@lepsto/sdk-app 91.0.1 → 92.0.0

package/src/gen/types.gen.ts

@@ -115427,9 +115427,9 @@ export interface UsersApikeysCreateInput {
  */
 name: string
 /**
- * 'server' mints a SECRET key (usk_…) for the Product's backend — returned exactly once and stored hashed. 'publishable' mints a non-secret key (upk_…) that identifies this product in browser flows and stays readable.
+ * 'publishable' mints a non-secret key (upk_…) that identifies this product in browser flows and stays readable. It is the only key type: the secret server key (usk_…) is retired.
  */
-type: ("server" | "publishable")
+type: "publishable"
 }
 
 export interface UsersApikeysCreateOutput {
@@ -115446,15 +115446,15 @@ key: string
  */
 name: string
 /**
- * `server` for a secret backend key (usk_…), `publishable` for a browser-safe one (upk_…).
+ * `publishable` — a browser-safe key (upk_…). It is the only type.
  */
-type: ("server" | "publishable")
+type: "publishable"
 /**
- * The full value of a publishable key, which is not a secret. Null for a server key — that value exists in exactly one response, ever.
+ * The full value of the key, which is not a secret and stays readable.
  */
 value: (string | null)
 /**
- * `usk_`/`upk_` plus six characters — enough to recognise a key, never to use one.
+ * `upk_` plus six characters — enough to recognise a key, never to use one.
  */
 prefix: string
 /**
@@ -115484,15 +115484,15 @@ id: string
  */
 name: string
 /**
- * `server` for a secret backend key (usk_…), `publishable` for a browser-safe one (upk_…).
+ * `publishable` — a browser-safe key (upk_…). It is the only type.
  */
-type: ("server" | "publishable")
+type: "publishable"
 /**
- * The full value of a publishable key, which is not a secret. Null for a server key — that value exists in exactly one response, ever.
+ * The full value of the key, which is not a secret and stays readable.
  */
 value: (string | null)
 /**
- * `usk_`/`upk_` plus six characters — enough to recognise a key, never to use one.
+ * `upk_` plus six characters — enough to recognise a key, never to use one.
  */
 prefix: string
 /**
@@ -115520,15 +115520,15 @@ id: string
  */
 name: string
 /**
- * `server` for a secret backend key (usk_…), `publishable` for a browser-safe one (upk_…).
+ * `publishable` — a browser-safe key (upk_…). It is the only type.
  */
-type: ("server" | "publishable")
+type: "publishable"
 /**
- * The full value of a publishable key, which is not a secret. Null for a server key — that value exists in exactly one response, ever.
+ * The full value of the key, which is not a secret and stays readable.
  */
 value: (string | null)
 /**
- * `usk_`/`upk_` plus six characters — enough to recognise a key, never to use one.
+ * `upk_` plus six characters — enough to recognise a key, never to use one.
  */
 prefix: string
 /**
@@ -115694,7 +115694,7 @@ from: (string | null)
  */
 codeEnabled: boolean
 /**
- * Base URL magic links point at, e.g. "https://public.lessly.com/{productId}/users". Null uses the deployment default.
+ * Base URL magic links point at, e.g. "https://public.lepsto.com/{productId}/users". Null uses the deployment default.
  */
 linkBaseUrl: (string | null)
 /**
@@ -115818,7 +115818,7 @@ successMessage: string
  */
 doubleOptIn: boolean
 /**
- * How long an UNCONVERTED waitlist entry — still pending, or invited and never registered — is kept, counted from SIGN-UP, before the sweep erases it. Default 180: Lessly Privacy Policy §6 promises deletion 6 months from sign-up. The bound stays wide because a client Product answers to its own privacy policy, not ours.
+ * How long an UNCONVERTED waitlist entry — still pending, or invited and never registered — is kept, counted from SIGN-UP, before the sweep erases it. Default 180: Lepsto Privacy Policy §6 promises deletion 6 months from sign-up. The bound stays wide because a client Product answers to its own privacy policy, not ours.
  */
 retentionDays: number
 /**
@@ -115989,7 +115989,7 @@ from?: (string | null)
  */
 codeEnabled?: boolean
 /**
- * Base URL magic links point at, e.g. "https://public.lessly.com/{productId}/users". Null uses the deployment default.
+ * Base URL magic links point at, e.g. "https://public.lepsto.com/{productId}/users". Null uses the deployment default.
  */
 linkBaseUrl?: (string | null)
 /**
@@ -116159,7 +116159,7 @@ successMessage?: string
  */
 doubleOptIn?: boolean
 /**
- * How long an UNCONVERTED waitlist entry — still pending, or invited and never registered — is kept, counted from SIGN-UP, before the sweep erases it. Default 180: Lessly Privacy Policy §6 promises deletion 6 months from sign-up. The bound stays wide because a client Product answers to its own privacy policy, not ours.
+ * How long an UNCONVERTED waitlist entry — still pending, or invited and never registered — is kept, counted from SIGN-UP, before the sweep erases it. Default 180: Lepsto Privacy Policy §6 promises deletion 6 months from sign-up. The bound stays wide because a client Product answers to its own privacy policy, not ours.
  */
 retentionDays?: number
 /**
@@ -116372,7 +116372,7 @@ from: (string | null)
  */
 codeEnabled: boolean
 /**
- * Base URL magic links point at, e.g. "https://public.lessly.com/{productId}/users". Null uses the deployment default.
+ * Base URL magic links point at, e.g. "https://public.lepsto.com/{productId}/users". Null uses the deployment default.
  */
 linkBaseUrl: (string | null)
 /**
@@ -116496,7 +116496,7 @@ successMessage: string
  */
 doubleOptIn: boolean
 /**
- * How long an UNCONVERTED waitlist entry — still pending, or invited and never registered — is kept, counted from SIGN-UP, before the sweep erases it. Default 180: Lessly Privacy Policy §6 promises deletion 6 months from sign-up. The bound stays wide because a client Product answers to its own privacy policy, not ours.
+ * How long an UNCONVERTED waitlist entry — still pending, or invited and never registered — is kept, counted from SIGN-UP, before the sweep erases it. Default 180: Lepsto Privacy Policy §6 promises deletion 6 months from sign-up. The bound stays wide because a client Product answers to its own privacy policy, not ours.
  */
 retentionDays: number
 /**
@@ -116841,11 +116841,11 @@ finishedAt: string
  */
 waitlistRetentionDays: number
 /**
- * What Lessly PUBLISHED, in its Privacy Policy §6: a waitlist address that never converted is deleted 6 months from sign-up. It rides along so the window above can be read against the promise it came from, rather than as a number with no provenance.
+ * What Lepsto PUBLISHED, in its Privacy Policy §6: a waitlist address that never converted is deleted 6 months from sign-up. It rides along so the window above can be read against the promise it came from, rather than as a number with no provenance.
  */
 waitlistPromisedMaxDays: number
 /**
- * True when this product configured a window WIDER than the published 180 days. Nothing refuses such a value and nothing clamps it — §6 is Lessly’s own policy and a client Product answers to its own, under which a longer window may be perfectly lawful. This flag exists INSTEAD of that ceiling: a deliberate divergence from what Lessly published must be diagnosable in one call rather than found by comparing two numbers nobody thought to compare.
+ * True when this product configured a window WIDER than the published 180 days. Nothing refuses such a value and nothing clamps it — §6 is Lepsto’s own policy and a client Product answers to its own, under which a longer window may be perfectly lawful. This flag exists INSTEAD of that ceiling: a deliberate divergence from what Lepsto published must be diagnosable in one call rather than found by comparing two numbers nobody thought to compare.
  */
 waitlistWiderThanPromised: boolean
 }
@@ -117306,7 +117306,7 @@ refreshReuseDetected: number
  */
 since: string
 /**
- * Point-in-time directory populations by DERIVED status — `user` has no status column, these are computed from `waitlisted` and the ban/delete/erase timestamps.
+ * Point-in-time directory populations by DERIVED status — `user` has no status column, these are computed from `kind`, `waitlisted` and the ban/delete/erase timestamps.
  */
 users: {
 /**
@@ -117314,7 +117314,7 @@ users: {
  */
 total: number
 /**
- * Full accounts: not waitlisted, not banned, not deleted, not erased.
+ * Full accounts: kind 'account', not waitlisted, not banned, not deleted, not erased.
  */
 active: number
 /**
@@ -117329,6 +117329,10 @@ erased: number
  * SOFT-deleted and still recoverable — not erased.
  */
 deleted: number
+/**
+ * People the Product knows who have no credential and have never signed in (kind 'contact'), excluding deleted and erased ones. Never part of `active`, and never billed as retained users.
+ */
+contacts: number
 /**
  * Waitlist signups with no credential yet.
  */
@@ -117383,6 +117387,251 @@ createdInWindow: number
 }
 }
 
+export interface UsersTouchesCreateInput {
+/**
+ * What was said or done, free text, 1-8192 characters. Personal data: it is whatever an operator typed about this person.
+ */
+body: string
+/**
+ * The end user this interaction was with.
+ */
+userId: string
+/**
+ * How the person was touched: 'message', 'call', 'meeting', 'note' (an internal observation nobody sent) or 'email' sent OUTSIDE the platform. Email this toolkit sent is not logged here — read those from the mail toolkit.
+ */
+channel: ("message" | "call" | "meeting" | "note" | "email")
+/**
+ * Which way it went: 'outbound' (you reached them), 'inbound' (they reached you) or 'none'. A 'note' or a 'meeting' must be 'none'.
+ */
+direction: ("outbound" | "inbound" | "none")
+/**
+ * When it happened (ISO 8601). Omit to mean now — pass it when logging after the fact, which may be any time in the past.
+ */
+occurredAt?: string
+}
+
+export interface UsersTouchesCreateOutput {
+/**
+ * Id of this touch. Pass it to users_touches_update or _delete.
+ */
+id: string
+/**
+ * What was said or done, free text, 1-8192 characters. Personal data: it is whatever an operator typed about this person.
+ */
+body: string
+/**
+ * The end user this interaction was with.
+ */
+userId: string
+/**
+ * Id of the operator or agent that logged it, verbatim.
+ */
+actorId: string
+/**
+ * How the person was touched: 'message', 'call', 'meeting', 'note' (an internal observation nobody sent) or 'email' sent OUTSIDE the platform. Email this toolkit sent is not logged here — read those from the mail toolkit.
+ */
+channel: ("message" | "call" | "meeting" | "note" | "email")
+/**
+ * Who logged it: 'operator' (a human) or 'agent' (a workflow or agent principal).
+ */
+actorType: ("operator" | "agent")
+/**
+ * When the touch was logged (ISO 8601).
+ */
+createdAt: string
+/**
+ * Which way it went: 'outbound' (you reached them), 'inbound' (they reached you) or 'none'. A 'note' or a 'meeting' must be 'none'.
+ */
+direction: ("outbound" | "inbound" | "none")
+/**
+ * Product this touch belongs to. Never an input — it comes from the calling identity.
+ */
+productId: string
+/**
+ * When the touch was last edited (ISO 8601).
+ */
+updatedAt: string
+/**
+ * When the interaction happened (ISO 8601) — not when it was logged.
+ */
+occurredAt: string
+}
+
+export interface UsersTouchesDiscardInput {
+/**
+ * Act on a touch somebody else logged. Without it a touch you did not author answers 404, exactly as a touch that does not exist does — the refusal must not tell you the row is there. Every forced call is recorded in the audit trail.
+ */
+force?: boolean
+/**
+ * The end user the touch belongs to.
+ */
+userId: string
+/**
+ * The touch to delete, from users_touches_list.
+ */
+touchId: string
+}
+
+export interface UsersTouchesDiscardOutput {
+/**
+ * Id of the touch that was deleted.
+ */
+id: string
+/**
+ * The end user it belonged to.
+ */
+userId: string
+/**
+ * Always true — a failure answers 404 instead.
+ */
+deleted: true
+}
+
+export interface UsersTouchesListInput {
+/**
+ * Page size, 1-100. Default 50.
+ */
+limit?: number
+/**
+ * Opaque cursor from a previous response's `nextCursor`. Omit for the first page.
+ */
+cursor?: string
+/**
+ * The end user whose touches to list.
+ */
+userId: string
+/**
+ * Only touches on this channel. Omit for all of them.
+ */
+channel?: ("message" | "call" | "meeting" | "note" | "email")
+}
+
+export interface UsersTouchesListOutput {
+/**
+ * The page of touches, newest first.
+ */
+items: {
+/**
+ * Id of this touch. Pass it to users_touches_update or _delete.
+ */
+id: string
+/**
+ * What was said or done, free text, 1-8192 characters. Personal data: it is whatever an operator typed about this person.
+ */
+body: string
+/**
+ * The end user this interaction was with.
+ */
+userId: string
+/**
+ * Id of the operator or agent that logged it, verbatim.
+ */
+actorId: string
+/**
+ * How the person was touched: 'message', 'call', 'meeting', 'note' (an internal observation nobody sent) or 'email' sent OUTSIDE the platform. Email this toolkit sent is not logged here — read those from the mail toolkit.
+ */
+channel: ("message" | "call" | "meeting" | "note" | "email")
+/**
+ * Who logged it: 'operator' (a human) or 'agent' (a workflow or agent principal).
+ */
+actorType: ("operator" | "agent")
+/**
+ * When the touch was logged (ISO 8601).
+ */
+createdAt: string
+/**
+ * Which way it went: 'outbound' (you reached them), 'inbound' (they reached you) or 'none'. A 'note' or a 'meeting' must be 'none'.
+ */
+direction: ("outbound" | "inbound" | "none")
+/**
+ * Product this touch belongs to. Never an input — it comes from the calling identity.
+ */
+productId: string
+/**
+ * When the touch was last edited (ISO 8601).
+ */
+updatedAt: string
+/**
+ * When the interaction happened (ISO 8601) — not when it was logged.
+ */
+occurredAt: string
+}[]
+/**
+ * Pass as `cursor` for the next page. Null when this was the last one.
+ */
+nextCursor: (string | null)
+}
+
+export interface UsersTouchesUpdateInput {
+/**
+ * Replacement text, 1-8192 characters. Omit to leave it unchanged.
+ */
+body?: string
+/**
+ * Act on a touch somebody else logged. Without it a touch you did not author answers 404, exactly as a touch that does not exist does — the refusal must not tell you the row is there. Every forced call is recorded in the audit trail.
+ */
+force?: boolean
+/**
+ * The end user the touch belongs to.
+ */
+userId: string
+/**
+ * The touch to edit, from users_touches_list.
+ */
+touchId: string
+/**
+ * Correct when it happened (ISO 8601). Omit to leave it unchanged.
+ */
+occurredAt?: string
+}
+
+export interface UsersTouchesUpdateOutput {
+/**
+ * Id of this touch. Pass it to users_touches_update or _delete.
+ */
+id: string
+/**
+ * What was said or done, free text, 1-8192 characters. Personal data: it is whatever an operator typed about this person.
+ */
+body: string
+/**
+ * The end user this interaction was with.
+ */
+userId: string
+/**
+ * Id of the operator or agent that logged it, verbatim.
+ */
+actorId: string
+/**
+ * How the person was touched: 'message', 'call', 'meeting', 'note' (an internal observation nobody sent) or 'email' sent OUTSIDE the platform. Email this toolkit sent is not logged here — read those from the mail toolkit.
+ */
+channel: ("message" | "call" | "meeting" | "note" | "email")
+/**
+ * Who logged it: 'operator' (a human) or 'agent' (a workflow or agent principal).
+ */
+actorType: ("operator" | "agent")
+/**
+ * When the touch was logged (ISO 8601).
+ */
+createdAt: string
+/**
+ * Which way it went: 'outbound' (you reached them), 'inbound' (they reached you) or 'none'. A 'note' or a 'meeting' must be 'none'.
+ */
+direction: ("outbound" | "inbound" | "none")
+/**
+ * Product this touch belongs to. Never an input — it comes from the calling identity.
+ */
+productId: string
+/**
+ * When the touch was last edited (ISO 8601).
+ */
+updatedAt: string
+/**
+ * When the interaction happened (ISO 8601) — not when it was logged.
+ */
+occurredAt: string
+}
+
 export interface UsersUsersBanInput {
 /**
  * The opaque user id returned by users_users_create or _list.
@@ -117395,10 +117644,22 @@ export interface UsersUsersBanOutput {
  * Id of this end user. Pass it to any users_users_* tool.
  */
 id: string
+/**
+ * What kind of person this row is: 'account' (can sign in) or 'contact' (known to the Product, no credential, never signed in). A contact is hidden from the default users_users_list view and is never counted as a retained user.
+ */
+kind: ("account" | "contact")
 /**
  * The user's display name. Null when nobody set one.
  */
 name: (string | null)
+/**
+ * Free labels on this person, stored trimmed, lowercased and de-duplicated.
+ */
+tags: string[]
+/**
+ * The relationship stage, in funnel order: new, contacted, replied, engaged, converted, lost. A real change publishes `users/user.stage-changed`.
+ */
+stage: ("new" | "contacted" | "replied" | "engaged" | "converted" | "lost")
 /**
  * When the user was banned (ISO 8601). Null while they are not banned.
  */
@@ -117431,6 +117692,10 @@ productId: string
  * When the user was last changed (ISO 8601).
  */
 updatedAt: string
+/**
+ * Set when you asked for an id that was merged into this account — it is the id you asked for, and this is the row it now lives in. Null on every ordinary read.
+ */
+mergedFrom: (string | null)
 /**
  * Whether this user is still on the waitlist and cannot sign in yet.
  */
@@ -117444,9 +117709,9 @@ identifiers: {
  */
 id: string
 /**
- * What kind of identifier this is. Today always `email`.
+ * What kind of identifier this is: `email`, `phone`, `telegram`, `linkedin` or `x`. Only `email` can be signed in with — the other four are contact channels, reachable but never part of the auth plane.
  */
-type: "email"
+type: ("email" | "phone" | "telegram" | "linkedin" | "x")
 /**
  * The address as the user typed it, for display.
  */
@@ -117468,6 +117733,10 @@ valueCanonical: string
  */
 verificationStatus: ("unverified" | "verified" | "expired")
 }[]
+/**
+ * When this person was last touched — the most recent logged interaction (ISO 8601). Null when nobody has logged one. This is when the interaction HAPPENED, not when it was logged.
+ */
+lastTouchAt: (string | null)
 /**
  * When a failed-attempt lockout expires (ISO 8601). Null when the user is not locked out.
  */
@@ -117502,6 +117771,10 @@ unsafeMetadata: {
 privateMetadata: {
 [k: string]: unknown
 }
+/**
+ * The user this person was merged INTO, when they were merged. Null for everybody else — follow it to find where their records went.
+ */
+mergedIntoUserId: (string | null)
 /**
  * Id of the primary identifier row. Null when there is no primary identifier.
  */
@@ -117513,10 +117786,22 @@ emailChangeLockedUntil: (string | null)
 }
 
 export interface UsersUsersCreateInput {
+/**
+ * What kind of person to create. 'account' (the default) can sign in. 'contact' is somebody the Product knows who has NO credential — a contact may not carry `password`, `waitlisted` or `requiresReset` (`contact_cannot_hold_credentials`), is hidden from the default users_users_list view, and is never counted as a retained user. A contact becomes an account only by proving an address, never by an operator setting this.
+ */
+kind?: ("account" | "contact")
 /**
  * The user's display name.
  */
 name?: string
+/**
+ * Free labels for this person. Trimmed, lowercased and de-duplicated on write; at most 32 of at most 64 characters each.
+ */
+tags?: string[]
+/**
+ * The relationship stage to start them at, in funnel order: new, contacted, replied, engaged, converted, lost. Default 'new'.
+ */
+stage?: ("new" | "contacted" | "replied" | "engaged" | "converted" | "lost")
 /**
  * URL of the user's avatar image.
  */
@@ -117547,7 +117832,7 @@ testUser?: boolean
  */
 waitlisted?: boolean
 /**
- * The email addresses that reach this user. At least one is required.
+ * How this user is reached: their email addresses, plus any contact channels (`phone`, `telegram`, `linkedin`, `x`). At least one is required.
  * 
  * @minItems 1
  */
@@ -117555,13 +117840,13 @@ identifiers: [{
 /**
  * Identifier kind. Only 'email' exists in this phase.
  */
-type: "email"
+type: ("email" | "phone" | "telegram" | "linkedin" | "x")
 /**
  * The email address. Stored canonicalised (lowercase, NFC) plus raw for display.
  */
 value: string
 /**
- * Record the identifier as already verified (use for trusted imports). Only ONE verified copy of a value may exist per product; unverified duplicates are allowed. Default false.
+ * Record the identifier as already verified (use for trusted imports). IGNORED for contact channels, which are always stored unverified — nothing here can prove a phone or a handle. Only ONE verified copy of an email may exist per product; unverified duplicates are allowed. Default false.
  */
 verified?: boolean
 /**
@@ -117572,13 +117857,13 @@ isPrimary?: boolean
 /**
  * Identifier kind. Only 'email' exists in this phase.
  */
-type: "email"
+type: ("email" | "phone" | "telegram" | "linkedin" | "x")
 /**
  * The email address. Stored canonicalised (lowercase, NFC) plus raw for display.
  */
 value: string
 /**
- * Record the identifier as already verified (use for trusted imports). Only ONE verified copy of a value may exist per product; unverified duplicates are allowed. Default false.
+ * Record the identifier as already verified (use for trusted imports). IGNORED for contact channels, which are always stored unverified — nothing here can prove a phone or a handle. Only ONE verified copy of an email may exist per product; unverified duplicates are allowed. Default false.
  */
 verified?: boolean
 /**
@@ -117617,10 +117902,22 @@ export interface UsersUsersCreateOutput {
  * Id of this end user. Pass it to any users_users_* tool.
  */
 id: string
+/**
+ * What kind of person this row is: 'account' (can sign in) or 'contact' (known to the Product, no credential, never signed in). A contact is hidden from the default users_users_list view and is never counted as a retained user.
+ */
+kind: ("account" | "contact")
 /**
  * The user's display name. Null when nobody set one.
  */
 name: (string | null)
+/**
+ * Free labels on this person, stored trimmed, lowercased and de-duplicated.
+ */
+tags: string[]
+/**
+ * The relationship stage, in funnel order: new, contacted, replied, engaged, converted, lost. A real change publishes `users/user.stage-changed`.
+ */
+stage: ("new" | "contacted" | "replied" | "engaged" | "converted" | "lost")
 /**
  * When the user was banned (ISO 8601). Null while they are not banned.
  */
@@ -117653,6 +117950,10 @@ productId: string
  * When the user was last changed (ISO 8601).
  */
 updatedAt: string
+/**
+ * Set when you asked for an id that was merged into this account — it is the id you asked for, and this is the row it now lives in. Null on every ordinary read.
+ */
+mergedFrom: (string | null)
 /**
  * Whether this user is still on the waitlist and cannot sign in yet.
  */
@@ -117666,9 +117967,9 @@ identifiers: {
  */
 id: string
 /**
- * What kind of identifier this is. Today always `email`.
+ * What kind of identifier this is: `email`, `phone`, `telegram`, `linkedin` or `x`. Only `email` can be signed in with — the other four are contact channels, reachable but never part of the auth plane.
  */
-type: "email"
+type: ("email" | "phone" | "telegram" | "linkedin" | "x")
 /**
  * The address as the user typed it, for display.
  */
@@ -117690,6 +117991,10 @@ valueCanonical: string
  */
 verificationStatus: ("unverified" | "verified" | "expired")
 }[]
+/**
+ * When this person was last touched — the most recent logged interaction (ISO 8601). Null when nobody has logged one. This is when the interaction HAPPENED, not when it was logged.
+ */
+lastTouchAt: (string | null)
 /**
  * When a failed-attempt lockout expires (ISO 8601). Null when the user is not locked out.
  */
@@ -117724,6 +118029,10 @@ unsafeMetadata: {
 privateMetadata: {
 [k: string]: unknown
 }
+/**
+ * The user this person was merged INTO, when they were merged. Null for everybody else — follow it to find where their records went.
+ */
+mergedIntoUserId: (string | null)
 /**
  * Id of the primary identifier row. Null when there is no primary identifier.
  */
@@ -117746,10 +118055,22 @@ export interface UsersUsersDeleteOutput {
  * Id of this end user. Pass it to any users_users_* tool.
  */
 id: string
+/**
+ * What kind of person this row is: 'account' (can sign in) or 'contact' (known to the Product, no credential, never signed in). A contact is hidden from the default users_users_list view and is never counted as a retained user.
+ */
+kind: ("account" | "contact")
 /**
  * The user's display name. Null when nobody set one.
  */
 name: (string | null)
+/**
+ * Free labels on this person, stored trimmed, lowercased and de-duplicated.
+ */
+tags: string[]
+/**
+ * The relationship stage, in funnel order: new, contacted, replied, engaged, converted, lost. A real change publishes `users/user.stage-changed`.
+ */
+stage: ("new" | "contacted" | "replied" | "engaged" | "converted" | "lost")
 /**
  * When the user was banned (ISO 8601). Null while they are not banned.
  */
@@ -117782,6 +118103,10 @@ productId: string
  * When the user was last changed (ISO 8601).
  */
 updatedAt: string
+/**
+ * Set when you asked for an id that was merged into this account — it is the id you asked for, and this is the row it now lives in. Null on every ordinary read.
+ */
+mergedFrom: (string | null)
 /**
  * Whether this user is still on the waitlist and cannot sign in yet.
  */
@@ -117795,9 +118120,9 @@ identifiers: {
  */
 id: string
 /**
- * What kind of identifier this is. Today always `email`.
+ * What kind of identifier this is: `email`, `phone`, `telegram`, `linkedin` or `x`. Only `email` can be signed in with — the other four are contact channels, reachable but never part of the auth plane.
  */
-type: "email"
+type: ("email" | "phone" | "telegram" | "linkedin" | "x")
 /**
  * The address as the user typed it, for display.
  */
@@ -117819,6 +118144,10 @@ valueCanonical: string
  */
 verificationStatus: ("unverified" | "verified" | "expired")
 }[]
+/**
+ * When this person was last touched — the most recent logged interaction (ISO 8601). Null when nobody has logged one. This is when the interaction HAPPENED, not when it was logged.
+ */
+lastTouchAt: (string | null)
 /**
  * When a failed-attempt lockout expires (ISO 8601). Null when the user is not locked out.
  */
@@ -117853,6 +118182,10 @@ unsafeMetadata: {
 privateMetadata: {
 [k: string]: unknown
 }
+/**
+ * The user this person was merged INTO, when they were merged. Null for everybody else — follow it to find where their records went.
+ */
+mergedIntoUserId: (string | null)
 /**
  * Id of the primary identifier row. Null when there is no primary identifier.
  */
@@ -117864,6 +118197,10 @@ emailChangeLockedUntil: (string | null)
 }
 
 export interface UsersUsersExportInput {
+/**
+ * Filter by kind: 'account' or 'contact'. Omit for accounts only, unless `includeContacts` is true.
+ */
+kind?: ("account" | "contact")
 /**
  * Rows per page, 1-500. Default 100.
  */
@@ -117884,6 +118221,10 @@ status?: ("active" | "banned" | "waitlisted")
  * Include soft-deleted users. Default false.
  */
 includeDeleted?: boolean
+/**
+ * Include CONTACTS alongside accounts, so one pass exports both. Default false — the same rule this export already applies to waitlist signups and test users.
+ */
+includeContacts?: boolean
 }
 
 export interface UsersUsersExportOutput {
@@ -117893,10 +118234,22 @@ users: {
  * Id of this end user. Pass it to any users_users_* tool.
  */
 id: string
+/**
+ * What kind of person this row is: 'account' (can sign in) or 'contact' (known to the Product, no credential, never signed in). A contact is hidden from the default users_users_list view and is never counted as a retained user.
+ */
+kind: ("account" | "contact")
 /**
  * The user's display name. Null when nobody set one.
  */
 name: (string | null)
+/**
+ * Free labels on this person, stored trimmed, lowercased and de-duplicated.
+ */
+tags: string[]
+/**
+ * The relationship stage, in funnel order: new, contacted, replied, engaged, converted, lost. A real change publishes `users/user.stage-changed`.
+ */
+stage: ("new" | "contacted" | "replied" | "engaged" | "converted" | "lost")
 /**
  * When the user was banned (ISO 8601). Null while they are not banned.
  */
@@ -117929,6 +118282,10 @@ productId: string
  * When the user was last changed (ISO 8601).
  */
 updatedAt: string
+/**
+ * Set when you asked for an id that was merged into this account — it is the id you asked for, and this is the row it now lives in. Null on every ordinary read.
+ */
+mergedFrom: (string | null)
 /**
  * Whether this user is still on the waitlist and cannot sign in yet.
  */
@@ -117942,9 +118299,9 @@ identifiers: {
  */
 id: string
 /**
- * What kind of identifier this is. Today always `email`.
+ * What kind of identifier this is: `email`, `phone`, `telegram`, `linkedin` or `x`. Only `email` can be signed in with — the other four are contact channels, reachable but never part of the auth plane.
  */
-type: "email"
+type: ("email" | "phone" | "telegram" | "linkedin" | "x")
 /**
  * The address as the user typed it, for display.
  */
@@ -117966,6 +118323,10 @@ valueCanonical: string
  */
 verificationStatus: ("unverified" | "verified" | "expired")
 }[]
+/**
+ * When this person was last touched — the most recent logged interaction (ISO 8601). Null when nobody has logged one. This is when the interaction HAPPENED, not when it was logged.
+ */
+lastTouchAt: (string | null)
 /**
  * When a failed-attempt lockout expires (ISO 8601). Null when the user is not locked out.
  */
@@ -118000,6 +118361,10 @@ unsafeMetadata: {
 privateMetadata: {
 [k: string]: unknown
 }
+/**
+ * The user this person was merged INTO, when they were merged. Null for everybody else — follow it to find where their records went.
+ */
+mergedIntoUserId: (string | null)
 /**
  * Id of the primary identifier row. Null when there is no primary identifier.
  */
@@ -118025,10 +118390,22 @@ export interface UsersUsersGetOutput {
  * Id of this end user. Pass it to any users_users_* tool.
  */
 id: string
+/**
+ * What kind of person this row is: 'account' (can sign in) or 'contact' (known to the Product, no credential, never signed in). A contact is hidden from the default users_users_list view and is never counted as a retained user.
+ */
+kind: ("account" | "contact")
 /**
  * The user's display name. Null when nobody set one.
  */
 name: (string | null)
+/**
+ * Free labels on this person, stored trimmed, lowercased and de-duplicated.
+ */
+tags: string[]
+/**
+ * The relationship stage, in funnel order: new, contacted, replied, engaged, converted, lost. A real change publishes `users/user.stage-changed`.
+ */
+stage: ("new" | "contacted" | "replied" | "engaged" | "converted" | "lost")
 /**
  * When the user was banned (ISO 8601). Null while they are not banned.
  */
@@ -118061,6 +118438,10 @@ productId: string
  * When the user was last changed (ISO 8601).
  */
 updatedAt: string
+/**
+ * Set when you asked for an id that was merged into this account — it is the id you asked for, and this is the row it now lives in. Null on every ordinary read.
+ */
+mergedFrom: (string | null)
 /**
  * Whether this user is still on the waitlist and cannot sign in yet.
  */
@@ -118074,9 +118455,9 @@ identifiers: {
  */
 id: string
 /**
- * What kind of identifier this is. Today always `email`.
+ * What kind of identifier this is: `email`, `phone`, `telegram`, `linkedin` or `x`. Only `email` can be signed in with — the other four are contact channels, reachable but never part of the auth plane.
  */
-type: "email"
+type: ("email" | "phone" | "telegram" | "linkedin" | "x")
 /**
  * The address as the user typed it, for display.
  */
@@ -118098,6 +118479,10 @@ valueCanonical: string
  */
 verificationStatus: ("unverified" | "verified" | "expired")
 }[]
+/**
+ * When this person was last touched — the most recent logged interaction (ISO 8601). Null when nobody has logged one. This is when the interaction HAPPENED, not when it was logged.
+ */
+lastTouchAt: (string | null)
 /**
  * When a failed-attempt lockout expires (ISO 8601). Null when the user is not locked out.
  */
@@ -118132,6 +118517,10 @@ unsafeMetadata: {
 privateMetadata: {
 [k: string]: unknown
 }
+/**
+ * The user this person was merged INTO, when they were merged. Null for everybody else — follow it to find where their records went.
+ */
+mergedIntoUserId: (string | null)
 /**
  * Id of the primary identifier row. Null when there is no primary identifier.
  */
@@ -118186,6 +118575,10 @@ userId: (string | null)
  * How many rows were passed over — an address already in the directory, typically.
  */
 skipped: number
+/**
+ * How many of the CREATED users were contacts (`kind: 'contact'`). A row that was skipped or failed is not counted.
+ */
+contacts: number
 /**
  * How many rows you submitted.
  */
@@ -118235,6 +118628,14 @@ expiresAt: string
 }
 
 export interface UsersUsersListInput {
+/**
+ * Return only people carrying this tag. ONE tag, matched against the stored (lowercased) value and ANDed with the other filters.
+ */
+tag?: string
+/**
+ * Filter by kind: 'account' or 'contact'. Passing 'contact' is how you list contacts — they are hidden otherwise. Omit for accounts only, unless `includeContacts` is true.
+ */
+kind?: ("account" | "contact")
 /**
  * Page size, 1-100. Default 25.
  */
@@ -118243,6 +118644,10 @@ limit?: number
  * Case-insensitive substring match against the user's identifiers (email) and name.
  */
 query?: string
+/**
+ * Filter by relationship stage: new, contacted, replied, engaged, converted or lost. Omit for every stage.
+ */
+stage?: ("new" | "contacted" | "replied" | "engaged" | "converted" | "lost")
 /**
  * Opaque cursor from a previous response's `nextCursor`. Omit for the first page.
  */
@@ -118255,6 +118660,18 @@ status?: ("active" | "banned" | "waitlisted")
  * Include soft-deleted users. Default false — deleted users are hidden.
  */
 includeDeleted?: boolean
+/**
+ * Only people whose most recent logged interaction happened at or after this instant (ISO 8601). People never touched are EXCLUDED by this filter — list without it to see everyone.
+ */
+lastTouchAfter?: string
+/**
+ * Include CONTACTS. Default false: a contact has no credential and has never signed in, so it is not part of the directory an operator browses — the same rule waitlist signups and test users follow. Use `kind: "contact"` to see only them.
+ */
+includeContacts?: boolean
+/**
+ * Only people whose most recent logged interaction happened before this instant (ISO 8601) — the "gone quiet" list. People never touched are EXCLUDED rather than treated as infinitely stale; list without this filter to see everyone.
+ */
+lastTouchBefore?: string
 /**
  * Include TEST USERS. Default false: a test user is a fixture, not a customer — it is excluded from metering and from this listing for the same reason. Ask for it explicitly when you are debugging the fixtures themselves.
  */
@@ -118274,10 +118691,22 @@ users: {
  * Id of this end user. Pass it to any users_users_* tool.
  */
 id: string
+/**
+ * What kind of person this row is: 'account' (can sign in) or 'contact' (known to the Product, no credential, never signed in). A contact is hidden from the default users_users_list view and is never counted as a retained user.
+ */
+kind: ("account" | "contact")
 /**
  * The user's display name. Null when nobody set one.
  */
 name: (string | null)
+/**
+ * Free labels on this person, stored trimmed, lowercased and de-duplicated.
+ */
+tags: string[]
+/**
+ * The relationship stage, in funnel order: new, contacted, replied, engaged, converted, lost. A real change publishes `users/user.stage-changed`.
+ */
+stage: ("new" | "contacted" | "replied" | "engaged" | "converted" | "lost")
 /**
  * When the user was banned (ISO 8601). Null while they are not banned.
  */
@@ -118310,6 +118739,10 @@ productId: string
  * When the user was last changed (ISO 8601).
  */
 updatedAt: string
+/**
+ * Set when you asked for an id that was merged into this account — it is the id you asked for, and this is the row it now lives in. Null on every ordinary read.
+ */
+mergedFrom: (string | null)
 /**
  * Whether this user is still on the waitlist and cannot sign in yet.
  */
@@ -118323,9 +118756,9 @@ identifiers: {
  */
 id: string
 /**
- * What kind of identifier this is. Today always `email`.
+ * What kind of identifier this is: `email`, `phone`, `telegram`, `linkedin` or `x`. Only `email` can be signed in with — the other four are contact channels, reachable but never part of the auth plane.
  */
-type: "email"
+type: ("email" | "phone" | "telegram" | "linkedin" | "x")
 /**
  * The address as the user typed it, for display.
  */
@@ -118347,6 +118780,10 @@ valueCanonical: string
  */
 verificationStatus: ("unverified" | "verified" | "expired")
 }[]
+/**
+ * When this person was last touched — the most recent logged interaction (ISO 8601). Null when nobody has logged one. This is when the interaction HAPPENED, not when it was logged.
+ */
+lastTouchAt: (string | null)
 /**
  * When a failed-attempt lockout expires (ISO 8601). Null when the user is not locked out.
  */
@@ -118381,6 +118818,10 @@ unsafeMetadata: {
 privateMetadata: {
 [k: string]: unknown
 }
+/**
+ * The user this person was merged INTO, when they were merged. Null for everybody else — follow it to find where their records went.
+ */
+mergedIntoUserId: (string | null)
 /**
  * Id of the primary identifier row. Null when there is no primary identifier.
  */
@@ -118434,10 +118875,22 @@ export interface UsersUsersUnbanOutput {
  * Id of this end user. Pass it to any users_users_* tool.
  */
 id: string
+/**
+ * What kind of person this row is: 'account' (can sign in) or 'contact' (known to the Product, no credential, never signed in). A contact is hidden from the default users_users_list view and is never counted as a retained user.
+ */
+kind: ("account" | "contact")
 /**
  * The user's display name. Null when nobody set one.
  */
 name: (string | null)
+/**
+ * Free labels on this person, stored trimmed, lowercased and de-duplicated.
+ */
+tags: string[]
+/**
+ * The relationship stage, in funnel order: new, contacted, replied, engaged, converted, lost. A real change publishes `users/user.stage-changed`.
+ */
+stage: ("new" | "contacted" | "replied" | "engaged" | "converted" | "lost")
 /**
  * When the user was banned (ISO 8601). Null while they are not banned.
  */
@@ -118470,6 +118923,10 @@ productId: string
  * When the user was last changed (ISO 8601).
  */
 updatedAt: string
+/**
+ * Set when you asked for an id that was merged into this account — it is the id you asked for, and this is the row it now lives in. Null on every ordinary read.
+ */
+mergedFrom: (string | null)
 /**
  * Whether this user is still on the waitlist and cannot sign in yet.
  */
@@ -118483,9 +118940,9 @@ identifiers: {
  */
 id: string
 /**
- * What kind of identifier this is. Today always `email`.
+ * What kind of identifier this is: `email`, `phone`, `telegram`, `linkedin` or `x`. Only `email` can be signed in with — the other four are contact channels, reachable but never part of the auth plane.
  */
-type: "email"
+type: ("email" | "phone" | "telegram" | "linkedin" | "x")
 /**
  * The address as the user typed it, for display.
  */
@@ -118507,6 +118964,10 @@ valueCanonical: string
  */
 verificationStatus: ("unverified" | "verified" | "expired")
 }[]
+/**
+ * When this person was last touched — the most recent logged interaction (ISO 8601). Null when nobody has logged one. This is when the interaction HAPPENED, not when it was logged.
+ */
+lastTouchAt: (string | null)
 /**
  * When a failed-attempt lockout expires (ISO 8601). Null when the user is not locked out.
  */
@@ -118541,6 +119002,10 @@ unsafeMetadata: {
 privateMetadata: {
 [k: string]: unknown
 }
+/**
+ * The user this person was merged INTO, when they were merged. Null for everybody else — follow it to find where their records went.
+ */
+mergedIntoUserId: (string | null)
 /**
  * Id of the primary identifier row. Null when there is no primary identifier.
  */
@@ -118556,6 +119021,14 @@ export interface UsersUsersUpdateInput {
  * The user's display name. Pass null to clear.
  */
 name?: (string | null)
+/**
+ * REPLACES the whole tag list — send every tag you want stored, not just the new ones. Trimmed, lowercased and de-duplicated on write.
+ */
+tags?: string[]
+/**
+ * Move the person to this relationship stage. A real change publishes `users/user.stage-changed`; a patch that changes ONLY the stage deliberately does not also publish `users/user.updated`, so a workflow that writes stages does not wake itself.
+ */
+stage?: ("new" | "contacted" | "replied" | "engaged" | "converted" | "lost")
 /**
  * The user to update.
  */
@@ -118603,10 +119076,22 @@ export interface UsersUsersUpdateOutput {
  * Id of this end user. Pass it to any users_users_* tool.
  */
 id: string
+/**
+ * What kind of person this row is: 'account' (can sign in) or 'contact' (known to the Product, no credential, never signed in). A contact is hidden from the default users_users_list view and is never counted as a retained user.
+ */
+kind: ("account" | "contact")
 /**
  * The user's display name. Null when nobody set one.
  */
 name: (string | null)
+/**
+ * Free labels on this person, stored trimmed, lowercased and de-duplicated.
+ */
+tags: string[]
+/**
+ * The relationship stage, in funnel order: new, contacted, replied, engaged, converted, lost. A real change publishes `users/user.stage-changed`.
+ */
+stage: ("new" | "contacted" | "replied" | "engaged" | "converted" | "lost")
 /**
  * When the user was banned (ISO 8601). Null while they are not banned.
  */
@@ -118639,6 +119124,10 @@ productId: string
  * When the user was last changed (ISO 8601).
  */
 updatedAt: string
+/**
+ * Set when you asked for an id that was merged into this account — it is the id you asked for, and this is the row it now lives in. Null on every ordinary read.
+ */
+mergedFrom: (string | null)
 /**
  * Whether this user is still on the waitlist and cannot sign in yet.
  */
@@ -118652,9 +119141,9 @@ identifiers: {
  */
 id: string
 /**
- * What kind of identifier this is. Today always `email`.
+ * What kind of identifier this is: `email`, `phone`, `telegram`, `linkedin` or `x`. Only `email` can be signed in with — the other four are contact channels, reachable but never part of the auth plane.
  */
-type: "email"
+type: ("email" | "phone" | "telegram" | "linkedin" | "x")
 /**
  * The address as the user typed it, for display.
  */
@@ -118676,6 +119165,10 @@ valueCanonical: string
  */
 verificationStatus: ("unverified" | "verified" | "expired")
 }[]
+/**
+ * When this person was last touched — the most recent logged interaction (ISO 8601). Null when nobody has logged one. This is when the interaction HAPPENED, not when it was logged.
+ */
+lastTouchAt: (string | null)
 /**
  * When a failed-attempt lockout expires (ISO 8601). Null when the user is not locked out.
  */
@@ -118710,6 +119203,10 @@ unsafeMetadata: {
 privateMetadata: {
 [k: string]: unknown
 }
+/**
+ * The user this person was merged INTO, when they were merged. Null for everybody else — follow it to find where their records went.
+ */
+mergedIntoUserId: (string | null)
 /**
  * Id of the primary identifier row. Null when there is no primary identifier.
  */