@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/src/schema/index.ts

@@ -1,13 +1,10 @@
-import { Interval } from './types'
-import { OutputInterval } from './types'
+/** Internal type. DO NOT USE DIRECTLY. */
+export type Incremental<T> = T | { [P in keyof T]?: P extends ' $fragmentName' | '__typename' ? T[P] : never }
+import { Interval } from './types.js'
+import { OutputInterval } from './types.js'
 import { GraphQLResolveInfo, GraphQLScalarType, GraphQLScalarTypeConfig } from 'graphql'
 export type Maybe<T> = T | null
 export type InputMaybe<T> = Maybe<T>
-export type Exact<T extends { [key: string]: unknown }> = { [K in keyof T]: T[K] }
-export type MakeOptional<T, K extends keyof T> = Omit<T, K> & { [SubKey in K]?: Maybe<T[SubKey]> }
-export type MakeMaybe<T, K extends keyof T> = Omit<T, K> & { [SubKey in K]: Maybe<T[SubKey]> }
-export type MakeEmpty<T extends { [key: string]: unknown }, K extends keyof T> = { [_ in K]?: never }
-export type Incremental<T> = T | { [P in keyof T]?: P extends ' $fragmentName' | '__typename' ? T[P] : never }
 export type Omit<T, K extends keyof T> = Pick<T, Exclude<keyof T, K>>
 export type RequireFields<T, K extends keyof T> = Omit<T, K> & { [P in K]-?: NonNullable<T[P]> }
 /** All built-in and custom scalars, mapped to their actual values */
@@ -18,6 +15,7 @@ export type Scalars = {
 	Int: { input: number; output: number }
 	Float: { input: number; output: number }
 	DateTime: { input: Date; output: Date }
+	/**  Interval is a string in the format ISO 8601, e.g. "PT1H" for 1 hour  */
 	Interval: { input: Interval; output: OutputInterval }
 	Json: { input: unknown; output: unknown }
 }
@@ -127,10 +125,23 @@ export type AddProjectMemberResponse = {
 
 export type ApiKey = {
 	readonly __typename?: 'ApiKey'
+	readonly createdAt?: Maybe<Scalars['DateTime']['output']>
+	/**  Human-readable label, stored on the key's identity (`identity.description`).  */
+	readonly description?: Maybe<Scalars['String']['output']>
+	/**  False once the key has been disabled (`disableApiKey`).  */
+	readonly enabled?: Maybe<Scalars['Boolean']['output']>
+	readonly expiresAt?: Maybe<Scalars['DateTime']['output']>
 	readonly id: Scalars['String']['output']
 	readonly identity: Identity
+	readonly lastUsedAt?: Maybe<Scalars['DateTime']['output']>
+	readonly type?: Maybe<ApiKeyType>
 }
 
+export type ApiKeyType =
+	| 'ONE_OFF'
+	| 'PERMANENT'
+	| 'SESSION'
+
 export type ApiKeyWithToken = {
 	readonly __typename?: 'ApiKeyWithToken'
 	readonly id: Scalars['String']['output']
@@ -138,6 +149,122 @@ export type ApiKeyWithToken = {
 	readonly token?: Maybe<Scalars['String']['output']>
 }
 
+/**
+ * A single `person_auth_log` row. Mirrors the columns described in
+ * docs/.../audit-log.md.
+ */
+export type AuthLogEntry = {
+	readonly __typename?: 'AuthLogEntry'
+	readonly createdAt: Scalars['DateTime']['output']
+	readonly errorCode?: Maybe<Scalars['String']['output']>
+	readonly errorMessage?: Maybe<Scalars['String']['output']>
+	/**
+	 * JSONB — domain payload. For change events this is typically
+	 * `{before, after}`; for creation events it's the snapshot.
+	 * Secret-bearing inputs are redacted before being stored.
+	 */
+	readonly eventData?: Maybe<Scalars['Json']['output']>
+	readonly id: Scalars['String']['output']
+	readonly identityProviderId?: Maybe<Scalars['String']['output']>
+	/**
+	 * Identity that performed the action. May be null for entries created
+	 * before this column was populated, or when the actor's identity was
+	 * later deleted (FK is ON DELETE SET NULL semantics-wise).
+	 */
+	readonly invokedByIdentityId?: Maybe<Scalars['String']['output']>
+	/**
+	 * Effective client IP after `trust-forwarded-info` is applied. The
+	 * raw socket peer is preserved in `metadata.forwarderIp` when a
+	 * trusted proxy was involved.
+	 */
+	readonly ipAddress?: Maybe<Scalars['String']['output']>
+	/**
+	 * JSONB — forensic context. Common keys: `forwarderIp`,
+	 * `forwarderUserAgent`, `sessionId`, `reason`.
+	 */
+	readonly metadata?: Maybe<Scalars['Json']['output']>
+	/** The actor's person (if the actor was a person, not a bare api_key). */
+	readonly personId?: Maybe<Scalars['String']['output']>
+	/**
+	 * Free-form input string — typically the email submitted on a failed
+	 * login, before any person record was looked up.
+	 */
+	readonly personInputIdentifier?: Maybe<Scalars['String']['output']>
+	readonly success: Scalars['Boolean']['output']
+	/**
+	 * The subject of the action when different from the actor (e.g. force
+	 * sign-out, role grant, membership change). Resolved from the affected
+	 * identity so the trail points at the right person even when the actor
+	 * acts on someone else's identity.
+	 */
+	readonly targetPersonId?: Maybe<Scalars['String']['output']>
+	/**
+	 * One of the values listed in `auth_log_type` (see audit-log docs).
+	 * Kept as String rather than a GraphQL enum because a few legacy values
+	 * (`2fa_enable`, `2fa_disable`) start with a digit and aren't valid
+	 * enum names, and the set is expected to keep growing.
+	 */
+	readonly type: Scalars['String']['output']
+	readonly userAgent?: Maybe<Scalars['String']['output']>
+}
+
+/** All fields are AND-combined. Omitted fields are unconstrained. */
+export type AuthLogFilter = {
+	/** Inclusive lower bound (`created_at >= createdAfter`). */
+	readonly createdAfter?: InputMaybe<Scalars['DateTime']['input']>
+	/** Exclusive upper bound (`created_at < createdBefore`). */
+	readonly createdBefore?: InputMaybe<Scalars['DateTime']['input']>
+	readonly invokedByIdentityId?: InputMaybe<Scalars['String']['input']>
+	readonly personId?: InputMaybe<Scalars['String']['input']>
+	readonly personInputIdentifier?: InputMaybe<Scalars['String']['input']>
+	readonly success?: InputMaybe<Scalars['Boolean']['input']>
+	readonly targetPersonId?: InputMaybe<Scalars['String']['input']>
+	/** OR-combined: any of the listed `auth_log_type` values matches. */
+	readonly types?: InputMaybe<ReadonlyArray<Scalars['String']['input']>>
+}
+
+export type AuthLogPage = {
+	readonly __typename?: 'AuthLogPage'
+	readonly entries: ReadonlyArray<AuthLogEntry>
+	/** True when more rows exist past `offset + limit`. */
+	readonly hasMore: Scalars['Boolean']['output']
+}
+
+export type AuthPolicy = {
+	readonly __typename?: 'AuthPolicy'
+	readonly id: Scalars['String']['output']
+	readonly idleTimeout?: Maybe<Scalars['Interval']['output']>
+	readonly mfaGraceDuration?: Maybe<Scalars['Interval']['output']>
+	readonly mfaRequired?: Maybe<Scalars['Boolean']['output']>
+	/** Project slug, present only for project-scoped policies. */
+	readonly project?: Maybe<Scalars['String']['output']>
+	readonly rememberMeAllowed?: Maybe<Scalars['Boolean']['output']>
+	readonly roles: ReadonlyArray<Scalars['String']['output']>
+	readonly scope: AuthPolicyScope
+	readonly tokenExpiration?: Maybe<Scalars['Interval']['output']>
+}
+
+export type AuthPolicyInput = {
+	readonly idleTimeout?: InputMaybe<Scalars['Interval']['input']>
+	readonly mfaGraceDuration?: InputMaybe<Scalars['Interval']['input']>
+	readonly mfaRequired?: InputMaybe<Scalars['Boolean']['input']>
+	/** Project slug. Required for scope=project, forbidden for scope=global. */
+	readonly project?: InputMaybe<Scalars['String']['input']>
+	readonly rememberMeAllowed?: InputMaybe<Scalars['Boolean']['input']>
+	readonly roles: ReadonlyArray<Scalars['String']['input']>
+	readonly scope: AuthPolicyScope
+	readonly tokenExpiration?: InputMaybe<Scalars['Interval']['input']>
+}
+
+export type AuthPolicyScope =
+	| 'global'
+	| 'project'
+
+export type CaptchaProvider =
+	| 'hcaptcha'
+	| 'recaptchaV3'
+	| 'turnstile'
+
 export type ChangeMyPasswordError = {
 	readonly __typename?: 'ChangeMyPasswordError'
 	readonly code: ChangeMyPasswordErrorCode
@@ -167,6 +294,7 @@ export type ChangeMyProfileErrorCode =
 	| 'EMAIL_ALREADY_EXISTS'
 	| 'INVALID_EMAIL_FORMAT'
 	| 'NOT_A_PERSON'
+	| 'RATE_LIMIT_EXCEEDED'
 
 export type ChangeMyProfileResponse = {
 	readonly __typename?: 'ChangeMyProfileResponse'
@@ -231,39 +359,173 @@ export type CommonSignInResult = {
 
 export type Config = {
 	readonly __typename?: 'Config'
+	readonly captcha: ConfigCaptcha
+	readonly emailChange: ConfigEmailChange
 	readonly login: ConfigLogin
+	readonly panel: ConfigPanel
 	readonly password: ConfigPassword
 	readonly passwordless: ConfigPasswordless
+	readonly rateLimits: ConfigRateLimits
+	readonly signup: ConfigSignup
+}
+
+/**
+ * Captcha config. The secret is never exposed; only the provider and (where
+ * applicable) the threshold are readable.
+ */
+export type ConfigCaptcha = {
+	readonly __typename?: 'ConfigCaptcha'
+	readonly protect: ConfigCaptchaProtect
+	readonly provider?: Maybe<CaptchaProvider>
+	readonly threshold?: Maybe<Scalars['Float']['output']>
+}
+
+/**
+ * Provider null disables captcha verification. Secret is write-only.
+ * Pass null secret to leave the stored value unchanged; pass empty string to clear.
+ */
+export type ConfigCaptchaInput = {
+	readonly protect?: InputMaybe<ConfigCaptchaProtectInput>
+	readonly provider?: InputMaybe<CaptchaProvider>
+	readonly secret?: InputMaybe<Scalars['String']['input']>
+	readonly threshold?: InputMaybe<Scalars['Float']['input']>
+}
+
+/**
+ * Per-flow captcha enforcement. The captcha provider/secret is shared; these
+ * flags decide which mutations actually require a captcha token when a provider
+ * is configured.
+ */
+export type ConfigCaptchaProtect = {
+	readonly __typename?: 'ConfigCaptchaProtect'
+	readonly emailVerification: Scalars['Boolean']['output']
+	readonly passwordReset: Scalars['Boolean']['output']
+	readonly passwordlessInit: Scalars['Boolean']['output']
+	readonly signUp: Scalars['Boolean']['output']
+}
+
+export type ConfigCaptchaProtectInput = {
+	readonly emailVerification?: InputMaybe<Scalars['Boolean']['input']>
+	readonly passwordReset?: InputMaybe<Scalars['Boolean']['input']>
+	readonly passwordlessInit?: InputMaybe<Scalars['Boolean']['input']>
+	readonly signUp?: InputMaybe<Scalars['Boolean']['input']>
+}
+
+export type ConfigEmailChange = {
+	readonly __typename?: 'ConfigEmailChange'
+	/**
+	 * When true, a user-initiated changeMyProfile e-mail change does not swap
+	 * the address immediately: it goes through a confirmation flow
+	 * (confirmEmailChange) against a token mailed to the new address, and the
+	 * old address stays active until the new one is confirmed. Independent of
+	 * ConfigSignup.requireEmailVerification. Defaults to false.
+	 */
+	readonly requireVerification: Scalars['Boolean']['output']
+}
+
+export type ConfigEmailChangeInput = {
+	readonly requireVerification?: InputMaybe<Scalars['Boolean']['input']>
 }
 
 export type ConfigInput = {
+	readonly captcha?: InputMaybe<ConfigCaptchaInput>
+	readonly emailChange?: InputMaybe<ConfigEmailChangeInput>
 	readonly login?: InputMaybe<ConfigLoginInput>
+	readonly panel?: InputMaybe<ConfigPanelInput>
 	readonly password?: InputMaybe<ConfigPasswordInput>
 	readonly passwordless?: InputMaybe<ConfigPasswordlessInput>
+	readonly rateLimits?: InputMaybe<ConfigRateLimitsInput>
+	readonly signup?: InputMaybe<ConfigSignupInput>
 }
 
 export type ConfigLogin = {
 	readonly __typename?: 'ConfigLogin'
+	readonly anomalyDetection: ConfigLoginAnomalyDetection
 	readonly attemptWindow: Scalars['Interval']['output']
 	readonly baseBackoff: Scalars['Interval']['output']
 	readonly defaultTokenExpiration: Scalars['Interval']['output']
 	readonly maxBackoff: Scalars['Interval']['output']
 	readonly maxTokenExpiration?: Maybe<Scalars['Interval']['output']>
+	readonly mfaGraceDuration: Scalars['Interval']['output']
+	/**
+	 * If false, signIn collapses NO_PASSWORD_SET / INVALID_PASSWORD into a
+	 * generic INVALID_CREDENTIALS and signUp omits the recommendedAction
+	 * hint on EMAIL_ALREADY_EXISTS errors. UNKNOWN_EMAIL and existence-level
+	 * signals are still controlled by revealUserExists. Defaults to true
+	 * (no change vs. previous behavior).
+	 */
+	readonly revealLoginMethod: Scalars['Boolean']['output']
 	readonly revealUserExists: Scalars['Boolean']['output']
 }
 
+/**
+ * Sign-in anomaly detection (A03). Opt-in, disabled by default. When enabled,
+ * each successful password verification is scored against the person's last
+ * historySize successful logins using signals derived from the trusted client
+ * info (country from a reverse-proxy geo header, a user-agent fingerprint, and
+ * the IP / IP prefix). The cumulative score then drives an action:
+ *   - score >= emailThreshold  → an informational UNUSUAL_LOGIN email is sent.
+ *   - score >= stepUpThreshold → a second factor (email OTP) is additionally
+ *     required before a session is issued (reuses the existing step-up flow).
+ * Country is only ever read through the same trusted-proxy gate as the
+ * forwarded IP / User-Agent — never from an untrusted client.
+ */
+export type ConfigLoginAnomalyDetection = {
+	readonly __typename?: 'ConfigLoginAnomalyDetection'
+	readonly emailThreshold: Scalars['Int']['output']
+	readonly enabled: Scalars['Boolean']['output']
+	readonly historySize: Scalars['Int']['output']
+	readonly stepUpThreshold: Scalars['Int']['output']
+}
+
+export type ConfigLoginAnomalyDetectionInput = {
+	readonly emailThreshold?: InputMaybe<Scalars['Int']['input']>
+	readonly enabled?: InputMaybe<Scalars['Boolean']['input']>
+	readonly historySize?: InputMaybe<Scalars['Int']['input']>
+	readonly stepUpThreshold?: InputMaybe<Scalars['Int']['input']>
+}
+
 export type ConfigLoginInput = {
+	readonly anomalyDetection?: InputMaybe<ConfigLoginAnomalyDetectionInput>
 	readonly attemptWindow?: InputMaybe<Scalars['Interval']['input']>
 	readonly baseBackoff?: InputMaybe<Scalars['Interval']['input']>
 	readonly defaultTokenExpiration?: InputMaybe<Scalars['Interval']['input']>
 	readonly maxBackoff?: InputMaybe<Scalars['Interval']['input']>
 	readonly maxTokenExpiration?: InputMaybe<Scalars['Interval']['input']>
+	readonly mfaGraceDuration?: InputMaybe<Scalars['Interval']['input']>
+	readonly revealLoginMethod?: InputMaybe<Scalars['Boolean']['input']>
 	readonly revealUserExists?: InputMaybe<Scalars['Boolean']['input']>
 }
 
+/**
+ * Who may enter the management panel. This is an entry gate for the console
+ * only, not an authorization system: everything done inside the panel still
+ * goes through the tenant ACL, so being allowed in grants no extra rights.
+ * An identity may enter when its global roles intersect globalRoles, or when
+ * it holds a membership with one of projectRoles in at least one project.
+ * Both lists empty means nobody can enter.
+ */
+export type ConfigPanel = {
+	readonly __typename?: 'ConfigPanel'
+	/** Global roles (identity.roles) that may use the management panel. */
+	readonly globalRoles: ReadonlyArray<Scalars['String']['output']>
+	/** Project membership roles that may use the management panel, in any project. */
+	readonly projectRoles: ReadonlyArray<Scalars['String']['output']>
+}
+
+/**
+ * Each list is replaced as a whole; omitting one leaves it unchanged. An empty
+ * list closes the panel for that dimension.
+ */
+export type ConfigPanelInput = {
+	readonly globalRoles?: InputMaybe<ReadonlyArray<Scalars['String']['input']>>
+	readonly projectRoles?: InputMaybe<ReadonlyArray<Scalars['String']['input']>>
+}
+
 export type ConfigPassword = {
 	readonly __typename?: 'ConfigPassword'
 	readonly checkBlacklist: Scalars['Boolean']['output']
+	readonly checkHibp: Scalars['Boolean']['output']
 	readonly minLength: Scalars['Int']['output']
 	readonly pattern?: Maybe<Scalars['String']['output']>
 	readonly requireDigit: Scalars['Int']['output']
@@ -274,6 +536,7 @@ export type ConfigPassword = {
 
 export type ConfigPasswordInput = {
 	readonly checkBlacklist?: InputMaybe<Scalars['Boolean']['input']>
+	readonly checkHibp?: InputMaybe<Scalars['Boolean']['input']>
 	readonly minLength?: InputMaybe<Scalars['Int']['input']>
 	readonly pattern?: InputMaybe<Scalars['String']['input']>
 	readonly requireDigit?: InputMaybe<Scalars['Int']['input']>
@@ -301,6 +564,64 @@ export type ConfigPolicy =
 	| 'optIn'
 	| 'optOut'
 
+export type ConfigRateLimitWindow = {
+	readonly __typename?: 'ConfigRateLimitWindow'
+	readonly limit: Scalars['Int']['output']
+	readonly window: Scalars['Interval']['output']
+}
+
+export type ConfigRateLimitWindowInput = {
+	readonly limit?: InputMaybe<Scalars['Int']['input']>
+	readonly window?: InputMaybe<Scalars['Interval']['input']>
+}
+
+/**
+ * Configurable per-IP rate-limit windows. Each value bounds the number of
+ * attempts allowed from the same client IP in the configured window. Per-email
+ * throttling for password-reset and passwordless-init flows reuses the
+ * exponential backoff from ConfigLogin (baseBackoff / maxBackoff /
+ * attemptWindow) against person_auth_log entries.
+ */
+export type ConfigRateLimits = {
+	readonly __typename?: 'ConfigRateLimits'
+	/**
+	 * Caps how many email-OTP codes may be dispatched per person within the
+	 * window (a brute-force / email-bomb backstop). Unlike the per-IP limits it
+	 * ships enabled by default. Set limit to 0 to disable.
+	 */
+	readonly emailOtpPerPerson: ConfigRateLimitWindow
+	readonly emailVerificationPerIp: ConfigRateLimitWindow
+	readonly loginPerIp: ConfigRateLimitWindow
+	readonly passwordResetPerIp: ConfigRateLimitWindow
+	readonly passwordlessInitPerIp: ConfigRateLimitWindow
+	readonly signUpPerIp: ConfigRateLimitWindow
+}
+
+export type ConfigRateLimitsInput = {
+	readonly emailOtpPerPerson?: InputMaybe<ConfigRateLimitWindowInput>
+	readonly emailVerificationPerIp?: InputMaybe<ConfigRateLimitWindowInput>
+	readonly loginPerIp?: InputMaybe<ConfigRateLimitWindowInput>
+	readonly passwordResetPerIp?: InputMaybe<ConfigRateLimitWindowInput>
+	readonly passwordlessInitPerIp?: InputMaybe<ConfigRateLimitWindowInput>
+	readonly signUpPerIp?: InputMaybe<ConfigRateLimitWindowInput>
+}
+
+export type ConfigSignup = {
+	readonly __typename?: 'ConfigSignup'
+	/**
+	 * When true, new accounts must verify their e-mail address before they can
+	 * sign in. The requirement is captured per account at sign-up, so toggling
+	 * this only affects accounts created afterwards. Defaults to false (no
+	 * change vs. previous behavior). E-mail changes are governed separately by
+	 * ConfigEmailChange.requireVerification.
+	 */
+	readonly requireEmailVerification: Scalars['Boolean']['output']
+}
+
+export type ConfigSignupInput = {
+	readonly requireEmailVerification?: InputMaybe<Scalars['Boolean']['input']>
+}
+
 export type ConfigureError = {
 	readonly __typename?: 'ConfigureError'
 	readonly code: ConfigureErrorCode
@@ -315,6 +636,46 @@ export type ConfigureResponse = {
 	readonly ok: Scalars['Boolean']['output']
 }
 
+export type ConfirmEmailChangeError = {
+	readonly __typename?: 'ConfirmEmailChangeError'
+	readonly code: ConfirmEmailChangeErrorCode
+	readonly developerMessage: Scalars['String']['output']
+}
+
+export type ConfirmEmailChangeErrorCode =
+	| 'EMAIL_ALREADY_EXISTS'
+	| 'INVALID_EMAIL_FORMAT'
+	| 'TOKEN_EXPIRED'
+	| 'TOKEN_INVALID'
+	| 'TOKEN_NOT_FOUND'
+	| 'TOKEN_USED'
+
+export type ConfirmEmailChangeResponse = {
+	readonly __typename?: 'ConfirmEmailChangeResponse'
+	readonly error?: Maybe<ConfirmEmailChangeError>
+	readonly ok: Scalars['Boolean']['output']
+}
+
+export type ConfirmEmailOtpError = {
+	readonly __typename?: 'ConfirmEmailOtpError'
+	readonly code: ConfirmEmailOtpErrorCode
+	readonly developerMessage: Scalars['String']['output']
+}
+
+export type ConfirmEmailOtpErrorCode = 'INVALID_OTP_TOKEN'
+
+export type ConfirmEmailOtpResponse = {
+	readonly __typename?: 'ConfirmEmailOtpResponse'
+	readonly error?: Maybe<ConfirmEmailOtpError>
+	readonly ok: Scalars['Boolean']['output']
+	readonly result?: Maybe<ConfirmEmailOtpResult>
+}
+
+export type ConfirmEmailOtpResult = {
+	readonly __typename?: 'ConfirmEmailOtpResult'
+	readonly backupCodes: ReadonlyArray<Scalars['String']['output']>
+}
+
 export type ConfirmOtpError = {
 	readonly __typename?: 'ConfirmOtpError'
 	readonly code: ConfirmOtpErrorCode
@@ -333,6 +694,12 @@ export type ConfirmOtpResponse = {
 	/** @deprecated Field no longer supported */
 	readonly errors: ReadonlyArray<ConfirmOtpError>
 	readonly ok: Scalars['Boolean']['output']
+	readonly result?: Maybe<ConfirmOtpResult>
+}
+
+export type ConfirmOtpResult = {
+	readonly __typename?: 'ConfirmOtpResult'
+	readonly backupCodes: ReadonlyArray<Scalars['String']['output']>
 }
 
 export type CreateApiKeyError = {
@@ -346,11 +713,23 @@ export type CreateApiKeyError = {
 
 export type CreateApiKeyErrorCode =
 	| 'INVALID_MEMBERSHIP'
+	| 'INVALID_ROLE'
 	| 'PROJECT_NOT_FOUND'
 	| 'ROLE_NOT_FOUND'
 	| 'VARIABLE_EMPTY'
 	| 'VARIABLE_NOT_FOUND'
 
+export type CreateApiKeyOptions = {
+	/**
+	 * If true, the created api_key trusts X-Contember-Client-IP and
+	 * X-Contember-Client-User-Agent headers on subsequent requests.
+	 * Intended for backend services that proxy user requests; the customer's
+	 * proxy must strip these headers from incoming traffic and re-inject
+	 * them with the real user values.
+	 */
+	readonly trustForwardedClientInfo?: InputMaybe<Scalars['Boolean']['input']>
+}
+
 export type CreateApiKeyResponse = {
 	readonly __typename?: 'CreateApiKeyResponse'
 	readonly error?: Maybe<CreateApiKeyError>
@@ -365,6 +744,49 @@ export type CreateApiKeyResult = {
 	readonly apiKey: ApiKeyWithToken
 }
 
+export type CreateAuthPolicyError = {
+	readonly __typename?: 'CreateAuthPolicyError'
+	readonly code: CreateAuthPolicyErrorCode
+	readonly developerMessage: Scalars['String']['output']
+}
+
+export type CreateAuthPolicyErrorCode =
+	| 'PROJECT_NOT_ALLOWED'
+	| 'PROJECT_NOT_FOUND'
+	| 'PROJECT_REQUIRED'
+
+export type CreateAuthPolicyResponse = {
+	readonly __typename?: 'CreateAuthPolicyResponse'
+	readonly error?: Maybe<CreateAuthPolicyError>
+	readonly ok: Scalars['Boolean']['output']
+	readonly result?: Maybe<CreateAuthPolicyResult>
+}
+
+export type CreateAuthPolicyResult = {
+	readonly __typename?: 'CreateAuthPolicyResult'
+	readonly id: Scalars['String']['output']
+}
+
+export type CreateCustomRoleError = {
+	readonly __typename?: 'CreateCustomRoleError'
+	readonly code: CreateCustomRoleErrorCode
+	readonly developerMessage: Scalars['String']['output']
+}
+
+export type CreateCustomRoleErrorCode =
+	| 'DUPLICATE_PERMISSION'
+	| 'INVALID_PERMISSION_CONFIGURATION'
+	| 'INVALID_SLUG'
+	| 'SLUG_ALREADY_ASSIGNED'
+	| 'SLUG_ALREADY_EXISTS'
+	| 'UNKNOWN_PERMISSION'
+
+export type CreateCustomRoleResponse = {
+	readonly __typename?: 'CreateCustomRoleResponse'
+	readonly error?: Maybe<CreateCustomRoleError>
+	readonly ok: Scalars['Boolean']['output']
+}
+
 export type CreatePasswordResetRequestError = {
 	readonly __typename?: 'CreatePasswordResetRequestError'
 	readonly code: CreatePasswordResetRequestErrorCode
@@ -373,7 +795,10 @@ export type CreatePasswordResetRequestError = {
 	readonly endUserMessage?: Maybe<Scalars['String']['output']>
 }
 
-export type CreatePasswordResetRequestErrorCode = 'PERSON_NOT_FOUND'
+export type CreatePasswordResetRequestErrorCode =
+	| 'INVALID_CAPTCHA'
+	| 'PERSON_NOT_FOUND'
+	| 'RATE_LIMIT_EXCEEDED'
 
 export type CreatePasswordResetRequestResponse = {
 	readonly __typename?: 'CreatePasswordResetRequestResponse'
@@ -439,6 +864,77 @@ export type CreateSessionTokenResult = CommonSignInResult & {
 	readonly token: Scalars['String']['output']
 }
 
+export type CustomRole = {
+	readonly __typename?: 'CustomRole'
+	readonly description?: Maybe<Scalars['String']['output']>
+	readonly grants: ReadonlyArray<CustomRoleGrant>
+	readonly slug: Scalars['String']['output']
+}
+
+export type CustomRoleConfigurationKind =
+	| 'CHANGE_PROFILE'
+	| 'CREATE_SESSION_TOKEN'
+	| 'GLOBAL_API_KEY'
+	| 'MAIL_TEMPLATE_SCOPE'
+	| 'NONE'
+	| 'ROLE_INPUT'
+	| 'ROLE_MUTATION'
+	| 'TARGET_IDENTITY'
+
+export type CustomRoleGrant = {
+	readonly __typename?: 'CustomRoleGrant'
+	readonly config?: Maybe<Scalars['Json']['output']>
+	readonly permission: Scalars['String']['output']
+}
+
+export type CustomRoleGrantInput = {
+	readonly config?: InputMaybe<Scalars['Json']['input']>
+	readonly permission: Scalars['String']['input']
+}
+
+export type CustomRolePermissionDefinition = {
+	readonly __typename?: 'CustomRolePermissionDefinition'
+	readonly configurationKind: CustomRoleConfigurationKind
+	readonly configurationRequired: Scalars['Boolean']['output']
+	readonly defaultConfig?: Maybe<Scalars['Json']['output']>
+	readonly name: Scalars['String']['output']
+}
+
+export type DeleteAuthPolicyError = {
+	readonly __typename?: 'DeleteAuthPolicyError'
+	readonly code: DeleteAuthPolicyErrorCode
+	readonly developerMessage: Scalars['String']['output']
+}
+
+export type DeleteAuthPolicyErrorCode = 'NOT_FOUND'
+
+export type DeleteAuthPolicyResponse = {
+	readonly __typename?: 'DeleteAuthPolicyResponse'
+	readonly error?: Maybe<DeleteAuthPolicyError>
+	readonly ok: Scalars['Boolean']['output']
+}
+
+export type DeleteCustomRoleError = {
+	readonly __typename?: 'DeleteCustomRoleError'
+	readonly code: DeleteCustomRoleErrorCode
+	readonly developerMessage: Scalars['String']['output']
+}
+
+export type DeleteCustomRoleErrorCode =
+	| 'NOT_FOUND'
+	/**
+	 * Another custom role's grant configuration references this one. Remove the reference first —
+	 * deleting would leave that role un-resubmittable, and recreating this slug would silently
+	 * re-bind the reference to a different definition.
+	 */
+	| 'ROLE_IN_USE'
+
+export type DeleteCustomRoleResponse = {
+	readonly __typename?: 'DeleteCustomRoleResponse'
+	readonly error?: Maybe<DeleteCustomRoleError>
+	readonly ok: Scalars['Boolean']['output']
+}
+
 export type DisableApiKeyError = {
 	readonly __typename?: 'DisableApiKeyError'
 	readonly code: DisableApiKeyErrorCode
@@ -457,6 +953,22 @@ export type DisableApiKeyResponse = {
 	readonly ok: Scalars['Boolean']['output']
 }
 
+export type DisableEmailOtpError = {
+	readonly __typename?: 'DisableEmailOtpError'
+	readonly code: DisableEmailOtpErrorCode
+	readonly developerMessage: Scalars['String']['output']
+}
+
+export type DisableEmailOtpErrorCode =
+	| 'EMAIL_OTP_NOT_ACTIVE'
+	| 'MFA_REQUIRED'
+
+export type DisableEmailOtpResponse = {
+	readonly __typename?: 'DisableEmailOtpResponse'
+	readonly error?: Maybe<DisableEmailOtpError>
+	readonly ok: Scalars['Boolean']['output']
+}
+
 export type DisableIdpError = {
 	readonly __typename?: 'DisableIDPError'
 	readonly code: DisableIdpErrorCode
@@ -479,7 +991,9 @@ export type DisableOtpError = {
 	readonly endUserMessage?: Maybe<Scalars['String']['output']>
 }
 
-export type DisableOtpErrorCode = 'OTP_NOT_ACTIVE'
+export type DisableOtpErrorCode =
+	| 'MFA_REQUIRED'
+	| 'OTP_NOT_ACTIVE'
 
 export type DisableOtpResponse = {
 	readonly __typename?: 'DisableOtpResponse'
@@ -505,6 +1019,36 @@ export type DisablePersonResponse = {
 	readonly ok: Scalars['Boolean']['output']
 }
 
+export type DisconnectIdpError = {
+	readonly __typename?: 'DisconnectIDPError'
+	readonly code: DisconnectIdpErrorCode
+	readonly developerMessage: Scalars['String']['output']
+}
+
+export type DisconnectIdpErrorCode =
+	/**
+	 * The provider has `disableLocalAuthentication`, so this connection is the only way
+	 * the person may sign in and cannot be removed by them — not even while the provider is disabled.
+	 */
+	| 'IDP_REQUIRED'
+	/**  The person is not allowed to disconnect their last remaining sign-in method.  */
+	| 'LAST_AUTH_METHOD'
+	/**  The caller is not a person (e.g. an API key) and so has no IdP connections to disconnect.  */
+	| 'NOT_A_PERSON'
+	/**  The authenticated person has no IdP connection with the given id.  */
+	| 'NOT_FOUND'
+
+export type DisconnectIdpResponse = {
+	readonly __typename?: 'DisconnectIDPResponse'
+	readonly error?: Maybe<DisconnectIdpError>
+	readonly ok: Scalars['Boolean']['output']
+}
+
+export type EmailVerificationOptions = {
+	readonly mailProject?: InputMaybe<Scalars['String']['input']>
+	readonly mailVariant?: InputMaybe<Scalars['String']['input']>
+}
+
 export type EnableIdpError = {
 	readonly __typename?: 'EnableIDPError'
 	readonly code: EnableIdpErrorCode
@@ -519,17 +1063,69 @@ export type EnableIdpResponse = {
 	readonly ok: Scalars['Boolean']['output']
 }
 
+export type EnablePersonError = {
+	readonly __typename?: 'EnablePersonError'
+	readonly code: EnablePersonErrorCode
+	readonly developerMessage: Scalars['String']['output']
+}
+
+export type EnablePersonErrorCode =
+	| 'PERSON_ALREADY_ENABLED'
+	| 'PERSON_NOT_FOUND'
+
+export type EnablePersonResponse = {
+	readonly __typename?: 'EnablePersonResponse'
+	readonly error?: Maybe<EnablePersonError>
+	readonly ok: Scalars['Boolean']['output']
+}
+
+export type ForceSignOutPersonError = {
+	readonly __typename?: 'ForceSignOutPersonError'
+	readonly code: ForceSignOutPersonErrorCode
+	readonly developerMessage: Scalars['String']['output']
+}
+
+export type ForceSignOutPersonErrorCode = 'PERSON_NOT_FOUND'
+
+export type ForceSignOutPersonResponse = {
+	readonly __typename?: 'ForceSignOutPersonResponse'
+	readonly error?: Maybe<ForceSignOutPersonError>
+	readonly ok: Scalars['Boolean']['output']
+}
+
 export type IdpOptions = {
+	readonly assumeEmailVerified?: InputMaybe<Scalars['Boolean']['input']>
 	readonly autoSignUp?: InputMaybe<Scalars['Boolean']['input']>
+	readonly disableLocalAuthentication?: InputMaybe<Scalars['Boolean']['input']>
 	readonly exclusive?: InputMaybe<Scalars['Boolean']['input']>
 	readonly initReturnsConfig?: InputMaybe<Scalars['Boolean']['input']>
+	readonly requireVerifiedEmail?: InputMaybe<Scalars['Boolean']['input']>
 }
 
 export type IdpOptionsOutput = {
 	readonly __typename?: 'IDPOptionsOutput'
+	/**
+	 * When true, e-mail addresses asserted by this provider are treated as verified
+	 * even without an "email_verified" claim. Use only for trusted providers.
+	 * Defaults to false.
+	 */
+	readonly assumeEmailVerified: Scalars['Boolean']['output']
 	readonly autoSignUp: Scalars['Boolean']['output']
+	/**
+	 * When true, a person linked to this provider may authenticate ONLY through it:
+	 * password sign-in and passwordless sign-in are refused and no password-reset
+	 * mail is sent. Disabling the provider lifts the restriction, which is the
+	 * break-glass for an IdP outage. Defaults to false.
+	 */
+	readonly disableLocalAuthentication: Scalars['Boolean']['output']
 	readonly exclusive: Scalars['Boolean']['output']
 	readonly initReturnsConfig: Scalars['Boolean']['output']
+	/**
+	 * When true, a non-exclusive provider may only auto-link to / sign in an
+	 * existing account by e-mail if the provider asserts the e-mail is verified.
+	 * Defaults to false.
+	 */
+	readonly requireVerifiedEmail: Scalars['Boolean']['output']
 }
 
 export type IdpResponseInput = {
@@ -545,12 +1141,50 @@ export type Identity = {
 	readonly person?: Maybe<Person>
 	readonly projects: ReadonlyArray<IdentityProjectRelation>
 	readonly roles?: Maybe<ReadonlyArray<Scalars['String']['output']>>
-}
-
+	/**
+	 * Active SESSION-type api keys for this identity. Always visible for
+	 * the calling identity (e.g. via `me { sessions }`). For other identities,
+	 * visible to callers holding the `person:viewSessions` permission against
+	 * the target — SUPER_ADMIN sees everyone; PROJECT_ADMIN sees everyone except
+	 * identities holding `super_admin` or `project_creator`; a custom role is
+	 * further bounded by its configured target constraints. Returns an
+	 * empty list rather than throwing when the viewer lacks visibility, so
+	 * batched identity queries do not abort on a single forbidden target.
+	 */
+	readonly sessions: ReadonlyArray<SessionInfo>
+}
+
+/**
+ * What the identity may do tenant-wide, evaluated against the same ACL the resolvers enforce.
+ *
+ * This is for building a UI that does not offer what it cannot deliver — it is **not** a security
+ * boundary, and answering `true` here grants nothing. Every operation is still checked when it is
+ * called. The distinction matters because permission failure is not uniform across this API: some
+ * queries answer an empty list, others throw, and every mutation throws, so a client cannot tell
+ * "nothing to show" from "not yours to see" by trying.
+ */
 export type IdentityGlobalPermissions = {
 	readonly __typename?: 'IdentityGlobalPermissions'
+	readonly canCreateGlobalApiKey: Scalars['Boolean']['output']
 	readonly canCreateProject: Scalars['Boolean']['output']
 	readonly canDeployEntrypoint: Scalars['Boolean']['output']
+	/**  Read `globalApiKeys`, which answers an empty list otherwise.  */
+	readonly canListGlobalApiKeys: Scalars['Boolean']['output']
+	/**  Read `identityProviders`.  */
+	readonly canListIdentityProviders: Scalars['Boolean']['output']
+	/**  Read `mailTemplates`.  */
+	readonly canListMailTemplates: Scalars['Boolean']['output']
+	/**
+	 * List every person in the tenant. Without it `persons` still answers, narrowed to the members
+	 * of the projects the caller administers — so this marks a full listing, not access to one.
+	 */
+	readonly canListPersons: Scalars['Boolean']['output']
+	/** Write the tenant configuration (`configure`) and read `authPolicies`. The CLI is the usual write path. */
+	readonly canManageConfiguration: Scalars['Boolean']['output']
+	/**  Read `authLog`, which throws otherwise.  */
+	readonly canViewAuthLog: Scalars['Boolean']['output']
+	/**  Read `configuration`, which throws otherwise. The other configuration queries gate on their own actions.  */
+	readonly canViewConfiguration: Scalars['Boolean']['output']
 }
 
 export type IdentityProjectRelation = {
@@ -568,6 +1202,30 @@ export type IdentityProvider = {
 	readonly type: Scalars['String']['output']
 }
 
+/**  Public view of an identity provider, exposed in personal IdP connection listings.  */
+export type IdentityProviderListItem = {
+	readonly __typename?: 'IdentityProviderListItem'
+	readonly disabledAt?: Maybe<Scalars['DateTime']['output']>
+	readonly slug: Scalars['String']['output']
+	readonly type: Scalars['String']['output']
+}
+
+export type InitEmailOtpError = {
+	readonly __typename?: 'InitEmailOtpError'
+	readonly code: InitEmailOtpErrorCode
+	readonly developerMessage: Scalars['String']['output']
+}
+
+export type InitEmailOtpErrorCode =
+	| 'NO_EMAIL'
+	| 'RATE_LIMITED'
+
+export type InitEmailOtpResponse = {
+	readonly __typename?: 'InitEmailOtpResponse'
+	readonly error?: Maybe<InitEmailOtpError>
+	readonly ok: Scalars['Boolean']['output']
+}
+
 export type InitSignInIdpError = {
 	readonly __typename?: 'InitSignInIDPError'
 	readonly code: InitSignInIdpErrorCode
@@ -603,8 +1261,15 @@ export type InitSignInPasswordlessError = {
 }
 
 export type InitSignInPasswordlessErrorCode =
+	/**
+	 * The person is linked to an identity provider with
+	 * `disableLocalAuthentication`, so passwordless sign-in is not available to them.
+	 */
+	| 'IDP_REQUIRED'
+	| 'INVALID_CAPTCHA'
 	| 'PASSWORDLESS_DISABLED'
 	| 'PERSON_NOT_FOUND'
+	| 'RATE_LIMIT_EXCEEDED'
 
 export type InitSignInPasswordlessOptions = {
 	readonly mailProject?: InputMaybe<Scalars['String']['input']>
@@ -695,10 +1360,17 @@ export type MailTemplateIdentifier = {
 }
 
 export type MailType =
+	| 'BACKUP_CODES_EXHAUSTED'
+	| 'EMAIL_CHANGE_NOTIFY'
+	| 'EMAIL_CHANGE_VERIFY'
+	| 'EMAIL_OTP'
+	| 'EMAIL_VERIFICATION'
 	| 'EXISTING_USER_INVITED'
+	| 'FORCED_SIGN_OUT'
 	| 'NEW_USER_INVITED'
 	| 'PASSWORDLESS_SIGN_IN'
 	| 'RESET_PASSWORD_REQUEST'
+	| 'UNUSUAL_LOGIN'
 
 export type MemberType =
 	| 'API_KEY'
@@ -728,6 +1400,12 @@ export type MembershipValidationErrorCode =
 	| 'VARIABLE_INVALID'
 	| 'VARIABLE_NOT_FOUND'
 
+export type MfaEnrollment = {
+	readonly __typename?: 'MfaEnrollment'
+	readonly otpSecret: Scalars['String']['output']
+	readonly otpUri: Scalars['String']['output']
+}
+
 export type Mutation = {
 	readonly __typename?: 'Mutation'
 	readonly activatePasswordlessOtp?: Maybe<ActivatePasswordlessOtpResponse>
@@ -742,29 +1420,60 @@ export type Mutation = {
 	readonly changePassword?: Maybe<ChangePasswordResponse>
 	readonly changeProfile?: Maybe<ChangeProfileResponse>
 	readonly configure?: Maybe<ConfigureResponse>
+	/**
+	 * Confirm a pending e-mail change (see changeMyProfile when
+	 * config.signup.requireEmailVerification is enabled). Consumes the token
+	 * that was mailed to the new address, swaps the address, and signs out all
+	 * existing sessions.
+	 */
+	readonly confirmEmailChange?: Maybe<ConfirmEmailChangeResponse>
+	readonly confirmEmailOtp?: Maybe<ConfirmEmailOtpResponse>
 	readonly confirmOtp?: Maybe<ConfirmOtpResponse>
 	readonly createApiKey?: Maybe<CreateApiKeyResponse>
+	readonly createAuthPolicy?: Maybe<CreateAuthPolicyResponse>
+	readonly createCustomRole?: Maybe<CreateCustomRoleResponse>
 	readonly createGlobalApiKey?: Maybe<CreateApiKeyResponse>
 	readonly createProject?: Maybe<CreateProjectResponse>
 	readonly createResetPasswordRequest?: Maybe<CreatePasswordResetRequestResponse>
 	readonly createSessionToken?: Maybe<CreateSessionTokenResponse>
+	readonly deleteAuthPolicy?: Maybe<DeleteAuthPolicyResponse>
+	readonly deleteCustomRole?: Maybe<DeleteCustomRoleResponse>
 	readonly disableApiKey?: Maybe<DisableApiKeyResponse>
+	readonly disableEmailOtp?: Maybe<DisableEmailOtpResponse>
 	readonly disableIDP?: Maybe<DisableIdpResponse>
 	readonly disableMyPasswordless?: Maybe<ToggleMyPasswordlessResponse>
 	readonly disableOtp?: Maybe<DisableOtpResponse>
 	readonly disablePerson?: Maybe<DisablePersonResponse>
+	/**
+	 * Disconnect one of the authenticated person's own external IdP connections,
+	 * addressed by the connection id (see PersonIdentityProvider.id) so a specific
+	 * connection can be removed even when the person has several to one provider.
+	 */
+	readonly disconnectMyIdentityProvider?: Maybe<DisconnectIdpResponse>
 	readonly enableIDP?: Maybe<EnableIdpResponse>
 	readonly enableMyPasswordless?: Maybe<ToggleMyPasswordlessResponse>
+	readonly enablePerson?: Maybe<EnablePersonResponse>
+	readonly forceSignOutPerson?: Maybe<ForceSignOutPersonResponse>
+	readonly initEmailOtp?: Maybe<InitEmailOtpResponse>
 	readonly initSignInIDP?: Maybe<InitSignInIdpResponse>
 	readonly initSignInPasswordless?: Maybe<InitSignInPasswordlessResponse>
 	readonly invite?: Maybe<InviteResponse>
 	readonly prepareOtp?: Maybe<PrepareOtpResponse>
+	readonly regenerateBackupCodes?: Maybe<RegenerateBackupCodesResponse>
 	readonly removeGlobalIdentityRoles?: Maybe<RemoveGlobalIdentityRolesResponse>
 	readonly removeMailTemplate?: Maybe<RemoveMailTemplateResponse>
 	/** @deprecated use removeMailTemplate */
 	readonly removeProjectMailTemplate?: Maybe<RemoveMailTemplateResponse>
 	readonly removeProjectMember?: Maybe<RemoveProjectMemberResponse>
+	/**
+	 * (Re)send the e-mail verification link for the given address. Always
+	 * reports ok regardless of whether the address exists or is already
+	 * verified, to avoid leaking account existence.
+	 */
+	readonly requestEmailVerification?: Maybe<RequestEmailVerificationResponse>
 	readonly resetPassword?: Maybe<ResetPasswordResponse>
+	readonly resetPersonMfa?: Maybe<ResetPersonMfaResponse>
+	readonly revokeSession?: Maybe<RevokeSessionResponse>
 	readonly setProjectSecret?: Maybe<SetProjectSecretResponse>
 	readonly signIn?: Maybe<SignInResponse>
 	readonly signInIDP?: Maybe<SignInIdpResponse>
@@ -772,9 +1481,12 @@ export type Mutation = {
 	readonly signOut?: Maybe<SignOutResponse>
 	readonly signUp?: Maybe<SignUpResponse>
 	readonly unmanagedInvite?: Maybe<InviteResponse>
+	readonly updateAuthPolicy?: Maybe<UpdateAuthPolicyResponse>
+	readonly updateCustomRole?: Maybe<UpdateCustomRoleResponse>
 	readonly updateIDP?: Maybe<UpdateIdpResponse>
 	readonly updateProject?: Maybe<UpdateProjectResponse>
 	readonly updateProjectMember?: Maybe<UpdateProjectMemberResponse>
+	readonly verifyEmail?: Maybe<VerifyEmailResponse>
 }
 
 export type MutationActivatePasswordlessOtpArgs = {
@@ -834,6 +1546,14 @@ export type MutationConfigureArgs = {
 	config: ConfigInput
 }
 
+export type MutationConfirmEmailChangeArgs = {
+	token: Scalars['String']['input']
+}
+
+export type MutationConfirmEmailOtpArgs = {
+	otpToken: Scalars['String']['input']
+}
+
 export type MutationConfirmOtpArgs = {
 	otpToken: Scalars['String']['input']
 }
@@ -841,12 +1561,24 @@ export type MutationConfirmOtpArgs = {
 export type MutationCreateApiKeyArgs = {
 	description: Scalars['String']['input']
 	memberships: ReadonlyArray<MembershipInput>
+	options?: InputMaybe<CreateApiKeyOptions>
 	projectSlug: Scalars['String']['input']
 	tokenHash?: InputMaybe<Scalars['String']['input']>
 }
 
+export type MutationCreateAuthPolicyArgs = {
+	policy: AuthPolicyInput
+}
+
+export type MutationCreateCustomRoleArgs = {
+	description?: InputMaybe<Scalars['String']['input']>
+	grants: ReadonlyArray<CustomRoleGrantInput>
+	slug: Scalars['String']['input']
+}
+
 export type MutationCreateGlobalApiKeyArgs = {
 	description: Scalars['String']['input']
+	options?: InputMaybe<CreateApiKeyOptions>
 	roles?: InputMaybe<ReadonlyArray<Scalars['String']['input']>>
 	tokenHash?: InputMaybe<Scalars['String']['input']>
 }
@@ -861,6 +1593,7 @@ export type MutationCreateProjectArgs = {
 }
 
 export type MutationCreateResetPasswordRequestArgs = {
+	captchaToken?: InputMaybe<Scalars['String']['input']>
 	email: Scalars['String']['input']
 	options?: InputMaybe<CreateResetPasswordRequestOptions>
 }
@@ -868,9 +1601,18 @@ export type MutationCreateResetPasswordRequestArgs = {
 export type MutationCreateSessionTokenArgs = {
 	email?: InputMaybe<Scalars['String']['input']>
 	expiration?: InputMaybe<Scalars['Int']['input']>
+	options?: InputMaybe<SignInOptions>
 	personId?: InputMaybe<Scalars['String']['input']>
 }
 
+export type MutationDeleteAuthPolicyArgs = {
+	id: Scalars['String']['input']
+}
+
+export type MutationDeleteCustomRoleArgs = {
+	slug: Scalars['String']['input']
+}
+
 export type MutationDisableApiKeyArgs = {
 	id: Scalars['String']['input']
 }
@@ -883,10 +1625,23 @@ export type MutationDisablePersonArgs = {
 	personId: Scalars['String']['input']
 }
 
+export type MutationDisconnectMyIdentityProviderArgs = {
+	id: Scalars['String']['input']
+}
+
 export type MutationEnableIdpArgs = {
 	identityProvider: Scalars['String']['input']
 }
 
+export type MutationEnablePersonArgs = {
+	personId: Scalars['String']['input']
+}
+
+export type MutationForceSignOutPersonArgs = {
+	personId: Scalars['String']['input']
+	reason?: InputMaybe<Scalars['String']['input']>
+}
+
 export type MutationInitSignInIdpArgs = {
 	data?: InputMaybe<Scalars['Json']['input']>
 	identityProvider: Scalars['String']['input']
@@ -894,6 +1649,7 @@ export type MutationInitSignInIdpArgs = {
 }
 
 export type MutationInitSignInPasswordlessArgs = {
+	captchaToken?: InputMaybe<Scalars['String']['input']>
 	email: Scalars['String']['input']
 	options?: InputMaybe<InitSignInPasswordlessOptions>
 }
@@ -928,11 +1684,25 @@ export type MutationRemoveProjectMemberArgs = {
 	projectSlug: Scalars['String']['input']
 }
 
+export type MutationRequestEmailVerificationArgs = {
+	captchaToken?: InputMaybe<Scalars['String']['input']>
+	email: Scalars['String']['input']
+	options?: InputMaybe<EmailVerificationOptions>
+}
+
 export type MutationResetPasswordArgs = {
 	password: Scalars['String']['input']
 	token: Scalars['String']['input']
 }
 
+export type MutationResetPersonMfaArgs = {
+	personId: Scalars['String']['input']
+}
+
+export type MutationRevokeSessionArgs = {
+	sessionId: Scalars['String']['input']
+}
+
 export type MutationSetProjectSecretArgs = {
 	key: Scalars['String']['input']
 	projectSlug: Scalars['String']['input']
@@ -940,8 +1710,10 @@ export type MutationSetProjectSecretArgs = {
 }
 
 export type MutationSignInArgs = {
+	backupCode?: InputMaybe<Scalars['String']['input']>
 	email: Scalars['String']['input']
 	expiration?: InputMaybe<Scalars['Int']['input']>
+	options?: InputMaybe<SignInOptions>
 	otpToken?: InputMaybe<Scalars['String']['input']>
 	password: Scalars['String']['input']
 }
@@ -951,13 +1723,16 @@ export type MutationSignInIdpArgs = {
 	expiration?: InputMaybe<Scalars['Int']['input']>
 	identityProvider: Scalars['String']['input']
 	idpResponse?: InputMaybe<IdpResponseInput>
+	options?: InputMaybe<SignInOptions>
 	redirectUrl?: InputMaybe<Scalars['String']['input']>
 	sessionData?: InputMaybe<Scalars['Json']['input']>
 }
 
 export type MutationSignInPasswordlessArgs = {
+	backupCode?: InputMaybe<Scalars['String']['input']>
 	expiration?: InputMaybe<Scalars['Int']['input']>
 	mfaOtp?: InputMaybe<Scalars['String']['input']>
+	options?: InputMaybe<SignInOptions>
 	requestId: Scalars['String']['input']
 	token: Scalars['String']['input']
 	validationType: PasswordlessValidationType
@@ -968,6 +1743,7 @@ export type MutationSignOutArgs = {
 }
 
 export type MutationSignUpArgs = {
+	captchaToken?: InputMaybe<Scalars['String']['input']>
 	email: Scalars['String']['input']
 	name?: InputMaybe<Scalars['String']['input']>
 	password?: InputMaybe<Scalars['String']['input']>
@@ -984,6 +1760,17 @@ export type MutationUnmanagedInviteArgs = {
 	projectSlug: Scalars['String']['input']
 }
 
+export type MutationUpdateAuthPolicyArgs = {
+	id: Scalars['String']['input']
+	policy: AuthPolicyInput
+}
+
+export type MutationUpdateCustomRoleArgs = {
+	description?: InputMaybe<Scalars['String']['input']>
+	grants?: InputMaybe<ReadonlyArray<CustomRoleGrantInput>>
+	slug: Scalars['String']['input']
+}
+
 export type MutationUpdateIdpArgs = {
 	configuration?: InputMaybe<Scalars['Json']['input']>
 	identityProvider: Scalars['String']['input']
@@ -1005,18 +1792,75 @@ export type MutationUpdateProjectMemberArgs = {
 	projectSlug: Scalars['String']['input']
 }
 
+export type MutationVerifyEmailArgs = {
+	token: Scalars['String']['input']
+}
+
 export type PasswordlessValidationType =
 	| 'otp'
 	| 'token'
 
 export type Person = {
 	readonly __typename?: 'Person'
+	/**
+	 * When the account was disabled (see `disablePerson`), null while the person
+	 * is active. Read-only — flip it with `disablePerson` / `enablePerson`.
+	 */
+	readonly disabledAt?: Maybe<Scalars['DateTime']['output']>
 	readonly email?: Maybe<Scalars['String']['output']>
+	/**
+	 * Whether e-mail based one-time-password 2FA is enabled for this person
+	 * (see `initEmailOtp` / `confirmEmailOtp` / `disableEmailOtp`). Independent
+	 * of `otpEnabled` (TOTP authenticator), so a UI can show each MFA method's
+	 * state separately.
+	 */
+	readonly emailOtpEnabled: Scalars['Boolean']['output']
+	readonly emailVerified: Scalars['Boolean']['output']
 	readonly id: Scalars['String']['output']
 	readonly identity: Identity
+	/**
+	 * External IdP connections of this person. Always visible for the calling
+	 * person (e.g. via `me { person { identityProviders } }`). For other
+	 * persons, visible to callers holding the `person:viewIdp` permission
+	 * against the target — SUPER_ADMIN sees everyone; PROJECT_ADMIN sees
+	 * everyone except identities holding `super_admin` or `project_creator`;
+	 * a custom role is further bounded by its configured target constraints.
+	 * Returns an empty list rather than throwing when the viewer lacks visibility.
+	 */
+	readonly identityProviders: ReadonlyArray<PersonIdentityProvider>
 	readonly name?: Maybe<Scalars['String']['output']>
 	readonly otpEnabled: Scalars['Boolean']['output']
+	/**
+	 * Whether passwordless sign-in is actually usable for this person right now: the tenant-wide
+	 * policy resolved against `passwordlessEnabled`, i.e. the very same decision `signIn` makes. A UI
+	 * offering an enable/disable toggle must branch on this — under an `always` or `never` policy the
+	 * raw opt-in flag says nothing about what will happen.
+	 */
+	readonly passwordlessAvailable: Scalars['Boolean']['output']
+	/**  The person's own opt-in flag; `null` means "follow the tenant policy". On its own it does not say whether passwordless sign-in works — see `passwordlessAvailable`.  */
 	readonly passwordlessEnabled?: Maybe<Scalars['Boolean']['output']>
+	/**
+	 * Whether `passwordlessEnabled` is what decides `passwordlessAvailable`. False under an `always`
+	 * or `never` policy, where the person's own flag is ignored — a UI should then report the state
+	 * rather than offer a toggle that changes nothing.
+	 */
+	readonly passwordlessSelfManaged: Scalars['Boolean']['output']
+}
+
+/**  A single external IdP connection of the currently authenticated person.  */
+export type PersonIdentityProvider = {
+	readonly __typename?: 'PersonIdentityProvider'
+	readonly createdAt: Scalars['DateTime']['output']
+	readonly externalIdentifier: Scalars['String']['output']
+	readonly id: Scalars['String']['output']
+	readonly identityProvider: IdentityProviderListItem
+}
+
+/**  Filter for the `persons` query. Fields are combined with AND.  */
+export type PersonsFilter = {
+	readonly email?: InputMaybe<Scalars['String']['input']>
+	readonly identityId?: InputMaybe<Scalars['String']['input']>
+	readonly personId?: InputMaybe<Scalars['String']['input']>
 }
 
 export type PrepareOtpResponse = {
@@ -1033,11 +1877,28 @@ export type PrepareOtpResult = {
 
 export type Project = {
 	readonly __typename?: 'Project'
+	/**
+	 * Permanent API keys scoped to this project — keys whose identity is a member
+	 * of the project (excludes SESSION tokens and global keys). Each key's
+	 * project memberships are reachable via `apiKey.identity.projects` for
+	 * cloning when (re)issuing a key. Requires `project.view members` permission;
+	 * returns an empty list otherwise.
+	 */
+	readonly apiKeys: ReadonlyArray<ApiKey>
 	readonly config: Scalars['Json']['output']
 	readonly id: Scalars['String']['output']
 	readonly members: ReadonlyArray<ProjectIdentityRelation>
 	readonly name: Scalars['String']['output']
+	/**  What the calling identity may do here. Advisory — for building the UI, not for enforcing it.  */
+	readonly permissions: ProjectPermissions
 	readonly roles: ReadonlyArray<RoleDefinition>
+	/**
+	 * Names of the project's secrets (see `setProjectSecret`). Secret VALUES are
+	 * never returned — only the keys and their timestamps — so a UI can show which
+	 * secrets exist. Requires the `project:viewSecrets` permission (project admins
+	 * + SUPER_ADMIN by default); returns an empty list otherwise.
+	 */
+	readonly secrets: ReadonlyArray<ProjectSecretInfo>
 	readonly slug: Scalars['String']['output']
 }
 
@@ -1065,24 +1926,107 @@ export type ProjectMembersInput = {
 	readonly offset?: InputMaybe<Scalars['Int']['input']>
 }
 
+/**
+ * What the calling identity may do in this project. Same contract as
+ * `IdentityGlobalPermissions`: advisory, evaluated per caller, never a substitute for the checks in
+ * the resolvers.
+ */
+export type ProjectPermissions = {
+	readonly __typename?: 'ProjectPermissions'
+	/**  Invite or add a member (`invite`, `addProjectMember`). Which roles may be granted is checked per membership.  */
+	readonly canAddMember: Scalars['Boolean']['output']
+	/**  Create an API key scoped to this project.  */
+	readonly canCreateApiKey: Scalars['Boolean']['output']
+	readonly canRemoveMember: Scalars['Boolean']['output']
+	/**  Write a project secret (`setProjectSecret`). Distinct from viewing: a project admin commonly has one and not the other.  */
+	readonly canSetSecret: Scalars['Boolean']['output']
+	/**  Update the project itself (`updateProject`).  */
+	readonly canUpdate: Scalars['Boolean']['output']
+	readonly canUpdateMember: Scalars['Boolean']['output']
+	/**  Read `members` and `apiKeys`; both answer an empty list otherwise.  */
+	readonly canViewMembers: Scalars['Boolean']['output']
+	/**  Read `secrets` (their names, never values); answers an empty list otherwise.  */
+	readonly canViewSecrets: Scalars['Boolean']['output']
+}
+
 export type ProjectSecret = {
 	readonly key: Scalars['String']['input']
 	readonly value: Scalars['String']['input']
 }
 
+/**  Metadata about a project secret — never its value.  */
+export type ProjectSecretInfo = {
+	readonly __typename?: 'ProjectSecretInfo'
+	readonly createdAt: Scalars['DateTime']['output']
+	readonly key: Scalars['String']['output']
+	readonly updatedAt: Scalars['DateTime']['output']
+}
+
 export type Query = {
 	readonly __typename?: 'Query'
+	/**
+	 * Read the tenant audit log (`person_auth_log`). Requires the
+	 * `system:viewAuthLog` permission — granted to SUPER_ADMIN and
+	 * PROJECT_ADMIN by default, and grantable to a custom role.
+	 * Ordered by created_at DESC. Page size is capped server-side
+	 * (default 100, max 500); `hasMore` indicates a further page exists.
+	 */
+	readonly authLog: AuthLogPage
+	/**
+	 * List configured auth policies (per-role MFA / session policy). Requires the
+	 * `system:configure` permission — by default granted only to SUPER_ADMIN
+	 * (and PROJECT_ADMIN, like `configure`). With no rows configured, MFA
+	 * enforcement is inert and sign-in behaves exactly as today.
+	 */
+	readonly authPolicies: ReadonlyArray<AuthPolicy>
 	readonly checkResetPasswordToken: CheckResetPasswordTokenCode
 	readonly configuration: Config
+	/**
+	 * List exact permission definitions grantable to a custom role. Requires
+	 * the `customRole:view` permission.
+	 */
+	readonly customRolePermissions: ReadonlyArray<CustomRolePermissionDefinition>
+	/**
+	 * List custom roles (runtime-defined global roles carrying a bundle of tenant
+	 * permissions). Requires the `customRole:view` permission — granted to
+	 * SUPER_ADMIN and PROJECT_ADMIN by default, and itself grantable to a custom
+	 * role. Managing definitions needs `customRole:manage`, which is not grantable.
+	 */
+	readonly customRoles: ReadonlyArray<CustomRole>
+	/**
+	 * List global (project-independent) permanent API keys — those created via
+	 * `createGlobalApiKey`, whose identity carries global roles and no project
+	 * membership. Requires the `apiKey:list` permission — granted to SUPER_ADMIN
+	 * and PROJECT_ADMIN by default, and grantable to a custom role.
+	 * Returns an empty list when the caller may not list them. To list a
+	 * project's keys use `project.apiKeys`.
+	 */
+	readonly globalApiKeys: ReadonlyArray<ApiKey>
 	readonly identityProviders: ReadonlyArray<IdentityProvider>
 	readonly mailTemplates: ReadonlyArray<MailTemplateData>
 	readonly me: Identity
 	readonly personById?: Maybe<Person>
+	/**
+	 * List persons across the tenant. Requires the `person:list` permission —
+	 * held by SUPER_ADMIN and PROJECT_ADMIN, and grantable to a custom role — which
+	 * lists every person. Without it the result is scoped to persons who are members
+	 * of a project the caller may view members of (i.e. the same persons reachable
+	 * via `project.members`). `filter` matches by e-mail (case-insensitive),
+	 * `personId`, or `identityId`; `limit`/`offset` paginate. Returns an empty
+	 * list when the caller may not list anyone.
+	 */
+	readonly persons: ReadonlyArray<Person>
 	readonly projectBySlug?: Maybe<Project>
 	readonly projectMemberships: ReadonlyArray<Membership>
 	readonly projects: ReadonlyArray<Project>
 }
 
+export type QueryAuthLogArgs = {
+	filter?: InputMaybe<AuthLogFilter>
+	limit?: InputMaybe<Scalars['Int']['input']>
+	offset?: InputMaybe<Scalars['Int']['input']>
+}
+
 export type QueryCheckResetPasswordTokenArgs = {
 	requestId: Scalars['String']['input']
 	token: Scalars['String']['input']
@@ -1092,6 +2036,12 @@ export type QueryPersonByIdArgs = {
 	id: Scalars['String']['input']
 }
 
+export type QueryPersonsArgs = {
+	filter?: InputMaybe<PersonsFilter>
+	limit?: InputMaybe<Scalars['Int']['input']>
+	offset?: InputMaybe<Scalars['Int']['input']>
+}
+
 export type QueryProjectBySlugArgs = {
 	slug: Scalars['String']['input']
 }
@@ -1101,6 +2051,26 @@ export type QueryProjectMembershipsArgs = {
 	projectSlug: Scalars['String']['input']
 }
 
+export type RegenerateBackupCodesError = {
+	readonly __typename?: 'RegenerateBackupCodesError'
+	readonly code: RegenerateBackupCodesErrorCode
+	readonly developerMessage: Scalars['String']['output']
+}
+
+export type RegenerateBackupCodesErrorCode = 'OTP_NOT_ACTIVE'
+
+export type RegenerateBackupCodesResponse = {
+	readonly __typename?: 'RegenerateBackupCodesResponse'
+	readonly error?: Maybe<RegenerateBackupCodesError>
+	readonly ok: Scalars['Boolean']['output']
+	readonly result?: Maybe<RegenerateBackupCodesResult>
+}
+
+export type RegenerateBackupCodesResult = {
+	readonly __typename?: 'RegenerateBackupCodesResult'
+	readonly backupCodes: ReadonlyArray<Scalars['String']['output']>
+}
+
 export type RemoveGlobalIdentityRolesError = {
 	readonly __typename?: 'RemoveGlobalIdentityRolesError'
 	readonly code: RemoveGlobalIdentityRolesErrorCode
@@ -1161,6 +2131,22 @@ export type RemoveProjectMemberResponse = {
 	readonly ok: Scalars['Boolean']['output']
 }
 
+export type RequestEmailVerificationError = {
+	readonly __typename?: 'RequestEmailVerificationError'
+	readonly code: RequestEmailVerificationErrorCode
+	readonly developerMessage: Scalars['String']['output']
+}
+
+export type RequestEmailVerificationErrorCode =
+	| 'INVALID_CAPTCHA'
+	| 'RATE_LIMIT_EXCEEDED'
+
+export type RequestEmailVerificationResponse = {
+	readonly __typename?: 'RequestEmailVerificationResponse'
+	readonly error?: Maybe<RequestEmailVerificationError>
+	readonly ok: Scalars['Boolean']['output']
+}
+
 export type ResetPasswordError = {
 	readonly __typename?: 'ResetPasswordError'
 	readonly code: ResetPasswordErrorCode
@@ -1185,6 +2171,36 @@ export type ResetPasswordResponse = {
 	readonly ok: Scalars['Boolean']['output']
 }
 
+export type ResetPersonMfaError = {
+	readonly __typename?: 'ResetPersonMfaError'
+	readonly code: ResetPersonMfaErrorCode
+	readonly developerMessage: Scalars['String']['output']
+}
+
+export type ResetPersonMfaErrorCode = 'PERSON_NOT_FOUND'
+
+export type ResetPersonMfaResponse = {
+	readonly __typename?: 'ResetPersonMfaResponse'
+	readonly error?: Maybe<ResetPersonMfaError>
+	readonly ok: Scalars['Boolean']['output']
+}
+
+export type RevokeSessionError = {
+	readonly __typename?: 'RevokeSessionError'
+	readonly code: RevokeSessionErrorCode
+	readonly developerMessage: Scalars['String']['output']
+}
+
+export type RevokeSessionErrorCode =
+	| 'NOT_A_PERSON'
+	| 'SESSION_NOT_FOUND'
+
+export type RevokeSessionResponse = {
+	readonly __typename?: 'RevokeSessionResponse'
+	readonly error?: Maybe<RevokeSessionError>
+	readonly ok: Scalars['Boolean']['output']
+}
+
 export type RoleConditionVariableDefinition = RoleVariableDefinition & {
 	readonly __typename?: 'RoleConditionVariableDefinition'
 	readonly name: Scalars['String']['output']
@@ -1212,6 +2228,26 @@ export type RoleVariableDefinition = {
 	readonly name: Scalars['String']['output']
 }
 
+export type SessionInfo = {
+	readonly __typename?: 'SessionInfo'
+	readonly createdAt: Scalars['DateTime']['output']
+	readonly createdIp?: Maybe<Scalars['String']['output']>
+	readonly createdUserAgent?: Maybe<Scalars['String']['output']>
+	readonly expiresAt?: Maybe<Scalars['DateTime']['output']>
+	readonly id: Scalars['String']['output']
+	readonly isCurrent: Scalars['Boolean']['output']
+	readonly lastIp?: Maybe<Scalars['String']['output']>
+	readonly lastUsedAt?: Maybe<Scalars['DateTime']['output']>
+	readonly lastUserAgent?: Maybe<Scalars['String']['output']>
+	/**
+	 * Whether this session honors X-Contember-Client-IP /
+	 * X-Contember-Client-User-Agent headers on subsequent requests. Set when
+	 * the session was minted via `SignInOptions.trustForwardedClientInfo`
+	 * from an api_key that was itself created with the flag.
+	 */
+	readonly trustForwardedClientInfo: Scalars['Boolean']['output']
+}
+
 export type SetProjectSecretError = {
 	readonly __typename?: 'SetProjectSecretError'
 	readonly code: SetProjectSecretErrorCode
@@ -1232,13 +2268,27 @@ export type SignInError = {
 	readonly developerMessage: Scalars['String']['output']
 	/** @deprecated Field no longer supported */
 	readonly endUserMessage?: Maybe<Scalars['String']['output']>
+	/**
+	 * Set only on a MFA_ENROLLMENT_REQUIRED error: the freshly provisioned
+	 * pending TOTP secret the client must enroll (show the QR / secret, then
+	 * retry signIn with otpToken). Additive — clients that don't read it are
+	 * unaffected.
+	 */
+	readonly mfaEnrollment?: Maybe<MfaEnrollment>
 	readonly retryAfter?: Maybe<Scalars['Int']['output']>
 }
 
 export type SignInErrorCode =
+	| 'EMAIL_NOT_VERIFIED'
+	/**
+	 * The person is linked to an identity provider with
+	 * `disableLocalAuthentication`, so password sign-in is not available to them.
+	 */
+	| 'IDP_REQUIRED'
 	| 'INVALID_CREDENTIALS'
 	| 'INVALID_OTP_TOKEN'
 	| 'INVALID_PASSWORD'
+	| 'MFA_ENROLLMENT_REQUIRED'
 	| 'NO_PASSWORD_SET'
 	| 'OTP_REQUIRED'
 	| 'PERSON_DISABLED'
@@ -1276,6 +2326,22 @@ export type SignInIdpResult = CommonSignInResult & {
 	readonly token: Scalars['String']['output']
 }
 
+export type SignInOptions = {
+	/**
+	 * If true, and the calling api_key has trust_forwarded_info=true,
+	 * the resulting session token will trust X-Contember-Client-IP and
+	 * X-Contember-Client-User-Agent headers on subsequent requests.
+	 * Silently ignored when the caller's api_key does not have the flag.
+	 *
+	 * Security: a proxy that sets these headers MUST strip any
+	 * incoming X-Contember-Client-IP / X-Contember-Client-User-Agent
+	 * from upstream traffic and re-inject values it trusts. Without
+	 * that, any client holding a session token minted with this flag
+	 * could spoof its own IP/User-Agent.
+	 */
+	readonly trustForwardedClientInfo?: InputMaybe<Scalars['Boolean']['input']>
+}
+
 export type SignInPasswordlessError = {
 	readonly __typename?: 'SignInPasswordlessError'
 	readonly code: SignInPasswordlessErrorCode
@@ -1283,7 +2349,13 @@ export type SignInPasswordlessError = {
 }
 
 export type SignInPasswordlessErrorCode =
+	/**
+	 * The person became linked to an identity provider with
+	 * `disableLocalAuthentication` after this magic link was issued.
+	 */
+	| 'IDP_REQUIRED'
 	| 'INVALID_OTP_TOKEN'
+	| 'MFA_ENROLLMENT_REQUIRED'
 	| 'OTP_REQUIRED'
 	| 'PERSON_DISABLED'
 	| 'TOKEN_EXPIRED'
@@ -1315,6 +2387,11 @@ export type SignInResponse = {
 
 export type SignInResult = CommonSignInResult & {
 	readonly __typename?: 'SignInResult'
+	/**
+	 * Set only when this sign-in completed an MFA enrollment (A06): the freshly
+	 * generated backup codes, shown exactly once. Null on a normal sign-in.
+	 */
+	readonly backupCodes?: Maybe<ReadonlyArray<Scalars['String']['output']>>
 	readonly person: Person
 	readonly token: Scalars['String']['output']
 }
@@ -1336,6 +2413,13 @@ export type SignOutResponse = {
 	readonly error?: Maybe<SignOutError>
 	/** @deprecated Field no longer supported */
 	readonly errors: ReadonlyArray<SignOutError>
+	/**
+	 * When the session was federated via an OIDC identity provider that supports RP-initiated
+	 * (front-channel) logout, the URL the client should redirect the browser to so the user is
+	 * also signed out at the IdP (Single Logout). Null for plain sessions or legacy IdPs without
+	 * an end-session endpoint, in which case only a local logout happened.
+	 */
+	readonly logoutUrl?: Maybe<Scalars['String']['output']>
 	readonly ok: Scalars['Boolean']['output']
 }
 
@@ -1345,14 +2429,26 @@ export type SignUpError = {
 	readonly developerMessage: Scalars['String']['output']
 	/** @deprecated Field no longer supported */
 	readonly endPersonMessage?: Maybe<Scalars['String']['output']>
+	/**
+	 * For EMAIL_ALREADY_EXISTS, the recommended next action client UIs should
+	 * offer to the visitor. Null for unrelated error codes.
+	 */
+	readonly recommendedAction?: Maybe<SignUpRecommendedAction>
 	readonly weakPasswordReasons?: Maybe<ReadonlyArray<WeakPasswordReason>>
 }
 
 export type SignUpErrorCode =
 	| 'EMAIL_ALREADY_EXISTS'
+	| 'INVALID_CAPTCHA'
 	| 'INVALID_EMAIL_FORMAT'
+	| 'INVALID_ROLE'
+	| 'RATE_LIMIT_EXCEEDED'
 	| 'TOO_WEAK'
 
+export type SignUpRecommendedAction =
+	| 'RESET_PASSWORD'
+	| 'SIGN_IN'
+
 export type SignUpResponse = {
 	readonly __typename?: 'SignUpResponse'
 	readonly error?: Maybe<SignUpError>
@@ -1388,17 +2484,53 @@ export type UnmanagedInviteOptions = {
 	readonly resetTokenHash?: InputMaybe<Scalars['String']['input']>
 }
 
-export type UpdateIdpError = {
-	readonly __typename?: 'UpdateIDPError'
-	readonly code: UpdateIdpErrorCode
+export type UpdateAuthPolicyError = {
+	readonly __typename?: 'UpdateAuthPolicyError'
+	readonly code: UpdateAuthPolicyErrorCode
 	readonly developerMessage: Scalars['String']['output']
 }
 
-export type UpdateIdpErrorCode =
-	| 'INVALID_CONFIGURATION'
+export type UpdateAuthPolicyErrorCode =
 	| 'NOT_FOUND'
+	| 'PROJECT_NOT_ALLOWED'
+	| 'PROJECT_NOT_FOUND'
+	| 'PROJECT_REQUIRED'
 
-export type UpdateIdpResponse = {
+export type UpdateAuthPolicyResponse = {
+	readonly __typename?: 'UpdateAuthPolicyResponse'
+	readonly error?: Maybe<UpdateAuthPolicyError>
+	readonly ok: Scalars['Boolean']['output']
+}
+
+export type UpdateCustomRoleError = {
+	readonly __typename?: 'UpdateCustomRoleError'
+	readonly code: UpdateCustomRoleErrorCode
+	readonly developerMessage: Scalars['String']['output']
+}
+
+export type UpdateCustomRoleErrorCode =
+	| 'DUPLICATE_PERMISSION'
+	| 'INVALID_PERMISSION_CONFIGURATION'
+	| 'NOT_FOUND'
+	| 'UNKNOWN_PERMISSION'
+
+export type UpdateCustomRoleResponse = {
+	readonly __typename?: 'UpdateCustomRoleResponse'
+	readonly error?: Maybe<UpdateCustomRoleError>
+	readonly ok: Scalars['Boolean']['output']
+}
+
+export type UpdateIdpError = {
+	readonly __typename?: 'UpdateIDPError'
+	readonly code: UpdateIdpErrorCode
+	readonly developerMessage: Scalars['String']['output']
+}
+
+export type UpdateIdpErrorCode =
+	| 'INVALID_CONFIGURATION'
+	| 'NOT_FOUND'
+
+export type UpdateIdpResponse = {
 	readonly __typename?: 'UpdateIDPResponse'
 	readonly error?: Maybe<UpdateIdpError>
 	readonly ok: Scalars['Boolean']['output']
@@ -1454,8 +2586,27 @@ export type VariableEntryInput = {
 	readonly values: ReadonlyArray<Scalars['String']['input']>
 }
 
+export type VerifyEmailError = {
+	readonly __typename?: 'VerifyEmailError'
+	readonly code: VerifyEmailErrorCode
+	readonly developerMessage: Scalars['String']['output']
+}
+
+export type VerifyEmailErrorCode =
+	| 'TOKEN_EXPIRED'
+	| 'TOKEN_INVALID'
+	| 'TOKEN_NOT_FOUND'
+	| 'TOKEN_USED'
+
+export type VerifyEmailResponse = {
+	readonly __typename?: 'VerifyEmailResponse'
+	readonly error?: Maybe<VerifyEmailError>
+	readonly ok: Scalars['Boolean']['output']
+}
+
 export type WeakPasswordReason =
 	| 'BLACKLISTED'
+	| 'COMPROMISED'
 	| 'INVALID_PATTERN'
 	| 'MISSING_DIGIT'
 	| 'MISSING_LOWERCASE'
@@ -1468,7 +2619,7 @@ export type ResolverTypeWrapper<T> = Promise<T> | T
 export type ResolverWithResolve<TResult, TParent, TContext, TArgs> = {
 	resolve: ResolverFn<TResult, TParent, TContext, TArgs>
 }
-export type Resolver<TResult, TParent = {}, TContext = {}, TArgs = {}> =
+export type Resolver<TResult, TParent = Record<PropertyKey, never>, TContext = Record<PropertyKey, never>, TArgs = Record<PropertyKey, never>> =
 	| ResolverFn<TResult, TParent, TContext, TArgs>
 	| ResolverWithResolve<TResult, TParent, TContext, TArgs>
 
@@ -1507,21 +2658,36 @@ export type SubscriptionObject<TResult, TKey extends string, TParent, TContext,
 	| SubscriptionSubscriberObject<TResult, TKey, TParent, TContext, TArgs>
 	| SubscriptionResolverObject<TResult, TParent, TContext, TArgs>
 
-export type SubscriptionResolver<TResult, TKey extends string, TParent = {}, TContext = {}, TArgs = {}> =
+export type SubscriptionResolver<
+	TResult,
+	TKey extends string,
+	TParent = Record<PropertyKey, never>,
+	TContext = Record<PropertyKey, never>,
+	TArgs = Record<PropertyKey, never>,
+> =
 	| ((...args: any[]) => SubscriptionObject<TResult, TKey, TParent, TContext, TArgs>)
 	| SubscriptionObject<TResult, TKey, TParent, TContext, TArgs>
 
-export type TypeResolveFn<TTypes, TParent = {}, TContext = {}> = (
+export type TypeResolveFn<TTypes, TParent = Record<PropertyKey, never>, TContext = Record<PropertyKey, never>> = (
 	parent: TParent,
 	context: TContext,
 	info: GraphQLResolveInfo,
 ) => Maybe<TTypes> | Promise<Maybe<TTypes>>
 
-export type IsTypeOfResolverFn<T = {}, TContext = {}> = (obj: T, context: TContext, info: GraphQLResolveInfo) => boolean | Promise<boolean>
+export type IsTypeOfResolverFn<T = Record<PropertyKey, never>, TContext = Record<PropertyKey, never>> = (
+	obj: T,
+	context: TContext,
+	info: GraphQLResolveInfo,
+) => boolean | Promise<boolean>
 
 export type NextResolverFn<T> = () => Promise<T>
 
-export type DirectiveResolverFn<TResult = {}, TParent = {}, TContext = {}, TArgs = {}> = (
+export type DirectiveResolverFn<
+	TResult = Record<PropertyKey, never>,
+	TParent = Record<PropertyKey, never>,
+	TContext = Record<PropertyKey, never>,
+	TArgs = Record<PropertyKey, never>,
+> = (
 	next: NextResolverFn<TResult>,
 	parent: TParent,
 	args: TArgs,
@@ -1531,8 +2697,15 @@ export type DirectiveResolverFn<TResult = {}, TParent = {}, TContext = {}, TArgs
 
 /** Mapping of interface types */
 export type ResolversInterfaceTypes<_RefType extends Record<string, unknown>> = {
-	CommonSignInResult: (CreateSessionTokenResult) | (SignInIdpResult) | (SignInPasswordlessResult) | (SignInResult)
-	RoleVariableDefinition: (RoleConditionVariableDefinition) | (RoleEntityVariableDefinition) | (RolePredefinedVariableDefinition)
+	CommonSignInResult:
+		| (CreateSessionTokenResult)
+		| (SignInIdpResult)
+		| (SignInPasswordlessResult)
+		| (SignInResult)
+	RoleVariableDefinition:
+		| (RoleConditionVariableDefinition)
+		| (RoleEntityVariableDefinition)
+		| (RolePredefinedVariableDefinition)
 }
 
 /** Mapping between all available schema types and the resolvers types */
@@ -1556,8 +2729,16 @@ export type ResolversTypes = {
 	AddProjectMemberErrorCode: AddProjectMemberErrorCode
 	AddProjectMemberResponse: ResolverTypeWrapper<AddProjectMemberResponse>
 	ApiKey: ResolverTypeWrapper<Omit<ApiKey, 'identity'> & { identity: ResolversTypes['Identity'] }>
+	ApiKeyType: ApiKeyType
 	ApiKeyWithToken: ResolverTypeWrapper<Omit<ApiKeyWithToken, 'identity'> & { identity: ResolversTypes['Identity'] }>
+	AuthLogEntry: ResolverTypeWrapper<AuthLogEntry>
+	AuthLogFilter: AuthLogFilter
+	AuthLogPage: ResolverTypeWrapper<AuthLogPage>
+	AuthPolicy: ResolverTypeWrapper<AuthPolicy>
+	AuthPolicyInput: AuthPolicyInput
+	AuthPolicyScope: AuthPolicyScope
 	Boolean: ResolverTypeWrapper<Scalars['Boolean']['output']>
+	CaptchaProvider: CaptchaProvider
 	ChangeMyPasswordError: ResolverTypeWrapper<ChangeMyPasswordError>
 	ChangeMyPasswordErrorCode: ChangeMyPasswordErrorCode
 	ChangeMyPasswordResponse: ResolverTypeWrapper<ChangeMyPasswordResponse>
@@ -1574,24 +2755,56 @@ export type ResolversTypes = {
 	CheckResetPasswordTokenResult: ResolverTypeWrapper<CheckResetPasswordTokenResult>
 	CommonSignInResult: ResolverTypeWrapper<ResolversInterfaceTypes<ResolversTypes>['CommonSignInResult']>
 	Config: ResolverTypeWrapper<Config>
+	ConfigCaptcha: ResolverTypeWrapper<ConfigCaptcha>
+	ConfigCaptchaInput: ConfigCaptchaInput
+	ConfigCaptchaProtect: ResolverTypeWrapper<ConfigCaptchaProtect>
+	ConfigCaptchaProtectInput: ConfigCaptchaProtectInput
+	ConfigEmailChange: ResolverTypeWrapper<ConfigEmailChange>
+	ConfigEmailChangeInput: ConfigEmailChangeInput
 	ConfigInput: ConfigInput
 	ConfigLogin: ResolverTypeWrapper<ConfigLogin>
+	ConfigLoginAnomalyDetection: ResolverTypeWrapper<ConfigLoginAnomalyDetection>
+	ConfigLoginAnomalyDetectionInput: ConfigLoginAnomalyDetectionInput
 	ConfigLoginInput: ConfigLoginInput
+	ConfigPanel: ResolverTypeWrapper<ConfigPanel>
+	ConfigPanelInput: ConfigPanelInput
 	ConfigPassword: ResolverTypeWrapper<ConfigPassword>
 	ConfigPasswordInput: ConfigPasswordInput
 	ConfigPasswordless: ResolverTypeWrapper<ConfigPasswordless>
 	ConfigPasswordlessInput: ConfigPasswordlessInput
 	ConfigPolicy: ConfigPolicy
+	ConfigRateLimitWindow: ResolverTypeWrapper<ConfigRateLimitWindow>
+	ConfigRateLimitWindowInput: ConfigRateLimitWindowInput
+	ConfigRateLimits: ResolverTypeWrapper<ConfigRateLimits>
+	ConfigRateLimitsInput: ConfigRateLimitsInput
+	ConfigSignup: ResolverTypeWrapper<ConfigSignup>
+	ConfigSignupInput: ConfigSignupInput
 	ConfigureError: ResolverTypeWrapper<ConfigureError>
 	ConfigureErrorCode: ConfigureErrorCode
 	ConfigureResponse: ResolverTypeWrapper<ConfigureResponse>
+	ConfirmEmailChangeError: ResolverTypeWrapper<ConfirmEmailChangeError>
+	ConfirmEmailChangeErrorCode: ConfirmEmailChangeErrorCode
+	ConfirmEmailChangeResponse: ResolverTypeWrapper<ConfirmEmailChangeResponse>
+	ConfirmEmailOtpError: ResolverTypeWrapper<ConfirmEmailOtpError>
+	ConfirmEmailOtpErrorCode: ConfirmEmailOtpErrorCode
+	ConfirmEmailOtpResponse: ResolverTypeWrapper<ConfirmEmailOtpResponse>
+	ConfirmEmailOtpResult: ResolverTypeWrapper<ConfirmEmailOtpResult>
 	ConfirmOtpError: ResolverTypeWrapper<ConfirmOtpError>
 	ConfirmOtpErrorCode: ConfirmOtpErrorCode
 	ConfirmOtpResponse: ResolverTypeWrapper<ConfirmOtpResponse>
+	ConfirmOtpResult: ResolverTypeWrapper<ConfirmOtpResult>
 	CreateApiKeyError: ResolverTypeWrapper<CreateApiKeyError>
 	CreateApiKeyErrorCode: CreateApiKeyErrorCode
+	CreateApiKeyOptions: CreateApiKeyOptions
 	CreateApiKeyResponse: ResolverTypeWrapper<Omit<CreateApiKeyResponse, 'result'> & { result?: Maybe<ResolversTypes['CreateApiKeyResult']> }>
 	CreateApiKeyResult: ResolverTypeWrapper<Omit<CreateApiKeyResult, 'apiKey'> & { apiKey: ResolversTypes['ApiKeyWithToken'] }>
+	CreateAuthPolicyError: ResolverTypeWrapper<CreateAuthPolicyError>
+	CreateAuthPolicyErrorCode: CreateAuthPolicyErrorCode
+	CreateAuthPolicyResponse: ResolverTypeWrapper<CreateAuthPolicyResponse>
+	CreateAuthPolicyResult: ResolverTypeWrapper<CreateAuthPolicyResult>
+	CreateCustomRoleError: ResolverTypeWrapper<CreateCustomRoleError>
+	CreateCustomRoleErrorCode: CreateCustomRoleErrorCode
+	CreateCustomRoleResponse: ResolverTypeWrapper<CreateCustomRoleResponse>
 	CreatePasswordResetRequestError: ResolverTypeWrapper<CreatePasswordResetRequestError>
 	CreatePasswordResetRequestErrorCode: CreatePasswordResetRequestErrorCode
 	CreatePasswordResetRequestResponse: ResolverTypeWrapper<CreatePasswordResetRequestResponse>
@@ -1605,10 +2818,24 @@ export type ResolversTypes = {
 	CreateSessionTokenErrorCode: CreateSessionTokenErrorCode
 	CreateSessionTokenResponse: ResolverTypeWrapper<CreateSessionTokenResponse>
 	CreateSessionTokenResult: ResolverTypeWrapper<CreateSessionTokenResult>
+	CustomRole: ResolverTypeWrapper<CustomRole>
+	CustomRoleConfigurationKind: CustomRoleConfigurationKind
+	CustomRoleGrant: ResolverTypeWrapper<CustomRoleGrant>
+	CustomRoleGrantInput: CustomRoleGrantInput
+	CustomRolePermissionDefinition: ResolverTypeWrapper<CustomRolePermissionDefinition>
 	DateTime: ResolverTypeWrapper<Scalars['DateTime']['output']>
+	DeleteAuthPolicyError: ResolverTypeWrapper<DeleteAuthPolicyError>
+	DeleteAuthPolicyErrorCode: DeleteAuthPolicyErrorCode
+	DeleteAuthPolicyResponse: ResolverTypeWrapper<DeleteAuthPolicyResponse>
+	DeleteCustomRoleError: ResolverTypeWrapper<DeleteCustomRoleError>
+	DeleteCustomRoleErrorCode: DeleteCustomRoleErrorCode
+	DeleteCustomRoleResponse: ResolverTypeWrapper<DeleteCustomRoleResponse>
 	DisableApiKeyError: ResolverTypeWrapper<DisableApiKeyError>
 	DisableApiKeyErrorCode: DisableApiKeyErrorCode
 	DisableApiKeyResponse: ResolverTypeWrapper<DisableApiKeyResponse>
+	DisableEmailOtpError: ResolverTypeWrapper<DisableEmailOtpError>
+	DisableEmailOtpErrorCode: DisableEmailOtpErrorCode
+	DisableEmailOtpResponse: ResolverTypeWrapper<DisableEmailOtpResponse>
 	DisableIDPError: ResolverTypeWrapper<DisableIdpError>
 	DisableIDPErrorCode: DisableIdpErrorCode
 	DisableIDPResponse: ResolverTypeWrapper<DisableIdpResponse>
@@ -1618,9 +2845,20 @@ export type ResolversTypes = {
 	DisablePersonError: ResolverTypeWrapper<DisablePersonError>
 	DisablePersonErrorCode: DisablePersonErrorCode
 	DisablePersonResponse: ResolverTypeWrapper<DisablePersonResponse>
+	DisconnectIDPError: ResolverTypeWrapper<DisconnectIdpError>
+	DisconnectIDPErrorCode: DisconnectIdpErrorCode
+	DisconnectIDPResponse: ResolverTypeWrapper<DisconnectIdpResponse>
+	EmailVerificationOptions: EmailVerificationOptions
 	EnableIDPError: ResolverTypeWrapper<EnableIdpError>
 	EnableIDPErrorCode: EnableIdpErrorCode
 	EnableIDPResponse: ResolverTypeWrapper<EnableIdpResponse>
+	EnablePersonError: ResolverTypeWrapper<EnablePersonError>
+	EnablePersonErrorCode: EnablePersonErrorCode
+	EnablePersonResponse: ResolverTypeWrapper<EnablePersonResponse>
+	Float: ResolverTypeWrapper<Scalars['Float']['output']>
+	ForceSignOutPersonError: ResolverTypeWrapper<ForceSignOutPersonError>
+	ForceSignOutPersonErrorCode: ForceSignOutPersonErrorCode
+	ForceSignOutPersonResponse: ResolverTypeWrapper<ForceSignOutPersonResponse>
 	IDPOptions: IdpOptions
 	IDPOptionsOutput: ResolverTypeWrapper<IdpOptionsOutput>
 	IDPResponseInput: IdpResponseInput
@@ -1633,6 +2871,10 @@ export type ResolversTypes = {
 	IdentityGlobalPermissions: ResolverTypeWrapper<IdentityGlobalPermissions>
 	IdentityProjectRelation: ResolverTypeWrapper<Omit<IdentityProjectRelation, 'project'> & { project: ResolversTypes['Project'] }>
 	IdentityProvider: ResolverTypeWrapper<IdentityProvider>
+	IdentityProviderListItem: ResolverTypeWrapper<IdentityProviderListItem>
+	InitEmailOtpError: ResolverTypeWrapper<InitEmailOtpError>
+	InitEmailOtpErrorCode: InitEmailOtpErrorCode
+	InitEmailOtpResponse: ResolverTypeWrapper<InitEmailOtpResponse>
 	InitSignInIDPError: ResolverTypeWrapper<InitSignInIdpError>
 	InitSignInIDPErrorCode: InitSignInIdpErrorCode
 	InitSignInIDPResponse: ResolverTypeWrapper<InitSignInIdpResponse>
@@ -1660,13 +2902,17 @@ export type ResolversTypes = {
 	MembershipInput: MembershipInput
 	MembershipValidationError: ResolverTypeWrapper<MembershipValidationError>
 	MembershipValidationErrorCode: MembershipValidationErrorCode
-	Mutation: ResolverTypeWrapper<{}>
+	MfaEnrollment: ResolverTypeWrapper<MfaEnrollment>
+	Mutation: ResolverTypeWrapper<Record<PropertyKey, never>>
 	PasswordlessValidationType: PasswordlessValidationType
 	Person: ResolverTypeWrapper<Omit<Person, 'identity'> & { identity: ResolversTypes['Identity'] }>
+	PersonIdentityProvider: ResolverTypeWrapper<PersonIdentityProvider>
+	PersonsFilter: PersonsFilter
 	PrepareOtpResponse: ResolverTypeWrapper<PrepareOtpResponse>
 	PrepareOtpResult: ResolverTypeWrapper<PrepareOtpResult>
 	Project: ResolverTypeWrapper<
-		Omit<Project, 'members' | 'roles'> & {
+		Omit<Project, 'apiKeys' | 'members' | 'roles'> & {
+			apiKeys: ReadonlyArray<ResolversTypes['ApiKey']>
 			members: ReadonlyArray<ResolversTypes['ProjectIdentityRelation']>
 			roles: ReadonlyArray<ResolversTypes['RoleDefinition']>
 		}
@@ -1674,8 +2920,14 @@ export type ResolversTypes = {
 	ProjectIdentityRelation: ResolverTypeWrapper<Omit<ProjectIdentityRelation, 'identity'> & { identity: ResolversTypes['Identity'] }>
 	ProjectMembersFilter: ProjectMembersFilter
 	ProjectMembersInput: ProjectMembersInput
+	ProjectPermissions: ResolverTypeWrapper<ProjectPermissions>
 	ProjectSecret: ProjectSecret
-	Query: ResolverTypeWrapper<{}>
+	ProjectSecretInfo: ResolverTypeWrapper<ProjectSecretInfo>
+	Query: ResolverTypeWrapper<Record<PropertyKey, never>>
+	RegenerateBackupCodesError: ResolverTypeWrapper<RegenerateBackupCodesError>
+	RegenerateBackupCodesErrorCode: RegenerateBackupCodesErrorCode
+	RegenerateBackupCodesResponse: ResolverTypeWrapper<RegenerateBackupCodesResponse>
+	RegenerateBackupCodesResult: ResolverTypeWrapper<RegenerateBackupCodesResult>
 	RemoveGlobalIdentityRolesError: ResolverTypeWrapper<RemoveGlobalIdentityRolesError>
 	RemoveGlobalIdentityRolesErrorCode: RemoveGlobalIdentityRolesErrorCode
 	RemoveGlobalIdentityRolesResponse: ResolverTypeWrapper<
@@ -1688,14 +2940,24 @@ export type ResolversTypes = {
 	RemoveProjectMemberError: ResolverTypeWrapper<RemoveProjectMemberError>
 	RemoveProjectMemberErrorCode: RemoveProjectMemberErrorCode
 	RemoveProjectMemberResponse: ResolverTypeWrapper<RemoveProjectMemberResponse>
+	RequestEmailVerificationError: ResolverTypeWrapper<RequestEmailVerificationError>
+	RequestEmailVerificationErrorCode: RequestEmailVerificationErrorCode
+	RequestEmailVerificationResponse: ResolverTypeWrapper<RequestEmailVerificationResponse>
 	ResetPasswordError: ResolverTypeWrapper<ResetPasswordError>
 	ResetPasswordErrorCode: ResetPasswordErrorCode
 	ResetPasswordResponse: ResolverTypeWrapper<ResetPasswordResponse>
+	ResetPersonMfaError: ResolverTypeWrapper<ResetPersonMfaError>
+	ResetPersonMfaErrorCode: ResetPersonMfaErrorCode
+	ResetPersonMfaResponse: ResolverTypeWrapper<ResetPersonMfaResponse>
+	RevokeSessionError: ResolverTypeWrapper<RevokeSessionError>
+	RevokeSessionErrorCode: RevokeSessionErrorCode
+	RevokeSessionResponse: ResolverTypeWrapper<RevokeSessionResponse>
 	RoleConditionVariableDefinition: ResolverTypeWrapper<RoleConditionVariableDefinition>
 	RoleDefinition: ResolverTypeWrapper<Omit<RoleDefinition, 'variables'> & { variables: ReadonlyArray<ResolversTypes['RoleVariableDefinition']> }>
 	RoleEntityVariableDefinition: ResolverTypeWrapper<RoleEntityVariableDefinition>
 	RolePredefinedVariableDefinition: ResolverTypeWrapper<RolePredefinedVariableDefinition>
 	RoleVariableDefinition: ResolverTypeWrapper<ResolversInterfaceTypes<ResolversTypes>['RoleVariableDefinition']>
+	SessionInfo: ResolverTypeWrapper<SessionInfo>
 	SetProjectSecretError: ResolverTypeWrapper<SetProjectSecretError>
 	SetProjectSecretErrorCode: SetProjectSecretErrorCode
 	SetProjectSecretResponse: ResolverTypeWrapper<SetProjectSecretResponse>
@@ -1705,6 +2967,7 @@ export type ResolversTypes = {
 	SignInIDPErrorCode: SignInIdpErrorCode
 	SignInIDPResponse: ResolverTypeWrapper<SignInIdpResponse>
 	SignInIDPResult: ResolverTypeWrapper<SignInIdpResult>
+	SignInOptions: SignInOptions
 	SignInPasswordlessError: ResolverTypeWrapper<SignInPasswordlessError>
 	SignInPasswordlessErrorCode: SignInPasswordlessErrorCode
 	SignInPasswordlessResponse: ResolverTypeWrapper<SignInPasswordlessResponse>
@@ -1716,6 +2979,7 @@ export type ResolversTypes = {
 	SignOutResponse: ResolverTypeWrapper<SignOutResponse>
 	SignUpError: ResolverTypeWrapper<SignUpError>
 	SignUpErrorCode: SignUpErrorCode
+	SignUpRecommendedAction: SignUpRecommendedAction
 	SignUpResponse: ResolverTypeWrapper<SignUpResponse>
 	SignUpResult: ResolverTypeWrapper<SignUpResult>
 	String: ResolverTypeWrapper<Scalars['String']['output']>
@@ -1723,6 +2987,12 @@ export type ResolversTypes = {
 	ToggleMyPasswordlessErrorCode: ToggleMyPasswordlessErrorCode
 	ToggleMyPasswordlessResponse: ResolverTypeWrapper<ToggleMyPasswordlessResponse>
 	UnmanagedInviteOptions: UnmanagedInviteOptions
+	UpdateAuthPolicyError: ResolverTypeWrapper<UpdateAuthPolicyError>
+	UpdateAuthPolicyErrorCode: UpdateAuthPolicyErrorCode
+	UpdateAuthPolicyResponse: ResolverTypeWrapper<UpdateAuthPolicyResponse>
+	UpdateCustomRoleError: ResolverTypeWrapper<UpdateCustomRoleError>
+	UpdateCustomRoleErrorCode: UpdateCustomRoleErrorCode
+	UpdateCustomRoleResponse: ResolverTypeWrapper<UpdateCustomRoleResponse>
 	UpdateIDPError: ResolverTypeWrapper<UpdateIdpError>
 	UpdateIDPErrorCode: UpdateIdpErrorCode
 	UpdateIDPResponse: ResolverTypeWrapper<UpdateIdpResponse>
@@ -1734,6 +3004,9 @@ export type ResolversTypes = {
 	UpdateProjectResponse: ResolverTypeWrapper<UpdateProjectResponse>
 	VariableEntry: ResolverTypeWrapper<VariableEntry>
 	VariableEntryInput: VariableEntryInput
+	VerifyEmailError: ResolverTypeWrapper<VerifyEmailError>
+	VerifyEmailErrorCode: VerifyEmailErrorCode
+	VerifyEmailResponse: ResolverTypeWrapper<VerifyEmailResponse>
 	WeakPasswordReason: WeakPasswordReason
 }
 
@@ -1754,6 +3027,11 @@ export type ResolversParentTypes = {
 	AddProjectMemberResponse: AddProjectMemberResponse
 	ApiKey: Omit<ApiKey, 'identity'> & { identity: ResolversParentTypes['Identity'] }
 	ApiKeyWithToken: Omit<ApiKeyWithToken, 'identity'> & { identity: ResolversParentTypes['Identity'] }
+	AuthLogEntry: AuthLogEntry
+	AuthLogFilter: AuthLogFilter
+	AuthLogPage: AuthLogPage
+	AuthPolicy: AuthPolicy
+	AuthPolicyInput: AuthPolicyInput
 	Boolean: Scalars['Boolean']['output']
 	ChangeMyPasswordError: ChangeMyPasswordError
 	ChangeMyPasswordResponse: ChangeMyPasswordResponse
@@ -1766,20 +3044,48 @@ export type ResolversParentTypes = {
 	CheckResetPasswordTokenResult: CheckResetPasswordTokenResult
 	CommonSignInResult: ResolversInterfaceTypes<ResolversParentTypes>['CommonSignInResult']
 	Config: Config
+	ConfigCaptcha: ConfigCaptcha
+	ConfigCaptchaInput: ConfigCaptchaInput
+	ConfigCaptchaProtect: ConfigCaptchaProtect
+	ConfigCaptchaProtectInput: ConfigCaptchaProtectInput
+	ConfigEmailChange: ConfigEmailChange
+	ConfigEmailChangeInput: ConfigEmailChangeInput
 	ConfigInput: ConfigInput
 	ConfigLogin: ConfigLogin
+	ConfigLoginAnomalyDetection: ConfigLoginAnomalyDetection
+	ConfigLoginAnomalyDetectionInput: ConfigLoginAnomalyDetectionInput
 	ConfigLoginInput: ConfigLoginInput
+	ConfigPanel: ConfigPanel
+	ConfigPanelInput: ConfigPanelInput
 	ConfigPassword: ConfigPassword
 	ConfigPasswordInput: ConfigPasswordInput
 	ConfigPasswordless: ConfigPasswordless
 	ConfigPasswordlessInput: ConfigPasswordlessInput
+	ConfigRateLimitWindow: ConfigRateLimitWindow
+	ConfigRateLimitWindowInput: ConfigRateLimitWindowInput
+	ConfigRateLimits: ConfigRateLimits
+	ConfigRateLimitsInput: ConfigRateLimitsInput
+	ConfigSignup: ConfigSignup
+	ConfigSignupInput: ConfigSignupInput
 	ConfigureError: ConfigureError
 	ConfigureResponse: ConfigureResponse
+	ConfirmEmailChangeError: ConfirmEmailChangeError
+	ConfirmEmailChangeResponse: ConfirmEmailChangeResponse
+	ConfirmEmailOtpError: ConfirmEmailOtpError
+	ConfirmEmailOtpResponse: ConfirmEmailOtpResponse
+	ConfirmEmailOtpResult: ConfirmEmailOtpResult
 	ConfirmOtpError: ConfirmOtpError
 	ConfirmOtpResponse: ConfirmOtpResponse
+	ConfirmOtpResult: ConfirmOtpResult
 	CreateApiKeyError: CreateApiKeyError
+	CreateApiKeyOptions: CreateApiKeyOptions
 	CreateApiKeyResponse: Omit<CreateApiKeyResponse, 'result'> & { result?: Maybe<ResolversParentTypes['CreateApiKeyResult']> }
 	CreateApiKeyResult: Omit<CreateApiKeyResult, 'apiKey'> & { apiKey: ResolversParentTypes['ApiKeyWithToken'] }
+	CreateAuthPolicyError: CreateAuthPolicyError
+	CreateAuthPolicyResponse: CreateAuthPolicyResponse
+	CreateAuthPolicyResult: CreateAuthPolicyResult
+	CreateCustomRoleError: CreateCustomRoleError
+	CreateCustomRoleResponse: CreateCustomRoleResponse
 	CreatePasswordResetRequestError: CreatePasswordResetRequestError
 	CreatePasswordResetRequestResponse: CreatePasswordResetRequestResponse
 	CreateProjectOptions: CreateProjectOptions
@@ -1790,17 +3096,35 @@ export type ResolversParentTypes = {
 	CreateSessionTokenError: CreateSessionTokenError
 	CreateSessionTokenResponse: CreateSessionTokenResponse
 	CreateSessionTokenResult: CreateSessionTokenResult
+	CustomRole: CustomRole
+	CustomRoleGrant: CustomRoleGrant
+	CustomRoleGrantInput: CustomRoleGrantInput
+	CustomRolePermissionDefinition: CustomRolePermissionDefinition
 	DateTime: Scalars['DateTime']['output']
+	DeleteAuthPolicyError: DeleteAuthPolicyError
+	DeleteAuthPolicyResponse: DeleteAuthPolicyResponse
+	DeleteCustomRoleError: DeleteCustomRoleError
+	DeleteCustomRoleResponse: DeleteCustomRoleResponse
 	DisableApiKeyError: DisableApiKeyError
 	DisableApiKeyResponse: DisableApiKeyResponse
+	DisableEmailOtpError: DisableEmailOtpError
+	DisableEmailOtpResponse: DisableEmailOtpResponse
 	DisableIDPError: DisableIdpError
 	DisableIDPResponse: DisableIdpResponse
 	DisableOtpError: DisableOtpError
 	DisableOtpResponse: DisableOtpResponse
 	DisablePersonError: DisablePersonError
 	DisablePersonResponse: DisablePersonResponse
+	DisconnectIDPError: DisconnectIdpError
+	DisconnectIDPResponse: DisconnectIdpResponse
+	EmailVerificationOptions: EmailVerificationOptions
 	EnableIDPError: EnableIdpError
 	EnableIDPResponse: EnableIdpResponse
+	EnablePersonError: EnablePersonError
+	EnablePersonResponse: EnablePersonResponse
+	Float: Scalars['Float']['output']
+	ForceSignOutPersonError: ForceSignOutPersonError
+	ForceSignOutPersonResponse: ForceSignOutPersonResponse
 	IDPOptions: IdpOptions
 	IDPOptionsOutput: IdpOptionsOutput
 	IDPResponseInput: IdpResponseInput
@@ -1811,6 +3135,9 @@ export type ResolversParentTypes = {
 	IdentityGlobalPermissions: IdentityGlobalPermissions
 	IdentityProjectRelation: Omit<IdentityProjectRelation, 'project'> & { project: ResolversParentTypes['Project'] }
 	IdentityProvider: IdentityProvider
+	IdentityProviderListItem: IdentityProviderListItem
+	InitEmailOtpError: InitEmailOtpError
+	InitEmailOtpResponse: InitEmailOtpResponse
 	InitSignInIDPError: InitSignInIdpError
 	InitSignInIDPResponse: InitSignInIdpResponse
 	InitSignInIDPResult: InitSignInIdpResult
@@ -1831,19 +3158,28 @@ export type ResolversParentTypes = {
 	Membership: Membership
 	MembershipInput: MembershipInput
 	MembershipValidationError: MembershipValidationError
-	Mutation: {}
+	MfaEnrollment: MfaEnrollment
+	Mutation: Record<PropertyKey, never>
 	Person: Omit<Person, 'identity'> & { identity: ResolversParentTypes['Identity'] }
+	PersonIdentityProvider: PersonIdentityProvider
+	PersonsFilter: PersonsFilter
 	PrepareOtpResponse: PrepareOtpResponse
 	PrepareOtpResult: PrepareOtpResult
-	Project: Omit<Project, 'members' | 'roles'> & {
+	Project: Omit<Project, 'apiKeys' | 'members' | 'roles'> & {
+		apiKeys: ReadonlyArray<ResolversParentTypes['ApiKey']>
 		members: ReadonlyArray<ResolversParentTypes['ProjectIdentityRelation']>
 		roles: ReadonlyArray<ResolversParentTypes['RoleDefinition']>
 	}
 	ProjectIdentityRelation: Omit<ProjectIdentityRelation, 'identity'> & { identity: ResolversParentTypes['Identity'] }
 	ProjectMembersFilter: ProjectMembersFilter
 	ProjectMembersInput: ProjectMembersInput
+	ProjectPermissions: ProjectPermissions
 	ProjectSecret: ProjectSecret
-	Query: {}
+	ProjectSecretInfo: ProjectSecretInfo
+	Query: Record<PropertyKey, never>
+	RegenerateBackupCodesError: RegenerateBackupCodesError
+	RegenerateBackupCodesResponse: RegenerateBackupCodesResponse
+	RegenerateBackupCodesResult: RegenerateBackupCodesResult
 	RemoveGlobalIdentityRolesError: RemoveGlobalIdentityRolesError
 	RemoveGlobalIdentityRolesResponse: Omit<RemoveGlobalIdentityRolesResponse, 'result'> & {
 		result?: Maybe<ResolversParentTypes['RemoveGlobalIdentityRolesResult']>
@@ -1853,19 +3189,27 @@ export type ResolversParentTypes = {
 	RemoveMailTemplateResponse: RemoveMailTemplateResponse
 	RemoveProjectMemberError: RemoveProjectMemberError
 	RemoveProjectMemberResponse: RemoveProjectMemberResponse
+	RequestEmailVerificationError: RequestEmailVerificationError
+	RequestEmailVerificationResponse: RequestEmailVerificationResponse
 	ResetPasswordError: ResetPasswordError
 	ResetPasswordResponse: ResetPasswordResponse
+	ResetPersonMfaError: ResetPersonMfaError
+	ResetPersonMfaResponse: ResetPersonMfaResponse
+	RevokeSessionError: RevokeSessionError
+	RevokeSessionResponse: RevokeSessionResponse
 	RoleConditionVariableDefinition: RoleConditionVariableDefinition
 	RoleDefinition: Omit<RoleDefinition, 'variables'> & { variables: ReadonlyArray<ResolversParentTypes['RoleVariableDefinition']> }
 	RoleEntityVariableDefinition: RoleEntityVariableDefinition
 	RolePredefinedVariableDefinition: RolePredefinedVariableDefinition
 	RoleVariableDefinition: ResolversInterfaceTypes<ResolversParentTypes>['RoleVariableDefinition']
+	SessionInfo: SessionInfo
 	SetProjectSecretError: SetProjectSecretError
 	SetProjectSecretResponse: SetProjectSecretResponse
 	SignInError: SignInError
 	SignInIDPError: SignInIdpError
 	SignInIDPResponse: SignInIdpResponse
 	SignInIDPResult: SignInIdpResult
+	SignInOptions: SignInOptions
 	SignInPasswordlessError: SignInPasswordlessError
 	SignInPasswordlessResponse: SignInPasswordlessResponse
 	SignInPasswordlessResult: SignInPasswordlessResult
@@ -1880,6 +3224,10 @@ export type ResolversParentTypes = {
 	ToggleMyPasswordlessError: ToggleMyPasswordlessError
 	ToggleMyPasswordlessResponse: ToggleMyPasswordlessResponse
 	UnmanagedInviteOptions: UnmanagedInviteOptions
+	UpdateAuthPolicyError: UpdateAuthPolicyError
+	UpdateAuthPolicyResponse: UpdateAuthPolicyResponse
+	UpdateCustomRoleError: UpdateCustomRoleError
+	UpdateCustomRoleResponse: UpdateCustomRoleResponse
 	UpdateIDPError: UpdateIdpError
 	UpdateIDPResponse: UpdateIdpResponse
 	UpdateProjectError: UpdateProjectError
@@ -1888,6 +3236,8 @@ export type ResolversParentTypes = {
 	UpdateProjectResponse: UpdateProjectResponse
 	VariableEntry: VariableEntry
 	VariableEntryInput: VariableEntryInput
+	VerifyEmailError: VerifyEmailError
+	VerifyEmailResponse: VerifyEmailResponse
 }
 
 export type ActivatePasswordlessOtpErrorResolvers<
@@ -1896,7 +3246,6 @@ export type ActivatePasswordlessOtpErrorResolvers<
 > = {
 	code?: Resolver<ResolversTypes['ActivatePasswordlessOtpErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type ActivatePasswordlessOtpResponseResolvers<
@@ -1905,7 +3254,6 @@ export type ActivatePasswordlessOtpResponseResolvers<
 > = {
 	error?: Resolver<Maybe<ResolversTypes['ActivatePasswordlessOtpError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type AddGlobalIdentityRolesErrorResolvers<
@@ -1914,7 +3262,6 @@ export type AddGlobalIdentityRolesErrorResolvers<
 > = {
 	code?: Resolver<ResolversTypes['AddGlobalIdentityRolesErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type AddGlobalIdentityRolesResponseResolvers<
@@ -1924,7 +3271,6 @@ export type AddGlobalIdentityRolesResponseResolvers<
 	error?: Resolver<Maybe<ResolversTypes['AddGlobalIdentityRolesError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	result?: Resolver<Maybe<ResolversTypes['AddGlobalIdentityRolesResult']>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type AddGlobalIdentityRolesResultResolvers<
@@ -1932,13 +3278,11 @@ export type AddGlobalIdentityRolesResultResolvers<
 	ParentType extends ResolversParentTypes['AddGlobalIdentityRolesResult'] = ResolversParentTypes['AddGlobalIdentityRolesResult'],
 > = {
 	identity?: Resolver<ResolversTypes['Identity'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type AddIdpErrorResolvers<ContextType = any, ParentType extends ResolversParentTypes['AddIDPError'] = ResolversParentTypes['AddIDPError']> = {
 	code?: Resolver<ResolversTypes['AddIDPErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type AddIdpResponseResolvers<
@@ -1947,7 +3291,6 @@ export type AddIdpResponseResolvers<
 > = {
 	error?: Resolver<Maybe<ResolversTypes['AddIDPError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type AddMailTemplateErrorResolvers<
@@ -1957,7 +3300,6 @@ export type AddMailTemplateErrorResolvers<
 	code?: Resolver<ResolversTypes['AddMailTemplateErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	endUserMessage?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type AddMailTemplateResponseResolvers<
@@ -1967,7 +3309,6 @@ export type AddMailTemplateResponseResolvers<
 	error?: Resolver<Maybe<ResolversTypes['AddMailTemplateError']>, ParentType, ContextType>
 	errors?: Resolver<ReadonlyArray<ResolversTypes['AddMailTemplateError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type AddProjectMemberErrorResolvers<
@@ -1978,7 +3319,6 @@ export type AddProjectMemberErrorResolvers<
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	endUserMessage?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
 	membershipValidation?: Resolver<Maybe<ReadonlyArray<ResolversTypes['MembershipValidationError']>>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type AddProjectMemberResponseResolvers<
@@ -1988,13 +3328,17 @@ export type AddProjectMemberResponseResolvers<
 	error?: Resolver<Maybe<ResolversTypes['AddProjectMemberError']>, ParentType, ContextType>
 	errors?: Resolver<ReadonlyArray<ResolversTypes['AddProjectMemberError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type ApiKeyResolvers<ContextType = any, ParentType extends ResolversParentTypes['ApiKey'] = ResolversParentTypes['ApiKey']> = {
+	createdAt?: Resolver<Maybe<ResolversTypes['DateTime']>, ParentType, ContextType>
+	description?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
+	enabled?: Resolver<Maybe<ResolversTypes['Boolean']>, ParentType, ContextType>
+	expiresAt?: Resolver<Maybe<ResolversTypes['DateTime']>, ParentType, ContextType>
 	id?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	identity?: Resolver<ResolversTypes['Identity'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
+	lastUsedAt?: Resolver<Maybe<ResolversTypes['DateTime']>, ParentType, ContextType>
+	type?: Resolver<Maybe<ResolversTypes['ApiKeyType']>, ParentType, ContextType>
 }
 
 export type ApiKeyWithTokenResolvers<
@@ -2004,7 +3348,42 @@ export type ApiKeyWithTokenResolvers<
 	id?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	identity?: Resolver<ResolversTypes['Identity'], ParentType, ContextType>
 	token?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
+}
+
+export type AuthLogEntryResolvers<ContextType = any, ParentType extends ResolversParentTypes['AuthLogEntry'] = ResolversParentTypes['AuthLogEntry']> =
+	{
+		createdAt?: Resolver<ResolversTypes['DateTime'], ParentType, ContextType>
+		errorCode?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
+		errorMessage?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
+		eventData?: Resolver<Maybe<ResolversTypes['Json']>, ParentType, ContextType>
+		id?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+		identityProviderId?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
+		invokedByIdentityId?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
+		ipAddress?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
+		metadata?: Resolver<Maybe<ResolversTypes['Json']>, ParentType, ContextType>
+		personId?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
+		personInputIdentifier?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
+		success?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+		targetPersonId?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
+		type?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+		userAgent?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
+	}
+
+export type AuthLogPageResolvers<ContextType = any, ParentType extends ResolversParentTypes['AuthLogPage'] = ResolversParentTypes['AuthLogPage']> = {
+	entries?: Resolver<ReadonlyArray<ResolversTypes['AuthLogEntry']>, ParentType, ContextType>
+	hasMore?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+}
+
+export type AuthPolicyResolvers<ContextType = any, ParentType extends ResolversParentTypes['AuthPolicy'] = ResolversParentTypes['AuthPolicy']> = {
+	id?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+	idleTimeout?: Resolver<Maybe<ResolversTypes['Interval']>, ParentType, ContextType>
+	mfaGraceDuration?: Resolver<Maybe<ResolversTypes['Interval']>, ParentType, ContextType>
+	mfaRequired?: Resolver<Maybe<ResolversTypes['Boolean']>, ParentType, ContextType>
+	project?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
+	rememberMeAllowed?: Resolver<Maybe<ResolversTypes['Boolean']>, ParentType, ContextType>
+	roles?: Resolver<ReadonlyArray<ResolversTypes['String']>, ParentType, ContextType>
+	scope?: Resolver<ResolversTypes['AuthPolicyScope'], ParentType, ContextType>
+	tokenExpiration?: Resolver<Maybe<ResolversTypes['Interval']>, ParentType, ContextType>
 }
 
 export type ChangeMyPasswordErrorResolvers<
@@ -2014,7 +3393,6 @@ export type ChangeMyPasswordErrorResolvers<
 	code?: Resolver<ResolversTypes['ChangeMyPasswordErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	weakPasswordReasons?: Resolver<Maybe<ReadonlyArray<ResolversTypes['WeakPasswordReason']>>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type ChangeMyPasswordResponseResolvers<
@@ -2023,7 +3401,6 @@ export type ChangeMyPasswordResponseResolvers<
 > = {
 	error?: Resolver<Maybe<ResolversTypes['ChangeMyPasswordError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type ChangeMyProfileErrorResolvers<
@@ -2032,7 +3409,6 @@ export type ChangeMyProfileErrorResolvers<
 > = {
 	code?: Resolver<ResolversTypes['ChangeMyProfileErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type ChangeMyProfileResponseResolvers<
@@ -2041,7 +3417,6 @@ export type ChangeMyProfileResponseResolvers<
 > = {
 	error?: Resolver<Maybe<ResolversTypes['ChangeMyProfileError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type ChangePasswordErrorResolvers<
@@ -2052,7 +3427,6 @@ export type ChangePasswordErrorResolvers<
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	endUserMessage?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
 	weakPasswordReasons?: Resolver<Maybe<ReadonlyArray<ResolversTypes['WeakPasswordReason']>>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type ChangePasswordResponseResolvers<
@@ -2062,7 +3436,6 @@ export type ChangePasswordResponseResolvers<
 	error?: Resolver<Maybe<ResolversTypes['ChangePasswordError']>, ParentType, ContextType>
 	errors?: Resolver<ReadonlyArray<ResolversTypes['ChangePasswordError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type ChangeProfileErrorResolvers<
@@ -2071,7 +3444,6 @@ export type ChangeProfileErrorResolvers<
 > = {
 	code?: Resolver<ResolversTypes['ChangeProfileErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type ChangeProfileResponseResolvers<
@@ -2080,7 +3452,6 @@ export type ChangeProfileResponseResolvers<
 > = {
 	error?: Resolver<Maybe<ResolversTypes['ChangeProfileError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type CheckResetPasswordTokenResultResolvers<
@@ -2088,7 +3459,6 @@ export type CheckResetPasswordTokenResultResolvers<
 	ParentType extends ResolversParentTypes['CheckResetPasswordTokenResult'] = ResolversParentTypes['CheckResetPasswordTokenResult'],
 > = {
 	code?: Resolver<ResolversTypes['CheckResetPasswordTokenCode'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type CommonSignInResultResolvers<
@@ -2096,25 +3466,70 @@ export type CommonSignInResultResolvers<
 	ParentType extends ResolversParentTypes['CommonSignInResult'] = ResolversParentTypes['CommonSignInResult'],
 > = {
 	__resolveType: TypeResolveFn<'CreateSessionTokenResult' | 'SignInIDPResult' | 'SignInPasswordlessResult' | 'SignInResult', ParentType, ContextType>
-	person?: Resolver<ResolversTypes['Person'], ParentType, ContextType>
-	token?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 }
 
 export type ConfigResolvers<ContextType = any, ParentType extends ResolversParentTypes['Config'] = ResolversParentTypes['Config']> = {
+	captcha?: Resolver<ResolversTypes['ConfigCaptcha'], ParentType, ContextType>
+	emailChange?: Resolver<ResolversTypes['ConfigEmailChange'], ParentType, ContextType>
 	login?: Resolver<ResolversTypes['ConfigLogin'], ParentType, ContextType>
+	panel?: Resolver<ResolversTypes['ConfigPanel'], ParentType, ContextType>
 	password?: Resolver<ResolversTypes['ConfigPassword'], ParentType, ContextType>
 	passwordless?: Resolver<ResolversTypes['ConfigPasswordless'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
+	rateLimits?: Resolver<ResolversTypes['ConfigRateLimits'], ParentType, ContextType>
+	signup?: Resolver<ResolversTypes['ConfigSignup'], ParentType, ContextType>
+}
+
+export type ConfigCaptchaResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['ConfigCaptcha'] = ResolversParentTypes['ConfigCaptcha'],
+> = {
+	protect?: Resolver<ResolversTypes['ConfigCaptchaProtect'], ParentType, ContextType>
+	provider?: Resolver<Maybe<ResolversTypes['CaptchaProvider']>, ParentType, ContextType>
+	threshold?: Resolver<Maybe<ResolversTypes['Float']>, ParentType, ContextType>
+}
+
+export type ConfigCaptchaProtectResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['ConfigCaptchaProtect'] = ResolversParentTypes['ConfigCaptchaProtect'],
+> = {
+	emailVerification?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	passwordReset?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	passwordlessInit?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	signUp?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+}
+
+export type ConfigEmailChangeResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['ConfigEmailChange'] = ResolversParentTypes['ConfigEmailChange'],
+> = {
+	requireVerification?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 }
 
 export type ConfigLoginResolvers<ContextType = any, ParentType extends ResolversParentTypes['ConfigLogin'] = ResolversParentTypes['ConfigLogin']> = {
+	anomalyDetection?: Resolver<ResolversTypes['ConfigLoginAnomalyDetection'], ParentType, ContextType>
 	attemptWindow?: Resolver<ResolversTypes['Interval'], ParentType, ContextType>
 	baseBackoff?: Resolver<ResolversTypes['Interval'], ParentType, ContextType>
 	defaultTokenExpiration?: Resolver<ResolversTypes['Interval'], ParentType, ContextType>
 	maxBackoff?: Resolver<ResolversTypes['Interval'], ParentType, ContextType>
 	maxTokenExpiration?: Resolver<Maybe<ResolversTypes['Interval']>, ParentType, ContextType>
+	mfaGraceDuration?: Resolver<ResolversTypes['Interval'], ParentType, ContextType>
+	revealLoginMethod?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	revealUserExists?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
+}
+
+export type ConfigLoginAnomalyDetectionResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['ConfigLoginAnomalyDetection'] = ResolversParentTypes['ConfigLoginAnomalyDetection'],
+> = {
+	emailThreshold?: Resolver<ResolversTypes['Int'], ParentType, ContextType>
+	enabled?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	historySize?: Resolver<ResolversTypes['Int'], ParentType, ContextType>
+	stepUpThreshold?: Resolver<ResolversTypes['Int'], ParentType, ContextType>
+}
+
+export type ConfigPanelResolvers<ContextType = any, ParentType extends ResolversParentTypes['ConfigPanel'] = ResolversParentTypes['ConfigPanel']> = {
+	globalRoles?: Resolver<ReadonlyArray<ResolversTypes['String']>, ParentType, ContextType>
+	projectRoles?: Resolver<ReadonlyArray<ResolversTypes['String']>, ParentType, ContextType>
 }
 
 export type ConfigPasswordResolvers<
@@ -2122,13 +3537,13 @@ export type ConfigPasswordResolvers<
 	ParentType extends ResolversParentTypes['ConfigPassword'] = ResolversParentTypes['ConfigPassword'],
 > = {
 	checkBlacklist?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	checkHibp?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	minLength?: Resolver<ResolversTypes['Int'], ParentType, ContextType>
 	pattern?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
 	requireDigit?: Resolver<ResolversTypes['Int'], ParentType, ContextType>
 	requireLowercase?: Resolver<ResolversTypes['Int'], ParentType, ContextType>
 	requireSpecial?: Resolver<ResolversTypes['Int'], ParentType, ContextType>
 	requireUppercase?: Resolver<ResolversTypes['Int'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type ConfigPasswordlessResolvers<
@@ -2138,16 +3553,39 @@ export type ConfigPasswordlessResolvers<
 	enabled?: Resolver<ResolversTypes['ConfigPolicy'], ParentType, ContextType>
 	expiration?: Resolver<ResolversTypes['Interval'], ParentType, ContextType>
 	url?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
+export type ConfigRateLimitWindowResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['ConfigRateLimitWindow'] = ResolversParentTypes['ConfigRateLimitWindow'],
+> = {
+	limit?: Resolver<ResolversTypes['Int'], ParentType, ContextType>
+	window?: Resolver<ResolversTypes['Interval'], ParentType, ContextType>
+}
+
+export type ConfigRateLimitsResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['ConfigRateLimits'] = ResolversParentTypes['ConfigRateLimits'],
+> = {
+	emailOtpPerPerson?: Resolver<ResolversTypes['ConfigRateLimitWindow'], ParentType, ContextType>
+	emailVerificationPerIp?: Resolver<ResolversTypes['ConfigRateLimitWindow'], ParentType, ContextType>
+	loginPerIp?: Resolver<ResolversTypes['ConfigRateLimitWindow'], ParentType, ContextType>
+	passwordResetPerIp?: Resolver<ResolversTypes['ConfigRateLimitWindow'], ParentType, ContextType>
+	passwordlessInitPerIp?: Resolver<ResolversTypes['ConfigRateLimitWindow'], ParentType, ContextType>
+	signUpPerIp?: Resolver<ResolversTypes['ConfigRateLimitWindow'], ParentType, ContextType>
+}
+
+export type ConfigSignupResolvers<ContextType = any, ParentType extends ResolversParentTypes['ConfigSignup'] = ResolversParentTypes['ConfigSignup']> =
+	{
+		requireEmailVerification?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	}
+
 export type ConfigureErrorResolvers<
 	ContextType = any,
 	ParentType extends ResolversParentTypes['ConfigureError'] = ResolversParentTypes['ConfigureError'],
 > = {
 	code?: Resolver<ResolversTypes['ConfigureErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type ConfigureResponseResolvers<
@@ -2156,7 +3594,46 @@ export type ConfigureResponseResolvers<
 > = {
 	error?: Resolver<Maybe<ResolversTypes['ConfigureError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
+}
+
+export type ConfirmEmailChangeErrorResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['ConfirmEmailChangeError'] = ResolversParentTypes['ConfirmEmailChangeError'],
+> = {
+	code?: Resolver<ResolversTypes['ConfirmEmailChangeErrorCode'], ParentType, ContextType>
+	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+}
+
+export type ConfirmEmailChangeResponseResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['ConfirmEmailChangeResponse'] = ResolversParentTypes['ConfirmEmailChangeResponse'],
+> = {
+	error?: Resolver<Maybe<ResolversTypes['ConfirmEmailChangeError']>, ParentType, ContextType>
+	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+}
+
+export type ConfirmEmailOtpErrorResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['ConfirmEmailOtpError'] = ResolversParentTypes['ConfirmEmailOtpError'],
+> = {
+	code?: Resolver<ResolversTypes['ConfirmEmailOtpErrorCode'], ParentType, ContextType>
+	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+}
+
+export type ConfirmEmailOtpResponseResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['ConfirmEmailOtpResponse'] = ResolversParentTypes['ConfirmEmailOtpResponse'],
+> = {
+	error?: Resolver<Maybe<ResolversTypes['ConfirmEmailOtpError']>, ParentType, ContextType>
+	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	result?: Resolver<Maybe<ResolversTypes['ConfirmEmailOtpResult']>, ParentType, ContextType>
+}
+
+export type ConfirmEmailOtpResultResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['ConfirmEmailOtpResult'] = ResolversParentTypes['ConfirmEmailOtpResult'],
+> = {
+	backupCodes?: Resolver<ReadonlyArray<ResolversTypes['String']>, ParentType, ContextType>
 }
 
 export type ConfirmOtpErrorResolvers<
@@ -2166,7 +3643,6 @@ export type ConfirmOtpErrorResolvers<
 	code?: Resolver<ResolversTypes['ConfirmOtpErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	endUserMessage?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type ConfirmOtpResponseResolvers<
@@ -2176,7 +3652,14 @@ export type ConfirmOtpResponseResolvers<
 	error?: Resolver<Maybe<ResolversTypes['ConfirmOtpError']>, ParentType, ContextType>
 	errors?: Resolver<ReadonlyArray<ResolversTypes['ConfirmOtpError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
+	result?: Resolver<Maybe<ResolversTypes['ConfirmOtpResult']>, ParentType, ContextType>
+}
+
+export type ConfirmOtpResultResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['ConfirmOtpResult'] = ResolversParentTypes['ConfirmOtpResult'],
+> = {
+	backupCodes?: Resolver<ReadonlyArray<ResolversTypes['String']>, ParentType, ContextType>
 }
 
 export type CreateApiKeyErrorResolvers<
@@ -2187,7 +3670,6 @@ export type CreateApiKeyErrorResolvers<
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	endUserMessage?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
 	membershipValidation?: Resolver<Maybe<ReadonlyArray<ResolversTypes['MembershipValidationError']>>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type CreateApiKeyResponseResolvers<
@@ -2198,7 +3680,6 @@ export type CreateApiKeyResponseResolvers<
 	errors?: Resolver<ReadonlyArray<ResolversTypes['CreateApiKeyError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	result?: Resolver<Maybe<ResolversTypes['CreateApiKeyResult']>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type CreateApiKeyResultResolvers<
@@ -2206,7 +3687,46 @@ export type CreateApiKeyResultResolvers<
 	ParentType extends ResolversParentTypes['CreateApiKeyResult'] = ResolversParentTypes['CreateApiKeyResult'],
 > = {
 	apiKey?: Resolver<ResolversTypes['ApiKeyWithToken'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
+}
+
+export type CreateAuthPolicyErrorResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['CreateAuthPolicyError'] = ResolversParentTypes['CreateAuthPolicyError'],
+> = {
+	code?: Resolver<ResolversTypes['CreateAuthPolicyErrorCode'], ParentType, ContextType>
+	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+}
+
+export type CreateAuthPolicyResponseResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['CreateAuthPolicyResponse'] = ResolversParentTypes['CreateAuthPolicyResponse'],
+> = {
+	error?: Resolver<Maybe<ResolversTypes['CreateAuthPolicyError']>, ParentType, ContextType>
+	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	result?: Resolver<Maybe<ResolversTypes['CreateAuthPolicyResult']>, ParentType, ContextType>
+}
+
+export type CreateAuthPolicyResultResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['CreateAuthPolicyResult'] = ResolversParentTypes['CreateAuthPolicyResult'],
+> = {
+	id?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+}
+
+export type CreateCustomRoleErrorResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['CreateCustomRoleError'] = ResolversParentTypes['CreateCustomRoleError'],
+> = {
+	code?: Resolver<ResolversTypes['CreateCustomRoleErrorCode'], ParentType, ContextType>
+	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+}
+
+export type CreateCustomRoleResponseResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['CreateCustomRoleResponse'] = ResolversParentTypes['CreateCustomRoleResponse'],
+> = {
+	error?: Resolver<Maybe<ResolversTypes['CreateCustomRoleError']>, ParentType, ContextType>
+	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 }
 
 export type CreatePasswordResetRequestErrorResolvers<
@@ -2216,7 +3736,6 @@ export type CreatePasswordResetRequestErrorResolvers<
 	code?: Resolver<ResolversTypes['CreatePasswordResetRequestErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	endUserMessage?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type CreatePasswordResetRequestResponseResolvers<
@@ -2226,7 +3745,6 @@ export type CreatePasswordResetRequestResponseResolvers<
 	error?: Resolver<Maybe<ResolversTypes['CreatePasswordResetRequestError']>, ParentType, ContextType>
 	errors?: Resolver<ReadonlyArray<ResolversTypes['CreatePasswordResetRequestError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type CreateProjectResponseResolvers<
@@ -2236,7 +3754,6 @@ export type CreateProjectResponseResolvers<
 	error?: Resolver<Maybe<ResolversTypes['CreateProjectResponseError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	result?: Resolver<Maybe<ResolversTypes['CreateProjectResult']>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type CreateProjectResponseErrorResolvers<
@@ -2245,7 +3762,6 @@ export type CreateProjectResponseErrorResolvers<
 > = {
 	code?: Resolver<ResolversTypes['CreateProjectResponseErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type CreateProjectResultResolvers<
@@ -2253,7 +3769,6 @@ export type CreateProjectResultResolvers<
 	ParentType extends ResolversParentTypes['CreateProjectResult'] = ResolversParentTypes['CreateProjectResult'],
 > = {
 	deployerApiKey?: Resolver<Maybe<ResolversTypes['ApiKeyWithToken']>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type CreateSessionTokenErrorResolvers<
@@ -2262,7 +3777,6 @@ export type CreateSessionTokenErrorResolvers<
 > = {
 	code?: Resolver<ResolversTypes['CreateSessionTokenErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type CreateSessionTokenResponseResolvers<
@@ -2272,7 +3786,6 @@ export type CreateSessionTokenResponseResolvers<
 	error?: Resolver<Maybe<ResolversTypes['CreateSessionTokenError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	result?: Resolver<Maybe<ResolversTypes['CreateSessionTokenResult']>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type CreateSessionTokenResultResolvers<
@@ -2284,10 +3797,66 @@ export type CreateSessionTokenResultResolvers<
 	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
+export type CustomRoleResolvers<ContextType = any, ParentType extends ResolversParentTypes['CustomRole'] = ResolversParentTypes['CustomRole']> = {
+	description?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
+	grants?: Resolver<ReadonlyArray<ResolversTypes['CustomRoleGrant']>, ParentType, ContextType>
+	slug?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+}
+
+export type CustomRoleGrantResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['CustomRoleGrant'] = ResolversParentTypes['CustomRoleGrant'],
+> = {
+	config?: Resolver<Maybe<ResolversTypes['Json']>, ParentType, ContextType>
+	permission?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+}
+
+export type CustomRolePermissionDefinitionResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['CustomRolePermissionDefinition'] = ResolversParentTypes['CustomRolePermissionDefinition'],
+> = {
+	configurationKind?: Resolver<ResolversTypes['CustomRoleConfigurationKind'], ParentType, ContextType>
+	configurationRequired?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	defaultConfig?: Resolver<Maybe<ResolversTypes['Json']>, ParentType, ContextType>
+	name?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+}
+
 export interface DateTimeScalarConfig extends GraphQLScalarTypeConfig<ResolversTypes['DateTime'], any> {
 	name: 'DateTime'
 }
 
+export type DeleteAuthPolicyErrorResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['DeleteAuthPolicyError'] = ResolversParentTypes['DeleteAuthPolicyError'],
+> = {
+	code?: Resolver<ResolversTypes['DeleteAuthPolicyErrorCode'], ParentType, ContextType>
+	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+}
+
+export type DeleteAuthPolicyResponseResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['DeleteAuthPolicyResponse'] = ResolversParentTypes['DeleteAuthPolicyResponse'],
+> = {
+	error?: Resolver<Maybe<ResolversTypes['DeleteAuthPolicyError']>, ParentType, ContextType>
+	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+}
+
+export type DeleteCustomRoleErrorResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['DeleteCustomRoleError'] = ResolversParentTypes['DeleteCustomRoleError'],
+> = {
+	code?: Resolver<ResolversTypes['DeleteCustomRoleErrorCode'], ParentType, ContextType>
+	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+}
+
+export type DeleteCustomRoleResponseResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['DeleteCustomRoleResponse'] = ResolversParentTypes['DeleteCustomRoleResponse'],
+> = {
+	error?: Resolver<Maybe<ResolversTypes['DeleteCustomRoleError']>, ParentType, ContextType>
+	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+}
+
 export type DisableApiKeyErrorResolvers<
 	ContextType = any,
 	ParentType extends ResolversParentTypes['DisableApiKeyError'] = ResolversParentTypes['DisableApiKeyError'],
@@ -2295,7 +3864,6 @@ export type DisableApiKeyErrorResolvers<
 	code?: Resolver<ResolversTypes['DisableApiKeyErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	endUserMessage?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type DisableApiKeyResponseResolvers<
@@ -2305,7 +3873,22 @@ export type DisableApiKeyResponseResolvers<
 	error?: Resolver<Maybe<ResolversTypes['DisableApiKeyError']>, ParentType, ContextType>
 	errors?: Resolver<ReadonlyArray<ResolversTypes['DisableApiKeyError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
+}
+
+export type DisableEmailOtpErrorResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['DisableEmailOtpError'] = ResolversParentTypes['DisableEmailOtpError'],
+> = {
+	code?: Resolver<ResolversTypes['DisableEmailOtpErrorCode'], ParentType, ContextType>
+	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+}
+
+export type DisableEmailOtpResponseResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['DisableEmailOtpResponse'] = ResolversParentTypes['DisableEmailOtpResponse'],
+> = {
+	error?: Resolver<Maybe<ResolversTypes['DisableEmailOtpError']>, ParentType, ContextType>
+	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 }
 
 export type DisableIdpErrorResolvers<
@@ -2314,7 +3897,6 @@ export type DisableIdpErrorResolvers<
 > = {
 	code?: Resolver<ResolversTypes['DisableIDPErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type DisableIdpResponseResolvers<
@@ -2323,7 +3905,6 @@ export type DisableIdpResponseResolvers<
 > = {
 	error?: Resolver<Maybe<ResolversTypes['DisableIDPError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type DisableOtpErrorResolvers<
@@ -2333,7 +3914,6 @@ export type DisableOtpErrorResolvers<
 	code?: Resolver<ResolversTypes['DisableOtpErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	endUserMessage?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type DisableOtpResponseResolvers<
@@ -2343,7 +3923,6 @@ export type DisableOtpResponseResolvers<
 	error?: Resolver<Maybe<ResolversTypes['DisableOtpError']>, ParentType, ContextType>
 	errors?: Resolver<ReadonlyArray<ResolversTypes['DisableOtpError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type DisablePersonErrorResolvers<
@@ -2352,7 +3931,6 @@ export type DisablePersonErrorResolvers<
 > = {
 	code?: Resolver<ResolversTypes['DisablePersonErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type DisablePersonResponseResolvers<
@@ -2361,7 +3939,22 @@ export type DisablePersonResponseResolvers<
 > = {
 	error?: Resolver<Maybe<ResolversTypes['DisablePersonError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
+}
+
+export type DisconnectIdpErrorResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['DisconnectIDPError'] = ResolversParentTypes['DisconnectIDPError'],
+> = {
+	code?: Resolver<ResolversTypes['DisconnectIDPErrorCode'], ParentType, ContextType>
+	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+}
+
+export type DisconnectIdpResponseResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['DisconnectIDPResponse'] = ResolversParentTypes['DisconnectIDPResponse'],
+> = {
+	error?: Resolver<Maybe<ResolversTypes['DisconnectIDPError']>, ParentType, ContextType>
+	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 }
 
 export type EnableIdpErrorResolvers<
@@ -2370,7 +3963,6 @@ export type EnableIdpErrorResolvers<
 > = {
 	code?: Resolver<ResolversTypes['EnableIDPErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type EnableIdpResponseResolvers<
@@ -2379,17 +3971,50 @@ export type EnableIdpResponseResolvers<
 > = {
 	error?: Resolver<Maybe<ResolversTypes['EnableIDPError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
+}
+
+export type EnablePersonErrorResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['EnablePersonError'] = ResolversParentTypes['EnablePersonError'],
+> = {
+	code?: Resolver<ResolversTypes['EnablePersonErrorCode'], ParentType, ContextType>
+	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+}
+
+export type EnablePersonResponseResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['EnablePersonResponse'] = ResolversParentTypes['EnablePersonResponse'],
+> = {
+	error?: Resolver<Maybe<ResolversTypes['EnablePersonError']>, ParentType, ContextType>
+	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+}
+
+export type ForceSignOutPersonErrorResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['ForceSignOutPersonError'] = ResolversParentTypes['ForceSignOutPersonError'],
+> = {
+	code?: Resolver<ResolversTypes['ForceSignOutPersonErrorCode'], ParentType, ContextType>
+	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+}
+
+export type ForceSignOutPersonResponseResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['ForceSignOutPersonResponse'] = ResolversParentTypes['ForceSignOutPersonResponse'],
+> = {
+	error?: Resolver<Maybe<ResolversTypes['ForceSignOutPersonError']>, ParentType, ContextType>
+	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 }
 
 export type IdpOptionsOutputResolvers<
 	ContextType = any,
 	ParentType extends ResolversParentTypes['IDPOptionsOutput'] = ResolversParentTypes['IDPOptionsOutput'],
 > = {
+	assumeEmailVerified?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	autoSignUp?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	disableLocalAuthentication?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	exclusive?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	initReturnsConfig?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
+	requireVerifiedEmail?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 }
 
 export type IdentityResolvers<ContextType = any, ParentType extends ResolversParentTypes['Identity'] = ResolversParentTypes['Identity']> = {
@@ -2400,16 +4025,23 @@ export type IdentityResolvers<ContextType = any, ParentType extends ResolversPar
 	person?: Resolver<Maybe<ResolversTypes['Person']>, ParentType, ContextType>
 	projects?: Resolver<ReadonlyArray<ResolversTypes['IdentityProjectRelation']>, ParentType, ContextType>
 	roles?: Resolver<Maybe<ReadonlyArray<ResolversTypes['String']>>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
+	sessions?: Resolver<ReadonlyArray<ResolversTypes['SessionInfo']>, ParentType, ContextType>
 }
 
 export type IdentityGlobalPermissionsResolvers<
 	ContextType = any,
 	ParentType extends ResolversParentTypes['IdentityGlobalPermissions'] = ResolversParentTypes['IdentityGlobalPermissions'],
 > = {
+	canCreateGlobalApiKey?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	canCreateProject?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	canDeployEntrypoint?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
+	canListGlobalApiKeys?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canListIdentityProviders?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canListMailTemplates?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canListPersons?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canManageConfiguration?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canViewAuthLog?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canViewConfiguration?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 }
 
 export type IdentityProjectRelationResolvers<
@@ -2418,7 +4050,6 @@ export type IdentityProjectRelationResolvers<
 > = {
 	memberships?: Resolver<ReadonlyArray<ResolversTypes['Membership']>, ParentType, ContextType>
 	project?: Resolver<ResolversTypes['Project'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type IdentityProviderResolvers<
@@ -2430,7 +4061,31 @@ export type IdentityProviderResolvers<
 	options?: Resolver<ResolversTypes['IDPOptionsOutput'], ParentType, ContextType>
 	slug?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	type?: Resolver<ResolversTypes['String'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
+}
+
+export type IdentityProviderListItemResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['IdentityProviderListItem'] = ResolversParentTypes['IdentityProviderListItem'],
+> = {
+	disabledAt?: Resolver<Maybe<ResolversTypes['DateTime']>, ParentType, ContextType>
+	slug?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+	type?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+}
+
+export type InitEmailOtpErrorResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['InitEmailOtpError'] = ResolversParentTypes['InitEmailOtpError'],
+> = {
+	code?: Resolver<ResolversTypes['InitEmailOtpErrorCode'], ParentType, ContextType>
+	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+}
+
+export type InitEmailOtpResponseResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['InitEmailOtpResponse'] = ResolversParentTypes['InitEmailOtpResponse'],
+> = {
+	error?: Resolver<Maybe<ResolversTypes['InitEmailOtpError']>, ParentType, ContextType>
+	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 }
 
 export type InitSignInIdpErrorResolvers<
@@ -2440,7 +4095,6 @@ export type InitSignInIdpErrorResolvers<
 	code?: Resolver<ResolversTypes['InitSignInIDPErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	endUserMessage?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type InitSignInIdpResponseResolvers<
@@ -2451,7 +4105,6 @@ export type InitSignInIdpResponseResolvers<
 	errors?: Resolver<ReadonlyArray<ResolversTypes['InitSignInIDPError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	result?: Resolver<Maybe<ResolversTypes['InitSignInIDPResult']>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type InitSignInIdpResultResolvers<
@@ -2461,7 +4114,6 @@ export type InitSignInIdpResultResolvers<
 	authUrl?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	idpConfiguration?: Resolver<Maybe<ResolversTypes['Json']>, ParentType, ContextType>
 	sessionData?: Resolver<ResolversTypes['Json'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type InitSignInPasswordlessErrorResolvers<
@@ -2470,7 +4122,6 @@ export type InitSignInPasswordlessErrorResolvers<
 > = {
 	code?: Resolver<ResolversTypes['InitSignInPasswordlessErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type InitSignInPasswordlessResponseResolvers<
@@ -2480,7 +4131,6 @@ export type InitSignInPasswordlessResponseResolvers<
 	error?: Resolver<Maybe<ResolversTypes['InitSignInPasswordlessError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	result?: Resolver<Maybe<ResolversTypes['InitSignInPasswordlessResult']>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type InitSignInPasswordlessResultResolvers<
@@ -2489,7 +4139,6 @@ export type InitSignInPasswordlessResultResolvers<
 > = {
 	expiresAt?: Resolver<ResolversTypes['DateTime'], ParentType, ContextType>
 	requestId?: Resolver<ResolversTypes['String'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export interface IntervalScalarConfig extends GraphQLScalarTypeConfig<ResolversTypes['Interval'], any> {
@@ -2501,7 +4150,6 @@ export type InviteErrorResolvers<ContextType = any, ParentType extends Resolvers
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	endUserMessage?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
 	membershipValidation?: Resolver<Maybe<ReadonlyArray<ResolversTypes['MembershipValidationError']>>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type InviteResponseResolvers<
@@ -2512,14 +4160,12 @@ export type InviteResponseResolvers<
 	errors?: Resolver<ReadonlyArray<ResolversTypes['InviteError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	result?: Resolver<Maybe<ResolversTypes['InviteResult']>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type InviteResultResolvers<ContextType = any, ParentType extends ResolversParentTypes['InviteResult'] = ResolversParentTypes['InviteResult']> =
 	{
 		isNew?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 		person?: Resolver<ResolversTypes['Person'], ParentType, ContextType>
-		__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 	}
 
 export interface JsonScalarConfig extends GraphQLScalarTypeConfig<ResolversTypes['Json'], any> {
@@ -2537,13 +4183,11 @@ export type MailTemplateDataResolvers<
 	type?: Resolver<ResolversTypes['MailType'], ParentType, ContextType>
 	useLayout?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	variant?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type MembershipResolvers<ContextType = any, ParentType extends ResolversParentTypes['Membership'] = ResolversParentTypes['Membership']> = {
 	role?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	variables?: Resolver<ReadonlyArray<ResolversTypes['VariableEntry']>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type MembershipValidationErrorResolvers<
@@ -2553,7 +4197,14 @@ export type MembershipValidationErrorResolvers<
 	code?: Resolver<ResolversTypes['MembershipValidationErrorCode'], ParentType, ContextType>
 	role?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	variable?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
+}
+
+export type MfaEnrollmentResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['MfaEnrollment'] = ResolversParentTypes['MfaEnrollment'],
+> = {
+	otpSecret?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+	otpUri?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 }
 
 export type MutationResolvers<ContextType = any, ParentType extends ResolversParentTypes['Mutation'] = ResolversParentTypes['Mutation']> = {
@@ -2613,6 +4264,18 @@ export type MutationResolvers<ContextType = any, ParentType extends ResolversPar
 		RequireFields<MutationChangeProfileArgs, 'personId'>
 	>
 	configure?: Resolver<Maybe<ResolversTypes['ConfigureResponse']>, ParentType, ContextType, RequireFields<MutationConfigureArgs, 'config'>>
+	confirmEmailChange?: Resolver<
+		Maybe<ResolversTypes['ConfirmEmailChangeResponse']>,
+		ParentType,
+		ContextType,
+		RequireFields<MutationConfirmEmailChangeArgs, 'token'>
+	>
+	confirmEmailOtp?: Resolver<
+		Maybe<ResolversTypes['ConfirmEmailOtpResponse']>,
+		ParentType,
+		ContextType,
+		RequireFields<MutationConfirmEmailOtpArgs, 'otpToken'>
+	>
 	confirmOtp?: Resolver<Maybe<ResolversTypes['ConfirmOtpResponse']>, ParentType, ContextType, RequireFields<MutationConfirmOtpArgs, 'otpToken'>>
 	createApiKey?: Resolver<
 		Maybe<ResolversTypes['CreateApiKeyResponse']>,
@@ -2620,6 +4283,18 @@ export type MutationResolvers<ContextType = any, ParentType extends ResolversPar
 		ContextType,
 		RequireFields<MutationCreateApiKeyArgs, 'description' | 'memberships' | 'projectSlug'>
 	>
+	createAuthPolicy?: Resolver<
+		Maybe<ResolversTypes['CreateAuthPolicyResponse']>,
+		ParentType,
+		ContextType,
+		RequireFields<MutationCreateAuthPolicyArgs, 'policy'>
+	>
+	createCustomRole?: Resolver<
+		Maybe<ResolversTypes['CreateCustomRoleResponse']>,
+		ParentType,
+		ContextType,
+		RequireFields<MutationCreateCustomRoleArgs, 'grants' | 'slug'>
+	>
 	createGlobalApiKey?: Resolver<
 		Maybe<ResolversTypes['CreateApiKeyResponse']>,
 		ParentType,
@@ -2639,7 +4314,20 @@ export type MutationResolvers<ContextType = any, ParentType extends ResolversPar
 		RequireFields<MutationCreateResetPasswordRequestArgs, 'email'>
 	>
 	createSessionToken?: Resolver<Maybe<ResolversTypes['CreateSessionTokenResponse']>, ParentType, ContextType, Partial<MutationCreateSessionTokenArgs>>
+	deleteAuthPolicy?: Resolver<
+		Maybe<ResolversTypes['DeleteAuthPolicyResponse']>,
+		ParentType,
+		ContextType,
+		RequireFields<MutationDeleteAuthPolicyArgs, 'id'>
+	>
+	deleteCustomRole?: Resolver<
+		Maybe<ResolversTypes['DeleteCustomRoleResponse']>,
+		ParentType,
+		ContextType,
+		RequireFields<MutationDeleteCustomRoleArgs, 'slug'>
+	>
 	disableApiKey?: Resolver<Maybe<ResolversTypes['DisableApiKeyResponse']>, ParentType, ContextType, RequireFields<MutationDisableApiKeyArgs, 'id'>>
+	disableEmailOtp?: Resolver<Maybe<ResolversTypes['DisableEmailOtpResponse']>, ParentType, ContextType>
 	disableIDP?: Resolver<
 		Maybe<ResolversTypes['DisableIDPResponse']>,
 		ParentType,
@@ -2654,8 +4342,22 @@ export type MutationResolvers<ContextType = any, ParentType extends ResolversPar
 		ContextType,
 		RequireFields<MutationDisablePersonArgs, 'personId'>
 	>
+	disconnectMyIdentityProvider?: Resolver<
+		Maybe<ResolversTypes['DisconnectIDPResponse']>,
+		ParentType,
+		ContextType,
+		RequireFields<MutationDisconnectMyIdentityProviderArgs, 'id'>
+	>
 	enableIDP?: Resolver<Maybe<ResolversTypes['EnableIDPResponse']>, ParentType, ContextType, RequireFields<MutationEnableIdpArgs, 'identityProvider'>>
 	enableMyPasswordless?: Resolver<Maybe<ResolversTypes['ToggleMyPasswordlessResponse']>, ParentType, ContextType>
+	enablePerson?: Resolver<Maybe<ResolversTypes['EnablePersonResponse']>, ParentType, ContextType, RequireFields<MutationEnablePersonArgs, 'personId'>>
+	forceSignOutPerson?: Resolver<
+		Maybe<ResolversTypes['ForceSignOutPersonResponse']>,
+		ParentType,
+		ContextType,
+		RequireFields<MutationForceSignOutPersonArgs, 'personId'>
+	>
+	initEmailOtp?: Resolver<Maybe<ResolversTypes['InitEmailOtpResponse']>, ParentType, ContextType>
 	initSignInIDP?: Resolver<
 		Maybe<ResolversTypes['InitSignInIDPResponse']>,
 		ParentType,
@@ -2675,6 +4377,7 @@ export type MutationResolvers<ContextType = any, ParentType extends ResolversPar
 		RequireFields<MutationInviteArgs, 'email' | 'memberships' | 'projectSlug'>
 	>
 	prepareOtp?: Resolver<Maybe<ResolversTypes['PrepareOtpResponse']>, ParentType, ContextType, Partial<MutationPrepareOtpArgs>>
+	regenerateBackupCodes?: Resolver<Maybe<ResolversTypes['RegenerateBackupCodesResponse']>, ParentType, ContextType>
 	removeGlobalIdentityRoles?: Resolver<
 		Maybe<ResolversTypes['RemoveGlobalIdentityRolesResponse']>,
 		ParentType,
@@ -2699,12 +4402,30 @@ export type MutationResolvers<ContextType = any, ParentType extends ResolversPar
 		ContextType,
 		RequireFields<MutationRemoveProjectMemberArgs, 'identityId' | 'projectSlug'>
 	>
+	requestEmailVerification?: Resolver<
+		Maybe<ResolversTypes['RequestEmailVerificationResponse']>,
+		ParentType,
+		ContextType,
+		RequireFields<MutationRequestEmailVerificationArgs, 'email'>
+	>
 	resetPassword?: Resolver<
 		Maybe<ResolversTypes['ResetPasswordResponse']>,
 		ParentType,
 		ContextType,
 		RequireFields<MutationResetPasswordArgs, 'password' | 'token'>
 	>
+	resetPersonMfa?: Resolver<
+		Maybe<ResolversTypes['ResetPersonMfaResponse']>,
+		ParentType,
+		ContextType,
+		RequireFields<MutationResetPersonMfaArgs, 'personId'>
+	>
+	revokeSession?: Resolver<
+		Maybe<ResolversTypes['RevokeSessionResponse']>,
+		ParentType,
+		ContextType,
+		RequireFields<MutationRevokeSessionArgs, 'sessionId'>
+	>
 	setProjectSecret?: Resolver<
 		Maybe<ResolversTypes['SetProjectSecretResponse']>,
 		ParentType,
@@ -2727,6 +4448,18 @@ export type MutationResolvers<ContextType = any, ParentType extends ResolversPar
 		ContextType,
 		RequireFields<MutationUnmanagedInviteArgs, 'email' | 'memberships' | 'projectSlug'>
 	>
+	updateAuthPolicy?: Resolver<
+		Maybe<ResolversTypes['UpdateAuthPolicyResponse']>,
+		ParentType,
+		ContextType,
+		RequireFields<MutationUpdateAuthPolicyArgs, 'id' | 'policy'>
+	>
+	updateCustomRole?: Resolver<
+		Maybe<ResolversTypes['UpdateCustomRoleResponse']>,
+		ParentType,
+		ContextType,
+		RequireFields<MutationUpdateCustomRoleArgs, 'slug'>
+	>
 	updateIDP?: Resolver<Maybe<ResolversTypes['UpdateIDPResponse']>, ParentType, ContextType, RequireFields<MutationUpdateIdpArgs, 'identityProvider'>>
 	updateProject?: Resolver<
 		Maybe<ResolversTypes['UpdateProjectResponse']>,
@@ -2740,16 +4473,32 @@ export type MutationResolvers<ContextType = any, ParentType extends ResolversPar
 		ContextType,
 		RequireFields<MutationUpdateProjectMemberArgs, 'identityId' | 'memberships' | 'projectSlug'>
 	>
+	verifyEmail?: Resolver<Maybe<ResolversTypes['VerifyEmailResponse']>, ParentType, ContextType, RequireFields<MutationVerifyEmailArgs, 'token'>>
 }
 
 export type PersonResolvers<ContextType = any, ParentType extends ResolversParentTypes['Person'] = ResolversParentTypes['Person']> = {
+	disabledAt?: Resolver<Maybe<ResolversTypes['DateTime']>, ParentType, ContextType>
 	email?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
+	emailOtpEnabled?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	emailVerified?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	id?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	identity?: Resolver<ResolversTypes['Identity'], ParentType, ContextType>
+	identityProviders?: Resolver<ReadonlyArray<ResolversTypes['PersonIdentityProvider']>, ParentType, ContextType>
 	name?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
 	otpEnabled?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	passwordlessAvailable?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	passwordlessEnabled?: Resolver<Maybe<ResolversTypes['Boolean']>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
+	passwordlessSelfManaged?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+}
+
+export type PersonIdentityProviderResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['PersonIdentityProvider'] = ResolversParentTypes['PersonIdentityProvider'],
+> = {
+	createdAt?: Resolver<ResolversTypes['DateTime'], ParentType, ContextType>
+	externalIdentifier?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+	id?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+	identityProvider?: Resolver<ResolversTypes['IdentityProviderListItem'], ParentType, ContextType>
 }
 
 export type PrepareOtpResponseResolvers<
@@ -2758,7 +4507,6 @@ export type PrepareOtpResponseResolvers<
 > = {
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	result?: Resolver<Maybe<ResolversTypes['PrepareOtpResult']>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type PrepareOtpResultResolvers<
@@ -2767,17 +4515,18 @@ export type PrepareOtpResultResolvers<
 > = {
 	otpSecret?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	otpUri?: Resolver<ResolversTypes['String'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type ProjectResolvers<ContextType = any, ParentType extends ResolversParentTypes['Project'] = ResolversParentTypes['Project']> = {
+	apiKeys?: Resolver<ReadonlyArray<ResolversTypes['ApiKey']>, ParentType, ContextType>
 	config?: Resolver<ResolversTypes['Json'], ParentType, ContextType>
 	id?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	members?: Resolver<ReadonlyArray<ResolversTypes['ProjectIdentityRelation']>, ParentType, ContextType, Partial<ProjectMembersArgs>>
 	name?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+	permissions?: Resolver<ResolversTypes['ProjectPermissions'], ParentType, ContextType>
 	roles?: Resolver<ReadonlyArray<ResolversTypes['RoleDefinition']>, ParentType, ContextType>
+	secrets?: Resolver<ReadonlyArray<ResolversTypes['ProjectSecretInfo']>, ParentType, ContextType>
 	slug?: Resolver<ResolversTypes['String'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type ProjectIdentityRelationResolvers<
@@ -2786,10 +4535,34 @@ export type ProjectIdentityRelationResolvers<
 > = {
 	identity?: Resolver<ResolversTypes['Identity'], ParentType, ContextType>
 	memberships?: Resolver<ReadonlyArray<ResolversTypes['Membership']>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
+}
+
+export type ProjectPermissionsResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['ProjectPermissions'] = ResolversParentTypes['ProjectPermissions'],
+> = {
+	canAddMember?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canCreateApiKey?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canRemoveMember?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canSetSecret?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canUpdate?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canUpdateMember?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canViewMembers?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	canViewSecrets?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+}
+
+export type ProjectSecretInfoResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['ProjectSecretInfo'] = ResolversParentTypes['ProjectSecretInfo'],
+> = {
+	createdAt?: Resolver<ResolversTypes['DateTime'], ParentType, ContextType>
+	key?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+	updatedAt?: Resolver<ResolversTypes['DateTime'], ParentType, ContextType>
 }
 
 export type QueryResolvers<ContextType = any, ParentType extends ResolversParentTypes['Query'] = ResolversParentTypes['Query']> = {
+	authLog?: Resolver<ResolversTypes['AuthLogPage'], ParentType, ContextType, Partial<QueryAuthLogArgs>>
+	authPolicies?: Resolver<ReadonlyArray<ResolversTypes['AuthPolicy']>, ParentType, ContextType>
 	checkResetPasswordToken?: Resolver<
 		ResolversTypes['CheckResetPasswordTokenCode'],
 		ParentType,
@@ -2797,10 +4570,14 @@ export type QueryResolvers<ContextType = any, ParentType extends ResolversParent
 		RequireFields<QueryCheckResetPasswordTokenArgs, 'requestId' | 'token'>
 	>
 	configuration?: Resolver<ResolversTypes['Config'], ParentType, ContextType>
+	customRolePermissions?: Resolver<ReadonlyArray<ResolversTypes['CustomRolePermissionDefinition']>, ParentType, ContextType>
+	customRoles?: Resolver<ReadonlyArray<ResolversTypes['CustomRole']>, ParentType, ContextType>
+	globalApiKeys?: Resolver<ReadonlyArray<ResolversTypes['ApiKey']>, ParentType, ContextType>
 	identityProviders?: Resolver<ReadonlyArray<ResolversTypes['IdentityProvider']>, ParentType, ContextType>
 	mailTemplates?: Resolver<ReadonlyArray<ResolversTypes['MailTemplateData']>, ParentType, ContextType>
 	me?: Resolver<ResolversTypes['Identity'], ParentType, ContextType>
 	personById?: Resolver<Maybe<ResolversTypes['Person']>, ParentType, ContextType, RequireFields<QueryPersonByIdArgs, 'id'>>
+	persons?: Resolver<ReadonlyArray<ResolversTypes['Person']>, ParentType, ContextType, Partial<QueryPersonsArgs>>
 	projectBySlug?: Resolver<Maybe<ResolversTypes['Project']>, ParentType, ContextType, RequireFields<QueryProjectBySlugArgs, 'slug'>>
 	projectMemberships?: Resolver<
 		ReadonlyArray<ResolversTypes['Membership']>,
@@ -2811,13 +4588,36 @@ export type QueryResolvers<ContextType = any, ParentType extends ResolversParent
 	projects?: Resolver<ReadonlyArray<ResolversTypes['Project']>, ParentType, ContextType>
 }
 
+export type RegenerateBackupCodesErrorResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['RegenerateBackupCodesError'] = ResolversParentTypes['RegenerateBackupCodesError'],
+> = {
+	code?: Resolver<ResolversTypes['RegenerateBackupCodesErrorCode'], ParentType, ContextType>
+	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+}
+
+export type RegenerateBackupCodesResponseResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['RegenerateBackupCodesResponse'] = ResolversParentTypes['RegenerateBackupCodesResponse'],
+> = {
+	error?: Resolver<Maybe<ResolversTypes['RegenerateBackupCodesError']>, ParentType, ContextType>
+	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	result?: Resolver<Maybe<ResolversTypes['RegenerateBackupCodesResult']>, ParentType, ContextType>
+}
+
+export type RegenerateBackupCodesResultResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['RegenerateBackupCodesResult'] = ResolversParentTypes['RegenerateBackupCodesResult'],
+> = {
+	backupCodes?: Resolver<ReadonlyArray<ResolversTypes['String']>, ParentType, ContextType>
+}
+
 export type RemoveGlobalIdentityRolesErrorResolvers<
 	ContextType = any,
 	ParentType extends ResolversParentTypes['RemoveGlobalIdentityRolesError'] = ResolversParentTypes['RemoveGlobalIdentityRolesError'],
 > = {
 	code?: Resolver<ResolversTypes['RemoveGlobalIdentityRolesErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type RemoveGlobalIdentityRolesResponseResolvers<
@@ -2827,7 +4627,6 @@ export type RemoveGlobalIdentityRolesResponseResolvers<
 	error?: Resolver<Maybe<ResolversTypes['RemoveGlobalIdentityRolesError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	result?: Resolver<Maybe<ResolversTypes['RemoveGlobalIdentityRolesResult']>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type RemoveGlobalIdentityRolesResultResolvers<
@@ -2835,7 +4634,6 @@ export type RemoveGlobalIdentityRolesResultResolvers<
 	ParentType extends ResolversParentTypes['RemoveGlobalIdentityRolesResult'] = ResolversParentTypes['RemoveGlobalIdentityRolesResult'],
 > = {
 	identity?: Resolver<ResolversTypes['Identity'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type RemoveMailTemplateErrorResolvers<
@@ -2845,7 +4643,6 @@ export type RemoveMailTemplateErrorResolvers<
 	code?: Resolver<ResolversTypes['RemoveMailTemplateErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	endUserMessage?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type RemoveMailTemplateResponseResolvers<
@@ -2855,7 +4652,6 @@ export type RemoveMailTemplateResponseResolvers<
 	error?: Resolver<Maybe<ResolversTypes['RemoveMailTemplateError']>, ParentType, ContextType>
 	errors?: Resolver<ReadonlyArray<ResolversTypes['RemoveMailTemplateError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type RemoveProjectMemberErrorResolvers<
@@ -2865,7 +4661,6 @@ export type RemoveProjectMemberErrorResolvers<
 	code?: Resolver<ResolversTypes['RemoveProjectMemberErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	endUserMessage?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type RemoveProjectMemberResponseResolvers<
@@ -2875,7 +4670,22 @@ export type RemoveProjectMemberResponseResolvers<
 	error?: Resolver<Maybe<ResolversTypes['RemoveProjectMemberError']>, ParentType, ContextType>
 	errors?: Resolver<ReadonlyArray<ResolversTypes['RemoveProjectMemberError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
+}
+
+export type RequestEmailVerificationErrorResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['RequestEmailVerificationError'] = ResolversParentTypes['RequestEmailVerificationError'],
+> = {
+	code?: Resolver<ResolversTypes['RequestEmailVerificationErrorCode'], ParentType, ContextType>
+	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+}
+
+export type RequestEmailVerificationResponseResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['RequestEmailVerificationResponse'] = ResolversParentTypes['RequestEmailVerificationResponse'],
+> = {
+	error?: Resolver<Maybe<ResolversTypes['RequestEmailVerificationError']>, ParentType, ContextType>
+	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 }
 
 export type ResetPasswordErrorResolvers<
@@ -2886,7 +4696,6 @@ export type ResetPasswordErrorResolvers<
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	endUserMessage?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
 	weakPasswordReasons?: Resolver<Maybe<ReadonlyArray<ResolversTypes['WeakPasswordReason']>>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type ResetPasswordResponseResolvers<
@@ -2896,7 +4705,38 @@ export type ResetPasswordResponseResolvers<
 	error?: Resolver<Maybe<ResolversTypes['ResetPasswordError']>, ParentType, ContextType>
 	errors?: Resolver<ReadonlyArray<ResolversTypes['ResetPasswordError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
+}
+
+export type ResetPersonMfaErrorResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['ResetPersonMfaError'] = ResolversParentTypes['ResetPersonMfaError'],
+> = {
+	code?: Resolver<ResolversTypes['ResetPersonMfaErrorCode'], ParentType, ContextType>
+	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+}
+
+export type ResetPersonMfaResponseResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['ResetPersonMfaResponse'] = ResolversParentTypes['ResetPersonMfaResponse'],
+> = {
+	error?: Resolver<Maybe<ResolversTypes['ResetPersonMfaError']>, ParentType, ContextType>
+	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+}
+
+export type RevokeSessionErrorResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['RevokeSessionError'] = ResolversParentTypes['RevokeSessionError'],
+> = {
+	code?: Resolver<ResolversTypes['RevokeSessionErrorCode'], ParentType, ContextType>
+	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+}
+
+export type RevokeSessionResponseResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['RevokeSessionResponse'] = ResolversParentTypes['RevokeSessionResponse'],
+> = {
+	error?: Resolver<Maybe<ResolversTypes['RevokeSessionError']>, ParentType, ContextType>
+	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 }
 
 export type RoleConditionVariableDefinitionResolvers<
@@ -2913,7 +4753,6 @@ export type RoleDefinitionResolvers<
 > = {
 	name?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	variables?: Resolver<ReadonlyArray<ResolversTypes['RoleVariableDefinition']>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type RoleEntityVariableDefinitionResolvers<
@@ -2943,7 +4782,19 @@ export type RoleVariableDefinitionResolvers<
 		ParentType,
 		ContextType
 	>
-	name?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+}
+
+export type SessionInfoResolvers<ContextType = any, ParentType extends ResolversParentTypes['SessionInfo'] = ResolversParentTypes['SessionInfo']> = {
+	createdAt?: Resolver<ResolversTypes['DateTime'], ParentType, ContextType>
+	createdIp?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
+	createdUserAgent?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
+	expiresAt?: Resolver<Maybe<ResolversTypes['DateTime']>, ParentType, ContextType>
+	id?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+	isCurrent?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	lastIp?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
+	lastUsedAt?: Resolver<Maybe<ResolversTypes['DateTime']>, ParentType, ContextType>
+	lastUserAgent?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
+	trustForwardedClientInfo?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 }
 
 export type SetProjectSecretErrorResolvers<
@@ -2952,7 +4803,6 @@ export type SetProjectSecretErrorResolvers<
 > = {
 	code?: Resolver<ResolversTypes['SetProjectSecretErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type SetProjectSecretResponseResolvers<
@@ -2961,15 +4811,14 @@ export type SetProjectSecretResponseResolvers<
 > = {
 	error?: Resolver<Maybe<ResolversTypes['SetProjectSecretError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type SignInErrorResolvers<ContextType = any, ParentType extends ResolversParentTypes['SignInError'] = ResolversParentTypes['SignInError']> = {
 	code?: Resolver<ResolversTypes['SignInErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	endUserMessage?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
+	mfaEnrollment?: Resolver<Maybe<ResolversTypes['MfaEnrollment']>, ParentType, ContextType>
 	retryAfter?: Resolver<Maybe<ResolversTypes['Int']>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type SignInIdpErrorResolvers<
@@ -2979,7 +4828,6 @@ export type SignInIdpErrorResolvers<
 	code?: Resolver<ResolversTypes['SignInIDPErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	endUserMessage?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type SignInIdpResponseResolvers<
@@ -2990,7 +4838,6 @@ export type SignInIdpResponseResolvers<
 	errors?: Resolver<ReadonlyArray<ResolversTypes['SignInIDPError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	result?: Resolver<Maybe<ResolversTypes['SignInIDPResult']>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type SignInIdpResultResolvers<
@@ -3009,7 +4856,6 @@ export type SignInPasswordlessErrorResolvers<
 > = {
 	code?: Resolver<ResolversTypes['SignInPasswordlessErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type SignInPasswordlessResponseResolvers<
@@ -3019,7 +4865,6 @@ export type SignInPasswordlessResponseResolvers<
 	error?: Resolver<Maybe<ResolversTypes['SignInPasswordlessError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	result?: Resolver<Maybe<ResolversTypes['SignInPasswordlessResult']>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type SignInPasswordlessResultResolvers<
@@ -3039,11 +4884,11 @@ export type SignInResponseResolvers<
 	errors?: Resolver<ReadonlyArray<ResolversTypes['SignInError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	result?: Resolver<Maybe<ResolversTypes['SignInResult']>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type SignInResultResolvers<ContextType = any, ParentType extends ResolversParentTypes['SignInResult'] = ResolversParentTypes['SignInResult']> =
 	{
+		backupCodes?: Resolver<Maybe<ReadonlyArray<ResolversTypes['String']>>, ParentType, ContextType>
 		person?: Resolver<ResolversTypes['Person'], ParentType, ContextType>
 		token?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 		__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
@@ -3054,7 +4899,6 @@ export type SignOutErrorResolvers<ContextType = any, ParentType extends Resolver
 		code?: Resolver<ResolversTypes['SignOutErrorCode'], ParentType, ContextType>
 		developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 		endUserMessage?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
-		__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 	}
 
 export type SignOutResponseResolvers<
@@ -3063,16 +4907,16 @@ export type SignOutResponseResolvers<
 > = {
 	error?: Resolver<Maybe<ResolversTypes['SignOutError']>, ParentType, ContextType>
 	errors?: Resolver<ReadonlyArray<ResolversTypes['SignOutError']>, ParentType, ContextType>
+	logoutUrl?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type SignUpErrorResolvers<ContextType = any, ParentType extends ResolversParentTypes['SignUpError'] = ResolversParentTypes['SignUpError']> = {
 	code?: Resolver<ResolversTypes['SignUpErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	endPersonMessage?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
+	recommendedAction?: Resolver<Maybe<ResolversTypes['SignUpRecommendedAction']>, ParentType, ContextType>
 	weakPasswordReasons?: Resolver<Maybe<ReadonlyArray<ResolversTypes['WeakPasswordReason']>>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type SignUpResponseResolvers<
@@ -3083,13 +4927,11 @@ export type SignUpResponseResolvers<
 	errors?: Resolver<ReadonlyArray<ResolversTypes['SignUpError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	result?: Resolver<Maybe<ResolversTypes['SignUpResult']>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type SignUpResultResolvers<ContextType = any, ParentType extends ResolversParentTypes['SignUpResult'] = ResolversParentTypes['SignUpResult']> =
 	{
 		person?: Resolver<ResolversTypes['Person'], ParentType, ContextType>
-		__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 	}
 
 export type ToggleMyPasswordlessErrorResolvers<
@@ -3098,7 +4940,6 @@ export type ToggleMyPasswordlessErrorResolvers<
 > = {
 	code?: Resolver<ResolversTypes['ToggleMyPasswordlessErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type ToggleMyPasswordlessResponseResolvers<
@@ -3107,7 +4948,38 @@ export type ToggleMyPasswordlessResponseResolvers<
 > = {
 	error?: Resolver<Maybe<ResolversTypes['ToggleMyPasswordlessError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
+}
+
+export type UpdateAuthPolicyErrorResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['UpdateAuthPolicyError'] = ResolversParentTypes['UpdateAuthPolicyError'],
+> = {
+	code?: Resolver<ResolversTypes['UpdateAuthPolicyErrorCode'], ParentType, ContextType>
+	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+}
+
+export type UpdateAuthPolicyResponseResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['UpdateAuthPolicyResponse'] = ResolversParentTypes['UpdateAuthPolicyResponse'],
+> = {
+	error?: Resolver<Maybe<ResolversTypes['UpdateAuthPolicyError']>, ParentType, ContextType>
+	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+}
+
+export type UpdateCustomRoleErrorResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['UpdateCustomRoleError'] = ResolversParentTypes['UpdateCustomRoleError'],
+> = {
+	code?: Resolver<ResolversTypes['UpdateCustomRoleErrorCode'], ParentType, ContextType>
+	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+}
+
+export type UpdateCustomRoleResponseResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['UpdateCustomRoleResponse'] = ResolversParentTypes['UpdateCustomRoleResponse'],
+> = {
+	error?: Resolver<Maybe<ResolversTypes['UpdateCustomRoleError']>, ParentType, ContextType>
+	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 }
 
 export type UpdateIdpErrorResolvers<
@@ -3116,7 +4988,6 @@ export type UpdateIdpErrorResolvers<
 > = {
 	code?: Resolver<ResolversTypes['UpdateIDPErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type UpdateIdpResponseResolvers<
@@ -3125,7 +4996,6 @@ export type UpdateIdpResponseResolvers<
 > = {
 	error?: Resolver<Maybe<ResolversTypes['UpdateIDPError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type UpdateProjectErrorResolvers<
@@ -3134,7 +5004,6 @@ export type UpdateProjectErrorResolvers<
 > = {
 	code?: Resolver<ResolversTypes['UpdateProjectErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type UpdateProjectMemberErrorResolvers<
@@ -3145,7 +5014,6 @@ export type UpdateProjectMemberErrorResolvers<
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	endUserMessage?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
 	membershipValidation?: Resolver<Maybe<ReadonlyArray<ResolversTypes['MembershipValidationError']>>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type UpdateProjectMemberResponseResolvers<
@@ -3155,7 +5023,6 @@ export type UpdateProjectMemberResponseResolvers<
 	error?: Resolver<Maybe<ResolversTypes['UpdateProjectMemberError']>, ParentType, ContextType>
 	errors?: Resolver<ReadonlyArray<ResolversTypes['UpdateProjectMemberError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type UpdateProjectResponseResolvers<
@@ -3164,7 +5031,6 @@ export type UpdateProjectResponseResolvers<
 > = {
 	error?: Resolver<Maybe<ResolversTypes['UpdateProjectError']>, ParentType, ContextType>
 	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
 export type VariableEntryResolvers<
@@ -3173,7 +5039,22 @@ export type VariableEntryResolvers<
 > = {
 	name?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	values?: Resolver<ReadonlyArray<ResolversTypes['String']>, ParentType, ContextType>
-	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
+}
+
+export type VerifyEmailErrorResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['VerifyEmailError'] = ResolversParentTypes['VerifyEmailError'],
+> = {
+	code?: Resolver<ResolversTypes['VerifyEmailErrorCode'], ParentType, ContextType>
+	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+}
+
+export type VerifyEmailResponseResolvers<
+	ContextType = any,
+	ParentType extends ResolversParentTypes['VerifyEmailResponse'] = ResolversParentTypes['VerifyEmailResponse'],
+> = {
+	error?: Resolver<Maybe<ResolversTypes['VerifyEmailError']>, ParentType, ContextType>
+	ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 }
 
 export type Resolvers<ContextType = any> = {
@@ -3190,6 +5071,9 @@ export type Resolvers<ContextType = any> = {
 	AddProjectMemberResponse?: AddProjectMemberResponseResolvers<ContextType>
 	ApiKey?: ApiKeyResolvers<ContextType>
 	ApiKeyWithToken?: ApiKeyWithTokenResolvers<ContextType>
+	AuthLogEntry?: AuthLogEntryResolvers<ContextType>
+	AuthLogPage?: AuthLogPageResolvers<ContextType>
+	AuthPolicy?: AuthPolicyResolvers<ContextType>
 	ChangeMyPasswordError?: ChangeMyPasswordErrorResolvers<ContextType>
 	ChangeMyPasswordResponse?: ChangeMyPasswordResponseResolvers<ContextType>
 	ChangeMyProfileError?: ChangeMyProfileErrorResolvers<ContextType>
@@ -3201,16 +5085,35 @@ export type Resolvers<ContextType = any> = {
 	CheckResetPasswordTokenResult?: CheckResetPasswordTokenResultResolvers<ContextType>
 	CommonSignInResult?: CommonSignInResultResolvers<ContextType>
 	Config?: ConfigResolvers<ContextType>
+	ConfigCaptcha?: ConfigCaptchaResolvers<ContextType>
+	ConfigCaptchaProtect?: ConfigCaptchaProtectResolvers<ContextType>
+	ConfigEmailChange?: ConfigEmailChangeResolvers<ContextType>
 	ConfigLogin?: ConfigLoginResolvers<ContextType>
+	ConfigLoginAnomalyDetection?: ConfigLoginAnomalyDetectionResolvers<ContextType>
+	ConfigPanel?: ConfigPanelResolvers<ContextType>
 	ConfigPassword?: ConfigPasswordResolvers<ContextType>
 	ConfigPasswordless?: ConfigPasswordlessResolvers<ContextType>
+	ConfigRateLimitWindow?: ConfigRateLimitWindowResolvers<ContextType>
+	ConfigRateLimits?: ConfigRateLimitsResolvers<ContextType>
+	ConfigSignup?: ConfigSignupResolvers<ContextType>
 	ConfigureError?: ConfigureErrorResolvers<ContextType>
 	ConfigureResponse?: ConfigureResponseResolvers<ContextType>
+	ConfirmEmailChangeError?: ConfirmEmailChangeErrorResolvers<ContextType>
+	ConfirmEmailChangeResponse?: ConfirmEmailChangeResponseResolvers<ContextType>
+	ConfirmEmailOtpError?: ConfirmEmailOtpErrorResolvers<ContextType>
+	ConfirmEmailOtpResponse?: ConfirmEmailOtpResponseResolvers<ContextType>
+	ConfirmEmailOtpResult?: ConfirmEmailOtpResultResolvers<ContextType>
 	ConfirmOtpError?: ConfirmOtpErrorResolvers<ContextType>
 	ConfirmOtpResponse?: ConfirmOtpResponseResolvers<ContextType>
+	ConfirmOtpResult?: ConfirmOtpResultResolvers<ContextType>
 	CreateApiKeyError?: CreateApiKeyErrorResolvers<ContextType>
 	CreateApiKeyResponse?: CreateApiKeyResponseResolvers<ContextType>
 	CreateApiKeyResult?: CreateApiKeyResultResolvers<ContextType>
+	CreateAuthPolicyError?: CreateAuthPolicyErrorResolvers<ContextType>
+	CreateAuthPolicyResponse?: CreateAuthPolicyResponseResolvers<ContextType>
+	CreateAuthPolicyResult?: CreateAuthPolicyResultResolvers<ContextType>
+	CreateCustomRoleError?: CreateCustomRoleErrorResolvers<ContextType>
+	CreateCustomRoleResponse?: CreateCustomRoleResponseResolvers<ContextType>
 	CreatePasswordResetRequestError?: CreatePasswordResetRequestErrorResolvers<ContextType>
 	CreatePasswordResetRequestResponse?: CreatePasswordResetRequestResponseResolvers<ContextType>
 	CreateProjectResponse?: CreateProjectResponseResolvers<ContextType>
@@ -3219,22 +5122,40 @@ export type Resolvers<ContextType = any> = {
 	CreateSessionTokenError?: CreateSessionTokenErrorResolvers<ContextType>
 	CreateSessionTokenResponse?: CreateSessionTokenResponseResolvers<ContextType>
 	CreateSessionTokenResult?: CreateSessionTokenResultResolvers<ContextType>
+	CustomRole?: CustomRoleResolvers<ContextType>
+	CustomRoleGrant?: CustomRoleGrantResolvers<ContextType>
+	CustomRolePermissionDefinition?: CustomRolePermissionDefinitionResolvers<ContextType>
 	DateTime?: GraphQLScalarType
+	DeleteAuthPolicyError?: DeleteAuthPolicyErrorResolvers<ContextType>
+	DeleteAuthPolicyResponse?: DeleteAuthPolicyResponseResolvers<ContextType>
+	DeleteCustomRoleError?: DeleteCustomRoleErrorResolvers<ContextType>
+	DeleteCustomRoleResponse?: DeleteCustomRoleResponseResolvers<ContextType>
 	DisableApiKeyError?: DisableApiKeyErrorResolvers<ContextType>
 	DisableApiKeyResponse?: DisableApiKeyResponseResolvers<ContextType>
+	DisableEmailOtpError?: DisableEmailOtpErrorResolvers<ContextType>
+	DisableEmailOtpResponse?: DisableEmailOtpResponseResolvers<ContextType>
 	DisableIDPError?: DisableIdpErrorResolvers<ContextType>
 	DisableIDPResponse?: DisableIdpResponseResolvers<ContextType>
 	DisableOtpError?: DisableOtpErrorResolvers<ContextType>
 	DisableOtpResponse?: DisableOtpResponseResolvers<ContextType>
 	DisablePersonError?: DisablePersonErrorResolvers<ContextType>
 	DisablePersonResponse?: DisablePersonResponseResolvers<ContextType>
+	DisconnectIDPError?: DisconnectIdpErrorResolvers<ContextType>
+	DisconnectIDPResponse?: DisconnectIdpResponseResolvers<ContextType>
 	EnableIDPError?: EnableIdpErrorResolvers<ContextType>
 	EnableIDPResponse?: EnableIdpResponseResolvers<ContextType>
+	EnablePersonError?: EnablePersonErrorResolvers<ContextType>
+	EnablePersonResponse?: EnablePersonResponseResolvers<ContextType>
+	ForceSignOutPersonError?: ForceSignOutPersonErrorResolvers<ContextType>
+	ForceSignOutPersonResponse?: ForceSignOutPersonResponseResolvers<ContextType>
 	IDPOptionsOutput?: IdpOptionsOutputResolvers<ContextType>
 	Identity?: IdentityResolvers<ContextType>
 	IdentityGlobalPermissions?: IdentityGlobalPermissionsResolvers<ContextType>
 	IdentityProjectRelation?: IdentityProjectRelationResolvers<ContextType>
 	IdentityProvider?: IdentityProviderResolvers<ContextType>
+	IdentityProviderListItem?: IdentityProviderListItemResolvers<ContextType>
+	InitEmailOtpError?: InitEmailOtpErrorResolvers<ContextType>
+	InitEmailOtpResponse?: InitEmailOtpResponseResolvers<ContextType>
 	InitSignInIDPError?: InitSignInIdpErrorResolvers<ContextType>
 	InitSignInIDPResponse?: InitSignInIdpResponseResolvers<ContextType>
 	InitSignInIDPResult?: InitSignInIdpResultResolvers<ContextType>
@@ -3249,13 +5170,20 @@ export type Resolvers<ContextType = any> = {
 	MailTemplateData?: MailTemplateDataResolvers<ContextType>
 	Membership?: MembershipResolvers<ContextType>
 	MembershipValidationError?: MembershipValidationErrorResolvers<ContextType>
+	MfaEnrollment?: MfaEnrollmentResolvers<ContextType>
 	Mutation?: MutationResolvers<ContextType>
 	Person?: PersonResolvers<ContextType>
+	PersonIdentityProvider?: PersonIdentityProviderResolvers<ContextType>
 	PrepareOtpResponse?: PrepareOtpResponseResolvers<ContextType>
 	PrepareOtpResult?: PrepareOtpResultResolvers<ContextType>
 	Project?: ProjectResolvers<ContextType>
 	ProjectIdentityRelation?: ProjectIdentityRelationResolvers<ContextType>
+	ProjectPermissions?: ProjectPermissionsResolvers<ContextType>
+	ProjectSecretInfo?: ProjectSecretInfoResolvers<ContextType>
 	Query?: QueryResolvers<ContextType>
+	RegenerateBackupCodesError?: RegenerateBackupCodesErrorResolvers<ContextType>
+	RegenerateBackupCodesResponse?: RegenerateBackupCodesResponseResolvers<ContextType>
+	RegenerateBackupCodesResult?: RegenerateBackupCodesResultResolvers<ContextType>
 	RemoveGlobalIdentityRolesError?: RemoveGlobalIdentityRolesErrorResolvers<ContextType>
 	RemoveGlobalIdentityRolesResponse?: RemoveGlobalIdentityRolesResponseResolvers<ContextType>
 	RemoveGlobalIdentityRolesResult?: RemoveGlobalIdentityRolesResultResolvers<ContextType>
@@ -3263,13 +5191,20 @@ export type Resolvers<ContextType = any> = {
 	RemoveMailTemplateResponse?: RemoveMailTemplateResponseResolvers<ContextType>
 	RemoveProjectMemberError?: RemoveProjectMemberErrorResolvers<ContextType>
 	RemoveProjectMemberResponse?: RemoveProjectMemberResponseResolvers<ContextType>
+	RequestEmailVerificationError?: RequestEmailVerificationErrorResolvers<ContextType>
+	RequestEmailVerificationResponse?: RequestEmailVerificationResponseResolvers<ContextType>
 	ResetPasswordError?: ResetPasswordErrorResolvers<ContextType>
 	ResetPasswordResponse?: ResetPasswordResponseResolvers<ContextType>
+	ResetPersonMfaError?: ResetPersonMfaErrorResolvers<ContextType>
+	ResetPersonMfaResponse?: ResetPersonMfaResponseResolvers<ContextType>
+	RevokeSessionError?: RevokeSessionErrorResolvers<ContextType>
+	RevokeSessionResponse?: RevokeSessionResponseResolvers<ContextType>
 	RoleConditionVariableDefinition?: RoleConditionVariableDefinitionResolvers<ContextType>
 	RoleDefinition?: RoleDefinitionResolvers<ContextType>
 	RoleEntityVariableDefinition?: RoleEntityVariableDefinitionResolvers<ContextType>
 	RolePredefinedVariableDefinition?: RolePredefinedVariableDefinitionResolvers<ContextType>
 	RoleVariableDefinition?: RoleVariableDefinitionResolvers<ContextType>
+	SessionInfo?: SessionInfoResolvers<ContextType>
 	SetProjectSecretError?: SetProjectSecretErrorResolvers<ContextType>
 	SetProjectSecretResponse?: SetProjectSecretResponseResolvers<ContextType>
 	SignInError?: SignInErrorResolvers<ContextType>
@@ -3288,6 +5223,10 @@ export type Resolvers<ContextType = any> = {
 	SignUpResult?: SignUpResultResolvers<ContextType>
 	ToggleMyPasswordlessError?: ToggleMyPasswordlessErrorResolvers<ContextType>
 	ToggleMyPasswordlessResponse?: ToggleMyPasswordlessResponseResolvers<ContextType>
+	UpdateAuthPolicyError?: UpdateAuthPolicyErrorResolvers<ContextType>
+	UpdateAuthPolicyResponse?: UpdateAuthPolicyResponseResolvers<ContextType>
+	UpdateCustomRoleError?: UpdateCustomRoleErrorResolvers<ContextType>
+	UpdateCustomRoleResponse?: UpdateCustomRoleResponseResolvers<ContextType>
 	UpdateIDPError?: UpdateIdpErrorResolvers<ContextType>
 	UpdateIDPResponse?: UpdateIdpResponseResolvers<ContextType>
 	UpdateProjectError?: UpdateProjectErrorResolvers<ContextType>
@@ -3295,4 +5234,6 @@ export type Resolvers<ContextType = any> = {
 	UpdateProjectMemberResponse?: UpdateProjectMemberResponseResolvers<ContextType>
 	UpdateProjectResponse?: UpdateProjectResponseResolvers<ContextType>
 	VariableEntry?: VariableEntryResolvers<ContextType>
+	VerifyEmailError?: VerifyEmailErrorResolvers<ContextType>
+	VerifyEmailResponse?: VerifyEmailResponseResolvers<ContextType>
 }