@keboola/api-client 24.0.0 → 27.0.0

package/dist/{types-Cgh3jqrV.d.cts → types-qvle4Ydu.d.cts}

@@ -1,4 +1,4 @@
-import { O as OpenapiBodyType, b as OpenapiReturnType, d as OpenapiPathType } from './types-gcShAmmi.cjs';
+import { O as OpenapiBodyType, b as OpenapiReturnType, d as OpenapiPathType } from './types-f8dUjMX4.cjs';
 
 /**
  * This file was auto-generated by openapi-typescript.
@@ -86,6 +86,74 @@ type paths = {
     patch?: never;
     trace?: never;
   };
+  '/v1/auth/methods': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Discover stack login methods
+     * @description Returns the login methods available on this stack, including public OAuth client IDs. Use POST /v1/auth/methods to narrow the list for a specific email address.
+     */
+    get: operations['get_auth_login_methods'];
+    put?: never;
+    /**
+     * Discover login methods for an email address
+     * @description Narrows the stack login methods to what the address's domain allows. The answer depends on the domain alone, so it is identical for existing and non-existing accounts.
+     */
+    post: operations['post_auth_login_methods_resolve'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/v1/auth/manage-tokens': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List Manage API tokens
+     * @description Returns the calling admin's Manage API tokens under `tokens` and their session tokens under `sessionTokens`, newest first. Metadata only — token values are never retrievable after creation.
+     */
+    get: operations['get_auth_manage_token_list'];
+    put?: never;
+    /**
+     * Create a Manage API token
+     * @description Issues a Manage API token owned by the calling admin. Requires an active sudo window. The token is returned once in the response and never again — only its hash is stored. `expiresIn` is a required lifetime in seconds, honored as sent; the only limit is that the expiry must fall before 9999-12-31 23:59:59. A non-expiring token cannot be requested here. Issuance is rate-limited per admin and answers `429` with `Retry-After` once the window is full.
+     */
+    post: operations['post_auth_manage_token_create'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/v1/auth/manage-tokens/{id}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    post?: never;
+    /**
+     * Delete a Manage API token
+     * @description Deletes a Manage API token (or session token) owned by the calling admin. Sudo is not required — deleting your own credential only reduces access. A token that does not exist or belongs to another user returns 404. Not idempotent: the row is hard-deleted, so a repeated call returns 404.
+     */
+    delete: operations['delete_auth_manage_token_delete'];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   '/v1/auth/mfa': {
     parameters: {
       query?: never;
@@ -319,7 +387,7 @@ type paths = {
     };
     /**
      * List active sessions
-     * @description Lists all active programmatic sessions for the authenticated admin.
+     * @description Lists all active programmatic sessions and OAuth grants for the authenticated admin.
      */
     get: operations['get_auth_sessions_list'];
     put?: never;
@@ -514,6 +582,86 @@ type paths = {
     patch?: never;
     trace?: never;
   };
+  '/v1/auth/webauthn/{id}': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    post?: never;
+    /**
+     * Remove a WebAuthn/passkey credential
+     * @description Removes a registered WebAuthn credential by its id. Removing the last WebAuthn credential while WebAuthn is the active MFA factor disables MFA entirely.
+     */
+    delete: operations['delete_auth_webauthn_delete'];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/v1/auth/webauthn': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List WebAuthn/passkey credentials
+     * @description Lists all registered WebAuthn/passkey credentials for the authenticated admin.
+     */
+    get: operations['get_auth_webauthn_list'];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/v1/auth/webauthn/register': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Confirm a WebAuthn/passkey enrollment
+     * @description Confirms a pending WebAuthn enrollment with the authenticator's attestation response. Registers the credential. Recovery codes are returned only when this enabled the first MFA factor.
+     */
+    post: operations['post_auth_webauthn_register'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/v1/auth/webauthn/register/options': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Start a WebAuthn/passkey enrollment
+     * @description Generates WebAuthn creation options for a new passkey/authenticator enrollment. Submit the resulting attestation to POST /v1/auth/webauthn/register to complete it.
+     */
+    post: operations['post_auth_webauthn_register_options'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   '/admin/auth/pkce/authorize': {
     parameters: {
       query?: never;
@@ -530,6 +678,22 @@ type paths = {
     patch?: never;
     trace?: never;
   };
+  '/admin/auth/pkce/project-select': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get: operations['get_auth_pkce_project_select'];
+    put?: never;
+    post: operations['post_auth_pkce_project_select_submit'];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
 };
 type components = {
   schemas: {
@@ -563,6 +727,16 @@ type components = {
       /** @description High-entropy device code returned by create. */
       deviceCode: string;
     };
+    LoginMethodsRequest: {
+      /** @description Email address whose domain the login methods are resolved for. */
+      email: string;
+    };
+    ManageTokenCreateRequest: {
+      /** @description User-facing label for the token. */
+      description: string;
+      /** @description Lifetime in seconds, honored as sent. Rejected when the resulting expiry would fall past 9999-12-31 23:59:59, the largest storable expiration. */
+      expiresIn: number;
+    };
     MfaRequest: {
       /** @description MFA challenge token from login response. */
       mfaToken: string;
@@ -686,6 +860,22 @@ type components = {
     TotpEnrollVerifyRequest: {
       /** @description 6-digit TOTP code generated from the pending secret. */
       code: string;
+      /**
+       * @description When true, revokes every other session of the admin and the tokens derived from them (the calling session and any long-lived personal access token stay valid). Defaults to false.
+       * @default false
+       */
+      revokeOtherSessions: boolean;
+    };
+    WebAuthnRegisterRequest: {
+      /** @description WebAuthn attestation response as returned by navigator.credentials.create(), serialized as a JSON string. */
+      credential: string;
+      /** @description Optional human-readable device name. Defaults to "Device <timestamp>" when omitted. */
+      deviceName: string;
+      /**
+       * @description When true, revokes every other session of the admin and the tokens derived from them (the calling session and any long-lived personal access token stay valid). Defaults to false.
+       * @default false
+       */
+      revokeOtherSessions: boolean;
     };
     PkceAuthorizeQueryRequest: {
       /**
@@ -709,6 +899,11 @@ type components = {
       codeChallengeMethod?: 'S256' | null;
       /** @description Opaque value used to maintain state between the request and callback. Required for the authorize flow to succeed. */
       state?: string | null;
+      /**
+       * @description Project data reach requested for the issued session. Omitted or "all" completes without any interstitial and issues an unrestricted session; "selected" shows the project picker, where the admin may narrow the session to specific projects or keep it unrestricted - so "selected" does not guarantee a narrowed session. Only project (Storage) access is narrowed; Manage API access keeps the admin's existing permissions.
+       * @enum {string|null}
+       */
+      projectScope?: 'all' | 'selected' | null;
     };
     PkceAuthorizeHeaderRequest: {
       /** @description Value of the Origin request header, if present. */
@@ -781,6 +976,13 @@ type components = {
       userCode: string;
       /** @enum {string} */
       decision: 'approve' | 'deny';
+      /**
+       * @description Send `all` to grant every project the admin is a member of. Omit it together with `projectIds` to keep the previous unrestricted meaning; omit only this field to freeze the grant to the submitted `projectIds`.
+       * @enum {string|null}
+       */
+      projectScope?: 'all' | null;
+      /** @description Ids of the projects the grant covers. Ignored when `projectScope=all`; required otherwise. */
+      projectIds?: string[] | null;
     };
     /** @enum {string} */
     DeviceApprovalDecision: 'approve' | 'deny';
@@ -832,6 +1034,93 @@ type components = {
       sessionId: string;
       user: components['schemas']['UserLoggedInResponse'];
     };
+    /** @description One login method the caller may use, discriminated on `type`. */
+    LoginMethod:
+      | {
+          /**
+           * @description Variant discriminator.
+           * @enum {string}
+           */
+          type: 'password';
+          /** @description Whether /v1/auth/password/reset-request is offered. */
+          passwordResetEnabled: boolean;
+        }
+      | {
+          /**
+           * @description Variant discriminator.
+           * @enum {string}
+           */
+          type: 'oidc';
+          /**
+           * @description The grantType to use at /v1/auth/login. A stack with both providers configured returns one entry per provider.
+           * @enum {string}
+           */
+          provider: 'google' | 'microsoft';
+          /** @description Public OAuth client ID to run the provider flow with. */
+          clientId: string;
+        }
+      | {
+          /**
+           * @description Variant discriminator.
+           * @enum {string}
+           */
+          type: 'saml';
+          /** @description Slug for /v1/auth/saml/initiate; null means the stack-wide configuration. */
+          customerSlug: string | null;
+          /** @description Label to render on the SSO button. */
+          displayName: string;
+        };
+    LoginMethodsResponse: {
+      /** @description Exhaustive list of login methods the caller may use. */
+      methods: components['schemas']['LoginMethod'][];
+      /**
+       * @description Why the list is narrowed; null when nothing narrows it.
+       * @enum {string|null}
+       */
+      restriction: 'ssoEnforced' | 'stackSsoOnly' | null;
+      /** @description Whether POST /v1/auth/methods can narrow the list for an email address. */
+      emailDiscoveryEnabled: boolean;
+      /** @description Where to send a visitor who wants to create an account; null when sign-up is unavailable. */
+      signUpUrl: string | null;
+    };
+    ManageTokenItemResponse: {
+      id: number;
+      /** @description User-facing label. */
+      description: string;
+      /** @description Token type, e.g. `admin` or `session`. */
+      type: string;
+      /** @description Manage API scopes granted to the token. Empty for tokens that only inherit the user's permissions. */
+      scopes: string[];
+      isSessionToken: boolean;
+      isExpired: boolean;
+      isDisabled: boolean;
+      /**
+       * Format: date-time
+       * @description `null` for legacy rows whose creation time was never recorded.
+       */
+      createdAt?: string | null;
+      /**
+       * Format: date-time
+       * @description `null` means the token never expires.
+       */
+      expiresAt?: string | null;
+      /**
+       * Format: date-time
+       * @description `null` means the token was never used.
+       */
+      lastUsedAt?: string | null;
+    };
+    ManageTokenListResponse: {
+      /** @description User-created Manage API tokens, newest first. */
+      tokens: components['schemas']['ManageTokenItemResponse'][];
+      /** @description Session tokens issued for the caller, newest first. */
+      sessionTokens: components['schemas']['ManageTokenItemResponse'][];
+    };
+    ManageTokenCreateResponse: {
+      /** @description Once-shown Manage API token. */
+      token: string;
+      manageToken: components['schemas']['ManageTokenItemResponse'];
+    };
     MfaRequest2: {
       /** @description MFA challenge token from login response. */
       mfaToken: string;
@@ -961,11 +1250,29 @@ type components = {
       /** @description Seconds until the request handle expires. */
       expiresIn: number;
     };
+    SessionClientResponse: {
+      /** @description OAuth client identifier. */
+      id: string;
+      /** @description Client display name, null when the client no longer exists. */
+      name?: string | null;
+    };
+    SessionProjectResponse: {
+      /** @description Project identifier. */
+      id: string;
+      /** @description Project name, null when the project no longer exists. */
+      name?: string | null;
+    };
     SessionItemResponse: {
       /** @description Session identifier. */
       id: string;
       /** @description Grant type used to create the session. */
       grantType: string;
+      /** @description OAuth client the session was granted to, null for grant types with no client. */
+      client?: components['schemas']['SessionClientResponse'] | null;
+      /** @description True when the session is not restricted to a project subset; `projects` is then empty. */
+      allProjects: boolean;
+      /** @description Projects the session was granted, as frozen at issuance. Empty when `allProjects` is true. */
+      projects: components['schemas']['SessionProjectResponse'][];
       /**
        * Format: date-time
        * @description Session creation timestamp.
@@ -993,6 +1300,29 @@ type components = {
       /** @description Whether this is the currently authenticated session. */
       isCurrent: boolean;
     };
+    OAuthSessionItemResponse: {
+      client: components['schemas']['SessionClientResponse'];
+      /** @description Project the grant is bound to, null for a project-less grant. */
+      project?: components['schemas']['SessionProjectResponse'] | null;
+      /** @description Storage token the grant is bound to, null for a project-less grant. */
+      tokenId?: number | null;
+      /** @description True when the grant reaches every project the admin is a member of, now and in the future; `projects` is then empty. */
+      allProjects: boolean;
+      /** @description Projects the grant reaches, as consented — not intersected with the admin's current project membership, so a project the admin has since lost access to is still listed. Empty when `allProjects` is true. */
+      projects: components['schemas']['SessionProjectResponse'][];
+      /** @description OAuth scopes the grant was issued with. */
+      scopes: string[];
+      /**
+       * Format: date-time
+       * @description When the admin first authorized this client, null for a grant predating consent records.
+       */
+      authorizedAt?: string | null;
+      /**
+       * Format: date-time
+       * @description Access token expiration timestamp.
+       */
+      expiresAt: string;
+    };
     SudoRequest2: {
       /**
        * @description TOTP verification code.
@@ -1107,6 +1437,50 @@ type components = {
       /** @description Plaintext recovery codes, present only when this enrollment enabled the first MFA factor. */
       recoveryCodes?: string[] | null;
     };
+    WebAuthnCredentialItemResponse: {
+      /** @description Credential identifier. */
+      id: number;
+      /** @description Human-readable device name. */
+      deviceName: string;
+      /**
+       * Format: date-time
+       * @description Registration timestamp.
+       */
+      created: string;
+    };
+    WebAuthnRegisterRequest2: {
+      /** @description WebAuthn attestation response as returned by navigator.credentials.create(), serialized as a JSON string. */
+      credential: string;
+      /**
+       * @description Optional human-readable device name. Defaults to "Device <timestamp>" when omitted.
+       * @default null
+       */
+      deviceName: string | null;
+      /**
+       * @description When true, revokes every other session of the admin and the tokens derived from them (the calling session and any long-lived personal access token stay valid). Defaults to false.
+       * @default false
+       */
+      revokeOtherSessions: boolean;
+    };
+    WebAuthnRegisterResponse: {
+      /** @description Identifier of the newly registered credential. */
+      id: number;
+      /** @description Human-readable device name. */
+      deviceName: string;
+      /**
+       * Format: date-time
+       * @description Registration timestamp.
+       */
+      created: string;
+      /** @description Freshly generated MFA recovery codes, present only when this was the first MFA factor enabled for the account. */
+      recoveryCodes?: string[] | null;
+    };
+    WebAuthnRegisterOptionsResponse: {
+      /** @description Serialized WebAuthn PublicKeyCredentialCreationOptions, consumable by navigator.credentials.create({publicKey: options}). */
+      options: Record<string, never>;
+      /** @description Enrollment challenge lifetime in seconds. */
+      expiresIn: number;
+    };
   };
   responses: never;
   parameters: never;
@@ -1169,7 +1543,7 @@ type operations = {
       path?: never;
       cookie?: never;
     };
-    /** @description Bearer mode (session bearer in the `Authorization` header): JSON body with `userCode` and `decision`. Browser/cookie mode: form-encoded body with `decision` and the CSRF `_token` — the device user code is read from the browser session, not the body. */
+    /** @description Bearer mode (session bearer in the `Authorization` header): JSON body with `userCode` and `decision`, optionally `projectScope`/`projectIds`. Browser/cookie mode: form-encoded body with `decision`, the CSRF `_token` and the project picker fields — the device user code is read from the browser session, not the body. */
     requestBody: {
       content: {
         'application/x-www-form-urlencoded': {
@@ -1177,6 +1551,13 @@ type operations = {
           decision: 'approve' | 'deny';
           /** @description CSRF token bound to the browser session. */
           _token: string;
+          /**
+           * @description Send `all` to grant every project the admin is a member of. Omit it to freeze the grant to the submitted `project_ids[]`.
+           * @enum {string}
+           */
+          project_scope?: 'all';
+          /** @description Ids of the projects the grant covers. Ignored when `project_scope=all`; required otherwise. */
+          project_ids?: string[];
         };
         'application/json': components['schemas']['DeviceAuthorizationApprovalRequest'];
       };
@@ -1191,7 +1572,14 @@ type operations = {
           'application/json': components['schemas']['DeviceAuthorizationApprovalResult'];
         };
       };
-      /** @description Request body, decision, browser session code, or device authorization state is invalid. */
+      /** @description Browser/cookie mode only: the submitted project selection was empty or named a project the admin cannot reach, so the browser is sent back to the approval page with an error code. Bearer mode answers 400/403 instead. */
+      302: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Request body, decision, project selection, browser session code, or device authorization state is invalid. */
       400: {
         headers: {
           [name: string]: unknown;
@@ -1205,7 +1593,7 @@ type operations = {
         };
         content?: never;
       };
-      /** @description PAT bearer, CSRF token, or approval authentication context is invalid. */
+      /** @description PAT bearer, CSRF token, approval authentication context, or a selected project the admin cannot reach. */
       403: {
         headers: {
           [name: string]: unknown;
@@ -1317,37 +1705,26 @@ type operations = {
       };
     };
   };
-  'post_/v1/auth/mfa': {
+  get_auth_login_methods: {
     parameters: {
       query?: never;
       header?: never;
       path?: never;
       cookie?: never;
     };
-    requestBody: {
-      content: {
-        'application/json': components['schemas']['MfaRequest2'];
-      };
-    };
+    requestBody?: never;
     responses: {
-      /** @description MFA verification successful. Returns access and refresh tokens. */
+      /** @description Login methods available on this stack. */
       200: {
         headers: {
           [name: string]: unknown;
         };
         content: {
-          'application/json': components['schemas']['LoginResponse'];
+          'application/json': components['schemas']['LoginMethodsResponse'];
         };
       };
-      /** @description MFA verification failed: invalid or expired MFA token, invalid TOTP / recovery code, exhausted challenge, or the challenge was already consumed by a concurrent request. */
-      401: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content?: never;
-      };
-      /** @description Rate limit exceeded for MFA verification attempts. */
-      429: {
+      /** @description An email was passed as a query parameter. */
+      400: {
         headers: {
           [name: string]: unknown;
         };
@@ -1355,7 +1732,7 @@ type operations = {
       };
     };
   };
-  post_auth_password_change: {
+  post_auth_login_methods_resolve: {
     parameters: {
       query?: never;
       header?: never;
@@ -1364,24 +1741,46 @@ type operations = {
     };
     requestBody: {
       content: {
-        'application/json': components['schemas']['PasswordChangeRequest'];
+        'application/json': components['schemas']['LoginMethodsRequest'];
       };
     };
     responses: {
-      /** @description Password changed. Other sessions were revoked only when revokeOtherSessions was true. */
-      204: {
+      /** @description Login methods the address may use. */
+      200: {
         headers: {
           [name: string]: unknown;
         };
-        content?: never;
+        content: {
+          'application/json': components['schemas']['LoginMethodsResponse'];
+        };
       };
-      /** @description Current password incorrect (auth.password.invalidCurrentPassword), or invalid request payload including a new password that violates the password policy (validation.failed). */
-      400: {
+      /** @description Per-IP request budget for discovery exhausted. */
+      429: {
         headers: {
           [name: string]: unknown;
         };
         content?: never;
       };
+    };
+  };
+  get_auth_manage_token_list: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description The caller's Manage API tokens and session tokens. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['ManageTokenListResponse'];
+        };
+      };
       /** @description Invalid or missing bearer token. */
       401: {
         headers: {
@@ -1389,8 +1788,183 @@ type operations = {
         };
         content?: never;
       };
-      /** @description Password is managed by the SSO identity provider. */
-      403: {
+      /** @description Programmatic auth feature disabled on this stack. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  post_auth_manage_token_create: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['ManageTokenCreateRequest'];
+      };
+    };
+    responses: {
+      /** @description Token created. The credential is shown in `token` and is not retrievable later. */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['ManageTokenCreateResponse'];
+        };
+      };
+      /** @description Invalid request payload, or `expiresIn` does not resolve to a storable future expiry. */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Invalid or missing bearer token. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Sudo window not active. */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Programmatic auth feature disabled on this stack. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Manage API token issuance rate limit exceeded. */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  delete_auth_manage_token_delete: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        /** @description Manage API token identifier. */
+        id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Token deleted. */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Invalid or missing bearer token. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Token not found, owned by another user, or programmatic auth disabled on this stack. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  'post_/v1/auth/mfa': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['MfaRequest2'];
+      };
+    };
+    responses: {
+      /** @description MFA verification successful. Returns access and refresh tokens. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['LoginResponse'];
+        };
+      };
+      /** @description MFA verification failed: invalid or expired MFA token, invalid TOTP / recovery code, exhausted challenge, or the challenge was already consumed by a concurrent request. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Rate limit exceeded for MFA verification attempts. */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  post_auth_password_change: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['PasswordChangeRequest'];
+      };
+    };
+    responses: {
+      /** @description Password changed. Other sessions were revoked only when revokeOtherSessions was true. */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Current password incorrect (auth.password.invalidCurrentPassword), or invalid request payload including a new password that violates the password policy (validation.failed). */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Invalid or missing bearer token. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Password is managed by the SSO identity provider. */
+      403: {
         headers: {
           [name: string]: unknown;
         };
@@ -1871,6 +2445,8 @@ type operations = {
           'application/json': {
             /** @description List of active sessions. */
             sessions?: components['schemas']['SessionItemResponse'][];
+            /** @description List of active OAuth grants. */
+            oauthSessions?: components['schemas']['OAuthSessionItemResponse'][];
           };
         };
       };
@@ -2143,7 +2719,10 @@ type operations = {
   };
   delete_auth_mfa_totp_delete: {
     parameters: {
-      query?: never;
+      query?: {
+        /** @description When true, revokes every other session of the admin and the tokens derived from them (the calling session and any long-lived personal access token stay valid). Defaults to false. */
+        revokeOtherSessions?: boolean;
+      };
       header?: never;
       path: {
         /** @description Identifier of the TOTP credential to remove. */
@@ -2289,6 +2868,201 @@ type operations = {
       };
     };
   };
+  delete_auth_webauthn_delete: {
+    parameters: {
+      query?: {
+        /** @description When true, revokes every other session of the admin and the tokens derived from them (the calling session and any long-lived personal access token stay valid). Defaults to false. */
+        revokeOtherSessions?: boolean;
+      };
+      header?: never;
+      path: {
+        /** @description Identifier of the credential to remove. */
+        id: number;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Credential removed successfully. */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Invalid or missing bearer token. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Sudo window not active. Call POST /v1/auth/sudo first. */
+      403: {
+        headers: {
+          /** @description RFC 9470 step-up challenge. */
+          'WWW-Authenticate'?: string;
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Credential not found, not owned by the caller, or the feature is disabled on this stack. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  get_auth_webauthn_list: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description List of registered WebAuthn credentials. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': {
+            /** @description List of registered WebAuthn credentials. */
+            webauthnCredentials?: components['schemas']['WebAuthnCredentialItemResponse'][];
+          };
+        };
+      };
+      /** @description Invalid or missing bearer token. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Programmatic auth feature disabled on this stack. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  post_auth_webauthn_register: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        'application/json': components['schemas']['WebAuthnRegisterRequest2'];
+      };
+    };
+    responses: {
+      /** @description WebAuthn credential registered. */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['WebAuthnRegisterResponse'];
+        };
+      };
+      /** @description The attestation response is malformed or failed ceremony validation (auth.mfa.invalidWebAuthnAttestation). */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Invalid or missing bearer token. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Sudo window not active. Call POST /v1/auth/sudo first. */
+      403: {
+        headers: {
+          /** @description RFC 9470 step-up challenge (only returned when the sudo window is not active). */
+          'WWW-Authenticate'?: string;
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description No eligible pending enrollment — either the feature is disabled on this stack, or no enrollment was started, it expired, exceeded the maximum attempts, or was already used. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description This authenticator credential is already registered (auth.mfa.webAuthnCredentialAlreadyRegistered), or a different MFA factor type (TOTP) became active for this account after this enrollment was started (auth.mfa.typeConflict). */
+      409: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  post_auth_webauthn_register_options: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Enrollment started. Returns the WebAuthn creation options. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          'application/json': components['schemas']['WebAuthnRegisterOptionsResponse'];
+        };
+      };
+      /** @description Invalid or missing bearer token. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Sudo window not active. Call POST /v1/auth/sudo first. */
+      403: {
+        headers: {
+          /** @description RFC 9470 step-up challenge (only returned when the sudo window is not active). */
+          'WWW-Authenticate'?: string;
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Programmatic auth feature disabled on this stack. */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description A different MFA factor type (TOTP) is already active for this account. */
+      409: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
   get_auth_pkce_authorize: {
     parameters: {
       query?: {
@@ -2304,6 +3078,8 @@ type operations = {
         codeChallengeMethod?: 'S256' | null;
         /** @description Opaque value used to maintain state between the request and callback. Required for the authorize flow to succeed. */
         state?: string | null;
+        /** @description Project data reach requested for the issued session. Omitted or "all" completes without any interstitial and issues an unrestricted session; "selected" shows the project picker, where the admin may narrow the session to specific projects or keep it unrestricted - so "selected" does not guarantee a narrowed session. Only project (Storage) access is narrowed; Manage API access keeps the admin's existing permissions. */
+        projectScope?: 'all' | 'selected' | null;
       };
       header?: never;
       path?: never;
@@ -2319,19 +3095,64 @@ type operations = {
       };
     };
   };
+  get_auth_pkce_project_select: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      default: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
+  post_auth_pkce_project_select_submit: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      default: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+    };
+  };
 };
 
 type IntrospectTokenResult = OpenapiReturnType<paths['/v1/auth/token/introspect']['get']>;
 type RefreshTokenResult = OpenapiReturnType<paths['/v1/auth/token/refresh']['post']>;
 type RevokeTokenBody = OpenapiBodyType<paths['/v1/auth/token/revoke']['post']>;
 
-type ListSessionsResult = OpenapiReturnType<paths['/v1/auth/sessions']['get']>;
 type RevokeSessionPath = OpenapiPathType<paths['/v1/auth/sessions/{sessionId}']['delete']>;
 
 type GetPkceTokenBody = OpenapiBodyType<paths['/v1/auth/pkce/token']['post']>;
 type GetPkceTokenResult = OpenapiReturnType<paths['/v1/auth/pkce/token']['post']>;
 
-type SudoBody = OpenapiBodyType<paths['/v1/auth/sudo']['post']>;
+/** The generated request body — what the typed client demands, not what the endpoint accepts. */
+type SudoBodyRaw = OpenapiBodyType<paths['/v1/auth/sudo']['post']>;
+/**
+ * The endpoint's request body is generated as `SudoRequest2`, which is **not** the input contract:
+ * the `*Request2` schemas are built from the PHP request object's readable properties, so they pick
+ * up getter-only artefacts (`type` here, `requestedCredentialType` on
+ * `DeviceAuthorizationCreateRequest2`) and mark every field required. The `#[OA\Schema]`-declared
+ * `SudoRequest` is the accepted shape: five optional factor fields, exactly one of them populated —
+ * the server infers the factor from which one is present. Its validator is an `Assert\Collection`
+ * with `allowExtraFields: false` and a per-field `Optional([NotBlank])`, so an unknown key like
+ * `type` and a present-but-null field are both rejected with a 400.
+ */
+type SudoBody = components['schemas']['SudoRequest'];
 type SudoResult = OpenapiReturnType<paths['/v1/auth/sudo']['post']>;
 type SudoChallengeResult = OpenapiReturnType<paths['/v1/auth/sudo/challenge']['post']>;
 
@@ -2358,8 +3179,7 @@ type VerifyMfaBody = OpenapiBodyType<paths['/v1/auth/mfa']['post']>;
 type VerifyMfaResult = OpenapiReturnType<paths['/v1/auth/mfa']['post']>;
 type RegenerateRecoveryCodesResult = OpenapiReturnType<paths['/v1/auth/mfa/recovery-codes']['post']>;
 type TotpSetupResult = OpenapiReturnType<paths['/v1/auth/mfa/totp']['post']>;
-type TotpVerifyBody = OpenapiBodyType<paths['/v1/auth/mfa/totp/verify']['post']>;
 type TotpVerifyResult = OpenapiReturnType<paths['/v1/auth/mfa/totp/verify']['post']>;
 type DisableTotpPath = OpenapiPathType<paths['/v1/auth/mfa/totp/{id}']['delete']>;
 
-export type { ApproveDeviceAuthorizationBody as A, CreateDeviceAuthorizationBody as C, DisableTotpPath as D, ExchangePatBody as E, GetDeviceAuthorizationTokenBody as G, InitiateSamlBody as I, ListPatsResult as L, RefreshTokenResult as R, SudoBody as S, TotpSetupResult as T, VerifyMfaBody as V, ApproveDeviceAuthorizationResult as a, AssertSamlBody as b, AssertSamlResult as c, CreateDeviceAuthorizationResult as d, CreatePatBody as e, CreatePatResult as f, ExchangePatResult as g, GetDeviceAuthorizationTokenResult as h, GetPkceTokenBody as i, GetPkceTokenResult as j, InitiateSamlResult as k, IntrospectTokenResult as l, ListSessionsResult as m, RegenerateRecoveryCodesResult as n, RevokePatPath as o, paths as p, RevokeSessionPath as q, RevokeTokenBody as r, SudoChallengeResult as s, SudoResult as t, TotpVerifyBody as u, TotpVerifyResult as v, VerifyMfaResult as w, components as x };
+export type { ApproveDeviceAuthorizationBody as A, CreateDeviceAuthorizationBody as C, DisableTotpPath as D, ExchangePatBody as E, GetDeviceAuthorizationTokenBody as G, InitiateSamlBody as I, ListPatsResult as L, RefreshTokenResult as R, SudoBody as S, TotpSetupResult as T, VerifyMfaBody as V, ApproveDeviceAuthorizationResult as a, AssertSamlBody as b, AssertSamlResult as c, CreateDeviceAuthorizationResult as d, CreatePatBody as e, CreatePatResult as f, ExchangePatResult as g, GetDeviceAuthorizationTokenResult as h, GetPkceTokenBody as i, GetPkceTokenResult as j, InitiateSamlResult as k, IntrospectTokenResult as l, RegenerateRecoveryCodesResult as m, RevokePatPath as n, RevokeSessionPath as o, paths as p, RevokeTokenBody as q, SudoBodyRaw as r, SudoChallengeResult as s, SudoResult as t, TotpVerifyResult as u, VerifyMfaResult as v, components as w };