@productcraft/auth 0.8.4 → 0.9.0

package/dist/index.d.cts

@@ -29,18 +29,31 @@ type PlatformUserStatsResponseDto = {
  * Generated by Kubb (https://kubb.dev/).
  * Do not edit manually.
  */
-declare const appResponseDtoEnvironmentEnum: {
+declare const appEnvironmentEnum: {
     readonly production: "production";
     readonly staging: "staging";
     readonly development: "development";
 };
-type AppResponseDtoEnvironmentEnumKey = (typeof appResponseDtoEnvironmentEnum)[keyof typeof appResponseDtoEnvironmentEnum];
-declare const appResponseDtoStatusEnum: {
+type AppEnvironmentEnumKey = (typeof appEnvironmentEnum)[keyof typeof appEnvironmentEnum];
+type AppEnvironment = AppEnvironmentEnumKey;
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+declare const appStatusEnum: {
     readonly active: "active";
     readonly suspended: "suspended";
     readonly archived: "archived";
 };
-type AppResponseDtoStatusEnumKey = (typeof appResponseDtoStatusEnum)[keyof typeof appResponseDtoStatusEnum];
+type AppStatusEnumKey = (typeof appStatusEnum)[keyof typeof appStatusEnum];
+type AppStatus = AppStatusEnumKey;
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
 type AppResponseDto = {
     /**
      * @description Days of `audit_log` history kept for this app. A nightly job deletes rows older than this. 30-3650.
@@ -48,6 +61,7 @@ type AppResponseDto = {
      */
     audit_retention_days: number;
     /**
+     * @description When the app was created (ISO 8601).
      * @type string, date-time
      */
     created_at: string;
@@ -57,31 +71,37 @@ type AppResponseDto = {
      */
     created_by: string;
     /**
+     * @description Human-readable name of the app.
      * @type string
      */
     display_name: string;
     /**
      * @description Which environment this app IS. One app is one environment — there is no switch; a staging app is a separate app created via `POST /v1/apps/:appId/clone`. Set at create time and never changed afterwards. Every app that predates this field is `production`.
-     * @type string
      */
-    environment: AppResponseDtoEnvironmentEnumKey;
+    environment: AppEnvironment;
     /**
+     * @description Unique identifier of the app.
      * @type string
      */
     id: string;
     /**
+     * @description Free-form JSON object you attach to the app; returned as stored.
      * @type object
      */
-    metadata: object;
+    metadata: {
+        [key: string]: any;
+    };
     /**
+     * @description URL-safe identifier of the app, unique within its parent.
      * @type string
      */
     slug: string;
     /**
-     * @type string
+     * @description App status: `active`, `suspended` (sign-ins refused) or `archived`.
      */
-    status: AppResponseDtoStatusEnumKey;
+    status: AppStatus;
     /**
+     * @description When the app was last changed (ISO 8601).
      * @type string, date-time
      */
     updated_at: string;
@@ -121,6 +141,7 @@ type PaginationDto = {
 
 type AppListResponseDto = {
     /**
+     * @description The app items on this page.
      * @type array
      */
     data: AppResponseDto[];
@@ -194,7 +215,9 @@ type AuditLogEntryDto = {
      * @description Free-form structured detail object captured at log time (e.g. `{ \"from\": \"bcrypt\", \"to\": \"argon2id\" }` on `auth.password.upgraded`). This is the `metadata` key on the wire.
      * @type object
      */
-    metadata: object | null;
+    metadata: {
+        [key: string]: any;
+    } | null;
     /**
      * @description Resource type touched (e.g. `app_membership`, `role`, `account`).
      * @type string
@@ -219,6 +242,7 @@ type AuditLogEntryDto = {
 
 type AuditLogListResponseDto = {
     /**
+     * @description The audit log items on this page.
      * @type array
      */
     data: AuditLogEntryDto[];
@@ -234,10 +258,12 @@ type AuditLogListResponseDto = {
  */
 type M2MScopeEntryDto = {
     /**
+     * @description Action half of the permission key (`resource.action`).
      * @type string
      */
     action: string;
     /**
+     * @description Resource half of the permission key (`resource.action`).
      * @type string
      */
     resource: string;
@@ -271,6 +297,7 @@ type M2MControllerSetScopes200 = M2MScopeEntryDto[];
  */
 type M2MRotateSecretResponseDto = {
     /**
+     * @description The M2M client id (used as `client_id` in the client-credentials grant).
      * @type string
      */
     client_id: string;
@@ -288,34 +315,42 @@ type M2MRotateSecretResponseDto = {
 
 type M2MClientDetailResponseDto = {
     /**
+     * @description The Auth app the M2M client belongs to.
      * @type string
      */
     app_id: string;
     /**
+     * @description The M2M client id (used as `client_id` in the client-credentials grant).
      * @type string
      */
     client_id: string;
     /**
+     * @description When the M2M client was created (ISO 8601).
      * @type string, date-time
      */
     created_at: string;
     /**
+     * @description Unique identifier of the M2M client.
      * @type string
      */
     id: string;
     /**
+     * @description Whether the client can obtain tokens.
      * @type boolean
      */
     is_active: boolean;
     /**
+     * @description When the M2M client was last used (ISO 8601), or `null` if never.
      * @type string, date-time
      */
     last_used_at: string | null;
     /**
+     * @description Name of the M2M client.
      * @type string
      */
     name: string;
     /**
+     * @description Scopes granted to the M2M client.
      * @type array
      */
     scopes: M2MScopeEntryDto[];
@@ -327,6 +362,7 @@ type M2MClientDetailResponseDto = {
  */
 type M2MClientCreateResponseDto = {
     /**
+     * @description The M2M client id (used as `client_id` in the client-credentials grant).
      * @type string
      */
     client_id: string;
@@ -336,14 +372,17 @@ type M2MClientCreateResponseDto = {
      */
     client_secret: string;
     /**
+     * @description When the M2M client was created (ISO 8601).
      * @type string, date-time
      */
     created_at: string;
     /**
+     * @description Unique identifier of the M2M client.
      * @type string
      */
     id: string;
     /**
+     * @description Name of the M2M client.
      * @type string
      */
     name: string;
@@ -355,30 +394,37 @@ type M2MClientCreateResponseDto = {
  */
 type M2MClientSummaryDto = {
     /**
+     * @description The Auth app the M2M client belongs to.
      * @type string
      */
     app_id: string;
     /**
+     * @description The M2M client id (used as `client_id` in the client-credentials grant).
      * @type string
      */
     client_id: string;
     /**
+     * @description When the M2M client was created (ISO 8601).
      * @type string, date-time
      */
     created_at: string;
     /**
+     * @description Unique identifier of the M2M client.
      * @type string
      */
     id: string;
     /**
+     * @description Whether the client can obtain tokens.
      * @type boolean
      */
     is_active: boolean;
     /**
+     * @description When the M2M client was last used (ISO 8601), or `null` if never.
      * @type string, date-time
      */
     last_used_at: string | null;
     /**
+     * @description Name of the M2M client.
      * @type string
      */
     name: string;
@@ -391,6 +437,7 @@ type M2MClientSummaryDto = {
 
 type M2MClientListResponseDto = {
     /**
+     * @description The M2M client items on this page.
      * @type array
      */
     data: M2MClientSummaryDto[];
@@ -406,6 +453,7 @@ type M2MClientListResponseDto = {
  */
 type CreateApiKeyResponseDto = {
     /**
+     * @description When the API key was created (ISO 8601).
      * @type string, date-time
      */
     created_at: string;
@@ -445,14 +493,22 @@ type CreateApiKeyResponseDto = {
  * Generated by Kubb (https://kubb.dev/).
  * Do not edit manually.
  */
-declare const apiKeySummaryDtoStatusEnum: {
+declare const apiKeyStatusEnum: {
     readonly active: "active";
     readonly expired: "expired";
     readonly revoked: "revoked";
 };
-type ApiKeySummaryDtoStatusEnumKey = (typeof apiKeySummaryDtoStatusEnum)[keyof typeof apiKeySummaryDtoStatusEnum];
+type ApiKeyStatusEnumKey = (typeof apiKeyStatusEnum)[keyof typeof apiKeyStatusEnum];
+type ApiKeyStatus = ApiKeyStatusEnumKey;
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
 type ApiKeySummaryDto = {
     /**
+     * @description When the API key was created (ISO 8601).
      * @type string, date-time
      */
     created_at: string;
@@ -462,6 +518,7 @@ type ApiKeySummaryDto = {
      */
     expires_at: string | null;
     /**
+     * @description Unique identifier of the API key.
      * @type string
      */
     id: string;
@@ -471,18 +528,22 @@ type ApiKeySummaryDto = {
      */
     key_prefix: string;
     /**
+     * @description When the API key was last used (ISO 8601), or `null` if never.
      * @type string, date-time
      */
     last_used_at: string | null;
     /**
+     * @description Name of the API key.
      * @type string
      */
     name: string;
     /**
+     * @description Permission keys (`resource.action`) the API key is scoped to.
      * @type array
      */
     permissions: string[];
     /**
+     * @description When the API key was revoked (ISO 8601), or `null` while it is active.
      * @type string, date-time
      */
     revoked_at: string | null;
@@ -498,9 +559,8 @@ type ApiKeySummaryDto = {
     rotated_from: string | null;
     /**
      * @description Lifecycle state at the time of the request. `active` keys authenticate; `expired` and `revoked` ones do not. Revoked wins over expired.
-     * @type string
      */
-    status: ApiKeySummaryDtoStatusEnumKey;
+    status: ApiKeyStatus;
 };
 
 /**
@@ -510,6 +570,7 @@ type ApiKeySummaryDto = {
 
 type ApiKeyListResponseDto = {
     /**
+     * @description The API key items on this page.
      * @type array
      */
     data: ApiKeySummaryDto[];
@@ -525,6 +586,7 @@ type ApiKeyListResponseDto = {
  */
 type PermissionDto = {
     /**
+     * @description Action half of the permission key (`resource.action`).
      * @type string
      */
     action: string;
@@ -534,6 +596,7 @@ type PermissionDto = {
      */
     app_id: string | null;
     /**
+     * @description When the permission was created (ISO 8601).
      * @type string, date-time
      */
     created_at: string;
@@ -548,6 +611,7 @@ type PermissionDto = {
      */
     id: string;
     /**
+     * @description Resource half of the permission key (`resource.action`).
      * @type string
      */
     resource: string;
@@ -569,6 +633,7 @@ type PermissionControllerListPermissions200 = PermissionDto[];
  */
 type AppPermissionCatalogEntryDto = {
     /**
+     * @description Action half of the permission key (`resource.action`).
      * @type string
      */
     action: string;
@@ -578,14 +643,17 @@ type AppPermissionCatalogEntryDto = {
      */
     app_id: string | null;
     /**
+     * @description When the permission was created (ISO 8601).
      * @type string, date-time
      */
     created_at: string;
     /**
+     * @description Free-text description of the permission, or `null`.
      * @type string
      */
     description: string | null;
     /**
+     * @description Unique identifier of the permission.
      * @type string
      */
     id: string;
@@ -595,6 +663,7 @@ type AppPermissionCatalogEntryDto = {
      */
     is_system: boolean;
     /**
+     * @description Resource half of the permission key (`resource.action`).
      * @type string
      */
     resource: string;
@@ -613,18 +682,22 @@ type RoleControllerListPermissions200 = AppPermissionCatalogEntryDto[];
  */
 type RolePermissionEntryDto = {
     /**
+     * @description Action half of the permission key (`resource.action`).
      * @type string
      */
     action: string;
     /**
+     * @description Free-text description of the role permission, or `null`.
      * @type string
      */
     description: string | null;
     /**
+     * @description Unique identifier of the role permission.
      * @type string
      */
     id: string;
     /**
+     * @description Resource half of the permission key (`resource.action`).
      * @type string
      */
     resource: string;
@@ -668,10 +741,12 @@ type AppMembershipResponseDto = {
      */
     app_id: string;
     /**
+     * @description Unique identifier of the app membership.
      * @type string
      */
     id: string;
     /**
+     * @description When the member joined the tenant (ISO 8601).
      * @type string, date-time
      */
     joined_at: string;
@@ -693,6 +768,7 @@ type RoleResponseDto = {
      */
     app_id: string;
     /**
+     * @description When the role was created (ISO 8601).
      * @type string, date-time
      */
     created_at: string;
@@ -717,6 +793,7 @@ type RoleResponseDto = {
      */
     name: string;
     /**
+     * @description When the role was last changed (ISO 8601).
      * @type string, date-time
      */
     updated_at: string;
@@ -729,6 +806,7 @@ type RoleResponseDto = {
 
 type RoleListResponseDto = {
     /**
+     * @description The role items on this page.
      * @type array
      */
     data: RoleResponseDto[];
@@ -759,14 +837,22 @@ type EndUserRoleAssignmentResponseDto = {
  * Generated by Kubb (https://kubb.dev/).
  * Do not edit manually.
  */
-declare const endUserSummaryDtoStatusEnum: {
+declare const endUserStatusEnum: {
     readonly active: "active";
     readonly suspended: "suspended";
     readonly deactivated: "deactivated";
 };
-type EndUserSummaryDtoStatusEnumKey = (typeof endUserSummaryDtoStatusEnum)[keyof typeof endUserSummaryDtoStatusEnum];
+type EndUserStatusEnumKey = (typeof endUserStatusEnum)[keyof typeof endUserStatusEnum];
+type EndUserStatus = EndUserStatusEnumKey;
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
 type EndUserSummaryDto = {
     /**
+     * @description Sessions of the user that are currently active.
      * @type number
      */
     active_session_count: number;
@@ -776,18 +862,22 @@ type EndUserSummaryDto = {
      */
     auth_providers: string[];
     /**
+     * @description When the end user was created (ISO 8601).
      * @type string, date-time
      */
     created_at: string;
     /**
+     * @description Human-readable name of the end user.
      * @type string
      */
     display_name: string | null;
     /**
+     * @description Email address.
      * @type string
      */
     email: string | null;
     /**
+     * @description When the primary email was verified, or `null` until it is.
      * @type string, date-time
      */
     email_verified_at: string | null;
@@ -797,10 +887,12 @@ type EndUserSummaryDto = {
      */
     failed_signins: number;
     /**
+     * @description Unique identifier of the end user.
      * @type string
      */
     id: string;
     /**
+     * @description When the member joined the tenant (ISO 8601).
      * @type string, date-time
      */
     joined_at: string | null;
@@ -810,6 +902,7 @@ type EndUserSummaryDto = {
      */
     last_activity_at: string | null;
     /**
+     * @description When the end user was last used (ISO 8601), or `null` if never.
      * @type string, date-time
      */
     last_used_at: string | null;
@@ -819,19 +912,21 @@ type EndUserSummaryDto = {
      */
     mfa_factor_count: number;
     /**
+     * @description App-level role name of the user, or `null` for none.
      * @type string
      */
     role: string | null;
     /**
-     * @type string
+     * @description Account status: `active`, `suspended` or `deactivated`.
      */
-    status: EndUserSummaryDtoStatusEnumKey;
+    status: EndUserStatus;
     /**
      * @description Set while a live session is locked out of step-up verification.
      * @type string, date-time
      */
     step_up_locked_until: string | null;
     /**
+     * @description The end user\'s username, unique within the app.
      * @type string
      */
     username: string;
@@ -849,6 +944,7 @@ type EndUserSummaryDto = {
 
 type EndUserListResponseDto = {
     /**
+     * @description The end user items on this page.
      * @type array
      */
     data: EndUserSummaryDto[];
@@ -864,34 +960,42 @@ type EndUserListResponseDto = {
  */
 type AppMemberSummaryDto = {
     /**
+     * @description The end user (account) the app member belongs to.
      * @type string
      */
     account_id: string;
     /**
+     * @description Human-readable name of the app member.
      * @type string
      */
     display_name: string | null;
     /**
+     * @description Unique identifier of the app member.
      * @type string
      */
     id: string;
     /**
+     * @description When the member joined the tenant (ISO 8601).
      * @type string, date-time
      */
     joined_at: string;
     /**
+     * @description The member\'s primary email address, or `null`.
      * @type string
      */
     primary_email: string | null;
     /**
+     * @description Id of the role.
      * @type string
      */
     role_id: string;
     /**
+     * @description Name of the role.
      * @type string
      */
     role_name: string;
     /**
+     * @description The end user\'s username, unique within the app.
      * @type string
      */
     username: string;
@@ -904,6 +1008,7 @@ type AppMemberSummaryDto = {
 
 type AppMemberListResponseDto = {
     /**
+     * @description The app member items on this page.
      * @type array
      */
     data: AppMemberSummaryDto[];
@@ -924,38 +1029,47 @@ type EndUserInviteResponseDto = {
      */
     code: string;
     /**
+     * @description When the invite was created (ISO 8601).
      * @type string, date-time
      */
     created_at: string;
     /**
+     * @description Email address.
      * @type string
      */
     email: string | null;
     /**
+     * @description When the invite expires (ISO 8601), or `null` if it never does.
      * @type string, date-time
      */
     expires_at: string | null;
     /**
+     * @description Unique identifier of the invite.
      * @type string
      */
     id: string;
     /**
+     * @description How many times the invite can be used, or `null` for no limit.
      * @type number
      */
     max_uses: number | null;
     /**
+     * @description When the invite was revoked (ISO 8601), or `null` while it is active.
      * @type string, date-time
      */
     revoked_at: string | null;
     /**
+     * @description Id of the role.
      * @type string
      */
     role_id: string;
     /**
+     * @description Name of the role.
      * @type string
      */
     role_name: string | null;
     /**
+     * @description How many times the invite has been used.
      * @type number
      */
     use_count: number;
@@ -968,6 +1082,7 @@ type EndUserInviteResponseDto = {
 
 type EndUserInviteListResponseDto = {
     /**
+     * @description The end user invite items on this page.
      * @type array
      */
     data: EndUserInviteResponseDto[];
@@ -981,11 +1096,18 @@ type EndUserInviteListResponseDto = {
  * Generated by Kubb (https://kubb.dev/).
  * Do not edit manually.
  */
-declare const botProtectionResponseDtoProviderEnum: {
+declare const botProtectionProviderEnum: {
     readonly turnstile: "turnstile";
     readonly hcaptcha: "hcaptcha";
 };
-type BotProtectionResponseDtoProviderEnumKey = (typeof botProtectionResponseDtoProviderEnum)[keyof typeof botProtectionResponseDtoProviderEnum];
+type BotProtectionProviderEnumKey = (typeof botProtectionProviderEnum)[keyof typeof botProtectionProviderEnum];
+type BotProtectionProvider = BotProtectionProviderEnumKey;
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
 type BotProtectionResponseDto = {
     /**
      * @description Whether sign-up requires a verified token.
@@ -998,9 +1120,9 @@ type BotProtectionResponseDto = {
      */
     expected_hostnames: string[];
     /**
-     * @type string
+     * @description The CAPTCHA provider the sign-up form renders: `turnstile` or `hcaptcha`.
      */
-    provider: BotProtectionResponseDtoProviderEnumKey;
+    provider: BotProtectionProvider;
     /**
      * @description Last four characters of the stored secret, so you can tell which one it is. null when none is stored.
      * @type string
@@ -1022,30 +1144,50 @@ type BotProtectionResponseDto = {
  * Generated by Kubb (https://kubb.dev/).
  * Do not edit manually.
  */
-
-declare const authConfigResponseDtoMfaEnum: {
+declare const mfaPolicyEnum: {
     readonly optional: "optional";
     readonly required: "required";
 };
-type AuthConfigResponseDtoMfaEnumKey = (typeof authConfigResponseDtoMfaEnum)[keyof typeof authConfigResponseDtoMfaEnum];
-declare const authConfigResponseDtoOauthLinkPolicyEnum: {
+type MfaPolicyEnumKey = (typeof mfaPolicyEnum)[keyof typeof mfaPolicyEnum];
+type MfaPolicy = MfaPolicyEnumKey;
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+declare const oAuthLinkPolicyEnum: {
     readonly auto: "auto";
     readonly confirm: "confirm";
     readonly reject: "reject";
 };
-type AuthConfigResponseDtoOauthLinkPolicyEnumKey = (typeof authConfigResponseDtoOauthLinkPolicyEnum)[keyof typeof authConfigResponseDtoOauthLinkPolicyEnum];
-declare const authConfigResponseDtoPasswordBreachCheckEnum: {
+type OAuthLinkPolicyEnumKey = (typeof oAuthLinkPolicyEnum)[keyof typeof oAuthLinkPolicyEnum];
+type OAuthLinkPolicy = OAuthLinkPolicyEnumKey;
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+declare const passwordBreachCheckEnum: {
     readonly off: "off";
     readonly warn: "warn";
     readonly block: "block";
 };
-type AuthConfigResponseDtoPasswordBreachCheckEnumKey = (typeof authConfigResponseDtoPasswordBreachCheckEnum)[keyof typeof authConfigResponseDtoPasswordBreachCheckEnum];
+type PasswordBreachCheckEnumKey = (typeof passwordBreachCheckEnum)[keyof typeof passwordBreachCheckEnum];
+type PasswordBreachCheck = PasswordBreachCheckEnumKey;
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
 type AuthConfigResponseDto = {
     /**
+     * @description Access-token lifetime in minutes (5-60).
      * @type number
      */
     access_token_minutes: number;
     /**
+     * @description Origins the OAuth web flow may redirect back to (`return_to`), exact match.
      * @type array
      */
     allowed_redirect_origins: string[];
@@ -1054,66 +1196,79 @@ type AuthConfigResponseDto = {
      */
     bot_protection: BotProtectionResponseDto | null;
     /**
+     * @description Whether routes that declare an app permission enforce it against the user\'s role.
      * @type boolean
      */
     enforce_app_permissions: boolean;
     /**
+     * @description Consecutive failed sign-ins before an account is locked for 15 minutes.
      * @type number
      */
     max_failed_login_attempts: number;
     /**
+     * @description Maximum concurrent sessions per user; a sign-in past it ends the oldest session.
      * @type number
      */
     max_sessions: number | null;
     /**
-     * @type string
+     * @description Whether every user must hold an MFA factor: `optional` or `required`.
      */
-    mfa: AuthConfigResponseDtoMfaEnumKey;
+    mfa: MfaPolicy;
     /**
+     * @description Days after account creation during which `mfa: required` still mints ordinary tokens.
      * @type number
      */
     mfa_grace_days: number;
     /**
-     * @type string
+     * @description What a federated sign-in does when its verified email already belongs to an account in the app: `auto` links it, `confirm` asks the user to prove the existing account first, `reject` refuses the sign-in.
      */
-    oauth_link_policy: AuthConfigResponseDtoOauthLinkPolicyEnumKey;
+    oauth_link_policy: OAuthLinkPolicy;
     /**
-     * @type string
+     * @description Breached-password check on sign-up and password changes: `block`, `warn` or `off`.
      */
-    password_breach_check: AuthConfigResponseDtoPasswordBreachCheckEnumKey;
+    password_breach_check: PasswordBreachCheck;
     /**
+     * @description Minimum password length.
      * @type number
      */
     password_min_length: number;
     /**
+     * @description Whether passwords need a digit.
      * @type boolean
      */
     password_require_number: boolean;
     /**
+     * @description Whether passwords need a symbol.
      * @type boolean
      */
     password_require_symbol: boolean;
     /**
+     * @description Whether passwords need an uppercase letter.
      * @type boolean
      */
     password_require_uppercase: boolean;
     /**
+     * @description Session lifetime in minutes.
      * @type number
      */
     session_duration_minutes: number;
     /**
+     * @description Whether existing users can sign in.
      * @type boolean
      */
     signin_enabled: boolean;
     /**
+     * @description Email domains allowed to sign up; empty means any domain.
      * @type array
      */
     signup_allowed_email_domains: string[];
     /**
+     * @description Role newly signed-up users receive.
      * @type string
      */
     signup_default_role: string;
     /**
+     * @description Whether new users can sign up.
      * @type boolean
      */
     signup_enabled: boolean;
@@ -1153,7 +1308,9 @@ type UpdateAppDto = {
      * @description Your own key/value data for this app. It replaces the stored metadata, and keys are kept exactly as you send them. The `auth` key holds the app\'s sign-in settings, which you change with `PATCH /v1/apps/{appId}/auth-config` (it checks every value): leave `auth` out and it is kept as it is, or send it back unchanged. A different `auth` value is refused with 400 `AUTH_SETTINGS_IN_METADATA`.
      * @type object | undefined
      */
-    metadata?: object;
+    metadata?: {
+        [key: string]: any;
+    };
     /**
      * @description Rename the app\'s slug. The old slug remains resolvable for 30 days as a JWKS-URL alias so existing customer-side verifiers don\'t break instantly. Same shape as the create-slug: lowercase alphanumeric + hyphens, 3–48 chars, not shaped like a UUID.
      * @type string | undefined
@@ -1465,10 +1622,12 @@ type UpdateEndUserStatusDto = {
  */
 type CreateRoleDto = {
     /**
+     * @description Free-text description of the role, or `null`.
      * @type string | undefined
      */
     description?: string;
     /**
+     * @description Name of the role.
      * @type string
      */
     name: string;
@@ -1480,6 +1639,7 @@ type CreateRoleDto = {
  */
 type UpdateRoleDto = {
     /**
+     * @description Free-text description of the update role, or `null`.
      * @type string | undefined
      */
     description?: string;
@@ -1513,6 +1673,7 @@ type CreatePermissionDto = {
      */
     action: string;
     /**
+     * @description Free-text description of the create permission, or `null`.
      * @type string | undefined
      */
     description?: string;
@@ -1591,10 +1752,15 @@ declare const endUserInviteControllerListQueryParamsStatusEnum: {
 type EndUserInviteControllerListQueryParamsStatusEnumKey = (typeof endUserInviteControllerListQueryParamsStatusEnum)[keyof typeof endUserInviteControllerListQueryParamsStatusEnum];
 type EndUserInviteControllerListQueryParams = {
     /**
-     * @type string | undefined
+     * @description Page size. Defaults to 20, clamped to 100.
+     * @minLength 1
+     * @maxLength 100
+     * @default 20
+     * @type integer | undefined
      */
-    limit?: string;
+    limit?: number;
     /**
+     * @description Opaque `next_cursor` from the previous page.
      * @type string | undefined
      */
     cursor?: string;
@@ -1612,10 +1778,15 @@ type EndUserInviteControllerListQueryParams = {
 
 type AppControllerListMembersQueryParams = {
     /**
-     * @type string | undefined
+     * @description Page size. Defaults to 20, clamped to 100.
+     * @minLength 1
+     * @maxLength 100
+     * @default 20
+     * @type integer | undefined
      */
-    limit?: string;
+    limit?: number;
     /**
+     * @description Opaque `next_cursor` from the previous page.
      * @type string | undefined
      */
     cursor?: string;
@@ -1626,6 +1797,12 @@ type AppControllerListMembersQueryParams = {
  * Do not edit manually.
  */
 
+declare const endUserControllerListEndUsersQueryParamsStatusEnum: {
+    readonly active: "active";
+    readonly suspended: "suspended";
+    readonly deactivated: "deactivated";
+};
+type EndUserControllerListEndUsersQueryParamsStatusEnumKey = (typeof endUserControllerListEndUsersQueryParamsStatusEnum)[keyof typeof endUserControllerListEndUsersQueryParamsStatusEnum];
 declare const endUserControllerListEndUsersQueryParamsSignalEnum: {
     readonly unverified: "unverified";
     readonly failing_signin: "failing_signin";
@@ -1651,18 +1828,25 @@ declare const endUserControllerListEndUsersQueryParamsOrderEnum: {
 type EndUserControllerListEndUsersQueryParamsOrderEnumKey = (typeof endUserControllerListEndUsersQueryParamsOrderEnum)[keyof typeof endUserControllerListEndUsersQueryParamsOrderEnum];
 type EndUserControllerListEndUsersQueryParams = {
     /**
-     * @type string | undefined
+     * @description Page size. Defaults to 20, clamped to 100.
+     * @minLength 1
+     * @maxLength 100
+     * @default 20
+     * @type integer | undefined
      */
-    limit?: string;
+    limit?: number;
     /**
+     * @description Opaque `next_cursor` from the previous page.
      * @type string | undefined
      */
     cursor?: string;
     /**
+     * @description Only users with this status.
      * @type string | undefined
      */
-    status?: string;
+    status?: EndUserControllerListEndUsersQueryParamsStatusEnumKey;
     /**
+     * @description Case-insensitive substring of the username or of any contact (email or phone).
      * @type string | undefined
      */
     search?: string;
@@ -1682,6 +1866,7 @@ type EndUserControllerListEndUsersQueryParams = {
      */
     sort?: EndUserControllerListEndUsersQueryParamsSortEnumKey;
     /**
+     * @description Sort direction for `sort`.
      * @type string | undefined
      */
     order?: EndUserControllerListEndUsersQueryParamsOrderEnumKey;
@@ -1694,18 +1879,25 @@ type EndUserControllerListEndUsersQueryParams = {
 
 type AppAuditControllerGetAuditLogsQueryParams = {
     /**
-     * @type string | undefined
+     * @description Page size. Defaults to 20, clamped to 100.
+     * @minLength 1
+     * @maxLength 100
+     * @default 20
+     * @type integer | undefined
      */
-    limit?: string;
+    limit?: number;
     /**
+     * @description Opaque `next_cursor` from the previous page.
      * @type string | undefined
      */
     cursor?: string;
     /**
+     * @description Only entries with this action (e.g. `user.signin`).
      * @type string | undefined
      */
     action?: string;
     /**
+     * @description Only entries this account performed.
      * @type string | undefined
      */
     actor_id?: string;
@@ -1728,10 +1920,15 @@ type AppAuditControllerGetAuditLogsQueryParams = {
 
 type M2MControllerListClientsQueryParams = {
     /**
-     * @type string | undefined
+     * @description Page size. Defaults to 20, clamped to 100.
+     * @minLength 1
+     * @maxLength 100
+     * @default 20
+     * @type integer | undefined
      */
-    limit?: string;
+    limit?: number;
     /**
+     * @description Opaque `next_cursor` from the previous page.
      * @type string | undefined
      */
     cursor?: string;
@@ -1744,10 +1941,15 @@ type M2MControllerListClientsQueryParams = {
 
 type RoleControllerListRolesQueryParams = {
     /**
-     * @type string | undefined
+     * @description Page size. Defaults to 20, clamped to 100.
+     * @minLength 1
+     * @maxLength 100
+     * @default 20
+     * @type integer | undefined
      */
-    limit?: string;
+    limit?: number;
     /**
+     * @description Opaque `next_cursor` from the previous page.
      * @type string | undefined
      */
     cursor?: string;
@@ -1856,6 +2058,7 @@ type OAuthTokenResponseDto = {
      */
     scope: string;
     /**
+     * @description Always `Bearer`.
      * @type string
      */
     token_type: string;
@@ -1867,6 +2070,7 @@ type OAuthTokenResponseDto = {
  */
 type AuthorizeBatchResultDto = {
     /**
+     * @description True when the token holds every permission of this check.
      * @type boolean
      */
     authorized: boolean;
@@ -1876,6 +2080,7 @@ type AuthorizeBatchResultDto = {
      */
     id?: string;
     /**
+     * @description Permissions of this check the token does not hold.
      * @type array
      */
     missing_permissions: string[];
@@ -1888,6 +2093,7 @@ type AuthorizeBatchResultDto = {
 
 type AuthorizeBatchResponseDto = {
     /**
+     * @description One result per check, in request order, each echoing its `id`.
      * @type array
      */
     results: AuthorizeBatchResultDto[];
@@ -1899,6 +2105,7 @@ type AuthorizeBatchResponseDto = {
  */
 type AuthorizeResponseDto = {
     /**
+     * @description True when the token is valid and holds every requested permission.
      * @type boolean
      */
     authorized: boolean;
@@ -1972,12 +2179,27 @@ type VerifyResponseDto = {
  * Generated by Kubb (https://kubb.dev/).
  * Do not edit manually.
  */
+declare const signInResultEnum: {
+    readonly session: "session";
+    readonly mfa_required: "mfa_required";
+    readonly mfa_enrollment_required: "mfa_enrollment_required";
+};
+type SignInResultEnumKey = (typeof signInResultEnum)[keyof typeof signInResultEnum];
+type SignInResult = SignInResultEnumKey;
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
 type IdpMfaEnrollmentRequiredResponseDto = {
     /**
+     * @description When the idp mfa enrollment required expires (ISO 8601), or `null` if it never does.
      * @type string, date-time
      */
     expires_at: string;
     /**
+     * @description Always `true`: the app requires MFA and the user has no factor yet, so no session was minted.
      * @type boolean
      */
     mfa_enrollment_required: boolean;
@@ -1986,6 +2208,10 @@ type IdpMfaEnrollmentRequiredResponseDto = {
      * @type string
      */
     mfa_token: string;
+    /**
+     * @description Always `mfa_enrollment_required` here: no session was minted; enrol a factor with `mfa.enroll`. Discriminates the sign-in results.
+     */
+    result: SignInResult;
 };
 
 /**
@@ -1994,10 +2220,12 @@ type IdpMfaEnrollmentRequiredResponseDto = {
  */
 type IdpNativeUserHintDto = {
     /**
+     * @description Email address.
      * @type string | undefined
      */
     email?: string;
     /**
+     * @description The user\'s name as the provider reported it (Apple sends it on the first sign-in only).
      * @type string | undefined
      */
     name?: string;
@@ -2033,12 +2261,20 @@ type IdpNativeSigninDto = {
  * Generated by Kubb (https://kubb.dev/).
  * Do not edit manually.
  */
-declare const idpTokenResponseDtoTokenTypeEnum: {
+declare const tokenTypeEnum: {
     readonly Bearer: "Bearer";
 };
-type IdpTokenResponseDtoTokenTypeEnumKey = (typeof idpTokenResponseDtoTokenTypeEnum)[keyof typeof idpTokenResponseDtoTokenTypeEnum];
+type TokenTypeEnumKey = (typeof tokenTypeEnum)[keyof typeof tokenTypeEnum];
+type TokenType = TokenTypeEnumKey;
+
+/**
+ * Generated by Kubb (https://kubb.dev/).
+ * Do not edit manually.
+ */
+
 type IdpTokenResponseDto = {
     /**
+     * @description Short-lived JWT signed with the app\'s JWKS key.
      * @type string
      */
     access_token: string;
@@ -2053,13 +2289,18 @@ type IdpTokenResponseDto = {
      */
     mfa_enrollment_due_at?: string;
     /**
+     * @description Long-lived token that mints a new access token via `refresh`. Rotated on use.
      * @type string
      */
     refresh_token: string;
     /**
-     * @type string
+     * @description Always `session` here: a session was minted. Discriminates the sign-in results (`session`, `mfa_required`, `mfa_enrollment_required`).
+     */
+    result: SignInResult;
+    /**
+     * @description Always `Bearer`.
      */
-    token_type: IdpTokenResponseDtoTokenTypeEnumKey;
+    token_type: TokenType;
 };
 
 /**
@@ -2076,7 +2317,11 @@ type ConsumerIdpControllerNativeSignInPathParamsProviderEnumKey = (typeof consum
 /**
  * @description Either a token pair or, when the app runs `auth_config.mfa: \"required\"` and the account holds no enabled factor, an enrolment demand (`mfa_enrollment_required: true`) with no session behind it. Branch on `mfa_enrollment_required`.
  */
-type ConsumerIdpControllerNativeSignIn200 = IdpTokenResponseDto | IdpMfaEnrollmentRequiredResponseDto;
+type ConsumerIdpControllerNativeSignIn200 = (IdpMfaEnrollmentRequiredResponseDto & {
+    result: "mfa_enrollment_required";
+}) | (IdpTokenResponseDto & {
+    result: "session";
+});
 
 /**
  * Generated by Kubb (https://kubb.dev/).
@@ -2109,6 +2354,7 @@ type ConsumerAcceptInviteDto = {
  * Generated by Kubb (https://kubb.dev/).
  * Do not edit manually.
  */
+
 type ConsumerMfaEnrollmentRequiredResponseDto = {
     /**
      * @description When the enrolment token expires (ISO 8601, UTC).
@@ -2125,12 +2371,17 @@ type ConsumerMfaEnrollmentRequiredResponseDto = {
      * @type string
      */
     mfa_token: string;
+    /**
+     * @description Always `mfa_enrollment_required` here: no session was minted; enrol a factor with `mfa.enroll`. Discriminates the sign-in results.
+     */
+    result: SignInResult;
 };
 
 /**
  * Generated by Kubb (https://kubb.dev/).
  * Do not edit manually.
  */
+
 type ConsumerTokenResponseDto = {
     /**
      * @description Short-lived JWT signed with the app-scoped JWKS key. Carries sub, role, permissions[], type=end_user.
@@ -2158,6 +2409,11 @@ type ConsumerTokenResponseDto = {
      */
     refresh_token: string;
     /**
+     * @description Always `session` here: a session was minted. Discriminates the sign-in results (`session`, `mfa_required`, `mfa_enrollment_required`).
+     */
+    result: SignInResult;
+    /**
+     * @description Always `Bearer`.
      * @type string
      */
     token_type: string;
@@ -2171,7 +2427,11 @@ type ConsumerTokenResponseDto = {
 /**
  * @description Account created from the invite. A session was minted unless `mfa_enrollment_required` is present — branch on that flag.
  */
-type ConsumerAuthControllerAcceptInvite201 = ConsumerTokenResponseDto | ConsumerMfaEnrollmentRequiredResponseDto;
+type ConsumerAuthControllerAcceptInvite201 = (ConsumerMfaEnrollmentRequiredResponseDto & {
+    result: "mfa_enrollment_required";
+}) | (ConsumerTokenResponseDto & {
+    result: "session";
+});
 
 /**
  * Generated by Kubb (https://kubb.dev/).
@@ -2184,10 +2444,12 @@ type ConsumerMfaChallengeFactorDto = {
      */
     email_masked?: string | null;
     /**
+     * @description Unique identifier of the factor.
      * @type string
      */
     id: string;
     /**
+     * @description Label the user gave the factor, or `null`.
      * @type string
      */
     label: string | null;
@@ -2224,6 +2486,10 @@ type ConsumerMfaChallengeResponseDto = {
      * @type string
      */
     mfa_token: string;
+    /**
+     * @description Always `mfa_required` here: finish the challenge with `mfa.verify`. Discriminates the sign-in results.
+     */
+    result: SignInResult;
 };
 
 /**
@@ -2256,7 +2522,13 @@ type ConsumerSigninDto = {
 /**
  * @description A normal token response, an MFA challenge, or an MFA enrolment demand — distinguish by `mfa_required` / `mfa_enrollment_required`. Neither flag present means a session was minted.
  */
-type ConsumerAuthControllerSignin200 = ConsumerTokenResponseDto | ConsumerMfaChallengeResponseDto | ConsumerMfaEnrollmentRequiredResponseDto;
+type ConsumerAuthControllerSignin200 = (ConsumerMfaEnrollmentRequiredResponseDto & {
+    result: "mfa_enrollment_required";
+}) | (ConsumerMfaChallengeResponseDto & {
+    result: "mfa_required";
+}) | (ConsumerTokenResponseDto & {
+    result: "session";
+});
 
 /**
  * Generated by Kubb (https://kubb.dev/).
@@ -2599,22 +2871,27 @@ type ConsumerPasskeyOptionsDto = {
  */
 type PublicFactorDto = {
     /**
+     * @description When the factor was created (ISO 8601).
      * @type string, date-time
      */
     created_at: string;
     /**
+     * @description Whether the factor is enabled.
      * @type boolean
      */
     enabled: boolean;
     /**
+     * @description When the factor was enabled (ISO 8601), or `null`.
      * @type string, date-time
      */
     enabled_at: string | null;
     /**
+     * @description Unique identifier of the factor.
      * @type string
      */
     id: string;
     /**
+     * @description Label the user gave the factor, or `null`.
      * @type string
      */
     label: string | null;
@@ -2648,10 +2925,12 @@ type ConfirmEnrollmentResponseDto = {
  */
 type StepUpResponseDto = {
     /**
+     * @description Authentication methods now recorded on the session (RFC 8176 `amr` values, e.g. `pwd`, `otp`, `webauthn`).
      * @type array
      */
     amr: string[];
     /**
+     * @description When the second factor was verified on this session (ISO 8601).
      * @type string, date-time
      */
     mfa_at: string;
@@ -3063,9 +3342,8 @@ declare class ConsumerScope {
          *
          * PAK-required with `auth.user.password-reset.create`: caller must
          * instantiate `Auth` with
-         * `auth: { type: "apiKey", key: "pcft_live_..." }`. The
-         * kubb-generated `headers.authorization` slot is a stub — the
-         * HTTP client's auth middleware overrides whatever's passed.
+         * `auth: { type: "apiKey", key: "pcft_live_..." }`; the HTTP
+         * client's auth middleware sends it.
          */
         requestReset: (data: ConsumerRequestPasswordResetDto) => Promise<ConsumerCodeIssueResponseDto>;
         /**
@@ -3095,9 +3373,8 @@ declare class ConsumerScope {
          *
          * PAK-required: caller must instantiate `Auth` with
          * `auth: { type: "apiKey", key: "pcft_live_..." }` carrying
-         * `auth.user.verify.create` narrowed to this app's URN. The
-         * kubb-generated `headers.authorization` slot is a stub — the
-         * HTTP client's auth middleware overrides whatever's passed.
+         * `auth.user.verify.create` narrowed to this app's URN; the HTTP
+         * client's auth middleware sends it.
          */
         requestVerification: (data: ConsumerRequestVerificationDto) => Promise<ConsumerCodeIssueResponseDto>;
         /**
@@ -3177,11 +3454,9 @@ declare class ConsumerScope {
     };
     readonly verify: {
         /**
-         * The kubb-generated client makes `headers.authorization` a required
-         * arg because the server controllers accept the bearer as a fallback
-         * to `body.token`. We stub an empty string here — the HTTP client's
-         * auth middleware overrides whatever's passed with the configured
-         * credential (`PCAuth.apiKey` / `bearer` / `cookie`).
+         * The token under test goes in `data.token`. The server also accepts
+         * it as a bearer; the HTTP client's auth middleware sends the
+         * configured credential (`PCAuth.apiKey` / `bearer` / `cookie`).
          */
         verify: (data: VerifyBody) => Promise<VerifyResponseDto>;
         authorize: (data: AuthorizeBody) => Promise<AuthorizeResponseDto>;
@@ -3319,9 +3594,12 @@ type AppControllerListMyAppsQueryParams = {
     workspace_id?: string;
     /**
      * @description Page size (default 20, max 100).
-     * @type string | undefined
+     * @minLength 1
+     * @maxLength 100
+     * @default 20
+     * @type integer | undefined
      */
-    limit?: string;
+    limit?: number;
     /**
      * @description Opaque `next_cursor` from the previous page.
      * @type string | undefined