@workos-inc/widgets 1.16.1 → 1.17.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 1.17.0
+
+### Minor Changes
+
+- Add a `filter` prop to the `Pipes` Widget that narrows which enabled integrations render, so a host can mount multiple instances each scoped to a subset (e.g. one instance per integration). Accepts either serializable criteria (`{ slugs, integrationTypes, authMethods }`) for the server-component pattern, or a predicate for arbitrary client-side filtering. Exports `PipesFilter`, `PipesFilterCriteria`, `PipesAuthMethod`, and the `DataIntegration` type.
+
 ## 1.16.1
 
 ### Patch Changes

package/dist/cjs/api/client-graphql/generated.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/api/client-graphql/generated.ts"],"sourcesContent":["import type { GraphQLClient, RequestOptions } from \"graphql-request\";\nexport type Maybe<T> = T | null;\nexport type InputMaybe<T> = Maybe<T>;\nexport type Exact<T extends { [key: string]: unknown }> = {\n  [K in keyof T]: T[K];\n};\nexport type MakeOptional<T, K extends keyof T> = Omit<T, K> & {\n  [SubKey in K]?: Maybe<T[SubKey]>;\n};\nexport type MakeMaybe<T, K extends keyof T> = Omit<T, K> & {\n  [SubKey in K]: Maybe<T[SubKey]>;\n};\nexport type MakeEmpty<\n  T extends { [key: string]: unknown },\n  K extends keyof T,\n> = { [_ in K]?: never };\nexport type Incremental<T> =\n  | T\n  | {\n      [P in keyof T]?: P extends \" $fragmentName\" | \"__typename\" ? T[P] : never;\n    };\ntype GraphQLClientRequestHeaders = RequestOptions[\"requestHeaders\"];\n/** All built-in and custom scalars, mapped to their actual values */\nexport type Scalars = {\n  ID: { input: string; output: string };\n  String: { input: string; output: string };\n  Boolean: { input: boolean; output: boolean };\n  Int: { input: number; output: number };\n  Float: { input: number; output: number };\n  /** A date-time string at UTC, such as 2019-12-03T09:54:33Z, compliant with the date-time format. */\n  DateTime: { input: string; output: string };\n  /** The `JSON` scalar type represents JSON values as specified by [ECMA-404](http://www.ecma-international.org/publications/files/ECMA-ST/ECMA-404.pdf). */\n  JSON: { input: any; output: any };\n};\n\n/** All other sessions were revoked successfully. */\nexport type AllSessionsRevoked = {\n  __typename?: \"AllSessionsRevoked\";\n  success: Scalars[\"Boolean\"][\"output\"];\n};\n\nexport type AssignPermissionToRoleInput = {\n  /** The slug of the permission to assign. */\n  permissionSlug: Scalars[\"String\"][\"input\"];\n  /** The ID of the role to assign the permission to. */\n  roleId: Scalars[\"ID\"][\"input\"];\n};\n\nexport type AuditEvent = {\n  __typename?: \"AuditEvent\";\n  action: Scalars[\"String\"][\"output\"];\n  actor: AuditEventActor;\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  data: Scalars[\"JSON\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  occurredAt: Scalars[\"DateTime\"][\"output\"];\n  targets: Array<Scalars[\"String\"][\"output\"]>;\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\nexport type AuditEventActor = {\n  __typename?: \"AuditEventActor\";\n  id: Scalars[\"String\"][\"output\"];\n  name?: Maybe<Scalars[\"String\"][\"output\"]>;\n  type: Scalars[\"String\"][\"output\"];\n};\n\nexport type AuditEventFilterInput = {\n  actions?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  actorIds?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  actorNames?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  rangeEnd: Scalars[\"DateTime\"][\"input\"];\n  rangeStart: Scalars[\"DateTime\"][\"input\"];\n  search?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  targetIds?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  targetTypes?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n};\n\nexport type AuditEventList = {\n  __typename?: \"AuditEventList\";\n  data: Array<AuditEvent>;\n  listMetadata: ListMetadata;\n};\n\nexport type AuditLogExport = {\n  __typename?: \"AuditLogExport\";\n  id: Scalars[\"ID\"][\"output\"];\n  state: AuditLogExportState;\n};\n\nexport type AuditLogExportState = \"Error\" | \"Expired\" | \"Pending\" | \"Ready\";\n\n/** The authentication methods the environment allows, and the password policy it enforces. Distinct from what the authenticated user has set up, which lives on `me`. */\nexport type AuthenticationSettings = {\n  __typename?: \"AuthenticationSettings\";\n  /** Whether multi-factor authentication is available in this environment. When `false`, TOTP enrollment should not be offered. */\n  mfaEnabled: Scalars[\"Boolean\"][\"output\"];\n  /** Whether multi-factor authentication is mandatory for every user in this environment. */\n  mfaRequired: Scalars[\"Boolean\"][\"output\"];\n  /** Whether users may authenticate with a passkey. */\n  passkeyAuthEnabled: Scalars[\"Boolean\"][\"output\"];\n  /** Whether users may authenticate with a password. When `false`, `createPassword` and `updatePassword` should not be offered. */\n  passwordAuthEnabled: Scalars[\"Boolean\"][\"output\"];\n  passwordPolicy: PasswordPolicy;\n};\n\n/** Input for confirming an email change with the verification code. */\nexport type ConfirmEmailChangeInput = {\n  /** The verification code sent to the new email address. */\n  code: Scalars[\"String\"][\"input\"];\n  /** The elevated access token from a successful `verifyCurrentEmail` call. */\n  elevatedAccessToken: Scalars[\"String\"][\"input\"];\n};\n\nexport type ConfirmEmailChangeResult =\n  | EmailChangeCodeExpired\n  | EmailChangeCodeIncorrect\n  | EmailChangeCodePreviouslyUsed\n  | EmailChangeConfirmed\n  | EmailChangeTooManyAttempts\n  | EmailManagedByProvider\n  | EmailNotAvailable\n  | IdentityVerificationExpired\n  | IdentityVerificationInvalid\n  | InvalidEmail\n  | NoPendingEmailChange;\n\n/** An OAuth profile linked to the authenticated user. */\nexport type ConnectedAccount = {\n  __typename?: \"ConnectedAccount\";\n  email?: Maybe<Scalars[\"String\"][\"output\"]>;\n  firstName?: Maybe<Scalars[\"String\"][\"output\"]>;\n  id: Scalars[\"ID\"][\"output\"];\n  lastLoginAt?: Maybe<Scalars[\"DateTime\"][\"output\"]>;\n  lastName?: Maybe<Scalars[\"String\"][\"output\"]>;\n  profilePictureUrl?: Maybe<Scalars[\"String\"][\"output\"]>;\n  provider: OAuthProvider;\n};\n\n/** An SSO connection belonging to the organization. Mirrors the SSO Connection exposed by the REST connections API. */\nexport type Connection = {\n  __typename?: \"Connection\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  /** A human-readable name for the connection. */\n  name: Scalars[\"String\"][\"output\"];\n  /** The organization the connection belongs to. */\n  organizationId?: Maybe<Scalars[\"ID\"][\"output\"]>;\n  /** Whether the connection has completed its IdP setup and can authenticate users (equivalent to an `Active` state). */\n  setupComplete: Scalars[\"Boolean\"][\"output\"];\n  /** The connection's IdP setup status. `Active` indicates setup is complete; other states indicate where the connection is in its setup flow. */\n  state: ConnectionState;\n  /** The identity provider type of the connection. */\n  type: ConnectionType;\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** Enum represents the state of the connection. */\nexport type ConnectionState = \"Active\" | \"Deleting\" | \"Inactive\" | \"Validating\";\n\n/** Enum represents the type of connection. */\nexport type ConnectionType =\n  | \"ADFSSAML\"\n  | \"AdpOidc\"\n  | \"AppleOAuth\"\n  | \"Auth0Migration\"\n  | \"Auth0SAML\"\n  | \"AzureSAML\"\n  | \"BitbucketOAuth\"\n  | \"CasSAML\"\n  | \"ClassLinkSAML\"\n  | \"CleverOIDC\"\n  | \"CloudflareSAML\"\n  | \"CyberArkSAML\"\n  | \"DiscordOAuth\"\n  | \"DuoSAML\"\n  | \"EntraIdOIDC\"\n  | \"GenericOIDC\"\n  | \"GenericSAML\"\n  | \"GitLabOAuth\"\n  | \"GithubOAuth\"\n  | \"GoogleOAuth\"\n  | \"GoogleOIDC\"\n  | \"GoogleSAML\"\n  | \"GrokOAuth\"\n  | \"IntuitOAuth\"\n  | \"JumpCloudSAML\"\n  | \"KeycloakSAML\"\n  | \"LastPassSAML\"\n  | \"LinkedInOAuth\"\n  | \"LoginGovOidc\"\n  | \"MagicLink\"\n  | \"MicrosoftOAuth\"\n  | \"MiniOrangeSAML\"\n  | \"NetIqSAML\"\n  | \"OktaOIDC\"\n  | \"OktaSAML\"\n  | \"OneLoginSAML\"\n  | \"OracleSAML\"\n  | \"PingFederateSAML\"\n  | \"PingOneSAML\"\n  | \"RipplingSAML\"\n  | \"SalesforceOAuth\"\n  | \"SalesforceSAML\"\n  | \"ShibbolethGenericSAML\"\n  | \"ShibbolethSAML\"\n  | \"SimpleSamlPhpSAML\"\n  | \"SlackOAuth\"\n  | \"TestIdp\"\n  | \"VMwareSAML\"\n  | \"VercelMarketplaceOAuth\"\n  | \"VercelOAuth\"\n  | \"XOAuth\"\n  | \"XeroOAuth\";\n\nexport type CreateAuditLogExportInput = {\n  actions?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  actorIds?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  actorNames?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  rangeEnd: Scalars[\"DateTime\"][\"input\"];\n  rangeStart: Scalars[\"DateTime\"][\"input\"];\n  targetIds?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  targetTypes?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n};\n\nexport type CreateAuditLogExportResult =\n  | AuditLogExport\n  | InvalidAuditLogExportDateRange\n  | NoAuditEventsFound;\n\n/** Input for setting a password on an account that does not yet have one (e.g. signed up via OAuth). */\nexport type CreatePasswordInput = {\n  /** An elevated access token obtained by verifying the current email address. Required to prove recent re-authentication. */\n  elevatedAccessToken: Scalars[\"String\"][\"input\"];\n  /** The password to set. Must satisfy the environment password policy. */\n  password: Scalars[\"String\"][\"input\"];\n};\n\nexport type CreatePasswordResult =\n  | ElevatedAccessTokenExpired\n  | ElevatedAccessTokenInvalid\n  | PasswordCreated\n  | PasswordPolicyViolation\n  | UserAlreadyHasPassword;\n\nexport type CreateRoleInput = {\n  /** Optional human-readable description of the role. */\n  description?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  /** Human-readable name for the role. */\n  name: Scalars[\"String\"][\"input\"];\n  /** Slugs of the permissions granted to the role. */\n  permissions?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  /** Unique slug identifying the role. Generated from the name when omitted. */\n  slug?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n};\n\nexport type CreateSsoConnectionInput = {\n  /** A human-readable name for the connection. Defaults to the organization's name. */\n  name?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  /** The identity provider type of the connection to create. */\n  type: ConnectionType;\n};\n\n/** The current email was verified successfully. */\nexport type CurrentEmailVerified = {\n  __typename?: \"CurrentEmailVerified\";\n  /** The elevated access token to pass to `sendEmailChange` and `confirmEmailChange`. */\n  elevatedAccessToken: Scalars[\"String\"][\"output\"];\n  /** When the elevated access token expires (ISO 8601). */\n  expiresAt: Scalars[\"String\"][\"output\"];\n};\n\n/** Daily verification email quota exceeded. */\nexport type DailyEmailQuotaExceeded = {\n  __typename?: \"DailyEmailQuotaExceeded\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** A third-party data provider configured for the current environment. */\nexport type DataProvider = {\n  __typename?: \"DataProvider\";\n  /** How accounts authenticate with this data provider. */\n  authMethods: Array<Scalars[\"String\"][\"output\"]>;\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  description?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** Whether the data provider is enabled in the environment. */\n  enabled: Scalars[\"Boolean\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  /** The provider type this data provider was created from. */\n  integrationType: Scalars[\"String\"][\"output\"];\n  /** The display name of the data provider. */\n  name: Scalars[\"String\"][\"output\"];\n  /** The OAuth scopes configured for the data provider. `null` when the provider's default scopes are used. */\n  scopes?: Maybe<Array<Scalars[\"String\"][\"output\"]>>;\n  /** The slug of the data provider. */\n  slug: Scalars[\"String\"][\"output\"];\n  /** The configuration state of the data provider: `valid`, `invalid`, or `requested`. */\n  state: Scalars[\"String\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** A connection between a data provider and the authenticated user's account. */\nexport type DataProviderConnection = {\n  __typename?: \"DataProviderConnection\";\n  /** How the connection authenticates: `oauth`, `api_key`, or `client_credentials`. */\n  authMethod: Scalars[\"String\"][\"output\"];\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  /** The data provider this connection was created for. */\n  dataProviderId: Scalars[\"ID\"][\"output\"];\n  /** The slug of the connected data provider. */\n  dataProviderSlug: Scalars[\"String\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  organizationId?: Maybe<Scalars[\"ID\"][\"output\"]>;\n  /** The OAuth scopes granted for this connection. */\n  scopes: Array<Scalars[\"String\"][\"output\"]>;\n  /** The status of the connection: `connected` or `needs_reauthorization`. */\n  state: Scalars[\"String\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n  userId?: Maybe<Scalars[\"ID\"][\"output\"]>;\n};\n\nexport type DataProviderConnectionList = {\n  __typename?: \"DataProviderConnectionList\";\n  data: Array<DataProviderConnection>;\n  listMetadata: ListMetadata;\n};\n\nexport type DataProviderList = {\n  __typename?: \"DataProviderList\";\n  data: Array<DataProvider>;\n  listMetadata: ListMetadata;\n};\n\nexport type DeleteRoleInput = {\n  /** The ID of the role to delete. */\n  id: Scalars[\"ID\"][\"input\"];\n};\n\n/** A Directory Sync connection within the current environment. */\nexport type Directory = {\n  __typename?: \"Directory\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  externalKey: Scalars[\"String\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  name: Scalars[\"String\"][\"output\"];\n  organizationId: Scalars[\"ID\"][\"output\"];\n  /** The linking state of the directory. */\n  state: Scalars[\"String\"][\"output\"];\n  /** The provider type of the directory. */\n  type: Scalars[\"String\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** A group provisioned through a Directory Sync connection. */\nexport type DirectoryGroup = {\n  __typename?: \"DirectoryGroup\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  directoryId: Scalars[\"ID\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  /** The identifier of the group in the identity provider. */\n  idpId: Scalars[\"String\"][\"output\"];\n  name: Scalars[\"String\"][\"output\"];\n  organizationId: Scalars[\"ID\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\nexport type DirectoryGroupList = {\n  __typename?: \"DirectoryGroupList\";\n  data: Array<DirectoryGroup>;\n  listMetadata: ListMetadata;\n};\n\nexport type DirectoryList = {\n  __typename?: \"DirectoryList\";\n  data: Array<Directory>;\n  listMetadata: ListMetadata;\n};\n\n/** A user provisioned through a Directory Sync connection. */\nexport type DirectoryUser = {\n  __typename?: \"DirectoryUser\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  directoryId: Scalars[\"ID\"][\"output\"];\n  email?: Maybe<Scalars[\"String\"][\"output\"]>;\n  firstName?: Maybe<Scalars[\"String\"][\"output\"]>;\n  id: Scalars[\"ID\"][\"output\"];\n  /** The identifier of the user in the identity provider. */\n  idpId: Scalars[\"String\"][\"output\"];\n  lastName?: Maybe<Scalars[\"String\"][\"output\"]>;\n  organizationId: Scalars[\"ID\"][\"output\"];\n  /** The provisioning state of the directory user. */\n  state: Scalars[\"String\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n  username?: Maybe<Scalars[\"String\"][\"output\"]>;\n};\n\nexport type DirectoryUserList = {\n  __typename?: \"DirectoryUserList\";\n  data: Array<DirectoryUser>;\n  listMetadata: ListMetadata;\n};\n\n/** The DNS name server provider detected for a domain. */\nexport type DomainVerificationNameServer =\n  | \"AwsRoute53\"\n  | \"CloudFlare\"\n  | \"GoDaddy\"\n  | \"GoogleDomains\"\n  | \"Other\";\n\n/** The elevated access token has expired. The user must re-verify their identity. */\nexport type ElevatedAccessTokenExpired = {\n  __typename?: \"ElevatedAccessTokenExpired\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The elevated access token is invalid. */\nexport type ElevatedAccessTokenInvalid = {\n  __typename?: \"ElevatedAccessTokenInvalid\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The verification code has expired. */\nexport type EmailChangeCodeExpired = {\n  __typename?: \"EmailChangeCodeExpired\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The verification code is incorrect. */\nexport type EmailChangeCodeIncorrect = {\n  __typename?: \"EmailChangeCodeIncorrect\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The verification code has already been used. */\nexport type EmailChangeCodePreviouslyUsed = {\n  __typename?: \"EmailChangeCodePreviouslyUsed\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The email was changed successfully. */\nexport type EmailChangeConfirmed = {\n  __typename?: \"EmailChangeConfirmed\";\n  /** A fresh elevated access token for subsequent elevated operations. */\n  elevatedAccessToken: Scalars[\"String\"][\"output\"];\n  /** When the elevated access token expires (ISO 8601). */\n  expiresAt: Scalars[\"String\"][\"output\"];\n  user: User;\n};\n\n/** Email change is not available for this account. */\nexport type EmailChangeNotAvailable = {\n  __typename?: \"EmailChangeNotAvailable\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** A verification code was sent to the new email address. */\nexport type EmailChangeSent = {\n  __typename?: \"EmailChangeSent\";\n  /** When the verification code expires. */\n  expiresAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** Too many verification attempts. */\nexport type EmailChangeTooManyAttempts = {\n  __typename?: \"EmailChangeTooManyAttempts\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The email is managed by an identity provider and cannot be changed. */\nexport type EmailManagedByProvider = {\n  __typename?: \"EmailManagedByProvider\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The email address is not available. */\nexport type EmailNotAvailable = {\n  __typename?: \"EmailNotAvailable\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** Input for enrolling a new TOTP factor. */\nexport type EnrollTotpInput = {\n  /** An elevated access token obtained by verifying the current email address. Required to prove recent re-authentication. */\n  elevatedAccessToken: Scalars[\"String\"][\"input\"];\n};\n\nexport type EnrollTotpResult =\n  | ElevatedAccessTokenExpired\n  | ElevatedAccessTokenInvalid\n  | TotpAlreadyEnrolled\n  | TotpFactor;\n\n/** A feature flag defined in the project that owns the environment the token was issued for. Mirrors the Feature Flag exposed by the REST feature flags API. */\nexport type Flag = {\n  __typename?: \"Flag\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  /** The value returned for users and organizations that do not match any targeting rule in the environment the token was issued for. */\n  defaultValue: Scalars[\"Boolean\"][\"output\"];\n  description?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** Whether the feature flag is active in the environment the token was issued for. */\n  enabled: Scalars[\"Boolean\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  /** A descriptive name for the feature flag. */\n  name: Scalars[\"String\"][\"output\"];\n  /** A unique key used to reference the feature flag. */\n  slug: Scalars[\"String\"][\"output\"];\n  /** Labels assigned to the feature flag. */\n  tags: Array<Scalars[\"String\"][\"output\"]>;\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\nexport type FlagList = {\n  __typename?: \"FlagList\";\n  data: Array<Flag>;\n  listMetadata: ListMetadata;\n};\n\n/** The identity verification has expired. Please verify your current email again. */\nexport type IdentityVerificationExpired = {\n  __typename?: \"IdentityVerificationExpired\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The identity verification is no longer valid. */\nexport type IdentityVerificationInvalid = {\n  __typename?: \"IdentityVerificationInvalid\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The provided current password does not match the existing password. */\nexport type IncorrectPassword = {\n  __typename?: \"IncorrectPassword\";\n  _placeholder: Scalars[\"Boolean\"][\"output\"];\n};\n\nexport type InvalidAuditLogExportDateRange = {\n  __typename?: \"InvalidAuditLogExportDateRange\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The provided email address is invalid. */\nexport type InvalidEmail = {\n  __typename?: \"InvalidEmail\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The requested invitation expiry is outside the allowed range (1–30 days). */\nexport type InvalidInvitationExpiry = {\n  __typename?: \"InvalidInvitationExpiry\";\n  /** Placeholder field to allow an empty @ObjectType. */\n  _placeholder?: Maybe<Scalars[\"Boolean\"][\"output\"]>;\n};\n\n/** The provided email address is not valid. */\nexport type InvalidInviteeEmail = {\n  __typename?: \"InvalidInviteeEmail\";\n  email: Scalars[\"String\"][\"output\"];\n};\n\n/** The requested role is not valid for this organization. */\nexport type InvalidInviteeRole = {\n  __typename?: \"InvalidInviteeRole\";\n  roleSlug?: Maybe<Scalars[\"String\"][\"output\"]>;\n};\n\n/** The provided locale is not a valid BCP 47 tag. */\nexport type InvalidLocale = {\n  __typename?: \"InvalidLocale\";\n  _placeholder: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** No pending invitation exists for this user in this organization. */\nexport type InvitationNotFound = {\n  __typename?: \"InvitationNotFound\";\n  userId: Scalars[\"ID\"][\"output\"];\n};\n\n/** The invitation is not pending (already accepted, expired, or revoked) and cannot be revoked. */\nexport type InvitationNotPending = {\n  __typename?: \"InvitationNotPending\";\n  userId: Scalars[\"ID\"][\"output\"];\n};\n\n/** The invitation was resent successfully. */\nexport type InvitationResent = {\n  __typename?: \"InvitationResent\";\n  invitation: OrganizationInvitation;\n};\n\n/** The invitation was revoked. */\nexport type InvitationRevoked = {\n  __typename?: \"InvitationRevoked\";\n  invitation: OrganizationInvitation;\n};\n\nexport type InviteUserInput = {\n  /** The email address to invite. */\n  email: Scalars[\"String\"][\"input\"];\n  /** Number of days until the invitation expires. Defaults to the environment setting when omitted. */\n  expiresInDays?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  /** Slug of the role to grant on acceptance. Defaults to the organization default role when omitted. */\n  roleSlug?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n};\n\nexport type InviteUserResult =\n  | InvalidInvitationExpiry\n  | InvalidInviteeEmail\n  | InvalidInviteeRole\n  | InviteeAlreadyInvited\n  | InviteeAlreadyMember\n  | InviteeEmailNotDeliverable\n  | OrganizationBlockedFromSendingInvites\n  | UserInvited;\n\n/** The user has already accepted their invitation and is an active member. */\nexport type InviteeAlreadyAccepted = {\n  __typename?: \"InviteeAlreadyAccepted\";\n  userId: Scalars[\"ID\"][\"output\"];\n};\n\n/** This email already has a pending invitation. */\nexport type InviteeAlreadyInvited = {\n  __typename?: \"InviteeAlreadyInvited\";\n  email: Scalars[\"String\"][\"output\"];\n};\n\n/** A user with this email is already a member of the organization. */\nexport type InviteeAlreadyMember = {\n  __typename?: \"InviteeAlreadyMember\";\n  email: Scalars[\"String\"][\"output\"];\n};\n\n/** The invitee's email domain has no mail servers, so the invitation email cannot be delivered. */\nexport type InviteeEmailNotDeliverable = {\n  __typename?: \"InviteeEmailNotDeliverable\";\n  email: Scalars[\"String\"][\"output\"];\n};\n\nexport type ListMetadata = {\n  __typename?: \"ListMetadata\";\n  after?: Maybe<Scalars[\"String\"][\"output\"]>;\n  before?: Maybe<Scalars[\"String\"][\"output\"]>;\n};\n\n/** The member is provisioned by a directory and cannot be removed. */\nexport type MemberIsManagedByDirectory = {\n  __typename?: \"MemberIsManagedByDirectory\";\n  /** The user ID of the directory-managed member. */\n  userId: Scalars[\"ID\"][\"output\"];\n};\n\n/** No active member was found for the given user in the organization. */\nexport type MemberNotFound = {\n  __typename?: \"MemberNotFound\";\n  /** The user ID that did not resolve to a member. */\n  userId: Scalars[\"ID\"][\"output\"];\n};\n\n/** The member was removed from the organization. */\nexport type MemberRemoved = {\n  __typename?: \"MemberRemoved\";\n  /** The user ID of the removed member. */\n  userId: Scalars[\"ID\"][\"output\"];\n};\n\n/** The member's role was updated. */\nexport type MemberRoleUpdated = {\n  __typename?: \"MemberRoleUpdated\";\n  member: OrganizationMember;\n};\n\n/** All TOTP factors were removed successfully. */\nexport type MfaFactorRemoved = {\n  __typename?: \"MfaFactorRemoved\";\n  success: Scalars[\"Boolean\"][\"output\"];\n};\n\nexport type Mutation = {\n  __typename?: \"Mutation\";\n  /** Grant a permission to a role belonging to the organization the token was issued for. */\n  assignPermissionToRole: Role;\n  /** Confirms an email change using the verification code sent to the new email address. Requires an elevated access token from `verifyCurrentEmail`. */\n  confirmEmailChange: ConfirmEmailChangeResult;\n  createAuditLogExport: CreateAuditLogExportResult;\n  /** Add a domain to the token's organization and begin DNS verification. */\n  createOrganizationDomain: OrganizationDomain;\n  /** Set a password for the authenticated user who does not yet have one (e.g. signed up via OAuth). Validates against the environment password policy. */\n  createPassword: CreatePasswordResult;\n  /** Create a role for the organization the token was issued for. */\n  createRole: Role;\n  /** Create an SSO connection for the token’s organization. */\n  createSsoConnection: Connection;\n  /** Delete a domain belonging to the token's organization and return it. */\n  deleteOrganizationDomain: OrganizationDomain;\n  /** Delete a role belonging to the organization the token was issued for. */\n  deleteRole: RoleDeleted;\n  /** Delete an SSO connection belonging to the token’s organization. */\n  deleteSsoConnection: Scalars[\"ID\"][\"output\"];\n  /** Create a TOTP factor and return the secret and QR URI for the user to scan. This is step 1 of TOTP enrollment. */\n  enrollTotp: EnrollTotpResult;\n  /** Invite a user to the organization the token was issued for, assigning a role and sending the invitation email. */\n  inviteUser: InviteUserResult;\n  /** Remove a member from the organization the token was issued for. */\n  removeMember: RemoveMemberResult;\n  /** Delete all TOTP factors for the authenticated user, effectively resetting MFA. */\n  removeMfaFactor: RemoveMfaFactorResult;\n  /** Resend a pending, expired, or revoked invitation for the organization the token was issued for. If the original invitation has expired or been revoked, a new invitation is created with the same role. */\n  resendInvitation: ResendInvitationResult;\n  /** Restart verification for a domain belonging to the token's organization. */\n  reverifyOrganizationDomain: OrganizationDomain;\n  /** Revokes all active sessions for the authenticated user except the current one. */\n  revokeAllSessions: RevokeAllSessionsResult;\n  /** Revoke a pending invitation for the organization the token was issued for. */\n  revokeInvitation: RevokeInvitationResult;\n  /** Revokes a specific session by ID. */\n  revokeSession: RevokeSessionResult;\n  /** Sends a verification code to the new email address. Requires an elevated access token from `verifyCurrentEmail`. The user must confirm with the code via `confirmEmailChange`. */\n  sendEmailChange: SendEmailChangeResult;\n  /** Sends a verification code to the user's current email address to prove ownership before changing email. */\n  sendVerificationCode: SendVerificationCodeResult;\n  /** Update an organization member's roles within the organization the token was issued for. When multiple roles are enabled, all provided role slugs are assigned; otherwise only the first is used. */\n  updateMemberRole: UpdateMemberRoleResult;\n  /** Change the password for the authenticated user. Requires the current password for verification and validates the new password against the environment password policy. */\n  updatePassword: UpdatePasswordResult;\n  /** Updates the authenticated user's profile (first name, last name, locale). */\n  updateProfile: UpdateProfileResult;\n  /** Update a role belonging to the organization the token was issued for. */\n  updateRole: Role;\n  /** Update an SSO connection belonging to the token’s organization. */\n  updateSsoConnection: Connection;\n  /** Verifies the code sent to the current email address. Returns an elevated access token required for `sendEmailChange` and `confirmEmailChange`. */\n  verifyCurrentEmail: VerifyCurrentEmailResult;\n  /** Confirm TOTP enrollment by verifying a code from the authenticator app. Marks the factor as verified. */\n  verifyTotp: VerifyTotpResult;\n};\n\nexport type MutationAssignPermissionToRoleArgs = {\n  input: AssignPermissionToRoleInput;\n};\n\nexport type MutationConfirmEmailChangeArgs = {\n  input: ConfirmEmailChangeInput;\n};\n\nexport type MutationCreateAuditLogExportArgs = {\n  input: CreateAuditLogExportInput;\n};\n\nexport type MutationCreateOrganizationDomainArgs = {\n  domain: Scalars[\"String\"][\"input\"];\n};\n\nexport type MutationCreatePasswordArgs = {\n  input: CreatePasswordInput;\n};\n\nexport type MutationCreateRoleArgs = {\n  input: CreateRoleInput;\n};\n\nexport type MutationCreateSsoConnectionArgs = {\n  input: CreateSsoConnectionInput;\n};\n\nexport type MutationDeleteOrganizationDomainArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type MutationDeleteRoleArgs = {\n  input: DeleteRoleInput;\n};\n\nexport type MutationDeleteSsoConnectionArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type MutationEnrollTotpArgs = {\n  input: EnrollTotpInput;\n};\n\nexport type MutationInviteUserArgs = {\n  input: InviteUserInput;\n};\n\nexport type MutationRemoveMemberArgs = {\n  input: RemoveMemberInput;\n};\n\nexport type MutationRemoveMfaFactorArgs = {\n  input: RemoveMfaFactorInput;\n};\n\nexport type MutationResendInvitationArgs = {\n  input: ResendInvitationInput;\n};\n\nexport type MutationReverifyOrganizationDomainArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type MutationRevokeInvitationArgs = {\n  input: RevokeInvitationInput;\n};\n\nexport type MutationRevokeSessionArgs = {\n  input: RevokeSessionInput;\n};\n\nexport type MutationSendEmailChangeArgs = {\n  input: SendEmailChangeInput;\n};\n\nexport type MutationUpdateMemberRoleArgs = {\n  input: UpdateMemberRoleInput;\n};\n\nexport type MutationUpdatePasswordArgs = {\n  input: UpdatePasswordInput;\n};\n\nexport type MutationUpdateProfileArgs = {\n  input: UpdateProfileInput;\n};\n\nexport type MutationUpdateRoleArgs = {\n  input: UpdateRoleInput;\n};\n\nexport type MutationUpdateSsoConnectionArgs = {\n  input: UpdateSsoConnectionInput;\n};\n\nexport type MutationVerifyCurrentEmailArgs = {\n  input: VerifyCurrentEmailInput;\n};\n\nexport type MutationVerifyTotpArgs = {\n  input: VerifyTotpInput;\n};\n\nexport type NoAuditEventsFound = {\n  __typename?: \"NoAuditEventsFound\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The user has no TOTP factors to remove. */\nexport type NoMfaFactorsEnrolled = {\n  __typename?: \"NoMfaFactorsEnrolled\";\n  _placeholder: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** There is no pending email change to confirm. */\nexport type NoPendingEmailChange = {\n  __typename?: \"NoPendingEmailChange\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** OAuth provider for a connected account. */\nexport type OAuthProvider =\n  | \"AppleOAuth\"\n  | \"BitbucketOAuth\"\n  | \"DiscordOAuth\"\n  | \"GitLabOAuth\"\n  | \"GithubOAuth\"\n  | \"GoogleOAuth\"\n  | \"GrokOAuth\"\n  | \"IntuitOAuth\"\n  | \"LinkedInOAuth\"\n  | \"MicrosoftOAuth\"\n  | \"SalesforceOAuth\"\n  | \"SlackOAuth\"\n  | \"VercelMarketplaceOAuth\"\n  | \"VercelOAuth\"\n  | \"XOAuth\"\n  | \"XeroOAuth\";\n\n/** An organization in the current environment. */\nexport type Organization = {\n  __typename?: \"Organization\";\n  /** Whether the organization allows profiles outside the organization domains. */\n  allowProfilesOutsideOrganization: Scalars[\"Boolean\"][\"output\"];\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  name: Scalars[\"String\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** This organization is not allowed to send invites. */\nexport type OrganizationBlockedFromSendingInvites = {\n  __typename?: \"OrganizationBlockedFromSendingInvites\";\n  /** Placeholder field to allow an empty @ObjectType. */\n  _placeholder?: Maybe<Scalars[\"Boolean\"][\"output\"]>;\n};\n\n/** A domain belonging to the organization the token was issued for. */\nexport type OrganizationDomain = {\n  __typename?: \"OrganizationDomain\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  /** The fully qualified domain name. */\n  domain: Scalars[\"String\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  /** The DNS name server provider detected for the domain. */\n  nameServer: DomainVerificationNameServer;\n  organizationId: Scalars[\"ID\"][\"output\"];\n  state: OrganizationDomainState;\n  /** The subdomain portion of the domain, if any. */\n  subdomain?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** The DNS record prefix the customer must add to verify the domain. */\n  verificationPrefix?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** The DNS record value the customer must add to verify the domain. */\n  verificationToken?: Maybe<Scalars[\"String\"][\"output\"]>;\n};\n\n/** The verification state of an organization domain. */\nexport type OrganizationDomainState =\n  | \"Failed\"\n  | \"LegacyVerified\"\n  | \"Pending\"\n  | \"Verified\";\n\n/** An invitation to join the organization the token was issued for. */\nexport type OrganizationInvitation = {\n  __typename?: \"OrganizationInvitation\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  /** The email address the invitation was sent to. */\n  email: Scalars[\"String\"][\"output\"];\n  /** When the invitation expires. */\n  expiresAt: Scalars[\"DateTime\"][\"output\"];\n  /** The ID of the invitation. */\n  id: Scalars[\"ID\"][\"output\"];\n  /** Slug of the role the invitee will be granted on acceptance, if any. */\n  roleSlug?: Maybe<Scalars[\"String\"][\"output\"]>;\n  status: OrganizationInvitationStatus;\n};\n\nexport type OrganizationInvitationStatus =\n  | \"Accepted\"\n  | \"Expired\"\n  | \"Pending\"\n  | \"Revoked\";\n\n/** An organization member — a user with their membership status and assigned roles. */\nexport type OrganizationMember = {\n  __typename?: \"OrganizationMember\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  email: Scalars[\"String\"][\"output\"];\n  emailVerified: Scalars[\"Boolean\"][\"output\"];\n  firstName?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** The user ID of the member. */\n  id: Scalars[\"ID\"][\"output\"];\n  /** Timestamp of the member's most recent session activity. */\n  lastActivityAt?: Maybe<Scalars[\"DateTime\"][\"output\"]>;\n  lastName?: Maybe<Scalars[\"String\"][\"output\"]>;\n  profilePictureUrl?: Maybe<Scalars[\"String\"][\"output\"]>;\n  roles: Array<OrganizationMemberRole>;\n  status: OrganizationMemberStatus;\n};\n\n/** A paginated list of organization members. */\nexport type OrganizationMemberList = {\n  __typename?: \"OrganizationMemberList\";\n  data: Array<OrganizationMember>;\n  listMetadata: ListMetadata;\n};\n\n/** A role assigned to an organization member. */\nexport type OrganizationMemberRole = {\n  __typename?: \"OrganizationMemberRole\";\n  name: Scalars[\"String\"][\"output\"];\n  slug: Scalars[\"String\"][\"output\"];\n};\n\nexport type OrganizationMemberStatus =\n  | \"Active\"\n  | \"InviteExpired\"\n  | \"InviteRevoked\"\n  | \"Invited\"\n  | \"NoInvite\";\n\n/** Enum represents the pagination order. */\nexport type PaginationOrder = \"Asc\" | \"Desc\" | \"Normal\";\n\n/** A registered passkey (WebAuthn credential) for the authenticated user. */\nexport type Passkey = {\n  __typename?: \"Passkey\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  /** When this passkey was last used to authenticate. */\n  lastVerifiedAt?: Maybe<Scalars[\"DateTime\"][\"output\"]>;\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** The types of characters in a password. */\nexport type PasswordCharacterType =\n  | \"Lowercase\"\n  | \"Number\"\n  | \"Symbol\"\n  | \"Uppercase\";\n\n/** The password was created successfully. */\nexport type PasswordCreated = {\n  __typename?: \"PasswordCreated\";\n  success: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** The password requirements configured for the environment. Use these to describe the requirements before a password is submitted; `createPassword` and `updatePassword` enforce them. */\nexport type PasswordPolicy = {\n  __typename?: \"PasswordPolicy\";\n  /** The minimum number of characters. */\n  minimumLength: Scalars[\"Int\"][\"output\"];\n  /** The minimum zxcvbn strength score (0–4) a password must reach. */\n  minimumStrength: Scalars[\"Int\"][\"output\"];\n  /** Whether passwords found in known data breaches are rejected. */\n  rejectsBreachedPasswords: Scalars[\"Boolean\"][\"output\"];\n  /** Whether a lowercase letter is required. */\n  requiresLowercase: Scalars[\"Boolean\"][\"output\"];\n  /** Whether a number is required. */\n  requiresNumber: Scalars[\"Boolean\"][\"output\"];\n  /** Whether a special character is required. */\n  requiresSymbol: Scalars[\"Boolean\"][\"output\"];\n  /** Whether an uppercase letter is required. */\n  requiresUppercase: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** The provided password does not meet the environment password policy requirements. */\nexport type PasswordPolicyViolation = {\n  __typename?: \"PasswordPolicyViolation\";\n  /** A machine-readable error code. Matches the `code` of the first entry in `violations`. */\n  code: Scalars[\"String\"][\"output\"];\n  /** A human-readable description of the policy violation. Describes the first entry in `violations`. */\n  message: Scalars[\"String\"][\"output\"];\n  /** Every way in which the password failed the policy, so all of them can be surfaced at once. */\n  violations: Array<PasswordViolation>;\n};\n\n/** The password was updated successfully. */\nexport type PasswordUpdated = {\n  __typename?: \"PasswordUpdated\";\n  success: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** A single way in which a password failed the environment password policy. Fields other than `code` and `message` are only populated for the codes that carry them. */\nexport type PasswordViolation = {\n  __typename?: \"PasswordViolation\";\n  /** For a missing `Symbol` character type, the symbols that satisfy the requirement. */\n  allowedSymbols?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** For `password_pwned`, how many times the password appears in known data breaches. */\n  breachOccurrences?: Maybe<Scalars[\"Int\"][\"output\"]>;\n  /** For `password_missing_character_type`, the class of character that is missing. */\n  characterType?: Maybe<PasswordCharacterType>;\n  /** A machine-readable error code, e.g. `password_too_short`, `password_missing_character_type`, `password_pwned`, `password_reused`, `password_too_weak`, `password_contains_email`, `password_too_long`. */\n  code: Scalars[\"String\"][\"output\"];\n  /** For `password_too_long`, the allowed maximum length. */\n  maximumLength?: Maybe<Scalars[\"Int\"][\"output\"]>;\n  /** A human-readable description of this violation. */\n  message: Scalars[\"String\"][\"output\"];\n  /** For `password_too_short`, the required minimum length. */\n  minimumLength?: Maybe<Scalars[\"Int\"][\"output\"]>;\n  /** For `password_too_weak`, suggestions for choosing a stronger password. Empty for other codes. */\n  strengthSuggestions: Array<Scalars[\"String\"][\"output\"]>;\n  /** For `password_too_weak`, a summary of why it is weak. */\n  strengthWarning?: Maybe<Scalars[\"String\"][\"output\"]>;\n};\n\n/** A permission that can be granted to a role within the environment. */\nexport type Permission = {\n  __typename?: \"Permission\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  description?: Maybe<Scalars[\"String\"][\"output\"]>;\n  id: Scalars[\"ID\"][\"output\"];\n  name: Scalars[\"String\"][\"output\"];\n  slug: Scalars[\"String\"][\"output\"];\n  /** Whether this is a WorkOS-managed system permission that cannot be modified. */\n  system: Scalars[\"Boolean\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** The profile was updated successfully. */\nexport type ProfileUpdated = {\n  __typename?: \"ProfileUpdated\";\n  user: User;\n};\n\nexport type Query = {\n  __typename?: \"Query\";\n  auditEvent: AuditEvent;\n  auditEvents: AuditEventList;\n  /** The authentication methods the environment allows and the password policy it enforces. Requires a session token. */\n  authenticationSettings: AuthenticationSettings;\n  /** Placeholder query for the Client GraphQL API scaffold. Returns a static value and is replaced by real resolvers. */\n  clientApiStatus: Scalars[\"String\"][\"output\"];\n  /** Return a data provider by ID within the token's environment. */\n  dataProvider: DataProvider;\n  /** Return one of the authenticated user's data provider connections by ID. */\n  dataProviderConnection: DataProviderConnection;\n  /** List the authenticated user's data provider connections, including their status. */\n  dataProviderConnections: DataProviderConnectionList;\n  /** List the data providers configured in the token's environment. */\n  dataProviders: DataProviderList;\n  /** Return a Directory Sync connection by ID within the token's organization. */\n  directoryConnection: Directory;\n  /** List the Directory Sync connections for the token's organization. */\n  directoryConnections: DirectoryList;\n  /** List the groups of a Directory Sync connection. */\n  directoryGroups: DirectoryGroupList;\n  /** List the users of a Directory Sync connection. */\n  directoryUsers: DirectoryUserList;\n  /** The permissions a user effectively has in the organization the token was issued for, including permissions inherited through the user's roles. Callers may read their own effective permissions; reading another member's requires the elevated user:read grant. */\n  effectivePermissions: Array<Permission>;\n  /** The feature flags that evaluate to enabled for a user in the environment the token was issued for, including flags targeted at the token's organization. Flags absent from the list evaluate to false. Callers may evaluate their own flags; evaluating another member of the token's organization requires the elevated user:read grant. */\n  evaluatedFlags: FlagList;\n  /** Fetch a feature flag by ID from the project that owns the token's environment. */\n  flag: Flag;\n  /** Fetch a feature flag by slug from the project that owns the token's environment. */\n  flagBySlug: Flag;\n  /** List the feature flags of the project that owns the token's environment, with their state in that environment. */\n  flags: FlagList;\n  /** Returns the currently authenticated user (the subject of the token). */\n  me: User;\n  /** Returns an organization by ID within the token's environment. */\n  organization: Organization;\n  /** List the domains belonging to the organization the token was issued for. */\n  organizationDomains: Array<OrganizationDomain>;\n  /** List members of the organization the token was issued for, with their roles. */\n  organizationMemberships: OrganizationMemberList;\n  /** List organizations the authenticated user belongs to. */\n  organizations: Array<UserOrganization>;\n  /** List registered passkeys for the authenticated user. Requires a session token. */\n  passkeys: Array<Passkey>;\n  /** List the permissions defined in the environment the token was issued for. */\n  permissions: Array<Permission>;\n  /** Fetch a single role available to the organization the token was issued for. */\n  role?: Maybe<Role>;\n  /** List roles available to the organization the token was issued for, with role assignment configuration. */\n  roles: RolesResult;\n  /** List active sessions for the authenticated user. Requires a session token. */\n  sessions: Array<Session>;\n  /** Returns an SSO connection by ID, including its IdP setup status, provided it belongs to the token's organization. */\n  ssoConnection: Connection;\n  /** List the SSO connections belonging to the organization the token was issued for. */\n  ssoConnections: Array<Connection>;\n  /** Returns a user by ID, provided they are a member of the token's organization. */\n  user: User;\n};\n\nexport type QueryAuditEventArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryAuditEventsArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  filter: AuditEventFilterInput;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n};\n\nexport type QueryDataProviderArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryDataProviderConnectionArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryDataProviderConnectionsArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n};\n\nexport type QueryDataProvidersArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n};\n\nexport type QueryDirectoryConnectionArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryDirectoryConnectionsArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n  search?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n};\n\nexport type QueryDirectoryGroupsArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  directoryId: Scalars[\"ID\"][\"input\"];\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n};\n\nexport type QueryDirectoryUsersArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  directoryId: Scalars[\"ID\"][\"input\"];\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n};\n\nexport type QueryEffectivePermissionsArgs = {\n  userId: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryEvaluatedFlagsArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n  userId: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryFlagArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryFlagBySlugArgs = {\n  slug: Scalars[\"String\"][\"input\"];\n};\n\nexport type QueryFlagsArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  enabled?: InputMaybe<Scalars[\"Boolean\"][\"input\"]>;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n  search?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n};\n\nexport type QueryOrganizationArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryOrganizationMembershipsArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n  roleSlug?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  search?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n};\n\nexport type QueryRoleArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QuerySsoConnectionArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryUserArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type RemoveMemberInput = {\n  /** The user ID of the member to remove. */\n  userId: Scalars[\"ID\"][\"input\"];\n};\n\nexport type RemoveMemberResult =\n  | MemberIsManagedByDirectory\n  | MemberNotFound\n  | MemberRemoved;\n\n/** Input for removing all TOTP factors. */\nexport type RemoveMfaFactorInput = {\n  /** An elevated access token obtained by verifying the current email address. Required to prove recent re-authentication. */\n  elevatedAccessToken: Scalars[\"String\"][\"input\"];\n};\n\nexport type RemoveMfaFactorResult =\n  | ElevatedAccessTokenExpired\n  | ElevatedAccessTokenInvalid\n  | MfaFactorRemoved\n  | NoMfaFactorsEnrolled;\n\nexport type ResendInvitationInput = {\n  /** The ID of the user whose invitation should be resent. */\n  userId: Scalars[\"ID\"][\"input\"];\n};\n\n/** No invitation exists for this user in this organization. */\nexport type ResendInvitationNotFound = {\n  __typename?: \"ResendInvitationNotFound\";\n  userId: Scalars[\"ID\"][\"output\"];\n};\n\nexport type ResendInvitationResult =\n  | InvitationResent\n  | InviteeAlreadyAccepted\n  | InviteeEmailNotDeliverable\n  | ResendInvitationNotFound;\n\nexport type RevokeAllSessionsResult = AllSessionsRevoked;\n\nexport type RevokeInvitationInput = {\n  /** The ID of the user whose pending invitation should be revoked. */\n  userId: Scalars[\"ID\"][\"input\"];\n};\n\nexport type RevokeInvitationResult =\n  | InvitationNotFound\n  | InvitationNotPending\n  | InvitationRevoked;\n\n/** Input for revoking a specific session. */\nexport type RevokeSessionInput = {\n  /** The ID of the session to revoke. */\n  sessionId: Scalars[\"ID\"][\"input\"];\n};\n\nexport type RevokeSessionResult = SessionNotFound | SessionRevoked;\n\n/** A role available within the organization. */\nexport type Role = {\n  __typename?: \"Role\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  description?: Maybe<Scalars[\"String\"][\"output\"]>;\n  id: Scalars[\"ID\"][\"output\"];\n  /** Whether this is the default role assigned to new members. */\n  isDefault: Scalars[\"Boolean\"][\"output\"];\n  name: Scalars[\"String\"][\"output\"];\n  slug: Scalars[\"String\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** Confirms that a role has been scheduled for deletion. */\nexport type RoleDeleted = {\n  __typename?: \"RoleDeleted\";\n  /** The ID of the deleted role. */\n  id: Scalars[\"ID\"][\"output\"];\n};\n\n/** No active roles with the given slugs exist in the environment. */\nexport type RoleNotFound = {\n  __typename?: \"RoleNotFound\";\n  /** The role slugs that did not resolve to active roles. */\n  roleSlugs: Array<Scalars[\"String\"][\"output\"]>;\n};\n\n/** Roles available in the organization along with role assignment configuration. */\nexport type RolesResult = {\n  __typename?: \"RolesResult\";\n  /** Whether members can be assigned multiple roles simultaneously. */\n  multipleRolesEnabled: Scalars[\"Boolean\"][\"output\"];\n  roles: Array<Role>;\n};\n\n/** Input for requesting an email change verification code. */\nexport type SendEmailChangeInput = {\n  /** The elevated access token from a successful `verifyCurrentEmail` call. */\n  elevatedAccessToken: Scalars[\"String\"][\"input\"];\n  /** The new email address to change to. */\n  newEmail: Scalars[\"String\"][\"input\"];\n};\n\nexport type SendEmailChangeResult =\n  | DailyEmailQuotaExceeded\n  | EmailChangeNotAvailable\n  | EmailChangeSent\n  | EmailManagedByProvider\n  | EmailNotAvailable\n  | IdentityVerificationExpired\n  | IdentityVerificationInvalid\n  | InvalidEmail;\n\nexport type SendVerificationCodeResult =\n  | DailyEmailQuotaExceeded\n  | VerificationCodeSent;\n\n/** An active user session. */\nexport type Session = {\n  __typename?: \"Session\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  currentLocation?: Maybe<SessionLocation>;\n  id: Scalars[\"ID\"][\"output\"];\n  ipAddress?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** Whether this session is the one making the request. */\n  isCurrent: Scalars[\"Boolean\"][\"output\"];\n  lastActivityAt?: Maybe<Scalars[\"DateTime\"][\"output\"]>;\n  organizationId?: Maybe<Scalars[\"String\"][\"output\"]>;\n  state: SessionState;\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n  userAgent?: Maybe<Scalars[\"String\"][\"output\"]>;\n};\n\n/** Approximate geographic location derived from the session IP. */\nexport type SessionLocation = {\n  __typename?: \"SessionLocation\";\n  cityName: Scalars[\"String\"][\"output\"];\n  countryISOCode: Scalars[\"String\"][\"output\"];\n};\n\n/** No session was found with the given ID. */\nexport type SessionNotFound = {\n  __typename?: \"SessionNotFound\";\n  /** The session ID that did not resolve to a session. */\n  sessionId: Scalars[\"ID\"][\"output\"];\n};\n\n/** The session was revoked successfully. */\nexport type SessionRevoked = {\n  __typename?: \"SessionRevoked\";\n  session: Session;\n};\n\n/** The lifecycle state of a session. */\nexport type SessionState = {\n  __typename?: \"SessionState\";\n  expiresAt?: Maybe<Scalars[\"DateTime\"][\"output\"]>;\n  /** Session state: Issued, Revoked, etc. */\n  tag: Scalars[\"String\"][\"output\"];\n};\n\n/** The user already has a verified TOTP factor enrolled. */\nexport type TotpAlreadyEnrolled = {\n  __typename?: \"TotpAlreadyEnrolled\";\n  _placeholder: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** TOTP factor details returned after enrollment. */\nexport type TotpFactor = {\n  __typename?: \"TotpFactor\";\n  /** The authentication challenge ID. */\n  authenticationChallengeId: Scalars[\"String\"][\"output\"];\n  /** The authentication factor ID. */\n  authenticationFactorId: Scalars[\"String\"][\"output\"];\n  /** A data-URI PNG of the QR code. */\n  qrCode: Scalars[\"String\"][\"output\"];\n  /** The TOTP secret for manual entry. */\n  secret: Scalars[\"String\"][\"output\"];\n  /** The TOTP URI for provisioning (otpauth://…). */\n  uri: Scalars[\"String\"][\"output\"];\n};\n\n/** The TOTP verification code was invalid. */\nexport type TotpVerificationFailed = {\n  __typename?: \"TotpVerificationFailed\";\n  _placeholder: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** The TOTP verification succeeded and the factor is active. */\nexport type TotpVerified = {\n  __typename?: \"TotpVerified\";\n  success: Scalars[\"Boolean\"][\"output\"];\n};\n\nexport type UpdateMemberRoleInput = {\n  /** Slugs of the roles to assign. When multiple roles are enabled for the environment, all provided roles are assigned; otherwise only the first slug is used. */\n  roleSlugs: Array<Scalars[\"String\"][\"input\"]>;\n  /** The user ID of the member to update. */\n  userId: Scalars[\"ID\"][\"input\"];\n};\n\nexport type UpdateMemberRoleResult =\n  | MemberNotFound\n  | MemberRoleUpdated\n  | RoleNotFound;\n\n/** Input for changing an existing password. Requires the current password for verification. */\nexport type UpdatePasswordInput = {\n  /** The current password for verification. */\n  currentPassword: Scalars[\"String\"][\"input\"];\n  /** The new password. Must satisfy the environment password policy. */\n  newPassword: Scalars[\"String\"][\"input\"];\n};\n\nexport type UpdatePasswordResult =\n  | IncorrectPassword\n  | PasswordPolicyViolation\n  | PasswordUpdated;\n\n/** Input for updating the authenticated user's profile. */\nexport type UpdateProfileInput = {\n  /** The user's first name. Pass an empty string to clear. */\n  firstName?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  /** The user's last name. Pass an empty string to clear. */\n  lastName?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  /** The user's locale as a BCP 47 language tag (e.g. 'en-US'). Pass an empty string to clear. */\n  locale?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n};\n\nexport type UpdateProfileResult = InvalidLocale | ProfileUpdated;\n\nexport type UpdateRoleInput = {\n  /** Human-readable description of the role. This is a full replace of the role, so an omitted or null description clears it — resupply the current value to preserve it. */\n  description?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  /** The ID of the role to update. */\n  id: Scalars[\"ID\"][\"input\"];\n  /** Human-readable name for the role. */\n  name: Scalars[\"String\"][\"input\"];\n  /** Slugs of the permissions granted to the role. Replaces the existing set when provided. */\n  permissions?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n};\n\nexport type UpdateSsoConnectionInput = {\n  id: Scalars[\"ID\"][\"input\"];\n  /** A new human-readable name for the connection. */\n  name?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n};\n\n/** A user in the current environment. */\nexport type User = {\n  __typename?: \"User\";\n  connectedAccounts: Array<ConnectedAccount>;\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  email: Scalars[\"String\"][\"output\"];\n  emailVerified: Scalars[\"Boolean\"][\"output\"];\n  firstName?: Maybe<Scalars[\"String\"][\"output\"]>;\n  id: Scalars[\"ID\"][\"output\"];\n  lastName?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** Whether multi-factor authentication (TOTP) is set up for this user. Always `false` when the environment has MFA turned off — use `authenticationSettings.mfaEnabled` to tell the two apart. Only populated on `me`. */\n  mfaEnabled: Scalars[\"Boolean\"][\"output\"];\n  /** When MFA was last used to authenticate. Only populated on `me`. */\n  mfaLastUsedAt?: Maybe<Scalars[\"DateTime\"][\"output\"]>;\n  /** When a password was last used to authenticate. Only populated on `me`. */\n  passwordLastUsedAt?: Maybe<Scalars[\"DateTime\"][\"output\"]>;\n  /** Whether this user has a password set. Reflects the user regardless of whether the environment allows password authentication; use `authenticationSettings.passwordAuthEnabled` for that. Only populated on `me`. */\n  passwordSet: Scalars[\"Boolean\"][\"output\"];\n  profilePictureUrl?: Maybe<Scalars[\"String\"][\"output\"]>;\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** The user already has a password set. */\nexport type UserAlreadyHasPassword = {\n  __typename?: \"UserAlreadyHasPassword\";\n  _placeholder: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** The invitation was created and the email sent. */\nexport type UserInvited = {\n  __typename?: \"UserInvited\";\n  invitation: OrganizationInvitation;\n};\n\n/** An organization the authenticated user belongs to, with a flag indicating whether it is the token's current organization. */\nexport type UserOrganization = {\n  __typename?: \"UserOrganization\";\n  id: Scalars[\"ID\"][\"output\"];\n  /** Whether this is the organization the token is currently scoped to. */\n  isCurrent: Scalars[\"Boolean\"][\"output\"];\n  name: Scalars[\"String\"][\"output\"];\n};\n\n/** The verification code has expired. */\nexport type VerificationCodeExpired = {\n  __typename?: \"VerificationCodeExpired\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The verification code is incorrect. */\nexport type VerificationCodeIncorrect = {\n  __typename?: \"VerificationCodeIncorrect\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The verification code has already been used. */\nexport type VerificationCodePreviouslyUsed = {\n  __typename?: \"VerificationCodePreviouslyUsed\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** A verification code was sent to the current email address for identity verification. */\nexport type VerificationCodeSent = {\n  __typename?: \"VerificationCodeSent\";\n  /** The authentication challenge ID to use in subsequent steps. */\n  authenticationChallengeId: Scalars[\"ID\"][\"output\"];\n  /** When the verification code expires. */\n  expiresAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** Too many verification code attempts. */\nexport type VerificationTooManyAttempts = {\n  __typename?: \"VerificationTooManyAttempts\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** Input for verifying the current email address. */\nexport type VerifyCurrentEmailInput = {\n  /** The authentication challenge ID returned from `sendVerificationCode`. */\n  authenticationChallengeId: Scalars[\"ID\"][\"input\"];\n  /** The verification code sent to the current email address. */\n  code: Scalars[\"String\"][\"input\"];\n};\n\nexport type VerifyCurrentEmailResult =\n  | CurrentEmailVerified\n  | VerificationCodeExpired\n  | VerificationCodeIncorrect\n  | VerificationCodePreviouslyUsed\n  | VerificationTooManyAttempts;\n\n/** Input for verifying a TOTP enrollment. */\nexport type VerifyTotpInput = {\n  /** The authentication challenge ID from enrollTotp. */\n  authenticationChallengeId: Scalars[\"String\"][\"input\"];\n  /** The TOTP code from the authenticator app. */\n  code: Scalars[\"String\"][\"input\"];\n  /** An elevated access token obtained by verifying the current email address. Required to prove recent re-authentication. */\n  elevatedAccessToken: Scalars[\"String\"][\"input\"];\n};\n\nexport type VerifyTotpResult =\n  | ElevatedAccessTokenExpired\n  | ElevatedAccessTokenInvalid\n  | TotpVerificationFailed\n  | TotpVerified;\n\nexport type ClientApiStatusQueryVariables = Exact<{ [key: string]: never }>;\n\nexport type ClientApiStatusQuery = {\n  __typename?: \"Query\";\n  clientApiStatus: string;\n};\n\nexport const ClientApiStatusDocument = `\n    query ClientApiStatus {\n  clientApiStatus\n}\n    `;\n\nexport type SdkFunctionWrapper = <T>(\n  action: (requestHeaders?: Record<string, string>) => Promise<T>,\n  operationName: string,\n  operationType?: string,\n  variables?: any,\n) => Promise<T>;\n\nconst defaultWrapper: SdkFunctionWrapper = (\n  action,\n  _operationName,\n  _operationType,\n  _variables,\n) => action();\n\nexport function getSdk(\n  client: GraphQLClient,\n  withWrapper: SdkFunctionWrapper = defaultWrapper,\n) {\n  return {\n    ClientApiStatus(\n      variables?: ClientApiStatusQueryVariables,\n      requestHeaders?: GraphQLClientRequestHeaders,\n      signal?: RequestInit[\"signal\"],\n    ): Promise<ClientApiStatusQuery> {\n      return withWrapper(\n        (wrappedRequestHeaders) =>\n          client.request<ClientApiStatusQuery>({\n            document: ClientApiStatusDocument,\n            variables,\n            requestHeaders: { ...requestHeaders, ...wrappedRequestHeaders },\n            signal,\n          }),\n        \"ClientApiStatus\",\n        \"query\",\n        variables,\n      );\n    },\n  };\n}\nexport type Sdk = ReturnType<typeof getSdk>;\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAulDO,MAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAavC,MAAM,iBAAqC,CACzC,QACA,gBACA,gBACA,eACG,OAAO;AAEL,SAAS,OACd,QACA,cAAkC,gBAClC;AACA,SAAO;AAAA,IACL,gBACE,WACA,gBACA,QAC+B;AAC/B,aAAO;AAAA,QACL,CAAC,0BACC,OAAO,QAA8B;AAAA,UACnC,UAAU;AAAA,UACV;AAAA,UACA,gBAAgB,EAAE,GAAG,gBAAgB,GAAG,sBAAsB;AAAA,UAC9D;AAAA,QACF,CAAC;AAAA,QACH;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../../../src/api/client-graphql/generated.ts"],"sourcesContent":["import type { GraphQLClient, RequestOptions } from \"graphql-request\";\nexport type Maybe<T> = T | null;\nexport type InputMaybe<T> = Maybe<T>;\nexport type Exact<T extends { [key: string]: unknown }> = {\n  [K in keyof T]: T[K];\n};\nexport type MakeOptional<T, K extends keyof T> = Omit<T, K> & {\n  [SubKey in K]?: Maybe<T[SubKey]>;\n};\nexport type MakeMaybe<T, K extends keyof T> = Omit<T, K> & {\n  [SubKey in K]: Maybe<T[SubKey]>;\n};\nexport type MakeEmpty<\n  T extends { [key: string]: unknown },\n  K extends keyof T,\n> = { [_ in K]?: never };\nexport type Incremental<T> =\n  | T\n  | {\n      [P in keyof T]?: P extends \" $fragmentName\" | \"__typename\" ? T[P] : never;\n    };\ntype GraphQLClientRequestHeaders = RequestOptions[\"requestHeaders\"];\n/** All built-in and custom scalars, mapped to their actual values */\nexport type Scalars = {\n  ID: { input: string; output: string };\n  String: { input: string; output: string };\n  Boolean: { input: boolean; output: boolean };\n  Int: { input: number; output: number };\n  Float: { input: number; output: number };\n  /** A date-time string at UTC, such as 2019-12-03T09:54:33Z, compliant with the date-time format. */\n  DateTime: { input: string; output: string };\n  /** The `JSON` scalar type represents JSON values as specified by [ECMA-404](http://www.ecma-international.org/publications/files/ECMA-ST/ECMA-404.pdf). */\n  JSON: { input: any; output: any };\n};\n\n/** All other sessions were revoked successfully. */\nexport type AllSessionsRevoked = {\n  __typename?: \"AllSessionsRevoked\";\n  success: Scalars[\"Boolean\"][\"output\"];\n};\n\nexport type AssignPermissionToRoleInput = {\n  /** The slug of the permission to assign. */\n  permissionSlug: Scalars[\"String\"][\"input\"];\n  /** The ID of the role to assign the permission to. */\n  roleId: Scalars[\"ID\"][\"input\"];\n};\n\nexport type AuditEvent = {\n  __typename?: \"AuditEvent\";\n  action: Scalars[\"String\"][\"output\"];\n  actor: AuditEventActor;\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  data: Scalars[\"JSON\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  occurredAt: Scalars[\"DateTime\"][\"output\"];\n  targets: Array<Scalars[\"String\"][\"output\"]>;\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\nexport type AuditEventActor = {\n  __typename?: \"AuditEventActor\";\n  id: Scalars[\"String\"][\"output\"];\n  name?: Maybe<Scalars[\"String\"][\"output\"]>;\n  type: Scalars[\"String\"][\"output\"];\n};\n\nexport type AuditEventFilterInput = {\n  actions?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  actorIds?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  actorNames?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  rangeEnd: Scalars[\"DateTime\"][\"input\"];\n  rangeStart: Scalars[\"DateTime\"][\"input\"];\n  search?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  targetIds?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  targetTypes?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n};\n\nexport type AuditEventList = {\n  __typename?: \"AuditEventList\";\n  data: Array<AuditEvent>;\n  listMetadata: ListMetadata;\n};\n\nexport type AuditLogExport = {\n  __typename?: \"AuditLogExport\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  state: AuditLogExportState;\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n  /** A signed URL to the CSV file. Only defined once the export is ready. */\n  url?: Maybe<Scalars[\"String\"][\"output\"]>;\n};\n\nexport type AuditLogExportState = \"Error\" | \"Expired\" | \"Pending\" | \"Ready\";\n\n/** The authentication methods the environment allows, and the password policy it enforces. Distinct from what the authenticated user has set up, which lives on `me`. */\nexport type AuthenticationSettings = {\n  __typename?: \"AuthenticationSettings\";\n  /** Whether multi-factor authentication is available in this environment. When `false`, TOTP enrollment should not be offered. */\n  mfaEnabled: Scalars[\"Boolean\"][\"output\"];\n  /** Whether multi-factor authentication is mandatory for every user in this environment. */\n  mfaRequired: Scalars[\"Boolean\"][\"output\"];\n  /** Whether users may authenticate with a passkey. */\n  passkeyAuthEnabled: Scalars[\"Boolean\"][\"output\"];\n  /** Whether users may authenticate with a password. When `false`, `createPassword` and `updatePassword` should not be offered. */\n  passwordAuthEnabled: Scalars[\"Boolean\"][\"output\"];\n  passwordPolicy: PasswordPolicy;\n};\n\n/** Input for confirming an email change with the verification code. */\nexport type ConfirmEmailChangeInput = {\n  /** The verification code sent to the new email address. */\n  code: Scalars[\"String\"][\"input\"];\n  /** The elevated access token from a successful `verifyCurrentEmail` call. */\n  elevatedAccessToken: Scalars[\"String\"][\"input\"];\n};\n\nexport type ConfirmEmailChangeResult =\n  | EmailChangeCodeExpired\n  | EmailChangeCodeIncorrect\n  | EmailChangeCodePreviouslyUsed\n  | EmailChangeConfirmed\n  | EmailChangeTooManyAttempts\n  | EmailManagedByProvider\n  | EmailNotAvailable\n  | IdentityVerificationExpired\n  | IdentityVerificationInvalid\n  | InvalidEmail\n  | NoPendingEmailChange;\n\n/** An OAuth profile linked to the authenticated user. */\nexport type ConnectedAccount = {\n  __typename?: \"ConnectedAccount\";\n  email?: Maybe<Scalars[\"String\"][\"output\"]>;\n  firstName?: Maybe<Scalars[\"String\"][\"output\"]>;\n  id: Scalars[\"ID\"][\"output\"];\n  lastLoginAt?: Maybe<Scalars[\"DateTime\"][\"output\"]>;\n  lastName?: Maybe<Scalars[\"String\"][\"output\"]>;\n  profilePictureUrl?: Maybe<Scalars[\"String\"][\"output\"]>;\n  provider: OAuthProvider;\n};\n\n/** An SSO connection belonging to the organization. Mirrors the SSO Connection exposed by the REST connections API. */\nexport type Connection = {\n  __typename?: \"Connection\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  /** A human-readable name for the connection. */\n  name: Scalars[\"String\"][\"output\"];\n  /** The organization the connection belongs to. */\n  organizationId?: Maybe<Scalars[\"ID\"][\"output\"]>;\n  /** Whether the connection has completed its IdP setup and can authenticate users (equivalent to an `Active` state). */\n  setupComplete: Scalars[\"Boolean\"][\"output\"];\n  /** The connection's IdP setup status. `Active` indicates setup is complete; other states indicate where the connection is in its setup flow. */\n  state: ConnectionState;\n  /** The identity provider type of the connection. */\n  type: ConnectionType;\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** Enum represents the state of the connection. */\nexport type ConnectionState = \"Active\" | \"Deleting\" | \"Inactive\" | \"Validating\";\n\n/** Enum represents the type of connection. */\nexport type ConnectionType =\n  | \"ADFSSAML\"\n  | \"AdpOidc\"\n  | \"AppleOAuth\"\n  | \"Auth0Migration\"\n  | \"Auth0SAML\"\n  | \"AzureSAML\"\n  | \"BitbucketOAuth\"\n  | \"CasSAML\"\n  | \"ClassLinkSAML\"\n  | \"CleverOIDC\"\n  | \"CloudflareSAML\"\n  | \"CyberArkSAML\"\n  | \"DiscordOAuth\"\n  | \"DuoSAML\"\n  | \"EntraIdOIDC\"\n  | \"GenericOIDC\"\n  | \"GenericSAML\"\n  | \"GitLabOAuth\"\n  | \"GithubOAuth\"\n  | \"GoogleOAuth\"\n  | \"GoogleOIDC\"\n  | \"GoogleSAML\"\n  | \"GrokOAuth\"\n  | \"IntuitOAuth\"\n  | \"JumpCloudSAML\"\n  | \"KeycloakSAML\"\n  | \"LastPassSAML\"\n  | \"LinkedInOAuth\"\n  | \"LoginGovOidc\"\n  | \"MagicLink\"\n  | \"MicrosoftOAuth\"\n  | \"MiniOrangeSAML\"\n  | \"NetIqSAML\"\n  | \"OktaOIDC\"\n  | \"OktaSAML\"\n  | \"OneLoginSAML\"\n  | \"OracleSAML\"\n  | \"PingFederateSAML\"\n  | \"PingOneSAML\"\n  | \"RipplingSAML\"\n  | \"SalesforceOAuth\"\n  | \"SalesforceSAML\"\n  | \"ShibbolethGenericSAML\"\n  | \"ShibbolethSAML\"\n  | \"SimpleSamlPhpSAML\"\n  | \"SlackOAuth\"\n  | \"TestIdp\"\n  | \"VMwareSAML\"\n  | \"VercelMarketplaceOAuth\"\n  | \"VercelOAuth\"\n  | \"XOAuth\"\n  | \"XeroOAuth\";\n\nexport type CreateAuditLogExportInput = {\n  actions?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  actorIds?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  actorNames?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  rangeEnd: Scalars[\"DateTime\"][\"input\"];\n  rangeStart: Scalars[\"DateTime\"][\"input\"];\n  targetIds?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  targetTypes?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n};\n\nexport type CreateAuditLogExportResult =\n  | AuditLogExport\n  | InvalidAuditLogExportDateRange\n  | NoAuditEventsFound;\n\n/** Input for setting a password on an account that does not yet have one (e.g. signed up via OAuth). */\nexport type CreatePasswordInput = {\n  /** An elevated access token obtained by verifying the current email address. Required to prove recent re-authentication. */\n  elevatedAccessToken: Scalars[\"String\"][\"input\"];\n  /** The password to set. Must satisfy the environment password policy. */\n  password: Scalars[\"String\"][\"input\"];\n};\n\nexport type CreatePasswordResult =\n  | ElevatedAccessTokenExpired\n  | ElevatedAccessTokenInvalid\n  | PasswordCreated\n  | PasswordPolicyViolation\n  | UserAlreadyHasPassword;\n\nexport type CreateRoleInput = {\n  /** Optional human-readable description of the role. */\n  description?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  /** Human-readable name for the role. */\n  name: Scalars[\"String\"][\"input\"];\n  /** Slugs of the permissions granted to the role. */\n  permissions?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  /** Unique slug identifying the role. Generated from the name when omitted. */\n  slug?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n};\n\nexport type CreateSsoConnectionInput = {\n  /** A human-readable name for the connection. Defaults to the organization's name. */\n  name?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  /** The identity provider type of the connection to create. */\n  type: ConnectionType;\n};\n\n/** The current email was verified successfully. */\nexport type CurrentEmailVerified = {\n  __typename?: \"CurrentEmailVerified\";\n  /** The elevated access token to pass to `sendEmailChange` and `confirmEmailChange`. */\n  elevatedAccessToken: Scalars[\"String\"][\"output\"];\n  /** When the elevated access token expires (ISO 8601). */\n  expiresAt: Scalars[\"String\"][\"output\"];\n};\n\n/** Daily verification email quota exceeded. */\nexport type DailyEmailQuotaExceeded = {\n  __typename?: \"DailyEmailQuotaExceeded\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** A third-party data provider configured for the current environment. */\nexport type DataProvider = {\n  __typename?: \"DataProvider\";\n  /** How accounts authenticate with this data provider. */\n  authMethods: Array<Scalars[\"String\"][\"output\"]>;\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  description?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** Whether the data provider is enabled in the environment. */\n  enabled: Scalars[\"Boolean\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  /** The provider type this data provider was created from. */\n  integrationType: Scalars[\"String\"][\"output\"];\n  /** The display name of the data provider. */\n  name: Scalars[\"String\"][\"output\"];\n  /** The OAuth scopes configured for the data provider. `null` when the provider's default scopes are used. */\n  scopes?: Maybe<Array<Scalars[\"String\"][\"output\"]>>;\n  /** The slug of the data provider. */\n  slug: Scalars[\"String\"][\"output\"];\n  /** The configuration state of the data provider: `valid`, `invalid`, or `requested`. */\n  state: Scalars[\"String\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** A connection between a data provider and the authenticated user's account. */\nexport type DataProviderConnection = {\n  __typename?: \"DataProviderConnection\";\n  /** How the connection authenticates: `oauth`, `api_key`, or `client_credentials`. */\n  authMethod: Scalars[\"String\"][\"output\"];\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  /** The data provider this connection was created for. */\n  dataProviderId: Scalars[\"ID\"][\"output\"];\n  /** The slug of the connected data provider. */\n  dataProviderSlug: Scalars[\"String\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  organizationId?: Maybe<Scalars[\"ID\"][\"output\"]>;\n  /** The OAuth scopes granted for this connection. */\n  scopes: Array<Scalars[\"String\"][\"output\"]>;\n  /** The status of the connection: `connected` or `needs_reauthorization`. */\n  state: Scalars[\"String\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n  userId?: Maybe<Scalars[\"ID\"][\"output\"]>;\n};\n\nexport type DataProviderConnectionList = {\n  __typename?: \"DataProviderConnectionList\";\n  data: Array<DataProviderConnection>;\n  listMetadata: ListMetadata;\n};\n\nexport type DataProviderList = {\n  __typename?: \"DataProviderList\";\n  data: Array<DataProvider>;\n  listMetadata: ListMetadata;\n};\n\nexport type DeleteRoleInput = {\n  /** The ID of the role to delete. */\n  id: Scalars[\"ID\"][\"input\"];\n};\n\n/** A Directory Sync connection within the current environment. */\nexport type Directory = {\n  __typename?: \"Directory\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  externalKey: Scalars[\"String\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  name: Scalars[\"String\"][\"output\"];\n  organizationId: Scalars[\"ID\"][\"output\"];\n  /** The linking state of the directory. */\n  state: Scalars[\"String\"][\"output\"];\n  /** The provider type of the directory. */\n  type: Scalars[\"String\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** A group provisioned through a Directory Sync connection. */\nexport type DirectoryGroup = {\n  __typename?: \"DirectoryGroup\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  directoryId: Scalars[\"ID\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  /** The identifier of the group in the identity provider. */\n  idpId: Scalars[\"String\"][\"output\"];\n  name: Scalars[\"String\"][\"output\"];\n  organizationId: Scalars[\"ID\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\nexport type DirectoryGroupList = {\n  __typename?: \"DirectoryGroupList\";\n  data: Array<DirectoryGroup>;\n  listMetadata: ListMetadata;\n};\n\nexport type DirectoryList = {\n  __typename?: \"DirectoryList\";\n  data: Array<Directory>;\n  listMetadata: ListMetadata;\n};\n\n/** A user provisioned through a Directory Sync connection. */\nexport type DirectoryUser = {\n  __typename?: \"DirectoryUser\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  directoryId: Scalars[\"ID\"][\"output\"];\n  email?: Maybe<Scalars[\"String\"][\"output\"]>;\n  firstName?: Maybe<Scalars[\"String\"][\"output\"]>;\n  id: Scalars[\"ID\"][\"output\"];\n  /** The identifier of the user in the identity provider. */\n  idpId: Scalars[\"String\"][\"output\"];\n  lastName?: Maybe<Scalars[\"String\"][\"output\"]>;\n  organizationId: Scalars[\"ID\"][\"output\"];\n  /** The provisioning state of the directory user. */\n  state: Scalars[\"String\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n  username?: Maybe<Scalars[\"String\"][\"output\"]>;\n};\n\nexport type DirectoryUserList = {\n  __typename?: \"DirectoryUserList\";\n  data: Array<DirectoryUser>;\n  listMetadata: ListMetadata;\n};\n\n/** The DNS name server provider detected for a domain. */\nexport type DomainVerificationNameServer =\n  | \"AwsRoute53\"\n  | \"CloudFlare\"\n  | \"GoDaddy\"\n  | \"GoogleDomains\"\n  | \"Other\";\n\n/** The elevated access token has expired. The user must re-verify their identity. */\nexport type ElevatedAccessTokenExpired = {\n  __typename?: \"ElevatedAccessTokenExpired\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The elevated access token is invalid. */\nexport type ElevatedAccessTokenInvalid = {\n  __typename?: \"ElevatedAccessTokenInvalid\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The verification code has expired. */\nexport type EmailChangeCodeExpired = {\n  __typename?: \"EmailChangeCodeExpired\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The verification code is incorrect. */\nexport type EmailChangeCodeIncorrect = {\n  __typename?: \"EmailChangeCodeIncorrect\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The verification code has already been used. */\nexport type EmailChangeCodePreviouslyUsed = {\n  __typename?: \"EmailChangeCodePreviouslyUsed\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The email was changed successfully. */\nexport type EmailChangeConfirmed = {\n  __typename?: \"EmailChangeConfirmed\";\n  /** A fresh elevated access token for subsequent elevated operations. */\n  elevatedAccessToken: Scalars[\"String\"][\"output\"];\n  /** When the elevated access token expires (ISO 8601). */\n  expiresAt: Scalars[\"String\"][\"output\"];\n  user: User;\n};\n\n/** Email change is not available for this account. */\nexport type EmailChangeNotAvailable = {\n  __typename?: \"EmailChangeNotAvailable\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** A verification code was sent to the new email address. */\nexport type EmailChangeSent = {\n  __typename?: \"EmailChangeSent\";\n  /** When the verification code expires. */\n  expiresAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** Too many verification attempts. */\nexport type EmailChangeTooManyAttempts = {\n  __typename?: \"EmailChangeTooManyAttempts\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The email is managed by an identity provider and cannot be changed. */\nexport type EmailManagedByProvider = {\n  __typename?: \"EmailManagedByProvider\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The email address is not available. */\nexport type EmailNotAvailable = {\n  __typename?: \"EmailNotAvailable\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** Input for enrolling a new TOTP factor. */\nexport type EnrollTotpInput = {\n  /** An elevated access token obtained by verifying the current email address. Required to prove recent re-authentication. */\n  elevatedAccessToken: Scalars[\"String\"][\"input\"];\n};\n\nexport type EnrollTotpResult =\n  | ElevatedAccessTokenExpired\n  | ElevatedAccessTokenInvalid\n  | TotpAlreadyEnrolled\n  | TotpFactor;\n\n/** A feature flag defined in the project that owns the environment the token was issued for. Mirrors the Feature Flag exposed by the REST feature flags API. */\nexport type Flag = {\n  __typename?: \"Flag\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  /** The value returned for users and organizations that do not match any targeting rule in the environment the token was issued for. */\n  defaultValue: Scalars[\"Boolean\"][\"output\"];\n  description?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** Whether the feature flag is active in the environment the token was issued for. */\n  enabled: Scalars[\"Boolean\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  /** A descriptive name for the feature flag. */\n  name: Scalars[\"String\"][\"output\"];\n  /** A unique key used to reference the feature flag. */\n  slug: Scalars[\"String\"][\"output\"];\n  /** Labels assigned to the feature flag. */\n  tags: Array<Scalars[\"String\"][\"output\"]>;\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\nexport type FlagList = {\n  __typename?: \"FlagList\";\n  data: Array<Flag>;\n  listMetadata: ListMetadata;\n};\n\n/** The identity verification has expired. Please verify your current email again. */\nexport type IdentityVerificationExpired = {\n  __typename?: \"IdentityVerificationExpired\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The identity verification is no longer valid. */\nexport type IdentityVerificationInvalid = {\n  __typename?: \"IdentityVerificationInvalid\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The provided current password does not match the existing password. */\nexport type IncorrectPassword = {\n  __typename?: \"IncorrectPassword\";\n  _placeholder: Scalars[\"Boolean\"][\"output\"];\n};\n\nexport type InvalidAuditLogExportDateRange = {\n  __typename?: \"InvalidAuditLogExportDateRange\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The provided email address is invalid. */\nexport type InvalidEmail = {\n  __typename?: \"InvalidEmail\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The requested invitation expiry is outside the allowed range (1–30 days). */\nexport type InvalidInvitationExpiry = {\n  __typename?: \"InvalidInvitationExpiry\";\n  /** Placeholder field to allow an empty @ObjectType. */\n  _placeholder?: Maybe<Scalars[\"Boolean\"][\"output\"]>;\n};\n\n/** The provided email address is not valid. */\nexport type InvalidInviteeEmail = {\n  __typename?: \"InvalidInviteeEmail\";\n  email: Scalars[\"String\"][\"output\"];\n};\n\n/** The requested role is not valid for this organization. */\nexport type InvalidInviteeRole = {\n  __typename?: \"InvalidInviteeRole\";\n  roleSlug?: Maybe<Scalars[\"String\"][\"output\"]>;\n};\n\n/** The provided locale is not a valid BCP 47 tag. */\nexport type InvalidLocale = {\n  __typename?: \"InvalidLocale\";\n  _placeholder: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** No pending invitation exists for this user in this organization. */\nexport type InvitationNotFound = {\n  __typename?: \"InvitationNotFound\";\n  userId: Scalars[\"ID\"][\"output\"];\n};\n\n/** The invitation is not pending (already accepted, expired, or revoked) and cannot be revoked. */\nexport type InvitationNotPending = {\n  __typename?: \"InvitationNotPending\";\n  userId: Scalars[\"ID\"][\"output\"];\n};\n\n/** The invitation was resent successfully. */\nexport type InvitationResent = {\n  __typename?: \"InvitationResent\";\n  invitation: OrganizationInvitation;\n};\n\n/** The invitation was revoked. */\nexport type InvitationRevoked = {\n  __typename?: \"InvitationRevoked\";\n  invitation: OrganizationInvitation;\n};\n\nexport type InviteUserInput = {\n  /** The email address to invite. */\n  email: Scalars[\"String\"][\"input\"];\n  /** Number of days until the invitation expires. Defaults to the environment setting when omitted. */\n  expiresInDays?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  /** Slug of the role to grant on acceptance. Defaults to the organization default role when omitted. */\n  roleSlug?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n};\n\nexport type InviteUserResult =\n  | InvalidInvitationExpiry\n  | InvalidInviteeEmail\n  | InvalidInviteeRole\n  | InviteeAlreadyInvited\n  | InviteeAlreadyMember\n  | InviteeEmailNotDeliverable\n  | OrganizationBlockedFromSendingInvites\n  | UserInvited;\n\n/** The user has already accepted their invitation and is an active member. */\nexport type InviteeAlreadyAccepted = {\n  __typename?: \"InviteeAlreadyAccepted\";\n  userId: Scalars[\"ID\"][\"output\"];\n};\n\n/** This email already has a pending invitation. */\nexport type InviteeAlreadyInvited = {\n  __typename?: \"InviteeAlreadyInvited\";\n  email: Scalars[\"String\"][\"output\"];\n};\n\n/** A user with this email is already a member of the organization. */\nexport type InviteeAlreadyMember = {\n  __typename?: \"InviteeAlreadyMember\";\n  email: Scalars[\"String\"][\"output\"];\n};\n\n/** The invitee's email domain has no mail servers, so the invitation email cannot be delivered. */\nexport type InviteeEmailNotDeliverable = {\n  __typename?: \"InviteeEmailNotDeliverable\";\n  email: Scalars[\"String\"][\"output\"];\n};\n\nexport type ListMetadata = {\n  __typename?: \"ListMetadata\";\n  after?: Maybe<Scalars[\"String\"][\"output\"]>;\n  before?: Maybe<Scalars[\"String\"][\"output\"]>;\n};\n\n/** The member is provisioned by a directory and cannot be removed. */\nexport type MemberIsManagedByDirectory = {\n  __typename?: \"MemberIsManagedByDirectory\";\n  /** The user ID of the directory-managed member. */\n  userId: Scalars[\"ID\"][\"output\"];\n};\n\n/** No active member was found for the given user in the organization. */\nexport type MemberNotFound = {\n  __typename?: \"MemberNotFound\";\n  /** The user ID that did not resolve to a member. */\n  userId: Scalars[\"ID\"][\"output\"];\n};\n\n/** The member was removed from the organization. */\nexport type MemberRemoved = {\n  __typename?: \"MemberRemoved\";\n  /** The user ID of the removed member. */\n  userId: Scalars[\"ID\"][\"output\"];\n};\n\n/** The member's role was updated. */\nexport type MemberRoleUpdated = {\n  __typename?: \"MemberRoleUpdated\";\n  member: OrganizationMember;\n};\n\n/** All TOTP factors were removed successfully. */\nexport type MfaFactorRemoved = {\n  __typename?: \"MfaFactorRemoved\";\n  success: Scalars[\"Boolean\"][\"output\"];\n};\n\nexport type Mutation = {\n  __typename?: \"Mutation\";\n  /** Grant a permission to a role belonging to the organization the token was issued for. */\n  assignPermissionToRole: Role;\n  /** Confirms an email change using the verification code sent to the new email address. Requires an elevated access token from `verifyCurrentEmail`. */\n  confirmEmailChange: ConfirmEmailChangeResult;\n  createAuditLogExport: CreateAuditLogExportResult;\n  /** Add a domain to the token's organization and begin DNS verification. */\n  createOrganizationDomain: OrganizationDomain;\n  /** Set a password for the authenticated user who does not yet have one (e.g. signed up via OAuth). Validates against the environment password policy. */\n  createPassword: CreatePasswordResult;\n  /** Create a role for the organization the token was issued for. */\n  createRole: Role;\n  /** Create an SSO connection for the token’s organization. */\n  createSsoConnection: Connection;\n  /** Delete a domain belonging to the token's organization and return it. */\n  deleteOrganizationDomain: OrganizationDomain;\n  /** Delete a role belonging to the organization the token was issued for. */\n  deleteRole: RoleDeleted;\n  /** Delete an SSO connection belonging to the token’s organization. */\n  deleteSsoConnection: Scalars[\"ID\"][\"output\"];\n  /** Create a TOTP factor and return the secret and QR URI for the user to scan. This is step 1 of TOTP enrollment. */\n  enrollTotp: EnrollTotpResult;\n  /** Invite a user to the organization the token was issued for, assigning a role and sending the invitation email. */\n  inviteUser: InviteUserResult;\n  /** Remove a member from the organization the token was issued for. */\n  removeMember: RemoveMemberResult;\n  /** Delete all TOTP factors for the authenticated user, effectively resetting MFA. */\n  removeMfaFactor: RemoveMfaFactorResult;\n  /** Resend a pending, expired, or revoked invitation for the organization the token was issued for. If the original invitation has expired or been revoked, a new invitation is created with the same role. */\n  resendInvitation: ResendInvitationResult;\n  /** Restart verification for a domain belonging to the token's organization. */\n  reverifyOrganizationDomain: OrganizationDomain;\n  /** Revokes all active sessions for the authenticated user except the current one. */\n  revokeAllSessions: RevokeAllSessionsResult;\n  /** Revoke a pending invitation for the organization the token was issued for. */\n  revokeInvitation: RevokeInvitationResult;\n  /** Revokes a specific session by ID. */\n  revokeSession: RevokeSessionResult;\n  /** Sends a verification code to the new email address. Requires an elevated access token from `verifyCurrentEmail`. The user must confirm with the code via `confirmEmailChange`. */\n  sendEmailChange: SendEmailChangeResult;\n  /** Sends a verification code to the user's current email address to prove ownership before changing email. */\n  sendVerificationCode: SendVerificationCodeResult;\n  /** Update an organization member's roles within the organization the token was issued for. When multiple roles are enabled, all provided role slugs are assigned; otherwise only the first is used. */\n  updateMemberRole: UpdateMemberRoleResult;\n  /** Change the password for the authenticated user. Requires the current password for verification and validates the new password against the environment password policy. */\n  updatePassword: UpdatePasswordResult;\n  /** Updates the authenticated user's profile (first name, last name, locale). */\n  updateProfile: UpdateProfileResult;\n  /** Update a role belonging to the organization the token was issued for. */\n  updateRole: Role;\n  /** Update an SSO connection belonging to the token’s organization. */\n  updateSsoConnection: Connection;\n  /** Verifies the code sent to the current email address. Returns an elevated access token required for `sendEmailChange` and `confirmEmailChange`. */\n  verifyCurrentEmail: VerifyCurrentEmailResult;\n  /** Confirm TOTP enrollment by verifying a code from the authenticator app. Marks the factor as verified. */\n  verifyTotp: VerifyTotpResult;\n};\n\nexport type MutationAssignPermissionToRoleArgs = {\n  input: AssignPermissionToRoleInput;\n};\n\nexport type MutationConfirmEmailChangeArgs = {\n  input: ConfirmEmailChangeInput;\n};\n\nexport type MutationCreateAuditLogExportArgs = {\n  input: CreateAuditLogExportInput;\n};\n\nexport type MutationCreateOrganizationDomainArgs = {\n  domain: Scalars[\"String\"][\"input\"];\n};\n\nexport type MutationCreatePasswordArgs = {\n  input: CreatePasswordInput;\n};\n\nexport type MutationCreateRoleArgs = {\n  input: CreateRoleInput;\n};\n\nexport type MutationCreateSsoConnectionArgs = {\n  input: CreateSsoConnectionInput;\n};\n\nexport type MutationDeleteOrganizationDomainArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type MutationDeleteRoleArgs = {\n  input: DeleteRoleInput;\n};\n\nexport type MutationDeleteSsoConnectionArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type MutationEnrollTotpArgs = {\n  input: EnrollTotpInput;\n};\n\nexport type MutationInviteUserArgs = {\n  input: InviteUserInput;\n};\n\nexport type MutationRemoveMemberArgs = {\n  input: RemoveMemberInput;\n};\n\nexport type MutationRemoveMfaFactorArgs = {\n  input: RemoveMfaFactorInput;\n};\n\nexport type MutationResendInvitationArgs = {\n  input: ResendInvitationInput;\n};\n\nexport type MutationReverifyOrganizationDomainArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type MutationRevokeInvitationArgs = {\n  input: RevokeInvitationInput;\n};\n\nexport type MutationRevokeSessionArgs = {\n  input: RevokeSessionInput;\n};\n\nexport type MutationSendEmailChangeArgs = {\n  input: SendEmailChangeInput;\n};\n\nexport type MutationUpdateMemberRoleArgs = {\n  input: UpdateMemberRoleInput;\n};\n\nexport type MutationUpdatePasswordArgs = {\n  input: UpdatePasswordInput;\n};\n\nexport type MutationUpdateProfileArgs = {\n  input: UpdateProfileInput;\n};\n\nexport type MutationUpdateRoleArgs = {\n  input: UpdateRoleInput;\n};\n\nexport type MutationUpdateSsoConnectionArgs = {\n  input: UpdateSsoConnectionInput;\n};\n\nexport type MutationVerifyCurrentEmailArgs = {\n  input: VerifyCurrentEmailInput;\n};\n\nexport type MutationVerifyTotpArgs = {\n  input: VerifyTotpInput;\n};\n\nexport type NoAuditEventsFound = {\n  __typename?: \"NoAuditEventsFound\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The user has no TOTP factors to remove. */\nexport type NoMfaFactorsEnrolled = {\n  __typename?: \"NoMfaFactorsEnrolled\";\n  _placeholder: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** There is no pending email change to confirm. */\nexport type NoPendingEmailChange = {\n  __typename?: \"NoPendingEmailChange\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** OAuth provider for a connected account. */\nexport type OAuthProvider =\n  | \"AppleOAuth\"\n  | \"BitbucketOAuth\"\n  | \"DiscordOAuth\"\n  | \"GitLabOAuth\"\n  | \"GithubOAuth\"\n  | \"GoogleOAuth\"\n  | \"GrokOAuth\"\n  | \"IntuitOAuth\"\n  | \"LinkedInOAuth\"\n  | \"MicrosoftOAuth\"\n  | \"SalesforceOAuth\"\n  | \"SlackOAuth\"\n  | \"VercelMarketplaceOAuth\"\n  | \"VercelOAuth\"\n  | \"XOAuth\"\n  | \"XeroOAuth\";\n\n/** An organization in the current environment. */\nexport type Organization = {\n  __typename?: \"Organization\";\n  /** Whether the organization allows profiles outside the organization domains. */\n  allowProfilesOutsideOrganization: Scalars[\"Boolean\"][\"output\"];\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  name: Scalars[\"String\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** This organization is not allowed to send invites. */\nexport type OrganizationBlockedFromSendingInvites = {\n  __typename?: \"OrganizationBlockedFromSendingInvites\";\n  /** Placeholder field to allow an empty @ObjectType. */\n  _placeholder?: Maybe<Scalars[\"Boolean\"][\"output\"]>;\n};\n\n/** A domain belonging to the organization the token was issued for. */\nexport type OrganizationDomain = {\n  __typename?: \"OrganizationDomain\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  /** The fully qualified domain name. */\n  domain: Scalars[\"String\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  /** The DNS name server provider detected for the domain. */\n  nameServer: DomainVerificationNameServer;\n  organizationId: Scalars[\"ID\"][\"output\"];\n  state: OrganizationDomainState;\n  /** The subdomain portion of the domain, if any. */\n  subdomain?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** The DNS record prefix the customer must add to verify the domain. */\n  verificationPrefix?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** The DNS record value the customer must add to verify the domain. */\n  verificationToken?: Maybe<Scalars[\"String\"][\"output\"]>;\n};\n\n/** The verification state of an organization domain. */\nexport type OrganizationDomainState =\n  | \"Failed\"\n  | \"LegacyVerified\"\n  | \"Pending\"\n  | \"Verified\";\n\n/** An invitation to join the organization the token was issued for. */\nexport type OrganizationInvitation = {\n  __typename?: \"OrganizationInvitation\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  /** The email address the invitation was sent to. */\n  email: Scalars[\"String\"][\"output\"];\n  /** When the invitation expires. */\n  expiresAt: Scalars[\"DateTime\"][\"output\"];\n  /** The ID of the invitation. */\n  id: Scalars[\"ID\"][\"output\"];\n  /** Slug of the role the invitee will be granted on acceptance, if any. */\n  roleSlug?: Maybe<Scalars[\"String\"][\"output\"]>;\n  status: OrganizationInvitationStatus;\n};\n\nexport type OrganizationInvitationStatus =\n  | \"Accepted\"\n  | \"Expired\"\n  | \"Pending\"\n  | \"Revoked\";\n\n/** An organization member — a user with their membership status and assigned roles. */\nexport type OrganizationMember = {\n  __typename?: \"OrganizationMember\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  email: Scalars[\"String\"][\"output\"];\n  emailVerified: Scalars[\"Boolean\"][\"output\"];\n  firstName?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** The user ID of the member. */\n  id: Scalars[\"ID\"][\"output\"];\n  /** Timestamp of the member's most recent session activity. */\n  lastActivityAt?: Maybe<Scalars[\"DateTime\"][\"output\"]>;\n  lastName?: Maybe<Scalars[\"String\"][\"output\"]>;\n  profilePictureUrl?: Maybe<Scalars[\"String\"][\"output\"]>;\n  roles: Array<OrganizationMemberRole>;\n  status: OrganizationMemberStatus;\n};\n\n/** A paginated list of organization members. */\nexport type OrganizationMemberList = {\n  __typename?: \"OrganizationMemberList\";\n  data: Array<OrganizationMember>;\n  listMetadata: ListMetadata;\n};\n\n/** A role assigned to an organization member. */\nexport type OrganizationMemberRole = {\n  __typename?: \"OrganizationMemberRole\";\n  name: Scalars[\"String\"][\"output\"];\n  slug: Scalars[\"String\"][\"output\"];\n};\n\nexport type OrganizationMemberStatus =\n  | \"Active\"\n  | \"InviteExpired\"\n  | \"InviteRevoked\"\n  | \"Invited\"\n  | \"NoInvite\";\n\n/** Enum represents the pagination order. */\nexport type PaginationOrder = \"Asc\" | \"Desc\" | \"Normal\";\n\n/** A registered passkey (WebAuthn credential) for the authenticated user. */\nexport type Passkey = {\n  __typename?: \"Passkey\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  /** When this passkey was last used to authenticate. */\n  lastVerifiedAt?: Maybe<Scalars[\"DateTime\"][\"output\"]>;\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** The types of characters in a password. */\nexport type PasswordCharacterType =\n  | \"Lowercase\"\n  | \"Number\"\n  | \"Symbol\"\n  | \"Uppercase\";\n\n/** The password was created successfully. */\nexport type PasswordCreated = {\n  __typename?: \"PasswordCreated\";\n  success: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** The password requirements configured for the environment. Use these to describe the requirements before a password is submitted; `createPassword` and `updatePassword` enforce them. */\nexport type PasswordPolicy = {\n  __typename?: \"PasswordPolicy\";\n  /** The minimum number of characters. */\n  minimumLength: Scalars[\"Int\"][\"output\"];\n  /** The minimum zxcvbn strength score (0–4) a password must reach. */\n  minimumStrength: Scalars[\"Int\"][\"output\"];\n  /** Whether passwords found in known data breaches are rejected. */\n  rejectsBreachedPasswords: Scalars[\"Boolean\"][\"output\"];\n  /** Whether a lowercase letter is required. */\n  requiresLowercase: Scalars[\"Boolean\"][\"output\"];\n  /** Whether a number is required. */\n  requiresNumber: Scalars[\"Boolean\"][\"output\"];\n  /** Whether a special character is required. */\n  requiresSymbol: Scalars[\"Boolean\"][\"output\"];\n  /** Whether an uppercase letter is required. */\n  requiresUppercase: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** The provided password does not meet the environment password policy requirements. */\nexport type PasswordPolicyViolation = {\n  __typename?: \"PasswordPolicyViolation\";\n  /** A machine-readable error code. Matches the `code` of the first entry in `violations`. */\n  code: Scalars[\"String\"][\"output\"];\n  /** A human-readable description of the policy violation. Describes the first entry in `violations`. */\n  message: Scalars[\"String\"][\"output\"];\n  /** Every way in which the password failed the policy, so all of them can be surfaced at once. */\n  violations: Array<PasswordViolation>;\n};\n\n/** The password was updated successfully. */\nexport type PasswordUpdated = {\n  __typename?: \"PasswordUpdated\";\n  success: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** A single way in which a password failed the environment password policy. Fields other than `code` and `message` are only populated for the codes that carry them. */\nexport type PasswordViolation = {\n  __typename?: \"PasswordViolation\";\n  /** For a missing `Symbol` character type, the symbols that satisfy the requirement. */\n  allowedSymbols?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** For `password_pwned`, how many times the password appears in known data breaches. */\n  breachOccurrences?: Maybe<Scalars[\"Int\"][\"output\"]>;\n  /** For `password_missing_character_type`, the class of character that is missing. */\n  characterType?: Maybe<PasswordCharacterType>;\n  /** A machine-readable error code, e.g. `password_too_short`, `password_missing_character_type`, `password_pwned`, `password_reused`, `password_too_weak`, `password_contains_email`, `password_too_long`. */\n  code: Scalars[\"String\"][\"output\"];\n  /** For `password_too_long`, the allowed maximum length. */\n  maximumLength?: Maybe<Scalars[\"Int\"][\"output\"]>;\n  /** A human-readable description of this violation. */\n  message: Scalars[\"String\"][\"output\"];\n  /** For `password_too_short`, the required minimum length. */\n  minimumLength?: Maybe<Scalars[\"Int\"][\"output\"]>;\n  /** For `password_too_weak`, suggestions for choosing a stronger password. Empty for other codes. */\n  strengthSuggestions: Array<Scalars[\"String\"][\"output\"]>;\n  /** For `password_too_weak`, a summary of why it is weak. */\n  strengthWarning?: Maybe<Scalars[\"String\"][\"output\"]>;\n};\n\n/** A permission that can be granted to a role within the environment. */\nexport type Permission = {\n  __typename?: \"Permission\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  description?: Maybe<Scalars[\"String\"][\"output\"]>;\n  id: Scalars[\"ID\"][\"output\"];\n  name: Scalars[\"String\"][\"output\"];\n  slug: Scalars[\"String\"][\"output\"];\n  /** Whether this is a WorkOS-managed system permission that cannot be modified. */\n  system: Scalars[\"Boolean\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** The profile was updated successfully. */\nexport type ProfileUpdated = {\n  __typename?: \"ProfileUpdated\";\n  user: User;\n};\n\nexport type Query = {\n  __typename?: \"Query\";\n  auditEvent: AuditEvent;\n  auditEvents: AuditEventList;\n  auditLogExport: AuditLogExport;\n  /** The authentication methods the environment allows and the password policy it enforces. Requires a session token. */\n  authenticationSettings: AuthenticationSettings;\n  /** Placeholder query for the Client GraphQL API scaffold. Returns a static value and is replaced by real resolvers. */\n  clientApiStatus: Scalars[\"String\"][\"output\"];\n  /** Return a data provider by ID within the token's environment. */\n  dataProvider: DataProvider;\n  /** Return one of the authenticated user's data provider connections by ID. */\n  dataProviderConnection: DataProviderConnection;\n  /** List the authenticated user's data provider connections, including their status. */\n  dataProviderConnections: DataProviderConnectionList;\n  /** List the data providers configured in the token's environment. */\n  dataProviders: DataProviderList;\n  /** Return a Directory Sync connection by ID within the token's organization. */\n  directoryConnection: Directory;\n  /** List the Directory Sync connections for the token's organization. */\n  directoryConnections: DirectoryList;\n  /** List the groups of a Directory Sync connection. */\n  directoryGroups: DirectoryGroupList;\n  /** List the users of a Directory Sync connection. */\n  directoryUsers: DirectoryUserList;\n  /** The permissions a user effectively has in the organization the token was issued for, including permissions inherited through the user's roles. Callers may read their own effective permissions; reading another member's requires the elevated user:read grant. */\n  effectivePermissions: Array<Permission>;\n  /** The feature flags that evaluate to enabled for a user in the environment the token was issued for, including flags targeted at the token's organization. Flags absent from the list evaluate to false. Callers may evaluate their own flags; evaluating another member of the token's organization requires the elevated user:read grant. */\n  evaluatedFlags: FlagList;\n  /** Fetch a feature flag by ID from the project that owns the token's environment. */\n  flag: Flag;\n  /** Fetch a feature flag by slug from the project that owns the token's environment. */\n  flagBySlug: Flag;\n  /** List the feature flags of the project that owns the token's environment, with their state in that environment. */\n  flags: FlagList;\n  /** Returns the currently authenticated user (the subject of the token). */\n  me: User;\n  /** Returns an organization by ID within the token's environment. */\n  organization: Organization;\n  /** List the domains belonging to the organization the token was issued for. */\n  organizationDomains: Array<OrganizationDomain>;\n  /** List members of the organization the token was issued for, with their roles. */\n  organizationMemberships: OrganizationMemberList;\n  /** List organizations the authenticated user belongs to. */\n  organizations: Array<UserOrganization>;\n  /** List registered passkeys for the authenticated user. Requires a session token. */\n  passkeys: Array<Passkey>;\n  /** List the permissions defined in the environment the token was issued for. */\n  permissions: Array<Permission>;\n  /** Fetch a single role available to the organization the token was issued for. */\n  role?: Maybe<Role>;\n  /** List roles available to the organization the token was issued for, with role assignment configuration. */\n  roles: RolesResult;\n  /** List active sessions for the authenticated user. Requires a session token. */\n  sessions: Array<Session>;\n  /** Returns an SSO connection by ID, including its IdP setup status, provided it belongs to the token's organization. */\n  ssoConnection: Connection;\n  /** List the SSO connections belonging to the organization the token was issued for. */\n  ssoConnections: Array<Connection>;\n  /** Returns a user by ID, provided they are a member of the token's organization. */\n  user: User;\n};\n\nexport type QueryAuditEventArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryAuditEventsArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  filter: AuditEventFilterInput;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n};\n\nexport type QueryAuditLogExportArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryDataProviderArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryDataProviderConnectionArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryDataProviderConnectionsArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n};\n\nexport type QueryDataProvidersArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n};\n\nexport type QueryDirectoryConnectionArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryDirectoryConnectionsArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n  search?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n};\n\nexport type QueryDirectoryGroupsArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  directoryId: Scalars[\"ID\"][\"input\"];\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n};\n\nexport type QueryDirectoryUsersArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  directoryId: Scalars[\"ID\"][\"input\"];\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n};\n\nexport type QueryEffectivePermissionsArgs = {\n  userId: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryEvaluatedFlagsArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n  userId: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryFlagArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryFlagBySlugArgs = {\n  slug: Scalars[\"String\"][\"input\"];\n};\n\nexport type QueryFlagsArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  enabled?: InputMaybe<Scalars[\"Boolean\"][\"input\"]>;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n  search?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n};\n\nexport type QueryOrganizationArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryOrganizationMembershipsArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n  roleSlug?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  search?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n};\n\nexport type QueryRoleArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QuerySsoConnectionArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryUserArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type RemoveMemberInput = {\n  /** The user ID of the member to remove. */\n  userId: Scalars[\"ID\"][\"input\"];\n};\n\nexport type RemoveMemberResult =\n  | MemberIsManagedByDirectory\n  | MemberNotFound\n  | MemberRemoved;\n\n/** Input for removing all TOTP factors. */\nexport type RemoveMfaFactorInput = {\n  /** An elevated access token obtained by verifying the current email address. Required to prove recent re-authentication. */\n  elevatedAccessToken: Scalars[\"String\"][\"input\"];\n};\n\nexport type RemoveMfaFactorResult =\n  | ElevatedAccessTokenExpired\n  | ElevatedAccessTokenInvalid\n  | MfaFactorRemoved\n  | NoMfaFactorsEnrolled;\n\nexport type ResendInvitationInput = {\n  /** The ID of the user whose invitation should be resent. */\n  userId: Scalars[\"ID\"][\"input\"];\n};\n\n/** No invitation exists for this user in this organization. */\nexport type ResendInvitationNotFound = {\n  __typename?: \"ResendInvitationNotFound\";\n  userId: Scalars[\"ID\"][\"output\"];\n};\n\nexport type ResendInvitationResult =\n  | InvitationResent\n  | InviteeAlreadyAccepted\n  | InviteeEmailNotDeliverable\n  | ResendInvitationNotFound;\n\nexport type RevokeAllSessionsResult = AllSessionsRevoked;\n\nexport type RevokeInvitationInput = {\n  /** The ID of the user whose pending invitation should be revoked. */\n  userId: Scalars[\"ID\"][\"input\"];\n};\n\nexport type RevokeInvitationResult =\n  | InvitationNotFound\n  | InvitationNotPending\n  | InvitationRevoked;\n\n/** Input for revoking a specific session. */\nexport type RevokeSessionInput = {\n  /** The ID of the session to revoke. */\n  sessionId: Scalars[\"ID\"][\"input\"];\n};\n\nexport type RevokeSessionResult = SessionNotFound | SessionRevoked;\n\n/** A role available within the organization. */\nexport type Role = {\n  __typename?: \"Role\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  description?: Maybe<Scalars[\"String\"][\"output\"]>;\n  id: Scalars[\"ID\"][\"output\"];\n  /** Whether this is the default role assigned to new members. */\n  isDefault: Scalars[\"Boolean\"][\"output\"];\n  name: Scalars[\"String\"][\"output\"];\n  slug: Scalars[\"String\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** Confirms that a role has been scheduled for deletion. */\nexport type RoleDeleted = {\n  __typename?: \"RoleDeleted\";\n  /** The ID of the deleted role. */\n  id: Scalars[\"ID\"][\"output\"];\n};\n\n/** No active roles with the given slugs exist in the environment. */\nexport type RoleNotFound = {\n  __typename?: \"RoleNotFound\";\n  /** The role slugs that did not resolve to active roles. */\n  roleSlugs: Array<Scalars[\"String\"][\"output\"]>;\n};\n\n/** Roles available in the organization along with role assignment configuration. */\nexport type RolesResult = {\n  __typename?: \"RolesResult\";\n  /** Whether members can be assigned multiple roles simultaneously. */\n  multipleRolesEnabled: Scalars[\"Boolean\"][\"output\"];\n  roles: Array<Role>;\n};\n\n/** Input for requesting an email change verification code. */\nexport type SendEmailChangeInput = {\n  /** The elevated access token from a successful `verifyCurrentEmail` call. */\n  elevatedAccessToken: Scalars[\"String\"][\"input\"];\n  /** The new email address to change to. */\n  newEmail: Scalars[\"String\"][\"input\"];\n};\n\nexport type SendEmailChangeResult =\n  | DailyEmailQuotaExceeded\n  | EmailChangeNotAvailable\n  | EmailChangeSent\n  | EmailManagedByProvider\n  | EmailNotAvailable\n  | IdentityVerificationExpired\n  | IdentityVerificationInvalid\n  | InvalidEmail;\n\nexport type SendVerificationCodeResult =\n  | DailyEmailQuotaExceeded\n  | VerificationCodeSent;\n\n/** An active user session. */\nexport type Session = {\n  __typename?: \"Session\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  currentLocation?: Maybe<SessionLocation>;\n  id: Scalars[\"ID\"][\"output\"];\n  ipAddress?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** Whether this session is the one making the request. */\n  isCurrent: Scalars[\"Boolean\"][\"output\"];\n  lastActivityAt?: Maybe<Scalars[\"DateTime\"][\"output\"]>;\n  organizationId?: Maybe<Scalars[\"String\"][\"output\"]>;\n  state: SessionState;\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n  userAgent?: Maybe<Scalars[\"String\"][\"output\"]>;\n};\n\n/** Approximate geographic location derived from the session IP. */\nexport type SessionLocation = {\n  __typename?: \"SessionLocation\";\n  cityName: Scalars[\"String\"][\"output\"];\n  countryISOCode: Scalars[\"String\"][\"output\"];\n};\n\n/** No session was found with the given ID. */\nexport type SessionNotFound = {\n  __typename?: \"SessionNotFound\";\n  /** The session ID that did not resolve to a session. */\n  sessionId: Scalars[\"ID\"][\"output\"];\n};\n\n/** The session was revoked successfully. */\nexport type SessionRevoked = {\n  __typename?: \"SessionRevoked\";\n  session: Session;\n};\n\n/** The lifecycle state of a session. */\nexport type SessionState = {\n  __typename?: \"SessionState\";\n  expiresAt?: Maybe<Scalars[\"DateTime\"][\"output\"]>;\n  /** Session state: Issued, Revoked, etc. */\n  tag: Scalars[\"String\"][\"output\"];\n};\n\n/** The user already has a verified TOTP factor enrolled. */\nexport type TotpAlreadyEnrolled = {\n  __typename?: \"TotpAlreadyEnrolled\";\n  _placeholder: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** TOTP factor details returned after enrollment. */\nexport type TotpFactor = {\n  __typename?: \"TotpFactor\";\n  /** The authentication challenge ID. */\n  authenticationChallengeId: Scalars[\"String\"][\"output\"];\n  /** The authentication factor ID. */\n  authenticationFactorId: Scalars[\"String\"][\"output\"];\n  /** A data-URI PNG of the QR code. */\n  qrCode: Scalars[\"String\"][\"output\"];\n  /** The TOTP secret for manual entry. */\n  secret: Scalars[\"String\"][\"output\"];\n  /** The TOTP URI for provisioning (otpauth://…). */\n  uri: Scalars[\"String\"][\"output\"];\n};\n\n/** The TOTP verification code was invalid. */\nexport type TotpVerificationFailed = {\n  __typename?: \"TotpVerificationFailed\";\n  _placeholder: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** The TOTP verification succeeded and the factor is active. */\nexport type TotpVerified = {\n  __typename?: \"TotpVerified\";\n  success: Scalars[\"Boolean\"][\"output\"];\n};\n\nexport type UpdateMemberRoleInput = {\n  /** Slugs of the roles to assign. When multiple roles are enabled for the environment, all provided roles are assigned; otherwise only the first slug is used. */\n  roleSlugs: Array<Scalars[\"String\"][\"input\"]>;\n  /** The user ID of the member to update. */\n  userId: Scalars[\"ID\"][\"input\"];\n};\n\nexport type UpdateMemberRoleResult =\n  | MemberNotFound\n  | MemberRoleUpdated\n  | RoleNotFound;\n\n/** Input for changing an existing password. Requires the current password for verification. */\nexport type UpdatePasswordInput = {\n  /** The current password for verification. */\n  currentPassword: Scalars[\"String\"][\"input\"];\n  /** The new password. Must satisfy the environment password policy. */\n  newPassword: Scalars[\"String\"][\"input\"];\n};\n\nexport type UpdatePasswordResult =\n  | IncorrectPassword\n  | PasswordPolicyViolation\n  | PasswordUpdated;\n\n/** Input for updating the authenticated user's profile. */\nexport type UpdateProfileInput = {\n  /** The user's first name. Pass an empty string to clear. */\n  firstName?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  /** The user's last name. Pass an empty string to clear. */\n  lastName?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  /** The user's locale as a BCP 47 language tag (e.g. 'en-US'). Pass an empty string to clear. */\n  locale?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n};\n\nexport type UpdateProfileResult = InvalidLocale | ProfileUpdated;\n\nexport type UpdateRoleInput = {\n  /** Human-readable description of the role. This is a full replace of the role, so an omitted or null description clears it — resupply the current value to preserve it. */\n  description?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  /** The ID of the role to update. */\n  id: Scalars[\"ID\"][\"input\"];\n  /** Human-readable name for the role. */\n  name: Scalars[\"String\"][\"input\"];\n  /** Slugs of the permissions granted to the role. Replaces the existing set when provided. */\n  permissions?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n};\n\nexport type UpdateSsoConnectionInput = {\n  id: Scalars[\"ID\"][\"input\"];\n  /** A new human-readable name for the connection. */\n  name?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n};\n\n/** A user in the current environment. */\nexport type User = {\n  __typename?: \"User\";\n  connectedAccounts: Array<ConnectedAccount>;\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  email: Scalars[\"String\"][\"output\"];\n  emailVerified: Scalars[\"Boolean\"][\"output\"];\n  firstName?: Maybe<Scalars[\"String\"][\"output\"]>;\n  id: Scalars[\"ID\"][\"output\"];\n  lastName?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** Whether multi-factor authentication (TOTP) is set up for this user. Always `false` when the environment has MFA turned off — use `authenticationSettings.mfaEnabled` to tell the two apart. Only populated on `me`. */\n  mfaEnabled: Scalars[\"Boolean\"][\"output\"];\n  /** When MFA was last used to authenticate. Only populated on `me`. */\n  mfaLastUsedAt?: Maybe<Scalars[\"DateTime\"][\"output\"]>;\n  /** When a password was last used to authenticate. Only populated on `me`. */\n  passwordLastUsedAt?: Maybe<Scalars[\"DateTime\"][\"output\"]>;\n  /** Whether this user has a password set. Reflects the user regardless of whether the environment allows password authentication; use `authenticationSettings.passwordAuthEnabled` for that. Only populated on `me`. */\n  passwordSet: Scalars[\"Boolean\"][\"output\"];\n  profilePictureUrl?: Maybe<Scalars[\"String\"][\"output\"]>;\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** The user already has a password set. */\nexport type UserAlreadyHasPassword = {\n  __typename?: \"UserAlreadyHasPassword\";\n  _placeholder: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** The invitation was created and the email sent. */\nexport type UserInvited = {\n  __typename?: \"UserInvited\";\n  invitation: OrganizationInvitation;\n};\n\n/** An organization the authenticated user belongs to, with a flag indicating whether it is the token's current organization. */\nexport type UserOrganization = {\n  __typename?: \"UserOrganization\";\n  id: Scalars[\"ID\"][\"output\"];\n  /** Whether this is the organization the token is currently scoped to. */\n  isCurrent: Scalars[\"Boolean\"][\"output\"];\n  name: Scalars[\"String\"][\"output\"];\n};\n\n/** The verification code has expired. */\nexport type VerificationCodeExpired = {\n  __typename?: \"VerificationCodeExpired\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The verification code is incorrect. */\nexport type VerificationCodeIncorrect = {\n  __typename?: \"VerificationCodeIncorrect\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The verification code has already been used. */\nexport type VerificationCodePreviouslyUsed = {\n  __typename?: \"VerificationCodePreviouslyUsed\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** A verification code was sent to the current email address for identity verification. */\nexport type VerificationCodeSent = {\n  __typename?: \"VerificationCodeSent\";\n  /** The authentication challenge ID to use in subsequent steps. */\n  authenticationChallengeId: Scalars[\"ID\"][\"output\"];\n  /** When the verification code expires. */\n  expiresAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** Too many verification code attempts. */\nexport type VerificationTooManyAttempts = {\n  __typename?: \"VerificationTooManyAttempts\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** Input for verifying the current email address. */\nexport type VerifyCurrentEmailInput = {\n  /** The authentication challenge ID returned from `sendVerificationCode`. */\n  authenticationChallengeId: Scalars[\"ID\"][\"input\"];\n  /** The verification code sent to the current email address. */\n  code: Scalars[\"String\"][\"input\"];\n};\n\nexport type VerifyCurrentEmailResult =\n  | CurrentEmailVerified\n  | VerificationCodeExpired\n  | VerificationCodeIncorrect\n  | VerificationCodePreviouslyUsed\n  | VerificationTooManyAttempts;\n\n/** Input for verifying a TOTP enrollment. */\nexport type VerifyTotpInput = {\n  /** The authentication challenge ID from enrollTotp. */\n  authenticationChallengeId: Scalars[\"String\"][\"input\"];\n  /** The TOTP code from the authenticator app. */\n  code: Scalars[\"String\"][\"input\"];\n  /** An elevated access token obtained by verifying the current email address. Required to prove recent re-authentication. */\n  elevatedAccessToken: Scalars[\"String\"][\"input\"];\n};\n\nexport type VerifyTotpResult =\n  | ElevatedAccessTokenExpired\n  | ElevatedAccessTokenInvalid\n  | TotpVerificationFailed\n  | TotpVerified;\n\nexport type ClientApiStatusQueryVariables = Exact<{ [key: string]: never }>;\n\nexport type ClientApiStatusQuery = {\n  __typename?: \"Query\";\n  clientApiStatus: string;\n};\n\nexport const ClientApiStatusDocument = `\n    query ClientApiStatus {\n  clientApiStatus\n}\n    `;\n\nexport type SdkFunctionWrapper = <T>(\n  action: (requestHeaders?: Record<string, string>) => Promise<T>,\n  operationName: string,\n  operationType?: string,\n  variables?: any,\n) => Promise<T>;\n\nconst defaultWrapper: SdkFunctionWrapper = (\n  action,\n  _operationName,\n  _operationType,\n  _variables,\n) => action();\n\nexport function getSdk(\n  client: GraphQLClient,\n  withWrapper: SdkFunctionWrapper = defaultWrapper,\n) {\n  return {\n    ClientApiStatus(\n      variables?: ClientApiStatusQueryVariables,\n      requestHeaders?: GraphQLClientRequestHeaders,\n      signal?: RequestInit[\"signal\"],\n    ): Promise<ClientApiStatusQuery> {\n      return withWrapper(\n        (wrappedRequestHeaders) =>\n          client.request<ClientApiStatusQuery>({\n            document: ClientApiStatusDocument,\n            variables,\n            requestHeaders: { ...requestHeaders, ...wrappedRequestHeaders },\n            signal,\n          }),\n        \"ClientApiStatus\",\n        \"query\",\n        variables,\n      );\n    },\n  };\n}\nexport type Sdk = ReturnType<typeof getSdk>;\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgmDO,MAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAavC,MAAM,iBAAqC,CACzC,QACA,gBACA,gBACA,eACG,OAAO;AAEL,SAAS,OACd,QACA,cAAkC,gBAClC;AACA,SAAO;AAAA,IACL,gBACE,WACA,gBACA,QAC+B;AAC/B,aAAO;AAAA,QACL,CAAC,0BACC,OAAO,QAA8B;AAAA,UACnC,UAAU;AAAA,UACV;AAAA,UACA,gBAAgB,EAAE,GAAG,gBAAgB,GAAG,sBAAsB;AAAA,UAC9D;AAAA,QACF,CAAC;AAAA,QACH;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/cjs/api/client-graphql/generated.d.cts

@@ -100,8 +100,12 @@ type AuditEventList = {
 };
 type AuditLogExport = {
     __typename?: "AuditLogExport";
+    createdAt: Scalars["DateTime"]["output"];
     id: Scalars["ID"]["output"];
     state: AuditLogExportState;
+    updatedAt: Scalars["DateTime"]["output"];
+    /** A signed URL to the CSV file. Only defined once the export is ready. */
+    url?: Maybe<Scalars["String"]["output"]>;
 };
 type AuditLogExportState = "Error" | "Expired" | "Pending" | "Ready";
 /** The authentication methods the environment allows, and the password policy it enforces. Distinct from what the authenticated user has set up, which lives on `me`. */
@@ -861,6 +865,7 @@ type Query = {
     __typename?: "Query";
     auditEvent: AuditEvent;
     auditEvents: AuditEventList;
+    auditLogExport: AuditLogExport;
     /** The authentication methods the environment allows and the password policy it enforces. Requires a session token. */
     authenticationSettings: AuthenticationSettings;
     /** Placeholder query for the Client GraphQL API scaffold. Returns a static value and is replaced by real resolvers. */
@@ -928,6 +933,9 @@ type QueryAuditEventsArgs = {
     limit?: InputMaybe<Scalars["Int"]["input"]>;
     order?: InputMaybe<PaginationOrder>;
 };
+type QueryAuditLogExportArgs = {
+    id: Scalars["ID"]["input"];
+};
 type QueryDataProviderArgs = {
     id: Scalars["ID"]["input"];
 };
@@ -1294,4 +1302,4 @@ declare function getSdk(client: GraphQLClient, withWrapper?: SdkFunctionWrapper)
 };
 type Sdk = ReturnType<typeof getSdk>;
 
-export { type AllSessionsRevoked, type AssignPermissionToRoleInput, type AuditEvent, type AuditEventActor, type AuditEventFilterInput, type AuditEventList, type AuditLogExport, type AuditLogExportState, type AuthenticationSettings, ClientApiStatusDocument, type ClientApiStatusQuery, type ClientApiStatusQueryVariables, type ConfirmEmailChangeInput, type ConfirmEmailChangeResult, type ConnectedAccount, type Connection, type ConnectionState, type ConnectionType, type CreateAuditLogExportInput, type CreateAuditLogExportResult, type CreatePasswordInput, type CreatePasswordResult, type CreateRoleInput, type CreateSsoConnectionInput, type CurrentEmailVerified, type DailyEmailQuotaExceeded, type DataProvider, type DataProviderConnection, type DataProviderConnectionList, type DataProviderList, type DeleteRoleInput, type Directory, type DirectoryGroup, type DirectoryGroupList, type DirectoryList, type DirectoryUser, type DirectoryUserList, type DomainVerificationNameServer, type ElevatedAccessTokenExpired, type ElevatedAccessTokenInvalid, type EmailChangeCodeExpired, type EmailChangeCodeIncorrect, type EmailChangeCodePreviouslyUsed, type EmailChangeConfirmed, type EmailChangeNotAvailable, type EmailChangeSent, type EmailChangeTooManyAttempts, type EmailManagedByProvider, type EmailNotAvailable, type EnrollTotpInput, type EnrollTotpResult, type Exact, type Flag, type FlagList, type IdentityVerificationExpired, type IdentityVerificationInvalid, type IncorrectPassword, type Incremental, type InputMaybe, type InvalidAuditLogExportDateRange, type InvalidEmail, type InvalidInvitationExpiry, type InvalidInviteeEmail, type InvalidInviteeRole, type InvalidLocale, type InvitationNotFound, type InvitationNotPending, type InvitationResent, type InvitationRevoked, type InviteUserInput, type InviteUserResult, type InviteeAlreadyAccepted, type InviteeAlreadyInvited, type InviteeAlreadyMember, type InviteeEmailNotDeliverable, type ListMetadata, type MakeEmpty, type MakeMaybe, type MakeOptional, type Maybe, type MemberIsManagedByDirectory, type MemberNotFound, type MemberRemoved, type MemberRoleUpdated, type MfaFactorRemoved, type Mutation, type MutationAssignPermissionToRoleArgs, type MutationConfirmEmailChangeArgs, type MutationCreateAuditLogExportArgs, type MutationCreateOrganizationDomainArgs, type MutationCreatePasswordArgs, type MutationCreateRoleArgs, type MutationCreateSsoConnectionArgs, type MutationDeleteOrganizationDomainArgs, type MutationDeleteRoleArgs, type MutationDeleteSsoConnectionArgs, type MutationEnrollTotpArgs, type MutationInviteUserArgs, type MutationRemoveMemberArgs, type MutationRemoveMfaFactorArgs, type MutationResendInvitationArgs, type MutationReverifyOrganizationDomainArgs, type MutationRevokeInvitationArgs, type MutationRevokeSessionArgs, type MutationSendEmailChangeArgs, type MutationUpdateMemberRoleArgs, type MutationUpdatePasswordArgs, type MutationUpdateProfileArgs, type MutationUpdateRoleArgs, type MutationUpdateSsoConnectionArgs, type MutationVerifyCurrentEmailArgs, type MutationVerifyTotpArgs, type NoAuditEventsFound, type NoMfaFactorsEnrolled, type NoPendingEmailChange, type OAuthProvider, type Organization, type OrganizationBlockedFromSendingInvites, type OrganizationDomain, type OrganizationDomainState, type OrganizationInvitation, type OrganizationInvitationStatus, type OrganizationMember, type OrganizationMemberList, type OrganizationMemberRole, type OrganizationMemberStatus, type PaginationOrder, type Passkey, type PasswordCharacterType, type PasswordCreated, type PasswordPolicy, type PasswordPolicyViolation, type PasswordUpdated, type PasswordViolation, type Permission, type ProfileUpdated, type Query, type QueryAuditEventArgs, type QueryAuditEventsArgs, type QueryDataProviderArgs, type QueryDataProviderConnectionArgs, type QueryDataProviderConnectionsArgs, type QueryDataProvidersArgs, type QueryDirectoryConnectionArgs, type QueryDirectoryConnectionsArgs, type QueryDirectoryGroupsArgs, type QueryDirectoryUsersArgs, type QueryEffectivePermissionsArgs, type QueryEvaluatedFlagsArgs, type QueryFlagArgs, type QueryFlagBySlugArgs, type QueryFlagsArgs, type QueryOrganizationArgs, type QueryOrganizationMembershipsArgs, type QueryRoleArgs, type QuerySsoConnectionArgs, type QueryUserArgs, type RemoveMemberInput, type RemoveMemberResult, type RemoveMfaFactorInput, type RemoveMfaFactorResult, type ResendInvitationInput, type ResendInvitationNotFound, type ResendInvitationResult, type RevokeAllSessionsResult, type RevokeInvitationInput, type RevokeInvitationResult, type RevokeSessionInput, type RevokeSessionResult, type Role, type RoleDeleted, type RoleNotFound, type RolesResult, type Scalars, type Sdk, type SdkFunctionWrapper, type SendEmailChangeInput, type SendEmailChangeResult, type SendVerificationCodeResult, type Session, type SessionLocation, type SessionNotFound, type SessionRevoked, type SessionState, type TotpAlreadyEnrolled, type TotpFactor, type TotpVerificationFailed, type TotpVerified, type UpdateMemberRoleInput, type UpdateMemberRoleResult, type UpdatePasswordInput, type UpdatePasswordResult, type UpdateProfileInput, type UpdateProfileResult, type UpdateRoleInput, type UpdateSsoConnectionInput, type User, type UserAlreadyHasPassword, type UserInvited, type UserOrganization, type VerificationCodeExpired, type VerificationCodeIncorrect, type VerificationCodePreviouslyUsed, type VerificationCodeSent, type VerificationTooManyAttempts, type VerifyCurrentEmailInput, type VerifyCurrentEmailResult, type VerifyTotpInput, type VerifyTotpResult, getSdk };
+export { type AllSessionsRevoked, type AssignPermissionToRoleInput, type AuditEvent, type AuditEventActor, type AuditEventFilterInput, type AuditEventList, type AuditLogExport, type AuditLogExportState, type AuthenticationSettings, ClientApiStatusDocument, type ClientApiStatusQuery, type ClientApiStatusQueryVariables, type ConfirmEmailChangeInput, type ConfirmEmailChangeResult, type ConnectedAccount, type Connection, type ConnectionState, type ConnectionType, type CreateAuditLogExportInput, type CreateAuditLogExportResult, type CreatePasswordInput, type CreatePasswordResult, type CreateRoleInput, type CreateSsoConnectionInput, type CurrentEmailVerified, type DailyEmailQuotaExceeded, type DataProvider, type DataProviderConnection, type DataProviderConnectionList, type DataProviderList, type DeleteRoleInput, type Directory, type DirectoryGroup, type DirectoryGroupList, type DirectoryList, type DirectoryUser, type DirectoryUserList, type DomainVerificationNameServer, type ElevatedAccessTokenExpired, type ElevatedAccessTokenInvalid, type EmailChangeCodeExpired, type EmailChangeCodeIncorrect, type EmailChangeCodePreviouslyUsed, type EmailChangeConfirmed, type EmailChangeNotAvailable, type EmailChangeSent, type EmailChangeTooManyAttempts, type EmailManagedByProvider, type EmailNotAvailable, type EnrollTotpInput, type EnrollTotpResult, type Exact, type Flag, type FlagList, type IdentityVerificationExpired, type IdentityVerificationInvalid, type IncorrectPassword, type Incremental, type InputMaybe, type InvalidAuditLogExportDateRange, type InvalidEmail, type InvalidInvitationExpiry, type InvalidInviteeEmail, type InvalidInviteeRole, type InvalidLocale, type InvitationNotFound, type InvitationNotPending, type InvitationResent, type InvitationRevoked, type InviteUserInput, type InviteUserResult, type InviteeAlreadyAccepted, type InviteeAlreadyInvited, type InviteeAlreadyMember, type InviteeEmailNotDeliverable, type ListMetadata, type MakeEmpty, type MakeMaybe, type MakeOptional, type Maybe, type MemberIsManagedByDirectory, type MemberNotFound, type MemberRemoved, type MemberRoleUpdated, type MfaFactorRemoved, type Mutation, type MutationAssignPermissionToRoleArgs, type MutationConfirmEmailChangeArgs, type MutationCreateAuditLogExportArgs, type MutationCreateOrganizationDomainArgs, type MutationCreatePasswordArgs, type MutationCreateRoleArgs, type MutationCreateSsoConnectionArgs, type MutationDeleteOrganizationDomainArgs, type MutationDeleteRoleArgs, type MutationDeleteSsoConnectionArgs, type MutationEnrollTotpArgs, type MutationInviteUserArgs, type MutationRemoveMemberArgs, type MutationRemoveMfaFactorArgs, type MutationResendInvitationArgs, type MutationReverifyOrganizationDomainArgs, type MutationRevokeInvitationArgs, type MutationRevokeSessionArgs, type MutationSendEmailChangeArgs, type MutationUpdateMemberRoleArgs, type MutationUpdatePasswordArgs, type MutationUpdateProfileArgs, type MutationUpdateRoleArgs, type MutationUpdateSsoConnectionArgs, type MutationVerifyCurrentEmailArgs, type MutationVerifyTotpArgs, type NoAuditEventsFound, type NoMfaFactorsEnrolled, type NoPendingEmailChange, type OAuthProvider, type Organization, type OrganizationBlockedFromSendingInvites, type OrganizationDomain, type OrganizationDomainState, type OrganizationInvitation, type OrganizationInvitationStatus, type OrganizationMember, type OrganizationMemberList, type OrganizationMemberRole, type OrganizationMemberStatus, type PaginationOrder, type Passkey, type PasswordCharacterType, type PasswordCreated, type PasswordPolicy, type PasswordPolicyViolation, type PasswordUpdated, type PasswordViolation, type Permission, type ProfileUpdated, type Query, type QueryAuditEventArgs, type QueryAuditEventsArgs, type QueryAuditLogExportArgs, type QueryDataProviderArgs, type QueryDataProviderConnectionArgs, type QueryDataProviderConnectionsArgs, type QueryDataProvidersArgs, type QueryDirectoryConnectionArgs, type QueryDirectoryConnectionsArgs, type QueryDirectoryGroupsArgs, type QueryDirectoryUsersArgs, type QueryEffectivePermissionsArgs, type QueryEvaluatedFlagsArgs, type QueryFlagArgs, type QueryFlagBySlugArgs, type QueryFlagsArgs, type QueryOrganizationArgs, type QueryOrganizationMembershipsArgs, type QueryRoleArgs, type QuerySsoConnectionArgs, type QueryUserArgs, type RemoveMemberInput, type RemoveMemberResult, type RemoveMfaFactorInput, type RemoveMfaFactorResult, type ResendInvitationInput, type ResendInvitationNotFound, type ResendInvitationResult, type RevokeAllSessionsResult, type RevokeInvitationInput, type RevokeInvitationResult, type RevokeSessionInput, type RevokeSessionResult, type Role, type RoleDeleted, type RoleNotFound, type RolesResult, type Scalars, type Sdk, type SdkFunctionWrapper, type SendEmailChangeInput, type SendEmailChangeResult, type SendVerificationCodeResult, type Session, type SessionLocation, type SessionNotFound, type SessionRevoked, type SessionState, type TotpAlreadyEnrolled, type TotpFactor, type TotpVerificationFailed, type TotpVerified, type UpdateMemberRoleInput, type UpdateMemberRoleResult, type UpdatePasswordInput, type UpdatePasswordResult, type UpdateProfileInput, type UpdateProfileResult, type UpdateRoleInput, type UpdateSsoConnectionInput, type User, type UserAlreadyHasPassword, type UserInvited, type UserOrganization, type VerificationCodeExpired, type VerificationCodeIncorrect, type VerificationCodePreviouslyUsed, type VerificationCodeSent, type VerificationTooManyAttempts, type VerifyCurrentEmailInput, type VerifyCurrentEmailResult, type VerifyTotpInput, type VerifyTotpResult, getSdk };

package/dist/cjs/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/index.ts"],"sourcesContent":["export {\n  WorkOsWidgets,\n  type WorkOsWidgetsProps,\n} from \"./workos-widgets.client.js\";\nexport {\n  OrganizationSwitcher,\n  OrganizationSwitcherLoading,\n  type OrganizationSwitcherProps,\n} from \"./organization-switcher.client.js\";\nexport {\n  AdminPortalSsoConnection,\n  AdminPortalSsoConnectionLoading,\n  type AdminPortalSsoConnectionProps,\n} from \"./admin-portal-sso-connection.client.js\";\nexport {\n  UserProfile,\n  UserProfileLoading,\n  type UserProfileProps,\n} from \"./user-profile.client.js\";\nexport {\n  UserSecurity,\n  UserSecurityLoading,\n  type UserSecurityProps,\n} from \"./user-security.client.js\";\nexport {\n  UserSessions,\n  UserSessionsLoading,\n  type UserSessionsProps,\n} from \"./user-sessions.client.js\";\nexport {\n  UsersManagement,\n  UsersManagementLoading,\n  type UsersManagementProps,\n} from \"./users-management.client.js\";\nexport {\n  AdminPortalDomainVerification,\n  AdminPortalDomainVerificationLoading,\n  type AdminPortalDomainVerificationProps,\n} from \"./admin-portal-domain-verification.client.js\";\nexport {\n  AdminPortalAuditLogStreaming,\n  AdminPortalAuditLogStreamingLoading,\n  AdminPortalAuditLogStreamingError,\n  type AdminPortalAuditLogStreamingProps,\n  AdminPortalAuditLogStreamingPresentational,\n  AdminPortalAuditLogStreamingButton as AdminPortalAuditLogStreamingOpenButton,\n  type AdminPortalAuditLogStreamingStatusProps,\n} from \"./admin-portal-audit-log-streaming.client.js\";\nexport {\n  ApiKeys,\n  ApiKeysLoading,\n  type ApiKeysProps,\n} from \"./api-keys.client.js\";\nexport { Pipes, PipesLoading, type PipesProps } from \"./pipes.client.js\";\nexport {\n  PipesAdmin,\n  PipesAdminLoading,\n  type PipesAdminProps,\n} from \"./pipes-admin.client.js\";\nexport {\n  DirectorySync,\n  DirectorySyncLoading,\n  type DirectorySyncProps,\n} from \"./directory-sync.client.js\";\nexport { IntlContext as internal_IntlContext } from \"./lib/i18n/intl-context.js\";\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mCAGO;AACP,0CAIO;AACP,gDAIO;AACP,iCAIO;AACP,kCAIO;AACP,kCAIO;AACP,qCAIO;AACP,qDAIO;AACP,qDAQO;AACP,6BAIO;AACP,0BAAqD;AACrD,gCAIO;AACP,mCAIO;AACP,0BAAoD;","names":[]}
+{"version":3,"sources":["../../src/index.ts"],"sourcesContent":["export {\n  WorkOsWidgets,\n  type WorkOsWidgetsProps,\n} from \"./workos-widgets.client.js\";\nexport {\n  OrganizationSwitcher,\n  OrganizationSwitcherLoading,\n  type OrganizationSwitcherProps,\n} from \"./organization-switcher.client.js\";\nexport {\n  AdminPortalSsoConnection,\n  AdminPortalSsoConnectionLoading,\n  type AdminPortalSsoConnectionProps,\n} from \"./admin-portal-sso-connection.client.js\";\nexport {\n  UserProfile,\n  UserProfileLoading,\n  type UserProfileProps,\n} from \"./user-profile.client.js\";\nexport {\n  UserSecurity,\n  UserSecurityLoading,\n  type UserSecurityProps,\n} from \"./user-security.client.js\";\nexport {\n  UserSessions,\n  UserSessionsLoading,\n  type UserSessionsProps,\n} from \"./user-sessions.client.js\";\nexport {\n  UsersManagement,\n  UsersManagementLoading,\n  type UsersManagementProps,\n} from \"./users-management.client.js\";\nexport {\n  AdminPortalDomainVerification,\n  AdminPortalDomainVerificationLoading,\n  type AdminPortalDomainVerificationProps,\n} from \"./admin-portal-domain-verification.client.js\";\nexport {\n  AdminPortalAuditLogStreaming,\n  AdminPortalAuditLogStreamingLoading,\n  AdminPortalAuditLogStreamingError,\n  type AdminPortalAuditLogStreamingProps,\n  AdminPortalAuditLogStreamingPresentational,\n  AdminPortalAuditLogStreamingButton as AdminPortalAuditLogStreamingOpenButton,\n  type AdminPortalAuditLogStreamingStatusProps,\n} from \"./admin-portal-audit-log-streaming.client.js\";\nexport {\n  ApiKeys,\n  ApiKeysLoading,\n  type ApiKeysProps,\n} from \"./api-keys.client.js\";\nexport {\n  Pipes,\n  PipesLoading,\n  type PipesAuthMethod,\n  type PipesFilter,\n  type PipesFilterCriteria,\n  type PipesProps,\n} from \"./pipes.client.js\";\nexport type { DataIntegration } from \"./api/endpoint.js\";\nexport {\n  PipesAdmin,\n  PipesAdminLoading,\n  type PipesAdminProps,\n} from \"./pipes-admin.client.js\";\nexport {\n  DirectorySync,\n  DirectorySyncLoading,\n  type DirectorySyncProps,\n} from \"./directory-sync.client.js\";\nexport { IntlContext as internal_IntlContext } from \"./lib/i18n/intl-context.js\";\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mCAGO;AACP,0CAIO;AACP,gDAIO;AACP,iCAIO;AACP,kCAIO;AACP,kCAIO;AACP,qCAIO;AACP,qDAIO;AACP,qDAQO;AACP,6BAIO;AACP,0BAOO;AAEP,gCAIO;AACP,mCAIO;AACP,0BAAoD;","names":[]}

package/dist/cjs/index.d.cts

@@ -8,7 +8,8 @@ export { UsersManagement, UsersManagementProps } from './users-management.client
 export { AdminPortalDomainVerification, AdminPortalDomainVerificationProps } from './admin-portal-domain-verification.client.cjs';
 export { AdminPortalAuditLogStreaming, AdminPortalAuditLogStreamingProps } from './admin-portal-audit-log-streaming.client.cjs';
 export { ApiKeys, ApiKeysProps } from './api-keys.client.cjs';
-export { Pipes, PipesProps } from './pipes.client.cjs';
+export { Pipes, PipesAuthMethod, PipesFilter, PipesFilterCriteria, PipesProps } from './pipes.client.cjs';
+export { DataIntegration } from './api/endpoint.cjs';
 export { PipesAdmin, PipesAdminProps } from './pipes-admin.client.cjs';
 export { DirectorySync, DirectorySyncProps } from './directory-sync.client.cjs';
 export { IntlContext as internal_IntlContext } from './lib/i18n/intl-context.cjs';
@@ -39,6 +40,5 @@ import './select-KR89Qnvm.cjs';
 import '@radix-ui/themes/components/select';
 import './api/api-provider.cjs';
 import './lib/utils.cjs';
-import './api/endpoint.cjs';
 import './api/widgets-api-client.cjs';
 import './lib/identity-providers.cjs';

package/dist/cjs/pipes.client.cjs

@@ -41,6 +41,21 @@ const Pipes = ({ authToken, ...domProps }) => {
     }
   );
 };
+function matchesPipesFilterCriteria(integration, criteria) {
+  if (criteria.slugs && !criteria.slugs.includes(integration.slug)) {
+    return false;
+  }
+  if (criteria.integrationTypes && !criteria.integrationTypes.includes(integration.integrationType)) {
+    return false;
+  }
+  if (criteria.authMethods) {
+    const methods = integration.authMethods ?? ["oauth"];
+    if (!criteria.authMethods.some((method) => methods.includes(method))) {
+      return false;
+    }
+  }
+  return true;
+}
 const PipesImpl = (props) => {
   const isHydrated = (0, import_use_is_hydrated.useIsHydrated)();
   const integrations = (0, import_endpoint.useMyDataIntegrations)();
@@ -51,7 +66,12 @@ const PipesImpl = (props) => {
     return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_pipes.PipesError, { error: integrations.error, ...props });
   }
   if (integrations.isSuccess) {
-    return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_pipes.Pipes, { integrations: integrations.data.data, ...props });
+    const all = integrations.data.data;
+    const { filter } = props;
+    const visible = filter ? typeof filter === "function" ? all.filter(filter) : all.filter(
+      (integration) => matchesPipesFilterCriteria(integration, filter)
+    ) : all;
+    return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_pipes.Pipes, { integrations: visible, ...props });
   }
   return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_pipes.PipesError, { error: integrations.error, ...props });
 };

package/dist/cjs/pipes.client.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/pipes.client.tsx"],"sourcesContent":["\"use client\";\nimport { ApiProvider, AuthToken } from \"./api/api-provider.js\";\nimport { useWorkOsApiUrl } from \"./lib/widgets-context.js\";\nimport {\n  Pipes as PipesPresentational,\n  PipesError,\n  PipesLoading,\n} from \"./lib/pipes.js\";\nimport type { PipesErrorProps, PipesLoadingProps } from \"./lib/pipes.js\";\nimport { useMyDataIntegrations } from \"./api/endpoint.js\";\nimport { useIsHydrated } from \"./lib/use-is-hydrated.js\";\nimport { ErrorBoundary } from \"./lib/error-boundary.js\";\nimport { WidgetRootDomProps } from \"./lib/utils.js\";\n\ninterface PipesProps extends WidgetRootDomProps {\n  authToken: AuthToken;\n}\n\nconst Pipes: React.FC<PipesProps> = ({ authToken, ...domProps }) => {\n  const baseUrl = useWorkOsApiUrl();\n\n  return (\n    <ErrorBoundary\n      fallbackRender={({ error }) => <PipesError {...domProps} error={error} />}\n    >\n      <ApiProvider widgetType=\"pipes\" authToken={authToken} baseUrl={baseUrl}>\n        <PipesImpl {...domProps} />\n      </ApiProvider>\n    </ErrorBoundary>\n  );\n};\n\nconst PipesImpl = (props: Omit<PipesProps, \"authToken\">) => {\n  const isHydrated = useIsHydrated();\n  const integrations = useMyDataIntegrations();\n\n  if (!isHydrated || integrations.isLoading) {\n    return <PipesLoading count={6} {...props} />;\n  }\n\n  if (integrations.isError) {\n    return <PipesError error={integrations.error} {...props} />;\n  }\n\n  if (integrations.isSuccess) {\n    return (\n      <PipesPresentational integrations={integrations.data.data} {...props} />\n    );\n  }\n\n  return <PipesError error={integrations.error} {...props} />;\n};\n\nexport type { PipesProps, PipesLoadingProps, PipesErrorProps };\nexport { Pipes, PipesLoading, PipesError };\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAuBqC;AAtBrC,0BAAuC;AACvC,6BAAgC;AAChC,mBAIO;AAEP,sBAAsC;AACtC,6BAA8B;AAC9B,4BAA8B;AAO9B,MAAM,QAA8B,CAAC,EAAE,WAAW,GAAG,SAAS,MAAM;AAClE,QAAM,cAAU,wCAAgB;AAEhC,SACE;AAAA,IAAC;AAAA;AAAA,MACC,gBAAgB,CAAC,EAAE,MAAM,MAAM,4CAAC,2BAAY,GAAG,UAAU,OAAc;AAAA,MAEvE,sDAAC,mCAAY,YAAW,SAAQ,WAAsB,SACpD,sDAAC,aAAW,GAAG,UAAU,GAC3B;AAAA;AAAA,EACF;AAEJ;AAEA,MAAM,YAAY,CAAC,UAAyC;AAC1D,QAAM,iBAAa,sCAAc;AACjC,QAAM,mBAAe,uCAAsB;AAE3C,MAAI,CAAC,cAAc,aAAa,WAAW;AACzC,WAAO,4CAAC,6BAAa,OAAO,GAAI,GAAG,OAAO;AAAA,EAC5C;AAEA,MAAI,aAAa,SAAS;AACxB,WAAO,4CAAC,2BAAW,OAAO,aAAa,OAAQ,GAAG,OAAO;AAAA,EAC3D;AAEA,MAAI,aAAa,WAAW;AAC1B,WACE,4CAAC,aAAAA,OAAA,EAAoB,cAAc,aAAa,KAAK,MAAO,GAAG,OAAO;AAAA,EAE1E;AAEA,SAAO,4CAAC,2BAAW,OAAO,aAAa,OAAQ,GAAG,OAAO;AAC3D;","names":["PipesPresentational"]}
+{"version":3,"sources":["../../src/pipes.client.tsx"],"sourcesContent":["\"use client\";\nimport { ApiProvider, AuthToken } from \"./api/api-provider.js\";\nimport { useWorkOsApiUrl } from \"./lib/widgets-context.js\";\nimport {\n  Pipes as PipesPresentational,\n  PipesError,\n  PipesLoading,\n} from \"./lib/pipes.js\";\nimport type { PipesErrorProps, PipesLoadingProps } from \"./lib/pipes.js\";\nimport { DataIntegration, useMyDataIntegrations } from \"./api/endpoint.js\";\nimport { useIsHydrated } from \"./lib/use-is-hydrated.js\";\nimport { ErrorBoundary } from \"./lib/error-boundary.js\";\nimport { WidgetRootDomProps } from \"./lib/utils.js\";\n\n/** An auth method a provider advertises (defaults to `oauth` when unset). */\ntype PipesAuthMethod = NonNullable<DataIntegration[\"authMethods\"]>[number];\n\n/**\n * Serializable criteria for narrowing which integrations render. All provided\n * criteria are ANDed; an absent criterion is ignored. Safe to pass from a\n * Server Component, since props cross the server/client boundary.\n */\ninterface PipesFilterCriteria {\n  /** Render only integrations whose `slug` is in this list. */\n  slugs?: string[];\n  /** Render only integrations whose `integrationType` is in this list. */\n  integrationTypes?: string[];\n  /** Render only integrations that advertise at least one of these methods. */\n  authMethods?: PipesAuthMethod[];\n}\n\n/**\n * Narrows which enabled integrations the widget renders. Either a predicate\n * (use from a Client Component host) or serializable criteria (use from a\n * Server Component host, where props must cross the server/client boundary).\n */\ntype PipesFilter =\n  | PipesFilterCriteria\n  | ((integration: DataIntegration) => boolean);\n\ninterface PipesProps extends WidgetRootDomProps {\n  authToken: AuthToken;\n  /**\n   * Optional filter that narrows which enabled integrations the widget\n   * renders. The widget still fetches the full set of integrations the user's\n   * organization has enabled (plus any the user is still connected to so they\n   * can disconnect); this prop only controls which of those rows are shown.\n   *\n   * Accepts either form:\n   *\n   * - **Serializable criteria** (`{ slugs, integrationTypes, authMethods }`),\n   *   ANDed together. This is the form to use when `<Pipes>` is embedded in a\n   *   Server Component (the documented token-minting pattern), because props\n   *   must be serializable across the server/client boundary and plain objects\n   *   survive it. e.g. `filter={{ slugs: [\"google-drive\"] }}`.\n   *\n   * - **A predicate** `((integration) => boolean)` for arbitrary filtering by any\n   *   field on the integration (`authMethods`, `integrationType`,\n   *   `installation.state`, etc.). A function is **not serializable across the\n   *   server/client boundary**: the predicate must be defined inside client\n   *   code and must never be passed in from a Server Component. Concretely, a\n   *   host using the App Router server-component pattern that needs a predicate\n   *   must author its own `\"use client\"` wrapper that *owns* the predicate and\n   *   receives only serializable props (e.g. `authToken`) from the server page.\n   *\n   * Undefined renders every enabled integration (the default).\n   */\n  filter?: PipesFilter;\n}\n\nconst Pipes: React.FC<PipesProps> = ({ authToken, ...domProps }) => {\n  const baseUrl = useWorkOsApiUrl();\n\n  return (\n    <ErrorBoundary\n      fallbackRender={({ error }) => <PipesError {...domProps} error={error} />}\n    >\n      <ApiProvider widgetType=\"pipes\" authToken={authToken} baseUrl={baseUrl}>\n        <PipesImpl {...domProps} />\n      </ApiProvider>\n    </ErrorBoundary>\n  );\n};\n\n/**\n * Evaluates serializable {@link PipesFilterCriteria} against an integration.\n * Provided criteria are ANDed; an integration with no declared `authMethods`\n * is treated as `oauth` (matching the widget's connect-method defaults).\n */\nfunction matchesPipesFilterCriteria(\n  integration: DataIntegration,\n  criteria: PipesFilterCriteria,\n): boolean {\n  if (criteria.slugs && !criteria.slugs.includes(integration.slug)) {\n    return false;\n  }\n  if (\n    criteria.integrationTypes &&\n    !criteria.integrationTypes.includes(integration.integrationType)\n  ) {\n    return false;\n  }\n  if (criteria.authMethods) {\n    const methods = integration.authMethods ?? [\"oauth\"];\n    if (!criteria.authMethods.some((method) => methods.includes(method))) {\n      return false;\n    }\n  }\n  return true;\n}\n\nconst PipesImpl = (props: Omit<PipesProps, \"authToken\">) => {\n  const isHydrated = useIsHydrated();\n  const integrations = useMyDataIntegrations();\n\n  if (!isHydrated || integrations.isLoading) {\n    return <PipesLoading count={6} {...props} />;\n  }\n\n  if (integrations.isError) {\n    return <PipesError error={integrations.error} {...props} />;\n  }\n\n  if (integrations.isSuccess) {\n    const all = integrations.data.data;\n    const { filter } = props;\n    const visible = filter\n      ? typeof filter === \"function\"\n        ? all.filter(filter)\n        : all.filter((integration) =>\n            matchesPipesFilterCriteria(integration, filter),\n          )\n      : all;\n\n    return <PipesPresentational integrations={visible} {...props} />;\n  }\n\n  return <PipesError error={integrations.error} {...props} />;\n};\n\nexport type {\n  PipesProps,\n  PipesFilter,\n  PipesFilterCriteria,\n  PipesAuthMethod,\n  PipesLoadingProps,\n  PipesErrorProps,\n};\nexport { Pipes, PipesLoading, PipesError };\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA2EqC;AA1ErC,0BAAuC;AACvC,6BAAgC;AAChC,mBAIO;AAEP,sBAAuD;AACvD,6BAA8B;AAC9B,4BAA8B;AA2D9B,MAAM,QAA8B,CAAC,EAAE,WAAW,GAAG,SAAS,MAAM;AAClE,QAAM,cAAU,wCAAgB;AAEhC,SACE;AAAA,IAAC;AAAA;AAAA,MACC,gBAAgB,CAAC,EAAE,MAAM,MAAM,4CAAC,2BAAY,GAAG,UAAU,OAAc;AAAA,MAEvE,sDAAC,mCAAY,YAAW,SAAQ,WAAsB,SACpD,sDAAC,aAAW,GAAG,UAAU,GAC3B;AAAA;AAAA,EACF;AAEJ;AAOA,SAAS,2BACP,aACA,UACS;AACT,MAAI,SAAS,SAAS,CAAC,SAAS,MAAM,SAAS,YAAY,IAAI,GAAG;AAChE,WAAO;AAAA,EACT;AACA,MACE,SAAS,oBACT,CAAC,SAAS,iBAAiB,SAAS,YAAY,eAAe,GAC/D;AACA,WAAO;AAAA,EACT;AACA,MAAI,SAAS,aAAa;AACxB,UAAM,UAAU,YAAY,eAAe,CAAC,OAAO;AACnD,QAAI,CAAC,SAAS,YAAY,KAAK,CAAC,WAAW,QAAQ,SAAS,MAAM,CAAC,GAAG;AACpE,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,MAAM,YAAY,CAAC,UAAyC;AAC1D,QAAM,iBAAa,sCAAc;AACjC,QAAM,mBAAe,uCAAsB;AAE3C,MAAI,CAAC,cAAc,aAAa,WAAW;AACzC,WAAO,4CAAC,6BAAa,OAAO,GAAI,GAAG,OAAO;AAAA,EAC5C;AAEA,MAAI,aAAa,SAAS;AACxB,WAAO,4CAAC,2BAAW,OAAO,aAAa,OAAQ,GAAG,OAAO;AAAA,EAC3D;AAEA,MAAI,aAAa,WAAW;AAC1B,UAAM,MAAM,aAAa,KAAK;AAC9B,UAAM,EAAE,OAAO,IAAI;AACnB,UAAM,UAAU,SACZ,OAAO,WAAW,aAChB,IAAI,OAAO,MAAM,IACjB,IAAI;AAAA,MAAO,CAAC,gBACV,2BAA2B,aAAa,MAAM;AAAA,IAChD,IACF;AAEJ,WAAO,4CAAC,aAAAA,OAAA,EAAoB,cAAc,SAAU,GAAG,OAAO;AAAA,EAChE;AAEA,SAAO,4CAAC,2BAAW,OAAO,aAAa,OAAQ,GAAG,OAAO;AAC3D;","names":["PipesPresentational"]}

package/dist/cjs/pipes.client.d.cts

@@ -1,8 +1,8 @@
 import { AuthToken } from './api/api-provider.cjs';
 export { PipesError, PipesErrorProps, PipesLoading, PipesLoadingProps } from './lib/pipes.cjs';
+import { DataIntegration } from './api/endpoint.cjs';
 import { WidgetRootDomProps } from './lib/utils.cjs';
 import 'react';
-import './api/endpoint.cjs';
 import '@tanstack/react-query';
 import './api/widgets-api-client.cjs';
 import './lib/elements.cjs';
@@ -17,9 +17,56 @@ import '@radix-ui/themes/components/dropdown-menu';
 import './select-KR89Qnvm.cjs';
 import '@radix-ui/themes/components/select';
 
+/** An auth method a provider advertises (defaults to `oauth` when unset). */
+type PipesAuthMethod = NonNullable<DataIntegration["authMethods"]>[number];
+/**
+ * Serializable criteria for narrowing which integrations render. All provided
+ * criteria are ANDed; an absent criterion is ignored. Safe to pass from a
+ * Server Component, since props cross the server/client boundary.
+ */
+interface PipesFilterCriteria {
+    /** Render only integrations whose `slug` is in this list. */
+    slugs?: string[];
+    /** Render only integrations whose `integrationType` is in this list. */
+    integrationTypes?: string[];
+    /** Render only integrations that advertise at least one of these methods. */
+    authMethods?: PipesAuthMethod[];
+}
+/**
+ * Narrows which enabled integrations the widget renders. Either a predicate
+ * (use from a Client Component host) or serializable criteria (use from a
+ * Server Component host, where props must cross the server/client boundary).
+ */
+type PipesFilter = PipesFilterCriteria | ((integration: DataIntegration) => boolean);
 interface PipesProps extends WidgetRootDomProps {
     authToken: AuthToken;
+    /**
+     * Optional filter that narrows which enabled integrations the widget
+     * renders. The widget still fetches the full set of integrations the user's
+     * organization has enabled (plus any the user is still connected to so they
+     * can disconnect); this prop only controls which of those rows are shown.
+     *
+     * Accepts either form:
+     *
+     * - **Serializable criteria** (`{ slugs, integrationTypes, authMethods }`),
+     *   ANDed together. This is the form to use when `<Pipes>` is embedded in a
+     *   Server Component (the documented token-minting pattern), because props
+     *   must be serializable across the server/client boundary and plain objects
+     *   survive it. e.g. `filter={{ slugs: ["google-drive"] }}`.
+     *
+     * - **A predicate** `((integration) => boolean)` for arbitrary filtering by any
+     *   field on the integration (`authMethods`, `integrationType`,
+     *   `installation.state`, etc.). A function is **not serializable across the
+     *   server/client boundary**: the predicate must be defined inside client
+     *   code and must never be passed in from a Server Component. Concretely, a
+     *   host using the App Router server-component pattern that needs a predicate
+     *   must author its own `"use client"` wrapper that *owns* the predicate and
+     *   receives only serializable props (e.g. `authToken`) from the server page.
+     *
+     * Undefined renders every enabled integration (the default).
+     */
+    filter?: PipesFilter;
 }
 declare const Pipes: React.FC<PipesProps>;
 
-export { Pipes, type PipesProps };
+export { Pipes, type PipesAuthMethod, type PipesFilter, type PipesFilterCriteria, type PipesProps };