@orvello/sdk 0.3.0 → 0.4.0

package/dist/openapi.json

@@ -8718,6 +8718,153 @@
         ]
       }
     },
+    "/invoices/external/:invoiceId/payment-instructions": {
+      "get": {
+        "operationId": "invoices_payment_instructions_external",
+        "tags": [
+          "invoices-external"
+        ],
+        "summary": "Read immutable bank payment instructions",
+        "description": "Reference and recipient frozen on first issue. Decimal amount is a string. Historical invoices without a snapshot return 409; no reference is created by reading. This is not evidence of payment or permission to provision.",
+        "responses": {
+          "200": {
+            "description": "JSON response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "message": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "code": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "data": {
+                      "anyOf": [
+                        {
+                          "type": "object",
+                          "properties": {
+                            "invoiceId": {
+                              "type": "integer",
+                              "exclusiveMinimum": 0
+                            },
+                            "reference": {
+                              "type": "string"
+                            },
+                            "accountOwner": {
+                              "type": "string"
+                            },
+                            "iban": {
+                              "type": "string"
+                            },
+                            "bic": {
+                              "anyOf": [
+                                {
+                                  "type": "string"
+                                },
+                                {
+                                  "type": "null"
+                                }
+                              ]
+                            },
+                            "bankName": {
+                              "anyOf": [
+                                {
+                                  "type": "string"
+                                },
+                                {
+                                  "type": "null"
+                                }
+                              ]
+                            },
+                            "currency": {
+                              "type": "string"
+                            },
+                            "invoiceAmount": {
+                              "type": "string"
+                            },
+                            "createdAt": {
+                              "type": "string",
+                              "format": "date-time"
+                            }
+                          },
+                          "required": [
+                            "invoiceId",
+                            "reference",
+                            "accountOwner",
+                            "iban",
+                            "bic",
+                            "bankName",
+                            "currency",
+                            "invoiceAmount",
+                            "createdAt"
+                          ],
+                          "additionalProperties": false
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "invoiceId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "integer",
+              "exclusiveMinimum": 0
+            }
+          }
+        ],
+        "security": [
+          {
+            "oauth2Bearer": []
+          },
+          {
+            "companyApiKeyBearer": []
+          }
+        ],
+        "x-auth": {
+          "allowOAuth2": true,
+          "allowApiKey": true,
+          "allowUserSession": false,
+          "requireRole": "viewer"
+        },
+        "x-scopes": [
+          "invoices:read"
+        ]
+      }
+    },
     "/invoices/external": {
       "get": {
         "operationId": "invoices_search_external",
@@ -58486,13 +58633,13 @@
         }
       }
     },
-    "/auth/register": {
+    "/auth/mfa/complete": {
       "post": {
-        "operationId": "auth_register",
+        "operationId": "auth_mfa_complete",
         "tags": [
           "auth"
         ],
-        "summary": "Register a new direct-auth account",
+        "summary": "Complete a first-factor login with TOTP or a recovery code",
         "responses": {
           "200": {
             "description": "JSON response",
@@ -58550,25 +58697,28 @@
               "schema": {
                 "type": "object",
                 "properties": {
-                  "email": {
+                  "challengeToken": {
                     "type": "string",
-                    "format": "email",
-                    "maxLength": 320
+                    "minLength": 32,
+                    "maxLength": 128
                   },
-                  "password": {
+                  "code": {
                     "type": "string",
-                    "minLength": 8,
-                    "maxLength": 256
+                    "minLength": 6,
+                    "maxLength": 64
                   },
-                  "name": {
+                  "kind": {
                     "type": "string",
-                    "minLength": 1,
-                    "maxLength": 200
+                    "enum": [
+                      "totp",
+                      "recovery"
+                    ],
+                    "default": "totp"
                   }
                 },
                 "required": [
-                  "email",
-                  "password"
+                  "challengeToken",
+                  "code"
                 ],
                 "additionalProperties": false
               }
@@ -58577,13 +58727,13 @@
         }
       }
     },
-    "/auth/login": {
-      "post": {
-        "operationId": "auth_login",
+    "/auth/mfa": {
+      "get": {
+        "operationId": "auth_mfa_status",
         "tags": [
           "auth"
         ],
-        "summary": "Log in with email + password",
+        "summary": "Read the current product account's MFA status",
         "responses": {
           "200": {
             "description": "JSON response",
@@ -58617,7 +58767,29 @@
                     },
                     "data": {
                       "anyOf": [
-                        {},
+                        {
+                          "type": "object",
+                          "properties": {
+                            "enabled": {
+                              "type": "boolean"
+                            },
+                            "methods": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              }
+                            },
+                            "recoveryCodesRemaining": {
+                              "type": "number"
+                            }
+                          },
+                          "required": [
+                            "enabled",
+                            "methods",
+                            "recoveryCodesRemaining"
+                          ],
+                          "additionalProperties": false
+                        },
                         {
                           "type": "null"
                         }
@@ -58634,42 +58806,21 @@
             }
           }
         },
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object",
-                "properties": {
-                  "email": {
-                    "type": "string",
-                    "format": "email",
-                    "maxLength": 320
-                  },
-                  "password": {
-                    "type": "string",
-                    "minLength": 8,
-                    "maxLength": 256
-                  }
-                },
-                "required": [
-                  "email",
-                  "password"
-                ],
-                "additionalProperties": false
-              }
-            }
+        "security": [
+          {
+            "frontendBearer": []
           }
-        }
+        ],
+        "x-transport": "http"
       }
     },
-    "/auth/refresh": {
+    "/auth/mfa/setup": {
       "post": {
-        "operationId": "auth_refresh",
+        "operationId": "auth_mfa_setup",
         "tags": [
           "auth"
         ],
-        "summary": "Rotate access + refresh tokens",
+        "summary": "Prepare TOTP enrollment after rechecking the password",
         "responses": {
           "200": {
             "description": "JSON response",
@@ -58703,7 +58854,26 @@
                     },
                     "data": {
                       "anyOf": [
-                        {},
+                        {
+                          "type": "object",
+                          "properties": {
+                            "secret": {
+                              "type": "string"
+                            },
+                            "otpauthUri": {
+                              "type": "string"
+                            },
+                            "expiresAt": {
+                              "type": "string"
+                            }
+                          },
+                          "required": [
+                            "secret",
+                            "otpauthUri",
+                            "expiresAt"
+                          ],
+                          "additionalProperties": false
+                        },
                         {
                           "type": "null"
                         }
@@ -58727,30 +58897,37 @@
               "schema": {
                 "type": "object",
                 "properties": {
-                  "refreshToken": {
+                  "password": {
                     "type": "string",
-                    "minLength": 20
+                    "minLength": 8,
+                    "maxLength": 256
                   }
                 },
                 "required": [
-                  "refreshToken"
+                  "password"
                 ],
                 "additionalProperties": false
               }
             }
           }
-        }
+        },
+        "security": [
+          {
+            "frontendBearer": []
+          }
+        ],
+        "x-transport": "http"
       }
     },
-    "/auth/logout": {
+    "/auth/mfa/enable": {
       "post": {
-        "operationId": "auth_logout",
+        "operationId": "auth_mfa_enable",
         "tags": [
           "auth"
         ],
-        "summary": "Revoke the current refresh token",
+        "summary": "Confirm TOTP enrollment and return recovery codes once",
         "responses": {
-          "204": {
+          "200": {
             "description": "JSON response",
             "content": {
               "application/json": {
@@ -58784,7 +58961,25 @@
                       "anyOf": [
                         {
                           "type": "object",
-                          "properties": {},
+                          "properties": {
+                            "enabled": {
+                              "type": "boolean"
+                            },
+                            "recoveryCodes": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              }
+                            },
+                            "reauthenticationRequired": {
+                              "type": "boolean"
+                            }
+                          },
+                          "required": [
+                            "enabled",
+                            "recoveryCodes",
+                            "reauthenticationRequired"
+                          ],
                           "additionalProperties": false
                         },
                         {
@@ -58803,6 +58998,473 @@
             }
           }
         },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "code": {
+                    "type": "string",
+                    "pattern": "^\\d{6}$"
+                  }
+                },
+                "required": [
+                  "code"
+                ],
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "frontendBearer": []
+          }
+        ],
+        "x-transport": "http"
+      }
+    },
+    "/auth/mfa/disable": {
+      "post": {
+        "operationId": "auth_mfa_disable",
+        "tags": [
+          "auth"
+        ],
+        "summary": "Disable MFA using both the password and a second factor",
+        "responses": {
+          "200": {
+            "description": "JSON response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "message": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "code": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "data": {
+                      "anyOf": [
+                        {
+                          "type": "object",
+                          "properties": {
+                            "ok": {
+                              "type": "boolean"
+                            },
+                            "reauthenticationRequired": {
+                              "type": "boolean"
+                            }
+                          },
+                          "required": [
+                            "ok",
+                            "reauthenticationRequired"
+                          ],
+                          "additionalProperties": false
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "password": {
+                    "type": "string",
+                    "minLength": 8,
+                    "maxLength": 256
+                  },
+                  "code": {
+                    "type": "string",
+                    "minLength": 6,
+                    "maxLength": 64
+                  },
+                  "kind": {
+                    "type": "string",
+                    "enum": [
+                      "totp",
+                      "recovery"
+                    ],
+                    "default": "totp"
+                  }
+                },
+                "required": [
+                  "password",
+                  "code"
+                ],
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "frontendBearer": []
+          }
+        ],
+        "x-transport": "http"
+      }
+    },
+    "/auth/register": {
+      "post": {
+        "operationId": "auth_register",
+        "tags": [
+          "auth"
+        ],
+        "summary": "Register a new direct-auth account",
+        "responses": {
+          "200": {
+            "description": "JSON response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "message": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "code": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "data": {
+                      "anyOf": [
+                        {},
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "email": {
+                    "type": "string",
+                    "format": "email",
+                    "maxLength": 320
+                  },
+                  "password": {
+                    "type": "string",
+                    "minLength": 8,
+                    "maxLength": 256
+                  },
+                  "name": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 200
+                  },
+                  "firstName": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 100
+                  },
+                  "lastName": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 100
+                  },
+                  "device": {
+                    "type": "object",
+                    "properties": {
+                      "deviceId": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 200
+                      },
+                      "deviceName": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 200
+                      },
+                      "deviceModel": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 200
+                      },
+                      "deviceOs": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 200
+                      },
+                      "appVersion": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 100
+                      },
+                      "platform": {
+                        "type": "string",
+                        "enum": [
+                          "ios",
+                          "android",
+                          "web",
+                          "expo"
+                        ]
+                      }
+                    },
+                    "additionalProperties": false
+                  }
+                },
+                "required": [
+                  "email",
+                  "password"
+                ],
+                "additionalProperties": false
+              }
+            }
+          }
+        }
+      }
+    },
+    "/auth/login": {
+      "post": {
+        "operationId": "auth_login",
+        "tags": [
+          "auth"
+        ],
+        "summary": "Log in with email + password",
+        "responses": {
+          "200": {
+            "description": "JSON response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "message": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "code": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "data": {
+                      "anyOf": [
+                        {},
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "email": {
+                    "type": "string",
+                    "format": "email",
+                    "maxLength": 320
+                  },
+                  "password": {
+                    "type": "string",
+                    "minLength": 8,
+                    "maxLength": 256
+                  },
+                  "device": {
+                    "type": "object",
+                    "properties": {
+                      "deviceId": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 200
+                      },
+                      "deviceName": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 200
+                      },
+                      "deviceModel": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 200
+                      },
+                      "deviceOs": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 200
+                      },
+                      "appVersion": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 100
+                      },
+                      "platform": {
+                        "type": "string",
+                        "enum": [
+                          "ios",
+                          "android",
+                          "web",
+                          "expo"
+                        ]
+                      }
+                    },
+                    "additionalProperties": false
+                  }
+                },
+                "required": [
+                  "email",
+                  "password"
+                ],
+                "additionalProperties": false
+              }
+            }
+          }
+        }
+      }
+    },
+    "/auth/refresh": {
+      "post": {
+        "operationId": "auth_refresh",
+        "tags": [
+          "auth"
+        ],
+        "summary": "Rotate access + refresh tokens",
+        "responses": {
+          "200": {
+            "description": "JSON response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "message": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "code": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "data": {
+                      "anyOf": [
+                        {},
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            }
+          }
+        },
         "requestBody": {
           "required": true,
           "content": {
@@ -58813,22 +59475,489 @@
                   "refreshToken": {
                     "type": "string",
                     "minLength": 20
+                  },
+                  "device": {
+                    "type": "object",
+                    "properties": {
+                      "deviceId": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 200
+                      },
+                      "deviceName": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 200
+                      },
+                      "deviceModel": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 200
+                      },
+                      "deviceOs": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 200
+                      },
+                      "appVersion": {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 100
+                      },
+                      "platform": {
+                        "type": "string",
+                        "enum": [
+                          "ios",
+                          "android",
+                          "web",
+                          "expo"
+                        ]
+                      }
+                    },
+                    "additionalProperties": false
+                  }
+                },
+                "required": [
+                  "refreshToken"
+                ],
+                "additionalProperties": false
+              }
+            }
+          }
+        }
+      }
+    },
+    "/auth/logout": {
+      "post": {
+        "operationId": "auth_logout",
+        "tags": [
+          "auth"
+        ],
+        "summary": "Revoke the current refresh token",
+        "responses": {
+          "204": {
+            "description": "JSON response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "message": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "code": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "data": {
+                      "anyOf": [
+                        {
+                          "type": "object",
+                          "properties": {},
+                          "additionalProperties": false
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "refreshToken": {
+                    "type": "string",
+                    "minLength": 20
+                  }
+                },
+                "additionalProperties": false
+              }
+            }
+          }
+        }
+      }
+    },
+    "/auth/me": {
+      "get": {
+        "operationId": "auth_me",
+        "tags": [
+          "auth"
+        ],
+        "summary": "Get the current user incl. roles and isAdmin (Bearer access JWT)",
+        "responses": {
+          "200": {
+            "description": "JSON response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "message": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "code": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "data": {
+                      "anyOf": [
+                        {},
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "frontendBearer": []
+          }
+        ],
+        "x-transport": "http"
+      }
+    },
+    "/auth/me/profile": {
+      "patch": {
+        "operationId": "auth_me_profile_update",
+        "tags": [
+          "auth"
+        ],
+        "summary": "Update the current user's own profile (name, avatar)",
+        "responses": {
+          "200": {
+            "description": "JSON response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "message": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "code": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "data": {
+                      "anyOf": [
+                        {},
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "avatarStyle": {
+                    "anyOf": [
+                      {
+                        "type": "object",
+                        "properties": {
+                          "seed": {
+                            "type": "string",
+                            "minLength": 1,
+                            "maxLength": 200
+                          },
+                          "hue": {
+                            "type": "integer",
+                            "minimum": 0,
+                            "maximum": 359
+                          },
+                          "shape": {
+                            "type": "string",
+                            "enum": [
+                              "round",
+                              "organic",
+                              "boxy",
+                              "nub",
+                              "cloud",
+                              "sun",
+                              "capsule",
+                              "triangle",
+                              "hexagon",
+                              "droplet"
+                            ]
+                          },
+                          "expression": {
+                            "type": "string",
+                            "enum": [
+                              "idle",
+                              "happy",
+                              "sad",
+                              "mad",
+                              "surprised",
+                              "wink",
+                              "sleepy",
+                              "smug",
+                              "unsure",
+                              "scared",
+                              "love",
+                              "shy",
+                              "sick",
+                              "thinking"
+                            ]
+                          },
+                          "background": {
+                            "type": "string",
+                            "enum": [
+                              "none",
+                              "squircle",
+                              "circle"
+                            ]
+                          }
+                        },
+                        "additionalProperties": false
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ]
+                  },
+                  "name": {
+                    "anyOf": [
+                      {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 200
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ]
+                  },
+                  "firstName": {
+                    "anyOf": [
+                      {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 100
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ]
+                  },
+                  "lastName": {
+                    "anyOf": [
+                      {
+                        "type": "string",
+                        "minLength": 1,
+                        "maxLength": 100
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ]
+                  }
+                },
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "frontendBearer": []
+          }
+        ],
+        "x-transport": "http"
+      }
+    },
+    "/auth/push-token": {
+      "post": {
+        "operationId": "auth_push_token_upsert",
+        "tags": [
+          "auth"
+        ],
+        "summary": "Register a device push token for the current user",
+        "responses": {
+          "204": {
+            "description": "JSON response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "message": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "code": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "data": {
+                      "anyOf": [
+                        {
+                          "type": "object",
+                          "properties": {},
+                          "additionalProperties": false
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "token": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 500
+                  },
+                  "platform": {
+                    "type": "string",
+                    "enum": [
+                      "ios",
+                      "android",
+                      "web",
+                      "expo"
+                    ]
                   }
                 },
+                "required": [
+                  "token",
+                  "platform"
+                ],
                 "additionalProperties": false
               }
             }
           }
-        }
+        },
+        "security": [
+          {
+            "frontendBearer": []
+          }
+        ],
+        "x-transport": "http"
       }
     },
-    "/auth/me": {
-      "get": {
-        "operationId": "auth_me",
+    "/auth/verify-email/request": {
+      "post": {
+        "operationId": "auth_verify_email_request",
         "tags": [
           "auth"
         ],
-        "summary": "Get the current user incl. roles and isAdmin (Bearer access JWT)",
+        "summary": "Send a fresh email-verification link to the current user",
         "responses": {
           "200": {
             "description": "JSON response",
@@ -58879,6 +60008,18 @@
             }
           }
         },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {},
+                "additionalProperties": false
+              }
+            }
+          }
+        },
         "security": [
           {
             "frontendBearer": []
@@ -58887,13 +60028,13 @@
         "x-transport": "http"
       }
     },
-    "/auth/me/profile": {
-      "patch": {
-        "operationId": "auth_me_profile_update",
+    "/auth/verify-email/confirm": {
+      "post": {
+        "operationId": "auth_verify_email_confirm",
         "tags": [
           "auth"
         ],
-        "summary": "Update the current user's own profile (name, avatar)",
+        "summary": "Confirm an email-verification token (programmatic / deep-link flow)",
         "responses": {
           "200": {
             "description": "JSON response",
@@ -58951,99 +60092,65 @@
               "schema": {
                 "type": "object",
                 "properties": {
-                  "name": {
+                  "token": {
                     "type": "string",
-                    "minLength": 1,
-                    "maxLength": 200
-                  },
-                  "avatarStyle": {
-                    "anyOf": [
-                      {
-                        "type": "object",
-                        "properties": {
-                          "seed": {
-                            "type": "string",
-                            "minLength": 1,
-                            "maxLength": 200
-                          },
-                          "hue": {
-                            "type": "integer",
-                            "minimum": 0,
-                            "maximum": 359
-                          },
-                          "shape": {
-                            "type": "string",
-                            "enum": [
-                              "round",
-                              "organic",
-                              "boxy",
-                              "nub",
-                              "cloud",
-                              "sun",
-                              "capsule",
-                              "triangle",
-                              "hexagon",
-                              "droplet"
-                            ]
-                          },
-                          "expression": {
-                            "type": "string",
-                            "enum": [
-                              "idle",
-                              "happy",
-                              "sad",
-                              "mad",
-                              "surprised",
-                              "wink",
-                              "sleepy",
-                              "smug",
-                              "unsure",
-                              "scared",
-                              "love",
-                              "shy",
-                              "sick",
-                              "thinking"
-                            ]
-                          },
-                          "background": {
-                            "type": "string",
-                            "enum": [
-                              "none",
-                              "squircle",
-                              "circle"
-                            ]
-                          }
-                        },
-                        "additionalProperties": false
-                      },
-                      {
-                        "type": "null"
-                      }
-                    ]
+                    "minLength": 20,
+                    "maxLength": 500
                   }
                 },
+                "required": [
+                  "token"
+                ],
                 "additionalProperties": false
               }
             }
           }
+        }
+      }
+    },
+    "/auth/verify-email": {
+      "get": {
+        "operationId": "auth_verify_email_landing",
+        "tags": [
+          "auth"
+        ],
+        "summary": "Browser landing page that consumes the verification token",
+        "responses": {
+          "200": {
+            "description": "Binary response",
+            "content": {
+              "text/html": {
+                "schema": {
+                  "type": "string",
+                  "format": "binary"
+                }
+              }
+            }
+          }
         },
-        "security": [
+        "parameters": [
           {
-            "frontendBearer": []
+            "name": "token",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 500
+            }
           }
-        ],
-        "x-transport": "http"
+        ]
       }
     },
-    "/auth/push-token": {
-      "post": {
-        "operationId": "auth_push_token_upsert",
+    "/auth/me/email": {
+      "patch": {
+        "operationId": "auth_me_email_patch",
         "tags": [
           "auth"
         ],
-        "summary": "Register a device push token for the current user",
+        "summary": "Change current user's email after password confirmation",
         "responses": {
-          "204": {
+          "200": {
             "description": "JSON response",
             "content": {
               "application/json": {
@@ -59075,11 +60182,7 @@
                     },
                     "data": {
                       "anyOf": [
-                        {
-                          "type": "object",
-                          "properties": {},
-                          "additionalProperties": false
-                        },
+                        {},
                         {
                           "type": "null"
                         }
@@ -59103,24 +60206,20 @@
               "schema": {
                 "type": "object",
                 "properties": {
-                  "token": {
+                  "email": {
                     "type": "string",
-                    "minLength": 1,
-                    "maxLength": 500
+                    "format": "email",
+                    "maxLength": 320
                   },
-                  "platform": {
+                  "password": {
                     "type": "string",
-                    "enum": [
-                      "ios",
-                      "android",
-                      "web",
-                      "expo"
-                    ]
+                    "minLength": 8,
+                    "maxLength": 256
                   }
                 },
                 "required": [
-                  "token",
-                  "platform"
+                  "email",
+                  "password"
                 ],
                 "additionalProperties": false
               }
@@ -59135,13 +60234,13 @@
         "x-transport": "http"
       }
     },
-    "/auth/verify-email/request": {
+    "/auth/password/change": {
       "post": {
-        "operationId": "auth_verify_email_request",
+        "operationId": "auth_password_change",
         "tags": [
           "auth"
         ],
-        "summary": "Send a fresh email-verification link to the current user",
+        "summary": "Change password for the current user",
         "responses": {
           "200": {
             "description": "JSON response",
@@ -59198,7 +60297,30 @@
             "application/json": {
               "schema": {
                 "type": "object",
-                "properties": {},
+                "properties": {
+                  "currentPassword": {
+                    "type": "string",
+                    "minLength": 8,
+                    "maxLength": 256
+                  },
+                  "newPassword": {
+                    "type": "string",
+                    "minLength": 8,
+                    "maxLength": 256
+                  },
+                  "revokeOtherSessions": {
+                    "type": "boolean",
+                    "default": true
+                  },
+                  "refreshToken": {
+                    "type": "string",
+                    "minLength": 20
+                  }
+                },
+                "required": [
+                  "currentPassword",
+                  "newPassword"
+                ],
                 "additionalProperties": false
               }
             }
@@ -59212,13 +60334,93 @@
         "x-transport": "http"
       }
     },
-    "/auth/verify-email/confirm": {
+    "/auth/password/reset/request": {
       "post": {
-        "operationId": "auth_verify_email_confirm",
+        "operationId": "auth_password_reset_request",
         "tags": [
           "auth"
         ],
-        "summary": "Confirm an email-verification token (programmatic / deep-link flow)",
+        "summary": "Request a password reset email",
+        "responses": {
+          "200": {
+            "description": "JSON response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "message": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "code": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "data": {
+                      "anyOf": [
+                        {},
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "email": {
+                    "type": "string",
+                    "format": "email",
+                    "maxLength": 320
+                  }
+                },
+                "required": [
+                  "email"
+                ],
+                "additionalProperties": false
+              }
+            }
+          }
+        }
+      }
+    },
+    "/auth/password/reset/confirm": {
+      "post": {
+        "operationId": "auth_password_reset_confirm",
+        "tags": [
+          "auth"
+        ],
+        "summary": "Reset password with an email token",
         "responses": {
           "200": {
             "description": "JSON response",
@@ -59280,10 +60482,16 @@
                     "type": "string",
                     "minLength": 20,
                     "maxLength": 500
+                  },
+                  "newPassword": {
+                    "type": "string",
+                    "minLength": 8,
+                    "maxLength": 256
                   }
                 },
                 "required": [
-                  "token"
+                  "token",
+                  "newPassword"
                 ],
                 "additionalProperties": false
               }
@@ -59292,13 +60500,13 @@
         }
       }
     },
-    "/auth/verify-email": {
+    "/auth/password/reset": {
       "get": {
-        "operationId": "auth_verify_email_landing",
+        "operationId": "auth_password_reset_landing",
         "tags": [
           "auth"
         ],
-        "summary": "Browser landing page that consumes the verification token",
+        "summary": "Browser landing page for password reset links",
         "responses": {
           "200": {
             "description": "Binary response",
@@ -59326,6 +60534,232 @@
         ]
       }
     },
+    "/auth/sessions": {
+      "get": {
+        "operationId": "auth_sessions_list",
+        "tags": [
+          "auth"
+        ],
+        "summary": "List active refresh-token sessions for the current user",
+        "responses": {
+          "200": {
+            "description": "JSON response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "message": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "code": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "data": {
+                      "anyOf": [
+                        {},
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "frontendBearer": []
+          }
+        ],
+        "x-transport": "http"
+      }
+    },
+    "/auth/sessions/:sessionId": {
+      "delete": {
+        "operationId": "auth_sessions_revoke",
+        "tags": [
+          "auth"
+        ],
+        "summary": "Revoke one active session",
+        "responses": {
+          "200": {
+            "description": "JSON response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "message": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "code": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "data": {
+                      "anyOf": [
+                        {},
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "sessionId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "integer",
+              "exclusiveMinimum": 0
+            }
+          }
+        ],
+        "security": [
+          {
+            "frontendBearer": []
+          }
+        ],
+        "x-transport": "http"
+      }
+    },
+    "/auth/sessions/revoke-other": {
+      "post": {
+        "operationId": "auth_sessions_revoke_other",
+        "tags": [
+          "auth"
+        ],
+        "summary": "Revoke all sessions except the supplied current refresh token",
+        "responses": {
+          "200": {
+            "description": "JSON response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "success": {
+                      "type": "boolean"
+                    },
+                    "message": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "code": {
+                      "anyOf": [
+                        {
+                          "type": "string"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    },
+                    "data": {
+                      "anyOf": [
+                        {},
+                        {
+                          "type": "null"
+                        }
+                      ]
+                    }
+                  },
+                  "required": [
+                    "success",
+                    "data"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            }
+          }
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "refreshToken": {
+                    "type": "string",
+                    "minLength": 20
+                  }
+                },
+                "required": [
+                  "refreshToken"
+                ],
+                "additionalProperties": false
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "frontendBearer": []
+          }
+        ],
+        "x-transport": "http"
+      }
+    },
     "/internal/users/provision": {
       "post": {
         "operationId": "internal_users_provision",