@contember/engine-tenant-api 2.2.0-alpha.3 → 2.2.0-alpha.5

package/dist/development/src/schema/tenant.graphql.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.graphql.cjs","sources":["../../../../../packages/engine-tenant-api/src/schema/tenant.graphql.ts"],"sourcesContent":["import { gql } from 'graphql-tag'\nimport { DocumentNode } from 'graphql'\n\nconst schema: DocumentNode = gql`\n\tscalar Json\n\tscalar DateTime\n\t\n\t\"\"\" Interval is a string in the format ISO 8601, e.g. \"PT1H\" for 1 hour \"\"\"\n\tscalar Interval\n\n\tschema {\n\t\tquery: Query\n\t\tmutation: Mutation\n\t}\n\n\ttype Query {\n\t\tme: Identity!\n\t\tpersonById(id: String!): Person\n\t\t\"\"\"\n\t\tList persons across the tenant. SUPER_ADMIN sees every person; otherwise\n\t\tthe result is scoped to persons who are members of a project the caller may\n\t\tview members of (i.e. the same persons reachable via \\`project.members\\`),\n\t\tso a PROJECT_ADMIN sees only their projects' members. \\`filter\\` matches by\n\t\te-mail (case-insensitive), \\`personId\\`, or \\`identityId\\`; \\`limit\\`/\\`offset\\`\n\t\tpaginate. Returns an empty list when the caller may not list anyone.\n\t\t\"\"\"\n\t\tpersons(filter: PersonsFilter, limit: Int, offset: Int): [Person!]!\n\t\tprojects: [Project!]!\n\t\tprojectBySlug(slug: String!): Project\n\t\tprojectMemberships(projectSlug: String!, identityId: String!): [Membership!]!\n\t\t\"\"\"\n\t\tList global (project-independent) permanent API keys — those created via\n\t\t\\`createGlobalApiKey\\`, whose identity carries global roles and no project\n\t\tmembership. Requires the \\`apiKey:list\\` permission — by default granted\n\t\tonly to SUPER_ADMIN via the wildcard ALL-resource/ALL-privilege grant.\n\t\tReturns an empty list when the caller may not list them. To list a\n\t\tproject's keys use \\`project.apiKeys\\`.\n\t\t\"\"\"\n\t\tglobalApiKeys: [ApiKey!]!\n\t\tcheckResetPasswordToken(requestId: String!, token: String!): CheckResetPasswordTokenCode!\n\n\t\tidentityProviders: [IdentityProvider!]!\n\n\t\tmailTemplates: [MailTemplateData!]!\n\n\t\tconfiguration: Config!\n\n\t\t\"\"\"\n\t\tList configured auth policies (per-role MFA / session policy). Requires the\n\t\t\\`system:configure\\` permission — by default granted only to SUPER_ADMIN\n\t\t(and PROJECT_ADMIN, like \\`configure\\`). With no rows configured, MFA\n\t\tenforcement is inert and sign-in behaves exactly as today.\n\t\t\"\"\"\n\t\tauthPolicies: [AuthPolicy!]!\n\n\t\t\"\"\"\n\t\tRead the tenant audit log (\\`person_auth_log\\`). Requires the\n\t\t\\`system:viewAuthLog\\` permission — by default granted only to\n\t\tSUPER_ADMIN via the wildcard ALL-resource/ALL-privilege grant.\n\t\tOrdered by created_at DESC. Page size is capped server-side\n\t\t(default 100, max 500); \\`hasMore\\` indicates a further page exists.\n\t\t\"\"\"\n\t\tauthLog(filter: AuthLogFilter, limit: Int, offset: Int): AuthLogPage!\n\t}\n\n\ttype Mutation {\n\t\tsignUp(email: String!, password: String, passwordHash: String, roles: [String!], name: String, captchaToken: String): SignUpResponse\n\t\tsignIn(email: String!, password: String!, expiration: Int, otpToken: String, backupCode: String, options: SignInOptions): SignInResponse\n\t\tcreateSessionToken(email: String, personId: String, expiration: Int, options: SignInOptions): CreateSessionTokenResponse\n\t\tsignOut(all: Boolean): SignOutResponse\n\t\tchangeProfile(personId: String!, email: String, name: String): ChangeProfileResponse\n\t\tchangeMyProfile(email: String, name: String): ChangeMyProfileResponse\n\t\tchangePassword(personId: String!, password: String!): ChangePasswordResponse\n\t\tchangeMyPassword(currentPassword: String!, newPassword: String!): ChangeMyPasswordResponse\n\n\t\tinitSignInIDP(\n\t\t\tidentityProvider: String!,\n\t\t\tdata: Json\n\t\t\tredirectUrl: String @deprecated(reason: \"use data.redirectUrl\")\n\t\t): InitSignInIDPResponse\n\t\tsignInIDP(\n\t\t\tidentityProvider: String!,\n\t\t\tdata: Json,\n\t\t\texpiration: Int\n\t\t\toptions: SignInOptions\n\t\t\tidpResponse: IDPResponseInput, @deprecated(reason: \"pass idpResponse.url as data.url\")\n\t\t\tredirectUrl: String @deprecated(reason: \"use data.redirectUrl\"),\n\t\t\tsessionData: Json @deprecated(reason: \"use data.sessionData\"),\n\t\t): SignInIDPResponse\n\t\t\n\t\t# passwordless sign in\n\t\tinitSignInPasswordless(email: String!, options: InitSignInPasswordlessOptions, captchaToken: String): InitSignInPasswordlessResponse\n\t\tsignInPasswordless(requestId: String!, validationType: PasswordlessValidationType!, token: String!, expiration: Int, mfaOtp: String, backupCode: String, options: SignInOptions): SignInPasswordlessResponse\n\t\tactivatePasswordlessOtp(requestId: String!, token: String!, otpHash: String!): ActivatePasswordlessOtpResponse\n\n        enableMyPasswordless: ToggleMyPasswordlessResponse\n        disableMyPasswordless: ToggleMyPasswordlessResponse\n\n\t\t# IDP management\n\t\taddIDP(identityProvider: String!, type: String!, configuration: Json!, options: IDPOptions): AddIDPResponse\n\t\tupdateIDP(identityProvider: String!, type: String, configuration: Json, options: IDPOptions, mergeConfiguration: Boolean): UpdateIDPResponse\n\t\tdisableIDP(identityProvider: String!): DisableIDPResponse\n\t\tenableIDP(identityProvider: String!): EnableIDPResponse\n\n\t\t\"\"\"\n\t\tDisconnect one of the authenticated person's own external IdP connections,\n\t\taddressed by the connection id (see PersonIdentityProvider.id) so a specific\n\t\tconnection can be removed even when the person has several to one provider.\n\t\t\"\"\"\n\t\tdisconnectMyIdentityProvider(id: String!): DisconnectIDPResponse\n\n\t\tprepareOtp(label: String): PrepareOtpResponse\n\t\tconfirmOtp(otpToken: String!): ConfirmOtpResponse\n\t\tdisableOtp: DisableOtpResponse\n\t\tregenerateBackupCodes: RegenerateBackupCodesResponse\n\n\t\tinitEmailOtp: InitEmailOtpResponse\n\t\tconfirmEmailOtp(otpToken: String!): ConfirmEmailOtpResponse\n\t\tdisableEmailOtp: DisableEmailOtpResponse\n\n\t\tdisablePerson(personId: String!): DisablePersonResponse\n\t\tforceSignOutPerson(personId: String!, reason: String): ForceSignOutPersonResponse\n\t\tresetPersonMfa(personId: String!): ResetPersonMfaResponse\n\t\trevokeSession(sessionId: String!): RevokeSessionResponse\n\n\t\tcreateResetPasswordRequest(email: String!, options: CreateResetPasswordRequestOptions, captchaToken: String): CreatePasswordResetRequestResponse\n\t\tresetPassword(token: String!, password: String!): ResetPasswordResponse\n\n\t\t\"\"\"\n\t\t(Re)send the e-mail verification link for the given address. Always\n\t\treports ok regardless of whether the address exists or is already\n\t\tverified, to avoid leaking account existence.\n\t\t\"\"\"\n\t\trequestEmailVerification(email: String!, options: EmailVerificationOptions, captchaToken: String): RequestEmailVerificationResponse\n\t\tverifyEmail(token: String!): VerifyEmailResponse\n\t\t\"\"\"\n\t\tConfirm a pending e-mail change (see changeMyProfile when\n\t\tconfig.signup.requireEmailVerification is enabled). Consumes the token\n\t\tthat was mailed to the new address, swaps the address, and signs out all\n\t\texisting sessions.\n\t\t\"\"\"\n\t\tconfirmEmailChange(token: String!): ConfirmEmailChangeResponse\n\n\t\tinvite(email: String!, name: String, projectSlug: String!, memberships: [MembershipInput!]!, options: InviteOptions): InviteResponse\n\t\tunmanagedInvite(\n\t\t\temail: String!,\n\t\t\tname: String,\n\t\t\tprojectSlug: String!,\n\t\t\tmemberships: [MembershipInput!]!,\n\t\t\toptions: UnmanagedInviteOptions,\n\t\t\tpassword: String @deprecated(reason: \"Use options\")\n\t\t): InviteResponse\n\n\t\taddProjectMember(projectSlug: String!, identityId: String!, memberships: [MembershipInput!]!): AddProjectMemberResponse\n\t\tremoveProjectMember(projectSlug: String!, identityId: String!): RemoveProjectMemberResponse\n\n\t\tupdateProjectMember(projectSlug: String!, identityId: String!, memberships: [MembershipInput!]!): UpdateProjectMemberResponse\n\n\t\tcreateApiKey(projectSlug: String!, memberships: [MembershipInput!]!, description: String!, tokenHash: String, options: CreateApiKeyOptions): CreateApiKeyResponse\n\t\tcreateGlobalApiKey(description: String!, roles: [String!], tokenHash: String, options: CreateApiKeyOptions): CreateApiKeyResponse\n\t\tdisableApiKey(id: String!): DisableApiKeyResponse\n\t\taddGlobalIdentityRoles(identityId: String!, roles: [String!]!): AddGlobalIdentityRolesResponse\n\t\tremoveGlobalIdentityRoles(identityId: String!, roles: [String!]!): RemoveGlobalIdentityRolesResponse\n\n\t\taddMailTemplate(template: MailTemplate!): AddMailTemplateResponse\n\t\tremoveMailTemplate(templateIdentifier: MailTemplateIdentifier!): RemoveMailTemplateResponse\n\n\t\tcreateProject(\n\t\t\tprojectSlug: String!,\n\t\t\tname: String,\n\t\t\tconfig: Json,\n\t\t\tsecrets: [ProjectSecret!],\n\t\t\toptions: CreateProjectOptions,\n\t\t\tdeployTokenHash: String @deprecated(reason: \"Use options\")\n\t\t): CreateProjectResponse\n\t\tsetProjectSecret(projectSlug: String!, key: String!, value: String!): SetProjectSecretResponse\n\t\tupdateProject(projectSlug: String!, name: String, config: Json, mergeConfig: Boolean): UpdateProjectResponse\n\t\t\n\t\tconfigure(config: ConfigInput!): ConfigureResponse\n\n\t\t# === auth policy (per-role MFA / session policy) ===\n\t\tcreateAuthPolicy(policy: AuthPolicyInput!): CreateAuthPolicyResponse\n\t\tupdateAuthPolicy(id: String!, policy: AuthPolicyInput!): UpdateAuthPolicyResponse\n\t\tdeleteAuthPolicy(id: String!): DeleteAuthPolicyResponse\n\n\t\taddProjectMailTemplate(template: MailTemplate!): AddMailTemplateResponse\n\t\t@deprecated(reason: \"use addMailTemplate\")\n\n\t\tremoveProjectMailTemplate(templateIdentifier: MailTemplateIdentifier!): RemoveMailTemplateResponse\n\t\t@deprecated(reason: \"use removeMailTemplate\")\n\n\t}\n\t\n\t# === configure ===\n\t\n\ttype Config {\n\t\tsignup: ConfigSignup!\n\t\temailChange: ConfigEmailChange!\n\t\tpasswordless: ConfigPasswordless!\n\t\tpassword: ConfigPassword!\n\t\tlogin: ConfigLogin!\n\t\tcaptcha: ConfigCaptcha!\n\t\trateLimits: ConfigRateLimits!\n\t}\n\n\ttype ConfigSignup {\n\t\t\"\"\"\n\t\tWhen true, new accounts must verify their e-mail address before they can\n\t\tsign in. The requirement is captured per account at sign-up, so toggling\n\t\tthis only affects accounts created afterwards. Defaults to false (no\n\t\tchange vs. previous behavior). E-mail changes are governed separately by\n\t\tConfigEmailChange.requireVerification.\n\t\t\"\"\"\n\t\trequireEmailVerification: Boolean!\n\t}\n\n\ttype ConfigEmailChange {\n\t\t\"\"\"\n\t\tWhen true, a user-initiated changeMyProfile e-mail change does not swap\n\t\tthe address immediately: it goes through a confirmation flow\n\t\t(confirmEmailChange) against a token mailed to the new address, and the\n\t\told address stays active until the new one is confirmed. Independent of\n\t\tConfigSignup.requireEmailVerification. Defaults to false.\n\t\t\"\"\"\n\t\trequireVerification: Boolean!\n\t}\n\n\ttype ConfigPasswordless {\n\t\tenabled: ConfigPolicy!\n\t\turl: String\n\t\texpiration: Interval!\n\t}\n\n\ttype ConfigPassword {\n\t\tminLength: Int!\n\t\trequireUppercase: Int!\n\t\trequireLowercase: Int!\n\t\trequireDigit: Int!\n\t\trequireSpecial: Int!\n\t\tpattern: String\n\t\tcheckBlacklist: Boolean!\n\t\tcheckHibp: Boolean!\n    }\n\n\ttype ConfigLogin {\n\t\tbaseBackoff: Interval!\n\t\tmaxBackoff: Interval!\n\t\tattemptWindow: Interval!\n\t\trevealUserExists: Boolean!\n\t\t\"\"\"\n\t\tIf false, signIn collapses NO_PASSWORD_SET / INVALID_PASSWORD into a\n\t\tgeneric INVALID_CREDENTIALS and signUp omits the recommendedAction\n\t\thint on EMAIL_ALREADY_EXISTS errors. UNKNOWN_EMAIL and existence-level\n\t\tsignals are still controlled by revealUserExists. Defaults to true\n\t\t(no change vs. previous behavior).\n\t\t\"\"\"\n\t\trevealLoginMethod: Boolean!\n\t\tdefaultTokenExpiration: Interval!\n\t\tmaxTokenExpiration: Interval\n\t\tmfaGraceDuration: Interval!\n\t\tanomalyDetection: ConfigLoginAnomalyDetection!\n    }\n\n\t\"\"\"\n\tSign-in anomaly detection (A03). Opt-in, disabled by default. When enabled,\n\teach successful password verification is scored against the person's last\n\thistorySize successful logins using signals derived from the trusted client\n\tinfo (country from a reverse-proxy geo header, a user-agent fingerprint, and\n\tthe IP / IP prefix). The cumulative score then drives an action:\n\t  - score >= emailThreshold  → an informational UNUSUAL_LOGIN email is sent.\n\t  - score >= stepUpThreshold → a second factor (email OTP) is additionally\n\t    required before a session is issued (reuses the existing step-up flow).\n\tCountry is only ever read through the same trusted-proxy gate as the\n\tforwarded IP / User-Agent — never from an untrusted client.\n\t\"\"\"\n\ttype ConfigLoginAnomalyDetection {\n\t\tenabled: Boolean!\n\t\thistorySize: Int!\n\t\temailThreshold: Int!\n\t\tstepUpThreshold: Int!\n\t}\n\n\t\"\"\"\n\tCaptcha config. The secret is never exposed; only the provider and (where\n\tapplicable) the threshold are readable.\n\t\"\"\"\n\ttype ConfigCaptcha {\n\t\tprovider: CaptchaProvider\n\t\tthreshold: Float\n\t\tprotect: ConfigCaptchaProtect!\n\t}\n\n\t\"\"\"\n\tPer-flow captcha enforcement. The captcha provider/secret is shared; these\n\tflags decide which mutations actually require a captcha token when a provider\n\tis configured.\n\t\"\"\"\n\ttype ConfigCaptchaProtect {\n\t\tsignUp: Boolean!\n\t\tpasswordReset: Boolean!\n\t\tpasswordlessInit: Boolean!\n\t\temailVerification: Boolean!\n\t}\n\n\tenum CaptchaProvider {\n\t\tturnstile\n\t\thcaptcha\n\t\trecaptchaV3\n\t}\n\n\t\"\"\"\n\tConfigurable per-IP rate-limit windows. Each value bounds the number of\n\tattempts allowed from the same client IP in the configured window. Per-email\n\tthrottling for password-reset and passwordless-init flows reuses the\n\texponential backoff from ConfigLogin (baseBackoff / maxBackoff /\n\tattemptWindow) against person_auth_log entries.\n\t\"\"\"\n\ttype ConfigRateLimits {\n\t\tsignUpPerIp: ConfigRateLimitWindow!\n\t\tloginPerIp: ConfigRateLimitWindow!\n\t\tpasswordResetPerIp: ConfigRateLimitWindow!\n\t\tpasswordlessInitPerIp: ConfigRateLimitWindow!\n\t\t\"\"\"\n\t\tCaps how many email-OTP codes may be dispatched per person within the\n\t\twindow (a brute-force / email-bomb backstop). Unlike the per-IP limits it\n\t\tships enabled by default. Set limit to 0 to disable.\n\t\t\"\"\"\n\t\temailOtpPerPerson: ConfigRateLimitWindow!\n\t\temailVerificationPerIp: ConfigRateLimitWindow!\n\t}\n\n\ttype ConfigRateLimitWindow {\n\t\tlimit: Int!\n\t\twindow: Interval!\n\t}\n\n\tinput ConfigInput {\n\t\tsignup: ConfigSignupInput\n\t\temailChange: ConfigEmailChangeInput\n\t\tpasswordless: ConfigPasswordlessInput\n\t\tpassword: ConfigPasswordInput\n\t\tlogin: ConfigLoginInput\n\t\tcaptcha: ConfigCaptchaInput\n\t\trateLimits: ConfigRateLimitsInput\n\t}\n\n\tinput ConfigSignupInput {\n\t\trequireEmailVerification: Boolean\n\t}\n\n\tinput ConfigEmailChangeInput {\n\t\trequireVerification: Boolean\n\t}\n\n\tenum ConfigPolicy {\n\t\talways\n\t\tnever\n\t\toptIn\n\t\toptOut\n\t}\n\n\tinput ConfigPasswordlessInput {\n\t\tenabled: ConfigPolicy\n\t\turl: String\n\t\texpiration: Interval\n\t}\n\n\tinput ConfigPasswordInput {\n\t\tminLength: Int\n\t\trequireUppercase: Int\n\t\trequireLowercase: Int\n\t\trequireDigit: Int\n\t\trequireSpecial: Int\n\t\tpattern: String\n\t\tcheckBlacklist: Boolean\n\t\tcheckHibp: Boolean\n    }\n\n\tinput ConfigLoginInput {\n\t\tbaseBackoff: Interval\n\t\tmaxBackoff: Interval\n\t\tattemptWindow: Interval\n\t\trevealUserExists: Boolean\n\t\trevealLoginMethod: Boolean\n\t\tdefaultTokenExpiration: Interval\n\t\tmaxTokenExpiration: Interval\n\t\tmfaGraceDuration: Interval\n\t\tanomalyDetection: ConfigLoginAnomalyDetectionInput\n    }\n\n\tinput ConfigLoginAnomalyDetectionInput {\n\t\tenabled: Boolean\n\t\thistorySize: Int\n\t\temailThreshold: Int\n\t\tstepUpThreshold: Int\n\t}\n\n\t\"\"\"\n\tProvider null disables captcha verification. Secret is write-only.\n\tPass null secret to leave the stored value unchanged; pass empty string to clear.\n\t\"\"\"\n\tinput ConfigCaptchaInput {\n\t\tprovider: CaptchaProvider\n\t\tsecret: String\n\t\tthreshold: Float\n\t\tprotect: ConfigCaptchaProtectInput\n\t}\n\n\tinput ConfigCaptchaProtectInput {\n\t\tsignUp: Boolean\n\t\tpasswordReset: Boolean\n\t\tpasswordlessInit: Boolean\n\t\temailVerification: Boolean\n\t}\n\n\tinput ConfigRateLimitsInput {\n\t\tsignUpPerIp: ConfigRateLimitWindowInput\n\t\tloginPerIp: ConfigRateLimitWindowInput\n\t\tpasswordResetPerIp: ConfigRateLimitWindowInput\n\t\tpasswordlessInitPerIp: ConfigRateLimitWindowInput\n\t\temailOtpPerPerson: ConfigRateLimitWindowInput\n\t\temailVerificationPerIp: ConfigRateLimitWindowInput\n\t}\n\n\tinput ConfigRateLimitWindowInput {\n\t\tlimit: Int\n\t\twindow: Interval\n\t}\n\t\n\ttype ConfigureResponse {\n\t\tok: Boolean!\n\t\terror: ConfigureError\n\t}\n\t\n\ttype ConfigureError {\n\t\tcode: ConfigureErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum ConfigureErrorCode {\n\t\tINVALID_CONFIG\n\t}\n\n\t# === signUp ===\n\ttype SignUpResponse {\n\t\tok: Boolean!\n\t\terrors: [SignUpError!]! @deprecated\n\t\terror: SignUpError\n\t\tresult: SignUpResult\n\t}\n\n\ttype SignUpError {\n\t\tcode: SignUpErrorCode!\n        weakPasswordReasons: [WeakPasswordReason!]\n\t\t\"\"\"\n\t\tFor EMAIL_ALREADY_EXISTS, the recommended next action client UIs should\n\t\toffer to the visitor. Null for unrelated error codes.\n\t\t\"\"\"\n\t\trecommendedAction: SignUpRecommendedAction\n\t\tdeveloperMessage: String!\n\t\tendPersonMessage: String @deprecated\n\t}\n\n\tenum SignUpErrorCode {\n\t\tEMAIL_ALREADY_EXISTS\n\t\tINVALID_EMAIL_FORMAT\n\t\tTOO_WEAK\n\t\tINVALID_CAPTCHA\n\t\tRATE_LIMIT_EXCEEDED\n\t}\n\n\tenum SignUpRecommendedAction {\n\t\tSIGN_IN\n\t\tRESET_PASSWORD\n\t}\n\n\ttype SignUpResult {\n\t\tperson: Person!\n\t}\n\n\t# === signInCommon ==\n\n\tinterface CommonSignInResult {\n\t\ttoken: String!\n\t\tperson: Person!\n\t}\n\n\t# === signIn ===\n\tinput SignInOptions {\n\t\t\"\"\"\n\t\tIf true, and the calling api_key has trust_forwarded_info=true,\n\t\tthe resulting session token will trust X-Contember-Client-IP and\n\t\tX-Contember-Client-User-Agent headers on subsequent requests.\n\t\tSilently ignored when the caller's api_key does not have the flag.\n\n\t\tSecurity: a proxy that sets these headers MUST strip any\n\t\tincoming X-Contember-Client-IP / X-Contember-Client-User-Agent\n\t\tfrom upstream traffic and re-inject values it trusts. Without\n\t\tthat, any client holding a session token minted with this flag\n\t\tcould spoof its own IP/User-Agent.\n\t\t\"\"\"\n\t\ttrustForwardedClientInfo: Boolean\n\t}\n\n\ttype SignInResponse {\n\t\tok: Boolean!\n\t\terrors: [SignInError!]! @deprecated\n\t\terror: SignInError\n\t\tresult: SignInResult\n\t}\n\n\ttype SignInError {\n\t\tcode: SignInErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t\tretryAfter: Int\n\t\t\"\"\"\n\t\tSet only on a MFA_ENROLLMENT_REQUIRED error: the freshly provisioned\n\t\tpending TOTP secret the client must enroll (show the QR / secret, then\n\t\tretry signIn with otpToken). Additive — clients that don't read it are\n\t\tunaffected.\n\t\t\"\"\"\n\t\tmfaEnrollment: MfaEnrollment\n\t}\n\n\ttype MfaEnrollment {\n\t\totpUri: String!\n\t\totpSecret: String!\n\t}\n\n\tenum SignInErrorCode {\n\t\tINVALID_CREDENTIALS\n\t\tUNKNOWN_EMAIL\n\t\tINVALID_PASSWORD\n\t\tPERSON_DISABLED\n\t\tNO_PASSWORD_SET\n\t\tOTP_REQUIRED\n\t\tINVALID_OTP_TOKEN\n\t\tMFA_ENROLLMENT_REQUIRED\n\t\tEMAIL_NOT_VERIFIED\n\t\tRATE_LIMIT_EXCEEDED\n\t}\n\n\ttype SignInResult implements CommonSignInResult {\n\t\ttoken: String!\n\t\tperson: Person!\n\t\t\"\"\"\n\t\tSet only when this sign-in completed an MFA enrollment (A06): the freshly\n\t\tgenerated backup codes, shown exactly once. Null on a normal sign-in.\n\t\t\"\"\"\n\t\tbackupCodes: [String!]\n\t}\n\n\t# == createSessionToken ==\n\n\ttype CreateSessionTokenResponse {\n\t\tok: Boolean!\n\t\terror: CreateSessionTokenError\n\t\tresult: CreateSessionTokenResult\n\t}\n\n\ttype CreateSessionTokenError {\n\t\tcode: CreateSessionTokenErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum CreateSessionTokenErrorCode {\n\t\tUNKNOWN_EMAIL\n\t\tUNKNOWN_PERSON_ID\n\t\tPERSON_DISABLED\n\t}\n\n\ttype CreateSessionTokenResult implements CommonSignInResult{\n\t\ttoken: String!\n\t\tperson: Person!\n\t}\n\n\t# === signOut ===\n\n\ttype SignOutResponse {\n\t\tok: Boolean!\n\t\terrors: [SignOutError!]! @deprecated\n\t\terror: SignOutError\n\t\t\"\"\"\n\t\tWhen the session was federated via an OIDC identity provider that supports RP-initiated\n\t\t(front-channel) logout, the URL the client should redirect the browser to so the user is\n\t\talso signed out at the IdP (Single Logout). Null for plain sessions or legacy IdPs without\n\t\tan end-session endpoint, in which case only a local logout happened.\n\t\t\"\"\"\n\t\tlogoutUrl: String\n\t}\n\n\ttype SignOutError {\n\t\tcode: SignOutErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum SignOutErrorCode {\n\t\tNOT_A_PERSON,\n\t\tNOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY\n\t}\n\n\t# === changeProfile ===\n\t\n\ttype ChangeProfileResponse {\n\t\tok: Boolean!\n\t\terror: ChangeProfileError\n\t}\n\t\n\ttype ChangeProfileError {\n\t\tcode: ChangeProfileErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum ChangeProfileErrorCode {\n\t\tPERSON_NOT_FOUND\n\t\tINVALID_EMAIL_FORMAT\n\t\tEMAIL_ALREADY_EXISTS\n\t}\n\t\n\t# === changeMyProfile ===\n\n\ttype ChangeMyProfileResponse {\n\t\tok: Boolean!\n\t\terror: ChangeMyProfileError\n\t}\n\n\ttype ChangeMyProfileError {\n\t\tcode: ChangeMyProfileErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum ChangeMyProfileErrorCode {\n\t\tNOT_A_PERSON\n\t\tINVALID_EMAIL_FORMAT\n\t\tEMAIL_ALREADY_EXISTS\n\t\tRATE_LIMIT_EXCEEDED\n\t}\n\n\t# === changePassword ===\n\n\ttype ChangePasswordResponse {\n\t\tok: Boolean!\n\t\terrors: [ChangePasswordError!]! @deprecated\n\t\terror: ChangePasswordError\n\t}\n\n\ttype ChangePasswordError {\n\t\tcode: ChangePasswordErrorCode!\n\t\tweakPasswordReasons: [WeakPasswordReason!]\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum ChangePasswordErrorCode {\n\t\tPERSON_NOT_FOUND\n\t\tTOO_WEAK\n\t}\n\t\n\tenum WeakPasswordReason {\n\t\tTOO_SHORT\n\t\tMISSING_UPPERCASE\n\t\tMISSING_LOWERCASE\n\t\tMISSING_DIGIT\n\t\tMISSING_SPECIAL\n\t\tINVALID_PATTERN\n\t\tBLACKLISTED\n\t\tCOMPROMISED\n    }\n\n\n\t# === changeMyPassword ===\n\t\n\ttype ChangeMyPasswordResponse {\n\t\tok: Boolean!\n\t\terror: ChangeMyPasswordError\n\t}\n\n\ttype ChangeMyPasswordError {\n\t\tcode: ChangeMyPasswordErrorCode!\n        weakPasswordReasons: [WeakPasswordReason!]\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum ChangeMyPasswordErrorCode {\n\t\tTOO_WEAK\n\t\tNOT_A_PERSON\n\t\tINVALID_PASSWORD\n\t\tNO_PASSWORD_SET\n\t}\n\n\t# === IDP ===\n\n\ttype InitSignInIDPResponse {\n\t\tok: Boolean!\n\t\terrors: [InitSignInIDPError!]! @deprecated\n\t\terror: InitSignInIDPError\n\t\tresult: InitSignInIDPResult\n\t}\n\n\ttype InitSignInIDPResult {\n\t\tauthUrl: String!\n\t\tsessionData: Json!\n\t\tidpConfiguration: Json\n\t}\n\n\ttype InitSignInIDPError {\n\t\tcode: InitSignInIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum InitSignInIDPErrorCode {\n\t\tPROVIDER_NOT_FOUND\n\t\tIDP_VALIDATION_FAILED\n\t}\n\n\tinput IDPResponseInput {\n\t\turl: String!\n\t}\n\n\ttype SignInIDPResponse {\n\t\tok: Boolean!\n\t\terrors: [SignInIDPError!]! @deprecated\n\t\terror: SignInIDPError\n\t\tresult: SignInIDPResult\n\t}\n\n\ttype SignInIDPError {\n\t\tcode: SignInIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum SignInIDPErrorCode {\n\t\tINVALID_IDP_RESPONSE\n\t\tIDP_VALIDATION_FAILED\n\n\t\tPERSON_NOT_FOUND\n\t\tPERSON_DISABLED\n\t\tPERSON_ALREADY_EXISTS\n\t}\n\n\ttype SignInIDPResult implements CommonSignInResult {\n\t\ttoken: String!\n\t\tperson: Person!\n\t\tidpResponse: Json\n\t}\n\n\ttype AddIDPResponse {\n\t\terror: AddIDPError\n\t\tok: Boolean!\n\t}\n\n\ttype AddIDPError {\n\t\tcode: AddIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum AddIDPErrorCode {\n\t\tALREADY_EXISTS\n\t\tUNKNOWN_TYPE\n\t\tINVALID_CONFIGURATION\n\t}\n\n\ttype UpdateIDPResponse {\n\t\terror: UpdateIDPError\n\t\tok: Boolean!\n\t}\n\n\ttype UpdateIDPError {\n\t\tcode: UpdateIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum UpdateIDPErrorCode {\n\t\tNOT_FOUND\n\t\tINVALID_CONFIGURATION\n\t}\n\n\n\ttype DisableIDPResponse {\n\t\terror: DisableIDPError\n\t\tok: Boolean!\n\t}\n\n\ttype DisableIDPError {\n\t\tcode: DisableIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum DisableIDPErrorCode {\n\t\tNOT_FOUND\n\t}\n\n\ttype EnableIDPResponse {\n\t\terror: EnableIDPError\n\t\tok: Boolean!\n\t}\n\n\ttype EnableIDPError {\n\t\tcode: EnableIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum EnableIDPErrorCode {\n\t\tNOT_FOUND\n\t}\n\n\t\"\"\" A single external IdP connection of the currently authenticated person. \"\"\"\n\ttype PersonIdentityProvider {\n\t\tid: String!\n\t\tcreatedAt: DateTime!\n\t\texternalIdentifier: String!\n\t\tidentityProvider: IdentityProviderListItem!\n\t}\n\n\t\"\"\" Public view of an identity provider, exposed in personal IdP connection listings. \"\"\"\n\ttype IdentityProviderListItem {\n\t\tslug: String!\n\t\ttype: String!\n\t\tdisabledAt: DateTime\n\t}\n\n\ttype DisconnectIDPResponse {\n\t\terror: DisconnectIDPError\n\t\tok: Boolean!\n\t}\n\n\ttype DisconnectIDPError {\n\t\tcode: DisconnectIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum DisconnectIDPErrorCode {\n\t\t\"\"\" The authenticated person has no IdP connection with the given id. \"\"\"\n\t\tNOT_FOUND\n\t\t\"\"\" The caller is not a person (e.g. an API key) and so has no IdP connections to disconnect. \"\"\"\n\t\tNOT_A_PERSON\n\t\t\"\"\" The person is not allowed to disconnect their last remaining sign-in method. \"\"\"\n\t\tLAST_AUTH_METHOD\n\t}\n\n\ttype IdentityProvider {\n\t\tslug: String!\n\t\ttype: String!\n\t\tconfiguration: Json!\n\t\tdisabledAt: DateTime\n\t\toptions: IDPOptionsOutput!\n\t}\n\n\ttype IDPOptionsOutput {\n\t\tautoSignUp: Boolean!\n\t\texclusive: Boolean!\n\t\tinitReturnsConfig: Boolean!\n\t\t\"\"\"\n\t\tWhen true, a non-exclusive provider may only auto-link to / sign in an\n\t\texisting account by e-mail if the provider asserts the e-mail is verified.\n\t\tDefaults to false.\n\t\t\"\"\"\n\t\trequireVerifiedEmail: Boolean!\n\t\t\"\"\"\n\t\tWhen true, e-mail addresses asserted by this provider are treated as verified\n\t\teven without an \"email_verified\" claim. Use only for trusted providers.\n\t\tDefaults to false.\n\t\t\"\"\"\n\t\tassumeEmailVerified: Boolean!\n\t}\n\n\tinput IDPOptions {\n\t\tautoSignUp: Boolean\n\t\texclusive: Boolean\n\t\tinitReturnsConfig: Boolean\n\t\trequireVerifiedEmail: Boolean\n\t\tassumeEmailVerified: Boolean\n\t}\n\n\t# === passwordless sign in ===\n\t\n\ttype InitSignInPasswordlessResponse {\n\t\tok: Boolean!\n\t\terror: InitSignInPasswordlessError\n\t\tresult: InitSignInPasswordlessResult\n\t}\n\t\n\ttype InitSignInPasswordlessError {\n\t\tcode: InitSignInPasswordlessErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum InitSignInPasswordlessErrorCode {\n\t\tPERSON_NOT_FOUND\n\n\t\tPASSWORDLESS_DISABLED\n\t\tINVALID_CAPTCHA\n\t\tRATE_LIMIT_EXCEEDED\n\t}\n\t\n\ttype InitSignInPasswordlessResult {\n\t\trequestId: String!\n\t\texpiresAt: DateTime!\n\t}\n\n\tinput InitSignInPasswordlessOptions {\n\t\tmailVariant: String\n\t\tmailProject: String\n\t}\n\t\n\ttype SignInPasswordlessResponse {\n\t\tok: Boolean!\n\t\terror: SignInPasswordlessError\n\t\tresult: SignInPasswordlessResult\n\t}\n\t\n\tenum PasswordlessValidationType {\n\t\totp\n\t\ttoken\n\t}\n\t\n\ttype SignInPasswordlessError {\n\t\tcode: SignInPasswordlessErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum SignInPasswordlessErrorCode {\n\t\tTOKEN_NOT_FOUND\n\t\tTOKEN_INVALID\n\t\tTOKEN_EXPIRED\n\t\tTOKEN_USED\n\t\tPERSON_DISABLED\n\t\tOTP_REQUIRED\n\t\tINVALID_OTP_TOKEN\n\t\tMFA_ENROLLMENT_REQUIRED\n\t}\n\n\ttype SignInPasswordlessResult implements CommonSignInResult {\n\t\ttoken: String!\n\t\tperson: Person!\n\t}\n\t\n\ttype ActivatePasswordlessOtpResponse {\n\t\tok: Boolean!\n\t\terror: ActivatePasswordlessOtpError\n\t}\n\t\n\ttype ActivatePasswordlessOtpError {\n\t\tcode: ActivatePasswordlessOtpErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum ActivatePasswordlessOtpErrorCode {\n\t\tTOKEN_NOT_FOUND\n\t\tTOKEN_INVALID\n\t\tTOKEN_EXPIRED\n\t\tTOKEN_USED\n\t}\n\t\n\ttype ToggleMyPasswordlessResponse {\n\t\tok: Boolean!\n\t\terror: ToggleMyPasswordlessError\n\t}\n\t\n\ttype ToggleMyPasswordlessError {\n\t\tcode: ToggleMyPasswordlessErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum ToggleMyPasswordlessErrorCode {\n\t\tCANNOT_TOGGLE\n        NOT_A_PERSON\n\t}\n\t\n\n\t# === invite ===\n\n\ttype InviteResponse {\n\t\tok: Boolean!\n\t\terrors: [InviteError!]! @deprecated\n\t\terror: InviteError\n\t\tresult: InviteResult\n\t}\n\n\ttype InviteError {\n\t\tcode: InviteErrorCode!\n\t\tdeveloperMessage: String!\n\t\tmembershipValidation: [MembershipValidationError!]\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum InviteErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t\tALREADY_MEMBER\n\t\tINVALID_MEMBERSHIP\n\t\tINVALID_EMAIL_FORMAT\n\n\t\tROLE_NOT_FOUND @deprecated\n\t\tVARIABLE_NOT_FOUND @deprecated\n\t\tVARIABLE_EMPTY @deprecated\n\t}\n\n\ttype InviteResult {\n\t\tperson: Person!\n\t\tisNew: Boolean!\n\t}\n\n\tenum InviteMethod {\n\t\tCREATE_PASSWORD\n\t\tRESET_PASSWORD\n\t}\n\n\tinput InviteOptions {\n\t\tmethod: InviteMethod\n\t\tmailVariant: String\n\t}\n\n\tinput UnmanagedInviteOptions {\n\t\tpassword: String\n\t\tresetTokenHash: String\n\t}\n\n\t# === addProjectMember ===\n\n\ttype AddProjectMemberResponse {\n\t\tok: Boolean!\n\t\terrors: [AddProjectMemberError!]!\n\t\terror: AddProjectMemberError\n\t}\n\n\ttype AddProjectMemberError {\n\t\tcode: AddProjectMemberErrorCode!\n\t\tmembershipValidation: [MembershipValidationError!]\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum AddProjectMemberErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t\tIDENTITY_NOT_FOUND\n\t\tALREADY_MEMBER\n\t\tINVALID_MEMBERSHIP\n\n\t\tROLE_NOT_FOUND @deprecated\n\t\tVARIABLE_EMPTY @deprecated\n\t\tVARIABLE_NOT_FOUND @deprecated\n\t}\n\n\t# === updateProjectMember ===\n\n\ttype UpdateProjectMemberResponse {\n\t\tok: Boolean!\n\t\terrors: [UpdateProjectMemberError!]! @deprecated\n\t\terror: UpdateProjectMemberError\n\t}\n\n\ttype UpdateProjectMemberError {\n\t\tcode: UpdateProjectMemberErrorCode!\n\t\tdeveloperMessage: String!\n\t\tmembershipValidation: [MembershipValidationError!]\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum UpdateProjectMemberErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t\tNOT_MEMBER\n\t\tINVALID_MEMBERSHIP\n\n\t\tROLE_NOT_FOUND @deprecated\n\t\tVARIABLE_EMPTY @deprecated\n\t\tVARIABLE_NOT_FOUND @deprecated\n\t}\n\n\t# === removeProjectMember ===\n\n\ttype RemoveProjectMemberResponse {\n\t\tok: Boolean!\n\t\terrors: [RemoveProjectMemberError!]!\n\t\terror: RemoveProjectMemberError\n\t}\n\n\ttype RemoveProjectMemberError {\n\t\tcode: RemoveProjectMemberErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum RemoveProjectMemberErrorCode {\n\t\tNOT_MEMBER\n\t\tPROJECT_NOT_FOUND\n\t}\n\n\t# === createApiKey ===\n\n\tinput CreateApiKeyOptions {\n\t\t\"\"\"\n\t\tIf true, the created api_key trusts X-Contember-Client-IP and\n\t\tX-Contember-Client-User-Agent headers on subsequent requests.\n\t\tIntended for backend services that proxy user requests; the customer's\n\t\tproxy must strip these headers from incoming traffic and re-inject\n\t\tthem with the real user values.\n\t\t\"\"\"\n\t\ttrustForwardedClientInfo: Boolean\n\t}\n\n\ttype CreateApiKeyResponse {\n\t\tok: Boolean!\n\t\terrors: [CreateApiKeyError!]! @deprecated\n\t\terror: CreateApiKeyError\n\t\tresult: CreateApiKeyResult\n\t}\n\n\ttype CreateApiKeyError {\n\t\tcode: CreateApiKeyErrorCode!\n\t\tdeveloperMessage: String!\n\t\tmembershipValidation: [MembershipValidationError!]\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum CreateApiKeyErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t\tINVALID_MEMBERSHIP\n\n\t\tVARIABLE_NOT_FOUND @deprecated\n\t\tROLE_NOT_FOUND @deprecated\n\t\tVARIABLE_EMPTY @deprecated\n\t}\n\n\ttype CreateApiKeyResult {\n\t\tapiKey: ApiKeyWithToken!\n\t}\n\n\t# === disableApiKey ===\n\n\ttype DisableApiKeyResponse {\n\t\tok: Boolean!\n\t\terrors: [DisableApiKeyError!]! @deprecated\n\t\terror: DisableApiKeyError\n\t}\n\n\ttype DisableApiKeyError {\n\t\tcode: DisableApiKeyErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum DisableApiKeyErrorCode {\n\t\tKEY_NOT_FOUND\n\t}\n\t# === addGlobalIdentityRoles ===\n\n\ttype AddGlobalIdentityRolesResponse {\n\t\tok: Boolean!\n\t\terror: AddGlobalIdentityRolesError\n\t\tresult: AddGlobalIdentityRolesResult\n\t}\n\n\ttype AddGlobalIdentityRolesResult {\n\t\tidentity: Identity!\n\t}\n\ttype AddGlobalIdentityRolesError {\n\t\tcode: AddGlobalIdentityRolesErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum AddGlobalIdentityRolesErrorCode {\n\t\tIDENTITY_NOT_FOUND\n\t\tINVALID_ROLE\n\t}\n\n\n\t# === removeGlobalIdentityRoles ===\n\n\ttype RemoveGlobalIdentityRolesResponse {\n\t\tok: Boolean!\n\t\terror: RemoveGlobalIdentityRolesError\n\t\tresult: RemoveGlobalIdentityRolesResult\n\t}\n\n\ttype RemoveGlobalIdentityRolesError {\n\t\tcode: RemoveGlobalIdentityRolesErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\ttype RemoveGlobalIdentityRolesResult {\n\t\tidentity: Identity!\n\t}\n\n\tenum RemoveGlobalIdentityRolesErrorCode {\n\t\tIDENTITY_NOT_FOUND\n\t\tINVALID_ROLE\n\t}\n\t# === common ===\n\n\t# === variables ===\n\n\tinput VariableEntryInput {\n\t\tname: String!\n\t\tvalues: [String!]!\n\t}\n\n\ttype VariableEntry {\n\t\tname: String!\n\t\tvalues: [String!]!\n\t}\n\n\t# === membership ===\n\n\tinput MembershipInput {\n\t\trole: String!\n\t\tvariables: [VariableEntryInput!]!\n\t}\n\n\ttype Membership {\n\t\trole: String!\n\t\tvariables: [VariableEntry!]!\n\t}\n\n\ttype MembershipValidationError {\n\t\tcode: MembershipValidationErrorCode!\n\t\trole: String!\n\t\tvariable: String\n\t}\n\n\tenum MembershipValidationErrorCode {\n\t\tROLE_NOT_FOUND\n\t\tVARIABLE_NOT_FOUND\n\t\tVARIABLE_EMPTY\n\t\tVARIABLE_INVALID\n\t}\n\n\t# === person ====\n\n\ttype Person {\n\t\tid: String!\n\t\temail: String\n\t\tname: String\n\t\totpEnabled: Boolean!\n\t\tpasswordlessEnabled: Boolean\n\t\t\"\"\"\n\t\tWhether e-mail based one-time-password 2FA is enabled for this person\n\t\t(see \\`initEmailOtp\\` / \\`confirmEmailOtp\\` / \\`disableEmailOtp\\`). Independent\n\t\tof \\`otpEnabled\\` (TOTP authenticator), so a UI can show each MFA method's\n\t\tstate separately.\n\t\t\"\"\"\n\t\temailOtpEnabled: Boolean!\n\t\temailVerified: Boolean!\n\t\tidentity: Identity!\n\n\t\t\"\"\"\n\t\tExternal IdP connections of this person. Always visible for the calling\n\t\tperson (e.g. via \\`me { person { identityProviders } }\\`). For other\n\t\tpersons, visible to callers holding the \\`person:viewIdp\\` permission\n\t\tagainst the target's roles — SUPER_ADMIN sees everyone; PROJECT_ADMIN\n\t\tsees members whose roles fall within their allowed-input-roles. Returns\n\t\tan empty list rather than throwing when the viewer lacks visibility.\n\t\t\"\"\"\n\t\tidentityProviders: [PersonIdentityProvider!]!\n\t}\n\n\t\"\"\" Filter for the \\`persons\\` query. Fields are combined with AND. \"\"\"\n\tinput PersonsFilter {\n\t\temail: String\n\t\tpersonId: String\n\t\tidentityId: String\n\t}\n\n\t# === api key ===\n\n\tenum ApiKeyType {\n\t\tSESSION\n\t\tPERMANENT\n\t\tONE_OFF\n\t}\n\n\ttype ApiKey {\n\t\tid: String!\n\t\tidentity: Identity!\n\t\t\"\"\" Human-readable label, stored on the key's identity (\\`identity.description\\`). \"\"\"\n\t\tdescription: String\n\t\ttype: ApiKeyType\n\t\t\"\"\" False once the key has been disabled (\\`disableApiKey\\`). \"\"\"\n\t\tenabled: Boolean\n\t\tcreatedAt: DateTime\n\t\tlastUsedAt: DateTime\n\t\texpiresAt: DateTime\n\t}\n\n\ttype ApiKeyWithToken {\n\t\tid: String!\n\t\ttoken: String\n\t\tidentity: Identity!\n\t}\n\n\t# === identity ===\n\n\ttype Identity {\n\t\tid: String!\n\t\tdescription: String\n\t\tperson: Person\n\t\tapiKey: ApiKey\n\t\tprojects: [IdentityProjectRelation!]!\n\t\tpermissions: IdentityGlobalPermissions\n\t\troles: [String!]\n\t\t\"\"\"\n\t\tActive SESSION-type api keys for this identity. Always visible for\n\t\tthe calling identity (e.g. via \\`me { sessions }\\`). For other identities,\n\t\tvisible to callers holding the \\`person:viewSessions\\` permission against\n\t\tthe target's roles — SUPER_ADMIN sees everyone; PROJECT_ADMIN sees\n\t\tmembers whose roles fall within their allowed-input-roles. Returns an\n\t\tempty list rather than throwing when the viewer lacks visibility, so\n\t\tbatched identity queries do not abort on a single forbidden target.\n\t\t\"\"\"\n\t\tsessions: [SessionInfo!]!\n\t}\n\n\ttype IdentityGlobalPermissions {\n\t\tcanCreateProject: Boolean!\n\t\tcanDeployEntrypoint: Boolean!\n\t}\n\n\ttype IdentityProjectRelation {\n\t\tproject: Project!\n\t\tmemberships: [Membership!]!\n\t}\n\n\t# === project ===\n\n\ttype Project {\n\t\tid: String!\n\t\tname: String!\n\t\tslug: String!\n\t\tconfig: Json!\n\t\troles: [RoleDefinition!]!\n\t\tmembers(\n\t\t\tinput: ProjectMembersInput,\n\t\t\tmemberType: MemberType @deprecated(reason: \"Use args\")\n\t\t): [ProjectIdentityRelation!]!\n\t\t\"\"\"\n\t\tPermanent API keys scoped to this project — keys whose identity is a member\n\t\tof the project (excludes SESSION tokens and global keys). Each key's\n\t\tproject memberships are reachable via \\`apiKey.identity.projects\\` for\n\t\tcloning when (re)issuing a key. Requires \\`project.view members\\` permission;\n\t\treturns an empty list otherwise.\n\t\t\"\"\"\n\t\tapiKeys: [ApiKey!]!\n\t\t\"\"\"\n\t\tNames of the project's secrets (see \\`setProjectSecret\\`). Secret VALUES are\n\t\tnever returned — only the keys and their timestamps — so a UI can show which\n\t\tsecrets exist. Requires the \\`project:viewSecrets\\` permission (project admins\n\t\t+ SUPER_ADMIN by default); returns an empty list otherwise.\n\t\t\"\"\"\n\t\tsecrets: [ProjectSecretInfo!]!\n\t}\n\n\t\"\"\" Metadata about a project secret — never its value. \"\"\"\n\ttype ProjectSecretInfo {\n\t\tkey: String!\n\t\tcreatedAt: DateTime!\n\t\tupdatedAt: DateTime!\n\t}\n\n\tinput ProjectMembersInput {\n\t\tlimit: Int\n\t\toffset: Int\n\t\tfilter: ProjectMembersFilter\n\t}\n\n\tinput ProjectMembersFilter {\n\t\tmemberType: MemberType\n\t\temail: [String!]\n\t\tidentityId: [String!]\n\t\tpersonId: [String!]\n\t}\n\n\tenum MemberType {\n\t\tAPI_KEY\n\t\tPERSON\n\t}\n\n\ttype ProjectIdentityRelation {\n\t\tidentity: Identity!\n\t\tmemberships: [Membership!]!\n\t}\n\n\ttype RoleDefinition {\n\t\tname: String!\n\t\tvariables: [RoleVariableDefinition!]!\n\t}\n\n\tinterface RoleVariableDefinition {\n\t\tname: String!\n\t}\n\n\ttype RoleEntityVariableDefinition implements RoleVariableDefinition {\n\t\tname: String!\n\t\tentityName: String!\n\t}\n\n\ttype RolePredefinedVariableDefinition implements RoleVariableDefinition {\n\t\tname: String!\n\t\tvalue: String!\n\t}\n\n\ttype RoleConditionVariableDefinition implements RoleVariableDefinition {\n\t\tname: String!\n\t}\n\n\t# ==== 2fa ====\n\n\ttype PrepareOtpResponse {\n\t\tok: Boolean!\n\t\tresult: PrepareOtpResult\n\t}\n\n\ttype PrepareOtpResult {\n\t\totpUri: String!\n\t\totpSecret: String!\n\t}\n\n\ttype ConfirmOtpResponse {\n\t\tok: Boolean!\n\t\terrors: [ConfirmOtpError!]! @deprecated\n\t\terror: ConfirmOtpError\n\t\tresult: ConfirmOtpResult\n\t}\n\n\ttype ConfirmOtpResult {\n\t\tbackupCodes: [String!]!\n\t}\n\n\ttype ConfirmOtpError {\n\t\tcode: ConfirmOtpErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum ConfirmOtpErrorCode {\n\t\tINVALID_OTP_TOKEN\n\t\tNOT_PREPARED\n\t}\n\n\ttype DisableOtpResponse {\n\t\tok: Boolean!\n\t\terrors: [DisableOtpError!]! @deprecated\n\t\terror: DisableOtpError\n\t}\n\n\ttype DisableOtpError {\n\t\tcode: DisableOtpErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum DisableOtpErrorCode {\n\t\tOTP_NOT_ACTIVE\n\t\tMFA_REQUIRED\n\t}\n\n\ttype RegenerateBackupCodesResponse {\n\t\tok: Boolean!\n\t\terror: RegenerateBackupCodesError\n\t\tresult: RegenerateBackupCodesResult\n\t}\n\n\ttype RegenerateBackupCodesError {\n\t\tcode: RegenerateBackupCodesErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum RegenerateBackupCodesErrorCode {\n\t\tOTP_NOT_ACTIVE\n\t}\n\n\ttype RegenerateBackupCodesResult {\n\t\tbackupCodes: [String!]!\n\t}\n\n\t# ==== email otp (A05) ====\n\n\ttype InitEmailOtpResponse {\n\t\tok: Boolean!\n\t\terror: InitEmailOtpError\n\t}\n\n\ttype InitEmailOtpError {\n\t\tcode: InitEmailOtpErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum InitEmailOtpErrorCode {\n\t\tNO_EMAIL\n\t\tRATE_LIMITED\n\t}\n\n\ttype ConfirmEmailOtpResponse {\n\t\tok: Boolean!\n\t\terror: ConfirmEmailOtpError\n\t\tresult: ConfirmEmailOtpResult\n\t}\n\n\ttype ConfirmEmailOtpResult {\n\t\tbackupCodes: [String!]!\n\t}\n\n\ttype ConfirmEmailOtpError {\n\t\tcode: ConfirmEmailOtpErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum ConfirmEmailOtpErrorCode {\n\t\tINVALID_OTP_TOKEN\n\t}\n\n\ttype DisableEmailOtpResponse {\n\t\tok: Boolean!\n\t\terror: DisableEmailOtpError\n\t}\n\n\ttype DisableEmailOtpError {\n\t\tcode: DisableEmailOtpErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum DisableEmailOtpErrorCode {\n\t\tEMAIL_OTP_NOT_ACTIVE\n\t\tMFA_REQUIRED\n\t}\n\n\ttype DisablePersonResponse {\n\t\tok: Boolean!\n\t\terror: DisablePersonError\n\t}\n\n\ttype DisablePersonError {\n\t\tcode: DisablePersonErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum DisablePersonErrorCode {\n\t\tPERSON_ALREADY_DISABLED\n\t\tPERSON_NOT_FOUND\n\t}\n\n\t# === forceSignOutPerson ===\n\n\ttype ForceSignOutPersonResponse {\n\t\tok: Boolean!\n\t\terror: ForceSignOutPersonError\n\t}\n\n\ttype ForceSignOutPersonError {\n\t\tcode: ForceSignOutPersonErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum ForceSignOutPersonErrorCode {\n\t\tPERSON_NOT_FOUND\n\t}\n\n\t# === resetPersonMfa ===\n\n\ttype ResetPersonMfaResponse {\n\t\tok: Boolean!\n\t\terror: ResetPersonMfaError\n\t}\n\n\ttype ResetPersonMfaError {\n\t\tcode: ResetPersonMfaErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum ResetPersonMfaErrorCode {\n\t\tPERSON_NOT_FOUND\n\t}\n\n\t# === auth policy (per-role MFA / session policy) ===\n\n\ttype AuthPolicy {\n\t\tid: String!\n\t\tscope: AuthPolicyScope!\n\t\t\"\"\"Project slug, present only for project-scoped policies.\"\"\"\n\t\tproject: String\n\t\troles: [String!]!\n\t\tmfaRequired: Boolean\n\t\ttokenExpiration: Interval\n\t\tidleTimeout: Interval\n\t\tmfaGraceDuration: Interval\n\t\trememberMeAllowed: Boolean\n\t}\n\n\tenum AuthPolicyScope {\n\t\tglobal\n\t\tproject\n\t}\n\n\tinput AuthPolicyInput {\n\t\tscope: AuthPolicyScope!\n\t\t\"\"\"Project slug. Required for scope=project, forbidden for scope=global.\"\"\"\n\t\tproject: String\n\t\troles: [String!]!\n\t\tmfaRequired: Boolean\n\t\ttokenExpiration: Interval\n\t\tidleTimeout: Interval\n\t\tmfaGraceDuration: Interval\n\t\trememberMeAllowed: Boolean\n\t}\n\n\ttype CreateAuthPolicyResponse {\n\t\tok: Boolean!\n\t\terror: CreateAuthPolicyError\n\t\tresult: CreateAuthPolicyResult\n\t}\n\n\ttype CreateAuthPolicyResult {\n\t\tid: String!\n\t}\n\n\ttype CreateAuthPolicyError {\n\t\tcode: CreateAuthPolicyErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum CreateAuthPolicyErrorCode {\n\t\tPROJECT_REQUIRED\n\t\tPROJECT_NOT_ALLOWED\n\t\tPROJECT_NOT_FOUND\n\t}\n\n\ttype UpdateAuthPolicyResponse {\n\t\tok: Boolean!\n\t\terror: UpdateAuthPolicyError\n\t}\n\n\ttype UpdateAuthPolicyError {\n\t\tcode: UpdateAuthPolicyErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum UpdateAuthPolicyErrorCode {\n\t\tNOT_FOUND\n\t\tPROJECT_REQUIRED\n\t\tPROJECT_NOT_ALLOWED\n\t\tPROJECT_NOT_FOUND\n\t}\n\n\ttype DeleteAuthPolicyResponse {\n\t\tok: Boolean!\n\t\terror: DeleteAuthPolicyError\n\t}\n\n\ttype DeleteAuthPolicyError {\n\t\tcode: DeleteAuthPolicyErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum DeleteAuthPolicyErrorCode {\n\t\tNOT_FOUND\n\t}\n\n\t# === sessions ===\n\n\ttype SessionInfo {\n\t\tid: String!\n\t\tcreatedAt: DateTime!\n\t\texpiresAt: DateTime\n\t\tlastUsedAt: DateTime\n\t\tlastIp: String\n\t\tlastUserAgent: String\n\t\tcreatedIp: String\n\t\tcreatedUserAgent: String\n\t\tisCurrent: Boolean!\n\t\t\"\"\"\n\t\tWhether this session honors X-Contember-Client-IP /\n\t\tX-Contember-Client-User-Agent headers on subsequent requests. Set when\n\t\tthe session was minted via \\`SignInOptions.trustForwardedClientInfo\\`\n\t\tfrom an api_key that was itself created with the flag.\n\t\t\"\"\"\n\t\ttrustForwardedClientInfo: Boolean!\n\t}\n\n\ttype RevokeSessionResponse {\n\t\tok: Boolean!\n\t\terror: RevokeSessionError\n\t}\n\n\ttype RevokeSessionError {\n\t\tcode: RevokeSessionErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum RevokeSessionErrorCode {\n\t\tSESSION_NOT_FOUND\n\t\tNOT_A_PERSON\n\t}\n\n\t# === mails ===\n\t\n\ttype MailTemplateData {\n\t\tprojectSlug: String\n\t\ttype: MailType!\n\t\tvariant: String\n\t\tsubject: String!\n\t\tcontent: String!\n\t\tuseLayout: Boolean!\n\t\treplyTo: String\n\t}\n\t\n\tinput MailTemplate {\n\t\tprojectSlug: String\n\t\ttype: MailType!\n\t\t\"Custom mail variant identifier, e.g. a locale.\"\n\t\tvariant: String\n\t\tsubject: String!\n\t\tcontent: String!\n\t\tuseLayout: Boolean\n\t\treplyTo: String\n\t}\n\n\tenum MailType {\n\t\tEXISTING_USER_INVITED\n\t\tNEW_USER_INVITED\n\t\tRESET_PASSWORD_REQUEST\n\t\tPASSWORDLESS_SIGN_IN\n\t\tFORCED_SIGN_OUT\n\t\tEMAIL_OTP\n\t\tBACKUP_CODES_EXHAUSTED\n\t\tEMAIL_VERIFICATION\n\t\tEMAIL_CHANGE_VERIFY\n\t\tEMAIL_CHANGE_NOTIFY\n\t\tUNUSUAL_LOGIN\n\t}\n\n\tinput MailTemplateIdentifier {\n\t\tprojectSlug: String\n\t\ttype: MailType!\n\t\tvariant: String\n\t}\n\n\ttype AddMailTemplateResponse {\n\t\tok: Boolean!\n\t\terrors: [AddMailTemplateError!]! @deprecated\n\t\terror: AddMailTemplateError\n\t}\n\n\ttype AddMailTemplateError {\n\t\tcode: AddMailTemplateErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum AddMailTemplateErrorCode {\n\t\tMISSING_VARIABLE\n\t\tPROJECT_NOT_FOUND\n\t\tINVALID_REPLY_EMAIL_FORMAT\n\t}\n\n\ttype RemoveMailTemplateResponse {\n\t\tok: Boolean!\n\t\terrors: [RemoveMailTemplateError!]!\n\t\terror: RemoveMailTemplateError\n\t}\n\n\ttype RemoveMailTemplateError {\n\t\tcode: RemoveMailTemplateErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum RemoveMailTemplateErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t\tTEMPLATE_NOT_FOUND\n\t}\n\n\t# === password reset ===\n\n\ttype CheckResetPasswordTokenResult {\n\t\tcode: CheckResetPasswordTokenCode!\n\t}\n\n\tenum CheckResetPasswordTokenCode {\n\t\tREQUEST_NOT_FOUND\n\t\tTOKEN_NOT_FOUND\n\t\tTOKEN_INVALID\n\t\tTOKEN_USED\n\t\tTOKEN_EXPIRED\n\t}\n\n\ttype CreatePasswordResetRequestResponse {\n\t\tok: Boolean!\n\t\terrors: [CreatePasswordResetRequestError!]! @deprecated\n\t\terror: CreatePasswordResetRequestError\n\t}\n\n\ttype CreatePasswordResetRequestError {\n\t\tcode: CreatePasswordResetRequestErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum CreatePasswordResetRequestErrorCode {\n\t\tPERSON_NOT_FOUND\n\t\tINVALID_CAPTCHA\n\t\tRATE_LIMIT_EXCEEDED\n\t}\n\n\ttype ResetPasswordResponse {\n\t\tok: Boolean!\n\t\terrors: [ResetPasswordError!]! @deprecated\n\t\terror: ResetPasswordError\n\t}\n\ttype ResetPasswordError {\n\t\tcode: ResetPasswordErrorCode!\n        weakPasswordReasons: [WeakPasswordReason!]\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum ResetPasswordErrorCode {\n\t\tTOKEN_NOT_FOUND\n\t\tTOKEN_INVALID\n\t\tTOKEN_USED\n\t\tTOKEN_EXPIRED\n\n\t\tPASSWORD_TOO_WEAK\n\t}\n\n\tinput CreateResetPasswordRequestOptions {\n\t\tmailProject: String\n\t\tmailVariant: String\n\t}\n\n\t# === email verification ===\n\n\tinput EmailVerificationOptions {\n\t\tmailProject: String\n\t\tmailVariant: String\n\t}\n\n\ttype RequestEmailVerificationResponse {\n\t\tok: Boolean!\n\t\terror: RequestEmailVerificationError\n\t}\n\n\ttype RequestEmailVerificationError {\n\t\tcode: RequestEmailVerificationErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum RequestEmailVerificationErrorCode {\n\t\tRATE_LIMIT_EXCEEDED\n\t\tINVALID_CAPTCHA\n\t}\n\n\ttype VerifyEmailResponse {\n\t\tok: Boolean!\n\t\terror: VerifyEmailError\n\t}\n\n\ttype VerifyEmailError {\n\t\tcode: VerifyEmailErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum VerifyEmailErrorCode {\n\t\tTOKEN_NOT_FOUND\n\t\tTOKEN_INVALID\n\t\tTOKEN_USED\n\t\tTOKEN_EXPIRED\n\t}\n\n\ttype ConfirmEmailChangeResponse {\n\t\tok: Boolean!\n\t\terror: ConfirmEmailChangeError\n\t}\n\n\ttype ConfirmEmailChangeError {\n\t\tcode: ConfirmEmailChangeErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum ConfirmEmailChangeErrorCode {\n\t\tTOKEN_NOT_FOUND\n\t\tTOKEN_INVALID\n\t\tTOKEN_USED\n\t\tTOKEN_EXPIRED\n\t\tEMAIL_ALREADY_EXISTS\n\t\tINVALID_EMAIL_FORMAT\n\t}\n\n\t# === project ===\n\n\tinput ProjectSecret {\n\t\tkey: String!\n\t\tvalue: String!\n\t}\n\n\tinput CreateProjectOptions {\n\t\tdeployTokenHash: String\n\t\tnoDeployToken: Boolean\n\t}\n\n\ttype CreateProjectResponse {\n\t\tok: Boolean!\n\t\terror: CreateProjectResponseError\n\t\tresult: CreateProjectResult\n\t}\n\n\ttype CreateProjectResponseError {\n\t\tcode: CreateProjectResponseErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\ttype CreateProjectResult {\n\t\tdeployerApiKey: ApiKeyWithToken\n\t}\n\n\tenum CreateProjectResponseErrorCode {\n\t\tALREADY_EXISTS\n\t\tINIT_ERROR\n\t}\n\n\ttype SetProjectSecretResponse {\n\t\tok: Boolean!\n\t\terror: SetProjectSecretError\n\t}\n\n\ttype SetProjectSecretError {\n\t\tcode: SetProjectSecretErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum SetProjectSecretErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t}\n\n\ttype UpdateProjectResponse {\n\t\tok: Boolean!\n\t\terror: UpdateProjectError\n\t}\n\n\ttype UpdateProjectError {\n\t\tcode: UpdateProjectErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum UpdateProjectErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t}\n\n\t# === auth log ===\n\n\t\"\"\"\n\tA single \\`person_auth_log\\` row. Mirrors the columns described in\n\tdocs/.../audit-log.md.\n\t\"\"\"\n\ttype AuthLogEntry {\n\t\tid: String!\n\t\tcreatedAt: DateTime!\n\t\t\"\"\"\n\t\tOne of the values listed in \\`auth_log_type\\` (see audit-log docs).\n\t\tKept as String rather than a GraphQL enum because a few legacy values\n\t\t(\\`2fa_enable\\`, \\`2fa_disable\\`) start with a digit and aren't valid\n\t\tenum names, and the set is expected to keep growing.\n\t\t\"\"\"\n\t\ttype: String!\n\t\tsuccess: Boolean!\n\t\t\"\"\"\n\t\tIdentity that performed the action. May be null for entries created\n\t\tbefore this column was populated, or when the actor's identity was\n\t\tlater deleted (FK is ON DELETE SET NULL semantics-wise).\n\t\t\"\"\"\n\t\tinvokedByIdentityId: String\n\t\t\"\"\"\n\t\tThe actor's person (if the actor was a person, not a bare api_key).\n\t\t\"\"\"\n\t\tpersonId: String\n\t\t\"\"\"\n\t\tThe subject of the action when different from the actor (e.g. force\n\t\tsign-out, role grant, membership change). Resolved from the affected\n\t\tidentity so the trail points at the right person even when the actor\n\t\tacts on someone else's identity.\n\t\t\"\"\"\n\t\ttargetPersonId: String\n\t\t\"\"\"\n\t\tFree-form input string — typically the email submitted on a failed\n\t\tlogin, before any person record was looked up.\n\t\t\"\"\"\n\t\tpersonInputIdentifier: String\n\t\terrorCode: String\n\t\terrorMessage: String\n\t\t\"\"\"\n\t\tEffective client IP after \\`trust-forwarded-info\\` is applied. The\n\t\traw socket peer is preserved in \\`metadata.forwarderIp\\` when a\n\t\ttrusted proxy was involved.\n\t\t\"\"\"\n\t\tipAddress: String\n\t\tuserAgent: String\n\t\tidentityProviderId: String\n\t\t\"\"\"\n\t\tJSONB — forensic context. Common keys: \\`forwarderIp\\`,\n\t\t\\`forwarderUserAgent\\`, \\`sessionId\\`, \\`reason\\`.\n\t\t\"\"\"\n\t\tmetadata: Json\n\t\t\"\"\"\n\t\tJSONB — domain payload. For change events this is typically\n\t\t\\`{before, after}\\`; for creation events it's the snapshot.\n\t\tSecret-bearing inputs are redacted before being stored.\n\t\t\"\"\"\n\t\teventData: Json\n\t}\n\n\t\"\"\"\n\tAll fields are AND-combined. Omitted fields are unconstrained.\n\t\"\"\"\n\tinput AuthLogFilter {\n\t\t\"OR-combined: any of the listed \\`auth_log_type\\` values matches.\"\n\t\ttypes: [String!]\n\t\tsuccess: Boolean\n\t\tinvokedByIdentityId: String\n\t\tpersonId: String\n\t\ttargetPersonId: String\n\t\tpersonInputIdentifier: String\n\t\t\"Inclusive lower bound (\\`created_at >= createdAfter\\`).\"\n\t\tcreatedAfter: DateTime\n\t\t\"Exclusive upper bound (\\`created_at < createdBefore\\`).\"\n\t\tcreatedBefore: DateTime\n\t}\n\n\ttype AuthLogPage {\n\t\tentries: [AuthLogEntry!]!\n\t\t\"True when more rows exist past \\`offset + limit\\`.\"\n\t\thasMore: Boolean!\n\t}\n`\n\nexport default schema\n"],"names":["gql"],"mappings":";;AAGA,MAAM,SAAuBA,WAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;;"}
+{"version":3,"file":"tenant.graphql.cjs","sources":["../../../../../packages/engine-tenant-api/src/schema/tenant.graphql.ts"],"sourcesContent":["import { gql } from 'graphql-tag'\nimport { DocumentNode } from 'graphql'\n\nconst schema: DocumentNode = gql`\n\tscalar Json\n\tscalar DateTime\n\t\n\t\"\"\" Interval is a string in the format ISO 8601, e.g. \"PT1H\" for 1 hour \"\"\"\n\tscalar Interval\n\n\tschema {\n\t\tquery: Query\n\t\tmutation: Mutation\n\t}\n\n\ttype Query {\n\t\tme: Identity!\n\t\tpersonById(id: String!): Person\n\t\t\"\"\"\n\t\tList persons across the tenant. SUPER_ADMIN sees every person; otherwise\n\t\tthe result is scoped to persons who are members of a project the caller may\n\t\tview members of (i.e. the same persons reachable via \\`project.members\\`),\n\t\tso a PROJECT_ADMIN sees only their projects' members. \\`filter\\` matches by\n\t\te-mail (case-insensitive), \\`personId\\`, or \\`identityId\\`; \\`limit\\`/\\`offset\\`\n\t\tpaginate. Returns an empty list when the caller may not list anyone.\n\t\t\"\"\"\n\t\tpersons(filter: PersonsFilter, limit: Int, offset: Int): [Person!]!\n\t\tprojects: [Project!]!\n\t\tprojectBySlug(slug: String!): Project\n\t\tprojectMemberships(projectSlug: String!, identityId: String!): [Membership!]!\n\t\t\"\"\"\n\t\tList global (project-independent) permanent API keys — those created via\n\t\t\\`createGlobalApiKey\\`, whose identity carries global roles and no project\n\t\tmembership. Requires the \\`apiKey:list\\` permission — by default granted\n\t\tonly to SUPER_ADMIN via the wildcard ALL-resource/ALL-privilege grant.\n\t\tReturns an empty list when the caller may not list them. To list a\n\t\tproject's keys use \\`project.apiKeys\\`.\n\t\t\"\"\"\n\t\tglobalApiKeys: [ApiKey!]!\n\t\tcheckResetPasswordToken(requestId: String!, token: String!): CheckResetPasswordTokenCode!\n\n\t\tidentityProviders: [IdentityProvider!]!\n\n\t\tmailTemplates: [MailTemplateData!]!\n\n\t\tconfiguration: Config!\n\n\t\t\"\"\"\n\t\tList configured auth policies (per-role MFA / session policy). Requires the\n\t\t\\`system:configure\\` permission — by default granted only to SUPER_ADMIN\n\t\t(and PROJECT_ADMIN, like \\`configure\\`). With no rows configured, MFA\n\t\tenforcement is inert and sign-in behaves exactly as today.\n\t\t\"\"\"\n\t\tauthPolicies: [AuthPolicy!]!\n\n\t\t\"\"\"\n\t\tRead the tenant audit log (\\`person_auth_log\\`). Requires the\n\t\t\\`system:viewAuthLog\\` permission — by default granted only to\n\t\tSUPER_ADMIN via the wildcard ALL-resource/ALL-privilege grant.\n\t\tOrdered by created_at DESC. Page size is capped server-side\n\t\t(default 100, max 500); \\`hasMore\\` indicates a further page exists.\n\t\t\"\"\"\n\t\tauthLog(filter: AuthLogFilter, limit: Int, offset: Int): AuthLogPage!\n\t}\n\n\ttype Mutation {\n\t\tsignUp(email: String!, password: String, passwordHash: String, roles: [String!], name: String, captchaToken: String): SignUpResponse\n\t\tsignIn(email: String!, password: String!, expiration: Int, otpToken: String, backupCode: String, options: SignInOptions): SignInResponse\n\t\tcreateSessionToken(email: String, personId: String, expiration: Int, options: SignInOptions): CreateSessionTokenResponse\n\t\tsignOut(all: Boolean): SignOutResponse\n\t\tchangeProfile(personId: String!, email: String, name: String): ChangeProfileResponse\n\t\tchangeMyProfile(email: String, name: String): ChangeMyProfileResponse\n\t\tchangePassword(personId: String!, password: String!): ChangePasswordResponse\n\t\tchangeMyPassword(currentPassword: String!, newPassword: String!): ChangeMyPasswordResponse\n\n\t\tinitSignInIDP(\n\t\t\tidentityProvider: String!,\n\t\t\tdata: Json\n\t\t\tredirectUrl: String @deprecated(reason: \"use data.redirectUrl\")\n\t\t): InitSignInIDPResponse\n\t\tsignInIDP(\n\t\t\tidentityProvider: String!,\n\t\t\tdata: Json,\n\t\t\texpiration: Int\n\t\t\toptions: SignInOptions\n\t\t\tidpResponse: IDPResponseInput, @deprecated(reason: \"pass idpResponse.url as data.url\")\n\t\t\tredirectUrl: String @deprecated(reason: \"use data.redirectUrl\"),\n\t\t\tsessionData: Json @deprecated(reason: \"use data.sessionData\"),\n\t\t): SignInIDPResponse\n\t\t\n\t\t# passwordless sign in\n\t\tinitSignInPasswordless(email: String!, options: InitSignInPasswordlessOptions, captchaToken: String): InitSignInPasswordlessResponse\n\t\tsignInPasswordless(requestId: String!, validationType: PasswordlessValidationType!, token: String!, expiration: Int, mfaOtp: String, backupCode: String, options: SignInOptions): SignInPasswordlessResponse\n\t\tactivatePasswordlessOtp(requestId: String!, token: String!, otpHash: String!): ActivatePasswordlessOtpResponse\n\n        enableMyPasswordless: ToggleMyPasswordlessResponse\n        disableMyPasswordless: ToggleMyPasswordlessResponse\n\n\t\t# IDP management\n\t\taddIDP(identityProvider: String!, type: String!, configuration: Json!, options: IDPOptions): AddIDPResponse\n\t\tupdateIDP(identityProvider: String!, type: String, configuration: Json, options: IDPOptions, mergeConfiguration: Boolean): UpdateIDPResponse\n\t\tdisableIDP(identityProvider: String!): DisableIDPResponse\n\t\tenableIDP(identityProvider: String!): EnableIDPResponse\n\n\t\t\"\"\"\n\t\tDisconnect one of the authenticated person's own external IdP connections,\n\t\taddressed by the connection id (see PersonIdentityProvider.id) so a specific\n\t\tconnection can be removed even when the person has several to one provider.\n\t\t\"\"\"\n\t\tdisconnectMyIdentityProvider(id: String!): DisconnectIDPResponse\n\n\t\tprepareOtp(label: String): PrepareOtpResponse\n\t\tconfirmOtp(otpToken: String!): ConfirmOtpResponse\n\t\tdisableOtp: DisableOtpResponse\n\t\tregenerateBackupCodes: RegenerateBackupCodesResponse\n\n\t\tinitEmailOtp: InitEmailOtpResponse\n\t\tconfirmEmailOtp(otpToken: String!): ConfirmEmailOtpResponse\n\t\tdisableEmailOtp: DisableEmailOtpResponse\n\n\t\tdisablePerson(personId: String!): DisablePersonResponse\n\t\tenablePerson(personId: String!): EnablePersonResponse\n\t\tforceSignOutPerson(personId: String!, reason: String): ForceSignOutPersonResponse\n\t\tresetPersonMfa(personId: String!): ResetPersonMfaResponse\n\t\trevokeSession(sessionId: String!): RevokeSessionResponse\n\n\t\tcreateResetPasswordRequest(email: String!, options: CreateResetPasswordRequestOptions, captchaToken: String): CreatePasswordResetRequestResponse\n\t\tresetPassword(token: String!, password: String!): ResetPasswordResponse\n\n\t\t\"\"\"\n\t\t(Re)send the e-mail verification link for the given address. Always\n\t\treports ok regardless of whether the address exists or is already\n\t\tverified, to avoid leaking account existence.\n\t\t\"\"\"\n\t\trequestEmailVerification(email: String!, options: EmailVerificationOptions, captchaToken: String): RequestEmailVerificationResponse\n\t\tverifyEmail(token: String!): VerifyEmailResponse\n\t\t\"\"\"\n\t\tConfirm a pending e-mail change (see changeMyProfile when\n\t\tconfig.signup.requireEmailVerification is enabled). Consumes the token\n\t\tthat was mailed to the new address, swaps the address, and signs out all\n\t\texisting sessions.\n\t\t\"\"\"\n\t\tconfirmEmailChange(token: String!): ConfirmEmailChangeResponse\n\n\t\tinvite(email: String!, name: String, projectSlug: String!, memberships: [MembershipInput!]!, options: InviteOptions): InviteResponse\n\t\tunmanagedInvite(\n\t\t\temail: String!,\n\t\t\tname: String,\n\t\t\tprojectSlug: String!,\n\t\t\tmemberships: [MembershipInput!]!,\n\t\t\toptions: UnmanagedInviteOptions,\n\t\t\tpassword: String @deprecated(reason: \"Use options\")\n\t\t): InviteResponse\n\n\t\taddProjectMember(projectSlug: String!, identityId: String!, memberships: [MembershipInput!]!): AddProjectMemberResponse\n\t\tremoveProjectMember(projectSlug: String!, identityId: String!): RemoveProjectMemberResponse\n\n\t\tupdateProjectMember(projectSlug: String!, identityId: String!, memberships: [MembershipInput!]!): UpdateProjectMemberResponse\n\n\t\tcreateApiKey(projectSlug: String!, memberships: [MembershipInput!]!, description: String!, tokenHash: String, options: CreateApiKeyOptions): CreateApiKeyResponse\n\t\tcreateGlobalApiKey(description: String!, roles: [String!], tokenHash: String, options: CreateApiKeyOptions): CreateApiKeyResponse\n\t\tdisableApiKey(id: String!): DisableApiKeyResponse\n\t\taddGlobalIdentityRoles(identityId: String!, roles: [String!]!): AddGlobalIdentityRolesResponse\n\t\tremoveGlobalIdentityRoles(identityId: String!, roles: [String!]!): RemoveGlobalIdentityRolesResponse\n\n\t\taddMailTemplate(template: MailTemplate!): AddMailTemplateResponse\n\t\tremoveMailTemplate(templateIdentifier: MailTemplateIdentifier!): RemoveMailTemplateResponse\n\n\t\tcreateProject(\n\t\t\tprojectSlug: String!,\n\t\t\tname: String,\n\t\t\tconfig: Json,\n\t\t\tsecrets: [ProjectSecret!],\n\t\t\toptions: CreateProjectOptions,\n\t\t\tdeployTokenHash: String @deprecated(reason: \"Use options\")\n\t\t): CreateProjectResponse\n\t\tsetProjectSecret(projectSlug: String!, key: String!, value: String!): SetProjectSecretResponse\n\t\tupdateProject(projectSlug: String!, name: String, config: Json, mergeConfig: Boolean): UpdateProjectResponse\n\t\t\n\t\tconfigure(config: ConfigInput!): ConfigureResponse\n\n\t\t# === auth policy (per-role MFA / session policy) ===\n\t\tcreateAuthPolicy(policy: AuthPolicyInput!): CreateAuthPolicyResponse\n\t\tupdateAuthPolicy(id: String!, policy: AuthPolicyInput!): UpdateAuthPolicyResponse\n\t\tdeleteAuthPolicy(id: String!): DeleteAuthPolicyResponse\n\n\t\taddProjectMailTemplate(template: MailTemplate!): AddMailTemplateResponse\n\t\t@deprecated(reason: \"use addMailTemplate\")\n\n\t\tremoveProjectMailTemplate(templateIdentifier: MailTemplateIdentifier!): RemoveMailTemplateResponse\n\t\t@deprecated(reason: \"use removeMailTemplate\")\n\n\t}\n\t\n\t# === configure ===\n\t\n\ttype Config {\n\t\tsignup: ConfigSignup!\n\t\temailChange: ConfigEmailChange!\n\t\tpasswordless: ConfigPasswordless!\n\t\tpassword: ConfigPassword!\n\t\tlogin: ConfigLogin!\n\t\tcaptcha: ConfigCaptcha!\n\t\trateLimits: ConfigRateLimits!\n\t\tpanel: ConfigPanel!\n\t}\n\n\ttype ConfigSignup {\n\t\t\"\"\"\n\t\tWhen true, new accounts must verify their e-mail address before they can\n\t\tsign in. The requirement is captured per account at sign-up, so toggling\n\t\tthis only affects accounts created afterwards. Defaults to false (no\n\t\tchange vs. previous behavior). E-mail changes are governed separately by\n\t\tConfigEmailChange.requireVerification.\n\t\t\"\"\"\n\t\trequireEmailVerification: Boolean!\n\t}\n\n\ttype ConfigEmailChange {\n\t\t\"\"\"\n\t\tWhen true, a user-initiated changeMyProfile e-mail change does not swap\n\t\tthe address immediately: it goes through a confirmation flow\n\t\t(confirmEmailChange) against a token mailed to the new address, and the\n\t\told address stays active until the new one is confirmed. Independent of\n\t\tConfigSignup.requireEmailVerification. Defaults to false.\n\t\t\"\"\"\n\t\trequireVerification: Boolean!\n\t}\n\n\ttype ConfigPasswordless {\n\t\tenabled: ConfigPolicy!\n\t\turl: String\n\t\texpiration: Interval!\n\t}\n\n\ttype ConfigPassword {\n\t\tminLength: Int!\n\t\trequireUppercase: Int!\n\t\trequireLowercase: Int!\n\t\trequireDigit: Int!\n\t\trequireSpecial: Int!\n\t\tpattern: String\n\t\tcheckBlacklist: Boolean!\n\t\tcheckHibp: Boolean!\n    }\n\n\ttype ConfigLogin {\n\t\tbaseBackoff: Interval!\n\t\tmaxBackoff: Interval!\n\t\tattemptWindow: Interval!\n\t\trevealUserExists: Boolean!\n\t\t\"\"\"\n\t\tIf false, signIn collapses NO_PASSWORD_SET / INVALID_PASSWORD into a\n\t\tgeneric INVALID_CREDENTIALS and signUp omits the recommendedAction\n\t\thint on EMAIL_ALREADY_EXISTS errors. UNKNOWN_EMAIL and existence-level\n\t\tsignals are still controlled by revealUserExists. Defaults to true\n\t\t(no change vs. previous behavior).\n\t\t\"\"\"\n\t\trevealLoginMethod: Boolean!\n\t\tdefaultTokenExpiration: Interval!\n\t\tmaxTokenExpiration: Interval\n\t\tmfaGraceDuration: Interval!\n\t\tanomalyDetection: ConfigLoginAnomalyDetection!\n    }\n\n\t\"\"\"\n\tSign-in anomaly detection (A03). Opt-in, disabled by default. When enabled,\n\teach successful password verification is scored against the person's last\n\thistorySize successful logins using signals derived from the trusted client\n\tinfo (country from a reverse-proxy geo header, a user-agent fingerprint, and\n\tthe IP / IP prefix). The cumulative score then drives an action:\n\t  - score >= emailThreshold  → an informational UNUSUAL_LOGIN email is sent.\n\t  - score >= stepUpThreshold → a second factor (email OTP) is additionally\n\t    required before a session is issued (reuses the existing step-up flow).\n\tCountry is only ever read through the same trusted-proxy gate as the\n\tforwarded IP / User-Agent — never from an untrusted client.\n\t\"\"\"\n\ttype ConfigLoginAnomalyDetection {\n\t\tenabled: Boolean!\n\t\thistorySize: Int!\n\t\temailThreshold: Int!\n\t\tstepUpThreshold: Int!\n\t}\n\n\t\"\"\"\n\tCaptcha config. The secret is never exposed; only the provider and (where\n\tapplicable) the threshold are readable.\n\t\"\"\"\n\ttype ConfigCaptcha {\n\t\tprovider: CaptchaProvider\n\t\tthreshold: Float\n\t\tprotect: ConfigCaptchaProtect!\n\t}\n\n\t\"\"\"\n\tPer-flow captcha enforcement. The captcha provider/secret is shared; these\n\tflags decide which mutations actually require a captcha token when a provider\n\tis configured.\n\t\"\"\"\n\ttype ConfigCaptchaProtect {\n\t\tsignUp: Boolean!\n\t\tpasswordReset: Boolean!\n\t\tpasswordlessInit: Boolean!\n\t\temailVerification: Boolean!\n\t}\n\n\tenum CaptchaProvider {\n\t\tturnstile\n\t\thcaptcha\n\t\trecaptchaV3\n\t}\n\n\t\"\"\"\n\tConfigurable per-IP rate-limit windows. Each value bounds the number of\n\tattempts allowed from the same client IP in the configured window. Per-email\n\tthrottling for password-reset and passwordless-init flows reuses the\n\texponential backoff from ConfigLogin (baseBackoff / maxBackoff /\n\tattemptWindow) against person_auth_log entries.\n\t\"\"\"\n\ttype ConfigRateLimits {\n\t\tsignUpPerIp: ConfigRateLimitWindow!\n\t\tloginPerIp: ConfigRateLimitWindow!\n\t\tpasswordResetPerIp: ConfigRateLimitWindow!\n\t\tpasswordlessInitPerIp: ConfigRateLimitWindow!\n\t\t\"\"\"\n\t\tCaps how many email-OTP codes may be dispatched per person within the\n\t\twindow (a brute-force / email-bomb backstop). Unlike the per-IP limits it\n\t\tships enabled by default. Set limit to 0 to disable.\n\t\t\"\"\"\n\t\temailOtpPerPerson: ConfigRateLimitWindow!\n\t\temailVerificationPerIp: ConfigRateLimitWindow!\n\t}\n\n\ttype ConfigRateLimitWindow {\n\t\tlimit: Int!\n\t\twindow: Interval!\n\t}\n\n\t\"\"\"\n\tWho may enter the management panel. This is an entry gate for the console\n\tonly, not an authorization system: everything done inside the panel still\n\tgoes through the tenant ACL, so being allowed in grants no extra rights.\n\tAn identity may enter when its global roles intersect globalRoles, or when\n\tit holds a membership with one of projectRoles in at least one project.\n\tBoth lists empty means nobody can enter.\n\t\"\"\"\n\ttype ConfigPanel {\n\t\t\"\"\"Global roles (identity.roles) that may use the management panel.\"\"\"\n\t\tglobalRoles: [String!]!\n\t\t\"\"\"Project membership roles that may use the management panel, in any project.\"\"\"\n\t\tprojectRoles: [String!]!\n\t}\n\n\tinput ConfigInput {\n\t\tsignup: ConfigSignupInput\n\t\temailChange: ConfigEmailChangeInput\n\t\tpasswordless: ConfigPasswordlessInput\n\t\tpassword: ConfigPasswordInput\n\t\tlogin: ConfigLoginInput\n\t\tcaptcha: ConfigCaptchaInput\n\t\trateLimits: ConfigRateLimitsInput\n\t\tpanel: ConfigPanelInput\n\t}\n\n\tinput ConfigSignupInput {\n\t\trequireEmailVerification: Boolean\n\t}\n\n\tinput ConfigEmailChangeInput {\n\t\trequireVerification: Boolean\n\t}\n\n\tenum ConfigPolicy {\n\t\talways\n\t\tnever\n\t\toptIn\n\t\toptOut\n\t}\n\n\tinput ConfigPasswordlessInput {\n\t\tenabled: ConfigPolicy\n\t\turl: String\n\t\texpiration: Interval\n\t}\n\n\tinput ConfigPasswordInput {\n\t\tminLength: Int\n\t\trequireUppercase: Int\n\t\trequireLowercase: Int\n\t\trequireDigit: Int\n\t\trequireSpecial: Int\n\t\tpattern: String\n\t\tcheckBlacklist: Boolean\n\t\tcheckHibp: Boolean\n    }\n\n\tinput ConfigLoginInput {\n\t\tbaseBackoff: Interval\n\t\tmaxBackoff: Interval\n\t\tattemptWindow: Interval\n\t\trevealUserExists: Boolean\n\t\trevealLoginMethod: Boolean\n\t\tdefaultTokenExpiration: Interval\n\t\tmaxTokenExpiration: Interval\n\t\tmfaGraceDuration: Interval\n\t\tanomalyDetection: ConfigLoginAnomalyDetectionInput\n    }\n\n\tinput ConfigLoginAnomalyDetectionInput {\n\t\tenabled: Boolean\n\t\thistorySize: Int\n\t\temailThreshold: Int\n\t\tstepUpThreshold: Int\n\t}\n\n\t\"\"\"\n\tProvider null disables captcha verification. Secret is write-only.\n\tPass null secret to leave the stored value unchanged; pass empty string to clear.\n\t\"\"\"\n\tinput ConfigCaptchaInput {\n\t\tprovider: CaptchaProvider\n\t\tsecret: String\n\t\tthreshold: Float\n\t\tprotect: ConfigCaptchaProtectInput\n\t}\n\n\tinput ConfigCaptchaProtectInput {\n\t\tsignUp: Boolean\n\t\tpasswordReset: Boolean\n\t\tpasswordlessInit: Boolean\n\t\temailVerification: Boolean\n\t}\n\n\tinput ConfigRateLimitsInput {\n\t\tsignUpPerIp: ConfigRateLimitWindowInput\n\t\tloginPerIp: ConfigRateLimitWindowInput\n\t\tpasswordResetPerIp: ConfigRateLimitWindowInput\n\t\tpasswordlessInitPerIp: ConfigRateLimitWindowInput\n\t\temailOtpPerPerson: ConfigRateLimitWindowInput\n\t\temailVerificationPerIp: ConfigRateLimitWindowInput\n\t}\n\n\tinput ConfigRateLimitWindowInput {\n\t\tlimit: Int\n\t\twindow: Interval\n\t}\n\n\t\"\"\"\n\tEach list is replaced as a whole; omitting one leaves it unchanged. An empty\n\tlist closes the panel for that dimension.\n\t\"\"\"\n\tinput ConfigPanelInput {\n\t\tglobalRoles: [String!]\n\t\tprojectRoles: [String!]\n\t}\n\t\n\ttype ConfigureResponse {\n\t\tok: Boolean!\n\t\terror: ConfigureError\n\t}\n\t\n\ttype ConfigureError {\n\t\tcode: ConfigureErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum ConfigureErrorCode {\n\t\tINVALID_CONFIG\n\t}\n\n\t# === signUp ===\n\ttype SignUpResponse {\n\t\tok: Boolean!\n\t\terrors: [SignUpError!]! @deprecated\n\t\terror: SignUpError\n\t\tresult: SignUpResult\n\t}\n\n\ttype SignUpError {\n\t\tcode: SignUpErrorCode!\n        weakPasswordReasons: [WeakPasswordReason!]\n\t\t\"\"\"\n\t\tFor EMAIL_ALREADY_EXISTS, the recommended next action client UIs should\n\t\toffer to the visitor. Null for unrelated error codes.\n\t\t\"\"\"\n\t\trecommendedAction: SignUpRecommendedAction\n\t\tdeveloperMessage: String!\n\t\tendPersonMessage: String @deprecated\n\t}\n\n\tenum SignUpErrorCode {\n\t\tEMAIL_ALREADY_EXISTS\n\t\tINVALID_EMAIL_FORMAT\n\t\tTOO_WEAK\n\t\tINVALID_CAPTCHA\n\t\tRATE_LIMIT_EXCEEDED\n\t}\n\n\tenum SignUpRecommendedAction {\n\t\tSIGN_IN\n\t\tRESET_PASSWORD\n\t}\n\n\ttype SignUpResult {\n\t\tperson: Person!\n\t}\n\n\t# === signInCommon ==\n\n\tinterface CommonSignInResult {\n\t\ttoken: String!\n\t\tperson: Person!\n\t}\n\n\t# === signIn ===\n\tinput SignInOptions {\n\t\t\"\"\"\n\t\tIf true, and the calling api_key has trust_forwarded_info=true,\n\t\tthe resulting session token will trust X-Contember-Client-IP and\n\t\tX-Contember-Client-User-Agent headers on subsequent requests.\n\t\tSilently ignored when the caller's api_key does not have the flag.\n\n\t\tSecurity: a proxy that sets these headers MUST strip any\n\t\tincoming X-Contember-Client-IP / X-Contember-Client-User-Agent\n\t\tfrom upstream traffic and re-inject values it trusts. Without\n\t\tthat, any client holding a session token minted with this flag\n\t\tcould spoof its own IP/User-Agent.\n\t\t\"\"\"\n\t\ttrustForwardedClientInfo: Boolean\n\t}\n\n\ttype SignInResponse {\n\t\tok: Boolean!\n\t\terrors: [SignInError!]! @deprecated\n\t\terror: SignInError\n\t\tresult: SignInResult\n\t}\n\n\ttype SignInError {\n\t\tcode: SignInErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t\tretryAfter: Int\n\t\t\"\"\"\n\t\tSet only on a MFA_ENROLLMENT_REQUIRED error: the freshly provisioned\n\t\tpending TOTP secret the client must enroll (show the QR / secret, then\n\t\tretry signIn with otpToken). Additive — clients that don't read it are\n\t\tunaffected.\n\t\t\"\"\"\n\t\tmfaEnrollment: MfaEnrollment\n\t}\n\n\ttype MfaEnrollment {\n\t\totpUri: String!\n\t\totpSecret: String!\n\t}\n\n\tenum SignInErrorCode {\n\t\tINVALID_CREDENTIALS\n\t\tUNKNOWN_EMAIL\n\t\tINVALID_PASSWORD\n\t\tPERSON_DISABLED\n\t\tNO_PASSWORD_SET\n\t\tOTP_REQUIRED\n\t\tINVALID_OTP_TOKEN\n\t\tMFA_ENROLLMENT_REQUIRED\n\t\tEMAIL_NOT_VERIFIED\n\t\tRATE_LIMIT_EXCEEDED\n\t}\n\n\ttype SignInResult implements CommonSignInResult {\n\t\ttoken: String!\n\t\tperson: Person!\n\t\t\"\"\"\n\t\tSet only when this sign-in completed an MFA enrollment (A06): the freshly\n\t\tgenerated backup codes, shown exactly once. Null on a normal sign-in.\n\t\t\"\"\"\n\t\tbackupCodes: [String!]\n\t}\n\n\t# == createSessionToken ==\n\n\ttype CreateSessionTokenResponse {\n\t\tok: Boolean!\n\t\terror: CreateSessionTokenError\n\t\tresult: CreateSessionTokenResult\n\t}\n\n\ttype CreateSessionTokenError {\n\t\tcode: CreateSessionTokenErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum CreateSessionTokenErrorCode {\n\t\tUNKNOWN_EMAIL\n\t\tUNKNOWN_PERSON_ID\n\t\tPERSON_DISABLED\n\t}\n\n\ttype CreateSessionTokenResult implements CommonSignInResult{\n\t\ttoken: String!\n\t\tperson: Person!\n\t}\n\n\t# === signOut ===\n\n\ttype SignOutResponse {\n\t\tok: Boolean!\n\t\terrors: [SignOutError!]! @deprecated\n\t\terror: SignOutError\n\t\t\"\"\"\n\t\tWhen the session was federated via an OIDC identity provider that supports RP-initiated\n\t\t(front-channel) logout, the URL the client should redirect the browser to so the user is\n\t\talso signed out at the IdP (Single Logout). Null for plain sessions or legacy IdPs without\n\t\tan end-session endpoint, in which case only a local logout happened.\n\t\t\"\"\"\n\t\tlogoutUrl: String\n\t}\n\n\ttype SignOutError {\n\t\tcode: SignOutErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum SignOutErrorCode {\n\t\tNOT_A_PERSON,\n\t\tNOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY\n\t}\n\n\t# === changeProfile ===\n\t\n\ttype ChangeProfileResponse {\n\t\tok: Boolean!\n\t\terror: ChangeProfileError\n\t}\n\t\n\ttype ChangeProfileError {\n\t\tcode: ChangeProfileErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum ChangeProfileErrorCode {\n\t\tPERSON_NOT_FOUND\n\t\tINVALID_EMAIL_FORMAT\n\t\tEMAIL_ALREADY_EXISTS\n\t}\n\t\n\t# === changeMyProfile ===\n\n\ttype ChangeMyProfileResponse {\n\t\tok: Boolean!\n\t\terror: ChangeMyProfileError\n\t}\n\n\ttype ChangeMyProfileError {\n\t\tcode: ChangeMyProfileErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum ChangeMyProfileErrorCode {\n\t\tNOT_A_PERSON\n\t\tINVALID_EMAIL_FORMAT\n\t\tEMAIL_ALREADY_EXISTS\n\t\tRATE_LIMIT_EXCEEDED\n\t}\n\n\t# === changePassword ===\n\n\ttype ChangePasswordResponse {\n\t\tok: Boolean!\n\t\terrors: [ChangePasswordError!]! @deprecated\n\t\terror: ChangePasswordError\n\t}\n\n\ttype ChangePasswordError {\n\t\tcode: ChangePasswordErrorCode!\n\t\tweakPasswordReasons: [WeakPasswordReason!]\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum ChangePasswordErrorCode {\n\t\tPERSON_NOT_FOUND\n\t\tTOO_WEAK\n\t}\n\t\n\tenum WeakPasswordReason {\n\t\tTOO_SHORT\n\t\tMISSING_UPPERCASE\n\t\tMISSING_LOWERCASE\n\t\tMISSING_DIGIT\n\t\tMISSING_SPECIAL\n\t\tINVALID_PATTERN\n\t\tBLACKLISTED\n\t\tCOMPROMISED\n    }\n\n\n\t# === changeMyPassword ===\n\t\n\ttype ChangeMyPasswordResponse {\n\t\tok: Boolean!\n\t\terror: ChangeMyPasswordError\n\t}\n\n\ttype ChangeMyPasswordError {\n\t\tcode: ChangeMyPasswordErrorCode!\n        weakPasswordReasons: [WeakPasswordReason!]\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum ChangeMyPasswordErrorCode {\n\t\tTOO_WEAK\n\t\tNOT_A_PERSON\n\t\tINVALID_PASSWORD\n\t\tNO_PASSWORD_SET\n\t}\n\n\t# === IDP ===\n\n\ttype InitSignInIDPResponse {\n\t\tok: Boolean!\n\t\terrors: [InitSignInIDPError!]! @deprecated\n\t\terror: InitSignInIDPError\n\t\tresult: InitSignInIDPResult\n\t}\n\n\ttype InitSignInIDPResult {\n\t\tauthUrl: String!\n\t\tsessionData: Json!\n\t\tidpConfiguration: Json\n\t}\n\n\ttype InitSignInIDPError {\n\t\tcode: InitSignInIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum InitSignInIDPErrorCode {\n\t\tPROVIDER_NOT_FOUND\n\t\tIDP_VALIDATION_FAILED\n\t}\n\n\tinput IDPResponseInput {\n\t\turl: String!\n\t}\n\n\ttype SignInIDPResponse {\n\t\tok: Boolean!\n\t\terrors: [SignInIDPError!]! @deprecated\n\t\terror: SignInIDPError\n\t\tresult: SignInIDPResult\n\t}\n\n\ttype SignInIDPError {\n\t\tcode: SignInIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum SignInIDPErrorCode {\n\t\tINVALID_IDP_RESPONSE\n\t\tIDP_VALIDATION_FAILED\n\n\t\tPERSON_NOT_FOUND\n\t\tPERSON_DISABLED\n\t\tPERSON_ALREADY_EXISTS\n\t}\n\n\ttype SignInIDPResult implements CommonSignInResult {\n\t\ttoken: String!\n\t\tperson: Person!\n\t\tidpResponse: Json\n\t}\n\n\ttype AddIDPResponse {\n\t\terror: AddIDPError\n\t\tok: Boolean!\n\t}\n\n\ttype AddIDPError {\n\t\tcode: AddIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum AddIDPErrorCode {\n\t\tALREADY_EXISTS\n\t\tUNKNOWN_TYPE\n\t\tINVALID_CONFIGURATION\n\t}\n\n\ttype UpdateIDPResponse {\n\t\terror: UpdateIDPError\n\t\tok: Boolean!\n\t}\n\n\ttype UpdateIDPError {\n\t\tcode: UpdateIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum UpdateIDPErrorCode {\n\t\tNOT_FOUND\n\t\tINVALID_CONFIGURATION\n\t}\n\n\n\ttype DisableIDPResponse {\n\t\terror: DisableIDPError\n\t\tok: Boolean!\n\t}\n\n\ttype DisableIDPError {\n\t\tcode: DisableIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum DisableIDPErrorCode {\n\t\tNOT_FOUND\n\t}\n\n\ttype EnableIDPResponse {\n\t\terror: EnableIDPError\n\t\tok: Boolean!\n\t}\n\n\ttype EnableIDPError {\n\t\tcode: EnableIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum EnableIDPErrorCode {\n\t\tNOT_FOUND\n\t}\n\n\t\"\"\" A single external IdP connection of the currently authenticated person. \"\"\"\n\ttype PersonIdentityProvider {\n\t\tid: String!\n\t\tcreatedAt: DateTime!\n\t\texternalIdentifier: String!\n\t\tidentityProvider: IdentityProviderListItem!\n\t}\n\n\t\"\"\" Public view of an identity provider, exposed in personal IdP connection listings. \"\"\"\n\ttype IdentityProviderListItem {\n\t\tslug: String!\n\t\ttype: String!\n\t\tdisabledAt: DateTime\n\t}\n\n\ttype DisconnectIDPResponse {\n\t\terror: DisconnectIDPError\n\t\tok: Boolean!\n\t}\n\n\ttype DisconnectIDPError {\n\t\tcode: DisconnectIDPErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum DisconnectIDPErrorCode {\n\t\t\"\"\" The authenticated person has no IdP connection with the given id. \"\"\"\n\t\tNOT_FOUND\n\t\t\"\"\" The caller is not a person (e.g. an API key) and so has no IdP connections to disconnect. \"\"\"\n\t\tNOT_A_PERSON\n\t\t\"\"\" The person is not allowed to disconnect their last remaining sign-in method. \"\"\"\n\t\tLAST_AUTH_METHOD\n\t}\n\n\ttype IdentityProvider {\n\t\tslug: String!\n\t\ttype: String!\n\t\tconfiguration: Json!\n\t\tdisabledAt: DateTime\n\t\toptions: IDPOptionsOutput!\n\t}\n\n\ttype IDPOptionsOutput {\n\t\tautoSignUp: Boolean!\n\t\texclusive: Boolean!\n\t\tinitReturnsConfig: Boolean!\n\t\t\"\"\"\n\t\tWhen true, a non-exclusive provider may only auto-link to / sign in an\n\t\texisting account by e-mail if the provider asserts the e-mail is verified.\n\t\tDefaults to false.\n\t\t\"\"\"\n\t\trequireVerifiedEmail: Boolean!\n\t\t\"\"\"\n\t\tWhen true, e-mail addresses asserted by this provider are treated as verified\n\t\teven without an \"email_verified\" claim. Use only for trusted providers.\n\t\tDefaults to false.\n\t\t\"\"\"\n\t\tassumeEmailVerified: Boolean!\n\t}\n\n\tinput IDPOptions {\n\t\tautoSignUp: Boolean\n\t\texclusive: Boolean\n\t\tinitReturnsConfig: Boolean\n\t\trequireVerifiedEmail: Boolean\n\t\tassumeEmailVerified: Boolean\n\t}\n\n\t# === passwordless sign in ===\n\t\n\ttype InitSignInPasswordlessResponse {\n\t\tok: Boolean!\n\t\terror: InitSignInPasswordlessError\n\t\tresult: InitSignInPasswordlessResult\n\t}\n\t\n\ttype InitSignInPasswordlessError {\n\t\tcode: InitSignInPasswordlessErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum InitSignInPasswordlessErrorCode {\n\t\tPERSON_NOT_FOUND\n\n\t\tPASSWORDLESS_DISABLED\n\t\tINVALID_CAPTCHA\n\t\tRATE_LIMIT_EXCEEDED\n\t}\n\t\n\ttype InitSignInPasswordlessResult {\n\t\trequestId: String!\n\t\texpiresAt: DateTime!\n\t}\n\n\tinput InitSignInPasswordlessOptions {\n\t\tmailVariant: String\n\t\tmailProject: String\n\t}\n\t\n\ttype SignInPasswordlessResponse {\n\t\tok: Boolean!\n\t\terror: SignInPasswordlessError\n\t\tresult: SignInPasswordlessResult\n\t}\n\t\n\tenum PasswordlessValidationType {\n\t\totp\n\t\ttoken\n\t}\n\t\n\ttype SignInPasswordlessError {\n\t\tcode: SignInPasswordlessErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum SignInPasswordlessErrorCode {\n\t\tTOKEN_NOT_FOUND\n\t\tTOKEN_INVALID\n\t\tTOKEN_EXPIRED\n\t\tTOKEN_USED\n\t\tPERSON_DISABLED\n\t\tOTP_REQUIRED\n\t\tINVALID_OTP_TOKEN\n\t\tMFA_ENROLLMENT_REQUIRED\n\t}\n\n\ttype SignInPasswordlessResult implements CommonSignInResult {\n\t\ttoken: String!\n\t\tperson: Person!\n\t}\n\t\n\ttype ActivatePasswordlessOtpResponse {\n\t\tok: Boolean!\n\t\terror: ActivatePasswordlessOtpError\n\t}\n\t\n\ttype ActivatePasswordlessOtpError {\n\t\tcode: ActivatePasswordlessOtpErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum ActivatePasswordlessOtpErrorCode {\n\t\tTOKEN_NOT_FOUND\n\t\tTOKEN_INVALID\n\t\tTOKEN_EXPIRED\n\t\tTOKEN_USED\n\t}\n\t\n\ttype ToggleMyPasswordlessResponse {\n\t\tok: Boolean!\n\t\terror: ToggleMyPasswordlessError\n\t}\n\t\n\ttype ToggleMyPasswordlessError {\n\t\tcode: ToggleMyPasswordlessErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\t\n\tenum ToggleMyPasswordlessErrorCode {\n\t\tCANNOT_TOGGLE\n        NOT_A_PERSON\n\t}\n\t\n\n\t# === invite ===\n\n\ttype InviteResponse {\n\t\tok: Boolean!\n\t\terrors: [InviteError!]! @deprecated\n\t\terror: InviteError\n\t\tresult: InviteResult\n\t}\n\n\ttype InviteError {\n\t\tcode: InviteErrorCode!\n\t\tdeveloperMessage: String!\n\t\tmembershipValidation: [MembershipValidationError!]\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum InviteErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t\tALREADY_MEMBER\n\t\tINVALID_MEMBERSHIP\n\t\tINVALID_EMAIL_FORMAT\n\n\t\tROLE_NOT_FOUND @deprecated\n\t\tVARIABLE_NOT_FOUND @deprecated\n\t\tVARIABLE_EMPTY @deprecated\n\t}\n\n\ttype InviteResult {\n\t\tperson: Person!\n\t\tisNew: Boolean!\n\t}\n\n\tenum InviteMethod {\n\t\tCREATE_PASSWORD\n\t\tRESET_PASSWORD\n\t}\n\n\tinput InviteOptions {\n\t\tmethod: InviteMethod\n\t\tmailVariant: String\n\t}\n\n\tinput UnmanagedInviteOptions {\n\t\tpassword: String\n\t\tresetTokenHash: String\n\t}\n\n\t# === addProjectMember ===\n\n\ttype AddProjectMemberResponse {\n\t\tok: Boolean!\n\t\terrors: [AddProjectMemberError!]!\n\t\terror: AddProjectMemberError\n\t}\n\n\ttype AddProjectMemberError {\n\t\tcode: AddProjectMemberErrorCode!\n\t\tmembershipValidation: [MembershipValidationError!]\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum AddProjectMemberErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t\tIDENTITY_NOT_FOUND\n\t\tALREADY_MEMBER\n\t\tINVALID_MEMBERSHIP\n\n\t\tROLE_NOT_FOUND @deprecated\n\t\tVARIABLE_EMPTY @deprecated\n\t\tVARIABLE_NOT_FOUND @deprecated\n\t}\n\n\t# === updateProjectMember ===\n\n\ttype UpdateProjectMemberResponse {\n\t\tok: Boolean!\n\t\terrors: [UpdateProjectMemberError!]! @deprecated\n\t\terror: UpdateProjectMemberError\n\t}\n\n\ttype UpdateProjectMemberError {\n\t\tcode: UpdateProjectMemberErrorCode!\n\t\tdeveloperMessage: String!\n\t\tmembershipValidation: [MembershipValidationError!]\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum UpdateProjectMemberErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t\tNOT_MEMBER\n\t\tINVALID_MEMBERSHIP\n\n\t\tROLE_NOT_FOUND @deprecated\n\t\tVARIABLE_EMPTY @deprecated\n\t\tVARIABLE_NOT_FOUND @deprecated\n\t}\n\n\t# === removeProjectMember ===\n\n\ttype RemoveProjectMemberResponse {\n\t\tok: Boolean!\n\t\terrors: [RemoveProjectMemberError!]!\n\t\terror: RemoveProjectMemberError\n\t}\n\n\ttype RemoveProjectMemberError {\n\t\tcode: RemoveProjectMemberErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum RemoveProjectMemberErrorCode {\n\t\tNOT_MEMBER\n\t\tPROJECT_NOT_FOUND\n\t}\n\n\t# === createApiKey ===\n\n\tinput CreateApiKeyOptions {\n\t\t\"\"\"\n\t\tIf true, the created api_key trusts X-Contember-Client-IP and\n\t\tX-Contember-Client-User-Agent headers on subsequent requests.\n\t\tIntended for backend services that proxy user requests; the customer's\n\t\tproxy must strip these headers from incoming traffic and re-inject\n\t\tthem with the real user values.\n\t\t\"\"\"\n\t\ttrustForwardedClientInfo: Boolean\n\t}\n\n\ttype CreateApiKeyResponse {\n\t\tok: Boolean!\n\t\terrors: [CreateApiKeyError!]! @deprecated\n\t\terror: CreateApiKeyError\n\t\tresult: CreateApiKeyResult\n\t}\n\n\ttype CreateApiKeyError {\n\t\tcode: CreateApiKeyErrorCode!\n\t\tdeveloperMessage: String!\n\t\tmembershipValidation: [MembershipValidationError!]\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum CreateApiKeyErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t\tINVALID_MEMBERSHIP\n\n\t\tVARIABLE_NOT_FOUND @deprecated\n\t\tROLE_NOT_FOUND @deprecated\n\t\tVARIABLE_EMPTY @deprecated\n\t}\n\n\ttype CreateApiKeyResult {\n\t\tapiKey: ApiKeyWithToken!\n\t}\n\n\t# === disableApiKey ===\n\n\ttype DisableApiKeyResponse {\n\t\tok: Boolean!\n\t\terrors: [DisableApiKeyError!]! @deprecated\n\t\terror: DisableApiKeyError\n\t}\n\n\ttype DisableApiKeyError {\n\t\tcode: DisableApiKeyErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum DisableApiKeyErrorCode {\n\t\tKEY_NOT_FOUND\n\t}\n\t# === addGlobalIdentityRoles ===\n\n\ttype AddGlobalIdentityRolesResponse {\n\t\tok: Boolean!\n\t\terror: AddGlobalIdentityRolesError\n\t\tresult: AddGlobalIdentityRolesResult\n\t}\n\n\ttype AddGlobalIdentityRolesResult {\n\t\tidentity: Identity!\n\t}\n\ttype AddGlobalIdentityRolesError {\n\t\tcode: AddGlobalIdentityRolesErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum AddGlobalIdentityRolesErrorCode {\n\t\tIDENTITY_NOT_FOUND\n\t\tINVALID_ROLE\n\t}\n\n\n\t# === removeGlobalIdentityRoles ===\n\n\ttype RemoveGlobalIdentityRolesResponse {\n\t\tok: Boolean!\n\t\terror: RemoveGlobalIdentityRolesError\n\t\tresult: RemoveGlobalIdentityRolesResult\n\t}\n\n\ttype RemoveGlobalIdentityRolesError {\n\t\tcode: RemoveGlobalIdentityRolesErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\ttype RemoveGlobalIdentityRolesResult {\n\t\tidentity: Identity!\n\t}\n\n\tenum RemoveGlobalIdentityRolesErrorCode {\n\t\tIDENTITY_NOT_FOUND\n\t\tINVALID_ROLE\n\t}\n\t# === common ===\n\n\t# === variables ===\n\n\tinput VariableEntryInput {\n\t\tname: String!\n\t\tvalues: [String!]!\n\t}\n\n\ttype VariableEntry {\n\t\tname: String!\n\t\tvalues: [String!]!\n\t}\n\n\t# === membership ===\n\n\tinput MembershipInput {\n\t\trole: String!\n\t\tvariables: [VariableEntryInput!]!\n\t}\n\n\ttype Membership {\n\t\trole: String!\n\t\tvariables: [VariableEntry!]!\n\t}\n\n\ttype MembershipValidationError {\n\t\tcode: MembershipValidationErrorCode!\n\t\trole: String!\n\t\tvariable: String\n\t}\n\n\tenum MembershipValidationErrorCode {\n\t\tROLE_NOT_FOUND\n\t\tVARIABLE_NOT_FOUND\n\t\tVARIABLE_EMPTY\n\t\tVARIABLE_INVALID\n\t}\n\n\t# === person ====\n\n\ttype Person {\n\t\tid: String!\n\t\temail: String\n\t\tname: String\n\t\totpEnabled: Boolean!\n\t\t\"\"\" The person's own opt-in flag; \\`null\\` means \"follow the tenant policy\". On its own it does not say whether passwordless sign-in works — see \\`passwordlessAvailable\\`. \"\"\"\n\t\tpasswordlessEnabled: Boolean\n\t\t\"\"\"\n\t\tWhether passwordless sign-in is actually usable for this person right now: the tenant-wide\n\t\tpolicy resolved against \\`passwordlessEnabled\\`, i.e. the very same decision \\`signIn\\` makes. A UI\n\t\toffering an enable/disable toggle must branch on this — under an \\`always\\` or \\`never\\` policy the\n\t\traw opt-in flag says nothing about what will happen.\n\t\t\"\"\"\n\t\tpasswordlessAvailable: Boolean!\n\t\t\"\"\"\n\t\tWhether \\`passwordlessEnabled\\` is what decides \\`passwordlessAvailable\\`. False under an \\`always\\`\n\t\tor \\`never\\` policy, where the person's own flag is ignored — a UI should then report the state\n\t\trather than offer a toggle that changes nothing.\n\t\t\"\"\"\n\t\tpasswordlessSelfManaged: Boolean!\n\t\t\"\"\"\n\t\tWhether e-mail based one-time-password 2FA is enabled for this person\n\t\t(see \\`initEmailOtp\\` / \\`confirmEmailOtp\\` / \\`disableEmailOtp\\`). Independent\n\t\tof \\`otpEnabled\\` (TOTP authenticator), so a UI can show each MFA method's\n\t\tstate separately.\n\t\t\"\"\"\n\t\temailOtpEnabled: Boolean!\n\t\temailVerified: Boolean!\n\t\t\"\"\"\n\t\tWhen the account was disabled (see \\`disablePerson\\`), null while the person\n\t\tis active. Read-only — flip it with \\`disablePerson\\` / \\`enablePerson\\`.\n\t\t\"\"\"\n\t\tdisabledAt: DateTime\n\t\tidentity: Identity!\n\n\t\t\"\"\"\n\t\tExternal IdP connections of this person. Always visible for the calling\n\t\tperson (e.g. via \\`me { person { identityProviders } }\\`). For other\n\t\tpersons, visible to callers holding the \\`person:viewIdp\\` permission\n\t\tagainst the target's roles — SUPER_ADMIN sees everyone; PROJECT_ADMIN\n\t\tsees members whose roles fall within their allowed-input-roles. Returns\n\t\tan empty list rather than throwing when the viewer lacks visibility.\n\t\t\"\"\"\n\t\tidentityProviders: [PersonIdentityProvider!]!\n\t}\n\n\t\"\"\" Filter for the \\`persons\\` query. Fields are combined with AND. \"\"\"\n\tinput PersonsFilter {\n\t\temail: String\n\t\tpersonId: String\n\t\tidentityId: String\n\t}\n\n\t# === api key ===\n\n\tenum ApiKeyType {\n\t\tSESSION\n\t\tPERMANENT\n\t\tONE_OFF\n\t}\n\n\ttype ApiKey {\n\t\tid: String!\n\t\tidentity: Identity!\n\t\t\"\"\" Human-readable label, stored on the key's identity (\\`identity.description\\`). \"\"\"\n\t\tdescription: String\n\t\ttype: ApiKeyType\n\t\t\"\"\" False once the key has been disabled (\\`disableApiKey\\`). \"\"\"\n\t\tenabled: Boolean\n\t\tcreatedAt: DateTime\n\t\tlastUsedAt: DateTime\n\t\texpiresAt: DateTime\n\t}\n\n\ttype ApiKeyWithToken {\n\t\tid: String!\n\t\ttoken: String\n\t\tidentity: Identity!\n\t}\n\n\t# === identity ===\n\n\ttype Identity {\n\t\tid: String!\n\t\tdescription: String\n\t\tperson: Person\n\t\tapiKey: ApiKey\n\t\tprojects: [IdentityProjectRelation!]!\n\t\tpermissions: IdentityGlobalPermissions\n\t\troles: [String!]\n\t\t\"\"\"\n\t\tActive SESSION-type api keys for this identity. Always visible for\n\t\tthe calling identity (e.g. via \\`me { sessions }\\`). For other identities,\n\t\tvisible to callers holding the \\`person:viewSessions\\` permission against\n\t\tthe target's roles — SUPER_ADMIN sees everyone; PROJECT_ADMIN sees\n\t\tmembers whose roles fall within their allowed-input-roles. Returns an\n\t\tempty list rather than throwing when the viewer lacks visibility, so\n\t\tbatched identity queries do not abort on a single forbidden target.\n\t\t\"\"\"\n\t\tsessions: [SessionInfo!]!\n\t}\n\n\t\"\"\"\n\tWhat the identity may do tenant-wide, evaluated against the same ACL the resolvers enforce.\n\n\tThis is for building a UI that does not offer what it cannot deliver — it is **not** a security\n\tboundary, and answering \\`true\\` here grants nothing. Every operation is still checked when it is\n\tcalled. The distinction matters because permission failure is not uniform across this API: some\n\tqueries answer an empty list, others throw, and every mutation throws, so a client cannot tell\n\t\"nothing to show\" from \"not yours to see\" by trying.\n\t\"\"\"\n\ttype IdentityGlobalPermissions {\n\t\tcanCreateProject: Boolean!\n\t\tcanDeployEntrypoint: Boolean!\n\t\t\"\"\" Read \\`configuration\\`, which throws otherwise. The other configuration queries gate on their own actions. \"\"\"\n\t\tcanViewConfiguration: Boolean!\n\t\t\"\"\" Read \\`identityProviders\\`. \"\"\"\n\t\tcanListIdentityProviders: Boolean!\n\t\t\"\"\" Read \\`mailTemplates\\`. \"\"\"\n\t\tcanListMailTemplates: Boolean!\n\t\t\"\"\"\n\t\tWrite the tenant configuration (\\`configure\\`) and read \\`authPolicies\\`. The CLI is the usual write path.\n\t\t\"\"\"\n\t\tcanManageConfiguration: Boolean!\n\t\t\"\"\" Read \\`authLog\\`, which throws otherwise. \"\"\"\n\t\tcanViewAuthLog: Boolean!\n\t\t\"\"\"\n\t\tList every person in the tenant. Without it \\`persons\\` still answers, narrowed to the members\n\t\tof the projects the caller administers — so this marks a full listing, not access to one.\n\t\t\"\"\"\n\t\tcanListPersons: Boolean!\n\t\t\"\"\" Read \\`globalApiKeys\\`, which answers an empty list otherwise. \"\"\"\n\t\tcanListGlobalApiKeys: Boolean!\n\t\tcanCreateGlobalApiKey: Boolean!\n\t}\n\n\t\"\"\"\n\tWhat the calling identity may do in this project. Same contract as\n\t\\`IdentityGlobalPermissions\\`: advisory, evaluated per caller, never a substitute for the checks in\n\tthe resolvers.\n\t\"\"\"\n\ttype ProjectPermissions {\n\t\t\"\"\" Read \\`members\\` and \\`apiKeys\\`; both answer an empty list otherwise. \"\"\"\n\t\tcanViewMembers: Boolean!\n\t\t\"\"\" Invite or add a member (\\`invite\\`, \\`addProjectMember\\`). Which roles may be granted is checked per membership. \"\"\"\n\t\tcanAddMember: Boolean!\n\t\tcanUpdateMember: Boolean!\n\t\tcanRemoveMember: Boolean!\n\t\t\"\"\" Read \\`secrets\\` (their names, never values); answers an empty list otherwise. \"\"\"\n\t\tcanViewSecrets: Boolean!\n\t\t\"\"\" Write a project secret (\\`setProjectSecret\\`). Distinct from viewing: a project admin commonly has one and not the other. \"\"\"\n\t\tcanSetSecret: Boolean!\n\t\t\"\"\" Create an API key scoped to this project. \"\"\"\n\t\tcanCreateApiKey: Boolean!\n\t\t\"\"\" Update the project itself (\\`updateProject\\`). \"\"\"\n\t\tcanUpdate: Boolean!\n\t}\n\n\ttype IdentityProjectRelation {\n\t\tproject: Project!\n\t\tmemberships: [Membership!]!\n\t}\n\n\t# === project ===\n\n\ttype Project {\n\t\tid: String!\n\t\tname: String!\n\t\tslug: String!\n\t\tconfig: Json!\n\t\troles: [RoleDefinition!]!\n\t\tmembers(\n\t\t\tinput: ProjectMembersInput,\n\t\t\tmemberType: MemberType @deprecated(reason: \"Use args\")\n\t\t): [ProjectIdentityRelation!]!\n\t\t\"\"\"\n\t\tPermanent API keys scoped to this project — keys whose identity is a member\n\t\tof the project (excludes SESSION tokens and global keys). Each key's\n\t\tproject memberships are reachable via \\`apiKey.identity.projects\\` for\n\t\tcloning when (re)issuing a key. Requires \\`project.view members\\` permission;\n\t\treturns an empty list otherwise.\n\t\t\"\"\"\n\t\tapiKeys: [ApiKey!]!\n\t\t\"\"\"\n\t\tNames of the project's secrets (see \\`setProjectSecret\\`). Secret VALUES are\n\t\tnever returned — only the keys and their timestamps — so a UI can show which\n\t\tsecrets exist. Requires the \\`project:viewSecrets\\` permission (project admins\n\t\t+ SUPER_ADMIN by default); returns an empty list otherwise.\n\t\t\"\"\"\n\t\tsecrets: [ProjectSecretInfo!]!\n\t\t\"\"\" What the calling identity may do here. Advisory — for building the UI, not for enforcing it. \"\"\"\n\t\tpermissions: ProjectPermissions!\n\t}\n\n\t\"\"\" Metadata about a project secret — never its value. \"\"\"\n\ttype ProjectSecretInfo {\n\t\tkey: String!\n\t\tcreatedAt: DateTime!\n\t\tupdatedAt: DateTime!\n\t}\n\n\tinput ProjectMembersInput {\n\t\tlimit: Int\n\t\toffset: Int\n\t\tfilter: ProjectMembersFilter\n\t}\n\n\tinput ProjectMembersFilter {\n\t\tmemberType: MemberType\n\t\temail: [String!]\n\t\tidentityId: [String!]\n\t\tpersonId: [String!]\n\t}\n\n\tenum MemberType {\n\t\tAPI_KEY\n\t\tPERSON\n\t}\n\n\ttype ProjectIdentityRelation {\n\t\tidentity: Identity!\n\t\tmemberships: [Membership!]!\n\t}\n\n\ttype RoleDefinition {\n\t\tname: String!\n\t\tvariables: [RoleVariableDefinition!]!\n\t}\n\n\tinterface RoleVariableDefinition {\n\t\tname: String!\n\t}\n\n\ttype RoleEntityVariableDefinition implements RoleVariableDefinition {\n\t\tname: String!\n\t\tentityName: String!\n\t}\n\n\ttype RolePredefinedVariableDefinition implements RoleVariableDefinition {\n\t\tname: String!\n\t\tvalue: String!\n\t}\n\n\ttype RoleConditionVariableDefinition implements RoleVariableDefinition {\n\t\tname: String!\n\t}\n\n\t# ==== 2fa ====\n\n\ttype PrepareOtpResponse {\n\t\tok: Boolean!\n\t\tresult: PrepareOtpResult\n\t}\n\n\ttype PrepareOtpResult {\n\t\totpUri: String!\n\t\totpSecret: String!\n\t}\n\n\ttype ConfirmOtpResponse {\n\t\tok: Boolean!\n\t\terrors: [ConfirmOtpError!]! @deprecated\n\t\terror: ConfirmOtpError\n\t\tresult: ConfirmOtpResult\n\t}\n\n\ttype ConfirmOtpResult {\n\t\tbackupCodes: [String!]!\n\t}\n\n\ttype ConfirmOtpError {\n\t\tcode: ConfirmOtpErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum ConfirmOtpErrorCode {\n\t\tINVALID_OTP_TOKEN\n\t\tNOT_PREPARED\n\t}\n\n\ttype DisableOtpResponse {\n\t\tok: Boolean!\n\t\terrors: [DisableOtpError!]! @deprecated\n\t\terror: DisableOtpError\n\t}\n\n\ttype DisableOtpError {\n\t\tcode: DisableOtpErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum DisableOtpErrorCode {\n\t\tOTP_NOT_ACTIVE\n\t\tMFA_REQUIRED\n\t}\n\n\ttype RegenerateBackupCodesResponse {\n\t\tok: Boolean!\n\t\terror: RegenerateBackupCodesError\n\t\tresult: RegenerateBackupCodesResult\n\t}\n\n\ttype RegenerateBackupCodesError {\n\t\tcode: RegenerateBackupCodesErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum RegenerateBackupCodesErrorCode {\n\t\tOTP_NOT_ACTIVE\n\t}\n\n\ttype RegenerateBackupCodesResult {\n\t\tbackupCodes: [String!]!\n\t}\n\n\t# ==== email otp (A05) ====\n\n\ttype InitEmailOtpResponse {\n\t\tok: Boolean!\n\t\terror: InitEmailOtpError\n\t}\n\n\ttype InitEmailOtpError {\n\t\tcode: InitEmailOtpErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum InitEmailOtpErrorCode {\n\t\tNO_EMAIL\n\t\tRATE_LIMITED\n\t}\n\n\ttype ConfirmEmailOtpResponse {\n\t\tok: Boolean!\n\t\terror: ConfirmEmailOtpError\n\t\tresult: ConfirmEmailOtpResult\n\t}\n\n\ttype ConfirmEmailOtpResult {\n\t\tbackupCodes: [String!]!\n\t}\n\n\ttype ConfirmEmailOtpError {\n\t\tcode: ConfirmEmailOtpErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum ConfirmEmailOtpErrorCode {\n\t\tINVALID_OTP_TOKEN\n\t}\n\n\ttype DisableEmailOtpResponse {\n\t\tok: Boolean!\n\t\terror: DisableEmailOtpError\n\t}\n\n\ttype DisableEmailOtpError {\n\t\tcode: DisableEmailOtpErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum DisableEmailOtpErrorCode {\n\t\tEMAIL_OTP_NOT_ACTIVE\n\t\tMFA_REQUIRED\n\t}\n\n\ttype DisablePersonResponse {\n\t\tok: Boolean!\n\t\terror: DisablePersonError\n\t}\n\n\ttype DisablePersonError {\n\t\tcode: DisablePersonErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum DisablePersonErrorCode {\n\t\tPERSON_ALREADY_DISABLED\n\t\tPERSON_NOT_FOUND\n\t}\n\n\t# === enablePerson ===\n\n\ttype EnablePersonResponse {\n\t\tok: Boolean!\n\t\terror: EnablePersonError\n\t}\n\n\ttype EnablePersonError {\n\t\tcode: EnablePersonErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum EnablePersonErrorCode {\n\t\tPERSON_ALREADY_ENABLED\n\t\tPERSON_NOT_FOUND\n\t}\n\n\t# === forceSignOutPerson ===\n\n\ttype ForceSignOutPersonResponse {\n\t\tok: Boolean!\n\t\terror: ForceSignOutPersonError\n\t}\n\n\ttype ForceSignOutPersonError {\n\t\tcode: ForceSignOutPersonErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum ForceSignOutPersonErrorCode {\n\t\tPERSON_NOT_FOUND\n\t}\n\n\t# === resetPersonMfa ===\n\n\ttype ResetPersonMfaResponse {\n\t\tok: Boolean!\n\t\terror: ResetPersonMfaError\n\t}\n\n\ttype ResetPersonMfaError {\n\t\tcode: ResetPersonMfaErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum ResetPersonMfaErrorCode {\n\t\tPERSON_NOT_FOUND\n\t}\n\n\t# === auth policy (per-role MFA / session policy) ===\n\n\ttype AuthPolicy {\n\t\tid: String!\n\t\tscope: AuthPolicyScope!\n\t\t\"\"\"Project slug, present only for project-scoped policies.\"\"\"\n\t\tproject: String\n\t\troles: [String!]!\n\t\tmfaRequired: Boolean\n\t\ttokenExpiration: Interval\n\t\tidleTimeout: Interval\n\t\tmfaGraceDuration: Interval\n\t\trememberMeAllowed: Boolean\n\t}\n\n\tenum AuthPolicyScope {\n\t\tglobal\n\t\tproject\n\t}\n\n\tinput AuthPolicyInput {\n\t\tscope: AuthPolicyScope!\n\t\t\"\"\"Project slug. Required for scope=project, forbidden for scope=global.\"\"\"\n\t\tproject: String\n\t\troles: [String!]!\n\t\tmfaRequired: Boolean\n\t\ttokenExpiration: Interval\n\t\tidleTimeout: Interval\n\t\tmfaGraceDuration: Interval\n\t\trememberMeAllowed: Boolean\n\t}\n\n\ttype CreateAuthPolicyResponse {\n\t\tok: Boolean!\n\t\terror: CreateAuthPolicyError\n\t\tresult: CreateAuthPolicyResult\n\t}\n\n\ttype CreateAuthPolicyResult {\n\t\tid: String!\n\t}\n\n\ttype CreateAuthPolicyError {\n\t\tcode: CreateAuthPolicyErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum CreateAuthPolicyErrorCode {\n\t\tPROJECT_REQUIRED\n\t\tPROJECT_NOT_ALLOWED\n\t\tPROJECT_NOT_FOUND\n\t}\n\n\ttype UpdateAuthPolicyResponse {\n\t\tok: Boolean!\n\t\terror: UpdateAuthPolicyError\n\t}\n\n\ttype UpdateAuthPolicyError {\n\t\tcode: UpdateAuthPolicyErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum UpdateAuthPolicyErrorCode {\n\t\tNOT_FOUND\n\t\tPROJECT_REQUIRED\n\t\tPROJECT_NOT_ALLOWED\n\t\tPROJECT_NOT_FOUND\n\t}\n\n\ttype DeleteAuthPolicyResponse {\n\t\tok: Boolean!\n\t\terror: DeleteAuthPolicyError\n\t}\n\n\ttype DeleteAuthPolicyError {\n\t\tcode: DeleteAuthPolicyErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum DeleteAuthPolicyErrorCode {\n\t\tNOT_FOUND\n\t}\n\n\t# === sessions ===\n\n\ttype SessionInfo {\n\t\tid: String!\n\t\tcreatedAt: DateTime!\n\t\texpiresAt: DateTime\n\t\tlastUsedAt: DateTime\n\t\tlastIp: String\n\t\tlastUserAgent: String\n\t\tcreatedIp: String\n\t\tcreatedUserAgent: String\n\t\tisCurrent: Boolean!\n\t\t\"\"\"\n\t\tWhether this session honors X-Contember-Client-IP /\n\t\tX-Contember-Client-User-Agent headers on subsequent requests. Set when\n\t\tthe session was minted via \\`SignInOptions.trustForwardedClientInfo\\`\n\t\tfrom an api_key that was itself created with the flag.\n\t\t\"\"\"\n\t\ttrustForwardedClientInfo: Boolean!\n\t}\n\n\ttype RevokeSessionResponse {\n\t\tok: Boolean!\n\t\terror: RevokeSessionError\n\t}\n\n\ttype RevokeSessionError {\n\t\tcode: RevokeSessionErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum RevokeSessionErrorCode {\n\t\tSESSION_NOT_FOUND\n\t\tNOT_A_PERSON\n\t}\n\n\t# === mails ===\n\t\n\ttype MailTemplateData {\n\t\tprojectSlug: String\n\t\ttype: MailType!\n\t\tvariant: String\n\t\tsubject: String!\n\t\tcontent: String!\n\t\tuseLayout: Boolean!\n\t\treplyTo: String\n\t}\n\t\n\tinput MailTemplate {\n\t\tprojectSlug: String\n\t\ttype: MailType!\n\t\t\"Custom mail variant identifier, e.g. a locale.\"\n\t\tvariant: String\n\t\tsubject: String!\n\t\tcontent: String!\n\t\tuseLayout: Boolean\n\t\treplyTo: String\n\t}\n\n\tenum MailType {\n\t\tEXISTING_USER_INVITED\n\t\tNEW_USER_INVITED\n\t\tRESET_PASSWORD_REQUEST\n\t\tPASSWORDLESS_SIGN_IN\n\t\tFORCED_SIGN_OUT\n\t\tEMAIL_OTP\n\t\tBACKUP_CODES_EXHAUSTED\n\t\tEMAIL_VERIFICATION\n\t\tEMAIL_CHANGE_VERIFY\n\t\tEMAIL_CHANGE_NOTIFY\n\t\tUNUSUAL_LOGIN\n\t}\n\n\tinput MailTemplateIdentifier {\n\t\tprojectSlug: String\n\t\ttype: MailType!\n\t\tvariant: String\n\t}\n\n\ttype AddMailTemplateResponse {\n\t\tok: Boolean!\n\t\terrors: [AddMailTemplateError!]! @deprecated\n\t\terror: AddMailTemplateError\n\t}\n\n\ttype AddMailTemplateError {\n\t\tcode: AddMailTemplateErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum AddMailTemplateErrorCode {\n\t\tMISSING_VARIABLE\n\t\tPROJECT_NOT_FOUND\n\t\tINVALID_REPLY_EMAIL_FORMAT\n\t}\n\n\ttype RemoveMailTemplateResponse {\n\t\tok: Boolean!\n\t\terrors: [RemoveMailTemplateError!]!\n\t\terror: RemoveMailTemplateError\n\t}\n\n\ttype RemoveMailTemplateError {\n\t\tcode: RemoveMailTemplateErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum RemoveMailTemplateErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t\tTEMPLATE_NOT_FOUND\n\t}\n\n\t# === password reset ===\n\n\ttype CheckResetPasswordTokenResult {\n\t\tcode: CheckResetPasswordTokenCode!\n\t}\n\n\tenum CheckResetPasswordTokenCode {\n\t\tREQUEST_NOT_FOUND\n\t\tTOKEN_NOT_FOUND\n\t\tTOKEN_INVALID\n\t\tTOKEN_USED\n\t\tTOKEN_EXPIRED\n\t}\n\n\ttype CreatePasswordResetRequestResponse {\n\t\tok: Boolean!\n\t\terrors: [CreatePasswordResetRequestError!]! @deprecated\n\t\terror: CreatePasswordResetRequestError\n\t}\n\n\ttype CreatePasswordResetRequestError {\n\t\tcode: CreatePasswordResetRequestErrorCode!\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum CreatePasswordResetRequestErrorCode {\n\t\tPERSON_NOT_FOUND\n\t\tINVALID_CAPTCHA\n\t\tRATE_LIMIT_EXCEEDED\n\t}\n\n\ttype ResetPasswordResponse {\n\t\tok: Boolean!\n\t\terrors: [ResetPasswordError!]! @deprecated\n\t\terror: ResetPasswordError\n\t}\n\ttype ResetPasswordError {\n\t\tcode: ResetPasswordErrorCode!\n        weakPasswordReasons: [WeakPasswordReason!]\n\t\tdeveloperMessage: String!\n\t\tendUserMessage: String @deprecated\n\t}\n\n\tenum ResetPasswordErrorCode {\n\t\tTOKEN_NOT_FOUND\n\t\tTOKEN_INVALID\n\t\tTOKEN_USED\n\t\tTOKEN_EXPIRED\n\n\t\tPASSWORD_TOO_WEAK\n\t}\n\n\tinput CreateResetPasswordRequestOptions {\n\t\tmailProject: String\n\t\tmailVariant: String\n\t}\n\n\t# === email verification ===\n\n\tinput EmailVerificationOptions {\n\t\tmailProject: String\n\t\tmailVariant: String\n\t}\n\n\ttype RequestEmailVerificationResponse {\n\t\tok: Boolean!\n\t\terror: RequestEmailVerificationError\n\t}\n\n\ttype RequestEmailVerificationError {\n\t\tcode: RequestEmailVerificationErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum RequestEmailVerificationErrorCode {\n\t\tRATE_LIMIT_EXCEEDED\n\t\tINVALID_CAPTCHA\n\t}\n\n\ttype VerifyEmailResponse {\n\t\tok: Boolean!\n\t\terror: VerifyEmailError\n\t}\n\n\ttype VerifyEmailError {\n\t\tcode: VerifyEmailErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum VerifyEmailErrorCode {\n\t\tTOKEN_NOT_FOUND\n\t\tTOKEN_INVALID\n\t\tTOKEN_USED\n\t\tTOKEN_EXPIRED\n\t}\n\n\ttype ConfirmEmailChangeResponse {\n\t\tok: Boolean!\n\t\terror: ConfirmEmailChangeError\n\t}\n\n\ttype ConfirmEmailChangeError {\n\t\tcode: ConfirmEmailChangeErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum ConfirmEmailChangeErrorCode {\n\t\tTOKEN_NOT_FOUND\n\t\tTOKEN_INVALID\n\t\tTOKEN_USED\n\t\tTOKEN_EXPIRED\n\t\tEMAIL_ALREADY_EXISTS\n\t\tINVALID_EMAIL_FORMAT\n\t}\n\n\t# === project ===\n\n\tinput ProjectSecret {\n\t\tkey: String!\n\t\tvalue: String!\n\t}\n\n\tinput CreateProjectOptions {\n\t\tdeployTokenHash: String\n\t\tnoDeployToken: Boolean\n\t}\n\n\ttype CreateProjectResponse {\n\t\tok: Boolean!\n\t\terror: CreateProjectResponseError\n\t\tresult: CreateProjectResult\n\t}\n\n\ttype CreateProjectResponseError {\n\t\tcode: CreateProjectResponseErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\ttype CreateProjectResult {\n\t\tdeployerApiKey: ApiKeyWithToken\n\t}\n\n\tenum CreateProjectResponseErrorCode {\n\t\tALREADY_EXISTS\n\t\tINIT_ERROR\n\t}\n\n\ttype SetProjectSecretResponse {\n\t\tok: Boolean!\n\t\terror: SetProjectSecretError\n\t}\n\n\ttype SetProjectSecretError {\n\t\tcode: SetProjectSecretErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum SetProjectSecretErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t}\n\n\ttype UpdateProjectResponse {\n\t\tok: Boolean!\n\t\terror: UpdateProjectError\n\t}\n\n\ttype UpdateProjectError {\n\t\tcode: UpdateProjectErrorCode!\n\t\tdeveloperMessage: String!\n\t}\n\n\tenum UpdateProjectErrorCode {\n\t\tPROJECT_NOT_FOUND\n\t}\n\n\t# === auth log ===\n\n\t\"\"\"\n\tA single \\`person_auth_log\\` row. Mirrors the columns described in\n\tdocs/.../audit-log.md.\n\t\"\"\"\n\ttype AuthLogEntry {\n\t\tid: String!\n\t\tcreatedAt: DateTime!\n\t\t\"\"\"\n\t\tOne of the values listed in \\`auth_log_type\\` (see audit-log docs).\n\t\tKept as String rather than a GraphQL enum because a few legacy values\n\t\t(\\`2fa_enable\\`, \\`2fa_disable\\`) start with a digit and aren't valid\n\t\tenum names, and the set is expected to keep growing.\n\t\t\"\"\"\n\t\ttype: String!\n\t\tsuccess: Boolean!\n\t\t\"\"\"\n\t\tIdentity that performed the action. May be null for entries created\n\t\tbefore this column was populated, or when the actor's identity was\n\t\tlater deleted (FK is ON DELETE SET NULL semantics-wise).\n\t\t\"\"\"\n\t\tinvokedByIdentityId: String\n\t\t\"\"\"\n\t\tThe actor's person (if the actor was a person, not a bare api_key).\n\t\t\"\"\"\n\t\tpersonId: String\n\t\t\"\"\"\n\t\tThe subject of the action when different from the actor (e.g. force\n\t\tsign-out, role grant, membership change). Resolved from the affected\n\t\tidentity so the trail points at the right person even when the actor\n\t\tacts on someone else's identity.\n\t\t\"\"\"\n\t\ttargetPersonId: String\n\t\t\"\"\"\n\t\tFree-form input string — typically the email submitted on a failed\n\t\tlogin, before any person record was looked up.\n\t\t\"\"\"\n\t\tpersonInputIdentifier: String\n\t\terrorCode: String\n\t\terrorMessage: String\n\t\t\"\"\"\n\t\tEffective client IP after \\`trust-forwarded-info\\` is applied. The\n\t\traw socket peer is preserved in \\`metadata.forwarderIp\\` when a\n\t\ttrusted proxy was involved.\n\t\t\"\"\"\n\t\tipAddress: String\n\t\tuserAgent: String\n\t\tidentityProviderId: String\n\t\t\"\"\"\n\t\tJSONB — forensic context. Common keys: \\`forwarderIp\\`,\n\t\t\\`forwarderUserAgent\\`, \\`sessionId\\`, \\`reason\\`.\n\t\t\"\"\"\n\t\tmetadata: Json\n\t\t\"\"\"\n\t\tJSONB — domain payload. For change events this is typically\n\t\t\\`{before, after}\\`; for creation events it's the snapshot.\n\t\tSecret-bearing inputs are redacted before being stored.\n\t\t\"\"\"\n\t\teventData: Json\n\t}\n\n\t\"\"\"\n\tAll fields are AND-combined. Omitted fields are unconstrained.\n\t\"\"\"\n\tinput AuthLogFilter {\n\t\t\"OR-combined: any of the listed \\`auth_log_type\\` values matches.\"\n\t\ttypes: [String!]\n\t\tsuccess: Boolean\n\t\tinvokedByIdentityId: String\n\t\tpersonId: String\n\t\ttargetPersonId: String\n\t\tpersonInputIdentifier: String\n\t\t\"Inclusive lower bound (\\`created_at >= createdAfter\\`).\"\n\t\tcreatedAfter: DateTime\n\t\t\"Exclusive upper bound (\\`created_at < createdBefore\\`).\"\n\t\tcreatedBefore: DateTime\n\t}\n\n\ttype AuthLogPage {\n\t\tentries: [AuthLogEntry!]!\n\t\t\"True when more rows exist past \\`offset + limit\\`.\"\n\t\thasMore: Boolean!\n\t}\n`\n\nexport default schema\n"],"names":["gql"],"mappings":";;AAGA,MAAM,SAAuBA,WAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;AAAAA;;"}

package/dist/development/src/schema/tenant.graphql.js

@@ -117,6 +117,7 @@ const schema = gql`
 		disableEmailOtp: DisableEmailOtpResponse
 
 		disablePerson(personId: String!): DisablePersonResponse
+		enablePerson(personId: String!): EnablePersonResponse
 		forceSignOutPerson(personId: String!, reason: String): ForceSignOutPersonResponse
 		resetPersonMfa(personId: String!): ResetPersonMfaResponse
 		revokeSession(sessionId: String!): RevokeSessionResponse
@@ -199,6 +200,7 @@ const schema = gql`
 		login: ConfigLogin!
 		captcha: ConfigCaptcha!
 		rateLimits: ConfigRateLimits!
+		panel: ConfigPanel!
 	}
 
 	type ConfigSignup {
@@ -332,6 +334,21 @@ const schema = gql`
 		window: Interval!
 	}
 
+	"""
+	Who may enter the management panel. This is an entry gate for the console
+	only, not an authorization system: everything done inside the panel still
+	goes through the tenant ACL, so being allowed in grants no extra rights.
+	An identity may enter when its global roles intersect globalRoles, or when
+	it holds a membership with one of projectRoles in at least one project.
+	Both lists empty means nobody can enter.
+	"""
+	type ConfigPanel {
+		"""Global roles (identity.roles) that may use the management panel."""
+		globalRoles: [String!]!
+		"""Project membership roles that may use the management panel, in any project."""
+		projectRoles: [String!]!
+	}
+
 	input ConfigInput {
 		signup: ConfigSignupInput
 		emailChange: ConfigEmailChangeInput
@@ -340,6 +357,7 @@ const schema = gql`
 		login: ConfigLoginInput
 		captcha: ConfigCaptchaInput
 		rateLimits: ConfigRateLimitsInput
+		panel: ConfigPanelInput
 	}
 
 	input ConfigSignupInput {
@@ -424,6 +442,15 @@ const schema = gql`
 		limit: Int
 		window: Interval
 	}
+
+	"""
+	Each list is replaced as a whole; omitting one leaves it unchanged. An empty
+	list closes the panel for that dimension.
+	"""
+	input ConfigPanelInput {
+		globalRoles: [String!]
+		projectRoles: [String!]
+	}
 	
 	type ConfigureResponse {
 		ok: Boolean!
@@ -1233,8 +1260,22 @@ const schema = gql`
 		email: String
 		name: String
 		otpEnabled: Boolean!
+		""" The person's own opt-in flag; \`null\` means "follow the tenant policy". On its own it does not say whether passwordless sign-in works — see \`passwordlessAvailable\`. """
 		passwordlessEnabled: Boolean
 		"""
+		Whether passwordless sign-in is actually usable for this person right now: the tenant-wide
+		policy resolved against \`passwordlessEnabled\`, i.e. the very same decision \`signIn\` makes. A UI
+		offering an enable/disable toggle must branch on this — under an \`always\` or \`never\` policy the
+		raw opt-in flag says nothing about what will happen.
+		"""
+		passwordlessAvailable: Boolean!
+		"""
+		Whether \`passwordlessEnabled\` is what decides \`passwordlessAvailable\`. False under an \`always\`
+		or \`never\` policy, where the person's own flag is ignored — a UI should then report the state
+		rather than offer a toggle that changes nothing.
+		"""
+		passwordlessSelfManaged: Boolean!
+		"""
 		Whether e-mail based one-time-password 2FA is enabled for this person
 		(see \`initEmailOtp\` / \`confirmEmailOtp\` / \`disableEmailOtp\`). Independent
 		of \`otpEnabled\` (TOTP authenticator), so a UI can show each MFA method's
@@ -1242,6 +1283,11 @@ const schema = gql`
 		"""
 		emailOtpEnabled: Boolean!
 		emailVerified: Boolean!
+		"""
+		When the account was disabled (see \`disablePerson\`), null while the person
+		is active. Read-only — flip it with \`disablePerson\` / \`enablePerson\`.
+		"""
+		disabledAt: DateTime
 		identity: Identity!
 
 		"""
@@ -1311,9 +1357,60 @@ const schema = gql`
 		sessions: [SessionInfo!]!
 	}
 
+	"""
+	What the identity may do tenant-wide, evaluated against the same ACL the resolvers enforce.
+
+	This is for building a UI that does not offer what it cannot deliver — it is **not** a security
+	boundary, and answering \`true\` here grants nothing. Every operation is still checked when it is
+	called. The distinction matters because permission failure is not uniform across this API: some
+	queries answer an empty list, others throw, and every mutation throws, so a client cannot tell
+	"nothing to show" from "not yours to see" by trying.
+	"""
 	type IdentityGlobalPermissions {
 		canCreateProject: Boolean!
 		canDeployEntrypoint: Boolean!
+		""" Read \`configuration\`, which throws otherwise. The other configuration queries gate on their own actions. """
+		canViewConfiguration: Boolean!
+		""" Read \`identityProviders\`. """
+		canListIdentityProviders: Boolean!
+		""" Read \`mailTemplates\`. """
+		canListMailTemplates: Boolean!
+		"""
+		Write the tenant configuration (\`configure\`) and read \`authPolicies\`. The CLI is the usual write path.
+		"""
+		canManageConfiguration: Boolean!
+		""" Read \`authLog\`, which throws otherwise. """
+		canViewAuthLog: Boolean!
+		"""
+		List every person in the tenant. Without it \`persons\` still answers, narrowed to the members
+		of the projects the caller administers — so this marks a full listing, not access to one.
+		"""
+		canListPersons: Boolean!
+		""" Read \`globalApiKeys\`, which answers an empty list otherwise. """
+		canListGlobalApiKeys: Boolean!
+		canCreateGlobalApiKey: Boolean!
+	}
+
+	"""
+	What the calling identity may do in this project. Same contract as
+	\`IdentityGlobalPermissions\`: advisory, evaluated per caller, never a substitute for the checks in
+	the resolvers.
+	"""
+	type ProjectPermissions {
+		""" Read \`members\` and \`apiKeys\`; both answer an empty list otherwise. """
+		canViewMembers: Boolean!
+		""" Invite or add a member (\`invite\`, \`addProjectMember\`). Which roles may be granted is checked per membership. """
+		canAddMember: Boolean!
+		canUpdateMember: Boolean!
+		canRemoveMember: Boolean!
+		""" Read \`secrets\` (their names, never values); answers an empty list otherwise. """
+		canViewSecrets: Boolean!
+		""" Write a project secret (\`setProjectSecret\`). Distinct from viewing: a project admin commonly has one and not the other. """
+		canSetSecret: Boolean!
+		""" Create an API key scoped to this project. """
+		canCreateApiKey: Boolean!
+		""" Update the project itself (\`updateProject\`). """
+		canUpdate: Boolean!
 	}
 
 	type IdentityProjectRelation {
@@ -1348,6 +1445,8 @@ const schema = gql`
 		+ SUPER_ADMIN by default); returns an empty list otherwise.
 		"""
 		secrets: [ProjectSecretInfo!]!
+		""" What the calling identity may do here. Advisory — for building the UI, not for enforcing it. """
+		permissions: ProjectPermissions!
 	}
 
 	""" Metadata about a project secret — never its value. """
@@ -1539,6 +1638,23 @@ const schema = gql`
 		PERSON_NOT_FOUND
 	}
 
+	# === enablePerson ===
+
+	type EnablePersonResponse {
+		ok: Boolean!
+		error: EnablePersonError
+	}
+
+	type EnablePersonError {
+		code: EnablePersonErrorCode!
+		developerMessage: String!
+	}
+
+	enum EnablePersonErrorCode {
+		PERSON_ALREADY_ENABLED
+		PERSON_NOT_FOUND
+	}
+
 	# === forceSignOutPerson ===
 
 	type ForceSignOutPersonResponse {