mudbase-sdk 1.3.12 → 2.3.13

package/apis/authentication-api.ts

@@ -0,0 +1,2303 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * MUDBASESDK
+ * MUDBASE is a scalable, real-time, and secure Backend-as-a-Service (BaaS) platform  designed for modern applications. Built with custom logic, it offers fine-grained  control, extensibility, and enterprise-grade security.  ## Features - 🔐 Multi-provider authentication (30+ OAuth providers) - 📊 Real-time database with collections - 📁 File storage and management - 🔑 API key management with permissions - 🔗 Webhook system with retry logic - ⚡ Serverless functions - 💬 Multi-channel messaging (Push, Email, SMS) - 📈 Usage analytics and monitoring - 🌐 Real-time WebSocket events - 🔍 Full-text search capabilities - 💳 Billing: fiat only for project subscriptions and org BaaS checkout (platform fee split). On-chain billing is not exposed on these APIs (optional `crypto-payment-module/` in repo, not mounted by default). - 🏢 Enterprise / Phase 4: custom domains on Growth, Scale, and Enterprise (TXT DNS at `_mudbase-verify.<hostname>`); `settings.customDomainAddon` is optional (billing/legacy); dedicated DB migration script, periodic DNS recheck job, optional `infrastructureEnvironments[]` and edge/metering fields on `dedicated`. 
+ *
+ * The version of the OpenAPI document: 1.3.13
+ * Contact: support@mudbase.dev
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+
+
+import type { Configuration } from '../configuration';
+import type { AxiosPromise, AxiosInstance, RawAxiosRequestConfig } from 'axios';
+import globalAxios from 'axios';
+// Some imports not used depending on template conditions
+// @ts-ignore
+import { DUMMY_BASE_URL, assertParamExists, setApiKeyToObject, setBasicAuthToObject, setBearerAuthToObject, setOAuthToObject, setSearchParams, serializeDataIfNeeded, toPathString, createRequestFunction, replaceWithSerializableTypeIfNeeded } from '../common';
+// @ts-ignore
+import { BASE_PATH, COLLECTION_FORMATS, type RequestArgs, BaseAPI, RequiredError, operationServerMap } from '../base';
+// @ts-ignore
+import type { AcceptInvite201Response } from '../models';
+// @ts-ignore
+import type { AcceptInviteRequest } from '../models';
+// @ts-ignore
+import type { AuthResponse } from '../models';
+// @ts-ignore
+import type { ConfirmLocalPasswordResetWithOtpRequest } from '../models';
+// @ts-ignore
+import type { ConvertAnonymousAccount200Response } from '../models';
+// @ts-ignore
+import type { ConvertAnonymousAccountRequest } from '../models';
+// @ts-ignore
+import type { CreateAnonymousSession200Response } from '../models';
+// @ts-ignore
+import type { CreateAnonymousSessionRequest } from '../models';
+// @ts-ignore
+import type { GetAvailableOAuthProviders200Response } from '../models';
+// @ts-ignore
+import type { GetLocalSession200Response } from '../models';
+// @ts-ignore
+import type { GetOrgOAuthProviders200Response } from '../models';
+// @ts-ignore
+import type { InitiateOAuth400Response } from '../models';
+// @ts-ignore
+import type { InitiateOAuth404Response } from '../models';
+// @ts-ignore
+import type { InitiateOrgOAuth400Response } from '../models';
+// @ts-ignore
+import type { LoginLocalUser200Response } from '../models';
+// @ts-ignore
+import type { LoginLocalUser403Response } from '../models';
+// @ts-ignore
+import type { LoginLocalUserRequest } from '../models';
+// @ts-ignore
+import type { LoginRequest } from '../models';
+// @ts-ignore
+import type { MagicLinkRequest } from '../models';
+// @ts-ignore
+import type { MessageResponse } from '../models';
+// @ts-ignore
+import type { OTPSendRequest } from '../models';
+// @ts-ignore
+import type { OTPVerifyRequest } from '../models';
+// @ts-ignore
+import type { OrgOAuthCallback400Response } from '../models';
+// @ts-ignore
+import type { RefreshToken200Response } from '../models';
+// @ts-ignore
+import type { RefreshToken400Response } from '../models';
+// @ts-ignore
+import type { RefreshTokenRequest } from '../models';
+// @ts-ignore
+import type { RegisterLocalUser201Response } from '../models';
+// @ts-ignore
+import type { RegisterLocalUserRequest } from '../models';
+// @ts-ignore
+import type { RegisterRequest } from '../models';
+// @ts-ignore
+import type { RegisterUser429Response } from '../models';
+// @ts-ignore
+import type { RequestLocalPasswordResetRequest } from '../models';
+// @ts-ignore
+import type { RequestPasswordResetRequest } from '../models';
+// @ts-ignore
+import type { ResendVerificationAuthRequest } from '../models';
+// @ts-ignore
+import type { ResetLocalPasswordRequest } from '../models';
+// @ts-ignore
+import type { ResetPasswordRequest } from '../models';
+// @ts-ignore
+import type { SessionResponse } from '../models';
+// @ts-ignore
+import type { ValidatePasswordResetToken200Response } from '../models';
+// @ts-ignore
+import type { ValidatePasswordResetToken400Response } from '../models';
+// @ts-ignore
+import type { ValidatePasswordResetTokenRequest } from '../models';
+// @ts-ignore
+import type { VerifyEmailAuthRequest } from '../models';
+// @ts-ignore
+import type { VerifyMagicLinkRequest } from '../models';
+/**
+ * AuthenticationApi - axios parameter creator
+ */
+export const AuthenticationApiAxiosParamCreator = function (configuration?: Configuration) {
+    return {
+        /**
+         * Accept an organization invitation using the token from the invite email link (e.g. `/invite/{token}?orgId=...`). Creates a new user with the invited email and adds them to the organization with the invited role. Returns a JWT and user so the client can log the user in immediately. No authentication required. 
+         * @summary Accept organization invitation
+         * @param {AcceptInviteRequest} acceptInviteRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        acceptInvite: async (acceptInviteRequest: AcceptInviteRequest, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'acceptInviteRequest' is not null or undefined
+            assertParamExists('acceptInvite', 'acceptInviteRequest', acceptInviteRequest)
+            const localVarPath = `/api/auth/accept-invite`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+            localVarHeaderParameter['Accept'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(acceptInviteRequest, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Set new password using the OTP sent to the user\'s email. Call after POST /api/auth/local/password-reset with projectId. Rate limited (OTP limit). If the user\'s email was not yet verified, it is marked as verified upon successful reset. 
+         * @summary Confirm password reset with OTP (project-based)
+         * @param {ConfirmLocalPasswordResetWithOtpRequest} confirmLocalPasswordResetWithOtpRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        confirmLocalPasswordResetWithOtp: async (confirmLocalPasswordResetWithOtpRequest: ConfirmLocalPasswordResetWithOtpRequest, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'confirmLocalPasswordResetWithOtpRequest' is not null or undefined
+            assertParamExists('confirmLocalPasswordResetWithOtp', 'confirmLocalPasswordResetWithOtpRequest', confirmLocalPasswordResetWithOtpRequest)
+            const localVarPath = `/api/auth/local/password-reset/confirm`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+            localVarHeaderParameter['Accept'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(confirmLocalPasswordResetWithOtpRequest, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Convert an anonymous user session to a full authenticated account. Preserves user data. Requires JWT Bearer token authentication. Both OrgBearerAuth and ProjectBearerAuth are supported (they use the same JWT token format). API keys are not supported for this endpoint. 
+         * @summary Convert anonymous account to full account
+         * @param {ConvertAnonymousAccountRequest} convertAnonymousAccountRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        convertAnonymousAccount: async (convertAnonymousAccountRequest: ConvertAnonymousAccountRequest, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'convertAnonymousAccountRequest' is not null or undefined
+            assertParamExists('convertAnonymousAccount', 'convertAnonymousAccountRequest', convertAnonymousAccountRequest)
+            const localVarPath = `/api/auth/anonymous/convert`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication OrgBearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+            // authentication ProjectBearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+            localVarHeaderParameter['Accept'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(convertAnonymousAccountRequest, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Create an anonymous user session for guest access. Users can later convert to full accounts.
+         * @summary Create anonymous session
+         * @param {CreateAnonymousSessionRequest} [createAnonymousSessionRequest] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        createAnonymousSession: async (createAnonymousSessionRequest?: CreateAnonymousSessionRequest, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            const localVarPath = `/api/auth/anonymous`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+            localVarHeaderParameter['Accept'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(createAnonymousSessionRequest, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Returns a list of all supported OAuth providers with their configuration details
+         * @summary Get all available OAuth providers
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getAvailableOAuthProviders: async (options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            const localVarPath = `/api/auth/oauth/providers/available`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            localVarHeaderParameter['Accept'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Get the current authenticated user session information. Requires JWT Bearer token authentication. Both OrgBearerAuth and ProjectBearerAuth are supported (they use the same JWT token format). API keys are not supported for this endpoint. 
+         * @summary Get current session
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getCurrentSession: async (options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            const localVarPath = `/api/auth/session`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication OrgBearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+            // authentication ProjectBearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+            localVarHeaderParameter['Accept'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Get the current authenticated user session (project-based). Requires JWT Bearer token authentication. Both OrgBearerAuth and ProjectBearerAuth are supported (they use the same JWT token format). API keys are not supported for this endpoint. 
+         * @summary Get current session (project-based)
+         * @param {string} [projectId] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getLocalSession: async (projectId?: string, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            const localVarPath = `/api/auth/local/session`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication OrgBearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+            // authentication ProjectBearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+            if (projectId !== undefined) {
+                localVarQueryParameter['projectId'] = projectId;
+            }
+
+            localVarHeaderParameter['Accept'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Returns a list of OAuth providers that are configured and available for organization-based authentication. Providers are configured via environment variables (e.g., GOOGLE_CLIENT_ID, GITHUB_CLIENT_ID). 
+         * @summary Get available OAuth providers for organization-based auth
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getOrgOAuthProviders: async (options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            const localVarPath = `/api/auth/oauth-org/providers`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            localVarHeaderParameter['Accept'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Initiates OAuth authentication flow for a specified provider and project. The OAuth provider must be configured and enabled for the project first. Returns an HTTP 302 redirect to the OAuth provider\'s consent screen. Note: Swagger \"Try it out\" may show \"Failed to fetch\" for this endpoint due to browser CORS restrictions on cross-origin redirects. Use top-level browser navigation or curl to test. 
+         * @summary Initiate OAuth authentication
+         * @param {InitiateOAuthProviderEnum} provider 
+         * @param {string} projectId 
+         * @param {string} [redirectUrl] The URL to redirect to after authentication. Must be pre-registered in project settings.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        initiateOAuth: async (provider: InitiateOAuthProviderEnum, projectId: string, redirectUrl?: string, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'provider' is not null or undefined
+            assertParamExists('initiateOAuth', 'provider', provider)
+            // verify required parameter 'projectId' is not null or undefined
+            assertParamExists('initiateOAuth', 'projectId', projectId)
+            const localVarPath = `/api/auth/oauth/{provider}/{projectId}`
+                .replace(`{${"provider"}}`, encodeURIComponent(String(provider)))
+                .replace(`{${"projectId"}}`, encodeURIComponent(String(projectId)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            if (redirectUrl !== undefined) {
+                localVarQueryParameter['redirect_url'] = redirectUrl;
+            }
+
+            localVarHeaderParameter['Accept'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Initiates OAuth authentication flow for organization-level signup/login. The OAuth provider must be configured via environment variables (e.g., GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET). After successful authentication, creates a new organization and user account, or logs in existing user. 
+         * @summary Initiate OAuth authentication for organization
+         * @param {InitiateOrgOAuthProviderEnum} provider 
+         * @param {string} [redirectUrl] The URL to redirect to after authentication
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        initiateOrgOAuth: async (provider: InitiateOrgOAuthProviderEnum, redirectUrl?: string, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'provider' is not null or undefined
+            assertParamExists('initiateOrgOAuth', 'provider', provider)
+            const localVarPath = `/api/auth/oauth-org/{provider}`
+                .replace(`{${"provider"}}`, encodeURIComponent(String(provider)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            if (redirectUrl !== undefined) {
+                localVarQueryParameter['redirect_url'] = redirectUrl;
+            }
+
+            localVarHeaderParameter['Accept'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * When the project has **requireEmailVerification** enabled and the user has not verified their email, returns 403 with code **EMAIL_VERIFICATION_REQUIRED** (user must verify email first, then login again). 
+         * @summary Login user (project-based)
+         * @param {LoginLocalUserRequest} loginLocalUserRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        loginLocalUser: async (loginLocalUserRequest: LoginLocalUserRequest, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'loginLocalUserRequest' is not null or undefined
+            assertParamExists('loginLocalUser', 'loginLocalUserRequest', loginLocalUserRequest)
+            const localVarPath = `/api/auth/local/login`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+            localVarHeaderParameter['Accept'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(loginLocalUserRequest, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * 
+         * @summary Login user
+         * @param {LoginRequest} loginRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        loginUser: async (loginRequest: LoginRequest, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'loginRequest' is not null or undefined
+            assertParamExists('loginUser', 'loginRequest', loginRequest)
+            const localVarPath = `/api/auth/login`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+            localVarHeaderParameter['Accept'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(loginRequest, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Logout the current authenticated user session (project-based). Requires JWT Bearer token authentication. Both OrgBearerAuth and ProjectBearerAuth are supported (they use the same JWT token format). API keys are not supported for this endpoint. 
+         * @summary Logout user (project-based)
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        logoutLocalUser: async (options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            const localVarPath = `/api/auth/local/logout`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication OrgBearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+            // authentication ProjectBearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+            localVarHeaderParameter['Accept'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Logout the current authenticated user session. Requires JWT Bearer token authentication. Both OrgBearerAuth and ProjectBearerAuth are supported (they use the same JWT token format). API keys are not supported for this endpoint. 
+         * @summary Logout user
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        logoutUser: async (options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            const localVarPath = `/api/auth/logout`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication OrgBearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+            // authentication ProjectBearerAuth required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+            localVarHeaderParameter['Accept'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Handles OAuth callback for project-based authentication. This route must be matched before /api/auth/oauth/{provider}/{projectId}. Redirects to frontend with query params token, refreshToken, and expiresIn. 
+         * @summary OAuth callback handler (project-based)
+         * @param {string} provider 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        oauthCallback: async (provider: string, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'provider' is not null or undefined
+            assertParamExists('oauthCallback', 'provider', provider)
+            const localVarPath = `/api/auth/oauth/callback/{provider}`
+                .replace(`{${"provider"}}`, encodeURIComponent(String(provider)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            localVarHeaderParameter['Accept'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Handles OAuth callback for organization-based authentication. Creates a new organization and user account if the user doesn\'t exist, or logs in existing user. Redirects to frontend with query params token, refreshToken, and expiresIn. 
+         * @summary OAuth callback handler for organization
+         * @param {OrgOAuthCallbackProviderEnum} provider 
+         * @param {string} [code] Authorization code from OAuth provider
+         * @param {string} [state] State parameter for CSRF protection
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        orgOAuthCallback: async (provider: OrgOAuthCallbackProviderEnum, code?: string, state?: string, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'provider' is not null or undefined
+            assertParamExists('orgOAuthCallback', 'provider', provider)
+            const localVarPath = `/api/auth/oauth-org/callback/{provider}`
+                .replace(`{${"provider"}}`, encodeURIComponent(String(provider)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            if (code !== undefined) {
+                localVarQueryParameter['code'] = code;
+            }
+
+            if (state !== undefined) {
+                localVarQueryParameter['state'] = state;
+            }
+
+            localVarHeaderParameter['Accept'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Exchange a valid refresh token for a new JWT access token and refresh token. Works for both **org-based** (platform/dashboard) and **project-based** auth; the same endpoint is used. The previous refresh token is invalidated (rotation). If the same refresh token is used again, the session is revoked (reuse detection). 
+         * @summary Refresh access token (org and project)
+         * @param {RefreshTokenRequest} refreshTokenRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        refreshToken: async (refreshTokenRequest: RefreshTokenRequest, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'refreshTokenRequest' is not null or undefined
+            assertParamExists('refreshToken', 'refreshTokenRequest', refreshTokenRequest)
+            const localVarPath = `/api/auth/refresh`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+            localVarHeaderParameter['Accept'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(refreshTokenRequest, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * When the project has **requireEmailVerification** enabled (default), the response is 201 with **requireVerification: true** and **no token**; the user must verify their email then sign in via login. When email verification is disabled, a token and refreshToken are returned. 
+         * @summary Register new user (project-based)
+         * @param {RegisterLocalUserRequest} registerLocalUserRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        registerLocalUser: async (registerLocalUserRequest: RegisterLocalUserRequest, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'registerLocalUserRequest' is not null or undefined
+            assertParamExists('registerLocalUser', 'registerLocalUserRequest', registerLocalUserRequest)
+            const localVarPath = `/api/auth/local/register`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+            localVarHeaderParameter['Accept'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(registerLocalUserRequest, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * 
+         * @summary Register new user
+         * @param {RegisterRequest} registerRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        registerUser: async (registerRequest: RegisterRequest, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'registerRequest' is not null or undefined
+            assertParamExists('registerUser', 'registerRequest', registerRequest)
+            const localVarPath = `/api/auth/register`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+            localVarHeaderParameter['Accept'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(registerRequest, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * When projectId is provided, sends a 6-digit OTP to the user\'s email (project-based reset uses OTP, not link). When projectId is omitted, sends a token link (org/platform local account). Rate limited. 
+         * @summary Request password reset (project-based, OTP)
+         * @param {RequestLocalPasswordResetRequest} requestLocalPasswordResetRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        requestLocalPasswordReset: async (requestLocalPasswordResetRequest: RequestLocalPasswordResetRequest, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'requestLocalPasswordResetRequest' is not null or undefined
+            assertParamExists('requestLocalPasswordReset', 'requestLocalPasswordResetRequest', requestLocalPasswordResetRequest)
+            const localVarPath = `/api/auth/local/password-reset`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+            localVarHeaderParameter['Accept'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(requestLocalPasswordResetRequest, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Sends a password reset link to the user\'s email. Use this for organization (platform) accounts. For project-based accounts use POST /api/auth/local/password-reset with projectId (sends OTP instead). 
+         * @summary Request password reset (organization / platform)
+         * @param {RequestPasswordResetRequest} requestPasswordResetRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        requestPasswordReset: async (requestPasswordResetRequest: RequestPasswordResetRequest, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'requestPasswordResetRequest' is not null or undefined
+            assertParamExists('requestPasswordReset', 'requestPasswordResetRequest', requestPasswordResetRequest)
+            const localVarPath = `/api/auth/password-reset`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+            localVarHeaderParameter['Accept'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(requestPasswordResetRequest, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Sends a new verification email to the given email (and optional project). For unauthenticated users who have not verified yet. Rate limited (e.g. 3 per 15 min per IP). 
+         * @summary Resend verification email (no auth)
+         * @param {ResendVerificationAuthRequest} resendVerificationAuthRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        resendVerificationAuth: async (resendVerificationAuthRequest: ResendVerificationAuthRequest, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'resendVerificationAuthRequest' is not null or undefined
+            assertParamExists('resendVerificationAuth', 'resendVerificationAuthRequest', resendVerificationAuthRequest)
+            const localVarPath = `/api/auth/resend-verification`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+            localVarHeaderParameter['Accept'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(resendVerificationAuthRequest, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Legacy token-based completion. Prefer OTP flow: use POST .../password-reset/confirm with the OTP sent to email for project-based resets. 
+         * @summary Reset password with token (project-based, legacy)
+         * @param {string} token 
+         * @param {ResetLocalPasswordRequest} resetLocalPasswordRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        resetLocalPassword: async (token: string, resetLocalPasswordRequest: ResetLocalPasswordRequest, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'token' is not null or undefined
+            assertParamExists('resetLocalPassword', 'token', token)
+            // verify required parameter 'resetLocalPasswordRequest' is not null or undefined
+            assertParamExists('resetLocalPassword', 'resetLocalPasswordRequest', resetLocalPasswordRequest)
+            const localVarPath = `/api/auth/local/password-reset/{token}`
+                .replace(`{${"token"}}`, encodeURIComponent(String(token)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+            localVarHeaderParameter['Accept'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(resetLocalPasswordRequest, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Set new password using the token from the reset link. Validate the token first with POST /api/auth/password-reset/validate before showing the form. If the user\'s email was not yet verified, it is marked as verified upon successful reset. 
+         * @summary Reset password with token (organization / platform)
+         * @param {string} token 
+         * @param {ResetPasswordRequest} resetPasswordRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        resetPassword: async (token: string, resetPasswordRequest: ResetPasswordRequest, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'token' is not null or undefined
+            assertParamExists('resetPassword', 'token', token)
+            // verify required parameter 'resetPasswordRequest' is not null or undefined
+            assertParamExists('resetPassword', 'resetPasswordRequest', resetPasswordRequest)
+            const localVarPath = `/api/auth/password-reset/{token}`
+                .replace(`{${"token"}}`, encodeURIComponent(String(token)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+            localVarHeaderParameter['Accept'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(resetPasswordRequest, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * 
+         * @summary Send magic link
+         * @param {MagicLinkRequest} magicLinkRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        sendMagicLink: async (magicLinkRequest: MagicLinkRequest, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'magicLinkRequest' is not null or undefined
+            assertParamExists('sendMagicLink', 'magicLinkRequest', magicLinkRequest)
+            const localVarPath = `/api/auth/magic-link/send`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+            localVarHeaderParameter['Accept'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(magicLinkRequest, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * 
+         * @summary Send OTP code
+         * @param {OTPSendRequest} oTPSendRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        sendOTP: async (oTPSendRequest: OTPSendRequest, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'oTPSendRequest' is not null or undefined
+            assertParamExists('sendOTP', 'oTPSendRequest', oTPSendRequest)
+            const localVarPath = `/api/auth/otp/send`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+            localVarHeaderParameter['Accept'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(oTPSendRequest, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Call before showing the \"set new password\" form. Validates that the token from the reset link is still valid and not expired. Organization (platform) reset only. 
+         * @summary Validate password reset token
+         * @param {ValidatePasswordResetTokenRequest} validatePasswordResetTokenRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        validatePasswordResetToken: async (validatePasswordResetTokenRequest: ValidatePasswordResetTokenRequest, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'validatePasswordResetTokenRequest' is not null or undefined
+            assertParamExists('validatePasswordResetToken', 'validatePasswordResetTokenRequest', validatePasswordResetTokenRequest)
+            const localVarPath = `/api/auth/password-reset/validate`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+            localVarHeaderParameter['Accept'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(validatePasswordResetTokenRequest, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Verifies the user\'s email using the token from the link sent at signup. Use this for both organization and project signups (unauthenticated). Same behavior as POST /api/users/verify-email. 
+         * @summary Verify email address (no auth)
+         * @param {VerifyEmailAuthRequest} verifyEmailAuthRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        verifyEmailAuth: async (verifyEmailAuthRequest: VerifyEmailAuthRequest, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'verifyEmailAuthRequest' is not null or undefined
+            assertParamExists('verifyEmailAuth', 'verifyEmailAuthRequest', verifyEmailAuthRequest)
+            const localVarPath = `/api/auth/verify-email`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+            localVarHeaderParameter['Accept'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(verifyEmailAuthRequest, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * 
+         * @summary Verify magic link
+         * @param {VerifyMagicLinkRequest} verifyMagicLinkRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        verifyMagicLink: async (verifyMagicLinkRequest: VerifyMagicLinkRequest, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'verifyMagicLinkRequest' is not null or undefined
+            assertParamExists('verifyMagicLink', 'verifyMagicLinkRequest', verifyMagicLinkRequest)
+            const localVarPath = `/api/auth/magic-link/verify`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+            localVarHeaderParameter['Accept'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(verifyMagicLinkRequest, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * 
+         * @summary Verify OTP code
+         * @param {OTPVerifyRequest} oTPVerifyRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        verifyOTP: async (oTPVerifyRequest: OTPVerifyRequest, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'oTPVerifyRequest' is not null or undefined
+            assertParamExists('verifyOTP', 'oTPVerifyRequest', oTPVerifyRequest)
+            const localVarPath = `/api/auth/otp/verify`;
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'POST', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+            localVarHeaderParameter['Accept'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(oTPVerifyRequest, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+    }
+};
+
+/**
+ * AuthenticationApi - functional programming interface
+ */
+export const AuthenticationApiFp = function(configuration?: Configuration) {
+    const localVarAxiosParamCreator = AuthenticationApiAxiosParamCreator(configuration)
+    return {
+        /**
+         * Accept an organization invitation using the token from the invite email link (e.g. `/invite/{token}?orgId=...`). Creates a new user with the invited email and adds them to the organization with the invited role. Returns a JWT and user so the client can log the user in immediately. No authentication required. 
+         * @summary Accept organization invitation
+         * @param {AcceptInviteRequest} acceptInviteRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async acceptInvite(acceptInviteRequest: AcceptInviteRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<AcceptInvite201Response>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.acceptInvite(acceptInviteRequest, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['AuthenticationApi.acceptInvite']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Set new password using the OTP sent to the user\'s email. Call after POST /api/auth/local/password-reset with projectId. Rate limited (OTP limit). If the user\'s email was not yet verified, it is marked as verified upon successful reset. 
+         * @summary Confirm password reset with OTP (project-based)
+         * @param {ConfirmLocalPasswordResetWithOtpRequest} confirmLocalPasswordResetWithOtpRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async confirmLocalPasswordResetWithOtp(confirmLocalPasswordResetWithOtpRequest: ConfirmLocalPasswordResetWithOtpRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<MessageResponse>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.confirmLocalPasswordResetWithOtp(confirmLocalPasswordResetWithOtpRequest, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['AuthenticationApi.confirmLocalPasswordResetWithOtp']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Convert an anonymous user session to a full authenticated account. Preserves user data. Requires JWT Bearer token authentication. Both OrgBearerAuth and ProjectBearerAuth are supported (they use the same JWT token format). API keys are not supported for this endpoint. 
+         * @summary Convert anonymous account to full account
+         * @param {ConvertAnonymousAccountRequest} convertAnonymousAccountRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async convertAnonymousAccount(convertAnonymousAccountRequest: ConvertAnonymousAccountRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<ConvertAnonymousAccount200Response>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.convertAnonymousAccount(convertAnonymousAccountRequest, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['AuthenticationApi.convertAnonymousAccount']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Create an anonymous user session for guest access. Users can later convert to full accounts.
+         * @summary Create anonymous session
+         * @param {CreateAnonymousSessionRequest} [createAnonymousSessionRequest] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async createAnonymousSession(createAnonymousSessionRequest?: CreateAnonymousSessionRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<CreateAnonymousSession200Response>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.createAnonymousSession(createAnonymousSessionRequest, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['AuthenticationApi.createAnonymousSession']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Returns a list of all supported OAuth providers with their configuration details
+         * @summary Get all available OAuth providers
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async getAvailableOAuthProviders(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<GetAvailableOAuthProviders200Response>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.getAvailableOAuthProviders(options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['AuthenticationApi.getAvailableOAuthProviders']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Get the current authenticated user session information. Requires JWT Bearer token authentication. Both OrgBearerAuth and ProjectBearerAuth are supported (they use the same JWT token format). API keys are not supported for this endpoint. 
+         * @summary Get current session
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async getCurrentSession(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<SessionResponse>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.getCurrentSession(options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['AuthenticationApi.getCurrentSession']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Get the current authenticated user session (project-based). Requires JWT Bearer token authentication. Both OrgBearerAuth and ProjectBearerAuth are supported (they use the same JWT token format). API keys are not supported for this endpoint. 
+         * @summary Get current session (project-based)
+         * @param {string} [projectId] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async getLocalSession(projectId?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<GetLocalSession200Response>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.getLocalSession(projectId, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['AuthenticationApi.getLocalSession']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Returns a list of OAuth providers that are configured and available for organization-based authentication. Providers are configured via environment variables (e.g., GOOGLE_CLIENT_ID, GITHUB_CLIENT_ID). 
+         * @summary Get available OAuth providers for organization-based auth
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async getOrgOAuthProviders(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<GetOrgOAuthProviders200Response>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.getOrgOAuthProviders(options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['AuthenticationApi.getOrgOAuthProviders']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Initiates OAuth authentication flow for a specified provider and project. The OAuth provider must be configured and enabled for the project first. Returns an HTTP 302 redirect to the OAuth provider\'s consent screen. Note: Swagger \"Try it out\" may show \"Failed to fetch\" for this endpoint due to browser CORS restrictions on cross-origin redirects. Use top-level browser navigation or curl to test. 
+         * @summary Initiate OAuth authentication
+         * @param {InitiateOAuthProviderEnum} provider 
+         * @param {string} projectId 
+         * @param {string} [redirectUrl] The URL to redirect to after authentication. Must be pre-registered in project settings.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async initiateOAuth(provider: InitiateOAuthProviderEnum, projectId: string, redirectUrl?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.initiateOAuth(provider, projectId, redirectUrl, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['AuthenticationApi.initiateOAuth']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Initiates OAuth authentication flow for organization-level signup/login. The OAuth provider must be configured via environment variables (e.g., GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET). After successful authentication, creates a new organization and user account, or logs in existing user. 
+         * @summary Initiate OAuth authentication for organization
+         * @param {InitiateOrgOAuthProviderEnum} provider 
+         * @param {string} [redirectUrl] The URL to redirect to after authentication
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async initiateOrgOAuth(provider: InitiateOrgOAuthProviderEnum, redirectUrl?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.initiateOrgOAuth(provider, redirectUrl, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['AuthenticationApi.initiateOrgOAuth']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * When the project has **requireEmailVerification** enabled and the user has not verified their email, returns 403 with code **EMAIL_VERIFICATION_REQUIRED** (user must verify email first, then login again). 
+         * @summary Login user (project-based)
+         * @param {LoginLocalUserRequest} loginLocalUserRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async loginLocalUser(loginLocalUserRequest: LoginLocalUserRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<LoginLocalUser200Response>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.loginLocalUser(loginLocalUserRequest, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['AuthenticationApi.loginLocalUser']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * 
+         * @summary Login user
+         * @param {LoginRequest} loginRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async loginUser(loginRequest: LoginRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<AuthResponse>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.loginUser(loginRequest, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['AuthenticationApi.loginUser']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Logout the current authenticated user session (project-based). Requires JWT Bearer token authentication. Both OrgBearerAuth and ProjectBearerAuth are supported (they use the same JWT token format). API keys are not supported for this endpoint. 
+         * @summary Logout user (project-based)
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async logoutLocalUser(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<MessageResponse>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.logoutLocalUser(options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['AuthenticationApi.logoutLocalUser']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Logout the current authenticated user session. Requires JWT Bearer token authentication. Both OrgBearerAuth and ProjectBearerAuth are supported (they use the same JWT token format). API keys are not supported for this endpoint. 
+         * @summary Logout user
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async logoutUser(options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<MessageResponse>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.logoutUser(options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['AuthenticationApi.logoutUser']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Handles OAuth callback for project-based authentication. This route must be matched before /api/auth/oauth/{provider}/{projectId}. Redirects to frontend with query params token, refreshToken, and expiresIn. 
+         * @summary OAuth callback handler (project-based)
+         * @param {string} provider 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async oauthCallback(provider: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.oauthCallback(provider, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['AuthenticationApi.oauthCallback']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Handles OAuth callback for organization-based authentication. Creates a new organization and user account if the user doesn\'t exist, or logs in existing user. Redirects to frontend with query params token, refreshToken, and expiresIn. 
+         * @summary OAuth callback handler for organization
+         * @param {OrgOAuthCallbackProviderEnum} provider 
+         * @param {string} [code] Authorization code from OAuth provider
+         * @param {string} [state] State parameter for CSRF protection
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async orgOAuthCallback(provider: OrgOAuthCallbackProviderEnum, code?: string, state?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.orgOAuthCallback(provider, code, state, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['AuthenticationApi.orgOAuthCallback']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Exchange a valid refresh token for a new JWT access token and refresh token. Works for both **org-based** (platform/dashboard) and **project-based** auth; the same endpoint is used. The previous refresh token is invalidated (rotation). If the same refresh token is used again, the session is revoked (reuse detection). 
+         * @summary Refresh access token (org and project)
+         * @param {RefreshTokenRequest} refreshTokenRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async refreshToken(refreshTokenRequest: RefreshTokenRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<RefreshToken200Response>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.refreshToken(refreshTokenRequest, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['AuthenticationApi.refreshToken']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * When the project has **requireEmailVerification** enabled (default), the response is 201 with **requireVerification: true** and **no token**; the user must verify their email then sign in via login. When email verification is disabled, a token and refreshToken are returned. 
+         * @summary Register new user (project-based)
+         * @param {RegisterLocalUserRequest} registerLocalUserRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async registerLocalUser(registerLocalUserRequest: RegisterLocalUserRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<RegisterLocalUser201Response>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.registerLocalUser(registerLocalUserRequest, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['AuthenticationApi.registerLocalUser']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * 
+         * @summary Register new user
+         * @param {RegisterRequest} registerRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async registerUser(registerRequest: RegisterRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<AuthResponse>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.registerUser(registerRequest, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['AuthenticationApi.registerUser']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * When projectId is provided, sends a 6-digit OTP to the user\'s email (project-based reset uses OTP, not link). When projectId is omitted, sends a token link (org/platform local account). Rate limited. 
+         * @summary Request password reset (project-based, OTP)
+         * @param {RequestLocalPasswordResetRequest} requestLocalPasswordResetRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async requestLocalPasswordReset(requestLocalPasswordResetRequest: RequestLocalPasswordResetRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<MessageResponse>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.requestLocalPasswordReset(requestLocalPasswordResetRequest, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['AuthenticationApi.requestLocalPasswordReset']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Sends a password reset link to the user\'s email. Use this for organization (platform) accounts. For project-based accounts use POST /api/auth/local/password-reset with projectId (sends OTP instead). 
+         * @summary Request password reset (organization / platform)
+         * @param {RequestPasswordResetRequest} requestPasswordResetRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async requestPasswordReset(requestPasswordResetRequest: RequestPasswordResetRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<MessageResponse>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.requestPasswordReset(requestPasswordResetRequest, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['AuthenticationApi.requestPasswordReset']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Sends a new verification email to the given email (and optional project). For unauthenticated users who have not verified yet. Rate limited (e.g. 3 per 15 min per IP). 
+         * @summary Resend verification email (no auth)
+         * @param {ResendVerificationAuthRequest} resendVerificationAuthRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async resendVerificationAuth(resendVerificationAuthRequest: ResendVerificationAuthRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<MessageResponse>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.resendVerificationAuth(resendVerificationAuthRequest, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['AuthenticationApi.resendVerificationAuth']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Legacy token-based completion. Prefer OTP flow: use POST .../password-reset/confirm with the OTP sent to email for project-based resets. 
+         * @summary Reset password with token (project-based, legacy)
+         * @param {string} token 
+         * @param {ResetLocalPasswordRequest} resetLocalPasswordRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async resetLocalPassword(token: string, resetLocalPasswordRequest: ResetLocalPasswordRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<MessageResponse>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.resetLocalPassword(token, resetLocalPasswordRequest, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['AuthenticationApi.resetLocalPassword']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Set new password using the token from the reset link. Validate the token first with POST /api/auth/password-reset/validate before showing the form. If the user\'s email was not yet verified, it is marked as verified upon successful reset. 
+         * @summary Reset password with token (organization / platform)
+         * @param {string} token 
+         * @param {ResetPasswordRequest} resetPasswordRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async resetPassword(token: string, resetPasswordRequest: ResetPasswordRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<MessageResponse>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.resetPassword(token, resetPasswordRequest, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['AuthenticationApi.resetPassword']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * 
+         * @summary Send magic link
+         * @param {MagicLinkRequest} magicLinkRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async sendMagicLink(magicLinkRequest: MagicLinkRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<MessageResponse>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.sendMagicLink(magicLinkRequest, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['AuthenticationApi.sendMagicLink']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * 
+         * @summary Send OTP code
+         * @param {OTPSendRequest} oTPSendRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async sendOTP(oTPSendRequest: OTPSendRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<MessageResponse>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.sendOTP(oTPSendRequest, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['AuthenticationApi.sendOTP']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Call before showing the \"set new password\" form. Validates that the token from the reset link is still valid and not expired. Organization (platform) reset only. 
+         * @summary Validate password reset token
+         * @param {ValidatePasswordResetTokenRequest} validatePasswordResetTokenRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async validatePasswordResetToken(validatePasswordResetTokenRequest: ValidatePasswordResetTokenRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<ValidatePasswordResetToken200Response>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.validatePasswordResetToken(validatePasswordResetTokenRequest, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['AuthenticationApi.validatePasswordResetToken']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Verifies the user\'s email using the token from the link sent at signup. Use this for both organization and project signups (unauthenticated). Same behavior as POST /api/users/verify-email. 
+         * @summary Verify email address (no auth)
+         * @param {VerifyEmailAuthRequest} verifyEmailAuthRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async verifyEmailAuth(verifyEmailAuthRequest: VerifyEmailAuthRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<MessageResponse>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.verifyEmailAuth(verifyEmailAuthRequest, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['AuthenticationApi.verifyEmailAuth']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * 
+         * @summary Verify magic link
+         * @param {VerifyMagicLinkRequest} verifyMagicLinkRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async verifyMagicLink(verifyMagicLinkRequest: VerifyMagicLinkRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<AuthResponse>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.verifyMagicLink(verifyMagicLinkRequest, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['AuthenticationApi.verifyMagicLink']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * 
+         * @summary Verify OTP code
+         * @param {OTPVerifyRequest} oTPVerifyRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async verifyOTP(oTPVerifyRequest: OTPVerifyRequest, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<AuthResponse>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.verifyOTP(oTPVerifyRequest, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['AuthenticationApi.verifyOTP']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+    }
+};
+
+/**
+ * AuthenticationApi - factory interface
+ */
+export const AuthenticationApiFactory = function (configuration?: Configuration, basePath?: string, axios?: AxiosInstance) {
+    const localVarFp = AuthenticationApiFp(configuration)
+    return {
+        /**
+         * Accept an organization invitation using the token from the invite email link (e.g. `/invite/{token}?orgId=...`). Creates a new user with the invited email and adds them to the organization with the invited role. Returns a JWT and user so the client can log the user in immediately. No authentication required. 
+         * @summary Accept organization invitation
+         * @param {AcceptInviteRequest} acceptInviteRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        acceptInvite(acceptInviteRequest: AcceptInviteRequest, options?: RawAxiosRequestConfig): AxiosPromise<AcceptInvite201Response> {
+            return localVarFp.acceptInvite(acceptInviteRequest, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Set new password using the OTP sent to the user\'s email. Call after POST /api/auth/local/password-reset with projectId. Rate limited (OTP limit). If the user\'s email was not yet verified, it is marked as verified upon successful reset. 
+         * @summary Confirm password reset with OTP (project-based)
+         * @param {ConfirmLocalPasswordResetWithOtpRequest} confirmLocalPasswordResetWithOtpRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        confirmLocalPasswordResetWithOtp(confirmLocalPasswordResetWithOtpRequest: ConfirmLocalPasswordResetWithOtpRequest, options?: RawAxiosRequestConfig): AxiosPromise<MessageResponse> {
+            return localVarFp.confirmLocalPasswordResetWithOtp(confirmLocalPasswordResetWithOtpRequest, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Convert an anonymous user session to a full authenticated account. Preserves user data. Requires JWT Bearer token authentication. Both OrgBearerAuth and ProjectBearerAuth are supported (they use the same JWT token format). API keys are not supported for this endpoint. 
+         * @summary Convert anonymous account to full account
+         * @param {ConvertAnonymousAccountRequest} convertAnonymousAccountRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        convertAnonymousAccount(convertAnonymousAccountRequest: ConvertAnonymousAccountRequest, options?: RawAxiosRequestConfig): AxiosPromise<ConvertAnonymousAccount200Response> {
+            return localVarFp.convertAnonymousAccount(convertAnonymousAccountRequest, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Create an anonymous user session for guest access. Users can later convert to full accounts.
+         * @summary Create anonymous session
+         * @param {CreateAnonymousSessionRequest} [createAnonymousSessionRequest] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        createAnonymousSession(createAnonymousSessionRequest?: CreateAnonymousSessionRequest, options?: RawAxiosRequestConfig): AxiosPromise<CreateAnonymousSession200Response> {
+            return localVarFp.createAnonymousSession(createAnonymousSessionRequest, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Returns a list of all supported OAuth providers with their configuration details
+         * @summary Get all available OAuth providers
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getAvailableOAuthProviders(options?: RawAxiosRequestConfig): AxiosPromise<GetAvailableOAuthProviders200Response> {
+            return localVarFp.getAvailableOAuthProviders(options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Get the current authenticated user session information. Requires JWT Bearer token authentication. Both OrgBearerAuth and ProjectBearerAuth are supported (they use the same JWT token format). API keys are not supported for this endpoint. 
+         * @summary Get current session
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getCurrentSession(options?: RawAxiosRequestConfig): AxiosPromise<SessionResponse> {
+            return localVarFp.getCurrentSession(options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Get the current authenticated user session (project-based). Requires JWT Bearer token authentication. Both OrgBearerAuth and ProjectBearerAuth are supported (they use the same JWT token format). API keys are not supported for this endpoint. 
+         * @summary Get current session (project-based)
+         * @param {string} [projectId] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getLocalSession(projectId?: string, options?: RawAxiosRequestConfig): AxiosPromise<GetLocalSession200Response> {
+            return localVarFp.getLocalSession(projectId, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Returns a list of OAuth providers that are configured and available for organization-based authentication. Providers are configured via environment variables (e.g., GOOGLE_CLIENT_ID, GITHUB_CLIENT_ID). 
+         * @summary Get available OAuth providers for organization-based auth
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getOrgOAuthProviders(options?: RawAxiosRequestConfig): AxiosPromise<GetOrgOAuthProviders200Response> {
+            return localVarFp.getOrgOAuthProviders(options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Initiates OAuth authentication flow for a specified provider and project. The OAuth provider must be configured and enabled for the project first. Returns an HTTP 302 redirect to the OAuth provider\'s consent screen. Note: Swagger \"Try it out\" may show \"Failed to fetch\" for this endpoint due to browser CORS restrictions on cross-origin redirects. Use top-level browser navigation or curl to test. 
+         * @summary Initiate OAuth authentication
+         * @param {InitiateOAuthProviderEnum} provider 
+         * @param {string} projectId 
+         * @param {string} [redirectUrl] The URL to redirect to after authentication. Must be pre-registered in project settings.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        initiateOAuth(provider: InitiateOAuthProviderEnum, projectId: string, redirectUrl?: string, options?: RawAxiosRequestConfig): AxiosPromise<void> {
+            return localVarFp.initiateOAuth(provider, projectId, redirectUrl, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Initiates OAuth authentication flow for organization-level signup/login. The OAuth provider must be configured via environment variables (e.g., GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET). After successful authentication, creates a new organization and user account, or logs in existing user. 
+         * @summary Initiate OAuth authentication for organization
+         * @param {InitiateOrgOAuthProviderEnum} provider 
+         * @param {string} [redirectUrl] The URL to redirect to after authentication
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        initiateOrgOAuth(provider: InitiateOrgOAuthProviderEnum, redirectUrl?: string, options?: RawAxiosRequestConfig): AxiosPromise<void> {
+            return localVarFp.initiateOrgOAuth(provider, redirectUrl, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * When the project has **requireEmailVerification** enabled and the user has not verified their email, returns 403 with code **EMAIL_VERIFICATION_REQUIRED** (user must verify email first, then login again). 
+         * @summary Login user (project-based)
+         * @param {LoginLocalUserRequest} loginLocalUserRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        loginLocalUser(loginLocalUserRequest: LoginLocalUserRequest, options?: RawAxiosRequestConfig): AxiosPromise<LoginLocalUser200Response> {
+            return localVarFp.loginLocalUser(loginLocalUserRequest, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * 
+         * @summary Login user
+         * @param {LoginRequest} loginRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        loginUser(loginRequest: LoginRequest, options?: RawAxiosRequestConfig): AxiosPromise<AuthResponse> {
+            return localVarFp.loginUser(loginRequest, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Logout the current authenticated user session (project-based). Requires JWT Bearer token authentication. Both OrgBearerAuth and ProjectBearerAuth are supported (they use the same JWT token format). API keys are not supported for this endpoint. 
+         * @summary Logout user (project-based)
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        logoutLocalUser(options?: RawAxiosRequestConfig): AxiosPromise<MessageResponse> {
+            return localVarFp.logoutLocalUser(options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Logout the current authenticated user session. Requires JWT Bearer token authentication. Both OrgBearerAuth and ProjectBearerAuth are supported (they use the same JWT token format). API keys are not supported for this endpoint. 
+         * @summary Logout user
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        logoutUser(options?: RawAxiosRequestConfig): AxiosPromise<MessageResponse> {
+            return localVarFp.logoutUser(options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Handles OAuth callback for project-based authentication. This route must be matched before /api/auth/oauth/{provider}/{projectId}. Redirects to frontend with query params token, refreshToken, and expiresIn. 
+         * @summary OAuth callback handler (project-based)
+         * @param {string} provider 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        oauthCallback(provider: string, options?: RawAxiosRequestConfig): AxiosPromise<void> {
+            return localVarFp.oauthCallback(provider, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Handles OAuth callback for organization-based authentication. Creates a new organization and user account if the user doesn\'t exist, or logs in existing user. Redirects to frontend with query params token, refreshToken, and expiresIn. 
+         * @summary OAuth callback handler for organization
+         * @param {OrgOAuthCallbackProviderEnum} provider 
+         * @param {string} [code] Authorization code from OAuth provider
+         * @param {string} [state] State parameter for CSRF protection
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        orgOAuthCallback(provider: OrgOAuthCallbackProviderEnum, code?: string, state?: string, options?: RawAxiosRequestConfig): AxiosPromise<void> {
+            return localVarFp.orgOAuthCallback(provider, code, state, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Exchange a valid refresh token for a new JWT access token and refresh token. Works for both **org-based** (platform/dashboard) and **project-based** auth; the same endpoint is used. The previous refresh token is invalidated (rotation). If the same refresh token is used again, the session is revoked (reuse detection). 
+         * @summary Refresh access token (org and project)
+         * @param {RefreshTokenRequest} refreshTokenRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        refreshToken(refreshTokenRequest: RefreshTokenRequest, options?: RawAxiosRequestConfig): AxiosPromise<RefreshToken200Response> {
+            return localVarFp.refreshToken(refreshTokenRequest, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * When the project has **requireEmailVerification** enabled (default), the response is 201 with **requireVerification: true** and **no token**; the user must verify their email then sign in via login. When email verification is disabled, a token and refreshToken are returned. 
+         * @summary Register new user (project-based)
+         * @param {RegisterLocalUserRequest} registerLocalUserRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        registerLocalUser(registerLocalUserRequest: RegisterLocalUserRequest, options?: RawAxiosRequestConfig): AxiosPromise<RegisterLocalUser201Response> {
+            return localVarFp.registerLocalUser(registerLocalUserRequest, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * 
+         * @summary Register new user
+         * @param {RegisterRequest} registerRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        registerUser(registerRequest: RegisterRequest, options?: RawAxiosRequestConfig): AxiosPromise<AuthResponse> {
+            return localVarFp.registerUser(registerRequest, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * When projectId is provided, sends a 6-digit OTP to the user\'s email (project-based reset uses OTP, not link). When projectId is omitted, sends a token link (org/platform local account). Rate limited. 
+         * @summary Request password reset (project-based, OTP)
+         * @param {RequestLocalPasswordResetRequest} requestLocalPasswordResetRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        requestLocalPasswordReset(requestLocalPasswordResetRequest: RequestLocalPasswordResetRequest, options?: RawAxiosRequestConfig): AxiosPromise<MessageResponse> {
+            return localVarFp.requestLocalPasswordReset(requestLocalPasswordResetRequest, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Sends a password reset link to the user\'s email. Use this for organization (platform) accounts. For project-based accounts use POST /api/auth/local/password-reset with projectId (sends OTP instead). 
+         * @summary Request password reset (organization / platform)
+         * @param {RequestPasswordResetRequest} requestPasswordResetRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        requestPasswordReset(requestPasswordResetRequest: RequestPasswordResetRequest, options?: RawAxiosRequestConfig): AxiosPromise<MessageResponse> {
+            return localVarFp.requestPasswordReset(requestPasswordResetRequest, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Sends a new verification email to the given email (and optional project). For unauthenticated users who have not verified yet. Rate limited (e.g. 3 per 15 min per IP). 
+         * @summary Resend verification email (no auth)
+         * @param {ResendVerificationAuthRequest} resendVerificationAuthRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        resendVerificationAuth(resendVerificationAuthRequest: ResendVerificationAuthRequest, options?: RawAxiosRequestConfig): AxiosPromise<MessageResponse> {
+            return localVarFp.resendVerificationAuth(resendVerificationAuthRequest, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Legacy token-based completion. Prefer OTP flow: use POST .../password-reset/confirm with the OTP sent to email for project-based resets. 
+         * @summary Reset password with token (project-based, legacy)
+         * @param {string} token 
+         * @param {ResetLocalPasswordRequest} resetLocalPasswordRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        resetLocalPassword(token: string, resetLocalPasswordRequest: ResetLocalPasswordRequest, options?: RawAxiosRequestConfig): AxiosPromise<MessageResponse> {
+            return localVarFp.resetLocalPassword(token, resetLocalPasswordRequest, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Set new password using the token from the reset link. Validate the token first with POST /api/auth/password-reset/validate before showing the form. If the user\'s email was not yet verified, it is marked as verified upon successful reset. 
+         * @summary Reset password with token (organization / platform)
+         * @param {string} token 
+         * @param {ResetPasswordRequest} resetPasswordRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        resetPassword(token: string, resetPasswordRequest: ResetPasswordRequest, options?: RawAxiosRequestConfig): AxiosPromise<MessageResponse> {
+            return localVarFp.resetPassword(token, resetPasswordRequest, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * 
+         * @summary Send magic link
+         * @param {MagicLinkRequest} magicLinkRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        sendMagicLink(magicLinkRequest: MagicLinkRequest, options?: RawAxiosRequestConfig): AxiosPromise<MessageResponse> {
+            return localVarFp.sendMagicLink(magicLinkRequest, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * 
+         * @summary Send OTP code
+         * @param {OTPSendRequest} oTPSendRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        sendOTP(oTPSendRequest: OTPSendRequest, options?: RawAxiosRequestConfig): AxiosPromise<MessageResponse> {
+            return localVarFp.sendOTP(oTPSendRequest, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Call before showing the \"set new password\" form. Validates that the token from the reset link is still valid and not expired. Organization (platform) reset only. 
+         * @summary Validate password reset token
+         * @param {ValidatePasswordResetTokenRequest} validatePasswordResetTokenRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        validatePasswordResetToken(validatePasswordResetTokenRequest: ValidatePasswordResetTokenRequest, options?: RawAxiosRequestConfig): AxiosPromise<ValidatePasswordResetToken200Response> {
+            return localVarFp.validatePasswordResetToken(validatePasswordResetTokenRequest, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Verifies the user\'s email using the token from the link sent at signup. Use this for both organization and project signups (unauthenticated). Same behavior as POST /api/users/verify-email. 
+         * @summary Verify email address (no auth)
+         * @param {VerifyEmailAuthRequest} verifyEmailAuthRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        verifyEmailAuth(verifyEmailAuthRequest: VerifyEmailAuthRequest, options?: RawAxiosRequestConfig): AxiosPromise<MessageResponse> {
+            return localVarFp.verifyEmailAuth(verifyEmailAuthRequest, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * 
+         * @summary Verify magic link
+         * @param {VerifyMagicLinkRequest} verifyMagicLinkRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        verifyMagicLink(verifyMagicLinkRequest: VerifyMagicLinkRequest, options?: RawAxiosRequestConfig): AxiosPromise<AuthResponse> {
+            return localVarFp.verifyMagicLink(verifyMagicLinkRequest, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * 
+         * @summary Verify OTP code
+         * @param {OTPVerifyRequest} oTPVerifyRequest 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        verifyOTP(oTPVerifyRequest: OTPVerifyRequest, options?: RawAxiosRequestConfig): AxiosPromise<AuthResponse> {
+            return localVarFp.verifyOTP(oTPVerifyRequest, options).then((request) => request(axios, basePath));
+        },
+    };
+};
+
+/**
+ * AuthenticationApi - object-oriented interface
+ */
+export class AuthenticationApi extends BaseAPI {
+    /**
+     * Accept an organization invitation using the token from the invite email link (e.g. `/invite/{token}?orgId=...`). Creates a new user with the invited email and adds them to the organization with the invited role. Returns a JWT and user so the client can log the user in immediately. No authentication required. 
+     * @summary Accept organization invitation
+     * @param {AcceptInviteRequest} acceptInviteRequest 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    public acceptInvite(acceptInviteRequest: AcceptInviteRequest, options?: RawAxiosRequestConfig) {
+        return AuthenticationApiFp(this.configuration).acceptInvite(acceptInviteRequest, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Set new password using the OTP sent to the user\'s email. Call after POST /api/auth/local/password-reset with projectId. Rate limited (OTP limit). If the user\'s email was not yet verified, it is marked as verified upon successful reset. 
+     * @summary Confirm password reset with OTP (project-based)
+     * @param {ConfirmLocalPasswordResetWithOtpRequest} confirmLocalPasswordResetWithOtpRequest 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    public confirmLocalPasswordResetWithOtp(confirmLocalPasswordResetWithOtpRequest: ConfirmLocalPasswordResetWithOtpRequest, options?: RawAxiosRequestConfig) {
+        return AuthenticationApiFp(this.configuration).confirmLocalPasswordResetWithOtp(confirmLocalPasswordResetWithOtpRequest, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Convert an anonymous user session to a full authenticated account. Preserves user data. Requires JWT Bearer token authentication. Both OrgBearerAuth and ProjectBearerAuth are supported (they use the same JWT token format). API keys are not supported for this endpoint. 
+     * @summary Convert anonymous account to full account
+     * @param {ConvertAnonymousAccountRequest} convertAnonymousAccountRequest 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    public convertAnonymousAccount(convertAnonymousAccountRequest: ConvertAnonymousAccountRequest, options?: RawAxiosRequestConfig) {
+        return AuthenticationApiFp(this.configuration).convertAnonymousAccount(convertAnonymousAccountRequest, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Create an anonymous user session for guest access. Users can later convert to full accounts.
+     * @summary Create anonymous session
+     * @param {CreateAnonymousSessionRequest} [createAnonymousSessionRequest] 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    public createAnonymousSession(createAnonymousSessionRequest?: CreateAnonymousSessionRequest, options?: RawAxiosRequestConfig) {
+        return AuthenticationApiFp(this.configuration).createAnonymousSession(createAnonymousSessionRequest, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Returns a list of all supported OAuth providers with their configuration details
+     * @summary Get all available OAuth providers
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    public getAvailableOAuthProviders(options?: RawAxiosRequestConfig) {
+        return AuthenticationApiFp(this.configuration).getAvailableOAuthProviders(options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Get the current authenticated user session information. Requires JWT Bearer token authentication. Both OrgBearerAuth and ProjectBearerAuth are supported (they use the same JWT token format). API keys are not supported for this endpoint. 
+     * @summary Get current session
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    public getCurrentSession(options?: RawAxiosRequestConfig) {
+        return AuthenticationApiFp(this.configuration).getCurrentSession(options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Get the current authenticated user session (project-based). Requires JWT Bearer token authentication. Both OrgBearerAuth and ProjectBearerAuth are supported (they use the same JWT token format). API keys are not supported for this endpoint. 
+     * @summary Get current session (project-based)
+     * @param {string} [projectId] 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    public getLocalSession(projectId?: string, options?: RawAxiosRequestConfig) {
+        return AuthenticationApiFp(this.configuration).getLocalSession(projectId, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Returns a list of OAuth providers that are configured and available for organization-based authentication. Providers are configured via environment variables (e.g., GOOGLE_CLIENT_ID, GITHUB_CLIENT_ID). 
+     * @summary Get available OAuth providers for organization-based auth
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    public getOrgOAuthProviders(options?: RawAxiosRequestConfig) {
+        return AuthenticationApiFp(this.configuration).getOrgOAuthProviders(options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Initiates OAuth authentication flow for a specified provider and project. The OAuth provider must be configured and enabled for the project first. Returns an HTTP 302 redirect to the OAuth provider\'s consent screen. Note: Swagger \"Try it out\" may show \"Failed to fetch\" for this endpoint due to browser CORS restrictions on cross-origin redirects. Use top-level browser navigation or curl to test. 
+     * @summary Initiate OAuth authentication
+     * @param {InitiateOAuthProviderEnum} provider 
+     * @param {string} projectId 
+     * @param {string} [redirectUrl] The URL to redirect to after authentication. Must be pre-registered in project settings.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    public initiateOAuth(provider: InitiateOAuthProviderEnum, projectId: string, redirectUrl?: string, options?: RawAxiosRequestConfig) {
+        return AuthenticationApiFp(this.configuration).initiateOAuth(provider, projectId, redirectUrl, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Initiates OAuth authentication flow for organization-level signup/login. The OAuth provider must be configured via environment variables (e.g., GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET). After successful authentication, creates a new organization and user account, or logs in existing user. 
+     * @summary Initiate OAuth authentication for organization
+     * @param {InitiateOrgOAuthProviderEnum} provider 
+     * @param {string} [redirectUrl] The URL to redirect to after authentication
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    public initiateOrgOAuth(provider: InitiateOrgOAuthProviderEnum, redirectUrl?: string, options?: RawAxiosRequestConfig) {
+        return AuthenticationApiFp(this.configuration).initiateOrgOAuth(provider, redirectUrl, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * When the project has **requireEmailVerification** enabled and the user has not verified their email, returns 403 with code **EMAIL_VERIFICATION_REQUIRED** (user must verify email first, then login again). 
+     * @summary Login user (project-based)
+     * @param {LoginLocalUserRequest} loginLocalUserRequest 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    public loginLocalUser(loginLocalUserRequest: LoginLocalUserRequest, options?: RawAxiosRequestConfig) {
+        return AuthenticationApiFp(this.configuration).loginLocalUser(loginLocalUserRequest, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * 
+     * @summary Login user
+     * @param {LoginRequest} loginRequest 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    public loginUser(loginRequest: LoginRequest, options?: RawAxiosRequestConfig) {
+        return AuthenticationApiFp(this.configuration).loginUser(loginRequest, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Logout the current authenticated user session (project-based). Requires JWT Bearer token authentication. Both OrgBearerAuth and ProjectBearerAuth are supported (they use the same JWT token format). API keys are not supported for this endpoint. 
+     * @summary Logout user (project-based)
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    public logoutLocalUser(options?: RawAxiosRequestConfig) {
+        return AuthenticationApiFp(this.configuration).logoutLocalUser(options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Logout the current authenticated user session. Requires JWT Bearer token authentication. Both OrgBearerAuth and ProjectBearerAuth are supported (they use the same JWT token format). API keys are not supported for this endpoint. 
+     * @summary Logout user
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    public logoutUser(options?: RawAxiosRequestConfig) {
+        return AuthenticationApiFp(this.configuration).logoutUser(options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Handles OAuth callback for project-based authentication. This route must be matched before /api/auth/oauth/{provider}/{projectId}. Redirects to frontend with query params token, refreshToken, and expiresIn. 
+     * @summary OAuth callback handler (project-based)
+     * @param {string} provider 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    public oauthCallback(provider: string, options?: RawAxiosRequestConfig) {
+        return AuthenticationApiFp(this.configuration).oauthCallback(provider, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Handles OAuth callback for organization-based authentication. Creates a new organization and user account if the user doesn\'t exist, or logs in existing user. Redirects to frontend with query params token, refreshToken, and expiresIn. 
+     * @summary OAuth callback handler for organization
+     * @param {OrgOAuthCallbackProviderEnum} provider 
+     * @param {string} [code] Authorization code from OAuth provider
+     * @param {string} [state] State parameter for CSRF protection
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    public orgOAuthCallback(provider: OrgOAuthCallbackProviderEnum, code?: string, state?: string, options?: RawAxiosRequestConfig) {
+        return AuthenticationApiFp(this.configuration).orgOAuthCallback(provider, code, state, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Exchange a valid refresh token for a new JWT access token and refresh token. Works for both **org-based** (platform/dashboard) and **project-based** auth; the same endpoint is used. The previous refresh token is invalidated (rotation). If the same refresh token is used again, the session is revoked (reuse detection). 
+     * @summary Refresh access token (org and project)
+     * @param {RefreshTokenRequest} refreshTokenRequest 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    public refreshToken(refreshTokenRequest: RefreshTokenRequest, options?: RawAxiosRequestConfig) {
+        return AuthenticationApiFp(this.configuration).refreshToken(refreshTokenRequest, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * When the project has **requireEmailVerification** enabled (default), the response is 201 with **requireVerification: true** and **no token**; the user must verify their email then sign in via login. When email verification is disabled, a token and refreshToken are returned. 
+     * @summary Register new user (project-based)
+     * @param {RegisterLocalUserRequest} registerLocalUserRequest 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    public registerLocalUser(registerLocalUserRequest: RegisterLocalUserRequest, options?: RawAxiosRequestConfig) {
+        return AuthenticationApiFp(this.configuration).registerLocalUser(registerLocalUserRequest, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * 
+     * @summary Register new user
+     * @param {RegisterRequest} registerRequest 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    public registerUser(registerRequest: RegisterRequest, options?: RawAxiosRequestConfig) {
+        return AuthenticationApiFp(this.configuration).registerUser(registerRequest, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * When projectId is provided, sends a 6-digit OTP to the user\'s email (project-based reset uses OTP, not link). When projectId is omitted, sends a token link (org/platform local account). Rate limited. 
+     * @summary Request password reset (project-based, OTP)
+     * @param {RequestLocalPasswordResetRequest} requestLocalPasswordResetRequest 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    public requestLocalPasswordReset(requestLocalPasswordResetRequest: RequestLocalPasswordResetRequest, options?: RawAxiosRequestConfig) {
+        return AuthenticationApiFp(this.configuration).requestLocalPasswordReset(requestLocalPasswordResetRequest, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Sends a password reset link to the user\'s email. Use this for organization (platform) accounts. For project-based accounts use POST /api/auth/local/password-reset with projectId (sends OTP instead). 
+     * @summary Request password reset (organization / platform)
+     * @param {RequestPasswordResetRequest} requestPasswordResetRequest 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    public requestPasswordReset(requestPasswordResetRequest: RequestPasswordResetRequest, options?: RawAxiosRequestConfig) {
+        return AuthenticationApiFp(this.configuration).requestPasswordReset(requestPasswordResetRequest, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Sends a new verification email to the given email (and optional project). For unauthenticated users who have not verified yet. Rate limited (e.g. 3 per 15 min per IP). 
+     * @summary Resend verification email (no auth)
+     * @param {ResendVerificationAuthRequest} resendVerificationAuthRequest 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    public resendVerificationAuth(resendVerificationAuthRequest: ResendVerificationAuthRequest, options?: RawAxiosRequestConfig) {
+        return AuthenticationApiFp(this.configuration).resendVerificationAuth(resendVerificationAuthRequest, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Legacy token-based completion. Prefer OTP flow: use POST .../password-reset/confirm with the OTP sent to email for project-based resets. 
+     * @summary Reset password with token (project-based, legacy)
+     * @param {string} token 
+     * @param {ResetLocalPasswordRequest} resetLocalPasswordRequest 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    public resetLocalPassword(token: string, resetLocalPasswordRequest: ResetLocalPasswordRequest, options?: RawAxiosRequestConfig) {
+        return AuthenticationApiFp(this.configuration).resetLocalPassword(token, resetLocalPasswordRequest, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Set new password using the token from the reset link. Validate the token first with POST /api/auth/password-reset/validate before showing the form. If the user\'s email was not yet verified, it is marked as verified upon successful reset. 
+     * @summary Reset password with token (organization / platform)
+     * @param {string} token 
+     * @param {ResetPasswordRequest} resetPasswordRequest 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    public resetPassword(token: string, resetPasswordRequest: ResetPasswordRequest, options?: RawAxiosRequestConfig) {
+        return AuthenticationApiFp(this.configuration).resetPassword(token, resetPasswordRequest, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * 
+     * @summary Send magic link
+     * @param {MagicLinkRequest} magicLinkRequest 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    public sendMagicLink(magicLinkRequest: MagicLinkRequest, options?: RawAxiosRequestConfig) {
+        return AuthenticationApiFp(this.configuration).sendMagicLink(magicLinkRequest, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * 
+     * @summary Send OTP code
+     * @param {OTPSendRequest} oTPSendRequest 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    public sendOTP(oTPSendRequest: OTPSendRequest, options?: RawAxiosRequestConfig) {
+        return AuthenticationApiFp(this.configuration).sendOTP(oTPSendRequest, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Call before showing the \"set new password\" form. Validates that the token from the reset link is still valid and not expired. Organization (platform) reset only. 
+     * @summary Validate password reset token
+     * @param {ValidatePasswordResetTokenRequest} validatePasswordResetTokenRequest 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    public validatePasswordResetToken(validatePasswordResetTokenRequest: ValidatePasswordResetTokenRequest, options?: RawAxiosRequestConfig) {
+        return AuthenticationApiFp(this.configuration).validatePasswordResetToken(validatePasswordResetTokenRequest, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Verifies the user\'s email using the token from the link sent at signup. Use this for both organization and project signups (unauthenticated). Same behavior as POST /api/users/verify-email. 
+     * @summary Verify email address (no auth)
+     * @param {VerifyEmailAuthRequest} verifyEmailAuthRequest 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    public verifyEmailAuth(verifyEmailAuthRequest: VerifyEmailAuthRequest, options?: RawAxiosRequestConfig) {
+        return AuthenticationApiFp(this.configuration).verifyEmailAuth(verifyEmailAuthRequest, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * 
+     * @summary Verify magic link
+     * @param {VerifyMagicLinkRequest} verifyMagicLinkRequest 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    public verifyMagicLink(verifyMagicLinkRequest: VerifyMagicLinkRequest, options?: RawAxiosRequestConfig) {
+        return AuthenticationApiFp(this.configuration).verifyMagicLink(verifyMagicLinkRequest, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * 
+     * @summary Verify OTP code
+     * @param {OTPVerifyRequest} oTPVerifyRequest 
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    public verifyOTP(oTPVerifyRequest: OTPVerifyRequest, options?: RawAxiosRequestConfig) {
+        return AuthenticationApiFp(this.configuration).verifyOTP(oTPVerifyRequest, options).then((request) => request(this.axios, this.basePath));
+    }
+}
+
+export const InitiateOAuthProviderEnum = {
+    Google: 'google',
+    Github: 'github',
+    Facebook: 'facebook',
+    Microsoft: 'microsoft',
+    Apple: 'apple',
+    Twitter: 'twitter',
+    Discord: 'discord',
+    Linkedin: 'linkedin',
+    Dropbox: 'dropbox',
+    Slack: 'slack',
+    Reddit: 'reddit',
+    Twitch: 'twitch',
+    Figma: 'figma',
+    Zoom: 'zoom',
+    Bitbucket: 'bitbucket',
+    Salesforce: 'salesforce',
+    Shopify: 'shopify',
+    Line: 'line',
+    Spotify: 'spotify',
+    Strava: 'strava',
+    Paypal: 'paypal',
+    Asana: 'asana',
+    Trello: 'trello',
+    Okta: 'okta',
+    Gitea: 'gitea',
+    Yandex: 'yandex',
+    Yahoo: 'yahoo',
+    Vk: 'vk',
+    Meetup: 'meetup'
+} as const;
+export type InitiateOAuthProviderEnum = typeof InitiateOAuthProviderEnum[keyof typeof InitiateOAuthProviderEnum];
+export const InitiateOrgOAuthProviderEnum = {
+    Google: 'google',
+    Github: 'github',
+    Facebook: 'facebook',
+    Microsoft: 'microsoft',
+    Discord: 'discord',
+    Linkedin: 'linkedin'
+} as const;
+export type InitiateOrgOAuthProviderEnum = typeof InitiateOrgOAuthProviderEnum[keyof typeof InitiateOrgOAuthProviderEnum];
+export const OrgOAuthCallbackProviderEnum = {
+    Google: 'google',
+    Github: 'github',
+    Facebook: 'facebook',
+    Microsoft: 'microsoft',
+    Discord: 'discord',
+    Linkedin: 'linkedin'
+} as const;
+export type OrgOAuthCallbackProviderEnum = typeof OrgOAuthCallbackProviderEnum[keyof typeof OrgOAuthCallbackProviderEnum];