@workos-inc/widgets 1.16.0 → 1.16.1-next.1786560778114

package/dist/cjs/api/client-graphql/generated.d.cts

@@ -49,136 +49,284 @@ type Scalars = {
         input: string;
         output: string;
     };
+    /** The `JSON` scalar type represents JSON values as specified by [ECMA-404](http://www.ecma-international.org/publications/files/ECMA-ST/ECMA-404.pdf). */
+    JSON: {
+        input: any;
+        output: any;
+    };
+};
+/** All other sessions were revoked successfully. */
+type AllSessionsRevoked = {
+    __typename?: "AllSessionsRevoked";
+    success: Scalars["Boolean"]["output"];
+};
+type AssignPermissionToRoleInput = {
+    /** The slug of the permission to assign. */
+    permissionSlug: Scalars["String"]["input"];
+    /** The ID of the role to assign the permission to. */
+    roleId: Scalars["ID"]["input"];
+};
+type AuditEvent = {
+    __typename?: "AuditEvent";
+    action: Scalars["String"]["output"];
+    actor: AuditEventActor;
+    createdAt: Scalars["DateTime"]["output"];
+    data: Scalars["JSON"]["output"];
+    id: Scalars["ID"]["output"];
+    occurredAt: Scalars["DateTime"]["output"];
+    targets: Array<Scalars["String"]["output"]>;
+    updatedAt: Scalars["DateTime"]["output"];
+};
+type AuditEventActor = {
+    __typename?: "AuditEventActor";
+    id: Scalars["String"]["output"];
+    name?: Maybe<Scalars["String"]["output"]>;
+    type: Scalars["String"]["output"];
+};
+type AuditEventFilterInput = {
+    actions?: InputMaybe<Array<Scalars["String"]["input"]>>;
+    actorIds?: InputMaybe<Array<Scalars["String"]["input"]>>;
+    actorNames?: InputMaybe<Array<Scalars["String"]["input"]>>;
+    rangeEnd: Scalars["DateTime"]["input"];
+    rangeStart: Scalars["DateTime"]["input"];
+    search?: InputMaybe<Scalars["String"]["input"]>;
+    targetIds?: InputMaybe<Array<Scalars["String"]["input"]>>;
+    targetTypes?: InputMaybe<Array<Scalars["String"]["input"]>>;
+};
+type AuditEventList = {
+    __typename?: "AuditEventList";
+    data: Array<AuditEvent>;
+    listMetadata: ListMetadata;
+};
+type AuditLogExport = {
+    __typename?: "AuditLogExport";
+    id: Scalars["ID"]["output"];
+    state: AuditLogExportState;
+};
+type AuditLogExportState = "Error" | "Expired" | "Pending" | "Ready";
+/** The authentication methods the environment allows, and the password policy it enforces. Distinct from what the authenticated user has set up, which lives on `me`. */
+type AuthenticationSettings = {
+    __typename?: "AuthenticationSettings";
+    /** Whether multi-factor authentication is available in this environment. When `false`, TOTP enrollment should not be offered. */
+    mfaEnabled: Scalars["Boolean"]["output"];
+    /** Whether multi-factor authentication is mandatory for every user in this environment. */
+    mfaRequired: Scalars["Boolean"]["output"];
+    /** Whether users may authenticate with a passkey. */
+    passkeyAuthEnabled: Scalars["Boolean"]["output"];
+    /** Whether users may authenticate with a password. When `false`, `createPassword` and `updatePassword` should not be offered. */
+    passwordAuthEnabled: Scalars["Boolean"]["output"];
+    passwordPolicy: PasswordPolicy;
+};
+/** Input for confirming an email change with the verification code. */
+type ConfirmEmailChangeInput = {
+    /** The verification code sent to the new email address. */
+    code: Scalars["String"]["input"];
+    /** The elevated access token from a successful `verifyCurrentEmail` call. */
+    elevatedAccessToken: Scalars["String"]["input"];
 };
+type ConfirmEmailChangeResult = EmailChangeCodeExpired | EmailChangeCodeIncorrect | EmailChangeCodePreviouslyUsed | EmailChangeConfirmed | EmailChangeTooManyAttempts | EmailManagedByProvider | EmailNotAvailable | IdentityVerificationExpired | IdentityVerificationInvalid | InvalidEmail | NoPendingEmailChange;
 /** An OAuth profile linked to the authenticated user. */
-type ClientApi_ConnectedAccount = {
-    __typename?: "ClientApi_ConnectedAccount";
+type ConnectedAccount = {
+    __typename?: "ConnectedAccount";
     email?: Maybe<Scalars["String"]["output"]>;
     firstName?: Maybe<Scalars["String"]["output"]>;
     id: Scalars["ID"]["output"];
     lastLoginAt?: Maybe<Scalars["DateTime"]["output"]>;
     lastName?: Maybe<Scalars["String"]["output"]>;
     profilePictureUrl?: Maybe<Scalars["String"]["output"]>;
-    provider: ClientApi_OAuthProvider;
+    provider: OAuthProvider;
 };
-/** OAuth provider for a connected account. */
-type ClientApi_OAuthProvider = "AppleOAuth" | "BitbucketOAuth" | "DiscordOAuth" | "GitLabOAuth" | "GithubOAuth" | "GoogleOAuth" | "IntuitOAuth" | "LinkedInOAuth" | "MicrosoftOAuth" | "SalesforceOAuth" | "SlackOAuth" | "VercelMarketplaceOAuth" | "VercelOAuth" | "XeroOAuth";
-/** An organization in the current environment. */
-type ClientApi_Organization = {
-    __typename?: "ClientApi_Organization";
-    /** Whether the organization allows profiles outside the organization domains. */
-    allowProfilesOutsideOrganization: Scalars["Boolean"]["output"];
+/** An SSO connection belonging to the organization. Mirrors the SSO Connection exposed by the REST connections API. */
+type Connection = {
+    __typename?: "Connection";
     createdAt: Scalars["DateTime"]["output"];
     id: Scalars["ID"]["output"];
+    /** A human-readable name for the connection. */
     name: Scalars["String"]["output"];
+    /** The organization the connection belongs to. */
+    organizationId?: Maybe<Scalars["ID"]["output"]>;
+    /** Whether the connection has completed its IdP setup and can authenticate users (equivalent to an `Active` state). */
+    setupComplete: Scalars["Boolean"]["output"];
+    /** The connection's IdP setup status. `Active` indicates setup is complete; other states indicate where the connection is in its setup flow. */
+    state: ConnectionState;
+    /** The identity provider type of the connection. */
+    type: ConnectionType;
     updatedAt: Scalars["DateTime"]["output"];
 };
-/** A registered passkey (WebAuthn credential) for the authenticated user. */
-type ClientApi_Passkey = {
-    __typename?: "ClientApi_Passkey";
-    createdAt: Scalars["DateTime"]["output"];
-    id: Scalars["ID"]["output"];
-    /** When this passkey was last used to authenticate. */
-    lastVerifiedAt?: Maybe<Scalars["DateTime"]["output"]>;
-    updatedAt: Scalars["DateTime"]["output"];
+/** Enum represents the state of the connection. */
+type ConnectionState = "Active" | "Deleting" | "Inactive" | "Validating";
+/** Enum represents the type of connection. */
+type ConnectionType = "ADFSSAML" | "AdpOidc" | "AppleOAuth" | "Auth0Migration" | "Auth0SAML" | "AzureSAML" | "BitbucketOAuth" | "CasSAML" | "ClassLinkSAML" | "CleverOIDC" | "CloudflareSAML" | "CyberArkSAML" | "DiscordOAuth" | "DuoSAML" | "EntraIdOIDC" | "GenericOIDC" | "GenericSAML" | "GitLabOAuth" | "GithubOAuth" | "GoogleOAuth" | "GoogleOIDC" | "GoogleSAML" | "GrokOAuth" | "IntuitOAuth" | "JumpCloudSAML" | "KeycloakSAML" | "LastPassSAML" | "LinkedInOAuth" | "LoginGovOidc" | "MagicLink" | "MicrosoftOAuth" | "MiniOrangeSAML" | "NetIqSAML" | "OktaOIDC" | "OktaSAML" | "OneLoginSAML" | "OracleSAML" | "PingFederateSAML" | "PingOneSAML" | "RipplingSAML" | "SalesforceOAuth" | "SalesforceSAML" | "ShibbolethGenericSAML" | "ShibbolethSAML" | "SimpleSamlPhpSAML" | "SlackOAuth" | "TestIdp" | "VMwareSAML" | "VercelMarketplaceOAuth" | "VercelOAuth" | "XOAuth" | "XeroOAuth";
+type CreateAuditLogExportInput = {
+    actions?: InputMaybe<Array<Scalars["String"]["input"]>>;
+    actorIds?: InputMaybe<Array<Scalars["String"]["input"]>>;
+    actorNames?: InputMaybe<Array<Scalars["String"]["input"]>>;
+    rangeEnd: Scalars["DateTime"]["input"];
+    rangeStart: Scalars["DateTime"]["input"];
+    targetIds?: InputMaybe<Array<Scalars["String"]["input"]>>;
+    targetTypes?: InputMaybe<Array<Scalars["String"]["input"]>>;
+};
+type CreateAuditLogExportResult = AuditLogExport | InvalidAuditLogExportDateRange | NoAuditEventsFound;
+/** Input for setting a password on an account that does not yet have one (e.g. signed up via OAuth). */
+type CreatePasswordInput = {
+    /** An elevated access token obtained by verifying the current email address. Required to prove recent re-authentication. */
+    elevatedAccessToken: Scalars["String"]["input"];
+    /** The password to set. Must satisfy the environment password policy. */
+    password: Scalars["String"]["input"];
 };
-/** A role available within the organization. */
-type ClientApi_Role = {
-    __typename?: "ClientApi_Role";
+type CreatePasswordResult = ElevatedAccessTokenExpired | ElevatedAccessTokenInvalid | PasswordCreated | PasswordPolicyViolation | UserAlreadyHasPassword;
+type CreateRoleInput = {
+    /** Optional human-readable description of the role. */
+    description?: InputMaybe<Scalars["String"]["input"]>;
+    /** Human-readable name for the role. */
+    name: Scalars["String"]["input"];
+    /** Slugs of the permissions granted to the role. */
+    permissions?: InputMaybe<Array<Scalars["String"]["input"]>>;
+    /** Unique slug identifying the role. Generated from the name when omitted. */
+    slug?: InputMaybe<Scalars["String"]["input"]>;
+};
+type CreateSsoConnectionInput = {
+    /** A human-readable name for the connection. Defaults to the organization's name. */
+    name?: InputMaybe<Scalars["String"]["input"]>;
+    /** The identity provider type of the connection to create. */
+    type: ConnectionType;
+};
+/** The current email was verified successfully. */
+type CurrentEmailVerified = {
+    __typename?: "CurrentEmailVerified";
+    /** The elevated access token to pass to `sendEmailChange` and `confirmEmailChange`. */
+    elevatedAccessToken: Scalars["String"]["output"];
+    /** When the elevated access token expires (ISO 8601). */
+    expiresAt: Scalars["String"]["output"];
+};
+/** Daily verification email quota exceeded. */
+type DailyEmailQuotaExceeded = {
+    __typename?: "DailyEmailQuotaExceeded";
+    message: Scalars["String"]["output"];
+};
+/** A third-party data provider configured for the current environment. */
+type DataProvider = {
+    __typename?: "DataProvider";
+    /** How accounts authenticate with this data provider. */
+    authMethods: Array<Scalars["String"]["output"]>;
     createdAt: Scalars["DateTime"]["output"];
     description?: Maybe<Scalars["String"]["output"]>;
+    /** Whether the data provider is enabled in the environment. */
+    enabled: Scalars["Boolean"]["output"];
     id: Scalars["ID"]["output"];
-    /** Whether this is the default role assigned to new members. */
-    isDefault: Scalars["Boolean"]["output"];
+    /** The provider type this data provider was created from. */
+    integrationType: Scalars["String"]["output"];
+    /** The display name of the data provider. */
     name: Scalars["String"]["output"];
+    /** The OAuth scopes configured for the data provider. `null` when the provider's default scopes are used. */
+    scopes?: Maybe<Array<Scalars["String"]["output"]>>;
+    /** The slug of the data provider. */
     slug: Scalars["String"]["output"];
+    /** The configuration state of the data provider: `valid`, `invalid`, or `requested`. */
+    state: Scalars["String"]["output"];
     updatedAt: Scalars["DateTime"]["output"];
 };
-/** Roles available in the organization along with role assignment configuration. */
-type ClientApi_RolesResult = {
-    __typename?: "ClientApi_RolesResult";
-    /** Whether members can be assigned multiple roles simultaneously. */
-    multipleRolesEnabled: Scalars["Boolean"]["output"];
-    roles: Array<ClientApi_Role>;
-};
-/** An active user session. */
-type ClientApi_Session = {
-    __typename?: "ClientApi_Session";
+/** A connection between a data provider and the authenticated user's account. */
+type DataProviderConnection = {
+    __typename?: "DataProviderConnection";
+    /** How the connection authenticates: `oauth`, `api_key`, or `client_credentials`. */
+    authMethod: Scalars["String"]["output"];
     createdAt: Scalars["DateTime"]["output"];
-    currentLocation?: Maybe<ClientApi_SessionLocation>;
+    /** The data provider this connection was created for. */
+    dataProviderId: Scalars["ID"]["output"];
+    /** The slug of the connected data provider. */
+    dataProviderSlug: Scalars["String"]["output"];
     id: Scalars["ID"]["output"];
-    ipAddress?: Maybe<Scalars["String"]["output"]>;
-    /** Whether this session is the one making the request. */
-    isCurrent: Scalars["Boolean"]["output"];
-    lastActivityAt?: Maybe<Scalars["DateTime"]["output"]>;
-    organizationId?: Maybe<Scalars["String"]["output"]>;
-    state: ClientApi_SessionState;
+    organizationId?: Maybe<Scalars["ID"]["output"]>;
+    /** The OAuth scopes granted for this connection. */
+    scopes: Array<Scalars["String"]["output"]>;
+    /** The status of the connection: `connected` or `needs_reauthorization`. */
+    state: Scalars["String"]["output"];
     updatedAt: Scalars["DateTime"]["output"];
-    userAgent?: Maybe<Scalars["String"]["output"]>;
+    userId?: Maybe<Scalars["ID"]["output"]>;
 };
-/** Approximate geographic location derived from the session IP. */
-type ClientApi_SessionLocation = {
-    __typename?: "ClientApi_SessionLocation";
-    cityName: Scalars["String"]["output"];
-    countryISOCode: Scalars["String"]["output"];
+type DataProviderConnectionList = {
+    __typename?: "DataProviderConnectionList";
+    data: Array<DataProviderConnection>;
+    listMetadata: ListMetadata;
 };
-/** The lifecycle state of a session. */
-type ClientApi_SessionState = {
-    __typename?: "ClientApi_SessionState";
-    expiresAt?: Maybe<Scalars["DateTime"]["output"]>;
-    /** Session state: Issued, Revoked, etc. */
-    tag: Scalars["String"]["output"];
+type DataProviderList = {
+    __typename?: "DataProviderList";
+    data: Array<DataProvider>;
+    listMetadata: ListMetadata;
 };
-/** A user in the current environment. */
-type ClientApi_User = {
-    __typename?: "ClientApi_User";
-    connectedAccounts: Array<ClientApi_ConnectedAccount>;
+type DeleteRoleInput = {
+    /** The ID of the role to delete. */
+    id: Scalars["ID"]["input"];
+};
+/** A Directory Sync connection within the current environment. */
+type Directory = {
+    __typename?: "Directory";
     createdAt: Scalars["DateTime"]["output"];
-    email: Scalars["String"]["output"];
-    emailVerified: Scalars["Boolean"]["output"];
-    firstName?: Maybe<Scalars["String"]["output"]>;
+    externalKey: Scalars["String"]["output"];
     id: Scalars["ID"]["output"];
-    lastName?: Maybe<Scalars["String"]["output"]>;
-    /** Whether multi-factor authentication (TOTP) is set up for this user. Only populated on `me`. */
-    mfaEnabled: Scalars["Boolean"]["output"];
-    /** When MFA was last used to authenticate. Only populated on `me`. */
-    mfaLastUsedAt?: Maybe<Scalars["DateTime"]["output"]>;
-    profilePictureUrl?: Maybe<Scalars["String"]["output"]>;
+    name: Scalars["String"]["output"];
+    organizationId: Scalars["ID"]["output"];
+    /** The linking state of the directory. */
+    state: Scalars["String"]["output"];
+    /** The provider type of the directory. */
+    type: Scalars["String"]["output"];
     updatedAt: Scalars["DateTime"]["output"];
 };
-/** An organization the authenticated user belongs to, with a flag indicating whether it is the token's current organization. */
-type ClientApi_UserOrganization = {
-    __typename?: "ClientApi_UserOrganization";
+/** A group provisioned through a Directory Sync connection. */
+type DirectoryGroup = {
+    __typename?: "DirectoryGroup";
+    createdAt: Scalars["DateTime"]["output"];
+    directoryId: Scalars["ID"]["output"];
     id: Scalars["ID"]["output"];
-    /** Whether this is the organization the token is currently scoped to. */
-    isCurrent: Scalars["Boolean"]["output"];
+    /** The identifier of the group in the identity provider. */
+    idpId: Scalars["String"]["output"];
     name: Scalars["String"]["output"];
+    organizationId: Scalars["ID"]["output"];
+    updatedAt: Scalars["DateTime"]["output"];
 };
-/** Input for confirming an email change with the verification code. */
-type ConfirmEmailChangeInput = {
-    /** The verification code sent to the new email address. */
-    code: Scalars["String"]["input"];
-    /** The elevated access token from a successful `verifyCurrentEmail` call. */
-    elevatedAccessToken: Scalars["String"]["input"];
+type DirectoryGroupList = {
+    __typename?: "DirectoryGroupList";
+    data: Array<DirectoryGroup>;
+    listMetadata: ListMetadata;
 };
-type ConfirmEmailChangeResult = EmailChangeCodeExpired | EmailChangeCodeIncorrect | EmailChangeCodePreviouslyUsed | EmailChangeConfirmed | EmailChangeTooManyAttempts | EmailManagedByProvider | EmailNotAvailable | IdentityVerificationExpired | IdentityVerificationInvalid | InvalidEmail | NoPendingEmailChange;
-/** Input for setting a password on an account that does not yet have one (e.g. signed up via OAuth). */
-type CreatePasswordInput = {
-    /** The password to set. Must satisfy the environment password policy. */
-    password: Scalars["String"]["input"];
+type DirectoryList = {
+    __typename?: "DirectoryList";
+    data: Array<Directory>;
+    listMetadata: ListMetadata;
 };
-type CreatePasswordResult = PasswordCreated | PasswordPolicyViolation | UserAlreadyHasPassword;
-/** The current email was verified successfully. */
-type CurrentEmailVerified = {
-    __typename?: "CurrentEmailVerified";
-    /** The elevated access token to pass to `sendEmailChange` and `confirmEmailChange`. */
-    elevatedAccessToken: Scalars["String"]["output"];
-    /** When the elevated access token expires (ISO 8601). */
-    expiresAt: Scalars["String"]["output"];
+/** A user provisioned through a Directory Sync connection. */
+type DirectoryUser = {
+    __typename?: "DirectoryUser";
+    createdAt: Scalars["DateTime"]["output"];
+    directoryId: Scalars["ID"]["output"];
+    email?: Maybe<Scalars["String"]["output"]>;
+    firstName?: Maybe<Scalars["String"]["output"]>;
+    id: Scalars["ID"]["output"];
+    /** The identifier of the user in the identity provider. */
+    idpId: Scalars["String"]["output"];
+    lastName?: Maybe<Scalars["String"]["output"]>;
+    organizationId: Scalars["ID"]["output"];
+    /** The provisioning state of the directory user. */
+    state: Scalars["String"]["output"];
+    updatedAt: Scalars["DateTime"]["output"];
+    username?: Maybe<Scalars["String"]["output"]>;
 };
-/** Daily verification email quota exceeded. */
-type DailyEmailQuotaExceeded = {
-    __typename?: "DailyEmailQuotaExceeded";
+type DirectoryUserList = {
+    __typename?: "DirectoryUserList";
+    data: Array<DirectoryUser>;
+    listMetadata: ListMetadata;
+};
+/** The DNS name server provider detected for a domain. */
+type DomainVerificationNameServer = "AwsRoute53" | "CloudFlare" | "GoDaddy" | "GoogleDomains" | "Other";
+/** The elevated access token has expired. The user must re-verify their identity. */
+type ElevatedAccessTokenExpired = {
+    __typename?: "ElevatedAccessTokenExpired";
+    message: Scalars["String"]["output"];
+};
+/** The elevated access token is invalid. */
+type ElevatedAccessTokenInvalid = {
+    __typename?: "ElevatedAccessTokenInvalid";
     message: Scalars["String"]["output"];
 };
 /** The verification code has expired. */
@@ -203,7 +351,7 @@ type EmailChangeConfirmed = {
     elevatedAccessToken: Scalars["String"]["output"];
     /** When the elevated access token expires (ISO 8601). */
     expiresAt: Scalars["String"]["output"];
-    user: ClientApi_User;
+    user: User;
 };
 /** Email change is not available for this account. */
 type EmailChangeNotAvailable = {
@@ -231,7 +379,35 @@ type EmailNotAvailable = {
     __typename?: "EmailNotAvailable";
     message: Scalars["String"]["output"];
 };
-type EnrollTotpResult = TotpAlreadyEnrolled | TotpFactor;
+/** Input for enrolling a new TOTP factor. */
+type EnrollTotpInput = {
+    /** An elevated access token obtained by verifying the current email address. Required to prove recent re-authentication. */
+    elevatedAccessToken: Scalars["String"]["input"];
+};
+type EnrollTotpResult = ElevatedAccessTokenExpired | ElevatedAccessTokenInvalid | TotpAlreadyEnrolled | TotpFactor;
+/** A feature flag defined in the project that owns the environment the token was issued for. Mirrors the Feature Flag exposed by the REST feature flags API. */
+type Flag = {
+    __typename?: "Flag";
+    createdAt: Scalars["DateTime"]["output"];
+    /** The value returned for users and organizations that do not match any targeting rule in the environment the token was issued for. */
+    defaultValue: Scalars["Boolean"]["output"];
+    description?: Maybe<Scalars["String"]["output"]>;
+    /** Whether the feature flag is active in the environment the token was issued for. */
+    enabled: Scalars["Boolean"]["output"];
+    id: Scalars["ID"]["output"];
+    /** A descriptive name for the feature flag. */
+    name: Scalars["String"]["output"];
+    /** A unique key used to reference the feature flag. */
+    slug: Scalars["String"]["output"];
+    /** Labels assigned to the feature flag. */
+    tags: Array<Scalars["String"]["output"]>;
+    updatedAt: Scalars["DateTime"]["output"];
+};
+type FlagList = {
+    __typename?: "FlagList";
+    data: Array<Flag>;
+    listMetadata: ListMetadata;
+};
 /** The identity verification has expired. Please verify your current email again. */
 type IdentityVerificationExpired = {
     __typename?: "IdentityVerificationExpired";
@@ -247,6 +423,10 @@ type IncorrectPassword = {
     __typename?: "IncorrectPassword";
     _placeholder: Scalars["Boolean"]["output"];
 };
+type InvalidAuditLogExportDateRange = {
+    __typename?: "InvalidAuditLogExportDateRange";
+    message: Scalars["String"]["output"];
+};
 /** The provided email address is invalid. */
 type InvalidEmail = {
     __typename?: "InvalidEmail";
@@ -301,7 +481,7 @@ type InviteUserInput = {
     /** Slug of the role to grant on acceptance. Defaults to the organization default role when omitted. */
     roleSlug?: InputMaybe<Scalars["String"]["input"]>;
 };
-type InviteUserResult = InvalidInvitationExpiry | InvalidInviteeEmail | InvalidInviteeRole | InviteeAlreadyInvited | InviteeAlreadyMember | UserInvited;
+type InviteUserResult = InvalidInvitationExpiry | InvalidInviteeEmail | InvalidInviteeRole | InviteeAlreadyInvited | InviteeAlreadyMember | InviteeEmailNotDeliverable | OrganizationBlockedFromSendingInvites | UserInvited;
 /** The user has already accepted their invitation and is an active member. */
 type InviteeAlreadyAccepted = {
     __typename?: "InviteeAlreadyAccepted";
@@ -317,6 +497,11 @@ type InviteeAlreadyMember = {
     __typename?: "InviteeAlreadyMember";
     email: Scalars["String"]["output"];
 };
+/** The invitee's email domain has no mail servers, so the invitation email cannot be delivered. */
+type InviteeEmailNotDeliverable = {
+    __typename?: "InviteeEmailNotDeliverable";
+    email: Scalars["String"]["output"];
+};
 type ListMetadata = {
     __typename?: "ListMetadata";
     after?: Maybe<Scalars["String"]["output"]>;
@@ -352,10 +537,25 @@ type MfaFactorRemoved = {
 };
 type Mutation = {
     __typename?: "Mutation";
+    /** Grant a permission to a role belonging to the organization the token was issued for. */
+    assignPermissionToRole: Role;
     /** Confirms an email change using the verification code sent to the new email address. Requires an elevated access token from `verifyCurrentEmail`. */
     confirmEmailChange: ConfirmEmailChangeResult;
+    createAuditLogExport: CreateAuditLogExportResult;
+    /** Add a domain to the token's organization and begin DNS verification. */
+    createOrganizationDomain: OrganizationDomain;
     /** Set a password for the authenticated user who does not yet have one (e.g. signed up via OAuth). Validates against the environment password policy. */
     createPassword: CreatePasswordResult;
+    /** Create a role for the organization the token was issued for. */
+    createRole: Role;
+    /** Create an SSO connection for the token’s organization. */
+    createSsoConnection: Connection;
+    /** Delete a domain belonging to the token's organization and return it. */
+    deleteOrganizationDomain: OrganizationDomain;
+    /** Delete a role belonging to the organization the token was issued for. */
+    deleteRole: RoleDeleted;
+    /** Delete an SSO connection belonging to the token’s organization. */
+    deleteSsoConnection: Scalars["ID"]["output"];
     /** Create a TOTP factor and return the secret and QR URI for the user to scan. This is step 1 of TOTP enrollment. */
     enrollTotp: EnrollTotpResult;
     /** Invite a user to the organization the token was issued for, assigning a role and sending the invitation email. */
@@ -366,8 +566,14 @@ type Mutation = {
     removeMfaFactor: RemoveMfaFactorResult;
     /** Resend a pending, expired, or revoked invitation for the organization the token was issued for. If the original invitation has expired or been revoked, a new invitation is created with the same role. */
     resendInvitation: ResendInvitationResult;
+    /** Restart verification for a domain belonging to the token's organization. */
+    reverifyOrganizationDomain: OrganizationDomain;
+    /** Revokes all active sessions for the authenticated user except the current one. */
+    revokeAllSessions: RevokeAllSessionsResult;
     /** Revoke a pending invitation for the organization the token was issued for. */
     revokeInvitation: RevokeInvitationResult;
+    /** Revokes a specific session by ID. */
+    revokeSession: RevokeSessionResult;
     /** Sends a verification code to the new email address. Requires an elevated access token from `verifyCurrentEmail`. The user must confirm with the code via `confirmEmailChange`. */
     sendEmailChange: SendEmailChangeResult;
     /** Sends a verification code to the user's current email address to prove ownership before changing email. */
@@ -378,29 +584,69 @@ type Mutation = {
     updatePassword: UpdatePasswordResult;
     /** Updates the authenticated user's profile (first name, last name, locale). */
     updateProfile: UpdateProfileResult;
+    /** Update a role belonging to the organization the token was issued for. */
+    updateRole: Role;
+    /** Update an SSO connection belonging to the token’s organization. */
+    updateSsoConnection: Connection;
     /** Verifies the code sent to the current email address. Returns an elevated access token required for `sendEmailChange` and `confirmEmailChange`. */
     verifyCurrentEmail: VerifyCurrentEmailResult;
     /** Confirm TOTP enrollment by verifying a code from the authenticator app. Marks the factor as verified. */
     verifyTotp: VerifyTotpResult;
 };
+type MutationAssignPermissionToRoleArgs = {
+    input: AssignPermissionToRoleInput;
+};
 type MutationConfirmEmailChangeArgs = {
     input: ConfirmEmailChangeInput;
 };
+type MutationCreateAuditLogExportArgs = {
+    input: CreateAuditLogExportInput;
+};
+type MutationCreateOrganizationDomainArgs = {
+    domain: Scalars["String"]["input"];
+};
 type MutationCreatePasswordArgs = {
     input: CreatePasswordInput;
 };
+type MutationCreateRoleArgs = {
+    input: CreateRoleInput;
+};
+type MutationCreateSsoConnectionArgs = {
+    input: CreateSsoConnectionInput;
+};
+type MutationDeleteOrganizationDomainArgs = {
+    id: Scalars["ID"]["input"];
+};
+type MutationDeleteRoleArgs = {
+    input: DeleteRoleInput;
+};
+type MutationDeleteSsoConnectionArgs = {
+    id: Scalars["ID"]["input"];
+};
+type MutationEnrollTotpArgs = {
+    input: EnrollTotpInput;
+};
 type MutationInviteUserArgs = {
     input: InviteUserInput;
 };
 type MutationRemoveMemberArgs = {
     input: RemoveMemberInput;
 };
+type MutationRemoveMfaFactorArgs = {
+    input: RemoveMfaFactorInput;
+};
 type MutationResendInvitationArgs = {
     input: ResendInvitationInput;
 };
+type MutationReverifyOrganizationDomainArgs = {
+    id: Scalars["ID"]["input"];
+};
 type MutationRevokeInvitationArgs = {
     input: RevokeInvitationInput;
 };
+type MutationRevokeSessionArgs = {
+    input: RevokeSessionInput;
+};
 type MutationSendEmailChangeArgs = {
     input: SendEmailChangeInput;
 };
@@ -413,12 +659,22 @@ type MutationUpdatePasswordArgs = {
 type MutationUpdateProfileArgs = {
     input: UpdateProfileInput;
 };
+type MutationUpdateRoleArgs = {
+    input: UpdateRoleInput;
+};
+type MutationUpdateSsoConnectionArgs = {
+    input: UpdateSsoConnectionInput;
+};
 type MutationVerifyCurrentEmailArgs = {
     input: VerifyCurrentEmailInput;
 };
 type MutationVerifyTotpArgs = {
     input: VerifyTotpInput;
 };
+type NoAuditEventsFound = {
+    __typename?: "NoAuditEventsFound";
+    message: Scalars["String"]["output"];
+};
 /** The user has no TOTP factors to remove. */
 type NoMfaFactorsEnrolled = {
     __typename?: "NoMfaFactorsEnrolled";
@@ -429,6 +685,44 @@ type NoPendingEmailChange = {
     __typename?: "NoPendingEmailChange";
     message: Scalars["String"]["output"];
 };
+/** OAuth provider for a connected account. */
+type OAuthProvider = "AppleOAuth" | "BitbucketOAuth" | "DiscordOAuth" | "GitLabOAuth" | "GithubOAuth" | "GoogleOAuth" | "GrokOAuth" | "IntuitOAuth" | "LinkedInOAuth" | "MicrosoftOAuth" | "SalesforceOAuth" | "SlackOAuth" | "VercelMarketplaceOAuth" | "VercelOAuth" | "XOAuth" | "XeroOAuth";
+/** An organization in the current environment. */
+type Organization = {
+    __typename?: "Organization";
+    /** Whether the organization allows profiles outside the organization domains. */
+    allowProfilesOutsideOrganization: Scalars["Boolean"]["output"];
+    createdAt: Scalars["DateTime"]["output"];
+    id: Scalars["ID"]["output"];
+    name: Scalars["String"]["output"];
+    updatedAt: Scalars["DateTime"]["output"];
+};
+/** This organization is not allowed to send invites. */
+type OrganizationBlockedFromSendingInvites = {
+    __typename?: "OrganizationBlockedFromSendingInvites";
+    /** Placeholder field to allow an empty @ObjectType. */
+    _placeholder?: Maybe<Scalars["Boolean"]["output"]>;
+};
+/** A domain belonging to the organization the token was issued for. */
+type OrganizationDomain = {
+    __typename?: "OrganizationDomain";
+    createdAt: Scalars["DateTime"]["output"];
+    /** The fully qualified domain name. */
+    domain: Scalars["String"]["output"];
+    id: Scalars["ID"]["output"];
+    /** The DNS name server provider detected for the domain. */
+    nameServer: DomainVerificationNameServer;
+    organizationId: Scalars["ID"]["output"];
+    state: OrganizationDomainState;
+    /** The subdomain portion of the domain, if any. */
+    subdomain?: Maybe<Scalars["String"]["output"]>;
+    /** The DNS record prefix the customer must add to verify the domain. */
+    verificationPrefix?: Maybe<Scalars["String"]["output"]>;
+    /** The DNS record value the customer must add to verify the domain. */
+    verificationToken?: Maybe<Scalars["String"]["output"]>;
+};
+/** The verification state of an organization domain. */
+type OrganizationDomainState = "Failed" | "LegacyVerified" | "Pending" | "Verified";
 /** An invitation to join the organization the token was issued for. */
 type OrganizationInvitation = {
     __typename?: "OrganizationInvitation";
@@ -475,49 +769,230 @@ type OrganizationMemberRole = {
 type OrganizationMemberStatus = "Active" | "InviteExpired" | "InviteRevoked" | "Invited" | "NoInvite";
 /** Enum represents the pagination order. */
 type PaginationOrder = "Asc" | "Desc" | "Normal";
+/** A registered passkey (WebAuthn credential) for the authenticated user. */
+type Passkey = {
+    __typename?: "Passkey";
+    createdAt: Scalars["DateTime"]["output"];
+    id: Scalars["ID"]["output"];
+    /** When this passkey was last used to authenticate. */
+    lastVerifiedAt?: Maybe<Scalars["DateTime"]["output"]>;
+    updatedAt: Scalars["DateTime"]["output"];
+};
+/** The types of characters in a password. */
+type PasswordCharacterType = "Lowercase" | "Number" | "Symbol" | "Uppercase";
 /** The password was created successfully. */
 type PasswordCreated = {
     __typename?: "PasswordCreated";
     success: Scalars["Boolean"]["output"];
 };
+/** The password requirements configured for the environment. Use these to describe the requirements before a password is submitted; `createPassword` and `updatePassword` enforce them. */
+type PasswordPolicy = {
+    __typename?: "PasswordPolicy";
+    /** The minimum number of characters. */
+    minimumLength: Scalars["Int"]["output"];
+    /** The minimum zxcvbn strength score (0–4) a password must reach. */
+    minimumStrength: Scalars["Int"]["output"];
+    /** Whether passwords found in known data breaches are rejected. */
+    rejectsBreachedPasswords: Scalars["Boolean"]["output"];
+    /** Whether a lowercase letter is required. */
+    requiresLowercase: Scalars["Boolean"]["output"];
+    /** Whether a number is required. */
+    requiresNumber: Scalars["Boolean"]["output"];
+    /** Whether a special character is required. */
+    requiresSymbol: Scalars["Boolean"]["output"];
+    /** Whether an uppercase letter is required. */
+    requiresUppercase: Scalars["Boolean"]["output"];
+};
 /** The provided password does not meet the environment password policy requirements. */
 type PasswordPolicyViolation = {
     __typename?: "PasswordPolicyViolation";
-    /** A machine-readable error code. */
+    /** A machine-readable error code. Matches the `code` of the first entry in `violations`. */
     code: Scalars["String"]["output"];
-    /** A human-readable description of the policy violation. */
+    /** A human-readable description of the policy violation. Describes the first entry in `violations`. */
     message: Scalars["String"]["output"];
+    /** Every way in which the password failed the policy, so all of them can be surfaced at once. */
+    violations: Array<PasswordViolation>;
 };
 /** The password was updated successfully. */
 type PasswordUpdated = {
     __typename?: "PasswordUpdated";
     success: Scalars["Boolean"]["output"];
 };
+/** A single way in which a password failed the environment password policy. Fields other than `code` and `message` are only populated for the codes that carry them. */
+type PasswordViolation = {
+    __typename?: "PasswordViolation";
+    /** For a missing `Symbol` character type, the symbols that satisfy the requirement. */
+    allowedSymbols?: Maybe<Scalars["String"]["output"]>;
+    /** For `password_pwned`, how many times the password appears in known data breaches. */
+    breachOccurrences?: Maybe<Scalars["Int"]["output"]>;
+    /** For `password_missing_character_type`, the class of character that is missing. */
+    characterType?: Maybe<PasswordCharacterType>;
+    /** A machine-readable error code, e.g. `password_too_short`, `password_missing_character_type`, `password_pwned`, `password_reused`, `password_too_weak`, `password_contains_email`, `password_too_long`. */
+    code: Scalars["String"]["output"];
+    /** For `password_too_long`, the allowed maximum length. */
+    maximumLength?: Maybe<Scalars["Int"]["output"]>;
+    /** A human-readable description of this violation. */
+    message: Scalars["String"]["output"];
+    /** For `password_too_short`, the required minimum length. */
+    minimumLength?: Maybe<Scalars["Int"]["output"]>;
+    /** For `password_too_weak`, suggestions for choosing a stronger password. Empty for other codes. */
+    strengthSuggestions: Array<Scalars["String"]["output"]>;
+    /** For `password_too_weak`, a summary of why it is weak. */
+    strengthWarning?: Maybe<Scalars["String"]["output"]>;
+};
+/** A permission that can be granted to a role within the environment. */
+type Permission = {
+    __typename?: "Permission";
+    createdAt: Scalars["DateTime"]["output"];
+    description?: Maybe<Scalars["String"]["output"]>;
+    id: Scalars["ID"]["output"];
+    name: Scalars["String"]["output"];
+    slug: Scalars["String"]["output"];
+    /** Whether this is a WorkOS-managed system permission that cannot be modified. */
+    system: Scalars["Boolean"]["output"];
+    updatedAt: Scalars["DateTime"]["output"];
+};
 /** The profile was updated successfully. */
 type ProfileUpdated = {
     __typename?: "ProfileUpdated";
-    user: ClientApi_User;
+    user: User;
 };
 type Query = {
     __typename?: "Query";
+    auditEvent: AuditEvent;
+    auditEvents: AuditEventList;
+    /** The authentication methods the environment allows and the password policy it enforces. Requires a session token. */
+    authenticationSettings: AuthenticationSettings;
     /** Placeholder query for the Client GraphQL API scaffold. Returns a static value and is replaced by real resolvers. */
     clientApiStatus: Scalars["String"]["output"];
+    /** Return a data provider by ID within the token's environment. */
+    dataProvider: DataProvider;
+    /** Return one of the authenticated user's data provider connections by ID. */
+    dataProviderConnection: DataProviderConnection;
+    /** List the authenticated user's data provider connections, including their status. */
+    dataProviderConnections: DataProviderConnectionList;
+    /** List the data providers configured in the token's environment. */
+    dataProviders: DataProviderList;
+    /** Return a Directory Sync connection by ID within the token's organization. */
+    directoryConnection: Directory;
+    /** List the Directory Sync connections for the token's organization. */
+    directoryConnections: DirectoryList;
+    /** List the groups of a Directory Sync connection. */
+    directoryGroups: DirectoryGroupList;
+    /** List the users of a Directory Sync connection. */
+    directoryUsers: DirectoryUserList;
+    /** The permissions a user effectively has in the organization the token was issued for, including permissions inherited through the user's roles. Callers may read their own effective permissions; reading another member's requires the elevated user:read grant. */
+    effectivePermissions: Array<Permission>;
+    /** The feature flags that evaluate to enabled for a user in the environment the token was issued for, including flags targeted at the token's organization. Flags absent from the list evaluate to false. Callers may evaluate their own flags; evaluating another member of the token's organization requires the elevated user:read grant. */
+    evaluatedFlags: FlagList;
+    /** Fetch a feature flag by ID from the project that owns the token's environment. */
+    flag: Flag;
+    /** Fetch a feature flag by slug from the project that owns the token's environment. */
+    flagBySlug: Flag;
+    /** List the feature flags of the project that owns the token's environment, with their state in that environment. */
+    flags: FlagList;
     /** Returns the currently authenticated user (the subject of the token). */
-    me: ClientApi_User;
+    me: User;
     /** Returns an organization by ID within the token's environment. */
-    organization: ClientApi_Organization;
+    organization: Organization;
+    /** List the domains belonging to the organization the token was issued for. */
+    organizationDomains: Array<OrganizationDomain>;
     /** List members of the organization the token was issued for, with their roles. */
     organizationMemberships: OrganizationMemberList;
     /** List organizations the authenticated user belongs to. */
-    organizations: Array<ClientApi_UserOrganization>;
+    organizations: Array<UserOrganization>;
     /** List registered passkeys for the authenticated user. Requires a session token. */
-    passkeys: Array<ClientApi_Passkey>;
+    passkeys: Array<Passkey>;
+    /** List the permissions defined in the environment the token was issued for. */
+    permissions: Array<Permission>;
+    /** Fetch a single role available to the organization the token was issued for. */
+    role?: Maybe<Role>;
     /** List roles available to the organization the token was issued for, with role assignment configuration. */
-    roles: ClientApi_RolesResult;
+    roles: RolesResult;
     /** List active sessions for the authenticated user. Requires a session token. */
-    sessions: Array<ClientApi_Session>;
+    sessions: Array<Session>;
+    /** Returns an SSO connection by ID, including its IdP setup status, provided it belongs to the token's organization. */
+    ssoConnection: Connection;
+    /** List the SSO connections belonging to the organization the token was issued for. */
+    ssoConnections: Array<Connection>;
     /** Returns a user by ID, provided they are a member of the token's organization. */
-    user: ClientApi_User;
+    user: User;
+};
+type QueryAuditEventArgs = {
+    id: Scalars["ID"]["input"];
+};
+type QueryAuditEventsArgs = {
+    after?: InputMaybe<Scalars["String"]["input"]>;
+    before?: InputMaybe<Scalars["String"]["input"]>;
+    filter: AuditEventFilterInput;
+    limit?: InputMaybe<Scalars["Int"]["input"]>;
+    order?: InputMaybe<PaginationOrder>;
+};
+type QueryDataProviderArgs = {
+    id: Scalars["ID"]["input"];
+};
+type QueryDataProviderConnectionArgs = {
+    id: Scalars["ID"]["input"];
+};
+type QueryDataProviderConnectionsArgs = {
+    after?: InputMaybe<Scalars["String"]["input"]>;
+    before?: InputMaybe<Scalars["String"]["input"]>;
+    limit?: InputMaybe<Scalars["Int"]["input"]>;
+    order?: InputMaybe<PaginationOrder>;
+};
+type QueryDataProvidersArgs = {
+    after?: InputMaybe<Scalars["String"]["input"]>;
+    before?: InputMaybe<Scalars["String"]["input"]>;
+    limit?: InputMaybe<Scalars["Int"]["input"]>;
+    order?: InputMaybe<PaginationOrder>;
+};
+type QueryDirectoryConnectionArgs = {
+    id: Scalars["ID"]["input"];
+};
+type QueryDirectoryConnectionsArgs = {
+    after?: InputMaybe<Scalars["String"]["input"]>;
+    before?: InputMaybe<Scalars["String"]["input"]>;
+    limit?: InputMaybe<Scalars["Int"]["input"]>;
+    order?: InputMaybe<PaginationOrder>;
+    search?: InputMaybe<Scalars["String"]["input"]>;
+};
+type QueryDirectoryGroupsArgs = {
+    after?: InputMaybe<Scalars["String"]["input"]>;
+    before?: InputMaybe<Scalars["String"]["input"]>;
+    directoryId: Scalars["ID"]["input"];
+    limit?: InputMaybe<Scalars["Int"]["input"]>;
+    order?: InputMaybe<PaginationOrder>;
+};
+type QueryDirectoryUsersArgs = {
+    after?: InputMaybe<Scalars["String"]["input"]>;
+    before?: InputMaybe<Scalars["String"]["input"]>;
+    directoryId: Scalars["ID"]["input"];
+    limit?: InputMaybe<Scalars["Int"]["input"]>;
+    order?: InputMaybe<PaginationOrder>;
+};
+type QueryEffectivePermissionsArgs = {
+    userId: Scalars["ID"]["input"];
+};
+type QueryEvaluatedFlagsArgs = {
+    after?: InputMaybe<Scalars["String"]["input"]>;
+    before?: InputMaybe<Scalars["String"]["input"]>;
+    limit?: InputMaybe<Scalars["Int"]["input"]>;
+    order?: InputMaybe<PaginationOrder>;
+    userId: Scalars["ID"]["input"];
+};
+type QueryFlagArgs = {
+    id: Scalars["ID"]["input"];
+};
+type QueryFlagBySlugArgs = {
+    slug: Scalars["String"]["input"];
+};
+type QueryFlagsArgs = {
+    after?: InputMaybe<Scalars["String"]["input"]>;
+    before?: InputMaybe<Scalars["String"]["input"]>;
+    enabled?: InputMaybe<Scalars["Boolean"]["input"]>;
+    limit?: InputMaybe<Scalars["Int"]["input"]>;
+    order?: InputMaybe<PaginationOrder>;
+    search?: InputMaybe<Scalars["String"]["input"]>;
 };
 type QueryOrganizationArgs = {
     id: Scalars["ID"]["input"];
@@ -530,6 +1005,12 @@ type QueryOrganizationMembershipsArgs = {
     roleSlug?: InputMaybe<Scalars["String"]["input"]>;
     search?: InputMaybe<Scalars["String"]["input"]>;
 };
+type QueryRoleArgs = {
+    id: Scalars["ID"]["input"];
+};
+type QuerySsoConnectionArgs = {
+    id: Scalars["ID"]["input"];
+};
 type QueryUserArgs = {
     id: Scalars["ID"]["input"];
 };
@@ -538,7 +1019,12 @@ type RemoveMemberInput = {
     userId: Scalars["ID"]["input"];
 };
 type RemoveMemberResult = MemberIsManagedByDirectory | MemberNotFound | MemberRemoved;
-type RemoveMfaFactorResult = MfaFactorRemoved | NoMfaFactorsEnrolled;
+/** Input for removing all TOTP factors. */
+type RemoveMfaFactorInput = {
+    /** An elevated access token obtained by verifying the current email address. Required to prove recent re-authentication. */
+    elevatedAccessToken: Scalars["String"]["input"];
+};
+type RemoveMfaFactorResult = ElevatedAccessTokenExpired | ElevatedAccessTokenInvalid | MfaFactorRemoved | NoMfaFactorsEnrolled;
 type ResendInvitationInput = {
     /** The ID of the user whose invitation should be resent. */
     userId: Scalars["ID"]["input"];
@@ -548,18 +1034,50 @@ type ResendInvitationNotFound = {
     __typename?: "ResendInvitationNotFound";
     userId: Scalars["ID"]["output"];
 };
-type ResendInvitationResult = InvitationResent | InviteeAlreadyAccepted | ResendInvitationNotFound;
+type ResendInvitationResult = InvitationResent | InviteeAlreadyAccepted | InviteeEmailNotDeliverable | ResendInvitationNotFound;
+type RevokeAllSessionsResult = AllSessionsRevoked;
 type RevokeInvitationInput = {
     /** The ID of the user whose pending invitation should be revoked. */
     userId: Scalars["ID"]["input"];
 };
 type RevokeInvitationResult = InvitationNotFound | InvitationNotPending | InvitationRevoked;
+/** Input for revoking a specific session. */
+type RevokeSessionInput = {
+    /** The ID of the session to revoke. */
+    sessionId: Scalars["ID"]["input"];
+};
+type RevokeSessionResult = SessionNotFound | SessionRevoked;
+/** A role available within the organization. */
+type Role = {
+    __typename?: "Role";
+    createdAt: Scalars["DateTime"]["output"];
+    description?: Maybe<Scalars["String"]["output"]>;
+    id: Scalars["ID"]["output"];
+    /** Whether this is the default role assigned to new members. */
+    isDefault: Scalars["Boolean"]["output"];
+    name: Scalars["String"]["output"];
+    slug: Scalars["String"]["output"];
+    updatedAt: Scalars["DateTime"]["output"];
+};
+/** Confirms that a role has been scheduled for deletion. */
+type RoleDeleted = {
+    __typename?: "RoleDeleted";
+    /** The ID of the deleted role. */
+    id: Scalars["ID"]["output"];
+};
 /** No active roles with the given slugs exist in the environment. */
 type RoleNotFound = {
     __typename?: "RoleNotFound";
     /** The role slugs that did not resolve to active roles. */
     roleSlugs: Array<Scalars["String"]["output"]>;
 };
+/** Roles available in the organization along with role assignment configuration. */
+type RolesResult = {
+    __typename?: "RolesResult";
+    /** Whether members can be assigned multiple roles simultaneously. */
+    multipleRolesEnabled: Scalars["Boolean"]["output"];
+    roles: Array<Role>;
+};
 /** Input for requesting an email change verification code. */
 type SendEmailChangeInput = {
     /** The elevated access token from a successful `verifyCurrentEmail` call. */
@@ -569,6 +1087,45 @@ type SendEmailChangeInput = {
 };
 type SendEmailChangeResult = DailyEmailQuotaExceeded | EmailChangeNotAvailable | EmailChangeSent | EmailManagedByProvider | EmailNotAvailable | IdentityVerificationExpired | IdentityVerificationInvalid | InvalidEmail;
 type SendVerificationCodeResult = DailyEmailQuotaExceeded | VerificationCodeSent;
+/** An active user session. */
+type Session = {
+    __typename?: "Session";
+    createdAt: Scalars["DateTime"]["output"];
+    currentLocation?: Maybe<SessionLocation>;
+    id: Scalars["ID"]["output"];
+    ipAddress?: Maybe<Scalars["String"]["output"]>;
+    /** Whether this session is the one making the request. */
+    isCurrent: Scalars["Boolean"]["output"];
+    lastActivityAt?: Maybe<Scalars["DateTime"]["output"]>;
+    organizationId?: Maybe<Scalars["String"]["output"]>;
+    state: SessionState;
+    updatedAt: Scalars["DateTime"]["output"];
+    userAgent?: Maybe<Scalars["String"]["output"]>;
+};
+/** Approximate geographic location derived from the session IP. */
+type SessionLocation = {
+    __typename?: "SessionLocation";
+    cityName: Scalars["String"]["output"];
+    countryISOCode: Scalars["String"]["output"];
+};
+/** No session was found with the given ID. */
+type SessionNotFound = {
+    __typename?: "SessionNotFound";
+    /** The session ID that did not resolve to a session. */
+    sessionId: Scalars["ID"]["output"];
+};
+/** The session was revoked successfully. */
+type SessionRevoked = {
+    __typename?: "SessionRevoked";
+    session: Session;
+};
+/** The lifecycle state of a session. */
+type SessionState = {
+    __typename?: "SessionState";
+    expiresAt?: Maybe<Scalars["DateTime"]["output"]>;
+    /** Session state: Issued, Revoked, etc. */
+    tag: Scalars["String"]["output"];
+};
 /** The user already has a verified TOTP factor enrolled. */
 type TotpAlreadyEnrolled = {
     __typename?: "TotpAlreadyEnrolled";
@@ -623,6 +1180,42 @@ type UpdateProfileInput = {
     locale?: InputMaybe<Scalars["String"]["input"]>;
 };
 type UpdateProfileResult = InvalidLocale | ProfileUpdated;
+type UpdateRoleInput = {
+    /** Human-readable description of the role. This is a full replace of the role, so an omitted or null description clears it — resupply the current value to preserve it. */
+    description?: InputMaybe<Scalars["String"]["input"]>;
+    /** The ID of the role to update. */
+    id: Scalars["ID"]["input"];
+    /** Human-readable name for the role. */
+    name: Scalars["String"]["input"];
+    /** Slugs of the permissions granted to the role. Replaces the existing set when provided. */
+    permissions?: InputMaybe<Array<Scalars["String"]["input"]>>;
+};
+type UpdateSsoConnectionInput = {
+    id: Scalars["ID"]["input"];
+    /** A new human-readable name for the connection. */
+    name?: InputMaybe<Scalars["String"]["input"]>;
+};
+/** A user in the current environment. */
+type User = {
+    __typename?: "User";
+    connectedAccounts: Array<ConnectedAccount>;
+    createdAt: Scalars["DateTime"]["output"];
+    email: Scalars["String"]["output"];
+    emailVerified: Scalars["Boolean"]["output"];
+    firstName?: Maybe<Scalars["String"]["output"]>;
+    id: Scalars["ID"]["output"];
+    lastName?: Maybe<Scalars["String"]["output"]>;
+    /** Whether multi-factor authentication (TOTP) is set up for this user. Always `false` when the environment has MFA turned off — use `authenticationSettings.mfaEnabled` to tell the two apart. Only populated on `me`. */
+    mfaEnabled: Scalars["Boolean"]["output"];
+    /** When MFA was last used to authenticate. Only populated on `me`. */
+    mfaLastUsedAt?: Maybe<Scalars["DateTime"]["output"]>;
+    /** When a password was last used to authenticate. Only populated on `me`. */
+    passwordLastUsedAt?: Maybe<Scalars["DateTime"]["output"]>;
+    /** Whether this user has a password set. Reflects the user regardless of whether the environment allows password authentication; use `authenticationSettings.passwordAuthEnabled` for that. Only populated on `me`. */
+    passwordSet: Scalars["Boolean"]["output"];
+    profilePictureUrl?: Maybe<Scalars["String"]["output"]>;
+    updatedAt: Scalars["DateTime"]["output"];
+};
 /** The user already has a password set. */
 type UserAlreadyHasPassword = {
     __typename?: "UserAlreadyHasPassword";
@@ -633,6 +1226,14 @@ type UserInvited = {
     __typename?: "UserInvited";
     invitation: OrganizationInvitation;
 };
+/** An organization the authenticated user belongs to, with a flag indicating whether it is the token's current organization. */
+type UserOrganization = {
+    __typename?: "UserOrganization";
+    id: Scalars["ID"]["output"];
+    /** Whether this is the organization the token is currently scoped to. */
+    isCurrent: Scalars["Boolean"]["output"];
+    name: Scalars["String"]["output"];
+};
 /** The verification code has expired. */
 type VerificationCodeExpired = {
     __typename?: "VerificationCodeExpired";
@@ -675,8 +1276,10 @@ type VerifyTotpInput = {
     authenticationChallengeId: Scalars["String"]["input"];
     /** The TOTP code from the authenticator app. */
     code: Scalars["String"]["input"];
+    /** An elevated access token obtained by verifying the current email address. Required to prove recent re-authentication. */
+    elevatedAccessToken: Scalars["String"]["input"];
 };
-type VerifyTotpResult = TotpVerificationFailed | TotpVerified;
+type VerifyTotpResult = ElevatedAccessTokenExpired | ElevatedAccessTokenInvalid | TotpVerificationFailed | TotpVerified;
 type ClientApiStatusQueryVariables = Exact<{
     [key: string]: never;
 }>;
@@ -691,4 +1294,4 @@ declare function getSdk(client: GraphQLClient, withWrapper?: SdkFunctionWrapper)
 };
 type Sdk = ReturnType<typeof getSdk>;
 
-export { ClientApiStatusDocument, type ClientApiStatusQuery, type ClientApiStatusQueryVariables, type ClientApi_ConnectedAccount, type ClientApi_OAuthProvider, type ClientApi_Organization, type ClientApi_Passkey, type ClientApi_Role, type ClientApi_RolesResult, type ClientApi_Session, type ClientApi_SessionLocation, type ClientApi_SessionState, type ClientApi_User, type ClientApi_UserOrganization, type ConfirmEmailChangeInput, type ConfirmEmailChangeResult, type CreatePasswordInput, type CreatePasswordResult, type CurrentEmailVerified, type DailyEmailQuotaExceeded, type EmailChangeCodeExpired, type EmailChangeCodeIncorrect, type EmailChangeCodePreviouslyUsed, type EmailChangeConfirmed, type EmailChangeNotAvailable, type EmailChangeSent, type EmailChangeTooManyAttempts, type EmailManagedByProvider, type EmailNotAvailable, type EnrollTotpResult, type Exact, type IdentityVerificationExpired, type IdentityVerificationInvalid, type IncorrectPassword, type Incremental, type InputMaybe, type InvalidEmail, type InvalidInvitationExpiry, type InvalidInviteeEmail, type InvalidInviteeRole, type InvalidLocale, type InvitationNotFound, type InvitationNotPending, type InvitationResent, type InvitationRevoked, type InviteUserInput, type InviteUserResult, type InviteeAlreadyAccepted, type InviteeAlreadyInvited, type InviteeAlreadyMember, type ListMetadata, type MakeEmpty, type MakeMaybe, type MakeOptional, type Maybe, type MemberIsManagedByDirectory, type MemberNotFound, type MemberRemoved, type MemberRoleUpdated, type MfaFactorRemoved, type Mutation, type MutationConfirmEmailChangeArgs, type MutationCreatePasswordArgs, type MutationInviteUserArgs, type MutationRemoveMemberArgs, type MutationResendInvitationArgs, type MutationRevokeInvitationArgs, type MutationSendEmailChangeArgs, type MutationUpdateMemberRoleArgs, type MutationUpdatePasswordArgs, type MutationUpdateProfileArgs, type MutationVerifyCurrentEmailArgs, type MutationVerifyTotpArgs, type NoMfaFactorsEnrolled, type NoPendingEmailChange, type OrganizationInvitation, type OrganizationInvitationStatus, type OrganizationMember, type OrganizationMemberList, type OrganizationMemberRole, type OrganizationMemberStatus, type PaginationOrder, type PasswordCreated, type PasswordPolicyViolation, type PasswordUpdated, type ProfileUpdated, type Query, type QueryOrganizationArgs, type QueryOrganizationMembershipsArgs, type QueryUserArgs, type RemoveMemberInput, type RemoveMemberResult, type RemoveMfaFactorResult, type ResendInvitationInput, type ResendInvitationNotFound, type ResendInvitationResult, type RevokeInvitationInput, type RevokeInvitationResult, type RoleNotFound, type Scalars, type Sdk, type SdkFunctionWrapper, type SendEmailChangeInput, type SendEmailChangeResult, type SendVerificationCodeResult, type TotpAlreadyEnrolled, type TotpFactor, type TotpVerificationFailed, type TotpVerified, type UpdateMemberRoleInput, type UpdateMemberRoleResult, type UpdatePasswordInput, type UpdatePasswordResult, type UpdateProfileInput, type UpdateProfileResult, type UserAlreadyHasPassword, type UserInvited, type VerificationCodeExpired, type VerificationCodeIncorrect, type VerificationCodePreviouslyUsed, type VerificationCodeSent, type VerificationTooManyAttempts, type VerifyCurrentEmailInput, type VerifyCurrentEmailResult, type VerifyTotpInput, type VerifyTotpResult, getSdk };
+export { type AllSessionsRevoked, type AssignPermissionToRoleInput, type AuditEvent, type AuditEventActor, type AuditEventFilterInput, type AuditEventList, type AuditLogExport, type AuditLogExportState, type AuthenticationSettings, ClientApiStatusDocument, type ClientApiStatusQuery, type ClientApiStatusQueryVariables, type ConfirmEmailChangeInput, type ConfirmEmailChangeResult, type ConnectedAccount, type Connection, type ConnectionState, type ConnectionType, type CreateAuditLogExportInput, type CreateAuditLogExportResult, type CreatePasswordInput, type CreatePasswordResult, type CreateRoleInput, type CreateSsoConnectionInput, type CurrentEmailVerified, type DailyEmailQuotaExceeded, type DataProvider, type DataProviderConnection, type DataProviderConnectionList, type DataProviderList, type DeleteRoleInput, type Directory, type DirectoryGroup, type DirectoryGroupList, type DirectoryList, type DirectoryUser, type DirectoryUserList, type DomainVerificationNameServer, type ElevatedAccessTokenExpired, type ElevatedAccessTokenInvalid, type EmailChangeCodeExpired, type EmailChangeCodeIncorrect, type EmailChangeCodePreviouslyUsed, type EmailChangeConfirmed, type EmailChangeNotAvailable, type EmailChangeSent, type EmailChangeTooManyAttempts, type EmailManagedByProvider, type EmailNotAvailable, type EnrollTotpInput, type EnrollTotpResult, type Exact, type Flag, type FlagList, type IdentityVerificationExpired, type IdentityVerificationInvalid, type IncorrectPassword, type Incremental, type InputMaybe, type InvalidAuditLogExportDateRange, type InvalidEmail, type InvalidInvitationExpiry, type InvalidInviteeEmail, type InvalidInviteeRole, type InvalidLocale, type InvitationNotFound, type InvitationNotPending, type InvitationResent, type InvitationRevoked, type InviteUserInput, type InviteUserResult, type InviteeAlreadyAccepted, type InviteeAlreadyInvited, type InviteeAlreadyMember, type InviteeEmailNotDeliverable, type ListMetadata, type MakeEmpty, type MakeMaybe, type MakeOptional, type Maybe, type MemberIsManagedByDirectory, type MemberNotFound, type MemberRemoved, type MemberRoleUpdated, type MfaFactorRemoved, type Mutation, type MutationAssignPermissionToRoleArgs, type MutationConfirmEmailChangeArgs, type MutationCreateAuditLogExportArgs, type MutationCreateOrganizationDomainArgs, type MutationCreatePasswordArgs, type MutationCreateRoleArgs, type MutationCreateSsoConnectionArgs, type MutationDeleteOrganizationDomainArgs, type MutationDeleteRoleArgs, type MutationDeleteSsoConnectionArgs, type MutationEnrollTotpArgs, type MutationInviteUserArgs, type MutationRemoveMemberArgs, type MutationRemoveMfaFactorArgs, type MutationResendInvitationArgs, type MutationReverifyOrganizationDomainArgs, type MutationRevokeInvitationArgs, type MutationRevokeSessionArgs, type MutationSendEmailChangeArgs, type MutationUpdateMemberRoleArgs, type MutationUpdatePasswordArgs, type MutationUpdateProfileArgs, type MutationUpdateRoleArgs, type MutationUpdateSsoConnectionArgs, type MutationVerifyCurrentEmailArgs, type MutationVerifyTotpArgs, type NoAuditEventsFound, type NoMfaFactorsEnrolled, type NoPendingEmailChange, type OAuthProvider, type Organization, type OrganizationBlockedFromSendingInvites, type OrganizationDomain, type OrganizationDomainState, type OrganizationInvitation, type OrganizationInvitationStatus, type OrganizationMember, type OrganizationMemberList, type OrganizationMemberRole, type OrganizationMemberStatus, type PaginationOrder, type Passkey, type PasswordCharacterType, type PasswordCreated, type PasswordPolicy, type PasswordPolicyViolation, type PasswordUpdated, type PasswordViolation, type Permission, type ProfileUpdated, type Query, type QueryAuditEventArgs, type QueryAuditEventsArgs, type QueryDataProviderArgs, type QueryDataProviderConnectionArgs, type QueryDataProviderConnectionsArgs, type QueryDataProvidersArgs, type QueryDirectoryConnectionArgs, type QueryDirectoryConnectionsArgs, type QueryDirectoryGroupsArgs, type QueryDirectoryUsersArgs, type QueryEffectivePermissionsArgs, type QueryEvaluatedFlagsArgs, type QueryFlagArgs, type QueryFlagBySlugArgs, type QueryFlagsArgs, type QueryOrganizationArgs, type QueryOrganizationMembershipsArgs, type QueryRoleArgs, type QuerySsoConnectionArgs, type QueryUserArgs, type RemoveMemberInput, type RemoveMemberResult, type RemoveMfaFactorInput, type RemoveMfaFactorResult, type ResendInvitationInput, type ResendInvitationNotFound, type ResendInvitationResult, type RevokeAllSessionsResult, type RevokeInvitationInput, type RevokeInvitationResult, type RevokeSessionInput, type RevokeSessionResult, type Role, type RoleDeleted, type RoleNotFound, type RolesResult, type Scalars, type Sdk, type SdkFunctionWrapper, type SendEmailChangeInput, type SendEmailChangeResult, type SendVerificationCodeResult, type Session, type SessionLocation, type SessionNotFound, type SessionRevoked, type SessionState, type TotpAlreadyEnrolled, type TotpFactor, type TotpVerificationFailed, type TotpVerified, type UpdateMemberRoleInput, type UpdateMemberRoleResult, type UpdatePasswordInput, type UpdatePasswordResult, type UpdateProfileInput, type UpdateProfileResult, type UpdateRoleInput, type UpdateSsoConnectionInput, type User, type UserAlreadyHasPassword, type UserInvited, type UserOrganization, type VerificationCodeExpired, type VerificationCodeIncorrect, type VerificationCodePreviouslyUsed, type VerificationCodeSent, type VerificationTooManyAttempts, type VerifyCurrentEmailInput, type VerifyCurrentEmailResult, type VerifyTotpInput, type VerifyTotpResult, getSdk };