@qlever-llc/trellis 0.8.4 → 0.9.0-rc.3

package/esm/auth/protocol.js

@@ -1,6 +1,7 @@
-import { ContractResourceBindingsSchema, ContractResourcesSchema, } from "@qlever-llc/trellis/contracts";
+import { ContractResourceBindingsSchema } from "@qlever-llc/trellis/contracts";
 import { Type } from "typebox";
-import { ClientTransportsSchema, SentinelCredsSchema, UserParticipantKindSchema, } from "./schemas.js";
+import { PageResponseSchema } from "../contract_support/protocol.js";
+import { ClientTransportsSchema, ContractApprovalCapabilitySchema, SentinelCredsSchema, UserParticipantKindSchema, } from "./schemas.js";
 const IsoDateStringSchema = Type.String({ format: "date-time" });
 export const ParticipantKindSchema = Type.Union([
     UserParticipantKindSchema,
@@ -11,21 +12,11 @@ export const DigestSchema = Type.String({ pattern: "^[A-Za-z0-9_-]+$" });
 export const OpenObjectSchema = Type.Unsafe({
     type: "object",
 });
-export const ServiceAppliedDeploymentContractSchema = Type.Object({
-    contractId: Type.String({ minLength: 1 }),
-    allowedDigests: Type.Array(DigestSchema),
-    resourceBindingsByDigest: Type.Optional(Type.Record(DigestSchema, ContractResourceBindingsSchema)),
-});
-export const DeviceAppliedDeploymentContractSchema = Type.Object({
-    contractId: Type.String({ minLength: 1 }),
-    allowedDigests: Type.Array(DigestSchema),
-}, { additionalProperties: false });
-export const ServiceDeploymentSchema = Type.Object({
+export const ServiceDeploymentSchema = Type.Unsafe(Type.Object({
     deploymentId: Type.String({ minLength: 1 }),
     namespaces: Type.Array(Type.String({ minLength: 1 })),
     disabled: Type.Boolean(),
-    appliedContracts: Type.Array(ServiceAppliedDeploymentContractSchema),
-});
+}));
 export const ServiceInstanceSchema = Type.Object({
     instanceId: Type.String({ minLength: 1 }),
     deploymentId: Type.String({ minLength: 1 }),
@@ -41,147 +32,377 @@ export const ApprovalDecisionSchema = Type.Union([
     Type.Literal("approved"),
     Type.Literal("denied"),
 ]);
-export const ContractApprovalViewSchema = Type.Object({
+export const IdentityAnchorViewSchema = Type.Union([
+    Type.Object({
+        kind: Type.Literal("web"),
+        contractId: Type.String({ minLength: 1 }),
+        origin: Type.String({ minLength: 1 }),
+    }),
+    Type.Object({
+        kind: Type.Literal("cli"),
+        contractId: Type.String({ minLength: 1 }),
+        sessionPublicKey: Type.String({ minLength: 1 }),
+    }),
+    Type.Object({
+        kind: Type.Literal("native"),
+        contractId: Type.String({ minLength: 1 }),
+        sessionPublicKey: Type.String({ minLength: 1 }),
+    }),
+    Type.Object({
+        kind: Type.Literal("device-user"),
+        contractId: Type.String({ minLength: 1 }),
+        devicePublicKey: Type.String({ minLength: 1 }),
+    }),
+]);
+export const ContractEvidenceViewSchema = Type.Object({
+    contractDigest: DigestSchema,
+    contractId: Type.String({ minLength: 1 }),
+});
+export const ApprovalEvidenceViewSchema = Type.Object({
     contractDigest: DigestSchema,
     contractId: Type.String({ minLength: 1 }),
     displayName: Type.String({ minLength: 1 }),
     description: Type.String({ minLength: 1 }),
-    capabilities: Type.Array(Type.String()),
+    capabilities: Type.Record(Type.String(), ContractApprovalCapabilitySchema),
+});
+export const IdentityEnvelopeApprovalViewSchema = Type.Object({
+    identityEnvelopeId: Type.String({ minLength: 1 }),
+    identityAnchor: IdentityAnchorViewSchema,
+    contractEvidence: ContractEvidenceViewSchema,
+    displayName: Type.String({ minLength: 1 }),
+    description: Type.String({ minLength: 1 }),
+    capabilities: Type.Record(Type.String(), ContractApprovalCapabilitySchema),
 });
 export const ApprovalRecordViewSchema = Type.Object({
     user: Type.String({ minLength: 1 }),
     answer: ApprovalDecisionSchema,
     answeredAt: IsoDateStringSchema,
     updatedAt: IsoDateStringSchema,
-    approval: ContractApprovalViewSchema,
+    identityEnvelopeId: Type.String({ minLength: 1 }),
+    identityAnchor: IdentityAnchorViewSchema,
+    contractEvidence: ContractEvidenceViewSchema,
+    displayName: Type.String({ minLength: 1 }),
+    description: Type.String({ minLength: 1 }),
+    capabilities: Type.Record(Type.String(), ContractApprovalCapabilitySchema),
     participantKind: UserParticipantKindSchema,
 });
-export const InstanceGrantPolicyActorSchema = Type.Object({
-    origin: Type.String({ minLength: 1 }),
-    id: Type.String({ minLength: 1 }),
+export const DeploymentEnvelopeKindSchema = Type.Union([
+    Type.Literal("service"),
+    Type.Literal("device"),
+    Type.Literal("app"),
+    Type.Literal("cli"),
+    Type.Literal("native"),
+    Type.Literal("device-user"),
+]);
+export const EnvelopeSurfaceKindSchema = Type.Union([
+    Type.Literal("rpc"),
+    Type.Literal("operation"),
+    Type.Literal("event"),
+    Type.Literal("feed"),
+]);
+export const EnvelopeSurfaceActionSchema = Type.Union([
+    Type.Literal("call"),
+    Type.Literal("publish"),
+    Type.Literal("subscribe"),
+    Type.Literal("read"),
+    Type.Literal("cancel"),
+]);
+export const EnvelopeResourceKindSchema = Type.Union([
+    Type.Literal("kv"),
+    Type.Literal("store"),
+    Type.Literal("jobs"),
+    Type.Literal("transfer"),
+]);
+export const EnvelopeBoundaryContractSchema = Type.Object({
+    contractId: Type.String({ minLength: 1 }),
+    required: Type.Boolean(),
 });
-export const PortalProfileSourceSchema = Type.Object({
-    kind: Type.Literal("portal_profile"),
-    portalId: Type.String({ minLength: 1 }),
-    entryUrl: Type.String({ minLength: 1 }),
+export const EnvelopeBoundarySurfaceSchema = Type.Object({
+    contractId: Type.String({ minLength: 1 }),
+    kind: EnvelopeSurfaceKindSchema,
+    name: Type.String({ minLength: 1 }),
+    action: EnvelopeSurfaceActionSchema,
+    required: Type.Boolean(),
+});
+export const EnvelopeBoundaryResourceSchema = Type.Object({
+    kind: EnvelopeResourceKindSchema,
+    alias: Type.String({ minLength: 1 }),
+    required: Type.Boolean(),
 });
-export const AdminPolicySourceSchema = Type.Object({
-    kind: Type.Literal("admin_policy"),
-    createdBy: Type.Optional(InstanceGrantPolicyActorSchema),
-    updatedBy: Type.Optional(InstanceGrantPolicyActorSchema),
+export const EnvelopeBoundarySchema = Type.Object({
+    contracts: Type.Array(EnvelopeBoundaryContractSchema),
+    surfaces: Type.Array(EnvelopeBoundarySurfaceSchema),
+    capabilities: Type.Array(Type.String({ minLength: 1 })),
+    resources: Type.Array(EnvelopeBoundaryResourceSchema),
 });
-export const InstanceGrantPolicySchema = Type.Object({
-    contractId: Type.String({ minLength: 1 }),
-    allowedOrigins: Type.Optional(Type.Array(Type.String({ minLength: 1 }))),
-    impliedCapabilities: Type.Array(Type.String()),
+export const DeploymentEnvelopeSchema = Type.Object({
+    deploymentId: Type.String({ minLength: 1 }),
+    kind: DeploymentEnvelopeKindSchema,
     disabled: Type.Boolean(),
     createdAt: IsoDateStringSchema,
     updatedAt: IsoDateStringSchema,
-    source: Type.Union([AdminPolicySourceSchema, PortalProfileSourceSchema]),
+    boundary: EnvelopeBoundarySchema,
 });
-export const AuthListInstanceGrantPoliciesSchema = Type.Object({});
-export const AuthListInstanceGrantPoliciesResponseSchema = Type.Object({
-    policies: Type.Array(InstanceGrantPolicySchema),
+export const DeploymentResourceBindingSchema = Type.Object({
+    deploymentId: Type.String({ minLength: 1 }),
+    kind: EnvelopeResourceKindSchema,
+    alias: Type.String({ minLength: 1 }),
+    binding: Type.Record(Type.String(), Type.Unknown()),
+    limits: Type.Union([Type.Record(Type.String(), Type.Unknown()), Type.Null()]),
+    createdAt: IsoDateStringSchema,
+    updatedAt: IsoDateStringSchema,
 });
-export const AuthUpsertInstanceGrantPolicySchema = Type.Object({
+export const DeploymentContractEvidenceSchema = Type.Object({
+    deploymentId: Type.String({ minLength: 1 }),
     contractId: Type.String({ minLength: 1 }),
-    allowedOrigins: Type.Optional(Type.Array(Type.String({ minLength: 1 }))),
-    impliedCapabilities: Type.Array(Type.String()),
+    contractDigest: DigestSchema,
+    contract: OpenObjectSchema,
+    firstSeenAt: IsoDateStringSchema,
+    lastSeenAt: IsoDateStringSchema,
+    ignoredAt: Type.Optional(Type.Union([IsoDateStringSchema, Type.Null()])),
+    ignoredBy: Type.Optional(Type.Union([Type.Record(Type.String(), Type.Unknown()), Type.Null()])),
+    ignoreReason: Type.Optional(Type.Union([Type.String({ minLength: 1 }), Type.Null()])),
 });
-export const AuthUpsertInstanceGrantPolicyResponseSchema = Type.Object({
-    policy: InstanceGrantPolicySchema,
+export const DeploymentPortalRouteSchema = Type.Object({
+    deploymentId: Type.String({ minLength: 1 }),
+    portalId: Type.Union([Type.String({ minLength: 1 }), Type.Null()]),
+    entryUrl: Type.Union([Type.String({ minLength: 1 }), Type.Null()]),
+    disabled: Type.Boolean(),
+    updatedAt: IsoDateStringSchema,
 });
-export const AuthDisableInstanceGrantPolicySchema = Type.Object({
+export const DeploymentGrantOverrideSchema = Type.Union([
+    Type.Object({
+        deploymentId: Type.String({ minLength: 1 }),
+        identityKind: Type.Literal("web"),
+        grantKind: Type.Literal("capability"),
+        contractId: Type.String({ minLength: 1 }),
+        origin: Type.String({ minLength: 1 }),
+        sessionPublicKey: Type.Null(),
+        capability: Type.String({ minLength: 1 }),
+        capabilityGroupKey: Type.Null(),
+    }),
+    Type.Object({
+        deploymentId: Type.String({ minLength: 1 }),
+        identityKind: Type.Literal("web"),
+        grantKind: Type.Literal("capability-group"),
+        contractId: Type.String({ minLength: 1 }),
+        origin: Type.String({ minLength: 1 }),
+        sessionPublicKey: Type.Null(),
+        capability: Type.Null(),
+        capabilityGroupKey: Type.String({ minLength: 1 }),
+    }),
+    Type.Object({
+        deploymentId: Type.String({ minLength: 1 }),
+        identityKind: Type.Literal("session"),
+        grantKind: Type.Literal("capability"),
+        contractId: Type.String({ minLength: 1 }),
+        origin: Type.Null(),
+        sessionPublicKey: Type.String({ minLength: 1 }),
+        capability: Type.String({ minLength: 1 }),
+        capabilityGroupKey: Type.Null(),
+    }),
+    Type.Object({
+        deploymentId: Type.String({ minLength: 1 }),
+        identityKind: Type.Literal("session"),
+        grantKind: Type.Literal("capability-group"),
+        contractId: Type.String({ minLength: 1 }),
+        origin: Type.Null(),
+        sessionPublicKey: Type.String({ minLength: 1 }),
+        capability: Type.Null(),
+        capabilityGroupKey: Type.String({ minLength: 1 }),
+    }),
+]);
+export const EnvelopeExpansionRequestSchema = Type.Object({
+    requestId: Type.String({ minLength: 1 }),
+    deploymentId: Type.String({ minLength: 1 }),
+    requestedByKind: Type.Union([
+        Type.Literal("service"),
+        Type.Literal("device"),
+        Type.Literal("user"),
+        Type.Literal("admin"),
+        Type.Literal("automation"),
+    ]),
+    requestedBy: Type.Record(Type.String(), Type.Unknown()),
     contractId: Type.String({ minLength: 1 }),
+    contractDigest: DigestSchema,
+    contract: OpenObjectSchema,
+    state: Type.Union([
+        Type.Literal("pending"),
+        Type.Literal("approved"),
+        Type.Literal("rejected"),
+    ]),
+    createdAt: IsoDateStringSchema,
+    decidedAt: Type.Union([IsoDateStringSchema, Type.Null()]),
+    decidedBy: Type.Union([
+        Type.Record(Type.String(), Type.Unknown()),
+        Type.Null(),
+    ]),
+    decisionReason: Type.Union([Type.String({ minLength: 1 }), Type.Null()]),
+    delta: EnvelopeBoundarySchema,
 });
-export const AuthDisableInstanceGrantPolicyResponseSchema = Type.Object({
-    policy: InstanceGrantPolicySchema,
+export const AuthEnvelopesListSchema = Type.Object({
+    kind: Type.Optional(DeploymentEnvelopeKindSchema),
+    disabled: Type.Optional(Type.Boolean()),
+    offset: Type.Optional(Type.Integer({ minimum: 0 })),
+    limit: Type.Integer({ minimum: 0, maximum: 500 }),
 });
-export const AuthCreateServiceDeploymentSchema = Type.Object({
+export const AuthEnvelopesListResponseSchema = Type.Object({
+    ...PageResponseSchema(DeploymentEnvelopeSchema).properties,
+});
+export const AuthEnvelopesGetSchema = Type.Object({
     deploymentId: Type.String({ minLength: 1 }),
-    namespaces: Type.Array(Type.String({ minLength: 1 })),
 });
-export const AuthCreateServiceDeploymentResponseSchema = Type.Object({
-    deployment: ServiceDeploymentSchema,
+export const AuthEnvelopesGetResponseSchema = Type.Object({
+    envelope: DeploymentEnvelopeSchema,
+    resourceBindings: Type.Array(DeploymentResourceBindingSchema),
+    contractEvidence: Type.Array(DeploymentContractEvidenceSchema),
+    expansionRequests: Type.Array(EnvelopeExpansionRequestSchema),
+    portalRoute: Type.Union([DeploymentPortalRouteSchema, Type.Null()]),
+    grantOverrides: Type.Array(DeploymentGrantOverrideSchema),
 });
-export const AuthListServiceDeploymentsSchema = Type.Object({
-    disabled: Type.Optional(Type.Boolean()),
+export const AuthEnvelopesGrantOverridesPutSchema = Type.Object({
+    deploymentId: Type.String({ minLength: 1 }),
+    overrides: Type.Array(DeploymentGrantOverrideSchema),
+});
+export const AuthEnvelopesGrantOverridesListSchema = Type.Object({
+    offset: Type.Optional(Type.Integer({ minimum: 0 })),
+    limit: Type.Integer({ minimum: 0, maximum: 500 }),
+});
+export const AuthEnvelopesGrantOverridesListResponseSchema = Type.Object({
+    ...PageResponseSchema(DeploymentGrantOverrideSchema).properties,
+});
+export const AuthEnvelopesGrantOverridesResponseSchema = Type.Object({
+    grantOverrides: Type.Array(DeploymentGrantOverrideSchema),
 });
-export const AuthListServiceDeploymentsResponseSchema = Type.Object({
-    deployments: Type.Array(ServiceDeploymentSchema),
+export const AuthEnvelopesGrantOverridesRemoveSchema = Type.Object({
+    deploymentId: Type.String({ minLength: 1 }),
+    overrides: Type.Array(DeploymentGrantOverrideSchema),
 });
-export const AuthApplyServiceDeploymentContractSchema = Type.Object({
+export const AuthEnvelopesExpandSchema = Type.Object({
     deploymentId: Type.String({ minLength: 1 }),
     contract: OpenObjectSchema,
     expectedDigest: DigestSchema,
-    replaceExisting: Type.Optional(Type.Boolean()),
 });
-export const AuthApplyServiceDeploymentContractResponseSchema = Type.Object({
-    deployment: ServiceDeploymentSchema,
-    contract: Type.Object({
-        digest: DigestSchema,
-        id: Type.String({ minLength: 1 }),
-        displayName: Type.String({ minLength: 1 }),
-        description: Type.String({ minLength: 1 }),
-        installedAt: IsoDateStringSchema,
-    }),
+export const AuthEnvelopesExpandResponseSchema = Type.Object({
+    envelope: DeploymentEnvelopeSchema,
+    delta: EnvelopeBoundarySchema,
+    contractEvidence: DeploymentContractEvidenceSchema,
+    resourceBindings: Type.Array(DeploymentResourceBindingSchema),
 });
-export const AuthUnapplyServiceDeploymentContractSchema = Type.Object({
-    deploymentId: Type.String({ minLength: 1 }),
-    contractId: Type.String({ minLength: 1 }),
-    digests: Type.Optional(Type.Array(DigestSchema)),
+export const AuthEnvelopesApproveRequestSchema = Type.Object({
+    requestId: Type.String({ minLength: 1 }),
+    reason: Type.Optional(Type.String({ minLength: 1 })),
 });
-export const AuthUnapplyServiceDeploymentContractResponseSchema = Type.Object({
-    deployment: ServiceDeploymentSchema,
+export const AuthEnvelopesApproveRequestResponseSchema = Type.Object({
+    request: EnvelopeExpansionRequestSchema,
+    envelope: DeploymentEnvelopeSchema,
+    delta: EnvelopeBoundarySchema,
+    contractEvidence: DeploymentContractEvidenceSchema,
+    resourceBindings: Type.Array(DeploymentResourceBindingSchema),
 });
-export const AuthDisableServiceDeploymentSchema = Type.Object({
-    deploymentId: Type.String({ minLength: 1 }),
+export const AuthEnvelopeExpansionsListSchema = Type.Object({
+    deploymentId: Type.Optional(Type.String({ minLength: 1 })),
+    state: Type.Optional(Type.Union([
+        Type.Literal("pending"),
+        Type.Literal("approved"),
+        Type.Literal("rejected"),
+    ])),
+    offset: Type.Optional(Type.Integer({ minimum: 0 })),
+    limit: Type.Integer({ minimum: 0, maximum: 500 }),
+});
+export const AuthEnvelopeExpansionsListResponseSchema = Type.Object({
+    ...PageResponseSchema(EnvelopeExpansionRequestSchema).properties,
+});
+export const AuthEnvelopeExpansionsRejectSchema = Type.Object({
+    requestId: Type.String({ minLength: 1 }),
+    reason: Type.Optional(Type.String({ minLength: 1 })),
+});
+export const AuthEnvelopeExpansionsRejectResponseSchema = Type.Object({
+    request: EnvelopeExpansionRequestSchema,
 });
-export const AuthDisableServiceDeploymentResponseSchema = Type.Object({
-    deployment: ServiceDeploymentSchema,
+export const AuthEnvelopeShrinkResourceSchema = Type.Object({
+    kind: EnvelopeResourceKindSchema,
+    alias: Type.String({ minLength: 1 }),
 });
-export const AuthEnableServiceDeploymentSchema = Type.Object({
+export const AuthEnvelopeShrinkMissingBoundarySchema = Type.Object({
+    missing: EnvelopeBoundarySchema,
+});
+export const AuthEnvelopeShrinkImpactedSessionSchema = Type.Object({
+    sessionKey: Type.String({ minLength: 1 }),
+    type: ParticipantKindSchema,
+    contractId: Type.Union([Type.String({ minLength: 1 }), Type.Null()]),
+    contractDigest: Type.Union([DigestSchema, Type.Null()]),
+    missing: EnvelopeBoundarySchema,
+});
+export const AuthEnvelopeShrinkImpactedIdentityEnvelopeSchema = Type.Object({
+    identityEnvelopeId: Type.String({ minLength: 1 }),
+    identityAnchor: IdentityAnchorViewSchema,
+    missing: EnvelopeBoundarySchema,
+});
+export const AuthEnvelopeShrinkImpactedRequestSchema = Type.Object({
+    requestId: Type.String({ minLength: 1 }),
+    missing: EnvelopeBoundarySchema,
+});
+export const AuthEnvelopeChangeImpactSchema = Type.Object({
+    removed: EnvelopeBoundarySchema,
+    impactedSessions: Type.Array(AuthEnvelopeShrinkImpactedSessionSchema),
+    impactedServiceInstances: Type.Array(AuthEnvelopeShrinkMissingBoundarySchema),
+    impactedDeviceSessions: Type.Array(AuthEnvelopeShrinkImpactedSessionSchema),
+    impactedIdentityEnvelopes: Type.Array(AuthEnvelopeShrinkImpactedIdentityEnvelopeSchema),
+    impactedPendingRequests: Type.Array(AuthEnvelopeShrinkImpactedRequestSchema),
+    orphanedResources: Type.Array(AuthEnvelopeShrinkResourceSchema),
+});
+export const AuthEnvelopesChangesPreviewSchema = Type.Object({
     deploymentId: Type.String({ minLength: 1 }),
+    proposedBoundary: EnvelopeBoundarySchema,
 });
-export const AuthEnableServiceDeploymentResponseSchema = Type.Object({
-    deployment: ServiceDeploymentSchema,
+export const AuthEnvelopesChangesPreviewResponseSchema = Type.Object({
+    current: DeploymentEnvelopeSchema,
+    proposed: DeploymentEnvelopeSchema,
+    impact: AuthEnvelopeChangeImpactSchema,
 });
-export const AuthRemoveServiceDeploymentSchema = Type.Object({
+export const AuthEnvelopesShrinkSchema = Type.Object({
     deploymentId: Type.String({ minLength: 1 }),
+    proposedBoundary: EnvelopeBoundarySchema,
+    confirm: Type.Boolean(),
 });
-export const AuthRemoveServiceDeploymentResponseSchema = Type.Object({
-    success: Type.Boolean(),
+export const AuthEnvelopesShrinkResponseSchema = Type.Object({
+    envelope: DeploymentEnvelopeSchema,
+    impact: AuthEnvelopeChangeImpactSchema,
+    retainedResources: Type.Array(AuthEnvelopeShrinkResourceSchema),
 });
-export const AuthProvisionServiceInstanceSchema = Type.Object({
+export const AuthServiceInstancesProvisionSchema = Type.Object({
     deploymentId: Type.String({ minLength: 1 }),
     instanceKey: Type.String({ minLength: 1 }),
 });
-export const AuthProvisionServiceInstanceResponseSchema = Type.Object({
+export const AuthServiceInstancesProvisionResponseSchema = Type.Object({
     instance: ServiceInstanceSchema,
 });
-export const AuthListServiceInstancesSchema = Type.Object({
+export const AuthServiceInstancesListSchema = Type.Object({
     deploymentId: Type.Optional(Type.String({ minLength: 1 })),
     disabled: Type.Optional(Type.Boolean()),
+    offset: Type.Optional(Type.Integer({ minimum: 0 })),
+    limit: Type.Integer({ minimum: 0, maximum: 500 }),
 });
-export const AuthListServiceInstancesResponseSchema = Type.Object({
-    instances: Type.Array(ServiceInstanceSchema),
+export const AuthServiceInstancesListResponseSchema = Type.Object({
+    ...PageResponseSchema(ServiceInstanceSchema).properties,
 });
-export const AuthDisableServiceInstanceSchema = Type.Object({
+export const AuthServiceInstancesDisableSchema = Type.Object({
     instanceId: Type.String({ minLength: 1 }),
 });
-export const AuthDisableServiceInstanceResponseSchema = Type.Object({
+export const AuthServiceInstancesDisableResponseSchema = Type.Object({
     instance: ServiceInstanceSchema,
 });
-export const AuthEnableServiceInstanceSchema = Type.Object({
+export const AuthServiceInstancesEnableSchema = Type.Object({
     instanceId: Type.String({ minLength: 1 }),
 });
-export const AuthEnableServiceInstanceResponseSchema = Type.Object({
+export const AuthServiceInstancesEnableResponseSchema = Type.Object({
     instance: ServiceInstanceSchema,
 });
-export const AuthRemoveServiceInstanceSchema = Type.Object({
+export const AuthServiceInstancesRemoveSchema = Type.Object({
     instanceId: Type.String({ minLength: 1 }),
 });
-export const AuthRemoveServiceInstanceResponseSchema = Type.Object({
+export const AuthServiceInstancesRemoveResponseSchema = Type.Object({
     success: Type.Boolean(),
 });
 export const ContractAnalysisSummarySchema = Type.Object({
@@ -292,53 +513,30 @@ export const ContractAnalysisSchema = Type.Object({
         jobs: Type.Array(ContractAnalysisJobsQueueSchema),
     }),
 });
-export const InstalledContractSchema = Type.Object({
-    digest: DigestSchema,
-    id: Type.String({ minLength: 1 }),
-    displayName: Type.String({ minLength: 1 }),
-    description: Type.String({ minLength: 1 }),
-    installedAt: IsoDateStringSchema,
-    analysisSummary: Type.Optional(ContractAnalysisSummarySchema),
-});
-export const InstalledContractDetailSchema = Type.Object({
-    digest: DigestSchema,
-    id: Type.String({ minLength: 1 }),
-    displayName: Type.String({ minLength: 1 }),
-    description: Type.String({ minLength: 1 }),
-    installedAt: IsoDateStringSchema,
-    analysisSummary: Type.Optional(ContractAnalysisSummarySchema),
-    analysis: Type.Optional(ContractAnalysisSchema),
-    resources: Type.Optional(ContractResourcesSchema),
-    contract: OpenObjectSchema,
-});
-export const AuthListInstalledContractsSchema = Type.Object({});
-export const AuthListInstalledContractsResponseSchema = Type.Object({
-    contracts: Type.Array(InstalledContractSchema),
-});
-export const AuthGetInstalledContractSchema = Type.Object({
-    digest: DigestSchema,
-});
-export const AuthGetInstalledContractResponseSchema = Type.Object({
-    contract: InstalledContractDetailSchema,
-});
 export const AuthenticatedUserSchema = Type.Object({
-    id: Type.String(),
-    origin: Type.String(),
+    userId: Type.String({ minLength: 1 }),
     active: Type.Boolean(),
     name: Type.String(),
     email: Type.String(),
     image: Type.Optional(Type.String()),
     capabilities: Type.Array(Type.String()),
+    identity: Type.Object({
+        identityId: Type.String({ minLength: 1 }),
+        provider: Type.String({ minLength: 1 }),
+        subject: Type.String({ minLength: 1 }),
+    }),
     lastLogin: Type.Optional(IsoDateStringSchema),
 });
-export const AuthMeSchema = Type.Object({});
-export const AuthValidateRequestSchema = Type.Object({
-    sessionKey: Type.String(),
-    proof: Type.String(),
-    subject: Type.String(),
-    payloadHash: Type.String(),
-    capabilities: Type.Optional(Type.Array(Type.String())),
-}, { additionalProperties: false });
+export const AuthSessionsMeSchema = Type.Object({});
+export const AuthRequestsValidateSchema = Type.Object({
+    sessionKey: Type.String({ minLength: 1 }),
+    proof: Type.String({ minLength: 1 }),
+    subject: Type.String({ minLength: 1 }),
+    payloadHash: Type.String({ minLength: 1 }),
+    iat: Type.Integer(),
+    requestId: Type.String({ minLength: 1 }),
+    capabilities: Type.Optional(Type.Array(Type.String({ minLength: 1 }))),
+});
 export const AuthenticatedServiceSchema = Type.Object({
     type: Type.Literal("service"),
     id: Type.String(),
@@ -367,7 +565,7 @@ const NullableAuthenticatedServiceSchema = Type.Union([
     AuthenticatedServiceSchema,
     Type.Null(),
 ]);
-export const AuthMeResponseSchema = Type.Object({
+export const AuthSessionsMeResponseSchema = Type.Object({
     participantKind: ParticipantKindSchema,
     user: NullableAuthenticatedUserSchema,
     device: NullableAuthenticatedDeviceSchema,
@@ -377,40 +575,46 @@ export const CallerViewSchema = Type.Union([
     Type.Object({
         type: Type.Literal("user"),
         participantKind: UserParticipantKindSchema,
-        trellisId: Type.String(),
-        id: Type.String(),
-        origin: Type.String(),
+        userId: Type.String({ minLength: 1 }),
+        identity: Type.Object({
+            identityId: Type.String({ minLength: 1 }),
+            provider: Type.String({ minLength: 1 }),
+            subject: Type.String({ minLength: 1 }),
+        }),
         active: Type.Boolean(),
         name: Type.String(),
         email: Type.String(),
         image: Type.Optional(Type.String()),
         capabilities: Type.Array(Type.String()),
+        lastAuth: IsoDateStringSchema,
     }),
     AuthenticatedServiceSchema,
     AuthenticatedDeviceSchema,
 ]);
-export const AuthValidateRequestResponseSchema = Type.Object({
+export const AuthRequestsValidateResponseSchema = Type.Object({
     allowed: Type.Boolean(),
     inboxPrefix: Type.String(),
     caller: CallerViewSchema,
 });
-export const AuthListApprovalsSchema = Type.Object({
+export const AuthIdentitiesListSchema = Type.Object({
     user: Type.Optional(Type.String({ minLength: 1 })),
-    digest: Type.Optional(DigestSchema),
+    offset: Type.Optional(Type.Integer({ minimum: 0 })),
+    limit: Type.Integer({ minimum: 0, maximum: 500 }),
 });
-export const AuthListApprovalsResponseSchema = Type.Object({
-    approvals: Type.Array(ApprovalRecordViewSchema),
+export const AuthIdentitiesListResponseSchema = Type.Object({
+    ...PageResponseSchema(ApprovalRecordViewSchema).properties,
 });
-export const AuthRevokeApprovalSchema = Type.Object({
-    contractDigest: DigestSchema,
+export const AuthIdentityEnvelopesRevokeSchema = Type.Object({
+    identityEnvelopeId: Type.String({ minLength: 1 }),
     user: Type.Optional(Type.String({ minLength: 1 })),
 });
-export const AuthRevokeApprovalResponseSchema = Type.Object({
+export const AuthIdentityEnvelopesRevokeResponseSchema = Type.Object({
     success: Type.Boolean(),
 });
 export const UserGrantViewSchema = Type.Object({
-    contractDigest: DigestSchema,
-    contractId: Type.String({ minLength: 1 }),
+    identityEnvelopeId: Type.String({ minLength: 1 }),
+    identityAnchor: IdentityAnchorViewSchema,
+    contractEvidence: ContractEvidenceViewSchema,
     displayName: Type.String({ minLength: 1 }),
     description: Type.String({ minLength: 1 }),
     participantKind: UserParticipantKindSchema,
@@ -418,48 +622,140 @@ export const UserGrantViewSchema = Type.Object({
     grantedAt: IsoDateStringSchema,
     updatedAt: IsoDateStringSchema,
 });
-export const AuthListUserGrantsSchema = Type.Object({});
-export const AuthListUserGrantsResponseSchema = Type.Object({
-    grants: Type.Array(UserGrantViewSchema),
+export const AuthIdentitiesGrantsListSchema = Type.Object({
+    offset: Type.Optional(Type.Integer({ minimum: 0 })),
+    limit: Type.Integer({ minimum: 0, maximum: 500 }),
 });
-export const AuthRevokeUserGrantSchema = Type.Object({
-    contractDigest: DigestSchema,
+export const AuthIdentitiesGrantsListResponseSchema = Type.Object({
+    ...PageResponseSchema(UserGrantViewSchema).properties,
 });
-export const AuthRevokeUserGrantResponseSchema = Type.Object({
-    success: Type.Boolean(),
-});
-export const PortalSchema = Type.Object({
+export const LoginPortalRecordSchema = Type.Object({
     portalId: Type.String({ minLength: 1 }),
-    entryUrl: Type.String({ minLength: 1 }),
+    displayName: Type.String({ minLength: 1 }),
+    entryUrl: Type.Union([Type.String({ minLength: 1 }), Type.Null()]),
+    builtIn: Type.Boolean(),
     disabled: Type.Boolean(),
+    createdAt: IsoDateStringSchema,
+    updatedAt: IsoDateStringSchema,
 });
-export const PortalProfileSchema = Type.Object({
+export const LoginPortalSettingsSchema = Type.Object({
     portalId: Type.String({ minLength: 1 }),
-    entryUrl: Type.String({ minLength: 1 }),
-    contractId: Type.String({ minLength: 1 }),
-    allowedOrigins: Type.Optional(Type.Array(Type.String({ minLength: 1 }))),
-    impliedCapabilities: Type.Array(Type.String()),
+    localRegistrationEnabled: Type.Boolean(),
+    federatedRegistrationEnabled: Type.Boolean(),
+    allowedFederatedProviders: Type.Union([
+        Type.Array(Type.String({ minLength: 1 })),
+        Type.Null(),
+    ]),
+    selfRegisteredAccountActive: Type.Boolean(),
+    updatedAt: IsoDateStringSchema,
+});
+export const LoginPortalFederatedProviderSchema = Type.Object({
+    id: Type.String({ minLength: 1 }),
+    displayName: Type.String({ minLength: 1 }),
+    type: Type.String({ minLength: 1 }),
+});
+export const LoginPortalRouteSchema = Type.Object({
+    routeKey: Type.String({ minLength: 1 }),
+    portalId: Type.String({ minLength: 1 }),
+    contractId: Type.Union([Type.String({ minLength: 1 }), Type.Null()]),
+    origin: Type.Union([Type.String({ minLength: 1 }), Type.Null()]),
     disabled: Type.Boolean(),
-    createdAt: IsoDateStringSchema,
     updatedAt: IsoDateStringSchema,
 });
-const NullablePortalIdSchema = Type.Union([
-    Type.String({ minLength: 1 }),
-    Type.Null(),
-]);
-export const LoginPortalDefaultSchema = Type.Object({
-    portalId: NullablePortalIdSchema,
+export const LoginPortalSummarySchema = Type.Object({
+    ...LoginPortalRecordSchema.properties,
+    routeCount: Type.Integer({ minimum: 0 }),
+    activeRouteCount: Type.Integer({ minimum: 0 }),
 });
-export const DevicePortalDefaultSchema = Type.Object({
-    portalId: NullablePortalIdSchema,
+export const AuthPortalsListSchema = Type.Object({
+    offset: Type.Optional(Type.Integer({ minimum: 0 })),
+    limit: Type.Integer({ minimum: 0, maximum: 500 }),
 });
-export const LoginPortalSelectionSchema = Type.Object({
-    contractId: Type.String({ minLength: 1 }),
-    portalId: NullablePortalIdSchema,
+export const AuthPortalsListResponseSchema = Type.Object({
+    ...PageResponseSchema(LoginPortalSummarySchema).properties,
 });
-export const DevicePortalSelectionSchema = Type.Object({
-    deploymentId: Type.String({ minLength: 1 }),
-    portalId: NullablePortalIdSchema,
+export const AuthPortalsGetSchema = Type.Object({
+    portalId: Type.String({ minLength: 1 }),
+});
+export const AuthPortalsGetResponseSchema = Type.Object({
+    portal: LoginPortalRecordSchema,
+    settings: LoginPortalSettingsSchema,
+    routes: Type.Array(LoginPortalRouteSchema),
+    defaultCapabilities: Type.Array(Type.String({ minLength: 1 })),
+    defaultCapabilityGroups: Type.Array(Type.String({ minLength: 1 })),
+    federatedProviders: Type.Array(LoginPortalFederatedProviderSchema),
+});
+export const AuthPortalsPutSchema = Type.Object({
+    portalId: Type.String({ minLength: 1 }),
+    displayName: Type.String({ minLength: 1 }),
+    entryUrl: Type.String({ minLength: 1 }),
+    disabled: Type.Optional(Type.Boolean()),
+});
+export const AuthPortalsPutResponseSchema = Type.Object({
+    portal: LoginPortalRecordSchema,
+});
+export const AuthPortalsRemoveSchema = Type.Object({
+    portalId: Type.String({ minLength: 1 }),
+});
+export const AuthPortalsRemoveResponseSchema = Type.Object({
+    success: Type.Boolean(),
+});
+export const AuthPortalsLoginSettingsGetSchema = Type.Object({
+    portalId: Type.String({ minLength: 1 }),
+});
+export const AuthPortalsLoginSettingsResponseSchema = Type.Object({
+    portal: LoginPortalRecordSchema,
+    settings: LoginPortalSettingsSchema,
+    defaultCapabilities: Type.Array(Type.String({ minLength: 1 })),
+    defaultCapabilityGroups: Type.Array(Type.String({ minLength: 1 })),
+    federatedProviders: Type.Array(LoginPortalFederatedProviderSchema),
+});
+export const AuthPortalsLoginSettingsUpdateSchema = Type.Object({
+    portalId: Type.String({ minLength: 1 }),
+    localRegistrationEnabled: Type.Boolean(),
+    federatedRegistrationEnabled: Type.Boolean(),
+    allowedFederatedProviders: Type.Union([
+        Type.Array(Type.String({ minLength: 1 })),
+        Type.Null(),
+    ]),
+    selfRegisteredAccountActive: Type.Boolean(),
+    defaultCapabilities: Type.Array(Type.String({ minLength: 1 })),
+    defaultCapabilityGroups: Type.Array(Type.String({ minLength: 1 })),
+});
+export const AuthPortalsRoutesPutSchema = Type.Object({
+    portalId: Type.String({ minLength: 1 }),
+    contractId: Type.Optional(Type.Union([
+        Type.String({ minLength: 1 }),
+        Type.Null(),
+    ])),
+    origin: Type.Optional(Type.Union([Type.String({ minLength: 1 }), Type.Null()])),
+    disabled: Type.Optional(Type.Boolean()),
+});
+export const AuthPortalsRoutesPutResponseSchema = Type.Object({
+    route: LoginPortalRouteSchema,
+});
+export const AuthPortalsRoutesRemoveSchema = Type.Object({
+    portalId: Type.String({ minLength: 1 }),
+    contractId: Type.Optional(Type.Union([
+        Type.String({ minLength: 1 }),
+        Type.Null(),
+    ])),
+    origin: Type.Optional(Type.Union([Type.String({ minLength: 1 }), Type.Null()])),
+});
+export const AuthPortalsRoutesRemoveResponseSchema = Type.Object({
+    success: Type.Boolean(),
+});
+export const FlowRegistrationAvailabilitySchema = Type.Object({
+    localIdentity: Type.Object({
+        available: Type.Boolean(),
+    }),
+    federatedIdentity: Type.Object({
+        available: Type.Boolean(),
+        providers: Type.Array(Type.Object({
+            id: Type.String({ minLength: 1 }),
+            displayName: Type.String({ minLength: 1 }),
+        })),
+    }),
 });
 export const PortalFlowStateSchema = Type.Union([
     Type.Object({
@@ -476,6 +772,8 @@ export const PortalFlowStateSchema = Type.Union([
             description: Type.String({ minLength: 1 }),
             context: Type.Optional(OpenObjectSchema),
         }),
+        portal: Type.Optional(LoginPortalRecordSchema),
+        registration: Type.Optional(FlowRegistrationAvailabilitySchema),
     }),
     Type.Object({
         status: Type.Literal("approval_required"),
@@ -487,12 +785,12 @@ export const PortalFlowStateSchema = Type.Union([
             email: Type.Optional(Type.String({ minLength: 1 })),
             image: Type.Optional(Type.String({ minLength: 1 })),
         }),
-        approval: ContractApprovalViewSchema,
+        approval: ApprovalEvidenceViewSchema,
     }),
     Type.Object({
         status: Type.Literal("approval_denied"),
         flowId: Type.String({ minLength: 1 }),
-        approval: ContractApprovalViewSchema,
+        approval: ApprovalEvidenceViewSchema,
         returnLocation: Type.Optional(Type.String({ minLength: 1 })),
     }),
     Type.Object({
@@ -503,7 +801,7 @@ export const PortalFlowStateSchema = Type.Union([
             id: Type.String({ minLength: 1 }),
             name: Type.Optional(Type.String({ minLength: 1 })),
         })),
-        approval: ContractApprovalViewSchema,
+        approval: ApprovalEvidenceViewSchema,
         missingCapabilities: Type.Array(Type.String()),
         userCapabilities: Type.Array(Type.String()),
         returnLocation: Type.Optional(Type.String({ minLength: 1 })),
@@ -516,11 +814,91 @@ export const PortalFlowStateSchema = Type.Union([
         status: Type.Literal("expired"),
     }),
 ]);
-export const DeviceDeploymentSchema = Type.Object({
+export const DeviceDeploymentSchema = Type.Unsafe(Type.Object({
     deploymentId: Type.String({ minLength: 1 }),
     reviewMode: Type.Optional(Type.Union([Type.Literal("none"), Type.Literal("required")])),
     disabled: Type.Boolean(),
-    appliedContracts: Type.Array(DeviceAppliedDeploymentContractSchema),
+}));
+export const AuthDeploymentKindSchema = Type.Union([
+    Type.Literal("service"),
+    Type.Literal("device"),
+]);
+export const AuthDeploymentSchema = Type.Union([
+    Type.Object({
+        kind: Type.Literal("service"),
+        deploymentId: Type.String({ minLength: 1 }),
+        namespaces: Type.Array(Type.String({ minLength: 1 })),
+        disabled: Type.Boolean(),
+    }),
+    Type.Object({
+        kind: Type.Literal("device"),
+        deploymentId: Type.String({ minLength: 1 }),
+        reviewMode: Type.Optional(Type.Union([Type.Literal("none"), Type.Literal("required")])),
+        disabled: Type.Boolean(),
+    }),
+]);
+export const AuthDeploymentsCreateSchema = Type.Union([
+    Type.Object({
+        kind: Type.Literal("service"),
+        deploymentId: Type.String({ minLength: 1 }),
+        namespaces: Type.Array(Type.String({ minLength: 1 })),
+    }),
+    Type.Object({
+        kind: Type.Literal("device"),
+        deploymentId: Type.String({ minLength: 1 }),
+        reviewMode: Type.Optional(Type.Union([Type.Literal("none"), Type.Literal("required")])),
+    }),
+]);
+export const AuthDeploymentsCreateResponseSchema = Type.Object({
+    deployment: AuthDeploymentSchema,
+});
+export const AuthDeploymentsListSchema = Type.Object({
+    kind: Type.Optional(AuthDeploymentKindSchema),
+    disabled: Type.Optional(Type.Boolean()),
+    offset: Type.Optional(Type.Integer({ minimum: 0 })),
+    limit: Type.Integer({ minimum: 0, maximum: 500 }),
+});
+export const AuthDeploymentsListResponseSchema = Type.Object({
+    ...PageResponseSchema(AuthDeploymentSchema).properties,
+});
+export const AuthDeploymentsDisableSchema = Type.Object({
+    kind: AuthDeploymentKindSchema,
+    deploymentId: Type.String({ minLength: 1 }),
+});
+export const AuthDeploymentsDisableResponseSchema = Type.Object({
+    deployment: AuthDeploymentSchema,
+});
+export const AuthCatalogIssuesResolveSchema = Type.Object({
+    issueId: Type.String({ minLength: 1 }),
+    action: Type.Union([
+        Type.Literal("keep-current"),
+        Type.Literal("force-replace"),
+    ]),
+});
+export const AuthCatalogIssuesResolveResponseSchema = Type.Object({
+    success: Type.Literal(true),
+    issueId: Type.String({ minLength: 1 }),
+    action: Type.Union([
+        Type.Literal("keep-current"),
+        Type.Literal("force-replace"),
+    ]),
+    ignoredEvidence: Type.Array(DeploymentContractEvidenceSchema),
+});
+export const AuthDeploymentsEnableSchema = Type.Object({
+    kind: AuthDeploymentKindSchema,
+    deploymentId: Type.String({ minLength: 1 }),
+});
+export const AuthDeploymentsEnableResponseSchema = Type.Object({
+    deployment: AuthDeploymentSchema,
+});
+export const AuthDeploymentsRemoveSchema = Type.Object({
+    kind: AuthDeploymentKindSchema,
+    deploymentId: Type.String({ minLength: 1 }),
+    cascade: Type.Optional(Type.Boolean()),
+    purgeUnusedContracts: Type.Optional(Type.Boolean()),
+});
+export const AuthDeploymentsRemoveResponseSchema = Type.Object({
+    success: Type.Boolean(),
 });
 export const DeviceMetadataSchema = Type.Record(Type.String({ minLength: 1 }), Type.String({ minLength: 1 }));
 export const DeviceSchema = Type.Object({
@@ -541,8 +919,13 @@ export const DeviceSchema = Type.Object({
     revokedAt: Type.Union([IsoDateStringSchema, Type.Null()]),
 });
 export const DeviceActivationActorSchema = Type.Object({
-    origin: Type.String({ minLength: 1 }),
-    id: Type.String({ minLength: 1 }),
+    participantKind: UserParticipantKindSchema,
+    userId: Type.String({ minLength: 1 }),
+    identity: Type.Object({
+        identityId: Type.String({ minLength: 1 }),
+        provider: Type.String({ minLength: 1 }),
+        subject: Type.String({ minLength: 1 }),
+    }),
 });
 export const DeviceActivationRecordSchema = Type.Object({
     instanceId: Type.String({ minLength: 1 }),
@@ -567,19 +950,16 @@ export const DeviceActivationReviewSchema = Type.Object({
     decidedAt: Type.Union([IsoDateStringSchema, Type.Null()]),
     reason: Type.Optional(Type.String({ minLength: 1 })),
 });
-export const AuthDeviceActivationReviewRequestedEventSchema = Type.Object({
+export const AuthDeviceUserAuthoritiesReviewRequestedEventSchema = Type.Object({
     reviewId: Type.String({ minLength: 1 }),
     flowId: Type.String({ minLength: 1 }),
     instanceId: Type.String({ minLength: 1 }),
     publicIdentityKey: Type.String({ minLength: 1 }),
     deploymentId: Type.String({ minLength: 1 }),
     requestedAt: IsoDateStringSchema,
-    requestedBy: Type.Object({
-        origin: Type.String({ minLength: 1 }),
-        id: Type.String({ minLength: 1 }),
-    }),
+    requestedBy: DeviceActivationActorSchema,
 });
-export const AuthDeviceActivationRequestedEventSchema = Type.Object({
+export const AuthDeviceUserAuthoritiesRequestedEventSchema = Type.Object({
     flowId: Type.String({ minLength: 1 }),
     instanceId: Type.String({ minLength: 1 }),
     publicIdentityKey: Type.String({ minLength: 1 }),
@@ -587,7 +967,7 @@ export const AuthDeviceActivationRequestedEventSchema = Type.Object({
     requestedAt: IsoDateStringSchema,
     requestedBy: DeviceActivationActorSchema,
 });
-export const AuthDeviceActivationApprovedEventSchema = Type.Object({
+export const AuthDeviceUserAuthoritiesApprovedEventSchema = Type.Object({
     reviewId: Type.String({ minLength: 1 }),
     flowId: Type.String({ minLength: 1 }),
     instanceId: Type.String({ minLength: 1 }),
@@ -596,17 +976,14 @@ export const AuthDeviceActivationApprovedEventSchema = Type.Object({
     requestedAt: IsoDateStringSchema,
     approvedAt: IsoDateStringSchema,
     requestedBy: DeviceActivationActorSchema,
-    approvedBy: Type.Object({
-        id: Type.String({ minLength: 1 }),
-        origin: Type.Optional(Type.String({ minLength: 1 })),
-    }),
+    approvedBy: DeviceActivationActorSchema,
 });
-export const AuthDeviceActivatedEventSchema = Type.Object({
+export const AuthDeviceUserAuthoritiesResolvedEventSchema = Type.Object({
     instanceId: Type.String({ minLength: 1 }),
     publicIdentityKey: Type.String({ minLength: 1 }),
     deploymentId: Type.String({ minLength: 1 }),
-    activatedAt: IsoDateStringSchema,
-    activatedBy: DeviceActivationActorSchema,
+    resolvedAt: IsoDateStringSchema,
+    resolvedBy: DeviceActivationActorSchema,
     flowId: Type.Optional(Type.String({ minLength: 1 })),
     reviewId: Type.Optional(Type.String({ minLength: 1 })),
 });
@@ -621,164 +998,23 @@ export const DeviceConnectInfoSchema = Type.Object({
     }),
     auth: Type.Object({
         mode: Type.Literal("device_identity"),
+        authority: Type.Union([
+            Type.Literal("admin_reviewed"),
+            Type.Literal("user_delegated"),
+        ]),
         iatSkewSeconds: Type.Number(),
     }),
 });
-export const AuthCreatePortalSchema = Type.Object({
-    portalId: Type.String({ minLength: 1 }),
-    entryUrl: Type.String({ minLength: 1 }),
-});
-export const AuthCreatePortalResponseSchema = Type.Object({
-    portal: PortalSchema,
-});
-export const AuthListPortalsSchema = Type.Object({});
-export const AuthListPortalsResponseSchema = Type.Object({
-    portals: Type.Array(PortalSchema),
-});
-export const AuthDisablePortalSchema = Type.Object({
-    portalId: Type.String({ minLength: 1 }),
-});
-export const AuthDisablePortalResponseSchema = Type.Object({
-    success: Type.Boolean(),
-});
-export const AuthListPortalProfilesSchema = Type.Object({});
-export const AuthListPortalProfilesResponseSchema = Type.Object({
-    profiles: Type.Array(PortalProfileSchema),
-});
-export const AuthSetPortalProfileSchema = Type.Object({
-    portalId: Type.String({ minLength: 1 }),
-    entryUrl: Type.String({ minLength: 1 }),
-    contractId: Type.String({ minLength: 1 }),
-    allowedOrigins: Type.Optional(Type.Array(Type.String({ minLength: 1 }))),
-});
-export const AuthSetPortalProfileResponseSchema = Type.Object({
-    profile: PortalProfileSchema,
-});
-export const AuthDisablePortalProfileSchema = Type.Object({
-    portalId: Type.String({ minLength: 1 }),
-});
-export const AuthDisablePortalProfileResponseSchema = Type.Object({
-    profile: PortalProfileSchema,
-});
-export const AuthGetLoginPortalDefaultSchema = Type.Object({});
-export const AuthGetLoginPortalDefaultResponseSchema = Type.Object({
-    defaultPortal: LoginPortalDefaultSchema,
-});
-export const AuthSetLoginPortalDefaultSchema = Type.Object({
-    portalId: NullablePortalIdSchema,
-});
-export const AuthSetLoginPortalDefaultResponseSchema = Type.Object({
-    defaultPortal: LoginPortalDefaultSchema,
-});
-export const AuthListLoginPortalSelectionsSchema = Type.Object({});
-export const AuthListLoginPortalSelectionsResponseSchema = Type.Object({
-    selections: Type.Array(LoginPortalSelectionSchema),
-});
-export const AuthSetLoginPortalSelectionSchema = Type.Object({
-    contractId: Type.String({ minLength: 1 }),
-    portalId: NullablePortalIdSchema,
-});
-export const AuthSetLoginPortalSelectionResponseSchema = Type.Object({
-    selection: LoginPortalSelectionSchema,
-});
-export const AuthClearLoginPortalSelectionSchema = Type.Object({
-    contractId: Type.String({ minLength: 1 }),
-});
-export const AuthClearLoginPortalSelectionResponseSchema = Type.Object({
-    success: Type.Boolean(),
-});
-export const AuthGetDevicePortalDefaultSchema = Type.Object({});
-export const AuthGetDevicePortalDefaultResponseSchema = Type.Object({
-    defaultPortal: DevicePortalDefaultSchema,
-});
-export const AuthSetDevicePortalDefaultSchema = Type.Object({
-    portalId: NullablePortalIdSchema,
-});
-export const AuthSetDevicePortalDefaultResponseSchema = Type.Object({
-    defaultPortal: DevicePortalDefaultSchema,
-});
-export const AuthListDevicePortalSelectionsSchema = Type.Object({});
-export const AuthListDevicePortalSelectionsResponseSchema = Type.Object({
-    selections: Type.Array(DevicePortalSelectionSchema),
-});
-export const AuthSetDevicePortalSelectionSchema = Type.Object({
-    deploymentId: Type.String({ minLength: 1 }),
-    portalId: NullablePortalIdSchema,
-});
-export const AuthSetDevicePortalSelectionResponseSchema = Type.Object({
-    selection: DevicePortalSelectionSchema,
-});
-export const AuthClearDevicePortalSelectionSchema = Type.Object({
-    deploymentId: Type.String({ minLength: 1 }),
-});
-export const AuthClearDevicePortalSelectionResponseSchema = Type.Object({
-    success: Type.Boolean(),
-});
-export const AuthCreateDeviceDeploymentSchema = Type.Object({
-    deploymentId: Type.String({ minLength: 1 }),
-    reviewMode: Type.Optional(Type.Union([Type.Literal("none"), Type.Literal("required")])),
-});
-export const AuthCreateDeviceDeploymentResponseSchema = Type.Object({
-    deployment: DeviceDeploymentSchema,
-});
-export const AuthListDeviceDeploymentsSchema = Type.Object({
-    disabled: Type.Optional(Type.Boolean()),
-});
-export const AuthListDeviceDeploymentsResponseSchema = Type.Object({
-    deployments: Type.Array(DeviceDeploymentSchema),
-});
-export const AuthApplyDeviceDeploymentContractSchema = Type.Object({
-    deploymentId: Type.String({ minLength: 1 }),
-    contract: OpenObjectSchema,
-    expectedDigest: DigestSchema,
-    replaceExisting: Type.Optional(Type.Boolean()),
-});
-export const AuthApplyDeviceDeploymentContractResponseSchema = Type.Object({
-    deployment: DeviceDeploymentSchema,
-    contract: Type.Object({
-        digest: DigestSchema,
-        id: Type.String({ minLength: 1 }),
-        displayName: Type.String({ minLength: 1 }),
-        description: Type.String({ minLength: 1 }),
-        installedAt: IsoDateStringSchema,
-    }),
-});
-export const AuthUnapplyDeviceDeploymentContractSchema = Type.Object({
-    deploymentId: Type.String({ minLength: 1 }),
-    contractId: Type.String({ minLength: 1 }),
-    digests: Type.Optional(Type.Array(DigestSchema)),
-});
-export const AuthUnapplyDeviceDeploymentContractResponseSchema = Type.Object({
-    deployment: DeviceDeploymentSchema,
-});
-export const AuthDisableDeviceDeploymentSchema = Type.Object({
-    deploymentId: Type.String({ minLength: 1 }),
-});
-export const AuthDisableDeviceDeploymentResponseSchema = Type.Object({
-    deployment: DeviceDeploymentSchema,
-});
-export const AuthEnableDeviceDeploymentSchema = Type.Object({
-    deploymentId: Type.String({ minLength: 1 }),
-});
-export const AuthEnableDeviceDeploymentResponseSchema = Type.Object({
-    deployment: DeviceDeploymentSchema,
-});
-export const AuthRemoveDeviceDeploymentSchema = Type.Object({
-    deploymentId: Type.String({ minLength: 1 }),
-});
-export const AuthRemoveDeviceDeploymentResponseSchema = Type.Object({
-    success: Type.Boolean(),
-});
-export const AuthProvisionDeviceInstanceSchema = Type.Object({
+export const AuthDevicesProvisionSchema = Type.Object({
     deploymentId: Type.String({ minLength: 1 }),
     publicIdentityKey: Type.String({ minLength: 1 }),
     activationKey: Type.String({ minLength: 1 }),
     metadata: Type.Optional(DeviceMetadataSchema),
 });
-export const AuthProvisionDeviceInstanceResponseSchema = Type.Object({
+export const AuthDevicesProvisionResponseSchema = Type.Object({
     instance: DeviceSchema,
 });
-export const AuthListDeviceInstancesSchema = Type.Object({
+export const AuthDevicesListSchema = Type.Object({
     deploymentId: Type.Optional(Type.String({ minLength: 1 })),
     state: Type.Optional(Type.Union([
         Type.Literal("registered"),
@@ -786,39 +1022,41 @@ export const AuthListDeviceInstancesSchema = Type.Object({
         Type.Literal("revoked"),
         Type.Literal("disabled"),
     ])),
+    offset: Type.Optional(Type.Integer({ minimum: 0 })),
+    limit: Type.Integer({ minimum: 0, maximum: 500 }),
 });
-export const AuthListDeviceInstancesResponseSchema = Type.Object({
-    instances: Type.Array(DeviceSchema),
+export const AuthDevicesListResponseSchema = Type.Object({
+    ...PageResponseSchema(DeviceSchema).properties,
 });
-export const AuthDisableDeviceInstanceSchema = Type.Object({
+export const AuthDevicesDisableSchema = Type.Object({
     instanceId: Type.String({ minLength: 1 }),
 });
-export const AuthDisableDeviceInstanceResponseSchema = Type.Object({
+export const AuthDevicesDisableResponseSchema = Type.Object({
     instance: DeviceSchema,
 });
-export const AuthEnableDeviceInstanceSchema = Type.Object({
+export const AuthDevicesEnableSchema = Type.Object({
     instanceId: Type.String({ minLength: 1 }),
 });
-export const AuthEnableDeviceInstanceResponseSchema = Type.Object({
+export const AuthDevicesEnableResponseSchema = Type.Object({
     instance: DeviceSchema,
 });
-export const AuthRemoveDeviceInstanceSchema = Type.Object({
+export const AuthDevicesRemoveSchema = Type.Object({
     instanceId: Type.String({ minLength: 1 }),
 });
-export const AuthRemoveDeviceInstanceResponseSchema = Type.Object({
+export const AuthDevicesRemoveResponseSchema = Type.Object({
     success: Type.Boolean(),
 });
-export const AuthActivateDeviceSchema = Type.Object({
+export const AuthResolveDeviceUserAuthoritiesSchema = Type.Object({
     flowId: Type.String({ minLength: 1 }),
 });
-export const AuthActivateDeviceProgressSchema = Type.Object({
+export const AuthResolveDeviceUserAuthoritiesProgressSchema = Type.Object({
     status: Type.Literal("pending_review"),
     reviewId: Type.String({ minLength: 1 }),
     instanceId: Type.String({ minLength: 1 }),
     deploymentId: Type.String({ minLength: 1 }),
     requestedAt: IsoDateStringSchema,
 });
-export const AuthActivateDeviceResponseSchema = Type.Union([
+export const AuthResolveDeviceUserAuthoritiesResponseSchema = Type.Union([
     Type.Object({
         status: Type.Literal("activated"),
         instanceId: Type.String({ minLength: 1 }),
@@ -844,31 +1082,41 @@ export const WaitForDeviceActivationResponseSchema = Type.Union([
         reason: Type.Optional(Type.String({ minLength: 1 })),
     }),
 ]);
-export const AuthGetDeviceConnectInfoSchema = Type.Object({
+export const WaitForDeviceActivationRequestSchema = Type.Object({
+    flowId: Type.String({ minLength: 1 }),
+    publicIdentityKey: Type.String({ minLength: 1 }),
+    nonce: Type.String({ minLength: 1 }),
+    contractDigest: DigestSchema,
+    iat: Type.Number(),
+    sig: Type.String({ minLength: 1 }),
+});
+export const AuthDevicesConnectInfoGetSchema = Type.Object({
     publicIdentityKey: Type.String({ minLength: 1 }),
     contractDigest: DigestSchema,
     iat: Type.Number(),
     sig: Type.String({ minLength: 1 }),
-}, { additionalProperties: false });
-export const AuthGetDeviceConnectInfoResponseSchema = Type.Object({
+});
+export const AuthDevicesConnectInfoGetResponseSchema = Type.Object({
     status: Type.Literal("ready"),
     connectInfo: DeviceConnectInfoSchema,
 });
-export const AuthListDeviceActivationsSchema = Type.Object({
+export const AuthDeviceUserAuthoritiesListSchema = Type.Object({
     instanceId: Type.Optional(Type.String({ minLength: 1 })),
     deploymentId: Type.Optional(Type.String({ minLength: 1 })),
     state: Type.Optional(Type.Union([Type.Literal("activated"), Type.Literal("revoked")])),
+    offset: Type.Optional(Type.Integer({ minimum: 0 })),
+    limit: Type.Integer({ minimum: 0, maximum: 500 }),
 });
-export const AuthListDeviceActivationsResponseSchema = Type.Object({
-    activations: Type.Array(DeviceActivationRecordSchema),
+export const AuthDeviceUserAuthoritiesListResponseSchema = Type.Object({
+    ...PageResponseSchema(DeviceActivationRecordSchema).properties,
 });
-export const AuthRevokeDeviceActivationSchema = Type.Object({
+export const AuthDeviceUserAuthoritiesRevokeSchema = Type.Object({
     instanceId: Type.String({ minLength: 1 }),
 });
-export const AuthRevokeDeviceActivationResponseSchema = Type.Object({
+export const AuthDeviceUserAuthoritiesRevokeResponseSchema = Type.Object({
     success: Type.Boolean(),
 });
-export const AuthListDeviceActivationReviewsSchema = Type.Object({
+export const AuthDeviceUserAuthoritiesReviewsListSchema = Type.Object({
     instanceId: Type.Optional(Type.String({ minLength: 1 })),
     deploymentId: Type.Optional(Type.String({ minLength: 1 })),
     state: Type.Optional(Type.Union([
@@ -876,38 +1124,162 @@ export const AuthListDeviceActivationReviewsSchema = Type.Object({
         Type.Literal("approved"),
         Type.Literal("rejected"),
     ])),
+    offset: Type.Optional(Type.Integer({ minimum: 0 })),
+    limit: Type.Integer({ minimum: 0, maximum: 500 }),
 });
-export const AuthListDeviceActivationReviewsResponseSchema = Type.Object({
-    reviews: Type.Array(DeviceActivationReviewSchema),
+export const AuthDeviceUserAuthoritiesReviewsListResponseSchema = Type.Object({
+    ...PageResponseSchema(DeviceActivationReviewSchema).properties,
 });
-export const AuthDecideDeviceActivationReviewSchema = Type.Object({
+export const AuthDeviceUserAuthoritiesReviewsDecideSchema = Type.Object({
     reviewId: Type.String({ minLength: 1 }),
     decision: Type.Union([Type.Literal("approve"), Type.Literal("reject")]),
     reason: Type.Optional(Type.String({ minLength: 1 })),
 });
-export const AuthDecideDeviceActivationReviewResponseSchema = Type.Object({
+export const AuthDeviceUserAuthoritiesReviewsDecideResponseSchema = Type.Object({
     review: DeviceActivationReviewSchema,
     activation: Type.Optional(DeviceActivationRecordSchema),
     confirmationCode: Type.Optional(Type.String({ minLength: 1 })),
 });
+export const UserIdentityViewSchema = Type.Object({
+    identityId: Type.String({ minLength: 1 }),
+    provider: Type.String({ minLength: 1 }),
+    subject: Type.String({ minLength: 1 }),
+    displayName: Type.Union([Type.String({ minLength: 1 }), Type.Null()]),
+    email: Type.Union([Type.String({ minLength: 1 }), Type.Null()]),
+    emailVerified: Type.Boolean(),
+    linkedAt: IsoDateStringSchema,
+    lastLoginAt: Type.Union([IsoDateStringSchema, Type.Null()]),
+});
 export const UserViewSchema = Type.Object({
-    origin: Type.String(),
-    id: Type.String(),
+    userId: Type.String({ minLength: 1 }),
     name: Type.Optional(Type.String()),
     email: Type.Optional(Type.String()),
     active: Type.Boolean(),
     capabilities: Type.Array(Type.String()),
+    capabilityGroups: Type.Array(Type.String()),
+    identities: Type.Array(UserIdentityViewSchema),
 });
-export const AuthListUsersSchema = Type.Object({});
-export const AuthListUsersResponseSchema = Type.Object({
-    users: Type.Array(UserViewSchema),
+export const AuthUsersListSchema = Type.Object({
+    offset: Type.Optional(Type.Integer({ minimum: 0 })),
+    limit: Type.Integer({ minimum: 0, maximum: 500 }),
 });
-export const AuthUpdateUserSchema = Type.Object({
-    origin: Type.String(),
-    id: Type.String(),
+export const AuthUsersListResponseSchema = Type.Object({
+    ...PageResponseSchema(UserViewSchema).properties,
+});
+export const AuthUsersGetSchema = Type.Object({
+    userId: Type.String({ minLength: 1 }),
+});
+export const AuthUsersGetResponseSchema = Type.Object({
+    user: UserViewSchema,
+});
+export const AuthUsersCreateSchema = Type.Object({
+    name: Type.Optional(Type.String({ minLength: 1 })),
+    email: Type.Optional(Type.String({ minLength: 1 })),
+    username: Type.Optional(Type.String({ minLength: 1 })),
+    active: Type.Optional(Type.Boolean()),
+    capabilities: Type.Optional(Type.Array(Type.String({ minLength: 1 }))),
+    capabilityGroups: Type.Optional(Type.Array(Type.String({ minLength: 1 }))),
+});
+export const AuthUsersCreateResponseSchema = Type.Object({
+    user: UserViewSchema,
+});
+export const AuthUsersIdentityLinkCreateSchema = Type.Object({
+    returnTo: Type.Optional(Type.String({ minLength: 1 })),
+});
+export const AuthUsersPasswordChangeSchema = Type.Object({
+    currentPassword: Type.String({ minLength: 1 }),
+    newPassword: Type.String({ minLength: 1 }),
+});
+export const AuthUsersPasswordChangeResponseSchema = Type.Object({
+    success: Type.Boolean(),
+});
+export const AuthUsersPasswordResetCreateSchema = Type.Object({
+    userId: Type.String({ minLength: 1 }),
+    expiresInSeconds: Type.Optional(Type.Integer({ minimum: 60, maximum: 2592000 })),
+});
+export const AuthUsersAccountFlowCreateResponseSchema = Type.Object({
+    flowId: Type.String({ minLength: 1 }),
+    url: Type.String({ minLength: 1 }),
+    expiresAt: IsoDateStringSchema,
+});
+export const CapabilityDefinitionSchema = Type.Object({
+    key: Type.String({ minLength: 1 }),
+    displayName: Type.String({ minLength: 1 }),
+    description: Type.String({ minLength: 1 }),
+    consequence: Type.Optional(Type.String({ minLength: 1 })),
+    source: Type.Union([Type.Literal("contract"), Type.Literal("platform")]),
+    contractId: Type.Optional(Type.String({ minLength: 1 })),
+    contractDigest: Type.Optional(DigestSchema),
+    contractDisplayName: Type.Optional(Type.String({ minLength: 1 })),
+});
+export const AuthCapabilitiesListSchema = Type.Object({
+    offset: Type.Optional(Type.Integer({ minimum: 0 })),
+    limit: Type.Integer({ minimum: 0, maximum: 500 }),
+});
+export const AuthCapabilitiesListResponseSchema = Type.Object({
+    ...PageResponseSchema(CapabilityDefinitionSchema).properties,
+});
+export const CapabilityGroupSchema = Type.Object({
+    groupKey: Type.String({ minLength: 1 }),
+    displayName: Type.String({ minLength: 1 }),
+    description: Type.String({ minLength: 1 }),
+    capabilities: Type.Array(Type.String({ minLength: 1 })),
+    includedGroups: Type.Array(Type.String({ minLength: 1 })),
+    createdAt: IsoDateStringSchema,
+    updatedAt: IsoDateStringSchema,
+});
+export const AuthCapabilityGroupsListSchema = Type.Object({
+    offset: Type.Optional(Type.Integer({ minimum: 0 })),
+    limit: Type.Integer({ minimum: 0, maximum: 500 }),
+});
+export const AuthCapabilityGroupsListResponseSchema = Type.Object({
+    ...PageResponseSchema(CapabilityGroupSchema).properties,
+});
+export const AuthCapabilityGroupsGetSchema = Type.Object({
+    groupKey: Type.String({ minLength: 1 }),
+});
+export const AuthCapabilityGroupsGetResponseSchema = Type.Object({
+    group: CapabilityGroupSchema,
+});
+export const AuthCapabilityGroupsPutSchema = Type.Object({
+    groupKey: Type.String({ minLength: 1 }),
+    displayName: Type.String({ minLength: 1 }),
+    description: Type.String({ minLength: 1 }),
+    capabilities: Type.Optional(Type.Array(Type.String({ minLength: 1 }))),
+    includedGroups: Type.Optional(Type.Array(Type.String({ minLength: 1 }))),
+});
+export const AuthCapabilityGroupsPutResponseSchema = Type.Object({
+    group: CapabilityGroupSchema,
+});
+export const AuthCapabilityGroupsDeleteSchema = Type.Object({
+    groupKey: Type.String({ minLength: 1 }),
+});
+export const AuthCapabilityGroupsDeleteResponseSchema = Type.Object({
+    success: Type.Boolean(),
+});
+export const AuthUsersUpdateSchema = Type.Object({
+    userId: Type.String({ minLength: 1 }),
     active: Type.Optional(Type.Boolean()),
     capabilities: Type.Optional(Type.Array(Type.String())),
+    capabilityGroups: Type.Optional(Type.Array(Type.String({ minLength: 1 }))),
+    name: Type.Optional(Type.String()),
+    email: Type.Optional(Type.String()),
+});
+export const AuthUsersUpdateResponseSchema = Type.Object({
+    success: Type.Boolean(),
+});
+export const AuthUserIdentitiesListSchema = Type.Object({
+    userId: Type.String({ minLength: 1 }),
+    offset: Type.Optional(Type.Integer({ minimum: 0 })),
+    limit: Type.Integer({ minimum: 0, maximum: 500 }),
+});
+export const AuthUserIdentitiesListResponseSchema = Type.Object({
+    ...PageResponseSchema(UserIdentityViewSchema).properties,
+});
+export const AuthUserIdentitiesUnlinkSchema = Type.Object({
+    userId: Type.String({ minLength: 1 }),
+    identityId: Type.String({ minLength: 1 }),
 });
-export const AuthUpdateUserResponseSchema = Type.Object({
+export const AuthUserIdentitiesUnlinkResponseSchema = Type.Object({
     success: Type.Boolean(),
 });