@lepsto/sdk-app 91.0.1 → 92.1.0

package/dist/_types/gen/types.gen.d.ts

@@ -72500,13 +72500,38 @@ export interface BrainMemoryAddInput {
 }
 export interface BrainMemoryAddOutput {
     /**
-     * True when the memory was stored
+     * True when the memory was stored and its facts extracted (or there was nothing to extract). False when extraction failed — the raw memory is still stored under memory_id — or when the memory was not stored at all
      */
     success: boolean;
     /**
      * Engine id of the memory just stored; keep it to read, replace or delete the memory later
      */
     memory_id: string;
+    /**
+     * Present only when success is false. Tell stored from not stored by `extraction`, not by this code: with extraction.status 'failed' the raw memory IS stored and searchable under memory_id, only its facts are missing — do not re-add the same content, that stores a duplicate. With no `extraction` nothing was stored, and the add can be retried
+     */
+    error_code?: string;
+    /**
+     * What fact extraction made of this memory
+     */
+    extraction?: {
+        /**
+         * How many memories extraction stored from this write, across every derived layer (facts, identity, profile, summaries) — not a count of facts alone
+         */
+        items: number;
+        /**
+         * ok = at least one memory was derived from it (a summary counts, so ok alone does not promise a fact); empty = nothing new came out of it — the content held nothing durable, or everything in it is already in memory; failed = extraction broke, the raw memory is stored without facts; skipped = the engine does not extract in this mode
+         */
+        status: ("ok" | "empty" | "failed" | "skipped");
+        /**
+         * The engine's code when extraction failed — or, with status ok, when it ran degraded but still stored its facts
+         */
+        error_code?: string;
+        /**
+         * The engine's own words for that failure or degradation — quote it when reporting a problem
+         */
+        error_message?: string;
+    };
     /**
      * Engine request id for this call — quote it when reporting a problem
      */
@@ -72850,6 +72875,23 @@ export interface BrainMemoryStatsOutput {
          */
         entityCount: number;
     };
+    /**
+     * Raw memories left without facts, for the caller's product and scope. Counts only, and a lower bound. Null when the engine could not compute it
+     */
+    extraction_gaps: ({
+        /**
+         * Raw memories (l1_raw) the scope holds
+         */
+        raw_total: number;
+        /**
+         * Raw memories no derived memory (fact, identity) points back to — their extraction produced nothing
+         */
+        raw_without_derived: number;
+        /**
+         * Of those, raw memories still in shadow status
+         */
+        shadow_without_derived: number;
+    } | null);
 }
 export interface BrainMemoryUpdateInput {
     /**
@@ -122109,9 +122151,9 @@ export interface UsersApikeysCreateInput {
      */
     name: string;
     /**
-     * 'server' mints a SECRET key (usk_…) for the Product's backend — returned exactly once and stored hashed. 'publishable' mints a non-secret key (upk_…) that identifies this product in browser flows and stays readable.
+     * 'publishable' mints a non-secret key (upk_…) that identifies this product in browser flows and stays readable. It is the only key type: the secret server key (usk_…) is retired.
      */
-    type: ("server" | "publishable");
+    type: "publishable";
 }
 export interface UsersApikeysCreateOutput {
     /**
@@ -122127,15 +122169,15 @@ export interface UsersApikeysCreateOutput {
      */
     name: string;
     /**
-     * `server` for a secret backend key (usk_…), `publishable` for a browser-safe one (upk_…).
+     * `publishable` — a browser-safe key (upk_…). It is the only type.
      */
-    type: ("server" | "publishable");
+    type: "publishable";
     /**
-     * The full value of a publishable key, which is not a secret. Null for a server key — that value exists in exactly one response, ever.
+     * The full value of the key, which is not a secret and stays readable.
      */
     value: (string | null);
     /**
-     * `usk_`/`upk_` plus six characters — enough to recognise a key, never to use one.
+     * `upk_` plus six characters — enough to recognise a key, never to use one.
      */
     prefix: string;
     /**
@@ -122163,15 +122205,15 @@ export interface UsersApikeysGetOutput {
      */
     name: string;
     /**
-     * `server` for a secret backend key (usk_…), `publishable` for a browser-safe one (upk_…).
+     * `publishable` — a browser-safe key (upk_…). It is the only type.
      */
-    type: ("server" | "publishable");
+    type: "publishable";
     /**
-     * The full value of a publishable key, which is not a secret. Null for a server key — that value exists in exactly one response, ever.
+     * The full value of the key, which is not a secret and stays readable.
      */
     value: (string | null);
     /**
-     * `usk_`/`upk_` plus six characters — enough to recognise a key, never to use one.
+     * `upk_` plus six characters — enough to recognise a key, never to use one.
      */
     prefix: string;
     /**
@@ -122196,15 +122238,15 @@ export interface UsersApikeysListOutput {
          */
         name: string;
         /**
-         * `server` for a secret backend key (usk_…), `publishable` for a browser-safe one (upk_…).
+         * `publishable` — a browser-safe key (upk_…). It is the only type.
          */
-        type: ("server" | "publishable");
+        type: "publishable";
         /**
-         * The full value of a publishable key, which is not a secret. Null for a server key — that value exists in exactly one response, ever.
+         * The full value of the key, which is not a secret and stays readable.
          */
         value: (string | null);
         /**
-         * `usk_`/`upk_` plus six characters — enough to recognise a key, never to use one.
+         * `upk_` plus six characters — enough to recognise a key, never to use one.
          */
         prefix: string;
         /**
@@ -122363,7 +122405,7 @@ export interface UsersConfigGetOutput {
          */
         codeEnabled: boolean;
         /**
-         * Base URL magic links point at, e.g. "https://public.lessly.com/{productId}/users". Null uses the deployment default.
+         * Base URL magic links point at, e.g. "https://public.lepsto.com/{productId}/users". Null uses the deployment default.
          */
         linkBaseUrl: (string | null);
         /**
@@ -122487,7 +122529,7 @@ export interface UsersConfigGetOutput {
          */
         doubleOptIn: boolean;
         /**
-         * How long an UNCONVERTED waitlist entry — still pending, or invited and never registered — is kept, counted from SIGN-UP, before the sweep erases it. Default 180: Lessly Privacy Policy §6 promises deletion 6 months from sign-up. The bound stays wide because a client Product answers to its own privacy policy, not ours.
+         * How long an UNCONVERTED waitlist entry — still pending, or invited and never registered — is kept, counted from SIGN-UP, before the sweep erases it. Default 180: Lepsto Privacy Policy §6 promises deletion 6 months from sign-up. The bound stays wide because a client Product answers to its own privacy policy, not ours.
          */
         retentionDays: number;
         /**
@@ -122657,7 +122699,7 @@ export interface UsersConfigUpsertInput {
          */
         codeEnabled?: boolean;
         /**
-         * Base URL magic links point at, e.g. "https://public.lessly.com/{productId}/users". Null uses the deployment default.
+         * Base URL magic links point at, e.g. "https://public.lepsto.com/{productId}/users". Null uses the deployment default.
          */
         linkBaseUrl?: (string | null);
         /**
@@ -122827,7 +122869,7 @@ export interface UsersConfigUpsertInput {
          */
         doubleOptIn?: boolean;
         /**
-         * How long an UNCONVERTED waitlist entry — still pending, or invited and never registered — is kept, counted from SIGN-UP, before the sweep erases it. Default 180: Lessly Privacy Policy §6 promises deletion 6 months from sign-up. The bound stays wide because a client Product answers to its own privacy policy, not ours.
+         * How long an UNCONVERTED waitlist entry — still pending, or invited and never registered — is kept, counted from SIGN-UP, before the sweep erases it. Default 180: Lepsto Privacy Policy §6 promises deletion 6 months from sign-up. The bound stays wide because a client Product answers to its own privacy policy, not ours.
          */
         retentionDays?: number;
         /**
@@ -123039,7 +123081,7 @@ export interface UsersConfigUpsertOutput {
          */
         codeEnabled: boolean;
         /**
-         * Base URL magic links point at, e.g. "https://public.lessly.com/{productId}/users". Null uses the deployment default.
+         * Base URL magic links point at, e.g. "https://public.lepsto.com/{productId}/users". Null uses the deployment default.
          */
         linkBaseUrl: (string | null);
         /**
@@ -123163,7 +123205,7 @@ export interface UsersConfigUpsertOutput {
          */
         doubleOptIn: boolean;
         /**
-         * How long an UNCONVERTED waitlist entry — still pending, or invited and never registered — is kept, counted from SIGN-UP, before the sweep erases it. Default 180: Lessly Privacy Policy §6 promises deletion 6 months from sign-up. The bound stays wide because a client Product answers to its own privacy policy, not ours.
+         * How long an UNCONVERTED waitlist entry — still pending, or invited and never registered — is kept, counted from SIGN-UP, before the sweep erases it. Default 180: Lepsto Privacy Policy §6 promises deletion 6 months from sign-up. The bound stays wide because a client Product answers to its own privacy policy, not ours.
          */
         retentionDays: number;
         /**
@@ -123493,11 +123535,11 @@ export interface UsersOpsRetentionGetOutput {
      */
     waitlistRetentionDays: number;
     /**
-     * What Lessly PUBLISHED, in its Privacy Policy §6: a waitlist address that never converted is deleted 6 months from sign-up. It rides along so the window above can be read against the promise it came from, rather than as a number with no provenance.
+     * What Lepsto PUBLISHED, in its Privacy Policy §6: a waitlist address that never converted is deleted 6 months from sign-up. It rides along so the window above can be read against the promise it came from, rather than as a number with no provenance.
      */
     waitlistPromisedMaxDays: number;
     /**
-     * True when this product configured a window WIDER than the published 180 days. Nothing refuses such a value and nothing clamps it — §6 is Lessly’s own policy and a client Product answers to its own, under which a longer window may be perfectly lawful. This flag exists INSTEAD of that ceiling: a deliberate divergence from what Lessly published must be diagnosable in one call rather than found by comparing two numbers nobody thought to compare.
+     * True when this product configured a window WIDER than the published 180 days. Nothing refuses such a value and nothing clamps it — §6 is Lepsto’s own policy and a client Product answers to its own, under which a longer window may be perfectly lawful. This flag exists INSTEAD of that ceiling: a deliberate divergence from what Lepsto published must be diagnosable in one call rather than found by comparing two numbers nobody thought to compare.
      */
     waitlistWiderThanPromised: boolean;
 }
@@ -123939,7 +123981,7 @@ export interface UsersStatsGetOutput {
      */
     since: string;
     /**
-     * Point-in-time directory populations by DERIVED status — `user` has no status column, these are computed from `waitlisted` and the ban/delete/erase timestamps.
+     * Point-in-time directory populations by DERIVED status — `user` has no status column, these are computed from `kind`, `waitlisted` and the ban/delete/erase timestamps.
      */
     users: {
         /**
@@ -123947,7 +123989,7 @@ export interface UsersStatsGetOutput {
          */
         total: number;
         /**
-         * Full accounts: not waitlisted, not banned, not deleted, not erased.
+         * Full accounts: kind 'account', not waitlisted, not banned, not deleted, not erased.
          */
         active: number;
         /**
@@ -123962,6 +124004,10 @@ export interface UsersStatsGetOutput {
          * SOFT-deleted and still recoverable — not erased.
          */
         deleted: number;
+        /**
+         * People the Product knows who have no credential and have never signed in (kind 'contact'), excluding deleted and erased ones. Never part of `active`, and never billed as retained users.
+         */
+        contacts: number;
         /**
          * Waitlist signups with no credential yet.
          */
@@ -124015,6 +124061,243 @@ export interface UsersStatsGetOutput {
         createdInWindow: number;
     };
 }
+export interface UsersTouchesCreateInput {
+    /**
+     * What was said or done, free text, 1-8192 characters. Personal data: it is whatever an operator typed about this person.
+     */
+    body: string;
+    /**
+     * The end user this interaction was with.
+     */
+    userId: string;
+    /**
+     * How the person was touched: 'message', 'call', 'meeting', 'note' (an internal observation nobody sent) or 'email' sent OUTSIDE the platform. Email this toolkit sent is not logged here — read those from the mail toolkit.
+     */
+    channel: ("message" | "call" | "meeting" | "note" | "email");
+    /**
+     * Which way it went: 'outbound' (you reached them), 'inbound' (they reached you) or 'none'. A 'note' or a 'meeting' must be 'none'.
+     */
+    direction: ("outbound" | "inbound" | "none");
+    /**
+     * When it happened (ISO 8601). Omit to mean now — pass it when logging after the fact, which may be any time in the past.
+     */
+    occurredAt?: string;
+}
+export interface UsersTouchesCreateOutput {
+    /**
+     * Id of this touch. Pass it to users_touches_update or _delete.
+     */
+    id: string;
+    /**
+     * What was said or done, free text, 1-8192 characters. Personal data: it is whatever an operator typed about this person.
+     */
+    body: string;
+    /**
+     * The end user this interaction was with.
+     */
+    userId: string;
+    /**
+     * Id of the operator or agent that logged it, verbatim.
+     */
+    actorId: string;
+    /**
+     * How the person was touched: 'message', 'call', 'meeting', 'note' (an internal observation nobody sent) or 'email' sent OUTSIDE the platform. Email this toolkit sent is not logged here — read those from the mail toolkit.
+     */
+    channel: ("message" | "call" | "meeting" | "note" | "email");
+    /**
+     * Who logged it: 'operator' (a human) or 'agent' (a workflow or agent principal).
+     */
+    actorType: ("operator" | "agent");
+    /**
+     * When the touch was logged (ISO 8601).
+     */
+    createdAt: string;
+    /**
+     * Which way it went: 'outbound' (you reached them), 'inbound' (they reached you) or 'none'. A 'note' or a 'meeting' must be 'none'.
+     */
+    direction: ("outbound" | "inbound" | "none");
+    /**
+     * Product this touch belongs to. Never an input — it comes from the calling identity.
+     */
+    productId: string;
+    /**
+     * When the touch was last edited (ISO 8601).
+     */
+    updatedAt: string;
+    /**
+     * When the interaction happened (ISO 8601) — not when it was logged.
+     */
+    occurredAt: string;
+}
+export interface UsersTouchesDiscardInput {
+    /**
+     * Act on a touch somebody else logged. Without it a touch you did not author answers 404, exactly as a touch that does not exist does — the refusal must not tell you the row is there. Every forced call is recorded in the audit trail.
+     */
+    force?: boolean;
+    /**
+     * The end user the touch belongs to.
+     */
+    userId: string;
+    /**
+     * The touch to delete, from users_touches_list.
+     */
+    touchId: string;
+}
+export interface UsersTouchesDiscardOutput {
+    /**
+     * Id of the touch that was deleted.
+     */
+    id: string;
+    /**
+     * The end user it belonged to.
+     */
+    userId: string;
+    /**
+     * Always true — a failure answers 404 instead.
+     */
+    deleted: true;
+}
+export interface UsersTouchesListInput {
+    /**
+     * Page size, 1-100. Default 50.
+     */
+    limit?: number;
+    /**
+     * Opaque cursor from a previous response's `nextCursor`. Omit for the first page.
+     */
+    cursor?: string;
+    /**
+     * The end user whose touches to list.
+     */
+    userId: string;
+    /**
+     * Only touches on this channel. Omit for all of them.
+     */
+    channel?: ("message" | "call" | "meeting" | "note" | "email");
+}
+export interface UsersTouchesListOutput {
+    /**
+     * The page of touches, newest first.
+     */
+    items: {
+        /**
+         * Id of this touch. Pass it to users_touches_update or _delete.
+         */
+        id: string;
+        /**
+         * What was said or done, free text, 1-8192 characters. Personal data: it is whatever an operator typed about this person.
+         */
+        body: string;
+        /**
+         * The end user this interaction was with.
+         */
+        userId: string;
+        /**
+         * Id of the operator or agent that logged it, verbatim.
+         */
+        actorId: string;
+        /**
+         * How the person was touched: 'message', 'call', 'meeting', 'note' (an internal observation nobody sent) or 'email' sent OUTSIDE the platform. Email this toolkit sent is not logged here — read those from the mail toolkit.
+         */
+        channel: ("message" | "call" | "meeting" | "note" | "email");
+        /**
+         * Who logged it: 'operator' (a human) or 'agent' (a workflow or agent principal).
+         */
+        actorType: ("operator" | "agent");
+        /**
+         * When the touch was logged (ISO 8601).
+         */
+        createdAt: string;
+        /**
+         * Which way it went: 'outbound' (you reached them), 'inbound' (they reached you) or 'none'. A 'note' or a 'meeting' must be 'none'.
+         */
+        direction: ("outbound" | "inbound" | "none");
+        /**
+         * Product this touch belongs to. Never an input — it comes from the calling identity.
+         */
+        productId: string;
+        /**
+         * When the touch was last edited (ISO 8601).
+         */
+        updatedAt: string;
+        /**
+         * When the interaction happened (ISO 8601) — not when it was logged.
+         */
+        occurredAt: string;
+    }[];
+    /**
+     * Pass as `cursor` for the next page. Null when this was the last one.
+     */
+    nextCursor: (string | null);
+}
+export interface UsersTouchesUpdateInput {
+    /**
+     * Replacement text, 1-8192 characters. Omit to leave it unchanged.
+     */
+    body?: string;
+    /**
+     * Act on a touch somebody else logged. Without it a touch you did not author answers 404, exactly as a touch that does not exist does — the refusal must not tell you the row is there. Every forced call is recorded in the audit trail.
+     */
+    force?: boolean;
+    /**
+     * The end user the touch belongs to.
+     */
+    userId: string;
+    /**
+     * The touch to edit, from users_touches_list.
+     */
+    touchId: string;
+    /**
+     * Correct when it happened (ISO 8601). Omit to leave it unchanged.
+     */
+    occurredAt?: string;
+}
+export interface UsersTouchesUpdateOutput {
+    /**
+     * Id of this touch. Pass it to users_touches_update or _delete.
+     */
+    id: string;
+    /**
+     * What was said or done, free text, 1-8192 characters. Personal data: it is whatever an operator typed about this person.
+     */
+    body: string;
+    /**
+     * The end user this interaction was with.
+     */
+    userId: string;
+    /**
+     * Id of the operator or agent that logged it, verbatim.
+     */
+    actorId: string;
+    /**
+     * How the person was touched: 'message', 'call', 'meeting', 'note' (an internal observation nobody sent) or 'email' sent OUTSIDE the platform. Email this toolkit sent is not logged here — read those from the mail toolkit.
+     */
+    channel: ("message" | "call" | "meeting" | "note" | "email");
+    /**
+     * Who logged it: 'operator' (a human) or 'agent' (a workflow or agent principal).
+     */
+    actorType: ("operator" | "agent");
+    /**
+     * When the touch was logged (ISO 8601).
+     */
+    createdAt: string;
+    /**
+     * Which way it went: 'outbound' (you reached them), 'inbound' (they reached you) or 'none'. A 'note' or a 'meeting' must be 'none'.
+     */
+    direction: ("outbound" | "inbound" | "none");
+    /**
+     * Product this touch belongs to. Never an input — it comes from the calling identity.
+     */
+    productId: string;
+    /**
+     * When the touch was last edited (ISO 8601).
+     */
+    updatedAt: string;
+    /**
+     * When the interaction happened (ISO 8601) — not when it was logged.
+     */
+    occurredAt: string;
+}
 export interface UsersUsersBanInput {
     /**
      * The opaque user id returned by users_users_create or _list.
@@ -124026,10 +124309,22 @@ export interface UsersUsersBanOutput {
      * Id of this end user. Pass it to any users_users_* tool.
      */
     id: string;
+    /**
+     * What kind of person this row is: 'account' (can sign in) or 'contact' (known to the Product, no credential, never signed in). A contact is hidden from the default users_users_list view and is never counted as a retained user.
+     */
+    kind: ("account" | "contact");
     /**
      * The user's display name. Null when nobody set one.
      */
     name: (string | null);
+    /**
+     * Free labels on this person, stored trimmed, lowercased and de-duplicated.
+     */
+    tags: string[];
+    /**
+     * The relationship stage, in funnel order: new, contacted, replied, engaged, converted, lost. A real change publishes `users/user.stage-changed`.
+     */
+    stage: ("new" | "contacted" | "replied" | "engaged" | "converted" | "lost");
     /**
      * When the user was banned (ISO 8601). Null while they are not banned.
      */
@@ -124062,6 +124357,10 @@ export interface UsersUsersBanOutput {
      * When the user was last changed (ISO 8601).
      */
     updatedAt: string;
+    /**
+     * Set when you asked for an id that was merged into this account — it is the id you asked for, and this is the row it now lives in. Null on every ordinary read.
+     */
+    mergedFrom: (string | null);
     /**
      * Whether this user is still on the waitlist and cannot sign in yet.
      */
@@ -124075,9 +124374,9 @@ export interface UsersUsersBanOutput {
          */
         id: string;
         /**
-         * What kind of identifier this is. Today always `email`.
+         * What kind of identifier this is: `email`, `phone`, `telegram`, `linkedin` or `x`. Only `email` can be signed in with — the other four are contact channels, reachable but never part of the auth plane.
          */
-        type: "email";
+        type: ("email" | "phone" | "telegram" | "linkedin" | "x");
         /**
          * The address as the user typed it, for display.
          */
@@ -124099,6 +124398,10 @@ export interface UsersUsersBanOutput {
          */
         verificationStatus: ("unverified" | "verified" | "expired");
     }[];
+    /**
+     * When this person was last touched — the most recent logged interaction (ISO 8601). Null when nobody has logged one. This is when the interaction HAPPENED, not when it was logged.
+     */
+    lastTouchAt: (string | null);
     /**
      * When a failed-attempt lockout expires (ISO 8601). Null when the user is not locked out.
      */
@@ -124133,6 +124436,10 @@ export interface UsersUsersBanOutput {
     privateMetadata: {
         [k: string]: unknown;
     };
+    /**
+     * The user this person was merged INTO, when they were merged. Null for everybody else — follow it to find where their records went.
+     */
+    mergedIntoUserId: (string | null);
     /**
      * Id of the primary identifier row. Null when there is no primary identifier.
      */
@@ -124143,10 +124450,22 @@ export interface UsersUsersBanOutput {
     emailChangeLockedUntil: (string | null);
 }
 export interface UsersUsersCreateInput {
+    /**
+     * What kind of person to create. 'account' (the default) can sign in. 'contact' is somebody the Product knows who has NO credential — a contact may not carry `password`, `waitlisted` or `requiresReset` (`contact_cannot_hold_credentials`), is hidden from the default users_users_list view, and is never counted as a retained user. A contact becomes an account only by proving an address, never by an operator setting this.
+     */
+    kind?: ("account" | "contact");
     /**
      * The user's display name.
      */
     name?: string;
+    /**
+     * Free labels for this person. Trimmed, lowercased and de-duplicated on write; at most 32 of at most 64 characters each.
+     */
+    tags?: string[];
+    /**
+     * The relationship stage to start them at, in funnel order: new, contacted, replied, engaged, converted, lost. Default 'new'.
+     */
+    stage?: ("new" | "contacted" | "replied" | "engaged" | "converted" | "lost");
     /**
      * URL of the user's avatar image.
      */
@@ -124177,7 +124496,7 @@ export interface UsersUsersCreateInput {
      */
     waitlisted?: boolean;
     /**
-     * The email addresses that reach this user. At least one is required.
+     * How this user is reached: their email addresses, plus any contact channels (`phone`, `telegram`, `linkedin`, `x`). At least one is required.
      *
      * @minItems 1
      */
@@ -124186,13 +124505,13 @@ export interface UsersUsersCreateInput {
             /**
              * Identifier kind. Only 'email' exists in this phase.
              */
-            type: "email";
+            type: ("email" | "phone" | "telegram" | "linkedin" | "x");
             /**
              * The email address. Stored canonicalised (lowercase, NFC) plus raw for display.
              */
             value: string;
             /**
-             * Record the identifier as already verified (use for trusted imports). Only ONE verified copy of a value may exist per product; unverified duplicates are allowed. Default false.
+             * Record the identifier as already verified (use for trusted imports). IGNORED for contact channels, which are always stored unverified — nothing here can prove a phone or a handle. Only ONE verified copy of an email may exist per product; unverified duplicates are allowed. Default false.
              */
             verified?: boolean;
             /**
@@ -124204,13 +124523,13 @@ export interface UsersUsersCreateInput {
             /**
              * Identifier kind. Only 'email' exists in this phase.
              */
-            type: "email";
+            type: ("email" | "phone" | "telegram" | "linkedin" | "x");
             /**
              * The email address. Stored canonicalised (lowercase, NFC) plus raw for display.
              */
             value: string;
             /**
-             * Record the identifier as already verified (use for trusted imports). Only ONE verified copy of a value may exist per product; unverified duplicates are allowed. Default false.
+             * Record the identifier as already verified (use for trusted imports). IGNORED for contact channels, which are always stored unverified — nothing here can prove a phone or a handle. Only ONE verified copy of an email may exist per product; unverified duplicates are allowed. Default false.
              */
             verified?: boolean;
             /**
@@ -124249,10 +124568,22 @@ export interface UsersUsersCreateOutput {
      * Id of this end user. Pass it to any users_users_* tool.
      */
     id: string;
+    /**
+     * What kind of person this row is: 'account' (can sign in) or 'contact' (known to the Product, no credential, never signed in). A contact is hidden from the default users_users_list view and is never counted as a retained user.
+     */
+    kind: ("account" | "contact");
     /**
      * The user's display name. Null when nobody set one.
      */
     name: (string | null);
+    /**
+     * Free labels on this person, stored trimmed, lowercased and de-duplicated.
+     */
+    tags: string[];
+    /**
+     * The relationship stage, in funnel order: new, contacted, replied, engaged, converted, lost. A real change publishes `users/user.stage-changed`.
+     */
+    stage: ("new" | "contacted" | "replied" | "engaged" | "converted" | "lost");
     /**
      * When the user was banned (ISO 8601). Null while they are not banned.
      */
@@ -124285,6 +124616,10 @@ export interface UsersUsersCreateOutput {
      * When the user was last changed (ISO 8601).
      */
     updatedAt: string;
+    /**
+     * Set when you asked for an id that was merged into this account — it is the id you asked for, and this is the row it now lives in. Null on every ordinary read.
+     */
+    mergedFrom: (string | null);
     /**
      * Whether this user is still on the waitlist and cannot sign in yet.
      */
@@ -124298,9 +124633,9 @@ export interface UsersUsersCreateOutput {
          */
         id: string;
         /**
-         * What kind of identifier this is. Today always `email`.
+         * What kind of identifier this is: `email`, `phone`, `telegram`, `linkedin` or `x`. Only `email` can be signed in with — the other four are contact channels, reachable but never part of the auth plane.
          */
-        type: "email";
+        type: ("email" | "phone" | "telegram" | "linkedin" | "x");
         /**
          * The address as the user typed it, for display.
          */
@@ -124322,6 +124657,10 @@ export interface UsersUsersCreateOutput {
          */
         verificationStatus: ("unverified" | "verified" | "expired");
     }[];
+    /**
+     * When this person was last touched — the most recent logged interaction (ISO 8601). Null when nobody has logged one. This is when the interaction HAPPENED, not when it was logged.
+     */
+    lastTouchAt: (string | null);
     /**
      * When a failed-attempt lockout expires (ISO 8601). Null when the user is not locked out.
      */
@@ -124356,6 +124695,10 @@ export interface UsersUsersCreateOutput {
     privateMetadata: {
         [k: string]: unknown;
     };
+    /**
+     * The user this person was merged INTO, when they were merged. Null for everybody else — follow it to find where their records went.
+     */
+    mergedIntoUserId: (string | null);
     /**
      * Id of the primary identifier row. Null when there is no primary identifier.
      */
@@ -124376,10 +124719,22 @@ export interface UsersUsersDeleteOutput {
      * Id of this end user. Pass it to any users_users_* tool.
      */
     id: string;
+    /**
+     * What kind of person this row is: 'account' (can sign in) or 'contact' (known to the Product, no credential, never signed in). A contact is hidden from the default users_users_list view and is never counted as a retained user.
+     */
+    kind: ("account" | "contact");
     /**
      * The user's display name. Null when nobody set one.
      */
     name: (string | null);
+    /**
+     * Free labels on this person, stored trimmed, lowercased and de-duplicated.
+     */
+    tags: string[];
+    /**
+     * The relationship stage, in funnel order: new, contacted, replied, engaged, converted, lost. A real change publishes `users/user.stage-changed`.
+     */
+    stage: ("new" | "contacted" | "replied" | "engaged" | "converted" | "lost");
     /**
      * When the user was banned (ISO 8601). Null while they are not banned.
      */
@@ -124412,6 +124767,10 @@ export interface UsersUsersDeleteOutput {
      * When the user was last changed (ISO 8601).
      */
     updatedAt: string;
+    /**
+     * Set when you asked for an id that was merged into this account — it is the id you asked for, and this is the row it now lives in. Null on every ordinary read.
+     */
+    mergedFrom: (string | null);
     /**
      * Whether this user is still on the waitlist and cannot sign in yet.
      */
@@ -124425,9 +124784,9 @@ export interface UsersUsersDeleteOutput {
          */
         id: string;
         /**
-         * What kind of identifier this is. Today always `email`.
+         * What kind of identifier this is: `email`, `phone`, `telegram`, `linkedin` or `x`. Only `email` can be signed in with — the other four are contact channels, reachable but never part of the auth plane.
          */
-        type: "email";
+        type: ("email" | "phone" | "telegram" | "linkedin" | "x");
         /**
          * The address as the user typed it, for display.
          */
@@ -124449,6 +124808,10 @@ export interface UsersUsersDeleteOutput {
          */
         verificationStatus: ("unverified" | "verified" | "expired");
     }[];
+    /**
+     * When this person was last touched — the most recent logged interaction (ISO 8601). Null when nobody has logged one. This is when the interaction HAPPENED, not when it was logged.
+     */
+    lastTouchAt: (string | null);
     /**
      * When a failed-attempt lockout expires (ISO 8601). Null when the user is not locked out.
      */
@@ -124483,6 +124846,10 @@ export interface UsersUsersDeleteOutput {
     privateMetadata: {
         [k: string]: unknown;
     };
+    /**
+     * The user this person was merged INTO, when they were merged. Null for everybody else — follow it to find where their records went.
+     */
+    mergedIntoUserId: (string | null);
     /**
      * Id of the primary identifier row. Null when there is no primary identifier.
      */
@@ -124493,6 +124860,10 @@ export interface UsersUsersDeleteOutput {
     emailChangeLockedUntil: (string | null);
 }
 export interface UsersUsersExportInput {
+    /**
+     * Filter by kind: 'account' or 'contact'. Omit for accounts only, unless `includeContacts` is true.
+     */
+    kind?: ("account" | "contact");
     /**
      * Rows per page, 1-500. Default 100.
      */
@@ -124513,6 +124884,10 @@ export interface UsersUsersExportInput {
      * Include soft-deleted users. Default false.
      */
     includeDeleted?: boolean;
+    /**
+     * Include CONTACTS alongside accounts, so one pass exports both. Default false — the same rule this export already applies to waitlist signups and test users.
+     */
+    includeContacts?: boolean;
 }
 export interface UsersUsersExportOutput {
     count: number;
@@ -124521,10 +124896,22 @@ export interface UsersUsersExportOutput {
          * Id of this end user. Pass it to any users_users_* tool.
          */
         id: string;
+        /**
+         * What kind of person this row is: 'account' (can sign in) or 'contact' (known to the Product, no credential, never signed in). A contact is hidden from the default users_users_list view and is never counted as a retained user.
+         */
+        kind: ("account" | "contact");
         /**
          * The user's display name. Null when nobody set one.
          */
         name: (string | null);
+        /**
+         * Free labels on this person, stored trimmed, lowercased and de-duplicated.
+         */
+        tags: string[];
+        /**
+         * The relationship stage, in funnel order: new, contacted, replied, engaged, converted, lost. A real change publishes `users/user.stage-changed`.
+         */
+        stage: ("new" | "contacted" | "replied" | "engaged" | "converted" | "lost");
         /**
          * When the user was banned (ISO 8601). Null while they are not banned.
          */
@@ -124557,6 +124944,10 @@ export interface UsersUsersExportOutput {
          * When the user was last changed (ISO 8601).
          */
         updatedAt: string;
+        /**
+         * Set when you asked for an id that was merged into this account — it is the id you asked for, and this is the row it now lives in. Null on every ordinary read.
+         */
+        mergedFrom: (string | null);
         /**
          * Whether this user is still on the waitlist and cannot sign in yet.
          */
@@ -124570,9 +124961,9 @@ export interface UsersUsersExportOutput {
              */
             id: string;
             /**
-             * What kind of identifier this is. Today always `email`.
+             * What kind of identifier this is: `email`, `phone`, `telegram`, `linkedin` or `x`. Only `email` can be signed in with — the other four are contact channels, reachable but never part of the auth plane.
              */
-            type: "email";
+            type: ("email" | "phone" | "telegram" | "linkedin" | "x");
             /**
              * The address as the user typed it, for display.
              */
@@ -124594,6 +124985,10 @@ export interface UsersUsersExportOutput {
              */
             verificationStatus: ("unverified" | "verified" | "expired");
         }[];
+        /**
+         * When this person was last touched — the most recent logged interaction (ISO 8601). Null when nobody has logged one. This is when the interaction HAPPENED, not when it was logged.
+         */
+        lastTouchAt: (string | null);
         /**
          * When a failed-attempt lockout expires (ISO 8601). Null when the user is not locked out.
          */
@@ -124628,6 +125023,10 @@ export interface UsersUsersExportOutput {
         privateMetadata: {
             [k: string]: unknown;
         };
+        /**
+         * The user this person was merged INTO, when they were merged. Null for everybody else — follow it to find where their records went.
+         */
+        mergedIntoUserId: (string | null);
         /**
          * Id of the primary identifier row. Null when there is no primary identifier.
          */
@@ -124651,10 +125050,22 @@ export interface UsersUsersGetOutput {
      * Id of this end user. Pass it to any users_users_* tool.
      */
     id: string;
+    /**
+     * What kind of person this row is: 'account' (can sign in) or 'contact' (known to the Product, no credential, never signed in). A contact is hidden from the default users_users_list view and is never counted as a retained user.
+     */
+    kind: ("account" | "contact");
     /**
      * The user's display name. Null when nobody set one.
      */
     name: (string | null);
+    /**
+     * Free labels on this person, stored trimmed, lowercased and de-duplicated.
+     */
+    tags: string[];
+    /**
+     * The relationship stage, in funnel order: new, contacted, replied, engaged, converted, lost. A real change publishes `users/user.stage-changed`.
+     */
+    stage: ("new" | "contacted" | "replied" | "engaged" | "converted" | "lost");
     /**
      * When the user was banned (ISO 8601). Null while they are not banned.
      */
@@ -124687,6 +125098,10 @@ export interface UsersUsersGetOutput {
      * When the user was last changed (ISO 8601).
      */
     updatedAt: string;
+    /**
+     * Set when you asked for an id that was merged into this account — it is the id you asked for, and this is the row it now lives in. Null on every ordinary read.
+     */
+    mergedFrom: (string | null);
     /**
      * Whether this user is still on the waitlist and cannot sign in yet.
      */
@@ -124700,9 +125115,9 @@ export interface UsersUsersGetOutput {
          */
         id: string;
         /**
-         * What kind of identifier this is. Today always `email`.
+         * What kind of identifier this is: `email`, `phone`, `telegram`, `linkedin` or `x`. Only `email` can be signed in with — the other four are contact channels, reachable but never part of the auth plane.
          */
-        type: "email";
+        type: ("email" | "phone" | "telegram" | "linkedin" | "x");
         /**
          * The address as the user typed it, for display.
          */
@@ -124724,6 +125139,10 @@ export interface UsersUsersGetOutput {
          */
         verificationStatus: ("unverified" | "verified" | "expired");
     }[];
+    /**
+     * When this person was last touched — the most recent logged interaction (ISO 8601). Null when nobody has logged one. This is when the interaction HAPPENED, not when it was logged.
+     */
+    lastTouchAt: (string | null);
     /**
      * When a failed-attempt lockout expires (ISO 8601). Null when the user is not locked out.
      */
@@ -124758,6 +125177,10 @@ export interface UsersUsersGetOutput {
     privateMetadata: {
         [k: string]: unknown;
     };
+    /**
+     * The user this person was merged INTO, when they were merged. Null for everybody else — follow it to find where their records went.
+     */
+    mergedIntoUserId: (string | null);
     /**
      * Id of the primary identifier row. Null when there is no primary identifier.
      */
@@ -124810,6 +125233,10 @@ export interface UsersUsersImportOutput {
      * How many rows were passed over — an address already in the directory, typically.
      */
     skipped: number;
+    /**
+     * How many of the CREATED users were contacts (`kind: 'contact'`). A row that was skipped or failed is not counted.
+     */
+    contacts: number;
     /**
      * How many rows you submitted.
      */
@@ -124856,6 +125283,14 @@ export interface UsersUsersInviteOutput {
     expiresAt: string;
 }
 export interface UsersUsersListInput {
+    /**
+     * Return only people carrying this tag. ONE tag, matched against the stored (lowercased) value and ANDed with the other filters.
+     */
+    tag?: string;
+    /**
+     * Filter by kind: 'account' or 'contact'. Passing 'contact' is how you list contacts — they are hidden otherwise. Omit for accounts only, unless `includeContacts` is true.
+     */
+    kind?: ("account" | "contact");
     /**
      * Page size, 1-100. Default 25.
      */
@@ -124864,6 +125299,10 @@ export interface UsersUsersListInput {
      * Case-insensitive substring match against the user's identifiers (email) and name.
      */
     query?: string;
+    /**
+     * Filter by relationship stage: new, contacted, replied, engaged, converted or lost. Omit for every stage.
+     */
+    stage?: ("new" | "contacted" | "replied" | "engaged" | "converted" | "lost");
     /**
      * Opaque cursor from a previous response's `nextCursor`. Omit for the first page.
      */
@@ -124876,6 +125315,18 @@ export interface UsersUsersListInput {
      * Include soft-deleted users. Default false — deleted users are hidden.
      */
     includeDeleted?: boolean;
+    /**
+     * Only people whose most recent logged interaction happened at or after this instant (ISO 8601). People never touched are EXCLUDED by this filter — list without it to see everyone.
+     */
+    lastTouchAfter?: string;
+    /**
+     * Include CONTACTS. Default false: a contact has no credential and has never signed in, so it is not part of the directory an operator browses — the same rule waitlist signups and test users follow. Use `kind: "contact"` to see only them.
+     */
+    includeContacts?: boolean;
+    /**
+     * Only people whose most recent logged interaction happened before this instant (ISO 8601) — the "gone quiet" list. People never touched are EXCLUDED rather than treated as infinitely stale; list without this filter to see everyone.
+     */
+    lastTouchBefore?: string;
     /**
      * Include TEST USERS. Default false: a test user is a fixture, not a customer — it is excluded from metering and from this listing for the same reason. Ask for it explicitly when you are debugging the fixtures themselves.
      */
@@ -124894,10 +125345,22 @@ export interface UsersUsersListOutput {
          * Id of this end user. Pass it to any users_users_* tool.
          */
         id: string;
+        /**
+         * What kind of person this row is: 'account' (can sign in) or 'contact' (known to the Product, no credential, never signed in). A contact is hidden from the default users_users_list view and is never counted as a retained user.
+         */
+        kind: ("account" | "contact");
         /**
          * The user's display name. Null when nobody set one.
          */
         name: (string | null);
+        /**
+         * Free labels on this person, stored trimmed, lowercased and de-duplicated.
+         */
+        tags: string[];
+        /**
+         * The relationship stage, in funnel order: new, contacted, replied, engaged, converted, lost. A real change publishes `users/user.stage-changed`.
+         */
+        stage: ("new" | "contacted" | "replied" | "engaged" | "converted" | "lost");
         /**
          * When the user was banned (ISO 8601). Null while they are not banned.
          */
@@ -124930,6 +125393,10 @@ export interface UsersUsersListOutput {
          * When the user was last changed (ISO 8601).
          */
         updatedAt: string;
+        /**
+         * Set when you asked for an id that was merged into this account — it is the id you asked for, and this is the row it now lives in. Null on every ordinary read.
+         */
+        mergedFrom: (string | null);
         /**
          * Whether this user is still on the waitlist and cannot sign in yet.
          */
@@ -124943,9 +125410,9 @@ export interface UsersUsersListOutput {
              */
             id: string;
             /**
-             * What kind of identifier this is. Today always `email`.
+             * What kind of identifier this is: `email`, `phone`, `telegram`, `linkedin` or `x`. Only `email` can be signed in with — the other four are contact channels, reachable but never part of the auth plane.
              */
-            type: "email";
+            type: ("email" | "phone" | "telegram" | "linkedin" | "x");
             /**
              * The address as the user typed it, for display.
              */
@@ -124967,6 +125434,10 @@ export interface UsersUsersListOutput {
              */
             verificationStatus: ("unverified" | "verified" | "expired");
         }[];
+        /**
+         * When this person was last touched — the most recent logged interaction (ISO 8601). Null when nobody has logged one. This is when the interaction HAPPENED, not when it was logged.
+         */
+        lastTouchAt: (string | null);
         /**
          * When a failed-attempt lockout expires (ISO 8601). Null when the user is not locked out.
          */
@@ -125001,6 +125472,10 @@ export interface UsersUsersListOutput {
         privateMetadata: {
             [k: string]: unknown;
         };
+        /**
+         * The user this person was merged INTO, when they were merged. Null for everybody else — follow it to find where their records went.
+         */
+        mergedIntoUserId: (string | null);
         /**
          * Id of the primary identifier row. Null when there is no primary identifier.
          */
@@ -125050,10 +125525,22 @@ export interface UsersUsersUnbanOutput {
      * Id of this end user. Pass it to any users_users_* tool.
      */
     id: string;
+    /**
+     * What kind of person this row is: 'account' (can sign in) or 'contact' (known to the Product, no credential, never signed in). A contact is hidden from the default users_users_list view and is never counted as a retained user.
+     */
+    kind: ("account" | "contact");
     /**
      * The user's display name. Null when nobody set one.
      */
     name: (string | null);
+    /**
+     * Free labels on this person, stored trimmed, lowercased and de-duplicated.
+     */
+    tags: string[];
+    /**
+     * The relationship stage, in funnel order: new, contacted, replied, engaged, converted, lost. A real change publishes `users/user.stage-changed`.
+     */
+    stage: ("new" | "contacted" | "replied" | "engaged" | "converted" | "lost");
     /**
      * When the user was banned (ISO 8601). Null while they are not banned.
      */
@@ -125086,6 +125573,10 @@ export interface UsersUsersUnbanOutput {
      * When the user was last changed (ISO 8601).
      */
     updatedAt: string;
+    /**
+     * Set when you asked for an id that was merged into this account — it is the id you asked for, and this is the row it now lives in. Null on every ordinary read.
+     */
+    mergedFrom: (string | null);
     /**
      * Whether this user is still on the waitlist and cannot sign in yet.
      */
@@ -125099,9 +125590,9 @@ export interface UsersUsersUnbanOutput {
          */
         id: string;
         /**
-         * What kind of identifier this is. Today always `email`.
+         * What kind of identifier this is: `email`, `phone`, `telegram`, `linkedin` or `x`. Only `email` can be signed in with — the other four are contact channels, reachable but never part of the auth plane.
          */
-        type: "email";
+        type: ("email" | "phone" | "telegram" | "linkedin" | "x");
         /**
          * The address as the user typed it, for display.
          */
@@ -125123,6 +125614,10 @@ export interface UsersUsersUnbanOutput {
          */
         verificationStatus: ("unverified" | "verified" | "expired");
     }[];
+    /**
+     * When this person was last touched — the most recent logged interaction (ISO 8601). Null when nobody has logged one. This is when the interaction HAPPENED, not when it was logged.
+     */
+    lastTouchAt: (string | null);
     /**
      * When a failed-attempt lockout expires (ISO 8601). Null when the user is not locked out.
      */
@@ -125157,6 +125652,10 @@ export interface UsersUsersUnbanOutput {
     privateMetadata: {
         [k: string]: unknown;
     };
+    /**
+     * The user this person was merged INTO, when they were merged. Null for everybody else — follow it to find where their records went.
+     */
+    mergedIntoUserId: (string | null);
     /**
      * Id of the primary identifier row. Null when there is no primary identifier.
      */
@@ -125171,6 +125670,14 @@ export interface UsersUsersUpdateInput {
      * The user's display name. Pass null to clear.
      */
     name?: (string | null);
+    /**
+     * REPLACES the whole tag list — send every tag you want stored, not just the new ones. Trimmed, lowercased and de-duplicated on write.
+     */
+    tags?: string[];
+    /**
+     * Move the person to this relationship stage. A real change publishes `users/user.stage-changed`; a patch that changes ONLY the stage deliberately does not also publish `users/user.updated`, so a workflow that writes stages does not wake itself.
+     */
+    stage?: ("new" | "contacted" | "replied" | "engaged" | "converted" | "lost");
     /**
      * The user to update.
      */
@@ -125217,10 +125724,22 @@ export interface UsersUsersUpdateOutput {
      * Id of this end user. Pass it to any users_users_* tool.
      */
     id: string;
+    /**
+     * What kind of person this row is: 'account' (can sign in) or 'contact' (known to the Product, no credential, never signed in). A contact is hidden from the default users_users_list view and is never counted as a retained user.
+     */
+    kind: ("account" | "contact");
     /**
      * The user's display name. Null when nobody set one.
      */
     name: (string | null);
+    /**
+     * Free labels on this person, stored trimmed, lowercased and de-duplicated.
+     */
+    tags: string[];
+    /**
+     * The relationship stage, in funnel order: new, contacted, replied, engaged, converted, lost. A real change publishes `users/user.stage-changed`.
+     */
+    stage: ("new" | "contacted" | "replied" | "engaged" | "converted" | "lost");
     /**
      * When the user was banned (ISO 8601). Null while they are not banned.
      */
@@ -125253,6 +125772,10 @@ export interface UsersUsersUpdateOutput {
      * When the user was last changed (ISO 8601).
      */
     updatedAt: string;
+    /**
+     * Set when you asked for an id that was merged into this account — it is the id you asked for, and this is the row it now lives in. Null on every ordinary read.
+     */
+    mergedFrom: (string | null);
     /**
      * Whether this user is still on the waitlist and cannot sign in yet.
      */
@@ -125266,9 +125789,9 @@ export interface UsersUsersUpdateOutput {
          */
         id: string;
         /**
-         * What kind of identifier this is. Today always `email`.
+         * What kind of identifier this is: `email`, `phone`, `telegram`, `linkedin` or `x`. Only `email` can be signed in with — the other four are contact channels, reachable but never part of the auth plane.
          */
-        type: "email";
+        type: ("email" | "phone" | "telegram" | "linkedin" | "x");
         /**
          * The address as the user typed it, for display.
          */
@@ -125290,6 +125813,10 @@ export interface UsersUsersUpdateOutput {
          */
         verificationStatus: ("unverified" | "verified" | "expired");
     }[];
+    /**
+     * When this person was last touched — the most recent logged interaction (ISO 8601). Null when nobody has logged one. This is when the interaction HAPPENED, not when it was logged.
+     */
+    lastTouchAt: (string | null);
     /**
      * When a failed-attempt lockout expires (ISO 8601). Null when the user is not locked out.
      */
@@ -125324,6 +125851,10 @@ export interface UsersUsersUpdateOutput {
     privateMetadata: {
         [k: string]: unknown;
     };
+    /**
+     * The user this person was merged INTO, when they were merged. Null for everybody else — follow it to find where their records went.
+     */
+    mergedIntoUserId: (string | null);
     /**
      * Id of the primary identifier row. Null when there is no primary identifier.
      */