@nvisy/sdk 0.45.0 → 0.47.0

package/dist/{index-kr36ZsdV.d.ts → index-B-oR9rqQ.d.ts}

@@ -117,7 +117,13 @@ interface paths {
         path?: never;
         cookie?: never;
       };
-      /** @description Request payload to update an account. */
+      /**
+       * @description Request payload to update an account's profile.
+       *
+       *     Credentials are not profile fields — a password and any linked providers are
+       *     managed through the account's identities (see the identity endpoints), never
+       *     here.
+       */
       requestBody: {
         content: {
           "application/json": components["schemas"]["UpdateAccount"];
@@ -342,7 +348,395 @@ interface paths {
             [name: string]: unknown;
           };
           content: {
-            "application/json": components["schemas"]["ErrorResponse"];
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+      };
+    };
+    post?: never;
+    /**
+     * Delete account avatar
+     * @description Removes the account's avatar. Only the account itself may delete it.
+     */
+    delete: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          /** @description Public handle of the account. */
+          username: components["schemas"]["Handle"];
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description no content */
+        204: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+      };
+    };
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/account/identities/": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List sign-in methods
+     * @description Returns the authenticated account's identities: its password and any linked providers.
+     */
+    get: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path?: never;
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description The account's sign-in methods. */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["AccountIdentities"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+      };
+    };
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/account/identities/password/": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    /**
+     * Set or change password
+     * @description Sets or changes the account's password. Changing an existing password requires the current password; setting a first password on an account that has none requires a step-up re-authentication proof.
+     */
+    put: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path?: never;
+        cookie?: never;
+      };
+      /**
+       * @description A password set or change.
+       *
+       *     When the account already has a password, `current_password` is required and
+       *     verified before the change is applied, so a hijacked session or CSRF cannot
+       *     silently reset it (and lock out the real owner). When the account has no
+       *     password yet (an SSO-only account setting its first one), there is nothing to
+       *     re-authenticate against, so a fresh step-up `reauth_proof` is required instead
+       *     — a live session alone must not mint a durable new credential.
+       */
+      requestBody: {
+        content: {
+          "application/json": components["schemas"]["SetPassword"];
+        };
+      };
+      responses: {
+        /** @description Password set. */
+        204: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        400: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /** @description Expected request with `Content-Type: application/json` */
+        415: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "text/plain": string;
+          };
+        };
+        /** @description Failed to deserialize the JSON body into the target type */
+        422: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "text/plain": string;
+          };
+        };
+      };
+    };
+    post?: never;
+    /**
+     * Remove password
+     * @description Removes the account's password, leaving it able to sign in only through its linked providers. Refused if the password is the account's only sign-in method.
+     */
+    delete: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path?: never;
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Password removed. */
+        204: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        409: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+      };
+    };
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/account/identities/{provider}/": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Link a provider
+     * @description Begins linking the given OpenID Connect provider to the authenticated account and returns the provider authorize URL. Requires a step-up re-authentication proof (`reauthProof`, from the reauth endpoint). On consent, the callback attaches the verified provider identity to the caller's account.
+     */
+    post: {
+      parameters: {
+        query?: {
+          /**
+           * @description A step-up re-authentication proof. Required to start a *link* (adding a
+           *     provider is a credential-adding action, so a live session alone is not
+           *     enough); ignored for sign-in and reauth.
+           */
+          reauthProof?: string;
+          /**
+           * @description Frontend URL to return to once done. Carried through the flow and used to
+           *     build the callback's redirect.
+           */
+          redirectUri?: string;
+        };
+        header?: never;
+        path: {
+          /** @description The identity provider to act on. */
+          provider: components["schemas"]["IdentityProvider"];
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description The response to a successful sign-in start: where to send the user. */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["OidcStartResponse"];
           };
         };
         /**
@@ -367,7 +761,7 @@ interface paths {
          *     response, including the error name, message, HTTP status code, resource
          *     information, and user-friendly messages.
          */
-        403: {
+        404: {
           headers: {
             [name: string]: unknown;
           };
@@ -382,7 +776,7 @@ interface paths {
          *     response, including the error name, message, HTTP status code, resource
          *     information, and user-friendly messages.
          */
-        404: {
+        503: {
           headers: {
             [name: string]: unknown;
           };
@@ -392,24 +786,23 @@ interface paths {
         };
       };
     };
-    post?: never;
     /**
-     * Delete account avatar
-     * @description Removes the account's avatar. Only the account itself may delete it.
+     * Unlink a provider
+     * @description Removes a linked OIDC provider from the account. Refused if the provider is the account's only sign-in method.
      */
     delete: {
       parameters: {
         query?: never;
         header?: never;
         path: {
-          /** @description Public handle of the account. */
-          username: components["schemas"]["Handle"];
+          /** @description The identity provider to act on. */
+          provider: components["schemas"]["IdentityProvider"];
         };
         cookie?: never;
       };
       requestBody?: never;
       responses: {
-        /** @description no content */
+        /** @description Provider unlinked. */
         204: {
           headers: {
             [name: string]: unknown;
@@ -423,7 +816,7 @@ interface paths {
          *     response, including the error name, message, HTTP status code, resource
          *     information, and user-friendly messages.
          */
-        401: {
+        400: {
           headers: {
             [name: string]: unknown;
           };
@@ -438,7 +831,7 @@ interface paths {
          *     response, including the error name, message, HTTP status code, resource
          *     information, and user-friendly messages.
          */
-        403: {
+        401: {
           headers: {
             [name: string]: unknown;
           };
@@ -461,6 +854,21 @@ interface paths {
             "application/json": components["schemas"]["ErrorResponse"];
           };
         };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        409: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
       };
     };
     options?: never;
@@ -2700,6 +3108,117 @@ interface paths {
     patch?: never;
     trace?: never;
   };
+  "/workspaces/{workspaceSlug}/connections/{connectionId}/picker-token/": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Mint picker token
+     * @description Returns a short-lived provider access token for a browser file picker (file services with a token-based picker only). The refresh token is never returned.
+     */
+    post: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          /** @description URL-safe workspace identifier. */
+          workspaceSlug: string;
+          /** @description Opaque identifier of the connection. */
+          connectionId: components["schemas"]["ConnectionId"];
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /**
+         * @description A short-lived provider OAuth access token for a browser file picker.
+         *
+         *     Carries only the access token and its expiry — never the refresh token, which
+         *     stays server-side. The token is minted from the connection's stored
+         *     credentials and is short-lived (the provider's access-token lifetime), so the
+         *     browser holds a narrow, expiring credential rather than a durable one.
+         */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["PickerToken"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        400: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+      };
+    };
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   "/workspaces/{workspaceSlug}/connections/oauth/{provider}/start/": {
     parameters: {
       query?: never;
@@ -9005,28 +9524,145 @@ interface paths {
         };
       };
       responses: {
-        /** @description Workspace webhook response. */
+        /** @description Workspace webhook response. */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["Webhook"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        400: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /** @description Expected request with `Content-Type: application/json` */
+        415: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "text/plain": string;
+          };
+        };
+        /** @description Failed to deserialize the JSON body into the target type */
+        422: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "text/plain": string;
+          };
+        };
+      };
+    };
+    trace?: never;
+  };
+  "/workspaces/{workspaceSlug}/webhooks/{webhookId}/test/": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Test webhook
+     * @description Sends a test payload to the webhook endpoint and returns the result.
+     */
+    post: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          /** @description URL-safe workspace identifier. */
+          workspaceSlug: string;
+          /** @description Opaque identifier of the webhook. */
+          webhookId: components["schemas"]["WebhookId"];
+        };
+        cookie?: never;
+      };
+      /** @description Request payload for testing a webhook. */
+      requestBody: {
+        content: {
+          "application/json": components["schemas"]["TestWebhook"];
+        };
+      };
+      responses: {
+        /** @description Result of a webhook delivery attempt. */
         200: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            "application/json": components["schemas"]["Webhook"];
+            "application/json": components["schemas"]["WebhookResult"];
           };
         };
-        /**
-         * @description HTTP error response representation with security-conscious design.
-         *
-         *     This struct contains all the information needed to serialize an error
-         *     response, including the error name, message, HTTP status code, resource
-         *     information, and user-friendly messages.
-         */
+        /** @description Failed to parse the request body as JSON */
         400: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            "application/json": components["schemas"]["ErrorResponse"];
+            "text/plain": string;
           };
         };
         /**
@@ -9094,56 +9730,54 @@ interface paths {
         };
       };
     };
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
     trace?: never;
   };
-  "/workspaces/{workspaceSlug}/webhooks/{webhookId}/test/": {
+  "/auth/{provider}/reauth/": {
     parameters: {
       query?: never;
       header?: never;
       path?: never;
       cookie?: never;
     };
-    get?: never;
-    put?: never;
     /**
-     * Test webhook
-     * @description Sends a test payload to the webhook endpoint and returns the result.
+     * Start OIDC step-up re-authentication
+     * @description Begins a step-up re-authentication with a provider already linked to the authenticated account, and returns the provider authorize URL. On consent, the callback mints a short-lived, single-use proof required to add a credential (set a first password, or link a new provider).
      */
-    post: {
+    get: {
       parameters: {
-        query?: never;
+        query?: {
+          /**
+           * @description A step-up re-authentication proof. Required to start a *link* (adding a
+           *     provider is a credential-adding action, so a live session alone is not
+           *     enough); ignored for sign-in and reauth.
+           */
+          reauthProof?: string;
+          /**
+           * @description Frontend URL to return to once done. Carried through the flow and used to
+           *     build the callback's redirect.
+           */
+          redirectUri?: string;
+        };
         header?: never;
         path: {
-          /** @description URL-safe workspace identifier. */
-          workspaceSlug: string;
-          /** @description Opaque identifier of the webhook. */
-          webhookId: components["schemas"]["WebhookId"];
+          /** @description The identity provider to act on. */
+          provider: components["schemas"]["IdentityProvider"];
         };
         cookie?: never;
       };
-      /** @description Request payload for testing a webhook. */
-      requestBody: {
-        content: {
-          "application/json": components["schemas"]["TestWebhook"];
-        };
-      };
+      requestBody?: never;
       responses: {
-        /** @description Result of a webhook delivery attempt. */
+        /** @description The response to a successful sign-in start: where to send the user. */
         200: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            "application/json": components["schemas"]["WebhookResult"];
-          };
-        };
-        /** @description Failed to parse the request body as JSON */
-        400: {
-          headers: {
-            [name: string]: unknown;
-          };
-          content: {
-            "text/plain": string;
+            "application/json": components["schemas"]["OidcStartResponse"];
           };
         };
         /**
@@ -9168,7 +9802,7 @@ interface paths {
          *     response, including the error name, message, HTTP status code, resource
          *     information, and user-friendly messages.
          */
-        403: {
+        404: {
           headers: {
             [name: string]: unknown;
           };
@@ -9183,7 +9817,7 @@ interface paths {
          *     response, including the error name, message, HTTP status code, resource
          *     information, and user-friendly messages.
          */
-        404: {
+        503: {
           headers: {
             [name: string]: unknown;
           };
@@ -9191,26 +9825,10 @@ interface paths {
             "application/json": components["schemas"]["ErrorResponse"];
           };
         };
-        /** @description Expected request with `Content-Type: application/json` */
-        415: {
-          headers: {
-            [name: string]: unknown;
-          };
-          content: {
-            "text/plain": string;
-          };
-        };
-        /** @description Failed to deserialize the JSON body into the target type */
-        422: {
-          headers: {
-            [name: string]: unknown;
-          };
-          content: {
-            "text/plain": string;
-          };
-        };
       };
     };
+    put?: never;
+    post?: never;
     delete?: never;
     options?: never;
     head?: never;
@@ -9228,7 +9846,7 @@ interface paths {
     put?: never;
     /**
      * Login
-     * @description Authenticates a user and returns an access token.
+     * @description Authenticates a user and starts a browser session: sets an HttpOnly session cookie and a CSRF cookie, returning no body. (Programmatic clients authenticate with an API token created via the tokens endpoint, not this one.)
      */
     post: {
       parameters: {
@@ -9244,14 +9862,12 @@ interface paths {
         };
       };
       responses: {
-        /** @description Response returned after successful authentication (login/signup). */
-        201: {
+        /** @description no content */
+        204: {
           headers: {
             [name: string]: unknown;
           };
-          content: {
-            "application/json": components["schemas"]["AuthToken"];
-          };
+          content?: never;
         };
         /**
          * @description HTTP error response representation with security-conscious design.
@@ -9320,7 +9936,7 @@ interface paths {
     put?: never;
     /**
      * Signup
-     * @description Creates a new account and returns an access token.
+     * @description Creates a new account and starts a browser session: sets an HttpOnly session cookie and a CSRF cookie, returning no body.
      */
     post: {
       parameters: {
@@ -9336,14 +9952,12 @@ interface paths {
         };
       };
       responses: {
-        /** @description Response returned after successful authentication (login/signup). */
-        201: {
+        /** @description no content */
+        204: {
           headers: {
             [name: string]: unknown;
           };
-          content: {
-            "application/json": components["schemas"]["AuthToken"];
-          };
+          content?: never;
         };
         /**
          * @description HTTP error response representation with security-conscious design.
@@ -9412,7 +10026,7 @@ interface paths {
     put?: never;
     /**
      * Logout
-     * @description Invalidates the current access token.
+     * @description Invalidates the current session and clears session cookies.
      */
     post: {
       parameters: {
@@ -9453,6 +10067,90 @@ interface paths {
     patch?: never;
     trace?: never;
   };
+  "/auth/{provider}/start/": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Start OIDC sign-in
+     * @description Begins an OpenID Connect sign-in with the given provider and returns the provider authorize URL to redirect the user to. On consent, the provider redirects to the callback, which signs the user in.
+     */
+    get: {
+      parameters: {
+        query?: {
+          /**
+           * @description A step-up re-authentication proof. Required to start a *link* (adding a
+           *     provider is a credential-adding action, so a live session alone is not
+           *     enough); ignored for sign-in and reauth.
+           */
+          reauthProof?: string;
+          /**
+           * @description Frontend URL to return to once done. Carried through the flow and used to
+           *     build the callback's redirect.
+           */
+          redirectUri?: string;
+        };
+        header?: never;
+        path: {
+          /** @description The identity provider to act on. */
+          provider: components["schemas"]["IdentityProvider"];
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description The response to a successful sign-in start: where to send the user. */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["OidcStartResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+        /**
+         * @description HTTP error response representation with security-conscious design.
+         *
+         *     This struct contains all the information needed to serialize an error
+         *     response, including the error name, message, HTTP status code, resource
+         *     information, and user-friendly messages.
+         */
+        503: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["ErrorResponse"];
+          };
+        };
+      };
+    };
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   "/health/": {
     parameters: {
       query?: never;
@@ -9634,6 +10332,33 @@ interface components {
       /** @description Public handle of the account. */
       username: components["schemas"]["Handle"];
     };
+    /** @description The account's sign-in methods. */
+    AccountIdentities: {
+      /** @description Every identity the account can sign in with. */
+      identities: components["schemas"]["AccountIdentity"][];
+    };
+    /**
+     * @description One of an account's sign-in methods, for the identities listing.
+     *
+     *     Never exposes the credential itself (a password hash or a provider subject),
+     *     only which methods exist and metadata about them.
+     */
+    AccountIdentity: {
+      /**
+       * Format: date-time
+       * @description When the identity was created (the password set, or the provider linked).
+       */
+      createdAt: string;
+      /** @description The authentication method: `password` or an OIDC provider. */
+      provider: components["schemas"]["IdentityProvider"];
+      /** @description The email the provider asserted at link time, for a linked provider. */
+      providerEmail?: string;
+      /**
+       * Format: date-time
+       * @description When the identity was last updated.
+       */
+      updatedAt: string;
+    };
     /**
      * @description Path parameters for account operations.
      *
@@ -10044,15 +10769,20 @@ interface components {
        *     `word/document.xml` text belongs to the document part
        *     itself, not to a nested one.
        *
-       *     For text specifically, a caller holding raw file bytes
-       *     rather than a decoded offset — a reviewer selecting rendered
-       *     text, say — leaves [`TextLocation::range`] empty and fills
-       *     [`TextLocation::source`] instead, which the engine
-       *     reverse-resolves. The other three have no such alternative:
-       *     their coordinates are the only way in.
+       *     Text carries either coordinate kind of [`TextCoord`]: a
+       *     [`Decoded`] span for a caller with an offset into the
+       *     decoded stream, or a [`Source`] one for a caller holding
+       *     only raw file bytes — a reviewer selecting rendered text,
+       *     say — which the engine reverse-resolves. Source-only is its
+       *     own kind rather than a decoded span left empty, so such a
+       *     selection is representable as itself.
+       *
+       *     The other three media have no such alternative: their
+       *     coordinates are the only way in.
        *
-       *     [`TextLocation::range`]: elide::modality::text::TextLocation::range
-       *     [`TextLocation::source`]: elide::modality::text::TextLocation::source
+       *     [`TextCoord`]: elide::modality::text::TextCoord
+       *     [`Decoded`]: elide::modality::text::TextCoord::Decoded
+       *     [`Source`]: elide::modality::text::TextCoord::Source
        */
       location: components["schemas"]["AudioLocation"];
       /**
@@ -10064,9 +10794,9 @@ interface components {
        *
        *     Nested media needs this: the report holds an embedded image
        *     as its own part, and an addition to one has nowhere to go
-       *     without naming it. Text usually does not — where a span came
-       *     from is already in `TextLocation::source`, which carries the
-       *     part alongside the raw range.
+       *     without naming it. Text usually does not — a source
+       *     reference already names the part it came from, alongside the
+       *     raw range.
        *
        *     `None` is an error when the request carried several
        *     documents, since there is then no sole document to mean.
@@ -10631,23 +11361,6 @@ interface components {
      *     [`AuditEvent`]: crate::entity::audit::AuditEvent
      */
     AuditHash: string;
-    /** @description Response returned after successful authentication (login/signup). */
-    AuthToken: {
-      /** @description The JWT API token for authentication. */
-      apiToken: string;
-      /**
-       * Format: date-time
-       * @description Timestamp when the token expires.
-       */
-      expiresAt: string;
-      /**
-       * Format: date-time
-       * @description Timestamp when the token was issued.
-       */
-      issuedAt: string;
-      /** @description Handle of the authenticated account. */
-      username: components["schemas"]["Handle"];
-    };
     /**
      * @description Configuration for a provider reached with an API key (OpenAI, Anthropic).
      *
@@ -11380,6 +12093,48 @@ interface components {
        */
       limit?: number;
     };
+    /**
+     * @description How to detect one caller-authored label.
+     *
+     *     Names a label the same policy declares in [`custom`]. A matcher
+     *     for a shipped built-in is rejected: elide already detects those,
+     *     and two definitions for one label would race in reconciliation.
+     *
+     *     [`custom`]: super::PolicyDefinition::custom
+     */
+    CustomMatcher: {
+      /**
+       * Format: float
+       * @description Score stamped on every match. Defaults to `0.6`.
+       *
+       *     Reconciliation keeps the higher-confidence entity when two
+       *     detections overlap, so this is what decides whether a
+       *     custom match beats a built-in one covering the same span.
+       * @default 0.6000000238418579
+       */
+      confidence?: number;
+      /**
+       * @description The label this detects, which the policy must declare in
+       *     [`custom`](super::PolicyDefinition::custom).
+       */
+      label: components["schemas"]["LabelRef"];
+      /**
+       * @description Human-readable name, recorded in the audit as the
+       *     recognizer that found the entity, so a trail distinguishes
+       *     a caller's matcher from a shipped pattern.
+       */
+      name: string;
+    } & ({
+      /** @constant */
+      kind: "pattern";
+      /** @description The expression, in `regex` crate syntax. */
+      pattern: string;
+    } | {
+      /** @constant */
+      kind: "terms";
+      /** @description The literals to scan for. */
+      terms: string[];
+    });
     /**
      * @description The coarseness a [`GeneralizeDate`] reduces a date/timestamp to.
      *
@@ -12111,6 +12866,26 @@ interface components {
      *       as de-identified.
      */
     HipaaDeidMethod: "safe_harbor" | "limited_data_set" | "expert_determination";
+    /**
+     * @description Path parameters for a provider-scoped identity operation: signing in with,
+     *     re-authenticating with, linking, or unlinking a provider. Named identically to
+     *     the stored [`IdentityProvider`], so the API and the account's identities name
+     *     each provider the same way.
+     */
+    IdentityPathParams: {
+      /** @description The identity provider to act on. */
+      provider: components["schemas"]["IdentityProvider"];
+    };
+    /**
+     * @description How an account authenticates.
+     *
+     *     Corresponds to the `IDENTITY_PROVIDER` PostgreSQL enum. [`Password`] is a
+     *     locally-held Argon2 secret; the rest are external OIDC providers keyed by the
+     *     provider's subject claim.
+     *
+     *     [`Password`]: Self::Password
+     */
+    IdentityProvider: "password" | "google" | "microsoft";
     /**
      * @description A detection recognition missed.
      *
@@ -12137,15 +12912,20 @@ interface components {
        *     `word/document.xml` text belongs to the document part
        *     itself, not to a nested one.
        *
-       *     For text specifically, a caller holding raw file bytes
-       *     rather than a decoded offset — a reviewer selecting rendered
-       *     text, say — leaves [`TextLocation::range`] empty and fills
-       *     [`TextLocation::source`] instead, which the engine
-       *     reverse-resolves. The other three have no such alternative:
-       *     their coordinates are the only way in.
+       *     Text carries either coordinate kind of [`TextCoord`]: a
+       *     [`Decoded`] span for a caller with an offset into the
+       *     decoded stream, or a [`Source`] one for a caller holding
+       *     only raw file bytes — a reviewer selecting rendered text,
+       *     say — which the engine reverse-resolves. Source-only is its
+       *     own kind rather than a decoded span left empty, so such a
+       *     selection is representable as itself.
+       *
+       *     The other three media have no such alternative: their
+       *     coordinates are the only way in.
        *
-       *     [`TextLocation::range`]: elide::modality::text::TextLocation::range
-       *     [`TextLocation::source`]: elide::modality::text::TextLocation::source
+       *     [`TextCoord`]: elide::modality::text::TextCoord
+       *     [`Decoded`]: elide::modality::text::TextCoord::Decoded
+       *     [`Source`]: elide::modality::text::TextCoord::Source
        */
       location: components["schemas"]["ImageLocation"];
       /**
@@ -12157,9 +12937,9 @@ interface components {
        *
        *     Nested media needs this: the report holds an embedded image
        *     as its own part, and an addition to one has nowhere to go
-       *     without naming it. Text usually does not — where a span came
-       *     from is already in `TextLocation::source`, which carries the
-       *     part alongside the raw range.
+       *     without naming it. Text usually does not — a source
+       *     reference already names the part it came from, alongside the
+       *     raw range.
        *
        *     `None` is an error when the request carried several
        *     documents, since there is then no sole document to mean.
@@ -13468,6 +14248,25 @@ interface components {
        */
       refresh_token?: string;
     };
+    /** @description Optional query parameters for starting a sign-in, link, or reauth. */
+    OidcStartQuery: {
+      /**
+       * @description A step-up re-authentication proof. Required to start a *link* (adding a
+       *     provider is a credential-adding action, so a live session alone is not
+       *     enough); ignored for sign-in and reauth.
+       */
+      reauthProof?: string;
+      /**
+       * @description Frontend URL to return to once done. Carried through the flow and used to
+       *     build the callback's redirect.
+       */
+      redirectUri?: string;
+    };
+    /** @description The response to a successful sign-in start: where to send the user. */
+    OidcStartResponse: {
+      /** @description The provider authorize URL the client should redirect the user to. */
+      authorizeUrl: string;
+    };
     /**
      * @description Identifies a redaction operator, for the redaction audit a higher
      *     layer assembles.
@@ -13484,20 +14283,6 @@ interface components {
       /** @description Operator's version at the time it was applied. */
       version: string;
     };
-    /**
-     * @description A re-authenticated password change: the new password plus the current one
-     *     that authorizes it.
-     *
-     *     Coupling the two in one struct makes the invariant explicit — a password
-     *     change always carries the current password, so a hijacked session or CSRF
-     *     cannot silently reset it (and lock out the real owner).
-     */
-    PasswordChange: {
-      /** @description The account's current password, verified before the change is applied. */
-      currentPassword: string;
-      /** @description The new password (will be hashed before storage). */
-      newPassword: string;
-    };
     /** @description Metadata of a pattern/dictionary recognition, carried by [`Pattern`]. */
     PatternEvent: {
       /**
@@ -13567,6 +14352,24 @@ interface components {
       /** @description The file's display name, as the picker reported it. */
       name: string;
     };
+    /**
+     * @description A short-lived provider OAuth access token for a browser file picker.
+     *
+     *     Carries only the access token and its expiry — never the refresh token, which
+     *     stays server-side. The token is minted from the connection's stored
+     *     credentials and is short-lived (the provider's access-token lifetime), so the
+     *     browser holds a narrow, expiring credential rather than a durable one.
+     */
+    PickerToken: {
+      /** @description The provider OAuth access token to hand to the browser picker. */
+      accessToken: string;
+      /**
+       * Format: int64
+       * @description Unix seconds at which the access token expires, if the provider reports
+       *     it. `None` means the provider did not return an expiry.
+       */
+      expiresAt?: number;
+    };
     /** @description Pipeline response. */
     Pipeline: {
       /**
@@ -13814,6 +14617,21 @@ interface components {
        *     customer-supplied so re-submissions carry the same id.
        */
       id: string;
+      /**
+       * @description How to detect the labels [`custom`] introduces.
+       *
+       *     A custom label declares vocabulary and nothing more, so
+       *     without a matcher it is scoped, targeted by rules, and never
+       *     found. Each matcher names a label this policy declares;
+       *     naming a shipped built-in is rejected, since elide already
+       *     detects those.
+       *
+       *     Compiled per request, so a policy declaring none costs
+       *     nothing.
+       *
+       *     [`custom`]: Self::custom
+       */
+      matchers?: components["schemas"]["CustomMatcher"][];
       /**
        * @description Human-readable name. Display-only. Does not key anything.
        *
@@ -13873,6 +14691,11 @@ interface components {
       description?: string;
       /** @description Per-policy catch-all, fired when no rule matched. */
       fallback?: components["schemas"]["ModalityRedactions"];
+      /**
+       * @description How to detect the custom labels this policy introduces. A custom label
+       *     without a matcher is declared but never found.
+       */
+      matchers?: components["schemas"]["CustomMatcher"][];
       /** @description Human-readable name. Display-only. */
       name: string;
       /** @description Ordered rules. First match wins within this policy. */
@@ -14647,6 +15470,32 @@ interface components {
        */
       parentId?: string;
     };
+    /**
+     * @description A password set or change.
+     *
+     *     When the account already has a password, `current_password` is required and
+     *     verified before the change is applied, so a hijacked session or CSRF cannot
+     *     silently reset it (and lock out the real owner). When the account has no
+     *     password yet (an SSO-only account setting its first one), there is nothing to
+     *     re-authenticate against, so a fresh step-up `reauth_proof` is required instead
+     *     — a live session alone must not mint a durable new credential.
+     */
+    SetPassword: {
+      /**
+       * @description The account's current password. Required when the account already has a
+       *     password; omitted when setting a first password on an account that has
+       *     none (supply `reauth_proof` instead).
+       */
+      currentPassword?: string;
+      /** @description The new password (will be hashed before storage). */
+      newPassword: string;
+      /**
+       * @description A step-up re-authentication proof (from the OIDC reauth endpoint).
+       *     Required when *setting a first password* on an account that has none;
+       *     ignored when changing an existing password.
+       */
+      reauthProof?: string;
+    };
     /**
      * @description Which SHA-2 variant a hashing operator uses.
      *
@@ -14909,15 +15758,20 @@ interface components {
        *     `word/document.xml` text belongs to the document part
        *     itself, not to a nested one.
        *
-       *     For text specifically, a caller holding raw file bytes
-       *     rather than a decoded offset — a reviewer selecting rendered
-       *     text, say — leaves [`TextLocation::range`] empty and fills
-       *     [`TextLocation::source`] instead, which the engine
-       *     reverse-resolves. The other three have no such alternative:
-       *     their coordinates are the only way in.
+       *     Text carries either coordinate kind of [`TextCoord`]: a
+       *     [`Decoded`] span for a caller with an offset into the
+       *     decoded stream, or a [`Source`] one for a caller holding
+       *     only raw file bytes — a reviewer selecting rendered text,
+       *     say — which the engine reverse-resolves. Source-only is its
+       *     own kind rather than a decoded span left empty, so such a
+       *     selection is representable as itself.
+       *
+       *     The other three media have no such alternative: their
+       *     coordinates are the only way in.
        *
-       *     [`TextLocation::range`]: elide::modality::text::TextLocation::range
-       *     [`TextLocation::source`]: elide::modality::text::TextLocation::source
+       *     [`TextCoord`]: elide::modality::text::TextCoord
+       *     [`Decoded`]: elide::modality::text::TextCoord::Decoded
+       *     [`Source`]: elide::modality::text::TextCoord::Source
        */
       location: components["schemas"]["TabularLocation"];
       /**
@@ -14929,9 +15783,9 @@ interface components {
        *
        *     Nested media needs this: the report holds an embedded image
        *     as its own part, and an addition to one has nowhere to go
-       *     without naming it. Text usually does not — where a span came
-       *     from is already in `TextLocation::source`, which carries the
-       *     part alongside the raw range.
+       *     without naming it. Text usually does not — a source
+       *     reference already names the part it came from, alongside the
+       *     raw range.
        *
        *     `None` is an error when the request carried several
        *     documents, since there is then no sole document to mean.
@@ -15514,15 +16368,20 @@ interface components {
        *     `word/document.xml` text belongs to the document part
        *     itself, not to a nested one.
        *
-       *     For text specifically, a caller holding raw file bytes
-       *     rather than a decoded offset — a reviewer selecting rendered
-       *     text, say — leaves [`TextLocation::range`] empty and fills
-       *     [`TextLocation::source`] instead, which the engine
-       *     reverse-resolves. The other three have no such alternative:
-       *     their coordinates are the only way in.
+       *     Text carries either coordinate kind of [`TextCoord`]: a
+       *     [`Decoded`] span for a caller with an offset into the
+       *     decoded stream, or a [`Source`] one for a caller holding
+       *     only raw file bytes — a reviewer selecting rendered text,
+       *     say — which the engine reverse-resolves. Source-only is its
+       *     own kind rather than a decoded span left empty, so such a
+       *     selection is representable as itself.
        *
-       *     [`TextLocation::range`]: elide::modality::text::TextLocation::range
-       *     [`TextLocation::source`]: elide::modality::text::TextLocation::source
+       *     The other three media have no such alternative: their
+       *     coordinates are the only way in.
+       *
+       *     [`TextCoord`]: elide::modality::text::TextCoord
+       *     [`Decoded`]: elide::modality::text::TextCoord::Decoded
+       *     [`Source`]: elide::modality::text::TextCoord::Source
        */
       location: components["schemas"]["TextLocation"];
       /**
@@ -15534,9 +16393,9 @@ interface components {
        *
        *     Nested media needs this: the report holds an embedded image
        *     as its own part, and an addition to one has nowhere to go
-       *     without naming it. Text usually does not — where a span came
-       *     from is already in `TextLocation::source`, which carries the
-       *     part alongside the raw range.
+       *     without naming it. Text usually does not — a source
+       *     reference already names the part it came from, alongside the
+       *     raw range.
        *
        *     `None` is an error when the request carried several
        *     documents, since there is then no sole document to mean.
@@ -16335,7 +17194,13 @@ interface components {
        */
       unreadCount: number;
     };
-    /** @description Request payload to update an account. */
+    /**
+     * @description Request payload to update an account's profile.
+     *
+     *     Credentials are not profile fields — a password and any linked providers are
+     *     managed through the account's identities (see the identity endpoints), never
+     *     here.
+     */
     UpdateAccount: {
       /** @description New display name (2-32 characters). */
       displayName?: string;
@@ -16344,8 +17209,6 @@ interface components {
        * @description New email address (must be valid email format).
        */
       emailAddress?: string;
-      /** @description A re-authenticated password change, when changing the password. */
-      password?: components["schemas"]["PasswordChange"];
       /** @description New account handle. */
       username?: components["schemas"]["Handle"];
     };
@@ -16883,8 +17746,12 @@ type Handle = Schemas$23["Handle"];
 type Account = Schemas$23["Account"];
 type PublicAccount = Schemas$23["PublicAccount"];
 type UpdateAccount = Schemas$23["UpdateAccount"];
-type PasswordChange = Schemas$23["PasswordChange"];
 type AccountRef = Schemas$23["AccountRef"];
+type AccountIdentities = Schemas$23["AccountIdentities"];
+type AccountIdentity = Schemas$23["AccountIdentity"];
+type IdentityProvider = Schemas$23["IdentityProvider"];
+type SetPassword = Schemas$23["SetPassword"];
+type OidcStartResponse = Schemas$23["OidcStartResponse"];
 //#endregion
 //#region src/datatypes/activity.d.ts
 type Schemas$22 = components["schemas"];
@@ -17044,7 +17911,6 @@ type TabularRetag = Schemas$18["TabularRetag"];
 type Schemas$17 = components["schemas"];
 type Login = Schemas$17["Login"];
 type Signup = Schemas$17["Signup"];
-type AuthToken = Schemas$17["AuthToken"];
 //#endregion
 //#region src/datatypes/catalog.d.ts
 type Schemas$16 = components["schemas"];
@@ -17081,6 +17947,7 @@ type ConnectionVerification = Schemas$14["ConnectionVerification"];
 type ImportFiles = Schemas$14["ImportFiles"];
 type PickedFile = Schemas$14["PickedFile"];
 type ExportFiles = Schemas$14["ExportFiles"];
+type PickerToken = Schemas$14["PickerToken"];
 type SyncMode = Schemas$14["SyncMode"];
 type SyncStatus = Schemas$14["SyncStatus"];
 type SyncTriggerType = Schemas$14["SyncTriggerType"];
@@ -17216,6 +18083,7 @@ type PolicyDraft = Schemas$3["PolicyDraft"];
 type CreatePolicy = Schemas$3["CreatePolicy"];
 type UpdatePolicy = Schemas$3["UpdatePolicy"];
 type PolicyRule = Schemas$3["PolicyRule"];
+type CustomMatcher = Schemas$3["CustomMatcher"];
 type PolicyTemplate = Schemas$3["PolicyTemplate"];
 type TemplateOrigin = Schemas$3["TemplateOrigin"];
 type HipaaDeidMethod = Schemas$3["HipaaDeidMethod"];
@@ -17282,5 +18150,5 @@ type Retention = Schemas["Retention"];
 type RetentionSettings = Schemas["RetentionSettings"];
 type RetentionOverride = Schemas["RetentionOverride"];
 //#endregion
-export { PolicyRule as $, WorkspaceActivityParams as $a, TextHint as $i, StartFileServiceOAuth as $n, EditSet as $r, ReplyInvite as $t, Color as A, RecognizerId as Aa, SourceSpan as Ai, RedactionResultPage as An, AudioEdit as Ar, NotificationPage as At, Label as B, ActivityFilterQuery as Ba, TabularManual as Bi, ConnectionVerification as Bn, AuditHash as Br, MemberSortField as Bt, Language as C, DetectionAnalytics as Ca, RangeOfUint as Ci, DetectionPage as Cn, Signup as Cr, DetectionCompletedParams as Ct, ScopeMetadata as D, ModelUsage as Da, RuleMatch as Di, RedactDetection as Dn, AudioAuditKind as Dr, MemberJoinedParams as Dt, Languages as E, DetectionTimeSeries as Ea, Report as Ei, PipelineDetectionsQuery as En, AudioAuditEvent as Er, MemberInvitedParams as Et, GdprArticle9Treatment as F, UsageAnalytics as Fa, TabularAuditLog as Fi, ConnectionConfig as Fn, AudioModel as Fr, UnreadStatus as Ft, LanguageTag as G, DetectionActivityParams as Ga, TextAdd as Gi, GcsCredentials as Gn, CodecParams as Gr, InviteCode as Gt, LabelLocale as H, ActivityPayload as Ha, TabularPattern as Hi, CreateConnection as Hn, Calibration as Hr, CreateInvite as Ht, GdprSensitiveScope as I, UsageReport as Ia, TabularEdit as Ii, ConnectionId as In, AudioPattern as Ir, UpdateNotificationSettings as It, PciDssPart as J, MemberActivityParams as Ja, TextAuditLog as Ji, OAuthStartResponse as Jn, DecodedSpan as Jr, InvitePreview as Jt, LocalizedText as K, FileActivityParams as Ka, TextAuditEvent as Ki, ImportFiles as Kn, Conflict as Kr, InviteExpiration as Kt, HipaaAccountNumbers as L, WorkspaceAnalytics as La, TabularEntity as Li, ConnectionPage as Ln, AudioRefinement as Lr, ListMembers as Lt, CreatePolicy as M, StorageKindEntry as Ma, TabularAdd as Mi, AuthenticatedProvider as Mn, AudioHint as Mr, NotificationSettings as Mt, DateGranularity as N, TokenCounts as Na, TabularAuditEvent as Ni, AzureCredentials as Nn, AudioLocation as Nr, RedactionCreatedParams as Nt, AudioRedaction as O, ModelUsageEntry as Oa, Selection as Oi, RedactionId as On, AudioAuditLog as Or, Notification as Ot, DateStyle as P, Usage as Pa, TabularAuditKind as Pi, Connection as Pn, AudioManual as Pr, UnreadCountEvent as Pt, PolicyDraft as Q, WebhookActivityParams as Qa, TextEntity as Qi, S3Credentials as Qn, Dpi as Qr, ListInvites as Qt, HipaaDeidMethod as R, Activity as Ra, TabularHint as Ri, ConnectionSync as Rn, AudioRetag as Rr, Member as Rt, CountryCode as S, UpdateApiToken as Sa, Polygon as Si, DetectionMetadata as Sn, Login as Sr, ConnectionSyncFailedParams as St, LanguageSpan as T, DetectionStatusEntry as Ta, Redaction as Ti, DetectionStatusEvent as Tn, AudioAdd as Tr, MarkedReadStatus as Tt, LabelRef as U, ActivityType as Ua, TabularRefinement as Ui, ExportFiles as Un, Category as Ur, GenerateInviteCode as Ut, LabelEntry as V, ActivityPage as Va, TabularModel as Vi, ConnectionsQuery as Vn, BoundingBox as Vr, UpdateMember as Vt, LabelScope as W, ConnectionActivityParams as Wa, TabularRetag as Wi, FileServiceConfig as Wn, CitedAttribution as Wr, Invite as Wt, Policy as X, PolicyActivityParams as Xa, TextData as Xi, PickedFile as Xn, Dimensions as Xr, InviteSortField as Xt, PciPanRender as Y, PipelineActivityParams as Ya, TextCoord as Yi, OAuthTokens as Yn, Deduplication as Yr, InviteSent as Yt, PolicyDefinition as Z, RedactionActivityParams as Za, TextEdit as Zi, Provider as Zn, DocumentContext as Zr, InviteStatus as Zt, WebhookId as _, ApiTokenPage as _a, ManualIntent as _i, ErrorResponse as _n, FileProviders as _r, PipelineSummaryPage as _t, RetentionSettings as a, TextRetag as aa, ImageAuditLog as ai, DeletedFiles as an, UpdateAccount as ao, SyncStatus as ar, TabularRedaction as at, WebhookStatus as b, CreateApiToken as ba, PatternEvent as bi, Detection as bn, RegisteredRecognizer as br, CursorPagination as bt, WorkspacePage as c, Layout as ca, ImageEntity as ci, FileKind as cn, UpdateConnection as cr, TextRedaction as ct, CreateWebhook as d, Token as da, ImageManual as di, ListFiles as dn, ChatSession as dr, CreatePipeline as dt, TextLocation as ea, EntityCoRef as ei, SortOrder as en, Account as eo, StorageConfig as er, PolicySummary as et, TestWebhook as f, Tokens as fa, ImageModel as fi, ModalityToken as fn, ChatSessionPage as fr, Pipeline as ft, WebhookEvent as g, ApiToken as ga, LeakProfile as gi, ExportQuery as gn, ConnectorCatalog as gr, PipelineSummary as gt, WebhookCreated as h, Transcription as ha, ImageRetag as hi, ExportFormat as hn, SendChatMessage as hr, PipelineStatus as ht, RetentionOverride as i, TextRefinement as ia, ImageAuditKind as ii, DeleteFiles as in, PublicAccount as io, SyncScheduleInput as ir, Sha2Algorithm as it, ConfidenceThreshold as j, StorageAnalytics as ja, Suppress as ji, WorkspaceDetectionsQuery as jn, AudioEntity as jr, NotificationPayload as jt, ClampBucket as k, ProviderType as ka, SourceRef as ki, RedactionResult as kn, AudioData as kr, NotificationEvent as kt, WorkspaceRole as l, LayoutBlock as la, ImageHint as li, FilePage as ln, ChatMessage as lr, UpdatePolicy as lt, Webhook as m, TranscriptWord as ma, ImageRefinement as mi, DateWindow as mn, CreateChatSession as mr, PipelineFilter as mt, RasterPolicy as n, TextModel as na, ImageAdd as ni, Health as nn, Handle as no, SyncMode as nr, PolicyTemplate as nt, UpdateWorkspace as o, TimeSpan as oa, ImageData as oi, File as on, paths as oo, SyncTriggerType as or, TemplateOrigin as ot, UpdateWebhook as p, TranscriptSegment as pa, ImagePattern as pi, UpdateFile as pn, ChatToken as pr, PipelineDefinition as pt, ModalityRedactions as q, InviteActivityParams as qa, TextAuditKind as qi, LlmConfig as qn, Contested as qr, InvitePage as qt, Retention as r, TextPattern as ra, ImageAuditEvent as ri, HealthStatus as rn, PasswordChange as ro, SyncSchedule as rr, Predicate as rt, Workspace as s, ArtifactSet as sa, ImageEdit as si, FileHash as sn, UnauthenticatedProvider as sr, TerminalFallback as st, CreateWorkspace as t, TextManual as ta, FreeformAttribution as ti, ComponentHealth as tn, AccountRef as to, SyncDeletionPolicy as tr, PolicySummaryPage as tt, WorkspaceSettings as u, LayoutWord as ua, ImageLocation as ui, FormatToken as un, ChatRole as ur, Waveform as ut, WebhookPage as v, ApiTokenType as va, ModelEvent as vi, ValidationErrorDetail as vn, LabelCatalog as vr, PipelineTriggerType as vt, LanguageProvenance as w, DetectionDayEntry as wa, RasterMode as wi, DetectionStatus as wn, Attribution as wr, DetectionFailedParams as wt, Confidence as x, TokenExpiration as xa, Point as xi, DetectionId as xn, AuthToken as xr, ConnectionSyncCompletedParams as xt, WebhookResult as y, ApiTokenWithJWT as ya, OperatorId as yi, CreateDetection as yn, RecognizerCatalog as yr, UpdatePipeline as yt, ImageRedaction as z, ActivityExportOptions as za, TabularLocation as zi, ConnectionSyncPage as zn, Audit as zr, MemberPage as zt };
-//# sourceMappingURL=index-kr36ZsdV.d.ts.map
+export { PolicyDraft as $, WebhookActivityParams as $a, TextEntity as $i, Provider as $n, Dpi as $r, ListInvites as $t, Color as A, ProviderType as Aa, SourceRef as Ai, RedactionResult as An, AudioData as Ar, NotificationEvent as At, ImageRedaction as B, ActivityExportOptions as Ba, TabularLocation as Bi, ConnectionSyncPage as Bn, Audit as Br, MemberPage as Bt, Language as C, UpdateApiToken as Ca, Polygon as Ci, DetectionMetadata as Cn, Login as Cr, ConnectionSyncFailedParams as Ct, ScopeMetadata as D, DetectionTimeSeries as Da, Report as Di, PipelineDetectionsQuery as Dn, AudioAuditEvent as Dr, MemberInvitedParams as Dt, Languages as E, DetectionStatusEntry as Ea, Redaction as Ei, DetectionStatusEvent as En, AudioAdd as Er, MarkedReadStatus as Et, DateStyle as F, Usage as Fa, TabularAuditKind as Fi, Connection as Fn, AudioManual as Fr, UnreadCountEvent as Ft, LabelScope as G, ConnectionActivityParams as Ga, TabularRetag as Gi, FileServiceConfig as Gn, CitedAttribution as Gr, Invite as Gt, LabelEntry as H, ActivityPage as Ha, TabularModel as Hi, ConnectionsQuery as Hn, BoundingBox as Hr, UpdateMember as Ht, GdprArticle9Treatment as I, UsageAnalytics as Ia, TabularAuditLog as Ii, ConnectionConfig as In, AudioModel as Ir, UnreadStatus as It, ModalityRedactions as J, InviteActivityParams as Ja, TextAuditKind as Ji, LlmConfig as Jn, Contested as Jr, InvitePage as Jt, LanguageTag as K, DetectionActivityParams as Ka, TextAdd as Ki, GcsCredentials as Kn, CodecParams as Kr, InviteCode as Kt, GdprSensitiveScope as L, UsageReport as La, TabularEdit as Li, ConnectionId as Ln, AudioPattern as Lr, UpdateNotificationSettings as Lt, CreatePolicy as M, StorageAnalytics as Ma, Suppress as Mi, WorkspaceDetectionsQuery as Mn, AudioEntity as Mr, NotificationPayload as Mt, CustomMatcher as N, StorageKindEntry as Na, TabularAdd as Ni, AuthenticatedProvider as Nn, AudioHint as Nr, NotificationSettings as Nt, AudioRedaction as O, ModelUsage as Oa, RuleMatch as Oi, RedactDetection as On, AudioAuditKind as Or, MemberJoinedParams as Ot, DateGranularity as P, TokenCounts as Pa, TabularAuditEvent as Pi, AzureCredentials as Pn, AudioLocation as Pr, RedactionCreatedParams as Pt, PolicyDefinition as Q, RedactionActivityParams as Qa, TextEdit as Qi, PickerToken as Qn, DocumentContext as Qr, InviteStatus as Qt, HipaaAccountNumbers as R, WorkspaceAnalytics as Ra, TabularEntity as Ri, ConnectionPage as Rn, AudioRefinement as Rr, ListMembers as Rt, CountryCode as S, TokenExpiration as Sa, Point as Si, DetectionId as Sn, RegisteredRecognizer as Sr, ConnectionSyncCompletedParams as St, LanguageSpan as T, DetectionDayEntry as Ta, RasterMode as Ti, DetectionStatus as Tn, Attribution as Tr, DetectionFailedParams as Tt, LabelLocale as U, ActivityPayload as Ua, TabularPattern as Ui, CreateConnection as Un, Calibration as Ur, CreateInvite as Ut, Label as V, ActivityFilterQuery as Va, TabularManual as Vi, ConnectionVerification as Vn, AuditHash as Vr, MemberSortField as Vt, LabelRef as W, ActivityType as Wa, TabularRefinement as Wi, ExportFiles as Wn, Category as Wr, GenerateInviteCode as Wt, PciPanRender as X, PipelineActivityParams as Xa, TextCoord as Xi, OAuthTokens as Xn, Deduplication as Xr, InviteSent as Xt, PciDssPart as Y, MemberActivityParams as Ya, TextAuditLog as Yi, OAuthStartResponse as Yn, DecodedSpan as Yr, InvitePreview as Yt, Policy as Z, PolicyActivityParams as Za, TextData as Zi, PickedFile as Zn, Dimensions as Zr, InviteSortField as Zt, WebhookId as _, ApiToken as _a, LeakProfile as _i, ExportQuery as _n, SendChatMessage as _r, PipelineSummary as _t, RetentionSettings as a, TextRefinement as aa, ImageAuditKind as ai, DeleteFiles as an, Handle as ao, SyncSchedule as ar, Sha2Algorithm as at, WebhookStatus as b, ApiTokenWithJWT as ba, OperatorId as bi, CreateDetection as bn, LabelCatalog as br, UpdatePipeline as bt, WorkspacePage as c, ArtifactSet as ca, ImageEdit as ci, FileHash as cn, PublicAccount as co, SyncTriggerType as cr, TerminalFallback as ct, CreateWebhook as d, LayoutWord as da, ImageLocation as di, FormatToken as dn, paths as do, ChatMessage as dr, Waveform as dt, TextHint as ea, EditSet as ei, ReplyInvite as en, WorkspaceActivityParams as eo, S3Credentials as er, PolicyRule as et, TestWebhook as f, Token as fa, ImageManual as fi, ListFiles as fn, ChatRole as fr, CreatePipeline as ft, WebhookEvent as g, Transcription as ga, ImageRetag as gi, ExportFormat as gn, CreateChatSession as gr, PipelineStatus as gt, WebhookCreated as h, TranscriptWord as ha, ImageRefinement as hi, DateWindow as hn, ChatToken as hr, PipelineFilter as ht, RetentionOverride as i, TextPattern as ia, ImageAuditEvent as ii, HealthStatus as in, AccountRef as io, SyncMode as ir, Predicate as it, ConfidenceThreshold as j, RecognizerId as ja, SourceSpan as ji, RedactionResultPage as jn, AudioEdit as jr, NotificationPage as jt, ClampBucket as k, ModelUsageEntry as ka, Selection as ki, RedactionId as kn, AudioAuditLog as kr, Notification as kt, WorkspaceRole as l, Layout as la, ImageEntity as li, FileKind as ln, SetPassword as lo, UnauthenticatedProvider as lr, TextRedaction as lt, Webhook as m, TranscriptSegment as ma, ImagePattern as mi, UpdateFile as mn, ChatSessionPage as mr, PipelineDefinition as mt, RasterPolicy as n, TextManual as na, FreeformAttribution as ni, ComponentHealth as nn, AccountIdentities as no, StorageConfig as nr, PolicySummaryPage as nt, UpdateWorkspace as o, TextRetag as oa, ImageAuditLog as oi, DeletedFiles as on, IdentityProvider as oo, SyncScheduleInput as or, TabularRedaction as ot, UpdateWebhook as p, Tokens as pa, ImageModel as pi, ModalityToken as pn, ChatSession as pr, Pipeline as pt, LocalizedText as q, FileActivityParams as qa, TextAuditEvent as qi, ImportFiles as qn, Conflict as qr, InviteExpiration as qt, Retention as r, TextModel as ra, ImageAdd as ri, Health as rn, AccountIdentity as ro, SyncDeletionPolicy as rr, PolicyTemplate as rt, Workspace as s, TimeSpan as sa, ImageData as si, File as sn, OidcStartResponse as so, SyncStatus as sr, TemplateOrigin as st, CreateWorkspace as t, TextLocation as ta, EntityCoRef as ti, SortOrder as tn, Account as to, StartFileServiceOAuth as tr, PolicySummary as tt, WorkspaceSettings as u, LayoutBlock as ua, ImageHint as ui, FilePage as un, UpdateAccount as uo, UpdateConnection as ur, UpdatePolicy as ut, WebhookPage as v, ApiTokenPage as va, ManualIntent as vi, ErrorResponse as vn, ConnectorCatalog as vr, PipelineSummaryPage as vt, LanguageProvenance as w, DetectionAnalytics as wa, RangeOfUint as wi, DetectionPage as wn, Signup as wr, DetectionCompletedParams as wt, Confidence as x, CreateApiToken as xa, PatternEvent as xi, Detection as xn, RecognizerCatalog as xr, CursorPagination as xt, WebhookResult as y, ApiTokenType as ya, ModelEvent as yi, ValidationErrorDetail as yn, FileProviders as yr, PipelineTriggerType as yt, HipaaDeidMethod as z, Activity as za, TabularHint as zi, ConnectionSync as zn, AudioRetag as zr, Member as zt };
+//# sourceMappingURL=index-B-oR9rqQ.d.ts.map