@nvisy/sdk 0.44.0 → 0.46.0

package/dist/{index-Cv75Uuts.d.ts → index-uEHkixjD.d.ts}

@@ -117,7 +117,13 @@ interface paths {
         path?: never;
         cookie?: never;
       };
-      /** @description Request payload to update an account. */
+      /**
+       * @description Request payload to update an account's profile.
+       *
+       *     Credentials are not profile fields — a password and any linked providers are
+       *     managed through the account's identities (see the identity endpoints), never
+       *     here.
+       */
       requestBody: {
         content: {
           "application/json": components["schemas"]["UpdateAccount"];
@@ -468,7 +474,7 @@ interface paths {
     patch?: never;
     trace?: never;
   };
-  "/workspaces/": {
+  "/account/identities/": {
     parameters: {
       query?: never;
       header?: never;
@@ -476,45 +482,25 @@ interface paths {
       cookie?: never;
     };
     /**
-     * List workspaces
-     * @description Returns all workspaces the authenticated user is a member of.
+     * List sign-in methods
+     * @description Returns the authenticated account's identities: its password and any linked providers.
      */
     get: {
       parameters: {
-        query?: {
-          /**
-           * @description Cursor pointing to the last item of the previous page.
-           *     Obtain this from the `nextCursor` field in the response.
-           */
-          after?: string;
-          /**
-           * @description Whether to include the total item count in the response's `total` field.
-           *     Defaults to `false`, since counting is an extra query; set it to `true`
-           *     only when the count is actually needed.
-           */
-          includeCount?: boolean;
-          /** @description The maximum number of records to return (1-100, default: 20). */
-          limit?: number;
-        };
+        query?: never;
         header?: never;
         path?: never;
         cookie?: never;
       };
       requestBody?: never;
       responses: {
-        /**
-         * @description Generic paginated response wrapper.
-         *
-         *     Provides a consistent structure for all paginated API responses with
-         *     cursor-based pagination support. When `next_cursor` is present, there
-         *     are more items to fetch.
-         */
+        /** @description The account's sign-in methods. */
         200: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            "application/json": components["schemas"]["WorkspacePage"];
+            "application/json": components["schemas"]["AccountIdentities"];
           };
         };
         /**
@@ -535,11 +521,26 @@ interface paths {
       };
     };
     put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/account/identities/password/": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
     /**
-     * Create workspace
-     * @description Creates a new workspace. The creator is automatically added as an owner.
+     * Set or change password
+     * @description Sets or changes the account's password. Changing an existing password requires the current password; setting a first password on an account that has none requires a step-up re-authentication proof.
      */
-    post: {
+    put: {
       parameters: {
         query?: never;
         header?: never;
@@ -547,25 +548,27 @@ interface paths {
         cookie?: never;
       };
       /**
-       * @description Request payload for creating a new workspace.
+       * @description A password set or change.
        *
-       *     Creates a new workspace with the specified configuration. The creator is
-       *     automatically added as an owner of the workspace.
+       *     When the account already has a password, `current_password` is required and
+       *     verified before the change is applied, so a hijacked session or CSRF cannot
+       *     silently reset it (and lock out the real owner). When the account has no
+       *     password yet (an SSO-only account setting its first one), there is nothing to
+       *     re-authenticate against, so a fresh step-up `reauth_proof` is required instead
+       *     — a live session alone must not mint a durable new credential.
        */
       requestBody: {
         content: {
-          "application/json": components["schemas"]["CreateWorkspace"];
+          "application/json": components["schemas"]["SetPassword"];
         };
       };
       responses: {
-        /** @description Workspace response. */
-        201: {
+        /** @description Password set. */
+        204: {
           headers: {
             [name: string]: unknown;
           };
-          content: {
-            "application/json": components["schemas"]["Workspace"];
-          };
+          content?: never;
         };
         /**
          * @description HTTP error response representation with security-conscious design.
@@ -617,43 +620,26 @@ interface paths {
         };
       };
     };
-    delete?: never;
-    options?: never;
-    head?: never;
-    patch?: never;
-    trace?: never;
-  };
-  "/workspaces/{workspaceSlug}/": {
-    parameters: {
-      query?: never;
-      header?: never;
-      path?: never;
-      cookie?: never;
-    };
+    post?: never;
     /**
-     * Get workspace
-     * @description Returns details for a specific workspace.
+     * Remove password
+     * @description Removes the account's password, leaving it able to sign in only through its linked providers. Refused if the password is the account's only sign-in method.
      */
-    get: {
+    delete: {
       parameters: {
         query?: never;
         header?: never;
-        path: {
-          /** @description URL-safe workspace identifier. */
-          workspaceSlug: string;
-        };
+        path?: never;
         cookie?: never;
       };
       requestBody?: never;
       responses: {
-        /** @description Workspace response. */
-        200: {
+        /** @description Password removed. */
+        204: {
           headers: {
             [name: string]: unknown;
           };
-          content: {
-            "application/json": components["schemas"]["Workspace"];
-          };
+          content?: never;
         };
         /**
          * @description HTTP error response representation with security-conscious design.
@@ -677,7 +663,7 @@ interface paths {
          *     response, including the error name, message, HTTP status code, resource
          *     information, and user-friendly messages.
          */
-        403: {
+        404: {
           headers: {
             [name: string]: unknown;
           };
@@ -692,7 +678,7 @@ interface paths {
          *     response, including the error name, message, HTTP status code, resource
          *     information, and user-friendly messages.
          */
-        404: {
+        409: {
           headers: {
             [name: string]: unknown;
           };
@@ -702,30 +688,56 @@ interface paths {
         };
       };
     };
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/account/identities/{provider}/": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
     put?: never;
-    post?: never;
     /**
-     * Delete workspace
-     * @description Soft-deletes a workspace. Data is retained for potential recovery.
+     * Link a provider
+     * @description Begins linking the given OpenID Connect provider to the authenticated account and returns the provider authorize URL. Requires a step-up re-authentication proof (`reauthProof`, from the reauth endpoint). On consent, the callback attaches the verified provider identity to the caller's account.
      */
-    delete: {
+    post: {
       parameters: {
-        query?: never;
+        query?: {
+          /**
+           * @description A step-up re-authentication proof. Required to start a *link* (adding a
+           *     provider is a credential-adding action, so a live session alone is not
+           *     enough); ignored for sign-in and reauth.
+           */
+          reauthProof?: string;
+          /**
+           * @description Frontend URL to return to once done. Carried through the flow and used to
+           *     build the callback's redirect.
+           */
+          redirectUri?: string;
+        };
         header?: never;
         path: {
-          /** @description URL-safe workspace identifier. */
-          workspaceSlug: string;
+          /** @description The identity provider to act on. */
+          provider: components["schemas"]["IdentityProvider"];
         };
         cookie?: never;
       };
       requestBody?: never;
       responses: {
-        /** @description no content */
+        /** @description The response to a successful sign-in start: where to send the user. */
         200: {
           headers: {
             [name: string]: unknown;
           };
-          content?: never;
+          content: {
+            "application/json": components["schemas"]["OidcStartResponse"];
+          };
         };
         /**
          * @description HTTP error response representation with security-conscious design.
@@ -749,7 +761,7 @@ interface paths {
          *     response, including the error name, message, HTTP status code, resource
          *     information, and user-friendly messages.
          */
-        403: {
+        404: {
           headers: {
             [name: string]: unknown;
           };
@@ -764,7 +776,7 @@ interface paths {
          *     response, including the error name, message, HTTP status code, resource
          *     information, and user-friendly messages.
          */
-        404: {
+        503: {
           headers: {
             [name: string]: unknown;
           };
@@ -774,42 +786,28 @@ interface paths {
         };
       };
     };
-    options?: never;
-    head?: never;
     /**
-     * Update workspace
-     * @description Updates an existing workspace's configuration. Only provided fields are updated.
+     * Unlink a provider
+     * @description Removes a linked OIDC provider from the account. Refused if the provider is the account's only sign-in method.
      */
-    patch: {
+    delete: {
       parameters: {
         query?: never;
         header?: never;
         path: {
-          /** @description URL-safe workspace identifier. */
-          workspaceSlug: string;
+          /** @description The identity provider to act on. */
+          provider: components["schemas"]["IdentityProvider"];
         };
         cookie?: never;
       };
-      /**
-       * @description Request payload to update an existing workspace.
-       *
-       *     All fields are optional; only provided fields will be updated. The slug is
-       *     immutable and set at creation, so it cannot be changed here.
-       */
-      requestBody: {
-        content: {
-          "application/json": components["schemas"]["UpdateWorkspace"];
-        };
-      };
+      requestBody?: never;
       responses: {
-        /** @description Workspace response. */
-        200: {
+        /** @description Provider unlinked. */
+        204: {
           headers: {
             [name: string]: unknown;
           };
-          content: {
-            "application/json": components["schemas"]["Workspace"];
-          };
+          content?: never;
         };
         /**
          * @description HTTP error response representation with security-conscious design.
@@ -848,7 +846,7 @@ interface paths {
          *     response, including the error name, message, HTTP status code, resource
          *     information, and user-friendly messages.
          */
-        403: {
+        404: {
           headers: {
             [name: string]: unknown;
           };
@@ -856,77 +854,75 @@ interface paths {
             "application/json": components["schemas"]["ErrorResponse"];
           };
         };
-        /** @description Expected request with `Content-Type: application/json` */
-        415: {
-          headers: {
-            [name: string]: unknown;
-          };
-          content: {
-            "text/plain": string;
-          };
-        };
-        /** @description Failed to deserialize the JSON body into the target type */
-        422: {
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        409: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            "text/plain": string;
+            "application/json": components["schemas"]["ErrorResponse"];
           };
         };
       };
     };
+    options?: never;
+    head?: never;
+    patch?: never;
     trace?: never;
   };
-  "/workspaces/{workspaceSlug}/avatar/": {
+  "/workspaces/": {
     parameters: {
       query?: never;
       header?: never;
       path?: never;
       cookie?: never;
     };
-    get?: never;
     /**
-     * Upload workspace avatar
-     * @description Uploads and normalizes the workspace's avatar. Requires UpdateWorkspace.
+     * List workspaces
+     * @description Returns all workspaces the authenticated user is a member of.
      */
-    put: {
+    get: {
       parameters: {
-        query?: never;
-        header?: never;
-        path: {
-          /** @description URL-safe workspace identifier. */
-          workspaceSlug: string;
+        query?: {
+          /**
+           * @description Cursor pointing to the last item of the previous page.
+           *     Obtain this from the `nextCursor` field in the response.
+           */
+          after?: string;
+          /**
+           * @description Whether to include the total item count in the response's `total` field.
+           *     Defaults to `false`, since counting is an extra query; set it to `true`
+           *     only when the count is actually needed.
+           */
+          includeCount?: boolean;
+          /** @description The maximum number of records to return (1-100, default: 20). */
+          limit?: number;
         };
+        header?: never;
+        path?: never;
         cookie?: never;
       };
-      /** @description multipart form data */
-      requestBody: {
-        content: {
-          "multipart/form-data": unknown[];
-        };
-      };
+      requestBody?: never;
       responses: {
-        /** @description no content */
-        200: {
-          headers: {
-            [name: string]: unknown;
-          };
-          content?: never;
-        };
         /**
-         * @description HTTP error response representation with security-conscious design.
+         * @description Generic paginated response wrapper.
          *
-         *     This struct contains all the information needed to serialize an error
-         *     response, including the error name, message, HTTP status code, resource
-         *     information, and user-friendly messages.
+         *     Provides a consistent structure for all paginated API responses with
+         *     cursor-based pagination support. When `next_cursor` is present, there
+         *     are more items to fetch.
          */
-        400: {
+        200: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            "application/json": components["schemas"]["ErrorResponse"];
+            "application/json": components["schemas"]["WorkspacePage"];
           };
         };
         /**
@@ -944,26 +940,438 @@ interface paths {
             "application/json": components["schemas"]["ErrorResponse"];
           };
         };
-        /**
-         * @description HTTP error response representation with security-conscious design.
-         *
-         *     This struct contains all the information needed to serialize an error
-         *     response, including the error name, message, HTTP status code, resource
-         *     information, and user-friendly messages.
-         */
-        403: {
-          headers: {
-            [name: string]: unknown;
-          };
-          content: {
-            "application/json": components["schemas"]["ErrorResponse"];
-          };
-        };
-        /**
-         * @description HTTP error response representation with security-conscious design.
-         *
-         *     This struct contains all the information needed to serialize an error
-         *     response, including the error name, message, HTTP status code, resource
+      };
+    };
+    put?: never;
+    /**
+     * Create workspace
+     * @description Creates a new workspace. The creator is automatically added as an owner.
+     */
+    post: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path?: never;
+        cookie?: never;
+      };
+      /**
+       * @description Request payload for creating a new workspace.
+       *
+       *     Creates a new workspace with the specified configuration. The creator is
+       *     automatically added as an owner of the workspace.
+       */
+      requestBody: {
+        content: {
+          "application/json": components["schemas"]["CreateWorkspace"];
+        };
+      };
+      responses: {
+        /** @description Workspace response. */
+        201: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["Workspace"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        400: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /** @description Expected request with `Content-Type: application/json` */
+        415: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "text/plain": string;
+          };
+        };
+        /** @description Failed to deserialize the JSON body into the target type */
+        422: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "text/plain": string;
+          };
+        };
+      };
+    };
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/workspaces/{workspaceSlug}/": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Get workspace
+     * @description Returns details for a specific workspace.
+     */
+    get: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          /** @description URL-safe workspace identifier. */
+          workspaceSlug: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Workspace response. */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["Workspace"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+      };
+    };
+    put?: never;
+    post?: never;
+    /**
+     * Delete workspace
+     * @description Soft-deletes a workspace. Data is retained for potential recovery.
+     */
+    delete: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          /** @description URL-safe workspace identifier. */
+          workspaceSlug: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description no content */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+      };
+    };
+    options?: never;
+    head?: never;
+    /**
+     * Update workspace
+     * @description Updates an existing workspace's configuration. Only provided fields are updated.
+     */
+    patch: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          /** @description URL-safe workspace identifier. */
+          workspaceSlug: string;
+        };
+        cookie?: never;
+      };
+      /**
+       * @description Request payload to update an existing workspace.
+       *
+       *     All fields are optional; only provided fields will be updated. The slug is
+       *     immutable and set at creation, so it cannot be changed here.
+       */
+      requestBody: {
+        content: {
+          "application/json": components["schemas"]["UpdateWorkspace"];
+        };
+      };
+      responses: {
+        /** @description Workspace response. */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["Workspace"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        400: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /** @description Expected request with `Content-Type: application/json` */
+        415: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "text/plain": string;
+          };
+        };
+        /** @description Failed to deserialize the JSON body into the target type */
+        422: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "text/plain": string;
+          };
+        };
+      };
+    };
+    trace?: never;
+  };
+  "/workspaces/{workspaceSlug}/avatar/": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    /**
+     * Upload workspace avatar
+     * @description Uploads and normalizes the workspace's avatar. Requires UpdateWorkspace.
+     */
+    put: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          /** @description URL-safe workspace identifier. */
+          workspaceSlug: string;
+        };
+        cookie?: never;
+      };
+      /** @description multipart form data */
+      requestBody: {
+        content: {
+          "multipart/form-data": unknown[];
+        };
+      };
+      responses: {
+        /** @description no content */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        400: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
          *     information, and user-friendly messages.
          */
         404: {
@@ -2638,13 +3046,124 @@ interface paths {
       };
       requestBody?: never;
       responses: {
-        /** @description Result of a connection reachability check. */
+        /** @description Result of a connection reachability check. */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ConnectionVerification"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+      };
+    };
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/workspaces/{workspaceSlug}/connections/{connectionId}/picker-token/": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Mint picker token
+     * @description Returns a short-lived provider access token for a browser file picker (file services with a token-based picker only). The refresh token is never returned.
+     */
+    post: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          /** @description URL-safe workspace identifier. */
+          workspaceSlug: string;
+          /** @description Opaque identifier of the connection. */
+          connectionId: components["schemas"]["ConnectionId"];
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /**
+         * @description A short-lived provider OAuth access token for a browser file picker.
+         *
+         *     Carries only the access token and its expiry — never the refresh token, which
+         *     stays server-side. The token is minted from the connection's stored
+         *     credentials and is short-lived (the provider's access-token lifetime), so the
+         *     browser holds a narrow, expiring credential rather than a durable one.
+         */
         200: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            "application/json": components["schemas"]["ConnectionVerification"];
+            "application/json": components["schemas"]["PickerToken"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        400: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
           };
         };
         /**
@@ -3217,7 +3736,244 @@ interface paths {
          *     response, including the error name, message, HTTP status code, resource
          *     information, and user-friendly messages.
          */
-        403: {
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        409: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /** @description Expected request with `Content-Type: application/json` */
+        415: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "text/plain": string;
+          };
+        };
+        /** @description Failed to deserialize the JSON body into the target type */
+        422: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "text/plain": string;
+          };
+        };
+      };
+    };
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/workspaces/{workspaceSlug}/syncs/": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List workspace syncs
+     * @description Returns all sync runs across the workspace's connections, most recent first, with optional status and provider filters.
+     */
+    get: {
+      parameters: {
+        query?: {
+          /**
+           * @description Cursor pointing to the last item of the previous page.
+           *     Obtain this from the `nextCursor` field in the response.
+           */
+          after?: string;
+          /**
+           * @description Whether to include the total item count in the response's `total` field.
+           *     Defaults to `false`, since counting is an extra query; set it to `true`
+           *     only when the count is actually needed.
+           */
+          includeCount?: boolean;
+          /** @description The maximum number of records to return (1-100, default: 20). */
+          limit?: number;
+          /**
+           * @description Filter by connection provider (`s3`, `azure`, `gcs`). Repeatable; a sync
+           *     matches if its connection uses any of the given providers. Empty means no
+           *     provider filter.
+           */
+          provider?: string[];
+          /** @description Filter by sync status. */
+          status?: components["schemas"]["SyncStatus"];
+        };
+        header?: never;
+        path: {
+          /** @description URL-safe workspace identifier. */
+          workspaceSlug: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /**
+         * @description Generic paginated response wrapper.
+         *
+         *     Provides a consistent structure for all paginated API responses with
+         *     cursor-based pagination support. When `next_cursor` is present, there
+         *     are more items to fetch.
+         */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ConnectionSyncPage"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+      };
+    };
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/workspaces/{workspaceSlug}/connections/{connectionId}/sync/": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Sync connection
+     * @description Runs the object-store connection's configured direction: imports every new object, or exports every redacted output not yet exported. File services use the picker import and per-file export instead. Returns the created sync; poll it for completion.
+     */
+    post: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          /** @description URL-safe workspace identifier. */
+          workspaceSlug: string;
+          /** @description Opaque identifier of the connection. */
+          connectionId: components["schemas"]["ConnectionId"];
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description A connection sync (import or export). */
+        202: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ConnectionSync"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        400: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        401: {
           headers: {
             [name: string]: unknown;
           };
@@ -3232,7 +3988,7 @@ interface paths {
          *     response, including the error name, message, HTTP status code, resource
          *     information, and user-friendly messages.
          */
-        404: {
+        403: {
           headers: {
             [name: string]: unknown;
           };
@@ -3247,7 +4003,7 @@ interface paths {
          *     response, including the error name, message, HTTP status code, resource
          *     information, and user-friendly messages.
          */
-        409: {
+        404: {
           headers: {
             [name: string]: unknown;
           };
@@ -3255,24 +4011,6 @@ interface paths {
             "application/json": components["schemas"]["ErrorResponse"];
           };
         };
-        /** @description Expected request with `Content-Type: application/json` */
-        415: {
-          headers: {
-            [name: string]: unknown;
-          };
-          content: {
-            "text/plain": string;
-          };
-        };
-        /** @description Failed to deserialize the JSON body into the target type */
-        422: {
-          headers: {
-            [name: string]: unknown;
-          };
-          content: {
-            "text/plain": string;
-          };
-        };
       };
     };
     delete?: never;
@@ -3281,64 +4019,63 @@ interface paths {
     patch?: never;
     trace?: never;
   };
-  "/workspaces/{workspaceSlug}/syncs/": {
+  "/workspaces/{workspaceSlug}/connections/{connectionId}/import/": {
     parameters: {
       query?: never;
       header?: never;
       path?: never;
       cookie?: never;
     };
+    get?: never;
+    put?: never;
     /**
-     * List workspace syncs
-     * @description Returns all sync runs across the workspace's connections, most recent first, with optional status and provider filters.
+     * Import selected files
+     * @description Imports the files selected in the provider's picker (file services only). Already-imported files are skipped. Returns the created sync; poll it for completion.
      */
-    get: {
+    post: {
       parameters: {
-        query?: {
-          /**
-           * @description Cursor pointing to the last item of the previous page.
-           *     Obtain this from the `nextCursor` field in the response.
-           */
-          after?: string;
-          /**
-           * @description Whether to include the total item count in the response's `total` field.
-           *     Defaults to `false`, since counting is an extra query; set it to `true`
-           *     only when the count is actually needed.
-           */
-          includeCount?: boolean;
-          /** @description The maximum number of records to return (1-100, default: 20). */
-          limit?: number;
-          /**
-           * @description Filter by connection provider (`s3`, `azure`, `gcs`). Repeatable; a sync
-           *     matches if its connection uses any of the given providers. Empty means no
-           *     provider filter.
-           */
-          provider?: string[];
-          /** @description Filter by sync status. */
-          status?: components["schemas"]["SyncStatus"];
-        };
+        query?: never;
         header?: never;
         path: {
           /** @description URL-safe workspace identifier. */
           workspaceSlug: string;
+          /** @description Opaque identifier of the connection. */
+          connectionId: components["schemas"]["ConnectionId"];
         };
         cookie?: never;
       };
-      requestBody?: never;
+      /**
+       * @description Request payload to import a caller-selected set of files from a file-service
+       *     connection (the provider picker returns id + name per file).
+       */
+      requestBody: {
+        content: {
+          "application/json": components["schemas"]["ImportFiles"];
+        };
+      };
       responses: {
+        /** @description A connection sync (import or export). */
+        202: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ConnectionSync"];
+          };
+        };
         /**
-         * @description Generic paginated response wrapper.
+         * @description HTTP error response representation with security-conscious design.
          *
-         *     Provides a consistent structure for all paginated API responses with
-         *     cursor-based pagination support. When `next_cursor` is present, there
-         *     are more items to fetch.
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
          */
-        200: {
+        400: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            "application/json": components["schemas"]["ConnectionSyncPage"];
+            "application/json": components["schemas"]["ErrorResponse"];
           };
         };
         /**
@@ -3386,17 +4123,48 @@ interface paths {
             "application/json": components["schemas"]["ErrorResponse"];
           };
         };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        409: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /** @description Expected request with `Content-Type: application/json` */
+        415: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "text/plain": string;
+          };
+        };
+        /** @description Failed to deserialize the JSON body into the target type */
+        422: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "text/plain": string;
+          };
+        };
       };
     };
-    put?: never;
-    post?: never;
     delete?: never;
     options?: never;
     head?: never;
     patch?: never;
     trace?: never;
   };
-  "/workspaces/{workspaceSlug}/connections/{connectionId}/sync/": {
+  "/workspaces/{workspaceSlug}/connections/{connectionId}/export/": {
     parameters: {
       query?: never;
       header?: never;
@@ -3406,8 +4174,8 @@ interface paths {
     get?: never;
     put?: never;
     /**
-     * Sync connection
-     * @description Imports an object from or exports a file to the connection. Returns the created sync; poll it for completion.
+     * Export files to connection
+     * @description Exports the selected workspace files to the connection, each as a new provider file. Returns the created sync; poll it for completion.
      */
     post: {
       parameters: {
@@ -3422,17 +4190,13 @@ interface paths {
         cookie?: never;
       };
       /**
-       * @description Request payload to trigger a connection sync.
-       *
-       *     The direction is determined by the connection's configured `sync_mode`.
-       *     - Import connections need no body: the sync fetches every not-yet-imported
-       *       object under the connection's root path.
-       *     - Export connections push one workspace file (`file_id`) to one object
-       *       `key`; both are required for export and ignored for import.
+       * @description Request payload to export a caller-selected set of workspace files to a
+       *     connection. Each is written as a new provider file, never overwriting a
+       *     source. Mirrors [`ImportFiles`] on the export side.
        */
       requestBody: {
         content: {
-          "application/json": components["schemas"]["SyncConnection"];
+          "application/json": components["schemas"]["ExportFiles"];
         };
       };
       responses: {
@@ -3505,6 +4269,21 @@ interface paths {
             "application/json": components["schemas"]["ErrorResponse"];
           };
         };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        409: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
         /** @description Expected request with `Content-Type: application/json` */
         415: {
           headers: {
@@ -8854,36 +9633,151 @@ interface paths {
         query?: never;
         header?: never;
         path: {
-          /** @description URL-safe workspace identifier. */
-          workspaceSlug: string;
-          /** @description Opaque identifier of the webhook. */
-          webhookId: components["schemas"]["WebhookId"];
+          /** @description URL-safe workspace identifier. */
+          workspaceSlug: string;
+          /** @description Opaque identifier of the webhook. */
+          webhookId: components["schemas"]["WebhookId"];
+        };
+        cookie?: never;
+      };
+      /** @description Request payload for testing a webhook. */
+      requestBody: {
+        content: {
+          "application/json": components["schemas"]["TestWebhook"];
+        };
+      };
+      responses: {
+        /** @description Result of a webhook delivery attempt. */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["WebhookResult"];
+          };
+        };
+        /** @description Failed to parse the request body as JSON */
+        400: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "text/plain": string;
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /** @description Expected request with `Content-Type: application/json` */
+        415: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "text/plain": string;
+          };
+        };
+        /** @description Failed to deserialize the JSON body into the target type */
+        422: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "text/plain": string;
+          };
+        };
+      };
+    };
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/auth/{provider}/reauth/": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Start OIDC step-up re-authentication
+     * @description Begins a step-up re-authentication with a provider already linked to the authenticated account, and returns the provider authorize URL. On consent, the callback mints a short-lived, single-use proof required to add a credential (set a first password, or link a new provider).
+     */
+    get: {
+      parameters: {
+        query?: {
+          /**
+           * @description A step-up re-authentication proof. Required to start a *link* (adding a
+           *     provider is a credential-adding action, so a live session alone is not
+           *     enough); ignored for sign-in and reauth.
+           */
+          reauthProof?: string;
+          /**
+           * @description Frontend URL to return to once done. Carried through the flow and used to
+           *     build the callback's redirect.
+           */
+          redirectUri?: string;
+        };
+        header?: never;
+        path: {
+          /** @description The identity provider to act on. */
+          provider: components["schemas"]["IdentityProvider"];
         };
         cookie?: never;
       };
-      /** @description Request payload for testing a webhook. */
-      requestBody: {
-        content: {
-          "application/json": components["schemas"]["TestWebhook"];
-        };
-      };
+      requestBody?: never;
       responses: {
-        /** @description Result of a webhook delivery attempt. */
+        /** @description The response to a successful sign-in start: where to send the user. */
         200: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            "application/json": components["schemas"]["WebhookResult"];
-          };
-        };
-        /** @description Failed to parse the request body as JSON */
-        400: {
-          headers: {
-            [name: string]: unknown;
-          };
-          content: {
-            "text/plain": string;
+            "application/json": components["schemas"]["OidcStartResponse"];
           };
         };
         /**
@@ -8908,7 +9802,7 @@ interface paths {
          *     response, including the error name, message, HTTP status code, resource
          *     information, and user-friendly messages.
          */
-        403: {
+        404: {
           headers: {
             [name: string]: unknown;
           };
@@ -8923,7 +9817,7 @@ interface paths {
          *     response, including the error name, message, HTTP status code, resource
          *     information, and user-friendly messages.
          */
-        404: {
+        503: {
           headers: {
             [name: string]: unknown;
           };
@@ -8931,26 +9825,10 @@ interface paths {
             "application/json": components["schemas"]["ErrorResponse"];
           };
         };
-        /** @description Expected request with `Content-Type: application/json` */
-        415: {
-          headers: {
-            [name: string]: unknown;
-          };
-          content: {
-            "text/plain": string;
-          };
-        };
-        /** @description Failed to deserialize the JSON body into the target type */
-        422: {
-          headers: {
-            [name: string]: unknown;
-          };
-          content: {
-            "text/plain": string;
-          };
-        };
       };
     };
+    put?: never;
+    post?: never;
     delete?: never;
     options?: never;
     head?: never;
@@ -9193,6 +10071,90 @@ interface paths {
     patch?: never;
     trace?: never;
   };
+  "/auth/{provider}/start/": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Start OIDC sign-in
+     * @description Begins an OpenID Connect sign-in with the given provider and returns the provider authorize URL to redirect the user to. On consent, the provider redirects to the callback, which signs the user in.
+     */
+    get: {
+      parameters: {
+        query?: {
+          /**
+           * @description A step-up re-authentication proof. Required to start a *link* (adding a
+           *     provider is a credential-adding action, so a live session alone is not
+           *     enough); ignored for sign-in and reauth.
+           */
+          reauthProof?: string;
+          /**
+           * @description Frontend URL to return to once done. Carried through the flow and used to
+           *     build the callback's redirect.
+           */
+          redirectUri?: string;
+        };
+        header?: never;
+        path: {
+          /** @description The identity provider to act on. */
+          provider: components["schemas"]["IdentityProvider"];
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description The response to a successful sign-in start: where to send the user. */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["OidcStartResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        503: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+      };
+    };
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   "/health/": {
     parameters: {
       query?: never;
@@ -9374,6 +10336,33 @@ interface components {
       /** @description Public handle of the account. */
       username: components["schemas"]["Handle"];
     };
+    /** @description The account's sign-in methods. */
+    AccountIdentities: {
+      /** @description Every identity the account can sign in with. */
+      identities: components["schemas"]["AccountIdentity"][];
+    };
+    /**
+     * @description One of an account's sign-in methods, for the identities listing.
+     *
+     *     Never exposes the credential itself (a password hash or a provider subject),
+     *     only which methods exist and metadata about them.
+     */
+    AccountIdentity: {
+      /**
+       * Format: date-time
+       * @description When the identity was created (the password set, or the provider linked).
+       */
+      createdAt: string;
+      /** @description The authentication method: `password` or an OIDC provider. */
+      provider: components["schemas"]["IdentityProvider"];
+      /** @description The email the provider asserted at link time, for a linked provider. */
+      providerEmail?: string;
+      /**
+       * Format: date-time
+       * @description When the identity was last updated.
+       */
+      updatedAt: string;
+    };
     /**
      * @description Path parameters for account operations.
      *
@@ -9619,11 +10608,6 @@ interface components {
      *     audit trail and activity tracking.
      */
     ActivityType: "workspace.created" | "workspace.updated" | "workspace.deleted" | "member.added" | "member.updated" | "member.deleted" | "invite.created" | "invite.accepted" | "invite.declined" | "invite.canceled" | "connection.created" | "connection.updated" | "connection.deleted" | "connection.sync.started" | "connection.sync.completed" | "connection.sync.failed" | "webhook.created" | "webhook.updated" | "webhook.deleted" | "file.created" | "file.updated" | "file.deleted" | "pipeline.created" | "pipeline.updated" | "pipeline.deleted" | "pipeline.detection.started" | "pipeline.detection.completed" | "pipeline.detection.failed" | "pipeline.redaction.created" | "policy.created" | "policy.updated" | "policy.deleted";
-    /** @description Anthropic API credentials. */
-    AnthropicCredentials: {
-      /** @description Anthropic API key. */
-      apiKey: string;
-    };
     /** @description API token response structure. */
     ApiToken: {
       /**
@@ -9789,15 +10773,20 @@ interface components {
        *     `word/document.xml` text belongs to the document part
        *     itself, not to a nested one.
        *
-       *     For text specifically, a caller holding raw file bytes
-       *     rather than a decoded offset — a reviewer selecting rendered
-       *     text, say — leaves [`TextLocation::range`] empty and fills
-       *     [`TextLocation::source`] instead, which the engine
-       *     reverse-resolves. The other three have no such alternative:
-       *     their coordinates are the only way in.
+       *     Text carries either coordinate kind of [`TextCoord`]: a
+       *     [`Decoded`] span for a caller with an offset into the
+       *     decoded stream, or a [`Source`] one for a caller holding
+       *     only raw file bytes — a reviewer selecting rendered text,
+       *     say — which the engine reverse-resolves. Source-only is its
+       *     own kind rather than a decoded span left empty, so such a
+       *     selection is representable as itself.
        *
-       *     [`TextLocation::range`]: elide::modality::text::TextLocation::range
-       *     [`TextLocation::source`]: elide::modality::text::TextLocation::source
+       *     The other three media have no such alternative: their
+       *     coordinates are the only way in.
+       *
+       *     [`TextCoord`]: elide::modality::text::TextCoord
+       *     [`Decoded`]: elide::modality::text::TextCoord::Decoded
+       *     [`Source`]: elide::modality::text::TextCoord::Source
        */
       location: components["schemas"]["AudioLocation"];
       /**
@@ -9809,9 +10798,9 @@ interface components {
        *
        *     Nested media needs this: the report holds an embedded image
        *     as its own part, and an addition to one has nowhere to go
-       *     without naming it. Text usually does not — where a span came
-       *     from is already in `TextLocation::source`, which carries the
-       *     part alongside the raw range.
+       *     without naming it. Text usually does not — a source
+       *     reference already names the part it came from, alongside the
+       *     raw range.
        *
        *     `None` is an error when the request carried several
        *     documents, since there is then no sole document to mean.
@@ -10393,6 +11382,20 @@ interface components {
       /** @description Handle of the authenticated account. */
       username: components["schemas"]["Handle"];
     };
+    /**
+     * @description Configuration for a provider reached with an API key (OpenAI, Anthropic).
+     *
+     *     The `api_key` is masked in [`Debug`], so neither this struct nor any config
+     *     that embeds it leaks the key.
+     */
+    AuthenticatedProvider: {
+      /** @description The provider API key. */
+      apiKey: string;
+      /** @description Override the API base URL (for a compatible endpoint or a proxy). Optional. */
+      baseUrl?: string;
+      /** @description Default model to use when a request does not specify one. Optional. */
+      defaultModel?: string;
+    };
     /**
      * @description Path parameters for a public avatar route: the owner id and the avatar's
      *     content-hash version.
@@ -11111,6 +12114,48 @@ interface components {
        */
       limit?: number;
     };
+    /**
+     * @description How to detect one caller-authored label.
+     *
+     *     Names a label the same policy declares in [`custom`]. A matcher
+     *     for a shipped built-in is rejected: elide already detects those,
+     *     and two definitions for one label would race in reconciliation.
+     *
+     *     [`custom`]: super::PolicyDefinition::custom
+     */
+    CustomMatcher: {
+      /**
+       * Format: float
+       * @description Score stamped on every match. Defaults to `0.6`.
+       *
+       *     Reconciliation keeps the higher-confidence entity when two
+       *     detections overlap, so this is what decides whether a
+       *     custom match beats a built-in one covering the same span.
+       * @default 0.6000000238418579
+       */
+      confidence?: number;
+      /**
+       * @description The label this detects, which the policy must declare in
+       *     [`custom`](super::PolicyDefinition::custom).
+       */
+      label: components["schemas"]["LabelRef"];
+      /**
+       * @description Human-readable name, recorded in the audit as the
+       *     recognizer that found the entity, so a trail distinguishes
+       *     a caller's matcher from a shipped pattern.
+       */
+      name: string;
+    } & ({
+      /** @constant */
+      kind: "pattern";
+      /** @description The expression, in `regex` crate syntax. */
+      pattern: string;
+    } | {
+      /** @constant */
+      kind: "terms";
+      /** @description The literals to scan for. */
+      terms: string[];
+    });
     /**
      * @description The coarseness a [`GeneralizeDate`] reduces a date/timestamp to.
      *
@@ -11555,6 +12600,18 @@ interface components {
       /** @description Validation error details for field-specific errors */
       validation?: components["schemas"]["ValidationErrorDetail"][];
     };
+    /**
+     * @description Request payload to export a caller-selected set of workspace files to a
+     *     connection. Each is written as a new provider file, never overwriting a
+     *     source. Mirrors [`ImportFiles`] on the export side.
+     */
+    ExportFiles: {
+      /**
+       * @description The workspace files to export, by id. Files already exported to the
+       *     connection are exported again (a fresh copy).
+       */
+      fileIds: string[];
+    };
     /** @description The file format an export is rendered as. */
     ExportFormat: "csv" | "json";
     /**
@@ -11677,7 +12734,10 @@ interface components {
     FileServiceConfig: {
       /** @description Which provider backs this connection. */
       provider: components["schemas"]["Provider"];
-      /** @description The folder (id or path) to scope the sync to; `None` uses the root. */
+      /**
+       * @description The folder (id or path) new exports are written into; `None` uses the
+       *     account root.
+       */
       root?: string;
       /** @description The OAuth token set for this connection. */
       tokens: components["schemas"]["OAuthTokens"];
@@ -11827,6 +12887,26 @@ interface components {
      *       as de-identified.
      */
     HipaaDeidMethod: "safe_harbor" | "limited_data_set" | "expert_determination";
+    /**
+     * @description Path parameters for a provider-scoped identity operation: signing in with,
+     *     re-authenticating with, linking, or unlinking a provider. Named identically to
+     *     the stored [`IdentityProvider`], so the API and the account's identities name
+     *     each provider the same way.
+     */
+    IdentityPathParams: {
+      /** @description The identity provider to act on. */
+      provider: components["schemas"]["IdentityProvider"];
+    };
+    /**
+     * @description How an account authenticates.
+     *
+     *     Corresponds to the `IDENTITY_PROVIDER` PostgreSQL enum. [`Password`] is a
+     *     locally-held Argon2 secret; the rest are external OIDC providers keyed by the
+     *     provider's subject claim.
+     *
+     *     [`Password`]: Self::Password
+     */
+    IdentityProvider: "password" | "google" | "microsoft";
     /**
      * @description A detection recognition missed.
      *
@@ -11853,15 +12933,20 @@ interface components {
        *     `word/document.xml` text belongs to the document part
        *     itself, not to a nested one.
        *
-       *     For text specifically, a caller holding raw file bytes
-       *     rather than a decoded offset — a reviewer selecting rendered
-       *     text, say — leaves [`TextLocation::range`] empty and fills
-       *     [`TextLocation::source`] instead, which the engine
-       *     reverse-resolves. The other three have no such alternative:
-       *     their coordinates are the only way in.
+       *     Text carries either coordinate kind of [`TextCoord`]: a
+       *     [`Decoded`] span for a caller with an offset into the
+       *     decoded stream, or a [`Source`] one for a caller holding
+       *     only raw file bytes — a reviewer selecting rendered text,
+       *     say — which the engine reverse-resolves. Source-only is its
+       *     own kind rather than a decoded span left empty, so such a
+       *     selection is representable as itself.
        *
-       *     [`TextLocation::range`]: elide::modality::text::TextLocation::range
-       *     [`TextLocation::source`]: elide::modality::text::TextLocation::source
+       *     The other three media have no such alternative: their
+       *     coordinates are the only way in.
+       *
+       *     [`TextCoord`]: elide::modality::text::TextCoord
+       *     [`Decoded`]: elide::modality::text::TextCoord::Decoded
+       *     [`Source`]: elide::modality::text::TextCoord::Source
        */
       location: components["schemas"]["ImageLocation"];
       /**
@@ -11873,9 +12958,9 @@ interface components {
        *
        *     Nested media needs this: the report holds an embedded image
        *     as its own part, and an addition to one has nowhere to go
-       *     without naming it. Text usually does not — where a span came
-       *     from is already in `TextLocation::source`, which carries the
-       *     part alongside the raw range.
+       *     without naming it. Text usually does not — a source
+       *     reference already names the part it came from, alongside the
+       *     raw range.
        *
        *     `None` is an error when the request carried several
        *     documents, since there is then no sole document to mean.
@@ -12354,6 +13439,14 @@ interface components {
       /** @description The rationale, when one was given. */
       reason?: string;
     };
+    /**
+     * @description Request payload to import a caller-selected set of files from a file-service
+     *     connection (the provider picker returns id + name per file).
+     */
+    ImportFiles: {
+      /** @description The files to import. Already-imported files are skipped. */
+      files: components["schemas"]["PickedFile"][];
+    };
     /**
      * @description Workspace invite with complete information.
      *
@@ -12828,36 +13921,21 @@ interface components {
      * @description A fully-typed LLM inference connection configuration.
      *
      *     The `provider` tag selects the variant and thereby the credential shape, so
-     *     an OpenAI connection cannot carry Anthropic credentials. Serialization exists
-     *     only to persist the config encrypted at rest, never to return it in API
-     *     responses.
+     *     an OpenAI connection cannot carry Anthropic credentials. The key-bearing
+     *     variants hold an [`AuthenticatedProvider`], which masks the key in `Debug`;
+     *     serialization exists only to persist the config encrypted at rest, never to
+     *     return it in API responses.
      */
-    LlmConfig: {
-      /** @description Override the API base URL (for Azure OpenAI or a proxy). Optional. */
-      baseUrl?: string;
-      /** @description OpenAI credentials. */
-      credentials: components["schemas"]["OpenAiCredentials"];
-      /** @description Default model to use when a request does not specify one. Optional. */
-      defaultModel?: string;
+    LlmConfig: ({
       /** @constant */
       provider: "openai";
-    } | {
-      /** @description Base URL of the Ollama server (e.g. `http://localhost:11434`). */
-      baseUrl: string;
-      /** @description Default model to use when a request does not specify one. Optional. */
-      defaultModel?: string;
+    } & components["schemas"]["AuthenticatedProvider"]) | ({
       /** @constant */
       provider: "ollama";
-    } | {
-      /** @description Override the API base URL. Optional. */
-      baseUrl?: string;
-      /** @description Anthropic credentials. */
-      credentials: components["schemas"]["AnthropicCredentials"];
-      /** @description Default model to use when a request does not specify one. Optional. */
-      defaultModel?: string;
+    } & components["schemas"]["UnauthenticatedProvider"]) | ({
       /** @constant */
       provider: "anthropic";
-    };
+    } & components["schemas"]["AuthenticatedProvider"]);
     /**
      * @description A value localized per [`LanguageTag`], with an English-first fallback.
      *
@@ -13174,7 +14252,8 @@ interface components {
     };
     /**
      * @description A persisted OAuth token set. Stored encrypted with the rest of a
-     *     connection's config; never returned in API responses.
+     *     connection's config; never returned in API responses. The tokens are masked
+     *     in [`Debug`] so a connection config's derived `Debug` cannot leak them.
      */
     OAuthTokens: {
       /** @description The current access token, sent as a bearer credential. */
@@ -13190,10 +14269,24 @@ interface components {
        */
       refresh_token?: string;
     };
-    /** @description OpenAI API credentials. */
-    OpenAiCredentials: {
-      /** @description OpenAI API key. */
-      apiKey: string;
+    /** @description Optional query parameters for starting a sign-in, link, or reauth. */
+    OidcStartQuery: {
+      /**
+       * @description A step-up re-authentication proof. Required to start a *link* (adding a
+       *     provider is a credential-adding action, so a live session alone is not
+       *     enough); ignored for sign-in and reauth.
+       */
+      reauthProof?: string;
+      /**
+       * @description Frontend URL to return to once done. Carried through the flow and used to
+       *     build the callback's redirect.
+       */
+      redirectUri?: string;
+    };
+    /** @description The response to a successful sign-in start: where to send the user. */
+    OidcStartResponse: {
+      /** @description The provider authorize URL the client should redirect the user to. */
+      authorizeUrl: string;
     };
     /**
      * @description Identifies a redaction operator, for the redaction audit a higher
@@ -13211,20 +14304,6 @@ interface components {
       /** @description Operator's version at the time it was applied. */
       version: string;
     };
-    /**
-     * @description A re-authenticated password change: the new password plus the current one
-     *     that authorizes it.
-     *
-     *     Coupling the two in one struct makes the invariant explicit — a password
-     *     change always carries the current password, so a hijacked session or CSRF
-     *     cannot silently reset it (and lock out the real owner).
-     */
-    PasswordChange: {
-      /** @description The account's current password, verified before the change is applied. */
-      currentPassword: string;
-      /** @description The new password (will be hashed before storage). */
-      newPassword: string;
-    };
     /** @description Metadata of a pattern/dictionary recognition, carried by [`Pattern`]. */
     PatternEvent: {
       /**
@@ -13287,6 +14366,31 @@ interface components {
      *     [`Engine::with_key_provider`]: https://docs.rs/elide-pipeline/latest/elide_pipeline/struct.Engine.html
      */
     PciPanRender: "truncate" | "truncate_last_four" | "hmac_sha256" | "hmac_sha512";
+    /** @description One file the user selected in the provider's picker. */
+    PickedFile: {
+      /** @description The provider's file identifier (used to fetch the bytes). */
+      id: string;
+      /** @description The file's display name, as the picker reported it. */
+      name: string;
+    };
+    /**
+     * @description A short-lived provider OAuth access token for a browser file picker.
+     *
+     *     Carries only the access token and its expiry — never the refresh token, which
+     *     stays server-side. The token is minted from the connection's stored
+     *     credentials and is short-lived (the provider's access-token lifetime), so the
+     *     browser holds a narrow, expiring credential rather than a durable one.
+     */
+    PickerToken: {
+      /** @description The provider OAuth access token to hand to the browser picker. */
+      accessToken: string;
+      /**
+       * Format: int64
+       * @description Unix seconds at which the access token expires, if the provider reports
+       *     it. `None` means the provider did not return an expiry.
+       */
+      expiresAt?: number;
+    };
     /** @description Pipeline response. */
     Pipeline: {
       /**
@@ -13534,6 +14638,21 @@ interface components {
        *     customer-supplied so re-submissions carry the same id.
        */
       id: string;
+      /**
+       * @description How to detect the labels [`custom`] introduces.
+       *
+       *     A custom label declares vocabulary and nothing more, so
+       *     without a matcher it is scoped, targeted by rules, and never
+       *     found. Each matcher names a label this policy declares;
+       *     naming a shipped built-in is rejected, since elide already
+       *     detects those.
+       *
+       *     Compiled per request, so a policy declaring none costs
+       *     nothing.
+       *
+       *     [`custom`]: Self::custom
+       */
+      matchers?: components["schemas"]["CustomMatcher"][];
       /**
        * @description Human-readable name. Display-only. Does not key anything.
        *
@@ -13593,6 +14712,11 @@ interface components {
       description?: string;
       /** @description Per-policy catch-all, fired when no rule matched. */
       fallback?: components["schemas"]["ModalityRedactions"];
+      /**
+       * @description How to detect the custom labels this policy introduces. A custom label
+       *     without a matcher is declared but never found.
+       */
+      matchers?: components["schemas"]["CustomMatcher"][];
       /** @description Human-readable name. Display-only. */
       name: string;
       /** @description Ordered rules. First match wins within this policy. */
@@ -14367,6 +15491,32 @@ interface components {
        */
       parentId?: string;
     };
+    /**
+     * @description A password set or change.
+     *
+     *     When the account already has a password, `current_password` is required and
+     *     verified before the change is applied, so a hijacked session or CSRF cannot
+     *     silently reset it (and lock out the real owner). When the account has no
+     *     password yet (an SSO-only account setting its first one), there is nothing to
+     *     re-authenticate against, so a fresh step-up `reauth_proof` is required instead
+     *     — a live session alone must not mint a durable new credential.
+     */
+    SetPassword: {
+      /**
+       * @description The account's current password. Required when the account already has a
+       *     password; omitted when setting a first password on an account that has
+       *     none (supply `reauth_proof` instead).
+       */
+      currentPassword?: string;
+      /** @description The new password (will be hashed before storage). */
+      newPassword: string;
+      /**
+       * @description A step-up re-authentication proof (from the OIDC reauth endpoint).
+       *     Required when *setting a first password* on an account that has none;
+       *     ignored when changing an existing password.
+       */
+      reauthProof?: string;
+    };
     /**
      * @description Which SHA-2 variant a hashing operator uses.
      *
@@ -14540,24 +15690,6 @@ interface components {
       /** @description The rationale, when one was given. */
       reason?: string;
     };
-    /**
-     * @description Request payload to trigger a connection sync.
-     *
-     *     The direction is determined by the connection's configured `sync_mode`.
-     *     - Import connections need no body: the sync fetches every not-yet-imported
-     *       object under the connection's root path.
-     *     - Export connections push one workspace file (`file_id`) to one object
-     *       `key`; both are required for export and ignored for import.
-     */
-    SyncConnection: {
-      /**
-       * Format: uuid
-       * @description The workspace file to export (export connections only).
-       */
-      fileId?: string;
-      /** @description The destination object key for an export, relative to the root path. */
-      key?: string;
-    };
     /**
      * @description What an import does with a file whose source object no longer exists.
      *
@@ -14647,15 +15779,20 @@ interface components {
        *     `word/document.xml` text belongs to the document part
        *     itself, not to a nested one.
        *
-       *     For text specifically, a caller holding raw file bytes
-       *     rather than a decoded offset — a reviewer selecting rendered
-       *     text, say — leaves [`TextLocation::range`] empty and fills
-       *     [`TextLocation::source`] instead, which the engine
-       *     reverse-resolves. The other three have no such alternative:
-       *     their coordinates are the only way in.
+       *     Text carries either coordinate kind of [`TextCoord`]: a
+       *     [`Decoded`] span for a caller with an offset into the
+       *     decoded stream, or a [`Source`] one for a caller holding
+       *     only raw file bytes — a reviewer selecting rendered text,
+       *     say — which the engine reverse-resolves. Source-only is its
+       *     own kind rather than a decoded span left empty, so such a
+       *     selection is representable as itself.
+       *
+       *     The other three media have no such alternative: their
+       *     coordinates are the only way in.
        *
-       *     [`TextLocation::range`]: elide::modality::text::TextLocation::range
-       *     [`TextLocation::source`]: elide::modality::text::TextLocation::source
+       *     [`TextCoord`]: elide::modality::text::TextCoord
+       *     [`Decoded`]: elide::modality::text::TextCoord::Decoded
+       *     [`Source`]: elide::modality::text::TextCoord::Source
        */
       location: components["schemas"]["TabularLocation"];
       /**
@@ -14667,9 +15804,9 @@ interface components {
        *
        *     Nested media needs this: the report holds an embedded image
        *     as its own part, and an addition to one has nowhere to go
-       *     without naming it. Text usually does not — where a span came
-       *     from is already in `TextLocation::source`, which carries the
-       *     part alongside the raw range.
+       *     without naming it. Text usually does not — a source
+       *     reference already names the part it came from, alongside the
+       *     raw range.
        *
        *     `None` is an error when the request carried several
        *     documents, since there is then no sole document to mean.
@@ -15252,15 +16389,20 @@ interface components {
        *     `word/document.xml` text belongs to the document part
        *     itself, not to a nested one.
        *
-       *     For text specifically, a caller holding raw file bytes
-       *     rather than a decoded offset — a reviewer selecting rendered
-       *     text, say — leaves [`TextLocation::range`] empty and fills
-       *     [`TextLocation::source`] instead, which the engine
-       *     reverse-resolves. The other three have no such alternative:
-       *     their coordinates are the only way in.
+       *     Text carries either coordinate kind of [`TextCoord`]: a
+       *     [`Decoded`] span for a caller with an offset into the
+       *     decoded stream, or a [`Source`] one for a caller holding
+       *     only raw file bytes — a reviewer selecting rendered text,
+       *     say — which the engine reverse-resolves. Source-only is its
+       *     own kind rather than a decoded span left empty, so such a
+       *     selection is representable as itself.
        *
-       *     [`TextLocation::range`]: elide::modality::text::TextLocation::range
-       *     [`TextLocation::source`]: elide::modality::text::TextLocation::source
+       *     The other three media have no such alternative: their
+       *     coordinates are the only way in.
+       *
+       *     [`TextCoord`]: elide::modality::text::TextCoord
+       *     [`Decoded`]: elide::modality::text::TextCoord::Decoded
+       *     [`Source`]: elide::modality::text::TextCoord::Source
        */
       location: components["schemas"]["TextLocation"];
       /**
@@ -15272,9 +16414,9 @@ interface components {
        *
        *     Nested media needs this: the report holds an embedded image
        *     as its own part, and an addition to one has nowhere to go
-       *     without naming it. Text usually does not — where a span came
-       *     from is already in `TextLocation::source`, which carries the
-       *     part alongside the raw range.
+       *     without naming it. Text usually does not — a source
+       *     reference already names the part it came from, alongside the
+       *     raw range.
        *
        *     `None` is an error when the request carried several
        *     documents, since there is then no sole document to mean.
@@ -16040,6 +17182,16 @@ interface components {
        */
       text: string;
     };
+    /**
+     * @description Configuration for a provider reached without an API key (Ollama), addressed
+     *     by a caller-supplied base URL. Carries no secret, so it derives [`Debug`].
+     */
+    UnauthenticatedProvider: {
+      /** @description Base URL of the server (e.g. `http://localhost:11434`). */
+      baseUrl: string;
+      /** @description Default model to use when a request does not specify one. Optional. */
+      defaultModel?: string;
+    };
     /**
      * @description An account's current unread-notification count, broadcast on the account's
      *     core-NATS unread subject.
@@ -16063,7 +17215,13 @@ interface components {
        */
       unreadCount: number;
     };
-    /** @description Request payload to update an account. */
+    /**
+     * @description Request payload to update an account's profile.
+     *
+     *     Credentials are not profile fields — a password and any linked providers are
+     *     managed through the account's identities (see the identity endpoints), never
+     *     here.
+     */
     UpdateAccount: {
       /** @description New display name (2-32 characters). */
       displayName?: string;
@@ -16072,8 +17230,6 @@ interface components {
        * @description New email address (must be valid email format).
        */
       emailAddress?: string;
-      /** @description A re-authenticated password change, when changing the password. */
-      password?: components["schemas"]["PasswordChange"];
       /** @description New account handle. */
       username?: components["schemas"]["Handle"];
     };
@@ -16611,8 +17767,12 @@ type Handle = Schemas$23["Handle"];
 type Account = Schemas$23["Account"];
 type PublicAccount = Schemas$23["PublicAccount"];
 type UpdateAccount = Schemas$23["UpdateAccount"];
-type PasswordChange = Schemas$23["PasswordChange"];
 type AccountRef = Schemas$23["AccountRef"];
+type AccountIdentities = Schemas$23["AccountIdentities"];
+type AccountIdentity = Schemas$23["AccountIdentity"];
+type IdentityProvider = Schemas$23["IdentityProvider"];
+type SetPassword = Schemas$23["SetPassword"];
+type OidcStartResponse = Schemas$23["OidcStartResponse"];
 //#endregion
 //#region src/datatypes/activity.d.ts
 type Schemas$22 = components["schemas"];
@@ -16803,10 +17963,13 @@ type CreateConnection = Schemas$14["CreateConnection"];
 type UpdateConnection = Schemas$14["UpdateConnection"];
 type ConnectionsQuery = Schemas$14["ConnectionsQuery"];
 type ConnectionPage = Schemas$14["ConnectionPage"];
-type SyncConnection = Schemas$14["SyncConnection"];
 type ConnectionSync = Schemas$14["ConnectionSync"];
 type ConnectionSyncPage = Schemas$14["ConnectionSyncPage"];
 type ConnectionVerification = Schemas$14["ConnectionVerification"];
+type ImportFiles = Schemas$14["ImportFiles"];
+type PickedFile = Schemas$14["PickedFile"];
+type ExportFiles = Schemas$14["ExportFiles"];
+type PickerToken = Schemas$14["PickerToken"];
 type SyncMode = Schemas$14["SyncMode"];
 type SyncStatus = Schemas$14["SyncStatus"];
 type SyncTriggerType = Schemas$14["SyncTriggerType"];
@@ -16817,8 +17980,8 @@ type S3Credentials = Schemas$14["S3Credentials"];
 type AzureCredentials = Schemas$14["AzureCredentials"];
 type GcsCredentials = Schemas$14["GcsCredentials"];
 type LlmConfig = Schemas$14["LlmConfig"];
-type AnthropicCredentials = Schemas$14["AnthropicCredentials"];
-type OpenAiCredentials = Schemas$14["OpenAiCredentials"];
+type AuthenticatedProvider = Schemas$14["AuthenticatedProvider"];
+type UnauthenticatedProvider = Schemas$14["UnauthenticatedProvider"];
 type Provider = Schemas$14["Provider"];
 type FileServiceConfig = Schemas$14["FileServiceConfig"];
 type OAuthTokens = Schemas$14["OAuthTokens"];
@@ -16942,6 +18105,7 @@ type PolicyDraft = Schemas$3["PolicyDraft"];
 type CreatePolicy = Schemas$3["CreatePolicy"];
 type UpdatePolicy = Schemas$3["UpdatePolicy"];
 type PolicyRule = Schemas$3["PolicyRule"];
+type CustomMatcher = Schemas$3["CustomMatcher"];
 type PolicyTemplate = Schemas$3["PolicyTemplate"];
 type TemplateOrigin = Schemas$3["TemplateOrigin"];
 type HipaaDeidMethod = Schemas$3["HipaaDeidMethod"];
@@ -17008,5 +18172,5 @@ type Retention = Schemas["Retention"];
 type RetentionSettings = Schemas["RetentionSettings"];
 type RetentionOverride = Schemas["RetentionOverride"];
 //#endregion
-export { PolicyRule as $, AccountRef as $a, TextManual as $i, SyncConnection as $n, FreeformAttribution as $r, ReplyInvite as $t, Color as A, StorageKindEntry as Aa, TabularAdd as Ai, RedactionResultPage as An, AudioHint as Ar, NotificationPage as At, Label as B, ActivityPayload as Ba, TabularPattern as Bi, ConnectionVerification as Bn, Calibration as Br, MemberSortField as Bt, Language as C, DetectionStatusEntry as Ca, Redaction as Ci, DetectionPage as Cn, AudioAdd as Cr, DetectionCompletedParams as Ct, ScopeMetadata as D, ProviderType as Da, SourceRef as Di, RedactDetection as Dn, AudioData as Dr, MemberJoinedParams as Dt, Languages as E, ModelUsageEntry as Ea, Selection as Ei, PipelineDetectionsQuery as En, AudioAuditLog as Er, MemberInvitedParams as Et, GdprArticle9Treatment as F, WorkspaceAnalytics as Fa, TabularEntity as Fi, ConnectionConfig as Fn, AudioRefinement as Fr, UnreadStatus as Ft, LanguageTag as G, InviteActivityParams as Ga, TextAuditKind as Gi, LlmConfig as Gn, Contested as Gr, InviteCode as Gt, LabelLocale as H, ConnectionActivityParams as Ha, TabularRetag as Hi, CreateConnection as Hn, CitedAttribution as Hr, CreateInvite as Ht, GdprSensitiveScope as I, Activity as Ia, TabularHint as Ii, ConnectionId as In, AudioRetag as Ir, UpdateNotificationSettings as It, PciDssPart as J, PolicyActivityParams as Ja, TextData as Ji, OpenAiCredentials as Jn, Dimensions as Jr, InvitePreview as Jt, LocalizedText as K, MemberActivityParams as Ka, TextAuditLog as Ki, OAuthStartResponse as Kn, DecodedSpan as Kr, InviteExpiration as Kt, HipaaAccountNumbers as L, ActivityExportOptions as La, TabularLocation as Li, ConnectionPage as Ln, Audit as Lr, ListMembers as Lt, CreatePolicy as M, Usage as Ma, TabularAuditKind as Mi, AnthropicCredentials as Mn, AudioManual as Mr, NotificationSettings as Mt, DateGranularity as N, UsageAnalytics as Na, TabularAuditLog as Ni, AzureCredentials as Nn, AudioModel as Nr, RedactionCreatedParams as Nt, AudioRedaction as O, RecognizerId as Oa, SourceSpan as Oi, RedactionId as On, AudioEdit as Or, Notification as Ot, DateStyle as P, UsageReport as Pa, TabularEdit as Pi, Connection as Pn, AudioPattern as Pr, UnreadCountEvent as Pt, PolicyDraft as Q, Account as Qa, TextLocation as Qi, StorageConfig as Qn, EntityCoRef as Qr, ListInvites as Qt, HipaaDeidMethod as R, ActivityFilterQuery as Ra, TabularManual as Ri, ConnectionSync as Rn, AuditHash as Rr, Member as Rt, CountryCode as S, DetectionDayEntry as Sa, RasterMode as Si, DetectionMetadata as Sn, Attribution as Sr, ConnectionSyncFailedParams as St, LanguageSpan as T, ModelUsage as Ta, RuleMatch as Ti, DetectionStatusEvent as Tn, AudioAuditKind as Tr, MarkedReadStatus as Tt, LabelRef as U, DetectionActivityParams as Ua, TextAdd as Ui, FileServiceConfig as Un, CodecParams as Ur, GenerateInviteCode as Ut, LabelEntry as V, ActivityType as Va, TabularRefinement as Vi, ConnectionsQuery as Vn, Category as Vr, UpdateMember as Vt, LabelScope as W, FileActivityParams as Wa, TextAuditEvent as Wi, GcsCredentials as Wn, Conflict as Wr, Invite as Wt, Policy as X, WebhookActivityParams as Xa, TextEntity as Xi, S3Credentials as Xn, Dpi as Xr, InviteSortField as Xt, PciPanRender as Y, RedactionActivityParams as Ya, TextEdit as Yi, Provider as Yn, DocumentContext as Yr, InviteSent as Yt, PolicyDefinition as Z, WorkspaceActivityParams as Za, TextHint as Zi, StartFileServiceOAuth as Zn, EditSet as Zr, InviteStatus as Zt, WebhookId as _, ApiTokenWithJWT as _a, OperatorId as _i, ErrorResponse as _n, RecognizerCatalog as _r, PipelineSummaryPage as _t, RetentionSettings as a, ArtifactSet as aa, ImageEdit as ai, DeletedFiles as an, SyncTriggerType as ar, TabularRedaction as at, WebhookStatus as b, UpdateApiToken as ba, Polygon as bi, Detection as bn, Login as br, CursorPagination as bt, WorkspacePage as c, LayoutWord as ca, ImageLocation as ci, FileKind as cn, ChatRole as cr, TextRedaction as ct, CreateWebhook as d, TranscriptSegment as da, ImagePattern as di, ListFiles as dn, ChatToken as dr, CreatePipeline as dt, TextModel as ea, ImageAdd as ei, SortOrder as en, Handle as eo, SyncDeletionPolicy as er, PolicySummary as et, TestWebhook as f, TranscriptWord as fa, ImageRefinement as fi, ModalityToken as fn, CreateChatSession as fr, Pipeline as ft, WebhookEvent as g, ApiTokenType as ga, ModelEvent as gi, ExportQuery as gn, LabelCatalog as gr, PipelineSummary as gt, WebhookCreated as h, ApiTokenPage as ha, ManualIntent as hi, ExportFormat as hn, FileProviders as hr, PipelineStatus as ht, RetentionOverride as i, TimeSpan as ia, ImageData as ii, DeleteFiles as in, paths as io, SyncStatus as ir, Sha2Algorithm as it, ConfidenceThreshold as j, TokenCounts as ja, TabularAuditEvent as ji, WorkspaceDetectionsQuery as jn, AudioLocation as jr, NotificationPayload as jt, ClampBucket as k, StorageAnalytics as ka, Suppress as ki, RedactionResult as kn, AudioEntity as kr, NotificationEvent as kt, WorkspaceRole as l, Token as la, ImageManual as li, FilePage as ln, ChatSession as lr, UpdatePolicy as lt, Webhook as m, ApiToken as ma, LeakProfile as mi, DateWindow as mn, ConnectorCatalog as mr, PipelineFilter as mt, RasterPolicy as n, TextRefinement as na, ImageAuditKind as ni, Health as nn, PublicAccount as no, SyncSchedule as nr, PolicyTemplate as nt, UpdateWorkspace as o, Layout as oa, ImageEntity as oi, File as on, UpdateConnection as or, TemplateOrigin as ot, UpdateWebhook as p, Transcription as pa, ImageRetag as pi, UpdateFile as pn, SendChatMessage as pr, PipelineDefinition as pt, ModalityRedactions as q, PipelineActivityParams as qa, TextCoord as qi, OAuthTokens as qn, Deduplication as qr, InvitePage as qt, Retention as r, TextRetag as ra, ImageAuditLog as ri, HealthStatus as rn, UpdateAccount as ro, SyncScheduleInput as rr, Predicate as rt, Workspace as s, LayoutBlock as sa, ImageHint as si, FileHash as sn, ChatMessage as sr, TerminalFallback as st, CreateWorkspace as t, TextPattern as ta, ImageAuditEvent as ti, ComponentHealth as tn, PasswordChange as to, SyncMode as tr, PolicySummaryPage as tt, WorkspaceSettings as u, Tokens as ua, ImageModel as ui, FormatToken as un, ChatSessionPage as ur, Waveform as ut, WebhookPage as v, CreateApiToken as va, PatternEvent as vi, ValidationErrorDetail as vn, RegisteredRecognizer as vr, PipelineTriggerType as vt, LanguageProvenance as w, DetectionTimeSeries as wa, Report as wi, DetectionStatus as wn, AudioAuditEvent as wr, DetectionFailedParams as wt, Confidence as x, DetectionAnalytics as xa, RangeOfUint as xi, DetectionId as xn, Signup as xr, ConnectionSyncCompletedParams as xt, WebhookResult as y, TokenExpiration as ya, Point as yi, CreateDetection as yn, AuthToken as yr, UpdatePipeline as yt, ImageRedaction as z, ActivityPage as za, TabularModel as zi, ConnectionSyncPage as zn, BoundingBox as zr, MemberPage as zt };
-//# sourceMappingURL=index-Cv75Uuts.d.ts.map
+export { PolicyDraft as $, RedactionActivityParams as $a, TextEdit as $i, Provider as $n, DocumentContext as $r, ListInvites as $t, Color as A, ModelUsageEntry as Aa, Selection as Ai, RedactionResult as An, AudioAuditLog as Ar, NotificationEvent as At, ImageRedaction as B, Activity as Ba, TabularHint as Bi, ConnectionSyncPage as Bn, AudioRetag as Br, MemberPage as Bt, Language as C, TokenExpiration as Ca, Point as Ci, DetectionMetadata as Cn, AuthToken as Cr, ConnectionSyncFailedParams as Ct, ScopeMetadata as D, DetectionStatusEntry as Da, Redaction as Di, PipelineDetectionsQuery as Dn, AudioAdd as Dr, MemberInvitedParams as Dt, Languages as E, DetectionDayEntry as Ea, RasterMode as Ei, DetectionStatusEvent as En, Attribution as Er, MarkedReadStatus as Et, DateStyle as F, TokenCounts as Fa, TabularAuditEvent as Fi, Connection as Fn, AudioLocation as Fr, UnreadCountEvent as Ft, LabelScope as G, ActivityType as Ga, TabularRefinement as Gi, FileServiceConfig as Gn, Category as Gr, Invite as Gt, LabelEntry as H, ActivityFilterQuery as Ha, TabularManual as Hi, ConnectionsQuery as Hn, AuditHash as Hr, UpdateMember as Ht, GdprArticle9Treatment as I, Usage as Ia, TabularAuditKind as Ii, ConnectionConfig as In, AudioManual as Ir, UnreadStatus as It, ModalityRedactions as J, FileActivityParams as Ja, TextAuditEvent as Ji, LlmConfig as Jn, Conflict as Jr, InvitePage as Jt, LanguageTag as K, ConnectionActivityParams as Ka, TabularRetag as Ki, GcsCredentials as Kn, CitedAttribution as Kr, InviteCode as Kt, GdprSensitiveScope as L, UsageAnalytics as La, TabularAuditLog as Li, ConnectionId as Ln, AudioModel as Lr, UpdateNotificationSettings as Lt, CreatePolicy as M, RecognizerId as Ma, SourceSpan as Mi, WorkspaceDetectionsQuery as Mn, AudioEdit as Mr, NotificationPayload as Mt, CustomMatcher as N, StorageAnalytics as Na, Suppress as Ni, AuthenticatedProvider as Nn, AudioEntity as Nr, NotificationSettings as Nt, AudioRedaction as O, DetectionTimeSeries as Oa, Report as Oi, RedactDetection as On, AudioAuditEvent as Or, MemberJoinedParams as Ot, DateGranularity as P, StorageKindEntry as Pa, TabularAdd as Pi, AzureCredentials as Pn, AudioHint as Pr, RedactionCreatedParams as Pt, PolicyDefinition as Q, PolicyActivityParams as Qa, TextData as Qi, PickerToken as Qn, Dimensions as Qr, InviteStatus as Qt, HipaaAccountNumbers as R, UsageReport as Ra, TabularEdit as Ri, ConnectionPage as Rn, AudioPattern as Rr, ListMembers as Rt, CountryCode as S, CreateApiToken as Sa, PatternEvent as Si, DetectionId as Sn, RegisteredRecognizer as Sr, ConnectionSyncCompletedParams as St, LanguageSpan as T, DetectionAnalytics as Ta, RangeOfUint as Ti, DetectionStatus as Tn, Signup as Tr, DetectionFailedParams as Tt, LabelLocale as U, ActivityPage as Ua, TabularModel as Ui, CreateConnection as Un, BoundingBox as Ur, CreateInvite as Ut, Label as V, ActivityExportOptions as Va, TabularLocation as Vi, ConnectionVerification as Vn, Audit as Vr, MemberSortField as Vt, LabelRef as W, ActivityPayload as Wa, TabularPattern as Wi, ExportFiles as Wn, Calibration as Wr, GenerateInviteCode as Wt, PciPanRender as X, MemberActivityParams as Xa, TextAuditLog as Xi, OAuthTokens as Xn, DecodedSpan as Xr, InviteSent as Xt, PciDssPart as Y, InviteActivityParams as Ya, TextAuditKind as Yi, OAuthStartResponse as Yn, Contested as Yr, InvitePreview as Yt, Policy as Z, PipelineActivityParams as Za, TextCoord as Zi, PickedFile as Zn, Deduplication as Zr, InviteSortField as Zt, WebhookId as _, Transcription as _a, ImageRetag as _i, ExportQuery as _n, SendChatMessage as _r, PipelineSummary as _t, RetentionSettings as a, TextPattern as aa, ImageAuditEvent as ai, DeleteFiles as an, AccountRef as ao, SyncSchedule as ar, Sha2Algorithm as at, WebhookStatus as b, ApiTokenType as ba, ModelEvent as bi, CreateDetection as bn, LabelCatalog as br, UpdatePipeline as bt, WorkspacePage as c, TimeSpan as ca, ImageData as ci, FileHash as cn, OidcStartResponse as co, SyncTriggerType as cr, TerminalFallback as ct, CreateWebhook as d, LayoutBlock as da, ImageHint as di, FormatToken as dn, UpdateAccount as do, ChatMessage as dr, Waveform as dt, TextEntity as ea, Dpi as ei, ReplyInvite as en, WebhookActivityParams as eo, S3Credentials as er, PolicyRule as et, TestWebhook as f, LayoutWord as fa, ImageLocation as fi, ListFiles as fn, paths as fo, ChatRole as fr, CreatePipeline as ft, WebhookEvent as g, TranscriptWord as ga, ImageRefinement as gi, ExportFormat as gn, CreateChatSession as gr, PipelineStatus as gt, WebhookCreated as h, TranscriptSegment as ha, ImagePattern as hi, DateWindow as hn, ChatToken as hr, PipelineFilter as ht, RetentionOverride as i, TextModel as ia, ImageAdd as ii, HealthStatus as in, AccountIdentity as io, SyncMode as ir, Predicate as it, ConfidenceThreshold as j, ProviderType as ja, SourceRef as ji, RedactionResultPage as jn, AudioData as jr, NotificationPage as jt, ClampBucket as k, ModelUsage as ka, RuleMatch as ki, RedactionId as kn, AudioAuditKind as kr, Notification as kt, WorkspaceRole as l, ArtifactSet as la, ImageEdit as li, FileKind as ln, PublicAccount as lo, UnauthenticatedProvider as lr, TextRedaction as lt, Webhook as m, Tokens as ma, ImageModel as mi, UpdateFile as mn, ChatSessionPage as mr, PipelineDefinition as mt, RasterPolicy as n, TextLocation as na, EntityCoRef as ni, ComponentHealth as nn, Account as no, StorageConfig as nr, PolicySummaryPage as nt, UpdateWorkspace as o, TextRefinement as oa, ImageAuditKind as oi, DeletedFiles as on, Handle as oo, SyncScheduleInput as or, TabularRedaction as ot, UpdateWebhook as p, Token as pa, ImageManual as pi, ModalityToken as pn, ChatSession as pr, Pipeline as pt, LocalizedText as q, DetectionActivityParams as qa, TextAdd as qi, ImportFiles as qn, CodecParams as qr, InviteExpiration as qt, Retention as r, TextManual as ra, FreeformAttribution as ri, Health as rn, AccountIdentities as ro, SyncDeletionPolicy as rr, PolicyTemplate as rt, Workspace as s, TextRetag as sa, ImageAuditLog as si, File as sn, IdentityProvider as so, SyncStatus as sr, TemplateOrigin as st, CreateWorkspace as t, TextHint as ta, EditSet as ti, SortOrder as tn, WorkspaceActivityParams as to, StartFileServiceOAuth as tr, PolicySummary as tt, WorkspaceSettings as u, Layout as ua, ImageEntity as ui, FilePage as un, SetPassword as uo, UpdateConnection as ur, UpdatePolicy as ut, WebhookPage as v, ApiToken as va, LeakProfile as vi, ErrorResponse as vn, ConnectorCatalog as vr, PipelineSummaryPage as vt, LanguageProvenance as w, UpdateApiToken as wa, Polygon as wi, DetectionPage as wn, Login as wr, DetectionCompletedParams as wt, Confidence as x, ApiTokenWithJWT as xa, OperatorId as xi, Detection as xn, RecognizerCatalog as xr, CursorPagination as xt, WebhookResult as y, ApiTokenPage as ya, ManualIntent as yi, ValidationErrorDetail as yn, FileProviders as yr, PipelineTriggerType as yt, HipaaDeidMethod as z, WorkspaceAnalytics as za, TabularEntity as zi, ConnectionSync as zn, AudioRefinement as zr, Member as zt };
+//# sourceMappingURL=index-uEHkixjD.d.ts.map