@cboxdk/id-js 0.19.0 → 0.21.0

package/dist/management.cjs

@@ -572,6 +572,10 @@ var environmentOperations = {
   "apis.scopes.define": { action: "apis.scopes.define", operationId: "apis_scopes_define", method: "PUT", path: "/apis/{id}/scopes/{key}", pathParams: ["id", "key"], scope: "apis:write", danger: "write", approval: true, body: true, pagination: null },
   "apis.scopes.remove": { action: "apis.scopes.remove", operationId: "apis_scopes_remove", method: "DELETE", path: "/apis/{id}/scopes/{key}", pathParams: ["id", "key"], scope: "apis:write", danger: "destructive", approval: true, body: false, pagination: null },
   "apis.update": { action: "apis.update", operationId: null, method: "PATCH", path: "/apis/{id}", pathParams: ["id"], scope: "apis:write", danger: "write", approval: true, body: true, pagination: null },
+  "app_catalog.delete": { action: "app_catalog.delete", operationId: "app_catalog_delete", method: "DELETE", path: "/app-catalog/{key}", pathParams: ["key"], scope: "app_catalog:write", danger: "destructive", approval: true, body: true, pagination: null },
+  "app_catalog.list": { action: "app_catalog.list", operationId: "app_catalog_list", method: "GET", path: "/app-catalog", pathParams: [], scope: "app_catalog:read", danger: "read", approval: true, body: false, pagination: null },
+  "app_catalog.save": { action: "app_catalog.save", operationId: "app_catalog_save", method: "PUT", path: "/app-catalog/{key}", pathParams: ["key"], scope: "app_catalog:write", danger: "write", approval: true, body: true, pagination: null },
+  "app_catalog.show": { action: "app_catalog.show", operationId: "app_catalog_show", method: "GET", path: "/app-catalog/{key}", pathParams: ["key"], scope: "app_catalog:read", danger: "read", approval: true, body: false, pagination: null },
   "approvals.deny": { action: "approvals.deny", operationId: "approvals_deny", method: "POST", path: "/agent-requests/{request_id}/deny", pathParams: ["request_id"], scope: "approvals:write", danger: "destructive", approval: true, body: false, pagination: null },
   "approvals.list": { action: "approvals.list", operationId: "approvals_list", method: "GET", path: "/agent-requests", pathParams: [], scope: "approvals:read", danger: "read", approval: true, body: false, pagination: "cursor" },
   "apps.blueprint": { action: "apps.blueprint", operationId: "apps_blueprint", method: "GET", path: "/apps/{id}/blueprint", pathParams: ["id"], scope: "apps:read", danger: "read", approval: true, body: false, pagination: null },
@@ -588,6 +592,7 @@ var environmentOperations = {
   "apps.secrets.rotate": { action: "apps.secrets.rotate", operationId: "apps_secrets_rotate", method: "POST", path: "/apps/{id}/secrets", pathParams: ["id"], scope: "apps:write", danger: "critical", approval: true, body: true, pagination: null },
   "apps.settings.api_key_prefix": { action: "apps.settings.api_key_prefix", operationId: "apps_settings_api_key_prefix", method: "PUT", path: "/apps/{id}/settings/api-key-prefix", pathParams: ["id"], scope: "apps:write", danger: "write", approval: true, body: true, pagination: null },
   "apps.settings.backchannel_logout": { action: "apps.settings.backchannel_logout", operationId: "apps_settings_backchannel_logout", method: "PUT", path: "/apps/{id}/settings/backchannel-logout", pathParams: ["id"], scope: "apps:write", danger: "write", approval: true, body: true, pagination: null },
+  "apps.settings.client_credentials": { action: "apps.settings.client_credentials", operationId: "apps_settings_client_credentials", method: "PUT", path: "/apps/{id}/settings/client-credentials", pathParams: ["id"], scope: "apps:write", danger: "write", approval: true, body: true, pagination: null },
   "apps.settings.token_exchange": { action: "apps.settings.token_exchange", operationId: "apps_settings_token_exchange", method: "PUT", path: "/apps/{id}/settings/token-exchange", pathParams: ["id"], scope: "apps:write", danger: "write", approval: true, body: true, pagination: null },
   "apps.settings.token_lifetime": { action: "apps.settings.token_lifetime", operationId: "apps_settings_token_lifetime", method: "PUT", path: "/apps/{id}/settings/token-lifetime", pathParams: ["id"], scope: "apps:write", danger: "write", approval: true, body: true, pagination: null },
   "apps.update": { action: "apps.update", operationId: "apps_update", method: "PATCH", path: "/apps/{id}", pathParams: ["id"], scope: "apps:write", danger: "write", approval: true, body: true, pagination: null },
@@ -604,6 +609,7 @@ var environmentOperations = {
   "audit_logs.settings.update": { action: "audit_logs.settings.update", operationId: "audit_logs_settings_update", method: "PATCH", path: "/audit-logs/settings", pathParams: [], scope: "audit_logs:manage", danger: "destructive", approval: true, body: true, pagination: null },
   "audit_logs.verify": { action: "audit_logs.verify", operationId: "audit_logs_verify", method: "GET", path: "/audit-logs/verify", pathParams: [], scope: "audit_logs:read", danger: "read", approval: true, body: false, pagination: null },
   "audit.list": { action: "audit.list", operationId: "audit_list", method: "GET", path: "/audit-log", pathParams: [], scope: "audit:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "authenticator.me.list": { action: null, operationId: "authenticatorIdentity", method: "GET", path: "/authenticator/me", pathParams: [], scope: null, danger: null, approval: false, body: false, pagination: null },
   "branding.appearance.get": { action: "branding.appearance.get", operationId: "branding_appearance_get", method: "GET", path: "/branding/appearance", pathParams: [], scope: "branding:read", danger: "read", approval: true, body: false, pagination: null },
   "branding.appearance.set": { action: "branding.appearance.set", operationId: "branding_appearance_set", method: "PUT", path: "/branding/appearance", pathParams: [], scope: "branding:write", danger: "write", approval: true, body: true, pagination: null },
   "branding.whitelabel.get": { action: "branding.whitelabel.get", operationId: "branding_whitelabel_get", method: "GET", path: "/branding/whitelabel", pathParams: [], scope: "branding:read", danger: "read", approval: true, body: false, pagination: null },
@@ -652,6 +658,7 @@ var environmentOperations = {
   "hooks.get": { action: "hooks.get", operationId: "hooks_get", method: "GET", path: "/hooks/{id}", pathParams: ["id"], scope: "hooks:read", danger: "read", approval: true, body: false, pagination: null },
   "hooks.list": { action: "hooks.list", operationId: "hooks_list", method: "GET", path: "/hooks", pathParams: [], scope: "hooks:read", danger: "read", approval: true, body: false, pagination: "cursor" },
   "hooks.update": { action: "hooks.update", operationId: "hooks_update", method: "PATCH", path: "/hooks/{id}", pathParams: ["id"], scope: "hooks:write", danger: "critical", approval: true, body: true, pagination: null },
+  "invitations.get": { action: "invitations.get", operationId: "invitations_get", method: "GET", path: "/organizations/{organization_id}/invitations/{invitation_id}", pathParams: ["organization_id", "invitation_id"], scope: "invitations:read", danger: "read", approval: true, body: false, pagination: null },
   "invitations.list": { action: "invitations.list", operationId: "invitations_list", method: "GET", path: "/organizations/{organization_id}/invitations", pathParams: ["organization_id"], scope: "invitations:read", danger: "read", approval: true, body: false, pagination: "cursor" },
   "invitations.resend": { action: "invitations.resend", operationId: "invitations_resend", method: "POST", path: "/organizations/{organization_id}/invitations/{invitation_id}/resend", pathParams: ["organization_id", "invitation_id"], scope: "invitations:write", danger: "write", approval: true, body: false, pagination: null },
   "invitations.revoke": { action: "invitations.revoke", operationId: "invitations_revoke", method: "DELETE", path: "/organizations/{organization_id}/invitations/{invitation_id}", pathParams: ["organization_id", "invitation_id"], scope: "invitations:write", danger: "destructive", approval: true, body: false, pagination: null },
@@ -671,6 +678,7 @@ var environmentOperations = {
   "log_streams.test": { action: "log_streams.test", operationId: "log_streams_test", method: "POST", path: "/log-streams/{id}/test", pathParams: ["id"], scope: "log_streams:write", danger: "write", approval: true, body: false, pagination: null },
   "log_streams.update": { action: "log_streams.update", operationId: "log_streams_update", method: "PATCH", path: "/log-streams/{id}", pathParams: ["id"], scope: "log_streams:write", danger: "critical", approval: true, body: true, pagination: null },
   "members.add": { action: "members.add", operationId: "members_add", method: "POST", path: "/organizations/{organization_id}/members", pathParams: ["organization_id"], scope: "members:write", danger: "write", approval: true, body: true, pagination: null },
+  "members.apps.roles.replace": { action: "members.apps.roles.replace", operationId: "members_apps_roles_replace", method: "PUT", path: "/organizations/{organization_id}/members/{user_id}/apps/{client_id}/roles", pathParams: ["organization_id", "user_id", "client_id"], scope: "roles:write", danger: "write", approval: true, body: true, pagination: null },
   "members.list": { action: "members.list", operationId: "members_list", method: "GET", path: "/organizations/{organization_id}/members", pathParams: ["organization_id"], scope: "members:read", danger: "read", approval: true, body: false, pagination: "cursor" },
   "members.remove": { action: "members.remove", operationId: "members_remove", method: "DELETE", path: "/organizations/{organization_id}/members/{user_id}", pathParams: ["organization_id", "user_id"], scope: "members:write", danger: "destructive", approval: true, body: false, pagination: null },
   "members.roles.grant": { action: "members.roles.grant", operationId: "members_roles_grant", method: "PUT", path: "/organizations/{organization_id}/members/{user_id}/roles/{role_id}", pathParams: ["organization_id", "user_id", "role_id"], scope: "roles:write", danger: "write", approval: true, body: false, pagination: null },
@@ -726,6 +734,7 @@ var environmentOperations = {
   "radar.settings.get": { action: "radar.settings.get", operationId: "radar_settings_get", method: "GET", path: "/radar/settings", pathParams: [], scope: "radar:read", danger: "read", approval: true, body: false, pagination: null },
   "radar.settings.update": { action: "radar.settings.update", operationId: "radar_settings_update", method: "PATCH", path: "/radar/settings", pathParams: [], scope: "radar:write", danger: "write", approval: true, body: true, pagination: null },
   "roles.create": { action: "roles.create", operationId: "roles_create", method: "POST", path: "/roles", pathParams: [], scope: "role_definitions:write", danger: "write", approval: true, body: true, pagination: null },
+  "roles.definition.activate": { action: "roles.definition.activate", operationId: "roles_definition_activate", method: "POST", path: "/roles/{id}/definition/activate", pathParams: ["id"], scope: "role_definitions:write", danger: "destructive", approval: true, body: true, pagination: null },
   "roles.delete": { action: "roles.delete", operationId: "roles_delete", method: "DELETE", path: "/roles/{id}", pathParams: ["id"], scope: "role_definitions:write", danger: "destructive", approval: true, body: false, pagination: null },
   "roles.get": { action: "roles.get", operationId: "roles_get", method: "GET", path: "/roles/{id}", pathParams: ["id"], scope: "roles:read", danger: "read", approval: true, body: false, pagination: null },
   "roles.list": { action: "roles.list", operationId: "roles_list", method: "GET", path: "/roles", pathParams: [], scope: "roles:read", danger: "read", approval: true, body: false, pagination: null },
@@ -737,6 +746,8 @@ var environmentOperations = {
   "saml_apps.get": { action: "saml_apps.get", operationId: "saml_apps_get", method: "GET", path: "/saml-apps/{id}", pathParams: ["id"], scope: "saml_apps:read", danger: "read", approval: true, body: false, pagination: null },
   "saml_apps.list": { action: "saml_apps.list", operationId: "saml_apps_list", method: "GET", path: "/saml-apps", pathParams: [], scope: "saml_apps:read", danger: "read", approval: true, body: false, pagination: "cursor" },
   "saml_apps.update": { action: "saml_apps.update", operationId: "saml_apps_update", method: "PATCH", path: "/saml-apps/{id}", pathParams: ["id"], scope: "saml_apps:write", danger: "critical", approval: true, body: true, pagination: null },
+  "signals.source.erasures.list": { action: null, operationId: "signals_source_erasures", method: "GET", path: "/signals/source/erasures", pathParams: [], scope: null, danger: null, approval: false, body: false, pagination: "cursor" },
+  "signals.source.list": { action: null, operationId: "signals_source_list", method: "GET", path: "/signals/source", pathParams: [], scope: null, danger: null, approval: false, body: false, pagination: "cursor" },
   "signin.policy.get": { action: "signin.policy.get", operationId: "signin_policy_get", method: "GET", path: "/sign-in/policy", pathParams: [], scope: "signin:read", danger: "read", approval: true, body: false, pagination: null },
   "signin.policy.inherit": { action: "signin.policy.inherit", operationId: "signin_policy_inherit", method: "DELETE", path: "/sign-in/policy/organizations/{organization_id}", pathParams: ["organization_id"], scope: "signin:write", danger: "critical", approval: true, body: false, pagination: null },
   "signin.policy.update": { action: "signin.policy.update", operationId: "signin_policy_update", method: "PATCH", path: "/sign-in/policy", pathParams: [], scope: "signin:write", danger: "critical", approval: true, body: true, pagination: null },
@@ -782,6 +793,8 @@ var environmentOperations = {
   "token_vault.secrets.list": { action: "token_vault.secrets.list", operationId: "token_vault_secrets_list", method: "GET", path: "/token-vault/secrets", pathParams: [], scope: "token_vault:read", danger: "read", approval: true, body: false, pagination: "cursor" },
   "token_vault.secrets.revoke": { action: "token_vault.secrets.revoke", operationId: "token_vault_secrets_revoke", method: "POST", path: "/token-vault/secrets/{id}/revoke", pathParams: ["id"], scope: "token_vault:write", danger: "destructive", approval: true, body: true, pagination: null },
   "token_vault.secrets.rotate": { action: "token_vault.secrets.rotate", operationId: "token_vault_secrets_rotate", method: "POST", path: "/token-vault/secrets/{id}/rotate", pathParams: ["id"], scope: "token_vault:write", danger: "critical", approval: true, body: true, pagination: null },
+  "user_property_namespaces.configure": { action: "user_property_namespaces.configure", operationId: "user_property_namespaces_configure", method: "PUT", path: "/user-property-namespaces/{name}", pathParams: ["name"], scope: "user_property_namespaces:write", danger: "critical", approval: true, body: true, pagination: null },
+  "user_property_namespaces.show": { action: "user_property_namespaces.show", operationId: "user_property_namespaces_show", method: "GET", path: "/user-property-namespaces/{name}", pathParams: ["name"], scope: "user_property_namespaces:read", danger: "read", approval: true, body: false, pagination: null },
   "users.create": { action: "users.create", operationId: "users_create", method: "POST", path: "/users", pathParams: [], scope: "users:write", danger: "write", approval: true, body: true, pagination: null },
   "users.deactivate": { action: "users.deactivate", operationId: "users_deactivate", method: "DELETE", path: "/users/{id}", pathParams: ["id"], scope: "users:write", danger: "destructive", approval: true, body: false, pagination: null },
   "users.environment_roles.get": { action: "users.environment_roles.get", operationId: "users_environment_roles_get", method: "GET", path: "/users/{id}/environment-roles/{role_id}", pathParams: ["id", "role_id"], scope: "roles:read", danger: "read", approval: true, body: false, pagination: null },
@@ -1028,6 +1041,52 @@ var EnvironmentClient = class {
       remove: (id, key, options) => this.transport.call(environmentOperations["apis.scopes.remove"], [id, key], void 0, options)
     }
   };
+  appCatalog = {
+    /**
+     * Remove a catalog app without deleting its OAuth clients or user data.
+     *
+     * Requires scope `app_catalog:write`. Danger: destructive.
+     *
+     * `DELETE /app-catalog/{key}` · action `app_catalog.delete`
+     * @scope `app_catalog:write`
+     * @danger destructive
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    delete: (key, body, options) => this.transport.call(environmentOperations["app_catalog.delete"], [key], body, options),
+    /**
+     * List catalog apps, including drafts and visibility settings.
+     *
+     * Requires scope `app_catalog:read`. Danger: read.
+     *
+     * `GET /app-catalog` · action `app_catalog.list`
+     * @scope `app_catalog:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    list: (options) => this.transport.call(environmentOperations["app_catalog.list"], [], void 0, options),
+    /**
+     * Create or replace a catalog app, its icon and visibility. Version zero creates; a stale version conflicts.
+     *
+     * Requires scope `app_catalog:write`. Danger: write.
+     *
+     * `PUT /app-catalog/{key}` · action `app_catalog.save`
+     * @scope `app_catalog:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    save: (key, body, options) => this.transport.call(environmentOperations["app_catalog.save"], [key], body, options),
+    /**
+     * Read a catalog app and its publication settings.
+     *
+     * Requires scope `app_catalog:read`. Danger: read.
+     *
+     * `GET /app-catalog/{key}` · action `app_catalog.show`
+     * @scope `app_catalog:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    show: (key, options) => this.transport.call(environmentOperations["app_catalog.show"], [key], void 0, options)
+  };
   approvals = {
     /**
      * Deny a pending approval request (CIBA) for the person it was raised for: the agent gets access_denied and no token.
@@ -1251,6 +1310,17 @@ var EnvironmentClient = class {
        * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
        */
       backchannelLogout: (id, body, options) => this.transport.call(environmentOperations["apps.settings.backchannel_logout"], [id], body, options),
+      /**
+       * Turn client-credentials authentication on or off for a confidential app; other grants and scopes stay unchanged.
+       *
+       * Requires scope `apps:write`. Danger: write.
+       *
+       * `PUT /apps/{id}/settings/client-credentials` · action `apps.settings.client_credentials`
+       * @scope `apps:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      clientCredentials: (id, body, options) => this.transport.call(environmentOperations["apps.settings.client_credentials"], [id], body, options),
       /**
        * Turn token exchange (RFC 8693) on or off for a confidential app.
        *
@@ -1436,6 +1506,18 @@ var EnvironmentClient = class {
     /** Every item of `audit.list`, fetching pages as the iteration reaches them. */
     listAll: (query, options) => this.transport.paginate(environmentOperations["audit.list"], [], query, options)
   };
+  authenticator = {
+    me: {
+      /**
+       * Verified identity for the authenticator
+       *
+       * Requires the provisioned public authenticator client, devices.manage and a DPoP proof. Available before device registration; revoked keys are refused.
+       *
+       * `GET /authenticator/me`
+       */
+      list: (options) => this.transport.call(environmentOperations["authenticator.me.list"], [], void 0, options)
+    }
+  };
   branding = {
     appearance: {
       /**
@@ -2023,6 +2105,17 @@ var EnvironmentClient = class {
     update: (id, body, options) => this.transport.call(environmentOperations["hooks.update"], [id], body, options)
   };
   invitations = {
+    /**
+     * Get an invitation and its acceptance receipt, confined to its organization.
+     *
+     * Requires scope `invitations:read`. Danger: read.
+     *
+     * `GET /organizations/{organization_id}/invitations/{invitation_id}` · action `invitations.get`
+     * @scope `invitations:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    get: (organizationId, invitationId, options) => this.transport.call(environmentOperations["invitations.get"], [organizationId, invitationId], void 0, options),
     /**
      * List an organization's pending invitations
      *
@@ -2322,6 +2415,21 @@ var EnvironmentClient = class {
      * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
      */
     update: (organizationId, userId, body, options) => this.transport.call(environmentOperations["members.update"], [organizationId, userId], body, options),
+    apps: {
+      roles: {
+        /**
+         * Replace one app's member roles atomically. Other apps and the organization membership remain unchanged. An empty role list removes this app's access only.
+         *
+         * Requires scope `roles:write`. Danger: write.
+         *
+         * `PUT /organizations/{organization_id}/members/{user_id}/apps/{client_id}/roles` · action `members.apps.roles.replace`
+         * @scope `roles:write`
+         * @danger write
+         * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+         */
+        replace: (organizationId, userId, clientId, body, options) => this.transport.call(environmentOperations["members.apps.roles.replace"], [organizationId, userId, clientId], body, options)
+      }
+    },
     roles: {
       /**
        * Grant a member a role in the organization
@@ -3025,6 +3133,19 @@ var EnvironmentClient = class {
      * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
      */
     update: (id, body, options) => this.transport.call(environmentOperations["roles.update"], [id], body, options),
+    definition: {
+      /**
+       * Activate a reviewed application role definition for its existing holders.
+       *
+       * Requires scope `role_definitions:write`. Danger: destructive.
+       *
+       * `POST /roles/{id}/definition/activate` · action `roles.definition.activate`
+       * @scope `role_definitions:write`
+       * @danger destructive
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      activate: (id, body, options) => this.transport.call(environmentOperations["roles.definition.activate"], [id], body, options)
+    },
     permissions: {
       /**
        * Add a permission to a role: everyone holding the role gains it. The permission must be unscoped or declared by the role's own app.
@@ -3109,6 +3230,45 @@ var EnvironmentClient = class {
      */
     update: (id, body, options) => this.transport.call(environmentOperations["saml_apps.update"], [id], body, options)
   };
+  signals = {
+    source: {
+      /**
+       * Read the environment-owner identity source
+       *
+       * Requires an environment key with `signals_source:read` and explicit operator
+       * opt-in for this environment. Organization grants and delegated user tokens
+       * cannot read this source. Records include pre-organization authentication.
+       * The cursor follows committed sequence order and is bound to the source generation.
+       * Follow `next_cursor`, including on empty pages; a stale generation or purged
+       * cursor requires an explicit restart. Pages are at most 1000 records / 1 MiB.
+       * Data follows the Signals 2.0.0 identity event contracts. Scope is attached by
+       * the consumer's explicit grant; producer_environment is always host-bound.
+       * Replay is limited to seven days, including raw-IP retention. A heartbeat
+       * proves exporter maintenance, not complete coverage of every identity flow.
+       *
+       * `GET /signals/source`
+       */
+      list: (query, options) => this.transport.call(environmentOperations["signals.source.list"], [], query, options),
+      /** Every item of `signals.source.list`, fetching pages as the iteration reaches them. */
+      listAll: (query, options) => this.transport.paginate(environmentOperations["signals.source.list"], [], query, options),
+      erasures: {
+        /**
+         * Replay source deletion receipts
+         *
+         * Requires `signals_source:read` on an environment-owner key. Replay this stream
+         * before making a restored or newly backfilled consumer eligible. It retains only
+         * opaque subject references and deletion facts beyond the raw-event replay window.
+         * Publication order and cursor integrity match the event source. The credential
+         * is checked on every page. Ordinary tenant grants cannot access this stream.
+         *
+         * `GET /signals/source/erasures`
+         */
+        list: (query, options) => this.transport.call(environmentOperations["signals.source.erasures.list"], [], query, options),
+        /** Every item of `signals.source.erasures.list`, fetching pages as the iteration reaches them. */
+        listAll: (query, options) => this.transport.paginate(environmentOperations["signals.source.erasures.list"], [], query, options)
+      }
+    }
+  };
   signin = {
     policy: {
       /**
@@ -3668,6 +3828,30 @@ var EnvironmentClient = class {
       rotate: (id, body, options) => this.transport.call(environmentOperations["token_vault.secrets.rotate"], [id], body, options)
     }
   };
+  userPropertyNamespaces = {
+    /**
+     * Create or replace the app and webhook grants for a user-property namespace. Empty grants revoke access without deleting user data.
+     *
+     * Requires scope `user_property_namespaces:write`. Danger: critical.
+     *
+     * `PUT /user-property-namespaces/{name}` · action `user_property_namespaces.configure`
+     * @scope `user_property_namespaces:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    configure: (name, body, options) => this.transport.call(environmentOperations["user_property_namespaces.configure"], [name], body, options),
+    /**
+     * Read the app and webhook grants for a user-property namespace.
+     *
+     * Requires scope `user_property_namespaces:read`. Danger: read.
+     *
+     * `GET /user-property-namespaces/{name}` · action `user_property_namespaces.show`
+     * @scope `user_property_namespaces:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    show: (name, options) => this.transport.call(environmentOperations["user_property_namespaces.show"], [name], void 0, options)
+  };
   users = {
     /**
      * Create a user
@@ -4030,6 +4214,9 @@ var EnvironmentClient = class {
 // src/management/generated/workspace.ts
 var workspaceOperations = {
   "action_approvals.get": { action: null, operationId: null, method: "GET", path: "/workspace/action-approvals/{id}", pathParams: ["id"], scope: null, danger: null, approval: false, body: false, pagination: null },
+  "billing.account.update": { action: "billing.account.update", operationId: "billing_account_update", method: "PATCH", path: "/workspace/billing/account", pathParams: [], scope: "billing:write", danger: "write", approval: true, body: true, pagination: null },
+  "billing.payment_method.default": { action: "billing.payment_method.default", operationId: "billing_payment_method_default", method: "PATCH", path: "/workspace/billing/payment-methods/{id}/default", pathParams: ["id"], scope: "billing:write", danger: "write", approval: true, body: false, pagination: null },
+  "billing.payment_method.remove": { action: "billing.payment_method.remove", operationId: "billing_payment_method_remove", method: "DELETE", path: "/workspace/billing/payment-methods/{id}", pathParams: ["id"], scope: "billing:write", danger: "write", approval: true, body: false, pagination: null },
   "environments.create": { action: "environments.create", operationId: "environments_create", method: "POST", path: "/workspace/environments", pathParams: [], scope: "environments:write", danger: "critical", approval: true, body: true, pagination: null },
   "environments.domain.remove": { action: "environments.domain.remove", operationId: "environments_domain_remove", method: "DELETE", path: "/workspace/environments/{environment_id}/domain", pathParams: ["environment_id"], scope: "environments:write", danger: "destructive", approval: true, body: false, pagination: null },
   "environments.domain.request": { action: "environments.domain.request", operationId: "environments_domain_request", method: "POST", path: "/workspace/environments/{environment_id}/domain", pathParams: ["environment_id"], scope: "environments:write", danger: "write", approval: true, body: true, pagination: null },
@@ -4052,7 +4239,7 @@ var workspaceOperations = {
   "team.invitations.revoke": { action: "team.invitations.revoke", operationId: "team_invitations_revoke", method: "DELETE", path: "/workspace/invitations/{id}", pathParams: ["id"], scope: "team:write", danger: "destructive", approval: true, body: false, pagination: null },
   "team.invite": { action: "team.invite", operationId: "team_invite", method: "POST", path: "/workspace/members", pathParams: [], scope: "team:write", danger: "write", approval: true, body: true, pagination: null },
   "team.list": { action: "team.list", operationId: "team_list", method: "GET", path: "/workspace/members", pathParams: [], scope: "team:read", danger: "read", approval: true, body: false, pagination: "page" },
-  "team.remove": { action: "team.remove", operationId: "team_remove", method: "DELETE", path: "/workspace/members/{id}", pathParams: ["id"], scope: "team:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "team.remove": { action: "team.remove", operationId: "team_remove", method: "DELETE", path: "/workspace/members/{id}", pathParams: ["id"], scope: "team:write", danger: "destructive", approval: true, body: true, pagination: null },
   "team.role": { action: "team.role", operationId: "team_role", method: "PATCH", path: "/workspace/members/{id}/role", pathParams: ["id"], scope: "team:write", danger: "write", approval: true, body: true, pagination: null },
   "team.transfer_ownership": { action: "team.transfer_ownership", operationId: "team_transfer_ownership", method: "POST", path: "/workspace/members/{id}/transfer-ownership", pathParams: ["id"], scope: "team:write", danger: "critical", approval: true, body: false, pagination: null },
   "workspace.get": { action: "workspace.get", operationId: "workspace_get", method: "GET", path: "/workspace", pathParams: [], scope: "workspace:read", danger: "read", approval: true, body: false, pagination: null },
@@ -4079,12 +4266,51 @@ var WorkspaceClient = class {
      */
     get: (id, options) => this.transport.call(workspaceOperations["action_approvals.get"], [id], void 0, options)
   };
+  billing = {
+    account: {
+      /**
+       * Update the workspace billing contact and invoice address.
+       *
+       * Requires scope `billing:write` and a role that may `manage-billing`. Danger: write.
+       *
+       * `PATCH /workspace/billing/account` · action `billing.account.update`
+       * @scope `billing:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      update: (body, options) => this.transport.call(workspaceOperations["billing.account.update"], [], body, options)
+    },
+    paymentMethod: {
+      /**
+       * Choose the workspace default payment card.
+       *
+       * Requires scope `billing:write` and a role that may `manage-billing`. Danger: write.
+       *
+       * `PATCH /workspace/billing/payment-methods/{id}/default` · action `billing.payment_method.default`
+       * @scope `billing:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      default: (id, options) => this.transport.call(workspaceOperations["billing.payment_method.default"], [id], void 0, options),
+      /**
+       * Remove an unneeded payment card from this workspace.
+       *
+       * Requires scope `billing:write` and a role that may `manage-billing`. Danger: write.
+       *
+       * `DELETE /workspace/billing/payment-methods/{id}` · action `billing.payment_method.remove`
+       * @scope `billing:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      remove: (id, options) => this.transport.call(workspaceOperations["billing.payment_method.remove"], [id], void 0, options)
+    }
+  };
   environments = {
     /**
      * Create an environment
      *
      * Requires scope `environments:write` and the `manage-environments` capability
-     * (owner/admin/developer). Danger: critical — with `initial_key` it mints a credential.
+     * (`id:write` for human members, or current ownership). Danger: critical — with `initial_key` it mints a credential.
      *
      * With `initial_key`, the environment's first management key is minted in the same
      * call and returned once as `initial_key.token` — enough for an agent holding one
@@ -4100,7 +4326,7 @@ var WorkspaceClient = class {
     /**
      * List environments
      *
-     * Requires scope `workspace:read` (any role).
+     * Requires scope `workspace:read` and permission to read environments. Returns only currently permitted environments; Billing-only members cannot list them.
      *
      * `GET /workspace/environments` · action `environments.list`
      * @scope `workspace:read`
@@ -4213,7 +4439,7 @@ var WorkspaceClient = class {
     /**
      * Create a project
      *
-     * Stand up another independently-billed IdP product. Requires scope `projects:write` and the `manage-environments` capability (owner/admin/developer).
+     * Stand up another independently-billed IdP product. Requires scope `projects:write` and the `manage-environments` capability (`id:write` for human members, or current ownership).
      *
      * `POST /workspace/projects` · action `projects.create`
      * @scope `projects:write`
@@ -4224,7 +4450,7 @@ var WorkspaceClient = class {
     /**
      * List projects
      *
-     * Requires scope `workspace:read` (any role). The workspace's projects (IdP products). Each carries its own plan and environment allowance.
+     * Requires scope `workspace:read` and permission to read environments. Human callers see only projects containing environments they may access; environment counts include only those environments. Billing-only members cannot list projects.
      *
      * `GET /workspace/projects` · action `projects.list`
      * @scope `workspace:read`
@@ -4294,11 +4520,10 @@ var WorkspaceClient = class {
     /**
      * Invite a member
      *
-     * Requires scope `team:write` and the `manage-members` capability (owner/admin). Invites the address onto the
-     * workspace's team — the same invitation the console's Team page sends: a mail naming
-     * this key as the inviter and the role, with a signed link on which the invitee sets a
-     * password and is signed in. Owner is never invited; ownership is transferred. An
-     * earlier pending invitation for the same address is superseded. List, re-send and
+     * Requires scope `team:write` and the `manage-members` capability (`members:manage` for human members, or current ownership). Invites the address onto the
+     * ID product team with the selected app roles. Existing shared membership and other
+     * apps are preserved. Owner is never invited; ownership is transferred separately. An
+     * earlier pending invitation for the same address and this app is superseded. List, re-send and
      * withdraw it under `/workspace/invitations`.
      *
      * `POST /workspace/members` · action `team.invite`
@@ -4310,7 +4535,7 @@ var WorkspaceClient = class {
     /**
      * List members
      *
-     * Requires scope `team:read` and the `read-members` capability (owner/admin/viewer). The roster is PII — a developer key is refused.
+     * Requires scope `team:read` and the `read-members` capability (`members:read` for human members, or current ownership). The roster contains personal information; a machine key also needs an explicit role allowing member reads.
      *
      * `GET /workspace/members` · action `team.list`
      * @scope `team:read`
@@ -4321,7 +4546,7 @@ var WorkspaceClient = class {
     /** Every item of `team.list`, fetching pages as the iteration reaches them. */
     listAll: (query, options) => this.transport.paginate(workspaceOperations["team.list"], [], query, options),
     /**
-     * Remove a member from the workspace's team. The owner is never removed; transfer ownership first.
+     * Remove native ID app roles while preserving shared organization membership and other apps. The current owner cannot be removed.
      *
      * Requires scope `team:write` and a role that may `manage-members`. Danger: destructive.
      *
@@ -4330,9 +4555,9 @@ var WorkspaceClient = class {
      * @danger destructive
      * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
      */
-    remove: (id, options) => this.transport.call(workspaceOperations["team.remove"], [id], void 0, options),
+    remove: (id, body, options) => this.transport.call(workspaceOperations["team.remove"], [id], body, options),
     /**
-     * Change a team member's role (admin, developer, member or viewer). The owner's role changes only by transferring ownership.
+     * Replace native ID app roles atomically. Shared organization membership is preserved.
      *
      * Requires scope `team:write` and a role that may `manage-members`. Danger: write.
      *
@@ -4343,7 +4568,7 @@ var WorkspaceClient = class {
      */
     role: (id, body, options) => this.transport.call(workspaceOperations["team.role"], [id], body, options),
     /**
-     * Make another member the workspace's owner; the current owner stays on as an admin. Only the owner, signed in, may do this.
+     * Transfer shared organization ownership. Existing app roles are preserved; the previous owner may lose native ID access. Only the current owner, signed in, may do this.
      *
      * Requires scope `team:write` and a role that may `manage-members`. Danger: critical.
      *
@@ -4395,7 +4620,7 @@ var WorkspaceClient = class {
     /**
      * Get the workspace
      *
-     * Requires scope `workspace:read` (any role). Returns the workspace's identity. The `projects` block (each project's plan/allowance) is included only for keys whose role can read billing (owner/admin/viewer — not developer).
+     * Requires scope `workspace:read` and current workspace access. Returns only the workspace identity and status, including for members with only the Billing app role.
      *
      * `GET /workspace` · action `workspace.get`
      * @scope `workspace:read`
@@ -4407,7 +4632,7 @@ var WorkspaceClient = class {
       /**
        * Rename the workspace.
        *
-       * Requires scope `settings:write` and a role that may `manage-members`. Danger: write.
+       * Requires scope `settings:write` and a role that may `own-organization` and `manage-members`. Danger: write.
        *
        * `PATCH /workspace` · action `workspace.settings.update`
        * @scope `settings:write`
@@ -4567,15 +4792,23 @@ var accountOperations = {
   "account.api_keys.create": { action: "account.api_keys.create", operationId: "account_api_keys_create", method: "POST", path: "/me/organizations/{organization_id}/api-keys", pathParams: ["organization_id"], scope: "account:api_keys:write", danger: "critical", approval: true, body: true, pagination: null },
   "account.api_keys.revoke": { action: "account.api_keys.revoke", operationId: "account_api_keys_revoke", method: "DELETE", path: "/me/organizations/{organization_id}/api-keys/{key_id}", pathParams: ["organization_id", "key_id"], scope: "account:api_keys:write", danger: "destructive", approval: true, body: false, pagination: null },
   "account.applications.revoke": { action: "account.applications.revoke", operationId: "account_applications_revoke", method: "DELETE", path: "/me/applications/{client_id}", pathParams: ["client_id"], scope: "account:applications:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "account.apps.list": { action: "account.apps.list", operationId: "account_apps_list", method: "GET", path: "/me/apps", pathParams: [], scope: "account:apps:read", danger: "read", approval: true, body: false, pagination: null },
   "account.devices.remove": { action: "account.devices.remove", operationId: "account_devices_remove", method: "DELETE", path: "/me/devices/{device_id}", pathParams: ["device_id"], scope: "account:devices:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "account.email.confirmation.send": { action: "account.email.confirmation.send", operationId: "account_email_confirmation_send", method: "POST", path: "/me/email/confirmation", pathParams: [], scope: "account:profile:write", danger: "write", approval: true, body: false, pagination: null },
   "account.mfa.sms.remove": { action: "account.mfa.sms.remove", operationId: "account_mfa_sms_remove", method: "DELETE", path: "/me/mfa/sms", pathParams: [], scope: "account:sign_in:write", danger: "critical", approval: true, body: false, pagination: null },
   "account.organizations.leave": { action: "account.organizations.leave", operationId: "account_organizations_leave", method: "POST", path: "/me/organizations/{organization_id}/leave", pathParams: ["organization_id"], scope: "account:organizations:write", danger: "destructive", approval: true, body: false, pagination: null },
   "account.passkeys.remove": { action: "account.passkeys.remove", operationId: "account_passkeys_remove", method: "DELETE", path: "/me/passkeys/{passkey_id}", pathParams: ["passkey_id"], scope: "account:sign_in:write", danger: "critical", approval: true, body: false, pagination: null },
+  "account.passkeys.rename": { action: "account.passkeys.rename", operationId: "account_passkeys_rename", method: "PATCH", path: "/me/passkeys/{passkey_id}", pathParams: ["passkey_id"], scope: "account:sign_in:write", danger: "write", approval: true, body: true, pagination: null },
   "account.pipes.disconnect": { action: "account.pipes.disconnect", operationId: "account_pipes_disconnect", method: "DELETE", path: "/me/pipes/{provider}", pathParams: ["provider"], scope: "account:pipes:write", danger: "destructive", approval: true, body: false, pagination: null },
   "account.profile.update": { action: "account.profile.update", operationId: "account_profile_update", method: "PATCH", path: "/me/profile", pathParams: [], scope: "account:profile:write", danger: "write", approval: true, body: true, pagination: null },
   "account.sessions.revoke": { action: "account.sessions.revoke", operationId: "account_sessions_revoke", method: "DELETE", path: "/me/sessions/{session_id}", pathParams: ["session_id"], scope: "account:sessions:write", danger: "destructive", approval: true, body: false, pagination: null },
   "account.sessions.revoke_others": { action: "account.sessions.revoke_others", operationId: "account_sessions_revoke_others", method: "POST", path: "/me/sessions/revoke-others", pathParams: [], scope: "account:sessions:write", danger: "critical", approval: true, body: false, pagination: null },
-  "account.social.unlink": { action: "account.social.unlink", operationId: "account_social_unlink", method: "DELETE", path: "/me/social/{provider}", pathParams: ["provider"], scope: "account:sign_in:write", danger: "critical", approval: true, body: false, pagination: null }
+  "account.sign_in_methods.disconnect": { action: "account.sign_in_methods.disconnect", operationId: "account_sign_in_methods_disconnect", method: "DELETE", path: "/me/sign-in-methods/{identity_id}", pathParams: ["identity_id"], scope: "account:sign_in:write", danger: "critical", approval: true, body: false, pagination: null },
+  "account.social.unlink": { action: "account.social.unlink", operationId: "account_social_unlink", method: "DELETE", path: "/me/social/{provider}", pathParams: ["provider"], scope: "account:sign_in:write", danger: "critical", approval: true, body: false, pagination: null },
+  "account.totp.remove": { action: "account.totp.remove", operationId: "account_totp_remove", method: "DELETE", path: "/me/two-factor/apps/{factor_id}", pathParams: ["factor_id"], scope: "account:sign_in:write", danger: "critical", approval: true, body: false, pagination: null },
+  "account.totp.rename": { action: "account.totp.rename", operationId: "account_totp_rename", method: "PATCH", path: "/me/two-factor/apps/{factor_id}", pathParams: ["factor_id"], scope: "account:sign_in:write", danger: "write", approval: true, body: true, pagination: null },
+  "account.waitlists.join": { action: "account.waitlists.join", operationId: "account_waitlists_join", method: "POST", path: "/me/services/{program}/waitlist", pathParams: ["program"], scope: "account:waitlists:write", danger: "write", approval: true, body: true, pagination: null },
+  "account.waitlists.leave": { action: "account.waitlists.leave", operationId: "account_waitlists_leave", method: "POST", path: "/me/services/{program}/waitlist/leave", pathParams: ["program"], scope: "account:waitlists:write", danger: "write", approval: true, body: true, pagination: null }
 };
 var AccountClient = class {
   /** The transport every method runs on — authentication, retries, approvals. */
@@ -4634,6 +4867,19 @@ var AccountClient = class {
      */
     revoke: (clientId, options) => this.transport.call(accountOperations["account.applications.revoke"], [clientId], void 0, options)
   };
+  apps = {
+    /**
+     * List the published apps visible to you in this environment. Optional organization context must be one you actively belong to.
+     *
+     * Requires scope `account:apps:read` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: read.
+     *
+     * `GET /me/apps` · action `account.apps.list`
+     * @scope `account:apps:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    list: (query, options) => this.transport.call(accountOperations["account.apps.list"], [], query, options)
+  };
   devices = {
     /**
      * Remove one of your trusted devices; it is no longer asked to approve anything.
@@ -4647,6 +4893,21 @@ var AccountClient = class {
      */
     remove: (deviceId, options) => this.transport.call(accountOperations["account.devices.remove"], [deviceId], void 0, options)
   };
+  email = {
+    confirmation: {
+      /**
+       * Mail yourself a link that confirms your email address.
+       *
+       * Requires scope `account:profile:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: write.
+       *
+       * `POST /me/email/confirmation` · action `account.email.confirmation.send`
+       * @scope `account:profile:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      send: (options) => this.transport.call(accountOperations["account.email.confirmation.send"], [], void 0, options)
+    }
+  };
   mfa = {
     sms: {
       /**
@@ -4686,7 +4947,18 @@ var AccountClient = class {
      * @danger critical
      * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
      */
-    remove: (passkeyId, options) => this.transport.call(accountOperations["account.passkeys.remove"], [passkeyId], void 0, options)
+    remove: (passkeyId, options) => this.transport.call(accountOperations["account.passkeys.remove"], [passkeyId], void 0, options),
+    /**
+     * Rename one of your passkeys.
+     *
+     * Requires scope `account:sign_in:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: write.
+     *
+     * `PATCH /me/passkeys/{passkey_id}` · action `account.passkeys.rename`
+     * @scope `account:sign_in:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    rename: (passkeyId, body, options) => this.transport.call(accountOperations["account.passkeys.rename"], [passkeyId], body, options)
   };
   pipes = {
     /**
@@ -4738,6 +5010,19 @@ var AccountClient = class {
      */
     revokeOthers: (options) => this.transport.call(accountOperations["account.sessions.revoke_others"], [], void 0, options)
   };
+  signInMethods = {
+    /**
+     * Disconnect one linked sign-in identity (Google, GitHub, …) from your account — never the last way you can sign in.
+     *
+     * Requires scope `account:sign_in:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: critical.
+     *
+     * `DELETE /me/sign-in-methods/{identity_id}` · action `account.sign_in_methods.disconnect`
+     * @scope `account:sign_in:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    disconnect: (identityId, options) => this.transport.call(accountOperations["account.sign_in_methods.disconnect"], [identityId], void 0, options)
+  };
   social = {
     /**
      * Disconnect a social account from yours — never the last way you can sign in.
@@ -4751,6 +5036,54 @@ var AccountClient = class {
      */
     unlink: (provider, options) => this.transport.call(accountOperations["account.social.unlink"], [provider], void 0, options)
   };
+  totp = {
+    /**
+     * Remove one of your authenticator apps.
+     *
+     * Requires scope `account:sign_in:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: critical.
+     *
+     * `DELETE /me/two-factor/apps/{factor_id}` · action `account.totp.remove`
+     * @scope `account:sign_in:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    remove: (factorId, options) => this.transport.call(accountOperations["account.totp.remove"], [factorId], void 0, options),
+    /**
+     * Rename one of your authenticator apps.
+     *
+     * Requires scope `account:sign_in:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: write.
+     *
+     * `PATCH /me/two-factor/apps/{factor_id}` · action `account.totp.rename`
+     * @scope `account:sign_in:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    rename: (factorId, body, options) => this.transport.call(accountOperations["account.totp.rename"], [factorId], body, options)
+  };
+  waitlists = {
+    /**
+     * Join a published service waitlist with your verified email. Does not buy a plan or grant access.
+     *
+     * Requires scope `account:waitlists:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: write.
+     *
+     * `POST /me/services/{program}/waitlist` · action `account.waitlists.join`
+     * @scope `account:waitlists:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    join: (program, body, options) => this.transport.call(accountOperations["account.waitlists.join"], [program], body, options),
+    /**
+     * Withdraw your own feature interest or beta application for a team. Active grants are managed by the service.
+     *
+     * Requires scope `account:waitlists:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: write.
+     *
+     * `POST /me/services/{program}/waitlist/leave` · action `account.waitlists.leave`
+     * @scope `account:waitlists:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    leave: (program, body, options) => this.transport.call(accountOperations["account.waitlists.leave"], [program], body, options)
+  };
 };
 
 // src/management/dpop.ts