@productcraft/auth 0.6.0 → 0.7.1

package/dist/index.d.ts

@@ -29,6 +29,12 @@ type PlatformUserStatsResponseDto = {
  * Generated by Kubb (https://kubb.dev/).
  * Do not edit manually.
  */
+declare const appResponseDtoEnvironmentEnum: {
+    readonly production: "production";
+    readonly staging: "staging";
+    readonly development: "development";
+};
+type AppResponseDtoEnvironmentEnumKey = (typeof appResponseDtoEnvironmentEnum)[keyof typeof appResponseDtoEnvironmentEnum];
 declare const appResponseDtoStatusEnum: {
     readonly active: "active";
     readonly suspended: "suspended";
@@ -36,6 +42,11 @@ declare const appResponseDtoStatusEnum: {
 };
 type AppResponseDtoStatusEnumKey = (typeof appResponseDtoStatusEnum)[keyof typeof appResponseDtoStatusEnum];
 type AppResponseDto = {
+    /**
+     * @description Days of `audit_log` history kept for this app. A nightly job deletes rows older than this. 30-3650.
+     * @type number
+     */
+    audit_retention_days: number;
     /**
      * @type string, date-time
      */
@@ -49,6 +60,11 @@ type AppResponseDto = {
      * @type string
      */
     display_name: string;
+    /**
+     * @description Which environment this app IS. One app is one environment — there is no switch; a staging app is a separate app created via `POST /v1/apps/:appId/clone`. Set at create time and never changed afterwards. Every app that predates this field is `production`.
+     * @type string
+     */
+    environment: AppResponseDtoEnvironmentEnumKey;
     /**
      * @type string
      */
@@ -69,6 +85,11 @@ type AppResponseDto = {
      * @type string, date-time
      */
     updated_at: string;
+    /**
+     * @description Days of outbound-webhook delivery-attempt history kept for this app. 7-365.
+     * @type number
+     */
+    webhook_attempt_retention_days: number;
     /**
      * @description Owning workspace UUID.
      * @type string
@@ -144,6 +165,11 @@ type AuditLogEntryDto = {
      * @type string
      */
     actor_id: string | null;
+    /**
+     * @description Who acted: `end_user`, `platform_user`, `api_key`, `system`, or an agent type.
+     * @type string
+     */
+    actor_type: string;
     /**
      * @description App this audit row belongs to.
      * @type string
@@ -155,25 +181,35 @@ type AuditLogEntryDto = {
      */
     created_at: string;
     /**
-     * @description Free-form structured detail object captured at log time.
+     * @description Audit row UUID.
+     * @type string
+     */
+    id: string;
+    /**
+     * @description Client IP recorded at log time, when known.
+     * @type string
+     */
+    ip: string | null;
+    /**
+     * @description Free-form structured detail object captured at log time (e.g. `{ \"from\": \"bcrypt\", \"to\": \"argon2id\" }` on `auth.password.upgraded`). This is the `metadata` key on the wire.
      * @type object
      */
-    details: object | null;
+    metadata: object | null;
     /**
-     * @description Audit row UUID.
+     * @description Resource type touched (e.g. `app_membership`, `role`, `account`).
      * @type string
      */
-    id: string;
+    resource: string | null;
     /**
      * @description Resource id touched.
      * @type string
      */
     resource_id: string | null;
     /**
-     * @description Resource type touched (e.g. `app_membership`, `role`).
-     * @type string
+     * @description Tenant the action concerns, when it concerns one (e.g. `tenant.api_key.*` rows). `null` on app-level rows and on rows written before the column existed.
+     * @type string, uuid
      */
-    resource_type: string | null;
+    tenant_id: string | null;
 };
 
 /**
@@ -196,31 +232,53 @@ type AuditLogListResponseDto = {
  * Generated by Kubb (https://kubb.dev/).
  * Do not edit manually.
  */
-type M2MRotateSecretResponseDto = {
+type M2MScopeEntryDto = {
     /**
      * @type string
      */
-    client_id: string;
+    action: string;
     /**
-     * @description New plaintext client secret. Returned exactly once.
      * @type string
      */
-    client_secret: string;
+    resource: string;
 };
 
 /**
  * Generated by Kubb (https://kubb.dev/).
  * Do not edit manually.
  */
-type M2MScopeEntryDto = {
+type SetScopesDto = {
+    /**
+     * @description Permission strings in resource.action format to assign as scopes
+     * @type array
+     */
+    permissions: string[];
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
+/**
+ * @description Scopes updated. Returns the scopes the credential now holds.
+ */
+type M2MControllerSetScopes200 = M2MScopeEntryDto[];
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type M2MRotateSecretResponseDto = {
     /**
      * @type string
      */
-    action: string;
+    client_id: string;
     /**
+     * @description New plaintext client secret. Returned exactly once.
      * @type string
      */
-    resource: string;
+    client_secret: string;
 };
 
 /**
@@ -351,6 +409,11 @@ type CreateApiKeyResponseDto = {
      * @type string, date-time
      */
     created_at: string;
+    /**
+     * @description When this key stops authenticating. `null` means it never expires.
+     * @type string, date-time
+     */
+    expires_at: string | null;
     /**
      * @description API key row UUID.
      * @type string
@@ -382,11 +445,22 @@ type CreateApiKeyResponseDto = {
  * Generated by Kubb (https://kubb.dev/).
  * Do not edit manually.
  */
+declare const apiKeySummaryDtoStatusEnum: {
+    readonly active: "active";
+    readonly expired: "expired";
+    readonly revoked: "revoked";
+};
+type ApiKeySummaryDtoStatusEnumKey = (typeof apiKeySummaryDtoStatusEnum)[keyof typeof apiKeySummaryDtoStatusEnum];
 type ApiKeySummaryDto = {
     /**
      * @type string, date-time
      */
     created_at: string;
+    /**
+     * @description `null` = never expires.
+     * @type string, date-time
+     */
+    expires_at: string | null;
     /**
      * @type string
      */
@@ -408,6 +482,25 @@ type ApiKeySummaryDto = {
      * @type array
      */
     permissions: string[];
+    /**
+     * @type string, date-time
+     */
+    revoked_at: string | null;
+    /**
+     * @description PlatformUser id of the revoker.
+     * @type string
+     */
+    revoked_by: string | null;
+    /**
+     * @description Id of the key this one replaced, if it was minted by a rotation.
+     * @type string
+     */
+    rotated_from: string | null;
+    /**
+     * @description Lifecycle state at the time of the request. `active` keys authenticate; `expired` and `revoked` ones do not. Revoked wins over expired.
+     * @type string
+     */
+    status: ApiKeySummaryDtoStatusEnumKey;
 };
 
 /**
@@ -514,6 +607,51 @@ type AppPermissionCatalogEntryDto = {
 
 type RoleControllerListPermissions200 = AppPermissionCatalogEntryDto[];
 
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type RolePermissionEntryDto = {
+    /**
+     * @type string
+     */
+    action: string;
+    /**
+     * @type string
+     */
+    description: string | null;
+    /**
+     * @type string
+     */
+    id: string;
+    /**
+     * @type string
+     */
+    resource: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type SetPermissionsDto = {
+    /**
+     * @description Array of permission strings in resource.action format
+     * @type array
+     */
+    permissions: string[];
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
+/**
+ * @description Permissions updated. Returns the set the role now holds — the write is caller-narrowed, so the resulting set is what the caller needs to see.
+ */
+type RoleControllerSetPermissions200 = RolePermissionEntryDto[];
+
 /**
  * Generated by Kubb (https://kubb.dev/).
  * Do not edit manually.
@@ -600,6 +738,23 @@ type RoleListResponseDto = {
     pagination: PaginationDto;
 };
 
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type EndUserRoleAssignmentResponseDto = {
+    /**
+     * @description Role name now bound to the app membership.
+     * @type string
+     */
+    role_name: string;
+    /**
+     * @description Account UUID of the end-user whose role changed.
+     * @type string
+     */
+    user_id: string;
+};
+
 /**
  * Generated by Kubb (https://kubb.dev/).
  * Do not edit manually.
@@ -615,6 +770,11 @@ type EndUserSummaryDto = {
      * @type number
      */
     active_session_count: number;
+    /**
+     * @description How this person can sign in: `password` when a credential exists, plus each linked OAuth provider (`google`, `apple`, …). Empty means neither — an admin-created account that has not been sent a password reset cannot get in at all, and that is a real state rather than missing data.
+     * @type array
+     */
+    auth_providers: string[];
     /**
      * @type string, date-time
      */
@@ -631,6 +791,11 @@ type EndUserSummaryDto = {
      * @type string, date-time
      */
     email_verified_at: string | null;
+    /**
+     * @description Failed sign-ins in the last 30 days. Flagged at 3.
+     * @type number
+     */
+    failed_signins: number;
     /**
      * @type string
      */
@@ -639,10 +804,20 @@ type EndUserSummaryDto = {
      * @type string, date-time
      */
     joined_at: string | null;
+    /**
+     * @description Most recent audit-log entry with this user as the actor. Null means we have never recorded them doing anything — which is a different fact from \"no session\", and the one that tells you whether they ever got in.
+     * @type string, date-time
+     */
+    last_activity_at: string | null;
     /**
      * @type string, date-time
      */
     last_used_at: string | null;
+    /**
+     * @description Enabled auth factors (TOTP, email OTP).
+     * @type number
+     */
+    mfa_factor_count: number;
     /**
      * @type string
      */
@@ -651,10 +826,20 @@ type EndUserSummaryDto = {
      * @type string
      */
     status: EndUserSummaryDtoStatusEnumKey;
+    /**
+     * @description Set while a live session is locked out of step-up verification.
+     * @type string, date-time
+     */
+    step_up_locked_until: string | null;
     /**
      * @type string
      */
     username: string;
+    /**
+     * @description Verified email contacts, primary or not. Distinct from `emailVerifiedAt`, which is the primary contact only — the `unverified` filter accepts any verified email, so a renderer branching on `emailVerifiedAt` would disagree with it.
+     * @type number
+     */
+    verified_email_count: number;
 };
 
 /**
@@ -796,13 +981,28 @@ type EndUserInviteListResponseDto = {
  * Generated by Kubb (https://kubb.dev/).
  * Do not edit manually.
  */
+declare const authConfigResponseDtoMfaEnum: {
+    readonly optional: "optional";
+    readonly required: "required";
+};
+type AuthConfigResponseDtoMfaEnumKey = (typeof authConfigResponseDtoMfaEnum)[keyof typeof authConfigResponseDtoMfaEnum];
 declare const authConfigResponseDtoOauthLinkPolicyEnum: {
     readonly auto: "auto";
     readonly confirm: "confirm";
     readonly reject: "reject";
 };
 type AuthConfigResponseDtoOauthLinkPolicyEnumKey = (typeof authConfigResponseDtoOauthLinkPolicyEnum)[keyof typeof authConfigResponseDtoOauthLinkPolicyEnum];
+declare const authConfigResponseDtoPasswordBreachCheckEnum: {
+    readonly off: "off";
+    readonly warn: "warn";
+    readonly block: "block";
+};
+type AuthConfigResponseDtoPasswordBreachCheckEnumKey = (typeof authConfigResponseDtoPasswordBreachCheckEnum)[keyof typeof authConfigResponseDtoPasswordBreachCheckEnum];
 type AuthConfigResponseDto = {
+    /**
+     * @type number
+     */
+    access_token_minutes: number;
     /**
      * @type array
      */
@@ -818,11 +1018,23 @@ type AuthConfigResponseDto = {
     /**
      * @type number
      */
-    max_sessions: number;
+    max_sessions: number | null;
+    /**
+     * @type string
+     */
+    mfa: AuthConfigResponseDtoMfaEnumKey;
+    /**
+     * @type number
+     */
+    mfa_grace_days: number;
     /**
      * @type string
      */
     oauth_link_policy: AuthConfigResponseDtoOauthLinkPolicyEnumKey;
+    /**
+     * @type string
+     */
+    password_breach_check: AuthConfigResponseDtoPasswordBreachCheckEnumKey;
     /**
      * @type number
      */
@@ -866,21 +1078,37 @@ type AuthConfigResponseDto = {
  * Do not edit manually.
  */
 type UpdateAppDto = {
+    /**
+     * @description Days of `audit_log` history kept for this app. A nightly job deletes rows older than this. Minimum 30 days so an incident review always has a month to look at; maximum 3650 (10 years).
+     * @minLength 30
+     * @maxLength 3650
+     * @default 365
+     * @type number | undefined
+     */
+    audit_retention_days?: number;
     /**
      * @description New display name
      * @type string | undefined
      */
     display_name?: string;
     /**
-     * @description Arbitrary metadata attached to the app
+     * @description Your own key/value data for this app. It replaces the stored metadata, and keys are kept exactly as you send them. The `auth` key holds the app\'s sign-in settings, which you change with `PATCH /v1/apps/{appId}/auth-config` (it checks every value): leave `auth` out and it is kept as it is, or send it back unchanged. A different `auth` value is refused with 400 `AUTH_SETTINGS_IN_METADATA`.
      * @type object | undefined
      */
     metadata?: object;
     /**
-     * @description Rename the app\'s slug. The old slug remains resolvable for 30 days as a JWKS-URL alias so existing customer-side verifiers don\'t break instantly. Same shape as the create-slug: lowercase alphanumeric + hyphens, 3–48 chars.
+     * @description Rename the app\'s slug. The old slug remains resolvable for 30 days as a JWKS-URL alias so existing customer-side verifiers don\'t break instantly. Same shape as the create-slug: lowercase alphanumeric + hyphens, 3–48 chars, not shaped like a UUID.
      * @type string | undefined
      */
     slug?: string;
+    /**
+     * @description Days of outbound-webhook delivery-attempt history kept for this app. Attempts are a debugging aid rather than a compliance record, hence the shorter floor.
+     * @minLength 7
+     * @maxLength 365
+     * @default 30
+     * @type number | undefined
+     */
+    webhook_attempt_retention_days?: number;
 };
 
 /**
@@ -905,13 +1133,31 @@ type UpdateAppStatusDto = {
  * Generated by Kubb (https://kubb.dev/).
  * Do not edit manually.
  */
+declare const updateAuthConfigDtoMfaEnum: {
+    readonly optional: "optional";
+    readonly required: "required";
+};
+type UpdateAuthConfigDtoMfaEnumKey = (typeof updateAuthConfigDtoMfaEnum)[keyof typeof updateAuthConfigDtoMfaEnum];
 declare const updateAuthConfigDtoOauthLinkPolicyEnum: {
     readonly auto: "auto";
     readonly confirm: "confirm";
     readonly reject: "reject";
 };
 type UpdateAuthConfigDtoOauthLinkPolicyEnumKey = (typeof updateAuthConfigDtoOauthLinkPolicyEnum)[keyof typeof updateAuthConfigDtoOauthLinkPolicyEnum];
+declare const updateAuthConfigDtoPasswordBreachCheckEnum: {
+    readonly off: "off";
+    readonly warn: "warn";
+    readonly block: "block";
+};
+type UpdateAuthConfigDtoPasswordBreachCheckEnumKey = (typeof updateAuthConfigDtoPasswordBreachCheckEnum)[keyof typeof updateAuthConfigDtoPasswordBreachCheckEnum];
 type UpdateAuthConfigDto = {
+    /**
+     * @description EndUser access-token lifetime in minutes (5-60, default 60). Independent of `session_duration_minutes`: the session and its refresh token can live for days while the access token expires in minutes. An access token is never issued for longer than the session it belongs to has left. M2M (client-credentials) tokens are unaffected and keep their fixed one-hour lifetime.
+     * @minLength 5
+     * @maxLength 60
+     * @type number | undefined
+     */
+    access_token_minutes?: number;
     /**
      * @description Allowed origins for the `return_to` parameter on the OAuth web redirect callback. Exact origin match (scheme + host + port); no paths, no wildcards. Empty array disables the web redirect flow for this app. Prevents the callback from acting as an open-redirect.
      * @type array | undefined
@@ -923,24 +1169,41 @@ type UpdateAuthConfigDto = {
      */
     enforce_app_permissions?: boolean;
     /**
-     * @description Failed-login attempts before the EndUser account is locked.
+     * @description Consecutive failed signin attempts before an EndUser is locked out for 15 minutes. Applies to the signin lockout counters only; the separate short-burst limiter (5 attempts per identifier per minute) is fixed and not configurable.
      * @minLength 1
      * @maxLength 100
      * @type number | undefined
      */
     max_failed_login_attempts?: number;
     /**
-     * @description Maximum concurrent sessions per EndUser. Oldest is evicted on overflow.
+     * @description Maximum concurrent sessions per EndUser. When a signin would take the account past this number, the OLDEST session — the one created longest ago, not the one used longest ago — is revoked (audited as `auth.session.evicted`). Omit or send null for unlimited.
      * @minLength 1
      * @maxLength 50
+     * @type number
+     */
+    max_sessions?: number | null;
+    /**
+     * @description Whether every EndUser must hold an MFA factor. `optional` (default) leaves MFA per-user opt-in. `required` refuses to mint a session for a user with no enabled factor: sign-in answers `{ mfa_enrollment_required: true, mfa_token, expires_at }` and the user enrols via POST /{app_slug}/v1/auth/mfa/enroll. IMPORTANT: turning this on does NOT terminate sessions that are already live — existing users keep their session until it expires or is revoked and only meet the requirement on their next sign-in. Revoke sessions explicitly if the policy has to bite immediately.
+     * @type string | undefined
+     */
+    mfa?: UpdateAuthConfigDtoMfaEnumKey;
+    /**
+     * @description Grace window in days, measured from ACCOUNT CREATION, during which `mfa: required` still mints ordinary tokens. The sign-in response then also carries `mfa_enrollment_due_at` so a client can prompt rather than block. 0 (default) means no grace. Note the anchor: an app that turns the policy on with existing users will find every account older than the window is already past it.
+     * @minLength 0
+     * @maxLength 365
      * @type number | undefined
      */
-    max_sessions?: number;
+    mfa_grace_days?: number;
     /**
      * @description How to handle a federated sign-in (Apple, Google, …) that lands on a verified email already belonging to an account in this app. `confirm` (default) refuses to auto-link and surfaces `link_required` so the user signs in with their original method. `auto` silently links when the provider claims the email is verified AND the email is not a private relay. `reject` refuses outright. Private-relay emails never auto-link regardless.
      * @type string | undefined
      */
     oauth_link_policy?: UpdateAuthConfigDtoOauthLinkPolicyEnumKey;
+    /**
+     * @description Whether passwords are checked against a public breach corpus (HIBP Pwned Passwords, k-anonymity range API) before being accepted. `block` (default) rejects a breached password with 400 `PASSWORD_BREACHED`. `warn` accepts it and returns `password_warnings: [\"breached\"]` alongside the tokens. `off` disables the lookup entirely, so no outbound call is made. The lookup always fails open — a timeout or an unreachable corpus never blocks a signup. Only the first five characters of the password\'s SHA-1 ever leave the service.
+     * @type string | undefined
+     */
+    password_breach_check?: UpdateAuthConfigDtoPasswordBreachCheckEnumKey;
     /**
      * @description Minimum password length (NIST minimum is 8).
      * @minLength 8
@@ -1118,18 +1381,6 @@ type AssignRoleDto = {
     role: string;
 };
 
-/**
- * Generated by Kubb (https://kubb.dev/).
- * Do not edit manually.
- */
-type SetPermissionsDto = {
-    /**
-     * @description Array of permission strings in resource.action format
-     * @type array
-     */
-    permissions: string[];
-};
-
 /**
  * Generated by Kubb (https://kubb.dev/).
  * Do not edit manually.
@@ -1155,7 +1406,18 @@ type CreatePermissionDto = {
  * Generated by Kubb (https://kubb.dev/).
  * Do not edit manually.
  */
+declare const createApiKeyDtoExpiresInDaysEnum: {
+    readonly "30": 30;
+    readonly "90": 90;
+    readonly "365": 365;
+};
+type CreateApiKeyDtoExpiresInDaysEnumKey = (typeof createApiKeyDtoExpiresInDaysEnum)[keyof typeof createApiKeyDtoExpiresInDaysEnum];
 type CreateApiKeyDto = {
+    /**
+     * @description Lifetime of the key in days. Omit or send `null` for a key that never expires — the historical behaviour and still the default.
+     * @type number
+     */
+    expires_in_days?: CreateApiKeyDtoExpiresInDaysEnumKey | null;
     /**
      * @description Human-readable label for this key (shown in the API keys list).
      * @minLength 1
@@ -1194,23 +1456,18 @@ type UpdateM2MClientDto = {
     is_active?: boolean;
 };
 
-/**
- * Generated by Kubb (https://kubb.dev/).
- * Do not edit manually.
- */
-type SetScopesDto = {
-    /**
-     * @description Permission strings in resource.action format to assign as scopes
-     * @type array
-     */
-    permissions: string[];
-};
-
 /**
  * Generated by Kubb (https://kubb.dev/).
  * Do not edit manually.
  */
 
+declare const endUserInviteControllerListQueryParamsStatusEnum: {
+    readonly pending: "pending";
+    readonly revoked: "revoked";
+    readonly expired: "expired";
+    readonly used: "used";
+};
+type EndUserInviteControllerListQueryParamsStatusEnumKey = (typeof endUserInviteControllerListQueryParamsStatusEnum)[keyof typeof endUserInviteControllerListQueryParamsStatusEnum];
 type EndUserInviteControllerListQueryParams = {
     /**
      * @type string | undefined
@@ -1220,6 +1477,11 @@ type EndUserInviteControllerListQueryParams = {
      * @type string | undefined
      */
     cursor?: string;
+    /**
+     * @description Derived lifecycle state. `revoked` = explicitly revoked; `expired` = past `expires_at`; `used` = `use_count` has reached `max_uses`; `pending` = still redeemable. Evaluated with the same precedence the accept-invite path rejects in, so the filter and redemption always agree.
+     * @type string | undefined
+     */
+    status?: EndUserInviteControllerListQueryParamsStatusEnumKey;
 };
 
 /**
@@ -1243,6 +1505,29 @@ type AppControllerListMembersQueryParams = {
  * Do not edit manually.
  */
 
+declare const endUserControllerListEndUsersQueryParamsSignalEnum: {
+    readonly unverified: "unverified";
+    readonly failing_signin: "failing_signin";
+    readonly no_mfa: "no_mfa";
+    readonly locked: "locked";
+    readonly never_active: "never_active";
+};
+type EndUserControllerListEndUsersQueryParamsSignalEnumKey = (typeof endUserControllerListEndUsersQueryParamsSignalEnum)[keyof typeof endUserControllerListEndUsersQueryParamsSignalEnum];
+declare const endUserControllerListEndUsersQueryParamsSortEnum: {
+    readonly created: "created";
+    readonly joined: "joined";
+    readonly user: "user";
+    readonly status: "status";
+    readonly role: "role";
+    readonly sessions: "sessions";
+    readonly last_activity: "last_activity";
+};
+type EndUserControllerListEndUsersQueryParamsSortEnumKey = (typeof endUserControllerListEndUsersQueryParamsSortEnum)[keyof typeof endUserControllerListEndUsersQueryParamsSortEnum];
+declare const endUserControllerListEndUsersQueryParamsOrderEnum: {
+    readonly asc: "asc";
+    readonly desc: "desc";
+};
+type EndUserControllerListEndUsersQueryParamsOrderEnumKey = (typeof endUserControllerListEndUsersQueryParamsOrderEnum)[keyof typeof endUserControllerListEndUsersQueryParamsOrderEnum];
 type EndUserControllerListEndUsersQueryParams = {
     /**
      * @type string | undefined
@@ -1260,6 +1545,25 @@ type EndUserControllerListEndUsersQueryParams = {
      * @type string | undefined
      */
     search?: string;
+    /**
+     * @description Narrow to accounts carrying one risk signal. Each is a fact already recorded: `unverified` (no verified email contact), `failing_signin` (>= 3 failed sign-ins in 30d), `no_mfa` (no enabled auth factor), `locked` (a live session locked out of step-up), `never_active` (no audit-log entry at all).
+     * @type string | undefined
+     */
+    signal?: EndUserControllerListEndUsersQueryParamsSignalEnumKey;
+    /**
+     * @description Narrow to accounts that can sign in with this provider. `password` matches accounts with a password credential; any other value matches a linked OAuth identity.
+     * @type string | undefined
+     */
+    provider?: string;
+    /**
+     * @description Order the list. Nulls sort last in BOTH directions.
+     * @type string | undefined
+     */
+    sort?: EndUserControllerListEndUsersQueryParamsSortEnumKey;
+    /**
+     * @type string | undefined
+     */
+    order?: EndUserControllerListEndUsersQueryParamsOrderEnumKey;
 };
 
 /**
@@ -1284,6 +1588,16 @@ type AppAuditControllerGetAuditLogsQueryParams = {
      * @type string | undefined
      */
     actor_id?: string;
+    /**
+     * @description Inclusive lower bound on `created_at`. ISO-8601 date (`2026-05-01`, midnight UTC) or date-time (`2026-05-01T09:00:00Z`). Composes with `action` / `actor_id` / `until` and with the cursor.
+     * @type string | undefined, date-time
+     */
+    since?: string;
+    /**
+     * @description Inclusive upper bound on `created_at`. Same formats as `since`. Note a bare date resolves to midnight UTC, so `until=2026-05-01` excludes that day\'s later entries.
+     * @type string | undefined, date-time
+     */
+    until?: string;
 };
 
 /**
@@ -1316,6 +1630,11 @@ type RoleControllerListRolesQueryParams = {
      * @type string | undefined
      */
     cursor?: string;
+    /**
+     * @description Case-insensitive substring match on the role name. Composes with the cursor.
+     * @type string | undefined
+     */
+    search?: string;
 };
 
 declare class AppScope {
@@ -1353,7 +1672,7 @@ declare class AppScope {
         get: (userId: string) => Promise<EndUserSummaryDto>;
         update: (userId: string, data: UpdateEndUserDto) => Promise<EndUserSummaryDto>;
         delete: (userId: string) => Promise<any>;
-        updateRole: (userId: string, data: UpdateEndUserRoleDto) => Promise<any>;
+        updateRole: (userId: string, data: UpdateEndUserRoleDto) => Promise<EndUserRoleAssignmentResponseDto>;
         updateStatus: (userId: string, data: UpdateEndUserStatusDto) => Promise<EndUserSummaryDto>;
         /** Spec bug: appId missing in spec params (see callDirect). */
         revokeAllSessions: (userId: string) => Promise<void>;
@@ -1368,7 +1687,7 @@ declare class AppScope {
         /** Spec bug: appId missing in spec params (see callDirect). */
         delete: (roleName: string) => Promise<void>;
         assign: (data: AssignRoleDto) => Promise<AppMembershipResponseDto>;
-        setPermissions: (roleName: string, data: SetPermissionsDto) => Promise<any>;
+        setPermissions: (roleName: string, data: SetPermissionsDto) => Promise<RoleControllerSetPermissions200>;
         listPermissions: () => Promise<RoleControllerListPermissions200>;
     };
     readonly permissions: {
@@ -1385,10 +1704,10 @@ declare class AppScope {
         list: (params?: Partial<M2MControllerListClientsQueryParams>) => Promise<M2MClientListResponseDto>;
         create: (data: CreateM2MClientDto) => Promise<M2MClientCreateResponseDto>;
         get: (clientId: string) => Promise<M2MClientDetailResponseDto>;
-        update: (clientId: string, data: UpdateM2MClientDto) => Promise<any>;
+        update: (clientId: string, data: UpdateM2MClientDto) => Promise<M2MClientDetailResponseDto>;
         delete: (clientId: string) => Promise<any>;
         rotateSecret: (clientId: string) => Promise<M2MRotateSecretResponseDto>;
-        setScopes: (clientId: string, data: SetScopesDto) => Promise<any>;
+        setScopes: (clientId: string, data: SetScopesDto) => Promise<M2MControllerSetScopes200>;
     };
     readonly auditLogs: {
         list: (params?: Partial<AppAuditControllerGetAuditLogsQueryParams>) => Promise<AuditLogListResponseDto>;
@@ -1513,7 +1832,7 @@ type VerifyPrincipalDto = {
 
 type VerifyResponseDto = {
     /**
-     * @description Failure code on `valid: false` — e.g. `TOKEN_INVALID`, `TOKEN_EXPIRED`, `TOKEN_REVOKED`, `ACCOUNT_SUSPENDED`.
+     * @description Failure code on `valid: false`. `TOKEN_INVALID` — signature / issuer / audience / app mismatch, an `end_user` token with no `sid` claim, or an `end_user` token whose account row no longer exists. `TOKEN_EXPIRED` — the token\'s own `exp` has passed. `TOKEN_REVOKED` — the backing session was revoked (sign-out, password change, admin revoke) or its row no longer exists because the end user was deleted. `SESSION_EXPIRED` — the session row is past `expires_at`; the access token outlived the session that minted it. `ACCOUNT_SUSPENDED` — the account exists but its status is not `active`.
      * @type string | undefined
      */
     error?: string;
@@ -1522,7 +1841,7 @@ type VerifyResponseDto = {
      */
     principal?: VerifyPrincipalDto;
     /**
-     * @description True iff the signature, issuer, audience, and session are all valid.
+     * @description True iff the signature, issuer, audience AND the backing session are all valid. For `end_user` tokens the session must exist, be unrevoked and be unexpired, and the account row must still exist and be active — a deleted end user is never `valid: true`, even inside the access token\'s own `exp` window.
      * @type boolean
      */
     valid: boolean;
@@ -1532,70 +1851,159 @@ type VerifyResponseDto = {
  * Generated by Kubb (https://kubb.dev/).
  * Do not edit manually.
  */
-type ConsumerMfaChallengeFactorDto = {
+type IdpMfaEnrollmentRequiredResponseDto = {
     /**
-     * @type string
+     * @type string, date-time
      */
-    id: string;
+    expires_at: string;
     /**
-     * @type string
+     * @type boolean
      */
-    label: string | null;
+    mfa_enrollment_required: boolean;
     /**
-     * @description Factor type — currently `totp`; widens as new factor types ship.
+     * @description Single-use enrolment token. Not an access token: no session has been created. Complete via `POST /{app_slug}/v1/auth/mfa/enroll` then `/auth/mfa/enroll/verify`.
      * @type string
      */
-    type: string;
+    mfa_token: string;
 };
 
 /**
  * Generated by Kubb (https://kubb.dev/).
  * Do not edit manually.
  */
-
-type ConsumerMfaChallengeResponseDto = {
+type IdpNativeUserHintDto = {
     /**
-     * @description When the challenge expires (ISO 8601, UTC).
-     * @type string, date-time
+     * @type string | undefined
      */
-    expires_at: string;
+    email?: string;
     /**
-     * @description Factors the user can satisfy this challenge with (any-of).
-     * @type array
+     * @type string | undefined
      */
-    factors: ConsumerMfaChallengeFactorDto[];
+    name?: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
+type IdpNativeSigninDto = {
     /**
-     * @description Always `true` on this response. Distinguishes it from the normal token response shape.
-     * @type boolean
+     * @description Provider-issued ID token (JWT). For Apple, the value returned by `ASAuthorizationAppleIDCredential.identityToken` after UTF-8 decoding the data.
+     * @minLength 16
+     * @maxLength 8192
+     * @type string
      */
-    mfa_required: boolean;
+    id_token: string;
     /**
-     * @description Single-use challenge id. Pass back as `mfa_token` on `/auth/mfa/verify` or `/auth/mfa/recover` to complete the sign-in. 5-minute TTL.
+     * @description Raw nonce the client generated and SHA-256-hashed into the authorize request. Backend recomputes the hash and compares to the token\'s `nonce` claim. Must be at least 32 bytes of entropy (base64url-encoded ~43 chars).
+     * @minLength 16
+     * @maxLength 256
      * @type string
      */
-    mfa_token: string;
+    nonce: string;
+    /**
+     * @description Apple-specific first-signin payload: { name, email }. Persist for display only — the verified JWT is the source of truth.
+     */
+    user?: IdpNativeUserHintDto;
 };
 
 /**
  * Generated by Kubb (https://kubb.dev/).
  * Do not edit manually.
  */
-type ConsumerSigninDto = {
+declare const idpTokenResponseDtoTokenTypeEnum: {
+    readonly Bearer: "Bearer";
+};
+type IdpTokenResponseDtoTokenTypeEnumKey = (typeof idpTokenResponseDtoTokenTypeEnum)[keyof typeof idpTokenResponseDtoTokenTypeEnum];
+type IdpTokenResponseDto = {
     /**
-     * @description Username or verified primary email — either accepted. Secondary or unverified emails do not authenticate.
      * @type string
      */
-    identifier: string;
+    access_token: string;
     /**
-     * @description EndUser password.
+     * @description Lifetime of the access token in seconds.
+     * @type number
+     */
+    expires_in: number;
+    /**
+     * @description Present only when the app runs `mfa: \"required\"`, the user holds no enabled factor, and the account is still inside `mfa_grace_days` of its creation. Tokens ARE issued; this is the deadline after which federated sign-in starts returning `mfa_enrollment_required` instead.
+     * @type string | undefined, date-time
+     */
+    mfa_enrollment_due_at?: string;
+    /**
+     * @type string
+     */
+    refresh_token: string;
+    /**
+     * @type string
+     */
+    token_type: IdpTokenResponseDtoTokenTypeEnumKey;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
+declare const consumerIdpControllerNativeSignInPathParamsProviderEnum: {
+    readonly apple: "apple";
+    readonly google: "google";
+    readonly github: "github";
+};
+type ConsumerIdpControllerNativeSignInPathParamsProviderEnumKey = (typeof consumerIdpControllerNativeSignInPathParamsProviderEnum)[keyof typeof consumerIdpControllerNativeSignInPathParamsProviderEnum];
+/**
+ * @description Either a token pair or, when the app runs `auth_config.mfa: \"required\"` and the account holds no enabled factor, an enrolment demand (`mfa_enrollment_required: true`) with no session behind it. Branch on `mfa_enrollment_required`.
+ */
+type ConsumerIdpControllerNativeSignIn200 = IdpTokenResponseDto | IdpMfaEnrollmentRequiredResponseDto;
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type ConsumerAcceptInviteDto = {
+    /**
+     * @description Invite code from the invitation email (`inv_…`).
+     * @type string
+     */
+    code: string;
+    /**
+     * @description Optional display name shown back to the user.
+     * @type string | undefined
+     */
+    display_name?: string;
+    /**
+     * @description Password the accepter sets for their new account.
      * @type string
      */
     password: string;
     /**
-     * @description Optional tenant UUID. When set, the issued JWT carries `tid` + `trole` claims and the user must already be a member of that tenant — non-membership returns 403.
+     * @description Optional username override. Defaults to a derivation of the invite email local-part.
      * @type string | undefined
      */
-    tenant_id?: string;
+    username?: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type ConsumerMfaEnrollmentRequiredResponseDto = {
+    /**
+     * @description When the enrolment token expires (ISO 8601, UTC).
+     * @type string, date-time
+     */
+    expires_at: string;
+    /**
+     * @description Always `true` on this response. Distinguishes it from both the normal token response and the `mfa_required` challenge response.
+     * @type boolean
+     */
+    mfa_enrollment_required: boolean;
+    /**
+     * @description Single-use enrolment token. Pass back as `mfa_token` on `/auth/mfa/enroll` and `/auth/mfa/enroll/verify`. It is NOT an access token: it cannot call `/me/*`, cannot be refreshed, and is refused by `/auth/mfa/verify`, `/auth/mfa/send-code` and `/auth/mfa/recover`. No session exists yet. 10-minute TTL.
+     * @type string
+     */
+    mfa_token: string;
 };
 
 /**
@@ -1613,6 +2021,16 @@ type ConsumerTokenResponseDto = {
      * @type number
      */
     expires_in: number;
+    /**
+     * @description Present only when the app runs `mfa: \"required\"`, the user holds no enabled factor, and the account is still inside `mfa_grace_days` of its creation. The session IS minted; this is the deadline after which sign-in will start returning `mfa_enrollment_required` instead, so a client can prompt rather than block. Absent in every other case.
+     * @type string | undefined, date-time
+     */
+    mfa_enrollment_due_at?: string;
+    /**
+     * @description Non-fatal notes about the password that was just set. Present only on `signup` and `accept-invite`, and only when the app runs `password_breach_check: \"warn\"` and the password was found in a public breach corpus — the value is then `[\"breached\"]` and the session is minted anyway, so the client can prompt the user to change it. The key is ABSENT (not an empty array) when there is nothing to report; do not branch on its length without checking that it exists. Apps on the default `block` never see it — a breached password is refused with 400 `PASSWORD_BREACHED`.
+     * @type array | undefined
+     */
+    password_warnings?: string[];
     /**
      * @description Long-lived opaque-ish JWT used to mint a new access token via /auth/refresh. Rotated on use.
      * @type string
@@ -1630,9 +2048,94 @@ type ConsumerTokenResponseDto = {
  */
 
 /**
- * @description Either a normal token response or an MFA challenge — distinguish by `mfa_required`.
+ * @description Account created from the invite. A session was minted unless `mfa_enrollment_required` is present — branch on that flag.
  */
-type ConsumerAuthControllerSignin200 = ConsumerTokenResponseDto | ConsumerMfaChallengeResponseDto;
+type ConsumerAuthControllerAcceptInvite201 = ConsumerTokenResponseDto | ConsumerMfaEnrollmentRequiredResponseDto;
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type ConsumerMfaChallengeFactorDto = {
+    /**
+     * @description Email factors only: masked address codes are delivered to (e.g. `a***a@e***e.com`). Null / absent for other factor types.
+     * @type string
+     */
+    email_masked?: string | null;
+    /**
+     * @type string
+     */
+    id: string;
+    /**
+     * @type string
+     */
+    label: string | null;
+    /**
+     * @description Factor type — `totp`, `email` or `webauthn`; widens as new factor types ship. For `email`, request delivery via `POST /auth/mfa/send-code` before verifying. For `webauthn`, request assertion options via `POST /auth/mfa/webauthn/options`.
+     * @type string
+     */
+    type: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
+type ConsumerMfaChallengeResponseDto = {
+    /**
+     * @description When the challenge expires (ISO 8601, UTC).
+     * @type string, date-time
+     */
+    expires_at: string;
+    /**
+     * @description Factors the user can satisfy this challenge with (any-of).
+     * @type array
+     */
+    factors: ConsumerMfaChallengeFactorDto[];
+    /**
+     * @description Always `true` on this response. Distinguishes it from the normal token response shape.
+     * @type boolean
+     */
+    mfa_required: boolean;
+    /**
+     * @description Single-use challenge id. Pass back as `mfa_token` on `/auth/mfa/verify` or `/auth/mfa/recover` to complete the sign-in. 5-minute TTL.
+     * @type string
+     */
+    mfa_token: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type ConsumerSigninDto = {
+    /**
+     * @description Username or verified primary email — either accepted. Secondary or unverified emails do not authenticate.
+     * @type string
+     */
+    identifier: string;
+    /**
+     * @description EndUser password.
+     * @type string
+     */
+    password: string;
+    /**
+     * @description Optional tenant UUID. When set, the issued JWT carries `tid` + `trole` claims and the user must already be a member of that tenant — non-membership returns 403.
+     * @type string | undefined
+     */
+    tenant_id?: string;
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
+/**
+ * @description A normal token response, an MFA challenge, or an MFA enrolment demand — distinguish by `mfa_required` / `mfa_enrollment_required`. Neither flag present means a session was minted.
+ */
+type ConsumerAuthControllerSignin200 = ConsumerTokenResponseDto | ConsumerMfaChallengeResponseDto | ConsumerMfaEnrollmentRequiredResponseDto;
 
 /**
  * Generated by Kubb (https://kubb.dev/).
@@ -1650,12 +2153,12 @@ type ConsumerSignupDto = {
      */
     email: string;
     /**
-     * @description Password. Must satisfy the app-configured policy (default: 8+ chars).
+     * @description Password. Must satisfy the app-configured policy (default: 12+ chars, at least one uppercase letter and one digit), must not be on the common-password deny-list, and — unless the app sets `password_breach_check` to `off` or `warn` — must not appear in the public breach corpus.
      * @type string
      */
     password: string;
     /**
-     * @description Unique username inside the app. 3+ chars.
+     * @description Unique username inside the app. 3-32 characters: letters, numbers, dot, underscore, hyphen. No \"@\" — a username shaped like an email address would sit in front of that address at sign-in.
      * @type string
      */
     username: string;
@@ -1772,33 +2275,6 @@ type ConsumerVerifyDto = {
     code: string;
 };
 
-/**
- * Generated by Kubb (https://kubb.dev/).
- * Do not edit manually.
- */
-type ConsumerAcceptInviteDto = {
-    /**
-     * @description Invite code from the invitation email (`inv_…`).
-     * @type string
-     */
-    code: string;
-    /**
-     * @description Optional display name shown back to the user.
-     * @type string | undefined
-     */
-    display_name?: string;
-    /**
-     * @description Password the accepter sets for their new account.
-     * @type string
-     */
-    password: string;
-    /**
-     * @description Optional username override. Defaults to a derivation of the invite email local-part.
-     * @type string | undefined
-     */
-    username?: string;
-};
-
 /**
  * Generated by Kubb (https://kubb.dev/).
  * Do not edit manually.
@@ -1872,6 +2348,14 @@ type UpdateMeDto = {
      * @type string | undefined
      */
     display_name?: string;
+    /**
+     * @description New username. Unique per app, case-insensitive. 3-32 chars: letters, numbers, dot, underscore, hyphen. Omit to leave unchanged — cannot be cleared. 409 `USERNAME_TAKEN` when another account in the app holds it.
+     * @minLength 3
+     * @maxLength 32
+     * @pattern ^[a-zA-Z0-9._-]+$
+     * @type string | undefined
+     */
+    username?: string;
 };
 
 /**
@@ -1974,82 +2458,261 @@ type ClientCredentialsDto = {
  * Generated by Kubb (https://kubb.dev/).
  * Do not edit manually.
  */
-type IdpNativeUserHintDto = {
+type ConsumerPasskeyOptionsDto = {
     /**
-     * @type string | undefined
+     * @description Optional tenant to activate on the session the ceremony will mint, same semantics as `tenant_id` on `/auth/signin`.
+     * @type string | undefined, uuid
      */
-    email?: string;
-    /**
-     * @type string | undefined
-     */
-    name?: string;
+    tenant_id?: string;
 };
 
 /**
  * Generated by Kubb (https://kubb.dev/).
  * Do not edit manually.
  */
-
-type IdpNativeSigninDto = {
+type PublicFactorDto = {
+    /**
+     * @type string, date-time
+     */
+    created_at: string;
+    /**
+     * @type boolean
+     */
+    enabled: boolean;
+    /**
+     * @type string, date-time
+     */
+    enabled_at: string | null;
     /**
-     * @description Provider-issued ID token (JWT). For Apple, the value returned by `ASAuthorizationAppleIDCredential.identityToken` after UTF-8 decoding the data.
-     * @minLength 16
-     * @maxLength 8192
      * @type string
      */
-    id_token: string;
+    id: string;
     /**
-     * @description Raw nonce the client generated and SHA-256-hashed into the authorize request. Backend recomputes the hash and compares to the token\'s `nonce` claim. Must be at least 32 bytes of entropy (base64url-encoded ~43 chars).
-     * @minLength 16
-     * @maxLength 256
      * @type string
      */
-    nonce: string;
+    label: string | null;
     /**
-     * @description Apple-specific first-signin payload: { name, email }. Persist for display only — the verified JWT is the source of truth.
+     * @description Factor type — `totp` (authenticator app), `email` (single-use code delivered to a verified email contact), or `webauthn` (a passkey). Further factor types will extend this list without a breaking change to the response shape.
+     * @type string
      */
-    user?: IdpNativeUserHintDto;
+    type: string;
 };
 
 /**
  * Generated by Kubb (https://kubb.dev/).
  * Do not edit manually.
  */
-declare const idpTokenResponseDtoTokenTypeEnum: {
-    readonly Bearer: "Bearer";
-};
-type IdpTokenResponseDtoTokenTypeEnumKey = (typeof idpTokenResponseDtoTokenTypeEnum)[keyof typeof idpTokenResponseDtoTokenTypeEnum];
-type IdpTokenResponseDto = {
+
+type ConfirmEnrollmentResponseDto = {
     /**
-     * @type string
+     * @type object
      */
-    access_token: string;
+    factor: PublicFactorDto;
     /**
-     * @description Lifetime of the access token in seconds.
-     * @type number
+     * @description Single-use recovery codes for this account. Shown once — store them now.
+     * @type array
      */
-    expires_in: number;
+    recovery_codes: string[];
+};
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type StepUpResponseDto = {
     /**
-     * @type string
+     * @type array
      */
-    refresh_token: string;
+    amr: string[];
     /**
-     * @type string
+     * @type string, date-time
      */
-    token_type: IdpTokenResponseDtoTokenTypeEnumKey;
+    mfa_at: string;
 };
 
 /**
- * Generated by Kubb (https://kubb.dev/).
- * Do not edit manually.
+ * Passkey (WebAuthn) helpers — the encoding layer and the browser bridge.
+ *
+ * WebAuthn speaks ArrayBuffer; the Auth API speaks JSON. Every buffer
+ * crossing the wire is **base64url** (`-` `_`, no `=` padding), and
+ * getting the alphabet or the padding wrong produces a signature
+ * failure rather than a parse error. These four functions are a
+ * straight port of section 2 of the passkeys guide, exported for
+ * customers who want the pieces; `consumer(slug).passkeys.*` composes
+ * them into one call per ceremony.
+ *
+ * Nothing in this module touches `navigator`, `window` or any other
+ * browser global at import time — the package must load cleanly in a
+ * Node process (BFFs verify tokens with it). Browser globals are read
+ * lazily, inside the functions that need them.
+ *
+ * Wire shape: snake_case everywhere EXCEPT the members of
+ * `credential.response` (`clientDataJSON`, `attestationObject`,
+ * `authenticatorData`, `signature`, `userHandle`). Those names are
+ * fixed by the WebAuthn spec and travel verbatim — they are not ours
+ * to rename.
+ */
+/** ArrayBuffer / typed array → base64url string (no `+`, `/` or `=`). */
+declare function toB64u(buf: ArrayBuffer | ArrayBufferView): string;
+/** base64url string → bytes. Tolerates missing padding. */
+declare function fromB64u(s: string): Uint8Array;
+/**
+ * The `public_key` object Auth returns from an options call, with
+ * every buffer base64url-encoded. Mirrors
+ * `PublicKeyCredentialCreationOptions` / `PublicKeyCredentialRequestOptions`
+ * from the WebAuthn spec, minus the ArrayBuffers.
+ */
+interface PasskeyPublicKeyOptions {
+    challenge: string;
+    user?: {
+        id: string;
+        [k: string]: unknown;
+    };
+    excludeCredentials?: Array<{
+        id: string;
+        [k: string]: unknown;
+    }>;
+    allowCredentials?: Array<{
+        id: string;
+        [k: string]: unknown;
+    }>;
+    [k: string]: unknown;
+}
+/**
+ * Auth returns `public_key` with every buffer base64url-encoded;
+ * `navigator.credentials` wants real ArrayBuffers. Decodes
+ * `challenge`, `user.id`, and the `id` of every entry in
+ * `excludeCredentials` / `allowCredentials`; everything else passes
+ * through with its value untouched.
+ *
+ * Accepts the member names either as the WebAuthn spec writes them
+ * (`rpId`, `pubKeyCredParams`) or as the Auth wire convention
+ * decamelizes them (`rp_id`, `pub_key_cred_params`) and always emits
+ * the spec's camelCase, which is the only shape the browser accepts.
  */
-
-declare const consumerIdpControllerNativeSignInPathParamsProviderEnum: {
-    readonly apple: "apple";
-    readonly google: "google";
-    readonly github: "github";
-};
-type ConsumerIdpControllerNativeSignInPathParamsProviderEnumKey = (typeof consumerIdpControllerNativeSignInPathParamsProviderEnum)[keyof typeof consumerIdpControllerNativeSignInPathParamsProviderEnum];
+/**
+ * Decoded options are typed loosely ON PURPOSE. The exact browser types
+ * (`PublicKeyCredentialCreationOptions` / `PublicKeyCredentialRequestOptions`)
+ * live in lib.dom, which this package does not depend on so that it keeps
+ * loading in Node. An `any` here is what lets a lib.dom customer write
+ * `navigator.credentials.create({ publicKey: decodeOptions(pk) })` with no
+ * cast — a structural return type could never satisfy the DOM's required
+ * members without depending on them.
+ */
+type PasskeyDecodedOptions = any;
+declare function decodeOptions(publicKey: PasskeyPublicKeyOptions | Record<string, unknown>): PasskeyDecodedOptions;
+/**
+ * Structural shape of a `PublicKeyCredential` — the DOM type without
+ * needing the DOM lib. A real `PublicKeyCredential` (from
+ * `navigator.credentials.create()` / `.get()`) satisfies it.
+ */
+interface PasskeyCredentialLike {
+    id: string;
+    response: {
+        clientDataJSON: ArrayBuffer;
+        attestationObject?: ArrayBuffer;
+        authenticatorData?: ArrayBuffer;
+        signature?: ArrayBuffer;
+        userHandle?: ArrayBuffer | null;
+    };
+}
+/**
+ * The `credential` object every verify endpoint accepts. `response`
+ * members keep their WebAuthn names verbatim.
+ */
+interface EncodedPasskeyCredential {
+    id: string;
+    response: {
+        clientDataJSON: string;
+        attestationObject?: string;
+        authenticatorData?: string;
+        signature?: string;
+        userHandle?: string;
+    };
+}
+/**
+ * …and the reverse, for the credential you send back. Only the
+ * members present on the response are emitted: an attestation
+ * (enrol) carries `attestationObject`; an assertion (sign-in /
+ * step-up) carries `authenticatorData` + `signature` (+ `userHandle`
+ * when the authenticator supplies one).
+ */
+declare function encodeCredential(cred: PasskeyCredentialLike): EncodedPasskeyCredential;
+/**
+ * Minimal view of `navigator.credentials`, typed structurally so the
+ * package compiles without the DOM lib and so tests can inject a
+ * stand-in.
+ */
+interface PasskeyCredentialsContainer {
+    create(options?: {
+        publicKey?: unknown;
+        signal?: AbortSignal;
+    }): Promise<unknown>;
+    get(options?: {
+        publicKey?: unknown;
+        mediation?: PasskeyMediation;
+        signal?: AbortSignal;
+    }): Promise<unknown>;
+}
+/** `CredentialMediationRequirement` from the Credential Management spec. */
+type PasskeyMediation = "silent" | "optional" | "conditional" | "required";
+type PasskeyErrorCode = 
+/** No WebAuthn in this environment — see {@link isPasskeySupported}. */
+"unsupported"
+/** The user dismissed the prompt, or no passkey matched (`NotAllowedError`). */
+ | "cancelled"
+/** The prompt ran out of time — the options' `timeout` or your `signal` fired (`TimeoutError`). */
+ | "timeout"
+/** The authenticator refused (e.g. credential already registered — `InvalidStateError`). */
+ | "invalid_state"
+/** The page origin does not match the app's `rp_id` (`SecurityError`). */
+ | "security"
+/** The browser returned no credential without throwing. */
+ | "no_credential"
+/** Any other `navigator.credentials` failure; `cause` carries the original. */
+ | "unknown";
+/**
+ * Thrown by the ceremony helpers when the *browser* side fails. HTTP
+ * failures from Auth keep surfacing as `AuthHttpError` so a caller can
+ * tell "the user cancelled" from "the server said 401".
+ */
+declare class PasskeyError extends Error {
+    readonly code: PasskeyErrorCode;
+    readonly cause?: unknown;
+    constructor(code: PasskeyErrorCode, message: string, cause?: unknown);
+}
+/**
+ * `true` when this environment can run a passkey ceremony: a
+ * `window` with `PublicKeyCredential`, `navigator.credentials.create`
+ * / `.get`, and a secure context (https, or http on localhost).
+ * Always `false` in Node — use it to hide the button rather than
+ * showing one that throws. Never throws itself.
+ */
+declare function isPasskeySupported(): boolean;
+interface PasskeyBrowserOptions {
+    /** Abort the browser prompt (e.g. on route change). */
+    signal?: AbortSignal;
+    /**
+     * Override `navigator.credentials` — for tests, or non-browser
+     * runtimes that expose a compatible container. Defaults to the
+     * global one, read at call time.
+     */
+    credentials?: PasskeyCredentialsContainer;
+}
+/**
+ * `navigator.credentials.create()` with base64url handled: takes the
+ * `public_key` from an Auth enrolment response, returns the encoded
+ * `credential` to POST back. Throws {@link PasskeyError}.
+ */
+declare function createPasskeyCredential(publicKey: PasskeyPublicKeyOptions | Record<string, unknown>, opts?: PasskeyBrowserOptions): Promise<EncodedPasskeyCredential>;
+/**
+ * `navigator.credentials.get()` with base64url handled: takes the
+ * `public_key` from an Auth options response, returns the encoded
+ * `credential` to POST back. Throws {@link PasskeyError}.
+ */
+declare function getPasskeyCredential(publicKey: PasskeyPublicKeyOptions | Record<string, unknown>, opts?: PasskeyBrowserOptions & {
+    mediation?: PasskeyMediation;
+}): Promise<EncodedPasskeyCredential>;
 
 /**
  * In-process JWKS cache for a single app's `/.well-known/jwks.json`.
@@ -2330,7 +2993,7 @@ declare class ConsumerScope {
          * provisions the EndUser. Public — the caller is unauthenticated
          * until the invite is accepted.
          */
-        acceptInvite: (data: ConsumerAcceptInviteDto) => Promise<ConsumerTokenResponseDto>;
+        acceptInvite: (data: ConsumerAcceptInviteDto) => Promise<ConsumerAuthControllerAcceptInvite201>;
         /**
          * Sign in / sign up with a provider ID token (native flow).
          *
@@ -2366,7 +3029,7 @@ declare class ConsumerScope {
             id_token: IdpNativeSigninDto["id_token"];
             nonce: IdpNativeSigninDto["nonce"];
             user?: IdpNativeSigninDto["user"];
-        }) => Promise<IdpTokenResponseDto>;
+        }) => Promise<ConsumerIdpControllerNativeSignIn200>;
     };
     readonly me: {
         getProfile: () => Promise<unknown>;
@@ -2388,6 +3051,82 @@ declare class ConsumerScope {
         authorize: (data: AuthorizeBody) => Promise<AuthorizeResponseDto>;
         authorizeBatch: (data: AuthorizeBatchBody) => Promise<AuthorizeBatchResponseDto>;
     };
+    readonly passkeys: {
+        /**
+         * Enrol a passkey as an MFA factor for the signed-in end-user.
+         * Requires the scope to carry the user's access token
+         * (`new Auth({ auth: { type: "bearer", token } })`).
+         *
+         * `POST /me/mfa/factors { type: "webauthn" }` →
+         * `navigator.credentials.create()` →
+         * `POST /me/mfa/factors/:id/verify { credential }`.
+         *
+         * Resolves with the now-enabled factor and the user's recovery
+         * codes — show those once, they are not retrievable later. The
+         * factor stays disabled until the verify call succeeds, so an
+         * abandoned prompt leaves nothing usable behind.
+         */
+        enroll: (opts?: PasskeyBrowserOptions & {
+            label?: string;
+        }) => Promise<ConfirmEnrollmentResponseDto>;
+        /**
+         * Passwordless sign-in with a discoverable passkey. No password,
+         * no email address: the authenticator finds its own passkey for
+         * the app's rp_id.
+         *
+         * `POST /auth/passkey/options {}` → `navigator.credentials.get()`
+         * → `POST /auth/passkey/verify { credential }`.
+         *
+         * Resolves with the session (`access_token`, `refresh_token`,
+         * …; `amr: ["webauthn"]`). Rejects with `PasskeyError`
+         * (`code: "cancelled"`) when the user dismisses the prompt or no
+         * passkey matches, and with `AuthHttpError` 401 for a forged,
+         * unknown, replayed or expired assertion — the server answers
+         * those uniformly on purpose.
+         *
+         * The options call deliberately takes no identifier (it would be
+         * an account-existence oracle); `tenant_id` is the only
+         * accepted body member and only matters for multi-tenant apps.
+         * Pass `mediation: "conditional"` for autofill-style UI.
+         */
+        signIn: (opts?: PasskeyBrowserOptions & {
+            mediation?: PasskeyMediation;
+            tenant_id?: ConsumerPasskeyOptionsDto["tenant_id"];
+        }) => Promise<ConsumerTokenResponseDto>;
+        /**
+         * Satisfy the MFA step of a password sign-in with a passkey.
+         * Call it when `auth.signin()` answered
+         * `{ mfa_required: true, mfa_token, factors }` and `factors`
+         * contains a `webauthn` entry.
+         *
+         * `POST /auth/mfa/webauthn/options { mfa_token }` →
+         * `navigator.credentials.get()` →
+         * `POST /auth/mfa/verify { mfa_token, credential }`.
+         *
+         * Resolves with the session (`amr: ["pwd", "webauthn"]`, fresh
+         * `mfa_at`). Possession of the `mfa_token` — a correct password
+         * — is the authority for the options call.
+         */
+        completeMfaChallenge: (args: PasskeyBrowserOptions & {
+            mfa_token: string;
+            mediation?: PasskeyMediation;
+        }) => Promise<ConsumerTokenResponseDto>;
+        /**
+         * Re-confirm the signed-in user's identity inside a live session
+         * (before a sensitive action). Requires the scope to carry the
+         * user's access token.
+         *
+         * `POST /me/mfa/step-up/webauthn/options` →
+         * `navigator.credentials.get()` →
+         * `POST /me/mfa/step-up { credential }`.
+         *
+         * Resolves with `{ amr, mfa_at }`. A passkey assertion is never
+         * tried as a recovery code, so a failed step-up never burns one.
+         */
+        stepUp: (opts?: PasskeyBrowserOptions & {
+            mediation?: PasskeyMediation;
+        }) => Promise<StepUpResponseDto>;
+    };
     readonly oauth: {
         clientCredentials: (data: ClientCredentialsDto) => Promise<OAuthTokenResponseDto>;
     };
@@ -2397,6 +3136,12 @@ declare class ConsumerScope {
  * Generated by Kubb (https://kubb.dev/).
  * Do not edit manually.
  */
+declare const createAppDtoEnvironmentEnum: {
+    readonly production: "production";
+    readonly staging: "staging";
+    readonly development: "development";
+};
+type CreateAppDtoEnvironmentEnumKey = (typeof createAppDtoEnvironmentEnum)[keyof typeof createAppDtoEnvironmentEnum];
 type CreateAppDto = {
     /**
      * @description Display name shown in the console.
@@ -2405,6 +3150,12 @@ type CreateAppDto = {
      * @type string
      */
     display_name: string;
+    /**
+     * @description Which environment this app is. Omit for `production` — the historical behaviour and the value every existing app has. Cannot be changed later; clone the app instead.
+     * @default "production"
+     * @type string | undefined
+     */
+    environment?: CreateAppDtoEnvironmentEnumKey;
     /**
      * @description URL-friendly app slug (lowercase letters, digits, hyphens).
      * @minLength 3
@@ -2426,17 +3177,20 @@ type CreateAppDto = {
 
 type AppControllerListMyAppsQueryParams = {
     /**
+     * @description Limit the result to this one workspace (UUID). The caller must be a member; an id the caller does not belong to returns nothing. Omit to cover every workspace the caller belongs to.
      * @type string | undefined
      */
-    limit?: string;
+    workspace_id?: string;
     /**
+     * @description Page size (default 20, max 100).
      * @type string | undefined
      */
-    cursor?: string;
+    limit?: string;
     /**
+     * @description Opaque `next_cursor` from the previous page.
      * @type string | undefined
      */
-    workspace_id?: string;
+    cursor?: string;
 };
 
 /**
@@ -2446,6 +3200,7 @@ type AppControllerListMyAppsQueryParams = {
 
 type StatsControllerGetMyStatsQueryParams = {
     /**
+     * @description Limit the result to this one workspace (UUID). The caller must be a member; an id the caller does not belong to returns nothing. Omit to cover every workspace the caller belongs to.
      * @type string | undefined
      */
     workspace_id?: string;
@@ -2507,6 +3262,25 @@ declare class JwksFetchError extends JwtVerifyError {
     });
 }
 
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+type WebauthnCredentialDto = {
+    /**
+     * @description base64url credential id (`PublicKeyCredential.id`).
+     * @type string
+     */
+    id: string;
+    /**
+     * @description The `response` member, with `clientDataJSON` + `attestationObject` (registration) or `clientDataJSON` + `authenticatorData` + `signature` + `userHandle` (assertion), each base64url-encoded.
+     * @type object
+     */
+    response: {
+        [key: string]: any;
+    };
+};
+
 interface AuthConfig extends PCClientConfig {
     /** Per-app JWKS cache lifetime in ms. Default 10 minutes. */
     jwksTtlMs?: number;
@@ -2545,4 +3319,4 @@ declare class Auth {
     };
 }
 
-export { AUTH_LEGACY_ISSUER, AppScope, type AssignRoleDto, Auth, type AuthClaims, type AuthConfig, AuthHttpError, type AuthorizeBatchBody, type AuthorizeBody, type ClientCredentialsDto, type ConsumerAcceptInviteDto, type ConsumerLogoutDto, type ConsumerRefreshDto, type ConsumerRequestPasswordResetDto, type ConsumerResetPasswordDto, ConsumerScope, type ConsumerSigninDto, type ConsumerSignupDto, type ConsumerTokenResponseDto, type CreateApiKeyDto, type CreateAppDto, type CreateEndUserInviteDto, type CreateM2MClientDto, type CreatePermissionDto, type CreateRoleDto, type EndUserInviteResponseDto, type IdpNativeSigninDto, type IdpNativeUserHintDto, type IdpTokenResponseDto, JwksCache, JwksFetchError, JwksKeyNotFoundError, JwtAudienceMismatchError, JwtExpiredError, JwtInvalidError, JwtIssuerMismatchError, JwtNotYetValidError, JwtVerifyError, type SetPermissionsDto, type SetScopesDto, type UpdateAppDto, type UpdateAppStatusDto, type UpdateAuthConfigDto, type UpdateEndUserDto, type UpdateEndUserRoleDto, type UpdateEndUserStatusDto, type UpdateM2MClientDto, type UpdateMeDto, type UpdateRoleDto, type VerifyBody, type VerifyOptions, verifyAuthToken };
+export { AUTH_LEGACY_ISSUER, AppScope, type AssignRoleDto, Auth, type AuthClaims, type AuthConfig, AuthHttpError, type AuthorizeBatchBody, type AuthorizeBody, type ClientCredentialsDto, type ConfirmEnrollmentResponseDto, type ConsumerAcceptInviteDto, type ConsumerLogoutDto, type ConsumerRefreshDto, type ConsumerRequestPasswordResetDto, type ConsumerResetPasswordDto, ConsumerScope, type ConsumerSigninDto, type ConsumerSignupDto, type ConsumerTokenResponseDto, type CreateApiKeyDto, type CreateAppDto, type CreateEndUserInviteDto, type CreateM2MClientDto, type CreatePermissionDto, type CreateRoleDto, type EncodedPasskeyCredential, type EndUserInviteResponseDto, type IdpNativeSigninDto, type IdpNativeUserHintDto, type IdpTokenResponseDto, JwksCache, JwksFetchError, JwksKeyNotFoundError, JwtAudienceMismatchError, JwtExpiredError, JwtInvalidError, JwtIssuerMismatchError, JwtNotYetValidError, JwtVerifyError, type PasskeyBrowserOptions, type PasskeyCredentialLike, type PasskeyCredentialsContainer, type PasskeyDecodedOptions, PasskeyError, type PasskeyErrorCode, type PasskeyMediation, type PasskeyPublicKeyOptions, type PublicFactorDto, type SetPermissionsDto, type SetScopesDto, type StepUpResponseDto, type UpdateAppDto, type UpdateAppStatusDto, type UpdateAuthConfigDto, type UpdateEndUserDto, type UpdateEndUserRoleDto, type UpdateEndUserStatusDto, type UpdateM2MClientDto, type UpdateMeDto, type UpdateRoleDto, type VerifyBody, type VerifyOptions, type WebauthnCredentialDto, createPasskeyCredential, decodeOptions, encodeCredential, fromB64u, getPasskeyCredential, isPasskeySupported, toB64u, verifyAuthToken };