@orvello/sdk 0.2.4 → 0.4.0

package/dist/openapi.json

@@ -8486,6 +8486,385 @@
         ]
       }
     },
+    "/invoices/external/:invoiceId/payment-evidence": {
+      "get": {
+        "operationId": "invoices_payment_evidence_external",
+        "tags": [
+          "invoices-external"
+        ],
+        "summary": "Read bank payment evidence for an invoice",
+        "description": "Consistent read-only snapshot of imported bank payments and refunds. Separates cash from discounts, writeoffs and manual paid marks. Decimal amounts are strings. bankPaymentConfirmed requires full matching-account/currency bank coverage without unresolved issues. revision is a content digest, not an ordered event version. No bank import or payment is initiated.",
+        "responses": {
+          "200": {
+            "description": "JSON response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "message": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "code": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "data": {
+                      "anyOf": [
+                        {
+                          "type": "object",
+                          "properties": {
+                            "invoiceId": {
+                              "type": "integer",
+                              "exclusiveMinimum": 0
+                            },
+                            "invoiceNumber": {
+                              "type": "string"
+                            },
+                            "currency": {
+                              "type": "string"
+                            },
+                            "invoiceStatus": {
+                              "type": "string"
+                            },
+                            "paidSource": {
+                              "anyOf": [
+                                {
+                                  "type": "string"
+                                },
+                                {
+                                  "type": "null"
+                                }
+                              ]
+                            },
+                            "receivingAccountId": {
+                              "anyOf": [
+                                {
+                                  "type": "integer",
+                                  "exclusiveMinimum": 0
+                                },
+                                {
+                                  "type": "null"
+                                }
+                              ]
+                            },
+                            "invoiceAmount": {
+                              "type": "string"
+                            },
+                            "bankReceivedAmount": {
+                              "type": "string"
+                            },
+                            "bankRefundedAmount": {
+                              "type": "string"
+                            },
+                            "bankNetAmount": {
+                              "type": "string"
+                            },
+                            "nonCashSettlementAmount": {
+                              "type": "string"
+                            },
+                            "outstandingBankAmount": {
+                              "type": "string"
+                            },
+                            "overpaidBankAmount": {
+                              "type": "string"
+                            },
+                            "state": {
+                              "type": "string",
+                              "enum": [
+                                "unpaid",
+                                "partial",
+                                "covered",
+                                "overpaid",
+                                "review_required",
+                                "ineligible"
+                              ]
+                            },
+                            "bankPaymentConfirmed": {
+                              "type": "boolean"
+                            },
+                            "issues": {
+                              "type": "array",
+                              "items": {
+                                "type": "string",
+                                "enum": [
+                                  "missing_receiving_account",
+                                  "invalid_invoice_amount",
+                                  "ineligible_invoice",
+                                  "missing_payment",
+                                  "wrong_account",
+                                  "currency_mismatch",
+                                  "invalid_amount",
+                                  "unsupported_source",
+                                  "invalid_direction",
+                                  "payment_overallocated",
+                                  "non_cash_settlement",
+                                  "status_without_bank_evidence",
+                                  "negative_bank_balance"
+                                ]
+                              }
+                            },
+                            "bankAllocationIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "integer",
+                                "exclusiveMinimum": 0
+                              }
+                            },
+                            "excludedAllocationIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "integer",
+                                "exclusiveMinimum": 0
+                              }
+                            },
+                            "reversedAllocationCount": {
+                              "type": "integer",
+                              "minimum": 0
+                            },
+                            "revision": {
+                              "type": "string",
+                              "pattern": "^[a-f0-9]{64}$"
+                            },
+                            "observedAt": {
+                              "type": "string",
+                              "format": "date-time"
+                            }
+                          },
+                          "required": [
+                            "invoiceId",
+                            "invoiceNumber",
+                            "currency",
+                            "invoiceStatus",
+                            "paidSource",
+                            "receivingAccountId",
+                            "invoiceAmount",
+                            "bankReceivedAmount",
+                            "bankRefundedAmount",
+                            "bankNetAmount",
+                            "nonCashSettlementAmount",
+                            "outstandingBankAmount",
+                            "overpaidBankAmount",
+                            "state",
+                            "bankPaymentConfirmed",
+                            "issues",
+                            "bankAllocationIds",
+                            "excludedAllocationIds",
+                            "reversedAllocationCount",
+                            "revision",
+                            "observedAt"
+                          ],
+                          "additionalProperties": false
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "invoiceId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "integer",
+              "exclusiveMinimum": 0
+            }
+          }
+        ],
+        "security": [
+          {
+            "oauth2Bearer": []
+          },
+          {
+            "companyApiKeyBearer": []
+          }
+        ],
+        "x-auth": {
+          "allowOAuth2": true,
+          "allowApiKey": true,
+          "allowUserSession": false,
+          "requireRole": "viewer"
+        },
+        "x-scopes": [
+          "invoices:read"
+        ]
+      }
+    },
+    "/invoices/external/:invoiceId/payment-instructions": {
+      "get": {
+        "operationId": "invoices_payment_instructions_external",
+        "tags": [
+          "invoices-external"
+        ],
+        "summary": "Read immutable bank payment instructions",
+        "description": "Reference and recipient frozen on first issue. Decimal amount is a string. Historical invoices without a snapshot return 409; no reference is created by reading. This is not evidence of payment or permission to provision.",
+        "responses": {
+          "200": {
+            "description": "JSON response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "message": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "code": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "data": {
+                      "anyOf": [
+                        {
+                          "type": "object",
+                          "properties": {
+                            "invoiceId": {
+                              "type": "integer",
+                              "exclusiveMinimum": 0
+                            },
+                            "reference": {
+                              "type": "string"
+                            },
+                            "accountOwner": {
+                              "type": "string"
+                            },
+                            "iban": {
+                              "type": "string"
+                            },
+                            "bic": {
+                              "anyOf": [
+                                {
+                                  "type": "string"
+                                },
+                                {
+                                  "type": "null"
+                                }
+                              ]
+                            },
+                            "bankName": {
+                              "anyOf": [
+                                {
+                                  "type": "string"
+                                },
+                                {
+                                  "type": "null"
+                                }
+                              ]
+                            },
+                            "currency": {
+                              "type": "string"
+                            },
+                            "invoiceAmount": {
+                              "type": "string"
+                            },
+                            "createdAt": {
+                              "type": "string",
+                              "format": "date-time"
+                            }
+                          },
+                          "required": [
+                            "invoiceId",
+                            "reference",
+                            "accountOwner",
+                            "iban",
+                            "bic",
+                            "bankName",
+                            "currency",
+                            "invoiceAmount",
+                            "createdAt"
+                          ],
+                          "additionalProperties": false
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "invoiceId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "integer",
+              "exclusiveMinimum": 0
+            }
+          }
+        ],
+        "security": [
+          {
+            "oauth2Bearer": []
+          },
+          {
+            "companyApiKeyBearer": []
+          }
+        ],
+        "x-auth": {
+          "allowOAuth2": true,
+          "allowApiKey": true,
+          "allowUserSession": false,
+          "requireRole": "viewer"
+        },
+        "x-scopes": [
+          "invoices:read"
+        ]
+      }
+    },
     "/invoices/external": {
       "get": {
         "operationId": "invoices_search_external",
@@ -58254,13 +58633,13 @@
         }
       }
     },
-    "/auth/register": {
+    "/auth/mfa/complete": {
       "post": {
-        "operationId": "auth_register",
+        "operationId": "auth_mfa_complete",
         "tags": [
           "auth"
         ],
-        "summary": "Register a new direct-auth account",
+        "summary": "Complete a first-factor login with TOTP or a recovery code",
         "responses": {
           "200": {
             "description": "JSON response",
@@ -58318,25 +58697,28 @@
               "schema": {
                 "type": "object",
                 "properties": {
-                  "email": {
+                  "challengeToken": {
                     "type": "string",
-                    "format": "email",
-                    "maxLength": 320
+                    "minLength": 32,
+                    "maxLength": 128
                   },
-                  "password": {
+                  "code": {
                     "type": "string",
-                    "minLength": 8,
-                    "maxLength": 256
+                    "minLength": 6,
+                    "maxLength": 64
                   },
-                  "name": {
+                  "kind": {
                     "type": "string",
-                    "minLength": 1,
-                    "maxLength": 200
+                    "enum": [
+                      "totp",
+                      "recovery"
+                    ],
+                    "default": "totp"
                   }
                 },
                 "required": [
-                  "email",
-                  "password"
+                  "challengeToken",
+                  "code"
                 ],
                 "additionalProperties": false
               }
@@ -58345,13 +58727,13 @@
         }
       }
     },
-    "/auth/login": {
-      "post": {
-        "operationId": "auth_login",
+    "/auth/mfa": {
+      "get": {
+        "operationId": "auth_mfa_status",
         "tags": [
           "auth"
         ],
-        "summary": "Log in with email + password",
+        "summary": "Read the current product account's MFA status",
         "responses": {
           "200": {
             "description": "JSON response",
@@ -58385,7 +58767,29 @@
                     },
                     "data": {
                       "anyOf": [
-                        {},
+                        {
+                          "type": "object",
+                          "properties": {
+                            "enabled": {
+                              "type": "boolean"
+                            },
+                            "methods": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              }
+                            },
+                            "recoveryCodesRemaining": {
+                              "type": "number"
+                            }
+                          },
+                          "required": [
+                            "enabled",
+                            "methods",
+                            "recoveryCodesRemaining"
+                          ],
+                          "additionalProperties": false
+                        },
                         {
                           "type": "null"
                         }
@@ -58402,42 +58806,21 @@
             }
           }
         },
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object",
-                "properties": {
-                  "email": {
-                    "type": "string",
-                    "format": "email",
-                    "maxLength": 320
-                  },
-                  "password": {
-                    "type": "string",
-                    "minLength": 8,
-                    "maxLength": 256
-                  }
-                },
-                "required": [
-                  "email",
-                  "password"
-                ],
-                "additionalProperties": false
-              }
-            }
+        "security": [
+          {
+            "frontendBearer": []
           }
-        }
+        ],
+        "x-transport": "http"
       }
     },
-    "/auth/refresh": {
+    "/auth/mfa/setup": {
       "post": {
-        "operationId": "auth_refresh",
+        "operationId": "auth_mfa_setup",
         "tags": [
           "auth"
         ],
-        "summary": "Rotate access + refresh tokens",
+        "summary": "Prepare TOTP enrollment after rechecking the password",
         "responses": {
           "200": {
             "description": "JSON response",
@@ -58471,7 +58854,26 @@
                     },
                     "data": {
                       "anyOf": [
-                        {},
+                        {
+                          "type": "object",
+                          "properties": {
+                            "secret": {
+                              "type": "string"
+                            },
+                            "otpauthUri": {
+                              "type": "string"
+                            },
+                            "expiresAt": {
+                              "type": "string"
+                            }
+                          },
+                          "required": [
+                            "secret",
+                            "otpauthUri",
+                            "expiresAt"
+                          ],
+                          "additionalProperties": false
+                        },
                         {
                           "type": "null"
                         }
@@ -58495,30 +58897,37 @@
               "schema": {
                 "type": "object",
                 "properties": {
-                  "refreshToken": {
+                  "password": {
                     "type": "string",
-                    "minLength": 20
+                    "minLength": 8,
+                    "maxLength": 256
                   }
                 },
                 "required": [
-                  "refreshToken"
+                  "password"
                 ],
                 "additionalProperties": false
               }
             }
           }
-        }
+        },
+        "security": [
+          {
+            "frontendBearer": []
+          }
+        ],
+        "x-transport": "http"
       }
     },
-    "/auth/logout": {
+    "/auth/mfa/enable": {
       "post": {
-        "operationId": "auth_logout",
+        "operationId": "auth_mfa_enable",
         "tags": [
           "auth"
         ],
-        "summary": "Revoke the current refresh token",
+        "summary": "Confirm TOTP enrollment and return recovery codes once",
         "responses": {
-          "204": {
+          "200": {
             "description": "JSON response",
             "content": {
               "application/json": {
@@ -58552,7 +58961,25 @@
                       "anyOf": [
                         {
                           "type": "object",
-                          "properties": {},
+                          "properties": {
+                            "enabled": {
+                              "type": "boolean"
+                            },
+                            "recoveryCodes": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              }
+                            },
+                            "reauthenticationRequired": {
+                              "type": "boolean"
+                            }
+                          },
+                          "required": [
+                            "enabled",
+                            "recoveryCodes",
+                            "reauthenticationRequired"
+                          ],
                           "additionalProperties": false
                         },
                         {
@@ -58578,25 +59005,34 @@
               "schema": {
                 "type": "object",
                 "properties": {
-                  "refreshToken": {
+                  "code": {
                     "type": "string",
-                    "minLength": 20
+                    "pattern": "^\\d{6}$"
                   }
                 },
+                "required": [
+                  "code"
+                ],
                 "additionalProperties": false
               }
             }
           }
-        }
+        },
+        "security": [
+          {
+            "frontendBearer": []
+          }
+        ],
+        "x-transport": "http"
       }
     },
-    "/auth/me": {
-      "get": {
-        "operationId": "auth_me",
+    "/auth/mfa/disable": {
+      "post": {
+        "operationId": "auth_mfa_disable",
         "tags": [
           "auth"
         ],
-        "summary": "Get the current user incl. roles and isAdmin (Bearer access JWT)",
+        "summary": "Disable MFA using both the password and a second factor",
         "responses": {
           "200": {
             "description": "JSON response",
@@ -58630,7 +59066,22 @@
                     },
                     "data": {
                       "anyOf": [
-                        {},
+                        {
+                          "type": "object",
+                          "properties": {
+                            "ok": {
+                              "type": "boolean"
+                            },
+                            "reauthenticationRequired": {
+                              "type": "boolean"
+                            }
+                          },
+                          "required": [
+                            "ok",
+                            "reauthenticationRequired"
+                          ],
+                          "additionalProperties": false
+                        },
                         {
                           "type": "null"
                         }
@@ -58647,6 +59098,41 @@
             }
           }
         },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "password": {
+                    "type": "string",
+                    "minLength": 8,
+                    "maxLength": 256
+                  },
+                  "code": {
+                    "type": "string",
+                    "minLength": 6,
+                    "maxLength": 64
+                  },
+                  "kind": {
+                    "type": "string",
+                    "enum": [
+                      "totp",
+                      "recovery"
+                    ],
+                    "default": "totp"
+                  }
+                },
+                "required": [
+                  "password",
+                  "code"
+                ],
+                "additionalProperties": false
+              }
+            }
+          }
+        },
         "security": [
           {
             "frontendBearer": []
@@ -58655,13 +59141,13 @@
         "x-transport": "http"
       }
     },
-    "/auth/me/profile": {
-      "patch": {
-        "operationId": "auth_me_profile_update",
+    "/auth/register": {
+      "post": {
+        "operationId": "auth_register",
         "tags": [
           "auth"
         ],
-        "summary": "Update the current user's own profile (name, avatar)",
+        "summary": "Register a new direct-auth account",
         "responses": {
           "200": {
             "description": "JSON response",
@@ -58719,99 +59205,92 @@
               "schema": {
                 "type": "object",
                 "properties": {
+                  "email": {
+                    "type": "string",
+                    "format": "email",
+                    "maxLength": 320
+                  },
+                  "password": {
+                    "type": "string",
+                    "minLength": 8,
+                    "maxLength": 256
+                  },
                   "name": {
                     "type": "string",
                     "minLength": 1,
                     "maxLength": 200
                   },
-                  "avatarStyle": {
-                    "anyOf": [
-                      {
-                        "type": "object",
-                        "properties": {
-                          "seed": {
-                            "type": "string",
-                            "minLength": 1,
-                            "maxLength": 200
-                          },
-                          "hue": {
-                            "type": "integer",
-                            "minimum": 0,
-                            "maximum": 359
-                          },
-                          "shape": {
-                            "type": "string",
-                            "enum": [
-                              "round",
-                              "organic",
-                              "boxy",
-                              "nub",
-                              "cloud",
-                              "sun",
-                              "capsule",
-                              "triangle",
-                              "hexagon",
-                              "droplet"
-                            ]
-                          },
-                          "expression": {
-                            "type": "string",
-                            "enum": [
-                              "idle",
-                              "happy",
-                              "sad",
-                              "mad",
-                              "surprised",
-                              "wink",
-                              "sleepy",
-                              "smug",
-                              "unsure",
-                              "scared",
-                              "love",
-                              "shy",
-                              "sick",
-                              "thinking"
-                            ]
-                          },
-                          "background": {
-                            "type": "string",
-                            "enum": [
-                              "none",
-                              "squircle",
-                              "circle"
-                            ]
-                          }
-                        },
-                        "additionalProperties": false
+                  "firstName": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 100
+                  },
+                  "lastName": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 100
+                  },
+                  "device": {
+                    "type": "object",
+                    "properties": {
+                      "deviceId": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 200
                       },
-                      {
-                        "type": "null"
+                      "deviceName": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 200
+                      },
+                      "deviceModel": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 200
+                      },
+                      "deviceOs": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 200
+                      },
+                      "appVersion": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 100
+                      },
+                      "platform": {
+                        "type": "string",
+                        "enum": [
+                          "ios",
+                          "android",
+                          "web",
+                          "expo"
+                        ]
                       }
-                    ]
+                    },
+                    "additionalProperties": false
                   }
                 },
+                "required": [
+                  "email",
+                  "password"
+                ],
                 "additionalProperties": false
               }
             }
           }
-        },
-        "security": [
-          {
-            "frontendBearer": []
-          }
-        ],
-        "x-transport": "http"
+        }
       }
     },
-    "/auth/push-token": {
+    "/auth/login": {
       "post": {
-        "operationId": "auth_push_token_upsert",
+        "operationId": "auth_login",
         "tags": [
           "auth"
         ],
-        "summary": "Register a device push token for the current user",
+        "summary": "Log in with email + password",
         "responses": {
-          "204": {
+          "200": {
             "description": "JSON response",
             "content": {
               "application/json": {
@@ -58843,11 +59322,7 @@
                     },
                     "data": {
                       "anyOf": [
-                        {
-                          "type": "object",
-                          "properties": {},
-                          "additionalProperties": false
-                        },
+                        {},
                         {
                           "type": "null"
                         }
@@ -58871,45 +59346,75 @@
               "schema": {
                 "type": "object",
                 "properties": {
-                  "token": {
+                  "email": {
                     "type": "string",
-                    "minLength": 1,
-                    "maxLength": 500
+                    "format": "email",
+                    "maxLength": 320
                   },
-                  "platform": {
+                  "password": {
                     "type": "string",
-                    "enum": [
-                      "ios",
-                      "android",
-                      "web",
-                      "expo"
-                    ]
+                    "minLength": 8,
+                    "maxLength": 256
+                  },
+                  "device": {
+                    "type": "object",
+                    "properties": {
+                      "deviceId": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 200
+                      },
+                      "deviceName": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 200
+                      },
+                      "deviceModel": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 200
+                      },
+                      "deviceOs": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 200
+                      },
+                      "appVersion": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 100
+                      },
+                      "platform": {
+                        "type": "string",
+                        "enum": [
+                          "ios",
+                          "android",
+                          "web",
+                          "expo"
+                        ]
+                      }
+                    },
+                    "additionalProperties": false
                   }
                 },
                 "required": [
-                  "token",
-                  "platform"
+                  "email",
+                  "password"
                 ],
                 "additionalProperties": false
               }
             }
           }
-        },
-        "security": [
-          {
-            "frontendBearer": []
-          }
-        ],
-        "x-transport": "http"
+        }
       }
     },
-    "/auth/verify-email/request": {
+    "/auth/refresh": {
       "post": {
-        "operationId": "auth_verify_email_request",
+        "operationId": "auth_refresh",
         "tags": [
           "auth"
         ],
-        "summary": "Send a fresh email-verification link to the current user",
+        "summary": "Rotate access + refresh tokens",
         "responses": {
           "200": {
             "description": "JSON response",
@@ -58966,29 +59471,71 @@
             "application/json": {
               "schema": {
                 "type": "object",
-                "properties": {},
+                "properties": {
+                  "refreshToken": {
+                    "type": "string",
+                    "minLength": 20
+                  },
+                  "device": {
+                    "type": "object",
+                    "properties": {
+                      "deviceId": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 200
+                      },
+                      "deviceName": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 200
+                      },
+                      "deviceModel": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 200
+                      },
+                      "deviceOs": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 200
+                      },
+                      "appVersion": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 100
+                      },
+                      "platform": {
+                        "type": "string",
+                        "enum": [
+                          "ios",
+                          "android",
+                          "web",
+                          "expo"
+                        ]
+                      }
+                    },
+                    "additionalProperties": false
+                  }
+                },
+                "required": [
+                  "refreshToken"
+                ],
                 "additionalProperties": false
               }
             }
           }
-        },
-        "security": [
-          {
-            "frontendBearer": []
-          }
-        ],
-        "x-transport": "http"
+        }
       }
     },
-    "/auth/verify-email/confirm": {
+    "/auth/logout": {
       "post": {
-        "operationId": "auth_verify_email_confirm",
+        "operationId": "auth_logout",
         "tags": [
           "auth"
         ],
-        "summary": "Confirm an email-verification token (programmatic / deep-link flow)",
+        "summary": "Revoke the current refresh token",
         "responses": {
-          "200": {
+          "204": {
             "description": "JSON response",
             "content": {
               "application/json": {
@@ -59020,7 +59567,11 @@
                     },
                     "data": {
                       "anyOf": [
-                        {},
+                        {
+                          "type": "object",
+                          "properties": {},
+                          "additionalProperties": false
+                        },
                         {
                           "type": "null"
                         }
@@ -59044,15 +59595,11 @@
               "schema": {
                 "type": "object",
                 "properties": {
-                  "token": {
+                  "refreshToken": {
                     "type": "string",
-                    "minLength": 20,
-                    "maxLength": 500
+                    "minLength": 20
                   }
                 },
-                "required": [
-                  "token"
-                ],
                 "additionalProperties": false
               }
             }
@@ -59060,31 +59607,924 @@
         }
       }
     },
-    "/auth/verify-email": {
+    "/auth/me": {
       "get": {
-        "operationId": "auth_verify_email_landing",
+        "operationId": "auth_me",
         "tags": [
           "auth"
         ],
-        "summary": "Browser landing page that consumes the verification token",
+        "summary": "Get the current user incl. roles and isAdmin (Bearer access JWT)",
         "responses": {
           "200": {
-            "description": "Binary response",
+            "description": "JSON response",
             "content": {
-              "text/html": {
+              "application/json": {
                 "schema": {
-                  "type": "string",
-                  "format": "binary"
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "message": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "code": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "data": {
+                      "anyOf": [
+                        {},
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ],
+                  "additionalProperties": false
                 }
               }
             }
           }
         },
-        "parameters": [
+        "security": [
           {
-            "name": "token",
-            "in": "query",
-            "required": false,
+            "frontendBearer": []
+          }
+        ],
+        "x-transport": "http"
+      }
+    },
+    "/auth/me/profile": {
+      "patch": {
+        "operationId": "auth_me_profile_update",
+        "tags": [
+          "auth"
+        ],
+        "summary": "Update the current user's own profile (name, avatar)",
+        "responses": {
+          "200": {
+            "description": "JSON response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "message": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "code": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "data": {
+                      "anyOf": [
+                        {},
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "avatarStyle": {
+                    "anyOf": [
+                      {
+                        "type": "object",
+                        "properties": {
+                          "seed": {
+                            "type": "string",
+                            "minLength": 1,
+                            "maxLength": 200
+                          },
+                          "hue": {
+                            "type": "integer",
+                            "minimum": 0,
+                            "maximum": 359
+                          },
+                          "shape": {
+                            "type": "string",
+                            "enum": [
+                              "round",
+                              "organic",
+                              "boxy",
+                              "nub",
+                              "cloud",
+                              "sun",
+                              "capsule",
+                              "triangle",
+                              "hexagon",
+                              "droplet"
+                            ]
+                          },
+                          "expression": {
+                            "type": "string",
+                            "enum": [
+                              "idle",
+                              "happy",
+                              "sad",
+                              "mad",
+                              "surprised",
+                              "wink",
+                              "sleepy",
+                              "smug",
+                              "unsure",
+                              "scared",
+                              "love",
+                              "shy",
+                              "sick",
+                              "thinking"
+                            ]
+                          },
+                          "background": {
+                            "type": "string",
+                            "enum": [
+                              "none",
+                              "squircle",
+                              "circle"
+                            ]
+                          }
+                        },
+                        "additionalProperties": false
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ]
+                  },
+                  "name": {
+                    "anyOf": [
+                      {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 200
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ]
+                  },
+                  "firstName": {
+                    "anyOf": [
+                      {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 100
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ]
+                  },
+                  "lastName": {
+                    "anyOf": [
+                      {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 100
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ]
+                  }
+                },
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "frontendBearer": []
+          }
+        ],
+        "x-transport": "http"
+      }
+    },
+    "/auth/push-token": {
+      "post": {
+        "operationId": "auth_push_token_upsert",
+        "tags": [
+          "auth"
+        ],
+        "summary": "Register a device push token for the current user",
+        "responses": {
+          "204": {
+            "description": "JSON response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "message": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "code": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "data": {
+                      "anyOf": [
+                        {
+                          "type": "object",
+                          "properties": {},
+                          "additionalProperties": false
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "token": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 500
+                  },
+                  "platform": {
+                    "type": "string",
+                    "enum": [
+                      "ios",
+                      "android",
+                      "web",
+                      "expo"
+                    ]
+                  }
+                },
+                "required": [
+                  "token",
+                  "platform"
+                ],
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "frontendBearer": []
+          }
+        ],
+        "x-transport": "http"
+      }
+    },
+    "/auth/verify-email/request": {
+      "post": {
+        "operationId": "auth_verify_email_request",
+        "tags": [
+          "auth"
+        ],
+        "summary": "Send a fresh email-verification link to the current user",
+        "responses": {
+          "200": {
+            "description": "JSON response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "message": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "code": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "data": {
+                      "anyOf": [
+                        {},
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {},
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "frontendBearer": []
+          }
+        ],
+        "x-transport": "http"
+      }
+    },
+    "/auth/verify-email/confirm": {
+      "post": {
+        "operationId": "auth_verify_email_confirm",
+        "tags": [
+          "auth"
+        ],
+        "summary": "Confirm an email-verification token (programmatic / deep-link flow)",
+        "responses": {
+          "200": {
+            "description": "JSON response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "message": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "code": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "data": {
+                      "anyOf": [
+                        {},
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "token": {
+                    "type": "string",
+                    "minLength": 20,
+                    "maxLength": 500
+                  }
+                },
+                "required": [
+                  "token"
+                ],
+                "additionalProperties": false
+              }
+            }
+          }
+        }
+      }
+    },
+    "/auth/verify-email": {
+      "get": {
+        "operationId": "auth_verify_email_landing",
+        "tags": [
+          "auth"
+        ],
+        "summary": "Browser landing page that consumes the verification token",
+        "responses": {
+          "200": {
+            "description": "Binary response",
+            "content": {
+              "text/html": {
+                "schema": {
+                  "type": "string",
+                  "format": "binary"
+                }
+              }
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "token",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 500
+            }
+          }
+        ]
+      }
+    },
+    "/auth/me/email": {
+      "patch": {
+        "operationId": "auth_me_email_patch",
+        "tags": [
+          "auth"
+        ],
+        "summary": "Change current user's email after password confirmation",
+        "responses": {
+          "200": {
+            "description": "JSON response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "message": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "code": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "data": {
+                      "anyOf": [
+                        {},
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "email": {
+                    "type": "string",
+                    "format": "email",
+                    "maxLength": 320
+                  },
+                  "password": {
+                    "type": "string",
+                    "minLength": 8,
+                    "maxLength": 256
+                  }
+                },
+                "required": [
+                  "email",
+                  "password"
+                ],
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "frontendBearer": []
+          }
+        ],
+        "x-transport": "http"
+      }
+    },
+    "/auth/password/change": {
+      "post": {
+        "operationId": "auth_password_change",
+        "tags": [
+          "auth"
+        ],
+        "summary": "Change password for the current user",
+        "responses": {
+          "200": {
+            "description": "JSON response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "message": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "code": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "data": {
+                      "anyOf": [
+                        {},
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "currentPassword": {
+                    "type": "string",
+                    "minLength": 8,
+                    "maxLength": 256
+                  },
+                  "newPassword": {
+                    "type": "string",
+                    "minLength": 8,
+                    "maxLength": 256
+                  },
+                  "revokeOtherSessions": {
+                    "type": "boolean",
+                    "default": true
+                  },
+                  "refreshToken": {
+                    "type": "string",
+                    "minLength": 20
+                  }
+                },
+                "required": [
+                  "currentPassword",
+                  "newPassword"
+                ],
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "frontendBearer": []
+          }
+        ],
+        "x-transport": "http"
+      }
+    },
+    "/auth/password/reset/request": {
+      "post": {
+        "operationId": "auth_password_reset_request",
+        "tags": [
+          "auth"
+        ],
+        "summary": "Request a password reset email",
+        "responses": {
+          "200": {
+            "description": "JSON response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "message": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "code": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "data": {
+                      "anyOf": [
+                        {},
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "email": {
+                    "type": "string",
+                    "format": "email",
+                    "maxLength": 320
+                  }
+                },
+                "required": [
+                  "email"
+                ],
+                "additionalProperties": false
+              }
+            }
+          }
+        }
+      }
+    },
+    "/auth/password/reset/confirm": {
+      "post": {
+        "operationId": "auth_password_reset_confirm",
+        "tags": [
+          "auth"
+        ],
+        "summary": "Reset password with an email token",
+        "responses": {
+          "200": {
+            "description": "JSON response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "message": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "code": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "data": {
+                      "anyOf": [
+                        {},
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "token": {
+                    "type": "string",
+                    "minLength": 20,
+                    "maxLength": 500
+                  },
+                  "newPassword": {
+                    "type": "string",
+                    "minLength": 8,
+                    "maxLength": 256
+                  }
+                },
+                "required": [
+                  "token",
+                  "newPassword"
+                ],
+                "additionalProperties": false
+              }
+            }
+          }
+        }
+      }
+    },
+    "/auth/password/reset": {
+      "get": {
+        "operationId": "auth_password_reset_landing",
+        "tags": [
+          "auth"
+        ],
+        "summary": "Browser landing page for password reset links",
+        "responses": {
+          "200": {
+            "description": "Binary response",
+            "content": {
+              "text/html": {
+                "schema": {
+                  "type": "string",
+                  "format": "binary"
+                }
+              }
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "token",
+            "in": "query",
+            "required": false,
             "schema": {
               "type": "string",
               "minLength": 1,
@@ -59094,6 +60534,232 @@
         ]
       }
     },
+    "/auth/sessions": {
+      "get": {
+        "operationId": "auth_sessions_list",
+        "tags": [
+          "auth"
+        ],
+        "summary": "List active refresh-token sessions for the current user",
+        "responses": {
+          "200": {
+            "description": "JSON response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "message": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "code": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "data": {
+                      "anyOf": [
+                        {},
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "frontendBearer": []
+          }
+        ],
+        "x-transport": "http"
+      }
+    },
+    "/auth/sessions/:sessionId": {
+      "delete": {
+        "operationId": "auth_sessions_revoke",
+        "tags": [
+          "auth"
+        ],
+        "summary": "Revoke one active session",
+        "responses": {
+          "200": {
+            "description": "JSON response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "message": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "code": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "data": {
+                      "anyOf": [
+                        {},
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "integer",
+              "exclusiveMinimum": 0
+            }
+          }
+        ],
+        "security": [
+          {
+            "frontendBearer": []
+          }
+        ],
+        "x-transport": "http"
+      }
+    },
+    "/auth/sessions/revoke-other": {
+      "post": {
+        "operationId": "auth_sessions_revoke_other",
+        "tags": [
+          "auth"
+        ],
+        "summary": "Revoke all sessions except the supplied current refresh token",
+        "responses": {
+          "200": {
+            "description": "JSON response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "message": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "code": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "data": {
+                      "anyOf": [
+                        {},
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "refreshToken": {
+                    "type": "string",
+                    "minLength": 20
+                  }
+                },
+                "required": [
+                  "refreshToken"
+                ],
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "frontendBearer": []
+          }
+        ],
+        "x-transport": "http"
+      }
+    },
     "/internal/users/provision": {
       "post": {
         "operationId": "internal_users_provision",