@marinoscar/platform-contract 0.1.0-next.3 → 0.1.0-next.4

package/dist/esm/identity/schemas.d.ts

@@ -0,0 +1,784 @@
+import { z } from 'zod';
+import { AUTH_ERROR_CODES, DEVICE_SESSION_STATUSES, DEVICE_TOKEN_ERROR_CODES, DEVICE_TOKEN_TYPES, ORG_INVITE_STATUSES, ORG_MEMBER_STATUSES, PAT_DURATION_UNITS, ROLE_SCOPES, TENANCY_MODES } from './constants.js';
+/**
+ * The entries of {@link authErrorCodeSchema}: each code keyed by itself.
+ *
+ * @stability stable
+ */
+export type AuthErrorCodeEnum = {
+    [K in (typeof AUTH_ERROR_CODES)[number]]: K;
+};
+/**
+ * The entries of a tenancy-mode enum: each mode keyed by itself.
+ *
+ * @stability stable
+ */
+export type TenancyModeEnum = {
+    [K in (typeof TENANCY_MODES)[number]]: K;
+};
+/**
+ * The entries of a role-scope enum: each scope keyed by itself.
+ *
+ * @stability experimental
+ */
+export type RoleScopeEnum = {
+    [K in (typeof ROLE_SCOPES)[number]]: K;
+};
+/**
+ * The entries of the former assignable-org-role enum: each built-in role keyed
+ * by itself.
+ *
+ * @deprecated The assignable set is open ({@link roleIdSchema}); this type only
+ *   names the built-in entries. Kept for one release.
+ * @stability stable
+ */
+export type AssignableOrgRoleEnum = {
+    [K in 'org_admin' | 'contributor' | 'viewer']: K;
+};
+/**
+ * The entries of a personal-access-token duration-unit enum.
+ *
+ * @stability stable
+ */
+export type PatDurationUnitEnum = {
+    [K in (typeof PAT_DURATION_UNITS)[number]]: K;
+};
+/**
+ * The entries of a device credential-type enum.
+ *
+ * @stability stable
+ */
+export type DeviceTokenTypeEnum = {
+    [K in (typeof DEVICE_TOKEN_TYPES)[number]]: K;
+};
+/**
+ * The entries of a device-session status enum.
+ *
+ * @stability stable
+ */
+export type DeviceSessionStatusEnum = {
+    [K in (typeof DEVICE_SESSION_STATUSES)[number]]: K;
+};
+/**
+ * The entries of a device token error-code enum.
+ *
+ * @stability stable
+ */
+export type DeviceTokenErrorCodeEnum = {
+    [K in (typeof DEVICE_TOKEN_ERROR_CODES)[number]]: K;
+};
+/**
+ * The entries of a membership-status enum.
+ *
+ * @stability stable
+ */
+export type OrgMemberStatusEnum = {
+    [K in (typeof ORG_MEMBER_STATUSES)[number]]: K;
+};
+/**
+ * The entries of an invitation-status enum.
+ *
+ * @stability stable
+ */
+export type OrgInviteStatusEnum = {
+    [K in (typeof ORG_INVITE_STATUSES)[number]]: K;
+};
+/**
+ * The entries of a list filter over membership statuses: `all` or one status.
+ *
+ * @stability stable
+ */
+export type OrgMemberStatusFilterEnum = {
+    [K in 'all' | (typeof ORG_MEMBER_STATUSES)[number]]: K;
+};
+/**
+ * The entries of a list filter over invitation statuses: `all` or one status.
+ *
+ * @stability stable
+ */
+export type OrgInviteStatusFilterEnum = {
+    [K in 'all' | (typeof ORG_INVITE_STATUSES)[number]]: K;
+};
+/**
+ * A sign-in failure code on the wire: the `error` query parameter of
+ * `/auth/callback`. A client that receives anything else shows the generic
+ * failure ({@link DEFAULT_AUTH_ERROR_CODE}) without echoing the value.
+ *
+ * @stability stable
+ */
+export declare const authErrorCodeSchema: z.ZodEnum<AuthErrorCodeEnum>;
+/**
+ * One OAuth provider of `GET /api/auth/providers`.
+ *
+ * @stability stable
+ */
+export declare const authProviderSchema: z.ZodObject<{
+    name: z.ZodString;
+    enabled: z.ZodBoolean;
+    mode: z.ZodOptional<z.ZodLiteral<"custom">>;
+}, z.core.$strip>;
+/**
+ * `GET /api/auth/providers`: every registered provider and whether it is enabled.
+ *
+ * @stability stable
+ */
+export declare const authProvidersResponseSchema: z.ZodObject<{
+    providers: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        enabled: z.ZodBoolean;
+        mode: z.ZodOptional<z.ZodLiteral<"custom">>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/**
+ * A role of the current user (`/api/auth/me` `roles[]`).
+ *
+ * @stability stable
+ */
+export declare const authRoleSchema: z.ZodObject<{
+    name: z.ZodString;
+}, z.core.$strip>;
+/**
+ * The organization the session acts in (`/api/auth/me` `activeOrg`).
+ *
+ * @stability stable
+ */
+export declare const activeOrgSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    slug: z.ZodString;
+}, z.core.$strip>;
+/**
+ * One organization the user is an active member of (`/api/auth/me`
+ * `memberships[]`).
+ *
+ * @stability stable
+ */
+export declare const authMembershipSchema: z.ZodObject<{
+    orgId: z.ZodString;
+    name: z.ZodString;
+    slug: z.ZodString;
+    role: z.ZodString;
+}, z.core.$strip>;
+/**
+ * What user extensions add to a user payload: `extensions` of `GET /api/auth/me`
+ * and of each row of `GET /api/users`. One entry per extension that contributed,
+ * keyed by the extension's id ({@link USER_EXTENSION_ID_PATTERN}); each value is
+ * a JSON object the extension chose, bounded by `USER_EXTENSION_LIMITS` and never
+ * a secret. Absent when no extension contributed.
+ *
+ * @extensionPoint schema
+ * @stability experimental
+ */
+export declare const userExtensionsSchema: z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+/**
+ * `GET /api/auth/me`: the signed-in user, their roles and effective
+ * permissions in the active organization, the deployment's tenancy mode, the
+ * active organization and every organization they may switch to.
+ *
+ * @extensionPoint schema
+ * @stability stable
+ */
+export declare const currentUserSchema: z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodString;
+    displayName: z.ZodNullable<z.ZodString>;
+    profileImageUrl: z.ZodNullable<z.ZodString>;
+    providerProfileImageUrl: z.ZodNullable<z.ZodString>;
+    hasUploadedProfileImage: z.ZodBoolean;
+    isActive: z.ZodBoolean;
+    roles: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+    }, z.core.$strip>>;
+    permissions: z.ZodArray<z.ZodString>;
+    tenancyMode: z.ZodEnum<TenancyModeEnum>;
+    activeOrg: z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        slug: z.ZodString;
+    }, z.core.$strip>>;
+    memberships: z.ZodArray<z.ZodObject<{
+        orgId: z.ZodString;
+        name: z.ZodString;
+        slug: z.ZodString;
+        role: z.ZodString;
+    }, z.core.$strip>>;
+    extensions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+}, z.core.$strip>;
+/**
+ * `POST /api/auth/refresh` and `POST /api/auth/switch-org`: a new access token
+ * (the refresh token travels in the HttpOnly cookie, never in the body).
+ *
+ * @stability stable
+ */
+export declare const tokenResponseSchema: z.ZodObject<{
+    accessToken: z.ZodString;
+    expiresIn: z.ZodNumber;
+}, z.core.$strip>;
+/**
+ * `POST /api/auth/switch-org` body: the organization to act in next. The ONLY
+ * place an org id enters the auth path from request input, and it is checked
+ * against the caller's active memberships before anything is issued.
+ *
+ * @stability stable
+ */
+export declare const switchOrgSchema: z.ZodObject<{
+    orgId: z.ZodUUID;
+}, z.core.$strip>;
+/**
+ * `POST /api/pat` body: a name, a lifetime and, optionally, the organization
+ * the token is bound to.
+ *
+ * @stability stable
+ */
+export declare const createPatSchema: z.ZodObject<{
+    name: z.ZodString;
+    durationValue: z.ZodNumber;
+    durationUnit: z.ZodEnum<PatDurationUnitEnum>;
+    orgId: z.ZodOptional<z.ZodUUID>;
+}, z.core.$strip>;
+/**
+ * `POST /api/pat` response: the new token, whose raw value is shown only once.
+ *
+ * @stability stable
+ */
+export declare const patCreatedResponseSchema: z.ZodObject<{
+    token: z.ZodString;
+    id: z.ZodString;
+    name: z.ZodString;
+    tokenPrefix: z.ZodString;
+    expiresAt: z.ZodString;
+    createdAt: z.ZodString;
+    orgId: z.ZodString;
+}, z.core.$strip>;
+/**
+ * One row of `GET /api/pat`. Never carries the token value.
+ *
+ * @stability stable
+ */
+export declare const patListItemSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    tokenPrefix: z.ZodString;
+    durationValue: z.ZodNumber;
+    durationUnit: z.ZodEnum<PatDurationUnitEnum>;
+    expiresAt: z.ZodString;
+    lastUsedAt: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+    revokedAt: z.ZodNullable<z.ZodString>;
+    orgId: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * The credential a device flow mints: `session` (default) or `pat`.
+ *
+ * `'session'` is the historical behaviour and MUST stay the default: the web
+ * activation page sends no `tokenType` at all.
+ *
+ * @stability stable
+ */
+export declare const deviceTokenTypeSchema: z.ZodEnum<DeviceTokenTypeEnum>;
+/**
+ * Client information of a device authorization request.
+ *
+ * WARNING: every field arrives from an UNAUTHENTICATED caller, is persisted
+ * verbatim and is later rendered where a human trusts it (the activation
+ * page, the Access Tokens list). Treat it as hostile at every point of use.
+ *
+ * `tokenType` defaults to `session`; an unknown value is rejected with a 400,
+ * never quietly replaced.
+ *
+ * @stability stable
+ */
+export declare const deviceClientInfoSchema: z.ZodObject<{
+    deviceName: z.ZodOptional<z.ZodString>;
+    userAgent: z.ZodOptional<z.ZodString>;
+    tokenType: z.ZodDefault<z.ZodEnum<DeviceTokenTypeEnum>>;
+}, z.core.$strip>;
+/**
+ * `POST /api/auth/device/code` body.
+ *
+ * @stability stable
+ */
+export declare const deviceCodeRequestSchema: z.ZodObject<{
+    clientInfo: z.ZodOptional<z.ZodObject<{
+        deviceName: z.ZodOptional<z.ZodString>;
+        userAgent: z.ZodOptional<z.ZodString>;
+        tokenType: z.ZodDefault<z.ZodEnum<DeviceTokenTypeEnum>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/**
+ * `POST /api/auth/device/code` response.
+ *
+ * @stability stable
+ */
+export declare const deviceCodeResponseSchema: z.ZodObject<{
+    deviceCode: z.ZodString;
+    userCode: z.ZodString;
+    verificationUri: z.ZodString;
+    verificationUriComplete: z.ZodString;
+    expiresIn: z.ZodNumber;
+    interval: z.ZodNumber;
+}, z.core.$strip>;
+/**
+ * `POST /api/auth/device/token` body.
+ *
+ * @stability stable
+ */
+export declare const deviceTokenRequestSchema: z.ZodObject<{
+    deviceCode: z.ZodString;
+}, z.core.$strip>;
+/**
+ * `POST /api/auth/device/token` success: a session credential (access plus
+ * refresh token) or, when `credentialType` is `pat`, a personal access token.
+ *
+ * @stability stable
+ */
+export declare const deviceTokenResponseSchema: z.ZodObject<{
+    accessToken: z.ZodString;
+    refreshToken: z.ZodOptional<z.ZodString>;
+    tokenType: z.ZodString;
+    expiresIn: z.ZodNumber;
+    credentialType: z.ZodOptional<z.ZodLiteral<"pat">>;
+    expiresAt: z.ZodOptional<z.ZodString>;
+    tokenId: z.ZodOptional<z.ZodString>;
+    tokenName: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * `POST /api/auth/device/token` failure (RFC 8628 section 3.5). Branch on
+ * `error`, never on the description or the status.
+ *
+ * @stability stable
+ */
+export declare const deviceTokenErrorSchema: z.ZodObject<{
+    error: z.ZodEnum<DeviceTokenErrorCodeEnum>;
+    error_description: z.ZodString;
+}, z.core.$strip>;
+/**
+ * `POST /api/auth/device/authorize` body: approve or deny a user code.
+ *
+ * @stability stable
+ */
+export declare const deviceAuthorizeRequestSchema: z.ZodObject<{
+    userCode: z.ZodString;
+    approve: z.ZodBoolean;
+}, z.core.$strip>;
+/**
+ * `POST /api/auth/device/authorize` response.
+ *
+ * @stability stable
+ */
+export declare const deviceAuthorizeResponseSchema: z.ZodObject<{
+    success: z.ZodBoolean;
+    message: z.ZodString;
+}, z.core.$strip>;
+/**
+ * `GET /api/auth/device/activate` response: what the activation page shows.
+ *
+ * @stability stable
+ */
+export declare const deviceActivateResponseSchema: z.ZodObject<{
+    verificationUri: z.ZodString;
+    userCode: z.ZodOptional<z.ZodString>;
+    clientInfo: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    expiresAt: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * One device session of `GET /api/auth/device/sessions`.
+ *
+ * @stability stable
+ */
+export declare const deviceSessionSchema: z.ZodObject<{
+    id: z.ZodString;
+    userCode: z.ZodString;
+    status: z.ZodEnum<DeviceSessionStatusEnum>;
+    clientInfo: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    createdAt: z.ZodString;
+    expiresAt: z.ZodString;
+    collectedAt: z.ZodNullable<z.ZodString>;
+    credentialExpiresAt: z.ZodNullable<z.ZodString>;
+    credentialType: z.ZodNullable<z.ZodEnum<DeviceTokenTypeEnum>>;
+}, z.core.$strip>;
+/**
+ * `GET /api/auth/device/sessions`: one page of device sessions, newest first.
+ *
+ * @stability stable
+ */
+export declare const deviceSessionsResponseSchema: z.ZodObject<{
+    sessions: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        userCode: z.ZodString;
+        status: z.ZodEnum<DeviceSessionStatusEnum>;
+        clientInfo: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        createdAt: z.ZodString;
+        expiresAt: z.ZodString;
+        collectedAt: z.ZodNullable<z.ZodString>;
+        credentialExpiresAt: z.ZodNullable<z.ZodString>;
+        credentialType: z.ZodNullable<z.ZodEnum<DeviceTokenTypeEnum>>;
+    }, z.core.$strip>>;
+    total: z.ZodNumber;
+    page: z.ZodNumber;
+    limit: z.ZodNumber;
+}, z.core.$strip>;
+/**
+ * `GET /api/admin/organizations` query: paging and an optional name or slug search.
+ *
+ * @stability stable
+ */
+export declare const organizationListQuerySchema: z.ZodObject<{
+    page: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    pageSize: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    search: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * `POST /api/admin/organizations` body: a name, a slug and the email of the
+ * first organization administrator (invited).
+ *
+ * @stability stable
+ */
+export declare const createOrganizationSchema: z.ZodObject<{
+    name: z.ZodString;
+    slug: z.ZodString;
+    firstAdminEmail: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+}, z.core.$strict>;
+/**
+ * `PATCH /api/admin/organizations/:id` body: a new name. The slug never changes.
+ *
+ * @stability stable
+ */
+export declare const renameOrganizationSchema: z.ZodObject<{
+    name: z.ZodString;
+}, z.core.$strict>;
+/**
+ * One organization, as the admin organization routes return it.
+ *
+ * @stability stable
+ */
+export declare const organizationResponseSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    name: z.ZodString;
+    slug: z.ZodString;
+    isDefault: z.ZodBoolean;
+    memberCount: z.ZodNumber;
+    createdAt: z.ZodISODateTime;
+    updatedAt: z.ZodISODateTime;
+}, z.core.$strip>;
+/**
+ * A role id on the wire: lower-case letters, digits, `_` and `-`, starting with
+ * a letter ({@link ROLE_ID_PATTERN}). Only the SHAPE is checked here; whether
+ * the role exists, has the right scope and may be assigned is decided by the
+ * API against the role registry (a 400 whose `details.reason` is
+ * `ROLE_NOT_ASSIGNABLE`).
+ *
+ * @stability experimental
+ */
+export declare const roleIdSchema: z.ZodString;
+/**
+ * `GET /api/roles` query: the scope to list. Without it the API lists every
+ * scope the caller may read (`users:read` for `system`, `org_members:read`
+ * for `org`).
+ *
+ * @stability experimental
+ */
+export declare const roleListQuerySchema: z.ZodObject<{
+    scope: z.ZodOptional<z.ZodEnum<RoleScopeEnum>>;
+}, z.core.$strip>;
+/**
+ * One role as `GET /api/roles` describes it.
+ *
+ * @stability experimental
+ */
+export declare const roleDescriptorSchema: z.ZodObject<{
+    id: z.ZodString;
+    label: z.ZodString;
+    description: z.ZodString;
+    scope: z.ZodEnum<RoleScopeEnum>;
+    assignable: z.ZodBoolean;
+}, z.core.$strip>;
+/**
+ * `GET /api/roles` response data: the roles, in registration order.
+ *
+ * @stability experimental
+ */
+export declare const roleListResponseSchema: z.ZodArray<z.ZodObject<{
+    id: z.ZodString;
+    label: z.ZodString;
+    description: z.ZodString;
+    scope: z.ZodEnum<RoleScopeEnum>;
+    assignable: z.ZodBoolean;
+}, z.core.$strip>>;
+/**
+ * `GET /api/org/members` query: paging, a search and a status filter.
+ *
+ * @stability stable
+ */
+export declare const orgMemberListQuerySchema: z.ZodObject<{
+    page: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    pageSize: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    search: z.ZodOptional<z.ZodString>;
+    status: z.ZodDefault<z.ZodEnum<OrgMemberStatusFilterEnum>>;
+}, z.core.$strip>;
+/**
+ * `PATCH /api/org/members/:userId` body: a new org role, a new status, or both.
+ *
+ * @stability stable
+ */
+export declare const updateOrgMemberSchema: z.ZodObject<{
+    roleName: z.ZodOptional<z.ZodString>;
+    status: z.ZodOptional<z.ZodEnum<OrgMemberStatusEnum>>;
+}, z.core.$strict>;
+/**
+ * One member of the active organization.
+ *
+ * @stability stable
+ */
+export declare const orgMemberResponseSchema: z.ZodObject<{
+    userId: z.ZodUUID;
+    email: z.ZodEmail;
+    displayName: z.ZodNullable<z.ZodString>;
+    role: z.ZodString;
+    status: z.ZodEnum<OrgMemberStatusEnum>;
+    lastActiveAt: z.ZodNullable<z.ZodISODateTime>;
+    joinedAt: z.ZodISODateTime;
+}, z.core.$strip>;
+/**
+ * `GET /api/org/invites` query: paging and a status filter.
+ *
+ * @stability stable
+ */
+export declare const orgInviteListQuerySchema: z.ZodObject<{
+    page: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    pageSize: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    status: z.ZodDefault<z.ZodEnum<OrgInviteStatusFilterEnum>>;
+}, z.core.$strip>;
+/**
+ * `POST /api/org/invites` body: who to invite, with which org role. Takes no
+ * org id: the invitation is always for the caller's active organization.
+ *
+ * @stability stable
+ */
+export declare const createOrgInviteSchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+    roleName: z.ZodString;
+    notes: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/**
+ * One invitation of the active organization.
+ *
+ * @stability stable
+ */
+export declare const orgInviteResponseSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    email: z.ZodEmail;
+    role: z.ZodString;
+    status: z.ZodEnum<OrgInviteStatusEnum>;
+    notes: z.ZodNullable<z.ZodString>;
+    expiresAt: z.ZodNullable<z.ZodISODateTime>;
+    createdAt: z.ZodISODateTime;
+    acceptedAt: z.ZodNullable<z.ZodISODateTime>;
+    invitedBy: z.ZodNullable<z.ZodObject<{
+        id: z.ZodUUID;
+        email: z.ZodEmail;
+    }, z.core.$strip>>;
+    acceptedBy: z.ZodNullable<z.ZodObject<{
+        id: z.ZodUUID;
+        email: z.ZodEmail;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/**
+ * `GET /api/auth/providers` response.
+ *
+ * @stability stable
+ */
+export type AuthProvidersResponse = z.infer<typeof authProvidersResponseSchema>;
+/**
+ * The `extensions` of a user payload: a JSON object per extension id.
+ *
+ * @stability experimental
+ */
+export type UserExtensions = z.infer<typeof userExtensionsSchema>;
+/**
+ * `GET /api/auth/me` response.
+ *
+ * @stability stable
+ */
+export type CurrentUser = z.infer<typeof currentUserSchema>;
+/**
+ * `/api/auth/me` `activeOrg`.
+ *
+ * @stability stable
+ */
+export type ActiveOrg = z.infer<typeof activeOrgSchema>;
+/**
+ * One of `/api/auth/me` `memberships`.
+ *
+ * @stability stable
+ */
+export type AuthMembership = z.infer<typeof authMembershipSchema>;
+/**
+ * An access-token response.
+ *
+ * @stability stable
+ */
+export type TokenResponse = z.infer<typeof tokenResponseSchema>;
+/**
+ * `POST /api/auth/switch-org` body.
+ *
+ * @stability stable
+ */
+export type SwitchOrgRequest = z.infer<typeof switchOrgSchema>;
+/**
+ * `POST /api/pat` body, as a client sends it.
+ *
+ * @stability stable
+ */
+export type CreatePatRequest = z.input<typeof createPatSchema>;
+/**
+ * `POST /api/pat` response.
+ *
+ * @stability stable
+ */
+export type PatCreatedResponse = z.infer<typeof patCreatedResponseSchema>;
+/**
+ * One row of `GET /api/pat`.
+ *
+ * @stability stable
+ */
+export type PatListItem = z.infer<typeof patListItemSchema>;
+/**
+ * Device client information, as parsed (`tokenType` filled in).
+ *
+ * @stability stable
+ */
+export type DeviceClientInfo = z.infer<typeof deviceClientInfoSchema>;
+/**
+ * `POST /api/auth/device/code` body, as a client sends it.
+ *
+ * @stability stable
+ */
+export type DeviceCodeRequest = z.input<typeof deviceCodeRequestSchema>;
+/**
+ * `POST /api/auth/device/code` response.
+ *
+ * @stability stable
+ */
+export type DeviceCodeResponse = z.infer<typeof deviceCodeResponseSchema>;
+/**
+ * `POST /api/auth/device/token` body.
+ *
+ * @stability stable
+ */
+export type DeviceTokenRequest = z.infer<typeof deviceTokenRequestSchema>;
+/**
+ * `POST /api/auth/device/token` success.
+ *
+ * @stability stable
+ */
+export type DeviceTokenResponse = z.infer<typeof deviceTokenResponseSchema>;
+/**
+ * `POST /api/auth/device/token` failure.
+ *
+ * @stability stable
+ */
+export type DeviceTokenError = z.infer<typeof deviceTokenErrorSchema>;
+/**
+ * `POST /api/auth/device/authorize` body.
+ *
+ * @stability stable
+ */
+export type DeviceAuthorizeRequest = z.infer<typeof deviceAuthorizeRequestSchema>;
+/**
+ * `POST /api/auth/device/authorize` response.
+ *
+ * @stability stable
+ */
+export type DeviceAuthorizeResponse = z.infer<typeof deviceAuthorizeResponseSchema>;
+/**
+ * `GET /api/auth/device/activate` response.
+ *
+ * @stability stable
+ */
+export type DeviceActivateResponse = z.infer<typeof deviceActivateResponseSchema>;
+/**
+ * One device session.
+ *
+ * @stability stable
+ */
+export type DeviceSession = z.infer<typeof deviceSessionSchema>;
+/**
+ * `GET /api/auth/device/sessions` response.
+ *
+ * @stability stable
+ */
+export type DeviceSessionsResponse = z.infer<typeof deviceSessionsResponseSchema>;
+/**
+ * `GET /api/admin/organizations` query, as parsed.
+ *
+ * @stability stable
+ */
+export type OrganizationListQuery = z.infer<typeof organizationListQuerySchema>;
+/**
+ * `POST /api/admin/organizations` body, as parsed.
+ *
+ * @stability stable
+ */
+export type CreateOrganizationRequest = z.infer<typeof createOrganizationSchema>;
+/**
+ * `PATCH /api/admin/organizations/:id` body.
+ *
+ * @stability stable
+ */
+export type RenameOrganizationRequest = z.infer<typeof renameOrganizationSchema>;
+/**
+ * One organization.
+ *
+ * @stability stable
+ */
+export type OrganizationResponse = z.infer<typeof organizationResponseSchema>;
+/**
+ * `GET /api/org/members` query, as parsed.
+ *
+ * @stability stable
+ */
+export type OrgMemberListQuery = z.infer<typeof orgMemberListQuerySchema>;
+/**
+ * `GET /api/roles` query, as parsed.
+ *
+ * @stability experimental
+ */
+export type RoleListQuery = z.infer<typeof roleListQuerySchema>;
+/**
+ * One role as `GET /api/roles` describes it.
+ *
+ * @stability experimental
+ */
+export type RoleDescriptor = z.infer<typeof roleDescriptorSchema>;
+/**
+ * `PATCH /api/org/members/:userId` body.
+ *
+ * @stability stable
+ */
+export type UpdateOrgMemberRequest = z.infer<typeof updateOrgMemberSchema>;
+/**
+ * One member of the active organization.
+ *
+ * @stability stable
+ */
+export type OrgMemberResponse = z.infer<typeof orgMemberResponseSchema>;
+/**
+ * `GET /api/org/invites` query, as parsed.
+ *
+ * @stability stable
+ */
+export type OrgInviteListQuery = z.infer<typeof orgInviteListQuerySchema>;
+/**
+ * `POST /api/org/invites` body, as parsed.
+ *
+ * @stability stable
+ */
+export type CreateOrgInviteRequest = z.infer<typeof createOrgInviteSchema>;
+/**
+ * One invitation of the active organization.
+ *
+ * @stability stable
+ */
+export type OrgInviteResponse = z.infer<typeof orgInviteResponseSchema>;
+//# sourceMappingURL=schemas.d.ts.map