@productcraft/auth 1.0.0 → 1.1.0

package/dist/index.cjs

@@ -40,6 +40,11 @@ var AppsResource = class extends APIResource {
    *
    * The new app starts with emails to its users turned on: they go out from the workspace default sender chosen in Mail, and the default verification, welcome, password-reset, invite and sign-in code templates are created in the workspace's Mail templates (an existing template with the same name is reused). Change or turn this off with `PATCH /v1/apps/{appId}/notification-settings`.
    *
+   * **Sign-up starts off.** A new app has `signup_enabled: false`, so `POST /{app_slug}/v1/auth/signup` answers 403 `FORBIDDEN` ("Signup is disabled for this app") until you turn it on with `PATCH /v1/apps/{app_id}/auth-config` and `{ "signup_enabled": true }`. Sign-in, invites and admin-created users work either way.
+   *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.AppCreateParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure (slug, display name, or workspaceId).
@@ -64,6 +69,9 @@ var AppsResource = class extends APIResource {
   /**
    * Delete an app permanently
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param appId - Id of the app.
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -74,7 +82,7 @@ var AppsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id
    * @example
    * ```ts
-   * await auth.apps.delete("app");
+   * await auth.apps.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   delete(appId, options) {
@@ -83,6 +91,9 @@ var AppsResource = class extends APIResource {
   /**
    * List apps in workspaces the caller is a member of. Pass `workspace_id` to scope the result to a single workspace — required from the per-workspace console page so cross-tenant memberships do not leak.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.AppListParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid pagination cursor.
@@ -104,6 +115,9 @@ var AppsResource = class extends APIResource {
   /**
    * Get app details
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param appId - Id of the app.
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -114,7 +128,7 @@ var AppsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id
    * @example
    * ```ts
-   * const app = await auth.apps.retrieve("app");
+   * const app = await auth.apps.retrieve("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   retrieve(appId, options) {
@@ -123,6 +137,9 @@ var AppsResource = class extends APIResource {
   /**
    * Update app display name, slug, metadata, and retention settings
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param appId - Id of the app.
    * @param params - `Auth.AppUpdateParams`.
    * @param options - Per-request options.
@@ -133,7 +150,7 @@ var AppsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id
    * @example
    * ```ts
-   * const app = await auth.apps.update("app", { audit_retention_days: 365 });
+   * const app = await auth.apps.update("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { audit_retention_days: 365 });
    * ```
    */
   update(appId, params, options) {
@@ -146,6 +163,9 @@ var StatsResource = class extends APIResource {
    *
    * Returns total Auth apps owned by workspaces the caller is a member of, end-users across those apps, and active API keys across those apps. Pass `workspace_id` to scope the counts to a single workspace — required from the dashboard so cross-tenant data does not bleed into the totals.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.StatsMeParams`.
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -169,6 +189,9 @@ var StatsResource = class extends APIResource {
    *
    * Days are UTC. Counts only: no end-user identifiers. Cached for up to 60 seconds (`generated_at`).
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.StatsRetrieveParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `workspaceId` is not a UUID or `window` is not one of 1d, 7d, 30d.
@@ -206,6 +229,16 @@ var WebhooksResource = class extends APIResource {
   unwrap(params) {
     return this._client.unwrapWebhook(params, "PRODUCTCRAFT_AUTH_WEBHOOK_SECRET");
   }
+  /**
+   * Sign a test event the way ProductCraft signs deliveries (Standard Webhooks), so a handler
+   * test can call `unwrap` without a live delivery. Returns the exact body and the headers.
+   *
+   * @param params - The event (an object is JSON-encoded), and optionally the secret, `id` and `timestamp`.
+   * @throws {ConfigurationError} No secret was passed or configured.
+   */
+  sign(params) {
+    return this._client.signWebhook(params, "PRODUCTCRAFT_AUTH_WEBHOOK_SECRET");
+  }
 };
 var AuthResources = class extends APIResource {
   #apps;
@@ -225,6 +258,9 @@ var AppApiKeysResource = class extends APIResource {
   /**
    * Mint a new hdk_live_* API key with an explicit permission scope. The raw key is returned ONCE.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.ApiKeyCreateParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure (name, empty `permissions`, a permission not matching `resource.action`, unsupported `expiresInDays`), or a malformed `Idempotency-Key`.
@@ -237,7 +273,7 @@ var AppApiKeysResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-api-keys
    * @example
    * ```ts
-   * const createApiKey = await auth.admin.app("app").apiKeys.create({ name: "CI deploy bot", permissions: ["user.read", "user.list"] });
+   * const createApiKey = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").apiKeys.create({ name: "CI deploy bot", permissions: ["user.read", "user.list"] });
    * ```
    */
   create(params, options) {
@@ -246,6 +282,9 @@ var AppApiKeysResource = class extends APIResource {
   /**
    * Revoke an API key. The key stops authenticating immediately; the row is kept (soft delete) so the list and the audit trail can still answer who revoked it and when.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param keyId - Id of the key.
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -255,7 +294,7 @@ var AppApiKeysResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-api-keys-key-id
    * @example
    * ```ts
-   * await auth.admin.app("app").apiKeys.delete("key");
+   * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").apiKeys.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   delete(keyId, options) {
@@ -264,6 +303,9 @@ var AppApiKeysResource = class extends APIResource {
   /**
    * List API keys for an app (no raw secret), newest first. Cursor-paginated: 20/page by default, 100 max.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.ApiKeyListParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`.
@@ -273,10 +315,10 @@ var AppApiKeysResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-api-keys
    * @example
    * ```ts
-   * for await (const apiKey of auth.admin.app("app").apiKeys.list()) {
+   * for await (const apiKey of auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").apiKeys.list()) {
    *   console.log(apiKey);
    * }
-   * const page = await auth.admin.app("app").apiKeys.list({}, { timeout: 5_000 });
+   * const page = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").apiKeys.list({}, { timeout: 5_000 });
    * ```
    */
   list(params, options) {
@@ -285,6 +327,9 @@ var AppApiKeysResource = class extends APIResource {
   /**
    * Mint a replacement for an existing key, carrying its name and permissions over. The outgoing key keeps working for `grace_hours` (24 by default) so a fleet can roll over without downtime. The raw key is returned ONCE.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param keyId - Id of the key.
    * @param params - `Auth.ApiKeyRotateParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
@@ -296,7 +341,7 @@ var AppApiKeysResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-api-keys-key-id-rotate
    * @example
    * ```ts
-   * const rotateApiKey = await auth.admin.app("app").apiKeys.rotate("key", { grace_hours: 24 });
+   * const rotateApiKey = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").apiKeys.rotate("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { grace_hours: 24 });
    * ```
    */
   rotate(keyId, params, options) {
@@ -309,6 +354,9 @@ var AppAuditLogsResource = class extends APIResource {
    *
    * The response is streamed: rows are walked in keyset batches and written as they are read, so neither the service nor the client has to hold the whole result set. Works on both lanes — a platform bearer token and a `pcft_live_*` Platform API Key with `auth.audit.read` hit the same route. Hard cap of 1,000,000 rows per call; a wider request is refused with 413 before any body is written, so a truncated file can never masquerade as a complete one.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.AuditLogExportParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `format`, or malformed `since` / `until`.
@@ -321,7 +369,7 @@ var AppAuditLogsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-audit-logs-export
    * @example
    * ```ts
-   * const response = await auth.admin.app("app").auditLogs.export();
+   * const response = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").auditLogs.export();
    * const text = await response.text();
    * ```
    */
@@ -331,6 +379,9 @@ var AppAuditLogsResource = class extends APIResource {
   /**
    * Append-only audit log for this app, newest first. Filter by `?action=`, `?actor_id=`, and/or the `?since=` / `?until=` date range. 20/page (max 100), cursor-paginated.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.AuditLogListParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`, `since`, or `until`.
@@ -342,10 +393,10 @@ var AppAuditLogsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-audit-logs
    * @example
    * ```ts
-   * for await (const auditLog of auth.admin.app("app").auditLogs.list()) {
+   * for await (const auditLog of auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").auditLogs.list()) {
    *   console.log(auditLog);
    * }
-   * const page = await auth.admin.app("app").auditLogs.list({}, { timeout: 5_000 });
+   * const page = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").auditLogs.list({}, { timeout: 5_000 });
    * ```
    */
   list(params, options) {
@@ -356,6 +407,9 @@ var AppAuditSinkResource = class extends APIResource {
   /**
    * Remove the audit sink. Shipping stops immediately; the audit log itself is untouched.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
    * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update`.
@@ -365,7 +419,7 @@ var AppAuditSinkResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-audit-sink
    * @example
    * ```ts
-   * await auth.admin.app("app").auditSink.disconnect();
+   * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").auditSink.disconnect();
    * ```
    */
   disconnect(options) {
@@ -376,6 +430,9 @@ var AppAuditSinkResource = class extends APIResource {
    *
    * Audit rows are POSTed in batches of up to 100, signed with the same `X-Auth-Signature: t=<unix>,v1=<hex>` HMAC header as the outbound webhooks. Delivery is at-least-once: the cursor advances only after a 2xx, so a batch that times out after the receiver processed it is re-sent. Every record carries its immutable `audit_log` id, so dedupe on that. A new sink starts from the moment it is created — configuring one does not replay the existing history into your SIEM. Replacing an existing sink clears the auto-disabled state (the same "I fixed my receiver" signal a webhook PUT carries) but does NOT rewind the cursor.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.AuditSinkReplaceParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: URL is not HTTPS, or the SSRF guard refused it (private address, unresolvable host, non-public TLD).
@@ -387,7 +444,7 @@ var AppAuditSinkResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#put-v1-apps-app-id-audit-sink
    * @example
    * ```ts
-   * const auditSinkWithSecret = await auth.admin.app("app").auditSink.replace({ url: "https://siem.customer.example.com/ingest/productcraft-auth" });
+   * const auditSinkWithSecret = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").auditSink.replace({ url: "https://siem.customer.example.com/ingest/productcraft-auth" });
    * ```
    */
   replace(params, options) {
@@ -396,6 +453,9 @@ var AppAuditSinkResource = class extends APIResource {
   /**
    * Current audit sink for this app, or 404 when none is configured. Never returns the signing secret — only its last-4 hint.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
    * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read`.
@@ -405,7 +465,7 @@ var AppAuditSinkResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-audit-sink
    * @example
    * ```ts
-   * const auditSink = await auth.admin.app("app").auditSink.retrieve();
+   * const auditSink = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").auditSink.retrieve();
    * ```
    */
   retrieve(options) {
@@ -416,6 +476,9 @@ var AppAuditSinkResource = class extends APIResource {
    *
    * The new secret signs every batch from now on; the old one stops at once. Update your receiver right away: batches it rejects in between are retried every minute (the position only moves after a 2xx), so nothing is lost, but export stops after 20 failures in a row. Clears the receiver-test proof.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
    * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update`.
@@ -425,7 +488,7 @@ var AppAuditSinkResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-audit-sink-rotate-secret
    * @example
    * ```ts
-   * const auditSinkWithSecret = await auth.admin.app("app").auditSink.rotateSecret();
+   * const auditSinkWithSecret = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").auditSink.rotateSecret();
    * ```
    */
   rotateSecret(options) {
@@ -436,6 +499,9 @@ var AppAuditSinkResource = class extends APIResource {
    *
    * Rows, in order: `destination` (not_set until a sink exists), `test_batch` (pass once the receiver accepted a test batch with the current address and secret; blocked when the last test was refused; carries `test.action: audit_sink.test`, run with `POST /v1/apps/{appId}/audit-sink/test`), and `delivery` (blocked when export stopped after repeated failures, attention while paused or while recent batches fail). Computed from the stored sink on every request; answers 200 whether or not a sink exists.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
    * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read`, or the app is suspended or archived.
@@ -445,7 +511,7 @@ var AppAuditSinkResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-audit-sink-setup-status
    * @example
    * ```ts
-   * const setupStatus = await auth.admin.app("app").auditSink.setupStatus();
+   * const setupStatus = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").auditSink.setupStatus();
    * ```
    */
   setupStatus(options) {
@@ -456,6 +522,9 @@ var AppAuditSinkResource = class extends APIResource {
    *
    * POSTs one signed batch, shaped exactly like a real one (`type: audit.batch`, same headers and signature), with `test: true` and a single synthetic record whose `id` starts with `test_`. Works while export is paused or stopped, so a fix can be proven before export is turned back on. The outcome is recorded on the sink (`last_attempt_*`, `last_test_succeeded_at`) but never moves the position in the audit log or counts toward the automatic stop. A refused test is still a 200 with `delivered: false`. At most 20 tests per app per hour.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
    * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update`.
@@ -466,7 +535,7 @@ var AppAuditSinkResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-audit-sink-test
    * @example
    * ```ts
-   * const auditSinkTestResult = await auth.admin.app("app").auditSink.test();
+   * const auditSinkTestResult = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").auditSink.test();
    * ```
    */
   test(options) {
@@ -477,6 +546,9 @@ var AppAuditSinkResource = class extends APIResource {
    *
    * Send `url`, `enabled` or both. `enabled: false` pauses export; `enabled: true` resumes it and clears a stop after repeated failures and the failure count. The position in the audit log is never moved: nothing is skipped and nothing is replayed twice on purpose. A new `url` is checked by the same address guard as `PUT`.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.AuditSinkUpdateParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: URL is not HTTPS, or the address guard refused it (private address, unresolvable host).
@@ -488,7 +560,7 @@ var AppAuditSinkResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-audit-sink
    * @example
    * ```ts
-   * const auditSink = await auth.admin.app("app").auditSink.update({ enabled: true });
+   * const auditSink = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").auditSink.update({ enabled: true });
    * ```
    */
   update(params, options) {
@@ -501,6 +573,9 @@ var AppAuthConfigProvidersResource = class extends APIResource {
    *
    * Calls the provider's token endpoint with a dummy sign-in code. If the provider refuses the client (`invalid_client`, GitHub `incorrect_client_credentials` or `unknown_client`), the result is `credentials_rejected` and the provider shows as `blocked` with reason `credentials_rejected` until the credentials are fixed. If it only refuses the code (`invalid_grant`, `bad_verification_code`), the credentials are valid. Nobody is signed in. The result is saved on the provider (`last_check_*`). The same check runs automatically whenever the credentials are saved. Works for a provider that is saved but not switched on yet.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param provider - The sign-in provider: `google`, `github` or `apple`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown provider id, or the saved config can no longer be read.
@@ -512,7 +587,7 @@ var AppAuthConfigProvidersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-auth-config-providers-provider-check
    * @example
    * ```ts
-   * const providerCheck = await auth.admin.app("app").authConfig.providers.check("provider");
+   * const providerCheck = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").authConfig.providers.check("google");
    * ```
    */
   check(provider, options) {
@@ -521,6 +596,9 @@ var AppAuthConfigProvidersResource = class extends APIResource {
   /**
    * Remove the config for an (app, provider). Existing identity rows (people who already signed in with this provider) stay; they just lose the ability to sign in again until config is re-uploaded.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param provider - The sign-in provider: `google`, `github` or `apple`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown provider id.
@@ -530,7 +608,7 @@ var AppAuthConfigProvidersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-auth-config-providers-provider
    * @example
    * ```ts
-   * await auth.admin.app("app").authConfig.providers.delete("provider");
+   * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").authConfig.providers.delete("google");
    * ```
    */
   delete(provider, options) {
@@ -541,6 +619,9 @@ var AppAuthConfigProvidersResource = class extends APIResource {
    *
    * Each entry carries `status` (`ready` | `blocked` | `disabled` | `not_configured`) and `blocked_reasons`, computed on the server with the same rule the web sign-in flow enforces, so a provider shown as `ready` is one people can actually sign in with.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
    * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.
@@ -550,7 +631,7 @@ var AppAuthConfigProvidersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-auth-config-providers
    * @example
    * ```ts
-   * const result = await auth.admin.app("app").authConfig.providers.list();
+   * const result = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").authConfig.providers.list();
    * ```
    */
   list(options) {
@@ -559,6 +640,9 @@ var AppAuthConfigProvidersResource = class extends APIResource {
   /**
    * Write or replace the config for an (app, provider). Validates the body via the provider impl's `parseConfig` before encrypting; malformed config 400s. Default `enabled=false`.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param provider - The sign-in provider: `google`, `github` or `apple`.
    * @param params - `Auth.AuthConfigProviderReplaceParams`.
    * @param options - Per-request options.
@@ -569,7 +653,7 @@ var AppAuthConfigProvidersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#put-v1-apps-app-id-auth-config-providers-provider
    * @example
    * ```ts
-   * const providerDetail = await auth.admin.app("app").authConfig.providers.replace("provider", { config: {} });
+   * const providerDetail = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").authConfig.providers.replace("google", { config: {} });
    * ```
    */
   replace(provider, params, options) {
@@ -578,6 +662,9 @@ var AppAuthConfigProvidersResource = class extends APIResource {
   /**
    * Get the config for one (app, provider). Secrets are redacted — `private_key_present: true` is the only acknowledgement that a private key is on file.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param provider - The sign-in provider: `google`, `github` or `apple`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown provider id.
@@ -588,7 +675,7 @@ var AppAuthConfigProvidersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-auth-config-providers-provider
    * @example
    * ```ts
-   * const providerDetail = await auth.admin.app("app").authConfig.providers.retrieve("provider");
+   * const providerDetail = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").authConfig.providers.retrieve("google");
    * ```
    */
   retrieve(provider, options) {
@@ -597,6 +684,9 @@ var AppAuthConfigProvidersResource = class extends APIResource {
   /**
    * Partially update the config for an (app, provider). Only top-level keys present in `config` are changed; omitted keys — secrets included — keep their stored values. The merged config is validated by the provider impl's `parseConfig`; 404 if the provider is not configured yet (create it with PUT).
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param provider - The sign-in provider: `google`, `github` or `apple`.
    * @param params - `Auth.AuthConfigProviderUpdateParams`.
    * @param options - Per-request options.
@@ -608,7 +698,7 @@ var AppAuthConfigProvidersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-auth-config-providers-provider
    * @example
    * ```ts
-   * const providerDetail = await auth.admin.app("app").authConfig.providers.update("provider", { config: {} });
+   * const providerDetail = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").authConfig.providers.update("google", { config: {} });
    * ```
    */
   update(provider, params, options) {
@@ -623,6 +713,9 @@ var AppAuthConfigResource = class extends APIResource {
   /**
    * Get the per-app auth config (signup, signin, password policy, sessions).
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
    * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.
@@ -632,7 +725,7 @@ var AppAuthConfigResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-auth-config
    * @example
    * ```ts
-   * const authConfig = await auth.admin.app("app").authConfig.retrieve();
+   * const authConfig = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").authConfig.retrieve();
    * ```
    */
   retrieve(options) {
@@ -641,6 +734,9 @@ var AppAuthConfigResource = class extends APIResource {
   /**
    * Update the per-app auth config. Only fields you pass are changed.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.AuthConfigUpdateParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure — a value out of range (password length, token/session lifetimes, lockout threshold, max sessions, MFA grace days, unverified-account window), an unknown enum value, a `signup_default_role` that does not exist in this app, or a `bot_protection` change that cannot stand: no provider or site key on first setup, a hostname that is not a hostname, or `enabled: true` with no secret stored or sent.
@@ -653,7 +749,7 @@ var AppAuthConfigResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-auth-config
    * @example
    * ```ts
-   * const authConfig = await auth.admin.app("app").authConfig.update({ access_token_minutes: 60 });
+   * const authConfig = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").authConfig.update({ access_token_minutes: 60 });
    * ```
    */
   update(params, options) {
@@ -672,6 +768,9 @@ var AppCredentialsResource = class extends APIResource {
   /**
    * Create a new M2M client
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.CredentialCreateParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure (missing or invalid name).
@@ -684,7 +783,7 @@ var AppCredentialsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-credentials
    * @example
    * ```ts
-   * const m2mClientCreate = await auth.admin.app("app").credentials.create({ name: "CI Pipeline" });
+   * const m2mClientCreate = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").credentials.create({ name: "CI Pipeline" });
    * ```
    */
   create(params, options) {
@@ -693,6 +792,9 @@ var AppCredentialsResource = class extends APIResource {
   /**
    * Delete an M2M client
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param clientId - Id of the client.
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -703,7 +805,7 @@ var AppCredentialsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-credentials-client-id
    * @example
    * ```ts
-   * await auth.admin.app("app").credentials.delete("client");
+   * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").credentials.delete("m2m_a1b2c3d4e5f6");
    * ```
    */
   delete(clientId, options) {
@@ -712,6 +814,9 @@ var AppCredentialsResource = class extends APIResource {
   /**
    * List M2M clients
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.CredentialListParams`.
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -722,10 +827,10 @@ var AppCredentialsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-credentials
    * @example
    * ```ts
-   * for await (const credential of auth.admin.app("app").credentials.list()) {
+   * for await (const credential of auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").credentials.list()) {
    *   console.log(credential);
    * }
-   * const page = await auth.admin.app("app").credentials.list({}, { timeout: 5_000 });
+   * const page = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").credentials.list({}, { timeout: 5_000 });
    * ```
    */
   list(params, options) {
@@ -734,6 +839,9 @@ var AppCredentialsResource = class extends APIResource {
   /**
    * Get M2M client details
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param clientId - Id of the client.
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -744,7 +852,7 @@ var AppCredentialsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-credentials-client-id
    * @example
    * ```ts
-   * const m2mClientDetail = await auth.admin.app("app").credentials.retrieve("client");
+   * const m2mClientDetail = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").credentials.retrieve("m2m_a1b2c3d4e5f6");
    * ```
    */
   retrieve(clientId, options) {
@@ -753,6 +861,9 @@ var AppCredentialsResource = class extends APIResource {
   /**
    * Rotate M2M client secret
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param clientId - Id of the client.
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -763,7 +874,7 @@ var AppCredentialsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-credentials-client-id-rotate
    * @example
    * ```ts
-   * const m2mRotateSecret = await auth.admin.app("app").credentials.rotate("client");
+   * const m2mRotateSecret = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").credentials.rotate("m2m_a1b2c3d4e5f6");
    * ```
    */
   rotate(clientId, options) {
@@ -772,6 +883,9 @@ var AppCredentialsResource = class extends APIResource {
   /**
    * Update M2M client status
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param clientId - Id of the client.
    * @param params - `Auth.CredentialUpdateParams`.
    * @param options - Per-request options.
@@ -784,7 +898,7 @@ var AppCredentialsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-credentials-client-id
    * @example
    * ```ts
-   * const m2mClientDetail = await auth.admin.app("app").credentials.update("client", { is_active: true });
+   * const m2mClientDetail = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").credentials.update("m2m_a1b2c3d4e5f6", { is_active: true });
    * ```
    */
   update(clientId, params, options) {
@@ -793,6 +907,9 @@ var AppCredentialsResource = class extends APIResource {
   /**
    * Set scopes for an M2M client
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param clientId - Id of the client.
    * @param params - `Auth.CredentialUpdateScopesParams`.
    * @param options - Per-request options.
@@ -805,7 +922,7 @@ var AppCredentialsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#put-v1-apps-app-id-credentials-client-id-scopes
    * @example
    * ```ts
-   * const result = await auth.admin.app("app").credentials.updateScopes("client", { permissions: ["user.read", "app.read"] });
+   * const result = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").credentials.updateScopes("m2m_a1b2c3d4e5f6", { permissions: ["user.read", "app.read"] });
    * ```
    */
   updateScopes(clientId, params, options) {
@@ -842,6 +959,9 @@ var AppCustomDomainsResource = class extends APIResource {
    *
    * Reads the zone through the provider's API and plans both records: `create`, or `skip` when already there. Nothing is ever changed or deleted, and only names at or under the custom host are written (Cloudflare records are DNS-only, not proxied). Anything in the way (another CNAME at the host, A/MX/TXT records where the CNAME must go) refuses the whole apply with 409 and the plan, before anything is written. `dry_run: true` returns the plan and changes nothing; `dry_run: false` writes exactly that plan and runs a check straight away (the records are usually `propagating` for a few minutes). The token is used for this request only: never stored, logged, queued or returned; revoke it afterwards (`warnings` says so when it could see more than this zone).
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param domainId - Id of the domain.
    * @param params - `Auth.CustomDomainApplyParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
@@ -856,7 +976,7 @@ var AppCustomDomainsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-custom-domains-domain-id-apply
    * @example
    * ```ts
-   * const customDomainApplyResult = await auth.admin.app("app").customDomains.apply("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b", { dry_run: true, provider: "cloudflare", token: "cf-token-from-your-dashboard" });
+   * const customDomainApplyResult = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").customDomains.apply("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { dry_run: true, provider: "cloudflare", token: "cf-token-from-your-dashboard" });
    * ```
    */
   apply(domainId, params, options) {
@@ -867,6 +987,9 @@ var AppCustomDomainsResource = class extends APIResource {
    *
    * Asks the zone's own nameservers and a public resolver for both records, stores each record's state and conflicts, and moves the status: `active` once both are verified; an active domain turns `failing` only when a record is definitely gone or blocked (a DNS outage never takes a working domain down). Safe to repeat.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param domainId - Id of the domain.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `domainId` is not a UUID.
@@ -878,7 +1001,7 @@ var AppCustomDomainsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-custom-domains-domain-id-check
    * @example
    * ```ts
-   * const customDomain = await auth.admin.app("app").customDomains.check("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b");
+   * const customDomain = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").customDomains.check("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   check(domainId, options) {
@@ -889,6 +1012,9 @@ var AppCustomDomainsResource = class extends APIResource {
    *
    * Returns the two records to publish: a CNAME from the host to `edge_target`, and a TXT token at `_productcraft-auth.<host>` that proves the domain is yours. The zone and its DNS provider are detected, and the first check runs straight away, so `records[].state` and `conflicts` already say what is missing or in the way. Publish the records by hand, import `…/export`, or let `…/apply` write them with a short-lived provider token. The domain turns `active` once both records are seen. Sign-in tokens keep the canonical issuer (`https://api.auth.productcraft.co/{slug}`), so nothing changes for code that verifies them. One custom domain per app. While the feature is in early access it is switched on per workspace.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.CustomDomainCreateParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, INVALID_HOSTNAME, HOSTNAME_RESERVED, APEX_NOT_SUPPORTED: Not a usable host name (`INVALID_HOSTNAME`), one of ours (`HOSTNAME_RESERVED`), or the root of a DNS zone, which cannot hold a CNAME (`APEX_NOT_SUPPORTED`).
@@ -901,7 +1027,7 @@ var AppCustomDomainsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-custom-domains
    * @example
    * ```ts
-   * const customDomain = await auth.admin.app("app").customDomains.create({ hostname: "auth.acme.com" });
+   * const customDomain = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").customDomains.create({ hostname: "auth.acme.com" });
    * ```
    */
   create(params, options) {
@@ -912,6 +1038,9 @@ var AppCustomDomainsResource = class extends APIResource {
    *
    * The host stops serving this app at once and its certificate is no longer renewed. Your DNS records are not touched: delete the CNAME and the `_productcraft-auth` TXT record at your DNS provider. Sign-ins on the canonical host are unaffected.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param domainId - Id of the domain.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `domainId` is not a UUID.
@@ -923,7 +1052,7 @@ var AppCustomDomainsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-custom-domains-domain-id
    * @example
    * ```ts
-   * await auth.admin.app("app").customDomains.delete("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b");
+   * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").customDomains.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   delete(domainId, options) {
@@ -934,6 +1063,9 @@ var AppCustomDomainsResource = class extends APIResource {
    *
    * `format=bind`: a zone-file fragment (`$ORIGIN <zone>.`, `$TTL 3600`, names relative to the zone, a comment per record with its purpose and any conflict) that Cloudflare and Route 53 import directly. `format=csv`: `type,name,value,priority,ttl,purpose,required`, fully qualified names. By default only records not verified yet; `all=true` for both. Served as an attachment.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param domainId - Id of the domain.
    * @param params - `Auth.CustomDomainExportParams`.
    * @param options - Per-request options.
@@ -946,7 +1078,7 @@ var AppCustomDomainsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-custom-domains-domain-id-export
    * @example
    * ```ts
-   * const response = await auth.admin.app("app").customDomains.export("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b", { format: "bind" });
+   * const response = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").customDomains.export("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { format: "bind" });
    * const text = await response.text();
    * ```
    */
@@ -958,6 +1090,9 @@ var AppCustomDomainsResource = class extends APIResource {
    *
    * Each with its status and the last check of its records, plus `available`: whether custom domains are switched on for the workspace. Always a single page.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
    * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.
@@ -967,7 +1102,7 @@ var AppCustomDomainsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-custom-domains
    * @example
    * ```ts
-   * for await (const customDomain of auth.admin.app("app").customDomains.list()) {
+   * for await (const customDomain of auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").customDomains.list()) {
    *   console.log(customDomain);
    * }
    * ```
@@ -980,6 +1115,9 @@ var AppCustomDomainsResource = class extends APIResource {
    *
    * Reads stored state only; `POST …/check` runs a new DNS check.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param domainId - Id of the domain.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `domainId` is not a UUID.
@@ -991,7 +1129,7 @@ var AppCustomDomainsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-custom-domains-domain-id
    * @example
    * ```ts
-   * const customDomain = await auth.admin.app("app").customDomains.retrieve("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b");
+   * const customDomain = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").customDomains.retrieve("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   retrieve(domainId, options) {
@@ -1002,6 +1140,9 @@ var AppEndUserInsightsUsersResource = class extends APIResource {
   /**
    * One end-user's recorded activity: their audit trail, their sessions with device/IP, and their enrolled factors. `noActivityRecorded` distinguishes "nothing happened" from "no data".
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param userId - Id of the user.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `appId` or `userId` is not a UUID.
@@ -1013,7 +1154,7 @@ var AppEndUserInsightsUsersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-end-user-insights-users-user-id
    * @example
    * ```ts
-   * const endUserDetailInsights = await auth.admin.app("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b").endUserInsights.users.retrieve("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b");
+   * const endUserDetailInsights = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUserInsights.users.retrieve("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   retrieve(userId, options) {
@@ -1028,6 +1169,9 @@ var AppEndUserInsightsResource = class extends APIResource {
   /**
    * Auth health for this app over the last 30 days: verification completion, sign-in failure rate, MFA adoption, password-reset follow-through, and session counts. Rates are null when there is nothing to divide by.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `appId` is not a UUID.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -1037,7 +1181,7 @@ var AppEndUserInsightsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-end-user-insights
    * @example
    * ```ts
-   * const endUserInsights = await auth.admin.app("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b").endUserInsights.retrieve();
+   * const endUserInsights = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUserInsights.retrieve();
    * ```
    */
   retrieve(options) {
@@ -1048,6 +1192,9 @@ var AppEndUsersContactsResource = class extends APIResource {
   /**
    * Add a contact for an end-user (unverified).
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param userId - Id of the user.
    * @param params - `Auth.EndUserContactCreateParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
@@ -1061,7 +1208,7 @@ var AppEndUsersContactsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-user-id-contacts
    * @example
    * ```ts
-   * const accountContact = await auth.admin.app("app").endUsers.contacts.create("user", { type: "email", value: "string" });
+   * const accountContact = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.contacts.create("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { type: "email", value: "ada@example.com" });
    * ```
    */
   create(userId, params, options) {
@@ -1070,6 +1217,9 @@ var AppEndUsersContactsResource = class extends APIResource {
   /**
    * Delete a contact from an end-user.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param userId - Id of the user.
    * @param contactId - Id of the contact.
    * @param options - Per-request options.
@@ -1082,7 +1232,7 @@ var AppEndUsersContactsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-end-users-user-id-contacts-contact-id
    * @example
    * ```ts
-   * await auth.admin.app("app").endUsers.contacts.delete("user", "contact");
+   * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.contacts.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   delete(userId, contactId, options) {
@@ -1091,6 +1241,9 @@ var AppEndUsersContactsResource = class extends APIResource {
   /**
    * List an end-user's contacts.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param userId - Id of the user.
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -1101,7 +1254,7 @@ var AppEndUsersContactsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-end-users-user-id-contacts
    * @example
    * ```ts
-   * const accountContactList = await auth.admin.app("app").endUsers.contacts.list("user");
+   * const accountContactList = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.contacts.list("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   list(userId, options) {
@@ -1110,6 +1263,9 @@ var AppEndUsersContactsResource = class extends APIResource {
   /**
    * Promote a verified contact to primary.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param userId - Id of the user.
    * @param contactId - Id of the contact.
    * @param options - Per-request options.
@@ -1122,7 +1278,7 @@ var AppEndUsersContactsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-user-id-contacts-contact-id-promote
    * @example
    * ```ts
-   * await auth.admin.app("app").endUsers.contacts.promote("user", "contact");
+   * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.contacts.promote("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   promote(userId, contactId, options) {
@@ -1131,6 +1287,9 @@ var AppEndUsersContactsResource = class extends APIResource {
   /**
    * Reissue a verification code for a contact.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param userId - Id of the user.
    * @param contactId - Id of the contact.
    * @param options - Per-request options.
@@ -1143,7 +1302,7 @@ var AppEndUsersContactsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-user-id-contacts-contact-id-resend-verification
    * @example
    * ```ts
-   * const issuedVerificationCode = await auth.admin.app("app").endUsers.contacts.resendVerification("user", "contact");
+   * const issuedVerificationCode = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.contacts.resendVerification("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   resendVerification(userId, contactId, options) {
@@ -1156,6 +1315,9 @@ var AppEndUsersImportsResource = class extends APIResource {
    *
    * Row fields: `email` (required), `username`, `display_name`, `role`, `tenant_slugs` (array), `external_id`, `metadata`, `email_verified`, and `password_hash` + `password_hash_algorithm`.  `password_hash_algorithm` is `argon2id` or `bcrypt`. **argon2id** hashes are accepted at any parameters. **bcrypt** hashes (`$2a$`, `$2b$`, `$2y$` — Auth0, PHP `password_hash`, Spring, node `bcrypt`, Devise / Rails, Laravel, Django) are accepted at any valid cost (4-31), verified on the user's first signin and replaced by an argon2id hash of the same password in that request, so the user keeps their password and never notices. Signin pads a bcrypt verify up to the argon2id floor, so at cost 10 and below an imported account cannot be told apart by timing; at cost 11 and above the verify is slower than the floor and answers when it finishes — a small timing difference on migrated accounts only, gone after each one's first signin.  A re-run is idempotent: rows match on `external_id` first, then the primary email, and update rather than duplicate. An existing password, an already-verified address and an existing member's role are never overwritten — see the module docs for why each one.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Body is empty or contains no NDJSON rows.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -1167,7 +1329,7 @@ var AppEndUsersImportsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-import
    * @example
    * ```ts
-   * const importJob = await auth.admin.app("app").endUsers.imports.create();
+   * const importJob = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.imports.create();
    * ```
    */
   create(options) {
@@ -1178,6 +1340,9 @@ var AppEndUsersImportsResource = class extends APIResource {
    *
    * `status: succeeded` means the job RAN TO COMPLETION, not that every row landed — read `failed_count` and `errors` for that. `errors` is capped at the first 500 entries; the counts stay exact.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param jobId - Id of the job.
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -1188,7 +1353,7 @@ var AppEndUsersImportsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-end-users-import-job-id
    * @example
    * ```ts
-   * const importJob = await auth.admin.app("app").endUsers.imports.retrieve("job");
+   * const importJob = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.imports.retrieve("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   retrieve(jobId, options) {
@@ -1199,6 +1364,9 @@ var AppEndUsersInvitesResource = class extends APIResource {
   /**
    * Pre-allocate an EndUser invite. Dispatches an invitation email via the workspace's Mail sender.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.EndUserInviteCreateParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown role, or maxUses / expiresInHours out of range.
@@ -1209,7 +1377,7 @@ var AppEndUsersInvitesResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-invites
    * @example
    * ```ts
-   * const endUserInvite = await auth.admin.app("app").endUsers.invites.create({ email: "alice@example.com" });
+   * const endUserInvite = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.invites.create({ email: "alice@example.com" });
    * ```
    */
   create(params, options) {
@@ -1218,6 +1386,9 @@ var AppEndUsersInvitesResource = class extends APIResource {
   /**
    * Revoke an EndUser invite (soft-delete).
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param inviteId - Id of the invite.
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -1228,7 +1399,7 @@ var AppEndUsersInvitesResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-end-users-invites-invite-id
    * @example
    * ```ts
-   * await auth.admin.app("app").endUsers.invites.delete("invite");
+   * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.invites.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   delete(inviteId, options) {
@@ -1237,6 +1408,9 @@ var AppEndUsersInvitesResource = class extends APIResource {
   /**
    * List EndUser invites for this app, newest first. Filter by `?status=`.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.EndUserInviteListParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `status` value.
@@ -1246,10 +1420,10 @@ var AppEndUsersInvitesResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-end-users-invites
    * @example
    * ```ts
-   * for await (const invite of auth.admin.app("app").endUsers.invites.list()) {
+   * for await (const invite of auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.invites.list()) {
    *   console.log(invite);
    * }
-   * const page = await auth.admin.app("app").endUsers.invites.list({}, { timeout: 5_000 });
+   * const page = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.invites.list({}, { timeout: 5_000 });
    * ```
    */
   list(params, options) {
@@ -1262,6 +1436,9 @@ var AppEndUsersMfaResource = class extends APIResource {
    *
    * Disables every enabled factor on the account, destroys its recovery codes, and revokes every live session. The next sign-in on an app running `auth_config.mfa: "required"` returns `mfa_enrollment_required` and the user must enrol a new factor before a session is minted. On an app running `mfa: "optional"` the user simply ends up with no MFA, which is the pre-existing meaning of deleting their factors. All three steps matter: leaving the recovery codes alive would let whoever holds the old printout complete `/auth/mfa/recover` and skip enrolment entirely. Audited, and emits `user.mfa.factor_disabled` per factor plus one `user.mfa.reenrollment_required`. Idempotent.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param userId - Id of the user.
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -1272,7 +1449,7 @@ var AppEndUsersMfaResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-user-id-mfa-require-reenrollment
    * @example
    * ```ts
-   * const requireMfaReenrollment = await auth.admin.app("app").endUsers.mfa.requireReenrollment("user");
+   * const requireMfaReenrollment = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.mfa.requireReenrollment("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   requireReenrollment(userId, options) {
@@ -1283,6 +1460,9 @@ var AppEndUsersSessionsResource = class extends APIResource {
   /**
    * Revoke every active session for an end-user.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param userId - Id of the user.
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -1293,7 +1473,7 @@ var AppEndUsersSessionsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-user-id-sessions-revoke-all
    * @example
    * ```ts
-   * await auth.admin.app("app").endUsers.sessions.revokeAll("user");
+   * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.sessions.revokeAll("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   revokeAll(userId, options) {
@@ -1326,6 +1506,9 @@ var AppEndUsersResource = class extends APIResource {
    *
    * Deletes every matched account in one transaction. Each deleted account gets an `auth.account.deleted` audit row (`via: platform_bulk`) whose metadata carries the `selection` (`{ mode: "ids" }`, or `{ mode: "filter", filter }`), so a filter sweep reads as one. The workspace audit log gets one `auth.end_users.deleted` row with the count. `user.deleted` (`via: "platform_bulk"`) fires per account only when 100 or fewer were deleted.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.EndUserBulkDeleteParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid `selection` body, or an unfiltered selection without `confirm_all_in_app: true` (including more than 5,000 ids).
@@ -1337,7 +1520,7 @@ var AppEndUsersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-bulk-delete
    * @example
    * ```ts
-   * const bulkAffectedUsers = await auth.admin.app("app").endUsers.bulkDelete({ selection: { mode: "ids" } });
+   * const bulkAffectedUsers = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.bulkDelete({ selection: { mode: "ids" } });
    * ```
    */
   bulkDelete(params, options) {
@@ -1346,6 +1529,9 @@ var AppEndUsersResource = class extends APIResource {
   /**
    * Bulk-revoke sessions across a selection.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.EndUserBulkRevokeSessionsParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid `selection` body (including more than 5,000 ids).
@@ -1357,7 +1543,7 @@ var AppEndUsersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-bulk-revoke-sessions
    * @example
    * ```ts
-   * const bulkAffectedUsers = await auth.admin.app("app").endUsers.bulkRevokeSessions({ selection: { mode: "ids" } });
+   * const bulkAffectedUsers = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.bulkRevokeSessions({ selection: { mode: "ids" } });
    * ```
    */
   bulkRevokeSessions(params, options) {
@@ -1366,6 +1552,9 @@ var AppEndUsersResource = class extends APIResource {
   /**
    * Bulk-assign a role across a selection.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.EndUserBulkUpdateRoleParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid `selection` body or empty `roleName`.
@@ -1377,7 +1566,7 @@ var AppEndUsersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-bulk-update-role
    * @example
    * ```ts
-   * const bulkAffectedUsers = await auth.admin.app("app").endUsers.bulkUpdateRole({ role_name: "string", selection: { mode: "ids" } });
+   * const bulkAffectedUsers = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.bulkUpdateRole({ role_name: "member", selection: { mode: "ids" } });
    * ```
    */
   bulkUpdateRole(params, options) {
@@ -1386,6 +1575,9 @@ var AppEndUsersResource = class extends APIResource {
   /**
    * Bulk-update status across a selection.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.EndUserBulkUpdateStatusParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid `selection` body, or `status` is not one of active, suspended, deactivated.
@@ -1397,7 +1589,7 @@ var AppEndUsersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-bulk-update-status
    * @example
    * ```ts
-   * const bulkAffectedUsers = await auth.admin.app("app").endUsers.bulkUpdateStatus({ selection: { mode: "ids" }, status: "suspended" });
+   * const bulkAffectedUsers = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.bulkUpdateStatus({ selection: { mode: "ids" }, status: "suspended" });
    * ```
    */
   bulkUpdateStatus(params, options) {
@@ -1408,6 +1600,9 @@ var AppEndUsersResource = class extends APIResource {
    *
    * Removes the account with its contacts, sessions and tenant memberships. Writes one `auth.account.deleted` audit row (`via: platform`) in the same transaction, mirrors the deletion into the workspace audit log as `auth.end_users.deleted`, and fires `user.deleted` with `via: "platform"`.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param userId - Id of the user.
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -1418,7 +1613,7 @@ var AppEndUsersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-end-users-user-id
    * @example
    * ```ts
-   * await auth.admin.app("app").endUsers.delete("user");
+   * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   delete(userId, options) {
@@ -1429,6 +1624,9 @@ var AppEndUsersResource = class extends APIResource {
    *
    * Streamed in keyset batches — neither the service nor the client holds the whole directory. Ordered oldest-first by `(created_at, id)` so a re-run is stable. Gated on `auth.user.export`, which is escalation class: this hands over every address in the directory in one call, where `auth.list` pages it. Hard cap of 1,000,000 rows; a wider request is refused with 413 before any body is written.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.EndUserExportParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `format`.
@@ -1441,7 +1639,7 @@ var AppEndUsersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-end-users-export
    * @example
    * ```ts
-   * const response = await auth.admin.app("app").endUsers.export();
+   * const response = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.export();
    * const text = await response.text();
    * ```
    */
@@ -1451,6 +1649,9 @@ var AppEndUsersResource = class extends APIResource {
   /**
    * List end-users in this app (cursor-paginated).
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.EndUserListParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `signal` / `sort` / `order`, or a `cursor` minted under a different ordering than the one requested.
@@ -1460,10 +1661,10 @@ var AppEndUsersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-end-users
    * @example
    * ```ts
-   * for await (const endUser of auth.admin.app("app").endUsers.list()) {
+   * for await (const endUser of auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.list()) {
    *   console.log(endUser);
    * }
-   * const page = await auth.admin.app("app").endUsers.list({}, { timeout: 5_000 });
+   * const page = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.list({}, { timeout: 5_000 });
    * ```
    */
   list(params, options) {
@@ -1472,6 +1673,9 @@ var AppEndUsersResource = class extends APIResource {
   /**
    * Resend verification to the primary email contact.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param userId - Id of the user.
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -1483,7 +1687,7 @@ var AppEndUsersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-user-id-resend-verification
    * @example
    * ```ts
-   * const issuedVerificationCode = await auth.admin.app("app").endUsers.resendVerification("user");
+   * const issuedVerificationCode = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.resendVerification("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   resendVerification(userId, options) {
@@ -1492,6 +1696,9 @@ var AppEndUsersResource = class extends APIResource {
   /**
    * Get one end-user.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param userId - Id of the user.
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -1502,7 +1709,7 @@ var AppEndUsersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-end-users-user-id
    * @example
    * ```ts
-   * const endUserSummary = await auth.admin.app("app").endUsers.retrieve("user");
+   * const endUserSummary = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.retrieve("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   retrieve(userId, options) {
@@ -1511,6 +1718,9 @@ var AppEndUsersResource = class extends APIResource {
   /**
    * Update end-user display name, primary email, or metadata keys (merged).
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param userId - Id of the user.
    * @param params - `Auth.EndUserUpdateParams`.
    * @param options - Per-request options.
@@ -1523,7 +1733,7 @@ var AppEndUsersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-end-users-user-id
    * @example
    * ```ts
-   * const endUserSummary = await auth.admin.app("app").endUsers.update("user", { display_name: "string" });
+   * const endUserSummary = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.update("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { display_name: "Ada Lovelace" });
    * ```
    */
   update(userId, params, options) {
@@ -1532,6 +1742,9 @@ var AppEndUsersResource = class extends APIResource {
   /**
    * Assign an end-user a role.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param userId - Id of the user.
    * @param params - `Auth.EndUserUpdateRoleParams`.
    * @param options - Per-request options.
@@ -1544,7 +1757,7 @@ var AppEndUsersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-end-users-user-id-role
    * @example
    * ```ts
-   * const endUserRoleAssignment = await auth.admin.app("app").endUsers.updateRole("user", { role_name: "admin" });
+   * const endUserRoleAssignment = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.updateRole("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { role_name: "admin" });
    * ```
    */
   updateRole(userId, params, options) {
@@ -1553,6 +1766,9 @@ var AppEndUsersResource = class extends APIResource {
   /**
    * Change end-user status (active / suspended / deactivated).
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param userId - Id of the user.
    * @param params - `Auth.EndUserUpdateStatusParams`.
    * @param options - Per-request options.
@@ -1565,7 +1781,7 @@ var AppEndUsersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-end-users-user-id-status
    * @example
    * ```ts
-   * const endUserSummary = await auth.admin.app("app").endUsers.updateStatus("user", { status: "suspended" });
+   * const endUserSummary = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.updateStatus("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { status: "suspended" });
    * ```
    */
   updateStatus(userId, params, options) {
@@ -1618,6 +1834,9 @@ var AppMembersResource = class extends APIResource {
   /**
    * Remove a member from the app
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param accountId - Id of the account.
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -1628,7 +1847,7 @@ var AppMembersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-members-account-id
    * @example
    * ```ts
-   * await auth.admin.app("app").members.delete("account");
+   * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").members.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   delete(accountId, options) {
@@ -1637,6 +1856,9 @@ var AppMembersResource = class extends APIResource {
   /**
    * List app members (PlatformUser view of EndUser memberships)
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.MemberListParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid pagination cursor.
@@ -1648,10 +1870,10 @@ var AppMembersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-members
    * @example
    * ```ts
-   * for await (const member of auth.admin.app("app").members.list()) {
+   * for await (const member of auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").members.list()) {
    *   console.log(member);
    * }
-   * const page = await auth.admin.app("app").members.list({}, { timeout: 5_000 });
+   * const page = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").members.list({}, { timeout: 5_000 });
    * ```
    */
   list(params, options) {
@@ -1672,6 +1894,9 @@ var AppNotificationSettingsResource = class extends APIResource {
    *
    * `effective_sender` is the sender emails actually go out from, checked live in Mail with your own access (the workspace default sender, or the app's custom address).
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
    * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.
@@ -1681,7 +1906,7 @@ var AppNotificationSettingsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-notification-settings
    * @example
    * ```ts
-   * const appNotificationSettings = await auth.admin.app("app").notificationSettings.retrieve();
+   * const appNotificationSettings = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").notificationSettings.retrieve();
    * ```
    */
   retrieve(options) {
@@ -1692,6 +1917,9 @@ var AppNotificationSettingsResource = class extends APIResource {
    *
    * Turning `notifications_via_envoi` on (from off) creates the default template of every empty slot in the workspace's Mail templates (`auth-verification`, `auth-welcome`, `auth-password-reset`, `auth-invite`, `auth-mfa-code`), reusing a template that already has that name, and fills the slot. Templates are created with your own Mail access; a slot that could not be created stays empty. A slot you clear later is not refilled until emails are switched off and on again.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.NotificationSettingUpdateParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid payload.
@@ -1704,7 +1932,7 @@ var AppNotificationSettingsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-notification-settings
    * @example
    * ```ts
-   * const appNotificationSettings = await auth.admin.app("app").notificationSettings.update({ default_sender_address: "ada@example.com" });
+   * const appNotificationSettings = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").notificationSettings.update({ default_sender_address: "ada@example.com" });
    * ```
    */
   update(params, options) {
@@ -1717,6 +1945,9 @@ var AppNotificationsResource = class extends APIResource {
    *
    * Sends the slot's real Mail template, with this app's real sender (the workspace default or the custom address) and example values for every variable, to your own verified account address. It cannot be sent anywhere else. It uses your own Mail access, goes through the same send path as real emails, and shows up in Mail > Emails. At most 10 tests per person per hour. Not available to API keys (a key has no inbox).
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param slot - The email to test.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `slot`.
@@ -1732,7 +1963,7 @@ var AppNotificationsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-notifications-slot-test
    * @example
    * ```ts
-   * const notificationTest = await auth.admin.app("app").notifications.test("slot");
+   * const notificationTest = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").notifications.test("verification");
    * ```
    */
   test(slot, options) {
@@ -1745,6 +1976,9 @@ var AppPermissionsEnforcementResource = class extends APIResource {
    *
    * Returns the deduplicated set of permission strings that any handler in this users-api build gates via `@RequireAppPermission`. Drives the console "Enforced" badge — a customer who binds `user.delete` to a role can see whether any route in this deploy actually checks for it. App-agnostic in shape; the path parameter is included for URN symmetry with the rest of the per-app surface, not to narrow the response.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
    * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.
@@ -1754,7 +1988,7 @@ var AppPermissionsEnforcementResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-permissions-enforcement
    * @example
    * ```ts
-   * const enforcedPermissions = await auth.admin.app("app").permissions.enforcement.list();
+   * const enforcedPermissions = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").permissions.enforcement.list();
    * ```
    */
   list(options) {
@@ -1769,6 +2003,9 @@ var AppPermissionsResource = class extends APIResource {
   /**
    * Create a custom permission
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.AppScopedPermissionCreateParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure (`resource` / `action` segment format, or `description` over 256 chars).
@@ -1781,7 +2018,7 @@ var AppPermissionsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-permissions
    * @example
    * ```ts
-   * const permission = await auth.admin.app("app").permissions.create({ action: "read", resource: "project" });
+   * const permission = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").permissions.create({ action: "read", resource: "project" });
    * ```
    */
   create(params, options) {
@@ -1790,6 +2027,9 @@ var AppPermissionsResource = class extends APIResource {
   /**
    * Delete a custom permission
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param permissionKey - Permission key, `resource.action` (e.g. `invoice.read`).
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `permissionKey` is not in `resource.action` format.
@@ -1801,7 +2041,7 @@ var AppPermissionsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-permissions-permission-key
    * @example
    * ```ts
-   * await auth.admin.app("app").permissions.delete("permission_key");
+   * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").permissions.delete("invoice.read");
    * ```
    */
   delete(permissionKey, options) {
@@ -1810,6 +2050,9 @@ var AppPermissionsResource = class extends APIResource {
   /**
    * List all permissions (system + custom)
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
    * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.
@@ -1819,7 +2062,7 @@ var AppPermissionsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-permissions
    * @example
    * ```ts
-   * const result = await auth.admin.app("app").permissions.list();
+   * const result = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").permissions.list();
    * ```
    */
   list(options) {
@@ -1830,6 +2073,9 @@ var AppRolesPermissionsResource = class extends APIResource {
   /**
    * List all available permissions
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
    * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.
@@ -1839,7 +2085,7 @@ var AppRolesPermissionsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-roles-permissions
    * @example
    * ```ts
-   * const result = await auth.admin.app("app").roles.permissions.list();
+   * const result = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").roles.permissions.list();
    * ```
    */
   list(options) {
@@ -1854,6 +2100,9 @@ var AppRolesResource = class extends APIResource {
   /**
    * Assign a role to a user
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.RoleAssignParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure (`accountId` not a UUID, or `role` empty / over 64 chars).
@@ -1865,7 +2114,7 @@ var AppRolesResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-roles-assign
    * @example
    * ```ts
-   * const appMembership = await auth.admin.app("app").roles.assign({ account_id: "string", role: "admin" });
+   * const appMembership = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").roles.assign({ account_id: "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", role: "admin" });
    * ```
    */
   assign(params, options) {
@@ -1874,6 +2123,9 @@ var AppRolesResource = class extends APIResource {
   /**
    * Create a new role (no permissions yet — set them via PUT /:roleName/permissions)
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.AppScopedRoleCreateParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure (`name` 1-64 chars, `description` up to 256).
@@ -1886,7 +2138,7 @@ var AppRolesResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-roles
    * @example
    * ```ts
-   * const role = await auth.admin.app("app").roles.create({ name: "editor" });
+   * const role = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").roles.create({ name: "editor" });
    * ```
    */
   create(params, options) {
@@ -1895,6 +2147,9 @@ var AppRolesResource = class extends APIResource {
   /**
    * Delete a custom role
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param roleName - Name of the role (e.g. `admin`).
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -1906,7 +2161,7 @@ var AppRolesResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-roles-role-name
    * @example
    * ```ts
-   * await auth.admin.app("app").roles.delete("role_name");
+   * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").roles.delete("admin");
    * ```
    */
   delete(roleName, options) {
@@ -1915,6 +2170,9 @@ var AppRolesResource = class extends APIResource {
   /**
    * List all roles in an app. Filter by `?search=` on the role name.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.AppScopedRoleListParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`.
@@ -1926,10 +2184,10 @@ var AppRolesResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-roles
    * @example
    * ```ts
-   * for await (const role of auth.admin.app("app").roles.list()) {
+   * for await (const role of auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").roles.list()) {
    *   console.log(role);
    * }
-   * const page = await auth.admin.app("app").roles.list({}, { timeout: 5_000 });
+   * const page = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").roles.list({}, { timeout: 5_000 });
    * ```
    */
   list(params, options) {
@@ -1938,6 +2196,9 @@ var AppRolesResource = class extends APIResource {
   /**
    * Get role details with permissions
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param roleName - Name of the role (e.g. `admin`).
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -1948,7 +2209,7 @@ var AppRolesResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-roles-role-name
    * @example
    * ```ts
-   * const roleWithPermissions = await auth.admin.app("app").roles.retrieve("role_name");
+   * const roleWithPermissions = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").roles.retrieve("admin");
    * ```
    */
   retrieve(roleName, options) {
@@ -1957,6 +2218,9 @@ var AppRolesResource = class extends APIResource {
   /**
    * Update role name or description
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param roleName - Name of the role (e.g. `admin`).
    * @param params - `Auth.AppScopedRoleUpdateParams`.
    * @param options - Per-request options.
@@ -1969,7 +2233,7 @@ var AppRolesResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-roles-role-name
    * @example
    * ```ts
-   * const role = await auth.admin.app("app").roles.update("role_name", { description: "Updated description" });
+   * const role = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").roles.update("admin", { description: "Updated description" });
    * ```
    */
   update(roleName, params, options) {
@@ -1978,6 +2242,9 @@ var AppRolesResource = class extends APIResource {
   /**
    * Set permissions for a role (caller-narrowed: caller must hold every requested permission)
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param roleName - Name of the role (e.g. `admin`).
    * @param params - `Auth.AppScopedRoleUpdatePermissionsParams`.
    * @param options - Per-request options.
@@ -1990,7 +2257,7 @@ var AppRolesResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#put-v1-apps-app-id-roles-role-name-permissions
    * @example
    * ```ts
-   * const result = await auth.admin.app("app").roles.updatePermissions("role_name", { permissions: ["user.read", "role.create"] });
+   * const result = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").roles.updatePermissions("admin", { permissions: ["user.read", "role.create"] });
    * ```
    */
   updatePermissions(roleName, params, options) {
@@ -2027,6 +2294,9 @@ var AppSetupStatusResource = class extends APIResource {
    *
    * Rows, in order: `signups` (attention while sign-ups are off), `redirect_origins` (blocked until at least one site may start sign-in), one `provider_<id>` row per switched-on sign-in provider (blocked while its status is blocked), `email` (sender chosen and a template for every email; attention while emails are off), `api_key` (attention until an active app key exists), `webhook` (attention until an endpoint has accepted a delivery), and `passkeys` (only while passkeys are on; blocked when no allowed redirect origin is on the passkey site). `complete` is true once no row is `not_set` or `blocked`. Each `fix.href` is a console path to the exact setting. Computed on every request from stored settings, plus the workspace default sender read from Mail with your own access when emails use it: nothing here calls DNS or a sign-in provider (a provider whose last credential check was rejected shows as blocked). A ready provider row carries `test.action: sign_in.try`: run it with `POST /v1/apps/{appId}/sign-in-tests` `{ method: "oauth", provider }`.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
    * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.
@@ -2036,7 +2306,7 @@ var AppSetupStatusResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-setup-status
    * @example
    * ```ts
-   * const setupStatus = await auth.admin.app("app").setupStatus.retrieve();
+   * const setupStatus = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").setupStatus.retrieve();
    * ```
    */
   retrieve(options) {
@@ -2049,6 +2319,9 @@ var AppSignInTestsResource = class extends APIResource {
    *
    * For `oauth`, the server first checks what it can on its own (an allowed redirect origin, saved credentials, and the provider credential check). If one fails, the test comes back `failed` at once with the fix. Otherwise open `start_url` in a popup: the person signs in at the provider, the provider returns to Auth, Auth resolves who it is exactly as a real sign-in would, records `would_sign_in_existing` or `would_create` (or the provider error mapped to its fix), creates no account and issues no token, then sends the popup to the console result page. Poll `GET …/sign-in-tests/{id}` until `state` is not `pending`. Works with a provider that is saved but not switched on yet. For `password` / `otp`, the test runs now: it checks the sign-up or sign-in rules for your own email and sends the real email to your own verified address. At most 20 tests per app per hour; tests are deleted after 24 hours.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.SignInTestCreateParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, CUSTOM_DOMAIN_OAUTH_ONLY: Unknown `method` or provider, `provider` missing for `oauth`, or `custom_domain` on a `password` / `otp` test (`CUSTOM_DOMAIN_OAUTH_ONLY`).
@@ -2061,7 +2334,7 @@ var AppSignInTestsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-sign-in-tests
    * @example
    * ```ts
-   * const signInTest = await auth.admin.app("app").signInTests.create({ method: "oauth" });
+   * const signInTest = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").signInTests.create({ method: "oauth" });
    * ```
    */
   create(params, options) {
@@ -2072,6 +2345,9 @@ var AppSignInTestsResource = class extends APIResource {
    *
    * Poll this after opening `start_url`. `state` turns `succeeded` (with `outcome` and `identity`) or `failed` (with `error.fix`). A test that is never finished turns `failed` with code `expired` 15 minutes after it was created.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param testId - Id of the test.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `testId` is not a UUID.
@@ -2083,7 +2359,7 @@ var AppSignInTestsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-sign-in-tests-test-id
    * @example
    * ```ts
-   * const signInTest = await auth.admin.app("app").signInTests.retrieve("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b");
+   * const signInTest = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").signInTests.retrieve("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   retrieve(testId, options) {
@@ -2096,6 +2372,9 @@ var AppTenantApiKeysConfigResource = class extends APIResource {
    *
    * Includes the platform kill switch `suspended`. Requires `auth.read` on the app.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
    * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app.
@@ -2105,7 +2384,7 @@ var AppTenantApiKeysConfigResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-tenant-api-keys-config
    * @example
    * ```ts
-   * const tenantApiKeysConfig = await auth.admin.app("app").tenantApiKeys.config.retrieve();
+   * const tenantApiKeysConfig = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenantApiKeys.config.retrieve();
    * ```
    */
   retrieve(options) {
@@ -2116,6 +2395,9 @@ var AppTenantApiKeysConfigResource = class extends APIResource {
    *
    * Fields you leave out keep their stored value. `suspended: true` is the kill switch: introspection answers `{"active": false}` for every key of the app at once, and key management is refused, until you set it back to `false`. The app's own config push (`PUT /:appSlug/v1/tenant-api-keys/config`) can never change it. Requires `auth.update` on the app.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.AppScopedTenantApiKeyConfigUpdateParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, TENANT_API_KEYS_SCOPE_INVALID, TENANT_API_KEYS_UNKNOWN_ROLE, TENANT_API_KEY_EXPIRY_INVALID, TENANT_API_KEYS_NO_SCOPES: `VALIDATION_ERROR`, `TENANT_API_KEYS_SCOPE_INVALID`, `TENANT_API_KEYS_UNKNOWN_ROLE`, `TENANT_API_KEY_EXPIRY_INVALID`, `TENANT_API_KEYS_NO_SCOPES`, or a malformed `Idempotency-Key`.
@@ -2128,7 +2410,7 @@ var AppTenantApiKeysConfigResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#put-v1-apps-app-id-tenant-api-keys-config
    * @example
    * ```ts
-   * const tenantApiKeysConfig = await auth.admin.app("app").tenantApiKeys.config.update({ default_expiry_days: 7 });
+   * const tenantApiKeysConfig = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenantApiKeys.config.update({ default_expiry_days: 7 });
    * ```
    */
   update(params, options) {
@@ -2145,6 +2427,9 @@ var AppTenantApiKeysResource = class extends APIResource {
    *
    * Immediate and final; recorded as revoked by you (`revoked_by_type: platform_user`) in the key and in the audit log. Idempotent: revoking a revoked key is a 204 that changes nothing. Requires `auth.revoke` on the app.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param keyId - Key id (UUID) or display id (`tak_…`).
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -2155,7 +2440,7 @@ var AppTenantApiKeysResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-tenant-api-keys-key-id
    * @example
    * ```ts
-   * await auth.admin.app("app").tenantApiKeys.delete("key");
+   * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenantApiKeys.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   delete(keyId, options) {
@@ -2166,6 +2451,9 @@ var AppTenantApiKeysResource = class extends APIResource {
    *
    * Every tenant of the app, newest first, cursor-paginated (20 per page, max 100). Secrets are never returned. Each key names its creator (`created_by`), and its `status` is `orphaned` when it is neither revoked nor expired but its creator left the tenant or the tenant is not active (introspection refuses it). Requires `auth.read` on the app.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.AppScopedTenantApiKeyListParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `status` or malformed `cursor`.
@@ -2177,10 +2465,10 @@ var AppTenantApiKeysResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-tenant-api-keys
    * @example
    * ```ts
-   * for await (const tenantApiKey of auth.admin.app("app").tenantApiKeys.list()) {
+   * for await (const tenantApiKey of auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenantApiKeys.list()) {
    *   console.log(tenantApiKey);
    * }
-   * const page = await auth.admin.app("app").tenantApiKeys.list({}, { timeout: 5_000 });
+   * const page = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenantApiKeys.list({}, { timeout: 5_000 });
    * ```
    */
   list(params, options) {
@@ -2191,6 +2479,9 @@ var AppTenantsInvitesResource = class extends APIResource {
   /**
    * Invite an email address into a tenant. Returns the plaintext code once; only its SHA-256 digest is stored.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param tenantId - Id of the tenant.
    * @param params - `Auth.AppScopedTenantInviteCreateParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
@@ -2203,7 +2494,7 @@ var AppTenantsInvitesResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-tenants-tenant-id-invites
    * @example
    * ```ts
-   * const createTenantInvite = await auth.admin.app("app").tenants.invites.create("tenant", { email: "alice@example.com", role_name: "member" });
+   * const createTenantInvite = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenants.invites.create("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { email: "alice@example.com", role_name: "member" });
    * ```
    */
   create(tenantId, params, options) {
@@ -2212,6 +2503,9 @@ var AppTenantsInvitesResource = class extends APIResource {
   /**
    * Revoke a pending invite. Idempotent — a second revoke is a 204 no-op and fires no second webhook.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param tenantId - Id of the tenant.
    * @param inviteId - Id of the invite.
    * @param options - Per-request options.
@@ -2222,7 +2516,7 @@ var AppTenantsInvitesResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-tenants-tenant-id-invites-invite-id
    * @example
    * ```ts
-   * await auth.admin.app("app").tenants.invites.delete("tenant", "invite");
+   * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenants.invites.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   delete(tenantId, inviteId, options) {
@@ -2231,6 +2525,9 @@ var AppTenantsInvitesResource = class extends APIResource {
   /**
    * List a tenant's invites, newest first. Optional `?status=pending|revoked|expired|used`. Codes are never returned.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param tenantId - Id of the tenant.
    * @param params - `Auth.AppScopedTenantInviteListParams`.
    * @param options - Per-request options.
@@ -2242,10 +2539,10 @@ var AppTenantsInvitesResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-tenants-tenant-id-invites
    * @example
    * ```ts
-   * for await (const invite of auth.admin.app("app").tenants.invites.list("tenant")) {
+   * for await (const invite of auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenants.invites.list("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f")) {
    *   console.log(invite);
    * }
-   * const page = await auth.admin.app("app").tenants.invites.list("tenant", {}, { timeout: 5_000 });
+   * const page = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenants.invites.list("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", {}, { timeout: 5_000 });
    * ```
    */
   list(tenantId, params, options) {
@@ -2256,6 +2553,9 @@ var AppTenantsMembersResource = class extends APIResource {
   /**
    * Add a member to a tenant.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param tenantId - Id of the tenant.
    * @param params - `Auth.AppScopedTenantMemberCreateParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
@@ -2269,7 +2569,7 @@ var AppTenantsMembersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-tenants-tenant-id-members
    * @example
    * ```ts
-   * const addMember = await auth.admin.app("app").tenants.members.create("tenant", { role_name: "member" });
+   * const addMember = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenants.members.create("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { role_name: "member" });
    * ```
    */
   create(tenantId, params, options) {
@@ -2278,6 +2578,9 @@ var AppTenantsMembersResource = class extends APIResource {
   /**
    * Remove a member from a tenant.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param tenantId - Id of the tenant.
    * @param accountId - Id of the account.
    * @param options - Per-request options.
@@ -2289,7 +2592,7 @@ var AppTenantsMembersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-tenants-tenant-id-members-account-id
    * @example
    * ```ts
-   * await auth.admin.app("app").tenants.members.delete("tenant", "account");
+   * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenants.members.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   delete(tenantId, accountId, options) {
@@ -2298,6 +2601,9 @@ var AppTenantsMembersResource = class extends APIResource {
   /**
    * List members of a tenant, newest membership first. Filter by `?search=` and/or `?role=`.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param tenantId - Id of the tenant.
    * @param params - `Auth.AppScopedTenantMemberListParams`.
    * @param options - Per-request options.
@@ -2310,10 +2616,10 @@ var AppTenantsMembersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-tenants-tenant-id-members
    * @example
    * ```ts
-   * for await (const member of auth.admin.app("app").tenants.members.list("tenant")) {
+   * for await (const member of auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenants.members.list("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f")) {
    *   console.log(member);
    * }
-   * const page = await auth.admin.app("app").tenants.members.list("tenant", {}, { timeout: 5_000 });
+   * const page = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenants.members.list("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", {}, { timeout: 5_000 });
    * ```
    */
   list(tenantId, params, options) {
@@ -2322,6 +2628,9 @@ var AppTenantsMembersResource = class extends APIResource {
   /**
    * Change a member's role inside a tenant.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param tenantId - Id of the tenant.
    * @param accountId - Id of the account.
    * @param params - `Auth.AppScopedTenantMemberUpdateParams`.
@@ -2335,7 +2644,7 @@ var AppTenantsMembersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-tenants-tenant-id-members-account-id
    * @example
    * ```ts
-   * const tenantMembership = await auth.admin.app("app").tenants.members.update("tenant", "account", { role_name: "admin" });
+   * const tenantMembership = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenants.members.update("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { role_name: "admin" });
    * ```
    */
   update(tenantId, accountId, params, options) {
@@ -2354,6 +2663,9 @@ var AppTenantsResource = class extends APIResource {
   /**
    * Create a tenant in this app. Auth-admin lane; requires auth.tenant.create on the app URN.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.AppScopedTenantCreateParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid body, empty `displayName`, or `slug` not 1-64 chars of [a-z0-9-].
@@ -2366,7 +2678,7 @@ var AppTenantsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-tenants
    * @example
    * ```ts
-   * const tenant = await auth.admin.app("app").tenants.create({ display_name: "Acme Co" });
+   * const tenant = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenants.create({ display_name: "Acme Co" });
    * ```
    */
   create(params, options) {
@@ -2375,6 +2687,9 @@ var AppTenantsResource = class extends APIResource {
   /**
    * Delete a tenant.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param tenantId - Id of the tenant.
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -2385,7 +2700,7 @@ var AppTenantsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-tenants-tenant-id
    * @example
    * ```ts
-   * await auth.admin.app("app").tenants.delete("tenant");
+   * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenants.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   delete(tenantId, options) {
@@ -2394,6 +2709,9 @@ var AppTenantsResource = class extends APIResource {
   /**
    * List tenants in this app, paginated by created_at desc.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.AppScopedTenantListParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `status` value.
@@ -2405,10 +2723,10 @@ var AppTenantsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-tenants
    * @example
    * ```ts
-   * for await (const tenant of auth.admin.app("app").tenants.list()) {
+   * for await (const tenant of auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenants.list()) {
    *   console.log(tenant);
    * }
-   * const page = await auth.admin.app("app").tenants.list({}, { timeout: 5_000 });
+   * const page = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenants.list({}, { timeout: 5_000 });
    * ```
    */
   list(params, options) {
@@ -2417,6 +2735,9 @@ var AppTenantsResource = class extends APIResource {
   /**
    * Get a single tenant by id or display id.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param tenantId - Id of the tenant.
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -2427,7 +2748,7 @@ var AppTenantsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-tenants-tenant-id
    * @example
    * ```ts
-   * const tenant = await auth.admin.app("app").tenants.retrieve("tenant");
+   * const tenant = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenants.retrieve("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   retrieve(tenantId, options) {
@@ -2436,6 +2757,9 @@ var AppTenantsResource = class extends APIResource {
   /**
    * Update a tenant (display_name, slug, status, metadata).
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param tenantId - Id of the tenant.
    * @param params - `Auth.AppScopedTenantUpdateParams`.
    * @param options - Per-request options.
@@ -2449,7 +2773,7 @@ var AppTenantsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-tenants-tenant-id
    * @example
    * ```ts
-   * const tenant = await auth.admin.app("app").tenants.update("tenant", { display_name: "string" });
+   * const tenant = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenants.update("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { display_name: "Acme Inc" });
    * ```
    */
   update(tenantId, params, options) {
@@ -2460,6 +2784,9 @@ var AppUnverifiedAccountExpiryResource = class extends APIResource {
   /**
    * Get the unverified-account expiry setting and how many accounts it deleted in the last 30 days.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
    * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.
@@ -2469,7 +2796,7 @@ var AppUnverifiedAccountExpiryResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-unverified-account-expiry
    * @example
    * ```ts
-   * const unverifiedAccountExpiryStatus = await auth.admin.app("app").unverifiedAccountExpiry.retrieve();
+   * const unverifiedAccountExpiryStatus = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").unverifiedAccountExpiry.retrieve();
    * ```
    */
   retrieve(options) {
@@ -2480,6 +2807,9 @@ var AppUnverifiedAccountExpiryResource = class extends APIResource {
    *
    * Permanently deletes every account that qualifies under the app's `unverified_account_ttl_days`, exactly as the nightly job does: each deletion is audited as `auth.account.expired_unverified` and fires `user.deleted` with `reason: "unverified_expired"`. Use `dry_run: true` to preview.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.UnverifiedAccountExpiryRunParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure (`min_age_minutes` out of range).
@@ -2493,7 +2823,7 @@ var AppUnverifiedAccountExpiryResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-unverified-account-expiry-run
    * @example
    * ```ts
-   * const unverifiedAccountExpiryRun = await auth.admin.app("app").unverifiedAccountExpiry.run({ dry_run: false });
+   * const unverifiedAccountExpiryRun = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").unverifiedAccountExpiry.run({ dry_run: false });
    * ```
    */
   run(params, options) {
@@ -2506,6 +2836,9 @@ var AppWebauthnConfigResource = class extends APIResource {
    *
    * Returns defaults with `enabled: false` and a null `rp_id` when passkeys have never been configured for the app.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
    * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.
@@ -2515,7 +2848,7 @@ var AppWebauthnConfigResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-webauthn-config
    * @example
    * ```ts
-   * const webauthnConfig = await auth.admin.app("app").webauthnConfig.retrieve();
+   * const webauthnConfig = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").webauthnConfig.retrieve();
    * ```
    */
   retrieve(options) {
@@ -2524,6 +2857,9 @@ var AppWebauthnConfigResource = class extends APIResource {
   /**
    * Set the per-app passkey (WebAuthn) relying-party settings.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.WebauthnConfigUpdateParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `rp_id` is malformed, or is not a registrable suffix of any origin in `allowed_redirect_origins`.
@@ -2535,7 +2871,7 @@ var AppWebauthnConfigResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#put-v1-apps-app-id-webauthn-config
    * @example
    * ```ts
-   * const webauthnConfig = await auth.admin.app("app").webauthnConfig.update({ enabled: true, rp_id: "example.com" });
+   * const webauthnConfig = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").webauthnConfig.update({ enabled: true, rp_id: "example.com" });
    * ```
    */
   update(params, options) {
@@ -2548,6 +2884,9 @@ var AppWebhooksEndpointsResource = class extends APIResource {
    *
    * Deliveries are signed with the Standard Webhooks headers `webhook-id`, `webhook-timestamp` and `webhook-signature` (`v1,<base64 HMAC-SHA256 of "<id>.<timestamp>.<body>">`); the returned `whsec_…` secret works unchanged with any Standard Webhooks library. Failed deliveries are retried after 1 min, 5 min, 30 min, 2 h, 6 h and 24 h.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.WebhookEndpointCreateParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, WEBHOOK_EVENT_TYPE_UNKNOWN: Validation failure: URL not https with a public host, or an unknown event type (`WEBHOOK_EVENT_TYPE_UNKNOWN`).
@@ -2561,7 +2900,7 @@ var AppWebhooksEndpointsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-webhooks-endpoints
    * @example
    * ```ts
-   * const webhookEndpointWithSecret = await auth.admin.app("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b").webhooks.endpoints.create({ url: "https://api.acme.com/webhooks" });
+   * const webhookEndpointWithSecret = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").webhooks.endpoints.create({ url: "https://api.acme.com/webhooks" });
    * ```
    */
   create(params, options) {
@@ -2572,6 +2911,9 @@ var AppWebhooksEndpointsResource = class extends APIResource {
    *
    * Queued retries are dropped. Its past attempts stay in the event log until the events expire.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param endpointId - Id of the endpoint.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `endpoint_id` is not a UUID.
@@ -2583,7 +2925,7 @@ var AppWebhooksEndpointsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-webhooks-endpoints-endpoint-id
    * @example
    * ```ts
-   * await auth.admin.app("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b").webhooks.endpoints.delete("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b");
+   * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").webhooks.endpoints.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   delete(endpointId, options) {
@@ -2594,6 +2936,9 @@ var AppWebhooksEndpointsResource = class extends APIResource {
    *
    * At most 10, so this is always one page. Signing secrets are never returned here, only their last 4 characters.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: The scope id in the path is malformed.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -2604,7 +2949,7 @@ var AppWebhooksEndpointsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-webhooks-endpoints
    * @example
    * ```ts
-   * for await (const endpoint of auth.admin.app("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b").webhooks.endpoints.list()) {
+   * for await (const endpoint of auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").webhooks.endpoints.list()) {
    *   console.log(endpoint);
    * }
    * ```
@@ -2617,6 +2962,9 @@ var AppWebhooksEndpointsResource = class extends APIResource {
    *
    * The endpoint's URL, subscription, on/off state, failure streak and the last 4 characters of its signing secret. The full secret is only returned when the endpoint is created or its secret is rotated.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param endpointId - Id of the endpoint.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `endpoint_id` is not a UUID.
@@ -2628,7 +2976,7 @@ var AppWebhooksEndpointsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-webhooks-endpoints-endpoint-id
    * @example
    * ```ts
-   * const webhookEndpoint = await auth.admin.app("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b").webhooks.endpoints.retrieve("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b");
+   * const webhookEndpoint = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").webhooks.endpoints.retrieve("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   retrieve(endpointId, options) {
@@ -2639,6 +2987,9 @@ var AppWebhooksEndpointsResource = class extends APIResource {
    *
    * For `grace_hours` (default 24) the previous secret keeps signing too: `webhook-signature` then lists one `v1,` signature per secret, so receivers can switch over without dropping a delivery.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param endpointId - Id of the endpoint.
    * @param params - `Auth.WebhookEndpointRotateSecretParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
@@ -2652,7 +3003,7 @@ var AppWebhooksEndpointsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-webhooks-endpoints-endpoint-id-rotate-secret
    * @example
    * ```ts
-   * const webhookEndpointWithSecret = await auth.admin.app("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b").webhooks.endpoints.rotateSecret("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b", { grace_hours: 24 });
+   * const webhookEndpointWithSecret = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").webhooks.endpoints.rotateSecret("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { grace_hours: 24 });
    * ```
    */
   rotateSecret(endpointId, params, options) {
@@ -2663,6 +3014,9 @@ var AppWebhooksEndpointsResource = class extends APIResource {
    *
    * Delivers the catalogue example of `event_type`, signed like any delivery, with `"test": true` in the body. Works while the endpoint is switched off or not subscribed to that type, is logged in the event log, and is never retried or counted toward an automatic disable. Waits up to 15 s for your receiver.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param endpointId - Id of the endpoint.
    * @param params - `Auth.WebhookEndpointTestParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
@@ -2676,7 +3030,7 @@ var AppWebhooksEndpointsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-webhooks-endpoints-endpoint-id-test
    * @example
    * ```ts
-   * const webhookDeliveryAttempt = await auth.admin.app("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b").webhooks.endpoints.test("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b", { event_type: "user.signup" });
+   * const webhookDeliveryAttempt = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").webhooks.endpoints.test("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { event_type: "user.signup" });
    * ```
    */
   test(endpointId, params, options) {
@@ -2687,6 +3041,9 @@ var AppWebhooksEndpointsResource = class extends APIResource {
    *
    * Only the fields sent change. `enabled: true` (or a new URL) also clears an automatic disable. Switching off cancels queued retries. The secret is unchanged; rotate it with `POST …/rotate-secret`.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param endpointId - Id of the endpoint.
    * @param params - `Auth.WebhookEndpointUpdateParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
@@ -2701,7 +3058,7 @@ var AppWebhooksEndpointsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-webhooks-endpoints-endpoint-id
    * @example
    * ```ts
-   * const webhookEndpoint = await auth.admin.app("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b").webhooks.endpoints.update("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b", { description: "Production receiver" });
+   * const webhookEndpoint = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").webhooks.endpoints.update("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { description: "Production receiver" });
    * ```
    */
   update(endpointId, params, options) {
@@ -2714,6 +3071,9 @@ var AppWebhooksEventTypesResource = class extends APIResource {
    *
    * Each type with a plain description, its group and an example `data` object (what "Send test" delivers).
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
    * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` (reads) or `auth.update` (changes, Send test, replay), or the app is suspended or archived.
@@ -2723,7 +3083,7 @@ var AppWebhooksEventTypesResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-webhooks-event-types
    * @example
    * ```ts
-   * const listWebhookEventTypes = await auth.admin.app("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b").webhooks.eventTypes.list();
+   * const listWebhookEventTypes = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").webhooks.eventTypes.list();
    * ```
    */
   list(options) {
@@ -2736,6 +3096,9 @@ var AppWebhooksEventsResource = class extends APIResource {
    *
    * Every event logged while at least one endpoint existed, with the latest state per endpoint and when the next retry is due.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.WebhookEventListParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid filter value or cursor.
@@ -2747,10 +3110,10 @@ var AppWebhooksEventsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-webhooks-events
    * @example
    * ```ts
-   * for await (const event of auth.admin.app("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b").webhooks.events.list()) {
+   * for await (const event of auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").webhooks.events.list()) {
    *   console.log(event);
    * }
-   * const page = await auth.admin.app("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b").webhooks.events.list({}, { timeout: 5_000 });
+   * const page = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").webhooks.events.list({}, { timeout: 5_000 });
    * ```
    */
   list(params, options) {
@@ -2761,6 +3124,9 @@ var AppWebhooksEventsResource = class extends APIResource {
    *
    * Same body and `webhook-id`, freshly signed, to every switched-on endpoint that receives this event type now, or only to `endpoint_id`. Waits for the receivers (up to 15 s each) and returns the attempts. A success cancels a retry still queued for that endpoint.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param eventId - The event id, `evt_<uuid>`.
    * @param params - `Auth.WebhookEventReplayParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
@@ -2774,7 +3140,7 @@ var AppWebhooksEventsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-webhooks-events-event-id-replay
    * @example
    * ```ts
-   * const replayWebhookEvent = await auth.admin.app("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b").webhooks.events.replay("event");
+   * const replayWebhookEvent = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").webhooks.events.replay("evt_3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   replay(eventId, params, options) {
@@ -2785,6 +3151,9 @@ var AppWebhooksEventsResource = class extends APIResource {
    *
    * The event as it was sent (`type`, `data`) and every delivery attempt to every endpoint, with its trigger, HTTP status, error and the start of the response body. Use it to debug a receiver, then `replay` to send it again.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param eventId - The event id, `evt_<uuid>`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `event_id` is not `evt_<uuid>`.
@@ -2796,7 +3165,7 @@ var AppWebhooksEventsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-webhooks-events-event-id
    * @example
    * ```ts
-   * const webhookEventDetail = await auth.admin.app("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b").webhooks.events.retrieve("event");
+   * const webhookEventDetail = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").webhooks.events.retrieve("evt_3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   retrieve(eventId, options) {
@@ -2910,6 +3279,9 @@ var AuthApp = class extends APIResource {
   /**
    * Create a second app in the same workspace whose configuration matches this one — the "staging app" flow. Copies the auth config, roles, permissions, notification settings and the webhook target (with a NEW signing secret), and optionally tenants. Never copies credentials, end-users, sessions, signing keys, federated provider configs or audit history.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.CloneParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure, or the slug matches the source.
@@ -2922,7 +3294,7 @@ var AuthApp = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-clone
    * @example
    * ```ts
-   * const cloneApp = await auth.admin.app("app").clone({ environment: "staging", slug: "acme-app-staging" });
+   * const cloneApp = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").clone({ environment: "staging", slug: "acme-app-staging" });
    * ```
    */
   clone(params, options) {
@@ -2931,6 +3303,9 @@ var AuthApp = class extends APIResource {
   /**
    * Update app status (active, suspended, archived)
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.UpdateStatusParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid status transition (e.g. archived → active).
@@ -2942,7 +3317,7 @@ var AuthApp = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-status
    * @example
    * ```ts
-   * const app = await auth.admin.app("app").updateStatus({ status: "suspended" });
+   * const app = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").updateStatus({ status: "suspended" });
    * ```
    */
   updateStatus(params, options) {
@@ -3078,6 +3453,9 @@ var ConsumerMeActivityResource = class extends APIResource {
    *
    * Login events, password changes, and other security-relevant records, scoped to this EndUser.
    *
+   * Credential: `end_user_token`.
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.
    * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
@@ -3085,7 +3463,7 @@ var ConsumerMeActivityResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-me-activity
    * @example
    * ```ts
-   * for await (const activity of auth.consumer("app").me.activity.list()) {
+   * for await (const activity of auth.consumer("my-app").me.activity.list()) {
    *   console.log(activity);
    * }
    * ```
@@ -3100,6 +3478,9 @@ var ConsumerMeContactsResource = class extends APIResource {
    *
    * Adds an email or phone contact to the EndUser. The contact starts unverified and non-primary. Verification is a separate flow — call /auth/request-verification with the contact value and the customer's PAK to mint a code, then submit via /auth/verify.
    *
+   * Credential: `end_user_token`.
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param params - `Auth.MeContactCreateParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: unsupported `type`, invalid email, or empty/over-long `value`.
@@ -3110,7 +3491,7 @@ var ConsumerMeContactsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-contacts
    * @example
    * ```ts
-   * const meContact = await auth.consumer("app").me.contacts.create({ type: "email", value: "string" });
+   * const meContact = await auth.consumer("my-app").me.contacts.create({ type: "email", value: "ada@example.com" });
    * ```
    */
   create(params, options) {
@@ -3119,6 +3500,9 @@ var ConsumerMeContactsResource = class extends APIResource {
   /**
    * Delete a contact
    *
+   * Credential: `end_user_token`.
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param id - Id of the contact.
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.
@@ -3129,7 +3513,7 @@ var ConsumerMeContactsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-me-contacts-id
    * @example
    * ```ts
-   * await auth.consumer("app").me.contacts.delete("id");
+   * await auth.consumer("my-app").me.contacts.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   delete(id, options) {
@@ -3138,6 +3522,9 @@ var ConsumerMeContactsResource = class extends APIResource {
   /**
    * List the EndUser's contacts
    *
+   * Credential: `end_user_token`.
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.
    * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): the general bucket, 60 requests per minute per IP. Adding, verifying or removing a contact is in the strict `auth` bucket (10 per minute).
@@ -3145,7 +3532,7 @@ var ConsumerMeContactsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-me-contacts
    * @example
    * ```ts
-   * const meContacts = await auth.consumer("app").me.contacts.list();
+   * const meContacts = await auth.consumer("my-app").me.contacts.list();
    * ```
    */
   list(options) {
@@ -3156,6 +3543,9 @@ var ConsumerMeContactsResource = class extends APIResource {
    *
    * Demotes the previous primary of the same type. Refused (409) when the target contact is unverified — promoting an unverified contact would let an attacker who registered the contact bypass verification by routing reset codes through it.
    *
+   * Credential: `end_user_token`.
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param id - Id of the contact.
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.
@@ -3166,7 +3556,7 @@ var ConsumerMeContactsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-contacts-id-promote
    * @example
    * ```ts
-   * await auth.consumer("app").me.contacts.promote("id");
+   * await auth.consumer("my-app").me.contacts.promote("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   promote(id, options) {
@@ -3179,6 +3569,9 @@ var ConsumerMeMfaFactorsResource = class extends APIResource {
    *
    * Creates a pending factor and returns the type-specific enrollment payload. TOTP: the otpauth URI, QR data URL, and shared secret; confirm with two consecutive codes. Email: a 6-digit code is sent to the bound verified email contact (primary by default, `contact_id` to override); confirm with that single code. The factor stays disabled until `/factors/:id/verify` succeeds.
    *
+   * Credential: `end_user_token`.
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param params - `Auth.MeMfaFactorCreateParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: unsupported `type`, over-long `label`, or `contact_id` is not a UUID.
@@ -3191,7 +3584,7 @@ var ConsumerMeMfaFactorsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-mfa-factors
    * @example
    * ```ts
-   * const startEnrollment = await auth.consumer("app").me.mfa.factors.create({ type: "totp" });
+   * const startEnrollment = await auth.consumer("my-app").me.mfa.factors.create({ type: "totp" });
    * ```
    */
   create(params, options) {
@@ -3202,6 +3595,9 @@ var ConsumerMeMfaFactorsResource = class extends APIResource {
    *
    * Soft-disable. The row is preserved (with `disabled_at` set) for audit. Has no effect on existing sessions — their `amr` claim still reflects whatever satisfied sign-in at the time. Disabling the only enabled factor removes the MFA requirement on future sign-ins.
    *
+   * Credential: `end_user_token`.
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param id - Id of the factor.
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.
@@ -3211,7 +3607,7 @@ var ConsumerMeMfaFactorsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-me-mfa-factors-id
    * @example
    * ```ts
-   * await auth.consumer("app").me.mfa.factors.delete("id");
+   * await auth.consumer("my-app").me.mfa.factors.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   delete(id, options) {
@@ -3222,6 +3618,9 @@ var ConsumerMeMfaFactorsResource = class extends APIResource {
    *
    * Includes factors in any state (pending enrollment + enabled). Disabled factors are not listed.
    *
+   * Credential: `end_user_token`.
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.
    * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
@@ -3229,7 +3628,7 @@ var ConsumerMeMfaFactorsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-me-mfa-factors
    * @example
    * ```ts
-   * const factorList = await auth.consumer("app").me.mfa.factors.list();
+   * const factorList = await auth.consumer("my-app").me.mfa.factors.list();
    * ```
    */
   list(options) {
@@ -3240,6 +3639,9 @@ var ConsumerMeMfaFactorsResource = class extends APIResource {
    *
    * TOTP: submit two `codes` from consecutive 30-second windows. Email: submit the emailed 6-digit `code`. On success the factor flips to enabled, recovery codes are minted (returned once), and prior recovery codes for the account are invalidated. Subsequent calls with the same `:id` fail with 400.
    *
+   * Credential: `end_user_token`.
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param id - Id of the factor.
    * @param params - `Auth.MeMfaFactorVerifyParams`.
    * @param options - Per-request options.
@@ -3250,7 +3652,7 @@ var ConsumerMeMfaFactorsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-mfa-factors-id-verify
    * @example
    * ```ts
-   * const confirmEnrollment = await auth.consumer("app").me.mfa.factors.verify("id", { code: "123456" });
+   * const confirmEnrollment = await auth.consumer("my-app").me.mfa.factors.verify("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { code: "123456" });
    * ```
    */
   verify(id, params, options) {
@@ -3263,6 +3665,9 @@ var ConsumerMeMfaRecoveryCodesResource = class extends APIResource {
    *
    * Mints a fresh set of single-use recovery codes and invalidates every prior code for the account. The new codes are returned once — store them now.
    *
+   * Credential: `end_user_token`.
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.
    * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
@@ -3270,7 +3675,7 @@ var ConsumerMeMfaRecoveryCodesResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-mfa-recovery-codes-regenerate
    * @example
    * ```ts
-   * const recoveryCodes = await auth.consumer("app").me.mfa.recoveryCodes.regenerate();
+   * const recoveryCodes = await auth.consumer("my-app").me.mfa.recoveryCodes.regenerate();
    * ```
    */
   regenerate(options) {
@@ -3283,6 +3688,9 @@ var ConsumerMeMfaStepUpWebauthnResource = class extends APIResource {
    *
    * Mints a single-use WebAuthn challenge for the enabled passkeys on this account and returns the `publicKey` member for `navigator.credentials.get()`. Submit the result to `/step-up` as `credential`. Refused while step-up is locked on this session — a locked session must not be able to keep minting challenges.
    *
+   * Credential: `end_user_token`.
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: No passkey is enrolled on this account.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -3292,7 +3700,7 @@ var ConsumerMeMfaStepUpWebauthnResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-mfa-step-up-webauthn-options
    * @example
    * ```ts
-   * const webauthnOptions = await auth.consumer("app").me.mfa.stepUp.webauthn.options();
+   * const webauthnOptions = await auth.consumer("my-app").me.mfa.stepUp.webauthn.options();
    * ```
    */
   options(options) {
@@ -3309,6 +3717,9 @@ var ConsumerMeMfaStepUpResource = class extends APIResource {
    *
    * Mints a single-use 6-digit code against one of the account's enabled email factors and delivers it to the bound address. Follow with `/step-up` submitting the code. Codes expire after 5 minutes; sends are throttled per contact (30s between sends, shared with the sign-in path). Refused while step-up is locked on this session.
    *
+   * Credential: `end_user_token`.
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param params - `Auth.MeMfaStepUpSendCodeParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Account has no enabled email factor (or the named factor is not an email factor).
@@ -3320,7 +3731,7 @@ var ConsumerMeMfaStepUpResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-mfa-step-up-send-code
    * @example
    * ```ts
-   * const stepUpSendCode = await auth.consumer("app").me.mfa.stepUp.sendCode({ factor_id: "9b2f6c1e-0d6a-4a63-9a43-2f1c3e4d5a6b" });
+   * const stepUpSendCode = await auth.consumer("my-app").me.mfa.stepUp.sendCode({ factor_id: "9b2f6c1e-0d6a-4a63-9a43-2f1c3e4d5a6b" });
    * ```
    */
   sendCode(params, options) {
@@ -3331,6 +3742,9 @@ var ConsumerMeMfaStepUpResource = class extends APIResource {
    *
    * Verify a fresh code (TOTP, emailed via `/step-up/send-code`, or recovery) against any enabled factor on the account, and update the session's `auth_methods` + `mfa_at`. Call `/auth/refresh` after this to mint a token whose claims reflect the new state. Customers reading `mfa_at` from access tokens to gate sensitive actions should require a `/step-up` + refresh cycle when the timestamp is older than their policy window. 5 consecutive wrong codes lock step-up on this session for 15 minutes.
    *
+   * Credential: `end_user_token`.
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param params - `Auth.MeMfaStepUpVerifyParams`.
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Code did not match any enabled factor or recovery code.
@@ -3340,7 +3754,7 @@ var ConsumerMeMfaStepUpResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-mfa-step-up
    * @example
    * ```ts
-   * const stepUp = await auth.consumer("app").me.mfa.stepUp.verify({ code: "123456" });
+   * const stepUp = await auth.consumer("my-app").me.mfa.stepUp.verify({ code: "123456" });
    * ```
    */
   verify(params, options) {
@@ -3367,6 +3781,9 @@ var ConsumerMeSessionsResource = class extends APIResource {
    *
    * Sign the EndUser out of one device. The session's refresh token is destroyed; its access token expires on its TTL. Requires the `session.revoke` permission when the app's `enforce_app_permissions` flag is on; otherwise (the default) any valid token can call this. Self-revoke (revoking your own session as a member with no perms) is something to enforce separately if needed; this guard does not exempt the principal from the role check.
    *
+   * Credential: `end_user_token`.
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param id - Id of the session.
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.
@@ -3376,7 +3793,7 @@ var ConsumerMeSessionsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-me-sessions-id
    * @example
    * ```ts
-   * await auth.consumer("app").me.sessions.delete("id");
+   * await auth.consumer("my-app").me.sessions.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   delete(id, options) {
@@ -3387,6 +3804,9 @@ var ConsumerMeSessionsResource = class extends APIResource {
    *
    * Each session includes a `current` flag identifying the one belonging to the bearer token used for this request.
    *
+   * Credential: `end_user_token`.
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.
    * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
@@ -3394,7 +3814,7 @@ var ConsumerMeSessionsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-me-sessions
    * @example
    * ```ts
-   * for await (const session of auth.consumer("app").me.sessions.list()) {
+   * for await (const session of auth.consumer("my-app").me.sessions.list()) {
    *   console.log(session);
    * }
    * ```
@@ -3409,6 +3829,9 @@ var ConsumerMeTenantInvitesResource = class extends APIResource {
    *
    * Adds the caller to the invited tenant with the role the invite names, and consumes the invite. Requires the invited address to be one of the caller's own VERIFIED email contacts in this app — holding the code is not sufficient, because whoever minted the invite also holds it, and an unverified contact is not proof of owning the address. A refused accept leaves the invite redeemable.
    *
+   * Credential: `end_user_token`.
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param params - `Auth.MeTenantInviteAcceptParams`.
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -3421,7 +3844,7 @@ var ConsumerMeTenantInvitesResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-tenant-invites-accept
    * @example
    * ```ts
-   * const acceptedTenantInvite = await auth.consumer("app").me.tenantInvites.accept({ code: "tinv_9dK2mQ7pR4vXbN1sT6yZ0hLcJeW3fAgU" });
+   * const acceptedTenantInvite = await auth.consumer("my-app").me.tenantInvites.accept({ code: "tinv_9dK2mQ7pR4vXbN1sT6yZ0hLcJeW3fAgU" });
    * ```
    */
   accept(params, options) {
@@ -3434,6 +3857,9 @@ var ConsumerMeTenantsResource = class extends APIResource {
    *
    * Returns each tenant the caller is a member of, including the tenant slug + display name and the member's role. Powers a tenant-switcher UI on the customer's product.
    *
+   * Credential: `end_user_token`.
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing / invalid bearer, or the session behind the token is revoked, expired or no longer exists.
    * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app exists but is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`). Decided by `AppStatusGuard` before the handler runs.
@@ -3443,7 +3869,7 @@ var ConsumerMeTenantsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-auth-me-tenants
    * @example
    * ```ts
-   * const myTenants = await auth.consumer("app").me.tenants.list();
+   * const myTenants = await auth.consumer("my-app").me.tenants.list();
    * ```
    */
   list(options) {
@@ -3480,6 +3906,9 @@ var ConsumerMeResource = class extends APIResource {
    *
    * Verifies `current_password`, sets the new hash, and revokes every OTHER active session for the account (the calling session is preserved). 401 if the current password is wrong or the account has no password credential — admin-provisioned accounts without an initial password should use the reset flow instead. The new password is held to exactly the same policy as signup: the app's length + character-class rules, the common-password deny-list, and the breach corpus.
    *
+   * Credential: `end_user_token`.
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param params - `Auth.MeChangePasswordParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, PASSWORD_TOO_COMMON, PASSWORD_BREACHED: The new password fails the app-configured policy, is on the common-password deny-list (`PASSWORD_TOO_COMMON`), appears in a public breach corpus (`PASSWORD_BREACHED`), or is identical to the current one.
@@ -3490,7 +3919,10 @@ var ConsumerMeResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-change-password
    * @example
    * ```ts
-   * await auth.consumer("app").me.changePassword({ current_password: "string", new_password: "string" });
+   * await auth.consumer("my-app").me.changePassword({
+   *   current_password: "correct horse battery staple",
+   *   new_password: "a new long passphrase 42",
+   * });
    * ```
    */
   changePassword(params, options) {
@@ -3501,6 +3933,9 @@ var ConsumerMeResource = class extends APIResource {
    *
    * Removes the EndUser, all sessions, and all related records inside this app. Cannot be undone. The app audit log keeps one `auth.account.deleted` row (`via: self`; username and email domain only, never the address), and `user.deleted` fires with `via: "self"`.
    *
+   * Credential: `end_user_token`.
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.
    * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
@@ -3508,7 +3943,7 @@ var ConsumerMeResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-me
    * @example
    * ```ts
-   * await auth.consumer("app").me.deleteAccount();
+   * await auth.consumer("my-app").me.deleteAccount();
    * ```
    */
   deleteAccount(options) {
@@ -3519,6 +3954,9 @@ var ConsumerMeResource = class extends APIResource {
    *
    * Clears both the uploaded avatar and any provider-captured picture, and deletes the stored object. A later Google/GitHub sign-in re-populates the provider picture — that is "sync from provider" behavior, by design.
    *
+   * Credential: `end_user_token`.
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.
    * @throws {NotFoundError} 404 NOT_FOUND, ACCOUNT_NOT_FOUND: Account not found in this app (`ACCOUNT_NOT_FOUND`).
@@ -3527,7 +3965,7 @@ var ConsumerMeResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-me-avatar
    * @example
    * ```ts
-   * await auth.consumer("app").me.deleteAvatar();
+   * await auth.consumer("my-app").me.deleteAvatar();
    * ```
    */
   deleteAvatar(options) {
@@ -3538,6 +3976,9 @@ var ConsumerMeResource = class extends APIResource {
    *
    * Returns the union of the app-level role permissions and the tenant-level role permissions (when the token carries an `org_id`). Resolved per-request through a 60-second LRU — role-permission edits propagate within ~1 minute. Use this instead of decoding a `permissions[]` claim from the JWT, which is no longer included. M2M tokens cannot call this — use `POST /:appSlug/v1/oauth/introspect` to inspect M2M scopes.
    *
+   * Credential: `end_user_token`.
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.
    * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
@@ -3545,7 +3986,7 @@ var ConsumerMeResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-me-permissions
    * @example
    * ```ts
-   * const mePermissions = await auth.consumer("app").me.permissions();
+   * const mePermissions = await auth.consumer("my-app").me.permissions();
    * ```
    */
   permissions(options) {
@@ -3556,6 +3997,9 @@ var ConsumerMeResource = class extends APIResource {
    *
    * Returns the EndUser identity, app membership, and role name. The flat `permissions[]` array is intentionally NOT included — permissions resolve from the role on demand. Call `GET /me/permissions` for the flat list when the client needs it for UI gating.
    *
+   * Credential: `end_user_token`.
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
    * @throws {NotFoundError} 404 NOT_FOUND: Account not found.
@@ -3564,7 +4008,7 @@ var ConsumerMeResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-me
    * @example
    * ```ts
-   * const meProfile = await auth.consumer("app").me.retrieve();
+   * const meProfile = await auth.consumer("my-app").me.retrieve();
    * ```
    */
   retrieve(options) {
@@ -3575,6 +4019,9 @@ var ConsumerMeResource = class extends APIResource {
    *
    * Editable fields: `display_name` and `username`. The username is unique per app (case-insensitive, same rule as signup); sending the current username is a no-op. Usernames cannot be cleared.
    *
+   * Credential: `end_user_token`.
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param params - `Auth.MeUpdateParams`.
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -3584,7 +4031,7 @@ var ConsumerMeResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#patch-app-slug-v1-me
    * @example
    * ```ts
-   * const meUpdatedAccount = await auth.consumer("app").me.update({ display_name: "Ada Lovelace" });
+   * const meUpdatedAccount = await auth.consumer("my-app").me.update({ display_name: "Ada Lovelace" });
    * ```
    */
   update(params, options) {
@@ -3595,6 +4042,9 @@ var ConsumerMeResource = class extends APIResource {
    *
    * PNG/JPEG/WEBP only — SVG is rejected (stored-XSS vector). ≤2 MB. Magic bytes are sniffed; a mislabeled file is rejected. The image is re-encoded server-side (orientation baked in, all metadata incl. EXIF/GPS stripped, bounded to 512×512, webp). An uploaded avatar takes precedence over a provider-captured picture.
    *
+   * Credential: `end_user_token`.
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param params - `Auth.MeUploadAvatarParams`.
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -3605,7 +4055,7 @@ var ConsumerMeResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-avatar
    * @example
    * ```ts
-   * const avatarUrl = await auth.consumer("app").me.uploadAvatar({ file: new File(["…"], "image.png", { type: "image/png" }) });
+   * const avatarUrl = await auth.consumer("my-app").me.uploadAvatar({ file: new File(["…"], "image.png", { type: "image/png" }) });
    * ```
    */
   uploadAvatar(params, options) {
@@ -3671,7 +4121,7 @@ var ConsumerMfaWebauthnResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-mfa-webauthn-options
    * @example
    * ```ts
-   * const consumerWebauthnOptions = await auth.consumer("app").mfa.webauthn.options({ mfa_token: "string" });
+   * const consumerWebauthnOptions = await auth.consumer("my-app").mfa.webauthn.options({ mfa_token: "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f" });
    * ```
    */
   options(params, options) {
@@ -3701,7 +4151,7 @@ var ConsumerMfaResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-mfa-enroll
    * @example
    * ```ts
-   * const startEnrollment = await auth.consumer("app").mfa.enroll({ mfa_token: "string", type: "totp" });
+   * const startEnrollment = await auth.consumer("my-app").mfa.enroll({ mfa_token: "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", type: "totp" });
    * ```
    */
   enroll(params, options) {
@@ -3725,7 +4175,10 @@ var ConsumerMfaResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-mfa-recover
    * @example
    * ```ts
-   * const consumerToken = await auth.consumer("app").mfa.recover({ mfa_token: "string", recovery_code: "1a2b-3c4d-5e6f-7890" });
+   * const consumerToken = await auth.consumer("my-app").mfa.recover({
+   *   mfa_token: "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f",
+   *   recovery_code: "1a2b-3c4d-5e6f-7890",
+   * });
    * ```
    */
   recover(params, options) {
@@ -3750,7 +4203,10 @@ var ConsumerMfaResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-mfa-send-code
    * @example
    * ```ts
-   * const consumerMfaSendCode = await auth.consumer("app").mfa.sendCode({ factor_id: "9b2f6c1e-0d6a-4a63-9a43-2f1c3e4d5a6b", mfa_token: "string" });
+   * const consumerMfaSendCode = await auth.consumer("my-app").mfa.sendCode({
+   *   factor_id: "9b2f6c1e-0d6a-4a63-9a43-2f1c3e4d5a6b",
+   *   mfa_token: "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f",
+   * });
    * ```
    */
   sendCode(params, options) {
@@ -3773,7 +4229,7 @@ var ConsumerMfaResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-mfa-verify
    * @example
    * ```ts
-   * const consumerToken = await auth.consumer("app").mfa.verify({ mfa_token: "string" });
+   * const consumerToken = await auth.consumer("my-app").mfa.verify({ mfa_token: "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f" });
    * ```
    */
   verify(params, options) {
@@ -3796,7 +4252,10 @@ var ConsumerMfaResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-mfa-enroll-verify
    * @example
    * ```ts
-   * const consumerMfaEnrollVerify = await auth.consumer("app").mfa.verifyEnrollment({ factor_id: "9b2f6c1e-0d6a-4a63-9a43-2f1c3e4d5a6b", mfa_token: "string" });
+   * const consumerMfaEnrollVerify = await auth.consumer("my-app").mfa.verifyEnrollment({
+   *   factor_id: "9b2f6c1e-0d6a-4a63-9a43-2f1c3e4d5a6b",
+   *   mfa_token: "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f",
+   * });
    * ```
    */
   verifyEnrollment(params, options) {
@@ -3809,6 +4268,10 @@ var ConsumerOauthResource = class extends APIResource {
    *
    * OAuth 2.0 token introspection. Send the access token via `Authorization: Bearer <token>` and receive either `{ active: false }` (invalid / expired / wrong app, or a session that is revoked, past its `expires_at`, or gone because the end user was deleted) or the active claim set including `scopes` (M2M) or `role` (EndUser), `exp`, `iat`, `iss`, `aid`. The body `token` field is optional and, if present, must match the bearer — RFC 7662 allows a separate `token` body field but we deliberately refuse cross-token introspection so a stolen token can't be probed against another active credential. The endpoint accepts both M2M and EndUser tokens — use it as the canonical way for a service to know what its own token can do, instead of decoding the JWT by hand. Returns 401 when the bearer is missing.
    *
+   * Credential: one of `m2m_token`, `end_user_token`.
+   * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param params - `Auth.OauthIntrospectParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed in the global `ValidationPipe`.
@@ -3821,7 +4284,7 @@ var ConsumerOauthResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-oauth-introspect
    * @example
    * ```ts
-   * const introspect = await auth.consumer("app").oauth.introspect({ token: "string" });
+   * const introspect = await auth.consumer("my-app").oauth.introspect({ token: "eyJhbGciOiJSUzI1NiIsImtpZCI6ImsxIn0.eyJzdWIiOiJ1c3JfMSJ9.c2lnbmF0dXJl" });
    * ```
    */
   introspect(params, options) {
@@ -3844,9 +4307,9 @@ var ConsumerOauthResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-oauth-token
    * @example
    * ```ts
-   * const oAuthToken = await auth.consumer("app").oauth.token({
+   * const oAuthToken = await auth.consumer("my-app").oauth.token({
    *   client_id: "m2m_a1b2c3d4e5f6...",
-   *   client_secret: "string",
+   *   client_secret: "the-secret-returned-by-credentials-create",
    *   grant_type: "client_credentials",
    * });
    * ```
@@ -3881,7 +4344,7 @@ var ConsumerPasskeyResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-passkey-options
    * @example
    * ```ts
-   * const consumerWebauthnOptions = await auth.consumer("app").passkey.options({ tenant_id: "9b2f6c1e-0d6a-4a63-9a43-2f1c3e4d5a6b" });
+   * const consumerWebauthnOptions = await auth.consumer("my-app").passkey.options({ tenant_id: "9b2f6c1e-0d6a-4a63-9a43-2f1c3e4d5a6b" });
    * ```
    */
   options(params, options) {
@@ -3904,7 +4367,7 @@ var ConsumerPasskeyResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-passkey-verify
    * @example
    * ```ts
-   * const consumerToken = await auth.consumer("app").passkey.verify({ credential: {} });
+   * const consumerToken = await auth.consumer("my-app").passkey.verify({ credential: {} });
    * ```
    */
   verify(params, options) {
@@ -3917,6 +4380,11 @@ var ConsumerPermissionsResource = class extends APIResource {
    *
    * Inserts a `<resource>.<action>` row in the per-app permission catalogue. The resource and action segments must each match `^[a-z][a-z0-9_-]{1,47}$`. Conflicts with a system permission name return 409. Customers usually then bind the new permission to a role via `PUT /admin/roles/:roleName/permissions`.
    *
+   * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.
+   * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.
+   * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param params - `Auth.ConsumerScopedPermissionCreateParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -3926,7 +4394,7 @@ var ConsumerPermissionsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-admin-permissions
    * @example
    * ```ts
-   * const consumerAdminPermission = await auth.consumer("app").permissions.create({ action: "read", resource: "project" });
+   * const consumerAdminPermission = await auth.consumer("my-app").permissions.create({ action: "read", resource: "project" });
    * ```
    */
   create(params, options) {
@@ -3937,6 +4405,11 @@ var ConsumerPermissionsResource = class extends APIResource {
    *
    * The `permissionKey` path parameter is the literal `<resource>.<action>` string. System permissions cannot be deleted — attempts return 403. Removing a permission also removes every `role_permission` row that bound it (cascade); role lookups dropped of that perm on the next request.
    *
+   * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.
+   * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.
+   * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param permissionKey - Permission key, `resource.action` (e.g. `invoice.read`).
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: permissionKey must be in `resource.action` format.
@@ -3948,7 +4421,7 @@ var ConsumerPermissionsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-admin-permissions-permission-key
    * @example
    * ```ts
-   * await auth.consumer("app").permissions.delete("permission_key");
+   * await auth.consumer("my-app").permissions.delete("invoice.read");
    * ```
    */
   delete(permissionKey, options) {
@@ -3959,6 +4432,11 @@ var ConsumerPermissionsResource = class extends APIResource {
    *
    * Returns the union of system permissions (shared across every app — `is_system: true` in the response) and any custom entries this app has defined (`is_system: false`). Useful for driving a role-editor UI that picks from the full catalogue.
    *
+   * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.
+   * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.
+   * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired Consumer-API bearer: an EndUser or M2M token, or an app API key (`hdk_live_*` / `hdk_test_*`); or the account, session, M2M client or key is no longer active, or the key belongs to another app.
    * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app is suspended or archived (`APP_SUSPENDED` / `APP_ARCHIVED`), or the caller lacks `permission.read`: an app API key always needs it in its permissions; a role or M2M scopes need it once the app enforces permissions.
@@ -3968,7 +4446,7 @@ var ConsumerPermissionsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-admin-permissions
    * @example
    * ```ts
-   * const result = await auth.consumer("app").permissions.list();
+   * const result = await auth.consumer("my-app").permissions.list();
    * ```
    */
   list(options) {
@@ -3981,6 +4459,11 @@ var ConsumerRolesResource = class extends APIResource {
    *
    * Creates a role with no permissions bound yet. Use `PUT /:roleName/permissions` to attach a permission set after creation — that route also runs caller-narrowing so an EndUser admin can't grant verbs they don't themselves hold.
    *
+   * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.
+   * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.
+   * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param params - `Auth.ConsumerScopedRoleCreateParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -3990,7 +4473,7 @@ var ConsumerRolesResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-admin-roles
    * @example
    * ```ts
-   * const consumerRole = await auth.consumer("app").roles.create({ name: "editor" });
+   * const consumerRole = await auth.consumer("my-app").roles.create({ name: "editor" });
    * ```
    */
   create(params, options) {
@@ -4001,6 +4484,11 @@ var ConsumerRolesResource = class extends APIResource {
    *
    * System roles (`owner`, `admin`, `member`) cannot be deleted — attempts return 403. Roles currently assigned to any member return 409 `ROLE_IN_USE`; reassign the affected members first.
    *
+   * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.
+   * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.
+   * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param roleName - Name of the role (e.g. `admin`).
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -4011,7 +4499,7 @@ var ConsumerRolesResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-admin-roles-role-name
    * @example
    * ```ts
-   * await auth.consumer("app").roles.delete("role_name");
+   * await auth.consumer("my-app").roles.delete("admin");
    * ```
    */
   delete(roleName, options) {
@@ -4022,6 +4510,11 @@ var ConsumerRolesResource = class extends APIResource {
    *
    * Cursor-paginated by `created_at`. Use the returned `next_cursor` in subsequent calls — offset pagination is not exposed.
    *
+   * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.
+   * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.
+   * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param params - `Auth.ConsumerScopedRoleListParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`.
@@ -4033,10 +4526,10 @@ var ConsumerRolesResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-admin-roles
    * @example
    * ```ts
-   * for await (const role of auth.consumer("app").roles.list()) {
+   * for await (const role of auth.consumer("my-app").roles.list()) {
    *   console.log(role);
    * }
-   * const page = await auth.consumer("app").roles.list({}, { timeout: 5_000 });
+   * const page = await auth.consumer("my-app").roles.list({}, { timeout: 5_000 });
    * ```
    */
   list(params, options) {
@@ -4047,6 +4540,11 @@ var ConsumerRolesResource = class extends APIResource {
    *
    * Returns the role plus the flat `permissions[]` array currently bound. Use this to drive a "configure role" UI in the customer product without having to call `/permissions` separately.
    *
+   * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.
+   * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.
+   * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param roleName - Name of the role (e.g. `admin`).
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -4056,7 +4554,7 @@ var ConsumerRolesResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-admin-roles-role-name
    * @example
    * ```ts
-   * const consumerRoleWithPermissions = await auth.consumer("app").roles.retrieve("role_name");
+   * const consumerRoleWithPermissions = await auth.consumer("my-app").roles.retrieve("admin");
    * ```
    */
   retrieve(roleName, options) {
@@ -4067,6 +4565,11 @@ var ConsumerRolesResource = class extends APIResource {
    *
    * Renames are intentionally NOT supported — the role name is part of every issued EndUser JWT, so changing it would silently break live sessions. Create a new role and migrate users instead.
    *
+   * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.
+   * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.
+   * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param roleName - Name of the role (e.g. `admin`).
    * @param params - `Auth.ConsumerScopedRoleUpdateParams`.
    * @param options - Per-request options.
@@ -4077,7 +4580,7 @@ var ConsumerRolesResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#patch-app-slug-v1-admin-roles-role-name
    * @example
    * ```ts
-   * const consumerRole = await auth.consumer("app").roles.update("role_name", { description: "Updated description" });
+   * const consumerRole = await auth.consumer("my-app").roles.update("admin", { description: "Updated description" });
    * ```
    */
   update(roleName, params, options) {
@@ -4088,6 +4591,11 @@ var ConsumerRolesResource = class extends APIResource {
    *
    * Destructive — the role's permission set is replaced wholesale with the supplied array. Caller-narrowed: the caller must hold every permission in the request, otherwise 403 `Cannot grant actions you don't have: ...`. For EndUser callers the caller-held set is their app-membership role's effective permissions. For M2M callers the held set is the token's `scopes[]` claim — the M2M cannot grant a role any verb that wasn't configured on the M2M credential. Unknown permission strings return 400.
    *
+   * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.
+   * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.
+   * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param roleName - Name of the role (e.g. `admin`).
    * @param params - `Auth.ConsumerScopedRoleUpdatePermissionsParams`.
    * @param options - Per-request options.
@@ -4100,7 +4608,7 @@ var ConsumerRolesResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#put-app-slug-v1-admin-roles-role-name-permissions
    * @example
    * ```ts
-   * const result = await auth.consumer("app").roles.updatePermissions("role_name", { permissions: ["user.read", "role.create"] });
+   * const result = await auth.consumer("my-app").roles.updatePermissions("admin", { permissions: ["user.read", "role.create"] });
    * ```
    */
   updatePermissions(roleName, params, options) {
@@ -4113,6 +4621,9 @@ var ConsumerTenantApiKeysConfigResource = class extends APIResource {
    *
    * Requires `auth.tenant.api_keys.configure` on the app.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, malformed or revoked Platform API Key (`Authorization: Bearer pcft_live_…`).
    * @throws {PermissionDeniedError} 403 FORBIDDEN, PAK_WORKSPACE_MISMATCH: `PAK_WORKSPACE_MISMATCH` (the PAK belongs to another workspace than the app), or the PAK's policy does not allow `auth.tenant.api_keys.configure` on `pcft:heimdall:app/<appId>`.
@@ -4123,7 +4634,7 @@ var ConsumerTenantApiKeysConfigResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-tenant-api-keys-config
    * @example
    * ```ts
-   * const tenantApiKeysConfig = await auth.consumer("app").tenantApiKeys.config.retrieve();
+   * const tenantApiKeysConfig = await auth.consumer("my-app").tenantApiKeys.config.retrieve();
    * ```
    */
   retrieve(options) {
@@ -4134,6 +4645,9 @@ var ConsumerTenantApiKeysConfigResource = class extends APIResource {
    *
    * Call it on boot: your code is the source of truth for the scopes a key can carry. Fields you leave out keep their stored value. `suspended` is the platform's kill switch: this route never changes it, and a body that carries it is refused. Requires `auth.tenant.api_keys.configure` on the app.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.ConsumerScopedTenantApiKeyConfigUpdateParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, TENANT_API_KEYS_SCOPE_INVALID, TENANT_API_KEYS_UNKNOWN_ROLE, TENANT_API_KEY_EXPIRY_INVALID, TENANT_API_KEYS_NO_SCOPES, TENANT_API_KEYS_SUSPENDED_NOT_WRITABLE: `VALIDATION_ERROR`, `TENANT_API_KEYS_SCOPE_INVALID` (`details.scopes`), `TENANT_API_KEYS_UNKNOWN_ROLE` (`details.roles`: `manage_roles` names a role this app does not have), `TENANT_API_KEY_EXPIRY_INVALID`, `TENANT_API_KEYS_NO_SCOPES` (enabling with no scope), `TENANT_API_KEYS_SUSPENDED_NOT_WRITABLE` (the body carries `suspended`), or a malformed `Idempotency-Key`.
@@ -4146,7 +4660,7 @@ var ConsumerTenantApiKeysConfigResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#put-app-slug-v1-tenant-api-keys-config
    * @example
    * ```ts
-   * const tenantApiKeysConfig = await auth.consumer("app").tenantApiKeys.config.update({ default_expiry_days: 7 });
+   * const tenantApiKeysConfig = await auth.consumer("my-app").tenantApiKeys.config.update({ default_expiry_days: 7 });
    * ```
    */
   update(params, options) {
@@ -4163,6 +4677,9 @@ var ConsumerTenantApiKeysResource = class extends APIResource {
    *
    * Returns the secret ONCE (`key`). Scopes must be grantable by the app and held by your own tenant role. At most 25 active keys per tenant. If the app requires recent MFA, verify a factor first (403 `step_up_required`). Responses carry `Cache-Control: no-store`.
    *
+   * Credential: `end_user_token`.
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param params - `Auth.TenantApiKeyCreateParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, TENANT_API_KEY_SCOPE_NOT_GRANTABLE, TENANT_API_KEY_EXPIRY_INVALID: `VALIDATION_ERROR`, `TENANT_API_KEY_SCOPE_NOT_GRANTABLE` (`details.scopes`), `TENANT_API_KEY_EXPIRY_INVALID` (`details.allowed`), or a malformed `Idempotency-Key`.
@@ -4175,7 +4692,7 @@ var ConsumerTenantApiKeysResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-tenant-api-keys
    * @example
    * ```ts
-   * const tenantApiKeyWithSecret = await auth.consumer("app").tenantApiKeys.create({ name: "CI e2e", scopes: ["disputes.read", "audit.read"] });
+   * const tenantApiKeyWithSecret = await auth.consumer("my-app").tenantApiKeys.create({ name: "CI e2e", scopes: ["disputes.read", "audit.read"] });
    * ```
    */
   create(params, options) {
@@ -4186,6 +4703,9 @@ var ConsumerTenantApiKeysResource = class extends APIResource {
    *
    * Immediate and final. Idempotent: revoking a revoked key is a 204 that changes nothing.
    *
+   * Credential: `end_user_token`.
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param keyId - Key id (UUID) or display id (`tak_…`).
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid end-user bearer token (M2M tokens, PAKs and API keys are refused).
@@ -4196,7 +4716,7 @@ var ConsumerTenantApiKeysResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-tenant-api-keys-key-id
    * @example
    * ```ts
-   * await auth.consumer("app").tenantApiKeys.delete("key");
+   * await auth.consumer("my-app").tenantApiKeys.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   delete(keyId, options) {
@@ -4207,6 +4727,9 @@ var ConsumerTenantApiKeysResource = class extends APIResource {
    *
    * For your backend: is this `pctk_` key, presented to YOUR API, usable right now, for which tenant and with which scopes? A key of another app is `{"active": false}`. Cache answers by the key's SHA-256: positives up to 30 s (never past `expires_at`), negatives up to 60 s. Intersect `scopes` with the permissions of `created_by.tenant_role` in your app. Requires `auth.tenant.api_keys.introspect` on the app. Not audited per call; `last_used_at` records use (5-minute granularity). This route has its own per-app rate bucket (1200 calls a minute by default), separate from your PAK's other calls; over it the answer is 429 with `Retry-After`, never a false `active: false`, so keep serving keys you hold a fresh positive for.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.TenantApiKeyIntrospectParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `key` missing or not a string.
@@ -4219,7 +4742,7 @@ var ConsumerTenantApiKeysResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-tenant-api-keys-introspect
    * @example
    * ```ts
-   * const tenantApiKeyIntrospection = await auth.consumer("app").tenantApiKeys.introspect({ key: "pctk_live_4fQ2aZ0000000000000000000000000000000000000_1a2B3c" });
+   * const tenantApiKeyIntrospection = await auth.consumer("my-app").tenantApiKeys.introspect({ key: "pctk_live_4fQ2aZ0000000000000000000000000000000000000_1a2B3c" });
    * ```
    */
   introspect(params, options) {
@@ -4230,6 +4753,9 @@ var ConsumerTenantApiKeysResource = class extends APIResource {
    *
    * Newest first, cursor-paginated (20 per page, max 100). Secrets are never returned; `key_prefix` and `last4` identify a key.
    *
+   * Credential: `end_user_token`.
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param params - `Auth.ConsumerScopedTenantApiKeyListParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `status` or malformed `cursor`.
@@ -4241,10 +4767,10 @@ var ConsumerTenantApiKeysResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-tenant-api-keys
    * @example
    * ```ts
-   * for await (const tenantApiKey of auth.consumer("app").tenantApiKeys.list()) {
+   * for await (const tenantApiKey of auth.consumer("my-app").tenantApiKeys.list()) {
    *   console.log(tenantApiKey);
    * }
-   * const page = await auth.consumer("app").tenantApiKeys.list({}, { timeout: 5_000 });
+   * const page = await auth.consumer("my-app").tenantApiKeys.list({}, { timeout: 5_000 });
    * ```
    */
   list(params, options) {
@@ -4255,6 +4781,9 @@ var ConsumerTenantApiKeysResource = class extends APIResource {
    *
    * Mints a replacement with the same name and scopes and returns its secret ONCE. You become the replacement's creator, so its scopes must be within your own tenant role. The outgoing key is revoked now (`grace_hours: 0`, the default) or keeps working for up to 24 hours. To kill a leaked key, revoke it. Responses carry `Cache-Control: no-store`.
    *
+   * Credential: `end_user_token`.
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param keyId - Key id (UUID) or display id (`tak_…`).
    * @param params - `Auth.TenantApiKeyRotateParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
@@ -4268,7 +4797,7 @@ var ConsumerTenantApiKeysResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-tenant-api-keys-key-id-rotate
    * @example
    * ```ts
-   * const tenantApiKeyWithSecret = await auth.consumer("app").tenantApiKeys.rotate("key", { expires_in_days: 7 });
+   * const tenantApiKeyWithSecret = await auth.consumer("my-app").tenantApiKeys.rotate("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { expires_in_days: 7 });
    * ```
    */
   rotate(keyId, params, options) {
@@ -4279,6 +4808,9 @@ var ConsumerTenantApiKeysResource = class extends APIResource {
    *
    * For your own audit trail: record why a key you saw go inactive died (revoked in the console, creator left the tenant, expired, keys suspended). Only keys of this app; another app's key is 404. Requires `auth.tenant.api_keys.introspect` on the app.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param keyId - Key id (UUID) or display id (`tak_…`), as `introspect` returned it.
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, malformed or revoked Platform API Key (`Authorization: Bearer pcft_live_…`).
@@ -4290,7 +4822,7 @@ var ConsumerTenantApiKeysResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-tenant-api-keys-key-id-status
    * @example
    * ```ts
-   * const tenantApiKeyStatus = await auth.consumer("app").tenantApiKeys.status("key");
+   * const tenantApiKeyStatus = await auth.consumer("my-app").tenantApiKeys.status("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   status(keyId, options) {
@@ -4303,6 +4835,9 @@ var ConsumerTenantsInvitesResource = class extends APIResource {
    *
    * Unlike `POST /members`, nothing is granted until the invitee accepts at `POST /:appSlug/v1/auth/accept-tenant-invite`. Only a SHA-256 digest of the code is stored, so the `code` in this response is unrecoverable afterwards.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param tenantId - Id of the tenant.
    * @param params - `Auth.ConsumerScopedTenantInviteCreateParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
@@ -4316,7 +4851,7 @@ var ConsumerTenantsInvitesResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-tenants-tenant-id-invites
    * @example
    * ```ts
-   * const createTenantInvite = await auth.consumer("app").tenants.invites.create("tenant", { email: "alice@example.com", role_name: "member" });
+   * const createTenantInvite = await auth.consumer("my-app").tenants.invites.create("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { email: "alice@example.com", role_name: "member" });
    * ```
    */
   create(tenantId, params, options) {
@@ -4325,6 +4860,9 @@ var ConsumerTenantsInvitesResource = class extends APIResource {
   /**
    * Revoke a pending invite. Idempotent — revoking an already-revoked invite is a 204 no-op and fires no second webhook. PAK must hold auth.tenant.members.remove.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param tenantId - Id of the tenant.
    * @param inviteId - Id of the invite.
    * @param options - Per-request options.
@@ -4335,7 +4873,7 @@ var ConsumerTenantsInvitesResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-tenants-tenant-id-invites-invite-id
    * @example
    * ```ts
-   * await auth.consumer("app").tenants.invites.delete("tenant", "invite");
+   * await auth.consumer("my-app").tenants.invites.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   delete(tenantId, inviteId, options) {
@@ -4346,6 +4884,9 @@ var ConsumerTenantsInvitesResource = class extends APIResource {
    *
    * Codes are never returned here — only the digest is stored. Use `status=pending` to show outstanding invitations.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param tenantId - Id of the tenant.
    * @param params - `Auth.ConsumerScopedTenantInviteListParams`.
    * @param options - Per-request options.
@@ -4357,10 +4898,10 @@ var ConsumerTenantsInvitesResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-tenants-tenant-id-invites
    * @example
    * ```ts
-   * for await (const invite of auth.consumer("app").tenants.invites.list("tenant")) {
+   * for await (const invite of auth.consumer("my-app").tenants.invites.list("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f")) {
    *   console.log(invite);
    * }
-   * const page = await auth.consumer("app").tenants.invites.list("tenant", {}, { timeout: 5_000 });
+   * const page = await auth.consumer("my-app").tenants.invites.list("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", {}, { timeout: 5_000 });
    * ```
    */
   list(tenantId, params, options) {
@@ -4371,6 +4912,9 @@ var ConsumerTenantsMembersResource = class extends APIResource {
   /**
    * Add a member to a tenant. Pass `accountId` for an existing user, or `email` (+ optional `display_name`/`username`) to auto-create the account inline. PAK must hold auth.tenant.members.add.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param tenantId - Id of the tenant.
    * @param params - `Auth.ConsumerScopedTenantMemberCreateParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
@@ -4383,7 +4927,7 @@ var ConsumerTenantsMembersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-tenants-tenant-id-members
    * @example
    * ```ts
-   * const consumerAddMember = await auth.consumer("app").tenants.members.create("tenant", { role_name: "member" });
+   * const consumerAddMember = await auth.consumer("my-app").tenants.members.create("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { role_name: "member" });
    * ```
    */
   create(tenantId, params, options) {
@@ -4392,6 +4936,9 @@ var ConsumerTenantsMembersResource = class extends APIResource {
   /**
    * Remove a member from a tenant. The underlying account row stays in the app — only the tenant_membership row is deleted. PAK must hold auth.tenant.members.remove.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param tenantId - Id of the tenant.
    * @param accountId - Id of the account.
    * @param options - Per-request options.
@@ -4402,7 +4949,7 @@ var ConsumerTenantsMembersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-tenants-tenant-id-members-account-id
    * @example
    * ```ts
-   * await auth.consumer("app").tenants.members.delete("tenant", "account");
+   * await auth.consumer("my-app").tenants.members.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   delete(tenantId, accountId, options) {
@@ -4411,6 +4958,9 @@ var ConsumerTenantsMembersResource = class extends APIResource {
   /**
    * List members of a tenant. Cursor-paginated by joined_at desc. Filter by `?search=` and/or `?role=`. PAK must hold auth.tenant.read.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param tenantId - Id of the tenant.
    * @param params - `Auth.ConsumerScopedTenantMemberListParams`.
    * @param options - Per-request options.
@@ -4424,10 +4974,10 @@ var ConsumerTenantsMembersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-tenants-tenant-id-members
    * @example
    * ```ts
-   * for await (const member of auth.consumer("app").tenants.members.list("tenant")) {
+   * for await (const member of auth.consumer("my-app").tenants.members.list("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f")) {
    *   console.log(member);
    * }
-   * const page = await auth.consumer("app").tenants.members.list("tenant", {}, { timeout: 5_000 });
+   * const page = await auth.consumer("my-app").tenants.members.list("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", {}, { timeout: 5_000 });
    * ```
    */
   list(tenantId, params, options) {
@@ -4436,6 +4986,9 @@ var ConsumerTenantsMembersResource = class extends APIResource {
   /**
    * Change a member's role. PAK must hold auth.tenant.members.update-role.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param tenantId - Id of the tenant.
    * @param accountId - Id of the account.
    * @param params - `Auth.ConsumerScopedTenantMemberUpdateParams`.
@@ -4448,7 +5001,7 @@ var ConsumerTenantsMembersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#patch-app-slug-v1-tenants-tenant-id-members-account-id
    * @example
    * ```ts
-   * const consumerTenantMembership = await auth.consumer("app").tenants.members.update("tenant", "account", { role_name: "admin" });
+   * const consumerTenantMembership = await auth.consumer("my-app").tenants.members.update("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { role_name: "admin" });
    * ```
    */
   update(tenantId, accountId, params, options) {
@@ -4467,6 +5020,9 @@ var ConsumerTenantsResource = class extends APIResource {
   /**
    * Create a tenant inside this app. Returns the new tenant with a `display_id` (`tnt_<12hex>`). PAK must hold auth.tenant.create.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.ConsumerScopedTenantCreateParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid display_name or slug.
@@ -4479,7 +5035,7 @@ var ConsumerTenantsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-tenants
    * @example
    * ```ts
-   * const consumerTenant = await auth.consumer("app").tenants.create({ display_name: "Acme Co" });
+   * const consumerTenant = await auth.consumer("my-app").tenants.create({ display_name: "Acme Co" });
    * ```
    */
   create(params, options) {
@@ -4488,6 +5044,9 @@ var ConsumerTenantsResource = class extends APIResource {
   /**
    * Delete a tenant. Cascades to tenant_membership rows; account rows are unaffected. PAK must hold auth.tenant.delete.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param tenantId - Id of the tenant.
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -4497,7 +5056,7 @@ var ConsumerTenantsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-tenants-tenant-id
    * @example
    * ```ts
-   * await auth.consumer("app").tenants.delete("tenant");
+   * await auth.consumer("my-app").tenants.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   delete(tenantId, options) {
@@ -4506,6 +5065,9 @@ var ConsumerTenantsResource = class extends APIResource {
   /**
    * List tenants in this app, paginated by created_at desc. PAK must hold auth.tenant.read.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.ConsumerScopedTenantListParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid `status` filter or malformed `cursor`.
@@ -4518,10 +5080,10 @@ var ConsumerTenantsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-tenants
    * @example
    * ```ts
-   * for await (const tenant of auth.consumer("app").tenants.list()) {
+   * for await (const tenant of auth.consumer("my-app").tenants.list()) {
    *   console.log(tenant);
    * }
-   * const page = await auth.consumer("app").tenants.list({}, { timeout: 5_000 });
+   * const page = await auth.consumer("my-app").tenants.list({}, { timeout: 5_000 });
    * ```
    */
   list(params, options) {
@@ -4530,6 +5092,9 @@ var ConsumerTenantsResource = class extends APIResource {
   /**
    * Fetch a single tenant by its UUID or `tnt_<12hex>` display id. PAK must hold auth.tenant.read.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param tenantId - Id of the tenant.
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -4539,7 +5104,7 @@ var ConsumerTenantsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-tenants-tenant-id
    * @example
    * ```ts
-   * const consumerTenant = await auth.consumer("app").tenants.retrieve("tenant");
+   * const consumerTenant = await auth.consumer("my-app").tenants.retrieve("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   retrieve(tenantId, options) {
@@ -4548,6 +5113,9 @@ var ConsumerTenantsResource = class extends APIResource {
   /**
    * Patch a tenant. Any subset of {display_name, slug, status, metadata}. PAK must hold auth.tenant.update.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param tenantId - Id of the tenant.
    * @param params - `Auth.ConsumerScopedTenantUpdateParams`.
    * @param options - Per-request options.
@@ -4560,7 +5128,7 @@ var ConsumerTenantsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#patch-app-slug-v1-tenants-tenant-id
    * @example
    * ```ts
-   * const consumerTenant = await auth.consumer("app").tenants.update("tenant", { display_name: "string" });
+   * const consumerTenant = await auth.consumer("my-app").tenants.update("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { display_name: "Acme Inc" });
    * ```
    */
   update(tenantId, params, options) {
@@ -4573,6 +5141,9 @@ var ConsumerUsersFactorsResource = class extends APIResource {
    *
    * Creates the factor in the enabled state. TOTP: returns the cleartext secret + otpauth URI + recovery codes in the response — intended for synthetic-account-style flows where the caller bundles credentials and ships them out once. Email: binds the user's verified email contact (primary by default, `contact_id` to override; 412 when unverified) and returns the masked address + recovery codes — sign-in codes are then delivered on demand via `/auth/mfa/send-code`.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param userId - Id of the user.
    * @param params - `Auth.UserFactorCreateParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
@@ -4587,7 +5158,7 @@ var ConsumerUsersFactorsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-users-user-id-factors
    * @example
    * ```ts
-   * const adminProvisionFactor = await auth.consumer("app").users.factors.create("user", { type: "totp" });
+   * const adminProvisionFactor = await auth.consumer("my-app").users.factors.create("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { type: "totp" });
    * ```
    */
   create(userId, params, options) {
@@ -4596,6 +5167,9 @@ var ConsumerUsersFactorsResource = class extends APIResource {
   /**
    * Disable a user's MFA factor
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param userId - Id of the user.
    * @param factorId - Id of the factor.
    * @param options - Per-request options.
@@ -4608,7 +5182,7 @@ var ConsumerUsersFactorsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-users-user-id-factors-factor-id
    * @example
    * ```ts
-   * await auth.consumer("app").users.factors.delete("user", "factor");
+   * await auth.consumer("my-app").users.factors.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   delete(userId, factorId, options) {
@@ -4617,6 +5191,9 @@ var ConsumerUsersFactorsResource = class extends APIResource {
   /**
    * List a user's MFA factors
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param userId - Id of the user.
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing bearer token, or the Platform API Key is malformed, unknown or revoked.
@@ -4628,7 +5205,7 @@ var ConsumerUsersFactorsResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-users-user-id-factors
    * @example
    * ```ts
-   * const factorList = await auth.consumer("app").users.factors.list("user");
+   * const factorList = await auth.consumer("my-app").users.factors.list("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   list(userId, options) {
@@ -4647,6 +5224,11 @@ var ConsumerUsersResource = class extends APIResource {
    *
    * What is NOT distinct: the password policy. A supplied `password` goes through the same app-configured rules, the same common-password deny-list and the same breach check as `/auth/signup`.
    *
+   * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.
+   * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.
+   * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param params - `Auth.UserCreateParams`.
    * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, PASSWORD_TOO_COMMON, PASSWORD_BREACHED: Invalid email, unknown role, or a password that fails the app policy — `PASSWORD_TOO_COMMON` / `PASSWORD_BREACHED`.
@@ -4658,7 +5240,7 @@ var ConsumerUsersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-admin-users
    * @example
    * ```ts
-   * const consumerAdminCreatedUser = await auth.consumer("app").users.create({ email: "string" });
+   * const consumerAdminCreatedUser = await auth.consumer("my-app").users.create({ email: "ada@example.com" });
    * ```
    */
   create(params, options) {
@@ -4669,6 +5251,11 @@ var ConsumerUsersResource = class extends APIResource {
    *
    * Removes the account, its sessions, contacts, and tenant memberships. Audit rows are preserved, and the deletion itself is audited as `auth.account.deleted` with `via: consumer_admin` and the caller as actor. Fires `user.deleted` with `via: "consumer_admin"`.
    *
+   * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.
+   * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.
+   * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param userId - Id of the user.
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired Consumer-API bearer: an EndUser or M2M token, or an app API key (`hdk_live_*` / `hdk_test_*`); or the account, session, M2M client or key is no longer active, or the key belongs to another app.
@@ -4679,7 +5266,7 @@ var ConsumerUsersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-admin-users-user-id
    * @example
    * ```ts
-   * await auth.consumer("app").users.delete("user");
+   * await auth.consumer("my-app").users.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   delete(userId, options) {
@@ -4690,6 +5277,11 @@ var ConsumerUsersResource = class extends APIResource {
    *
    * Cursor-paginated. Supports the same `status` and `search` filters as the auth-admin equivalent. Use the cursor in subsequent calls — Auth does not expose offset pagination.
    *
+   * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.
+   * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.
+   * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param params - `Auth.UserListParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`, or a cursor issued for a different sort order.
@@ -4701,10 +5293,10 @@ var ConsumerUsersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-admin-users
    * @example
    * ```ts
-   * for await (const user of auth.consumer("app").users.list()) {
+   * for await (const user of auth.consumer("my-app").users.list()) {
    *   console.log(user);
    * }
-   * const page = await auth.consumer("app").users.list({}, { timeout: 5_000 });
+   * const page = await auth.consumer("my-app").users.list({}, { timeout: 5_000 });
    * ```
    */
   list(params, options) {
@@ -4713,6 +5305,11 @@ var ConsumerUsersResource = class extends APIResource {
   /**
    * Read one end-user
    *
+   * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.
+   * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.
+   * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param userId - Id of the user.
    * @param options - Per-request options.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -4722,7 +5319,7 @@ var ConsumerUsersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-admin-users-user-id
    * @example
    * ```ts
-   * const consumerAdminEndUser = await auth.consumer("app").users.retrieve("user");
+   * const consumerAdminEndUser = await auth.consumer("my-app").users.retrieve("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
    * ```
    */
   retrieve(userId, options) {
@@ -4733,6 +5330,11 @@ var ConsumerUsersResource = class extends APIResource {
    *
    * Email update promotes an existing contact to primary (not for creating new contacts — that goes through the per-contact flow).
    *
+   * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.
+   * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.
+   * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param userId - Id of the user.
    * @param params - `Auth.UserUpdateParams`.
    * @param options - Per-request options.
@@ -4745,7 +5347,7 @@ var ConsumerUsersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#patch-app-slug-v1-admin-users-user-id
    * @example
    * ```ts
-   * const consumerAdminEndUser = await auth.consumer("app").users.update("user", { display_name: "string" });
+   * const consumerAdminEndUser = await auth.consumer("my-app").users.update("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { display_name: "Ada Lovelace" });
    * ```
    */
   update(userId, params, options) {
@@ -4756,6 +5358,11 @@ var ConsumerUsersResource = class extends APIResource {
    *
    * Sets `app_membership.role_id` for the target user. For M2M callers the assignable role is bounded by the token's scopes (the guard already enforced `role.assign`); the role's own permission set is NOT additionally narrowed against the M2M scopes because M2M scopes are typically broader than per-user role perms by design (a backend cron with `user.list` + `role.assign` SHOULD be able to promote a user into a role carrying any per-app perm). EndUser admins are bounded by their own role's perms transitively — they couldn't authenticate as an admin without holding the perm.
    *
+   * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.
+   * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.
+   * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param userId - Id of the user.
    * @param params - `Auth.UserUpdateRoleParams`.
    * @param options - Per-request options.
@@ -4768,7 +5375,7 @@ var ConsumerUsersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#patch-app-slug-v1-admin-users-user-id-role
    * @example
    * ```ts
-   * const consumerAdminRoleAssignment = await auth.consumer("app").users.updateRole("user", { role_name: "string" });
+   * const consumerAdminRoleAssignment = await auth.consumer("my-app").users.updateRole("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { role_name: "member" });
    * ```
    */
   updateRole(userId, params, options) {
@@ -4779,6 +5386,11 @@ var ConsumerUsersResource = class extends APIResource {
    *
    * Setting status to `suspended` or `deactivated` also revokes all active sessions for the user (same behaviour as the auth-admin equivalent).
    *
+   * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.
+   * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.
+   * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param userId - Id of the user.
    * @param params - `Auth.UserUpdateStatusParams`.
    * @param options - Per-request options.
@@ -4791,7 +5403,7 @@ var ConsumerUsersResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#patch-app-slug-v1-admin-users-user-id-status
    * @example
    * ```ts
-   * const consumerAdminEndUser = await auth.consumer("app").users.updateStatus("user", { status: "active" });
+   * const consumerAdminEndUser = await auth.consumer("my-app").users.updateStatus("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { status: "active" });
    * ```
    */
   updateStatus(userId, params, options) {
@@ -4815,7 +5427,7 @@ var ConsumerVerifyResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-authorize
    * @example
    * ```ts
-   * const authorize = await auth.consumer("app").verify.authorize({ permission: "string" });
+   * const authorize = await auth.consumer("my-app").verify.authorize({ permission: "invoice.read" });
    * ```
    */
   authorize(params, options) {
@@ -4837,7 +5449,7 @@ var ConsumerVerifyResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-authorize-batch
    * @example
    * ```ts
-   * const authorizeBatch = await auth.consumer("app").verify.authorizeBatch({ checks: [{}] });
+   * const authorizeBatch = await auth.consumer("my-app").verify.authorizeBatch({ checks: [{}] });
    * ```
    */
   authorizeBatch(params, options) {
@@ -4859,7 +5471,7 @@ var ConsumerVerifyResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-verify
    * @example
    * ```ts
-   * const verify = await auth.consumer("app").verify.token({ token: "string" });
+   * const verify = await auth.consumer("my-app").verify.token({ token: "eyJhbGciOiJSUzI1NiIsImtpZCI6ImsxIn0.eyJzdWIiOiJ1c3JfMSJ9.c2lnbmF0dXJl" });
    * ```
    */
   token(params, options) {
@@ -4887,7 +5499,7 @@ var ConsumerWellKnownResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-well-known-jwks-json
    * @example
    * ```ts
-   * const jwks = await auth.consumer("app").wellKnown.jwks();
+   * const jwks = await auth.consumer("my-app").wellKnown.jwks();
    * ```
    */
   jwks(options) {
@@ -4905,7 +5517,7 @@ var ConsumerWellKnownResource = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-well-known-openid-configuration
    * @example
    * ```ts
-   * const openIdConfiguration = await auth.consumer("app").wellKnown.openidConfiguration();
+   * const openIdConfiguration = await auth.consumer("my-app").wellKnown.openidConfiguration();
    * ```
    */
   openidConfiguration(options) {
@@ -4981,7 +5593,7 @@ var AuthConsumer = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-accept-invite
    * @example
    * ```ts
-   * const result = await auth.consumer("app").acceptInvite({ code: "inv_x7H2k3jLqXr", password: "CorrectHorseBatteryStaple" });
+   * const result = await auth.consumer("my-app").acceptInvite({ code: "inv_x7H2k3jLqXr", password: "CorrectHorseBatteryStaple" });
    * ```
    */
   acceptInvite(params, options) {
@@ -5006,7 +5618,7 @@ var AuthConsumer = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-accept-tenant-invite
    * @example
    * ```ts
-   * const consumerToken = await auth.consumer("app").acceptTenantInvite({ code: "tinv_9dK2mQ7pR4vXbN1sT6yZ0hLcJeW3fAgU", password: "CorrectHorseBatteryStaple" });
+   * const consumerToken = await auth.consumer("my-app").acceptTenantInvite({ code: "tinv_9dK2mQ7pR4vXbN1sT6yZ0hLcJeW3fAgU", password: "CorrectHorseBatteryStaple" });
    * ```
    */
   acceptTenantInvite(params, options) {
@@ -5024,7 +5636,7 @@ var AuthConsumer = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-oauth-exchange
    * @example
    * ```ts
-   * const exchange = await auth.consumer("app").exchangeProviderCode({ code: "string" });
+   * const exchange = await auth.consumer("my-app").exchangeProviderCode({ code: "hc_8f14e45fceea167a5a36dedd4bea2543" });
    * ```
    */
   exchangeProviderCode(params, options) {
@@ -5047,7 +5659,9 @@ var AuthConsumer = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-logout
    * @example
    * ```ts
-   * await auth.consumer("app").logout({ refresh_token: "string" });
+   * await auth.consumer("my-app").logout({
+   *   refresh_token: "eyJhbGciOiJSUzI1NiIsImtpZCI6ImsxIn0.eyJ0eXAiOiJyZWZyZXNoIn0.c2lnbmF0dXJl",
+   * });
    * ```
    */
   logout(params, options) {
@@ -5070,7 +5684,9 @@ var AuthConsumer = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-refresh
    * @example
    * ```ts
-   * const consumerToken = await auth.consumer("app").refresh({ refresh_token: "string" });
+   * const consumerToken = await auth.consumer("my-app").refresh({
+   *   refresh_token: "eyJhbGciOiJSUzI1NiIsImtpZCI6ImsxIn0.eyJ0eXAiOiJyZWZyZXNoIn0.c2lnbmF0dXJl",
+   * });
    * ```
    */
   refresh(params, options) {
@@ -5085,6 +5701,9 @@ var AuthConsumer = class extends APIResource {
    *
    * Renamed from /auth/request-reset.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.RequestPasswordResetParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Provide exactly one of `email` or `phone`, or request validation failed in the global `ValidationPipe`.
@@ -5097,7 +5716,7 @@ var AuthConsumer = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-request-password-reset
    * @example
    * ```ts
-   * const consumerCodeIssue = await auth.consumer("app").requestPasswordReset({ email: "jane@example.com" });
+   * const consumerCodeIssue = await auth.consumer("my-app").requestPasswordReset({ email: "jane@example.com" });
    * ```
    */
   requestPasswordReset(params, options) {
@@ -5112,6 +5731,9 @@ var AuthConsumer = class extends APIResource {
    *
    * Issuing a code invalidates any previously issued, unconsumed code for the same contact — including the one auto-emailed at signup. Only the most recently minted code is accepted.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.RequestVerificationParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Provide exactly one of `email` or `phone`, or request validation failed in the global `ValidationPipe`.
@@ -5124,7 +5746,7 @@ var AuthConsumer = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-request-verification
    * @example
    * ```ts
-   * const consumerCodeIssue = await auth.consumer("app").requestVerification({ email: "jane@example.com" });
+   * const consumerCodeIssue = await auth.consumer("my-app").requestVerification({ email: "jane@example.com" });
    * ```
    */
   requestVerification(params, options) {
@@ -5148,7 +5770,7 @@ var AuthConsumer = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-reset-password
    * @example
    * ```ts
-   * await auth.consumer("app").resetPassword({ code: "123456", new_password: "string" });
+   * await auth.consumer("my-app").resetPassword({ code: "123456", new_password: "a new long passphrase 42" });
    * ```
    */
   resetPassword(params, options) {
@@ -5159,6 +5781,9 @@ var AuthConsumer = class extends APIResource {
    *
    * Same shape as `send-verification-email` but for the reset slot. PAK perm: `auth.user.password-reset.send-email`. Same loud precondition errors. Email-only.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.SendPasswordResetEmailParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.
@@ -5173,7 +5798,7 @@ var AuthConsumer = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-send-password-reset-email
    * @example
    * ```ts
-   * const consumerCodeDispatch = await auth.consumer("app").sendPasswordResetEmail({ email: "jane@example.com" });
+   * const consumerCodeDispatch = await auth.consumer("my-app").sendPasswordResetEmail({ email: "jane@example.com" });
    * ```
    */
   sendPasswordResetEmail(params, options) {
@@ -5197,6 +5822,9 @@ var AuthConsumer = class extends APIResource {
    *
    * Issuing a code invalidates any previously issued, unconsumed code for the same contact — including the one auto-emailed at signup. Only the most recently minted code is accepted.
    *
+   * Credential: `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.SendVerificationEmailParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.
@@ -5211,7 +5839,7 @@ var AuthConsumer = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-send-verification-email
    * @example
    * ```ts
-   * const consumerCodeDispatch = await auth.consumer("app").sendVerificationEmail({ email: "jane@example.com" });
+   * const consumerCodeDispatch = await auth.consumer("my-app").sendVerificationEmail({ email: "jane@example.com" });
    * ```
    */
   sendVerificationEmail(params, options) {
@@ -5235,7 +5863,7 @@ var AuthConsumer = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-signin
    * @example
    * ```ts
-   * const result = await auth.consumer("app").signin({ identifier: "jane_doe", password: "string" });
+   * const result = await auth.consumer("my-app").signin({ identifier: "jane_doe", password: "correct horse battery staple" });
    * ```
    */
   signin(params, options) {
@@ -5256,7 +5884,10 @@ var AuthConsumer = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-oauth-provider
    * @example
    * ```ts
-   * const result = await auth.consumer("app").signinWithProvider("provider", { id_token: "string", nonce: "string" });
+   * const result = await auth.consumer("my-app").signinWithProvider("google", {
+   *   id_token: "eyJhbGciOiJSUzI1NiIsImtpZCI6ImsxIn0.eyJzdWIiOiJ1c3JfMSJ9.c2lnbmF0dXJl",
+   *   nonce: "n-0S6_WzA2Mj",
+   * });
    * ```
    */
   signinWithProvider(provider, params, options) {
@@ -5271,11 +5902,14 @@ var AuthConsumer = class extends APIResource {
    *
    * When the app has bot protection on (`auth_config.bot_protection`, Cloudflare Turnstile or hCaptcha), send the widget response as `bot_protection_token`. Auth verifies it with the provider before it looks at the email, username or password, and refuses the sign-up when the token is missing (400 `BOT_PROTECTION_REQUIRED`), rejected (403 `BOT_PROTECTION_FAILED`) or cannot be checked (503 `BOT_PROTECTION_UNAVAILABLE`; no account is created). This applies to PAK-authenticated calls too: a backend forwards the token its browser received.
    *
+   * Credential (optional): `workspace_key`.
+   * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+   *
    * @param params - `Auth.SignupParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, BOT_PROTECTION_REQUIRED: `BOT_PROTECTION_REQUIRED`: the app has bot protection on and the request carried no `bot_protection_token`. Also: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.
    * @throws {AuthenticationError} 401 UNAUTHORIZED: The app sets `signup_requires_pak` and no Platform API Key was presented on `Authorization: Bearer`.
-   * @throws {PermissionDeniedError} 403 FORBIDDEN, BOT_PROTECTION_FAILED, APP_SUSPENDED, APP_ARCHIVED: `BOT_PROTECTION_FAILED`: the bot-protection provider rejected the `bot_protection_token` (bad, expired or already used), or the hostname it reported is not one of the app's `bot_protection.expected_hostnames`; render a fresh widget and retry. Otherwise: signup is disabled for this app, the email domain is not on the app's allow-list, the presented PAK belongs to a different workspace, or its policy denies `auth.signup.create` on this app. Also returned when the app itself is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`).
+   * @throws {PermissionDeniedError} 403 FORBIDDEN, BOT_PROTECTION_FAILED, APP_SUSPENDED, APP_ARCHIVED: `BOT_PROTECTION_FAILED`: the bot-protection provider rejected the `bot_protection_token` (bad, expired or already used), or the hostname it reported is not one of the app's `bot_protection.expected_hostnames`; render a fresh widget and retry. Otherwise: signup is disabled for this app (new apps start with `signup_enabled: false`; turn it on with `PATCH /v1/apps/{app_id}/auth-config`), the email domain is not on the app's allow-list, the presented PAK belongs to a different workspace, or its policy denies `auth.signup.create` on this app. Also returned when the app itself is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`).
    * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.
    * @throws {ConflictError} 409 CONFLICT: Email or username already in use in this app, or the app has no workspace binding and therefore cannot accept a PAK signup.
    * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.
@@ -5285,7 +5919,7 @@ var AuthConsumer = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-signup
    * @example
    * ```ts
-   * const result = await auth.consumer("app").signup({ email: "jane@example.com", password: "CorrectHorseBatteryStaple", username: "john_doe" });
+   * const result = await auth.consumer("my-app").signup({ email: "jane@example.com", password: "CorrectHorseBatteryStaple", username: "john_doe" });
    * ```
    */
   signup(params, options) {
@@ -5296,6 +5930,9 @@ var AuthConsumer = class extends APIResource {
    *
    * Re-issues the EndUser's access + refresh tokens with the new `org_id` + `org_role` claims, after verifying the caller holds a tenant_membership for the target tenant. The session row is updated to the new tenant so subsequent refreshes preserve the context. The new access token keeps the session's `amr` and `mfa_at` (as `/auth/refresh` does), so a sign-in that completed MFA still proves it after a switch. Refresh-token rotation runs as usual; the previous refresh token enters the standard 60-second grace window.
    *
+   * Credential: `end_user_token`.
+   * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+   *
    * @param params - `Auth.SwitchTenantParams`.
    * @param options - Per-request options.
    * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.
@@ -5308,7 +5945,7 @@ var AuthConsumer = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-switch-tenant
    * @example
    * ```ts
-   * const consumerToken = await auth.consumer("app").switchTenant({ tenant_id: "string" });
+   * const consumerToken = await auth.consumer("my-app").switchTenant({ tenant_id: "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f" });
    * ```
    */
   switchTenant(params, options) {
@@ -5333,7 +5970,7 @@ var AuthConsumer = class extends APIResource {
    * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-verify
    * @example
    * ```ts
-   * const consumerVerify = await auth.consumer("app").verifyEmail({ code: "123456" });
+   * const consumerVerify = await auth.consumer("my-app").verifyEmail({ code: "123456" });
    * ```
    */
   verifyEmail(params, options) {
@@ -7294,7 +7931,7 @@ var WebhookEventStatus = { values: ["pending", "delivered", "failed", "not_sent"
 var WebhookEventType = { values: ["user.signup", "user.signin", "user.suspended", "user.deactivated", "user.reinstated", "user.role_changed", "user.deleted", "user.contact_verified", "user.email_verified", "user.password_reset.requested", "user.password_reset.completed", "user.mfa.factor_enrolled", "user.mfa.factor_disabled", "user.mfa.recovery_code_used", "user.mfa.step_up_succeeded", "user.mfa.step_up_locked", "user.mfa.enrollment_required", "user.mfa.reenrollment_required", "tenant.created", "tenant.updated", "tenant.deleted", "tenant.member.added", "tenant.member.removed", "tenant.member.role_changed", "tenant.invite.created", "tenant.invite.accepted", "tenant.invite.revoked", "app.slug_changed"] };
 
 // src/_generated/client.ts
-var VERSION = "1.0.0" ;
+var VERSION = "1.1.0" ;
 exports.default = class Auth extends AuthBase {
   #openapi;
   constructor(options = {}) {