauthnCredentialPayloadSelect = {
         select: WebauthnCredentialEdgeSelect;
     };
 };
+export interface CompleteMfaChallengeRecord {
+    accessToken?: string | null;
+    accessTokenExpiresAt?: string | null;
+    deviceApprovalRequired?: boolean | null;
+    id?: string | null;
+    isVerified?: boolean | null;
+    outDeviceToken?: string | null;
+    outUserId?: string | null;
+}
+export type CompleteMfaChallengeRecordSelect = {
+    accessToken?: boolean;
+    accessTokenExpiresAt?: boolean;
+    deviceApprovalRequired?: boolean;
+    id?: boolean;
+    isVerified?: boolean;
+    outDeviceToken?: boolean;
+    outUserId?: boolean;
+};
 export interface CreateApiKeyRecord {
     apiKey?: string | null;
     expiresAt?: string | null;
@@ -3455,23 +4206,59 @@ export type ExtendTokenExpiresRecordSelect = {
     id?: boolean;
     sessionId?: boolean;
 };
+export interface MintAccessTokenRecord {
+    accessExpiresAt?: string | null;
+    accessToken?: string | null;
+    principalUserId?: string | null;
+    refreshExpiresAt?: string | null;
+    refreshToken?: string | null;
+    sessionId?: string | null;
+}
+export type MintAccessTokenRecordSelect = {
+    accessExpiresAt?: boolean;
+    accessToken?: boolean;
+    principalUserId?: boolean;
+    refreshExpiresAt?: boolean;
+    refreshToken?: boolean;
+    sessionId?: boolean;
+};
+export interface RefreshAccessTokenRecord {
+    accessExpiresAt?: string | null;
+    accessToken?: string | null;
+    principalUserId?: string | null;
+    refreshExpiresAt?: string | null;
+    refreshToken?: string | null;
+    sessionId?: string | null;
+}
+export type RefreshAccessTokenRecordSelect = {
+    accessExpiresAt?: boolean;
+    accessToken?: boolean;
+    principalUserId?: boolean;
+    refreshExpiresAt?: boolean;
+    refreshToken?: boolean;
+    sessionId?: boolean;
+};
 export interface SignInRecord {
     accessToken?: string | null;
     accessTokenExpiresAt?: string | null;
+    deviceApprovalRequired?: boolean | null;
     id?: string | null;
     isVerified?: boolean | null;
     mfaChallengeToken?: string | null;
     mfaRequired?: boolean | null;
+    outDeviceToken?: string | null;
     totpEnabled?: boolean | null;
     userId?: string | null;
 }
 export type SignInRecordSelect = {
     accessToken?: boolean;
     accessTokenExpiresAt?: boolean;
+    deviceApprovalRequired?: boolean;
     id?: boolean;
     isVerified?: boolean;
     mfaChallengeToken?: boolean;
     mfaRequired?: boolean;
+    outDeviceToken?: boolean;
     totpEnabled?: boolean;
     userId?: boolean;
 };
@@ -3491,14 +4278,32 @@ export type SignInCrossOriginRecordSelect = {
     totpEnabled?: boolean;
     userId?: boolean;
 };
+export interface SignInMagicLinkRecord {
+    accessToken?: string | null;
+    accessTokenExpiresAt?: string | null;
+    deviceApprovalRequired?: boolean | null;
+    outDeviceToken?: string | null;
+    userId?: string | null;
+}
+export type SignInMagicLinkRecordSelect = {
+    accessToken?: boolean;
+    accessTokenExpiresAt?: boolean;
+    deviceApprovalRequired?: boolean;
+    outDeviceToken?: boolean;
+    userId?: boolean;
+};
 export interface SignInSmsOtpRecord {
     accessToken?: string | null;
     accessTokenExpiresAt?: string | null;
+    deviceApprovalRequired?: boolean | null;
+    outDeviceToken?: string | null;
     userId?: string | null;
 }
 export type SignInSmsOtpRecordSelect = {
     accessToken?: boolean;
     accessTokenExpiresAt?: boolean;
+    deviceApprovalRequired?: boolean;
+    outDeviceToken?: boolean;
     userId?: boolean;
 };
 export interface SignUpRecord {
@@ -3506,6 +4311,7 @@ export interface SignUpRecord {
     accessTokenExpiresAt?: string | null;
     id?: string | null;
     isVerified?: boolean | null;
+    outDeviceToken?: string | null;
     totpEnabled?: boolean | null;
     userId?: string | null;
 }
@@ -3514,17 +4320,32 @@ export type SignUpRecordSelect = {
     accessTokenExpiresAt?: boolean;
     id?: boolean;
     isVerified?: boolean;
+    outDeviceToken?: boolean;
     totpEnabled?: boolean;
     userId?: boolean;
 };
+export interface SignUpMagicLinkRecord {
+    accessToken?: string | null;
+    accessTokenExpiresAt?: string | null;
+    outDeviceToken?: string | null;
+    userId?: string | null;
+}
+export type SignUpMagicLinkRecordSelect = {
+    accessToken?: boolean;
+    accessTokenExpiresAt?: boolean;
+    outDeviceToken?: boolean;
+    userId?: boolean;
+};
 export interface SignUpSmsRecord {
     accessToken?: string | null;
     accessTokenExpiresAt?: string | null;
+    outDeviceToken?: string | null;
     userId?: string | null;
 }
 export type SignUpSmsRecordSelect = {
     accessToken?: boolean;
     accessTokenExpiresAt?: boolean;
+    outDeviceToken?: boolean;
     userId?: boolean;
 };
 /** A `AuditLogAuth` edge in the connection. */
@@ -3575,18 +4396,6 @@ export type PhoneNumberEdgeSelect = {
         select: PhoneNumberSelect;
     };
 };
-/** A `PrincipalEntity` edge in the connection. */
-export interface PrincipalEntityEdge {
-    cursor?: string | null;
-    /** The `PrincipalEntity` at the end of the edge. */
-    node?: PrincipalEntity | null;
-}
-export type PrincipalEntityEdgeSelect = {
-    cursor?: boolean;
-    node?: {
-        select: PrincipalEntitySelect;
-    };
-};
 /** A `RoleType` edge in the connection. */
 export interface RoleTypeEdge {
     cursor?: string | null;
@@ -3611,6 +4420,30 @@ export type UserEdgeSelect = {
         select: UserSelect;
     };
 };
+/** A `UserSetting` edge in the connection. */
+export interface UserSettingEdge {
+    cursor?: string | null;
+    /** The `UserSetting` at the end of the edge. */
+    node?: UserSetting | null;
+}
+export type UserSettingEdgeSelect = {
+    cursor?: boolean;
+    node?: {
+        select: UserSettingSelect;
+    };
+};
+/** A `UserSettingsSecurity` edge in the connection. */
+export interface UserSettingsSecurityEdge {
+    cursor?: string | null;
+    /** The `UserSettingsSecurity` at the end of the edge. */
+    node?: UserSettingsSecurity | null;
+}
+export type UserSettingsSecurityEdgeSelect = {
+    cursor?: boolean;
+    node?: {
+        select: UserSettingsSecuritySelect;
+    };
+};
 /** A `WebauthnCredential` edge in the connection. */
 export interface WebauthnCredentialEdge {
     cursor?: string | null;