@productcraft/auth 0.5.0

package/dist/index.d.cts

@@ -0,0 +1,2508 @@
+import { PCClientConfig } from '@productcraft/core';
+export { PCAuth, PCClientConfig } from '@productcraft/core';
+import { ResponseConfig, Client } from '@kubb/plugin-client/clients/fetch';
+import { JWTHeaderParameters, FlattenedJWSInput, CryptoKey, JWTPayload } from 'jose';
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type PlatformUserStatsResponseDto = {
+    /**
+     * @description API keys across those apps. Rows are hard-deleted on revoke so existence implies active.
+     * @type number
+     */
+    api_keys_active: number;
+    /**
+     * @description Auth apps the caller is a member of (any role).
+     * @type number
+     */
+    apps: number;
+    /**
+     * @description EndUsers across those apps.
+     * @type number
+     */
+    end_users: number;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+declare const appResponseDtoStatusEnum: {
+    readonly active: "active";
+    readonly suspended: "suspended";
+    readonly archived: "archived";
+};
+type AppResponseDtoStatusEnumKey = (typeof appResponseDtoStatusEnum)[keyof typeof appResponseDtoStatusEnum];
+type AppResponseDto = {
+    /**
+     * @type string, date-time
+     */
+    created_at: string;
+    /**
+     * @description Account that created the app.
+     * @type string
+     */
+    created_by: string;
+    /**
+     * @type string
+     */
+    display_name: string;
+    /**
+     * @type string
+     */
+    id: string;
+    /**
+     * @type object
+     */
+    metadata: object;
+    /**
+     * @type string
+     */
+    slug: string;
+    /**
+     * @type string
+     */
+    status: AppResponseDtoStatusEnumKey;
+    /**
+     * @type string, date-time
+     */
+    updated_at: string;
+    /**
+     * @description Owning workspace UUID.
+     * @type string
+     */
+    workspace_id: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type PaginationDto = {
+    /**
+     * @description True iff another page exists; if true, pass `next_cursor` on the next request.
+     * @type boolean
+     */
+    has_more: boolean;
+    /**
+     * @description Opaque cursor for the next page. `null` when no more pages are available.
+     * @type string
+     */
+    next_cursor: string | null;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
+type AppListResponseDto = {
+    /**
+     * @type array
+     */
+    data: AppResponseDto[];
+    /**
+     * @type object
+     */
+    pagination: PaginationDto;
+};
+
+/**
+ * Custom HTTP client passed to kubb-generated request functions.
+ *
+ * Each generated client function accepts an optional `{ client }`
+ * override matching kubb's `Client` shape:
+ *   <TData, TError, TVars>(config: RequestConfig<TVars>) => Promise<ResponseConfig<TData>>
+ *
+ * We construct one per `Auth` instance — bound to that instance's
+ * baseUrl + auth credential — so generated functions don't need to
+ * know anything about authentication or environment selection.
+ */
+
+/** Thrown for any non-2xx response; `response.data` is the parsed body. */
+declare class AuthHttpError<TData = unknown> extends Error {
+    readonly status: number;
+    readonly statusText: string;
+    readonly data: TData;
+    constructor(response: ResponseConfig<TData>);
+}
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type AuditLogEntryDto = {
+    /**
+     * @description Canonical action string (e.g. `app.member.removed`, `role.created`).
+     * @type string
+     */
+    action: string;
+    /**
+     * @description Account id that triggered the action. `null` for `system` actor type.
+     * @type string
+     */
+    actor_id: string | null;
+    /**
+     * @description App this audit row belongs to.
+     * @type string
+     */
+    app_id: string;
+    /**
+     * @description ISO 8601 timestamp.
+     * @type string, date-time
+     */
+    created_at: string;
+    /**
+     * @description Free-form structured detail object captured at log time.
+     * @type object
+     */
+    details: object | null;
+    /**
+     * @description Audit row UUID.
+     * @type string
+     */
+    id: string;
+    /**
+     * @description Resource id touched.
+     * @type string
+     */
+    resource_id: string | null;
+    /**
+     * @description Resource type touched (e.g. `app_membership`, `role`).
+     * @type string
+     */
+    resource_type: string | null;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
+type AuditLogListResponseDto = {
+    /**
+     * @type array
+     */
+    data: AuditLogEntryDto[];
+    /**
+     * @type object
+     */
+    pagination: PaginationDto;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type M2MRotateSecretResponseDto = {
+    /**
+     * @type string
+     */
+    client_id: string;
+    /**
+     * @description New plaintext client secret. Returned exactly once.
+     * @type string
+     */
+    client_secret: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type M2MScopeEntryDto = {
+    /**
+     * @type string
+     */
+    action: string;
+    /**
+     * @type string
+     */
+    resource: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
+type M2MClientDetailResponseDto = {
+    /**
+     * @type string
+     */
+    app_id: string;
+    /**
+     * @type string
+     */
+    client_id: string;
+    /**
+     * @type string, date-time
+     */
+    created_at: string;
+    /**
+     * @type string
+     */
+    id: string;
+    /**
+     * @type boolean
+     */
+    is_active: boolean;
+    /**
+     * @type string, date-time
+     */
+    last_used_at: string | null;
+    /**
+     * @type string
+     */
+    name: string;
+    /**
+     * @type array
+     */
+    scopes: M2MScopeEntryDto[];
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type M2MClientCreateResponseDto = {
+    /**
+     * @type string
+     */
+    client_id: string;
+    /**
+     * @description Plaintext client secret. Returned exactly once.
+     * @type string
+     */
+    client_secret: string;
+    /**
+     * @type string, date-time
+     */
+    created_at: string;
+    /**
+     * @type string
+     */
+    id: string;
+    /**
+     * @type string
+     */
+    name: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type M2MClientSummaryDto = {
+    /**
+     * @type string
+     */
+    app_id: string;
+    /**
+     * @type string
+     */
+    client_id: string;
+    /**
+     * @type string, date-time
+     */
+    created_at: string;
+    /**
+     * @type string
+     */
+    id: string;
+    /**
+     * @type boolean
+     */
+    is_active: boolean;
+    /**
+     * @type string, date-time
+     */
+    last_used_at: string | null;
+    /**
+     * @type string
+     */
+    name: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
+type M2MClientListResponseDto = {
+    /**
+     * @type array
+     */
+    data: M2MClientSummaryDto[];
+    /**
+     * @type object
+     */
+    pagination: PaginationDto;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type CreateApiKeyResponseDto = {
+    /**
+     * @type string, date-time
+     */
+    created_at: string;
+    /**
+     * @description API key row UUID.
+     * @type string
+     */
+    id: string;
+    /**
+     * @description Raw API key. Returned exactly once — store it now.
+     * @type string
+     */
+    key: string;
+    /**
+     * @description First 16 chars of the key — safe to display in lists.
+     * @type string
+     */
+    key_prefix: string;
+    /**
+     * @description Display name.
+     * @type string
+     */
+    name: string;
+    /**
+     * @description Permission scope.
+     * @type array
+     */
+    permissions: string[];
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type ApiKeySummaryDto = {
+    /**
+     * @type string, date-time
+     */
+    created_at: string;
+    /**
+     * @type string
+     */
+    id: string;
+    /**
+     * @description Prefix only — full key is never returned after creation.
+     * @type string
+     */
+    key_prefix: string;
+    /**
+     * @type string, date-time
+     */
+    last_used_at: string | null;
+    /**
+     * @type string
+     */
+    name: string;
+    /**
+     * @type array
+     */
+    permissions: string[];
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
+type ApiKeyListResponseDto = {
+    /**
+     * @type array
+     */
+    data: ApiKeySummaryDto[];
+    /**
+     * @type object
+     */
+    pagination: PaginationDto;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type PermissionDto = {
+    /**
+     * @type string
+     */
+    action: string;
+    /**
+     * @description App scope. `null` for system permissions.
+     * @type string
+     */
+    app_id: string | null;
+    /**
+     * @type string, date-time
+     */
+    created_at: string;
+    /**
+     * @description Free-text description of what this permission allows.
+     * @type string
+     */
+    description: string | null;
+    /**
+     * @description Permission row UUID.
+     * @type string
+     */
+    id: string;
+    /**
+     * @type string
+     */
+    resource: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
+/**
+ * @description Flat list — system + per-app permissions.
+ */
+type PermissionControllerListPermissions200 = PermissionDto[];
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type AppPermissionCatalogEntryDto = {
+    /**
+     * @type string
+     */
+    action: string;
+    /**
+     * @description App scope. `null` for system permissions.
+     * @type string
+     */
+    app_id: string | null;
+    /**
+     * @type string, date-time
+     */
+    created_at: string;
+    /**
+     * @type string
+     */
+    description: string | null;
+    /**
+     * @type string
+     */
+    id: string;
+    /**
+     * @description True iff the row is a system (shared) permission.
+     * @type boolean
+     */
+    is_system: boolean;
+    /**
+     * @type string
+     */
+    resource: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
+type RoleControllerListPermissions200 = AppPermissionCatalogEntryDto[];
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type AppMembershipResponseDto = {
+    /**
+     * @description Account UUID.
+     * @type string
+     */
+    account_id: string;
+    /**
+     * @description App UUID.
+     * @type string
+     */
+    app_id: string;
+    /**
+     * @type string
+     */
+    id: string;
+    /**
+     * @type string, date-time
+     */
+    joined_at: string;
+    /**
+     * @description Role UUID.
+     * @type string
+     */
+    role_id: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type RoleResponseDto = {
+    /**
+     * @description App scope (UUID).
+     * @type string
+     */
+    app_id: string;
+    /**
+     * @type string, date-time
+     */
+    created_at: string;
+    /**
+     * @description Free-text description.
+     * @type string
+     */
+    description: string | null;
+    /**
+     * @description Role UUID.
+     * @type string
+     */
+    id: string;
+    /**
+     * @description Whether this is a system role (owner / admin / member).
+     * @type boolean
+     */
+    is_system: boolean;
+    /**
+     * @description Role name slug.
+     * @type string
+     */
+    name: string;
+    /**
+     * @type string, date-time
+     */
+    updated_at: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
+type RoleListResponseDto = {
+    /**
+     * @type array
+     */
+    data: RoleResponseDto[];
+    /**
+     * @type object
+     */
+    pagination: PaginationDto;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+declare const endUserSummaryDtoStatusEnum: {
+    readonly active: "active";
+    readonly suspended: "suspended";
+    readonly deactivated: "deactivated";
+};
+type EndUserSummaryDtoStatusEnumKey = (typeof endUserSummaryDtoStatusEnum)[keyof typeof endUserSummaryDtoStatusEnum];
+type EndUserSummaryDto = {
+    /**
+     * @type number
+     */
+    active_session_count: number;
+    /**
+     * @type string, date-time
+     */
+    created_at: string;
+    /**
+     * @type string
+     */
+    display_name: string | null;
+    /**
+     * @type string
+     */
+    email: string | null;
+    /**
+     * @type string, date-time
+     */
+    email_verified_at: string | null;
+    /**
+     * @type string
+     */
+    id: string;
+    /**
+     * @type string, date-time
+     */
+    joined_at: string | null;
+    /**
+     * @type string, date-time
+     */
+    last_used_at: string | null;
+    /**
+     * @type string
+     */
+    role: string | null;
+    /**
+     * @type string
+     */
+    status: EndUserSummaryDtoStatusEnumKey;
+    /**
+     * @type string
+     */
+    username: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
+type EndUserListResponseDto = {
+    /**
+     * @type array
+     */
+    data: EndUserSummaryDto[];
+    /**
+     * @type object
+     */
+    pagination: PaginationDto;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type AppMemberSummaryDto = {
+    /**
+     * @type string
+     */
+    account_id: string;
+    /**
+     * @type string
+     */
+    display_name: string | null;
+    /**
+     * @type string
+     */
+    id: string;
+    /**
+     * @type string, date-time
+     */
+    joined_at: string;
+    /**
+     * @type string
+     */
+    primary_email: string | null;
+    /**
+     * @type string
+     */
+    role_id: string;
+    /**
+     * @type string
+     */
+    role_name: string;
+    /**
+     * @type string
+     */
+    username: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
+type AppMemberListResponseDto = {
+    /**
+     * @type array
+     */
+    data: AppMemberSummaryDto[];
+    /**
+     * @type object
+     */
+    pagination: PaginationDto;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type EndUserInviteResponseDto = {
+    /**
+     * @description Invite code the recipient submits to accept.
+     * @type string
+     */
+    code: string;
+    /**
+     * @type string, date-time
+     */
+    created_at: string;
+    /**
+     * @type string
+     */
+    email: string | null;
+    /**
+     * @type string, date-time
+     */
+    expires_at: string | null;
+    /**
+     * @type string
+     */
+    id: string;
+    /**
+     * @type number
+     */
+    max_uses: number | null;
+    /**
+     * @type string, date-time
+     */
+    revoked_at: string | null;
+    /**
+     * @type string
+     */
+    role_id: string;
+    /**
+     * @type string
+     */
+    role_name: string | null;
+    /**
+     * @type number
+     */
+    use_count: number;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
+type EndUserInviteListResponseDto = {
+    /**
+     * @type array
+     */
+    data: EndUserInviteResponseDto[];
+    /**
+     * @type object
+     */
+    pagination: PaginationDto;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+declare const authConfigResponseDtoOauthLinkPolicyEnum: {
+    readonly auto: "auto";
+    readonly confirm: "confirm";
+    readonly reject: "reject";
+};
+type AuthConfigResponseDtoOauthLinkPolicyEnumKey = (typeof authConfigResponseDtoOauthLinkPolicyEnum)[keyof typeof authConfigResponseDtoOauthLinkPolicyEnum];
+type AuthConfigResponseDto = {
+    /**
+     * @type array
+     */
+    allowed_redirect_origins: string[];
+    /**
+     * @type boolean
+     */
+    enforce_app_permissions: boolean;
+    /**
+     * @type number
+     */
+    max_failed_login_attempts: number;
+    /**
+     * @type number
+     */
+    max_sessions: number;
+    /**
+     * @type string
+     */
+    oauth_link_policy: AuthConfigResponseDtoOauthLinkPolicyEnumKey;
+    /**
+     * @type number
+     */
+    password_min_length: number;
+    /**
+     * @type boolean
+     */
+    password_require_number: boolean;
+    /**
+     * @type boolean
+     */
+    password_require_symbol: boolean;
+    /**
+     * @type boolean
+     */
+    password_require_uppercase: boolean;
+    /**
+     * @type number
+     */
+    session_duration_minutes: number;
+    /**
+     * @type boolean
+     */
+    signin_enabled: boolean;
+    /**
+     * @type array
+     */
+    signup_allowed_email_domains: string[];
+    /**
+     * @type string
+     */
+    signup_default_role: string;
+    /**
+     * @type boolean
+     */
+    signup_enabled: boolean;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type UpdateAppDto = {
+    /**
+     * @description New display name
+     * @type string | undefined
+     */
+    display_name?: string;
+    /**
+     * @description Arbitrary metadata attached to the app
+     * @type object | undefined
+     */
+    metadata?: object;
+    /**
+     * @description Rename the app\'s slug. The old slug remains resolvable for 30 days as a JWKS-URL alias so existing customer-side verifiers don\'t break instantly. Same shape as the create-slug: lowercase alphanumeric + hyphens, 3–48 chars.
+     * @type string | undefined
+     */
+    slug?: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+declare const updateAppStatusDtoStatusEnum: {
+    readonly active: "active";
+    readonly suspended: "suspended";
+    readonly archived: "archived";
+};
+type UpdateAppStatusDtoStatusEnumKey = (typeof updateAppStatusDtoStatusEnum)[keyof typeof updateAppStatusDtoStatusEnum];
+type UpdateAppStatusDto = {
+    /**
+     * @description New app status
+     * @type string
+     */
+    status: UpdateAppStatusDtoStatusEnumKey;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+declare const updateAuthConfigDtoOauthLinkPolicyEnum: {
+    readonly auto: "auto";
+    readonly confirm: "confirm";
+    readonly reject: "reject";
+};
+type UpdateAuthConfigDtoOauthLinkPolicyEnumKey = (typeof updateAuthConfigDtoOauthLinkPolicyEnum)[keyof typeof updateAuthConfigDtoOauthLinkPolicyEnum];
+type UpdateAuthConfigDto = {
+    /**
+     * @description Allowed origins for the `return_to` parameter on the OAuth web redirect callback. Exact origin match (scheme + host + port); no paths, no wildcards. Empty array disables the web redirect flow for this app. Prevents the callback from acting as an open-redirect.
+     * @type array | undefined
+     */
+    allowed_redirect_origins?: string[];
+    /**
+     * @description When true, Consumer-API routes annotated with `@RequireAppPermission(perm)` enforce the requested perm against the EndUser\'s role-resolved permission set. When false (default), permission checks are bypassed — any valid token can call any annotated route. Flip on once you\'ve authored roles + permissions for this app and want them to actually mean something.
+     * @type boolean | undefined
+     */
+    enforce_app_permissions?: boolean;
+    /**
+     * @description Failed-login attempts before the EndUser account is locked.
+     * @minLength 1
+     * @maxLength 100
+     * @type number | undefined
+     */
+    max_failed_login_attempts?: number;
+    /**
+     * @description Maximum concurrent sessions per EndUser. Oldest is evicted on overflow.
+     * @minLength 1
+     * @maxLength 50
+     * @type number | undefined
+     */
+    max_sessions?: number;
+    /**
+     * @description How to handle a federated sign-in (Apple, Google, …) that lands on a verified email already belonging to an account in this app. `confirm` (default) refuses to auto-link and surfaces `link_required` so the user signs in with their original method. `auto` silently links when the provider claims the email is verified AND the email is not a private relay. `reject` refuses outright. Private-relay emails never auto-link regardless.
+     * @type string | undefined
+     */
+    oauth_link_policy?: UpdateAuthConfigDtoOauthLinkPolicyEnumKey;
+    /**
+     * @description Minimum password length (NIST minimum is 8).
+     * @minLength 8
+     * @maxLength 128
+     * @type number | undefined
+     */
+    password_min_length?: number;
+    /**
+     * @description Require a digit in passwords.
+     * @type boolean | undefined
+     */
+    password_require_number?: boolean;
+    /**
+     * @description Require a symbol in passwords.
+     * @type boolean | undefined
+     */
+    password_require_symbol?: boolean;
+    /**
+     * @description Require an uppercase letter in passwords.
+     * @type boolean | undefined
+     */
+    password_require_uppercase?: boolean;
+    /**
+     * @description Session lifetime in minutes (1 minute to 30 days).
+     * @minLength 1
+     * @maxLength 43200
+     * @type number | undefined
+     */
+    session_duration_minutes?: number;
+    /**
+     * @description Whether existing EndUsers can sign in.
+     * @type boolean | undefined
+     */
+    signin_enabled?: boolean;
+    /**
+     * @description Optional allowlist of email domains for signup. Empty array = any domain.
+     * @type array | undefined
+     */
+    signup_allowed_email_domains?: string[];
+    /**
+     * @description Role slug newly-signed-up EndUsers receive (e.g. `member`).
+     * @type string | undefined
+     */
+    signup_default_role?: string;
+    /**
+     * @description Whether new EndUsers can sign up.
+     * @type boolean | undefined
+     */
+    signup_enabled?: boolean;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type CreateEndUserInviteDto = {
+    /**
+     * @description Invitee email. Locks the invite to this address.
+     * @type string
+     */
+    email: string;
+    /**
+     * @description Hours until the invite expires. Defaults to 72 (3 days).
+     * @minLength 1
+     * @maxLength 720
+     * @type number | undefined
+     */
+    expires_in_hours?: number;
+    /**
+     * @description Maximum number of accepts. Defaults to 1.
+     * @minLength 1
+     * @maxLength 10000
+     * @type number | undefined
+     */
+    max_uses?: number;
+    /**
+     * @description Optional human-readable name shown in the email.
+     * @type string | undefined
+     */
+    name?: string;
+    /**
+     * @description Role slug to grant on accept. Defaults to `member`.
+     * @type string | undefined
+     */
+    role_name?: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type UpdateEndUserDto = {
+    /**
+     * @description New display name
+     * @type string | undefined
+     */
+    display_name?: string;
+    /**
+     * @description New primary email
+     * @type string | undefined
+     */
+    email?: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type UpdateEndUserRoleDto = {
+    /**
+     * @description Name of the role to assign
+     * @type string
+     */
+    role_name: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+declare const updateEndUserStatusDtoStatusEnum: {
+    readonly active: "active";
+    readonly suspended: "suspended";
+    readonly deactivated: "deactivated";
+};
+type UpdateEndUserStatusDtoStatusEnumKey = (typeof updateEndUserStatusDtoStatusEnum)[keyof typeof updateEndUserStatusDtoStatusEnum];
+type UpdateEndUserStatusDto = {
+    /**
+     * @description New end-user status
+     * @type string
+     */
+    status: UpdateEndUserStatusDtoStatusEnumKey;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type CreateRoleDto = {
+    /**
+     * @type string | undefined
+     */
+    description?: string;
+    /**
+     * @type string
+     */
+    name: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type UpdateRoleDto = {
+    /**
+     * @type string | undefined
+     */
+    description?: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type AssignRoleDto = {
+    /**
+     * @description Account ID of the user
+     * @type string
+     */
+    account_id: string;
+    /**
+     * @description Role name to assign
+     * @type string
+     */
+    role: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type SetPermissionsDto = {
+    /**
+     * @description Array of permission strings in resource.action format
+     * @type array
+     */
+    permissions: string[];
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type CreatePermissionDto = {
+    /**
+     * @description Action name
+     * @type string
+     */
+    action: string;
+    /**
+     * @type string | undefined
+     */
+    description?: string;
+    /**
+     * @description Resource name
+     * @type string
+     */
+    resource: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type CreateApiKeyDto = {
+    /**
+     * @description Human-readable label for this key (shown in the API keys list).
+     * @minLength 1
+     * @maxLength 120
+     * @type string
+     */
+    name: string;
+    /**
+     * @description Permission scope for the key. Each entry must match `resource.action` (lowercase + underscores).
+     * @type array
+     */
+    permissions: string[];
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type CreateM2MClientDto = {
+    /**
+     * @description Client display name
+     * @type string
+     */
+    name: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type UpdateM2MClientDto = {
+    /**
+     * @description Set active or inactive
+     * @type boolean | undefined
+     */
+    is_active?: boolean;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type SetScopesDto = {
+    /**
+     * @description Permission strings in resource.action format to assign as scopes
+     * @type array
+     */
+    permissions: string[];
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
+type EndUserInviteControllerListQueryParams = {
+    /**
+     * @type string | undefined
+     */
+    limit?: string;
+    /**
+     * @type string | undefined
+     */
+    cursor?: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
+type AppControllerListMembersQueryParams = {
+    /**
+     * @type string | undefined
+     */
+    limit?: string;
+    /**
+     * @type string | undefined
+     */
+    cursor?: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
+type EndUserControllerListEndUsersQueryParams = {
+    /**
+     * @type string | undefined
+     */
+    limit?: string;
+    /**
+     * @type string | undefined
+     */
+    cursor?: string;
+    /**
+     * @type string | undefined
+     */
+    status?: string;
+    /**
+     * @type string | undefined
+     */
+    search?: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
+type AppAuditControllerGetAuditLogsQueryParams = {
+    /**
+     * @type string | undefined
+     */
+    limit?: string;
+    /**
+     * @type string | undefined
+     */
+    cursor?: string;
+    /**
+     * @type string | undefined
+     */
+    action?: string;
+    /**
+     * @type string | undefined
+     */
+    actor_id?: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
+type M2MControllerListClientsQueryParams = {
+    /**
+     * @type string | undefined
+     */
+    limit?: string;
+    /**
+     * @type string | undefined
+     */
+    cursor?: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
+type RoleControllerListRolesQueryParams = {
+    /**
+     * @type string | undefined
+     */
+    limit?: string;
+    /**
+     * @type string | undefined
+     */
+    cursor?: string;
+};
+
+declare class AppScope {
+    /** The appId bound to this scope. */
+    readonly appId: string;
+    private readonly client;
+    constructor(appId: string, client: Client);
+    /**
+     * Direct HTTP escape hatch used to call endpoints whose spec is buggy
+     * — currently those whose path declares `{appId}` but whose
+     * `parameters[]` omits it, so the kubb-generated code leaves the
+     * URL template unfilled. Tracked upstream; remove once the spec is
+     * fixed and the per-call wrappers can move back to kubb's output.
+     */
+    private callDirect;
+    get: () => Promise<AppResponseDto>;
+    update: (data: UpdateAppDto) => Promise<AppResponseDto>;
+    delete: () => Promise<any>;
+    updateStatus: (data: UpdateAppStatusDto) => Promise<AppResponseDto>;
+    readonly authConfig: {
+        get: () => Promise<AuthConfigResponseDto>;
+        update: (data: UpdateAuthConfigDto) => Promise<AuthConfigResponseDto>;
+    };
+    readonly invites: {
+        list: (params?: Partial<EndUserInviteControllerListQueryParams>) => Promise<EndUserInviteListResponseDto>;
+        create: (data: CreateEndUserInviteDto) => Promise<EndUserInviteResponseDto>;
+        revoke: (inviteId: string) => Promise<any>;
+    };
+    readonly members: {
+        list: (params?: Partial<AppControllerListMembersQueryParams>) => Promise<AppMemberListResponseDto>;
+        remove: (accountId: string) => Promise<any>;
+    };
+    readonly endUsers: {
+        list: (params?: Partial<EndUserControllerListEndUsersQueryParams>) => Promise<EndUserListResponseDto>;
+        get: (userId: string) => Promise<EndUserSummaryDto>;
+        update: (userId: string, data: UpdateEndUserDto) => Promise<EndUserSummaryDto>;
+        delete: (userId: string) => Promise<any>;
+        updateRole: (userId: string, data: UpdateEndUserRoleDto) => Promise<any>;
+        updateStatus: (userId: string, data: UpdateEndUserStatusDto) => Promise<EndUserSummaryDto>;
+        /** Spec bug: appId missing in spec params (see callDirect). */
+        revokeAllSessions: (userId: string) => Promise<void>;
+    };
+    readonly roles: {
+        list: (params?: Partial<RoleControllerListRolesQueryParams>) => Promise<RoleListResponseDto>;
+        /** Spec bug: appId missing in spec params (see callDirect). */
+        get: (roleName: string) => Promise<unknown>;
+        create: (data: CreateRoleDto) => Promise<RoleResponseDto>;
+        /** Spec bug: appId missing in spec params (see callDirect). */
+        update: (roleName: string, data: UpdateRoleDto) => Promise<unknown>;
+        /** Spec bug: appId missing in spec params (see callDirect). */
+        delete: (roleName: string) => Promise<void>;
+        assign: (data: AssignRoleDto) => Promise<AppMembershipResponseDto>;
+        setPermissions: (roleName: string, data: SetPermissionsDto) => Promise<any>;
+        listPermissions: () => Promise<RoleControllerListPermissions200>;
+    };
+    readonly permissions: {
+        list: () => Promise<PermissionControllerListPermissions200>;
+        create: (data: CreatePermissionDto) => Promise<PermissionDto>;
+        delete: (permissionKey: string) => Promise<any>;
+    };
+    readonly apiKeys: {
+        list: () => Promise<ApiKeyListResponseDto>;
+        create: (data: CreateApiKeyDto) => Promise<CreateApiKeyResponseDto>;
+        delete: (keyId: string) => Promise<any>;
+    };
+    readonly credentials: {
+        list: (params?: Partial<M2MControllerListClientsQueryParams>) => Promise<M2MClientListResponseDto>;
+        create: (data: CreateM2MClientDto) => Promise<M2MClientCreateResponseDto>;
+        get: (clientId: string) => Promise<M2MClientDetailResponseDto>;
+        update: (clientId: string, data: UpdateM2MClientDto) => Promise<any>;
+        delete: (clientId: string) => Promise<any>;
+        rotateSecret: (clientId: string) => Promise<M2MRotateSecretResponseDto>;
+        setScopes: (clientId: string, data: SetScopesDto) => Promise<any>;
+    };
+    readonly auditLogs: {
+        list: (params?: Partial<AppAuditControllerGetAuditLogsQueryParams>) => Promise<AuditLogListResponseDto>;
+    };
+}
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type OAuthTokenResponseDto = {
+    /**
+     * @description Access token (RS256 JWT signed with the app JWKS key).
+     * @type string
+     */
+    access_token: string;
+    /**
+     * @description Access-token lifetime in seconds.
+     * @type number
+     */
+    expires_in: number;
+    /**
+     * @description Space-separated scopes, RFC 6749.
+     * @type string
+     */
+    scope: string;
+    /**
+     * @type string
+     */
+    token_type: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type AuthorizeBatchResultDto = {
+    /**
+     * @type boolean
+     */
+    authorized: boolean;
+    /**
+     * @description Caller-supplied id from the corresponding check entry. Echoed back so callers can correlate results to inputs without relying on array order.
+     * @type string | undefined
+     */
+    id?: string;
+    /**
+     * @type array
+     */
+    missing_permissions: string[];
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
+type AuthorizeBatchResponseDto = {
+    /**
+     * @type array
+     */
+    results: AuthorizeBatchResultDto[];
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type AuthorizeResponseDto = {
+    /**
+     * @type boolean
+     */
+    authorized: boolean;
+    /**
+     * @description Failure code on `authorized: false`.
+     * @type string | undefined
+     */
+    error?: string;
+    /**
+     * @description Permissions the token does not hold.
+     * @type array | undefined
+     */
+    missing_permissions?: string[];
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type VerifyPrincipalDto = {
+    /**
+     * @description App UUID this token is bound to.
+     * @type string
+     */
+    aid: string;
+    /**
+     * @description Permission claim — only set on M2M tokens.
+     * @type array | undefined
+     */
+    permissions?: string[];
+    /**
+     * @description App-level role name when EndUser.
+     * @type string | undefined
+     */
+    role?: string;
+    /**
+     * @description Subject — EndUser account id or M2M client id.
+     * @type string
+     */
+    sub: string;
+    /**
+     * @description Principal type, e.g. `end_user` or `m2m`.
+     * @type string
+     */
+    type: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
+type VerifyResponseDto = {
+    /**
+     * @description Failure code on `valid: false` — e.g. `TOKEN_INVALID`, `TOKEN_EXPIRED`, `TOKEN_REVOKED`, `ACCOUNT_SUSPENDED`.
+     * @type string | undefined
+     */
+    error?: string;
+    /**
+     * @type object | undefined
+     */
+    principal?: VerifyPrincipalDto;
+    /**
+     * @description True iff the signature, issuer, audience, and session are all valid.
+     * @type boolean
+     */
+    valid: boolean;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type ConsumerMfaChallengeFactorDto = {
+    /**
+     * @type string
+     */
+    id: string;
+    /**
+     * @type string
+     */
+    label: string | null;
+    /**
+     * @description Factor type — currently `totp`; widens as new factor types ship.
+     * @type string
+     */
+    type: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
+type ConsumerMfaChallengeResponseDto = {
+    /**
+     * @description When the challenge expires (ISO 8601, UTC).
+     * @type string, date-time
+     */
+    expires_at: string;
+    /**
+     * @description Factors the user can satisfy this challenge with (any-of).
+     * @type array
+     */
+    factors: ConsumerMfaChallengeFactorDto[];
+    /**
+     * @description Always `true` on this response. Distinguishes it from the normal token response shape.
+     * @type boolean
+     */
+    mfa_required: boolean;
+    /**
+     * @description Single-use challenge id. Pass back as `mfa_token` on `/auth/mfa/verify` or `/auth/mfa/recover` to complete the sign-in. 5-minute TTL.
+     * @type string
+     */
+    mfa_token: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type ConsumerSigninDto = {
+    /**
+     * @description Username or verified primary email — either accepted. Secondary or unverified emails do not authenticate.
+     * @type string
+     */
+    identifier: string;
+    /**
+     * @description EndUser password.
+     * @type string
+     */
+    password: string;
+    /**
+     * @description Optional tenant UUID. When set, the issued JWT carries `tid` + `trole` claims and the user must already be a member of that tenant — non-membership returns 403.
+     * @type string | undefined
+     */
+    tenant_id?: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type ConsumerTokenResponseDto = {
+    /**
+     * @description Short-lived JWT signed with the app-scoped JWKS key. Carries sub, role, permissions[], type=end_user.
+     * @type string
+     */
+    access_token: string;
+    /**
+     * @description Access-token lifetime in seconds.
+     * @type number
+     */
+    expires_in: number;
+    /**
+     * @description Long-lived opaque-ish JWT used to mint a new access token via /auth/refresh. Rotated on use.
+     * @type string
+     */
+    refresh_token: string;
+    /**
+     * @type string
+     */
+    token_type: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
+/**
+ * @description Either a normal token response or an MFA challenge — distinguish by `mfa_required`.
+ */
+type ConsumerAuthControllerSignin200 = ConsumerTokenResponseDto | ConsumerMfaChallengeResponseDto;
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type ConsumerSignupDto = {
+    /**
+     * @description Optional display name shown back to the user.
+     * @type string | undefined
+     */
+    display_name?: string;
+    /**
+     * @description EndUser email address. Becomes the primary email contact and the default verification target.
+     * @type string
+     */
+    email: string;
+    /**
+     * @description Password. Must satisfy the app-configured policy (default: 8+ chars).
+     * @type string
+     */
+    password: string;
+    /**
+     * @description Unique username inside the app. 3+ chars.
+     * @type string
+     */
+    username: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type ConsumerRefreshDto = {
+    /**
+     * @description Refresh token returned from signin/signup/previous refresh. Each refresh rotates the token; the previous one is revoked.
+     * @type string
+     */
+    refresh_token: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type ConsumerLogoutDto = {
+    /**
+     * @description Refresh token to revoke. The matching session is destroyed; the access token continues to verify until its TTL expires.
+     * @type string
+     */
+    refresh_token: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type ConsumerRequestPasswordResetDto = {
+    /**
+     * @description Email contact value to target. Set this OR `phone`, not both.
+     * @type string | undefined
+     */
+    email?: string;
+    /**
+     * @description Phone contact value (any format the customer normalised; recommended E.164). Set this OR `email`, not both.
+     * @type string | undefined
+     */
+    phone?: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type ConsumerResetPasswordDto = {
+    /**
+     * @description 6-digit numeric code from the password-reset message.
+     * @type string
+     */
+    code: string;
+    /**
+     * @description New password. Must satisfy the app-configured policy.
+     * @type string
+     */
+    new_password: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type ConsumerRequestVerificationDto = {
+    /**
+     * @description Email contact value to target. Set this OR `phone`, not both.
+     * @type string | undefined
+     */
+    email?: string;
+    /**
+     * @description Phone contact value (any format the customer normalised; recommended E.164). Set this OR `email`, not both.
+     * @type string | undefined
+     */
+    phone?: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type ConsumerSendVerificationEmailDto = {
+    /**
+     * @description Email contact value to send the verification code to.
+     * @type string
+     */
+    email: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type ConsumerVerifyDto = {
+    /**
+     * @description 6-digit numeric verification code. The server resolves which contact the code is for from the code value itself.
+     * @type string
+     */
+    code: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type ConsumerAcceptInviteDto = {
+    /**
+     * @description Invite code from the invitation email (`inv_…`).
+     * @type string
+     */
+    code: string;
+    /**
+     * @description Optional display name shown back to the user.
+     * @type string | undefined
+     */
+    display_name?: string;
+    /**
+     * @description Password the accepter sets for their new account.
+     * @type string
+     */
+    password: string;
+    /**
+     * @description Optional username override. Defaults to a derivation of the invite email local-part.
+     * @type string | undefined
+     */
+    username?: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type ConsumerVerifyResponseDto = {
+    /**
+     * @description EndUser account id whose contact was verified.
+     * @type string
+     */
+    account_id: string;
+    /**
+     * @description Account_contact id that just flipped to verified.
+     * @type string
+     */
+    contact_id: string;
+    /**
+     * @description Contact type: `email` or `phone`.
+     * @type string
+     */
+    type: string;
+    /**
+     * @description Normalised contact value.
+     * @type string
+     */
+    value: string;
+    /**
+     * @description Verification timestamp, ISO 8601.
+     * @type string
+     */
+    verified_at: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type ConsumerCodeIssueResponseDto = {
+    /**
+     * @description Plaintext 6-digit code. Returned when the contact matches an EndUser in this app and the precondition is satisfied (contact unverified, for verification; contact verified, for reset). Otherwise the response is `{}` (no code) — same shape on both branches to prevent enumeration.
+     * @type string
+     */
+    code: string;
+    /**
+     * @description Code expiry, ISO 8601. Codes live for 10 minutes.
+     * @type string
+     */
+    expires_at: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type ConsumerCodeDispatchResponseDto = {
+    /**
+     * @description Code expiry, ISO 8601. The plaintext code is NOT returned — Mail has dispatched it.
+     * @type string
+     */
+    expires_at: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type UpdateMeDto = {
+    /**
+     * @description New display name. Pass an empty string to clear it; omit to leave unchanged.
+     * @minLength 0
+     * @maxLength 120
+     * @type string | undefined
+     */
+    display_name?: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type VerifyBody = {
+    /**
+     * @description EndUser or M2M JWT to verify against the app JWKS. Optional — if omitted, the token is read from the `Authorization: Bearer <jwt>` header instead.
+     * @type string | undefined
+     */
+    token?: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type AuthorizeBody = {
+    /**
+     * @description Single permission to check, e.g. \'user.read\'. Use this OR `permissions`.
+     * @type string | undefined
+     */
+    permission?: string;
+    /**
+     * @description Multiple permissions; the token must hold ALL of them.
+     * @type array | undefined
+     */
+    permissions?: string[];
+    /**
+     * @description JWT to verify and authorize. Optional — if omitted, the token is read from the `Authorization: Bearer <jwt>` header.
+     * @type string | undefined
+     */
+    token?: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type AuthorizeBatchEntry = {
+    /**
+     * @description Caller-chosen correlation id for this check. Echoed back on the matching result so the caller can map results to inputs without relying on array order.
+     * @type string | undefined
+     */
+    id?: string;
+    /**
+     * @description Single permission to check, e.g. \'invoice.read\'. Use this OR `permissions`.
+     * @type string | undefined
+     */
+    permission?: string;
+    /**
+     * @description Multiple permissions; ALL must be held for this check to pass.
+     * @type array | undefined
+     */
+    permissions?: string[];
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
+type AuthorizeBatchBody = {
+    /**
+     * @description List of checks. Each returns { id?, authorized, missing_permissions }.
+     * @type array
+     */
+    checks: AuthorizeBatchEntry[];
+    /**
+     * @description JWT to verify and authorize against each check. Optional — if omitted, the token is read from the `Authorization: Bearer <jwt>` header.
+     * @type string | undefined
+     */
+    token?: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type ClientCredentialsDto = {
+    /**
+     * @description M2M client identifier (m2m_*).
+     * @type string
+     */
+    client_id: string;
+    /**
+     * @description M2M client secret (issued at client creation, never returned again).
+     * @type string
+     */
+    client_secret: string;
+    /**
+     * @description OAuth grant type. Only \'client_credentials\' is supported.
+     * @type string
+     */
+    grant_type: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type IdpNativeUserHintDto = {
+    /**
+     * @type string | undefined
+     */
+    email?: string;
+    /**
+     * @type string | undefined
+     */
+    name?: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
+type IdpNativeSigninDto = {
+    /**
+     * @description Provider-issued ID token (JWT). For Apple, the value returned by `ASAuthorizationAppleIDCredential.identityToken` after UTF-8 decoding the data.
+     * @minLength 16
+     * @maxLength 8192
+     * @type string
+     */
+    id_token: string;
+    /**
+     * @description Raw nonce the client generated and SHA-256-hashed into the authorize request. Backend recomputes the hash and compares to the token\'s `nonce` claim. Must be at least 32 bytes of entropy (base64url-encoded ~43 chars).
+     * @minLength 16
+     * @maxLength 256
+     * @type string
+     */
+    nonce: string;
+    /**
+     * @description Apple-specific first-signin payload: { name, email }. Persist for display only — the verified JWT is the source of truth.
+     */
+    user?: IdpNativeUserHintDto;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+declare const idpTokenResponseDtoTokenTypeEnum: {
+    readonly Bearer: "Bearer";
+};
+type IdpTokenResponseDtoTokenTypeEnumKey = (typeof idpTokenResponseDtoTokenTypeEnum)[keyof typeof idpTokenResponseDtoTokenTypeEnum];
+type IdpTokenResponseDto = {
+    /**
+     * @type string
+     */
+    access_token: string;
+    /**
+     * @description Lifetime of the access token in seconds.
+     * @type number
+     */
+    expires_in: number;
+    /**
+     * @type string
+     */
+    refresh_token: string;
+    /**
+     * @type string
+     */
+    token_type: IdpTokenResponseDtoTokenTypeEnumKey;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
+declare const consumerIdpControllerNativeSignInPathParamsProviderEnum: {
+    readonly apple: "apple";
+    readonly google: "google";
+    readonly github: "github";
+};
+type ConsumerIdpControllerNativeSignInPathParamsProviderEnumKey = (typeof consumerIdpControllerNativeSignInPathParamsProviderEnum)[keyof typeof consumerIdpControllerNativeSignInPathParamsProviderEnum];
+
+/**
+ * In-process JWKS cache for a single app's `/.well-known/jwks.json`.
+ *
+ * Thin wrapper over `jose.createRemoteJWKSet`, which already gives us:
+ *   - TTL-based cache (cacheMaxAge)
+ *   - Cooldown between failed fetches (cooldownDuration)
+ *   - Singleflight (concurrent verifies share one inflight fetch)
+ *   - Auto-refetch when the token's `kid` isn't in the cached JWKS
+ *     (rotation handling)
+ *
+ * We add:
+ *   - Translation of jose's internal `JWKSNoMatchingKey` /
+ *     `JWKSTimeout` / etc. errors into our typed `JwksKeyNotFoundError`
+ *     / `JwksFetchError`.
+ *   - A `refresh()` method for explicit cache busting (rare, but useful
+ *     for tests + manual rotation drills).
+ *
+ * Instances are returned by `ConsumerScope.jwks` and are jose-compatible
+ * out of the box — `jose.jwtVerify(token, scope.jwks.getKey, ...)` works.
+ */
+
+interface JwksCacheOptions {
+    url: URL;
+    /** Cache lifetime in ms. Default 10 minutes — same as jose's default. */
+    ttlMs?: number;
+    /** Min ms between failed fetches. Default 30 seconds. */
+    cooldownMs?: number;
+    /** Network timeout per fetch. Default 5 seconds. */
+    timeoutMs?: number;
+    /** Pin a custom fetch implementation (e.g. undici with retry, mock fetch in tests). */
+    fetch?: typeof fetch;
+}
+type AuthGetKeyFn = (protectedHeader?: JWTHeaderParameters, token?: FlattenedJWSInput) => Promise<CryptoKey>;
+declare class JwksCache {
+    readonly url: URL;
+    private readonly _jose;
+    constructor(options: JwksCacheOptions);
+    /**
+     * Resolve a signing key for a given JWT header.
+     * Bound as an arrow-function field so it can be passed around
+     * (`jose.jwtVerify(token, cache.getKey, ...)`, passport-jwt, etc.)
+     * without losing `this`.
+     */
+    readonly getKey: AuthGetKeyFn;
+    /**
+     * Force a refetch on the next verify. Useful in tests and for
+     * external rotation drills — the normal flow self-heals because
+     * jose auto-refetches on kid miss.
+     */
+    refresh(): void;
+}
+
+/**
+ * `verifyAuthToken` — the 80%-case verify helper.
+ *
+ * Wraps `jose.jwtVerify` with:
+ *   - Sensible defaults (algorithm allow-list, clockTolerance)
+ *   - Typed claim payload (`AuthClaims`)
+ *   - Translation of jose errors into our typed error hierarchy
+ */
+
+/**
+ * Claims that an Auth-issued EndUser access token is expected to
+ * carry. Unknown claims pass through as `string | number | unknown`
+ * (jose's `JWTPayload` is open-ended) — callers can intersect with
+ * their own custom-claim type if they've configured Auth to add
+ * extras.
+ */
+interface AuthClaims extends JWTPayload {
+    /** EndUser id. */
+    sub: string;
+    /** App slug the token was issued for. */
+    iss: string;
+    /** Audience — usually the app slug or oauth client_id. */
+    aud?: string | string[];
+    /** Standard exp/iat/nbf. */
+    exp: number;
+    iat: number;
+    nbf?: number;
+    /** JWT id — present on refreshable tokens. */
+    jti?: string;
+    /** Role assigned by Auth, if any. */
+    role?: string;
+    /** Permission keys the EndUser is authorized for. */
+    permissions?: string[];
+    /** Email on the EndUser profile, when claimed. */
+    email?: string;
+    /** Whether the email is verified. */
+    email_verified?: boolean;
+}
+interface VerifyOptions {
+    /** Expected `iss` claim. Defaults to the value set on the consumer scope. */
+    issuer?: string | string[];
+    /** Expected `aud` claim. If unset (and unset on the scope), aud check is skipped. */
+    audience?: string | string[];
+    /** Allowed JWS algorithms. Default ['ES256', 'RS256', 'EdDSA']. */
+    algorithms?: string[];
+    /**
+     * Acceptable clock skew. Number = seconds, string = jose duration
+     * (`"30s"`, `"2m"`, ...). Default 5 seconds.
+     */
+    clockTolerance?: string | number;
+    /** Additional claims that must be present (non-empty) on the token. */
+    requiredClaims?: string[];
+    /** Override the verify time. Default `Date.now()`. */
+    currentDate?: Date;
+    /** Maximum token age — passed straight to jose. */
+    maxTokenAge?: string | number;
+}
+/**
+ * Verify an Auth-issued JWT against a JWKS resolver.
+ *
+ * @param token        The compact-form JWT (header.payload.signature)
+ * @param getKey       A jose-compatible key resolver — pass
+ *                     `scope.jwks.getKey` from a `ConsumerScope`
+ * @param opts         Defaults supplied by the scope; override here
+ *                     for one-off cases.
+ */
+declare function verifyAuthToken(token: string, getKey: AuthGetKeyFn, opts?: VerifyOptions): Promise<AuthClaims>;
+
+/**
+ * Legacy `iss` claim Auth Consumer-API tokens used to be minted
+ * with. Kept exported so consumers verifying tokens issued before the
+ * 2026-05-24 per-app-issuer migration can still match `iss` while a
+ * deployment cycles to fresh tokens. New tokens carry the per-app
+ * issuer URL — `${baseUrl}/${appSlug}` — accessible via
+ * `scope.expectedIssuer`.
+ */
+declare const AUTH_LEGACY_ISSUER = "heimdall";
+interface ConsumerScopeInternals {
+    client: Client;
+    baseUrl: string;
+    /** Custom fetch — forwarded to the JWKS cache so tests / undici / proxies work. */
+    fetch?: typeof fetch;
+}
+declare class ConsumerScope {
+    /** The appSlug bound to this scope. */
+    readonly appSlug: string;
+    /**
+     * Issuer the Auth Consumer API stamps on every token for this
+     * app — the public Auth API base joined with the app slug
+     * (e.g. `https://api.auth.productcraft.co/acme`). Pin it in
+     * your local verifier so a token minted for another app on the
+     * platform cannot pass.
+     *
+     * `scope.verifyToken` already enforces this for you. Pass it as a
+     * second-position issuer if you're wiring `jose.jwtVerify`,
+     * `passport-jwt`, or PyJWT yourself.
+     */
+    readonly expectedIssuer: string;
+    /**
+     * Audience the Consumer API stamps on every token for this app —
+     * literally the app slug (e.g. `"acme"`). Pin it in your verifier
+     * the same way as `expectedIssuer`. `scope.verifyToken` enforces
+     * it by default.
+     */
+    readonly expectedAudience: string;
+    /**
+     * Both accepted issuer strings (`expectedIssuer` + the legacy
+     * `'auth'` literal). `verifyToken` passes this to jose so tokens
+     * minted before the 2026-05-24 per-app-issuer migration keep
+     * verifying alongside fresh ones — useful for the ~1-hour transition
+     * window per access-token TTL, and the longer session TTL on
+     * refresh tokens.
+     */
+    readonly acceptedIssuers: readonly string[];
+    /** jose-compatible JWKS resolver. Drop into `jose.jwtVerify`, passport-jwt, etc. */
+    readonly jwks: JwksCache;
+    private readonly client;
+    constructor(appSlug: string, internals: ConsumerScopeInternals, opts?: {
+        jwksTtlMs?: number;
+    });
+    /**
+     * Direct HTTP escape hatch for endpoints whose spec is buggy
+     * (path declares `{appSlug}` but parameters[] omits it). Tracked
+     * upstream; remove once the spec is fixed.
+     */
+    private callDirect;
+    /**
+     * Verify an Auth-issued JWT against this app's JWKS.
+     *
+     * Checks the signature, expiry, `iss`, and `aud`. Accepts both the
+     * per-app issuer URL (`expectedIssuer`) and the legacy `'heimdall'`
+     * literal during the issuer-migration transition window — callers
+     * who want to refuse legacy tokens can override with
+     * `{ issuer: scope.expectedIssuer }`. Audience defaults to the app
+     * slug (`expectedAudience`); pass `{ audience: false }` (in an
+     * options override) to skip the audience check entirely.
+     */
+    verifyToken(token: string, opts?: VerifyOptions): Promise<AuthClaims>;
+    readonly auth: {
+        signin: (data: ConsumerSigninDto) => Promise<ConsumerAuthControllerSignin200>;
+        /**
+         * Signup may require a Platform API Key when the app has
+         * `signup_requires_pak: true`. Configure that on the Auth
+         * instance (`new Auth({ auth: { type: "apiKey", key: "..." } })`)
+         * — our HTTP client attaches the Authorization header automatically.
+         */
+        signup: (data: ConsumerSignupDto) => Promise<unknown>;
+        refresh: (data: ConsumerRefreshDto) => Promise<ConsumerTokenResponseDto>;
+        logout: (data: ConsumerLogoutDto) => Promise<any>;
+        /**
+         * PAK-required: caller must instantiate `Auth` with
+         * `auth: { type: "apiKey", key: "pcft_live_..." }`. The
+         * kubb-generated `headers.authorization` slot is a stub — the
+         * HTTP client's auth middleware overrides whatever's passed.
+         */
+        requestReset: (data: ConsumerRequestPasswordResetDto) => Promise<ConsumerCodeIssueResponseDto>;
+        resetPassword: (data: ConsumerResetPasswordDto) => Promise<any>;
+        /**
+         * Mint a 6-digit contact-verification code bound to the email or
+         * phone in the body. Returns `{ code, expires_at }` for delivery
+         * via the customer's own channel — or `{}` if no match / already
+         * verified (uniform shape — no account enumeration).
+         *
+         * PAK-required: caller must instantiate `Auth` with
+         * `auth: { type: "apiKey", key: "pcft_live_..." }` carrying
+         * `auth.user.verify.create` narrowed to this app's URN. The
+         * kubb-generated `headers.authorization` slot is a stub — the
+         * HTTP client's auth middleware overrides whatever's passed.
+         */
+        requestVerification: (data: ConsumerRequestVerificationDto) => Promise<ConsumerCodeIssueResponseDto>;
+        /**
+         * Mint + dispatch a verification email via Mail in one call.
+         * Returns `{ expires_at }` on success; the plaintext code is NOT
+         * returned. Returns `{}` when the contact is missing or already
+         * verified (same enumeration defence as `requestVerification`).
+         *
+         * PAK-required with `auth.user.verify.send-email` — distinct
+         * permission from the bare mint so customers can enable mint
+         * without enabling outbound Mail traffic. Surfaces typed 412
+         * precondition errors (e.g. `ENVOI_NOT_ENABLED`) rather than the
+         * silent fail-closed of a fire-and-forget mailer.
+         */
+        sendVerificationEmail: (data: ConsumerSendVerificationEmailDto) => Promise<ConsumerCodeDispatchResponseDto>;
+        /**
+         * Consume a 6-digit verification code, flipping the bound
+         * contact's `verified_at`. Public — anyone holding the code can
+         * submit it; that is the whole point of the flow. Server resolves
+         * the contact + account from the code value itself. Returns
+         * `{ account_id, email_verified_at }` on success; 410 on invalid /
+         * expired / consumed code.
+         */
+        verify: (data: ConsumerVerifyDto) => Promise<ConsumerVerifyResponseDto>;
+        /**
+         * Accept an end-user invite into this app. The invite is minted by
+         * an app admin (`auth.app(appId).invites.create`) and delivered
+         * to the invitee out-of-band; this consumes the invite token and
+         * provisions the EndUser. Public — the caller is unauthenticated
+         * until the invite is accepted.
+         */
+        acceptInvite: (data: ConsumerAcceptInviteDto) => Promise<ConsumerTokenResponseDto>;
+        /**
+         * Sign in / sign up with a provider ID token (native flow).
+         *
+         * Submit the identity token Apple (or Google, once enabled) issued
+         * to a native client (iOS `ASAuthorizationController`, Google
+         * Sign-In for iOS / Android). Auth verifies the signature
+         * against the provider's JWKS, pins the issuer, checks the
+         * audience against the app's configured native client ids,
+         * recomputes `sha256(nonce)` and compares to the token's `nonce`
+         * claim, then resolves or creates the EndUser. Same response
+         * shape as `auth.signin`.
+         *
+         * Account linking: when an EndUser already exists with a verified
+         * primary email matching the token's `email` claim, the app's
+         * `oauth_link_policy` decides the outcome:
+         *   - `confirm` (default): refuse with 409 `link_required`. UI
+         *     should sign the user in via their original method to bind.
+         *   - `auto`: silently link the identity to the existing account
+         *     (provider claims `email_verified: true` AND the email is
+         *     not an Apple private relay).
+         *   - `reject`: refuse with 409 `account_exists_with_different_provider`.
+         *
+         * Apple's private-relay emails (`*@privaterelay.appleid.com`) are
+         * persisted as-is on the EndUser's primary email contact and
+         * never participate in auto-link.
+         *
+         * Apple sends the user's display name only on the FIRST sign-in.
+         * Pass it through `user.name` on that call — Auth persists it
+         * to the EndUser row. Subsequent sign-ins should omit `user`.
+         */
+        signinWithProvider: (args: {
+            provider: ConsumerIdpControllerNativeSignInPathParamsProviderEnumKey;
+            id_token: IdpNativeSigninDto["id_token"];
+            nonce: IdpNativeSigninDto["nonce"];
+            user?: IdpNativeSigninDto["user"];
+        }) => Promise<IdpTokenResponseDto>;
+    };
+    readonly me: {
+        getProfile: () => Promise<unknown>;
+        updateProfile: (data: UpdateMeDto) => Promise<unknown>;
+        listSessions: (params?: Record<string, string | number>) => Promise<unknown>;
+        revokeSession: (id: string) => Promise<void>;
+        getActivity: (params?: Record<string, string | number>) => Promise<unknown>;
+        deleteAccount: () => Promise<void>;
+    };
+    readonly verify: {
+        /**
+         * The kubb-generated client makes `headers.authorization` a required
+         * arg because the server controllers accept the bearer as a fallback
+         * to `body.token`. We stub an empty string here — the HTTP client's
+         * auth middleware overrides whatever's passed with the configured
+         * credential (`PCAuth.apiKey` / `bearer` / `cookie`).
+         */
+        verify: (data: VerifyBody) => Promise<VerifyResponseDto>;
+        authorize: (data: AuthorizeBody) => Promise<AuthorizeResponseDto>;
+        authorizeBatch: (data: AuthorizeBatchBody) => Promise<AuthorizeBatchResponseDto>;
+    };
+    readonly oauth: {
+        clientCredentials: (data: ClientCredentialsDto) => Promise<OAuthTokenResponseDto>;
+    };
+}
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type CreateAppDto = {
+    /**
+     * @description Display name shown in the console.
+     * @minLength 1
+     * @maxLength 120
+     * @type string
+     */
+    display_name: string;
+    /**
+     * @description URL-friendly app slug (lowercase letters, digits, hyphens).
+     * @minLength 3
+     * @maxLength 64
+     * @type string
+     */
+    slug: string;
+    /**
+     * @description UUID of the platform workspace that will own the new app. The caller must hold `auth.create` on this workspace.
+     * @type string
+     */
+    workspace_id: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
+type AppControllerListMyAppsQueryParams = {
+    /**
+     * @type string | undefined
+     */
+    limit?: string;
+    /**
+     * @type string | undefined
+     */
+    cursor?: string;
+    /**
+     * @type string | undefined
+     */
+    workspace_id?: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
+type StatsControllerGetMyStatsQueryParams = {
+    /**
+     * @type string | undefined
+     */
+    workspace_id?: string;
+};
+
+/**
+ * Typed error hierarchy for JWT verification. All errors inherit from
+ * `JwtVerifyError` so callers can do one `instanceof` to catch any
+ * verify failure, or branch on more specific subclasses for UX.
+ */
+declare class JwtVerifyError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string, options?: {
+        cause?: unknown;
+    });
+}
+/** Signature didn't match, header malformed, or token structure invalid. */
+declare class JwtInvalidError extends JwtVerifyError {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
+/** Token's `exp` claim is in the past (allowing for clockTolerance). */
+declare class JwtExpiredError extends JwtVerifyError {
+    readonly expiredAt?: Date;
+    constructor(message: string, expiredAt?: Date, options?: {
+        cause?: unknown;
+    });
+}
+/** Token's `nbf` is in the future. */
+declare class JwtNotYetValidError extends JwtVerifyError {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
+/** `iss` claim doesn't match the expected issuer. */
+declare class JwtIssuerMismatchError extends JwtVerifyError {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
+/** `aud` claim doesn't match the expected audience. */
+declare class JwtAudienceMismatchError extends JwtVerifyError {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
+/** The token's `kid` isn't in the JWKS (even after a forced refetch). */
+declare class JwksKeyNotFoundError extends JwtVerifyError {
+    readonly kid: string | undefined;
+    constructor(kid: string | undefined, options?: {
+        cause?: unknown;
+    });
+}
+/** Network / non-2xx fetching the JWKS endpoint. */
+declare class JwksFetchError extends JwtVerifyError {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
+
+interface AuthConfig extends PCClientConfig {
+    /** Per-app JWKS cache lifetime in ms. Default 10 minutes. */
+    jwksTtlMs?: number;
+}
+declare class Auth {
+    private readonly client;
+    private readonly baseUrl;
+    private readonly fetch;
+    private readonly jwtConfig;
+    constructor(config?: AuthConfig);
+    /**
+     * Returns an `AppScope` bound to the given appId. All operations under
+     * `/v1/apps/{appId}/...` are exposed as resource namespaces on the
+     * returned object.
+     */
+    app(appId: string): AppScope;
+    /**
+     * Returns a `ConsumerScope` bound to the given appSlug. Exposes the
+     * `/{appSlug}/v1/...` surface (sign-in, sign-up, me, verify, oauth)
+     * and the JWT-verify helper for tokens issued by this app.
+     */
+    consumer(appSlug: string): ConsumerScope;
+    readonly apps: {
+        /** List apps the caller's workspace can see. */
+        list: (params?: Partial<AppControllerListMyAppsQueryParams>) => Promise<AppListResponseDto>;
+        /** Create a new app under the caller's workspace. */
+        create: (data: CreateAppDto) => Promise<AppResponseDto>;
+    };
+    readonly stats: {
+        /**
+         * Get the signed-in PlatformUser's aggregate counts. Pass
+         * `workspaceId` to scope to a single workspace; omit to total
+         * across every workspace the caller belongs to.
+         */
+        get: (params?: Partial<StatsControllerGetMyStatsQueryParams>) => Promise<PlatformUserStatsResponseDto>;
+    };
+}
+
+export { AUTH_LEGACY_ISSUER, AppScope, type AssignRoleDto, Auth, type AuthClaims, type AuthConfig, AuthHttpError, type AuthorizeBatchBody, type AuthorizeBody, type ClientCredentialsDto, type ConsumerAcceptInviteDto, type ConsumerLogoutDto, type ConsumerRefreshDto, type ConsumerRequestPasswordResetDto, type ConsumerResetPasswordDto, ConsumerScope, type ConsumerSigninDto, type ConsumerSignupDto, type ConsumerTokenResponseDto, type CreateApiKeyDto, type CreateAppDto, type CreateEndUserInviteDto, type CreateM2MClientDto, type CreatePermissionDto, type CreateRoleDto, type EndUserInviteResponseDto, type IdpNativeSigninDto, type IdpNativeUserHintDto, type IdpTokenResponseDto, JwksCache, JwksFetchError, JwksKeyNotFoundError, JwtAudienceMismatchError, JwtExpiredError, JwtInvalidError, JwtIssuerMismatchError, JwtNotYetValidError, JwtVerifyError, type SetPermissionsDto, type SetScopesDto, type UpdateAppDto, type UpdateAppStatusDto, type UpdateAuthConfigDto, type UpdateEndUserDto, type UpdateEndUserRoleDto, type UpdateEndUserStatusDto, type UpdateM2MClientDto, type UpdateMeDto, type UpdateRoleDto, type VerifyBody, type VerifyOptions, verifyAuthToken };