@lessly/sdk-app 40.0.0 → 41.0.0

package/src/gen/brain/queryOptions.gen.ts

@@ -68,8 +68,6 @@ import type {
   BrainProductSharedMemoryResetInput,
   BrainRestoreStatusInput,
   BrainRestoreStatusOutput,
-  BrainUsageReportInput,
-  BrainUsageReportOutput,
 } from '../types.gen';
 
 export const brainBackupCreateMutationOptions = (sdk: GeneratedClient) => ({
@@ -271,8 +269,3 @@ export const brainRestoreStatusQueryOptions = (sdk: GeneratedClient, input: Brai
   queryKey: ['brain', 'restore', 'status', input] as const,
   queryFn: () => sdk['brain']['restore']['status'](input),
 });
-
-export const brainUsageReportQueryOptions = (sdk: GeneratedClient, input: BrainUsageReportInput) => ({
-  queryKey: ['brain', 'usage', 'report', input] as const,
-  queryFn: () => sdk['brain']['usage']['report'](input),
-});

package/src/gen/client.gen.ts

@@ -82,8 +82,6 @@ import type {
   BrainProductSharedMemoryResetOutput,
   BrainRestoreStatusInput,
   BrainRestoreStatusOutput,
-  BrainUsageReportInput,
-  BrainUsageReportOutput,
   ConsentConfigCookieDomainUpsertInput,
   ConsentConfigCookieDomainUpsertOutput,
   ConsentConfigCustomizationUpsertInput,
@@ -632,6 +630,30 @@ import type {
   OrganizationSupportThreadReplyOutput,
   OrganizationSupportThreadsListInput,
   OrganizationSupportThreadsListOutput,
+  PlaygroundAnalyticsOverviewInput,
+  PlaygroundAnalyticsOverviewOutput,
+  PlaygroundBillingEntitlementsInput,
+  PlaygroundBillingEntitlementsOutput,
+  PlaygroundBillingRecordUsageInput,
+  PlaygroundBillingRecordUsageOutput,
+  PlaygroundClickupCreateTaskInput,
+  PlaygroundClickupCreateTaskOutput,
+  PlaygroundClickupGetLastWebhookInput,
+  PlaygroundClickupGetLastWebhookOutput,
+  PlaygroundClickupGetOverviewInput,
+  PlaygroundClickupGetOverviewOutput,
+  PlaygroundGdriveGetLastChangeInput,
+  PlaygroundGdriveGetLastChangeOutput,
+  PlaygroundGdriveReadFileInput,
+  PlaygroundGdriveReadFileOutput,
+  PlaygroundGoogleadsReadCustomerInput,
+  PlaygroundGoogleadsReadCustomerOutput,
+  PlaygroundLifecycleGetStateInput,
+  PlaygroundLifecycleGetStateOutput,
+  PlaygroundLifecycleListEventsInput,
+  PlaygroundLifecycleListEventsOutput,
+  PlaygroundWebhookGetLastInput,
+  PlaygroundWebhookGetLastOutput,
   RealtimeArchiveExportInput,
   RealtimeArchiveExportOutput,
   RealtimeArchiveExportStatusInput,
@@ -874,6 +896,10 @@ import type {
   UsersOpsRetentionGetOutput,
   UsersOpsSloGetInput,
   UsersOpsSloGetOutput,
+  UsersPasskeysListInput,
+  UsersPasskeysListOutput,
+  UsersPasskeysRevokeInput,
+  UsersPasskeysRevokeOutput,
   UsersSessionsGetInput,
   UsersSessionsGetOutput,
   UsersSessionsImpersonateInput,
@@ -1035,9 +1061,6 @@ export interface GeneratedClient {
     restore: {
       status(input: BrainRestoreStatusInput): Promise<BrainRestoreStatusOutput>;
     };
-    usage: {
-      report(input: BrainUsageReportInput): Promise<BrainUsageReportOutput>;
-    };
   };
   consent: {
     'config-cookie-domain': {
@@ -1519,6 +1542,34 @@ export interface GeneratedClient {
       list(input: OrganizationSupportThreadsListInput): Promise<OrganizationSupportThreadsListOutput>;
     };
   };
+  playground: {
+    analytics: {
+      overview(input: PlaygroundAnalyticsOverviewInput): Promise<PlaygroundAnalyticsOverviewOutput>;
+    };
+    billing: {
+      entitlements(input: PlaygroundBillingEntitlementsInput): Promise<PlaygroundBillingEntitlementsOutput>;
+      'record-usage'(input: PlaygroundBillingRecordUsageInput): Promise<PlaygroundBillingRecordUsageOutput>;
+    };
+    clickup: {
+      'create-task'(input: PlaygroundClickupCreateTaskInput): Promise<PlaygroundClickupCreateTaskOutput>;
+      'get-last-webhook'(input: PlaygroundClickupGetLastWebhookInput): Promise<PlaygroundClickupGetLastWebhookOutput>;
+      'get-overview'(input: PlaygroundClickupGetOverviewInput): Promise<PlaygroundClickupGetOverviewOutput>;
+    };
+    gdrive: {
+      'get-last-change'(input: PlaygroundGdriveGetLastChangeInput): Promise<PlaygroundGdriveGetLastChangeOutput>;
+      'read-file'(input: PlaygroundGdriveReadFileInput): Promise<PlaygroundGdriveReadFileOutput>;
+    };
+    googleads: {
+      'read-customer'(input: PlaygroundGoogleadsReadCustomerInput): Promise<PlaygroundGoogleadsReadCustomerOutput>;
+    };
+    lifecycle: {
+      'get-state'(input: PlaygroundLifecycleGetStateInput): Promise<PlaygroundLifecycleGetStateOutput>;
+      'list-events'(input: PlaygroundLifecycleListEventsInput): Promise<PlaygroundLifecycleListEventsOutput>;
+    };
+    webhook: {
+      'get-last'(input: PlaygroundWebhookGetLastInput): Promise<PlaygroundWebhookGetLastOutput>;
+    };
+  };
   realtime: {
     archive: {
       export(input: RealtimeArchiveExportInput): Promise<RealtimeArchiveExportOutput>;
@@ -1753,6 +1804,10 @@ export interface GeneratedClient {
     'ops-slo': {
       get(input: UsersOpsSloGetInput): Promise<UsersOpsSloGetOutput>;
     };
+    passkeys: {
+      list(input: UsersPasskeysListInput): Promise<UsersPasskeysListOutput>;
+      revoke(input: UsersPasskeysRevokeInput): Promise<UsersPasskeysRevokeOutput>;
+    };
     sessions: {
       get(input: UsersSessionsGetInput): Promise<UsersSessionsGetOutput>;
       impersonate(input: UsersSessionsImpersonateInput): Promise<UsersSessionsImpersonateOutput>;

package/src/gen/manifest.gen.ts

@@ -1,2 +1,2 @@
 // AUTOGENERATED by scripts/generate.ts — do not edit.
-export const namespaces = ['analytics', 'brain', 'consent', 'deployment', 'mail', 'observe', 'organization', 'realtime', 'support', 'tracking', 'users', 'waitlist'] as const;
+export const namespaces = ['analytics', 'brain', 'consent', 'deployment', 'mail', 'observe', 'organization', 'playground', 'realtime', 'support', 'tracking', 'users', 'waitlist'] as const;

package/src/gen/playground/index.ts

@@ -0,0 +1,3 @@
+// AUTOGENERATED by scripts/generate.ts — do not edit.
+export * from './queryOptions.gen';
+export type { PlaygroundAnalyticsOverviewInput, PlaygroundAnalyticsOverviewOutput, PlaygroundBillingEntitlementsInput, PlaygroundBillingEntitlementsOutput, PlaygroundBillingRecordUsageInput, PlaygroundBillingRecordUsageOutput, PlaygroundClickupCreateTaskInput, PlaygroundClickupCreateTaskOutput, PlaygroundClickupGetLastWebhookInput, PlaygroundClickupGetLastWebhookOutput, PlaygroundClickupGetOverviewInput, PlaygroundClickupGetOverviewOutput, PlaygroundGdriveGetLastChangeInput, PlaygroundGdriveGetLastChangeOutput, PlaygroundGdriveReadFileInput, PlaygroundGdriveReadFileOutput, PlaygroundGoogleadsReadCustomerInput, PlaygroundGoogleadsReadCustomerOutput, PlaygroundLifecycleGetStateInput, PlaygroundLifecycleGetStateOutput, PlaygroundLifecycleListEventsInput, PlaygroundLifecycleListEventsOutput, PlaygroundWebhookGetLastInput, PlaygroundWebhookGetLastOutput } from '../types.gen';

package/src/gen/playground/queryOptions.gen.ts

@@ -0,0 +1,86 @@
+// AUTOGENERATED by scripts/generate.ts — do not edit.
+import type { GeneratedClient } from '../client.gen';
+import type {
+  PlaygroundAnalyticsOverviewInput,
+  PlaygroundAnalyticsOverviewOutput,
+  PlaygroundBillingEntitlementsInput,
+  PlaygroundBillingEntitlementsOutput,
+  PlaygroundBillingRecordUsageInput,
+  PlaygroundClickupCreateTaskInput,
+  PlaygroundClickupGetLastWebhookInput,
+  PlaygroundClickupGetLastWebhookOutput,
+  PlaygroundClickupGetOverviewInput,
+  PlaygroundClickupGetOverviewOutput,
+  PlaygroundGdriveGetLastChangeInput,
+  PlaygroundGdriveGetLastChangeOutput,
+  PlaygroundGdriveReadFileInput,
+  PlaygroundGdriveReadFileOutput,
+  PlaygroundGoogleadsReadCustomerInput,
+  PlaygroundGoogleadsReadCustomerOutput,
+  PlaygroundLifecycleGetStateInput,
+  PlaygroundLifecycleGetStateOutput,
+  PlaygroundLifecycleListEventsInput,
+  PlaygroundLifecycleListEventsOutput,
+  PlaygroundWebhookGetLastInput,
+  PlaygroundWebhookGetLastOutput,
+} from '../types.gen';
+
+export const playgroundAnalyticsOverviewQueryOptions = (sdk: GeneratedClient, input: PlaygroundAnalyticsOverviewInput) => ({
+  queryKey: ['playground', 'analytics', 'overview', input] as const,
+  queryFn: () => sdk['playground']['analytics']['overview'](input),
+});
+
+export const playgroundBillingEntitlementsQueryOptions = (sdk: GeneratedClient, input: PlaygroundBillingEntitlementsInput) => ({
+  queryKey: ['playground', 'billing', 'entitlements', input] as const,
+  queryFn: () => sdk['playground']['billing']['entitlements'](input),
+});
+
+export const playgroundBillingRecordUsageMutationOptions = (sdk: GeneratedClient) => ({
+  mutationKey: ['playground', 'billing', 'record-usage'],
+  mutationFn: (input: PlaygroundBillingRecordUsageInput) => sdk['playground']['billing']['record-usage'](input),
+});
+
+export const playgroundClickupCreateTaskMutationOptions = (sdk: GeneratedClient) => ({
+  mutationKey: ['playground', 'clickup', 'create-task'],
+  mutationFn: (input: PlaygroundClickupCreateTaskInput) => sdk['playground']['clickup']['create-task'](input),
+});
+
+export const playgroundClickupGetLastWebhookQueryOptions = (sdk: GeneratedClient, input: PlaygroundClickupGetLastWebhookInput) => ({
+  queryKey: ['playground', 'clickup', 'get-last-webhook', input] as const,
+  queryFn: () => sdk['playground']['clickup']['get-last-webhook'](input),
+});
+
+export const playgroundClickupGetOverviewQueryOptions = (sdk: GeneratedClient, input: PlaygroundClickupGetOverviewInput) => ({
+  queryKey: ['playground', 'clickup', 'get-overview', input] as const,
+  queryFn: () => sdk['playground']['clickup']['get-overview'](input),
+});
+
+export const playgroundGdriveGetLastChangeQueryOptions = (sdk: GeneratedClient, input: PlaygroundGdriveGetLastChangeInput) => ({
+  queryKey: ['playground', 'gdrive', 'get-last-change', input] as const,
+  queryFn: () => sdk['playground']['gdrive']['get-last-change'](input),
+});
+
+export const playgroundGdriveReadFileQueryOptions = (sdk: GeneratedClient, input: PlaygroundGdriveReadFileInput) => ({
+  queryKey: ['playground', 'gdrive', 'read-file', input] as const,
+  queryFn: () => sdk['playground']['gdrive']['read-file'](input),
+});
+
+export const playgroundGoogleadsReadCustomerQueryOptions = (sdk: GeneratedClient, input: PlaygroundGoogleadsReadCustomerInput) => ({
+  queryKey: ['playground', 'googleads', 'read-customer', input] as const,
+  queryFn: () => sdk['playground']['googleads']['read-customer'](input),
+});
+
+export const playgroundLifecycleGetStateQueryOptions = (sdk: GeneratedClient, input: PlaygroundLifecycleGetStateInput) => ({
+  queryKey: ['playground', 'lifecycle', 'get-state', input] as const,
+  queryFn: () => sdk['playground']['lifecycle']['get-state'](input),
+});
+
+export const playgroundLifecycleListEventsQueryOptions = (sdk: GeneratedClient, input: PlaygroundLifecycleListEventsInput) => ({
+  queryKey: ['playground', 'lifecycle', 'list-events', input] as const,
+  queryFn: () => sdk['playground']['lifecycle']['list-events'](input),
+});
+
+export const playgroundWebhookGetLastQueryOptions = (sdk: GeneratedClient, input: PlaygroundWebhookGetLastInput) => ({
+  queryKey: ['playground', 'webhook', 'get-last', input] as const,
+  queryFn: () => sdk['playground']['webhook']['get-last'](input),
+});

package/src/gen/types.gen.ts

@@ -1028,98 +1028,6 @@ snapshotId: string
 preRestoreSnapshotId: (string | null)
 } | null)
 
-export interface BrainUsageReportInput {
-/**
- * How many UTC days of this product's ledger to return, ending today (default 30, max 90)
- */
-days?: number
-}
-
-export interface BrainUsageReportOutput {
-note: string
-/**
- * Brain's own ledger, for THIS product only
- */
-product: {
-/**
- * Inclusive UTC end of the window (today), YYYY-MM-DD
- */
-to: string
-/**
- * The window actually used, after clamping
- */
-days: number
-/**
- * Inclusive UTC start of the window, YYYY-MM-DD
- */
-from: string
-rows: {
-/**
- * 'sync' | 'batch'; '' when the push carried none
- */
-mode: string
-/**
- * Manifest meter slug, e.g. llm-tokens
- */
-meter: string
-/**
- * Model dimension; '' when the push carried none
- */
-model: string
-/**
- * How many record() calls landed in this slice
- */
-events: number
-/**
- * Tokens we metered for this slice, delivered or not
- */
-tokens: number
-/**
- * Purpose dimension; '' when the push carried none
- */
-purpose: string
-/**
- * UTC calendar day, YYYY-MM-DD
- */
-usage_date: string
-/**
- * Of those events, how many billing did not accept
- */
-delivery_failed: number
-}[]
-/**
- * The rows rolled up per meter across the whole window
- */
-totals: {
-meter: string
-events: number
-tokens: number
-delivery_failed: number
-}[]
-product_id: string
-}
-/**
- * The platform billing aggregate for the whole ORG; null if it could not be read
- */
-platform: ({
-plan: string
-scope: "org"
-meters: {
-unit?: string
-used?: number
-limit?: (number | null)
-remaining?: (number | null)
-unlimited?: boolean
-meter_slug: string
-}[]
-org_id: string
-} | null)
-/**
- * Why the platform aggregate is null; null when it was read successfully
- */
-platform_error: (string | null)
-}
-
 export interface ConsentConfigCookieDomainUpsertInput {
 cookieDomain: ("" | null | string)
 }
@@ -15053,6 +14961,7 @@ displayName: (string | null)
 orgRoles: {
 id: string
 name: string
+description: (string | null)
 }[]
 canManage: boolean
 inherited: {
@@ -15449,6 +15358,226 @@ lastMessagePreview: (string | null)
 }[]
 }
 
+export interface PlaygroundAnalyticsOverviewInput {
+/**
+ * Max records per entity in recent[]; omit for the endpoint default
+ */
+limit?: number
+}
+
+export interface PlaygroundAnalyticsOverviewOutput {
+ok: boolean
+minted: boolean
+overview?: unknown
+http_status: number
+}
+
+export interface PlaygroundBillingEntitlementsInput {
+
+}
+
+export interface PlaygroundBillingEntitlementsOutput {
+ok: boolean
+minted: boolean
+http_status: number
+entitlements?: unknown
+}
+
+export interface PlaygroundBillingRecordUsageInput {
+/**
+ * Quantity of events to record against playground-events (SUM); defaults to 1
+ */
+value?: number
+}
+
+export interface PlaygroundBillingRecordUsageOutput {
+minted: boolean
+accepted: (number | null)
+recorded: boolean
+duplicates: (number | null)
+http_status: number
+}
+
+export interface PlaygroundClickupCreateTaskInput {
+/**
+ * Task title; defaults to a fixture label
+ */
+name?: string
+/**
+ * ClickUp list id; falls back to CLICKUP_TEST_LIST_ID
+ */
+listId?: string
+}
+
+export interface PlaygroundClickupCreateTaskOutput {
+minted: boolean
+task_id: (string | null)
+list_status: number
+vend_status: number
+clickup_status: number
+installation_count: number
+}
+
+export interface PlaygroundClickupGetLastWebhookInput {
+
+}
+
+export type PlaygroundClickupGetLastWebhookOutput = ({
+payload: string
+event_id: string
+provider: string
+verified: boolean
+product_id: string
+occurred_at: string
+connector_id: string
+clickup_event: (string | null)
+receipt_count: number
+} | {
+found: false
+})
+
+export interface PlaygroundClickupGetOverviewInput {
+
+}
+
+export interface PlaygroundClickupGetOverviewOutput {
+team: ({
+teamId: string
+teamName: string
+} | null)
+lists: PlaygroundClickupGetOverviewOutputItems[]
+tasks: {
+id: string
+name: string
+status: (string | null)
+}[]
+minted: boolean
+spaces: PlaygroundClickupGetOverviewOutputItems[]
+list_status: number
+vend_status: number
+lists_status: number
+tasks_status: number
+spaces_status: number
+folders_status: number
+installation_count: number
+}
+export interface PlaygroundClickupGetOverviewOutputItems {
+id: string
+name: string
+}
+
+export interface PlaygroundGdriveGetLastChangeInput {
+
+}
+
+export type PlaygroundGdriveGetLastChangeOutput = ({
+file_id: string
+removed: boolean
+file_name: (string | null)
+mime_type: (string | null)
+product_id: string
+occurred_at: string
+connector_id: string
+resource_state: string
+} | {
+found: false
+})
+
+export interface PlaygroundGdriveReadFileInput {
+/**
+ * Drive file id; falls back to GDRIVE_TEST_FILE_ID, then the first picked file
+ */
+fileId?: string
+}
+
+export interface PlaygroundGdriveReadFileOutput {
+minted: boolean
+file_id: (string | null)
+file_name: (string | null)
+mime_type: (string | null)
+file_count: number
+get_status: number
+list_status: number
+vend_status: number
+content_bytes: (number | null)
+}
+
+export interface PlaygroundGoogleadsReadCustomerInput {
+
+}
+
+export interface PlaygroundGoogleadsReadCustomerOutput {
+minted: boolean
+vended: boolean
+customer_id: (string | null)
+vend_status: number
+result_count: number
+search_status: number
+login_customer_id: (string | null)
+}
+
+export interface PlaygroundLifecycleGetStateInput {
+
+}
+
+export interface PlaygroundLifecycleGetStateOutput {
+blocked: boolean
+archived: boolean
+productId: string
+lastBlockTransition: ({
+eventId: string
+eventName: string
+productId: string
+occurredAt: string
+recordedAt: string
+receiptCount: number
+organizationId: string
+cascadedFromOrg: boolean
+} | null)
+lastArchiveTransition: ({
+eventId: string
+eventName: string
+productId: string
+occurredAt: string
+recordedAt: string
+receiptCount: number
+organizationId: string
+cascadedFromOrg: boolean
+} | null)
+}
+
+export interface PlaygroundLifecycleListEventsInput {
+
+}
+
+export type PlaygroundLifecycleListEventsOutput = {
+eventId: string
+eventName: string
+productId: string
+occurredAt: string
+recordedAt: string
+receiptCount: number
+organizationId: string
+cascadedFromOrg: boolean
+}[]
+
+export interface PlaygroundWebhookGetLastInput {
+
+}
+
+export type PlaygroundWebhookGetLastOutput = ({
+payload?: unknown
+event_id: string
+provider: string
+verified: boolean
+product_id: string
+occurred_at: string
+connector_id: string
+delivery_count: number
+} | {
+found: false
+})
+
 export interface RealtimeArchiveExportInput {
 /**
  * Only entries with ts <= to_ts (epoch ms)
@@ -37660,6 +37789,24 @@ siteKey: (string | null)
 provider: "turnstile"
 riskElevated: boolean
 }
+passkeys: {
+/**
+ * The WebAuthn Relying Party ID — the product's own domain, without a scheme or port. Leave null to derive it from `allowedOrigins`, which works whenever they all sit on one host. Set it to the shared PARENT domain when they do not (`example.com` covering `app.example.com` and `www.example.com`); it must cover EVERY allowed origin or passkeys stay off. CHANGING IT ORPHANS every credential already enrolled — an authenticator only ever asserts a credential back to the RP ID it was created for.
+ */
+rpId: (string | null)
+/**
+ * The user-visible relying-party name the operating system's passkey prompt shows. Defaults to the RP ID.
+ */
+rpName: (string | null)
+/**
+ * Whether this product is a WebAuthn relying party: passkeys can be enrolled and offered as a sign-in strategy. Default false. Switching it on is not enough on its own — the product also needs at least one browser origin in `allowedOrigins` for the RP ID to be derived from.
+ */
+enabled: boolean
+/**
+ * Whether the authenticator must verify the user (biometric, PIN) rather than merely being present. Default false, which asks for verification but accepts an assertion without it — at `aal1`. A verified assertion always mints `aal2`, whatever this says; setting it true refuses the unverified one outright.
+ */
+requireUserVerification: boolean
+}
 recovery: {
 /**
  * Offer the password-recovery flow at all. Default true.
@@ -37971,6 +38118,27 @@ secretKey?: (string | null)
  */
 riskElevated?: boolean
 }
+/**
+ * Passkey (WebAuthn) settings: whether this product is a relying party, the RP ID and name, and whether an assertion must be user-verified. Merged field-by-field. The `passkey` strategy is offered only when `enabled` is true AND an RP ID resolves.
+ */
+passkeys?: {
+/**
+ * The WebAuthn Relying Party ID — the product's own domain, without a scheme or port. Leave null to derive it from `allowedOrigins`, which works whenever they all sit on one host. Set it to the shared PARENT domain when they do not (`example.com` covering `app.example.com` and `www.example.com`); it must cover EVERY allowed origin or passkeys stay off. CHANGING IT ORPHANS every credential already enrolled — an authenticator only ever asserts a credential back to the RP ID it was created for.
+ */
+rpId?: (string | null)
+/**
+ * The user-visible relying-party name the operating system's passkey prompt shows. Defaults to the RP ID.
+ */
+rpName?: (string | null)
+/**
+ * Whether this product is a WebAuthn relying party: passkeys can be enrolled and offered as a sign-in strategy. Default false. Switching it on is not enough on its own — the product also needs at least one browser origin in `allowedOrigins` for the RP ID to be derived from.
+ */
+enabled?: boolean
+/**
+ * Whether the authenticator must verify the user (biometric, PIN) rather than merely being present. Default false, which asks for verification but accepts an assertion without it — at `aal1`. A verified assertion always mints `aal2`, whatever this says; setting it true refuses the unverified one outright.
+ */
+requireUserVerification?: boolean
+}
 /**
  * Password-recovery settings (whether it is offered, how long a reset link lives). Merged field-by-field.
  */
@@ -38299,6 +38467,24 @@ siteKey: (string | null)
 provider: "turnstile"
 riskElevated: boolean
 }
+passkeys: {
+/**
+ * The WebAuthn Relying Party ID — the product's own domain, without a scheme or port. Leave null to derive it from `allowedOrigins`, which works whenever they all sit on one host. Set it to the shared PARENT domain when they do not (`example.com` covering `app.example.com` and `www.example.com`); it must cover EVERY allowed origin or passkeys stay off. CHANGING IT ORPHANS every credential already enrolled — an authenticator only ever asserts a credential back to the RP ID it was created for.
+ */
+rpId: (string | null)
+/**
+ * The user-visible relying-party name the operating system's passkey prompt shows. Defaults to the RP ID.
+ */
+rpName: (string | null)
+/**
+ * Whether this product is a WebAuthn relying party: passkeys can be enrolled and offered as a sign-in strategy. Default false. Switching it on is not enough on its own — the product also needs at least one browser origin in `allowedOrigins` for the RP ID to be derived from.
+ */
+enabled: boolean
+/**
+ * Whether the authenticator must verify the user (biometric, PIN) rather than merely being present. Default false, which asks for verification but accepts an assertion without it — at `aal1`. A verified assertion always mints `aal2`, whatever this says; setting it true refuses the unverified one outright.
+ */
+requireUserVerification: boolean
+}
 recovery: {
 /**
  * Offer the password-recovery flow at all. Default true.
@@ -38491,7 +38677,7 @@ userId: string
 
 export interface UsersFactorsListOutput {
 factors: {
-type: ("totp" | "backup_codes")
+type: ("totp" | "backup_codes" | "webauthn")
 status: ("unverified" | "verified")
 createdAt: string
 remaining: (number | null)
@@ -38808,6 +38994,52 @@ signInFailureBaseline: (number | null)
 }
 }
 
+export interface UsersPasskeysListInput {
+/**
+ * The end user whose passkeys to list.
+ */
+userId: string
+}
+
+export interface UsersPasskeysListOutput {
+passkeys: {
+id: string
+name: (string | null)
+aaguid: (string | null)
+backedUp: boolean
+createdAt: string
+signCount: number
+lastUsedAt: (string | null)
+transports: string[]
+}[]
+}
+
+export interface UsersPasskeysRevokeInput {
+/**
+ * Why this credential is being revoked, and under which ticket. Recorded verbatim in the audit row — this is the whole point of the tool being audited.
+ */
+reason: string
+/**
+ * The end user whose passkey is being revoked.
+ */
+userId: string
+/**
+ * Which credential to revoke — the `id` from `users_passkeys_list`.
+ */
+passkeyId: string
+}
+
+export interface UsersPasskeysRevokeOutput {
+/**
+ * Present when the revoke was refused — today, only because it was the last way in.
+ */
+error: ({
+code: string
+message: string
+} | null)
+status: ("deleted" | "failed")
+}
+
 export interface UsersSessionsGetInput {
 /**
  * The session to read.