@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/dist/types/schema/index.d.ts

@@ -303,6 +303,7 @@ export type Config = {
     readonly captcha: ConfigCaptcha;
     readonly emailChange: ConfigEmailChange;
     readonly login: ConfigLogin;
+    readonly panel: ConfigPanel;
     readonly password: ConfigPassword;
     readonly passwordless: ConfigPasswordless;
     readonly rateLimits: ConfigRateLimits;
@@ -364,6 +365,7 @@ export type ConfigInput = {
     readonly captcha?: InputMaybe<ConfigCaptchaInput>;
     readonly emailChange?: InputMaybe<ConfigEmailChangeInput>;
     readonly login?: InputMaybe<ConfigLoginInput>;
+    readonly panel?: InputMaybe<ConfigPanelInput>;
     readonly password?: InputMaybe<ConfigPasswordInput>;
     readonly passwordless?: InputMaybe<ConfigPasswordlessInput>;
     readonly rateLimits?: InputMaybe<ConfigRateLimitsInput>;
@@ -424,6 +426,29 @@ export type ConfigLoginInput = {
     readonly revealLoginMethod?: InputMaybe<Scalars['Boolean']['input']>;
     readonly revealUserExists?: InputMaybe<Scalars['Boolean']['input']>;
 };
+/**
+ * Who may enter the management panel. This is an entry gate for the console
+ * only, not an authorization system: everything done inside the panel still
+ * goes through the tenant ACL, so being allowed in grants no extra rights.
+ * An identity may enter when its global roles intersect globalRoles, or when
+ * it holds a membership with one of projectRoles in at least one project.
+ * Both lists empty means nobody can enter.
+ */
+export type ConfigPanel = {
+    readonly __typename?: 'ConfigPanel';
+    /** Global roles (identity.roles) that may use the management panel. */
+    readonly globalRoles: ReadonlyArray<Scalars['String']['output']>;
+    /** Project membership roles that may use the management panel, in any project. */
+    readonly projectRoles: ReadonlyArray<Scalars['String']['output']>;
+};
+/**
+ * Each list is replaced as a whole; omitting one leaves it unchanged. An empty
+ * list closes the panel for that dimension.
+ */
+export type ConfigPanelInput = {
+    readonly globalRoles?: InputMaybe<ReadonlyArray<Scalars['String']['input']>>;
+    readonly projectRoles?: InputMaybe<ReadonlyArray<Scalars['String']['input']>>;
+};
 export type ConfigPassword = {
     readonly __typename?: 'ConfigPassword';
     readonly checkBlacklist: Scalars['Boolean']['output'];
@@ -575,7 +600,7 @@ export type CreateApiKeyError = {
     readonly endUserMessage?: Maybe<Scalars['String']['output']>;
     readonly membershipValidation?: Maybe<ReadonlyArray<MembershipValidationError>>;
 };
-export type CreateApiKeyErrorCode = 'INVALID_MEMBERSHIP' | 'PROJECT_NOT_FOUND' | 'ROLE_NOT_FOUND' | 'VARIABLE_EMPTY' | 'VARIABLE_NOT_FOUND';
+export type CreateApiKeyErrorCode = 'INVALID_MEMBERSHIP' | 'INVALID_ROLE' | 'PROJECT_NOT_FOUND' | 'ROLE_NOT_FOUND' | 'VARIABLE_EMPTY' | 'VARIABLE_NOT_FOUND';
 export type CreateApiKeyOptions = {
     /**
      * If true, the created api_key trusts X-Contember-Client-IP and
@@ -614,6 +639,17 @@ export type CreateAuthPolicyResult = {
     readonly __typename?: 'CreateAuthPolicyResult';
     readonly id: Scalars['String']['output'];
 };
+export type CreateCustomRoleError = {
+    readonly __typename?: 'CreateCustomRoleError';
+    readonly code: CreateCustomRoleErrorCode;
+    readonly developerMessage: Scalars['String']['output'];
+};
+export type CreateCustomRoleErrorCode = 'DUPLICATE_PERMISSION' | 'INVALID_PERMISSION_CONFIGURATION' | 'INVALID_SLUG' | 'SLUG_ALREADY_ASSIGNED' | 'SLUG_ALREADY_EXISTS' | 'UNKNOWN_PERMISSION';
+export type CreateCustomRoleResponse = {
+    readonly __typename?: 'CreateCustomRoleResponse';
+    readonly error?: Maybe<CreateCustomRoleError>;
+    readonly ok: Scalars['Boolean']['output'];
+};
 export type CreatePasswordResetRequestError = {
     readonly __typename?: 'CreatePasswordResetRequestError';
     readonly code: CreatePasswordResetRequestErrorCode;
@@ -670,6 +706,29 @@ export type CreateSessionTokenResult = CommonSignInResult & {
     readonly person: Person;
     readonly token: Scalars['String']['output'];
 };
+export type CustomRole = {
+    readonly __typename?: 'CustomRole';
+    readonly description?: Maybe<Scalars['String']['output']>;
+    readonly grants: ReadonlyArray<CustomRoleGrant>;
+    readonly slug: Scalars['String']['output'];
+};
+export type CustomRoleConfigurationKind = 'CHANGE_PROFILE' | 'CREATE_SESSION_TOKEN' | 'GLOBAL_API_KEY' | 'MAIL_TEMPLATE_SCOPE' | 'NONE' | 'ROLE_INPUT' | 'ROLE_MUTATION' | 'TARGET_IDENTITY';
+export type CustomRoleGrant = {
+    readonly __typename?: 'CustomRoleGrant';
+    readonly config?: Maybe<Scalars['Json']['output']>;
+    readonly permission: Scalars['String']['output'];
+};
+export type CustomRoleGrantInput = {
+    readonly config?: InputMaybe<Scalars['Json']['input']>;
+    readonly permission: Scalars['String']['input'];
+};
+export type CustomRolePermissionDefinition = {
+    readonly __typename?: 'CustomRolePermissionDefinition';
+    readonly configurationKind: CustomRoleConfigurationKind;
+    readonly configurationRequired: Scalars['Boolean']['output'];
+    readonly defaultConfig?: Maybe<Scalars['Json']['output']>;
+    readonly name: Scalars['String']['output'];
+};
 export type DeleteAuthPolicyError = {
     readonly __typename?: 'DeleteAuthPolicyError';
     readonly code: DeleteAuthPolicyErrorCode;
@@ -681,6 +740,23 @@ export type DeleteAuthPolicyResponse = {
     readonly error?: Maybe<DeleteAuthPolicyError>;
     readonly ok: Scalars['Boolean']['output'];
 };
+export type DeleteCustomRoleError = {
+    readonly __typename?: 'DeleteCustomRoleError';
+    readonly code: DeleteCustomRoleErrorCode;
+    readonly developerMessage: Scalars['String']['output'];
+};
+export type DeleteCustomRoleErrorCode = 'NOT_FOUND'
+/**
+ * Another custom role's grant configuration references this one. Remove the reference first —
+ * deleting would leave that role un-resubmittable, and recreating this slug would silently
+ * re-bind the reference to a different definition.
+ */
+ | 'ROLE_IN_USE';
+export type DeleteCustomRoleResponse = {
+    readonly __typename?: 'DeleteCustomRoleResponse';
+    readonly error?: Maybe<DeleteCustomRoleError>;
+    readonly ok: Scalars['Boolean']['output'];
+};
 export type DisableApiKeyError = {
     readonly __typename?: 'DisableApiKeyError';
     readonly code: DisableApiKeyErrorCode;
@@ -750,8 +826,13 @@ export type DisconnectIdpError = {
     readonly developerMessage: Scalars['String']['output'];
 };
 export type DisconnectIdpErrorCode = 
+/**
+ * The provider has `disableLocalAuthentication`, so this connection is the only way
+ * the person may sign in and cannot be removed by them — not even while the provider is disabled.
+ */
+'IDP_REQUIRED'
 /**  The person is not allowed to disconnect their last remaining sign-in method.  */
-'LAST_AUTH_METHOD'
+ | 'LAST_AUTH_METHOD'
 /**  The caller is not a person (e.g. an API key) and so has no IdP connections to disconnect.  */
  | 'NOT_A_PERSON'
 /**  The authenticated person has no IdP connection with the given id.  */
@@ -776,6 +857,17 @@ export type EnableIdpResponse = {
     readonly error?: Maybe<EnableIdpError>;
     readonly ok: Scalars['Boolean']['output'];
 };
+export type EnablePersonError = {
+    readonly __typename?: 'EnablePersonError';
+    readonly code: EnablePersonErrorCode;
+    readonly developerMessage: Scalars['String']['output'];
+};
+export type EnablePersonErrorCode = 'PERSON_ALREADY_ENABLED' | 'PERSON_NOT_FOUND';
+export type EnablePersonResponse = {
+    readonly __typename?: 'EnablePersonResponse';
+    readonly error?: Maybe<EnablePersonError>;
+    readonly ok: Scalars['Boolean']['output'];
+};
 export type ForceSignOutPersonError = {
     readonly __typename?: 'ForceSignOutPersonError';
     readonly code: ForceSignOutPersonErrorCode;
@@ -790,6 +882,7 @@ export type ForceSignOutPersonResponse = {
 export type IdpOptions = {
     readonly assumeEmailVerified?: InputMaybe<Scalars['Boolean']['input']>;
     readonly autoSignUp?: InputMaybe<Scalars['Boolean']['input']>;
+    readonly disableLocalAuthentication?: InputMaybe<Scalars['Boolean']['input']>;
     readonly exclusive?: InputMaybe<Scalars['Boolean']['input']>;
     readonly initReturnsConfig?: InputMaybe<Scalars['Boolean']['input']>;
     readonly requireVerifiedEmail?: InputMaybe<Scalars['Boolean']['input']>;
@@ -803,6 +896,13 @@ export type IdpOptionsOutput = {
      */
     readonly assumeEmailVerified: Scalars['Boolean']['output'];
     readonly autoSignUp: Scalars['Boolean']['output'];
+    /**
+     * When true, a person linked to this provider may authenticate ONLY through it:
+     * password sign-in and passwordless sign-in are refused and no password-reset
+     * mail is sent. Disabling the provider lifts the restriction, which is the
+     * break-glass for an IdP outage. Defaults to false.
+     */
+    readonly disableLocalAuthentication: Scalars['Boolean']['output'];
     readonly exclusive: Scalars['Boolean']['output'];
     readonly initReturnsConfig: Scalars['Boolean']['output'];
     /**
@@ -828,17 +928,45 @@ export type Identity = {
      * Active SESSION-type api keys for this identity. Always visible for
      * the calling identity (e.g. via `me { sessions }`). For other identities,
      * visible to callers holding the `person:viewSessions` permission against
-     * the target's roles — SUPER_ADMIN sees everyone; PROJECT_ADMIN sees
-     * members whose roles fall within their allowed-input-roles. Returns an
+     * the target — SUPER_ADMIN sees everyone; PROJECT_ADMIN sees everyone except
+     * identities holding `super_admin` or `project_creator`; a custom role is
+     * further bounded by its configured target constraints. Returns an
      * empty list rather than throwing when the viewer lacks visibility, so
      * batched identity queries do not abort on a single forbidden target.
      */
     readonly sessions: ReadonlyArray<SessionInfo>;
 };
+/**
+ * What the identity may do tenant-wide, evaluated against the same ACL the resolvers enforce.
+ *
+ * This is for building a UI that does not offer what it cannot deliver — it is **not** a security
+ * boundary, and answering `true` here grants nothing. Every operation is still checked when it is
+ * called. The distinction matters because permission failure is not uniform across this API: some
+ * queries answer an empty list, others throw, and every mutation throws, so a client cannot tell
+ * "nothing to show" from "not yours to see" by trying.
+ */
 export type IdentityGlobalPermissions = {
     readonly __typename?: 'IdentityGlobalPermissions';
+    readonly canCreateGlobalApiKey: Scalars['Boolean']['output'];
     readonly canCreateProject: Scalars['Boolean']['output'];
     readonly canDeployEntrypoint: Scalars['Boolean']['output'];
+    /**  Read `globalApiKeys`, which answers an empty list otherwise.  */
+    readonly canListGlobalApiKeys: Scalars['Boolean']['output'];
+    /**  Read `identityProviders`.  */
+    readonly canListIdentityProviders: Scalars['Boolean']['output'];
+    /**  Read `mailTemplates`.  */
+    readonly canListMailTemplates: Scalars['Boolean']['output'];
+    /**
+     * List every person in the tenant. Without it `persons` still answers, narrowed to the members
+     * of the projects the caller administers — so this marks a full listing, not access to one.
+     */
+    readonly canListPersons: Scalars['Boolean']['output'];
+    /** Write the tenant configuration (`configure`) and read `authPolicies`. The CLI is the usual write path. */
+    readonly canManageConfiguration: Scalars['Boolean']['output'];
+    /**  Read `authLog`, which throws otherwise.  */
+    readonly canViewAuthLog: Scalars['Boolean']['output'];
+    /**  Read `configuration`, which throws otherwise. The other configuration queries gate on their own actions.  */
+    readonly canViewConfiguration: Scalars['Boolean']['output'];
 };
 export type IdentityProjectRelation = {
     readonly __typename?: 'IdentityProjectRelation';
@@ -898,7 +1026,12 @@ export type InitSignInPasswordlessError = {
     readonly code: InitSignInPasswordlessErrorCode;
     readonly developerMessage: Scalars['String']['output'];
 };
-export type InitSignInPasswordlessErrorCode = 'INVALID_CAPTCHA' | 'PASSWORDLESS_DISABLED' | 'PERSON_NOT_FOUND' | 'RATE_LIMIT_EXCEEDED';
+export type InitSignInPasswordlessErrorCode = 
+/**
+ * The person is linked to an identity provider with
+ * `disableLocalAuthentication`, so passwordless sign-in is not available to them.
+ */
+'IDP_REQUIRED' | 'INVALID_CAPTCHA' | 'PASSWORDLESS_DISABLED' | 'PERSON_NOT_FOUND' | 'RATE_LIMIT_EXCEEDED';
 export type InitSignInPasswordlessOptions = {
     readonly mailProject?: InputMaybe<Scalars['String']['input']>;
     readonly mailVariant?: InputMaybe<Scalars['String']['input']>;
@@ -1014,11 +1147,13 @@ export type Mutation = {
     readonly confirmOtp?: Maybe<ConfirmOtpResponse>;
     readonly createApiKey?: Maybe<CreateApiKeyResponse>;
     readonly createAuthPolicy?: Maybe<CreateAuthPolicyResponse>;
+    readonly createCustomRole?: Maybe<CreateCustomRoleResponse>;
     readonly createGlobalApiKey?: Maybe<CreateApiKeyResponse>;
     readonly createProject?: Maybe<CreateProjectResponse>;
     readonly createResetPasswordRequest?: Maybe<CreatePasswordResetRequestResponse>;
     readonly createSessionToken?: Maybe<CreateSessionTokenResponse>;
     readonly deleteAuthPolicy?: Maybe<DeleteAuthPolicyResponse>;
+    readonly deleteCustomRole?: Maybe<DeleteCustomRoleResponse>;
     readonly disableApiKey?: Maybe<DisableApiKeyResponse>;
     readonly disableEmailOtp?: Maybe<DisableEmailOtpResponse>;
     readonly disableIDP?: Maybe<DisableIdpResponse>;
@@ -1033,6 +1168,7 @@ export type Mutation = {
     readonly disconnectMyIdentityProvider?: Maybe<DisconnectIdpResponse>;
     readonly enableIDP?: Maybe<EnableIdpResponse>;
     readonly enableMyPasswordless?: Maybe<ToggleMyPasswordlessResponse>;
+    readonly enablePerson?: Maybe<EnablePersonResponse>;
     readonly forceSignOutPerson?: Maybe<ForceSignOutPersonResponse>;
     readonly initEmailOtp?: Maybe<InitEmailOtpResponse>;
     readonly initSignInIDP?: Maybe<InitSignInIdpResponse>;
@@ -1062,6 +1198,7 @@ export type Mutation = {
     readonly signUp?: Maybe<SignUpResponse>;
     readonly unmanagedInvite?: Maybe<InviteResponse>;
     readonly updateAuthPolicy?: Maybe<UpdateAuthPolicyResponse>;
+    readonly updateCustomRole?: Maybe<UpdateCustomRoleResponse>;
     readonly updateIDP?: Maybe<UpdateIdpResponse>;
     readonly updateProject?: Maybe<UpdateProjectResponse>;
     readonly updateProjectMember?: Maybe<UpdateProjectMemberResponse>;
@@ -1132,6 +1269,11 @@ export type MutationCreateApiKeyArgs = {
 export type MutationCreateAuthPolicyArgs = {
     policy: AuthPolicyInput;
 };
+export type MutationCreateCustomRoleArgs = {
+    description?: InputMaybe<Scalars['String']['input']>;
+    grants: ReadonlyArray<CustomRoleGrantInput>;
+    slug: Scalars['String']['input'];
+};
 export type MutationCreateGlobalApiKeyArgs = {
     description: Scalars['String']['input'];
     options?: InputMaybe<CreateApiKeyOptions>;
@@ -1160,6 +1302,9 @@ export type MutationCreateSessionTokenArgs = {
 export type MutationDeleteAuthPolicyArgs = {
     id: Scalars['String']['input'];
 };
+export type MutationDeleteCustomRoleArgs = {
+    slug: Scalars['String']['input'];
+};
 export type MutationDisableApiKeyArgs = {
     id: Scalars['String']['input'];
 };
@@ -1175,6 +1320,9 @@ export type MutationDisconnectMyIdentityProviderArgs = {
 export type MutationEnableIdpArgs = {
     identityProvider: Scalars['String']['input'];
 };
+export type MutationEnablePersonArgs = {
+    personId: Scalars['String']['input'];
+};
 export type MutationForceSignOutPersonArgs = {
     personId: Scalars['String']['input'];
     reason?: InputMaybe<Scalars['String']['input']>;
@@ -1282,6 +1430,11 @@ export type MutationUpdateAuthPolicyArgs = {
     id: Scalars['String']['input'];
     policy: AuthPolicyInput;
 };
+export type MutationUpdateCustomRoleArgs = {
+    description?: InputMaybe<Scalars['String']['input']>;
+    grants?: InputMaybe<ReadonlyArray<CustomRoleGrantInput>>;
+    slug: Scalars['String']['input'];
+};
 export type MutationUpdateIdpArgs = {
     configuration?: InputMaybe<Scalars['Json']['input']>;
     identityProvider: Scalars['String']['input'];
@@ -1306,6 +1459,11 @@ export type MutationVerifyEmailArgs = {
 export type PasswordlessValidationType = 'otp' | 'token';
 export type Person = {
     readonly __typename?: 'Person';
+    /**
+     * When the account was disabled (see `disablePerson`), null while the person
+     * is active. Read-only — flip it with `disablePerson` / `enablePerson`.
+     */
+    readonly disabledAt?: Maybe<Scalars['DateTime']['output']>;
     readonly email?: Maybe<Scalars['String']['output']>;
     /**
      * Whether e-mail based one-time-password 2FA is enabled for this person
@@ -1321,14 +1479,29 @@ export type Person = {
      * External IdP connections of this person. Always visible for the calling
      * person (e.g. via `me { person { identityProviders } }`). For other
      * persons, visible to callers holding the `person:viewIdp` permission
-     * against the target's roles — SUPER_ADMIN sees everyone; PROJECT_ADMIN
-     * sees members whose roles fall within their allowed-input-roles. Returns
-     * an empty list rather than throwing when the viewer lacks visibility.
+     * against the target — SUPER_ADMIN sees everyone; PROJECT_ADMIN sees
+     * everyone except identities holding `super_admin` or `project_creator`;
+     * a custom role is further bounded by its configured target constraints.
+     * Returns an empty list rather than throwing when the viewer lacks visibility.
      */
     readonly identityProviders: ReadonlyArray<PersonIdentityProvider>;
     readonly name?: Maybe<Scalars['String']['output']>;
     readonly otpEnabled: Scalars['Boolean']['output'];
+    /**
+     * Whether passwordless sign-in is actually usable for this person right now: the tenant-wide
+     * policy resolved against `passwordlessEnabled`, i.e. the very same decision `signIn` makes. A UI
+     * offering an enable/disable toggle must branch on this — under an `always` or `never` policy the
+     * raw opt-in flag says nothing about what will happen.
+     */
+    readonly passwordlessAvailable: Scalars['Boolean']['output'];
+    /**  The person's own opt-in flag; `null` means "follow the tenant policy". On its own it does not say whether passwordless sign-in works — see `passwordlessAvailable`.  */
     readonly passwordlessEnabled?: Maybe<Scalars['Boolean']['output']>;
+    /**
+     * Whether `passwordlessEnabled` is what decides `passwordlessAvailable`. False under an `always`
+     * or `never` policy, where the person's own flag is ignored — a UI should then report the state
+     * rather than offer a toggle that changes nothing.
+     */
+    readonly passwordlessSelfManaged: Scalars['Boolean']['output'];
 };
 /**  A single external IdP connection of the currently authenticated person.  */
 export type PersonIdentityProvider = {
@@ -1368,6 +1541,8 @@ export type Project = {
     readonly id: Scalars['String']['output'];
     readonly members: ReadonlyArray<ProjectIdentityRelation>;
     readonly name: Scalars['String']['output'];
+    /**  What the calling identity may do here. Advisory — for building the UI, not for enforcing it.  */
+    readonly permissions: ProjectPermissions;
     readonly roles: ReadonlyArray<RoleDefinition>;
     /**
      * Names of the project's secrets (see `setProjectSecret`). Secret VALUES are
@@ -1398,6 +1573,28 @@ export type ProjectMembersInput = {
     readonly limit?: InputMaybe<Scalars['Int']['input']>;
     readonly offset?: InputMaybe<Scalars['Int']['input']>;
 };
+/**
+ * What the calling identity may do in this project. Same contract as
+ * `IdentityGlobalPermissions`: advisory, evaluated per caller, never a substitute for the checks in
+ * the resolvers.
+ */
+export type ProjectPermissions = {
+    readonly __typename?: 'ProjectPermissions';
+    /**  Invite or add a member (`invite`, `addProjectMember`). Which roles may be granted is checked per membership.  */
+    readonly canAddMember: Scalars['Boolean']['output'];
+    /**  Create an API key scoped to this project.  */
+    readonly canCreateApiKey: Scalars['Boolean']['output'];
+    readonly canRemoveMember: Scalars['Boolean']['output'];
+    /**  Write a project secret (`setProjectSecret`). Distinct from viewing: a project admin commonly has one and not the other.  */
+    readonly canSetSecret: Scalars['Boolean']['output'];
+    /**  Update the project itself (`updateProject`).  */
+    readonly canUpdate: Scalars['Boolean']['output'];
+    readonly canUpdateMember: Scalars['Boolean']['output'];
+    /**  Read `members` and `apiKeys`; both answer an empty list otherwise.  */
+    readonly canViewMembers: Scalars['Boolean']['output'];
+    /**  Read `secrets` (their names, never values); answers an empty list otherwise.  */
+    readonly canViewSecrets: Scalars['Boolean']['output'];
+};
 export type ProjectSecret = {
     readonly key: Scalars['String']['input'];
     readonly value: Scalars['String']['input'];
@@ -1413,8 +1610,8 @@ export type Query = {
     readonly __typename?: 'Query';
     /**
      * Read the tenant audit log (`person_auth_log`). Requires the
-     * `system:viewAuthLog` permission — by default granted only to
-     * SUPER_ADMIN via the wildcard ALL-resource/ALL-privilege grant.
+     * `system:viewAuthLog` permission — granted to SUPER_ADMIN and
+     * PROJECT_ADMIN by default, and grantable to a custom role.
      * Ordered by created_at DESC. Page size is capped server-side
      * (default 100, max 500); `hasMore` indicates a further page exists.
      */
@@ -1428,11 +1625,23 @@ export type Query = {
     readonly authPolicies: ReadonlyArray<AuthPolicy>;
     readonly checkResetPasswordToken: CheckResetPasswordTokenCode;
     readonly configuration: Config;
+    /**
+     * List exact permission definitions grantable to a custom role. Requires
+     * the `customRole:view` permission.
+     */
+    readonly customRolePermissions: ReadonlyArray<CustomRolePermissionDefinition>;
+    /**
+     * List custom roles (runtime-defined global roles carrying a bundle of tenant
+     * permissions). Requires the `customRole:view` permission — granted to
+     * SUPER_ADMIN and PROJECT_ADMIN by default, and itself grantable to a custom
+     * role. Managing definitions needs `customRole:manage`, which is not grantable.
+     */
+    readonly customRoles: ReadonlyArray<CustomRole>;
     /**
      * List global (project-independent) permanent API keys — those created via
      * `createGlobalApiKey`, whose identity carries global roles and no project
-     * membership. Requires the `apiKey:list` permission — by default granted
-     * only to SUPER_ADMIN via the wildcard ALL-resource/ALL-privilege grant.
+     * membership. Requires the `apiKey:list` permission — granted to SUPER_ADMIN
+     * and PROJECT_ADMIN by default, and grantable to a custom role.
      * Returns an empty list when the caller may not list them. To list a
      * project's keys use `project.apiKeys`.
      */
@@ -1442,12 +1651,13 @@ export type Query = {
     readonly me: Identity;
     readonly personById?: Maybe<Person>;
     /**
-     * List persons across the tenant. SUPER_ADMIN sees every person; otherwise
-     * the result is scoped to persons who are members of a project the caller may
-     * view members of (i.e. the same persons reachable via `project.members`),
-     * so a PROJECT_ADMIN sees only their projects' members. `filter` matches by
-     * e-mail (case-insensitive), `personId`, or `identityId`; `limit`/`offset`
-     * paginate. Returns an empty list when the caller may not list anyone.
+     * List persons across the tenant. Requires the `person:list` permission —
+     * held by SUPER_ADMIN and PROJECT_ADMIN, and grantable to a custom role — which
+     * lists every person. Without it the result is scoped to persons who are members
+     * of a project the caller may view members of (i.e. the same persons reachable
+     * via `project.members`). `filter` matches by e-mail (case-insensitive),
+     * `personId`, or `identityId`; `limit`/`offset` paginate. Returns an empty
+     * list when the caller may not list anyone.
      */
     readonly persons: ReadonlyArray<Person>;
     readonly projectBySlug?: Maybe<Project>;
@@ -1654,7 +1864,12 @@ export type SignInError = {
     readonly mfaEnrollment?: Maybe<MfaEnrollment>;
     readonly retryAfter?: Maybe<Scalars['Int']['output']>;
 };
-export type SignInErrorCode = 'EMAIL_NOT_VERIFIED' | 'INVALID_CREDENTIALS' | 'INVALID_OTP_TOKEN' | 'INVALID_PASSWORD' | 'MFA_ENROLLMENT_REQUIRED' | 'NO_PASSWORD_SET' | 'OTP_REQUIRED' | 'PERSON_DISABLED' | 'RATE_LIMIT_EXCEEDED' | 'UNKNOWN_EMAIL';
+export type SignInErrorCode = 'EMAIL_NOT_VERIFIED'
+/**
+ * The person is linked to an identity provider with
+ * `disableLocalAuthentication`, so password sign-in is not available to them.
+ */
+ | 'IDP_REQUIRED' | 'INVALID_CREDENTIALS' | 'INVALID_OTP_TOKEN' | 'INVALID_PASSWORD' | 'MFA_ENROLLMENT_REQUIRED' | 'NO_PASSWORD_SET' | 'OTP_REQUIRED' | 'PERSON_DISABLED' | 'RATE_LIMIT_EXCEEDED' | 'UNKNOWN_EMAIL';
 export type SignInIdpError = {
     readonly __typename?: 'SignInIDPError';
     readonly code: SignInIdpErrorCode;
@@ -1697,7 +1912,12 @@ export type SignInPasswordlessError = {
     readonly code: SignInPasswordlessErrorCode;
     readonly developerMessage: Scalars['String']['output'];
 };
-export type SignInPasswordlessErrorCode = 'INVALID_OTP_TOKEN' | 'MFA_ENROLLMENT_REQUIRED' | 'OTP_REQUIRED' | 'PERSON_DISABLED' | 'TOKEN_EXPIRED' | 'TOKEN_INVALID' | 'TOKEN_NOT_FOUND' | 'TOKEN_USED';
+export type SignInPasswordlessErrorCode = 
+/**
+ * The person became linked to an identity provider with
+ * `disableLocalAuthentication` after this magic link was issued.
+ */
+'IDP_REQUIRED' | 'INVALID_OTP_TOKEN' | 'MFA_ENROLLMENT_REQUIRED' | 'OTP_REQUIRED' | 'PERSON_DISABLED' | 'TOKEN_EXPIRED' | 'TOKEN_INVALID' | 'TOKEN_NOT_FOUND' | 'TOKEN_USED';
 export type SignInPasswordlessResponse = {
     readonly __typename?: 'SignInPasswordlessResponse';
     readonly error?: Maybe<SignInPasswordlessError>;
@@ -1762,7 +1982,7 @@ export type SignUpError = {
     readonly recommendedAction?: Maybe<SignUpRecommendedAction>;
     readonly weakPasswordReasons?: Maybe<ReadonlyArray<WeakPasswordReason>>;
 };
-export type SignUpErrorCode = 'EMAIL_ALREADY_EXISTS' | 'INVALID_CAPTCHA' | 'INVALID_EMAIL_FORMAT' | 'RATE_LIMIT_EXCEEDED' | 'TOO_WEAK';
+export type SignUpErrorCode = 'EMAIL_ALREADY_EXISTS' | 'INVALID_CAPTCHA' | 'INVALID_EMAIL_FORMAT' | 'INVALID_ROLE' | 'RATE_LIMIT_EXCEEDED' | 'TOO_WEAK';
 export type SignUpRecommendedAction = 'RESET_PASSWORD' | 'SIGN_IN';
 export type SignUpResponse = {
     readonly __typename?: 'SignUpResponse';
@@ -1802,6 +2022,17 @@ export type UpdateAuthPolicyResponse = {
     readonly error?: Maybe<UpdateAuthPolicyError>;
     readonly ok: Scalars['Boolean']['output'];
 };
+export type UpdateCustomRoleError = {
+    readonly __typename?: 'UpdateCustomRoleError';
+    readonly code: UpdateCustomRoleErrorCode;
+    readonly developerMessage: Scalars['String']['output'];
+};
+export type UpdateCustomRoleErrorCode = 'DUPLICATE_PERMISSION' | 'INVALID_PERMISSION_CONFIGURATION' | 'NOT_FOUND' | 'UNKNOWN_PERMISSION';
+export type UpdateCustomRoleResponse = {
+    readonly __typename?: 'UpdateCustomRoleResponse';
+    readonly error?: Maybe<UpdateCustomRoleError>;
+    readonly ok: Scalars['Boolean']['output'];
+};
 export type UpdateIdpError = {
     readonly __typename?: 'UpdateIDPError';
     readonly code: UpdateIdpErrorCode;
@@ -1956,6 +2187,8 @@ export type ResolversTypes = {
     ConfigLoginAnomalyDetection: ResolverTypeWrapper<ConfigLoginAnomalyDetection>;
     ConfigLoginAnomalyDetectionInput: ConfigLoginAnomalyDetectionInput;
     ConfigLoginInput: ConfigLoginInput;
+    ConfigPanel: ResolverTypeWrapper<ConfigPanel>;
+    ConfigPanelInput: ConfigPanelInput;
     ConfigPassword: ResolverTypeWrapper<ConfigPassword>;
     ConfigPasswordInput: ConfigPasswordInput;
     ConfigPasswordless: ResolverTypeWrapper<ConfigPasswordless>;
@@ -1994,6 +2227,9 @@ export type ResolversTypes = {
     CreateAuthPolicyErrorCode: CreateAuthPolicyErrorCode;
     CreateAuthPolicyResponse: ResolverTypeWrapper<CreateAuthPolicyResponse>;
     CreateAuthPolicyResult: ResolverTypeWrapper<CreateAuthPolicyResult>;
+    CreateCustomRoleError: ResolverTypeWrapper<CreateCustomRoleError>;
+    CreateCustomRoleErrorCode: CreateCustomRoleErrorCode;
+    CreateCustomRoleResponse: ResolverTypeWrapper<CreateCustomRoleResponse>;
     CreatePasswordResetRequestError: ResolverTypeWrapper<CreatePasswordResetRequestError>;
     CreatePasswordResetRequestErrorCode: CreatePasswordResetRequestErrorCode;
     CreatePasswordResetRequestResponse: ResolverTypeWrapper<CreatePasswordResetRequestResponse>;
@@ -2011,10 +2247,18 @@ export type ResolversTypes = {
     CreateSessionTokenErrorCode: CreateSessionTokenErrorCode;
     CreateSessionTokenResponse: ResolverTypeWrapper<CreateSessionTokenResponse>;
     CreateSessionTokenResult: ResolverTypeWrapper<CreateSessionTokenResult>;
+    CustomRole: ResolverTypeWrapper<CustomRole>;
+    CustomRoleConfigurationKind: CustomRoleConfigurationKind;
+    CustomRoleGrant: ResolverTypeWrapper<CustomRoleGrant>;
+    CustomRoleGrantInput: CustomRoleGrantInput;
+    CustomRolePermissionDefinition: ResolverTypeWrapper<CustomRolePermissionDefinition>;
     DateTime: ResolverTypeWrapper<Scalars['DateTime']['output']>;
     DeleteAuthPolicyError: ResolverTypeWrapper<DeleteAuthPolicyError>;
     DeleteAuthPolicyErrorCode: DeleteAuthPolicyErrorCode;
     DeleteAuthPolicyResponse: ResolverTypeWrapper<DeleteAuthPolicyResponse>;
+    DeleteCustomRoleError: ResolverTypeWrapper<DeleteCustomRoleError>;
+    DeleteCustomRoleErrorCode: DeleteCustomRoleErrorCode;
+    DeleteCustomRoleResponse: ResolverTypeWrapper<DeleteCustomRoleResponse>;
     DisableApiKeyError: ResolverTypeWrapper<DisableApiKeyError>;
     DisableApiKeyErrorCode: DisableApiKeyErrorCode;
     DisableApiKeyResponse: ResolverTypeWrapper<DisableApiKeyResponse>;
@@ -2037,6 +2281,9 @@ export type ResolversTypes = {
     EnableIDPError: ResolverTypeWrapper<EnableIdpError>;
     EnableIDPErrorCode: EnableIdpErrorCode;
     EnableIDPResponse: ResolverTypeWrapper<EnableIdpResponse>;
+    EnablePersonError: ResolverTypeWrapper<EnablePersonError>;
+    EnablePersonErrorCode: EnablePersonErrorCode;
+    EnablePersonResponse: ResolverTypeWrapper<EnablePersonResponse>;
     Float: ResolverTypeWrapper<Scalars['Float']['output']>;
     ForceSignOutPersonError: ResolverTypeWrapper<ForceSignOutPersonError>;
     ForceSignOutPersonErrorCode: ForceSignOutPersonErrorCode;
@@ -2104,6 +2351,7 @@ export type ResolversTypes = {
     }>;
     ProjectMembersFilter: ProjectMembersFilter;
     ProjectMembersInput: ProjectMembersInput;
+    ProjectPermissions: ResolverTypeWrapper<ProjectPermissions>;
     ProjectSecret: ProjectSecret;
     ProjectSecretInfo: ResolverTypeWrapper<ProjectSecretInfo>;
     Query: ResolverTypeWrapper<Record<PropertyKey, never>>;
@@ -2177,6 +2425,9 @@ export type ResolversTypes = {
     UpdateAuthPolicyError: ResolverTypeWrapper<UpdateAuthPolicyError>;
     UpdateAuthPolicyErrorCode: UpdateAuthPolicyErrorCode;
     UpdateAuthPolicyResponse: ResolverTypeWrapper<UpdateAuthPolicyResponse>;
+    UpdateCustomRoleError: ResolverTypeWrapper<UpdateCustomRoleError>;
+    UpdateCustomRoleErrorCode: UpdateCustomRoleErrorCode;
+    UpdateCustomRoleResponse: ResolverTypeWrapper<UpdateCustomRoleResponse>;
     UpdateIDPError: ResolverTypeWrapper<UpdateIdpError>;
     UpdateIDPErrorCode: UpdateIdpErrorCode;
     UpdateIDPResponse: ResolverTypeWrapper<UpdateIdpResponse>;
@@ -2244,6 +2495,8 @@ export type ResolversParentTypes = {
     ConfigLoginAnomalyDetection: ConfigLoginAnomalyDetection;
     ConfigLoginAnomalyDetectionInput: ConfigLoginAnomalyDetectionInput;
     ConfigLoginInput: ConfigLoginInput;
+    ConfigPanel: ConfigPanel;
+    ConfigPanelInput: ConfigPanelInput;
     ConfigPassword: ConfigPassword;
     ConfigPasswordInput: ConfigPasswordInput;
     ConfigPasswordless: ConfigPasswordless;
@@ -2275,6 +2528,8 @@ export type ResolversParentTypes = {
     CreateAuthPolicyError: CreateAuthPolicyError;
     CreateAuthPolicyResponse: CreateAuthPolicyResponse;
     CreateAuthPolicyResult: CreateAuthPolicyResult;
+    CreateCustomRoleError: CreateCustomRoleError;
+    CreateCustomRoleResponse: CreateCustomRoleResponse;
     CreatePasswordResetRequestError: CreatePasswordResetRequestError;
     CreatePasswordResetRequestResponse: CreatePasswordResetRequestResponse;
     CreateProjectOptions: CreateProjectOptions;
@@ -2289,9 +2544,15 @@ export type ResolversParentTypes = {
     CreateSessionTokenError: CreateSessionTokenError;
     CreateSessionTokenResponse: CreateSessionTokenResponse;
     CreateSessionTokenResult: CreateSessionTokenResult;
+    CustomRole: CustomRole;
+    CustomRoleGrant: CustomRoleGrant;
+    CustomRoleGrantInput: CustomRoleGrantInput;
+    CustomRolePermissionDefinition: CustomRolePermissionDefinition;
     DateTime: Scalars['DateTime']['output'];
     DeleteAuthPolicyError: DeleteAuthPolicyError;
     DeleteAuthPolicyResponse: DeleteAuthPolicyResponse;
+    DeleteCustomRoleError: DeleteCustomRoleError;
+    DeleteCustomRoleResponse: DeleteCustomRoleResponse;
     DisableApiKeyError: DisableApiKeyError;
     DisableApiKeyResponse: DisableApiKeyResponse;
     DisableEmailOtpError: DisableEmailOtpError;
@@ -2307,6 +2568,8 @@ export type ResolversParentTypes = {
     EmailVerificationOptions: EmailVerificationOptions;
     EnableIDPError: EnableIdpError;
     EnableIDPResponse: EnableIdpResponse;
+    EnablePersonError: EnablePersonError;
+    EnablePersonResponse: EnablePersonResponse;
     Float: Scalars['Float']['output'];
     ForceSignOutPersonError: ForceSignOutPersonError;
     ForceSignOutPersonResponse: ForceSignOutPersonResponse;
@@ -2364,6 +2627,7 @@ export type ResolversParentTypes = {
     };
     ProjectMembersFilter: ProjectMembersFilter;
     ProjectMembersInput: ProjectMembersInput;
+    ProjectPermissions: ProjectPermissions;
     ProjectSecret: ProjectSecret;
     ProjectSecretInfo: ProjectSecretInfo;
     Query: Record<PropertyKey, never>;
@@ -2420,6 +2684,8 @@ export type ResolversParentTypes = {
     UnmanagedInviteOptions: UnmanagedInviteOptions;
     UpdateAuthPolicyError: UpdateAuthPolicyError;
     UpdateAuthPolicyResponse: UpdateAuthPolicyResponse;
+    UpdateCustomRoleError: UpdateCustomRoleError;
+    UpdateCustomRoleResponse: UpdateCustomRoleResponse;
     UpdateIDPError: UpdateIdpError;
     UpdateIDPResponse: UpdateIdpResponse;
     UpdateProjectError: UpdateProjectError;
@@ -2573,6 +2839,7 @@ export type ConfigResolvers<ContextType = any, ParentType extends ResolversParen
     captcha?: Resolver<ResolversTypes['ConfigCaptcha'], ParentType, ContextType>;
     emailChange?: Resolver<ResolversTypes['ConfigEmailChange'], ParentType, ContextType>;
     login?: Resolver<ResolversTypes['ConfigLogin'], ParentType, ContextType>;
+    panel?: Resolver<ResolversTypes['ConfigPanel'], ParentType, ContextType>;
     password?: Resolver<ResolversTypes['ConfigPassword'], ParentType, ContextType>;
     passwordless?: Resolver<ResolversTypes['ConfigPasswordless'], ParentType, ContextType>;
     rateLimits?: Resolver<ResolversTypes['ConfigRateLimits'], ParentType, ContextType>;
@@ -2609,6 +2876,10 @@ export type ConfigLoginAnomalyDetectionResolvers<ContextType = any, ParentType e
     historySize?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
     stepUpThreshold?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
 };
+export type ConfigPanelResolvers<ContextType = any, ParentType extends ResolversParentTypes['ConfigPanel'] = ResolversParentTypes['ConfigPanel']> = {
+    globalRoles?: Resolver<ReadonlyArray<ResolversTypes['String']>, ParentType, ContextType>;
+    projectRoles?: Resolver<ReadonlyArray<ResolversTypes['String']>, ParentType, ContextType>;
+};
 export type ConfigPasswordResolvers<ContextType = any, ParentType extends ResolversParentTypes['ConfigPassword'] = ResolversParentTypes['ConfigPassword']> = {
     checkBlacklist?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
     checkHibp?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
@@ -2708,6 +2979,14 @@ export type CreateAuthPolicyResponseResolvers<ContextType = any, ParentType exte
 export type CreateAuthPolicyResultResolvers<ContextType = any, ParentType extends ResolversParentTypes['CreateAuthPolicyResult'] = ResolversParentTypes['CreateAuthPolicyResult']> = {
     id?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
 };
+export type CreateCustomRoleErrorResolvers<ContextType = any, ParentType extends ResolversParentTypes['CreateCustomRoleError'] = ResolversParentTypes['CreateCustomRoleError']> = {
+    code?: Resolver<ResolversTypes['CreateCustomRoleErrorCode'], ParentType, ContextType>;
+    developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+};
+export type CreateCustomRoleResponseResolvers<ContextType = any, ParentType extends ResolversParentTypes['CreateCustomRoleResponse'] = ResolversParentTypes['CreateCustomRoleResponse']> = {
+    error?: Resolver<Maybe<ResolversTypes['CreateCustomRoleError']>, ParentType, ContextType>;
+    ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+};
 export type CreatePasswordResetRequestErrorResolvers<ContextType = any, ParentType extends ResolversParentTypes['CreatePasswordResetRequestError'] = ResolversParentTypes['CreatePasswordResetRequestError']> = {
     code?: Resolver<ResolversTypes['CreatePasswordResetRequestErrorCode'], ParentType, ContextType>;
     developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
@@ -2744,6 +3023,21 @@ export type CreateSessionTokenResultResolvers<ContextType = any, ParentType exte
     token?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
     __isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>;
 };
+export type CustomRoleResolvers<ContextType = any, ParentType extends ResolversParentTypes['CustomRole'] = ResolversParentTypes['CustomRole']> = {
+    description?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>;
+    grants?: Resolver<ReadonlyArray<ResolversTypes['CustomRoleGrant']>, ParentType, ContextType>;
+    slug?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+};
+export type CustomRoleGrantResolvers<ContextType = any, ParentType extends ResolversParentTypes['CustomRoleGrant'] = ResolversParentTypes['CustomRoleGrant']> = {
+    config?: Resolver<Maybe<ResolversTypes['Json']>, ParentType, ContextType>;
+    permission?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+};
+export type CustomRolePermissionDefinitionResolvers<ContextType = any, ParentType extends ResolversParentTypes['CustomRolePermissionDefinition'] = ResolversParentTypes['CustomRolePermissionDefinition']> = {
+    configurationKind?: Resolver<ResolversTypes['CustomRoleConfigurationKind'], ParentType, ContextType>;
+    configurationRequired?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+    defaultConfig?: Resolver<Maybe<ResolversTypes['Json']>, ParentType, ContextType>;
+    name?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+};
 export interface DateTimeScalarConfig extends GraphQLScalarTypeConfig<ResolversTypes['DateTime'], any> {
     name: 'DateTime';
 }
@@ -2755,6 +3049,14 @@ export type DeleteAuthPolicyResponseResolvers<ContextType = any, ParentType exte
     error?: Resolver<Maybe<ResolversTypes['DeleteAuthPolicyError']>, ParentType, ContextType>;
     ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
 };
+export type DeleteCustomRoleErrorResolvers<ContextType = any, ParentType extends ResolversParentTypes['DeleteCustomRoleError'] = ResolversParentTypes['DeleteCustomRoleError']> = {
+    code?: Resolver<ResolversTypes['DeleteCustomRoleErrorCode'], ParentType, ContextType>;
+    developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+};
+export type DeleteCustomRoleResponseResolvers<ContextType = any, ParentType extends ResolversParentTypes['DeleteCustomRoleResponse'] = ResolversParentTypes['DeleteCustomRoleResponse']> = {
+    error?: Resolver<Maybe<ResolversTypes['DeleteCustomRoleError']>, ParentType, ContextType>;
+    ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+};
 export type DisableApiKeyErrorResolvers<ContextType = any, ParentType extends ResolversParentTypes['DisableApiKeyError'] = ResolversParentTypes['DisableApiKeyError']> = {
     code?: Resolver<ResolversTypes['DisableApiKeyErrorCode'], ParentType, ContextType>;
     developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
@@ -2815,6 +3117,14 @@ export type EnableIdpResponseResolvers<ContextType = any, ParentType extends Res
     error?: Resolver<Maybe<ResolversTypes['EnableIDPError']>, ParentType, ContextType>;
     ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
 };
+export type EnablePersonErrorResolvers<ContextType = any, ParentType extends ResolversParentTypes['EnablePersonError'] = ResolversParentTypes['EnablePersonError']> = {
+    code?: Resolver<ResolversTypes['EnablePersonErrorCode'], ParentType, ContextType>;
+    developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+};
+export type EnablePersonResponseResolvers<ContextType = any, ParentType extends ResolversParentTypes['EnablePersonResponse'] = ResolversParentTypes['EnablePersonResponse']> = {
+    error?: Resolver<Maybe<ResolversTypes['EnablePersonError']>, ParentType, ContextType>;
+    ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+};
 export type ForceSignOutPersonErrorResolvers<ContextType = any, ParentType extends ResolversParentTypes['ForceSignOutPersonError'] = ResolversParentTypes['ForceSignOutPersonError']> = {
     code?: Resolver<ResolversTypes['ForceSignOutPersonErrorCode'], ParentType, ContextType>;
     developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
@@ -2826,6 +3136,7 @@ export type ForceSignOutPersonResponseResolvers<ContextType = any, ParentType ex
 export type IdpOptionsOutputResolvers<ContextType = any, ParentType extends ResolversParentTypes['IDPOptionsOutput'] = ResolversParentTypes['IDPOptionsOutput']> = {
     assumeEmailVerified?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
     autoSignUp?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+    disableLocalAuthentication?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
     exclusive?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
     initReturnsConfig?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
     requireVerifiedEmail?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
@@ -2841,8 +3152,16 @@ export type IdentityResolvers<ContextType = any, ParentType extends ResolversPar
     sessions?: Resolver<ReadonlyArray<ResolversTypes['SessionInfo']>, ParentType, ContextType>;
 };
 export type IdentityGlobalPermissionsResolvers<ContextType = any, ParentType extends ResolversParentTypes['IdentityGlobalPermissions'] = ResolversParentTypes['IdentityGlobalPermissions']> = {
+    canCreateGlobalApiKey?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
     canCreateProject?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
     canDeployEntrypoint?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+    canListGlobalApiKeys?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+    canListIdentityProviders?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+    canListMailTemplates?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+    canListPersons?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+    canManageConfiguration?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+    canViewAuthLog?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+    canViewConfiguration?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
 };
 export type IdentityProjectRelationResolvers<ContextType = any, ParentType extends ResolversParentTypes['IdentityProjectRelation'] = ResolversParentTypes['IdentityProjectRelation']> = {
     memberships?: Resolver<ReadonlyArray<ResolversTypes['Membership']>, ParentType, ContextType>;
@@ -2958,11 +3277,13 @@ export type MutationResolvers<ContextType = any, ParentType extends ResolversPar
     confirmOtp?: Resolver<Maybe<ResolversTypes['ConfirmOtpResponse']>, ParentType, ContextType, RequireFields<MutationConfirmOtpArgs, 'otpToken'>>;
     createApiKey?: Resolver<Maybe<ResolversTypes['CreateApiKeyResponse']>, ParentType, ContextType, RequireFields<MutationCreateApiKeyArgs, 'description' | 'memberships' | 'projectSlug'>>;
     createAuthPolicy?: Resolver<Maybe<ResolversTypes['CreateAuthPolicyResponse']>, ParentType, ContextType, RequireFields<MutationCreateAuthPolicyArgs, 'policy'>>;
+    createCustomRole?: Resolver<Maybe<ResolversTypes['CreateCustomRoleResponse']>, ParentType, ContextType, RequireFields<MutationCreateCustomRoleArgs, 'grants' | 'slug'>>;
     createGlobalApiKey?: Resolver<Maybe<ResolversTypes['CreateApiKeyResponse']>, ParentType, ContextType, RequireFields<MutationCreateGlobalApiKeyArgs, 'description'>>;
     createProject?: Resolver<Maybe<ResolversTypes['CreateProjectResponse']>, ParentType, ContextType, RequireFields<MutationCreateProjectArgs, 'projectSlug'>>;
     createResetPasswordRequest?: Resolver<Maybe<ResolversTypes['CreatePasswordResetRequestResponse']>, ParentType, ContextType, RequireFields<MutationCreateResetPasswordRequestArgs, 'email'>>;
     createSessionToken?: Resolver<Maybe<ResolversTypes['CreateSessionTokenResponse']>, ParentType, ContextType, Partial<MutationCreateSessionTokenArgs>>;
     deleteAuthPolicy?: Resolver<Maybe<ResolversTypes['DeleteAuthPolicyResponse']>, ParentType, ContextType, RequireFields<MutationDeleteAuthPolicyArgs, 'id'>>;
+    deleteCustomRole?: Resolver<Maybe<ResolversTypes['DeleteCustomRoleResponse']>, ParentType, ContextType, RequireFields<MutationDeleteCustomRoleArgs, 'slug'>>;
     disableApiKey?: Resolver<Maybe<ResolversTypes['DisableApiKeyResponse']>, ParentType, ContextType, RequireFields<MutationDisableApiKeyArgs, 'id'>>;
     disableEmailOtp?: Resolver<Maybe<ResolversTypes['DisableEmailOtpResponse']>, ParentType, ContextType>;
     disableIDP?: Resolver<Maybe<ResolversTypes['DisableIDPResponse']>, ParentType, ContextType, RequireFields<MutationDisableIdpArgs, 'identityProvider'>>;
@@ -2972,6 +3293,7 @@ export type MutationResolvers<ContextType = any, ParentType extends ResolversPar
     disconnectMyIdentityProvider?: Resolver<Maybe<ResolversTypes['DisconnectIDPResponse']>, ParentType, ContextType, RequireFields<MutationDisconnectMyIdentityProviderArgs, 'id'>>;
     enableIDP?: Resolver<Maybe<ResolversTypes['EnableIDPResponse']>, ParentType, ContextType, RequireFields<MutationEnableIdpArgs, 'identityProvider'>>;
     enableMyPasswordless?: Resolver<Maybe<ResolversTypes['ToggleMyPasswordlessResponse']>, ParentType, ContextType>;
+    enablePerson?: Resolver<Maybe<ResolversTypes['EnablePersonResponse']>, ParentType, ContextType, RequireFields<MutationEnablePersonArgs, 'personId'>>;
     forceSignOutPerson?: Resolver<Maybe<ResolversTypes['ForceSignOutPersonResponse']>, ParentType, ContextType, RequireFields<MutationForceSignOutPersonArgs, 'personId'>>;
     initEmailOtp?: Resolver<Maybe<ResolversTypes['InitEmailOtpResponse']>, ParentType, ContextType>;
     initSignInIDP?: Resolver<Maybe<ResolversTypes['InitSignInIDPResponse']>, ParentType, ContextType, RequireFields<MutationInitSignInIdpArgs, 'identityProvider'>>;
@@ -2995,12 +3317,14 @@ export type MutationResolvers<ContextType = any, ParentType extends ResolversPar
     signUp?: Resolver<Maybe<ResolversTypes['SignUpResponse']>, ParentType, ContextType, RequireFields<MutationSignUpArgs, 'email'>>;
     unmanagedInvite?: Resolver<Maybe<ResolversTypes['InviteResponse']>, ParentType, ContextType, RequireFields<MutationUnmanagedInviteArgs, 'email' | 'memberships' | 'projectSlug'>>;
     updateAuthPolicy?: Resolver<Maybe<ResolversTypes['UpdateAuthPolicyResponse']>, ParentType, ContextType, RequireFields<MutationUpdateAuthPolicyArgs, 'id' | 'policy'>>;
+    updateCustomRole?: Resolver<Maybe<ResolversTypes['UpdateCustomRoleResponse']>, ParentType, ContextType, RequireFields<MutationUpdateCustomRoleArgs, 'slug'>>;
     updateIDP?: Resolver<Maybe<ResolversTypes['UpdateIDPResponse']>, ParentType, ContextType, RequireFields<MutationUpdateIdpArgs, 'identityProvider'>>;
     updateProject?: Resolver<Maybe<ResolversTypes['UpdateProjectResponse']>, ParentType, ContextType, RequireFields<MutationUpdateProjectArgs, 'projectSlug'>>;
     updateProjectMember?: Resolver<Maybe<ResolversTypes['UpdateProjectMemberResponse']>, ParentType, ContextType, RequireFields<MutationUpdateProjectMemberArgs, 'identityId' | 'memberships' | 'projectSlug'>>;
     verifyEmail?: Resolver<Maybe<ResolversTypes['VerifyEmailResponse']>, ParentType, ContextType, RequireFields<MutationVerifyEmailArgs, 'token'>>;
 };
 export type PersonResolvers<ContextType = any, ParentType extends ResolversParentTypes['Person'] = ResolversParentTypes['Person']> = {
+    disabledAt?: Resolver<Maybe<ResolversTypes['DateTime']>, ParentType, ContextType>;
     email?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>;
     emailOtpEnabled?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
     emailVerified?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
@@ -3009,7 +3333,9 @@ export type PersonResolvers<ContextType = any, ParentType extends ResolversParen
     identityProviders?: Resolver<ReadonlyArray<ResolversTypes['PersonIdentityProvider']>, ParentType, ContextType>;
     name?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>;
     otpEnabled?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+    passwordlessAvailable?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
     passwordlessEnabled?: Resolver<Maybe<ResolversTypes['Boolean']>, ParentType, ContextType>;
+    passwordlessSelfManaged?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
 };
 export type PersonIdentityProviderResolvers<ContextType = any, ParentType extends ResolversParentTypes['PersonIdentityProvider'] = ResolversParentTypes['PersonIdentityProvider']> = {
     createdAt?: Resolver<ResolversTypes['DateTime'], ParentType, ContextType>;
@@ -3031,6 +3357,7 @@ export type ProjectResolvers<ContextType = any, ParentType extends ResolversPare
     id?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
     members?: Resolver<ReadonlyArray<ResolversTypes['ProjectIdentityRelation']>, ParentType, ContextType, Partial<ProjectMembersArgs>>;
     name?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+    permissions?: Resolver<ResolversTypes['ProjectPermissions'], ParentType, ContextType>;
     roles?: Resolver<ReadonlyArray<ResolversTypes['RoleDefinition']>, ParentType, ContextType>;
     secrets?: Resolver<ReadonlyArray<ResolversTypes['ProjectSecretInfo']>, ParentType, ContextType>;
     slug?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
@@ -3039,6 +3366,16 @@ export type ProjectIdentityRelationResolvers<ContextType = any, ParentType exten
     identity?: Resolver<ResolversTypes['Identity'], ParentType, ContextType>;
     memberships?: Resolver<ReadonlyArray<ResolversTypes['Membership']>, ParentType, ContextType>;
 };
+export type ProjectPermissionsResolvers<ContextType = any, ParentType extends ResolversParentTypes['ProjectPermissions'] = ResolversParentTypes['ProjectPermissions']> = {
+    canAddMember?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+    canCreateApiKey?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+    canRemoveMember?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+    canSetSecret?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+    canUpdate?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+    canUpdateMember?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+    canViewMembers?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+    canViewSecrets?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+};
 export type ProjectSecretInfoResolvers<ContextType = any, ParentType extends ResolversParentTypes['ProjectSecretInfo'] = ResolversParentTypes['ProjectSecretInfo']> = {
     createdAt?: Resolver<ResolversTypes['DateTime'], ParentType, ContextType>;
     key?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
@@ -3049,6 +3386,8 @@ export type QueryResolvers<ContextType = any, ParentType extends ResolversParent
     authPolicies?: Resolver<ReadonlyArray<ResolversTypes['AuthPolicy']>, ParentType, ContextType>;
     checkResetPasswordToken?: Resolver<ResolversTypes['CheckResetPasswordTokenCode'], ParentType, ContextType, RequireFields<QueryCheckResetPasswordTokenArgs, 'requestId' | 'token'>>;
     configuration?: Resolver<ResolversTypes['Config'], ParentType, ContextType>;
+    customRolePermissions?: Resolver<ReadonlyArray<ResolversTypes['CustomRolePermissionDefinition']>, ParentType, ContextType>;
+    customRoles?: Resolver<ReadonlyArray<ResolversTypes['CustomRole']>, ParentType, ContextType>;
     globalApiKeys?: Resolver<ReadonlyArray<ResolversTypes['ApiKey']>, ParentType, ContextType>;
     identityProviders?: Resolver<ReadonlyArray<ResolversTypes['IdentityProvider']>, ParentType, ContextType>;
     mailTemplates?: Resolver<ReadonlyArray<ResolversTypes['MailTemplateData']>, ParentType, ContextType>;
@@ -3272,6 +3611,14 @@ export type UpdateAuthPolicyResponseResolvers<ContextType = any, ParentType exte
     error?: Resolver<Maybe<ResolversTypes['UpdateAuthPolicyError']>, ParentType, ContextType>;
     ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
 };
+export type UpdateCustomRoleErrorResolvers<ContextType = any, ParentType extends ResolversParentTypes['UpdateCustomRoleError'] = ResolversParentTypes['UpdateCustomRoleError']> = {
+    code?: Resolver<ResolversTypes['UpdateCustomRoleErrorCode'], ParentType, ContextType>;
+    developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+};
+export type UpdateCustomRoleResponseResolvers<ContextType = any, ParentType extends ResolversParentTypes['UpdateCustomRoleResponse'] = ResolversParentTypes['UpdateCustomRoleResponse']> = {
+    error?: Resolver<Maybe<ResolversTypes['UpdateCustomRoleError']>, ParentType, ContextType>;
+    ok?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+};
 export type UpdateIdpErrorResolvers<ContextType = any, ParentType extends ResolversParentTypes['UpdateIDPError'] = ResolversParentTypes['UpdateIDPError']> = {
     code?: Resolver<ResolversTypes['UpdateIDPErrorCode'], ParentType, ContextType>;
     developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
@@ -3344,6 +3691,7 @@ export type Resolvers<ContextType = any> = {
     ConfigEmailChange?: ConfigEmailChangeResolvers<ContextType>;
     ConfigLogin?: ConfigLoginResolvers<ContextType>;
     ConfigLoginAnomalyDetection?: ConfigLoginAnomalyDetectionResolvers<ContextType>;
+    ConfigPanel?: ConfigPanelResolvers<ContextType>;
     ConfigPassword?: ConfigPasswordResolvers<ContextType>;
     ConfigPasswordless?: ConfigPasswordlessResolvers<ContextType>;
     ConfigRateLimitWindow?: ConfigRateLimitWindowResolvers<ContextType>;
@@ -3365,6 +3713,8 @@ export type Resolvers<ContextType = any> = {
     CreateAuthPolicyError?: CreateAuthPolicyErrorResolvers<ContextType>;
     CreateAuthPolicyResponse?: CreateAuthPolicyResponseResolvers<ContextType>;
     CreateAuthPolicyResult?: CreateAuthPolicyResultResolvers<ContextType>;
+    CreateCustomRoleError?: CreateCustomRoleErrorResolvers<ContextType>;
+    CreateCustomRoleResponse?: CreateCustomRoleResponseResolvers<ContextType>;
     CreatePasswordResetRequestError?: CreatePasswordResetRequestErrorResolvers<ContextType>;
     CreatePasswordResetRequestResponse?: CreatePasswordResetRequestResponseResolvers<ContextType>;
     CreateProjectResponse?: CreateProjectResponseResolvers<ContextType>;
@@ -3373,9 +3723,14 @@ export type Resolvers<ContextType = any> = {
     CreateSessionTokenError?: CreateSessionTokenErrorResolvers<ContextType>;
     CreateSessionTokenResponse?: CreateSessionTokenResponseResolvers<ContextType>;
     CreateSessionTokenResult?: CreateSessionTokenResultResolvers<ContextType>;
+    CustomRole?: CustomRoleResolvers<ContextType>;
+    CustomRoleGrant?: CustomRoleGrantResolvers<ContextType>;
+    CustomRolePermissionDefinition?: CustomRolePermissionDefinitionResolvers<ContextType>;
     DateTime?: GraphQLScalarType;
     DeleteAuthPolicyError?: DeleteAuthPolicyErrorResolvers<ContextType>;
     DeleteAuthPolicyResponse?: DeleteAuthPolicyResponseResolvers<ContextType>;
+    DeleteCustomRoleError?: DeleteCustomRoleErrorResolvers<ContextType>;
+    DeleteCustomRoleResponse?: DeleteCustomRoleResponseResolvers<ContextType>;
     DisableApiKeyError?: DisableApiKeyErrorResolvers<ContextType>;
     DisableApiKeyResponse?: DisableApiKeyResponseResolvers<ContextType>;
     DisableEmailOtpError?: DisableEmailOtpErrorResolvers<ContextType>;
@@ -3390,6 +3745,8 @@ export type Resolvers<ContextType = any> = {
     DisconnectIDPResponse?: DisconnectIdpResponseResolvers<ContextType>;
     EnableIDPError?: EnableIdpErrorResolvers<ContextType>;
     EnableIDPResponse?: EnableIdpResponseResolvers<ContextType>;
+    EnablePersonError?: EnablePersonErrorResolvers<ContextType>;
+    EnablePersonResponse?: EnablePersonResponseResolvers<ContextType>;
     ForceSignOutPersonError?: ForceSignOutPersonErrorResolvers<ContextType>;
     ForceSignOutPersonResponse?: ForceSignOutPersonResponseResolvers<ContextType>;
     IDPOptionsOutput?: IdpOptionsOutputResolvers<ContextType>;
@@ -3422,6 +3779,7 @@ export type Resolvers<ContextType = any> = {
     PrepareOtpResult?: PrepareOtpResultResolvers<ContextType>;
     Project?: ProjectResolvers<ContextType>;
     ProjectIdentityRelation?: ProjectIdentityRelationResolvers<ContextType>;
+    ProjectPermissions?: ProjectPermissionsResolvers<ContextType>;
     ProjectSecretInfo?: ProjectSecretInfoResolvers<ContextType>;
     Query?: QueryResolvers<ContextType>;
     RegenerateBackupCodesError?: RegenerateBackupCodesErrorResolvers<ContextType>;
@@ -3468,6 +3826,8 @@ export type Resolvers<ContextType = any> = {
     ToggleMyPasswordlessResponse?: ToggleMyPasswordlessResponseResolvers<ContextType>;
     UpdateAuthPolicyError?: UpdateAuthPolicyErrorResolvers<ContextType>;
     UpdateAuthPolicyResponse?: UpdateAuthPolicyResponseResolvers<ContextType>;
+    UpdateCustomRoleError?: UpdateCustomRoleErrorResolvers<ContextType>;
+    UpdateCustomRoleResponse?: UpdateCustomRoleResponseResolvers<ContextType>;
     UpdateIDPError?: UpdateIdpErrorResolvers<ContextType>;
     UpdateIDPResponse?: UpdateIdpResponseResolvers<ContextType>;
     UpdateProjectError?: UpdateProjectErrorResolvers<ContextType>;