@lessly/sdk-app 17.0.0 → 17.2.0

package/src/gen/types.gen.ts

@@ -15461,6 +15461,2705 @@ scriptUrl: string
 minimalSnippet: string
 }
 
+export interface UsersApikeysCreateInput {
+/**
+ * A label only humans read — which backend or environment holds this key.
+ */
+name: string
+/**
+ * 'server' mints a SECRET key (usk_…) for the Product's backend — returned exactly once and stored hashed. 'publishable' mints a non-secret key (upk_…) that identifies this product in browser flows and stays readable.
+ */
+type: ("server" | "publishable")
+}
+
+export interface UsersApikeysCreateOutput {
+id: string
+key: string
+name: string
+type: ("server" | "publishable")
+value: (string | null)
+prefix: string
+createdAt: string
+revokedAt: (string | null)
+}
+
+export interface UsersApikeysListInput {
+
+}
+
+export interface UsersApikeysListOutput {
+keys: {
+id: string
+name: string
+type: ("server" | "publishable")
+value: (string | null)
+prefix: string
+createdAt: string
+revokedAt: (string | null)
+}[]
+}
+
+export interface UsersApikeysRevokeInput {
+/**
+ * Id of the key to revoke. Revocation is immediate and final.
+ */
+id: string
+}
+
+export interface UsersApikeysRevokeOutput {
+id: string
+revoked: true
+}
+
+export interface UsersAuditListInput {
+/**
+ * Page size, 1-100. Default 25.
+ */
+limit?: number
+/**
+ * ISO-8601 lower bound (inclusive) on the event timestamp.
+ */
+since?: string
+/**
+ * ISO-8601 upper bound (exclusive) on the event timestamp.
+ */
+until?: string
+/**
+ * Exact action to filter by, e.g. 'user.banned'. Omit for all actions.
+ */
+action?: string
+/**
+ * Opaque cursor from a previous response's `nextCursor`. Omit for the first page.
+ */
+cursor?: string
+/**
+ * Exact id of the audited target, e.g. a user id.
+ */
+targetId?: string
+/**
+ * Target kind to filter by, e.g. 'user'.
+ */
+targetType?: string
+}
+
+export interface UsersAuditListOutput {
+events: {
+id: string
+ip: (string | null)
+action: string
+actorId: (string | null)
+metadata: {
+[k: string]: unknown
+}
+targetId: (string | null)
+actorType: ("operator" | "system" | "end_user")
+createdAt: string
+productId: string
+userAgent: (string | null)
+targetType: (string | null)
+}[]
+nextCursor: (string | null)
+}
+
+export interface UsersConfigGetInput {
+
+}
+
+export interface UsersConfigGetOutput {
+mfa: {
+/**
+ * Whether a second factor is MANDATORY for this product. When true, a user may not unenroll their last verified factor. Default false.
+ */
+required: boolean
+/**
+ * How many single-use backup codes a batch contains. Default 10.
+ */
+backupCodeCount: number
+/**
+ * Mandatory delay on an operator-initiated factor reset, in hours — the abort window the user is emailed. Default 72.
+ */
+resetDelayHours: number
+/**
+ * How long a passed step-up challenge stays spendable, in minutes. The grant is SINGLE-USE regardless. Default 5.
+ */
+stepUpGrantMinutes: number
+/**
+ * Wrong BACKUP codes before the account is locked, counted separately from TOTP. Default 5.
+ */
+maxBackupCodeAttempts: number
+/**
+ * Wrong second-factor codes before the account is locked. Default 5.
+ */
+maxSecondFactorAttempts: number
+/**
+ * How recently the caller must have authenticated to enroll or regenerate a factor, in minutes. Default 10.
+ */
+sensitiveAuthAgeMinutes: number
+}
+email: {
+/**
+ * Sender for auth email, e.g. "Acme <auth@acme.com>". MUST be on a domain verified in this product's mail toolkit. While it is null, email_code/email_link are not offered as strategies.
+ */
+from: (string | null)
+/**
+ * Offer the 6-digit code strategy (email_code). Default true.
+ */
+codeEnabled: boolean
+/**
+ * Base URL magic links point at, e.g. "https://public.lessly.com/{productId}/users". Null uses the deployment default.
+ */
+linkBaseUrl: (string | null)
+/**
+ * Offer the magic-link strategy (email_link). Default true.
+ */
+linkEnabled: boolean
+/**
+ * How long an emailed code or link stays usable, in minutes. Default 15.
+ */
+codeTtlMinutes: number
+/**
+ * Auth emails one address may receive per day. Default 10.
+ */
+resendDailyCap: number
+/**
+ * Wrong-code entries allowed per token before it is spent. Default 5.
+ */
+maxCodeAttempts: number
+/**
+ * Minimum seconds between two auth emails to one address. Floor of 60 is enforced regardless. Default 60.
+ */
+resendCooldownSeconds: number
+}
+oauth: {
+providers: {
+github: UsersConfigGetOutputGoogle
+google: UsersConfigGetOutputGoogle
+}
+}
+hosted: {
+/**
+ * Serve the hosted sign-in, sign-up and recovery pages for this product. Default true. False answers those routes with a refusal page instead — for a product that ships its own frontend and wants no second front door.
+ */
+enabled: boolean
+/**
+ * Absolute https URL of a logo rendered above the form. Null renders no logo.
+ */
+logoUrl: (string | null)
+/**
+ * Terms link rendered in the footer. Null renders no link.
+ */
+termsUrl: (string | null)
+/**
+ * CSS colour of the body text.
+ */
+textColor: string
+/**
+ * One line under the card. Null renders no footer.
+ */
+footerText: (string | null)
+/**
+ * Privacy-policy link rendered in the footer. Null renders no link.
+ */
+privacyUrl: (string | null)
+/**
+ * CSS colour for the submit button, the links and the focus ring.
+ */
+accentColor: string
+/**
+ * Shown in the heading and the page title. Default "This product".
+ */
+productName: string
+/**
+ * CSS length for the card and its controls, e.g. "12px".
+ */
+borderRadius: string
+/**
+ * CSS colour of the card itself.
+ */
+surfaceColor: string
+/**
+ * CSS colour of secondary text and hints.
+ */
+mutedTextColor: string
+/**
+ * CSS colour of the page behind the card.
+ */
+backgroundColor: string
+}
+invite: {
+/**
+ * How long an invite link stays usable, in days. Default 14.
+ */
+ttlDays: number
+/**
+ * Minimum minutes between two invite emails to one address. Default 60.
+ */
+resendCooldownMinutes: number
+}
+status: ("active" | "paused")
+captcha: {
+enabled: boolean
+siteKey: (string | null)
+provider: "turnstile"
+riskElevated: boolean
+}
+recovery: {
+/**
+ * Offer the password-recovery flow at all. Default true.
+ */
+enabled: boolean
+/**
+ * How long a reset link stays usable, in minutes. Default 60.
+ */
+ttlMinutes: number
+}
+testMode: {
+/**
+ * Opt this product into test mode. Refused outright on a production deployment — the environment gate is checked first and cannot be configured away. Turning it on is audited and raises an alert. Default false.
+ */
+enabled: boolean
+}
+waitlist: {
+/**
+ * The embeddable widget’s copy and colours.
+ */
+widget: {
+/**
+ * Heading above the widget form.
+ */
+title: string
+/**
+ * Link rendered beside the consent text. Null renders no link.
+ */
+policyUrl: (string | null)
+/**
+ * CSS colour for the button and the focus ring.
+ */
+accentColor: string
+/**
+ * Submit button copy.
+ */
+buttonLabel: string
+/**
+ * Consent checkbox copy. Null renders no checkbox, and the signup records the consent proof as `unspecified`.
+ */
+consentText: (string | null)
+/**
+ * One line under the heading.
+ */
+description: string
+/**
+ * The privacy-policy version the widget records in each consent proof.
+ */
+policyVersion: string
+/**
+ * Shown after a submission. ONE message for every outcome: the signup route answers identically whether or not the address was already on the list.
+ */
+successMessage: string
+}
+/**
+ * Require a confirmation email before a waitlist signup counts. Default false — the entry is created either way, but an unconfirmed one is reported separately and is never invited.
+ */
+doubleOptIn: boolean
+/**
+ * How long a still-pending waitlist entry is kept before the sweep erases it. Default 365.
+ */
+retentionDays: number
+/**
+ * How long a double-opt-in confirmation link stays usable, in hours. Default 48.
+ */
+confirmTtlHours: number
+}
+productId: string
+retention: {
+/**
+ * How long an EXPIRED flow attempt is kept after its own expiry. Default 0 — swept as soon as it dies, which is what the reaper did before this window existed.
+ */
+flowAttemptDays: number
+/**
+ * How long a SPENT or EXPIRED one-time token row (an OTP, a magic link, a recovery or abort token) is kept after it stops being usable, for forensics. The secret is a hash and the row is already dead — this only decides how long the trail lives. Default 30.
+ */
+oneTimeTokenDays: number
+/**
+ * How long an EXPIRED session and its refresh tokens are kept after expiry. Zero does not shorten any lifetime: a session past either window can never be refreshed again, so the row is already inert. Default 0.
+ */
+expiredSessionDays: number
+}
+protection: {
+/**
+ * Check passwords against the HaveIBeenPwned breach corpus (k-anonymity). Blocking at sign-up, advisory at sign-in. Default true.
+ */
+hibpEnabled: boolean
+/**
+ * How long an account stays locked. Self-healing — the lock expires on its own. Default 15.
+ */
+lockoutMinutes: number
+/**
+ * Failed sign-ins for one identifier before the account is locked. Default 10.
+ */
+maxFailedAttempts: number
+/**
+ * Flow calls allowed per IP per product per window before HTTP 429. Default 120.
+ */
+ipAttemptsPerWindow: number
+/**
+ * Sliding window the failed sign-ins are counted over, in minutes. Default 15.
+ */
+failedAttemptWindowMinutes: number
+/**
+ * Flow calls allowed per identifier per window before HTTP 429. Default 30.
+ */
+identifierAttemptsPerWindow: number
+}
+signupMode: ("public" | "invite-only" | "waitlist")
+emailChange: {
+/**
+ * Allow end users to change their email address. Default true.
+ */
+enabled: boolean
+/**
+ * How long after a REVERT further email changes are refused, in days. Default 7.
+ */
+cooldownDays: number
+/**
+ * How long the old address may undo the change, in days. Default 30.
+ */
+revertTtlDays: number
+/**
+ * How long the two confirmation links stay usable, in hours. Default 24.
+ */
+requestTtlHours: number
+/**
+ * Mandatory delay on an operator-assisted override, in hours — the abort window the old address is notified with. Default 72.
+ */
+overrideDelayHours: number
+}
+notifications: {
+/**
+ * Email the user the first time a session appears from an unseen device. Default true.
+ */
+newDevice: boolean
+/**
+ * Email the old address when an email change is requested, completed, reverted or overridden. Default true.
+ */
+emailChange: boolean
+/**
+ * Email the user when an operator impersonates their account. Default true.
+ */
+impersonation: boolean
+/**
+ * Email the user when their password is set or changed. Default true.
+ */
+passwordChanged: boolean
+}
+allowedOrigins: string[]
+passwordPolicy: {
+/**
+ * Minimum password length. Default 8.
+ */
+minLength: number
+/**
+ * Require at least one digit.
+ */
+requireNumber: boolean
+/**
+ * Require at least one non-alphanumeric character.
+ */
+requireSymbol: boolean
+/**
+ * Require at least one uppercase letter.
+ */
+requireUppercase: boolean
+}
+sessionTtlHours: number
+lifecycleBlocked: boolean
+lifecycleArchived: boolean
+refreshSlidingDays: number
+refreshAbsoluteDays: number
+redirectUriAllowlist: string[]
+accessTokenTtlMinutes: number
+captchaSecretConfigured: boolean
+}
+export interface UsersConfigGetOutputGoogle {
+enabled: boolean
+clientId: (string | null)
+secretConfigured: boolean
+}
+
+export interface UsersConfigUpsertInput {
+/**
+ * MFA settings: backup-code batch size, the operator-reset delay, how fresh authentication must be to enroll, and the second-factor lockout ceilings. Merged field-by-field.
+ */
+mfa?: {
+/**
+ * Whether a second factor is MANDATORY for this product. When true, a user may not unenroll their last verified factor. Default false.
+ */
+required?: boolean
+/**
+ * How many single-use backup codes a batch contains. Default 10.
+ */
+backupCodeCount?: number
+/**
+ * Mandatory delay on an operator-initiated factor reset, in hours — the abort window the user is emailed. Default 72.
+ */
+resetDelayHours?: number
+/**
+ * How long a passed step-up challenge stays spendable, in minutes. The grant is SINGLE-USE regardless. Default 5.
+ */
+stepUpGrantMinutes?: number
+/**
+ * Wrong BACKUP codes before the account is locked, counted separately from TOTP. Default 5.
+ */
+maxBackupCodeAttempts?: number
+/**
+ * Wrong second-factor codes before the account is locked. Default 5.
+ */
+maxSecondFactorAttempts?: number
+/**
+ * How recently the caller must have authenticated to enroll or regenerate a factor, in minutes. Default 10.
+ */
+sensitiveAuthAgeMinutes?: number
+}
+/**
+ * Email OTP / magic-link settings. Merged field-by-field. Set `email.from` to a sender on a domain verified in this product's mail toolkit — until then the email strategies are not offered.
+ */
+email?: {
+/**
+ * Sender for auth email, e.g. "Acme <auth@acme.com>". MUST be on a domain verified in this product's mail toolkit. While it is null, email_code/email_link are not offered as strategies.
+ */
+from?: (string | null)
+/**
+ * Offer the 6-digit code strategy (email_code). Default true.
+ */
+codeEnabled?: boolean
+/**
+ * Base URL magic links point at, e.g. "https://public.lessly.com/{productId}/users". Null uses the deployment default.
+ */
+linkBaseUrl?: (string | null)
+/**
+ * Offer the magic-link strategy (email_link). Default true.
+ */
+linkEnabled?: boolean
+/**
+ * How long an emailed code or link stays usable, in minutes. Default 15.
+ */
+codeTtlMinutes?: number
+/**
+ * Auth emails one address may receive per day. Default 10.
+ */
+resendDailyCap?: number
+/**
+ * Wrong-code entries allowed per token before it is spent. Default 5.
+ */
+maxCodeAttempts?: number
+/**
+ * Minimum seconds between two auth emails to one address. Floor of 60 is enforced regardless. Default 60.
+ */
+resendCooldownSeconds?: number
+}
+/**
+ * OAuth provider credentials and switches, per provider. Merged field-by-field. A provider is offered as a sign-in strategy only when it is enabled AND a full client id + secret pair resolves — from here, or from the deployment's shared development credentials.
+ */
+oauth?: {
+github?: UsersConfigUpsertInputGoogle
+/**
+ * Google sign-in credentials and switch.
+ */
+google?: {
+/**
+ * Offer this provider as a sign-in strategy.
+ */
+enabled?: boolean
+/**
+ * The OAuth client id from the provider console. Pass null to clear it and fall back to the deployment's shared development credentials, if it has any.
+ */
+clientId?: (string | null)
+/**
+ * WRITE-ONLY. The OAuth client secret; stored encrypted and never returned. Omit to leave the stored secret untouched, pass null to clear it.
+ */
+clientSecret?: (string | null)
+}
+}
+/**
+ * The hosted sign-in / sign-up / recovery pages: whether they are served, and the product name, logo, colours and footer links they render with. Merged field-by-field, so setting one colour leaves the rest alone.
+ */
+hosted?: {
+/**
+ * Serve the hosted sign-in, sign-up and recovery pages for this product. Default true. False answers those routes with a refusal page instead — for a product that ships its own frontend and wants no second front door.
+ */
+enabled?: boolean
+/**
+ * Absolute https URL of a logo rendered above the form. Null renders no logo.
+ */
+logoUrl?: (string | null)
+/**
+ * Terms link rendered in the footer. Null renders no link.
+ */
+termsUrl?: (string | null)
+/**
+ * CSS colour of the body text.
+ */
+textColor?: string
+/**
+ * One line under the card. Null renders no footer.
+ */
+footerText?: (string | null)
+/**
+ * Privacy-policy link rendered in the footer. Null renders no link.
+ */
+privacyUrl?: (string | null)
+/**
+ * CSS colour for the submit button, the links and the focus ring.
+ */
+accentColor?: string
+/**
+ * Shown in the heading and the page title. Default "This product".
+ */
+productName?: string
+/**
+ * CSS length for the card and its controls, e.g. "12px".
+ */
+borderRadius?: string
+/**
+ * CSS colour of the card itself.
+ */
+surfaceColor?: string
+/**
+ * CSS colour of secondary text and hints.
+ */
+mutedTextColor?: string
+/**
+ * CSS colour of the page behind the card.
+ */
+backgroundColor?: string
+}
+/**
+ * Invite lifetime and re-invite cooldown. Merged field-by-field.
+ */
+invite?: {
+/**
+ * How long an invite link stays usable, in days. Default 14.
+ */
+ttlDays?: number
+/**
+ * Minimum minutes between two invite emails to one address. Default 60.
+ */
+resendCooldownMinutes?: number
+}
+/**
+ * Captcha (Cloudflare Turnstile) settings for flow creation. Merged field-by-field.
+ */
+captcha?: {
+/**
+ * Require a captcha token when a flow attempt is created.
+ */
+enabled?: boolean
+/**
+ * The public site key the Product renders the widget with.
+ */
+siteKey?: (string | null)
+/**
+ * WRITE-ONLY. The provider secret used server-side to verify tokens; stored encrypted and never returned. Omit to leave the stored secret untouched, pass null to clear it.
+ */
+secretKey?: (string | null)
+/**
+ * Demand a captcha from an identifier that is currently accumulating failed attempts, even when `enabled` is false. Default true.
+ */
+riskElevated?: boolean
+}
+/**
+ * Password-recovery settings (whether it is offered, how long a reset link lives). Merged field-by-field.
+ */
+recovery?: {
+/**
+ * Offer the password-recovery flow at all. Default true.
+ */
+enabled?: boolean
+/**
+ * How long a reset link stays usable, in minutes. Default 60.
+ */
+ttlMinutes?: number
+}
+/**
+ * Test mode: whether this product may have TEST USERS — accounts that are excluded from metering, kept out of the default directory listing, never really emailed, and (when the deployment sets one) able to sign in with the fixed magic OTP. REFUSED on a production deployment. Merged field-by-field.
+ */
+testMode?: {
+/**
+ * Opt this product into test mode. Refused outright on a production deployment — the environment gate is checked first and cannot be configured away. Turning it on is audited and raises an alert. Default false.
+ */
+enabled?: boolean
+}
+/**
+ * Waitlist settings: the double-opt-in toggle, how long a pending entry is retained before the sweep erases it, the confirmation link lifetime, and the embeddable widget’s copy and colours. Merged field-by-field, including inside `widget`.
+ */
+waitlist?: {
+/**
+ * The embeddable widget’s copy and colours. Merged field-by-field, so setting one line leaves the rest alone.
+ */
+widget?: {
+/**
+ * Heading above the widget form.
+ */
+title?: string
+/**
+ * Link rendered beside the consent text. Null renders no link.
+ */
+policyUrl?: (string | null)
+/**
+ * CSS colour for the button and the focus ring.
+ */
+accentColor?: string
+/**
+ * Submit button copy.
+ */
+buttonLabel?: string
+/**
+ * Consent checkbox copy. Null renders no checkbox, and the signup records the consent proof as `unspecified`.
+ */
+consentText?: (string | null)
+/**
+ * One line under the heading.
+ */
+description?: string
+/**
+ * The privacy-policy version the widget records in each consent proof.
+ */
+policyVersion?: string
+/**
+ * Shown after a submission. ONE message for every outcome: the signup route answers identically whether or not the address was already on the list.
+ */
+successMessage?: string
+}
+/**
+ * Require a confirmation email before a waitlist signup counts. Default false — the entry is created either way, but an unconfirmed one is reported separately and is never invited.
+ */
+doubleOptIn?: boolean
+/**
+ * How long a still-pending waitlist entry is kept before the sweep erases it. Default 365.
+ */
+retentionDays?: number
+/**
+ * How long a double-opt-in confirmation link stays usable, in hours. Default 48.
+ */
+confirmTtlHours?: number
+}
+/**
+ * How long DEAD rows are kept before the retention sweep removes them: spent one-time tokens, expired flow attempts, expired sessions and their refresh tokens. These are grace periods on top of expiry, never lifetimes — an unswept expired row is inert. Merged field-by-field.
+ */
+retention?: {
+/**
+ * How long an EXPIRED flow attempt is kept after its own expiry. Default 0 — swept as soon as it dies, which is what the reaper did before this window existed.
+ */
+flowAttemptDays?: number
+/**
+ * How long a SPENT or EXPIRED one-time token row (an OTP, a magic link, a recovery or abort token) is kept after it stops being usable, for forensics. The secret is a hash and the row is already dead — this only decides how long the trail lives. Default 30.
+ */
+oneTimeTokenDays?: number
+/**
+ * How long an EXPIRED session and its refresh tokens are kept after expiry. Zero does not shorten any lifetime: a session past either window can never be refreshed again, so the row is already inert. Default 0.
+ */
+expiredSessionDays?: number
+}
+/**
+ * Rate limits, lockout and breached-password settings. Merged field-by-field.
+ */
+protection?: {
+/**
+ * Check passwords against the HaveIBeenPwned breach corpus (k-anonymity). Blocking at sign-up, advisory at sign-in. Default true.
+ */
+hibpEnabled?: boolean
+/**
+ * How long an account stays locked. Self-healing — the lock expires on its own. Default 15.
+ */
+lockoutMinutes?: number
+/**
+ * Failed sign-ins for one identifier before the account is locked. Default 10.
+ */
+maxFailedAttempts?: number
+/**
+ * Flow calls allowed per IP per product per window before HTTP 429. Default 120.
+ */
+ipAttemptsPerWindow?: number
+/**
+ * Sliding window the failed sign-ins are counted over, in minutes. Default 15.
+ */
+failedAttemptWindowMinutes?: number
+/**
+ * Flow calls allowed per identifier per window before HTTP 429. Default 30.
+ */
+identifierAttemptsPerWindow?: number
+}
+/**
+ * How end users may join this product: 'public' (anyone), 'invite-only', or 'waitlist'. Default 'public'.
+ */
+signupMode?: ("public" | "invite-only" | "waitlist")
+/**
+ * Email-change settings: confirmation lifetime, the old address's revert window, the post-revert cooldown and the operator-override delay. Merged field-by-field.
+ */
+emailChange?: {
+/**
+ * Allow end users to change their email address. Default true.
+ */
+enabled?: boolean
+/**
+ * How long after a REVERT further email changes are refused, in days. Default 7.
+ */
+cooldownDays?: number
+/**
+ * How long the old address may undo the change, in days. Default 30.
+ */
+revertTtlDays?: number
+/**
+ * How long the two confirmation links stay usable, in hours. Default 24.
+ */
+requestTtlHours?: number
+/**
+ * Mandatory delay on an operator-assisted override, in hours — the abort window the old address is notified with. Default 72.
+ */
+overrideDelayHours?: number
+}
+/**
+ * Which security notification emails this product sends. All on by default. Merged field-by-field.
+ */
+notifications?: {
+/**
+ * Email the user the first time a session appears from an unseen device. Default true.
+ */
+newDevice?: boolean
+/**
+ * Email the old address when an email change is requested, completed, reverted or overridden. Default true.
+ */
+emailChange?: boolean
+/**
+ * Email the user when an operator impersonates their account. Default true.
+ */
+impersonation?: boolean
+/**
+ * Email the user when their password is set or changed. Default true.
+ */
+passwordChanged?: boolean
+}
+/**
+ * Browser origins allowed to drive this product's end-user flows, up to 20. Scheme + host + port only, matched exactly. Replaces the whole list. Empty means "no browser origin" once this product has a publishable key.
+ * 
+ * @maxItems 20
+ */
+allowedOrigins?: []|[string]|[string, string]|[string, string, string]|[string, string, string, string]|[string, string, string, string, string]|[string, string, string, string, string, string]|[string, string, string, string, string, string, string]|[string, string, string, string, string, string, string, string]|[string, string, string, string, string, string, string, string, string]|[string, string, string, string, string, string, string, string, string, string]|[string, string, string, string, string, string, string, string, string, string, string]|[string, string, string, string, string, string, string, string, string, string, string, string]|[string, string, string, string, string, string, string, string, string, string, string, string, string]|[string, string, string, string, string, string, string, string, string, string, string, string, string, string]|[string, string, string, string, string, string, string, string, string, string, string, string, string, string, string]|[string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string]|[string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string]|[string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string]|[string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string]|[string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string]
+/**
+ * Password rules for this product. Merged field-by-field into the current policy.
+ */
+passwordPolicy?: {
+/**
+ * Minimum password length. Default 8.
+ */
+minLength?: number
+/**
+ * Require at least one digit.
+ */
+requireNumber?: boolean
+/**
+ * Require at least one non-alphanumeric character.
+ */
+requireSymbol?: boolean
+/**
+ * Require at least one uppercase letter.
+ */
+requireUppercase?: boolean
+}
+/**
+ * End-user session lifetime in hours. Default 720 (30 days).
+ */
+sessionTtlHours?: number
+/**
+ * Inactivity window of a session in days — every refresh slides it forward. Default 30.
+ */
+refreshSlidingDays?: number
+/**
+ * Hard time-box of a session in days, counted from sign-in and never extended. Default 365.
+ */
+refreshAbsoluteDays?: number
+/**
+ * Callback URIs the browser code handoff may deliver a one-time authorization code to, up to 20. Matched EXACTLY — no wildcards, no prefixes, no fragments — so list every callback in full. Replaces the whole list.
+ * 
+ * @maxItems 20
+ */
+redirectUriAllowlist?: []|[string]|[string, string]|[string, string, string]|[string, string, string, string]|[string, string, string, string, string]|[string, string, string, string, string, string]|[string, string, string, string, string, string, string]|[string, string, string, string, string, string, string, string]|[string, string, string, string, string, string, string, string, string]|[string, string, string, string, string, string, string, string, string, string]|[string, string, string, string, string, string, string, string, string, string, string]|[string, string, string, string, string, string, string, string, string, string, string, string]|[string, string, string, string, string, string, string, string, string, string, string, string, string]|[string, string, string, string, string, string, string, string, string, string, string, string, string, string]|[string, string, string, string, string, string, string, string, string, string, string, string, string, string, string]|[string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string]|[string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string]|[string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string]|[string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string]|[string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string, string]
+/**
+ * Access JWT lifetime in minutes, 5-60. Default 10. Short on purpose: a revoked session dies within one TTL.
+ */
+accessTokenTtlMinutes?: number
+}
+/**
+ * GitHub sign-in credentials and switch.
+ */
+export interface UsersConfigUpsertInputGoogle {
+/**
+ * Offer this provider as a sign-in strategy.
+ */
+enabled?: boolean
+/**
+ * The OAuth client id from the provider console. Pass null to clear it and fall back to the deployment's shared development credentials, if it has any.
+ */
+clientId?: (string | null)
+/**
+ * WRITE-ONLY. The OAuth client secret; stored encrypted and never returned. Omit to leave the stored secret untouched, pass null to clear it.
+ */
+clientSecret?: (string | null)
+}
+
+export interface UsersConfigUpsertOutput {
+mfa: {
+/**
+ * Whether a second factor is MANDATORY for this product. When true, a user may not unenroll their last verified factor. Default false.
+ */
+required: boolean
+/**
+ * How many single-use backup codes a batch contains. Default 10.
+ */
+backupCodeCount: number
+/**
+ * Mandatory delay on an operator-initiated factor reset, in hours — the abort window the user is emailed. Default 72.
+ */
+resetDelayHours: number
+/**
+ * How long a passed step-up challenge stays spendable, in minutes. The grant is SINGLE-USE regardless. Default 5.
+ */
+stepUpGrantMinutes: number
+/**
+ * Wrong BACKUP codes before the account is locked, counted separately from TOTP. Default 5.
+ */
+maxBackupCodeAttempts: number
+/**
+ * Wrong second-factor codes before the account is locked. Default 5.
+ */
+maxSecondFactorAttempts: number
+/**
+ * How recently the caller must have authenticated to enroll or regenerate a factor, in minutes. Default 10.
+ */
+sensitiveAuthAgeMinutes: number
+}
+email: {
+/**
+ * Sender for auth email, e.g. "Acme <auth@acme.com>". MUST be on a domain verified in this product's mail toolkit. While it is null, email_code/email_link are not offered as strategies.
+ */
+from: (string | null)
+/**
+ * Offer the 6-digit code strategy (email_code). Default true.
+ */
+codeEnabled: boolean
+/**
+ * Base URL magic links point at, e.g. "https://public.lessly.com/{productId}/users". Null uses the deployment default.
+ */
+linkBaseUrl: (string | null)
+/**
+ * Offer the magic-link strategy (email_link). Default true.
+ */
+linkEnabled: boolean
+/**
+ * How long an emailed code or link stays usable, in minutes. Default 15.
+ */
+codeTtlMinutes: number
+/**
+ * Auth emails one address may receive per day. Default 10.
+ */
+resendDailyCap: number
+/**
+ * Wrong-code entries allowed per token before it is spent. Default 5.
+ */
+maxCodeAttempts: number
+/**
+ * Minimum seconds between two auth emails to one address. Floor of 60 is enforced regardless. Default 60.
+ */
+resendCooldownSeconds: number
+}
+oauth: {
+providers: {
+github: UsersConfigUpsertOutputGoogle
+google: UsersConfigUpsertOutputGoogle
+}
+}
+hosted: {
+/**
+ * Serve the hosted sign-in, sign-up and recovery pages for this product. Default true. False answers those routes with a refusal page instead — for a product that ships its own frontend and wants no second front door.
+ */
+enabled: boolean
+/**
+ * Absolute https URL of a logo rendered above the form. Null renders no logo.
+ */
+logoUrl: (string | null)
+/**
+ * Terms link rendered in the footer. Null renders no link.
+ */
+termsUrl: (string | null)
+/**
+ * CSS colour of the body text.
+ */
+textColor: string
+/**
+ * One line under the card. Null renders no footer.
+ */
+footerText: (string | null)
+/**
+ * Privacy-policy link rendered in the footer. Null renders no link.
+ */
+privacyUrl: (string | null)
+/**
+ * CSS colour for the submit button, the links and the focus ring.
+ */
+accentColor: string
+/**
+ * Shown in the heading and the page title. Default "This product".
+ */
+productName: string
+/**
+ * CSS length for the card and its controls, e.g. "12px".
+ */
+borderRadius: string
+/**
+ * CSS colour of the card itself.
+ */
+surfaceColor: string
+/**
+ * CSS colour of secondary text and hints.
+ */
+mutedTextColor: string
+/**
+ * CSS colour of the page behind the card.
+ */
+backgroundColor: string
+}
+invite: {
+/**
+ * How long an invite link stays usable, in days. Default 14.
+ */
+ttlDays: number
+/**
+ * Minimum minutes between two invite emails to one address. Default 60.
+ */
+resendCooldownMinutes: number
+}
+status: ("active" | "paused")
+captcha: {
+enabled: boolean
+siteKey: (string | null)
+provider: "turnstile"
+riskElevated: boolean
+}
+recovery: {
+/**
+ * Offer the password-recovery flow at all. Default true.
+ */
+enabled: boolean
+/**
+ * How long a reset link stays usable, in minutes. Default 60.
+ */
+ttlMinutes: number
+}
+testMode: {
+/**
+ * Opt this product into test mode. Refused outright on a production deployment — the environment gate is checked first and cannot be configured away. Turning it on is audited and raises an alert. Default false.
+ */
+enabled: boolean
+}
+waitlist: {
+/**
+ * The embeddable widget’s copy and colours.
+ */
+widget: {
+/**
+ * Heading above the widget form.
+ */
+title: string
+/**
+ * Link rendered beside the consent text. Null renders no link.
+ */
+policyUrl: (string | null)
+/**
+ * CSS colour for the button and the focus ring.
+ */
+accentColor: string
+/**
+ * Submit button copy.
+ */
+buttonLabel: string
+/**
+ * Consent checkbox copy. Null renders no checkbox, and the signup records the consent proof as `unspecified`.
+ */
+consentText: (string | null)
+/**
+ * One line under the heading.
+ */
+description: string
+/**
+ * The privacy-policy version the widget records in each consent proof.
+ */
+policyVersion: string
+/**
+ * Shown after a submission. ONE message for every outcome: the signup route answers identically whether or not the address was already on the list.
+ */
+successMessage: string
+}
+/**
+ * Require a confirmation email before a waitlist signup counts. Default false — the entry is created either way, but an unconfirmed one is reported separately and is never invited.
+ */
+doubleOptIn: boolean
+/**
+ * How long a still-pending waitlist entry is kept before the sweep erases it. Default 365.
+ */
+retentionDays: number
+/**
+ * How long a double-opt-in confirmation link stays usable, in hours. Default 48.
+ */
+confirmTtlHours: number
+}
+productId: string
+retention: {
+/**
+ * How long an EXPIRED flow attempt is kept after its own expiry. Default 0 — swept as soon as it dies, which is what the reaper did before this window existed.
+ */
+flowAttemptDays: number
+/**
+ * How long a SPENT or EXPIRED one-time token row (an OTP, a magic link, a recovery or abort token) is kept after it stops being usable, for forensics. The secret is a hash and the row is already dead — this only decides how long the trail lives. Default 30.
+ */
+oneTimeTokenDays: number
+/**
+ * How long an EXPIRED session and its refresh tokens are kept after expiry. Zero does not shorten any lifetime: a session past either window can never be refreshed again, so the row is already inert. Default 0.
+ */
+expiredSessionDays: number
+}
+protection: {
+/**
+ * Check passwords against the HaveIBeenPwned breach corpus (k-anonymity). Blocking at sign-up, advisory at sign-in. Default true.
+ */
+hibpEnabled: boolean
+/**
+ * How long an account stays locked. Self-healing — the lock expires on its own. Default 15.
+ */
+lockoutMinutes: number
+/**
+ * Failed sign-ins for one identifier before the account is locked. Default 10.
+ */
+maxFailedAttempts: number
+/**
+ * Flow calls allowed per IP per product per window before HTTP 429. Default 120.
+ */
+ipAttemptsPerWindow: number
+/**
+ * Sliding window the failed sign-ins are counted over, in minutes. Default 15.
+ */
+failedAttemptWindowMinutes: number
+/**
+ * Flow calls allowed per identifier per window before HTTP 429. Default 30.
+ */
+identifierAttemptsPerWindow: number
+}
+signupMode: ("public" | "invite-only" | "waitlist")
+emailChange: {
+/**
+ * Allow end users to change their email address. Default true.
+ */
+enabled: boolean
+/**
+ * How long after a REVERT further email changes are refused, in days. Default 7.
+ */
+cooldownDays: number
+/**
+ * How long the old address may undo the change, in days. Default 30.
+ */
+revertTtlDays: number
+/**
+ * How long the two confirmation links stay usable, in hours. Default 24.
+ */
+requestTtlHours: number
+/**
+ * Mandatory delay on an operator-assisted override, in hours — the abort window the old address is notified with. Default 72.
+ */
+overrideDelayHours: number
+}
+notifications: {
+/**
+ * Email the user the first time a session appears from an unseen device. Default true.
+ */
+newDevice: boolean
+/**
+ * Email the old address when an email change is requested, completed, reverted or overridden. Default true.
+ */
+emailChange: boolean
+/**
+ * Email the user when an operator impersonates their account. Default true.
+ */
+impersonation: boolean
+/**
+ * Email the user when their password is set or changed. Default true.
+ */
+passwordChanged: boolean
+}
+allowedOrigins: string[]
+passwordPolicy: {
+/**
+ * Minimum password length. Default 8.
+ */
+minLength: number
+/**
+ * Require at least one digit.
+ */
+requireNumber: boolean
+/**
+ * Require at least one non-alphanumeric character.
+ */
+requireSymbol: boolean
+/**
+ * Require at least one uppercase letter.
+ */
+requireUppercase: boolean
+}
+sessionTtlHours: number
+lifecycleBlocked: boolean
+lifecycleArchived: boolean
+refreshSlidingDays: number
+refreshAbsoluteDays: number
+redirectUriAllowlist: string[]
+accessTokenTtlMinutes: number
+captchaSecretConfigured: boolean
+}
+export interface UsersConfigUpsertOutputGoogle {
+enabled: boolean
+clientId: (string | null)
+secretConfigured: boolean
+}
+
+export interface UsersFactorsListInput {
+/**
+ * The end user whose enrolled factors to list.
+ */
+userId: string
+}
+
+export interface UsersFactorsListOutput {
+factors: {
+type: ("totp" | "backup_codes")
+status: ("unverified" | "verified")
+createdAt: string
+remaining: (number | null)
+lastUsedAt: (string | null)
+verifiedAt: (string | null)
+}[]
+}
+
+export interface UsersFactorsResetInput {
+/**
+ * What identity proofing was done and under which ticket. Recorded verbatim in the audit row — this is the whole point of the tool being audited.
+ */
+reason: string
+/**
+ * The end user whose second factor is being reset.
+ */
+userId: string
+}
+
+export interface UsersFactorsResetOutput {
+requestId: string
+scheduledFor: string
+}
+
+export interface UsersKeysListInput {
+
+}
+
+export interface UsersKeysListOutput {
+keys: {
+/**
+ * The RFC 7638 JWK thumbprint — what a token header carries.
+ */
+kid: string
+/**
+ * `standby` is pre-generated and not published; `current` signs; `retired` is still in JWKS for the overlap; `revoked` was evicted.
+ */
+state: ("standby" | "current" | "retired" | "revoked")
+createdAt: string
+retiredAt: (string | null)
+revokedAt: (string | null)
+/**
+ * When a retired key leaves JWKS. Null unless the key is retired.
+ */
+overlapExpiresAt: (string | null)
+}[]
+}
+
+export interface UsersKeysRevokeInput {
+/**
+ * The key to evict, as listed by users_keys_list.
+ */
+kid: string
+/**
+ * Why. Goes into the audit row and is the only account of the incident it keeps.
+ */
+reason?: string
+/**
+ * Sign every end user of this product out as well. Defaults to TRUE: a compromised signing key could have minted any of those sessions. Pass false ONLY when you know no forged token was ever issued.
+ */
+revokeSessions?: boolean
+}
+
+export interface UsersKeysRevokeOutput {
+/**
+ * The fresh key minted or promoted in its place.
+ */
+currentKid: string
+revokedKid: string
+sessionsRevoked: number
+}
+
+export interface UsersKeysRotateInput {
+
+}
+
+export interface UsersKeysRotateOutput {
+/**
+ * The key signing from now on.
+ */
+currentKid: string
+/**
+ * The key just retired. Null if there was none.
+ */
+previousKid: (string | null)
+/**
+ * When the retired key stops verifying. Both kids are in JWKS until then.
+ */
+overlapExpiresAt: (string | null)
+}
+
+export interface UsersOpsRetentionGetInput {
+
+}
+
+export interface UsersOpsRetentionGetOutput {
+/**
+ * The single retention job. There is exactly one — it replaced the sessions reaper and the waitlist sweep.
+ */
+sweep: {
+/**
+ * Its schedule, in cron syntax.
+ */
+cron: string
+/**
+ * What one pass removes, in the order it removes it.
+ */
+removes: string[]
+/**
+ * The Synapse cron function that performs every sweep below.
+ */
+functionId: string
+}
+/**
+ * This product’s EFFECTIVE windows — what it configured, with the documented default filling anything it did not.
+ */
+windows: {
+/**
+ * How long an EXPIRED flow attempt is kept after its own expiry. Default 0 — swept as soon as it dies, which is what the reaper did before this window existed.
+ */
+flowAttemptDays: number
+/**
+ * How long a SPENT or EXPIRED one-time token row (an OTP, a magic link, a recovery or abort token) is kept after it stops being usable, for forensics. The secret is a hash and the row is already dead — this only decides how long the trail lives. Default 30.
+ */
+oneTimeTokenDays: number
+/**
+ * How long an EXPIRED session and its refresh tokens are kept after expiry. Zero does not shorten any lifetime: a session past either window can never be refreshed again, so the row is already inert. Default 0.
+ */
+expiredSessionDays: number
+}
+/**
+ * The documented defaults, so a reader can tell a deliberate window from an inherited one without a second call.
+ */
+defaults: {
+/**
+ * How long an EXPIRED flow attempt is kept after its own expiry. Default 0 — swept as soon as it dies, which is what the reaper did before this window existed.
+ */
+flowAttemptDays: number
+/**
+ * How long a SPENT or EXPIRED one-time token row (an OTP, a magic link, a recovery or abort token) is kept after it stops being usable, for forensics. The secret is a hash and the row is already dead — this only decides how long the trail lives. Default 30.
+ */
+oneTimeTokenDays: number
+/**
+ * How long an EXPIRED session and its refresh tokens are kept after expiry. Zero does not shorten any lifetime: a session past either window can never be refreshed again, so the row is already inert. Default 0.
+ */
+expiredSessionDays: number
+}
+/**
+ * What this service deliberately keeps forever, and why. Reading a retention surface that lists only what IS deleted is how an operator concludes the audit log ages out — it does not.
+ */
+notSwept: {
+why: string
+what: string
+}[]
+/**
+ * How long a still-PENDING waitlist entry is kept. It lives in the `waitlist` config block rather than in `retention`, because it is not a grace period on a dead row: a pending entry never expires on its own, so this window is the whole of what makes it go away — and the sweep ERASES it (audit row, `users/waitlist-entry.erased`) rather than deleting it.
+ */
+waitlistRetentionDays: number
+}
+
+export interface UsersOpsSloGetInput {
+
+}
+
+export interface UsersOpsSloGetOutput {
+/**
+ * Every published objective and its verdict for this window.
+ */
+slos: {
+/**
+ * Stable id of the objective — the key to quote in a runbook.
+ */
+id: string
+/**
+ * Short human name.
+ */
+title: string
+/**
+ * `insufficient_data` is NOT `ok`: it means the window is too quiet to judge, which an operator reading a dashboard must be able to tell apart from health.
+ */
+status: ("ok" | "breached" | "insufficient_data")
+/**
+ * How many events went into `observed`.
+ */
+samples: number
+/**
+ * What this replica sees in the CURRENT window, in the same unit as `objective`. NULL when nothing was observed.
+ */
+observed: (number | null)
+/**
+ * The `users/alert.raised` kind a breach of this objective fires, for wiring an alert route.
+ */
+alertKind: string
+/**
+ * The published objective, as a ratio in 0..1.
+ */
+objective: number
+/**
+ * Which side of `objective` is healthy: a success rate is at-least, an error rate at-most.
+ */
+comparator: ("at-least" | "at-most")
+/**
+ * Below this many samples the ratio is not judged at all — a quiet window is not an outage.
+ */
+minSamples: number
+/**
+ * What is counted, and what is deliberately NOT counted.
+ */
+description: string
+/**
+ * The window the observation is computed over.
+ */
+windowSeconds: number
+}[]
+/**
+ * These numbers come from ONE replica’s in-process window, not from the whole deployment. Treat them as a spot check, not as the fleet’s error budget.
+ */
+scope: "replica"
+/**
+ * The current window, exactly as the alert hook sees it.
+ */
+window: {
+mail: {
+/**
+ * Auth emails handed to mail (a cooldown or daily cap never reaches this).
+ */
+total: number
+/**
+ * Of those, the ones mail would not take.
+ */
+failures: number
+/**
+ * failures / total. NULL when nothing was sent.
+ */
+failureRate: (number | null)
+}
+signIn: {
+/**
+ * SETTLED flow attempts — completed or failed. A pending one is neither.
+ */
+total: number
+/**
+ * Of those, the ones that failed.
+ */
+failures: number
+/**
+ * completed / settled. NULL, never 0, when nothing settled.
+ */
+successRate: (number | null)
+}
+refresh: {
+/**
+ * Refresh attempts.
+ */
+total: number
+/**
+ * Failed refreshes, detected reuse included.
+ */
+errors: number
+/**
+ * Detected token REUSE — theft, counted rather than rated.
+ */
+reuses: number
+/**
+ * errors / total. NULL when nothing was refreshed.
+ */
+errorRate: (number | null)
+}
+/**
+ * Length of the evaluation window.
+ */
+windowSeconds: number
+/**
+ * ISO start of the window these numbers belong to.
+ */
+windowStartedAt: string
+/**
+ * This product’s OWN trailing sign-in failure rate, over CLOSED windows. What the anomaly signal compares the live window against — NULL until at least one window has closed.
+ */
+signInFailureBaseline: (number | null)
+}
+}
+
+export interface UsersSessionsGetInput {
+/**
+ * The session to read.
+ */
+sessionId: string
+}
+
+export interface UsersSessionsGetOutput {
+id: string
+ip: (string | null)
+/**
+ * `aal2` only if a verified second factor completed.
+ */
+aal: ("aal1" | "aal2")
+/**
+ * The factors this session was established with.
+ */
+amr: string[]
+status: ("active" | "revoked")
+userId: string
+createdAt: string
+expiresAt: string
+revokedAt: (string | null)
+userAgent: (string | null)
+revokedReason: (string | null)
+/**
+ * The operator behind an impersonated session, or null for an ordinary one.
+ */
+impersonatedBy: (string | null)
+lastRefreshedAt: (string | null)
+absoluteExpiresAt: string
+}
+
+export interface UsersSessionsImpersonateInput {
+/**
+ * Why. Recorded in the audit trail and shown to the user in the notification email — write what you would want to read in an incident review (a ticket number and one sentence).
+ */
+reason: string
+/**
+ * The end user to sign in as.
+ */
+userId: string
+}
+
+export interface UsersSessionsImpersonateOutput {
+userId: string
+/**
+ * When the session dies. It cannot be extended or refreshed.
+ */
+expiresAt: string
+/**
+ * Seconds until the access token expires.
+ */
+expiresIn: number
+sessionId: string
+/**
+ * The access JWT of the impersonated session. There is NO refresh token.
+ */
+accessToken: string
+}
+
+export interface UsersSessionsListInput {
+/**
+ * The end user whose sessions to list.
+ */
+userId: string
+}
+
+export interface UsersSessionsListOutput {
+sessions: {
+id: string
+ip: (string | null)
+status: ("active" | "revoked")
+userId: string
+createdAt: string
+expiresAt: string
+revokedAt: (string | null)
+userAgent: (string | null)
+lastRefreshedAt: (string | null)
+absoluteExpiresAt: string
+}[]
+}
+
+export interface UsersSessionsRevokeInput {
+/**
+ * Revoke every session of this user.
+ */
+userId?: string
+/**
+ * Revoke exactly this session.
+ */
+sessionId?: string
+}
+
+export interface UsersSessionsRevokeOutput {
+revoked: number
+}
+
+export interface UsersStatsGetInput {
+/**
+ * Look-back window for the TIME-BOUNDED numbers — the sign-in counters, the abuse block and `sessions.createdInWindow`: '24h', '7d', '30d' or '90d'. Default '7d'. The user, live-session and factor populations are point-in-time and ignore it.
+ */
+window?: ("24h" | "7d" | "30d" | "90d")
+}
+
+export interface UsersStatsGetOutput {
+/**
+ * Abuse signals over the window. Denied origins are deliberately absent: that check fires on unauthenticated traffic and is served by logs and metrics, not by per-product audit rows.
+ */
+abuse: {
+/**
+ * Accounts locked by a failed-attempt ceiling — password and second factor both.
+ */
+lockouts: number
+/**
+ * The subset of `lockouts` caused by the SECOND-factor ceiling.
+ */
+mfaLockouts: number
+/**
+ * Mirrors `signIns.failed`, so the abuse block reads on its own.
+ */
+failedSignIns: number
+/**
+ * Breach-corpus matches against a user's password.
+ */
+pwnedPasswordsSeen: number
+/**
+ * Refresh tokens spent twice outside the grace window — theft, not staleness. Each one revoked a whole session family.
+ */
+refreshReuseDetected: number
+}
+/**
+ * ISO start of that window — the `created_at` floor every counter used.
+ */
+since: string
+/**
+ * Point-in-time directory populations by DERIVED status — `user` has no status column, these are computed from `waitlisted` and the ban/delete/erase timestamps.
+ */
+users: {
+/**
+ * Every directory row, GDPR tombstones included.
+ */
+total: number
+/**
+ * Full accounts: not waitlisted, not banned, not deleted, not erased.
+ */
+active: number
+/**
+ * Banned accounts that are still present.
+ */
+banned: number
+/**
+ * GDPR-erased tombstones: the id survives, the PII does not.
+ */
+erased: number
+/**
+ * SOFT-deleted and still recoverable — not erased.
+ */
+deleted: number
+/**
+ * Waitlist signups with no credential yet.
+ */
+waitlisted: number
+}
+/**
+ * The window the time-bounded numbers were computed over.
+ */
+window: ("24h" | "7d" | "30d" | "90d")
+/**
+ * Enrolled second factors (TOTP and backup-code batches).
+ */
+factors: {
+/**
+ * VERIFIED second factors; an unverified enrollment gates nothing.
+ */
+verified: number
+/**
+ * Distinct users holding at least one verified factor.
+ */
+usersWithFactor: number
+}
+/**
+ * Sign-in outcomes over the window, from the audit log.
+ */
+signIns: {
+/**
+ * Failed sign-in attempts in the window.
+ */
+failed: number
+/**
+ * Successful sign-ins in the window.
+ */
+succeeded: number
+/**
+ * succeeded / (succeeded + failed), 4 decimals. NULL — never 0 — when nothing was attempted: an idle window and a totally broken one are opposite facts.
+ */
+successRate: (number | null)
+}
+/**
+ * Device sessions.
+ */
+sessions: {
+/**
+ * Live right now: active, unrevoked and inside BOTH the sliding and absolute expiry.
+ */
+active: number
+/**
+ * Sessions established since `since`.
+ */
+createdInWindow: number
+}
+}
+
+export interface UsersUsersBanInput {
+/**
+ * The opaque user id returned by users_users_create or _list.
+ */
+userId: string
+}
+
+export interface UsersUsersBanOutput {
+id: string
+name: (string | null)
+bannedAt: (string | null)
+erasedAt: (string | null)
+imageUrl: (string | null)
+testUser: boolean
+createdAt: string
+deletedAt: (string | null)
+productId: string
+updatedAt: string
+waitlisted: boolean
+identifiers: {
+id: string
+type: "email"
+value: string
+isPrimary: boolean
+verifiedAt: (string | null)
+valueCanonical: string
+verificationStatus: ("unverified" | "verified" | "expired")
+}[]
+lockedUntil: (string | null)
+lastSignInAt: (string | null)
+requiresReset: boolean
+publicMetadata: UsersUsersBanOutputPublicMetadata
+unsafeMetadata: UsersUsersBanOutputPublicMetadata
+privateMetadata: UsersUsersBanOutputPublicMetadata
+emailChangeLockedUntil: (string | null)
+}
+export interface UsersUsersBanOutputPublicMetadata {
+[k: string]: unknown
+}
+
+export interface UsersUsersCreateInput {
+/**
+ * The user's display name.
+ */
+name?: string
+/**
+ * URL of the user's avatar image.
+ */
+imageUrl?: string
+/**
+ * Optional credential to store for this user. Hashes only — this toolkit never accepts a plaintext password. Nothing verifies it until Phase 2.
+ */
+password?: {
+/**
+ * A PHC-format password hash (e.g. an argon2id string) to store as-is. Never send a plaintext password.
+ */
+phcHash?: string
+/**
+ * An imported hash from another system, to be lazily rehashed on the first successful sign-in (Phase 2).
+ */
+foreignHash?: string
+/**
+ * Algorithm of `foreignHash`. Required when `foreignHash` is set.
+ */
+foreignHashAlgo?: ("bcrypt" | "argon2" | "pbkdf2" | "scrypt")
+}
+/**
+ * Create this user as a TEST FIXTURE: excluded from metering (it never counts toward retained-users), hidden from the default users_users_list view, never really emailed, and — when the deployment configures one — able to sign in with the fixed magic OTP. REFUSED unless this product has test mode enabled, which a production deployment cannot do. There is no way to set or clear this later. Default false.
+ */
+testUser?: boolean
+/**
+ * Create the user as a waitlist signup: no way in until promoted. Default false.
+ */
+waitlisted?: boolean
+/**
+ * The email addresses that reach this user. At least one is required.
+ * 
+ * @minItems 1
+ */
+identifiers: [{
+/**
+ * Identifier kind. Only 'email' exists in this phase.
+ */
+type: "email"
+/**
+ * The email address. Stored canonicalised (lowercase, NFC) plus raw for display.
+ */
+value: string
+/**
+ * Record the identifier as already verified (use for trusted imports). Only ONE verified copy of a value may exist per product; unverified duplicates are allowed. Default false.
+ */
+verified?: boolean
+/**
+ * Mark as the primary identifier of its type. The first identifier of a type defaults to primary.
+ */
+isPrimary?: boolean
+}, ...({
+/**
+ * Identifier kind. Only 'email' exists in this phase.
+ */
+type: "email"
+/**
+ * The email address. Stored canonicalised (lowercase, NFC) plus raw for display.
+ */
+value: string
+/**
+ * Record the identifier as already verified (use for trusted imports). Only ONE verified copy of a value may exist per product; unverified duplicates are allowed. Default false.
+ */
+verified?: boolean
+/**
+ * Mark as the primary identifier of its type. The first identifier of a type defaults to primary.
+ */
+isPrimary?: boolean
+})[]]
+/**
+ * Force a password reset before the user can sign in (use for unverifiable imported hashes). Default false.
+ */
+requiresReset?: boolean
+/**
+ * Metadata the end user may READ and that may flow into the JWT. Management-plane write only.
+ */
+publicMetadata?: {
+[k: string]: unknown
+}
+unsafeMetadata?: UsersUsersCreateInputPublicMetadata
+privateMetadata?: UsersUsersCreateInputPublicMetadata1
+}
+/**
+ * Metadata the end user may WRITE in a later phase. Never trust it for authorization.
+ */
+export interface UsersUsersCreateInputPublicMetadata {
+[k: string]: unknown
+}
+/**
+ * Metadata visible to the management plane only. Never exposed to the end user.
+ */
+export interface UsersUsersCreateInputPublicMetadata1 {
+[k: string]: unknown
+}
+
+export interface UsersUsersCreateOutput {
+id: string
+name: (string | null)
+bannedAt: (string | null)
+erasedAt: (string | null)
+imageUrl: (string | null)
+testUser: boolean
+createdAt: string
+deletedAt: (string | null)
+productId: string
+updatedAt: string
+waitlisted: boolean
+identifiers: {
+id: string
+type: "email"
+value: string
+isPrimary: boolean
+verifiedAt: (string | null)
+valueCanonical: string
+verificationStatus: ("unverified" | "verified" | "expired")
+}[]
+lockedUntil: (string | null)
+lastSignInAt: (string | null)
+requiresReset: boolean
+publicMetadata: UsersUsersCreateOutputPublicMetadata
+unsafeMetadata: UsersUsersCreateOutputPublicMetadata
+privateMetadata: UsersUsersCreateOutputPublicMetadata
+emailChangeLockedUntil: (string | null)
+}
+export interface UsersUsersCreateOutputPublicMetadata {
+[k: string]: unknown
+}
+
+export interface UsersUsersDeleteInput {
+/**
+ * The opaque user id returned by users_users_create or _list.
+ */
+userId: string
+}
+
+export interface UsersUsersDeleteOutput {
+id: string
+name: (string | null)
+bannedAt: (string | null)
+erasedAt: (string | null)
+imageUrl: (string | null)
+testUser: boolean
+createdAt: string
+deletedAt: (string | null)
+productId: string
+updatedAt: string
+waitlisted: boolean
+identifiers: {
+id: string
+type: "email"
+value: string
+isPrimary: boolean
+verifiedAt: (string | null)
+valueCanonical: string
+verificationStatus: ("unverified" | "verified" | "expired")
+}[]
+lockedUntil: (string | null)
+lastSignInAt: (string | null)
+requiresReset: boolean
+publicMetadata: UsersUsersDeleteOutputPublicMetadata
+unsafeMetadata: UsersUsersDeleteOutputPublicMetadata
+privateMetadata: UsersUsersDeleteOutputPublicMetadata
+emailChangeLockedUntil: (string | null)
+}
+export interface UsersUsersDeleteOutputPublicMetadata {
+[k: string]: unknown
+}
+
+export interface UsersUsersEraseInput {
+/**
+ * The opaque user id returned by users_users_create or _list.
+ */
+userId: string
+}
+
+export interface UsersUsersEraseOutput {
+id: string
+name: (string | null)
+bannedAt: (string | null)
+erasedAt: (string | null)
+imageUrl: (string | null)
+testUser: boolean
+createdAt: string
+deletedAt: (string | null)
+productId: string
+updatedAt: string
+waitlisted: boolean
+identifiers: {
+id: string
+type: "email"
+value: string
+isPrimary: boolean
+verifiedAt: (string | null)
+valueCanonical: string
+verificationStatus: ("unverified" | "verified" | "expired")
+}[]
+lockedUntil: (string | null)
+lastSignInAt: (string | null)
+requiresReset: boolean
+publicMetadata: UsersUsersEraseOutputPublicMetadata
+unsafeMetadata: UsersUsersEraseOutputPublicMetadata
+privateMetadata: UsersUsersEraseOutputPublicMetadata
+emailChangeLockedUntil: (string | null)
+}
+export interface UsersUsersEraseOutputPublicMetadata {
+[k: string]: unknown
+}
+
+export interface UsersUsersExportInput {
+/**
+ * Rows per page, 1-500. Default 100.
+ */
+limit?: number
+/**
+ * Case-insensitive substring match against the user's identifiers (email) and name.
+ */
+query?: string
+/**
+ * Opaque cursor from the previous page's `nextCursor`. Omit for the first page.
+ */
+cursor?: string
+/**
+ * Filter by status: 'active', 'banned' or 'waitlisted'. Omit for all.
+ */
+status?: ("active" | "banned" | "waitlisted")
+/**
+ * Include soft-deleted users. Default false.
+ */
+includeDeleted?: boolean
+}
+
+export interface UsersUsersExportOutput {
+count: number
+users: {
+id: string
+name: (string | null)
+bannedAt: (string | null)
+erasedAt: (string | null)
+imageUrl: (string | null)
+testUser: boolean
+createdAt: string
+deletedAt: (string | null)
+productId: string
+updatedAt: string
+waitlisted: boolean
+identifiers: {
+id: string
+type: "email"
+value: string
+isPrimary: boolean
+verifiedAt: (string | null)
+valueCanonical: string
+verificationStatus: ("unverified" | "verified" | "expired")
+}[]
+lockedUntil: (string | null)
+lastSignInAt: (string | null)
+requiresReset: boolean
+publicMetadata: UsersUsersExportOutputPublicMetadata
+unsafeMetadata: UsersUsersExportOutputPublicMetadata
+privateMetadata: UsersUsersExportOutputPublicMetadata
+emailChangeLockedUntil: (string | null)
+}[]
+exportedAt: string
+nextCursor: (string | null)
+}
+export interface UsersUsersExportOutputPublicMetadata {
+[k: string]: unknown
+}
+
+export interface UsersUsersGetInput {
+/**
+ * The opaque user id returned by users_users_create or _list.
+ */
+userId: string
+}
+
+export interface UsersUsersGetOutput {
+id: string
+name: (string | null)
+bannedAt: (string | null)
+erasedAt: (string | null)
+imageUrl: (string | null)
+testUser: boolean
+createdAt: string
+deletedAt: (string | null)
+productId: string
+updatedAt: string
+waitlisted: boolean
+identifiers: {
+id: string
+type: "email"
+value: string
+isPrimary: boolean
+verifiedAt: (string | null)
+valueCanonical: string
+verificationStatus: ("unverified" | "verified" | "expired")
+}[]
+lockedUntil: (string | null)
+lastSignInAt: (string | null)
+requiresReset: boolean
+publicMetadata: UsersUsersGetOutputPublicMetadata
+unsafeMetadata: UsersUsersGetOutputPublicMetadata
+privateMetadata: UsersUsersGetOutputPublicMetadata
+emailChangeLockedUntil: (string | null)
+}
+export interface UsersUsersGetOutputPublicMetadata {
+[k: string]: unknown
+}
+
+export interface UsersUsersImportInput {
+/**
+ * The users to import, at most 500 per call — batch client-side beyond that. Each row: identifiers (email), optional profile, optional password HASH, optional flags.
+ * 
+ * @minItems 1
+ * @maxItems 500
+ */
+users: [unknown, ...(unknown)[]]
+}
+
+export interface UsersUsersImportOutput {
+failed: number
+created: number
+results: {
+row: number
+reason: (string | null)
+status: ("created" | "skipped" | "failed")
+userId: (string | null)
+}[]
+skipped: number
+requested: number
+}
+
+export interface UsersUsersInviteInput {
+/**
+ * The invitee's display name.
+ */
+name?: string
+/**
+ * The address to invite. Stored canonicalised (lowercase, NFC) plus raw for display.
+ */
+email: string
+/**
+ * Metadata the end user may READ and that may flow into the JWT.
+ */
+publicMetadata?: {
+[k: string]: unknown
+}
+/**
+ * Metadata visible to the management plane only. Never exposed to the end user.
+ */
+privateMetadata?: {
+[k: string]: unknown
+}
+}
+
+export interface UsersUsersInviteOutput {
+mailed: boolean
+userId: string
+created: boolean
+expiresAt: string
+}
+
+export interface UsersUsersListInput {
+/**
+ * Page size, 1-100. Default 25.
+ */
+limit?: number
+/**
+ * Case-insensitive substring match against the user's identifiers (email) and name.
+ */
+query?: string
+/**
+ * Opaque cursor from a previous response's `nextCursor`. Omit for the first page.
+ */
+cursor?: string
+/**
+ * Filter by status: 'active' (not banned, not waitlisted), 'banned', or 'waitlisted'. Omit for all.
+ */
+status?: ("active" | "banned" | "waitlisted")
+/**
+ * Include soft-deleted users. Default false — deleted users are hidden.
+ */
+includeDeleted?: boolean
+/**
+ * Include TEST USERS. Default false: a test user is a fixture, not a customer — it is excluded from metering and from this listing for the same reason. Ask for it explicitly when you are debugging the fixtures themselves.
+ */
+includeTestUsers?: boolean
+/**
+ * Include waitlist signups. Default false: a waitlisted row is somebody who ASKED to join and cannot sign in, so it is not part of the directory an operator browses. Use `status: "waitlisted"` to see only them, or `users_waitlist_list` for the funnel.
+ */
+includeWaitlisted?: boolean
+}
+
+export interface UsersUsersListOutput {
+users: {
+id: string
+name: (string | null)
+bannedAt: (string | null)
+erasedAt: (string | null)
+imageUrl: (string | null)
+testUser: boolean
+createdAt: string
+deletedAt: (string | null)
+productId: string
+updatedAt: string
+waitlisted: boolean
+identifiers: {
+id: string
+type: "email"
+value: string
+isPrimary: boolean
+verifiedAt: (string | null)
+valueCanonical: string
+verificationStatus: ("unverified" | "verified" | "expired")
+}[]
+lockedUntil: (string | null)
+lastSignInAt: (string | null)
+requiresReset: boolean
+publicMetadata: UsersUsersListOutputPublicMetadata
+unsafeMetadata: UsersUsersListOutputPublicMetadata
+privateMetadata: UsersUsersListOutputPublicMetadata
+emailChangeLockedUntil: (string | null)
+}[]
+nextCursor: (string | null)
+}
+export interface UsersUsersListOutputPublicMetadata {
+[k: string]: unknown
+}
+
+export interface UsersUsersSetPrimaryIdentifierInput {
+/**
+ * The address to make primary. Must not already belong, verified, to another user of this product.
+ */
+email: string
+/**
+ * What identity proofing was done and under which ticket. Recorded verbatim in the audit row — this is the whole point of the tool being audited.
+ */
+reason: string
+/**
+ * The user whose primary email address is being replaced.
+ */
+userId: string
+}
+
+export interface UsersUsersSetPrimaryIdentifierOutput {
+requestId: string
+scheduledFor: string
+}
+
+export interface UsersUsersUnbanInput {
+/**
+ * The opaque user id returned by users_users_create or _list.
+ */
+userId: string
+}
+
+export interface UsersUsersUnbanOutput {
+id: string
+name: (string | null)
+bannedAt: (string | null)
+erasedAt: (string | null)
+imageUrl: (string | null)
+testUser: boolean
+createdAt: string
+deletedAt: (string | null)
+productId: string
+updatedAt: string
+waitlisted: boolean
+identifiers: {
+id: string
+type: "email"
+value: string
+isPrimary: boolean
+verifiedAt: (string | null)
+valueCanonical: string
+verificationStatus: ("unverified" | "verified" | "expired")
+}[]
+lockedUntil: (string | null)
+lastSignInAt: (string | null)
+requiresReset: boolean
+publicMetadata: UsersUsersUnbanOutputPublicMetadata
+unsafeMetadata: UsersUsersUnbanOutputPublicMetadata
+privateMetadata: UsersUsersUnbanOutputPublicMetadata
+emailChangeLockedUntil: (string | null)
+}
+export interface UsersUsersUnbanOutputPublicMetadata {
+[k: string]: unknown
+}
+
+export interface UsersUsersUpdateInput {
+/**
+ * The user's display name. Pass null to clear.
+ */
+name?: (string | null)
+/**
+ * The user to update.
+ */
+userId: string
+/**
+ * URL of the user's avatar image. Pass null to clear.
+ */
+imageUrl?: (string | null)
+/**
+ * Whether the user is still a waitlist signup.
+ */
+waitlisted?: boolean
+/**
+ * ISO-8601 timestamp of a temporary, self-healing lockout — the failed-attempt ceiling sets it and it expires on its own. Pass null to unlock the account immediately (audited as `user.unlocked`).
+ */
+lockedUntil?: (string | null)
+/**
+ * Whether the user must reset their password before signing in.
+ */
+requiresReset?: boolean
+/**
+ * REPLACES the whole public metadata bag. Management-plane write, end-user read.
+ */
+publicMetadata?: {
+[k: string]: unknown
+}
+unsafeMetadata?: UsersUsersUpdateInputPublicMetadata
+privateMetadata?: UsersUsersUpdateInputPublicMetadata1
+}
+/**
+ * REPLACES the whole unsafe metadata bag. End-user writable in a later phase; never authoritative.
+ */
+export interface UsersUsersUpdateInputPublicMetadata {
+[k: string]: unknown
+}
+/**
+ * REPLACES the whole private metadata bag. Management plane only.
+ */
+export interface UsersUsersUpdateInputPublicMetadata1 {
+[k: string]: unknown
+}
+
+export interface UsersUsersUpdateOutput {
+id: string
+name: (string | null)
+bannedAt: (string | null)
+erasedAt: (string | null)
+imageUrl: (string | null)
+testUser: boolean
+createdAt: string
+deletedAt: (string | null)
+productId: string
+updatedAt: string
+waitlisted: boolean
+identifiers: {
+id: string
+type: "email"
+value: string
+isPrimary: boolean
+verifiedAt: (string | null)
+valueCanonical: string
+verificationStatus: ("unverified" | "verified" | "expired")
+}[]
+lockedUntil: (string | null)
+lastSignInAt: (string | null)
+requiresReset: boolean
+publicMetadata: UsersUsersUpdateOutputPublicMetadata
+unsafeMetadata: UsersUsersUpdateOutputPublicMetadata
+privateMetadata: UsersUsersUpdateOutputPublicMetadata
+emailChangeLockedUntil: (string | null)
+}
+export interface UsersUsersUpdateOutputPublicMetadata {
+[k: string]: unknown
+}
+
+export interface UsersWaitlistEraseInput {
+/**
+ * The waitlisted user whose entry and directory row to erase.
+ */
+userId: string
+}
+
+export interface UsersWaitlistEraseOutput {
+erased: boolean
+}
+
+export interface UsersWaitlistFunnelInput {
+
+}
+
+export interface UsersWaitlistFunnelOutput {
+total: number
+invited: number
+pending: number
+withdrawn: number
+registered: number
+unconfirmed: number
+}
+
+export interface UsersWaitlistImportInput {
+/**
+ * The legacy signups to import, at most 500 per call — batch client-side beyond that.
+ * 
+ * @minItems 1
+ * @maxItems 500
+ */
+entries: [{
+/**
+ * The signup's display name.
+ */
+name?: string
+/**
+ * The consent proof from the source system. REQUIRED: a waitlist entry with no evidence of consent is exactly what this import exists to avoid creating.
+ */
+consent: {
+/**
+ * The IP the source system recorded, when it recorded one.
+ */
+ip?: (string | null)
+/**
+ * Where the acceptance happened in the source system, e.g. `legacy-widget`.
+ */
+source: string
+/**
+ * The user agent the source system recorded, when it recorded one.
+ */
+userAgent?: (string | null)
+/**
+ * When they accepted it, as recorded by the source system. Carried over verbatim — this is the evidence, and stamping it with the import time would destroy it.
+ */
+acceptedAt: string
+/**
+ * The privacy-policy version the signer accepted in the SOURCE system.
+ */
+policyVersion: string
+}
+/**
+ * Whether the address had proven itself reachable in the source system. Default true — a legacy list has already been mailed. Pass false to land the row as unconfirmed, where it is reported separately and is never invited.
+ */
+confirmed?: boolean
+/**
+ * The email address on the legacy list. Stored canonicalised plus raw for display.
+ */
+identifier: string
+/**
+ * Referrer / UTM attribution the source system recorded.
+ */
+attribution?: {
+/**
+ * utm_term of the visit.
+ */
+utmTerm?: string
+/**
+ * The document referrer of the signup page.
+ */
+referrer?: string
+/**
+ * utm_medium of the visit.
+ */
+utmMedium?: string
+/**
+ * utm_source of the visit.
+ */
+utmSource?: string
+/**
+ * utm_content of the visit.
+ */
+utmContent?: string
+/**
+ * The URL the signup was submitted from.
+ */
+landingPage?: string
+/**
+ * utm_campaign of the visit.
+ */
+utmCampaign?: string
+}
+/**
+ * End-user-writable metadata to carry onto the created user.
+ */
+unsafeMetadata?: {
+[k: string]: unknown
+}
+}, ...({
+/**
+ * The signup's display name.
+ */
+name?: string
+/**
+ * The consent proof from the source system. REQUIRED: a waitlist entry with no evidence of consent is exactly what this import exists to avoid creating.
+ */
+consent: {
+/**
+ * The IP the source system recorded, when it recorded one.
+ */
+ip?: (string | null)
+/**
+ * Where the acceptance happened in the source system, e.g. `legacy-widget`.
+ */
+source: string
+/**
+ * The user agent the source system recorded, when it recorded one.
+ */
+userAgent?: (string | null)
+/**
+ * When they accepted it, as recorded by the source system. Carried over verbatim — this is the evidence, and stamping it with the import time would destroy it.
+ */
+acceptedAt: string
+/**
+ * The privacy-policy version the signer accepted in the SOURCE system.
+ */
+policyVersion: string
+}
+/**
+ * Whether the address had proven itself reachable in the source system. Default true — a legacy list has already been mailed. Pass false to land the row as unconfirmed, where it is reported separately and is never invited.
+ */
+confirmed?: boolean
+/**
+ * The email address on the legacy list. Stored canonicalised plus raw for display.
+ */
+identifier: string
+/**
+ * Referrer / UTM attribution the source system recorded.
+ */
+attribution?: {
+/**
+ * utm_term of the visit.
+ */
+utmTerm?: string
+/**
+ * The document referrer of the signup page.
+ */
+referrer?: string
+/**
+ * utm_medium of the visit.
+ */
+utmMedium?: string
+/**
+ * utm_source of the visit.
+ */
+utmSource?: string
+/**
+ * utm_content of the visit.
+ */
+utmContent?: string
+/**
+ * The URL the signup was submitted from.
+ */
+landingPage?: string
+/**
+ * utm_campaign of the visit.
+ */
+utmCampaign?: string
+}
+/**
+ * End-user-writable metadata to carry onto the created user.
+ */
+unsafeMetadata?: {
+[k: string]: unknown
+}
+})[]]
+}
+
+export interface UsersWaitlistImportOutput {
+failed: number
+results: {
+row: number
+reason: (string | null)
+status: ("imported" | "skipped" | "failed")
+userId: (string | null)
+}[]
+skipped: number
+imported: number
+requested: number
+}
+
+export interface UsersWaitlistInviteInput {
+/**
+ * The waitlisted users to promote, up to 100 per call. Each gets the STANDARD invite email; accepting it is what creates their credential.
+ * 
+ * @minItems 1
+ * @maxItems 100
+ */
+userIds: [string, ...(string)[]]
+}
+
+export interface UsersWaitlistInviteOutput {
+invited: number
+results: {
+reason: (("suppressed" | "not_found" | "already_registered") | null)
+status: ("invited" | "skipped")
+userId: string
+}[]
+skipped: number
+}
+
+export interface UsersWaitlistListInput {
+/**
+ * Entries per page, 1-100. Default 25.
+ */
+limit?: number
+/**
+ * Opaque cursor from the previous page's `nextCursor`. Omit for the first page.
+ */
+cursor?: string
+/**
+ * Filter by funnel status: 'pending', 'invited', 'registered' or 'withdrawn'. Omit for all.
+ */
+status?: ("pending" | "invited" | "registered" | "withdrawn")
+/**
+ * Double opt-in only: false returns entries whose address never confirmed. Omit for both.
+ */
+confirmed?: boolean
+}
+
+export interface UsersWaitlistListOutput {
+entries: {
+status: ("pending" | "invited" | "registered" | "withdrawn")
+userId: string
+createdAt: string
+invitedAt: (string | null)
+identifier: string
+attribution: {
+[k: string]: unknown
+}
+confirmedAt: (string | null)
+withdrawnAt: (string | null)
+consentProof: {
+[k: string]: unknown
+}
+registeredAt: (string | null)
+inviteTokenId: (string | null)
+}[]
+nextCursor: (string | null)
+}
+
+export interface UsersWebhooksCreateInput {
+/**
+ * Where deliveries are POSTed. HTTPS only, no embedded credentials.
+ */
+url: string
+/**
+ * Which events to deliver. `user.created`, `user.updated` and `user.deleted` mirror the directory; `session.revoked` fires on sign-out, ban, erase and refresh-token reuse.
+ * 
+ * @minItems 1
+ */
+events: [("user.created" | "user.updated" | "user.deleted" | "session.revoked"), ...(("user.created" | "user.updated" | "user.deleted" | "session.revoked"))[]]
+/**
+ * A label only humans read — which system this endpoint feeds.
+ */
+description?: string
+}
+
+export interface UsersWebhooksCreateOutput {
+id: string
+url: string
+active: boolean
+events: ("user.created" | "user.updated" | "user.deleted" | "session.revoked")[]
+secret: string
+createdAt: string
+updatedAt: string
+description: (string | null)
+secretPrefix: string
+}
+
+export interface UsersWebhooksDeleteInput {
+/**
+ * Id of the webhook endpoint.
+ */
+id: string
+}
+
+export interface UsersWebhooksDeleteOutput {
+id: string
+deleted: true
+}
+
+export interface UsersWebhooksDeliveriesListInput {
+/**
+ * Id of the webhook endpoint whose deliveries to list.
+ */
+id: string
+limit?: number
+}
+
+export interface UsersWebhooksDeliveriesListOutput {
+deliveries: {
+id: string
+status: ("pending" | "succeeded" | "failed")
+eventId: string
+attempts: number
+createdAt: string
+eventType: ("user.created" | "user.updated" | "user.deleted" | "session.revoked")
+lastError: (string | null)
+webhookId: string
+lastAttemptAt: (string | null)
+responseStatus: (number | null)
+}[]
+}
+
+export interface UsersWebhooksGetInput {
+/**
+ * Id of the webhook endpoint.
+ */
+id: string
+}
+
+export interface UsersWebhooksGetOutput {
+id: string
+url: string
+active: boolean
+events: ("user.created" | "user.updated" | "user.deleted" | "session.revoked")[]
+createdAt: string
+updatedAt: string
+description: (string | null)
+secretPrefix: string
+}
+
+export interface UsersWebhooksListInput {
+
+}
+
+export interface UsersWebhooksListOutput {
+webhooks: {
+id: string
+url: string
+active: boolean
+events: ("user.created" | "user.updated" | "user.deleted" | "session.revoked")[]
+createdAt: string
+updatedAt: string
+description: (string | null)
+secretPrefix: string
+}[]
+}
+
+export interface UsersWebhooksRotateSecretInput {
+/**
+ * Id of the webhook endpoint.
+ */
+id: string
+}
+
+export interface UsersWebhooksRotateSecretOutput {
+id: string
+url: string
+active: boolean
+events: ("user.created" | "user.updated" | "user.deleted" | "session.revoked")[]
+secret: string
+createdAt: string
+updatedAt: string
+description: (string | null)
+secretPrefix: string
+}
+
+export interface UsersWebhooksUpdateInput {
+/**
+ * Id of the webhook endpoint.
+ */
+id: string
+/**
+ * Where deliveries are POSTed. HTTPS only, no embedded credentials.
+ */
+url?: string
+/**
+ * false pauses delivery without losing the endpoint or its secret.
+ */
+active?: boolean
+/**
+ * Which events to deliver. `user.created`, `user.updated` and `user.deleted` mirror the directory; `session.revoked` fires on sign-out, ban, erase and refresh-token reuse.
+ * 
+ * @minItems 1
+ */
+events?: [("user.created" | "user.updated" | "user.deleted" | "session.revoked"), ...(("user.created" | "user.updated" | "user.deleted" | "session.revoked"))[]]
+description?: (string | null)
+}
+
+export interface UsersWebhooksUpdateOutput {
+id: string
+url: string
+active: boolean
+events: ("user.created" | "user.updated" | "user.deleted" | "session.revoked")[]
+createdAt: string
+updatedAt: string
+description: (string | null)
+secretPrefix: string
+}
+
 export interface WaitlistConfigGetInput {
 
 }