@grantjs/schema 1.0.0 → 1.1.0

package/src/generated/resolvers.ts

@@ -235,6 +235,7 @@ export type AddOrganizationTagInput = {
 
 export type AddOrganizationUserInput = {
   organizationId: Scalars['ID']['input'];
+  roleId: Scalars['ID']['input'];
   userId: Scalars['ID']['input'];
 };
 
@@ -278,11 +279,14 @@ export type AddProjectTagInput = {
 
 export type AddProjectUserApiKeyInput = {
   apiKeyId: Scalars['ID']['input'];
+  /** Optional pivot metadata (e.g. CDM `cdmImport` / `cdmSource`); omit for normal API creates. */
+  metadata?: InputMaybe<Scalars['JSON']['input']>;
   projectId: Scalars['ID']['input'];
   userId: Scalars['ID']['input'];
 };
 
 export type AddProjectUserInput = {
+  metadata?: InputMaybe<Scalars['JSON']['input']>;
   projectId: Scalars['ID']['input'];
   userId: Scalars['ID']['input'];
 };
@@ -398,6 +402,43 @@ export type AuthorizationResult = {
   reason?: Maybe<AuthorizationReason>;
 };
 
+export enum CdmFindBy {
+  Email = 'email',
+  Id = 'id',
+  Key = 'key',
+  Name = 'name',
+  Slug = 'slug',
+}
+
+export enum CdmIfMissing {
+  CreateNew = 'createNew',
+  Fail = 'fail',
+  Skip = 'skip',
+}
+
+export type CdmKeyResolverInput = {
+  findBy?: InputMaybe<CdmFindBy>;
+  ifMissing?: InputMaybe<CdmIfMissing>;
+  value: Scalars['String']['input'];
+};
+
+export type CdmModeInput = {
+  confirmDestructive?: InputMaybe<Scalars['Boolean']['input']>;
+  onConflict?: InputMaybe<CdmOnConflict>;
+  strategy: CdmModeStrategy;
+};
+
+export enum CdmModeStrategy {
+  Merge = 'merge',
+  Replace = 'replace',
+}
+
+export enum CdmOnConflict {
+  Fail = 'fail',
+  Skip = 'skip',
+  Update = 'update',
+}
+
 export type ChangeMyPasswordInput = {
   confirmPassword: Scalars['String']['input'];
   currentPassword: Scalars['String']['input'];
@@ -497,6 +538,7 @@ export type CreatePermissionInput = {
   action: Scalars['String']['input'];
   condition?: InputMaybe<Scalars['JSON']['input']>;
   description?: InputMaybe<Scalars['String']['input']>;
+  metadata?: InputMaybe<Scalars['JSON']['input']>;
   name: Scalars['String']['input'];
   primaryTagId?: InputMaybe<Scalars['ID']['input']>;
   resourceId?: InputMaybe<Scalars['ID']['input']>;
@@ -548,8 +590,10 @@ export type CreateProjectInput = {
 
 export type CreateResourceInput = {
   actions?: InputMaybe<Array<Scalars['String']['input']>>;
+  createPermissions?: InputMaybe<Scalars['Boolean']['input']>;
   description?: InputMaybe<Scalars['String']['input']>;
   isActive?: InputMaybe<Scalars['Boolean']['input']>;
+  metadata?: InputMaybe<Scalars['JSON']['input']>;
   name: Scalars['String']['input'];
   primaryTagId?: InputMaybe<Scalars['ID']['input']>;
   scope: Scope;
@@ -569,6 +613,7 @@ export type CreateRoleInput = {
 
 export type CreateTagInput = {
   color: Scalars['String']['input'];
+  metadata?: InputMaybe<Scalars['JSON']['input']>;
   name: Scalars['String']['input'];
   scope: Scope;
 };
@@ -632,6 +677,10 @@ export type ExchangeApiKeyResult = {
   expiresIn: Scalars['Int']['output'];
 };
 
+export type GenerateMyMfaRecoveryCodesInput = {
+  factorId?: InputMaybe<Scalars['ID']['input']>;
+};
+
 export type GetUserAuthenticationMethodsInput = {
   provider?: InputMaybe<UserAuthenticationMethodProvider>;
   userId?: InputMaybe<Scalars['ID']['input']>;
@@ -664,6 +713,16 @@ export type Group = Auditable & {
   updatedAt: Scalars['Date']['output'];
 };
 
+export type GroupCdmInput = {
+  description?: InputMaybe<Scalars['String']['input']>;
+  key: Scalars['String']['input'];
+  metadata?: InputMaybe<Scalars['JSON']['input']>;
+  name: Scalars['String']['input'];
+  permissions?: InputMaybe<Array<Scalars['String']['input']>>;
+  primaryTag?: InputMaybe<Scalars['String']['input']>;
+  tags?: InputMaybe<Array<Scalars['String']['input']>>;
+};
+
 export type GroupPage = PaginatedResults & {
   __typename?: 'GroupPage';
   groups: Array<Group>;
@@ -757,8 +816,11 @@ export type LoginResponse = {
   accessToken: Scalars['String']['output'];
   accounts: Array<Account>;
   email?: Maybe<Scalars['String']['output']>;
+  mfaVerified?: Maybe<Scalars['Boolean']['output']>;
   refreshToken: Scalars['String']['output'];
   requiresEmailVerification?: Maybe<Scalars['Boolean']['output']>;
+  /** When true, the client should complete MFA before expecting full API access (see AUTH_MIN_AAL_AT_LOGIN). */
+  requiresMfaStepUp?: Maybe<Scalars['Boolean']['output']>;
   verificationExpiry?: Maybe<Scalars['Date']['output']>;
 };
 
@@ -771,6 +833,7 @@ export type MeResponse = {
   __typename?: 'MeResponse';
   accounts: Array<Account>;
   email?: Maybe<Scalars['String']['output']>;
+  mfaVerified?: Maybe<Scalars['Boolean']['output']>;
   requiresEmailVerification?: Maybe<Scalars['Boolean']['output']>;
   verificationExpiry?: Maybe<Scalars['Date']['output']>;
 };
@@ -780,13 +843,63 @@ export enum MemberType {
   Member = 'member',
 }
 
+export type MfaDevice = {
+  __typename?: 'MfaDevice';
+  createdAt: Scalars['Date']['output'];
+  id: Scalars['ID']['output'];
+  isEnabled: Scalars['Boolean']['output'];
+  isPrimary: Scalars['Boolean']['output'];
+  lastUsedAt?: Maybe<Scalars['Date']['output']>;
+  name: Scalars['String']['output'];
+};
+
+export type MfaEnrollment = {
+  __typename?: 'MfaEnrollment';
+  factorId: Scalars['ID']['output'];
+  otpAuthUrl: Scalars['String']['output'];
+  secret: Scalars['String']['output'];
+};
+
+export type MfaRecoveryCodeStatus = {
+  __typename?: 'MfaRecoveryCodeStatus';
+  activeCount: Scalars['Int']['output'];
+  lastGeneratedAt?: Maybe<Scalars['Date']['output']>;
+};
+
+export type MfaSetupResponse = {
+  __typename?: 'MfaSetupResponse';
+  factorId: Scalars['ID']['output'];
+  otpAuthUrl: Scalars['String']['output'];
+  secret: Scalars['String']['output'];
+};
+
+export type MfaVerifyResponse = {
+  __typename?: 'MfaVerifyResponse';
+  accessToken: Scalars['String']['output'];
+  mfaVerified: Scalars['Boolean']['output'];
+  refreshToken: Scalars['String']['output'];
+};
+
+export type MfaVerifyResult = {
+  __typename?: 'MfaVerifyResult';
+  success: Scalars['Boolean']['output'];
+};
+
 export type Mutation = {
   __typename?: 'Mutation';
   _empty?: Maybe<Scalars['String']['output']>;
   acceptInvitation: AcceptInvitationResult;
+  /**
+   * Cancel a pending or running project CDM sync job. Cancellation is
+   * immediate when the job is still PENDING; if the job is already RUNNING, the
+   * cancellation is recorded and the worker stops at the next checkpoint
+   * (best-effort).
+   */
+  cancelProjectSync: ProjectSyncJob;
   changeMyPassword: ChangeMyPasswordResult;
   createApiKey: CreateApiKeyResult;
   createGroup: Group;
+  createMyMfaEnrollment: MfaEnrollment;
   createMySecondaryAccount: CreateMySecondaryAccountResult;
   createMyUserAuthenticationMethod: UserAuthenticationMethod;
   createOrganization: Organization;
@@ -811,11 +924,13 @@ export type Mutation = {
   deleteTag: Tag;
   deleteUser: User;
   exchangeApiKey: ExchangeApiKeyResult;
+  generateMyMfaRecoveryCodes: Array<Scalars['String']['output']>;
   inviteMember: OrganizationInvitation;
   login: LoginResponse;
   logoutMyUser: LogoutMyUserResponse;
   refreshSession: RefreshSessionResponse;
   register: CreateAccountResult;
+  removeMyMfaDevice: MfaVerifyResult;
   removeOrganizationMember: OrganizationMember;
   renewInvitation: OrganizationInvitation;
   requestPasswordReset: RequestPasswordResetResponse;
@@ -832,6 +947,31 @@ export type Mutation = {
    */
   rotateSigningKey: SigningKey;
   setMyPrimaryAuthenticationMethod: UserAuthenticationMethod;
+  setMyPrimaryMfaDevice: MfaDevice;
+  setupMfa: MfaSetupResponse;
+  /**
+   * Enqueue an asynchronous CDM **export** job for the given project. The worker
+   * snapshots current permission state into a replay-ready `SyncProjectInput` and
+   * stores it on the job row (`snapshot`); poll `projectSyncJob` for status.
+   *
+   * Requires Project:update in the given project scope (same as starting import jobs).
+   *
+   * Pass optional `input.jobName` for idempotency with the same rules as import `input.id`.
+   */
+  startProjectExport: ProjectSyncJob;
+  /**
+   * Enqueue an asynchronous project CDM import job for the given project.
+   * Applies a canonical data model document: roles, groups, resources, permissions,
+   * tags, project pivots, and user assignments scoped to the project.
+   * Requires Project:update in the given project scope.
+   *
+   * Returns immediately with a job descriptor in the PENDING status; the actual
+   * import runs in the background. Poll `projectSyncJob` for status.
+   * Pass optional `input.id` as a stable **job name** for idempotency: if an active job
+   * already exists for the same `(project, operation=IMPORT, jobName)`, that job is
+   * returned instead of creating a new one.
+   */
+  startProjectSync: ProjectSyncJob;
   updateGroup: Group;
   updateMyUser: User;
   updateOrganization: Organization;
@@ -847,12 +987,21 @@ export type Mutation = {
   uploadMyUserPicture: UploadUserPictureResult;
   uploadUserPicture: UploadUserPictureResult;
   verifyEmail: VerifyEmailResponse;
+  verifyMfa: MfaVerifyResponse;
+  verifyMfaRecoveryCode: MfaVerifyResponse;
+  verifyMyMfaEnrollment: MfaVerifyResult;
 };
 
 export type MutationAcceptInvitationArgs = {
   input: AcceptInvitationInput;
 };
 
+export type MutationCancelProjectSyncArgs = {
+  id: Scalars['ID']['input'];
+  jobId: Scalars['ID']['input'];
+  scope: Scope;
+};
+
 export type MutationChangeMyPasswordArgs = {
   input: ChangeMyPasswordInput;
 };
@@ -962,6 +1111,10 @@ export type MutationExchangeApiKeyArgs = {
   input: ExchangeApiKeyInput;
 };
 
+export type MutationGenerateMyMfaRecoveryCodesArgs = {
+  input?: InputMaybe<GenerateMyMfaRecoveryCodesInput>;
+};
+
 export type MutationInviteMemberArgs = {
   input: InviteMemberInput;
 };
@@ -974,6 +1127,10 @@ export type MutationRegisterArgs = {
   input: RegisterInput;
 };
 
+export type MutationRemoveMyMfaDeviceArgs = {
+  input: RemoveMyMfaDeviceInput;
+};
+
 export type MutationRemoveOrganizationMemberArgs = {
   input: RemoveOrganizationMemberInput;
   userId: Scalars['ID']['input'];
@@ -1022,6 +1179,22 @@ export type MutationSetMyPrimaryAuthenticationMethodArgs = {
   id: Scalars['ID']['input'];
 };
 
+export type MutationSetMyPrimaryMfaDeviceArgs = {
+  input: SetMyPrimaryMfaDeviceInput;
+};
+
+export type MutationStartProjectExportArgs = {
+  id: Scalars['ID']['input'];
+  input: StartProjectExportInput;
+  scope: Scope;
+};
+
+export type MutationStartProjectSyncArgs = {
+  id: Scalars['ID']['input'];
+  input: SyncProjectInput;
+  scope: Scope;
+};
+
 export type MutationUpdateGroupArgs = {
   id: Scalars['ID']['input'];
   input: UpdateGroupInput;
@@ -1088,6 +1261,18 @@ export type MutationVerifyEmailArgs = {
   input: VerifyEmailInput;
 };
 
+export type MutationVerifyMfaArgs = {
+  input: VerifyMfaInput;
+};
+
+export type MutationVerifyMfaRecoveryCodeArgs = {
+  input: VerifyMfaRecoveryCodeInput;
+};
+
+export type MutationVerifyMyMfaEnrollmentArgs = {
+  input: VerifyMyMfaEnrollmentInput;
+};
+
 export type MyUserSessionsInput = {
   audience?: InputMaybe<Scalars['String']['input']>;
   limit?: InputMaybe<Scalars['Int']['input']>;
@@ -1104,6 +1289,7 @@ export type Organization = Auditable & {
   name: Scalars['String']['output'];
   permissions?: Maybe<Array<Permission>>;
   projects?: Maybe<Array<Project>>;
+  requireMfaForSensitiveActions: Scalars['Boolean']['output'];
   roles?: Maybe<Array<Role>>;
   slug: Scalars['String']['output'];
   tags?: Maybe<Array<Tag>>;
@@ -1328,6 +1514,7 @@ export type OrganizationUser = Auditable & {
   id: Scalars['ID']['output'];
   organization?: Maybe<Organization>;
   organizationId: Scalars['ID']['output'];
+  roleId: Scalars['ID']['output'];
   updatedAt: Scalars['Date']['output'];
   user?: Maybe<User>;
   userId: Scalars['ID']['output'];
@@ -1346,6 +1533,7 @@ export type Permission = Auditable & {
   deletedAt?: Maybe<Scalars['Date']['output']>;
   description?: Maybe<Scalars['String']['output']>;
   id: Scalars['ID']['output'];
+  metadata: Scalars['JSON']['output'];
   name: Scalars['String']['output'];
   resource?: Maybe<Resource>;
   resourceId?: Maybe<Scalars['ID']['output']>;
@@ -1353,6 +1541,20 @@ export type Permission = Auditable & {
   updatedAt: Scalars['Date']['output'];
 };
 
+/** Custom permission for this project; `resource` is an opaque key in the same document. */
+export type PermissionCdmInput = {
+  action: Scalars['String']['input'];
+  condition?: InputMaybe<Scalars['JSON']['input']>;
+  description?: InputMaybe<Scalars['String']['input']>;
+  groups?: InputMaybe<Array<Scalars['String']['input']>>;
+  key: Scalars['String']['input'];
+  metadata?: InputMaybe<Scalars['JSON']['input']>;
+  name: Scalars['String']['input'];
+  primaryTag?: InputMaybe<Scalars['String']['input']>;
+  resource: Scalars['String']['input'];
+  tags?: InputMaybe<Array<Scalars['String']['input']>>;
+};
+
 export type PermissionPage = PaginatedResults & {
   __typename?: 'PermissionPage';
   hasNextPage: Scalars['Boolean']['output'];
@@ -1563,6 +1765,68 @@ export enum ProjectSortableField {
   UpdatedAt = 'updatedAt',
 }
 
+/** Asynchronous project CDM import or export job. */
+export type ProjectSyncJob = {
+  __typename?: 'ProjectSyncJob';
+  cancelledAt?: Maybe<Scalars['Date']['output']>;
+  cdmVersion: Scalars['Int']['output'];
+  completedAt?: Maybe<Scalars['Date']['output']>;
+  enqueuedAt: Scalars['Date']['output'];
+  errorMessage?: Maybe<Scalars['String']['output']>;
+  /** Rollback snapshot (import) or exported CDM (export); REST `.../snapshot`. */
+  hasSnapshot: Scalars['Boolean']['output'];
+  id: Scalars['ID']['output'];
+  /** Client idempotency key from `SyncProjectInput.id` on import. */
+  jobName?: Maybe<Scalars['String']['output']>;
+  /** Import merge/replace; null for export. */
+  modeStrategy?: Maybe<CdmModeStrategy>;
+  operation: ProjectSyncJobOperation;
+  projectId: Scalars['ID']['output'];
+  /** Import counters when completed; null for export (CDM in snapshot download). */
+  result?: Maybe<SyncProjectResult>;
+  snapshotSizeBytes?: Maybe<Scalars['Int']['output']>;
+  snapshotTakenAt?: Maybe<Scalars['Date']['output']>;
+  startedAt?: Maybe<Scalars['Date']['output']>;
+  status: ProjectSyncJobStatus;
+  warnings: Array<Scalars['String']['output']>;
+};
+
+/** CDM import or export work for a project (`project_sync_jobs`). */
+export enum ProjectSyncJobOperation {
+  Export = 'EXPORT',
+  Import = 'IMPORT',
+}
+
+/** Paginated list of project CDM sync jobs. */
+export type ProjectSyncJobPage = PaginatedResults & {
+  __typename?: 'ProjectSyncJobPage';
+  hasNextPage: Scalars['Boolean']['output'];
+  jobs: Array<ProjectSyncJob>;
+  totalCount: Scalars['Int']['output'];
+};
+
+export type ProjectSyncJobSortInput = {
+  field: ProjectSyncJobSortableField;
+  order: SortOrder;
+};
+
+export enum ProjectSyncJobSortableField {
+  CompletedAt = 'completedAt',
+  EnqueuedAt = 'enqueuedAt',
+  JobName = 'jobName',
+  StartedAt = 'startedAt',
+  Status = 'status',
+}
+
+/** Lifecycle status of an asynchronous project CDM sync job. */
+export enum ProjectSyncJobStatus {
+  Cancelled = 'CANCELLED',
+  Completed = 'COMPLETED',
+  Failed = 'FAILED',
+  Pending = 'PENDING',
+  Running = 'RUNNING',
+}
+
 export type ProjectTag = Auditable & {
   __typename?: 'ProjectTag';
   createdAt: Scalars['Date']['output'];
@@ -1584,7 +1848,10 @@ export type ProjectUser = Auditable & {
   __typename?: 'ProjectUser';
   createdAt: Scalars['Date']['output'];
   deletedAt?: Maybe<Scalars['Date']['output']>;
+  displayName?: Maybe<Scalars['String']['output']>;
   id: Scalars['ID']['output'];
+  metadata: Scalars['JSON']['output'];
+  pictureUrl?: Maybe<Scalars['String']['output']>;
   project?: Maybe<Project>;
   projectId: Scalars['ID']['output'];
   updatedAt: Scalars['Date']['output'];
@@ -1618,6 +1885,8 @@ export type Query = {
   invitation?: Maybe<OrganizationInvitation>;
   isAuthorized: AuthorizationResult;
   me: MeResponse;
+  myMfaDevices: Array<MfaDevice>;
+  myMfaRecoveryCodeStatus: MfaRecoveryCodeStatus;
   myUserAuthenticationMethods: Array<UserAuthenticationMethod>;
   myUserDataExport: UserDataExport;
   myUserSessions: UserSessionPage;
@@ -1627,6 +1896,18 @@ export type Query = {
   permissions: PermissionPage;
   /** List OAuth apps for the given project scope. Allowed scopes: accountProject, organizationProject. */
   projectApps: ProjectAppPage;
+  /**
+   * Read the current state of a project CDM sync job. Use this to poll
+   * the lifecycle of a job started via `startProjectSync`.
+   */
+  projectSyncJob: ProjectSyncJob;
+  /**
+   * List project CDM sync jobs for a project, with optional pagination,
+   * search (matches jobName), status filter, and sort. Use this to populate the
+   * job history view. Use `projectSyncJob` to read a single job's
+   * current state for polling.
+   */
+  projectSyncJobs: ProjectSyncJobPage;
   projects: ProjectPage;
   resources: ResourcePage;
   roles: RolePage;
@@ -1718,6 +1999,22 @@ export type QueryProjectAppsArgs = {
   tagIds?: InputMaybe<Array<Scalars['ID']['input']>>;
 };
 
+export type QueryProjectSyncJobArgs = {
+  id: Scalars['ID']['input'];
+  jobId: Scalars['ID']['input'];
+  scope: Scope;
+};
+
+export type QueryProjectSyncJobsArgs = {
+  id: Scalars['ID']['input'];
+  limit?: InputMaybe<Scalars['Int']['input']>;
+  page?: InputMaybe<Scalars['Int']['input']>;
+  scope: Scope;
+  search?: InputMaybe<Scalars['String']['input']>;
+  sort?: InputMaybe<ProjectSyncJobSortInput>;
+  status?: InputMaybe<ProjectSyncJobStatus>;
+};
+
 export type QueryProjectsArgs = {
   ids?: InputMaybe<Array<Scalars['ID']['input']>>;
   limit?: InputMaybe<Scalars['Int']['input']>;
@@ -1975,6 +2272,10 @@ export type RemoveGroupTagInput = {
   tagId: Scalars['ID']['input'];
 };
 
+export type RemoveMyMfaDeviceInput = {
+  factorId: Scalars['ID']['input'];
+};
+
 export type RemoveOrganizationGroupInput = {
   groupId: Scalars['ID']['input'];
   organizationId: Scalars['ID']['input'];
@@ -2134,12 +2435,26 @@ export type Resource = Auditable & {
   description?: Maybe<Scalars['String']['output']>;
   id: Scalars['ID']['output'];
   isActive: Scalars['Boolean']['output'];
+  metadata: Scalars['JSON']['output'];
   name: Scalars['String']['output'];
+  permissions?: Maybe<Array<Permission>>;
   slug: Scalars['String']['output'];
   tags: Array<Tag>;
   updatedAt: Scalars['Date']['output'];
 };
 
+/** Project resource row for CDM import/export. */
+export type ResourceCdmInput = {
+  actions: Array<Scalars['String']['input']>;
+  description?: InputMaybe<Scalars['String']['input']>;
+  key: Scalars['String']['input'];
+  metadata?: InputMaybe<Scalars['JSON']['input']>;
+  name: Scalars['String']['input'];
+  primaryTag?: InputMaybe<Scalars['String']['input']>;
+  slug?: InputMaybe<Scalars['String']['input']>;
+  tags?: InputMaybe<Array<Scalars['String']['input']>>;
+};
+
 export type ResourcePage = PaginatedResults & {
   __typename?: 'ResourcePage';
   hasNextPage: Scalars['Boolean']['output'];
@@ -2210,6 +2525,17 @@ export type Role = Auditable & {
   updatedAt: Scalars['Date']['output'];
 };
 
+export type RoleCdmInput = {
+  description?: InputMaybe<Scalars['String']['input']>;
+  groups?: InputMaybe<Array<Scalars['String']['input']>>;
+  key: Scalars['String']['input'];
+  metadata?: InputMaybe<Scalars['JSON']['input']>;
+  name: Scalars['String']['input'];
+  permissions?: InputMaybe<Array<Scalars['String']['input']>>;
+  primaryTag?: InputMaybe<Scalars['String']['input']>;
+  tags?: InputMaybe<Array<Scalars['String']['input']>>;
+};
+
 export type RoleGroup = Auditable & {
   __typename?: 'RoleGroup';
   createdAt: Scalars['Date']['output'];
@@ -2293,6 +2619,10 @@ export type SessionExportData = {
   userAgent?: Maybe<Scalars['String']['output']>;
 };
 
+export type SetMyPrimaryMfaDeviceInput = {
+  factorId: Scalars['ID']['input'];
+};
+
 /**
  * Signing key for a scope (e.g. project). Used for RS256 API key tokens; public key is exposed in JWKS.
  * Only project scopes (accountProject, organizationProject) have manageable keys; system key is internal.
@@ -2318,6 +2648,77 @@ export enum SortOrder {
   Desc = 'DESC',
 }
 
+/**
+ * Parameters for enqueueing an asynchronous CDM **export** job. The worker
+ * materialises a `SyncProjectInput` document and stores it in the job `snapshot`
+ * column; this input is persisted as the job `payload` (export options only).
+ */
+export type StartProjectExportInput = {
+  /**
+   * When `users` are exported, whether to emit CDM-managed project user API key rows
+   * (identity only). Omit = default true (full export behaviour).
+   */
+  includeUserApiKeys?: InputMaybe<Scalars['Boolean']['input']>;
+  /**
+   * Optional stable idempotency / display name (same column as import `SyncProjectInput.id`).
+   * When set, an active job for the same `(project, operation=EXPORT, jobName)` is returned
+   * instead of creating a new one.
+   */
+  jobName?: InputMaybe<Scalars['String']['input']>;
+  /**
+   * Embedded in the exported CDM document `mode` block for re-import.
+   * Does not change export execution (snapshot is always read-only).
+   */
+  mode?: InputMaybe<CdmModeInput>;
+  /** Subset of CDM slices to export; omit or empty for a full project export. */
+  sections?: InputMaybe<Array<Scalars['String']['input']>>;
+  /** CDM document version (only `1` is supported). */
+  version: Scalars['Int']['input'];
+};
+
+/**
+ * Versioned canonical project document (CDM) for export/import: roles, users,
+ * resources, permissions, groups, and tags scoped to one project.
+ */
+export type SyncProjectInput = {
+  groups?: InputMaybe<Array<GroupCdmInput>>;
+  id?: InputMaybe<Scalars['String']['input']>;
+  mode: CdmModeInput;
+  permissions?: InputMaybe<Array<PermissionCdmInput>>;
+  resources?: InputMaybe<Array<ResourceCdmInput>>;
+  roles: Array<RoleCdmInput>;
+  tags?: InputMaybe<Array<TagCdmInput>>;
+  users: Array<UserCdmInput>;
+  version: Scalars['Int']['input'];
+};
+
+/** Counters and warnings from a completed CDM import. */
+export type SyncProjectResult = {
+  __typename?: 'SyncProjectResult';
+  groupPermissionsLinked: Scalars['Int']['output'];
+  groupTagsLinked: Scalars['Int']['output'];
+  groupsCreated: Scalars['Int']['output'];
+  importId?: Maybe<Scalars['String']['output']>;
+  permissionsCreated: Scalars['Int']['output'];
+  projectGroupsLinked: Scalars['Int']['output'];
+  projectId: Scalars['ID']['output'];
+  projectPermissionsLinked: Scalars['Int']['output'];
+  projectResourcesLinked: Scalars['Int']['output'];
+  projectRolesLinked: Scalars['Int']['output'];
+  projectTagsLinked: Scalars['Int']['output'];
+  projectUserApiKeysCreated: Scalars['Int']['output'];
+  projectUsersEnsured: Scalars['Int']['output'];
+  resourcesCreated: Scalars['Int']['output'];
+  roleGroupsLinked: Scalars['Int']['output'];
+  roleTagsLinked: Scalars['Int']['output'];
+  rolesCreated: Scalars['Int']['output'];
+  tagsCreated: Scalars['Int']['output'];
+  userRolesAssigned: Scalars['Int']['output'];
+  userTagsLinked: Scalars['Int']['output'];
+  usersCreated: Scalars['Int']['output'];
+  warnings: Array<Scalars['String']['output']>;
+};
+
 export type Tag = Auditable & {
   __typename?: 'Tag';
   color: Scalars['String']['output'];
@@ -2325,10 +2726,18 @@ export type Tag = Auditable & {
   deletedAt?: Maybe<Scalars['Date']['output']>;
   id: Scalars['ID']['output'];
   isPrimary?: Maybe<Scalars['Boolean']['output']>;
+  metadata: Scalars['JSON']['output'];
   name: Scalars['String']['output'];
   updatedAt: Scalars['Date']['output'];
 };
 
+export type TagCdmInput = {
+  color: Scalars['String']['input'];
+  key: Scalars['String']['input'];
+  metadata?: InputMaybe<Scalars['JSON']['input']>;
+  name: Scalars['String']['input'];
+};
+
 export type TagPage = PaginatedResults & {
   __typename?: 'TagPage';
   hasNextPage: Scalars['Boolean']['output'];
@@ -2414,6 +2823,7 @@ export type UpdateMyUserInput = {
 
 export type UpdateOrganizationInput = {
   name?: InputMaybe<Scalars['String']['input']>;
+  requireMfaForSensitiveActions?: InputMaybe<Scalars['Boolean']['input']>;
   scope: Scope;
 };
 
@@ -2447,6 +2857,7 @@ export type UpdatePermissionInput = {
   action?: InputMaybe<Scalars['String']['input']>;
   condition?: InputMaybe<Scalars['JSON']['input']>;
   description?: InputMaybe<Scalars['String']['input']>;
+  metadata?: InputMaybe<Scalars['JSON']['input']>;
   name?: InputMaybe<Scalars['String']['input']>;
   primaryTagId?: InputMaybe<Scalars['ID']['input']>;
   resourceId?: InputMaybe<Scalars['ID']['input']>;
@@ -2502,6 +2913,7 @@ export type UpdateResourceInput = {
   actions?: InputMaybe<Array<Scalars['String']['input']>>;
   description?: InputMaybe<Scalars['String']['input']>;
   isActive?: InputMaybe<Scalars['Boolean']['input']>;
+  metadata?: InputMaybe<Scalars['JSON']['input']>;
   name?: InputMaybe<Scalars['String']['input']>;
   primaryTagId?: InputMaybe<Scalars['ID']['input']>;
   scope: Scope;
@@ -2533,6 +2945,7 @@ export type UpdateRoleTagInput = {
 
 export type UpdateTagInput = {
   color?: InputMaybe<Scalars['String']['input']>;
+  metadata?: InputMaybe<Scalars['JSON']['input']>;
   name?: InputMaybe<Scalars['String']['input']>;
   scope: Scope;
 };
@@ -2603,6 +3016,16 @@ export type User = Auditable & {
   updatedAt: Scalars['Date']['output'];
 };
 
+export type UserApiKeyCdmInput = {
+  clientId?: InputMaybe<Scalars['String']['input']>;
+  clientSecret?: InputMaybe<Scalars['String']['input']>;
+  description?: InputMaybe<Scalars['String']['input']>;
+  expiresAt?: InputMaybe<Scalars['Date']['input']>;
+  key?: InputMaybe<Scalars['String']['input']>;
+  metadata?: InputMaybe<Scalars['JSON']['input']>;
+  name?: InputMaybe<Scalars['String']['input']>;
+};
+
 export enum UserAuthenticationEmailProviderAction {
   Connect = 'connect',
   Login = 'login',
@@ -2631,6 +3054,18 @@ export enum UserAuthenticationMethodProvider {
   Google = 'google',
 }
 
+export type UserCdmInput = {
+  apiKeys?: InputMaybe<Array<UserApiKeyCdmInput>>;
+  groups?: InputMaybe<Array<Scalars['String']['input']>>;
+  key: CdmKeyResolverInput;
+  metadata?: InputMaybe<Scalars['JSON']['input']>;
+  name: Scalars['String']['input'];
+  permissions?: InputMaybe<Array<Scalars['String']['input']>>;
+  primaryTag?: InputMaybe<Scalars['String']['input']>;
+  roles?: InputMaybe<Array<Scalars['String']['input']>>;
+  tags?: InputMaybe<Array<Scalars['String']['input']>>;
+};
+
 export type UserDataExport = {
   __typename?: 'UserDataExport';
   accounts: Array<AccountExportData>;
@@ -2770,6 +3205,18 @@ export type VerifyEmailResponse = {
   success: Scalars['Boolean']['output'];
 };
 
+export type VerifyMfaInput = {
+  code: Scalars['String']['input'];
+};
+
+export type VerifyMfaRecoveryCodeInput = {
+  code: Scalars['String']['input'];
+};
+
+export type VerifyMyMfaEnrollmentInput = {
+  code: Scalars['String']['input'];
+};
+
 export type WithIndex<TObject> = TObject & Record<string, any>;
 export type ResolversObject<TObject> = WithIndex<TObject>;
 
@@ -2924,6 +3371,7 @@ export type ResolversInterfaceTypes<_RefType extends Record<string, unknown>> =
     | PermissionPage
     | ProjectAppPage
     | ProjectPage
+    | ProjectSyncJobPage
     | ResourcePage
     | RolePage
     | TagPage
@@ -2987,6 +3435,12 @@ export type ResolversTypes = ResolversObject<{
   AuthorizationReason: AuthorizationReason;
   AuthorizationResult: ResolverTypeWrapper<AuthorizationResult>;
   Boolean: ResolverTypeWrapper<Scalars['Boolean']['output']>;
+  CdmFindBy: CdmFindBy;
+  CdmIfMissing: CdmIfMissing;
+  CdmKeyResolverInput: CdmKeyResolverInput;
+  CdmModeInput: CdmModeInput;
+  CdmModeStrategy: CdmModeStrategy;
+  CdmOnConflict: CdmOnConflict;
   ChangeMyPasswordInput: ChangeMyPasswordInput;
   ChangeMyPasswordResult: ResolverTypeWrapper<ChangeMyPasswordResult>;
   Creatable: ResolverTypeWrapper<ResolversInterfaceTypes<ResolversTypes>['Creatable']>;
@@ -3016,9 +3470,11 @@ export type ResolversTypes = ResolversObject<{
   DeleteUserSessionInput: DeleteUserSessionInput;
   ExchangeApiKeyInput: ExchangeApiKeyInput;
   ExchangeApiKeyResult: ResolverTypeWrapper<ExchangeApiKeyResult>;
+  GenerateMyMfaRecoveryCodesInput: GenerateMyMfaRecoveryCodesInput;
   GetUserAuthenticationMethodsInput: GetUserAuthenticationMethodsInput;
   GetUserSessionsInput: GetUserSessionsInput;
   Group: ResolverTypeWrapper<Group>;
+  GroupCdmInput: GroupCdmInput;
   GroupPage: ResolverTypeWrapper<GroupPage>;
   GroupPermission: ResolverTypeWrapper<GroupPermission>;
   GroupSearchableField: GroupSearchableField;
@@ -3037,6 +3493,12 @@ export type ResolversTypes = ResolversObject<{
   LogoutMyUserResponse: ResolverTypeWrapper<LogoutMyUserResponse>;
   MeResponse: ResolverTypeWrapper<MeResponse>;
   MemberType: MemberType;
+  MfaDevice: ResolverTypeWrapper<MfaDevice>;
+  MfaEnrollment: ResolverTypeWrapper<MfaEnrollment>;
+  MfaRecoveryCodeStatus: ResolverTypeWrapper<MfaRecoveryCodeStatus>;
+  MfaSetupResponse: ResolverTypeWrapper<MfaSetupResponse>;
+  MfaVerifyResponse: ResolverTypeWrapper<MfaVerifyResponse>;
+  MfaVerifyResult: ResolverTypeWrapper<MfaVerifyResult>;
   Mutation: ResolverTypeWrapper<Record<PropertyKey, never>>;
   MyUserSessionsInput: MyUserSessionsInput;
   Organization: ResolverTypeWrapper<Organization>;
@@ -3068,6 +3530,7 @@ export type ResolversTypes = ResolversObject<{
     ResolversInterfaceTypes<ResolversTypes>['PaginatedResults']
   >;
   Permission: ResolverTypeWrapper<Permission>;
+  PermissionCdmInput: PermissionCdmInput;
   PermissionPage: ResolverTypeWrapper<PermissionPage>;
   PermissionSearchableField: PermissionSearchableField;
   PermissionSortInput: PermissionSortInput;
@@ -3089,6 +3552,12 @@ export type ResolversTypes = ResolversObject<{
   ProjectSearchableField: ProjectSearchableField;
   ProjectSortInput: ProjectSortInput;
   ProjectSortableField: ProjectSortableField;
+  ProjectSyncJob: ResolverTypeWrapper<ProjectSyncJob>;
+  ProjectSyncJobOperation: ProjectSyncJobOperation;
+  ProjectSyncJobPage: ResolverTypeWrapper<ProjectSyncJobPage>;
+  ProjectSyncJobSortInput: ProjectSyncJobSortInput;
+  ProjectSyncJobSortableField: ProjectSyncJobSortableField;
+  ProjectSyncJobStatus: ProjectSyncJobStatus;
   ProjectTag: ResolverTypeWrapper<ProjectTag>;
   ProjectUser: ResolverTypeWrapper<ProjectUser>;
   ProjectUserApiKey: ResolverTypeWrapper<ProjectUserApiKey>;
@@ -3133,6 +3602,7 @@ export type ResolversTypes = ResolversObject<{
   RemoveAccountTagInput: RemoveAccountTagInput;
   RemoveGroupPermissionInput: RemoveGroupPermissionInput;
   RemoveGroupTagInput: RemoveGroupTagInput;
+  RemoveMyMfaDeviceInput: RemoveMyMfaDeviceInput;
   RemoveOrganizationGroupInput: RemoveOrganizationGroupInput;
   RemoveOrganizationMemberInput: RemoveOrganizationMemberInput;
   RemoveOrganizationPermissionInput: RemoveOrganizationPermissionInput;
@@ -3163,6 +3633,7 @@ export type ResolversTypes = ResolversObject<{
   ResetPasswordInput: ResetPasswordInput;
   ResetPasswordResponse: ResolverTypeWrapper<ResetPasswordResponse>;
   Resource: ResolverTypeWrapper<Resource>;
+  ResourceCdmInput: ResourceCdmInput;
   ResourcePage: ResolverTypeWrapper<ResourcePage>;
   ResourceSearchableField: ResourceSearchableField;
   ResourceSortInput: ResourceSortInput;
@@ -3171,6 +3642,7 @@ export type ResolversTypes = ResolversObject<{
   RevokeApiKeyInput: RevokeApiKeyInput;
   RevokeMyUserSessionResult: ResolverTypeWrapper<RevokeMyUserSessionResult>;
   Role: ResolverTypeWrapper<Role>;
+  RoleCdmInput: RoleCdmInput;
   RoleGroup: ResolverTypeWrapper<RoleGroup>;
   RolePage: ResolverTypeWrapper<RolePage>;
   RoleSearchableField: RoleSearchableField;
@@ -3180,10 +3652,15 @@ export type ResolversTypes = ResolversObject<{
   Scope: Scope;
   Searchable: ResolverTypeWrapper<ResolversInterfaceTypes<ResolversTypes>['Searchable']>;
   SessionExportData: ResolverTypeWrapper<SessionExportData>;
+  SetMyPrimaryMfaDeviceInput: SetMyPrimaryMfaDeviceInput;
   SigningKey: ResolverTypeWrapper<SigningKey>;
   SortOrder: SortOrder;
+  StartProjectExportInput: StartProjectExportInput;
   String: ResolverTypeWrapper<Scalars['String']['output']>;
+  SyncProjectInput: SyncProjectInput;
+  SyncProjectResult: ResolverTypeWrapper<SyncProjectResult>;
   Tag: ResolverTypeWrapper<Tag>;
+  TagCdmInput: TagCdmInput;
   TagPage: ResolverTypeWrapper<TagPage>;
   TagSearchableField: TagSearchableField;
   TagSortField: TagSortField;
@@ -3220,9 +3697,11 @@ export type ResolversTypes = ResolversObject<{
   UploadUserPictureInput: UploadUserPictureInput;
   UploadUserPictureResult: ResolverTypeWrapper<UploadUserPictureResult>;
   User: ResolverTypeWrapper<User>;
+  UserApiKeyCdmInput: UserApiKeyCdmInput;
   UserAuthenticationEmailProviderAction: UserAuthenticationEmailProviderAction;
   UserAuthenticationMethod: ResolverTypeWrapper<UserAuthenticationMethod>;
   UserAuthenticationMethodProvider: UserAuthenticationMethodProvider;
+  UserCdmInput: UserCdmInput;
   UserDataExport: ResolverTypeWrapper<UserDataExport>;
   UserExportData: ResolverTypeWrapper<UserExportData>;
   UserPage: ResolverTypeWrapper<UserPage>;
@@ -3239,6 +3718,9 @@ export type ResolversTypes = ResolversObject<{
   UserTag: ResolverTypeWrapper<UserTag>;
   VerifyEmailInput: VerifyEmailInput;
   VerifyEmailResponse: ResolverTypeWrapper<VerifyEmailResponse>;
+  VerifyMfaInput: VerifyMfaInput;
+  VerifyMfaRecoveryCodeInput: VerifyMfaRecoveryCodeInput;
+  VerifyMyMfaEnrollmentInput: VerifyMyMfaEnrollmentInput;
 }>;
 
 /** Mapping between all available schema types and the resolvers parents */
@@ -3290,6 +3772,8 @@ export type ResolversParentTypes = ResolversObject<{
   AuthenticationMethodExportData: AuthenticationMethodExportData;
   AuthorizationResult: AuthorizationResult;
   Boolean: Scalars['Boolean']['output'];
+  CdmKeyResolverInput: CdmKeyResolverInput;
+  CdmModeInput: CdmModeInput;
   ChangeMyPasswordInput: ChangeMyPasswordInput;
   ChangeMyPasswordResult: ChangeMyPasswordResult;
   Creatable: ResolversInterfaceTypes<ResolversParentTypes>['Creatable'];
@@ -3319,9 +3803,11 @@ export type ResolversParentTypes = ResolversObject<{
   DeleteUserSessionInput: DeleteUserSessionInput;
   ExchangeApiKeyInput: ExchangeApiKeyInput;
   ExchangeApiKeyResult: ExchangeApiKeyResult;
+  GenerateMyMfaRecoveryCodesInput: GenerateMyMfaRecoveryCodesInput;
   GetUserAuthenticationMethodsInput: GetUserAuthenticationMethodsInput;
   GetUserSessionsInput: GetUserSessionsInput;
   Group: Group;
+  GroupCdmInput: GroupCdmInput;
   GroupPage: GroupPage;
   GroupPermission: GroupPermission;
   GroupSortInput: GroupSortInput;
@@ -3337,6 +3823,12 @@ export type ResolversParentTypes = ResolversObject<{
   LoginResponse: LoginResponse;
   LogoutMyUserResponse: LogoutMyUserResponse;
   MeResponse: MeResponse;
+  MfaDevice: MfaDevice;
+  MfaEnrollment: MfaEnrollment;
+  MfaRecoveryCodeStatus: MfaRecoveryCodeStatus;
+  MfaSetupResponse: MfaSetupResponse;
+  MfaVerifyResponse: MfaVerifyResponse;
+  MfaVerifyResult: MfaVerifyResult;
   Mutation: Record<PropertyKey, never>;
   MyUserSessionsInput: MyUserSessionsInput;
   Organization: Organization;
@@ -3359,6 +3851,7 @@ export type ResolversParentTypes = ResolversObject<{
   OrganizationUser: OrganizationUser;
   PaginatedResults: ResolversInterfaceTypes<ResolversParentTypes>['PaginatedResults'];
   Permission: Permission;
+  PermissionCdmInput: PermissionCdmInput;
   PermissionPage: PermissionPage;
   PermissionSortInput: PermissionSortInput;
   PermissionTag: PermissionTag;
@@ -3374,6 +3867,9 @@ export type ResolversParentTypes = ResolversObject<{
   ProjectResource: ProjectResource;
   ProjectRole: ProjectRole;
   ProjectSortInput: ProjectSortInput;
+  ProjectSyncJob: ProjectSyncJob;
+  ProjectSyncJobPage: ProjectSyncJobPage;
+  ProjectSyncJobSortInput: ProjectSyncJobSortInput;
   ProjectTag: ProjectTag;
   ProjectUser: ProjectUser;
   ProjectUserApiKey: ProjectUserApiKey;
@@ -3418,6 +3914,7 @@ export type ResolversParentTypes = ResolversObject<{
   RemoveAccountTagInput: RemoveAccountTagInput;
   RemoveGroupPermissionInput: RemoveGroupPermissionInput;
   RemoveGroupTagInput: RemoveGroupTagInput;
+  RemoveMyMfaDeviceInput: RemoveMyMfaDeviceInput;
   RemoveOrganizationGroupInput: RemoveOrganizationGroupInput;
   RemoveOrganizationMemberInput: RemoveOrganizationMemberInput;
   RemoveOrganizationPermissionInput: RemoveOrganizationPermissionInput;
@@ -3448,12 +3945,14 @@ export type ResolversParentTypes = ResolversObject<{
   ResetPasswordInput: ResetPasswordInput;
   ResetPasswordResponse: ResetPasswordResponse;
   Resource: Resource;
+  ResourceCdmInput: ResourceCdmInput;
   ResourcePage: ResourcePage;
   ResourceSortInput: ResourceSortInput;
   ResourceTag: ResourceTag;
   RevokeApiKeyInput: RevokeApiKeyInput;
   RevokeMyUserSessionResult: RevokeMyUserSessionResult;
   Role: Role;
+  RoleCdmInput: RoleCdmInput;
   RoleGroup: RoleGroup;
   RolePage: RolePage;
   RoleSortInput: RoleSortInput;
@@ -3461,9 +3960,14 @@ export type ResolversParentTypes = ResolversObject<{
   Scope: Scope;
   Searchable: ResolversInterfaceTypes<ResolversParentTypes>['Searchable'];
   SessionExportData: SessionExportData;
+  SetMyPrimaryMfaDeviceInput: SetMyPrimaryMfaDeviceInput;
   SigningKey: SigningKey;
+  StartProjectExportInput: StartProjectExportInput;
   String: Scalars['String']['output'];
+  SyncProjectInput: SyncProjectInput;
+  SyncProjectResult: SyncProjectResult;
   Tag: Tag;
+  TagCdmInput: TagCdmInput;
   TagPage: TagPage;
   TagSortInput: TagSortInput;
   UpdateAccountProjectTagInput: UpdateAccountProjectTagInput;
@@ -3496,7 +4000,9 @@ export type ResolversParentTypes = ResolversObject<{
   UploadUserPictureInput: UploadUserPictureInput;
   UploadUserPictureResult: UploadUserPictureResult;
   User: User;
+  UserApiKeyCdmInput: UserApiKeyCdmInput;
   UserAuthenticationMethod: UserAuthenticationMethod;
+  UserCdmInput: UserCdmInput;
   UserDataExport: UserDataExport;
   UserExportData: UserExportData;
   UserPage: UserPage;
@@ -3509,6 +4015,9 @@ export type ResolversParentTypes = ResolversObject<{
   UserTag: UserTag;
   VerifyEmailInput: VerifyEmailInput;
   VerifyEmailResponse: VerifyEmailResponse;
+  VerifyMfaInput: VerifyMfaInput;
+  VerifyMfaRecoveryCodeInput: VerifyMfaRecoveryCodeInput;
+  VerifyMyMfaEnrollmentInput: VerifyMyMfaEnrollmentInput;
 }>;
 
 export type AcceptInvitationResultResolvers<
@@ -3928,8 +4437,10 @@ export type LoginResponseResolvers<
   accessToken?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
   accounts?: Resolver<Array<ResolversTypes['Account']>, ParentType, ContextType>;
   email?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>;
+  mfaVerified?: Resolver<Maybe<ResolversTypes['Boolean']>, ParentType, ContextType>;
   refreshToken?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
   requiresEmailVerification?: Resolver<Maybe<ResolversTypes['Boolean']>, ParentType, ContextType>;
+  requiresMfaStepUp?: Resolver<Maybe<ResolversTypes['Boolean']>, ParentType, ContextType>;
   verificationExpiry?: Resolver<Maybe<ResolversTypes['Date']>, ParentType, ContextType>;
 }>;
 
@@ -3947,10 +4458,69 @@ export type MeResponseResolvers<
 > = ResolversObject<{
   accounts?: Resolver<Array<ResolversTypes['Account']>, ParentType, ContextType>;
   email?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>;
+  mfaVerified?: Resolver<Maybe<ResolversTypes['Boolean']>, ParentType, ContextType>;
   requiresEmailVerification?: Resolver<Maybe<ResolversTypes['Boolean']>, ParentType, ContextType>;
   verificationExpiry?: Resolver<Maybe<ResolversTypes['Date']>, ParentType, ContextType>;
 }>;
 
+export type MfaDeviceResolvers<
+  ContextType = any,
+  ParentType extends ResolversParentTypes['MfaDevice'] = ResolversParentTypes['MfaDevice'],
+> = ResolversObject<{
+  createdAt?: Resolver<ResolversTypes['Date'], ParentType, ContextType>;
+  id?: Resolver<ResolversTypes['ID'], ParentType, ContextType>;
+  isEnabled?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+  isPrimary?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+  lastUsedAt?: Resolver<Maybe<ResolversTypes['Date']>, ParentType, ContextType>;
+  name?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+}>;
+
+export type MfaEnrollmentResolvers<
+  ContextType = any,
+  ParentType extends ResolversParentTypes['MfaEnrollment'] = ResolversParentTypes['MfaEnrollment'],
+> = ResolversObject<{
+  factorId?: Resolver<ResolversTypes['ID'], ParentType, ContextType>;
+  otpAuthUrl?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+  secret?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+}>;
+
+export type MfaRecoveryCodeStatusResolvers<
+  ContextType = any,
+  ParentType extends ResolversParentTypes['MfaRecoveryCodeStatus'] =
+    ResolversParentTypes['MfaRecoveryCodeStatus'],
+> = ResolversObject<{
+  activeCount?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
+  lastGeneratedAt?: Resolver<Maybe<ResolversTypes['Date']>, ParentType, ContextType>;
+}>;
+
+export type MfaSetupResponseResolvers<
+  ContextType = any,
+  ParentType extends ResolversParentTypes['MfaSetupResponse'] =
+    ResolversParentTypes['MfaSetupResponse'],
+> = ResolversObject<{
+  factorId?: Resolver<ResolversTypes['ID'], ParentType, ContextType>;
+  otpAuthUrl?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+  secret?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+}>;
+
+export type MfaVerifyResponseResolvers<
+  ContextType = any,
+  ParentType extends ResolversParentTypes['MfaVerifyResponse'] =
+    ResolversParentTypes['MfaVerifyResponse'],
+> = ResolversObject<{
+  accessToken?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+  mfaVerified?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+  refreshToken?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+}>;
+
+export type MfaVerifyResultResolvers<
+  ContextType = any,
+  ParentType extends ResolversParentTypes['MfaVerifyResult'] =
+    ResolversParentTypes['MfaVerifyResult'],
+> = ResolversObject<{
+  success?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+}>;
+
 export type MutationResolvers<
   ContextType = any,
   ParentType extends ResolversParentTypes['Mutation'] = ResolversParentTypes['Mutation'],
@@ -3962,6 +4532,12 @@ export type MutationResolvers<
     ContextType,
     RequireFields<MutationAcceptInvitationArgs, 'input'>
   >;
+  cancelProjectSync?: Resolver<
+    ResolversTypes['ProjectSyncJob'],
+    ParentType,
+    ContextType,
+    RequireFields<MutationCancelProjectSyncArgs, 'id' | 'jobId' | 'scope'>
+  >;
   changeMyPassword?: Resolver<
     ResolversTypes['ChangeMyPasswordResult'],
     ParentType,
@@ -3980,6 +4556,7 @@ export type MutationResolvers<
     ContextType,
     RequireFields<MutationCreateGroupArgs, 'input'>
   >;
+  createMyMfaEnrollment?: Resolver<ResolversTypes['MfaEnrollment'], ParentType, ContextType>;
   createMySecondaryAccount?: Resolver<
     ResolversTypes['CreateMySecondaryAccountResult'],
     ParentType,
@@ -4117,6 +4694,12 @@ export type MutationResolvers<
     ContextType,
     RequireFields<MutationExchangeApiKeyArgs, 'input'>
   >;
+  generateMyMfaRecoveryCodes?: Resolver<
+    Array<ResolversTypes['String']>,
+    ParentType,
+    ContextType,
+    Partial<MutationGenerateMyMfaRecoveryCodesArgs>
+  >;
   inviteMember?: Resolver<
     ResolversTypes['OrganizationInvitation'],
     ParentType,
@@ -4137,6 +4720,12 @@ export type MutationResolvers<
     ContextType,
     RequireFields<MutationRegisterArgs, 'input'>
   >;
+  removeMyMfaDevice?: Resolver<
+    ResolversTypes['MfaVerifyResult'],
+    ParentType,
+    ContextType,
+    RequireFields<MutationRemoveMyMfaDeviceArgs, 'input'>
+  >;
   removeOrganizationMember?: Resolver<
     ResolversTypes['OrganizationMember'],
     ParentType,
@@ -4203,6 +4792,25 @@ export type MutationResolvers<
     ContextType,
     RequireFields<MutationSetMyPrimaryAuthenticationMethodArgs, 'id'>
   >;
+  setMyPrimaryMfaDevice?: Resolver<
+    ResolversTypes['MfaDevice'],
+    ParentType,
+    ContextType,
+    RequireFields<MutationSetMyPrimaryMfaDeviceArgs, 'input'>
+  >;
+  setupMfa?: Resolver<ResolversTypes['MfaSetupResponse'], ParentType, ContextType>;
+  startProjectExport?: Resolver<
+    ResolversTypes['ProjectSyncJob'],
+    ParentType,
+    ContextType,
+    RequireFields<MutationStartProjectExportArgs, 'id' | 'input' | 'scope'>
+  >;
+  startProjectSync?: Resolver<
+    ResolversTypes['ProjectSyncJob'],
+    ParentType,
+    ContextType,
+    RequireFields<MutationStartProjectSyncArgs, 'id' | 'input' | 'scope'>
+  >;
   updateGroup?: Resolver<
     ResolversTypes['Group'],
     ParentType,
@@ -4287,6 +4895,24 @@ export type MutationResolvers<
     ContextType,
     RequireFields<MutationVerifyEmailArgs, 'input'>
   >;
+  verifyMfa?: Resolver<
+    ResolversTypes['MfaVerifyResponse'],
+    ParentType,
+    ContextType,
+    RequireFields<MutationVerifyMfaArgs, 'input'>
+  >;
+  verifyMfaRecoveryCode?: Resolver<
+    ResolversTypes['MfaVerifyResponse'],
+    ParentType,
+    ContextType,
+    RequireFields<MutationVerifyMfaRecoveryCodeArgs, 'input'>
+  >;
+  verifyMyMfaEnrollment?: Resolver<
+    ResolversTypes['MfaVerifyResult'],
+    ParentType,
+    ContextType,
+    RequireFields<MutationVerifyMyMfaEnrollmentArgs, 'input'>
+  >;
 }>;
 
 export type OrganizationResolvers<
@@ -4300,6 +4926,7 @@ export type OrganizationResolvers<
   name?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
   permissions?: Resolver<Maybe<Array<ResolversTypes['Permission']>>, ParentType, ContextType>;
   projects?: Resolver<Maybe<Array<ResolversTypes['Project']>>, ParentType, ContextType>;
+  requireMfaForSensitiveActions?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
   roles?: Resolver<Maybe<Array<ResolversTypes['Role']>>, ParentType, ContextType>;
   slug?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
   tags?: Resolver<Maybe<Array<ResolversTypes['Tag']>>, ParentType, ContextType>;
@@ -4520,6 +5147,7 @@ export type OrganizationUserResolvers<
   id?: Resolver<ResolversTypes['ID'], ParentType, ContextType>;
   organization?: Resolver<Maybe<ResolversTypes['Organization']>, ParentType, ContextType>;
   organizationId?: Resolver<ResolversTypes['ID'], ParentType, ContextType>;
+  roleId?: Resolver<ResolversTypes['ID'], ParentType, ContextType>;
   updatedAt?: Resolver<ResolversTypes['Date'], ParentType, ContextType>;
   user?: Resolver<Maybe<ResolversTypes['User']>, ParentType, ContextType>;
   userId?: Resolver<ResolversTypes['ID'], ParentType, ContextType>;
@@ -4539,6 +5167,7 @@ export type PaginatedResultsResolvers<
     | 'PermissionPage'
     | 'ProjectAppPage'
     | 'ProjectPage'
+    | 'ProjectSyncJobPage'
     | 'ResourcePage'
     | 'RolePage'
     | 'TagPage'
@@ -4559,6 +5188,7 @@ export type PermissionResolvers<
   deletedAt?: Resolver<Maybe<ResolversTypes['Date']>, ParentType, ContextType>;
   description?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>;
   id?: Resolver<ResolversTypes['ID'], ParentType, ContextType>;
+  metadata?: Resolver<ResolversTypes['JSON'], ParentType, ContextType>;
   name?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
   resource?: Resolver<Maybe<ResolversTypes['Resource']>, ParentType, ContextType>;
   resourceId?: Resolver<Maybe<ResolversTypes['ID']>, ParentType, ContextType>;
@@ -4771,6 +5401,41 @@ export type ProjectRoleResolvers<
   __isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>;
 }>;
 
+export type ProjectSyncJobResolvers<
+  ContextType = any,
+  ParentType extends ResolversParentTypes['ProjectSyncJob'] =
+    ResolversParentTypes['ProjectSyncJob'],
+> = ResolversObject<{
+  cancelledAt?: Resolver<Maybe<ResolversTypes['Date']>, ParentType, ContextType>;
+  cdmVersion?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
+  completedAt?: Resolver<Maybe<ResolversTypes['Date']>, ParentType, ContextType>;
+  enqueuedAt?: Resolver<ResolversTypes['Date'], ParentType, ContextType>;
+  errorMessage?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>;
+  hasSnapshot?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+  id?: Resolver<ResolversTypes['ID'], ParentType, ContextType>;
+  jobName?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>;
+  modeStrategy?: Resolver<Maybe<ResolversTypes['CdmModeStrategy']>, ParentType, ContextType>;
+  operation?: Resolver<ResolversTypes['ProjectSyncJobOperation'], ParentType, ContextType>;
+  projectId?: Resolver<ResolversTypes['ID'], ParentType, ContextType>;
+  result?: Resolver<Maybe<ResolversTypes['SyncProjectResult']>, ParentType, ContextType>;
+  snapshotSizeBytes?: Resolver<Maybe<ResolversTypes['Int']>, ParentType, ContextType>;
+  snapshotTakenAt?: Resolver<Maybe<ResolversTypes['Date']>, ParentType, ContextType>;
+  startedAt?: Resolver<Maybe<ResolversTypes['Date']>, ParentType, ContextType>;
+  status?: Resolver<ResolversTypes['ProjectSyncJobStatus'], ParentType, ContextType>;
+  warnings?: Resolver<Array<ResolversTypes['String']>, ParentType, ContextType>;
+}>;
+
+export type ProjectSyncJobPageResolvers<
+  ContextType = any,
+  ParentType extends ResolversParentTypes['ProjectSyncJobPage'] =
+    ResolversParentTypes['ProjectSyncJobPage'],
+> = ResolversObject<{
+  hasNextPage?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+  jobs?: Resolver<Array<ResolversTypes['ProjectSyncJob']>, ParentType, ContextType>;
+  totalCount?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
+  __isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>;
+}>;
+
 export type ProjectTagResolvers<
   ContextType = any,
   ParentType extends ResolversParentTypes['ProjectTag'] = ResolversParentTypes['ProjectTag'],
@@ -4798,7 +5463,10 @@ export type ProjectUserResolvers<
 > = ResolversObject<{
   createdAt?: Resolver<ResolversTypes['Date'], ParentType, ContextType>;
   deletedAt?: Resolver<Maybe<ResolversTypes['Date']>, ParentType, ContextType>;
+  displayName?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>;
   id?: Resolver<ResolversTypes['ID'], ParentType, ContextType>;
+  metadata?: Resolver<ResolversTypes['JSON'], ParentType, ContextType>;
+  pictureUrl?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>;
   project?: Resolver<
     Maybe<ResolversTypes['Project']>,
     ParentType,
@@ -4860,6 +5528,12 @@ export type QueryResolvers<
     RequireFields<QueryIsAuthorizedArgs, 'input'>
   >;
   me?: Resolver<ResolversTypes['MeResponse'], ParentType, ContextType>;
+  myMfaDevices?: Resolver<Array<ResolversTypes['MfaDevice']>, ParentType, ContextType>;
+  myMfaRecoveryCodeStatus?: Resolver<
+    ResolversTypes['MfaRecoveryCodeStatus'],
+    ParentType,
+    ContextType
+  >;
   myUserAuthenticationMethods?: Resolver<
     Array<ResolversTypes['UserAuthenticationMethod']>,
     ParentType,
@@ -4902,6 +5576,18 @@ export type QueryResolvers<
     ContextType,
     RequireFields<QueryProjectAppsArgs, 'scope'>
   >;
+  projectSyncJob?: Resolver<
+    ResolversTypes['ProjectSyncJob'],
+    ParentType,
+    ContextType,
+    RequireFields<QueryProjectSyncJobArgs, 'id' | 'jobId' | 'scope'>
+  >;
+  projectSyncJobs?: Resolver<
+    ResolversTypes['ProjectSyncJobPage'],
+    ParentType,
+    ContextType,
+    RequireFields<QueryProjectSyncJobsArgs, 'id' | 'scope'>
+  >;
   projects?: Resolver<
     ResolversTypes['ProjectPage'],
     ParentType,
@@ -4989,7 +5675,9 @@ export type ResourceResolvers<
   description?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>;
   id?: Resolver<ResolversTypes['ID'], ParentType, ContextType>;
   isActive?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
+  metadata?: Resolver<ResolversTypes['JSON'], ParentType, ContextType>;
   name?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
+  permissions?: Resolver<Maybe<Array<ResolversTypes['Permission']>>, ParentType, ContextType>;
   slug?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
   tags?: Resolver<Array<ResolversTypes['Tag']>, ParentType, ContextType>;
   updatedAt?: Resolver<ResolversTypes['Date'], ParentType, ContextType>;
@@ -5152,6 +5840,35 @@ export type SigningKeyResolvers<
   __isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>;
 }>;
 
+export type SyncProjectResultResolvers<
+  ContextType = any,
+  ParentType extends ResolversParentTypes['SyncProjectResult'] =
+    ResolversParentTypes['SyncProjectResult'],
+> = ResolversObject<{
+  groupPermissionsLinked?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
+  groupTagsLinked?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
+  groupsCreated?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
+  importId?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>;
+  permissionsCreated?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
+  projectGroupsLinked?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
+  projectId?: Resolver<ResolversTypes['ID'], ParentType, ContextType>;
+  projectPermissionsLinked?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
+  projectResourcesLinked?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
+  projectRolesLinked?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
+  projectTagsLinked?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
+  projectUserApiKeysCreated?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
+  projectUsersEnsured?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
+  resourcesCreated?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
+  roleGroupsLinked?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
+  roleTagsLinked?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
+  rolesCreated?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
+  tagsCreated?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
+  userRolesAssigned?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
+  userTagsLinked?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
+  usersCreated?: Resolver<ResolversTypes['Int'], ParentType, ContextType>;
+  warnings?: Resolver<Array<ResolversTypes['String']>, ParentType, ContextType>;
+}>;
+
 export type TagResolvers<
   ContextType = any,
   ParentType extends ResolversParentTypes['Tag'] = ResolversParentTypes['Tag'],
@@ -5161,6 +5878,7 @@ export type TagResolvers<
   deletedAt?: Resolver<Maybe<ResolversTypes['Date']>, ParentType, ContextType>;
   id?: Resolver<ResolversTypes['ID'], ParentType, ContextType>;
   isPrimary?: Resolver<Maybe<ResolversTypes['Boolean']>, ParentType, ContextType>;
+  metadata?: Resolver<ResolversTypes['JSON'], ParentType, ContextType>;
   name?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
   updatedAt?: Resolver<ResolversTypes['Date'], ParentType, ContextType>;
   __isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>;
@@ -5403,6 +6121,12 @@ export type Resolvers<ContextType = any> = ResolversObject<{
   LoginResponse?: LoginResponseResolvers<ContextType>;
   LogoutMyUserResponse?: LogoutMyUserResponseResolvers<ContextType>;
   MeResponse?: MeResponseResolvers<ContextType>;
+  MfaDevice?: MfaDeviceResolvers<ContextType>;
+  MfaEnrollment?: MfaEnrollmentResolvers<ContextType>;
+  MfaRecoveryCodeStatus?: MfaRecoveryCodeStatusResolvers<ContextType>;
+  MfaSetupResponse?: MfaSetupResponseResolvers<ContextType>;
+  MfaVerifyResponse?: MfaVerifyResponseResolvers<ContextType>;
+  MfaVerifyResult?: MfaVerifyResultResolvers<ContextType>;
   Mutation?: MutationResolvers<ContextType>;
   Organization?: OrganizationResolvers<ContextType>;
   OrganizationGroup?: OrganizationGroupResolvers<ContextType>;
@@ -5433,6 +6157,8 @@ export type Resolvers<ContextType = any> = ResolversObject<{
   ProjectPermission?: ProjectPermissionResolvers<ContextType>;
   ProjectResource?: ProjectResourceResolvers<ContextType>;
   ProjectRole?: ProjectRoleResolvers<ContextType>;
+  ProjectSyncJob?: ProjectSyncJobResolvers<ContextType>;
+  ProjectSyncJobPage?: ProjectSyncJobPageResolvers<ContextType>;
   ProjectTag?: ProjectTagResolvers<ContextType>;
   ProjectUser?: ProjectUserResolvers<ContextType>;
   ProjectUserApiKey?: ProjectUserApiKeyResolvers<ContextType>;
@@ -5452,6 +6178,7 @@ export type Resolvers<ContextType = any> = ResolversObject<{
   Searchable?: SearchableResolvers<ContextType>;
   SessionExportData?: SessionExportDataResolvers<ContextType>;
   SigningKey?: SigningKeyResolvers<ContextType>;
+  SyncProjectResult?: SyncProjectResultResolvers<ContextType>;
   Tag?: TagResolvers<ContextType>;
   TagPage?: TagPageResolvers<ContextType>;
   UploadUserPictureResult?: UploadUserPictureResultResolvers<ContextType>;