@workos-inc/widgets 1.17.2-next.1788288181219 → 1.17.2

package/CHANGELOG.md

@@ -1,10 +1,10 @@
 # Changelog
 
-## 1.17.2-next.1788288181219
+## 1.17.2
 
 ### Patch Changes
 
-- Sync generated GraphQL SDK from upstream Client GraphQL schema.
+- Fix the change-email dialog getting stuck open in a loading state after a successful verification.
 
 ## 1.17.1
 

package/dist/cjs/api/client-graphql/generated.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/api/client-graphql/generated.ts"],"sourcesContent":["import type { GraphQLClient, RequestOptions } from \"graphql-request\";\nexport type Maybe<T> = T | null;\nexport type InputMaybe<T> = Maybe<T>;\nexport type Exact<T extends { [key: string]: unknown }> = {\n  [K in keyof T]: T[K];\n};\nexport type MakeOptional<T, K extends keyof T> = Omit<T, K> & {\n  [SubKey in K]?: Maybe<T[SubKey]>;\n};\nexport type MakeMaybe<T, K extends keyof T> = Omit<T, K> & {\n  [SubKey in K]: Maybe<T[SubKey]>;\n};\nexport type MakeEmpty<\n  T extends { [key: string]: unknown },\n  K extends keyof T,\n> = { [_ in K]?: never };\nexport type Incremental<T> =\n  | T\n  | {\n      [P in keyof T]?: P extends \" $fragmentName\" | \"__typename\" ? T[P] : never;\n    };\ntype GraphQLClientRequestHeaders = RequestOptions[\"requestHeaders\"];\n/** All built-in and custom scalars, mapped to their actual values */\nexport type Scalars = {\n  ID: { input: string; output: string };\n  String: { input: string; output: string };\n  Boolean: { input: boolean; output: boolean };\n  Int: { input: number; output: number };\n  Float: { input: number; output: number };\n  /** A date-time string at UTC, such as 2019-12-03T09:54:33Z, compliant with the date-time format. */\n  DateTime: { input: string; output: string };\n  /** The `JSON` scalar type represents JSON values as specified by [ECMA-404](http://www.ecma-international.org/publications/files/ECMA-ST/ECMA-404.pdf). */\n  JSON: { input: any; output: any };\n};\n\n/** A short-lived link that starts an Admin Portal session for the token’s organization, scoped to a single setup flow. */\nexport type AdminPortalLink = {\n  __typename?: \"AdminPortalLink\";\n  /** When the link stops being redeemable. */\n  expiresAt: Scalars[\"DateTime\"][\"output\"];\n  /** The setup flow the link is scoped to. */\n  intent: AdminPortalLinkIntent;\n  /** The Admin Portal URL to send the user to. It carries a bearer capability, so treat it as a secret and redirect immediately. */\n  link: Scalars[\"String\"][\"output\"];\n};\n\n/** The Admin Portal setup flow a link is scoped to. */\nexport type AdminPortalLinkIntent = \"DomainVerification\" | \"LogStreams\" | \"Sso\";\n\n/** All other sessions were revoked successfully. */\nexport type AllSessionsRevoked = {\n  __typename?: \"AllSessionsRevoked\";\n  success: Scalars[\"Boolean\"][\"output\"];\n};\n\nexport type AssignPermissionToRoleInput = {\n  /** The slug of the permission to assign. */\n  permissionSlug: Scalars[\"String\"][\"input\"];\n  /** The ID of the role to assign the permission to. */\n  roleId: Scalars[\"ID\"][\"input\"];\n};\n\nexport type AuditEvent = {\n  __typename?: \"AuditEvent\";\n  action: Scalars[\"String\"][\"output\"];\n  actor: AuditEventActor;\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  data: Scalars[\"JSON\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  occurredAt: Scalars[\"DateTime\"][\"output\"];\n  targets: Array<Scalars[\"String\"][\"output\"]>;\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\nexport type AuditEventActor = {\n  __typename?: \"AuditEventActor\";\n  id: Scalars[\"String\"][\"output\"];\n  name?: Maybe<Scalars[\"String\"][\"output\"]>;\n  type: Scalars[\"String\"][\"output\"];\n};\n\nexport type AuditEventFilterInput = {\n  actions?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  actorIds?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  actorNames?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  rangeEnd: Scalars[\"DateTime\"][\"input\"];\n  rangeStart: Scalars[\"DateTime\"][\"input\"];\n  search?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  targetIds?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  targetTypes?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n};\n\nexport type AuditEventList = {\n  __typename?: \"AuditEventList\";\n  data: Array<AuditEvent>;\n  listMetadata: ListMetadata;\n};\n\nexport type AuditLogExport = {\n  __typename?: \"AuditLogExport\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  state: AuditLogExportState;\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n  /** A signed URL to the CSV file. Only defined once the export is ready. */\n  url?: Maybe<Scalars[\"String\"][\"output\"]>;\n};\n\nexport type AuditLogExportState = \"Error\" | \"Expired\" | \"Pending\" | \"Ready\";\n\n/** The audit log stream destination configured for the token's organization. Exposes status metadata only; destination settings and credentials are never included. */\nexport type AuditLogStream = {\n  __typename?: \"AuditLogStream\";\n  auditLogTrailId: Scalars[\"ID\"][\"output\"];\n  /** The most recent delivery error message, if any. */\n  errorMessage?: Maybe<Scalars[\"String\"][\"output\"]>;\n  id: Scalars[\"ID\"][\"output\"];\n  /** The ID of the last audit log event delivered to the stream. */\n  lastSyncedEventId?: Maybe<Scalars[\"String\"][\"output\"]>;\n  state: AuditLogStreamState;\n  type: AuditLogStreamType;\n};\n\n/** The delivery state of an audit log stream. */\nexport type AuditLogStreamState = \"Active\" | \"Error\" | \"Inactive\" | \"Invalid\";\n\n/** The destination provider audit log events are streamed to. */\nexport type AuditLogStreamType =\n  | \"AzureSentinel\"\n  | \"Datadog\"\n  | \"GenericHttps\"\n  | \"GoogleCloudStorage\"\n  | \"S3\"\n  | \"Snowflake\"\n  | \"Splunk\";\n\n/** The authentication methods the environment allows, and the password policy it enforces. Distinct from what the authenticated user has set up, which lives on `me`. */\nexport type AuthenticationSettings = {\n  __typename?: \"AuthenticationSettings\";\n  /** Whether multi-factor authentication is available in this environment. When `false`, TOTP enrollment should not be offered. */\n  mfaEnabled: Scalars[\"Boolean\"][\"output\"];\n  /** Whether multi-factor authentication is mandatory for every user in this environment. */\n  mfaRequired: Scalars[\"Boolean\"][\"output\"];\n  /** Whether users may authenticate with a passkey. */\n  passkeyAuthEnabled: Scalars[\"Boolean\"][\"output\"];\n  /** Whether users may authenticate with a password. When `false`, `createPassword` and `updatePassword` should not be offered. */\n  passwordAuthEnabled: Scalars[\"Boolean\"][\"output\"];\n  passwordPolicy: PasswordPolicy;\n};\n\n/** Input for confirming an email change with the verification code. */\nexport type ConfirmEmailChangeInput = {\n  /** The verification code sent to the new email address. */\n  code: Scalars[\"String\"][\"input\"];\n  /** The elevated access token from a successful `verifyCurrentEmail` call. */\n  elevatedAccessToken: Scalars[\"String\"][\"input\"];\n};\n\nexport type ConfirmEmailChangeResult =\n  | EmailChangeCodeExpired\n  | EmailChangeCodeIncorrect\n  | EmailChangeCodePreviouslyUsed\n  | EmailChangeConfirmed\n  | EmailChangeTooManyAttempts\n  | EmailManagedByProvider\n  | EmailNotAvailable\n  | IdentityVerificationExpired\n  | IdentityVerificationInvalid\n  | InvalidEmail\n  | NoPendingEmailChange;\n\nexport type ConnectDataProviderResult =\n  | DataProviderAuthMethodUnsupported\n  | DataProviderConfigInvalid\n  | DataProviderConnected\n  | DataProviderConnectionAuthMethodConflict;\n\nexport type ConnectDataProviderWithClientCredentialsInput = {\n  /** The OAuth client ID issued by the data provider. Only data providers whose `authMethods` include `client_credentials` can be connected this way. */\n  clientId: Scalars[\"String\"][\"input\"];\n  /** The OAuth client secret issued by the data provider. Write-only: it is stored encrypted and never returned. */\n  clientSecret: Scalars[\"String\"][\"input\"];\n  /** Values for the provider’s connection configuration fields. */\n  config?: InputMaybe<Array<DataProviderConfigEntryInput>>;\n  /** The data provider to connect the authenticated user to. */\n  dataProviderId: Scalars[\"ID\"][\"input\"];\n};\n\n/** An OAuth profile linked to the authenticated user. */\nexport type ConnectedAccount = {\n  __typename?: \"ConnectedAccount\";\n  email?: Maybe<Scalars[\"String\"][\"output\"]>;\n  firstName?: Maybe<Scalars[\"String\"][\"output\"]>;\n  id: Scalars[\"ID\"][\"output\"];\n  lastLoginAt?: Maybe<Scalars[\"DateTime\"][\"output\"]>;\n  lastName?: Maybe<Scalars[\"String\"][\"output\"]>;\n  profilePictureUrl?: Maybe<Scalars[\"String\"][\"output\"]>;\n  provider: OAuthProvider;\n};\n\n/** An SSO connection belonging to the organization. Mirrors the SSO Connection exposed by the REST connections API. */\nexport type Connection = {\n  __typename?: \"Connection\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  /** A human-readable name for the connection. */\n  name: Scalars[\"String\"][\"output\"];\n  /** The organization the connection belongs to. */\n  organizationId?: Maybe<Scalars[\"ID\"][\"output\"]>;\n  /** Whether the connection has completed its IdP setup and can authenticate users (equivalent to an `Active` state). */\n  setupComplete: Scalars[\"Boolean\"][\"output\"];\n  /** The connection's IdP setup status. `Active` indicates setup is complete; other states indicate where the connection is in its setup flow. */\n  state: ConnectionState;\n  /** The identity provider type of the connection. */\n  type: ConnectionType;\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** Enum represents the state of the connection. */\nexport type ConnectionState = \"Active\" | \"Deleting\" | \"Inactive\" | \"Validating\";\n\n/** Enum represents the type of connection. */\nexport type ConnectionType =\n  | \"ADFSSAML\"\n  | \"AdpOidc\"\n  | \"AppleOAuth\"\n  | \"Auth0Migration\"\n  | \"Auth0SAML\"\n  | \"AzureSAML\"\n  | \"BitbucketOAuth\"\n  | \"CasSAML\"\n  | \"ClassLinkSAML\"\n  | \"CleverOIDC\"\n  | \"CloudflareSAML\"\n  | \"CyberArkSAML\"\n  | \"DiscordOAuth\"\n  | \"DuoSAML\"\n  | \"EntraIdOIDC\"\n  | \"GenericOIDC\"\n  | \"GenericSAML\"\n  | \"GitLabOAuth\"\n  | \"GithubOAuth\"\n  | \"GoogleOAuth\"\n  | \"GoogleOIDC\"\n  | \"GoogleSAML\"\n  | \"GrokOAuth\"\n  | \"IntuitOAuth\"\n  | \"JumpCloudSAML\"\n  | \"KeycloakSAML\"\n  | \"LastPassSAML\"\n  | \"LinkedInOAuth\"\n  | \"LoginGovOidc\"\n  | \"MagicLink\"\n  | \"MicrosoftOAuth\"\n  | \"MiniOrangeSAML\"\n  | \"NetIqSAML\"\n  | \"OktaOIDC\"\n  | \"OktaSAML\"\n  | \"OneLoginSAML\"\n  | \"OracleSAML\"\n  | \"PingFederateSAML\"\n  | \"PingOneSAML\"\n  | \"RipplingSAML\"\n  | \"SalesforceOAuth\"\n  | \"SalesforceSAML\"\n  | \"ShibbolethGenericSAML\"\n  | \"ShibbolethSAML\"\n  | \"SimpleSamlPhpSAML\"\n  | \"SlackOAuth\"\n  | \"TestIdp\"\n  | \"VMwareSAML\"\n  | \"VercelMarketplaceOAuth\"\n  | \"VercelOAuth\"\n  | \"XOAuth\"\n  | \"XeroOAuth\";\n\nexport type CreateAuditLogExportInput = {\n  actions?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  actorIds?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  actorNames?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  rangeEnd: Scalars[\"DateTime\"][\"input\"];\n  rangeStart: Scalars[\"DateTime\"][\"input\"];\n  targetIds?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  targetTypes?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n};\n\nexport type CreateAuditLogExportResult =\n  | AuditLogExport\n  | InvalidAuditLogExportDateRange\n  | NoAuditEventsFound;\n\nexport type CreateDataProviderAuthorizationInput = {\n  /** Values for the provider’s connect-time configuration fields. Omit when the provider declares none. */\n  config?: InputMaybe<Array<DataProviderConfigEntryInput>>;\n  /** The data provider to authorize for the authenticated user. It must be one the user can connect (`dataProviders`). */\n  dataProviderId: Scalars[\"ID\"][\"input\"];\n  /** Request a confirmation step at the end of the flow, returning a `handoffToken` the client must complete. Defaults to false. */\n  requireHandoff?: InputMaybe<Scalars[\"Boolean\"][\"input\"]>;\n};\n\nexport type CreateDataProviderAuthorizationResult =\n  | DataProviderAuthorization\n  | DataProviderAuthorizationUnavailable\n  | DataProviderConfigInvalid;\n\nexport type CreateDataProviderConnectionInput = {\n  /** The API key issued by the data provider. Only data providers whose `authMethods` include `api_key` can be connected this way; OAuth providers are connected through the widget's authorization flow. */\n  apiKey: Scalars[\"String\"][\"input\"];\n  /** The data provider to connect the authenticated user to. */\n  dataProviderId: Scalars[\"ID\"][\"input\"];\n};\n\nexport type CreateOrganizationDataProviderAuthorizationInput = {\n  /** Values for the provider’s connect-time configuration fields. Omit when the provider declares none. */\n  config?: InputMaybe<Array<DataProviderConfigEntryInput>>;\n  /** The organization-owned data provider to authorize (`organizationDataProviders`). */\n  dataProviderId: Scalars[\"ID\"][\"input\"];\n};\n\n/** Input for setting a password on an account that does not yet have one (e.g. signed up via OAuth). */\nexport type CreatePasswordInput = {\n  /** An elevated access token obtained by verifying the current email address. Required to prove recent re-authentication. */\n  elevatedAccessToken: Scalars[\"String\"][\"input\"];\n  /** The password to set. Must satisfy the environment password policy. */\n  password: Scalars[\"String\"][\"input\"];\n};\n\nexport type CreatePasswordResult =\n  | ElevatedAccessTokenExpired\n  | ElevatedAccessTokenInvalid\n  | PasswordCreated\n  | PasswordPolicyViolation\n  | UserAlreadyHasPassword;\n\nexport type CreateRoleInput = {\n  /** Optional human-readable description of the role. */\n  description?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  /** Human-readable name for the role. */\n  name: Scalars[\"String\"][\"input\"];\n  /** Slugs of the permissions granted to the role. */\n  permissions?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  /** Unique slug identifying the role. Generated from the name when omitted. */\n  slug?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n};\n\nexport type CreateSsoConnectionInput = {\n  /** A human-readable name for the connection. Defaults to the organization's name. */\n  name?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  /** The identity provider type of the connection to create. */\n  type: ConnectionType;\n};\n\n/** The current email was verified successfully. */\nexport type CurrentEmailVerified = {\n  __typename?: \"CurrentEmailVerified\";\n  /** The elevated access token to pass to `sendEmailChange` and `confirmEmailChange`. */\n  elevatedAccessToken: Scalars[\"String\"][\"output\"];\n  /** When the elevated access token expires (ISO 8601). */\n  expiresAt: Scalars[\"String\"][\"output\"];\n};\n\n/** Daily verification email quota exceeded. */\nexport type DailyEmailQuotaExceeded = {\n  __typename?: \"DailyEmailQuotaExceeded\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** A third-party data provider configured for the current environment. */\nexport type DataProvider = {\n  __typename?: \"DataProvider\";\n  /** How accounts authenticate with this data provider. */\n  authMethods: Array<Scalars[\"String\"][\"output\"]>;\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  description?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** Whether the data provider is enabled in the environment. */\n  enabled: Scalars[\"Boolean\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  /** The provider type this data provider was created from. */\n  integrationType: Scalars[\"String\"][\"output\"];\n  /** The display name of the data provider. */\n  name: Scalars[\"String\"][\"output\"];\n  /** The OAuth scopes configured for the data provider. `null` when the provider's default scopes are used. */\n  scopes?: Maybe<Array<Scalars[\"String\"][\"output\"]>>;\n  /** The slug of the data provider. */\n  slug: Scalars[\"String\"][\"output\"];\n  /** The configuration state of the data provider: `valid`, `invalid`, or `requested`. */\n  state: Scalars[\"String\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** The data provider cannot be connected the requested way — for example client credentials for a provider that only supports OAuth. */\nexport type DataProviderAuthMethodUnsupported = {\n  __typename?: \"DataProviderAuthMethodUnsupported\";\n  /** The unsupported auth method that was requested. */\n  authMethod: Scalars[\"String\"][\"output\"];\n  /** The auth methods the data provider does support. */\n  supportedAuthMethods: Array<Scalars[\"String\"][\"output\"]>;\n};\n\n/** A started authorization: the URL to open and the state to poll while the user completes it. */\nexport type DataProviderAuthorization = {\n  __typename?: \"DataProviderAuthorization\";\n  /** Present when the flow ends on a confirmation step the client must complete instead of finishing silently. Always present for organization-scoped authorization. */\n  handoffToken?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** One-time token the interstitial URL is keyed by. Retained so a client can correlate the popup it opened. */\n  redirectToken: Scalars[\"String\"][\"output\"];\n  /** The OAuth `state` for this attempt. Poll `dataProviderAuthorizationStatus` with it to observe completion. */\n  state: Scalars[\"String\"][\"output\"];\n  /** The WorkOS interstitial URL to open in the popup. It redirects to the provider once, then expires. */\n  url: Scalars[\"String\"][\"output\"];\n};\n\n/** Whether an authorization attempt is still in progress. */\nexport type DataProviderAuthorizationStatus = {\n  __typename?: \"DataProviderAuthorizationStatus\";\n  /** True while the attempt is outstanding. It becomes false once the provider callback has been handled or the attempt expired, so a client that sees false reloads the connection to learn the outcome. */\n  connecting: Scalars[\"Boolean\"][\"output\"];\n  /** The `state` that was polled. */\n  state: Scalars[\"String\"][\"output\"];\n};\n\n/** The data provider cannot start an authorization right now — most often because the organization has not supplied its own OAuth credentials yet. */\nexport type DataProviderAuthorizationUnavailable = {\n  __typename?: \"DataProviderAuthorizationUnavailable\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** A non-secret configuration value set on a data provider. */\nexport type DataProviderConfigEntry = {\n  __typename?: \"DataProviderConfigEntry\";\n  /** The configuration field declared by the provider. */\n  name: Scalars[\"String\"][\"output\"];\n  /** The value set for the field. */\n  value: Scalars[\"String\"][\"output\"];\n};\n\nexport type DataProviderConfigEntryInput = {\n  /** The configuration field declared by the provider. */\n  name: Scalars[\"String\"][\"input\"];\n  /** The value to set for the field. */\n  value: Scalars[\"String\"][\"input\"];\n};\n\n/** The supplied configuration does not satisfy the provider’s declared fields. */\nexport type DataProviderConfigInvalid = {\n  __typename?: \"DataProviderConfigInvalid\";\n  /** Which field is missing, unknown, or malformed. Names the field so a client can highlight it. */\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** A data provider's configuration for the token's organization, excluding secret values. */\nexport type DataProviderConfiguration = {\n  __typename?: \"DataProviderConfiguration\";\n  /** Every scope the organization may request. Only populated for providers where the organization brings its own OAuth credentials; empty otherwise. */\n  availableScopes: Array<Scalars[\"String\"][\"output\"]>;\n  config: Array<DataProviderConfigEntry>;\n  /** The data provider being configured. */\n  dataProviderId: Scalars[\"ID\"][\"output\"];\n  dataProviderSlug: Scalars[\"String\"][\"output\"];\n  /** Whether the organization's users can see and connect the data provider. */\n  enabled: Scalars[\"Boolean\"][\"output\"];\n  /** Whether the organization has supplied its own OAuth client credentials. Always false for a provider whose credentials the developer manages. The values themselves are never returned. */\n  hasCredentials: Scalars[\"Boolean\"][\"output\"];\n  /** The organization the configuration applies to. */\n  organizationId: Scalars[\"ID\"][\"output\"];\n  /** The scopes the organization requests, or null to use the provider defaults. */\n  scopes?: Maybe<Array<Scalars[\"String\"][\"output\"]>>;\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** The connection was created or its credentials were replaced. */\nexport type DataProviderConnected = {\n  __typename?: \"DataProviderConnected\";\n  connection: DataProviderConnection;\n};\n\n/** A connection between a data provider and the authenticated user's account. */\nexport type DataProviderConnection = {\n  __typename?: \"DataProviderConnection\";\n  /** How the connection authenticates: `oauth`, `api_key`, or `client_credentials`. */\n  authMethod: Scalars[\"String\"][\"output\"];\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  /** The data provider this connection was created for. */\n  dataProviderId: Scalars[\"ID\"][\"output\"];\n  /** The slug of the connected data provider. */\n  dataProviderSlug: Scalars[\"String\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  organizationId?: Maybe<Scalars[\"ID\"][\"output\"]>;\n  /** The OAuth scopes granted for this connection. */\n  scopes: Array<Scalars[\"String\"][\"output\"]>;\n  /** The status of the connection: `connected` or `needs_reauthorization`. */\n  state: Scalars[\"String\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n  userId?: Maybe<Scalars[\"ID\"][\"output\"]>;\n};\n\n/** The user already has a connection to this data provider that authenticates differently, so it must be disconnected first. */\nexport type DataProviderConnectionAuthMethodConflict = {\n  __typename?: \"DataProviderConnectionAuthMethodConflict\";\n  /** How the existing connection authenticates. */\n  existingAuthMethod: Scalars[\"String\"][\"output\"];\n};\n\nexport type DataProviderConnectionList = {\n  __typename?: \"DataProviderConnectionList\";\n  data: Array<DataProviderConnection>;\n  listMetadata: ListMetadata;\n};\n\nexport type DataProviderList = {\n  __typename?: \"DataProviderList\";\n  data: Array<DataProvider>;\n  listMetadata: ListMetadata;\n};\n\nexport type DeleteRoleInput = {\n  /** The ID of the role to delete. */\n  id: Scalars[\"ID\"][\"input\"];\n};\n\n/** A Directory Sync connection within the current environment. */\nexport type Directory = {\n  __typename?: \"Directory\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  externalKey: Scalars[\"String\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  name: Scalars[\"String\"][\"output\"];\n  organizationId: Scalars[\"ID\"][\"output\"];\n  /** The linking state of the directory. */\n  state: Scalars[\"String\"][\"output\"];\n  /** The provider type of the directory. */\n  type: Scalars[\"String\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** A group provisioned through a Directory Sync connection. */\nexport type DirectoryGroup = {\n  __typename?: \"DirectoryGroup\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  directoryId: Scalars[\"ID\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  /** The identifier of the group in the identity provider. */\n  idpId: Scalars[\"String\"][\"output\"];\n  name: Scalars[\"String\"][\"output\"];\n  organizationId: Scalars[\"ID\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\nexport type DirectoryGroupList = {\n  __typename?: \"DirectoryGroupList\";\n  data: Array<DirectoryGroup>;\n  listMetadata: ListMetadata;\n};\n\nexport type DirectoryList = {\n  __typename?: \"DirectoryList\";\n  data: Array<Directory>;\n  listMetadata: ListMetadata;\n};\n\n/** A user provisioned through a Directory Sync connection. */\nexport type DirectoryUser = {\n  __typename?: \"DirectoryUser\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  directoryId: Scalars[\"ID\"][\"output\"];\n  email?: Maybe<Scalars[\"String\"][\"output\"]>;\n  firstName?: Maybe<Scalars[\"String\"][\"output\"]>;\n  id: Scalars[\"ID\"][\"output\"];\n  /** The identifier of the user in the identity provider. */\n  idpId: Scalars[\"String\"][\"output\"];\n  lastName?: Maybe<Scalars[\"String\"][\"output\"]>;\n  organizationId: Scalars[\"ID\"][\"output\"];\n  /** The provisioning state of the directory user. */\n  state: Scalars[\"String\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n  username?: Maybe<Scalars[\"String\"][\"output\"]>;\n};\n\nexport type DirectoryUserList = {\n  __typename?: \"DirectoryUserList\";\n  data: Array<DirectoryUser>;\n  listMetadata: ListMetadata;\n};\n\n/** The DNS name server provider detected for a domain. */\nexport type DomainVerificationNameServer =\n  | \"AwsRoute53\"\n  | \"CloudFlare\"\n  | \"GoDaddy\"\n  | \"GoogleDomains\"\n  | \"Other\";\n\n/** The elevated access token has expired. The user must re-verify their identity. */\nexport type ElevatedAccessTokenExpired = {\n  __typename?: \"ElevatedAccessTokenExpired\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The elevated access token is invalid. */\nexport type ElevatedAccessTokenInvalid = {\n  __typename?: \"ElevatedAccessTokenInvalid\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The verification code has expired. */\nexport type EmailChangeCodeExpired = {\n  __typename?: \"EmailChangeCodeExpired\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The verification code is incorrect. */\nexport type EmailChangeCodeIncorrect = {\n  __typename?: \"EmailChangeCodeIncorrect\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The verification code has already been used. */\nexport type EmailChangeCodePreviouslyUsed = {\n  __typename?: \"EmailChangeCodePreviouslyUsed\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The email was changed successfully. */\nexport type EmailChangeConfirmed = {\n  __typename?: \"EmailChangeConfirmed\";\n  /** A fresh elevated access token for subsequent elevated operations. */\n  elevatedAccessToken: Scalars[\"String\"][\"output\"];\n  /** When the elevated access token expires (ISO 8601). */\n  expiresAt: Scalars[\"String\"][\"output\"];\n  user: User;\n};\n\n/** Email change is not available for this account. */\nexport type EmailChangeNotAvailable = {\n  __typename?: \"EmailChangeNotAvailable\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** A verification code was sent to the new email address. */\nexport type EmailChangeSent = {\n  __typename?: \"EmailChangeSent\";\n  /** When the verification code expires. */\n  expiresAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** Too many verification attempts. */\nexport type EmailChangeTooManyAttempts = {\n  __typename?: \"EmailChangeTooManyAttempts\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The email is managed by an identity provider and cannot be changed. */\nexport type EmailManagedByProvider = {\n  __typename?: \"EmailManagedByProvider\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The email address is not available. */\nexport type EmailNotAvailable = {\n  __typename?: \"EmailNotAvailable\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** Input for enrolling a new TOTP factor. */\nexport type EnrollTotpInput = {\n  /** An elevated access token obtained by verifying the current email address. Required to prove recent re-authentication. */\n  elevatedAccessToken: Scalars[\"String\"][\"input\"];\n};\n\nexport type EnrollTotpResult =\n  | ElevatedAccessTokenExpired\n  | ElevatedAccessTokenInvalid\n  | TotpAlreadyEnrolled\n  | TotpFactor;\n\n/** A feature flag defined in the project that owns the environment the token was issued for. Mirrors the Feature Flag exposed by the REST feature flags API. */\nexport type Flag = {\n  __typename?: \"Flag\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  /** The value returned for users and organizations that do not match any targeting rule in the environment the token was issued for. */\n  defaultValue: Scalars[\"Boolean\"][\"output\"];\n  description?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** Whether the feature flag is active in the environment the token was issued for. */\n  enabled: Scalars[\"Boolean\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  /** A descriptive name for the feature flag. */\n  name: Scalars[\"String\"][\"output\"];\n  /** A unique key used to reference the feature flag. */\n  slug: Scalars[\"String\"][\"output\"];\n  /** Labels assigned to the feature flag. */\n  tags: Array<Scalars[\"String\"][\"output\"]>;\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\nexport type FlagList = {\n  __typename?: \"FlagList\";\n  data: Array<Flag>;\n  listMetadata: ListMetadata;\n};\n\n/** The identity verification has expired. Please verify your current email again. */\nexport type IdentityVerificationExpired = {\n  __typename?: \"IdentityVerificationExpired\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The identity verification is no longer valid. */\nexport type IdentityVerificationInvalid = {\n  __typename?: \"IdentityVerificationInvalid\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The provided current password does not match the existing password. */\nexport type IncorrectPassword = {\n  __typename?: \"IncorrectPassword\";\n  _placeholder: Scalars[\"Boolean\"][\"output\"];\n};\n\nexport type InvalidAuditLogExportDateRange = {\n  __typename?: \"InvalidAuditLogExportDateRange\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The provided email address is invalid. */\nexport type InvalidEmail = {\n  __typename?: \"InvalidEmail\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The requested invitation expiry is outside the allowed range (1–30 days). */\nexport type InvalidInvitationExpiry = {\n  __typename?: \"InvalidInvitationExpiry\";\n  /** Placeholder field to allow an empty @ObjectType. */\n  _placeholder?: Maybe<Scalars[\"Boolean\"][\"output\"]>;\n};\n\n/** The provided email address is not valid. */\nexport type InvalidInviteeEmail = {\n  __typename?: \"InvalidInviteeEmail\";\n  email: Scalars[\"String\"][\"output\"];\n};\n\n/** The requested role is not valid for this organization. */\nexport type InvalidInviteeRole = {\n  __typename?: \"InvalidInviteeRole\";\n  roleSlug?: Maybe<Scalars[\"String\"][\"output\"]>;\n};\n\n/** The provided locale is not a valid BCP 47 tag. */\nexport type InvalidLocale = {\n  __typename?: \"InvalidLocale\";\n  _placeholder: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** No pending invitation exists for this user in this organization. */\nexport type InvitationNotFound = {\n  __typename?: \"InvitationNotFound\";\n  userId: Scalars[\"ID\"][\"output\"];\n};\n\n/** The invitation is not pending (already accepted, expired, or revoked) and cannot be revoked. */\nexport type InvitationNotPending = {\n  __typename?: \"InvitationNotPending\";\n  userId: Scalars[\"ID\"][\"output\"];\n};\n\n/** The invitation was resent successfully. */\nexport type InvitationResent = {\n  __typename?: \"InvitationResent\";\n  invitation: OrganizationInvitation;\n};\n\n/** The invitation was revoked. */\nexport type InvitationRevoked = {\n  __typename?: \"InvitationRevoked\";\n  invitation: OrganizationInvitation;\n};\n\nexport type InviteUserInput = {\n  /** The email address to invite. */\n  email: Scalars[\"String\"][\"input\"];\n  /** Number of days until the invitation expires. Defaults to the environment setting when omitted. */\n  expiresInDays?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  /** Slug of the role to grant on acceptance. Defaults to the organization default role when omitted. */\n  roleSlug?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n};\n\nexport type InviteUserResult =\n  | InvalidInvitationExpiry\n  | InvalidInviteeEmail\n  | InvalidInviteeRole\n  | InviteeAlreadyInvited\n  | InviteeAlreadyMember\n  | InviteeEmailNotDeliverable\n  | OrganizationBlockedFromSendingInvites\n  | UserInvited;\n\n/** The user has already accepted their invitation and is an active member. */\nexport type InviteeAlreadyAccepted = {\n  __typename?: \"InviteeAlreadyAccepted\";\n  userId: Scalars[\"ID\"][\"output\"];\n};\n\n/** This email already has a pending invitation. */\nexport type InviteeAlreadyInvited = {\n  __typename?: \"InviteeAlreadyInvited\";\n  email: Scalars[\"String\"][\"output\"];\n};\n\n/** A user with this email is already a member of the organization. */\nexport type InviteeAlreadyMember = {\n  __typename?: \"InviteeAlreadyMember\";\n  email: Scalars[\"String\"][\"output\"];\n};\n\n/** The invitee's email domain has no mail servers, so the invitation email cannot be delivered. */\nexport type InviteeEmailNotDeliverable = {\n  __typename?: \"InviteeEmailNotDeliverable\";\n  email: Scalars[\"String\"][\"output\"];\n};\n\nexport type ListMetadata = {\n  __typename?: \"ListMetadata\";\n  after?: Maybe<Scalars[\"String\"][\"output\"]>;\n  before?: Maybe<Scalars[\"String\"][\"output\"]>;\n};\n\n/** The member is provisioned by a directory and cannot be removed. */\nexport type MemberIsManagedByDirectory = {\n  __typename?: \"MemberIsManagedByDirectory\";\n  /** The user ID of the directory-managed member. */\n  userId: Scalars[\"ID\"][\"output\"];\n};\n\n/** No active member was found for the given user in the organization. */\nexport type MemberNotFound = {\n  __typename?: \"MemberNotFound\";\n  /** The user ID that did not resolve to a member. */\n  userId: Scalars[\"ID\"][\"output\"];\n};\n\n/** The member was removed from the organization. */\nexport type MemberRemoved = {\n  __typename?: \"MemberRemoved\";\n  /** The user ID of the removed member. */\n  userId: Scalars[\"ID\"][\"output\"];\n};\n\n/** The member's role was updated. */\nexport type MemberRoleUpdated = {\n  __typename?: \"MemberRoleUpdated\";\n  member: OrganizationMember;\n};\n\n/** All TOTP factors were removed successfully. */\nexport type MfaFactorRemoved = {\n  __typename?: \"MfaFactorRemoved\";\n  success: Scalars[\"Boolean\"][\"output\"];\n};\n\nexport type Mutation = {\n  __typename?: \"Mutation\";\n  /** Grant a permission to a role belonging to the organization the token was issued for. */\n  assignPermissionToRole: Role;\n  /** Confirms an email change using the verification code sent to the new email address. Requires an elevated access token from `verifyCurrentEmail`. */\n  confirmEmailChange: ConfirmEmailChangeResult;\n  /** Connect the authenticated user to a data provider with OAuth client credentials the user supplies. Replaces the credentials when the user already has a client-credentials connection to the data provider, so this is both the connect and the reconnect path. The credentials are stored encrypted and never returned. */\n  connectDataProviderWithClientCredentials: ConnectDataProviderResult;\n  /** Mint a short-lived link that starts an Admin Portal session for the token's organization, scoped to a single setup flow. */\n  createAdminPortalLink: AdminPortalLink;\n  createAuditLogExport: CreateAuditLogExportResult;\n  /** Start an OAuth authorization connecting the authenticated user to a data provider. Returns the URL to open in a popup and the `state` to poll with `dataProviderAuthorizationStatus`. Re-authorizing a provider the user is already connected to replaces that connection's credentials once the flow completes, so this is also the reconnect path. */\n  createDataProviderAuthorization: CreateDataProviderAuthorizationResult;\n  /** Connect the authenticated user to a data provider with an API key the user supplies. Replaces the API key when the user already has an API-key connection to the data provider. */\n  createDataProviderConnection: DataProviderConnection;\n  /** Start an OAuth authorization connecting the token's organization to an organization-owned data provider, producing one connection shared by every member. A handoff is always required: the member completing the flow must confirm it explicitly because the resulting connection is not their own. */\n  createOrganizationDataProviderAuthorization: CreateDataProviderAuthorizationResult;\n  /** Add a domain to the token's organization and begin DNS verification. */\n  createOrganizationDomain: OrganizationDomain;\n  /** Set a password for the authenticated user who does not yet have one (e.g. signed up via OAuth). Validates against the environment password policy. */\n  createPassword: CreatePasswordResult;\n  /** Create a role for the organization the token was issued for. */\n  createRole: Role;\n  /** Create an SSO connection for the token’s organization. */\n  createSsoConnection: Connection;\n  /** Disconnect one of the authenticated user's data provider connections, revoking the stored credentials. */\n  deleteDataProviderConnection: Scalars[\"ID\"][\"output\"];\n  /** Delete a domain belonging to the token's organization and return it. */\n  deleteOrganizationDomain: OrganizationDomain;\n  /** Delete a role belonging to the organization the token was issued for. */\n  deleteRole: RoleDeleted;\n  /** Delete an SSO connection belonging to the token’s organization. */\n  deleteSsoConnection: Scalars[\"ID\"][\"output\"];\n  /** Create a TOTP factor and return the secret and QR URI for the user to scan. This is step 1 of TOTP enrollment. */\n  enrollTotp: EnrollTotpResult;\n  /** Invite a user to the organization the token was issued for, assigning a role and sending the invitation email. */\n  inviteUser: InviteUserResult;\n  /** Remove a member from the organization the token was issued for. */\n  removeMember: RemoveMemberResult;\n  /** Delete all TOTP factors for the authenticated user, effectively resetting MFA. */\n  removeMfaFactor: RemoveMfaFactorResult;\n  /** Resend a pending, expired, or revoked invitation for the organization the token was issued for. If the original invitation has expired or been revoked, a new invitation is created with the same role. */\n  resendInvitation: ResendInvitationResult;\n  /** Restart verification for a domain belonging to the token's organization. */\n  reverifyOrganizationDomain: OrganizationDomain;\n  /** Revokes all active sessions for the authenticated user except the current one. */\n  revokeAllSessions: RevokeAllSessionsResult;\n  /** Revoke a pending invitation for the organization the token was issued for. */\n  revokeInvitation: RevokeInvitationResult;\n  /** Revokes a specific session by ID. */\n  revokeSession: RevokeSessionResult;\n  /** Sends a verification code to the new email address. Requires an elevated access token from `verifyCurrentEmail`. The user must confirm with the code via `confirmEmailChange`. */\n  sendEmailChange: SendEmailChangeResult;\n  /** Sends a verification code to the user's current email address to prove ownership before changing email. */\n  sendVerificationCode: SendVerificationCodeResult;\n  /** Write a data provider's configuration for the token's organization: whether the organization's members can connect it, the scopes it requests, the organization's own OAuth client credentials, and any non-secret configuration values the provider declares. Fields left out are unchanged. Supersedes `setDataProviderEnabled` for anything beyond toggling `enabled`. */\n  setDataProviderConfiguration: SetDataProviderConfigurationResult;\n  /** Enable or disable a data provider for the token's organization. Disabling it hides the data provider from the organization's users and stops new connections; existing connections stay readable so they can be disconnected. */\n  setDataProviderEnabled: DataProvider;\n  /** Update an organization member's roles within the organization the token was issued for. When multiple roles are enabled, all provided role slugs are assigned; otherwise only the first is used. */\n  updateMemberRole: UpdateMemberRoleResult;\n  /** Change the password for the authenticated user. Requires the current password for verification and validates the new password against the environment password policy. */\n  updatePassword: UpdatePasswordResult;\n  /** Updates the authenticated user's profile (first name, last name, locale). */\n  updateProfile: UpdateProfileResult;\n  /** Update a role belonging to the organization the token was issued for. */\n  updateRole: Role;\n  /** Update an SSO connection belonging to the token’s organization. */\n  updateSsoConnection: Connection;\n  /** Verifies the code sent to the current email address. Returns an elevated access token required for `sendEmailChange` and `confirmEmailChange`. */\n  verifyCurrentEmail: VerifyCurrentEmailResult;\n  /** Confirm TOTP enrollment by verifying a code from the authenticator app. Marks the factor as verified. */\n  verifyTotp: VerifyTotpResult;\n};\n\nexport type MutationAssignPermissionToRoleArgs = {\n  input: AssignPermissionToRoleInput;\n};\n\nexport type MutationConfirmEmailChangeArgs = {\n  input: ConfirmEmailChangeInput;\n};\n\nexport type MutationConnectDataProviderWithClientCredentialsArgs = {\n  input: ConnectDataProviderWithClientCredentialsInput;\n};\n\nexport type MutationCreateAdminPortalLinkArgs = {\n  intent: AdminPortalLinkIntent;\n};\n\nexport type MutationCreateAuditLogExportArgs = {\n  input: CreateAuditLogExportInput;\n};\n\nexport type MutationCreateDataProviderAuthorizationArgs = {\n  input: CreateDataProviderAuthorizationInput;\n};\n\nexport type MutationCreateDataProviderConnectionArgs = {\n  input: CreateDataProviderConnectionInput;\n};\n\nexport type MutationCreateOrganizationDataProviderAuthorizationArgs = {\n  input: CreateOrganizationDataProviderAuthorizationInput;\n};\n\nexport type MutationCreateOrganizationDomainArgs = {\n  domain: Scalars[\"String\"][\"input\"];\n};\n\nexport type MutationCreatePasswordArgs = {\n  input: CreatePasswordInput;\n};\n\nexport type MutationCreateRoleArgs = {\n  input: CreateRoleInput;\n};\n\nexport type MutationCreateSsoConnectionArgs = {\n  input: CreateSsoConnectionInput;\n};\n\nexport type MutationDeleteDataProviderConnectionArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type MutationDeleteOrganizationDomainArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type MutationDeleteRoleArgs = {\n  input: DeleteRoleInput;\n};\n\nexport type MutationDeleteSsoConnectionArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type MutationEnrollTotpArgs = {\n  input: EnrollTotpInput;\n};\n\nexport type MutationInviteUserArgs = {\n  input: InviteUserInput;\n};\n\nexport type MutationRemoveMemberArgs = {\n  input: RemoveMemberInput;\n};\n\nexport type MutationRemoveMfaFactorArgs = {\n  input: RemoveMfaFactorInput;\n};\n\nexport type MutationResendInvitationArgs = {\n  input: ResendInvitationInput;\n};\n\nexport type MutationReverifyOrganizationDomainArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type MutationRevokeInvitationArgs = {\n  input: RevokeInvitationInput;\n};\n\nexport type MutationRevokeSessionArgs = {\n  input: RevokeSessionInput;\n};\n\nexport type MutationSendEmailChangeArgs = {\n  input: SendEmailChangeInput;\n};\n\nexport type MutationSetDataProviderConfigurationArgs = {\n  input: SetDataProviderConfigurationInput;\n};\n\nexport type MutationSetDataProviderEnabledArgs = {\n  input: SetDataProviderEnabledInput;\n};\n\nexport type MutationUpdateMemberRoleArgs = {\n  input: UpdateMemberRoleInput;\n};\n\nexport type MutationUpdatePasswordArgs = {\n  input: UpdatePasswordInput;\n};\n\nexport type MutationUpdateProfileArgs = {\n  input: UpdateProfileInput;\n};\n\nexport type MutationUpdateRoleArgs = {\n  input: UpdateRoleInput;\n};\n\nexport type MutationUpdateSsoConnectionArgs = {\n  input: UpdateSsoConnectionInput;\n};\n\nexport type MutationVerifyCurrentEmailArgs = {\n  input: VerifyCurrentEmailInput;\n};\n\nexport type MutationVerifyTotpArgs = {\n  input: VerifyTotpInput;\n};\n\nexport type NoAuditEventsFound = {\n  __typename?: \"NoAuditEventsFound\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The user has no TOTP factors to remove. */\nexport type NoMfaFactorsEnrolled = {\n  __typename?: \"NoMfaFactorsEnrolled\";\n  _placeholder: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** There is no pending email change to confirm. */\nexport type NoPendingEmailChange = {\n  __typename?: \"NoPendingEmailChange\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** OAuth provider for a connected account. */\nexport type OAuthProvider =\n  | \"AppleOAuth\"\n  | \"BitbucketOAuth\"\n  | \"DiscordOAuth\"\n  | \"GitLabOAuth\"\n  | \"GithubOAuth\"\n  | \"GoogleOAuth\"\n  | \"GrokOAuth\"\n  | \"IntuitOAuth\"\n  | \"LinkedInOAuth\"\n  | \"MicrosoftOAuth\"\n  | \"SalesforceOAuth\"\n  | \"SlackOAuth\"\n  | \"VercelMarketplaceOAuth\"\n  | \"VercelOAuth\"\n  | \"XOAuth\"\n  | \"XeroOAuth\";\n\n/** An organization in the current environment. */\nexport type Organization = {\n  __typename?: \"Organization\";\n  /** Whether the organization allows profiles outside the organization domains. */\n  allowProfilesOutsideOrganization: Scalars[\"Boolean\"][\"output\"];\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  name: Scalars[\"String\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** This organization is not allowed to send invites. */\nexport type OrganizationBlockedFromSendingInvites = {\n  __typename?: \"OrganizationBlockedFromSendingInvites\";\n  /** Placeholder field to allow an empty @ObjectType. */\n  _placeholder?: Maybe<Scalars[\"Boolean\"][\"output\"]>;\n};\n\n/** A data provider the token's organization connects on behalf of all its members. */\nexport type OrganizationDataProvider = {\n  __typename?: \"OrganizationDataProvider\";\n  authMethods: Array<Scalars[\"String\"][\"output\"]>;\n  /** The organization's single shared connection, when it has authorized this data provider. */\n  connection?: Maybe<DataProviderConnection>;\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  description?: Maybe<Scalars[\"String\"][\"output\"]>;\n  enabled: Scalars[\"Boolean\"][\"output\"];\n  /** Whether the organization has supplied its own OAuth client credentials for this data provider. Always false for a provider whose credentials the developer manages. */\n  hasCredentials: Scalars[\"Boolean\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  integrationType: Scalars[\"String\"][\"output\"];\n  name: Scalars[\"String\"][\"output\"];\n  scopes?: Maybe<Array<Scalars[\"String\"][\"output\"]>>;\n  slug: Scalars[\"String\"][\"output\"];\n  state: Scalars[\"String\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\nexport type OrganizationDataProviderList = {\n  __typename?: \"OrganizationDataProviderList\";\n  data: Array<OrganizationDataProvider>;\n  listMetadata: ListMetadata;\n};\n\n/** A domain belonging to the organization the token was issued for. */\nexport type OrganizationDomain = {\n  __typename?: \"OrganizationDomain\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  /** The fully qualified domain name. */\n  domain: Scalars[\"String\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  /** The DNS name server provider detected for the domain. */\n  nameServer: DomainVerificationNameServer;\n  organizationId: Scalars[\"ID\"][\"output\"];\n  state: OrganizationDomainState;\n  /** The subdomain portion of the domain, if any. */\n  subdomain?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** The DNS record prefix the customer must add to verify the domain. */\n  verificationPrefix?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** The DNS record value the customer must add to verify the domain. */\n  verificationToken?: Maybe<Scalars[\"String\"][\"output\"]>;\n};\n\nexport type OrganizationDomainList = {\n  __typename?: \"OrganizationDomainList\";\n  data: Array<OrganizationDomain>;\n  listMetadata: ListMetadata;\n};\n\n/** The verification state of an organization domain. */\nexport type OrganizationDomainState =\n  | \"Failed\"\n  | \"LegacyVerified\"\n  | \"Pending\"\n  | \"Verified\";\n\n/** An invitation to join the organization the token was issued for. */\nexport type OrganizationInvitation = {\n  __typename?: \"OrganizationInvitation\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  /** The email address the invitation was sent to. */\n  email: Scalars[\"String\"][\"output\"];\n  /** When the invitation expires. */\n  expiresAt: Scalars[\"DateTime\"][\"output\"];\n  /** The ID of the invitation. */\n  id: Scalars[\"ID\"][\"output\"];\n  /** Slug of the role the invitee will be granted on acceptance, if any. */\n  roleSlug?: Maybe<Scalars[\"String\"][\"output\"]>;\n  status: OrganizationInvitationStatus;\n};\n\nexport type OrganizationInvitationStatus =\n  | \"Accepted\"\n  | \"Expired\"\n  | \"Pending\"\n  | \"Revoked\";\n\n/** An organization member — a user with their membership status and assigned roles. */\nexport type OrganizationMember = {\n  __typename?: \"OrganizationMember\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  email: Scalars[\"String\"][\"output\"];\n  emailVerified: Scalars[\"Boolean\"][\"output\"];\n  firstName?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** The user ID of the member. */\n  id: Scalars[\"ID\"][\"output\"];\n  /** Timestamp of the member's most recent session activity. */\n  lastActivityAt?: Maybe<Scalars[\"DateTime\"][\"output\"]>;\n  lastName?: Maybe<Scalars[\"String\"][\"output\"]>;\n  profilePictureUrl?: Maybe<Scalars[\"String\"][\"output\"]>;\n  roles: Array<OrganizationMemberRole>;\n  status: OrganizationMemberStatus;\n};\n\n/** A paginated list of organization members. */\nexport type OrganizationMemberList = {\n  __typename?: \"OrganizationMemberList\";\n  data: Array<OrganizationMember>;\n  listMetadata: ListMetadata;\n};\n\n/** A role assigned to an organization member. */\nexport type OrganizationMemberRole = {\n  __typename?: \"OrganizationMemberRole\";\n  name: Scalars[\"String\"][\"output\"];\n  slug: Scalars[\"String\"][\"output\"];\n};\n\nexport type OrganizationMemberStatus =\n  | \"Active\"\n  | \"InviteExpired\"\n  | \"InviteRevoked\"\n  | \"Invited\"\n  | \"NoInvite\";\n\n/** Enum represents the pagination order. */\nexport type PaginationOrder = \"Asc\" | \"Desc\" | \"Normal\";\n\n/** A registered passkey (WebAuthn credential) for the authenticated user. */\nexport type Passkey = {\n  __typename?: \"Passkey\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  /** When this passkey was last used to authenticate. */\n  lastVerifiedAt?: Maybe<Scalars[\"DateTime\"][\"output\"]>;\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** The types of characters in a password. */\nexport type PasswordCharacterType =\n  | \"Lowercase\"\n  | \"Number\"\n  | \"Symbol\"\n  | \"Uppercase\";\n\n/** The password was created successfully. */\nexport type PasswordCreated = {\n  __typename?: \"PasswordCreated\";\n  success: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** The password requirements configured for the environment. Use these to describe the requirements before a password is submitted; `createPassword` and `updatePassword` enforce them. */\nexport type PasswordPolicy = {\n  __typename?: \"PasswordPolicy\";\n  /** The minimum number of characters. */\n  minimumLength: Scalars[\"Int\"][\"output\"];\n  /** The minimum zxcvbn strength score (0–4) a password must reach. */\n  minimumStrength: Scalars[\"Int\"][\"output\"];\n  /** Whether passwords found in known data breaches are rejected. */\n  rejectsBreachedPasswords: Scalars[\"Boolean\"][\"output\"];\n  /** Whether a lowercase letter is required. */\n  requiresLowercase: Scalars[\"Boolean\"][\"output\"];\n  /** Whether a number is required. */\n  requiresNumber: Scalars[\"Boolean\"][\"output\"];\n  /** Whether a special character is required. */\n  requiresSymbol: Scalars[\"Boolean\"][\"output\"];\n  /** Whether an uppercase letter is required. */\n  requiresUppercase: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** The provided password does not meet the environment password policy requirements. */\nexport type PasswordPolicyViolation = {\n  __typename?: \"PasswordPolicyViolation\";\n  /** A machine-readable error code. Matches the `code` of the first entry in `violations`. */\n  code: Scalars[\"String\"][\"output\"];\n  /** A human-readable description of the policy violation. Describes the first entry in `violations`. */\n  message: Scalars[\"String\"][\"output\"];\n  /** Every way in which the password failed the policy, so all of them can be surfaced at once. */\n  violations: Array<PasswordViolation>;\n};\n\n/** The password was updated successfully. */\nexport type PasswordUpdated = {\n  __typename?: \"PasswordUpdated\";\n  success: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** A single way in which a password failed the environment password policy. Fields other than `code` and `message` are only populated for the codes that carry them. */\nexport type PasswordViolation = {\n  __typename?: \"PasswordViolation\";\n  /** For a missing `Symbol` character type, the symbols that satisfy the requirement. */\n  allowedSymbols?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** For `password_pwned`, how many times the password appears in known data breaches. */\n  breachOccurrences?: Maybe<Scalars[\"Int\"][\"output\"]>;\n  /** For `password_missing_character_type`, the class of character that is missing. */\n  characterType?: Maybe<PasswordCharacterType>;\n  /** A machine-readable error code, e.g. `password_too_short`, `password_missing_character_type`, `password_pwned`, `password_reused`, `password_too_weak`, `password_contains_email`, `password_too_long`. */\n  code: Scalars[\"String\"][\"output\"];\n  /** For `password_too_long`, the allowed maximum length. */\n  maximumLength?: Maybe<Scalars[\"Int\"][\"output\"]>;\n  /** A human-readable description of this violation. */\n  message: Scalars[\"String\"][\"output\"];\n  /** For `password_too_short`, the required minimum length. */\n  minimumLength?: Maybe<Scalars[\"Int\"][\"output\"]>;\n  /** For `password_too_weak`, suggestions for choosing a stronger password. Empty for other codes. */\n  strengthSuggestions: Array<Scalars[\"String\"][\"output\"]>;\n  /** For `password_too_weak`, a summary of why it is weak. */\n  strengthWarning?: Maybe<Scalars[\"String\"][\"output\"]>;\n};\n\n/** A permission that can be granted to a role within the environment. */\nexport type Permission = {\n  __typename?: \"Permission\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  description?: Maybe<Scalars[\"String\"][\"output\"]>;\n  id: Scalars[\"ID\"][\"output\"];\n  name: Scalars[\"String\"][\"output\"];\n  slug: Scalars[\"String\"][\"output\"];\n  /** Whether this is a WorkOS-managed system permission that cannot be modified. */\n  system: Scalars[\"Boolean\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\nexport type PermissionList = {\n  __typename?: \"PermissionList\";\n  data: Array<Permission>;\n  listMetadata: ListMetadata;\n};\n\n/** The profile was updated successfully. */\nexport type ProfileUpdated = {\n  __typename?: \"ProfileUpdated\";\n  user: User;\n};\n\nexport type Query = {\n  __typename?: \"Query\";\n  auditEvent: AuditEvent;\n  auditEvents: AuditEventList;\n  auditLogExport: AuditLogExport;\n  /** The audit log stream destination configured for the token's organization, or null when no stream is configured. */\n  auditLogStream?: Maybe<AuditLogStream>;\n  /** The authentication methods the environment allows and the password policy it enforces. Requires a session token. */\n  authenticationSettings: AuthenticationSettings;\n  /** Placeholder query for the Client GraphQL API scaffold. Returns a static value and is replaced by real resolvers. */\n  clientApiStatus: Scalars[\"String\"][\"output\"];\n  /** Return a data provider by ID within the token's environment. */\n  dataProvider: DataProvider;\n  /** Report whether an authorization attempt is still outstanding. Poll this with the `state` returned when the authorization was created while the popup is open; it flips to `connecting: false` once the provider callback has been handled or the attempt expired. */\n  dataProviderAuthorizationStatus: DataProviderAuthorizationStatus;\n  /** Return one of the authenticated user's data provider connections by ID. */\n  dataProviderConnection: DataProviderConnection;\n  /** List the authenticated user's data provider connections, including their status. */\n  dataProviderConnections: DataProviderConnectionList;\n  /** List the data providers configured in the token's environment. */\n  dataProviders: DataProviderList;\n  /** Return a Directory Sync connection by ID within the token's organization. */\n  directoryConnection: Directory;\n  /** List the Directory Sync connections for the token's organization. */\n  directoryConnections: DirectoryList;\n  /** List the groups of a Directory Sync connection. */\n  directoryGroups: DirectoryGroupList;\n  /** List the users of a Directory Sync connection. */\n  directoryUsers: DirectoryUserList;\n  /** The permissions a user effectively has in the organization the token was issued for, including permissions inherited through the user's roles. Callers may read their own effective permissions; reading another member's requires the elevated user:read grant. */\n  effectivePermissions: Array<Permission>;\n  /** The feature flags that evaluate to enabled for a user in the environment the token was issued for, including flags targeted at the token's organization. Flags absent from the list evaluate to false. Callers may evaluate their own flags; evaluating another member of the token's organization requires the elevated user:read grant. */\n  evaluatedFlags: FlagList;\n  /** Fetch a feature flag by ID from the project that owns the token's environment. */\n  flag: Flag;\n  /** Fetch a feature flag by slug from the project that owns the token's environment. */\n  flagBySlug: Flag;\n  /** List the feature flags of the project that owns the token's environment, with their state in that environment. */\n  flags: FlagList;\n  /** Returns the currently authenticated user (the subject of the token). */\n  me: User;\n  /** Returns an organization by ID within the token's environment. */\n  organization: Organization;\n  /** List the data providers the token's organization connects on behalf of all its members, with the organization's shared connection when it has one. */\n  organizationDataProviders: OrganizationDataProviderList;\n  /** Return a domain by ID within the token's organization, including its verification status. */\n  organizationDomain: OrganizationDomain;\n  /** List the domains belonging to the organization the token was issued for. */\n  organizationDomains: OrganizationDomainList;\n  /** List members of the organization the token was issued for, with their roles. */\n  organizationMemberships: OrganizationMemberList;\n  /** List organizations the authenticated user belongs to. */\n  organizations: Array<UserOrganization>;\n  /** List registered passkeys for the authenticated user. Requires a session token. */\n  passkeys: Array<Passkey>;\n  /** List the permissions defined in the environment the token was issued for. */\n  permissions: PermissionList;\n  /** Fetch a single role available to the organization the token was issued for. */\n  role?: Maybe<Role>;\n  /** List roles available to the organization the token was issued for, with role assignment configuration. */\n  roles: RolesResult;\n  /** List active sessions for the authenticated user. Requires a session token. */\n  sessions: Array<Session>;\n  /** Returns an SSO connection by ID, including its IdP setup status, provided it belongs to the token's organization. */\n  ssoConnection: Connection;\n  /** List the SSO connections belonging to the organization the token was issued for. */\n  ssoConnections: Array<Connection>;\n  /** Returns a user by ID, provided they are a member of the token's organization. */\n  user: User;\n};\n\nexport type QueryAuditEventArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryAuditEventsArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  filter: AuditEventFilterInput;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n};\n\nexport type QueryAuditLogExportArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryDataProviderArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryDataProviderAuthorizationStatusArgs = {\n  dataProviderId: Scalars[\"ID\"][\"input\"];\n  state: Scalars[\"String\"][\"input\"];\n};\n\nexport type QueryDataProviderConnectionArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryDataProviderConnectionsArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n};\n\nexport type QueryDataProvidersArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n};\n\nexport type QueryDirectoryConnectionArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryDirectoryConnectionsArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n  search?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n};\n\nexport type QueryDirectoryGroupsArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  directoryId: Scalars[\"ID\"][\"input\"];\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n};\n\nexport type QueryDirectoryUsersArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  directoryId: Scalars[\"ID\"][\"input\"];\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n};\n\nexport type QueryEffectivePermissionsArgs = {\n  userId: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryEvaluatedFlagsArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n  userId: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryFlagArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryFlagBySlugArgs = {\n  slug: Scalars[\"String\"][\"input\"];\n};\n\nexport type QueryFlagsArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  enabled?: InputMaybe<Scalars[\"Boolean\"][\"input\"]>;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n  search?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n};\n\nexport type QueryOrganizationArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryOrganizationDataProvidersArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n};\n\nexport type QueryOrganizationDomainArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryOrganizationDomainsArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n};\n\nexport type QueryOrganizationMembershipsArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n  roleSlug?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  search?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n};\n\nexport type QueryPermissionsArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n  search?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n};\n\nexport type QueryRoleArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QuerySsoConnectionArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryUserArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type RemoveMemberInput = {\n  /** The user ID of the member to remove. */\n  userId: Scalars[\"ID\"][\"input\"];\n};\n\nexport type RemoveMemberResult =\n  | MemberIsManagedByDirectory\n  | MemberNotFound\n  | MemberRemoved;\n\n/** Input for removing all TOTP factors. */\nexport type RemoveMfaFactorInput = {\n  /** An elevated access token obtained by verifying the current email address. Required to prove recent re-authentication. */\n  elevatedAccessToken: Scalars[\"String\"][\"input\"];\n};\n\nexport type RemoveMfaFactorResult =\n  | ElevatedAccessTokenExpired\n  | ElevatedAccessTokenInvalid\n  | MfaFactorRemoved\n  | NoMfaFactorsEnrolled;\n\nexport type ResendInvitationInput = {\n  /** The ID of the user whose invitation should be resent. */\n  userId: Scalars[\"ID\"][\"input\"];\n};\n\n/** No invitation exists for this user in this organization. */\nexport type ResendInvitationNotFound = {\n  __typename?: \"ResendInvitationNotFound\";\n  userId: Scalars[\"ID\"][\"output\"];\n};\n\nexport type ResendInvitationResult =\n  | InvitationResent\n  | InviteeAlreadyAccepted\n  | InviteeEmailNotDeliverable\n  | ResendInvitationNotFound;\n\nexport type RevokeAllSessionsResult = AllSessionsRevoked;\n\nexport type RevokeInvitationInput = {\n  /** The ID of the user whose pending invitation should be revoked. */\n  userId: Scalars[\"ID\"][\"input\"];\n};\n\nexport type RevokeInvitationResult =\n  | InvitationNotFound\n  | InvitationNotPending\n  | InvitationRevoked;\n\n/** Input for revoking a specific session. */\nexport type RevokeSessionInput = {\n  /** The ID of the session to revoke. */\n  sessionId: Scalars[\"ID\"][\"input\"];\n};\n\nexport type RevokeSessionResult = SessionNotFound | SessionRevoked;\n\n/** A role available within the organization. */\nexport type Role = {\n  __typename?: \"Role\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  description?: Maybe<Scalars[\"String\"][\"output\"]>;\n  id: Scalars[\"ID\"][\"output\"];\n  /** Whether this is the default role assigned to new members. */\n  isDefault: Scalars[\"Boolean\"][\"output\"];\n  name: Scalars[\"String\"][\"output\"];\n  slug: Scalars[\"String\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** Confirms that a role has been scheduled for deletion. */\nexport type RoleDeleted = {\n  __typename?: \"RoleDeleted\";\n  /** The ID of the deleted role. */\n  id: Scalars[\"ID\"][\"output\"];\n};\n\n/** No active roles with the given slugs exist in the environment. */\nexport type RoleNotFound = {\n  __typename?: \"RoleNotFound\";\n  /** The role slugs that did not resolve to active roles. */\n  roleSlugs: Array<Scalars[\"String\"][\"output\"]>;\n};\n\n/** Roles available in the organization along with role assignment configuration. */\nexport type RolesResult = {\n  __typename?: \"RolesResult\";\n  /** Whether members can be assigned multiple roles simultaneously. */\n  multipleRolesEnabled: Scalars[\"Boolean\"][\"output\"];\n  roles: Array<Role>;\n};\n\n/** Input for requesting an email change verification code. */\nexport type SendEmailChangeInput = {\n  /** The elevated access token from a successful `verifyCurrentEmail` call. */\n  elevatedAccessToken: Scalars[\"String\"][\"input\"];\n  /** The new email address to change to. */\n  newEmail: Scalars[\"String\"][\"input\"];\n};\n\nexport type SendEmailChangeResult =\n  | DailyEmailQuotaExceeded\n  | EmailChangeNotAvailable\n  | EmailChangeSent\n  | EmailManagedByProvider\n  | EmailNotAvailable\n  | IdentityVerificationExpired\n  | IdentityVerificationInvalid\n  | InvalidEmail;\n\nexport type SendVerificationCodeResult =\n  | DailyEmailQuotaExceeded\n  | VerificationCodeSent;\n\n/** An active user session. */\nexport type Session = {\n  __typename?: \"Session\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  currentLocation?: Maybe<SessionLocation>;\n  id: Scalars[\"ID\"][\"output\"];\n  ipAddress?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** Whether this session is the one making the request. */\n  isCurrent: Scalars[\"Boolean\"][\"output\"];\n  lastActivityAt?: Maybe<Scalars[\"DateTime\"][\"output\"]>;\n  organizationId?: Maybe<Scalars[\"String\"][\"output\"]>;\n  state: SessionState;\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n  userAgent?: Maybe<Scalars[\"String\"][\"output\"]>;\n};\n\n/** Approximate geographic location derived from the session IP. */\nexport type SessionLocation = {\n  __typename?: \"SessionLocation\";\n  cityName: Scalars[\"String\"][\"output\"];\n  countryISOCode: Scalars[\"String\"][\"output\"];\n};\n\n/** No session was found with the given ID. */\nexport type SessionNotFound = {\n  __typename?: \"SessionNotFound\";\n  /** The session ID that did not resolve to a session. */\n  sessionId: Scalars[\"ID\"][\"output\"];\n};\n\n/** The session was revoked successfully. */\nexport type SessionRevoked = {\n  __typename?: \"SessionRevoked\";\n  session: Session;\n};\n\n/** The lifecycle state of a session. */\nexport type SessionState = {\n  __typename?: \"SessionState\";\n  expiresAt?: Maybe<Scalars[\"DateTime\"][\"output\"]>;\n  /** Session state: Issued, Revoked, etc. */\n  tag: Scalars[\"String\"][\"output\"];\n};\n\nexport type SetDataProviderConfigurationInput = {\n  /** The organization's own OAuth client ID. Must be supplied together with `clientSecret`. */\n  clientId?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  /** The organization's own OAuth client secret. Write-only: it is stored encrypted and never returned; clients read `hasCredentials` instead. */\n  clientSecret?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  /** Non-secret configuration values declared by the provider. */\n  config?: InputMaybe<Array<DataProviderConfigEntryInput>>;\n  /** The data provider to configure for the token's organization. Configuration always applies to the token's organization; it cannot be set for another one. */\n  dataProviderId: Scalars[\"ID\"][\"input\"];\n  /** Whether the organization's users can see and connect the data provider. */\n  enabled?: InputMaybe<Scalars[\"Boolean\"][\"input\"]>;\n  /** The scopes the organization requests. Only providers where the organization brings its own OAuth credentials may widen beyond the defaults. */\n  scopes?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n};\n\nexport type SetDataProviderConfigurationResult =\n  | DataProviderConfigInvalid\n  | DataProviderConfiguration;\n\nexport type SetDataProviderEnabledInput = {\n  dataProviderId: Scalars[\"ID\"][\"input\"];\n  /** Whether the data provider is available to the organization the token was issued for. */\n  enabled: Scalars[\"Boolean\"][\"input\"];\n};\n\n/** The user already has a verified TOTP factor enrolled. */\nexport type TotpAlreadyEnrolled = {\n  __typename?: \"TotpAlreadyEnrolled\";\n  _placeholder: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** TOTP factor details returned after enrollment. */\nexport type TotpFactor = {\n  __typename?: \"TotpFactor\";\n  /** The authentication challenge ID. */\n  authenticationChallengeId: Scalars[\"String\"][\"output\"];\n  /** The authentication factor ID. */\n  authenticationFactorId: Scalars[\"String\"][\"output\"];\n  /** A data-URI PNG of the QR code. */\n  qrCode: Scalars[\"String\"][\"output\"];\n  /** The TOTP secret for manual entry. */\n  secret: Scalars[\"String\"][\"output\"];\n  /** The TOTP URI for provisioning (otpauth://…). */\n  uri: Scalars[\"String\"][\"output\"];\n};\n\n/** The TOTP verification code was invalid. */\nexport type TotpVerificationFailed = {\n  __typename?: \"TotpVerificationFailed\";\n  _placeholder: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** The TOTP verification succeeded and the factor is active. */\nexport type TotpVerified = {\n  __typename?: \"TotpVerified\";\n  success: Scalars[\"Boolean\"][\"output\"];\n};\n\nexport type UpdateMemberRoleInput = {\n  /** Slugs of the roles to assign. When multiple roles are enabled for the environment, all provided roles are assigned; otherwise only the first slug is used. */\n  roleSlugs: Array<Scalars[\"String\"][\"input\"]>;\n  /** The user ID of the member to update. */\n  userId: Scalars[\"ID\"][\"input\"];\n};\n\nexport type UpdateMemberRoleResult =\n  | MemberNotFound\n  | MemberRoleUpdated\n  | RoleNotFound;\n\n/** Input for changing an existing password. Requires the current password for verification. */\nexport type UpdatePasswordInput = {\n  /** The current password for verification. */\n  currentPassword: Scalars[\"String\"][\"input\"];\n  /** The new password. Must satisfy the environment password policy. */\n  newPassword: Scalars[\"String\"][\"input\"];\n};\n\nexport type UpdatePasswordResult =\n  | IncorrectPassword\n  | PasswordPolicyViolation\n  | PasswordUpdated;\n\n/** Input for updating the authenticated user's profile. */\nexport type UpdateProfileInput = {\n  /** The user's first name. Pass an empty string to clear. */\n  firstName?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  /** The user's last name. Pass an empty string to clear. */\n  lastName?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  /** The user's locale as a BCP 47 language tag (e.g. 'en-US'). Pass an empty string to clear. */\n  locale?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n};\n\nexport type UpdateProfileResult = InvalidLocale | ProfileUpdated;\n\nexport type UpdateRoleInput = {\n  /** Human-readable description of the role. This is a full replace of the role, so an omitted or null description clears it — resupply the current value to preserve it. */\n  description?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  /** The ID of the role to update. */\n  id: Scalars[\"ID\"][\"input\"];\n  /** Human-readable name for the role. */\n  name: Scalars[\"String\"][\"input\"];\n  /** Slugs of the permissions granted to the role. Replaces the existing set when provided. */\n  permissions?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n};\n\nexport type UpdateSsoConnectionInput = {\n  id: Scalars[\"ID\"][\"input\"];\n  /** A new human-readable name for the connection. */\n  name?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n};\n\n/** A user in the current environment. */\nexport type User = {\n  __typename?: \"User\";\n  connectedAccounts: Array<ConnectedAccount>;\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  email: Scalars[\"String\"][\"output\"];\n  emailVerified: Scalars[\"Boolean\"][\"output\"];\n  firstName?: Maybe<Scalars[\"String\"][\"output\"]>;\n  id: Scalars[\"ID\"][\"output\"];\n  lastName?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** Whether multi-factor authentication (TOTP) is set up for this user. Always `false` when the environment has MFA turned off — use `authenticationSettings.mfaEnabled` to tell the two apart. Only populated on `me`. */\n  mfaEnabled: Scalars[\"Boolean\"][\"output\"];\n  /** When MFA was last used to authenticate. Only populated on `me`. */\n  mfaLastUsedAt?: Maybe<Scalars[\"DateTime\"][\"output\"]>;\n  /** When a password was last used to authenticate. Only populated on `me`. */\n  passwordLastUsedAt?: Maybe<Scalars[\"DateTime\"][\"output\"]>;\n  /** Whether this user has a password set. Reflects the user regardless of whether the environment allows password authentication; use `authenticationSettings.passwordAuthEnabled` for that. Only populated on `me`. */\n  passwordSet: Scalars[\"Boolean\"][\"output\"];\n  profilePictureUrl?: Maybe<Scalars[\"String\"][\"output\"]>;\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** The user already has a password set. */\nexport type UserAlreadyHasPassword = {\n  __typename?: \"UserAlreadyHasPassword\";\n  _placeholder: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** The invitation was created and the email sent. */\nexport type UserInvited = {\n  __typename?: \"UserInvited\";\n  invitation: OrganizationInvitation;\n};\n\n/** An organization the authenticated user belongs to, with a flag indicating whether it is the token's current organization. */\nexport type UserOrganization = {\n  __typename?: \"UserOrganization\";\n  id: Scalars[\"ID\"][\"output\"];\n  /** Whether this is the organization the token is currently scoped to. */\n  isCurrent: Scalars[\"Boolean\"][\"output\"];\n  name: Scalars[\"String\"][\"output\"];\n};\n\n/** The verification code has expired. */\nexport type VerificationCodeExpired = {\n  __typename?: \"VerificationCodeExpired\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The verification code is incorrect. */\nexport type VerificationCodeIncorrect = {\n  __typename?: \"VerificationCodeIncorrect\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The verification code has already been used. */\nexport type VerificationCodePreviouslyUsed = {\n  __typename?: \"VerificationCodePreviouslyUsed\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** A verification code was sent to the current email address for identity verification. */\nexport type VerificationCodeSent = {\n  __typename?: \"VerificationCodeSent\";\n  /** The authentication challenge ID to use in subsequent steps. */\n  authenticationChallengeId: Scalars[\"ID\"][\"output\"];\n  /** When the verification code expires. */\n  expiresAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** Too many verification code attempts. */\nexport type VerificationTooManyAttempts = {\n  __typename?: \"VerificationTooManyAttempts\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** Input for verifying the current email address. */\nexport type VerifyCurrentEmailInput = {\n  /** The authentication challenge ID returned from `sendVerificationCode`. */\n  authenticationChallengeId: Scalars[\"ID\"][\"input\"];\n  /** The verification code sent to the current email address. */\n  code: Scalars[\"String\"][\"input\"];\n};\n\nexport type VerifyCurrentEmailResult =\n  | CurrentEmailVerified\n  | VerificationCodeExpired\n  | VerificationCodeIncorrect\n  | VerificationCodePreviouslyUsed\n  | VerificationTooManyAttempts;\n\n/** Input for verifying a TOTP enrollment. */\nexport type VerifyTotpInput = {\n  /** The authentication challenge ID from enrollTotp. */\n  authenticationChallengeId: Scalars[\"String\"][\"input\"];\n  /** The TOTP code from the authenticator app. */\n  code: Scalars[\"String\"][\"input\"];\n  /** An elevated access token obtained by verifying the current email address. Required to prove recent re-authentication. */\n  elevatedAccessToken: Scalars[\"String\"][\"input\"];\n};\n\nexport type VerifyTotpResult =\n  | ElevatedAccessTokenExpired\n  | ElevatedAccessTokenInvalid\n  | TotpVerificationFailed\n  | TotpVerified;\n\nexport type ClientApiStatusQueryVariables = Exact<{ [key: string]: never }>;\n\nexport type ClientApiStatusQuery = {\n  __typename?: \"Query\";\n  clientApiStatus: string;\n};\n\nexport const ClientApiStatusDocument = `\n    query ClientApiStatus {\n  clientApiStatus\n}\n    `;\n\nexport type SdkFunctionWrapper = <T>(\n  action: (requestHeaders?: Record<string, string>) => Promise<T>,\n  operationName: string,\n  operationType?: string,\n  variables?: any,\n) => Promise<T>;\n\nconst defaultWrapper: SdkFunctionWrapper = (\n  action,\n  _operationName,\n  _operationType,\n  _variables,\n) => action();\n\nexport function getSdk(\n  client: GraphQLClient,\n  withWrapper: SdkFunctionWrapper = defaultWrapper,\n) {\n  return {\n    ClientApiStatus(\n      variables?: ClientApiStatusQueryVariables,\n      requestHeaders?: GraphQLClientRequestHeaders,\n      signal?: RequestInit[\"signal\"],\n    ): Promise<ClientApiStatusQuery> {\n      return withWrapper(\n        (wrappedRequestHeaders) =>\n          client.request<ClientApiStatusQuery>({\n            document: ClientApiStatusDocument,\n            variables,\n            requestHeaders: { ...requestHeaders, ...wrappedRequestHeaders },\n            signal,\n          }),\n        \"ClientApiStatus\",\n        \"query\",\n        variables,\n      );\n    },\n  };\n}\nexport type Sdk = ReturnType<typeof getSdk>;\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAw6DO,MAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAavC,MAAM,iBAAqC,CACzC,QACA,gBACA,gBACA,eACG,OAAO;AAEL,SAAS,OACd,QACA,cAAkC,gBAClC;AACA,SAAO;AAAA,IACL,gBACE,WACA,gBACA,QAC+B;AAC/B,aAAO;AAAA,QACL,CAAC,0BACC,OAAO,QAA8B;AAAA,UACnC,UAAU;AAAA,UACV;AAAA,UACA,gBAAgB,EAAE,GAAG,gBAAgB,GAAG,sBAAsB;AAAA,UAC9D;AAAA,QACF,CAAC;AAAA,QACH;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../../../src/api/client-graphql/generated.ts"],"sourcesContent":["import type { GraphQLClient, RequestOptions } from \"graphql-request\";\nexport type Maybe<T> = T | null;\nexport type InputMaybe<T> = Maybe<T>;\nexport type Exact<T extends { [key: string]: unknown }> = {\n  [K in keyof T]: T[K];\n};\nexport type MakeOptional<T, K extends keyof T> = Omit<T, K> & {\n  [SubKey in K]?: Maybe<T[SubKey]>;\n};\nexport type MakeMaybe<T, K extends keyof T> = Omit<T, K> & {\n  [SubKey in K]: Maybe<T[SubKey]>;\n};\nexport type MakeEmpty<\n  T extends { [key: string]: unknown },\n  K extends keyof T,\n> = { [_ in K]?: never };\nexport type Incremental<T> =\n  | T\n  | {\n      [P in keyof T]?: P extends \" $fragmentName\" | \"__typename\" ? T[P] : never;\n    };\ntype GraphQLClientRequestHeaders = RequestOptions[\"requestHeaders\"];\n/** All built-in and custom scalars, mapped to their actual values */\nexport type Scalars = {\n  ID: { input: string; output: string };\n  String: { input: string; output: string };\n  Boolean: { input: boolean; output: boolean };\n  Int: { input: number; output: number };\n  Float: { input: number; output: number };\n  /** A date-time string at UTC, such as 2019-12-03T09:54:33Z, compliant with the date-time format. */\n  DateTime: { input: string; output: string };\n  /** The `JSON` scalar type represents JSON values as specified by [ECMA-404](http://www.ecma-international.org/publications/files/ECMA-ST/ECMA-404.pdf). */\n  JSON: { input: any; output: any };\n};\n\n/** A short-lived link that starts an Admin Portal session for the token’s organization, scoped to a single setup flow. */\nexport type AdminPortalLink = {\n  __typename?: \"AdminPortalLink\";\n  /** When the link stops being redeemable. */\n  expiresAt: Scalars[\"DateTime\"][\"output\"];\n  /** The setup flow the link is scoped to. */\n  intent: AdminPortalLinkIntent;\n  /** The Admin Portal URL to send the user to. It carries a bearer capability, so treat it as a secret and redirect immediately. */\n  link: Scalars[\"String\"][\"output\"];\n};\n\n/** The Admin Portal setup flow a link is scoped to. */\nexport type AdminPortalLinkIntent = \"DomainVerification\" | \"LogStreams\" | \"Sso\";\n\n/** All other sessions were revoked successfully. */\nexport type AllSessionsRevoked = {\n  __typename?: \"AllSessionsRevoked\";\n  success: Scalars[\"Boolean\"][\"output\"];\n};\n\nexport type AssignPermissionToRoleInput = {\n  /** The slug of the permission to assign. */\n  permissionSlug: Scalars[\"String\"][\"input\"];\n  /** The ID of the role to assign the permission to. */\n  roleId: Scalars[\"ID\"][\"input\"];\n};\n\nexport type AuditEvent = {\n  __typename?: \"AuditEvent\";\n  action: Scalars[\"String\"][\"output\"];\n  actor: AuditEventActor;\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  data: Scalars[\"JSON\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  occurredAt: Scalars[\"DateTime\"][\"output\"];\n  targets: Array<Scalars[\"String\"][\"output\"]>;\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\nexport type AuditEventActor = {\n  __typename?: \"AuditEventActor\";\n  id: Scalars[\"String\"][\"output\"];\n  name?: Maybe<Scalars[\"String\"][\"output\"]>;\n  type: Scalars[\"String\"][\"output\"];\n};\n\nexport type AuditEventFilterInput = {\n  actions?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  actorIds?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  actorNames?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  rangeEnd: Scalars[\"DateTime\"][\"input\"];\n  rangeStart: Scalars[\"DateTime\"][\"input\"];\n  search?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  targetIds?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  targetTypes?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n};\n\nexport type AuditEventList = {\n  __typename?: \"AuditEventList\";\n  data: Array<AuditEvent>;\n  listMetadata: ListMetadata;\n};\n\nexport type AuditLogExport = {\n  __typename?: \"AuditLogExport\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  state: AuditLogExportState;\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n  /** A signed URL to the CSV file. Only defined once the export is ready. */\n  url?: Maybe<Scalars[\"String\"][\"output\"]>;\n};\n\nexport type AuditLogExportState = \"Error\" | \"Expired\" | \"Pending\" | \"Ready\";\n\n/** The audit log stream destination configured for the token's organization. Exposes status metadata only; destination settings and credentials are never included. */\nexport type AuditLogStream = {\n  __typename?: \"AuditLogStream\";\n  auditLogTrailId: Scalars[\"ID\"][\"output\"];\n  /** The most recent delivery error message, if any. */\n  errorMessage?: Maybe<Scalars[\"String\"][\"output\"]>;\n  id: Scalars[\"ID\"][\"output\"];\n  /** The ID of the last audit log event delivered to the stream. */\n  lastSyncedEventId?: Maybe<Scalars[\"String\"][\"output\"]>;\n  state: AuditLogStreamState;\n  type: AuditLogStreamType;\n};\n\n/** The delivery state of an audit log stream. */\nexport type AuditLogStreamState = \"Active\" | \"Error\" | \"Inactive\" | \"Invalid\";\n\n/** The destination provider audit log events are streamed to. */\nexport type AuditLogStreamType =\n  | \"AzureSentinel\"\n  | \"Datadog\"\n  | \"GenericHttps\"\n  | \"GoogleCloudStorage\"\n  | \"S3\"\n  | \"Snowflake\"\n  | \"Splunk\";\n\n/** AuthKit settings for the token's environment. */\nexport type AuthKitSettings = {\n  __typename?: \"AuthKitSettings\";\n  /** The HTTPS origin of the preferred AuthKit domain. */\n  origin: Scalars[\"String\"][\"output\"];\n};\n\n/** The authentication methods the environment allows, and the password policy it enforces. Distinct from what the authenticated user has set up, which lives on `me`. */\nexport type AuthenticationSettings = {\n  __typename?: \"AuthenticationSettings\";\n  /** Whether multi-factor authentication is available in this environment. When `false`, TOTP enrollment should not be offered. */\n  mfaEnabled: Scalars[\"Boolean\"][\"output\"];\n  /** Whether multi-factor authentication is mandatory for every user in this environment. */\n  mfaRequired: Scalars[\"Boolean\"][\"output\"];\n  /** Whether users may authenticate with a passkey. */\n  passkeyAuthEnabled: Scalars[\"Boolean\"][\"output\"];\n  /** Whether users may authenticate with a password. When `false`, `createPassword` and `updatePassword` should not be offered. */\n  passwordAuthEnabled: Scalars[\"Boolean\"][\"output\"];\n  passwordPolicy: PasswordPolicy;\n};\n\n/** The branding configured for the token's environment. */\nexport type Branding = {\n  __typename?: \"Branding\";\n  /** The product name shown to users. */\n  displayName: Scalars[\"String\"][\"output\"];\n  /** The fully resolved dark-mode icon URL, or null when it is not configured. */\n  logoDarkIconPath?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** The fully resolved dark-mode logo URL, or null when it is not configured. */\n  logoDarkPath?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** The fully resolved light-mode icon URL, or null when it is not configured. */\n  logoLightIconPath?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** The fully resolved light-mode logo URL, or null when it is not configured. */\n  logoLightPath?: Maybe<Scalars[\"String\"][\"output\"]>;\n};\n\n/** Input for confirming an email change with the verification code. */\nexport type ConfirmEmailChangeInput = {\n  /** The verification code sent to the new email address. */\n  code: Scalars[\"String\"][\"input\"];\n  /** The elevated access token from a successful `verifyCurrentEmail` call. */\n  elevatedAccessToken: Scalars[\"String\"][\"input\"];\n};\n\nexport type ConfirmEmailChangeResult =\n  | EmailChangeCodeExpired\n  | EmailChangeCodeIncorrect\n  | EmailChangeCodePreviouslyUsed\n  | EmailChangeConfirmed\n  | EmailChangeTooManyAttempts\n  | EmailManagedByProvider\n  | EmailNotAvailable\n  | IdentityVerificationExpired\n  | IdentityVerificationInvalid\n  | InvalidEmail\n  | NoPendingEmailChange;\n\nexport type ConnectDataProviderResult =\n  | DataProviderAuthMethodUnsupported\n  | DataProviderConfigInvalid\n  | DataProviderConnected\n  | DataProviderConnectionAuthMethodConflict;\n\nexport type ConnectDataProviderWithClientCredentialsInput = {\n  /** The OAuth client ID issued by the data provider. Only data providers whose `authMethods` include `client_credentials` can be connected this way. */\n  clientId: Scalars[\"String\"][\"input\"];\n  /** The OAuth client secret issued by the data provider. Write-only: it is stored encrypted and never returned. */\n  clientSecret: Scalars[\"String\"][\"input\"];\n  /** Values for the provider’s connection configuration fields. */\n  config?: InputMaybe<Array<DataProviderConfigEntryInput>>;\n  /** The data provider to connect the authenticated user to. */\n  dataProviderId: Scalars[\"ID\"][\"input\"];\n};\n\n/** An OAuth profile linked to the authenticated user. */\nexport type ConnectedAccount = {\n  __typename?: \"ConnectedAccount\";\n  email?: Maybe<Scalars[\"String\"][\"output\"]>;\n  firstName?: Maybe<Scalars[\"String\"][\"output\"]>;\n  id: Scalars[\"ID\"][\"output\"];\n  lastLoginAt?: Maybe<Scalars[\"DateTime\"][\"output\"]>;\n  lastName?: Maybe<Scalars[\"String\"][\"output\"]>;\n  profilePictureUrl?: Maybe<Scalars[\"String\"][\"output\"]>;\n  provider: OAuthProvider;\n};\n\n/** An SSO connection belonging to the organization. Mirrors the SSO Connection exposed by the REST connections API. */\nexport type Connection = {\n  __typename?: \"Connection\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  /** A human-readable name for the connection. */\n  name: Scalars[\"String\"][\"output\"];\n  /** The organization the connection belongs to. */\n  organizationId?: Maybe<Scalars[\"ID\"][\"output\"]>;\n  /** Whether the connection has completed its IdP setup and can authenticate users (equivalent to an `Active` state). */\n  setupComplete: Scalars[\"Boolean\"][\"output\"];\n  /** The connection's IdP setup status. `Active` indicates setup is complete; other states indicate where the connection is in its setup flow. */\n  state: ConnectionState;\n  /** The identity provider type of the connection. */\n  type: ConnectionType;\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** Enum represents the state of the connection. */\nexport type ConnectionState = \"Active\" | \"Deleting\" | \"Inactive\" | \"Validating\";\n\n/** Enum represents the type of connection. */\nexport type ConnectionType =\n  | \"ADFSSAML\"\n  | \"AdpOidc\"\n  | \"AppleOAuth\"\n  | \"Auth0Migration\"\n  | \"Auth0SAML\"\n  | \"AzureSAML\"\n  | \"BitbucketOAuth\"\n  | \"CasSAML\"\n  | \"ClassLinkSAML\"\n  | \"CleverOIDC\"\n  | \"CloudflareSAML\"\n  | \"CyberArkSAML\"\n  | \"DiscordOAuth\"\n  | \"DuoSAML\"\n  | \"EntraIdOIDC\"\n  | \"GenericOIDC\"\n  | \"GenericSAML\"\n  | \"GitLabOAuth\"\n  | \"GithubOAuth\"\n  | \"GoogleOAuth\"\n  | \"GoogleOIDC\"\n  | \"GoogleSAML\"\n  | \"GrokOAuth\"\n  | \"IntuitOAuth\"\n  | \"JumpCloudSAML\"\n  | \"KeycloakSAML\"\n  | \"LastPassSAML\"\n  | \"LinkedInOAuth\"\n  | \"LoginGovOidc\"\n  | \"MagicLink\"\n  | \"MicrosoftOAuth\"\n  | \"MiniOrangeSAML\"\n  | \"NetIqSAML\"\n  | \"OktaOIDC\"\n  | \"OktaSAML\"\n  | \"OneLoginSAML\"\n  | \"OracleSAML\"\n  | \"PingFederateSAML\"\n  | \"PingOneSAML\"\n  | \"RipplingSAML\"\n  | \"SalesforceOAuth\"\n  | \"SalesforceSAML\"\n  | \"ShibbolethGenericSAML\"\n  | \"ShibbolethSAML\"\n  | \"SimpleSamlPhpSAML\"\n  | \"SlackOAuth\"\n  | \"TestIdp\"\n  | \"VMwareSAML\"\n  | \"VercelMarketplaceOAuth\"\n  | \"VercelOAuth\"\n  | \"XOAuth\"\n  | \"XeroOAuth\";\n\nexport type CreateAuditLogExportInput = {\n  actions?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  actorIds?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  actorNames?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  rangeEnd: Scalars[\"DateTime\"][\"input\"];\n  rangeStart: Scalars[\"DateTime\"][\"input\"];\n  targetIds?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  targetTypes?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n};\n\nexport type CreateAuditLogExportResult =\n  | AuditLogExport\n  | InvalidAuditLogExportDateRange\n  | NoAuditEventsFound;\n\nexport type CreateDataProviderAuthorizationInput = {\n  /** Values for the provider’s connect-time configuration fields. Omit when the provider declares none. */\n  config?: InputMaybe<Array<DataProviderConfigEntryInput>>;\n  /** The data provider to authorize for the authenticated user. It must be one the user can connect (`dataProviders`). */\n  dataProviderId: Scalars[\"ID\"][\"input\"];\n  /** Request a confirmation step at the end of the flow, returning a `handoffToken` the client must complete. Defaults to false. */\n  requireHandoff?: InputMaybe<Scalars[\"Boolean\"][\"input\"]>;\n};\n\nexport type CreateDataProviderAuthorizationResult =\n  | DataProviderAuthorization\n  | DataProviderAuthorizationUnavailable\n  | DataProviderConfigInvalid;\n\nexport type CreateDataProviderConnectionInput = {\n  /** The API key issued by the data provider. Only data providers whose `authMethods` include `api_key` can be connected this way; OAuth providers are connected through the widget's authorization flow. */\n  apiKey: Scalars[\"String\"][\"input\"];\n  /** The data provider to connect the authenticated user to. */\n  dataProviderId: Scalars[\"ID\"][\"input\"];\n};\n\nexport type CreateOrganizationDataProviderAuthorizationInput = {\n  /** Values for the provider’s connect-time configuration fields. Omit when the provider declares none. */\n  config?: InputMaybe<Array<DataProviderConfigEntryInput>>;\n  /** The organization-owned data provider to authorize (`organizationDataProviders`). */\n  dataProviderId: Scalars[\"ID\"][\"input\"];\n};\n\n/** Input for setting a password on an account that does not yet have one (e.g. signed up via OAuth). */\nexport type CreatePasswordInput = {\n  /** An elevated access token obtained by verifying the current email address. Required to prove recent re-authentication. */\n  elevatedAccessToken: Scalars[\"String\"][\"input\"];\n  /** The password to set. Must satisfy the environment password policy. */\n  password: Scalars[\"String\"][\"input\"];\n};\n\nexport type CreatePasswordResult =\n  | ElevatedAccessTokenExpired\n  | ElevatedAccessTokenInvalid\n  | PasswordCreated\n  | PasswordPolicyViolation\n  | UserAlreadyHasPassword;\n\nexport type CreateRoleInput = {\n  /** Optional human-readable description of the role. */\n  description?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  /** Human-readable name for the role. */\n  name: Scalars[\"String\"][\"input\"];\n  /** Slugs of the permissions granted to the role. */\n  permissions?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n  /** Unique slug identifying the role. Generated from the name when omitted. */\n  slug?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n};\n\nexport type CreateSsoConnectionInput = {\n  /** A human-readable name for the connection. Defaults to the organization's name. */\n  name?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  /** The identity provider type of the connection to create. */\n  type: ConnectionType;\n};\n\n/** The current email was verified successfully. */\nexport type CurrentEmailVerified = {\n  __typename?: \"CurrentEmailVerified\";\n  /** The elevated access token to pass to `sendEmailChange` and `confirmEmailChange`. */\n  elevatedAccessToken: Scalars[\"String\"][\"output\"];\n  /** When the elevated access token expires (ISO 8601). */\n  expiresAt: Scalars[\"String\"][\"output\"];\n};\n\n/** Daily verification email quota exceeded. */\nexport type DailyEmailQuotaExceeded = {\n  __typename?: \"DailyEmailQuotaExceeded\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** A third-party data provider configured for the current environment. */\nexport type DataProvider = {\n  __typename?: \"DataProvider\";\n  /** How accounts authenticate with this data provider. */\n  authMethods: Array<Scalars[\"String\"][\"output\"]>;\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  description?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** Whether the data provider is enabled in the environment. */\n  enabled: Scalars[\"Boolean\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  /** The provider type this data provider was created from. */\n  integrationType: Scalars[\"String\"][\"output\"];\n  /** The display name of the data provider. */\n  name: Scalars[\"String\"][\"output\"];\n  /** The OAuth scopes configured for the data provider. `null` when the provider's default scopes are used. */\n  scopes?: Maybe<Array<Scalars[\"String\"][\"output\"]>>;\n  /** The slug of the data provider. */\n  slug: Scalars[\"String\"][\"output\"];\n  /** The configuration state of the data provider: `valid`, `invalid`, or `requested`. */\n  state: Scalars[\"String\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** The data provider cannot be connected the requested way — for example client credentials for a provider that only supports OAuth. */\nexport type DataProviderAuthMethodUnsupported = {\n  __typename?: \"DataProviderAuthMethodUnsupported\";\n  /** The unsupported auth method that was requested. */\n  authMethod: Scalars[\"String\"][\"output\"];\n  /** The auth methods the data provider does support. */\n  supportedAuthMethods: Array<Scalars[\"String\"][\"output\"]>;\n};\n\n/** A started authorization: the URL to open and the state to poll while the user completes it. */\nexport type DataProviderAuthorization = {\n  __typename?: \"DataProviderAuthorization\";\n  /** Present when the flow ends on a confirmation step the client must complete instead of finishing silently. Always present for organization-scoped authorization. */\n  handoffToken?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** One-time token the interstitial URL is keyed by. Retained so a client can correlate the popup it opened. */\n  redirectToken: Scalars[\"String\"][\"output\"];\n  /** The OAuth `state` for this attempt. Poll `dataProviderAuthorizationStatus` with it to observe completion. */\n  state: Scalars[\"String\"][\"output\"];\n  /** The WorkOS interstitial URL to open in the popup. It redirects to the provider once, then expires. */\n  url: Scalars[\"String\"][\"output\"];\n};\n\n/** Whether an authorization attempt is still in progress. */\nexport type DataProviderAuthorizationStatus = {\n  __typename?: \"DataProviderAuthorizationStatus\";\n  /** True while the attempt is outstanding. It becomes false once the provider callback has been handled or the attempt expired, so a client that sees false reloads the connection to learn the outcome. */\n  connecting: Scalars[\"Boolean\"][\"output\"];\n  /** The `state` that was polled. */\n  state: Scalars[\"String\"][\"output\"];\n};\n\n/** The data provider cannot start an authorization right now — most often because the organization has not supplied its own OAuth credentials yet. */\nexport type DataProviderAuthorizationUnavailable = {\n  __typename?: \"DataProviderAuthorizationUnavailable\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** A non-secret configuration value set on a data provider. */\nexport type DataProviderConfigEntry = {\n  __typename?: \"DataProviderConfigEntry\";\n  /** The configuration field declared by the provider. */\n  name: Scalars[\"String\"][\"output\"];\n  /** The value set for the field. */\n  value: Scalars[\"String\"][\"output\"];\n};\n\nexport type DataProviderConfigEntryInput = {\n  /** The configuration field declared by the provider. */\n  name: Scalars[\"String\"][\"input\"];\n  /** The value to set for the field. */\n  value: Scalars[\"String\"][\"input\"];\n};\n\n/** The supplied configuration does not satisfy the provider’s declared fields. */\nexport type DataProviderConfigInvalid = {\n  __typename?: \"DataProviderConfigInvalid\";\n  /** Which field is missing, unknown, or malformed. Names the field so a client can highlight it. */\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** A data provider's configuration for the token's organization, excluding secret values. */\nexport type DataProviderConfiguration = {\n  __typename?: \"DataProviderConfiguration\";\n  /** Every scope the organization may request. Only populated for providers where the organization brings its own OAuth credentials; empty otherwise. */\n  availableScopes: Array<Scalars[\"String\"][\"output\"]>;\n  config: Array<DataProviderConfigEntry>;\n  /** The data provider being configured. */\n  dataProviderId: Scalars[\"ID\"][\"output\"];\n  dataProviderSlug: Scalars[\"String\"][\"output\"];\n  /** Whether the organization's users can see and connect the data provider. */\n  enabled: Scalars[\"Boolean\"][\"output\"];\n  /** Whether the organization has supplied its own OAuth client credentials. Always false for a provider whose credentials the developer manages. The values themselves are never returned. */\n  hasCredentials: Scalars[\"Boolean\"][\"output\"];\n  /** The organization the configuration applies to. */\n  organizationId: Scalars[\"ID\"][\"output\"];\n  /** The scopes the organization requests, or null to use the provider defaults. */\n  scopes?: Maybe<Array<Scalars[\"String\"][\"output\"]>>;\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** The connection was created or its credentials were replaced. */\nexport type DataProviderConnected = {\n  __typename?: \"DataProviderConnected\";\n  connection: DataProviderConnection;\n};\n\n/** A connection between a data provider and the authenticated user's account. */\nexport type DataProviderConnection = {\n  __typename?: \"DataProviderConnection\";\n  /** How the connection authenticates: `oauth`, `api_key`, or `client_credentials`. */\n  authMethod: Scalars[\"String\"][\"output\"];\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  /** The data provider this connection was created for. */\n  dataProviderId: Scalars[\"ID\"][\"output\"];\n  /** The slug of the connected data provider. */\n  dataProviderSlug: Scalars[\"String\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  organizationId?: Maybe<Scalars[\"ID\"][\"output\"]>;\n  /** The OAuth scopes granted for this connection. */\n  scopes: Array<Scalars[\"String\"][\"output\"]>;\n  /** The status of the connection: `connected` or `needs_reauthorization`. */\n  state: Scalars[\"String\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n  userId?: Maybe<Scalars[\"ID\"][\"output\"]>;\n};\n\n/** The user already has a connection to this data provider that authenticates differently, so it must be disconnected first. */\nexport type DataProviderConnectionAuthMethodConflict = {\n  __typename?: \"DataProviderConnectionAuthMethodConflict\";\n  /** How the existing connection authenticates. */\n  existingAuthMethod: Scalars[\"String\"][\"output\"];\n};\n\nexport type DataProviderConnectionList = {\n  __typename?: \"DataProviderConnectionList\";\n  data: Array<DataProviderConnection>;\n  listMetadata: ListMetadata;\n};\n\nexport type DataProviderList = {\n  __typename?: \"DataProviderList\";\n  data: Array<DataProvider>;\n  listMetadata: ListMetadata;\n};\n\n/** Input for deleting a passkey. */\nexport type DeletePasskeyInput = {\n  /** An elevated access token obtained by verifying the current email address. Required to prove recent re-authentication. */\n  elevatedAccessToken: Scalars[\"String\"][\"input\"];\n  /** The ID of the passkey to delete. */\n  passkeyId: Scalars[\"ID\"][\"input\"];\n};\n\nexport type DeletePasskeyResult =\n  | ElevatedAccessTokenExpired\n  | ElevatedAccessTokenInvalid\n  | PasskeyDeleted\n  | PasskeyNotFound;\n\nexport type DeleteRoleInput = {\n  /** The ID of the role to delete. */\n  id: Scalars[\"ID\"][\"input\"];\n};\n\n/** A Directory Sync connection within the current environment. */\nexport type Directory = {\n  __typename?: \"Directory\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  externalKey: Scalars[\"String\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  name: Scalars[\"String\"][\"output\"];\n  organizationId: Scalars[\"ID\"][\"output\"];\n  /** The linking state of the directory. */\n  state: Scalars[\"String\"][\"output\"];\n  /** The provider type of the directory. */\n  type: Scalars[\"String\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** A group provisioned through a Directory Sync connection. */\nexport type DirectoryGroup = {\n  __typename?: \"DirectoryGroup\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  directoryId: Scalars[\"ID\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  /** The identifier of the group in the identity provider. */\n  idpId: Scalars[\"String\"][\"output\"];\n  name: Scalars[\"String\"][\"output\"];\n  organizationId: Scalars[\"ID\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\nexport type DirectoryGroupList = {\n  __typename?: \"DirectoryGroupList\";\n  data: Array<DirectoryGroup>;\n  listMetadata: ListMetadata;\n};\n\nexport type DirectoryList = {\n  __typename?: \"DirectoryList\";\n  data: Array<Directory>;\n  listMetadata: ListMetadata;\n};\n\n/** A user provisioned through a Directory Sync connection. */\nexport type DirectoryUser = {\n  __typename?: \"DirectoryUser\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  directoryId: Scalars[\"ID\"][\"output\"];\n  email?: Maybe<Scalars[\"String\"][\"output\"]>;\n  firstName?: Maybe<Scalars[\"String\"][\"output\"]>;\n  id: Scalars[\"ID\"][\"output\"];\n  /** The identifier of the user in the identity provider. */\n  idpId: Scalars[\"String\"][\"output\"];\n  lastName?: Maybe<Scalars[\"String\"][\"output\"]>;\n  organizationId: Scalars[\"ID\"][\"output\"];\n  /** The provisioning state of the directory user. */\n  state: Scalars[\"String\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n  username?: Maybe<Scalars[\"String\"][\"output\"]>;\n};\n\nexport type DirectoryUserList = {\n  __typename?: \"DirectoryUserList\";\n  data: Array<DirectoryUser>;\n  listMetadata: ListMetadata;\n};\n\n/** The DNS name server provider detected for a domain. */\nexport type DomainVerificationNameServer =\n  | \"AwsRoute53\"\n  | \"CloudFlare\"\n  | \"GoDaddy\"\n  | \"GoogleDomains\"\n  | \"Other\";\n\n/** The elevated access token has expired. The user must re-verify their identity. */\nexport type ElevatedAccessTokenExpired = {\n  __typename?: \"ElevatedAccessTokenExpired\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The elevated access token is invalid. */\nexport type ElevatedAccessTokenInvalid = {\n  __typename?: \"ElevatedAccessTokenInvalid\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The verification code has expired. */\nexport type EmailChangeCodeExpired = {\n  __typename?: \"EmailChangeCodeExpired\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The verification code is incorrect. */\nexport type EmailChangeCodeIncorrect = {\n  __typename?: \"EmailChangeCodeIncorrect\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The verification code has already been used. */\nexport type EmailChangeCodePreviouslyUsed = {\n  __typename?: \"EmailChangeCodePreviouslyUsed\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The email was changed successfully. */\nexport type EmailChangeConfirmed = {\n  __typename?: \"EmailChangeConfirmed\";\n  /** A fresh elevated access token for subsequent elevated operations. */\n  elevatedAccessToken: Scalars[\"String\"][\"output\"];\n  /** When the elevated access token expires (ISO 8601). */\n  expiresAt: Scalars[\"String\"][\"output\"];\n  user: User;\n};\n\n/** Email change is not available for this account. */\nexport type EmailChangeNotAvailable = {\n  __typename?: \"EmailChangeNotAvailable\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** A verification code was sent to the new email address. */\nexport type EmailChangeSent = {\n  __typename?: \"EmailChangeSent\";\n  /** When the verification code expires. */\n  expiresAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** Too many verification attempts. */\nexport type EmailChangeTooManyAttempts = {\n  __typename?: \"EmailChangeTooManyAttempts\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The email is managed by an identity provider and cannot be changed. */\nexport type EmailManagedByProvider = {\n  __typename?: \"EmailManagedByProvider\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The email address is not available. */\nexport type EmailNotAvailable = {\n  __typename?: \"EmailNotAvailable\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** Input for enrolling a new TOTP factor. */\nexport type EnrollTotpInput = {\n  /** An elevated access token obtained by verifying the current email address. Required to prove recent re-authentication. */\n  elevatedAccessToken: Scalars[\"String\"][\"input\"];\n};\n\nexport type EnrollTotpResult =\n  | ElevatedAccessTokenExpired\n  | ElevatedAccessTokenInvalid\n  | TotpAlreadyEnrolled\n  | TotpFactor;\n\n/** A feature flag defined in the project that owns the environment the token was issued for. Mirrors the Feature Flag exposed by the REST feature flags API. */\nexport type Flag = {\n  __typename?: \"Flag\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  /** The value returned for users and organizations that do not match any targeting rule in the environment the token was issued for. */\n  defaultValue: Scalars[\"Boolean\"][\"output\"];\n  description?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** Whether the feature flag is active in the environment the token was issued for. */\n  enabled: Scalars[\"Boolean\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  /** A descriptive name for the feature flag. */\n  name: Scalars[\"String\"][\"output\"];\n  /** A unique key used to reference the feature flag. */\n  slug: Scalars[\"String\"][\"output\"];\n  /** Labels assigned to the feature flag. */\n  tags: Array<Scalars[\"String\"][\"output\"]>;\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\nexport type FlagList = {\n  __typename?: \"FlagList\";\n  data: Array<Flag>;\n  listMetadata: ListMetadata;\n};\n\n/** The identity verification has expired. Please verify your current email again. */\nexport type IdentityVerificationExpired = {\n  __typename?: \"IdentityVerificationExpired\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The identity verification is no longer valid. */\nexport type IdentityVerificationInvalid = {\n  __typename?: \"IdentityVerificationInvalid\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The provided current password does not match the existing password. */\nexport type IncorrectPassword = {\n  __typename?: \"IncorrectPassword\";\n  _placeholder: Scalars[\"Boolean\"][\"output\"];\n};\n\nexport type InvalidAuditLogExportDateRange = {\n  __typename?: \"InvalidAuditLogExportDateRange\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The provided email address is invalid. */\nexport type InvalidEmail = {\n  __typename?: \"InvalidEmail\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The requested invitation expiry is outside the allowed range (1–30 days). */\nexport type InvalidInvitationExpiry = {\n  __typename?: \"InvalidInvitationExpiry\";\n  /** Placeholder field to allow an empty @ObjectType. */\n  _placeholder?: Maybe<Scalars[\"Boolean\"][\"output\"]>;\n};\n\n/** The provided email address is not valid. */\nexport type InvalidInviteeEmail = {\n  __typename?: \"InvalidInviteeEmail\";\n  email: Scalars[\"String\"][\"output\"];\n};\n\n/** The requested role is not valid for this organization. */\nexport type InvalidInviteeRole = {\n  __typename?: \"InvalidInviteeRole\";\n  roleSlug?: Maybe<Scalars[\"String\"][\"output\"]>;\n};\n\n/** The provided locale is not a valid BCP 47 tag. */\nexport type InvalidLocale = {\n  __typename?: \"InvalidLocale\";\n  _placeholder: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** No pending invitation exists for this user in this organization. */\nexport type InvitationNotFound = {\n  __typename?: \"InvitationNotFound\";\n  userId: Scalars[\"ID\"][\"output\"];\n};\n\n/** The invitation is not pending (already accepted, expired, or revoked) and cannot be revoked. */\nexport type InvitationNotPending = {\n  __typename?: \"InvitationNotPending\";\n  userId: Scalars[\"ID\"][\"output\"];\n};\n\n/** The invitation was resent successfully. */\nexport type InvitationResent = {\n  __typename?: \"InvitationResent\";\n  invitation: OrganizationInvitation;\n};\n\n/** The invitation was revoked. */\nexport type InvitationRevoked = {\n  __typename?: \"InvitationRevoked\";\n  invitation: OrganizationInvitation;\n};\n\nexport type InviteUserInput = {\n  /** The email address to invite. */\n  email: Scalars[\"String\"][\"input\"];\n  /** Number of days until the invitation expires. Defaults to the environment setting when omitted. */\n  expiresInDays?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  /** Slug of the role to grant on acceptance. Defaults to the organization default role when omitted. */\n  roleSlug?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n};\n\nexport type InviteUserResult =\n  | InvalidInvitationExpiry\n  | InvalidInviteeEmail\n  | InvalidInviteeRole\n  | InviteeAlreadyInvited\n  | InviteeAlreadyMember\n  | InviteeEmailNotDeliverable\n  | OrganizationBlockedFromSendingInvites\n  | UserInvited;\n\n/** The user has already accepted their invitation and is an active member. */\nexport type InviteeAlreadyAccepted = {\n  __typename?: \"InviteeAlreadyAccepted\";\n  userId: Scalars[\"ID\"][\"output\"];\n};\n\n/** This email already has a pending invitation. */\nexport type InviteeAlreadyInvited = {\n  __typename?: \"InviteeAlreadyInvited\";\n  email: Scalars[\"String\"][\"output\"];\n};\n\n/** A user with this email is already a member of the organization. */\nexport type InviteeAlreadyMember = {\n  __typename?: \"InviteeAlreadyMember\";\n  email: Scalars[\"String\"][\"output\"];\n};\n\n/** The invitee's email domain has no mail servers, so the invitation email cannot be delivered. */\nexport type InviteeEmailNotDeliverable = {\n  __typename?: \"InviteeEmailNotDeliverable\";\n  email: Scalars[\"String\"][\"output\"];\n};\n\nexport type ListMetadata = {\n  __typename?: \"ListMetadata\";\n  after?: Maybe<Scalars[\"String\"][\"output\"]>;\n  before?: Maybe<Scalars[\"String\"][\"output\"]>;\n};\n\n/** The member is provisioned by a directory and cannot be removed. */\nexport type MemberIsManagedByDirectory = {\n  __typename?: \"MemberIsManagedByDirectory\";\n  /** The user ID of the directory-managed member. */\n  userId: Scalars[\"ID\"][\"output\"];\n};\n\n/** No active member was found for the given user in the organization. */\nexport type MemberNotFound = {\n  __typename?: \"MemberNotFound\";\n  /** The user ID that did not resolve to a member. */\n  userId: Scalars[\"ID\"][\"output\"];\n};\n\n/** The member was removed from the organization. */\nexport type MemberRemoved = {\n  __typename?: \"MemberRemoved\";\n  /** The user ID of the removed member. */\n  userId: Scalars[\"ID\"][\"output\"];\n};\n\n/** The member's role was updated. */\nexport type MemberRoleUpdated = {\n  __typename?: \"MemberRoleUpdated\";\n  member: OrganizationMember;\n};\n\n/** All TOTP factors were removed successfully. */\nexport type MfaFactorRemoved = {\n  __typename?: \"MfaFactorRemoved\";\n  success: Scalars[\"Boolean\"][\"output\"];\n};\n\nexport type Mutation = {\n  __typename?: \"Mutation\";\n  /** Grant a permission to a role belonging to the organization the token was issued for. */\n  assignPermissionToRole: Role;\n  /** Confirms an email change using the verification code sent to the new email address. Requires an elevated access token from `verifyCurrentEmail`. */\n  confirmEmailChange: ConfirmEmailChangeResult;\n  /** Connect the authenticated user to a data provider with OAuth client credentials the user supplies. Replaces the credentials when the user already has a client-credentials connection to the data provider, so this is both the connect and the reconnect path. The credentials are stored encrypted and never returned. */\n  connectDataProviderWithClientCredentials: ConnectDataProviderResult;\n  /** Mint a short-lived link that starts an Admin Portal session for the token's organization, scoped to a single setup flow. */\n  createAdminPortalLink: AdminPortalLink;\n  createAuditLogExport: CreateAuditLogExportResult;\n  /** Start an OAuth authorization connecting the authenticated user to a data provider. Returns the URL to open in a popup and the `state` to poll with `dataProviderAuthorizationStatus`. Re-authorizing a provider the user is already connected to replaces that connection's credentials once the flow completes, so this is also the reconnect path. */\n  createDataProviderAuthorization: CreateDataProviderAuthorizationResult;\n  /** Connect the authenticated user to a data provider with an API key the user supplies. Replaces the API key when the user already has an API-key connection to the data provider. */\n  createDataProviderConnection: DataProviderConnection;\n  /** Start an OAuth authorization connecting the token's organization to an organization-owned data provider, producing one connection shared by every member. A handoff is always required: the member completing the flow must confirm it explicitly because the resulting connection is not their own. */\n  createOrganizationDataProviderAuthorization: CreateDataProviderAuthorizationResult;\n  /** Add a domain to the token's organization and begin DNS verification. */\n  createOrganizationDomain: OrganizationDomain;\n  /** Set a password for the authenticated user who does not yet have one (e.g. signed up via OAuth). Validates against the environment password policy. */\n  createPassword: CreatePasswordResult;\n  /** Create a role for the organization the token was issued for. */\n  createRole: Role;\n  /** Create an SSO connection for the token’s organization. */\n  createSsoConnection: Connection;\n  /** Disconnect one of the authenticated user's data provider connections, revoking the stored credentials. */\n  deleteDataProviderConnection: Scalars[\"ID\"][\"output\"];\n  /** Delete a domain belonging to the token's organization and return it. */\n  deleteOrganizationDomain: OrganizationDomain;\n  /** Remove the specified passkey from the authenticated user's account. */\n  deletePasskey: DeletePasskeyResult;\n  /** Delete a role belonging to the organization the token was issued for. */\n  deleteRole: RoleDeleted;\n  /** Delete an SSO connection belonging to the token’s organization. */\n  deleteSsoConnection: Scalars[\"ID\"][\"output\"];\n  /** Create a TOTP factor and return the secret and QR URI for the user to scan. This is step 1 of TOTP enrollment. */\n  enrollTotp: EnrollTotpResult;\n  /** Invite a user to the organization the token was issued for, assigning a role and sending the invitation email. */\n  inviteUser: InviteUserResult;\n  /** Begin passkey (WebAuthn) registration for the authenticated user by returning the credential creation options. This is step 1 of the registration ceremony; complete it with `verifyPasskey`. */\n  registerPasskey: RegisterPasskeyResult;\n  /** Remove a member from the organization the token was issued for. */\n  removeMember: RemoveMemberResult;\n  /** Delete all TOTP factors for the authenticated user, effectively resetting MFA. */\n  removeMfaFactor: RemoveMfaFactorResult;\n  /** Resend a pending, expired, or revoked invitation for the organization the token was issued for. If the original invitation has expired or been revoked, a new invitation is created with the same role. */\n  resendInvitation: ResendInvitationResult;\n  /** Restart verification for a domain belonging to the token's organization. */\n  reverifyOrganizationDomain: OrganizationDomain;\n  /** Revokes all active sessions for the authenticated user except the current one. */\n  revokeAllSessions: RevokeAllSessionsResult;\n  /** Revoke a pending invitation for the organization the token was issued for. */\n  revokeInvitation: RevokeInvitationResult;\n  /** Revokes a specific session by ID. */\n  revokeSession: RevokeSessionResult;\n  /** Sends a verification code to the new email address. Requires an elevated access token from `verifyCurrentEmail`. The user must confirm with the code via `confirmEmailChange`. */\n  sendEmailChange: SendEmailChangeResult;\n  /** Sends a verification code to the user's current email address to prove ownership before changing email. */\n  sendVerificationCode: SendVerificationCodeResult;\n  /** Write a data provider's configuration for the token's organization: whether the organization's members can connect it, the scopes it requests, the organization's own OAuth client credentials, and any non-secret configuration values the provider declares. Fields left out are unchanged. Supersedes `setDataProviderEnabled` for anything beyond toggling `enabled`. */\n  setDataProviderConfiguration: SetDataProviderConfigurationResult;\n  /** Enable or disable a data provider for the token's organization. Disabling it hides the data provider from the organization's users and stops new connections; existing connections stay readable so they can be disconnected. */\n  setDataProviderEnabled: DataProvider;\n  /** Update an organization member's roles within the organization the token was issued for. When multiple roles are enabled, all provided role slugs are assigned; otherwise only the first is used. */\n  updateMemberRole: UpdateMemberRoleResult;\n  /** Change the password for the authenticated user. Requires the current password for verification and validates the new password against the environment password policy. */\n  updatePassword: UpdatePasswordResult;\n  /** Updates the authenticated user's profile (first name, last name, locale). */\n  updateProfile: UpdateProfileResult;\n  /** Update a role belonging to the organization the token was issued for. */\n  updateRole: Role;\n  /** Update an SSO connection belonging to the token’s organization. */\n  updateSsoConnection: Connection;\n  /** Verifies the code sent to the current email address. Returns an elevated access token required for `sendEmailChange` and `confirmEmailChange`. */\n  verifyCurrentEmail: VerifyCurrentEmailResult;\n  /** Complete passkey (WebAuthn) registration by verifying the credential created by the authenticator. This is step 2 of the registration ceremony started by `registerPasskey`. */\n  verifyPasskey: VerifyPasskeyResult;\n  /** Confirm TOTP enrollment by verifying a code from the authenticator app. Marks the factor as verified. */\n  verifyTotp: VerifyTotpResult;\n};\n\nexport type MutationAssignPermissionToRoleArgs = {\n  input: AssignPermissionToRoleInput;\n};\n\nexport type MutationConfirmEmailChangeArgs = {\n  input: ConfirmEmailChangeInput;\n};\n\nexport type MutationConnectDataProviderWithClientCredentialsArgs = {\n  input: ConnectDataProviderWithClientCredentialsInput;\n};\n\nexport type MutationCreateAdminPortalLinkArgs = {\n  intent: AdminPortalLinkIntent;\n};\n\nexport type MutationCreateAuditLogExportArgs = {\n  input: CreateAuditLogExportInput;\n};\n\nexport type MutationCreateDataProviderAuthorizationArgs = {\n  input: CreateDataProviderAuthorizationInput;\n};\n\nexport type MutationCreateDataProviderConnectionArgs = {\n  input: CreateDataProviderConnectionInput;\n};\n\nexport type MutationCreateOrganizationDataProviderAuthorizationArgs = {\n  input: CreateOrganizationDataProviderAuthorizationInput;\n};\n\nexport type MutationCreateOrganizationDomainArgs = {\n  domain: Scalars[\"String\"][\"input\"];\n};\n\nexport type MutationCreatePasswordArgs = {\n  input: CreatePasswordInput;\n};\n\nexport type MutationCreateRoleArgs = {\n  input: CreateRoleInput;\n};\n\nexport type MutationCreateSsoConnectionArgs = {\n  input: CreateSsoConnectionInput;\n};\n\nexport type MutationDeleteDataProviderConnectionArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type MutationDeleteOrganizationDomainArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type MutationDeletePasskeyArgs = {\n  input: DeletePasskeyInput;\n};\n\nexport type MutationDeleteRoleArgs = {\n  input: DeleteRoleInput;\n};\n\nexport type MutationDeleteSsoConnectionArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type MutationEnrollTotpArgs = {\n  input: EnrollTotpInput;\n};\n\nexport type MutationInviteUserArgs = {\n  input: InviteUserInput;\n};\n\nexport type MutationRegisterPasskeyArgs = {\n  input: RegisterPasskeyInput;\n};\n\nexport type MutationRemoveMemberArgs = {\n  input: RemoveMemberInput;\n};\n\nexport type MutationRemoveMfaFactorArgs = {\n  input: RemoveMfaFactorInput;\n};\n\nexport type MutationResendInvitationArgs = {\n  input: ResendInvitationInput;\n};\n\nexport type MutationReverifyOrganizationDomainArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type MutationRevokeInvitationArgs = {\n  input: RevokeInvitationInput;\n};\n\nexport type MutationRevokeSessionArgs = {\n  input: RevokeSessionInput;\n};\n\nexport type MutationSendEmailChangeArgs = {\n  input: SendEmailChangeInput;\n};\n\nexport type MutationSetDataProviderConfigurationArgs = {\n  input: SetDataProviderConfigurationInput;\n};\n\nexport type MutationSetDataProviderEnabledArgs = {\n  input: SetDataProviderEnabledInput;\n};\n\nexport type MutationUpdateMemberRoleArgs = {\n  input: UpdateMemberRoleInput;\n};\n\nexport type MutationUpdatePasswordArgs = {\n  input: UpdatePasswordInput;\n};\n\nexport type MutationUpdateProfileArgs = {\n  input: UpdateProfileInput;\n};\n\nexport type MutationUpdateRoleArgs = {\n  input: UpdateRoleInput;\n};\n\nexport type MutationUpdateSsoConnectionArgs = {\n  input: UpdateSsoConnectionInput;\n};\n\nexport type MutationVerifyCurrentEmailArgs = {\n  input: VerifyCurrentEmailInput;\n};\n\nexport type MutationVerifyPasskeyArgs = {\n  input: VerifyPasskeyInput;\n};\n\nexport type MutationVerifyTotpArgs = {\n  input: VerifyTotpInput;\n};\n\nexport type NoAuditEventsFound = {\n  __typename?: \"NoAuditEventsFound\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The user has no TOTP factors to remove. */\nexport type NoMfaFactorsEnrolled = {\n  __typename?: \"NoMfaFactorsEnrolled\";\n  _placeholder: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** There is no pending email change to confirm. */\nexport type NoPendingEmailChange = {\n  __typename?: \"NoPendingEmailChange\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** OAuth provider for a connected account. */\nexport type OAuthProvider =\n  | \"AppleOAuth\"\n  | \"BitbucketOAuth\"\n  | \"DiscordOAuth\"\n  | \"GitLabOAuth\"\n  | \"GithubOAuth\"\n  | \"GoogleOAuth\"\n  | \"GrokOAuth\"\n  | \"IntuitOAuth\"\n  | \"LinkedInOAuth\"\n  | \"MicrosoftOAuth\"\n  | \"SalesforceOAuth\"\n  | \"SlackOAuth\"\n  | \"VercelMarketplaceOAuth\"\n  | \"VercelOAuth\"\n  | \"XOAuth\"\n  | \"XeroOAuth\";\n\n/** An organization in the current environment. */\nexport type Organization = {\n  __typename?: \"Organization\";\n  /** Whether the organization allows profiles outside the organization domains. */\n  allowProfilesOutsideOrganization: Scalars[\"Boolean\"][\"output\"];\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  name: Scalars[\"String\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** This organization is not allowed to send invites. */\nexport type OrganizationBlockedFromSendingInvites = {\n  __typename?: \"OrganizationBlockedFromSendingInvites\";\n  /** Placeholder field to allow an empty @ObjectType. */\n  _placeholder?: Maybe<Scalars[\"Boolean\"][\"output\"]>;\n};\n\n/** A data provider the token's organization connects on behalf of all its members. */\nexport type OrganizationDataProvider = {\n  __typename?: \"OrganizationDataProvider\";\n  authMethods: Array<Scalars[\"String\"][\"output\"]>;\n  /** The organization's single shared connection, when it has authorized this data provider. */\n  connection?: Maybe<DataProviderConnection>;\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  description?: Maybe<Scalars[\"String\"][\"output\"]>;\n  enabled: Scalars[\"Boolean\"][\"output\"];\n  /** Whether the organization has supplied its own OAuth client credentials for this data provider. Always false for a provider whose credentials the developer manages. */\n  hasCredentials: Scalars[\"Boolean\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  integrationType: Scalars[\"String\"][\"output\"];\n  name: Scalars[\"String\"][\"output\"];\n  scopes?: Maybe<Array<Scalars[\"String\"][\"output\"]>>;\n  slug: Scalars[\"String\"][\"output\"];\n  state: Scalars[\"String\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\nexport type OrganizationDataProviderList = {\n  __typename?: \"OrganizationDataProviderList\";\n  data: Array<OrganizationDataProvider>;\n  listMetadata: ListMetadata;\n};\n\n/** A domain belonging to the organization the token was issued for. */\nexport type OrganizationDomain = {\n  __typename?: \"OrganizationDomain\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  /** The fully qualified domain name. */\n  domain: Scalars[\"String\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  /** The DNS name server provider detected for the domain. */\n  nameServer: DomainVerificationNameServer;\n  organizationId: Scalars[\"ID\"][\"output\"];\n  state: OrganizationDomainState;\n  /** The subdomain portion of the domain, if any. */\n  subdomain?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** The DNS record prefix the customer must add to verify the domain. */\n  verificationPrefix?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** The DNS record value the customer must add to verify the domain. */\n  verificationToken?: Maybe<Scalars[\"String\"][\"output\"]>;\n};\n\nexport type OrganizationDomainList = {\n  __typename?: \"OrganizationDomainList\";\n  data: Array<OrganizationDomain>;\n  listMetadata: ListMetadata;\n};\n\n/** The verification state of an organization domain. */\nexport type OrganizationDomainState =\n  | \"Failed\"\n  | \"LegacyVerified\"\n  | \"Pending\"\n  | \"Verified\";\n\n/** An invitation to join the organization the token was issued for. */\nexport type OrganizationInvitation = {\n  __typename?: \"OrganizationInvitation\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  /** The email address the invitation was sent to. */\n  email: Scalars[\"String\"][\"output\"];\n  /** When the invitation expires. */\n  expiresAt: Scalars[\"DateTime\"][\"output\"];\n  /** The ID of the invitation. */\n  id: Scalars[\"ID\"][\"output\"];\n  /** Slug of the role the invitee will be granted on acceptance, if any. */\n  roleSlug?: Maybe<Scalars[\"String\"][\"output\"]>;\n  status: OrganizationInvitationStatus;\n};\n\nexport type OrganizationInvitationStatus =\n  | \"Accepted\"\n  | \"Expired\"\n  | \"Pending\"\n  | \"Revoked\";\n\n/** An organization member — a user with their membership status and assigned roles. */\nexport type OrganizationMember = {\n  __typename?: \"OrganizationMember\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  email: Scalars[\"String\"][\"output\"];\n  emailVerified: Scalars[\"Boolean\"][\"output\"];\n  firstName?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** The user ID of the member. */\n  id: Scalars[\"ID\"][\"output\"];\n  /** Timestamp of the member's most recent session activity. */\n  lastActivityAt?: Maybe<Scalars[\"DateTime\"][\"output\"]>;\n  lastName?: Maybe<Scalars[\"String\"][\"output\"]>;\n  profilePictureUrl?: Maybe<Scalars[\"String\"][\"output\"]>;\n  roles: Array<OrganizationMemberRole>;\n  status: OrganizationMemberStatus;\n};\n\n/** A paginated list of organization members. */\nexport type OrganizationMemberList = {\n  __typename?: \"OrganizationMemberList\";\n  data: Array<OrganizationMember>;\n  listMetadata: ListMetadata;\n};\n\n/** A role assigned to an organization member. */\nexport type OrganizationMemberRole = {\n  __typename?: \"OrganizationMemberRole\";\n  name: Scalars[\"String\"][\"output\"];\n  slug: Scalars[\"String\"][\"output\"];\n};\n\nexport type OrganizationMemberStatus =\n  | \"Active\"\n  | \"InviteExpired\"\n  | \"InviteRevoked\"\n  | \"Invited\"\n  | \"NoInvite\";\n\n/** Enum represents the pagination order. */\nexport type PaginationOrder = \"Asc\" | \"Desc\" | \"Normal\";\n\n/** A registered passkey (WebAuthn credential) for the authenticated user. */\nexport type Passkey = {\n  __typename?: \"Passkey\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  id: Scalars[\"ID\"][\"output\"];\n  /** When this passkey was last used to authenticate. */\n  lastVerifiedAt?: Maybe<Scalars[\"DateTime\"][\"output\"]>;\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** The registration challenge was not found. Challenges are single-use and expire after a few minutes; restart registration. */\nexport type PasskeyChallengeNotFound = {\n  __typename?: \"PasskeyChallengeNotFound\";\n  _placeholder: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** The passkey was deleted successfully. */\nexport type PasskeyDeleted = {\n  __typename?: \"PasskeyDeleted\";\n  success: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** No passkey with the given ID belongs to the authenticated user. */\nexport type PasskeyNotFound = {\n  __typename?: \"PasskeyNotFound\";\n  _placeholder: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** The WebAuthn credential creation options to pass to the browser, plus the challenge ID to send back with the attestation in `verifyPasskey`. */\nexport type PasskeyRegistrationOptions = {\n  __typename?: \"PasskeyRegistrationOptions\";\n  /** The server-side challenge ID. Pass it to `verifyPasskey` together with the attestation response. */\n  challengeId: Scalars[\"String\"][\"output\"];\n  /** The WebAuthn PublicKeyCredentialCreationOptionsJSON to pass to navigator.credentials.create(). */\n  options: Scalars[\"JSON\"][\"output\"];\n};\n\n/** The WebAuthn attestation response failed verification. */\nexport type PasskeyVerificationFailed = {\n  __typename?: \"PasskeyVerificationFailed\";\n  _placeholder: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** The passkey was verified and registered successfully. */\nexport type PasskeyVerified = {\n  __typename?: \"PasskeyVerified\";\n  success: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** The types of characters in a password. */\nexport type PasswordCharacterType =\n  | \"Lowercase\"\n  | \"Number\"\n  | \"Symbol\"\n  | \"Uppercase\";\n\n/** The password was created successfully. */\nexport type PasswordCreated = {\n  __typename?: \"PasswordCreated\";\n  success: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** The password requirements configured for the environment. Use these to describe the requirements before a password is submitted; `createPassword` and `updatePassword` enforce them. */\nexport type PasswordPolicy = {\n  __typename?: \"PasswordPolicy\";\n  /** The minimum number of characters. */\n  minimumLength: Scalars[\"Int\"][\"output\"];\n  /** The minimum zxcvbn strength score (0–4) a password must reach. */\n  minimumStrength: Scalars[\"Int\"][\"output\"];\n  /** Whether passwords found in known data breaches are rejected. */\n  rejectsBreachedPasswords: Scalars[\"Boolean\"][\"output\"];\n  /** Whether a lowercase letter is required. */\n  requiresLowercase: Scalars[\"Boolean\"][\"output\"];\n  /** Whether a number is required. */\n  requiresNumber: Scalars[\"Boolean\"][\"output\"];\n  /** Whether a special character is required. */\n  requiresSymbol: Scalars[\"Boolean\"][\"output\"];\n  /** Whether an uppercase letter is required. */\n  requiresUppercase: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** The provided password does not meet the environment password policy requirements. */\nexport type PasswordPolicyViolation = {\n  __typename?: \"PasswordPolicyViolation\";\n  /** A machine-readable error code. Matches the `code` of the first entry in `violations`. */\n  code: Scalars[\"String\"][\"output\"];\n  /** A human-readable description of the policy violation. Describes the first entry in `violations`. */\n  message: Scalars[\"String\"][\"output\"];\n  /** Every way in which the password failed the policy, so all of them can be surfaced at once. */\n  violations: Array<PasswordViolation>;\n};\n\n/** The password was updated successfully. */\nexport type PasswordUpdated = {\n  __typename?: \"PasswordUpdated\";\n  success: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** A single way in which a password failed the environment password policy. Fields other than `code` and `message` are only populated for the codes that carry them. */\nexport type PasswordViolation = {\n  __typename?: \"PasswordViolation\";\n  /** For a missing `Symbol` character type, the symbols that satisfy the requirement. */\n  allowedSymbols?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** For `password_pwned`, how many times the password appears in known data breaches. */\n  breachOccurrences?: Maybe<Scalars[\"Int\"][\"output\"]>;\n  /** For `password_missing_character_type`, the class of character that is missing. */\n  characterType?: Maybe<PasswordCharacterType>;\n  /** A machine-readable error code, e.g. `password_too_short`, `password_missing_character_type`, `password_pwned`, `password_reused`, `password_too_weak`, `password_contains_email`, `password_too_long`. */\n  code: Scalars[\"String\"][\"output\"];\n  /** For `password_too_long`, the allowed maximum length. */\n  maximumLength?: Maybe<Scalars[\"Int\"][\"output\"]>;\n  /** A human-readable description of this violation. */\n  message: Scalars[\"String\"][\"output\"];\n  /** For `password_too_short`, the required minimum length. */\n  minimumLength?: Maybe<Scalars[\"Int\"][\"output\"]>;\n  /** For `password_too_weak`, suggestions for choosing a stronger password. Empty for other codes. */\n  strengthSuggestions: Array<Scalars[\"String\"][\"output\"]>;\n  /** For `password_too_weak`, a summary of why it is weak. */\n  strengthWarning?: Maybe<Scalars[\"String\"][\"output\"]>;\n};\n\n/** A permission that can be granted to a role within the environment. */\nexport type Permission = {\n  __typename?: \"Permission\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  description?: Maybe<Scalars[\"String\"][\"output\"]>;\n  id: Scalars[\"ID\"][\"output\"];\n  name: Scalars[\"String\"][\"output\"];\n  slug: Scalars[\"String\"][\"output\"];\n  /** Whether this is a WorkOS-managed system permission that cannot be modified. */\n  system: Scalars[\"Boolean\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\nexport type PermissionList = {\n  __typename?: \"PermissionList\";\n  data: Array<Permission>;\n  listMetadata: ListMetadata;\n};\n\n/** The profile was updated successfully. */\nexport type ProfileUpdated = {\n  __typename?: \"ProfileUpdated\";\n  user: User;\n};\n\nexport type Query = {\n  __typename?: \"Query\";\n  auditEvent: AuditEvent;\n  auditEvents: AuditEventList;\n  auditLogExport: AuditLogExport;\n  /** The audit log stream destination configured for the token's organization, or null when no stream is configured. */\n  auditLogStream?: Maybe<AuditLogStream>;\n  /** The authentication methods the environment allows and the password policy it enforces. Requires a session token. */\n  authenticationSettings: AuthenticationSettings;\n  /** The AuthKit settings for the token's environment. */\n  authkitSettings: AuthKitSettings;\n  /** The branding configured for the token's environment. */\n  branding: Branding;\n  /** Placeholder query for the Client GraphQL API scaffold. Returns a static value and is replaced by real resolvers. */\n  clientApiStatus: Scalars[\"String\"][\"output\"];\n  /** Return a data provider by ID within the token's environment. */\n  dataProvider: DataProvider;\n  /** Report whether an authorization attempt is still outstanding. Poll this with the `state` returned when the authorization was created while the popup is open; it flips to `connecting: false` once the provider callback has been handled or the attempt expired. */\n  dataProviderAuthorizationStatus: DataProviderAuthorizationStatus;\n  /** Return one of the authenticated user's data provider connections by ID. */\n  dataProviderConnection: DataProviderConnection;\n  /** List the authenticated user's data provider connections, including their status. */\n  dataProviderConnections: DataProviderConnectionList;\n  /** List the data providers configured in the token's environment. */\n  dataProviders: DataProviderList;\n  /** Return a Directory Sync connection by ID within the token's organization. */\n  directoryConnection: Directory;\n  /** List the Directory Sync connections for the token's organization. */\n  directoryConnections: DirectoryList;\n  /** List the groups of a Directory Sync connection. */\n  directoryGroups: DirectoryGroupList;\n  /** List the users of a Directory Sync connection. */\n  directoryUsers: DirectoryUserList;\n  /** The permissions a user effectively has in the organization the token was issued for, including permissions inherited through the user's roles. Callers may read their own effective permissions; reading another member's requires the elevated user:read grant. */\n  effectivePermissions: Array<Permission>;\n  /** The feature flags that evaluate to enabled for a user in the environment the token was issued for, including flags targeted at the token's organization. Flags absent from the list evaluate to false. Callers may evaluate their own flags; evaluating another member of the token's organization requires the elevated user:read grant. */\n  evaluatedFlags: FlagList;\n  /** Fetch a feature flag by ID from the project that owns the token's environment. */\n  flag: Flag;\n  /** Fetch a feature flag by slug from the project that owns the token's environment. */\n  flagBySlug: Flag;\n  /** List the feature flags of the project that owns the token's environment, with their state in that environment. */\n  flags: FlagList;\n  /** Returns the currently authenticated user (the subject of the token). */\n  me: User;\n  /** Returns an organization by ID within the token's environment. */\n  organization: Organization;\n  /** List the data providers the token's organization connects on behalf of all its members, with the organization's shared connection when it has one. */\n  organizationDataProviders: OrganizationDataProviderList;\n  /** Return a domain by ID within the token's organization, including its verification status. */\n  organizationDomain: OrganizationDomain;\n  /** List the domains belonging to the organization the token was issued for. */\n  organizationDomains: OrganizationDomainList;\n  /** List members of the organization the token was issued for, with their roles. */\n  organizationMemberships: OrganizationMemberList;\n  /** List organizations the authenticated user belongs to. */\n  organizations: Array<UserOrganization>;\n  /** List registered passkeys for the authenticated user. Requires a session token. */\n  passkeys: Array<Passkey>;\n  /** List the permissions defined in the environment the token was issued for. */\n  permissions: PermissionList;\n  /** Fetch a single role available to the organization the token was issued for. */\n  role?: Maybe<Role>;\n  /** List roles available to the organization the token was issued for, with role assignment configuration. */\n  roles: RolesResult;\n  /** List active sessions for the authenticated user. Requires a session token. */\n  sessions: Array<Session>;\n  /** Returns an SSO connection by ID, including its IdP setup status, provided it belongs to the token's organization. */\n  ssoConnection: Connection;\n  /** List the SSO connections belonging to the organization the token was issued for. */\n  ssoConnections: Array<Connection>;\n  /** Returns a user by ID, provided they are a member of the token's organization. */\n  user: User;\n};\n\nexport type QueryAuditEventArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryAuditEventsArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  filter: AuditEventFilterInput;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n};\n\nexport type QueryAuditLogExportArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryDataProviderArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryDataProviderAuthorizationStatusArgs = {\n  dataProviderId: Scalars[\"ID\"][\"input\"];\n  state: Scalars[\"String\"][\"input\"];\n};\n\nexport type QueryDataProviderConnectionArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryDataProviderConnectionsArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n};\n\nexport type QueryDataProvidersArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n};\n\nexport type QueryDirectoryConnectionArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryDirectoryConnectionsArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n  search?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n};\n\nexport type QueryDirectoryGroupsArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  directoryId: Scalars[\"ID\"][\"input\"];\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n};\n\nexport type QueryDirectoryUsersArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  directoryId: Scalars[\"ID\"][\"input\"];\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n};\n\nexport type QueryEffectivePermissionsArgs = {\n  userId: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryEvaluatedFlagsArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n  userId: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryFlagArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryFlagBySlugArgs = {\n  slug: Scalars[\"String\"][\"input\"];\n};\n\nexport type QueryFlagsArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  enabled?: InputMaybe<Scalars[\"Boolean\"][\"input\"]>;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n  search?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n};\n\nexport type QueryOrganizationArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryOrganizationDataProvidersArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n};\n\nexport type QueryOrganizationDomainArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryOrganizationDomainsArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n};\n\nexport type QueryOrganizationMembershipsArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n  roleSlug?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  search?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n};\n\nexport type QueryPermissionsArgs = {\n  after?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  before?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  limit?: InputMaybe<Scalars[\"Int\"][\"input\"]>;\n  order?: InputMaybe<PaginationOrder>;\n  search?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n};\n\nexport type QueryRoleArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QuerySsoConnectionArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\nexport type QueryUserArgs = {\n  id: Scalars[\"ID\"][\"input\"];\n};\n\n/** Input for beginning passkey (WebAuthn) registration. */\nexport type RegisterPasskeyInput = {\n  /** An elevated access token obtained by verifying the current email address. Required to prove recent re-authentication. */\n  elevatedAccessToken: Scalars[\"String\"][\"input\"];\n};\n\nexport type RegisterPasskeyResult =\n  | ElevatedAccessTokenExpired\n  | ElevatedAccessTokenInvalid\n  | PasskeyRegistrationOptions;\n\nexport type RemoveMemberInput = {\n  /** The user ID of the member to remove. */\n  userId: Scalars[\"ID\"][\"input\"];\n};\n\nexport type RemoveMemberResult =\n  | MemberIsManagedByDirectory\n  | MemberNotFound\n  | MemberRemoved;\n\n/** Input for removing all TOTP factors. */\nexport type RemoveMfaFactorInput = {\n  /** An elevated access token obtained by verifying the current email address. Required to prove recent re-authentication. */\n  elevatedAccessToken: Scalars[\"String\"][\"input\"];\n};\n\nexport type RemoveMfaFactorResult =\n  | ElevatedAccessTokenExpired\n  | ElevatedAccessTokenInvalid\n  | MfaFactorRemoved\n  | NoMfaFactorsEnrolled;\n\nexport type ResendInvitationInput = {\n  /** The ID of the user whose invitation should be resent. */\n  userId: Scalars[\"ID\"][\"input\"];\n};\n\n/** No invitation exists for this user in this organization. */\nexport type ResendInvitationNotFound = {\n  __typename?: \"ResendInvitationNotFound\";\n  userId: Scalars[\"ID\"][\"output\"];\n};\n\nexport type ResendInvitationResult =\n  | InvitationResent\n  | InviteeAlreadyAccepted\n  | InviteeEmailNotDeliverable\n  | ResendInvitationNotFound;\n\nexport type RevokeAllSessionsResult = AllSessionsRevoked;\n\nexport type RevokeInvitationInput = {\n  /** The ID of the user whose pending invitation should be revoked. */\n  userId: Scalars[\"ID\"][\"input\"];\n};\n\nexport type RevokeInvitationResult =\n  | InvitationNotFound\n  | InvitationNotPending\n  | InvitationRevoked;\n\n/** Input for revoking a specific session. */\nexport type RevokeSessionInput = {\n  /** The ID of the session to revoke. */\n  sessionId: Scalars[\"ID\"][\"input\"];\n};\n\nexport type RevokeSessionResult = SessionNotFound | SessionRevoked;\n\n/** A role available within the organization. */\nexport type Role = {\n  __typename?: \"Role\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  description?: Maybe<Scalars[\"String\"][\"output\"]>;\n  id: Scalars[\"ID\"][\"output\"];\n  /** Whether this is the default role assigned to new members. */\n  isDefault: Scalars[\"Boolean\"][\"output\"];\n  name: Scalars[\"String\"][\"output\"];\n  slug: Scalars[\"String\"][\"output\"];\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** Confirms that a role has been scheduled for deletion. */\nexport type RoleDeleted = {\n  __typename?: \"RoleDeleted\";\n  /** The ID of the deleted role. */\n  id: Scalars[\"ID\"][\"output\"];\n};\n\n/** No active roles with the given slugs exist in the environment. */\nexport type RoleNotFound = {\n  __typename?: \"RoleNotFound\";\n  /** The role slugs that did not resolve to active roles. */\n  roleSlugs: Array<Scalars[\"String\"][\"output\"]>;\n};\n\n/** Roles available in the organization along with role assignment configuration. */\nexport type RolesResult = {\n  __typename?: \"RolesResult\";\n  /** Whether members can be assigned multiple roles simultaneously. */\n  multipleRolesEnabled: Scalars[\"Boolean\"][\"output\"];\n  roles: Array<Role>;\n};\n\n/** Input for requesting an email change verification code. */\nexport type SendEmailChangeInput = {\n  /** The elevated access token from a successful `verifyCurrentEmail` call. */\n  elevatedAccessToken: Scalars[\"String\"][\"input\"];\n  /** The new email address to change to. */\n  newEmail: Scalars[\"String\"][\"input\"];\n};\n\nexport type SendEmailChangeResult =\n  | DailyEmailQuotaExceeded\n  | EmailChangeNotAvailable\n  | EmailChangeSent\n  | EmailManagedByProvider\n  | EmailNotAvailable\n  | IdentityVerificationExpired\n  | IdentityVerificationInvalid\n  | InvalidEmail;\n\nexport type SendVerificationCodeResult =\n  | DailyEmailQuotaExceeded\n  | VerificationCodeSent;\n\n/** An active user session. */\nexport type Session = {\n  __typename?: \"Session\";\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  currentLocation?: Maybe<SessionLocation>;\n  id: Scalars[\"ID\"][\"output\"];\n  ipAddress?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** Whether this session is the one making the request. */\n  isCurrent: Scalars[\"Boolean\"][\"output\"];\n  lastActivityAt?: Maybe<Scalars[\"DateTime\"][\"output\"]>;\n  organizationId?: Maybe<Scalars[\"String\"][\"output\"]>;\n  state: SessionState;\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n  userAgent?: Maybe<Scalars[\"String\"][\"output\"]>;\n};\n\n/** Approximate geographic location derived from the session IP. */\nexport type SessionLocation = {\n  __typename?: \"SessionLocation\";\n  cityName: Scalars[\"String\"][\"output\"];\n  countryISOCode: Scalars[\"String\"][\"output\"];\n};\n\n/** No session was found with the given ID. */\nexport type SessionNotFound = {\n  __typename?: \"SessionNotFound\";\n  /** The session ID that did not resolve to a session. */\n  sessionId: Scalars[\"ID\"][\"output\"];\n};\n\n/** The session was revoked successfully. */\nexport type SessionRevoked = {\n  __typename?: \"SessionRevoked\";\n  session: Session;\n};\n\n/** The lifecycle state of a session. */\nexport type SessionState = {\n  __typename?: \"SessionState\";\n  expiresAt?: Maybe<Scalars[\"DateTime\"][\"output\"]>;\n  /** Session state: Issued, Revoked, etc. */\n  tag: Scalars[\"String\"][\"output\"];\n};\n\nexport type SetDataProviderConfigurationInput = {\n  /** The organization's own OAuth client ID. Must be supplied together with `clientSecret`. */\n  clientId?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  /** The organization's own OAuth client secret. Write-only: it is stored encrypted and never returned; clients read `hasCredentials` instead. */\n  clientSecret?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  /** Non-secret configuration values declared by the provider. */\n  config?: InputMaybe<Array<DataProviderConfigEntryInput>>;\n  /** The data provider to configure for the token's organization. Configuration always applies to the token's organization; it cannot be set for another one. */\n  dataProviderId: Scalars[\"ID\"][\"input\"];\n  /** Whether the organization's users can see and connect the data provider. */\n  enabled?: InputMaybe<Scalars[\"Boolean\"][\"input\"]>;\n  /** The scopes the organization requests. Only providers where the organization brings its own OAuth credentials may widen beyond the defaults. */\n  scopes?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n};\n\nexport type SetDataProviderConfigurationResult =\n  | DataProviderConfigInvalid\n  | DataProviderConfiguration;\n\nexport type SetDataProviderEnabledInput = {\n  dataProviderId: Scalars[\"ID\"][\"input\"];\n  /** Whether the data provider is available to the organization the token was issued for. */\n  enabled: Scalars[\"Boolean\"][\"input\"];\n};\n\n/** The user already has a verified TOTP factor enrolled. */\nexport type TotpAlreadyEnrolled = {\n  __typename?: \"TotpAlreadyEnrolled\";\n  _placeholder: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** TOTP factor details returned after enrollment. */\nexport type TotpFactor = {\n  __typename?: \"TotpFactor\";\n  /** The authentication challenge ID. */\n  authenticationChallengeId: Scalars[\"String\"][\"output\"];\n  /** The authentication factor ID. */\n  authenticationFactorId: Scalars[\"String\"][\"output\"];\n  /** A data-URI PNG of the QR code. */\n  qrCode: Scalars[\"String\"][\"output\"];\n  /** The TOTP secret for manual entry. */\n  secret: Scalars[\"String\"][\"output\"];\n  /** The TOTP URI for provisioning (otpauth://…). */\n  uri: Scalars[\"String\"][\"output\"];\n};\n\n/** The TOTP verification code was invalid. */\nexport type TotpVerificationFailed = {\n  __typename?: \"TotpVerificationFailed\";\n  _placeholder: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** The TOTP verification succeeded and the factor is active. */\nexport type TotpVerified = {\n  __typename?: \"TotpVerified\";\n  success: Scalars[\"Boolean\"][\"output\"];\n};\n\nexport type UpdateMemberRoleInput = {\n  /** Slugs of the roles to assign. When multiple roles are enabled for the environment, all provided roles are assigned; otherwise only the first slug is used. */\n  roleSlugs: Array<Scalars[\"String\"][\"input\"]>;\n  /** The user ID of the member to update. */\n  userId: Scalars[\"ID\"][\"input\"];\n};\n\nexport type UpdateMemberRoleResult =\n  | MemberNotFound\n  | MemberRoleUpdated\n  | RoleNotFound;\n\n/** Input for changing an existing password. Requires the current password for verification. */\nexport type UpdatePasswordInput = {\n  /** The current password for verification. */\n  currentPassword: Scalars[\"String\"][\"input\"];\n  /** The new password. Must satisfy the environment password policy. */\n  newPassword: Scalars[\"String\"][\"input\"];\n};\n\nexport type UpdatePasswordResult =\n  | IncorrectPassword\n  | PasswordPolicyViolation\n  | PasswordUpdated;\n\n/** Input for updating the authenticated user's profile. */\nexport type UpdateProfileInput = {\n  /** The user's first name. Pass an empty string to clear. */\n  firstName?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  /** The user's last name. Pass an empty string to clear. */\n  lastName?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  /** The user's locale as a BCP 47 language tag (e.g. 'en-US'). Pass an empty string to clear. */\n  locale?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n};\n\nexport type UpdateProfileResult = InvalidLocale | ProfileUpdated;\n\nexport type UpdateRoleInput = {\n  /** Human-readable description of the role. This is a full replace of the role, so an omitted or null description clears it — resupply the current value to preserve it. */\n  description?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n  /** The ID of the role to update. */\n  id: Scalars[\"ID\"][\"input\"];\n  /** Human-readable name for the role. */\n  name: Scalars[\"String\"][\"input\"];\n  /** Slugs of the permissions granted to the role. Replaces the existing set when provided. */\n  permissions?: InputMaybe<Array<Scalars[\"String\"][\"input\"]>>;\n};\n\nexport type UpdateSsoConnectionInput = {\n  id: Scalars[\"ID\"][\"input\"];\n  /** A new human-readable name for the connection. */\n  name?: InputMaybe<Scalars[\"String\"][\"input\"]>;\n};\n\n/** A user in the current environment. */\nexport type User = {\n  __typename?: \"User\";\n  connectedAccounts: Array<ConnectedAccount>;\n  createdAt: Scalars[\"DateTime\"][\"output\"];\n  email: Scalars[\"String\"][\"output\"];\n  emailVerified: Scalars[\"Boolean\"][\"output\"];\n  firstName?: Maybe<Scalars[\"String\"][\"output\"]>;\n  id: Scalars[\"ID\"][\"output\"];\n  lastName?: Maybe<Scalars[\"String\"][\"output\"]>;\n  /** Whether multi-factor authentication (TOTP) is set up for this user. Always `false` when the environment has MFA turned off — use `authenticationSettings.mfaEnabled` to tell the two apart. Only populated on `me`. */\n  mfaEnabled: Scalars[\"Boolean\"][\"output\"];\n  /** When MFA was last used to authenticate. Only populated on `me`. */\n  mfaLastUsedAt?: Maybe<Scalars[\"DateTime\"][\"output\"]>;\n  /** When a password was last used to authenticate. Only populated on `me`. */\n  passwordLastUsedAt?: Maybe<Scalars[\"DateTime\"][\"output\"]>;\n  /** Whether this user has a password set. Reflects the user regardless of whether the environment allows password authentication; use `authenticationSettings.passwordAuthEnabled` for that. Only populated on `me`. */\n  passwordSet: Scalars[\"Boolean\"][\"output\"];\n  profilePictureUrl?: Maybe<Scalars[\"String\"][\"output\"]>;\n  updatedAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** The user already has a password set. */\nexport type UserAlreadyHasPassword = {\n  __typename?: \"UserAlreadyHasPassword\";\n  _placeholder: Scalars[\"Boolean\"][\"output\"];\n};\n\n/** The invitation was created and the email sent. */\nexport type UserInvited = {\n  __typename?: \"UserInvited\";\n  invitation: OrganizationInvitation;\n};\n\n/** An organization the authenticated user belongs to, with a flag indicating whether it is the token's current organization. */\nexport type UserOrganization = {\n  __typename?: \"UserOrganization\";\n  id: Scalars[\"ID\"][\"output\"];\n  /** Whether this is the organization the token is currently scoped to. */\n  isCurrent: Scalars[\"Boolean\"][\"output\"];\n  name: Scalars[\"String\"][\"output\"];\n};\n\n/** The verification code has expired. */\nexport type VerificationCodeExpired = {\n  __typename?: \"VerificationCodeExpired\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The verification code is incorrect. */\nexport type VerificationCodeIncorrect = {\n  __typename?: \"VerificationCodeIncorrect\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** The verification code has already been used. */\nexport type VerificationCodePreviouslyUsed = {\n  __typename?: \"VerificationCodePreviouslyUsed\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** A verification code was sent to the current email address for identity verification. */\nexport type VerificationCodeSent = {\n  __typename?: \"VerificationCodeSent\";\n  /** The authentication challenge ID to use in subsequent steps. */\n  authenticationChallengeId: Scalars[\"ID\"][\"output\"];\n  /** When the verification code expires. */\n  expiresAt: Scalars[\"DateTime\"][\"output\"];\n};\n\n/** Too many verification code attempts. */\nexport type VerificationTooManyAttempts = {\n  __typename?: \"VerificationTooManyAttempts\";\n  message: Scalars[\"String\"][\"output\"];\n};\n\n/** Input for verifying the current email address. */\nexport type VerifyCurrentEmailInput = {\n  /** The authentication challenge ID returned from `sendVerificationCode`. */\n  authenticationChallengeId: Scalars[\"ID\"][\"input\"];\n  /** The verification code sent to the current email address. */\n  code: Scalars[\"String\"][\"input\"];\n};\n\nexport type VerifyCurrentEmailResult =\n  | CurrentEmailVerified\n  | VerificationCodeExpired\n  | VerificationCodeIncorrect\n  | VerificationCodePreviouslyUsed\n  | VerificationTooManyAttempts;\n\n/** Input for completing passkey (WebAuthn) registration by verifying the attestation created by the authenticator. */\nexport type VerifyPasskeyInput = {\n  /** The challenge ID returned by `registerPasskey`. */\n  challengeId: Scalars[\"String\"][\"input\"];\n  /** An elevated access token obtained by verifying the current email address. Required to prove recent re-authentication. */\n  elevatedAccessToken: Scalars[\"String\"][\"input\"];\n  /** The WebAuthn RegistrationResponseJSON returned by navigator.credentials.create(). */\n  response: Scalars[\"JSON\"][\"input\"];\n};\n\nexport type VerifyPasskeyResult =\n  | ElevatedAccessTokenExpired\n  | ElevatedAccessTokenInvalid\n  | PasskeyChallengeNotFound\n  | PasskeyVerificationFailed\n  | PasskeyVerified;\n\n/** Input for verifying a TOTP enrollment. */\nexport type VerifyTotpInput = {\n  /** The authentication challenge ID from enrollTotp. */\n  authenticationChallengeId: Scalars[\"String\"][\"input\"];\n  /** The TOTP code from the authenticator app. */\n  code: Scalars[\"String\"][\"input\"];\n  /** An elevated access token obtained by verifying the current email address. Required to prove recent re-authentication. */\n  elevatedAccessToken: Scalars[\"String\"][\"input\"];\n};\n\nexport type VerifyTotpResult =\n  | ElevatedAccessTokenExpired\n  | ElevatedAccessTokenInvalid\n  | TotpVerificationFailed\n  | TotpVerified;\n\nexport type ClientApiStatusQueryVariables = Exact<{ [key: string]: never }>;\n\nexport type ClientApiStatusQuery = {\n  __typename?: \"Query\";\n  clientApiStatus: string;\n};\n\nexport const ClientApiStatusDocument = `\n    query ClientApiStatus {\n  clientApiStatus\n}\n    `;\n\nexport type SdkFunctionWrapper = <T>(\n  action: (requestHeaders?: Record<string, string>) => Promise<T>,\n  operationName: string,\n  operationType?: string,\n  variables?: any,\n) => Promise<T>;\n\nconst defaultWrapper: SdkFunctionWrapper = (\n  action,\n  _operationName,\n  _operationType,\n  _variables,\n) => action();\n\nexport function getSdk(\n  client: GraphQLClient,\n  withWrapper: SdkFunctionWrapper = defaultWrapper,\n) {\n  return {\n    ClientApiStatus(\n      variables?: ClientApiStatusQueryVariables,\n      requestHeaders?: GraphQLClientRequestHeaders,\n      signal?: RequestInit[\"signal\"],\n    ): Promise<ClientApiStatusQuery> {\n      return withWrapper(\n        (wrappedRequestHeaders) =>\n          client.request<ClientApiStatusQuery>({\n            document: ClientApiStatusDocument,\n            variables,\n            requestHeaders: { ...requestHeaders, ...wrappedRequestHeaders },\n            signal,\n          }),\n        \"ClientApiStatus\",\n        \"query\",\n        variables,\n      );\n    },\n  };\n}\nexport type Sdk = ReturnType<typeof getSdk>;\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAqiEO,MAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAavC,MAAM,iBAAqC,CACzC,QACA,gBACA,gBACA,eACG,OAAO;AAEL,SAAS,OACd,QACA,cAAkC,gBAClC;AACA,SAAO;AAAA,IACL,gBACE,WACA,gBACA,QAC+B;AAC/B,aAAO;AAAA,QACL,CAAC,0BACC,OAAO,QAA8B;AAAA,UACnC,UAAU;AAAA,UACV;AAAA,UACA,gBAAgB,EAAE,GAAG,gBAAgB,GAAG,sBAAsB;AAAA,UAC9D;AAAA,QACF,CAAC;AAAA,QACH;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;","names":[]}