@robosystems/client 1.8.1 → 1.10.0

package/sdk/types.gen.d.ts

@@ -461,6 +461,38 @@ export type AttributionFilter = {
      */
     predicate: LineItemMetadataPredicate;
 };
+/**
+ * AuthProvidersResponse
+ *
+ * Auth posture response model.
+ *
+ * Describes which authentication methods this deployment offers so the
+ * login surface can render the correct posture from runtime configuration.
+ */
+export type AuthProvidersResponse = {
+    /**
+     * Password Auth
+     *
+     * Whether password authentication is available
+     */
+    password_auth: boolean;
+    /**
+     * OIDC SSO availability
+     */
+    oidc: OidcProviderInfo;
+    /**
+     * Registration
+     *
+     * Whether self-service registration is open
+     */
+    registration: boolean;
+    /**
+     * Passkeys
+     *
+     * Whether passkey authentication is available
+     */
+    passkeys: boolean;
+};
 /**
  * AuthResponse
  *
@@ -489,6 +521,18 @@ export type AuthResponse = {
      * Success message
      */
     message: string;
+    /**
+     * Status
+     *
+     * Login flow state: authenticated (token present), or a passkey MFA step is required before a session is issued (mfa_token present)
+     */
+    status?: 'authenticated' | 'mfa_required' | 'mfa_enrollment_required';
+    /**
+     * Mfa Token
+     *
+     * Short-lived token authorizing the MFA second step or forced enrollment; present only when status is not 'authenticated'
+     */
+    mfa_token?: string | null;
     /**
      * Token
      *
@@ -1247,6 +1291,21 @@ export type CancelSubscriptionRequest = {
      */
     user_id?: string | null;
 };
+/**
+ * CeremonyOptionsResponse
+ *
+ * WebAuthn options for the browser, verbatim from the RP library.
+ */
+export type CeremonyOptionsResponse = {
+    /**
+     * Options
+     *
+     * PublicKeyCredential options (browser JSON, opaque)
+     */
+    options: {
+        [key: string]: unknown;
+    };
+};
 /**
  * ChangeReportingStyleRequest
  *
@@ -8586,6 +8645,71 @@ export type MetricObservation = {
      */
     value: number;
 };
+/**
+ * MfaOptionsRequest
+ *
+ * Request assertion options for the second factor.
+ */
+export type MfaOptionsRequest = {
+    /**
+     * Mfa Token
+     *
+     * Token from a login that returned mfa_required
+     */
+    mfa_token: string;
+};
+/**
+ * MfaStatusResponse
+ *
+ * The user's MFA posture, for account settings.
+ */
+export type MfaStatusResponse = {
+    /**
+     * Passkey Count
+     *
+     * Enrolled passkey count
+     */
+    passkey_count: number;
+    /**
+     * Recovery Codes Remaining
+     *
+     * Unused recovery codes remaining
+     */
+    recovery_codes_remaining: number;
+    /**
+     * Enforcement Applies
+     *
+     * Whether the MFA requirement applies to this user's roles
+     */
+    enforcement_applies: boolean;
+};
+/**
+ * MfaVerifyRequest
+ *
+ * Complete the second factor with an assertion or a recovery code.
+ */
+export type MfaVerifyRequest = {
+    /**
+     * Mfa Token
+     *
+     * Token from a login that returned mfa_required
+     */
+    mfa_token: string;
+    /**
+     * Assertion
+     *
+     * WebAuthn assertion (browser JSON, opaque)
+     */
+    assertion?: {
+        [key: string]: unknown;
+    } | null;
+    /**
+     * Recovery Code
+     *
+     * Single-use recovery code
+     */
+    recovery_code?: string | null;
+};
 /**
  * OAuthCallbackRequest
  *
@@ -8706,6 +8830,25 @@ export type OAuthInitResponse = {
      */
     expires_at: string;
 };
+/**
+ * OIDCProviderInfo
+ *
+ * OIDC provider availability model.
+ */
+export type OidcProviderInfo = {
+    /**
+     * Enabled
+     *
+     * Whether OIDC SSO is available
+     */
+    enabled: boolean;
+    /**
+     * Provider Label
+     *
+     * Display label for the OIDC provider (e.g. 'Okta')
+     */
+    provider_label?: string | null;
+};
 /**
  * OfferingRepositoryPlan
  *
@@ -11218,6 +11361,161 @@ export type OrgUsageSummary = {
      */
     storage_limit_gb: number | null;
 };
+/**
+ * PasskeyDeleteRequest
+ *
+ * Re-authentication proof for removing a passkey.
+ */
+export type PasskeyDeleteRequest = {
+    /**
+     * Password
+     *
+     * Current password (password-holding users)
+     */
+    password?: string | null;
+    /**
+     * Assertion
+     *
+     * Fresh WebAuthn assertion from the re-auth ceremony
+     */
+    assertion?: {
+        [key: string]: unknown;
+    } | null;
+};
+/**
+ * PasskeyInfo
+ *
+ * One enrolled passkey, as listed in account settings.
+ */
+export type PasskeyInfo = {
+    /**
+     * Id
+     *
+     * Passkey identifier
+     */
+    id: string;
+    /**
+     * Name
+     *
+     * User-facing label
+     */
+    name: string;
+    /**
+     * Created At
+     *
+     * Enrollment time (ISO 8601)
+     */
+    created_at: string;
+    /**
+     * Last Used At
+     *
+     * Last successful assertion time (ISO 8601)
+     */
+    last_used_at?: string | null;
+    /**
+     * Backup Eligible
+     *
+     * Whether the credential is synced (multi-device) capable
+     */
+    backup_eligible: boolean;
+    /**
+     * Backup State
+     *
+     * Whether the credential is currently backed up
+     */
+    backup_state: boolean;
+};
+/**
+ * PasskeyListResponse
+ *
+ * The user's enrolled passkeys.
+ */
+export type PasskeyListResponse = {
+    /**
+     * Passkeys
+     *
+     * Enrolled passkeys
+     */
+    passkeys: Array<PasskeyInfo>;
+};
+/**
+ * PasskeyLoginVerifyRequest
+ *
+ * Complete a passwordless login with a discoverable-credential assertion.
+ */
+export type PasskeyLoginVerifyRequest = {
+    /**
+     * Assertion
+     *
+     * WebAuthn assertion (browser JSON, opaque)
+     */
+    assertion: {
+        [key: string]: unknown;
+    };
+};
+/**
+ * PasskeyRegisterOptionsRequest
+ *
+ * Begin enrollment. mfa_token is the forced-enrollment lane; omitted for
+ * an authenticated settings-flow enrollment.
+ */
+export type PasskeyRegisterOptionsRequest = {
+    /**
+     * Mfa Token
+     *
+     * Enrollment token from a login that returned mfa_enrollment_required
+     */
+    mfa_token?: string | null;
+};
+/**
+ * PasskeyRegisterVerifyRequest
+ *
+ * Finish enrollment with the authenticator's attestation response.
+ */
+export type PasskeyRegisterVerifyRequest = {
+    /**
+     * Credential
+     *
+     * WebAuthn registration credential (browser JSON, opaque)
+     */
+    credential: {
+        [key: string]: unknown;
+    };
+    /**
+     * Name
+     *
+     * User-facing label for this passkey
+     */
+    name?: string | null;
+    /**
+     * Mfa Token
+     *
+     * Enrollment token when finishing a forced enrollment
+     */
+    mfa_token?: string | null;
+};
+/**
+ * PasskeyRegisterVerifyResponse
+ *
+ * Enrollment result; the first passkey also carries recovery codes and,
+ * in the forced-enrollment lane, the completed login.
+ */
+export type PasskeyRegisterVerifyResponse = {
+    /**
+     * The newly enrolled passkey
+     */
+    passkey: PasskeyInfo;
+    /**
+     * Recovery Codes
+     *
+     * Single-use recovery codes — returned exactly once, at first enrollment
+     */
+    recovery_codes?: Array<string> | null;
+    /**
+     * Completed login (forced-enrollment lane only)
+     */
+    auth?: AuthResponse | null;
+};
 /**
  * PasswordCheckRequest
  *
@@ -11457,7 +11755,13 @@ export type PortalSessionResponse = {
      *
      * Stripe Customer Portal URL where user can manage payment methods
      */
-    portal_url: string;
+    portal_url?: string | null;
+    /**
+     * Billing Disabled
+     *
+     * True when billing is disabled on this deployment (no portal exists)
+     */
+    billing_disabled?: boolean;
 };
 /**
  * PortfolioBlockEnvelope
@@ -12184,6 +12488,40 @@ export type RebuildScheduleRequest = {
      */
     structure_id: string;
 };
+/**
+ * RecoveryCodesRequest
+ *
+ * Re-authentication proof for regenerating recovery codes.
+ */
+export type RecoveryCodesRequest = {
+    /**
+     * Password
+     *
+     * Current password (password-holding users)
+     */
+    password?: string | null;
+    /**
+     * Assertion
+     *
+     * Fresh WebAuthn assertion from the re-auth ceremony
+     */
+    assertion?: {
+        [key: string]: unknown;
+    } | null;
+};
+/**
+ * RecoveryCodesResponse
+ *
+ * A fresh recovery-code set — shown exactly once.
+ */
+export type RecoveryCodesResponse = {
+    /**
+     * Codes
+     *
+     * Single-use recovery codes
+     */
+    codes: Array<string>;
+};
 /**
  * RegenerateReportOperation
  *
@@ -17337,6 +17675,379 @@ export type CompleteSsoAuthResponses = {
     200: AuthResponse;
 };
 export type CompleteSsoAuthResponse = CompleteSsoAuthResponses[keyof CompleteSsoAuthResponses];
+export type GetPasskeyRegistrationOptionsData = {
+    body: PasskeyRegisterOptionsRequest;
+    path?: never;
+    query?: never;
+    url: '/v1/auth/passkeys/register/options';
+};
+export type GetPasskeyRegistrationOptionsErrors = {
+    /**
+     * Invalid request
+     */
+    400: ErrorResponse;
+    /**
+     * Authentication required
+     */
+    401: ErrorResponse;
+    /**
+     * Validation Error
+     */
+    422: HttpValidationError;
+    /**
+     * Rate limit exceeded
+     */
+    429: ErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: ErrorResponse;
+};
+export type GetPasskeyRegistrationOptionsError = GetPasskeyRegistrationOptionsErrors[keyof GetPasskeyRegistrationOptionsErrors];
+export type GetPasskeyRegistrationOptionsResponses = {
+    /**
+     * Successful Response
+     */
+    200: CeremonyOptionsResponse;
+};
+export type GetPasskeyRegistrationOptionsResponse = GetPasskeyRegistrationOptionsResponses[keyof GetPasskeyRegistrationOptionsResponses];
+export type VerifyPasskeyRegistrationData = {
+    body: PasskeyRegisterVerifyRequest;
+    path?: never;
+    query?: never;
+    url: '/v1/auth/passkeys/register/verify';
+};
+export type VerifyPasskeyRegistrationErrors = {
+    /**
+     * Registration failed
+     */
+    400: ErrorResponse;
+    /**
+     * Authentication required
+     */
+    401: ErrorResponse;
+    /**
+     * Validation Error
+     */
+    422: HttpValidationError;
+    /**
+     * Rate limit exceeded
+     */
+    429: ErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: ErrorResponse;
+};
+export type VerifyPasskeyRegistrationError = VerifyPasskeyRegistrationErrors[keyof VerifyPasskeyRegistrationErrors];
+export type VerifyPasskeyRegistrationResponses = {
+    /**
+     * Successful Response
+     */
+    200: PasskeyRegisterVerifyResponse;
+};
+export type VerifyPasskeyRegistrationResponse = VerifyPasskeyRegistrationResponses[keyof VerifyPasskeyRegistrationResponses];
+export type ListUserPasskeysData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/v1/auth/passkeys';
+};
+export type ListUserPasskeysErrors = {
+    /**
+     * Invalid request
+     */
+    400: ErrorResponse;
+    /**
+     * Rate limit exceeded
+     */
+    429: ErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: ErrorResponse;
+};
+export type ListUserPasskeysError = ListUserPasskeysErrors[keyof ListUserPasskeysErrors];
+export type ListUserPasskeysResponses = {
+    /**
+     * Successful Response
+     */
+    200: PasskeyListResponse;
+};
+export type ListUserPasskeysResponse = ListUserPasskeysResponses[keyof ListUserPasskeysResponses];
+export type GetPasskeyReauthOptionsData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/v1/auth/passkeys/reauth/options';
+};
+export type GetPasskeyReauthOptionsErrors = {
+    /**
+     * Invalid request
+     */
+    400: ErrorResponse;
+    /**
+     * Rate limit exceeded
+     */
+    429: ErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: ErrorResponse;
+};
+export type GetPasskeyReauthOptionsError = GetPasskeyReauthOptionsErrors[keyof GetPasskeyReauthOptionsErrors];
+export type GetPasskeyReauthOptionsResponses = {
+    /**
+     * Successful Response
+     */
+    200: CeremonyOptionsResponse;
+};
+export type GetPasskeyReauthOptionsResponse = GetPasskeyReauthOptionsResponses[keyof GetPasskeyReauthOptionsResponses];
+export type DeleteUserPasskeyData = {
+    body: PasskeyDeleteRequest;
+    path: {
+        /**
+         * Passkey Id
+         */
+        passkey_id: string;
+    };
+    query?: never;
+    url: '/v1/auth/passkeys/{passkey_id}';
+};
+export type DeleteUserPasskeyErrors = {
+    /**
+     * Invalid request
+     */
+    400: ErrorResponse;
+    /**
+     * Re-authentication failed
+     */
+    401: ErrorResponse;
+    /**
+     * Last passkey of an MFA-required role
+     */
+    409: ErrorResponse;
+    /**
+     * Validation Error
+     */
+    422: HttpValidationError;
+    /**
+     * Rate limit exceeded
+     */
+    429: ErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: ErrorResponse;
+};
+export type DeleteUserPasskeyError = DeleteUserPasskeyErrors[keyof DeleteUserPasskeyErrors];
+export type DeleteUserPasskeyResponses = {
+    /**
+     * Successful Response
+     */
+    200: SuccessResponse;
+};
+export type DeleteUserPasskeyResponse = DeleteUserPasskeyResponses[keyof DeleteUserPasskeyResponses];
+export type GetPasskeyLoginOptionsData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/v1/auth/passkeys/login/options';
+};
+export type GetPasskeyLoginOptionsErrors = {
+    /**
+     * Invalid request
+     */
+    400: ErrorResponse;
+    /**
+     * Rate limit exceeded
+     */
+    429: ErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: ErrorResponse;
+};
+export type GetPasskeyLoginOptionsError = GetPasskeyLoginOptionsErrors[keyof GetPasskeyLoginOptionsErrors];
+export type GetPasskeyLoginOptionsResponses = {
+    /**
+     * Successful Response
+     */
+    200: CeremonyOptionsResponse;
+};
+export type GetPasskeyLoginOptionsResponse = GetPasskeyLoginOptionsResponses[keyof GetPasskeyLoginOptionsResponses];
+export type VerifyPasskeyLoginData = {
+    body: PasskeyLoginVerifyRequest;
+    path?: never;
+    query?: never;
+    url: '/v1/auth/passkeys/login/verify';
+};
+export type VerifyPasskeyLoginErrors = {
+    /**
+     * Invalid request
+     */
+    400: ErrorResponse;
+    /**
+     * Verification failed
+     */
+    401: ErrorResponse;
+    /**
+     * Validation Error
+     */
+    422: HttpValidationError;
+    /**
+     * Rate limit exceeded
+     */
+    429: ErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: ErrorResponse;
+};
+export type VerifyPasskeyLoginError = VerifyPasskeyLoginErrors[keyof VerifyPasskeyLoginErrors];
+export type VerifyPasskeyLoginResponses = {
+    /**
+     * Successful Response
+     */
+    200: AuthResponse;
+};
+export type VerifyPasskeyLoginResponse = VerifyPasskeyLoginResponses[keyof VerifyPasskeyLoginResponses];
+export type GetMfaOptionsData = {
+    body: MfaOptionsRequest;
+    path?: never;
+    query?: never;
+    url: '/v1/auth/mfa/options';
+};
+export type GetMfaOptionsErrors = {
+    /**
+     * Invalid request
+     */
+    400: ErrorResponse;
+    /**
+     * Invalid or expired MFA token
+     */
+    401: ErrorResponse;
+    /**
+     * Validation Error
+     */
+    422: HttpValidationError;
+    /**
+     * Rate limit exceeded
+     */
+    429: ErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: ErrorResponse;
+};
+export type GetMfaOptionsError = GetMfaOptionsErrors[keyof GetMfaOptionsErrors];
+export type GetMfaOptionsResponses = {
+    /**
+     * Successful Response
+     */
+    200: CeremonyOptionsResponse;
+};
+export type GetMfaOptionsResponse = GetMfaOptionsResponses[keyof GetMfaOptionsResponses];
+export type VerifyMfaData = {
+    body: MfaVerifyRequest;
+    path?: never;
+    query?: never;
+    url: '/v1/auth/mfa/verify';
+};
+export type VerifyMfaErrors = {
+    /**
+     * Invalid request
+     */
+    400: ErrorResponse;
+    /**
+     * Verification failed
+     */
+    401: ErrorResponse;
+    /**
+     * Validation Error
+     */
+    422: HttpValidationError;
+    /**
+     * Rate limit exceeded
+     */
+    429: ErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: ErrorResponse;
+};
+export type VerifyMfaError = VerifyMfaErrors[keyof VerifyMfaErrors];
+export type VerifyMfaResponses = {
+    /**
+     * Successful Response
+     */
+    200: AuthResponse;
+};
+export type VerifyMfaResponse = VerifyMfaResponses[keyof VerifyMfaResponses];
+export type GetMfaStatusData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/v1/auth/mfa/status';
+};
+export type GetMfaStatusErrors = {
+    /**
+     * Invalid request
+     */
+    400: ErrorResponse;
+    /**
+     * Rate limit exceeded
+     */
+    429: ErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: ErrorResponse;
+};
+export type GetMfaStatusError = GetMfaStatusErrors[keyof GetMfaStatusErrors];
+export type GetMfaStatusResponses = {
+    /**
+     * Successful Response
+     */
+    200: MfaStatusResponse;
+};
+export type GetMfaStatusResponse = GetMfaStatusResponses[keyof GetMfaStatusResponses];
+export type RegenerateMfaRecoveryCodesData = {
+    body: RecoveryCodesRequest;
+    path?: never;
+    query?: never;
+    url: '/v1/auth/mfa/recovery-codes/regenerate';
+};
+export type RegenerateMfaRecoveryCodesErrors = {
+    /**
+     * Invalid request
+     */
+    400: ErrorResponse;
+    /**
+     * Re-authentication failed
+     */
+    401: ErrorResponse;
+    /**
+     * Validation Error
+     */
+    422: HttpValidationError;
+    /**
+     * Rate limit exceeded
+     */
+    429: ErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: ErrorResponse;
+};
+export type RegenerateMfaRecoveryCodesError = RegenerateMfaRecoveryCodesErrors[keyof RegenerateMfaRecoveryCodesErrors];
+export type RegenerateMfaRecoveryCodesResponses = {
+    /**
+     * Successful Response
+     */
+    200: RecoveryCodesResponse;
+};
+export type RegenerateMfaRecoveryCodesResponse = RegenerateMfaRecoveryCodesResponses[keyof RegenerateMfaRecoveryCodesResponses];
 export type GetCaptchaConfigData = {
     body?: never;
     path?: never;
@@ -17364,6 +18075,34 @@ export type GetCaptchaConfigResponses = {
      */
     200: unknown;
 };
+export type GetAuthProvidersData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/v1/auth/providers';
+};
+export type GetAuthProvidersErrors = {
+    /**
+     * Invalid request
+     */
+    400: ErrorResponse;
+    /**
+     * Rate limit exceeded
+     */
+    429: ErrorResponse;
+    /**
+     * Internal server error
+     */
+    500: ErrorResponse;
+};
+export type GetAuthProvidersError = GetAuthProvidersErrors[keyof GetAuthProvidersErrors];
+export type GetAuthProvidersResponses = {
+    /**
+     * Successful Response
+     */
+    200: AuthProvidersResponse;
+};
+export type GetAuthProvidersResponse = GetAuthProvidersResponses[keyof GetAuthProvidersResponses];
 export type GetServiceStatusData = {
     body?: never;
     path?: never;