@djangocfg/api 2.1.546 → 2.1.547

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@djangocfg/api",
-  "version": "2.1.546",
+  "version": "2.1.547",
   "description": "Auto-generated TypeScript API client with React hooks, SWR integration, and Zod validation for Django REST Framework backends",
   "keywords": [
     "django",
@@ -85,7 +85,7 @@
     "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@djangocfg/typescript-config": "^2.1.546",
+    "@djangocfg/typescript-config": "^2.1.547",
     "@testing-library/react": "^16.3.2",
     "@types/node": "^25.9.5",
     "@types/react": "19.2.15",

package/src/_api/generated/_cfg_accounts/hooks/index.ts

@@ -21,4 +21,5 @@ export { useCfgAccountsProfileRetrieve } from "./useCfgAccountsProfileRetrieve";
 export { useCfgAccountsProfileUpdatePartialUpdate } from "./useCfgAccountsProfileUpdatePartialUpdate";
 export { useCfgAccountsProfileUpdateUpdate } from "./useCfgAccountsProfileUpdateUpdate";
 export { useCfgAccountsTokenBlacklistCreate } from "./useCfgAccountsTokenBlacklistCreate";
+export { useCfgAccountsTokenCreate } from "./useCfgAccountsTokenCreate";
 export { useCfgAccountsTokenRefreshCreate } from "./useCfgAccountsTokenRefreshCreate";

package/src/_api/generated/_cfg_accounts/hooks/useCfgAccountsTokenCreate.ts

@@ -0,0 +1,64 @@
+'use client';
+
+// AUTO-GENERATED by openapi_processor / ts.hooks
+// POST /cfg/accounts/token/
+// DO NOT EDIT — re-run `make gen`.
+
+import useSWRMutation from "swr/mutation";
+import type { SWRMutationConfiguration } from "swr/mutation";
+import { CfgAccountsAuth } from "../../sdk.gen";
+import type { CfgAccountsTokenCreateData, CfgAccountsTokenCreateResponses } from "../../types.gen";
+import { PasswordLoginResponseSchema } from "../schemas/PasswordLoginResponse";
+
+type Args = Omit<CfgAccountsTokenCreateData, "url">;
+type Result = CfgAccountsTokenCreateResponses[keyof CfgAccountsTokenCreateResponses];
+
+export function useCfgAccountsTokenCreate(
+  config?: SWRMutationConfiguration<Result, Error, readonly ["cfg_accounts_token_create"], Args>,
+) {
+  return useSWRMutation<Result, Error, readonly ["cfg_accounts_token_create"], Args>(
+    ["cfg_accounts_token_create"] as const,
+    async (_key, { arg }: { arg: Args }) => {
+      const res = await CfgAccountsAuth.cfgAccountsTokenCreate({ ...arg, throwOnError: true } as never);
+      const data = res.data as Result;
+      const parsed = PasswordLoginResponseSchema.safeParse(data);
+      if (!parsed.success) {
+        // Log first so the failure is always visible, even if the
+        // event handler swallows it.
+        console.warn(
+          "[zod] response did not match schema",
+          {
+            operation: "cfg_accounts_token_create",
+            method: "POST",
+            path: "/cfg/accounts/token/",
+            issues: parsed.error.issues,
+            data,
+          },
+        );
+        if (typeof window !== "undefined") {
+          try {
+            window.dispatchEvent(
+              new CustomEvent("zod-validation-error", {
+                detail: {
+                  operation: "cfg_accounts_token_create",
+                  method: "POST",
+                  path: "/cfg/accounts/token/",
+                  issues: parsed.error.issues,
+                  data,
+                  timestamp: new Date(),
+                },
+                bubbles: true,
+                cancelable: false,
+              }),
+            );
+          } catch {
+            // Event dispatch is best-effort.
+          }
+        }
+        return data;
+      }
+      return parsed.data as unknown as Result;
+    },
+    config,
+  );
+}

package/src/_api/generated/_cfg_accounts/openapi.json

@@ -1071,6 +1071,61 @@
         "x-async-capable": false
       }
     },
+    "/cfg/accounts/token/": {
+      "post": {
+        "operationId": "cfg_accounts_token_create",
+        "description": "Obtain a JWT pair with email + password.\n\nReturns the same envelope as OTP verify: either ``requires_2fa=True`` with\na session id, or the token pair plus the user object. Failures are uniform\n(401 ``invalid_credentials``) whether the email is unknown, the password is\nwrong, or the account is inactive/soft-deleted — no enumeration.",
+        "tags": [
+          "cfg_accounts_auth"
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PasswordLoginRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "security": [
+          {}
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PasswordLoginResponse"
+                }
+              }
+            },
+            "description": ""
+          },
+          "401": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PasswordLoginError"
+                }
+              }
+            },
+            "description": ""
+          },
+          "429": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PasswordLoginError"
+                }
+              }
+            },
+            "description": ""
+          }
+        },
+        "x-async-capable": false
+      }
+    },
     "/cfg/accounts/token/blacklist/": {
       "post": {
         "operationId": "cfg_accounts_token_blacklist_create",
@@ -1763,6 +1818,108 @@
           }
         }
       },
+      "PasswordLoginError": {
+        "type": "object",
+        "description": "Typed error response for password login.\n\nerror_code values:\n  - invalid_credentials — wrong email/password, inactive or deleted account\n  - rate_limited        — IP rate limit hit\n  - locked_out          — too many failed attempts for this email",
+        "properties": {
+          "error": {
+            "type": "string",
+            "description": "Human-readable error message"
+          },
+          "error_code": {
+            "type": "string",
+            "description": "Machine-readable error code"
+          },
+          "retry_after": {
+            "type": [
+              "integer",
+              "null"
+            ],
+            "description": "Seconds until the caller may retry (throttled responses only)"
+          }
+        },
+        "required": [
+          "error",
+          "error_code"
+        ]
+      },
+      "PasswordLoginRequest": {
+        "type": "object",
+        "description": "Validate email+password against live accounts only.\n\nSubclasses SimpleJWT so the field/validation contract stays theirs, but\nreplaces ``validate()`` — the token pair itself is minted by the view via\n``mint_tokens_for_request`` so the DPoP binding and remembered-session\nlifetime match OTP, OAuth and TOTP exactly.",
+        "properties": {
+          "remember_me": {
+            "type": "boolean",
+            "default": false,
+            "description": "Keep this browser signed in for 30 days"
+          },
+          "email": {
+            "type": "string",
+            "format": "email",
+            "writeOnly": true,
+            "minLength": 1
+          },
+          "password": {
+            "type": "string",
+            "writeOnly": true
+          }
+        },
+        "required": [
+          "email",
+          "password"
+        ]
+      },
+      "PasswordLoginResponse": {
+        "type": "object",
+        "description": "Password-login response.\n\nMirrors the OTP verify response so a client can treat every login flow\nidentically. ``requires_2fa=True`` carries a session id instead of tokens.",
+        "properties": {
+          "requires_2fa": {
+            "type": "boolean",
+            "default": false,
+            "description": "Whether 2FA verification is required"
+          },
+          "session_id": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "format": "uuid",
+            "description": "2FA session ID (if requires_2fa is True)"
+          },
+          "refresh": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "description": "JWT refresh token (if requires_2fa is False)"
+          },
+          "access": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "description": "JWT access token (if requires_2fa is False)"
+          },
+          "user": {
+            "oneOf": [
+              {
+                "$ref": "#/components/schemas/User"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "User information (if requires_2fa is False)"
+          },
+          "should_prompt_2fa": {
+            "type": "boolean",
+            "description": "Whether user should be prompted to enable 2FA"
+          },
+          "persistent_session": {
+            "type": "boolean",
+            "description": "Whether this login should persist across browser restarts"
+          }
+        }
+      },
       "PatchedCfgUserUpdateRequest": {
         "type": "object",
         "description": "Serializer for updating user profile.",

package/src/_api/generated/_cfg_accounts/schemas/PasswordLoginError.ts

@@ -0,0 +1,13 @@
+// AUTO-GENERATED by cmdop_server / devtools.generator.ts_extras
+// Source: OpenAPI 3.1 components.schemas
+// DO NOT EDIT — re-run `make gen-clients`.
+
+import { z } from "zod";
+
+export const PasswordLoginErrorSchema = z.object({
+  error: z.string(),
+  error_code: z.string(),
+  retry_after: z.number().int().nullable().optional(),
+});
+
+export type PasswordLoginError = z.infer<typeof PasswordLoginErrorSchema>;

package/src/_api/generated/_cfg_accounts/schemas/PasswordLoginRequest.ts

@@ -0,0 +1,13 @@
+// AUTO-GENERATED by cmdop_server / devtools.generator.ts_extras
+// Source: OpenAPI 3.1 components.schemas
+// DO NOT EDIT — re-run `make gen-clients`.
+
+import { z } from "zod";
+
+export const PasswordLoginRequestSchema = z.object({
+  remember_me: z.boolean().default(false).optional(),
+  email: z.email(),
+  password: z.string(),
+});
+
+export type PasswordLoginRequest = z.infer<typeof PasswordLoginRequestSchema>;

package/src/_api/generated/_cfg_accounts/schemas/PasswordLoginResponse.ts

@@ -0,0 +1,18 @@
+// AUTO-GENERATED by cmdop_server / devtools.generator.ts_extras
+// Source: OpenAPI 3.1 components.schemas
+// DO NOT EDIT — re-run `make gen-clients`.
+
+import { z } from "zod";
+import { UserSchema } from "./User";
+
+export const PasswordLoginResponseSchema = z.object({
+  requires_2fa: z.boolean().default(false).optional(),
+  session_id: z.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i).nullable().optional(),
+  refresh: z.string().nullable().optional(),
+  access: z.string().nullable().optional(),
+  user: UserSchema.nullable().optional(),
+  should_prompt_2fa: z.boolean().optional(),
+  persistent_session: z.boolean().optional(),
+});
+
+export type PasswordLoginResponse = z.infer<typeof PasswordLoginResponseSchema>;

package/src/_api/generated/_cfg_accounts/schemas/index.ts

@@ -25,6 +25,9 @@ export * from "./OTPRequestRequest";
 export * from "./OTPRequestResponse";
 export * from "./OTPVerifyRequest";
 export * from "./OTPVerifyResponse";
+export * from "./PasswordLoginError";
+export * from "./PasswordLoginRequest";
+export * from "./PasswordLoginResponse";
 export * from "./PatchedCfgUserUpdateRequest";
 export * from "./TokenBlacklistRequest";
 export * from "./TokenRefresh";

package/src/_api/generated/openapi.json

@@ -1063,6 +1063,61 @@
         "x-async-capable": false
       }
     },
+    "/cfg/accounts/token/": {
+      "post": {
+        "operationId": "cfg_accounts_token_create",
+        "description": "Obtain a JWT pair with email + password.\n\nReturns the same envelope as OTP verify: either ``requires_2fa=True`` with\na session id, or the token pair plus the user object. Failures are uniform\n(401 ``invalid_credentials``) whether the email is unknown, the password is\nwrong, or the account is inactive/soft-deleted — no enumeration.",
+        "tags": [
+          "cfg_accounts_auth"
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PasswordLoginRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "security": [
+          {}
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PasswordLoginResponse"
+                }
+              }
+            },
+            "description": ""
+          },
+          "401": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PasswordLoginError"
+                }
+              }
+            },
+            "description": ""
+          },
+          "429": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PasswordLoginError"
+                }
+              }
+            },
+            "description": ""
+          }
+        },
+        "x-async-capable": false
+      }
+    },
     "/cfg/accounts/token/blacklist/": {
       "post": {
         "operationId": "cfg_accounts_token_blacklist_create",
@@ -2398,6 +2453,108 @@
           }
         }
       },
+      "PasswordLoginError": {
+        "type": "object",
+        "description": "Typed error response for password login.\n\nerror_code values:\n  - invalid_credentials — wrong email/password, inactive or deleted account\n  - rate_limited        — IP rate limit hit\n  - locked_out          — too many failed attempts for this email",
+        "properties": {
+          "error": {
+            "type": "string",
+            "description": "Human-readable error message"
+          },
+          "error_code": {
+            "type": "string",
+            "description": "Machine-readable error code"
+          },
+          "retry_after": {
+            "type": [
+              "integer",
+              "null"
+            ],
+            "description": "Seconds until the caller may retry (throttled responses only)"
+          }
+        },
+        "required": [
+          "error",
+          "error_code"
+        ]
+      },
+      "PasswordLoginRequest": {
+        "type": "object",
+        "description": "Validate email+password against live accounts only.\n\nSubclasses SimpleJWT so the field/validation contract stays theirs, but\nreplaces ``validate()`` — the token pair itself is minted by the view via\n``mint_tokens_for_request`` so the DPoP binding and remembered-session\nlifetime match OTP, OAuth and TOTP exactly.",
+        "properties": {
+          "remember_me": {
+            "type": "boolean",
+            "default": false,
+            "description": "Keep this browser signed in for 30 days"
+          },
+          "email": {
+            "type": "string",
+            "format": "email",
+            "writeOnly": true,
+            "minLength": 1
+          },
+          "password": {
+            "type": "string",
+            "writeOnly": true
+          }
+        },
+        "required": [
+          "email",
+          "password"
+        ]
+      },
+      "PasswordLoginResponse": {
+        "type": "object",
+        "description": "Password-login response.\n\nMirrors the OTP verify response so a client can treat every login flow\nidentically. ``requires_2fa=True`` carries a session id instead of tokens.",
+        "properties": {
+          "requires_2fa": {
+            "type": "boolean",
+            "default": false,
+            "description": "Whether 2FA verification is required"
+          },
+          "session_id": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "format": "uuid",
+            "description": "2FA session ID (if requires_2fa is True)"
+          },
+          "refresh": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "description": "JWT refresh token (if requires_2fa is False)"
+          },
+          "access": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "description": "JWT access token (if requires_2fa is False)"
+          },
+          "user": {
+            "oneOf": [
+              {
+                "$ref": "#/components/schemas/User"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "User information (if requires_2fa is False)"
+          },
+          "should_prompt_2fa": {
+            "type": "boolean",
+            "description": "Whether user should be prompted to enable 2FA"
+          },
+          "persistent_session": {
+            "type": "boolean",
+            "description": "Whether this login should persist across browser restarts"
+          }
+        }
+      },
       "PatchedCfgUserUpdateRequest": {
         "type": "object",
         "description": "Serializer for updating user profile.",

package/src/_api/generated/sdk.gen.ts

@@ -2,7 +2,7 @@
 
 import { type Client, type ClientMeta, formDataBodySerializer, type Options as Options2, type RequestResult, type TDataShape } from './client';
 import { client } from './client.gen';
-import type { CfgAccountsApiKeyRegenerateCreateData, CfgAccountsApiKeyRegenerateCreateErrors, CfgAccountsApiKeyRegenerateCreateResponses, CfgAccountsApiKeyRetrieveData, CfgAccountsApiKeyRetrieveErrors, CfgAccountsApiKeyRetrieveResponses, CfgAccountsApiKeyRevealCreateData, CfgAccountsApiKeyRevealCreateErrors, CfgAccountsApiKeyRevealCreateResponses, CfgAccountsApiKeyTestCreateData, CfgAccountsApiKeyTestCreateResponses, CfgAccountsOauthConnectionsListData, CfgAccountsOauthConnectionsListResponses, CfgAccountsOauthDisconnectCreateData, CfgAccountsOauthDisconnectCreateErrors, CfgAccountsOauthDisconnectCreateResponses, CfgAccountsOauthGithubAuthorizeCreateData, CfgAccountsOauthGithubAuthorizeCreateErrors, CfgAccountsOauthGithubAuthorizeCreateResponses, CfgAccountsOauthGithubCallbackCreateData, CfgAccountsOauthGithubCallbackCreateErrors, CfgAccountsOauthGithubCallbackCreateResponses, CfgAccountsOauthProvidersRetrieveData, CfgAccountsOauthProvidersRetrieveResponses, CfgAccountsOtpConsentPolicyRetrieveData, CfgAccountsOtpConsentPolicyRetrieveResponses, CfgAccountsOtpRequestCreateData, CfgAccountsOtpRequestCreateErrors, CfgAccountsOtpRequestCreateResponses, CfgAccountsOtpVerifyCreateData, CfgAccountsOtpVerifyCreateErrors, CfgAccountsOtpVerifyCreateResponses, CfgAccountsProfileAvatarCreateData, CfgAccountsProfileAvatarCreateErrors, CfgAccountsProfileAvatarCreateResponses, CfgAccountsProfileDeleteCreateData, CfgAccountsProfileDeleteCreateErrors, CfgAccountsProfileDeleteCreateResponses, CfgAccountsProfilePartialPartialUpdateData, CfgAccountsProfilePartialPartialUpdateErrors, CfgAccountsProfilePartialPartialUpdateResponses, CfgAccountsProfilePartialUpdateData, CfgAccountsProfilePartialUpdateErrors, CfgAccountsProfilePartialUpdateResponses, CfgAccountsProfileRetrieveData, CfgAccountsProfileRetrieveErrors, CfgAccountsProfileRetrieveResponses, CfgAccountsProfileUpdatePartialUpdateData, CfgAccountsProfileUpdatePartialUpdateErrors, CfgAccountsProfileUpdatePartialUpdateResponses, CfgAccountsProfileUpdateUpdateData, CfgAccountsProfileUpdateUpdateErrors, CfgAccountsProfileUpdateUpdateResponses, CfgAccountsTokenBlacklistCreateData, CfgAccountsTokenBlacklistCreateResponses, CfgAccountsTokenRefreshCreateData, CfgAccountsTokenRefreshCreateResponses, CfgTotpBackupCodesRegenerateCreateData, CfgTotpBackupCodesRegenerateCreateErrors, CfgTotpBackupCodesRegenerateCreateResponses, CfgTotpBackupCodesRetrieveData, CfgTotpBackupCodesRetrieveResponses, CfgTotpDevicesDestroyData, CfgTotpDevicesDestroyResponses, CfgTotpDevicesRetrieveData, CfgTotpDevicesRetrieveResponses, CfgTotpDisableCreateData, CfgTotpDisableCreateErrors, CfgTotpDisableCreateResponses, CfgTotpSetupConfirmCreateData, CfgTotpSetupConfirmCreateErrors, CfgTotpSetupConfirmCreateResponses, CfgTotpSetupCreateData, CfgTotpSetupCreateErrors, CfgTotpSetupCreateResponses, CfgTotpVerifyBackupCreateData, CfgTotpVerifyBackupCreateErrors, CfgTotpVerifyBackupCreateResponses, CfgTotpVerifyCreateData, CfgTotpVerifyCreateErrors, CfgTotpVerifyCreateResponses } from './types.gen';
+import type { CfgAccountsApiKeyRegenerateCreateData, CfgAccountsApiKeyRegenerateCreateErrors, CfgAccountsApiKeyRegenerateCreateResponses, CfgAccountsApiKeyRetrieveData, CfgAccountsApiKeyRetrieveErrors, CfgAccountsApiKeyRetrieveResponses, CfgAccountsApiKeyRevealCreateData, CfgAccountsApiKeyRevealCreateErrors, CfgAccountsApiKeyRevealCreateResponses, CfgAccountsApiKeyTestCreateData, CfgAccountsApiKeyTestCreateResponses, CfgAccountsOauthConnectionsListData, CfgAccountsOauthConnectionsListResponses, CfgAccountsOauthDisconnectCreateData, CfgAccountsOauthDisconnectCreateErrors, CfgAccountsOauthDisconnectCreateResponses, CfgAccountsOauthGithubAuthorizeCreateData, CfgAccountsOauthGithubAuthorizeCreateErrors, CfgAccountsOauthGithubAuthorizeCreateResponses, CfgAccountsOauthGithubCallbackCreateData, CfgAccountsOauthGithubCallbackCreateErrors, CfgAccountsOauthGithubCallbackCreateResponses, CfgAccountsOauthProvidersRetrieveData, CfgAccountsOauthProvidersRetrieveResponses, CfgAccountsOtpConsentPolicyRetrieveData, CfgAccountsOtpConsentPolicyRetrieveResponses, CfgAccountsOtpRequestCreateData, CfgAccountsOtpRequestCreateErrors, CfgAccountsOtpRequestCreateResponses, CfgAccountsOtpVerifyCreateData, CfgAccountsOtpVerifyCreateErrors, CfgAccountsOtpVerifyCreateResponses, CfgAccountsProfileAvatarCreateData, CfgAccountsProfileAvatarCreateErrors, CfgAccountsProfileAvatarCreateResponses, CfgAccountsProfileDeleteCreateData, CfgAccountsProfileDeleteCreateErrors, CfgAccountsProfileDeleteCreateResponses, CfgAccountsProfilePartialPartialUpdateData, CfgAccountsProfilePartialPartialUpdateErrors, CfgAccountsProfilePartialPartialUpdateResponses, CfgAccountsProfilePartialUpdateData, CfgAccountsProfilePartialUpdateErrors, CfgAccountsProfilePartialUpdateResponses, CfgAccountsProfileRetrieveData, CfgAccountsProfileRetrieveErrors, CfgAccountsProfileRetrieveResponses, CfgAccountsProfileUpdatePartialUpdateData, CfgAccountsProfileUpdatePartialUpdateErrors, CfgAccountsProfileUpdatePartialUpdateResponses, CfgAccountsProfileUpdateUpdateData, CfgAccountsProfileUpdateUpdateErrors, CfgAccountsProfileUpdateUpdateResponses, CfgAccountsTokenBlacklistCreateData, CfgAccountsTokenBlacklistCreateResponses, CfgAccountsTokenCreateData, CfgAccountsTokenCreateErrors, CfgAccountsTokenCreateResponses, CfgAccountsTokenRefreshCreateData, CfgAccountsTokenRefreshCreateResponses, CfgTotpBackupCodesRegenerateCreateData, CfgTotpBackupCodesRegenerateCreateErrors, CfgTotpBackupCodesRegenerateCreateResponses, CfgTotpBackupCodesRetrieveData, CfgTotpBackupCodesRetrieveResponses, CfgTotpDevicesDestroyData, CfgTotpDevicesDestroyResponses, CfgTotpDevicesRetrieveData, CfgTotpDevicesRetrieveResponses, CfgTotpDisableCreateData, CfgTotpDisableCreateErrors, CfgTotpDisableCreateResponses, CfgTotpSetupConfirmCreateData, CfgTotpSetupConfirmCreateErrors, CfgTotpSetupConfirmCreateResponses, CfgTotpSetupCreateData, CfgTotpSetupCreateErrors, CfgTotpSetupCreateResponses, CfgTotpVerifyBackupCreateData, CfgTotpVerifyBackupCreateErrors, CfgTotpVerifyBackupCreateResponses, CfgTotpVerifyCreateData, CfgTotpVerifyCreateErrors, CfgTotpVerifyCreateResponses } from './types.gen';
 
 export type Options<TData extends TDataShape = TDataShape, ThrowOnError extends boolean = boolean, TResponse = unknown> = Options2<TData, ThrowOnError, TResponse> & {
     /**
@@ -416,6 +416,25 @@ export class CfgAccountsProfile {
 }
 
 export class CfgAccountsAuth {
+    /**
+     * Obtain a JWT pair with email + password.
+     *
+     * Returns the same envelope as OTP verify: either ``requires_2fa=True`` with
+     * a session id, or the token pair plus the user object. Failures are uniform
+     * (401 ``invalid_credentials``) whether the email is unknown, the password is
+     * wrong, or the account is inactive/soft-deleted — no enumeration.
+     */
+    public static cfgAccountsTokenCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsTokenCreateData, ThrowOnError>): RequestResult<CfgAccountsTokenCreateResponses, CfgAccountsTokenCreateErrors, ThrowOnError> {
+        return (options.client ?? client).post<CfgAccountsTokenCreateResponses, CfgAccountsTokenCreateErrors, ThrowOnError>({
+            url: '/cfg/accounts/token/',
+            ...options,
+            headers: {
+                'Content-Type': 'application/json',
+                ...options.headers
+            }
+        });
+    }
+
     /**
      * Revoke a refresh token (logout).
      *