@productcraft/auth 1.0.0 → 1.1.0

package/dist/index.d.ts

@@ -1,7 +1,6 @@
-import { LastResponse, WebhookPayload, WebhookHeaders, APIClient, RequestOptions, APIPromise, PagePromise, ClientOptions, PollOptions, APIError } from '@productcraft/core';
+import { LastResponse, WebhookPayload, WebhookHeaders, APIClient, RequestOptions, APIPromise, PagePromise, SignedWebhook, ClientOptions, PollOptions, APIError } from '@productcraft/core';
 export { APIConnectionError, APIError, APITimeoutError, APIUserAbortError, AuthenticationError, BadRequestError, ConfigurationError, ConflictError, IdempotencyKeyReuseError, InternalServerError, NotFoundError, PCAuth, PCClientConfig, PermissionDeniedError, ProductCraftError, RateLimitError, UnprocessableEntityError, WebhookVerificationError } from '@productcraft/core';
 import { Client } from 'openapi-fetch';
-import { JWTHeaderParameters, FlattenedJWSInput, CryptoKey, JWTPayload } from 'jose';
 
 /** Error codes this API documents. Open: codes added later still type-check. See https://productcraft.co/docs/errors. */
 type AuthErrorCode = "BAD_REQUEST" | "VALIDATION_ERROR" | "UNAUTHORIZED" | "PAYMENT_REQUIRED" | "FORBIDDEN" | "NOT_FOUND" | "METHOD_NOT_ALLOWED" | "NOT_ACCEPTABLE" | "REQUEST_TIMEOUT" | "CONFLICT" | "GONE" | "PRECONDITION_FAILED" | "PAYLOAD_TOO_LARGE" | "UNSUPPORTED_MEDIA_TYPE" | "UNPROCESSABLE_ENTITY" | "PRECONDITION_REQUIRED" | "RATE_LIMITED" | "INTERNAL_SERVER_ERROR" | "NOT_IMPLEMENTED" | "BAD_GATEWAY" | "SERVICE_UNAVAILABLE" | "GATEWAY_TIMEOUT" | "SERVICE_NOT_ENABLED" | "INVALID_CREDENTIALS" | "SESSION_REVOKED" | "MCP_NOT_PERMITTED" | "MCP_WORKSPACE_MISMATCH" | "PAK_NOT_PERMITTED" | "ACTIONS_NOT_GRANTABLE" | "IDEMPOTENCY_KEY_REUSE" | "IDEMPOTENCY_KEY_REQUIRED" | "IDEMPOTENCY_IN_PROGRESS" | "WEBHOOK_ENDPOINT_LIMIT" | "WEBHOOK_ENDPOINT_NOT_FOUND" | "WEBHOOK_ENDPOINT_NOT_SUBSCRIBED" | "WEBHOOK_EVENT_NOT_FOUND" | "WEBHOOK_EVENT_TYPE_UNKNOWN" | "ACCOUNT_EXISTS" | "ACCOUNT_NOT_FOUND" | "ACCOUNT_SUSPENDED" | "APEX_NOT_SUPPORTED" | "APP_ARCHIVED" | "APP_HAS_NO_WORKSPACE" | "APP_NOT_FOUND" | "APP_SUSPENDED" | "AUTH_SETTINGS_IN_METADATA" | "AVATAR_INVALID_TYPE" | "AVATAR_MAGIC_MISMATCH" | "AVATAR_NOT_FOUND" | "AVATAR_TOO_LARGE" | "BOT_PROTECTION_FAILED" | "BOT_PROTECTION_REQUIRED" | "BOT_PROTECTION_UNAVAILABLE" | "CUSTOM_DOMAIN_EXISTS" | "CUSTOM_DOMAIN_NOT_ACTIVE" | "CUSTOM_DOMAIN_NOT_FOUND" | "CUSTOM_DOMAIN_OAUTH_ONLY" | "DNS_CONFLICTS" | "ENVOI_APP_NOT_BOUND_TO_WORKSPACE" | "ENVOI_NOT_ENABLED" | "ENVOI_NOT_WIRED" | "ENVOI_SENDER_NOT_CONFIGURED" | "ENVOI_TEMPLATE_NOT_CONFIGURED" | "FEATURE_NOT_ENABLED" | "HOSTNAME_RESERVED" | "HOSTNAME_TAKEN" | "INSUFFICIENT_PERMISSIONS" | "INVALID_FORMAT" | "INVALID_HOSTNAME" | "INVALID_IDENTIFIER" | "INVALID_PROVIDER" | "INVALID_ZONE" | "MAIL_UNREACHABLE" | "PAK_WORKSPACE_MISMATCH" | "PASSWORD_BREACHED" | "PASSWORD_TOO_COMMON" | "PROVIDER_ERROR" | "PROVIDER_PERMISSION_DENIED" | "PROVIDER_TOKEN_REJECTED" | "PROVIDER_UNAVAILABLE" | "PROVIDER_ZONE_NOT_FOUND" | "ROLE_IN_USE" | "SENDER_ADDRESS_REQUIRED" | "SESSION_EXPIRED" | "SIGN_IN_TEST_INVALID" | "SLUG_TAKEN" | "SLUG_UUID_SHAPED" | "TENANT_API_KEYS_APP_PROXY_ONLY" | "TENANT_API_KEYS_FORBIDDEN" | "TENANT_API_KEYS_NOT_ENABLED" | "TENANT_API_KEYS_NO_SCOPES" | "TENANT_API_KEYS_SCOPE_INVALID" | "TENANT_API_KEYS_SUSPENDED" | "TENANT_API_KEYS_SUSPENDED_NOT_WRITABLE" | "TENANT_API_KEYS_UNKNOWN_ROLE" | "TENANT_API_KEY_EXPIRY_INVALID" | "TENANT_API_KEY_LIMIT" | "TENANT_API_KEY_NOT_ACTIVE" | "TENANT_API_KEY_NOT_FOUND" | "TENANT_API_KEY_SCOPE_ABOVE_CEILING" | "TENANT_API_KEY_SCOPE_NOT_GRANTABLE" | "TENANT_CONTEXT_REQUIRED" | "TENANT_MEMBERSHIP_REQUIRED" | "TENANT_NOT_ACTIVE" | "TOKEN_EXPIRED" | "TOKEN_INVALID" | "TOKEN_REVOKED" | "USERNAME_TAKEN" | "account_exists_with_different_provider" | "idempotency_secret_not_replayable" | "link_required" | "step_up_required" | (string & {});
@@ -24,6 +23,8 @@ type paths = {
         /**
          * Create a new app owned by the caller
          * @description The new app starts with emails to its users turned on: they go out from the workspace default sender chosen in Mail, and the default verification, welcome, password-reset, invite and sign-in code templates are created in the workspace's Mail templates (an existing template with the same name is reused). Change or turn this off with `PATCH /v1/apps/{appId}/notification-settings`.
+         *
+         *     **Sign-up starts off.** A new app has `signup_enabled: false`, so `POST /{app_slug}/v1/auth/signup` answers 403 `FORBIDDEN` ("Signup is disabled for this app") until you turn it on with `PATCH /v1/apps/{app_id}/auth-config` and `{ "signup_enabled": true }`. Sign-in, invites and admin-created users work either way.
          */
         post: operations["AppController_createApp"];
         delete?: never;
@@ -3393,7 +3394,10 @@ type components = {
              * @enum {string}
              */
             type: "email" | "phone";
-            /** @description Email or phone value (E.164 recommended for phone) */
+            /**
+             * @description Email or phone value (E.164 recommended for phone)
+             * @example ada@example.com
+             */
             value: string;
         };
         AddMemberDto: {
@@ -3424,7 +3428,10 @@ type components = {
         AdminCreateUserDto: {
             /** @description Human-readable display name. */
             display_name?: string;
-            /** @description Primary email — becomes the account's primary email contact (unverified). */
+            /**
+             * @description Primary email — becomes the account's primary email contact (unverified).
+             * @example ada@example.com
+             */
             email: string;
             /** @description Optional initial password. When omitted, the account has no credential — the customer triggers the password-reset flow to onboard the user. When supplied it must satisfy the SAME rules as `/auth/signup`: the app-configured length and character classes, the common-password deny-list (400 `PASSWORD_TOO_COMMON`) and, unless the app sets `password_breach_check` to `off` or `warn`, the breach corpus (400 `PASSWORD_BREACHED`). */
             password?: string;
@@ -3444,7 +3451,10 @@ type components = {
             recovery_codes: string[];
         };
         AdminUpdateRoleDto: {
-            /** @description Target role name (must already exist in this app). */
+            /**
+             * @description Target role name (must already exist in this app).
+             * @example member
+             */
             role_name: string;
         };
         AdminUpdateStatusDto: {
@@ -3455,7 +3465,10 @@ type components = {
             status: "active" | "suspended" | "deactivated";
         };
         AdminUpdateUserDto: {
-            /** @description New display name. Empty string clears. */
+            /**
+             * @description New display name. Empty string clears.
+             * @example Ada Lovelace
+             */
             display_name?: string;
             /** @description New primary email address. Replaces the current primary email contact (still unverified after the change). */
             email?: string;
@@ -3993,7 +4006,10 @@ type components = {
         /** @enum {string} */
         ApplyPlanResult: "created" | "unchanged" | "failed";
         AssignRoleDto: {
-            /** @description Account ID of the user */
+            /**
+             * @description Account ID of the user
+             * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+             */
             account_id: string;
             /**
              * @description Role name to assign
@@ -4387,7 +4403,10 @@ type components = {
             missing_permissions: string[];
         };
         AuthorizeBody: {
-            /** @description Single permission to check, e.g. 'user.read'. Use this OR `permissions`. */
+            /**
+             * @description Single permission to check, e.g. 'user.read'. Use this OR `permissions`.
+             * @example invoice.read
+             */
             permission?: string;
             /** @description Multiple permissions; the token must hold ALL of them. */
             permissions?: string[];
@@ -4478,7 +4497,10 @@ type components = {
             status?: "active" | "suspended" | "deactivated";
         };
         BulkUpdateRoleDto: {
-            /** @description Role name to assign to all selected users */
+            /**
+             * @description Role name to assign to all selected users
+             * @example member
+             */
             role_name: string;
             selection: components["schemas"]["BulkSelectionDto"];
         };
@@ -4493,9 +4515,15 @@ type components = {
         };
         CallbackBodyDto: Record<string, unknown>;
         ChangePasswordDto: {
-            /** @description The current password — required even when changing. */
+            /**
+             * @description The current password — required even when changing.
+             * @example correct horse battery staple
+             */
             current_password: string;
-            /** @description The new password. Must be at least 8 chars; the app may enforce a stricter policy. */
+            /**
+             * @description The new password. Must be at least 8 chars; the app may enforce a stricter policy.
+             * @example a new long passphrase 42
+             */
             new_password: string;
         };
         ClientCredentialsDto: {
@@ -4504,7 +4532,10 @@ type components = {
              * @example m2m_a1b2c3d4e5f6...
              */
             client_id: string;
-            /** @description M2M client secret (issued at client creation, never returned again). */
+            /**
+             * @description M2M client secret (issued at client creation, never returned again).
+             * @example the-secret-returned-by-credentials-create
+             */
             client_secret: string;
             /**
              * @description OAuth grant type. Only 'client_credentials' is supported.
@@ -4779,7 +4810,10 @@ type components = {
             expires_at: string;
         };
         ConsumerLogoutDto: {
-            /** @description Refresh token to revoke. The matching session is destroyed; the access token continues to verify until its TTL expires. */
+            /**
+             * @description Refresh token to revoke. The matching session is destroyed; the access token continues to verify until its TTL expires.
+             * @example eyJhbGciOiJSUzI1NiIsImtpZCI6ImsxIn0.eyJ0eXAiOiJyZWZyZXNoIn0.c2lnbmF0dXJl
+             */
             refresh_token: string;
         };
         ConsumerMfaChallengeFactorDto: {
@@ -4824,7 +4858,10 @@ type components = {
             contact_id?: string;
             /** @description Optional human-readable label for the factor (e.g. "iPhone 15"). */
             label?: string;
-            /** @description The `mfa_token` from an `mfa_enrollment_required: true` signin response. UUID. */
+            /**
+             * @description The `mfa_token` from an `mfa_enrollment_required: true` signin response. UUID.
+             * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+             */
             mfa_token: string;
             /**
              * @description Factor type to enrol — `totp` (authenticator app) or `email` (single-use code to a verified email contact).
@@ -4852,7 +4889,10 @@ type components = {
              * @description Id of the pending factor returned by `/auth/mfa/enroll`.
              */
             factor_id: string;
-            /** @description The same `mfa_token` used to start the enrolment. UUID. */
+            /**
+             * @description The same `mfa_token` used to start the enrolment. UUID.
+             * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+             */
             mfa_token: string;
         };
         ConsumerMfaEnrollVerifyResponseDto: {
@@ -4925,7 +4965,10 @@ type components = {
             result: "mfa_enrollment_required";
         };
         ConsumerMfaRecoverDto: {
-            /** @description The `mfa_token` returned by `/auth/signin`. UUID. */
+            /**
+             * @description The `mfa_token` returned by `/auth/signin`. UUID.
+             * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+             */
             mfa_token: string;
             /**
              * @description A single-use recovery code (16 hex chars, hyphens optional). Consumes the code on success — the user should regenerate the set afterwards via `/me/mfa/recovery-codes/regenerate`.
@@ -4939,7 +4982,10 @@ type components = {
              * @description Id of the email factor (from the challenge `factors` list) to deliver the code through.
              */
             factor_id: string;
-            /** @description The `mfa_token` returned by `/auth/signin`. UUID. */
+            /**
+             * @description The `mfa_token` returned by `/auth/signin`. UUID.
+             * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+             */
             mfa_token: string;
         };
         ConsumerMfaSendCodeResponseDto: {
@@ -4964,11 +5010,17 @@ type components = {
             credential?: {
                 [key: string]: unknown;
             };
-            /** @description The `mfa_token` returned by `/auth/signin`. UUID. */
+            /**
+             * @description The `mfa_token` returned by `/auth/signin`. UUID.
+             * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+             */
             mfa_token: string;
         };
         ConsumerMfaWebauthnOptionsDto: {
-            /** @description The `mfa_token` returned by `/auth/signin`. UUID. */
+            /**
+             * @description The `mfa_token` returned by `/auth/signin`. UUID.
+             * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+             */
             mfa_token: string;
         };
         ConsumerPasskeyOptionsDto: {
@@ -4985,7 +5037,10 @@ type components = {
             };
         };
         ConsumerRefreshDto: {
-            /** @description Refresh token returned from signin/signup/previous refresh. Each refresh rotates the token; the previous one is revoked. */
+            /**
+             * @description Refresh token returned from signin/signup/previous refresh. Each refresh rotates the token; the previous one is revoked.
+             * @example eyJhbGciOiJSUzI1NiIsImtpZCI6ImsxIn0.eyJ0eXAiOiJyZWZyZXNoIn0.c2lnbmF0dXJl
+             */
             refresh_token: string;
         };
         ConsumerRequestPasswordResetDto: {
@@ -5018,7 +5073,10 @@ type components = {
              * @example 123456
              */
             code: string;
-            /** @description New password. Must satisfy the app-configured policy. */
+            /**
+             * @description New password. Must satisfy the app-configured policy.
+             * @example a new long passphrase 42
+             */
             new_password: string;
         };
         ConsumerRoleListResponseDto: {
@@ -5108,7 +5166,10 @@ type components = {
              * @example jane_doe
              */
             identifier: string;
-            /** @description EndUser password. */
+            /**
+             * @description EndUser password.
+             * @example correct horse battery staple
+             */
             password: string;
             /** @description Optional tenant UUID. When set, the issued JWT carries `tid` + `trole` claims and the user must already be a member of that tenant — non-membership returns 403. */
             tenant_id?: string;
@@ -5141,7 +5202,10 @@ type components = {
             username: string;
         };
         ConsumerSwitchTenantDto: {
-            /** @description Tenant UUID to switch the EndUser's session into. Caller must already hold a tenant_membership row for this tenant in the app, else 403. */
+            /**
+             * @description Tenant UUID to switch the EndUser's session into. Caller must already hold a tenant_membership row for this tenant in the app, else 403.
+             * @example 3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+             */
             tenant_id: string;
         };
         ConsumerTenantListResponseDto: {
@@ -6238,7 +6302,10 @@ type components = {
             status_code: number;
         };
         ExchangeRequestDto: {
-            /** @description The opaque `heimdall_code` the customer received on the OAuth callback `return_to`. Single-use; expires after 60 seconds. */
+            /**
+             * @description The opaque `heimdall_code` the customer received on the OAuth callback `return_to`. Single-use; expires after 60 seconds.
+             * @example hc_8f14e45fceea167a5a36dedd4bea2543
+             */
             code: string;
         };
         ExchangeResponseDto: {
@@ -6295,9 +6362,15 @@ type components = {
             result: "mfa_enrollment_required";
         };
         IdpNativeSigninDto: {
-            /** @description Provider-issued ID token (JWT). For Apple, the value returned by `ASAuthorizationAppleIDCredential.identityToken` after UTF-8 decoding the data. */
+            /**
+             * @description Provider-issued ID token (JWT). For Apple, the value returned by `ASAuthorizationAppleIDCredential.identityToken` after UTF-8 decoding the data.
+             * @example eyJhbGciOiJSUzI1NiIsImtpZCI6ImsxIn0.eyJzdWIiOiJ1c3JfMSJ9.c2lnbmF0dXJl
+             */
             id_token: string;
-            /** @description Raw nonce the client generated and SHA-256-hashed into the authorize request. Backend recomputes the hash and compares to the token's `nonce` claim. Must be at least 32 bytes of entropy (base64url-encoded ~43 chars). */
+            /**
+             * @description Raw nonce the client generated and SHA-256-hashed into the authorize request. Backend recomputes the hash and compares to the token's `nonce` claim. Must be at least 32 bytes of entropy (base64url-encoded ~43 chars).
+             * @example n-0S6_WzA2Mj
+             */
             nonce: string;
             /** @description Apple-specific first-signin payload: { name, email }. Persist for display only — the verified JWT is the source of truth. */
             user?: components["schemas"]["IdpNativeUserHintDto"];
@@ -6471,7 +6544,10 @@ type components = {
             requested: number;
         };
         IntrospectDto: {
-            /** @description The access token to introspect. Optional — when omitted the endpoint introspects the `Authorization: Bearer` token. When present, it must match the bearer (we refuse cross-token introspection so a stolen token cannot be probed against a different active credential). */
+            /**
+             * @description The access token to introspect. Optional — when omitted the endpoint introspects the `Authorization: Bearer` token. When present, it must match the bearer (we refuse cross-token introspection so a stolen token cannot be probed against a different active credential).
+             * @example eyJhbGciOiJSUzI1NiIsImtpZCI6ImsxIn0.eyJzdWIiOiJ1c3JfMSJ9.c2lnbmF0dXJl
+             */
             token?: string;
             /**
              * @description Optional `token_type_hint` per RFC 7662. We only issue access tokens at this endpoint so the only meaningful value is `access_token`; the field is accepted for client-library compatibility.
@@ -9171,7 +9247,10 @@ type components = {
             site_key?: string;
         };
         UpdateEndUserDto: {
-            /** @description New display name */
+            /**
+             * @description New display name
+             * @example Ada Lovelace
+             */
             display_name?: string;
             /** @description New primary email */
             email?: string;
@@ -9231,7 +9310,10 @@ type components = {
             description?: string;
         };
         UpdateTenantDto: {
-            /** @description Human-readable name of the tenant. */
+            /**
+             * @description Human-readable name of the tenant.
+             * @example Acme Inc
+             */
             display_name?: string;
             /** @description Free-form JSON object you attach to the tenant; returned as stored. */
             metadata?: {
@@ -10131,7 +10213,10 @@ type components = {
             type: "user.suspended";
         };
         VerifyBody: {
-            /** @description EndUser or M2M JWT to verify against the app JWKS. Optional — if omitted, the token is read from the `Authorization: Bearer <jwt>` header instead. */
+            /**
+             * @description EndUser or M2M JWT to verify against the app JWKS. Optional — if omitted, the token is read from the `Authorization: Bearer <jwt>` header instead.
+             * @example eyJhbGciOiJSUzI1NiIsImtpZCI6ImsxIn0.eyJzdWIiOiJ1c3JfMSJ9.c2lnbmF0dXJl
+             */
             token?: string;
         };
         VerifyPrincipalDto: {
@@ -24931,7 +25016,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description `BOT_PROTECTION_FAILED`: the bot-protection provider rejected the `bot_protection_token` (bad, expired or already used), or the hostname it reported is not one of the app's `bot_protection.expected_hostnames`; render a fresh widget and retry. Otherwise: signup is disabled for this app, the email domain is not on the app's allow-list, the presented PAK belongs to a different workspace, or its policy denies `auth.signup.create` on this app. Also returned when the app itself is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`). */
+            /** @description `BOT_PROTECTION_FAILED`: the bot-protection provider rejected the `bot_protection_token` (bad, expired or already used), or the hostname it reported is not one of the app's `bot_protection.expected_hostnames`; render a fresh widget and retry. Otherwise: signup is disabled for this app (new apps start with `signup_enabled: false`; turn it on with `PATCH /v1/apps/{app_id}/auth-config`), the email domain is not on the app's allow-list, the presented PAK belongs to a different workspace, or its policy denies `auth.signup.create` on this app. Also returned when the app itself is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`). */
             403: {
                 headers: {
                     "X-Request-Id": components["headers"]["RequestId"];
@@ -29157,8 +29242,8 @@ interface operations {
 
 type IsUnion<T, U = T> = T extends unknown ? ([U] extends [T] ? false : true) : never;
 type OpenString<T extends string> = string extends T ? T : true extends IsUnion<T> ? T | (string & {}) : T;
-type OpenValue<T> = [T] extends [string] ? OpenString<T> : T extends readonly (infer I)[] ? Open<I>[] : T extends object ? {
-    [K in keyof T]: Open<T[K]>;
+type OpenValue<T> = [T] extends [string] ? OpenString<T> : T extends readonly (infer I)[] ? (OpenValue<Exclude<I, null | undefined>> | Extract<I, null | undefined>)[] : T extends object ? {
+    [K in keyof T]: OpenValue<Exclude<T[K], null | undefined>> | Extract<T[K], null | undefined>;
 } : T;
 /** A response type: string-literal unions also accept values added after this SDK was built. */
 type Open<T> = OpenValue<Exclude<T, null | undefined>> | Extract<T, null | undefined>;
@@ -30117,6 +30202,17 @@ interface WebhookUnwrapParams {
     /** Accepted clock skew in seconds. Default 300. */
     toleranceSeconds?: number;
 }
+/** `webhooks.sign()`: what to sign. Tests only; ProductCraft signs real deliveries. */
+interface WebhookSignParams {
+    /** The event: an `UnwrapWebhookEvent`-shaped object (JSON-encoded) or the exact body string. */
+    payload: WebhookPayload | Record<string, unknown>;
+    /** Signing secret. Default: the client's `webhookSecret` (the first, when several), then `PRODUCTCRAFT_AUTH_WEBHOOK_SECRET`. */
+    secret?: string;
+    /** `webhook-id`. Default: a random `msg_…` id. */
+    id?: string;
+    /** Unix seconds for `webhook-timestamp`. Default: now. */
+    timestamp?: number;
+}
 
 type Bound = Readonly<Record<string, string | undefined>>;
 declare class APIResource {
@@ -30132,6 +30228,11 @@ declare class AppsResource extends APIResource {
      *
      * The new app starts with emails to its users turned on: they go out from the workspace default sender chosen in Mail, and the default verification, welcome, password-reset, invite and sign-in code templates are created in the workspace's Mail templates (an existing template with the same name is reused). Change or turn this off with `PATCH /v1/apps/{appId}/notification-settings`.
      *
+     * **Sign-up starts off.** A new app has `signup_enabled: false`, so `POST /{app_slug}/v1/auth/signup` answers 403 `FORBIDDEN` ("Signup is disabled for this app") until you turn it on with `PATCH /v1/apps/{app_id}/auth-config` and `{ "signup_enabled": true }`. Sign-in, invites and admin-created users work either way.
+     *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.AppCreateParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure (slug, display name, or workspaceId).
@@ -30154,6 +30255,9 @@ declare class AppsResource extends APIResource {
     /**
      * Delete an app permanently
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param appId - Id of the app.
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -30164,13 +30268,16 @@ declare class AppsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id
      * @example
      * ```ts
-     * await auth.apps.delete("app");
+     * await auth.apps.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     delete(appId: string, options?: RequestOptions): APIPromise<void>;
     /**
      * List apps in workspaces the caller is a member of. Pass `workspace_id` to scope the result to a single workspace — required from the per-workspace console page so cross-tenant memberships do not leak.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.AppListParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid pagination cursor.
@@ -30190,6 +30297,9 @@ declare class AppsResource extends APIResource {
     /**
      * Get app details
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param appId - Id of the app.
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -30200,13 +30310,16 @@ declare class AppsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id
      * @example
      * ```ts
-     * const app = await auth.apps.retrieve("app");
+     * const app = await auth.apps.retrieve("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     retrieve(appId: string, options?: RequestOptions): APIPromise<WithLastResponse<App>>;
     /**
      * Update app display name, slug, metadata, and retention settings
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param appId - Id of the app.
      * @param params - `Auth.AppUpdateParams`.
      * @param options - Per-request options.
@@ -30217,7 +30330,7 @@ declare class AppsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id
      * @example
      * ```ts
-     * const app = await auth.apps.update("app", { audit_retention_days: 365 });
+     * const app = await auth.apps.update("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { audit_retention_days: 365 });
      * ```
      */
     update(appId: string, params?: AppUpdateParams, options?: RequestOptions): APIPromise<WithLastResponse<App>>;
@@ -30229,6 +30342,9 @@ declare class StatsResource extends APIResource {
      *
      * Returns total Auth apps owned by workspaces the caller is a member of, end-users across those apps, and active API keys across those apps. Pass `workspace_id` to scope the counts to a single workspace — required from the dashboard so cross-tenant data does not bleed into the totals.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.StatsMeParams`.
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -30250,6 +30366,9 @@ declare class StatsResource extends APIResource {
      *
      * Days are UTC. Counts only: no end-user identifiers. Cached for up to 60 seconds (`generated_at`).
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.StatsRetrieveParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `workspaceId` is not a UUID or `window` is not one of 1d, 7d, 30d.
@@ -30282,6 +30401,14 @@ declare class WebhooksResource extends APIResource {
      * @throws {ConfigurationError} No secret was passed or configured.
      */
     unwrap(params: WebhookUnwrapParams): Promise<UnwrapWebhookEvent>;
+    /**
+     * Sign a test event the way ProductCraft signs deliveries (Standard Webhooks), so a handler
+     * test can call `unwrap` without a live delivery. Returns the exact body and the headers.
+     *
+     * @param params - The event (an object is JSON-encoded), and optionally the secret, `id` and `timestamp`.
+     * @throws {ConfigurationError} No secret was passed or configured.
+     */
+    sign(params: WebhookSignParams): Promise<SignedWebhook>;
 }
 /** `auth` */
 declare class AuthResources extends APIResource {
@@ -30295,6 +30422,9 @@ declare class AppApiKeysResource extends APIResource {
     /**
      * Mint a new hdk_live_* API key with an explicit permission scope. The raw key is returned ONCE.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.ApiKeyCreateParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure (name, empty `permissions`, a permission not matching `resource.action`, unsupported `expiresInDays`), or a malformed `Idempotency-Key`.
@@ -30307,13 +30437,16 @@ declare class AppApiKeysResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-api-keys
      * @example
      * ```ts
-     * const createApiKey = await auth.admin.app("app").apiKeys.create({ name: "CI deploy bot", permissions: ["user.read", "user.list"] });
+     * const createApiKey = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").apiKeys.create({ name: "CI deploy bot", permissions: ["user.read", "user.list"] });
      * ```
      */
     create(params: ApiKeyCreateParams, options?: RequestOptions): APIPromise<WithLastResponse<CreateApiKey>>;
     /**
      * Revoke an API key. The key stops authenticating immediately; the row is kept (soft delete) so the list and the audit trail can still answer who revoked it and when.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param keyId - Id of the key.
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -30323,13 +30456,16 @@ declare class AppApiKeysResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-api-keys-key-id
      * @example
      * ```ts
-     * await auth.admin.app("app").apiKeys.delete("key");
+     * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").apiKeys.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     delete(keyId: string, options?: RequestOptions): APIPromise<void>;
     /**
      * List API keys for an app (no raw secret), newest first. Cursor-paginated: 20/page by default, 100 max.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.ApiKeyListParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`.
@@ -30339,16 +30475,19 @@ declare class AppApiKeysResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-api-keys
      * @example
      * ```ts
-     * for await (const apiKey of auth.admin.app("app").apiKeys.list()) {
+     * for await (const apiKey of auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").apiKeys.list()) {
      *   console.log(apiKey);
      * }
-     * const page = await auth.admin.app("app").apiKeys.list({}, { timeout: 5_000 });
+     * const page = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").apiKeys.list({}, { timeout: 5_000 });
      * ```
      */
     list(params?: ApiKeyListParams, options?: RequestOptions): PagePromise<ApiKeySummary>;
     /**
      * Mint a replacement for an existing key, carrying its name and permissions over. The outgoing key keeps working for `grace_hours` (24 by default) so a fleet can roll over without downtime. The raw key is returned ONCE.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param keyId - Id of the key.
      * @param params - `Auth.ApiKeyRotateParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
@@ -30360,7 +30499,7 @@ declare class AppApiKeysResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-api-keys-key-id-rotate
      * @example
      * ```ts
-     * const rotateApiKey = await auth.admin.app("app").apiKeys.rotate("key", { grace_hours: 24 });
+     * const rotateApiKey = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").apiKeys.rotate("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { grace_hours: 24 });
      * ```
      */
     rotate(keyId: string, params?: ApiKeyRotateParams, options?: RequestOptions): APIPromise<WithLastResponse<RotateApiKey>>;
@@ -30372,6 +30511,9 @@ declare class AppAuditLogsResource extends APIResource {
      *
      * The response is streamed: rows are walked in keyset batches and written as they are read, so neither the service nor the client has to hold the whole result set. Works on both lanes — a platform bearer token and a `pcft_live_*` Platform API Key with `auth.audit.read` hit the same route. Hard cap of 1,000,000 rows per call; a wider request is refused with 413 before any body is written, so a truncated file can never masquerade as a complete one.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.AuditLogExportParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `format`, or malformed `since` / `until`.
@@ -30384,7 +30526,7 @@ declare class AppAuditLogsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-audit-logs-export
      * @example
      * ```ts
-     * const response = await auth.admin.app("app").auditLogs.export();
+     * const response = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").auditLogs.export();
      * const text = await response.text();
      * ```
      */
@@ -30392,6 +30534,9 @@ declare class AppAuditLogsResource extends APIResource {
     /**
      * Append-only audit log for this app, newest first. Filter by `?action=`, `?actor_id=`, and/or the `?since=` / `?until=` date range. 20/page (max 100), cursor-paginated.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.AuditLogListParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`, `since`, or `until`.
@@ -30403,10 +30548,10 @@ declare class AppAuditLogsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-audit-logs
      * @example
      * ```ts
-     * for await (const auditLog of auth.admin.app("app").auditLogs.list()) {
+     * for await (const auditLog of auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").auditLogs.list()) {
      *   console.log(auditLog);
      * }
-     * const page = await auth.admin.app("app").auditLogs.list({}, { timeout: 5_000 });
+     * const page = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").auditLogs.list({}, { timeout: 5_000 });
      * ```
      */
     list(params?: AuditLogListParams, options?: RequestOptions): PagePromise<AuditLogEntry>;
@@ -30416,6 +30561,9 @@ declare class AppAuditSinkResource extends APIResource {
     /**
      * Remove the audit sink. Shipping stops immediately; the audit log itself is untouched.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
      * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update`.
@@ -30425,7 +30573,7 @@ declare class AppAuditSinkResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-audit-sink
      * @example
      * ```ts
-     * await auth.admin.app("app").auditSink.disconnect();
+     * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").auditSink.disconnect();
      * ```
      */
     disconnect(options?: RequestOptions): APIPromise<void>;
@@ -30434,6 +30582,9 @@ declare class AppAuditSinkResource extends APIResource {
      *
      * Audit rows are POSTed in batches of up to 100, signed with the same `X-Auth-Signature: t=<unix>,v1=<hex>` HMAC header as the outbound webhooks. Delivery is at-least-once: the cursor advances only after a 2xx, so a batch that times out after the receiver processed it is re-sent. Every record carries its immutable `audit_log` id, so dedupe on that. A new sink starts from the moment it is created — configuring one does not replay the existing history into your SIEM. Replacing an existing sink clears the auto-disabled state (the same "I fixed my receiver" signal a webhook PUT carries) but does NOT rewind the cursor.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.AuditSinkReplaceParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: URL is not HTTPS, or the SSRF guard refused it (private address, unresolvable host, non-public TLD).
@@ -30445,13 +30596,16 @@ declare class AppAuditSinkResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#put-v1-apps-app-id-audit-sink
      * @example
      * ```ts
-     * const auditSinkWithSecret = await auth.admin.app("app").auditSink.replace({ url: "https://siem.customer.example.com/ingest/productcraft-auth" });
+     * const auditSinkWithSecret = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").auditSink.replace({ url: "https://siem.customer.example.com/ingest/productcraft-auth" });
      * ```
      */
     replace(params: AuditSinkReplaceParams, options?: RequestOptions): APIPromise<WithLastResponse<AuditSinkWithSecret>>;
     /**
      * Current audit sink for this app, or 404 when none is configured. Never returns the signing secret — only its last-4 hint.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
      * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read`.
@@ -30461,7 +30615,7 @@ declare class AppAuditSinkResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-audit-sink
      * @example
      * ```ts
-     * const auditSink = await auth.admin.app("app").auditSink.retrieve();
+     * const auditSink = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").auditSink.retrieve();
      * ```
      */
     retrieve(options?: RequestOptions): APIPromise<WithLastResponse<AuditSink>>;
@@ -30470,6 +30624,9 @@ declare class AppAuditSinkResource extends APIResource {
      *
      * The new secret signs every batch from now on; the old one stops at once. Update your receiver right away: batches it rejects in between are retried every minute (the position only moves after a 2xx), so nothing is lost, but export stops after 20 failures in a row. Clears the receiver-test proof.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
      * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update`.
@@ -30479,7 +30636,7 @@ declare class AppAuditSinkResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-audit-sink-rotate-secret
      * @example
      * ```ts
-     * const auditSinkWithSecret = await auth.admin.app("app").auditSink.rotateSecret();
+     * const auditSinkWithSecret = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").auditSink.rotateSecret();
      * ```
      */
     rotateSecret(options?: RequestOptions): APIPromise<WithLastResponse<AuditSinkWithSecret>>;
@@ -30488,6 +30645,9 @@ declare class AppAuditSinkResource extends APIResource {
      *
      * Rows, in order: `destination` (not_set until a sink exists), `test_batch` (pass once the receiver accepted a test batch with the current address and secret; blocked when the last test was refused; carries `test.action: audit_sink.test`, run with `POST /v1/apps/{appId}/audit-sink/test`), and `delivery` (blocked when export stopped after repeated failures, attention while paused or while recent batches fail). Computed from the stored sink on every request; answers 200 whether or not a sink exists.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
      * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read`, or the app is suspended or archived.
@@ -30497,7 +30657,7 @@ declare class AppAuditSinkResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-audit-sink-setup-status
      * @example
      * ```ts
-     * const setupStatus = await auth.admin.app("app").auditSink.setupStatus();
+     * const setupStatus = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").auditSink.setupStatus();
      * ```
      */
     setupStatus(options?: RequestOptions): APIPromise<WithLastResponse<SetupStatus>>;
@@ -30506,6 +30666,9 @@ declare class AppAuditSinkResource extends APIResource {
      *
      * POSTs one signed batch, shaped exactly like a real one (`type: audit.batch`, same headers and signature), with `test: true` and a single synthetic record whose `id` starts with `test_`. Works while export is paused or stopped, so a fix can be proven before export is turned back on. The outcome is recorded on the sink (`last_attempt_*`, `last_test_succeeded_at`) but never moves the position in the audit log or counts toward the automatic stop. A refused test is still a 200 with `delivered: false`. At most 20 tests per app per hour.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
      * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.update`.
@@ -30516,7 +30679,7 @@ declare class AppAuditSinkResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-audit-sink-test
      * @example
      * ```ts
-     * const auditSinkTestResult = await auth.admin.app("app").auditSink.test();
+     * const auditSinkTestResult = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").auditSink.test();
      * ```
      */
     test(options?: RequestOptions): APIPromise<WithLastResponse<AuditSinkTestResult>>;
@@ -30525,6 +30688,9 @@ declare class AppAuditSinkResource extends APIResource {
      *
      * Send `url`, `enabled` or both. `enabled: false` pauses export; `enabled: true` resumes it and clears a stop after repeated failures and the failure count. The position in the audit log is never moved: nothing is skipped and nothing is replayed twice on purpose. A new `url` is checked by the same address guard as `PUT`.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.AuditSinkUpdateParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: URL is not HTTPS, or the address guard refused it (private address, unresolvable host).
@@ -30536,7 +30702,7 @@ declare class AppAuditSinkResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-audit-sink
      * @example
      * ```ts
-     * const auditSink = await auth.admin.app("app").auditSink.update({ enabled: true });
+     * const auditSink = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").auditSink.update({ enabled: true });
      * ```
      */
     update(params?: AuditSinkUpdateParams, options?: RequestOptions): APIPromise<WithLastResponse<AuditSink>>;
@@ -30548,6 +30714,9 @@ declare class AppAuthConfigProvidersResource extends APIResource {
      *
      * Calls the provider's token endpoint with a dummy sign-in code. If the provider refuses the client (`invalid_client`, GitHub `incorrect_client_credentials` or `unknown_client`), the result is `credentials_rejected` and the provider shows as `blocked` with reason `credentials_rejected` until the credentials are fixed. If it only refuses the code (`invalid_grant`, `bad_verification_code`), the credentials are valid. Nobody is signed in. The result is saved on the provider (`last_check_*`). The same check runs automatically whenever the credentials are saved. Works for a provider that is saved but not switched on yet.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param provider - The sign-in provider: `google`, `github` or `apple`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown provider id, or the saved config can no longer be read.
@@ -30559,13 +30728,16 @@ declare class AppAuthConfigProvidersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-auth-config-providers-provider-check
      * @example
      * ```ts
-     * const providerCheck = await auth.admin.app("app").authConfig.providers.check("provider");
+     * const providerCheck = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").authConfig.providers.check("google");
      * ```
      */
     check(provider: string, options?: RequestOptions): APIPromise<WithLastResponse<ProviderCheck>>;
     /**
      * Remove the config for an (app, provider). Existing identity rows (people who already signed in with this provider) stay; they just lose the ability to sign in again until config is re-uploaded.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param provider - The sign-in provider: `google`, `github` or `apple`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown provider id.
@@ -30575,7 +30747,7 @@ declare class AppAuthConfigProvidersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-auth-config-providers-provider
      * @example
      * ```ts
-     * await auth.admin.app("app").authConfig.providers.delete("provider");
+     * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").authConfig.providers.delete("google");
      * ```
      */
     delete(provider: string, options?: RequestOptions): APIPromise<void>;
@@ -30584,6 +30756,9 @@ declare class AppAuthConfigProvidersResource extends APIResource {
      *
      * Each entry carries `status` (`ready` | `blocked` | `disabled` | `not_configured`) and `blocked_reasons`, computed on the server with the same rule the web sign-in flow enforces, so a provider shown as `ready` is one people can actually sign in with.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
      * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.
@@ -30593,13 +30768,16 @@ declare class AppAuthConfigProvidersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-auth-config-providers
      * @example
      * ```ts
-     * const result = await auth.admin.app("app").authConfig.providers.list();
+     * const result = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").authConfig.providers.list();
      * ```
      */
     list(options?: RequestOptions): APIPromise<WithLastResponse<AuthConfigProviderListResponse>>;
     /**
      * Write or replace the config for an (app, provider). Validates the body via the provider impl's `parseConfig` before encrypting; malformed config 400s. Default `enabled=false`.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param provider - The sign-in provider: `google`, `github` or `apple`.
      * @param params - `Auth.AuthConfigProviderReplaceParams`.
      * @param options - Per-request options.
@@ -30610,13 +30788,16 @@ declare class AppAuthConfigProvidersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#put-v1-apps-app-id-auth-config-providers-provider
      * @example
      * ```ts
-     * const providerDetail = await auth.admin.app("app").authConfig.providers.replace("provider", { config: {} });
+     * const providerDetail = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").authConfig.providers.replace("google", { config: {} });
      * ```
      */
     replace(provider: string, params: AuthConfigProviderReplaceParams, options?: RequestOptions): APIPromise<WithLastResponse<ProviderDetail>>;
     /**
      * Get the config for one (app, provider). Secrets are redacted — `private_key_present: true` is the only acknowledgement that a private key is on file.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param provider - The sign-in provider: `google`, `github` or `apple`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown provider id.
@@ -30627,13 +30808,16 @@ declare class AppAuthConfigProvidersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-auth-config-providers-provider
      * @example
      * ```ts
-     * const providerDetail = await auth.admin.app("app").authConfig.providers.retrieve("provider");
+     * const providerDetail = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").authConfig.providers.retrieve("google");
      * ```
      */
     retrieve(provider: string, options?: RequestOptions): APIPromise<WithLastResponse<ProviderDetail>>;
     /**
      * Partially update the config for an (app, provider). Only top-level keys present in `config` are changed; omitted keys — secrets included — keep their stored values. The merged config is validated by the provider impl's `parseConfig`; 404 if the provider is not configured yet (create it with PUT).
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param provider - The sign-in provider: `google`, `github` or `apple`.
      * @param params - `Auth.AuthConfigProviderUpdateParams`.
      * @param options - Per-request options.
@@ -30645,7 +30829,7 @@ declare class AppAuthConfigProvidersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-auth-config-providers-provider
      * @example
      * ```ts
-     * const providerDetail = await auth.admin.app("app").authConfig.providers.update("provider", { config: {} });
+     * const providerDetail = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").authConfig.providers.update("google", { config: {} });
      * ```
      */
     update(provider: string, params?: AuthConfigProviderUpdateParams, options?: RequestOptions): APIPromise<WithLastResponse<ProviderDetail>>;
@@ -30657,6 +30841,9 @@ declare class AppAuthConfigResource extends APIResource {
     /**
      * Get the per-app auth config (signup, signin, password policy, sessions).
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
      * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.
@@ -30666,13 +30853,16 @@ declare class AppAuthConfigResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-auth-config
      * @example
      * ```ts
-     * const authConfig = await auth.admin.app("app").authConfig.retrieve();
+     * const authConfig = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").authConfig.retrieve();
      * ```
      */
     retrieve(options?: RequestOptions): APIPromise<WithLastResponse<AuthConfig>>;
     /**
      * Update the per-app auth config. Only fields you pass are changed.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.AuthConfigUpdateParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure — a value out of range (password length, token/session lifetimes, lockout threshold, max sessions, MFA grace days, unverified-account window), an unknown enum value, a `signup_default_role` that does not exist in this app, or a `bot_protection` change that cannot stand: no provider or site key on first setup, a hostname that is not a hostname, or `enabled: true` with no secret stored or sent.
@@ -30685,7 +30875,7 @@ declare class AppAuthConfigResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-auth-config
      * @example
      * ```ts
-     * const authConfig = await auth.admin.app("app").authConfig.update({ access_token_minutes: 60 });
+     * const authConfig = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").authConfig.update({ access_token_minutes: 60 });
      * ```
      */
     update(params?: AuthConfigUpdateParams, options?: RequestOptions): APIPromise<WithLastResponse<AuthConfig>>;
@@ -30701,6 +30891,9 @@ declare class AppCredentialsResource extends APIResource {
     /**
      * Create a new M2M client
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.CredentialCreateParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure (missing or invalid name).
@@ -30713,13 +30906,16 @@ declare class AppCredentialsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-credentials
      * @example
      * ```ts
-     * const m2mClientCreate = await auth.admin.app("app").credentials.create({ name: "CI Pipeline" });
+     * const m2mClientCreate = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").credentials.create({ name: "CI Pipeline" });
      * ```
      */
     create(params: CredentialCreateParams, options?: RequestOptions): APIPromise<WithLastResponse<M2mClientCreate>>;
     /**
      * Delete an M2M client
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param clientId - Id of the client.
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -30730,13 +30926,16 @@ declare class AppCredentialsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-credentials-client-id
      * @example
      * ```ts
-     * await auth.admin.app("app").credentials.delete("client");
+     * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").credentials.delete("m2m_a1b2c3d4e5f6");
      * ```
      */
     delete(clientId: string, options?: RequestOptions): APIPromise<void>;
     /**
      * List M2M clients
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.CredentialListParams`.
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -30747,16 +30946,19 @@ declare class AppCredentialsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-credentials
      * @example
      * ```ts
-     * for await (const credential of auth.admin.app("app").credentials.list()) {
+     * for await (const credential of auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").credentials.list()) {
      *   console.log(credential);
      * }
-     * const page = await auth.admin.app("app").credentials.list({}, { timeout: 5_000 });
+     * const page = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").credentials.list({}, { timeout: 5_000 });
      * ```
      */
     list(params?: CredentialListParams, options?: RequestOptions): PagePromise<M2mClientSummary>;
     /**
      * Get M2M client details
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param clientId - Id of the client.
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -30767,13 +30969,16 @@ declare class AppCredentialsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-credentials-client-id
      * @example
      * ```ts
-     * const m2mClientDetail = await auth.admin.app("app").credentials.retrieve("client");
+     * const m2mClientDetail = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").credentials.retrieve("m2m_a1b2c3d4e5f6");
      * ```
      */
     retrieve(clientId: string, options?: RequestOptions): APIPromise<WithLastResponse<M2mClientDetail>>;
     /**
      * Rotate M2M client secret
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param clientId - Id of the client.
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -30784,13 +30989,16 @@ declare class AppCredentialsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-credentials-client-id-rotate
      * @example
      * ```ts
-     * const m2mRotateSecret = await auth.admin.app("app").credentials.rotate("client");
+     * const m2mRotateSecret = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").credentials.rotate("m2m_a1b2c3d4e5f6");
      * ```
      */
     rotate(clientId: string, options?: RequestOptions): APIPromise<WithLastResponse<M2mRotateSecret>>;
     /**
      * Update M2M client status
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param clientId - Id of the client.
      * @param params - `Auth.CredentialUpdateParams`.
      * @param options - Per-request options.
@@ -30803,13 +31011,16 @@ declare class AppCredentialsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-credentials-client-id
      * @example
      * ```ts
-     * const m2mClientDetail = await auth.admin.app("app").credentials.update("client", { is_active: true });
+     * const m2mClientDetail = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").credentials.update("m2m_a1b2c3d4e5f6", { is_active: true });
      * ```
      */
     update(clientId: string, params?: CredentialUpdateParams, options?: RequestOptions): APIPromise<WithLastResponse<M2mClientDetail>>;
     /**
      * Set scopes for an M2M client
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param clientId - Id of the client.
      * @param params - `Auth.CredentialUpdateScopesParams`.
      * @param options - Per-request options.
@@ -30822,7 +31033,7 @@ declare class AppCredentialsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#put-v1-apps-app-id-credentials-client-id-scopes
      * @example
      * ```ts
-     * const result = await auth.admin.app("app").credentials.updateScopes("client", { permissions: ["user.read", "app.read"] });
+     * const result = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").credentials.updateScopes("m2m_a1b2c3d4e5f6", { permissions: ["user.read", "app.read"] });
      * ```
      */
     updateScopes(clientId: string, params: CredentialUpdateScopesParams, options?: RequestOptions): APIPromise<WithLastResponse<CredentialUpdateScopesResponse>>;
@@ -30852,6 +31063,9 @@ declare class AppCustomDomainsResource extends APIResource {
      *
      * Reads the zone through the provider's API and plans both records: `create`, or `skip` when already there. Nothing is ever changed or deleted, and only names at or under the custom host are written (Cloudflare records are DNS-only, not proxied). Anything in the way (another CNAME at the host, A/MX/TXT records where the CNAME must go) refuses the whole apply with 409 and the plan, before anything is written. `dry_run: true` returns the plan and changes nothing; `dry_run: false` writes exactly that plan and runs a check straight away (the records are usually `propagating` for a few minutes). The token is used for this request only: never stored, logged, queued or returned; revoke it afterwards (`warnings` says so when it could see more than this zone).
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param domainId - Id of the domain.
      * @param params - `Auth.CustomDomainApplyParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
@@ -30866,7 +31080,7 @@ declare class AppCustomDomainsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-custom-domains-domain-id-apply
      * @example
      * ```ts
-     * const customDomainApplyResult = await auth.admin.app("app").customDomains.apply("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b", { dry_run: true, provider: "cloudflare", token: "cf-token-from-your-dashboard" });
+     * const customDomainApplyResult = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").customDomains.apply("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { dry_run: true, provider: "cloudflare", token: "cf-token-from-your-dashboard" });
      * ```
      */
     apply(domainId: string, params: CustomDomainApplyParams, options?: RequestOptions): APIPromise<WithLastResponse<CustomDomainApplyResult>>;
@@ -30875,6 +31089,9 @@ declare class AppCustomDomainsResource extends APIResource {
      *
      * Asks the zone's own nameservers and a public resolver for both records, stores each record's state and conflicts, and moves the status: `active` once both are verified; an active domain turns `failing` only when a record is definitely gone or blocked (a DNS outage never takes a working domain down). Safe to repeat.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param domainId - Id of the domain.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `domainId` is not a UUID.
@@ -30886,7 +31103,7 @@ declare class AppCustomDomainsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-custom-domains-domain-id-check
      * @example
      * ```ts
-     * const customDomain = await auth.admin.app("app").customDomains.check("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b");
+     * const customDomain = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").customDomains.check("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     check(domainId: string, options?: RequestOptions): APIPromise<WithLastResponse<CustomDomain>>;
@@ -30895,6 +31112,9 @@ declare class AppCustomDomainsResource extends APIResource {
      *
      * Returns the two records to publish: a CNAME from the host to `edge_target`, and a TXT token at `_productcraft-auth.<host>` that proves the domain is yours. The zone and its DNS provider are detected, and the first check runs straight away, so `records[].state` and `conflicts` already say what is missing or in the way. Publish the records by hand, import `…/export`, or let `…/apply` write them with a short-lived provider token. The domain turns `active` once both records are seen. Sign-in tokens keep the canonical issuer (`https://api.auth.productcraft.co/{slug}`), so nothing changes for code that verifies them. One custom domain per app. While the feature is in early access it is switched on per workspace.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.CustomDomainCreateParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, INVALID_HOSTNAME, HOSTNAME_RESERVED, APEX_NOT_SUPPORTED: Not a usable host name (`INVALID_HOSTNAME`), one of ours (`HOSTNAME_RESERVED`), or the root of a DNS zone, which cannot hold a CNAME (`APEX_NOT_SUPPORTED`).
@@ -30907,7 +31127,7 @@ declare class AppCustomDomainsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-custom-domains
      * @example
      * ```ts
-     * const customDomain = await auth.admin.app("app").customDomains.create({ hostname: "auth.acme.com" });
+     * const customDomain = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").customDomains.create({ hostname: "auth.acme.com" });
      * ```
      */
     create(params: CustomDomainCreateParams, options?: RequestOptions): APIPromise<WithLastResponse<CustomDomain>>;
@@ -30916,6 +31136,9 @@ declare class AppCustomDomainsResource extends APIResource {
      *
      * The host stops serving this app at once and its certificate is no longer renewed. Your DNS records are not touched: delete the CNAME and the `_productcraft-auth` TXT record at your DNS provider. Sign-ins on the canonical host are unaffected.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param domainId - Id of the domain.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `domainId` is not a UUID.
@@ -30927,7 +31150,7 @@ declare class AppCustomDomainsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-custom-domains-domain-id
      * @example
      * ```ts
-     * await auth.admin.app("app").customDomains.delete("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b");
+     * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").customDomains.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     delete(domainId: string, options?: RequestOptions): APIPromise<void>;
@@ -30936,6 +31159,9 @@ declare class AppCustomDomainsResource extends APIResource {
      *
      * `format=bind`: a zone-file fragment (`$ORIGIN <zone>.`, `$TTL 3600`, names relative to the zone, a comment per record with its purpose and any conflict) that Cloudflare and Route 53 import directly. `format=csv`: `type,name,value,priority,ttl,purpose,required`, fully qualified names. By default only records not verified yet; `all=true` for both. Served as an attachment.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param domainId - Id of the domain.
      * @param params - `Auth.CustomDomainExportParams`.
      * @param options - Per-request options.
@@ -30948,7 +31174,7 @@ declare class AppCustomDomainsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-custom-domains-domain-id-export
      * @example
      * ```ts
-     * const response = await auth.admin.app("app").customDomains.export("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b", { format: "bind" });
+     * const response = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").customDomains.export("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { format: "bind" });
      * const text = await response.text();
      * ```
      */
@@ -30958,6 +31184,9 @@ declare class AppCustomDomainsResource extends APIResource {
      *
      * Each with its status and the last check of its records, plus `available`: whether custom domains are switched on for the workspace. Always a single page.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
      * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.
@@ -30967,7 +31196,7 @@ declare class AppCustomDomainsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-custom-domains
      * @example
      * ```ts
-     * for await (const customDomain of auth.admin.app("app").customDomains.list()) {
+     * for await (const customDomain of auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").customDomains.list()) {
      *   console.log(customDomain);
      * }
      * ```
@@ -30978,6 +31207,9 @@ declare class AppCustomDomainsResource extends APIResource {
      *
      * Reads stored state only; `POST …/check` runs a new DNS check.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param domainId - Id of the domain.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `domainId` is not a UUID.
@@ -30989,7 +31221,7 @@ declare class AppCustomDomainsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-custom-domains-domain-id
      * @example
      * ```ts
-     * const customDomain = await auth.admin.app("app").customDomains.retrieve("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b");
+     * const customDomain = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").customDomains.retrieve("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     retrieve(domainId: string, options?: RequestOptions): APIPromise<WithLastResponse<CustomDomain>>;
@@ -30999,6 +31231,9 @@ declare class AppEndUserInsightsUsersResource extends APIResource {
     /**
      * One end-user's recorded activity: their audit trail, their sessions with device/IP, and their enrolled factors. `noActivityRecorded` distinguishes "nothing happened" from "no data".
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param userId - Id of the user.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `appId` or `userId` is not a UUID.
@@ -31010,7 +31245,7 @@ declare class AppEndUserInsightsUsersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-end-user-insights-users-user-id
      * @example
      * ```ts
-     * const endUserDetailInsights = await auth.admin.app("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b").endUserInsights.users.retrieve("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b");
+     * const endUserDetailInsights = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUserInsights.users.retrieve("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     retrieve(userId: string, options?: RequestOptions): APIPromise<WithLastResponse<EndUserDetailInsights>>;
@@ -31022,6 +31257,9 @@ declare class AppEndUserInsightsResource extends APIResource {
     /**
      * Auth health for this app over the last 30 days: verification completion, sign-in failure rate, MFA adoption, password-reset follow-through, and session counts. Rates are null when there is nothing to divide by.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `appId` is not a UUID.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -31031,7 +31269,7 @@ declare class AppEndUserInsightsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-end-user-insights
      * @example
      * ```ts
-     * const endUserInsights = await auth.admin.app("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b").endUserInsights.retrieve();
+     * const endUserInsights = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUserInsights.retrieve();
      * ```
      */
     retrieve(options?: RequestOptions): APIPromise<WithLastResponse<EndUserInsights>>;
@@ -31041,6 +31279,9 @@ declare class AppEndUsersContactsResource extends APIResource {
     /**
      * Add a contact for an end-user (unverified).
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param userId - Id of the user.
      * @param params - `Auth.EndUserContactCreateParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
@@ -31054,13 +31295,16 @@ declare class AppEndUsersContactsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-user-id-contacts
      * @example
      * ```ts
-     * const accountContact = await auth.admin.app("app").endUsers.contacts.create("user", { type: "email", value: "string" });
+     * const accountContact = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.contacts.create("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { type: "email", value: "ada@example.com" });
      * ```
      */
     create(userId: string, params: EndUserContactCreateParams, options?: RequestOptions): APIPromise<WithLastResponse<AccountContact>>;
     /**
      * Delete a contact from an end-user.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param userId - Id of the user.
      * @param contactId - Id of the contact.
      * @param options - Per-request options.
@@ -31073,13 +31317,16 @@ declare class AppEndUsersContactsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-end-users-user-id-contacts-contact-id
      * @example
      * ```ts
-     * await auth.admin.app("app").endUsers.contacts.delete("user", "contact");
+     * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.contacts.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     delete(userId: string, contactId: string, options?: RequestOptions): APIPromise<void>;
     /**
      * List an end-user's contacts.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param userId - Id of the user.
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -31090,13 +31337,16 @@ declare class AppEndUsersContactsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-end-users-user-id-contacts
      * @example
      * ```ts
-     * const accountContactList = await auth.admin.app("app").endUsers.contacts.list("user");
+     * const accountContactList = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.contacts.list("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     list(userId: string, options?: RequestOptions): APIPromise<WithLastResponse<AccountContactList>>;
     /**
      * Promote a verified contact to primary.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param userId - Id of the user.
      * @param contactId - Id of the contact.
      * @param options - Per-request options.
@@ -31109,13 +31359,16 @@ declare class AppEndUsersContactsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-user-id-contacts-contact-id-promote
      * @example
      * ```ts
-     * await auth.admin.app("app").endUsers.contacts.promote("user", "contact");
+     * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.contacts.promote("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     promote(userId: string, contactId: string, options?: RequestOptions): APIPromise<void>;
     /**
      * Reissue a verification code for a contact.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param userId - Id of the user.
      * @param contactId - Id of the contact.
      * @param options - Per-request options.
@@ -31128,7 +31381,7 @@ declare class AppEndUsersContactsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-user-id-contacts-contact-id-resend-verification
      * @example
      * ```ts
-     * const issuedVerificationCode = await auth.admin.app("app").endUsers.contacts.resendVerification("user", "contact");
+     * const issuedVerificationCode = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.contacts.resendVerification("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     resendVerification(userId: string, contactId: string, options?: RequestOptions): APIPromise<WithLastResponse<IssuedVerificationCode>>;
@@ -31140,6 +31393,9 @@ declare class AppEndUsersImportsResource extends APIResource {
      *
      * Row fields: `email` (required), `username`, `display_name`, `role`, `tenant_slugs` (array), `external_id`, `metadata`, `email_verified`, and `password_hash` + `password_hash_algorithm`.  `password_hash_algorithm` is `argon2id` or `bcrypt`. **argon2id** hashes are accepted at any parameters. **bcrypt** hashes (`$2a$`, `$2b$`, `$2y$` — Auth0, PHP `password_hash`, Spring, node `bcrypt`, Devise / Rails, Laravel, Django) are accepted at any valid cost (4-31), verified on the user's first signin and replaced by an argon2id hash of the same password in that request, so the user keeps their password and never notices. Signin pads a bcrypt verify up to the argon2id floor, so at cost 10 and below an imported account cannot be told apart by timing; at cost 11 and above the verify is slower than the floor and answers when it finishes — a small timing difference on migrated accounts only, gone after each one's first signin.  A re-run is idempotent: rows match on `external_id` first, then the primary email, and update rather than duplicate. An existing password, an already-verified address and an existing member's role are never overwritten — see the module docs for why each one.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Body is empty or contains no NDJSON rows.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -31151,7 +31407,7 @@ declare class AppEndUsersImportsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-import
      * @example
      * ```ts
-     * const importJob = await auth.admin.app("app").endUsers.imports.create();
+     * const importJob = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.imports.create();
      * ```
      */
     create(options?: RequestOptions): APIPromise<WithLastResponse<ImportJob>>;
@@ -31160,6 +31416,9 @@ declare class AppEndUsersImportsResource extends APIResource {
      *
      * `status: succeeded` means the job RAN TO COMPLETION, not that every row landed — read `failed_count` and `errors` for that. `errors` is capped at the first 500 entries; the counts stay exact.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param jobId - Id of the job.
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -31170,7 +31429,7 @@ declare class AppEndUsersImportsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-end-users-import-job-id
      * @example
      * ```ts
-     * const importJob = await auth.admin.app("app").endUsers.imports.retrieve("job");
+     * const importJob = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.imports.retrieve("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     retrieve(jobId: string, options?: RequestOptions): APIPromise<WithLastResponse<ImportJob>>;
@@ -31180,6 +31439,9 @@ declare class AppEndUsersInvitesResource extends APIResource {
     /**
      * Pre-allocate an EndUser invite. Dispatches an invitation email via the workspace's Mail sender.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.EndUserInviteCreateParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown role, or maxUses / expiresInHours out of range.
@@ -31190,13 +31452,16 @@ declare class AppEndUsersInvitesResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-invites
      * @example
      * ```ts
-     * const endUserInvite = await auth.admin.app("app").endUsers.invites.create({ email: "alice@example.com" });
+     * const endUserInvite = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.invites.create({ email: "alice@example.com" });
      * ```
      */
     create(params: EndUserInviteCreateParams, options?: RequestOptions): APIPromise<WithLastResponse<EndUserInvite>>;
     /**
      * Revoke an EndUser invite (soft-delete).
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param inviteId - Id of the invite.
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -31207,13 +31472,16 @@ declare class AppEndUsersInvitesResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-end-users-invites-invite-id
      * @example
      * ```ts
-     * await auth.admin.app("app").endUsers.invites.delete("invite");
+     * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.invites.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     delete(inviteId: string, options?: RequestOptions): APIPromise<void>;
     /**
      * List EndUser invites for this app, newest first. Filter by `?status=`.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.EndUserInviteListParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `status` value.
@@ -31223,10 +31491,10 @@ declare class AppEndUsersInvitesResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-end-users-invites
      * @example
      * ```ts
-     * for await (const invite of auth.admin.app("app").endUsers.invites.list()) {
+     * for await (const invite of auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.invites.list()) {
      *   console.log(invite);
      * }
-     * const page = await auth.admin.app("app").endUsers.invites.list({}, { timeout: 5_000 });
+     * const page = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.invites.list({}, { timeout: 5_000 });
      * ```
      */
     list(params?: EndUserInviteListParams, options?: RequestOptions): PagePromise<EndUserInvite>;
@@ -31238,6 +31506,9 @@ declare class AppEndUsersMfaResource extends APIResource {
      *
      * Disables every enabled factor on the account, destroys its recovery codes, and revokes every live session. The next sign-in on an app running `auth_config.mfa: "required"` returns `mfa_enrollment_required` and the user must enrol a new factor before a session is minted. On an app running `mfa: "optional"` the user simply ends up with no MFA, which is the pre-existing meaning of deleting their factors. All three steps matter: leaving the recovery codes alive would let whoever holds the old printout complete `/auth/mfa/recover` and skip enrolment entirely. Audited, and emits `user.mfa.factor_disabled` per factor plus one `user.mfa.reenrollment_required`. Idempotent.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param userId - Id of the user.
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -31248,7 +31519,7 @@ declare class AppEndUsersMfaResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-user-id-mfa-require-reenrollment
      * @example
      * ```ts
-     * const requireMfaReenrollment = await auth.admin.app("app").endUsers.mfa.requireReenrollment("user");
+     * const requireMfaReenrollment = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.mfa.requireReenrollment("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     requireReenrollment(userId: string, options?: RequestOptions): APIPromise<WithLastResponse<RequireMfaReenrollment>>;
@@ -31258,6 +31529,9 @@ declare class AppEndUsersSessionsResource extends APIResource {
     /**
      * Revoke every active session for an end-user.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param userId - Id of the user.
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -31268,7 +31542,7 @@ declare class AppEndUsersSessionsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-user-id-sessions-revoke-all
      * @example
      * ```ts
-     * await auth.admin.app("app").endUsers.sessions.revokeAll("user");
+     * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.sessions.revokeAll("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     revokeAll(userId: string, options?: RequestOptions): APIPromise<void>;
@@ -31286,6 +31560,9 @@ declare class AppEndUsersResource extends APIResource {
      *
      * Deletes every matched account in one transaction. Each deleted account gets an `auth.account.deleted` audit row (`via: platform_bulk`) whose metadata carries the `selection` (`{ mode: "ids" }`, or `{ mode: "filter", filter }`), so a filter sweep reads as one. The workspace audit log gets one `auth.end_users.deleted` row with the count. `user.deleted` (`via: "platform_bulk"`) fires per account only when 100 or fewer were deleted.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.EndUserBulkDeleteParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid `selection` body, or an unfiltered selection without `confirm_all_in_app: true` (including more than 5,000 ids).
@@ -31297,13 +31574,16 @@ declare class AppEndUsersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-bulk-delete
      * @example
      * ```ts
-     * const bulkAffectedUsers = await auth.admin.app("app").endUsers.bulkDelete({ selection: { mode: "ids" } });
+     * const bulkAffectedUsers = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.bulkDelete({ selection: { mode: "ids" } });
      * ```
      */
     bulkDelete(params: EndUserBulkDeleteParams, options?: RequestOptions): APIPromise<WithLastResponse<BulkAffectedUsers>>;
     /**
      * Bulk-revoke sessions across a selection.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.EndUserBulkRevokeSessionsParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid `selection` body (including more than 5,000 ids).
@@ -31315,13 +31595,16 @@ declare class AppEndUsersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-bulk-revoke-sessions
      * @example
      * ```ts
-     * const bulkAffectedUsers = await auth.admin.app("app").endUsers.bulkRevokeSessions({ selection: { mode: "ids" } });
+     * const bulkAffectedUsers = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.bulkRevokeSessions({ selection: { mode: "ids" } });
      * ```
      */
     bulkRevokeSessions(params: EndUserBulkRevokeSessionsParams, options?: RequestOptions): APIPromise<WithLastResponse<BulkAffectedUsers>>;
     /**
      * Bulk-assign a role across a selection.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.EndUserBulkUpdateRoleParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid `selection` body or empty `roleName`.
@@ -31333,13 +31616,16 @@ declare class AppEndUsersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-bulk-update-role
      * @example
      * ```ts
-     * const bulkAffectedUsers = await auth.admin.app("app").endUsers.bulkUpdateRole({ role_name: "string", selection: { mode: "ids" } });
+     * const bulkAffectedUsers = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.bulkUpdateRole({ role_name: "member", selection: { mode: "ids" } });
      * ```
      */
     bulkUpdateRole(params: EndUserBulkUpdateRoleParams, options?: RequestOptions): APIPromise<WithLastResponse<BulkAffectedUsers>>;
     /**
      * Bulk-update status across a selection.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.EndUserBulkUpdateStatusParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid `selection` body, or `status` is not one of active, suspended, deactivated.
@@ -31351,7 +31637,7 @@ declare class AppEndUsersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-bulk-update-status
      * @example
      * ```ts
-     * const bulkAffectedUsers = await auth.admin.app("app").endUsers.bulkUpdateStatus({ selection: { mode: "ids" }, status: "suspended" });
+     * const bulkAffectedUsers = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.bulkUpdateStatus({ selection: { mode: "ids" }, status: "suspended" });
      * ```
      */
     bulkUpdateStatus(params: EndUserBulkUpdateStatusParams, options?: RequestOptions): APIPromise<WithLastResponse<BulkAffectedUsers>>;
@@ -31360,6 +31646,9 @@ declare class AppEndUsersResource extends APIResource {
      *
      * Removes the account with its contacts, sessions and tenant memberships. Writes one `auth.account.deleted` audit row (`via: platform`) in the same transaction, mirrors the deletion into the workspace audit log as `auth.end_users.deleted`, and fires `user.deleted` with `via: "platform"`.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param userId - Id of the user.
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -31370,7 +31659,7 @@ declare class AppEndUsersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-end-users-user-id
      * @example
      * ```ts
-     * await auth.admin.app("app").endUsers.delete("user");
+     * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     delete(userId: string, options?: RequestOptions): APIPromise<void>;
@@ -31379,6 +31668,9 @@ declare class AppEndUsersResource extends APIResource {
      *
      * Streamed in keyset batches — neither the service nor the client holds the whole directory. Ordered oldest-first by `(created_at, id)` so a re-run is stable. Gated on `auth.user.export`, which is escalation class: this hands over every address in the directory in one call, where `auth.list` pages it. Hard cap of 1,000,000 rows; a wider request is refused with 413 before any body is written.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.EndUserExportParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `format`.
@@ -31391,7 +31683,7 @@ declare class AppEndUsersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-end-users-export
      * @example
      * ```ts
-     * const response = await auth.admin.app("app").endUsers.export();
+     * const response = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.export();
      * const text = await response.text();
      * ```
      */
@@ -31399,6 +31691,9 @@ declare class AppEndUsersResource extends APIResource {
     /**
      * List end-users in this app (cursor-paginated).
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.EndUserListParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `signal` / `sort` / `order`, or a `cursor` minted under a different ordering than the one requested.
@@ -31408,16 +31703,19 @@ declare class AppEndUsersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-end-users
      * @example
      * ```ts
-     * for await (const endUser of auth.admin.app("app").endUsers.list()) {
+     * for await (const endUser of auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.list()) {
      *   console.log(endUser);
      * }
-     * const page = await auth.admin.app("app").endUsers.list({}, { timeout: 5_000 });
+     * const page = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.list({}, { timeout: 5_000 });
      * ```
      */
     list(params?: EndUserListParams, options?: RequestOptions): PagePromise<EndUserSummary>;
     /**
      * Resend verification to the primary email contact.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param userId - Id of the user.
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -31429,13 +31727,16 @@ declare class AppEndUsersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-end-users-user-id-resend-verification
      * @example
      * ```ts
-     * const issuedVerificationCode = await auth.admin.app("app").endUsers.resendVerification("user");
+     * const issuedVerificationCode = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.resendVerification("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     resendVerification(userId: string, options?: RequestOptions): APIPromise<WithLastResponse<IssuedVerificationCode>>;
     /**
      * Get one end-user.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param userId - Id of the user.
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -31446,13 +31747,16 @@ declare class AppEndUsersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-end-users-user-id
      * @example
      * ```ts
-     * const endUserSummary = await auth.admin.app("app").endUsers.retrieve("user");
+     * const endUserSummary = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.retrieve("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     retrieve(userId: string, options?: RequestOptions): APIPromise<WithLastResponse<EndUserSummary>>;
     /**
      * Update end-user display name, primary email, or metadata keys (merged).
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param userId - Id of the user.
      * @param params - `Auth.EndUserUpdateParams`.
      * @param options - Per-request options.
@@ -31465,13 +31769,16 @@ declare class AppEndUsersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-end-users-user-id
      * @example
      * ```ts
-     * const endUserSummary = await auth.admin.app("app").endUsers.update("user", { display_name: "string" });
+     * const endUserSummary = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.update("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { display_name: "Ada Lovelace" });
      * ```
      */
     update(userId: string, params?: EndUserUpdateParams, options?: RequestOptions): APIPromise<WithLastResponse<EndUserSummary>>;
     /**
      * Assign an end-user a role.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param userId - Id of the user.
      * @param params - `Auth.EndUserUpdateRoleParams`.
      * @param options - Per-request options.
@@ -31484,13 +31791,16 @@ declare class AppEndUsersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-end-users-user-id-role
      * @example
      * ```ts
-     * const endUserRoleAssignment = await auth.admin.app("app").endUsers.updateRole("user", { role_name: "admin" });
+     * const endUserRoleAssignment = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.updateRole("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { role_name: "admin" });
      * ```
      */
     updateRole(userId: string, params: EndUserUpdateRoleParams, options?: RequestOptions): APIPromise<WithLastResponse<EndUserRoleAssignment>>;
     /**
      * Change end-user status (active / suspended / deactivated).
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param userId - Id of the user.
      * @param params - `Auth.EndUserUpdateStatusParams`.
      * @param options - Per-request options.
@@ -31503,7 +31813,7 @@ declare class AppEndUsersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-end-users-user-id-status
      * @example
      * ```ts
-     * const endUserSummary = await auth.admin.app("app").endUsers.updateStatus("user", { status: "suspended" });
+     * const endUserSummary = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").endUsers.updateStatus("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { status: "suspended" });
      * ```
      */
     updateStatus(userId: string, params: EndUserUpdateStatusParams, options?: RequestOptions): APIPromise<WithLastResponse<EndUserSummary>>;
@@ -31546,6 +31856,9 @@ declare class AppMembersResource extends APIResource {
     /**
      * Remove a member from the app
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param accountId - Id of the account.
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -31556,13 +31869,16 @@ declare class AppMembersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-members-account-id
      * @example
      * ```ts
-     * await auth.admin.app("app").members.delete("account");
+     * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").members.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     delete(accountId: string, options?: RequestOptions): APIPromise<void>;
     /**
      * List app members (PlatformUser view of EndUser memberships)
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.MemberListParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid pagination cursor.
@@ -31574,10 +31890,10 @@ declare class AppMembersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-members
      * @example
      * ```ts
-     * for await (const member of auth.admin.app("app").members.list()) {
+     * for await (const member of auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").members.list()) {
      *   console.log(member);
      * }
-     * const page = await auth.admin.app("app").members.list({}, { timeout: 5_000 });
+     * const page = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").members.list({}, { timeout: 5_000 });
      * ```
      */
     list(params?: MemberListParams, options?: RequestOptions): PagePromise<AppMemberSummary>;
@@ -31595,6 +31911,9 @@ declare class AppNotificationSettingsResource extends APIResource {
      *
      * `effective_sender` is the sender emails actually go out from, checked live in Mail with your own access (the workspace default sender, or the app's custom address).
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
      * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.
@@ -31604,7 +31923,7 @@ declare class AppNotificationSettingsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-notification-settings
      * @example
      * ```ts
-     * const appNotificationSettings = await auth.admin.app("app").notificationSettings.retrieve();
+     * const appNotificationSettings = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").notificationSettings.retrieve();
      * ```
      */
     retrieve(options?: RequestOptions): APIPromise<WithLastResponse<AppNotificationSettings>>;
@@ -31613,6 +31932,9 @@ declare class AppNotificationSettingsResource extends APIResource {
      *
      * Turning `notifications_via_envoi` on (from off) creates the default template of every empty slot in the workspace's Mail templates (`auth-verification`, `auth-welcome`, `auth-password-reset`, `auth-invite`, `auth-mfa-code`), reusing a template that already has that name, and fills the slot. Templates are created with your own Mail access; a slot that could not be created stays empty. A slot you clear later is not refilled until emails are switched off and on again.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.NotificationSettingUpdateParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid payload.
@@ -31625,7 +31947,7 @@ declare class AppNotificationSettingsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-notification-settings
      * @example
      * ```ts
-     * const appNotificationSettings = await auth.admin.app("app").notificationSettings.update({ default_sender_address: "ada@example.com" });
+     * const appNotificationSettings = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").notificationSettings.update({ default_sender_address: "ada@example.com" });
      * ```
      */
     update(params?: NotificationSettingUpdateParams, options?: RequestOptions): APIPromise<WithLastResponse<AppNotificationSettings>>;
@@ -31637,6 +31959,9 @@ declare class AppNotificationsResource extends APIResource {
      *
      * Sends the slot's real Mail template, with this app's real sender (the workspace default or the custom address) and example values for every variable, to your own verified account address. It cannot be sent anywhere else. It uses your own Mail access, goes through the same send path as real emails, and shows up in Mail > Emails. At most 10 tests per person per hour. Not available to API keys (a key has no inbox).
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param slot - The email to test.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `slot`.
@@ -31652,7 +31977,7 @@ declare class AppNotificationsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-notifications-slot-test
      * @example
      * ```ts
-     * const notificationTest = await auth.admin.app("app").notifications.test("slot");
+     * const notificationTest = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").notifications.test("verification");
      * ```
      */
     test(slot: string, options?: RequestOptions): APIPromise<WithLastResponse<NotificationTest>>;
@@ -31664,6 +31989,9 @@ declare class AppPermissionsEnforcementResource extends APIResource {
      *
      * Returns the deduplicated set of permission strings that any handler in this users-api build gates via `@RequireAppPermission`. Drives the console "Enforced" badge — a customer who binds `user.delete` to a role can see whether any route in this deploy actually checks for it. App-agnostic in shape; the path parameter is included for URN symmetry with the rest of the per-app surface, not to narrow the response.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
      * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.
@@ -31673,7 +32001,7 @@ declare class AppPermissionsEnforcementResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-permissions-enforcement
      * @example
      * ```ts
-     * const enforcedPermissions = await auth.admin.app("app").permissions.enforcement.list();
+     * const enforcedPermissions = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").permissions.enforcement.list();
      * ```
      */
     list(options?: RequestOptions): APIPromise<WithLastResponse<EnforcedPermissions>>;
@@ -31685,6 +32013,9 @@ declare class AppPermissionsResource extends APIResource {
     /**
      * Create a custom permission
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.AppScopedPermissionCreateParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure (`resource` / `action` segment format, or `description` over 256 chars).
@@ -31697,13 +32028,16 @@ declare class AppPermissionsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-permissions
      * @example
      * ```ts
-     * const permission = await auth.admin.app("app").permissions.create({ action: "read", resource: "project" });
+     * const permission = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").permissions.create({ action: "read", resource: "project" });
      * ```
      */
     create(params: AppScopedPermissionCreateParams, options?: RequestOptions): APIPromise<WithLastResponse<Permission>>;
     /**
      * Delete a custom permission
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param permissionKey - Permission key, `resource.action` (e.g. `invoice.read`).
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `permissionKey` is not in `resource.action` format.
@@ -31715,13 +32049,16 @@ declare class AppPermissionsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-permissions-permission-key
      * @example
      * ```ts
-     * await auth.admin.app("app").permissions.delete("permission_key");
+     * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").permissions.delete("invoice.read");
      * ```
      */
     delete(permissionKey: string, options?: RequestOptions): APIPromise<void>;
     /**
      * List all permissions (system + custom)
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
      * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.
@@ -31731,7 +32068,7 @@ declare class AppPermissionsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-permissions
      * @example
      * ```ts
-     * const result = await auth.admin.app("app").permissions.list();
+     * const result = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").permissions.list();
      * ```
      */
     list(options?: RequestOptions): APIPromise<WithLastResponse<AppScopedPermissionListResponse>>;
@@ -31741,6 +32078,9 @@ declare class AppRolesPermissionsResource extends APIResource {
     /**
      * List all available permissions
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
      * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.
@@ -31750,7 +32090,7 @@ declare class AppRolesPermissionsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-roles-permissions
      * @example
      * ```ts
-     * const result = await auth.admin.app("app").roles.permissions.list();
+     * const result = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").roles.permissions.list();
      * ```
      */
     list(options?: RequestOptions): APIPromise<WithLastResponse<RolePermissionListResponse>>;
@@ -31762,6 +32102,9 @@ declare class AppRolesResource extends APIResource {
     /**
      * Assign a role to a user
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.RoleAssignParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure (`accountId` not a UUID, or `role` empty / over 64 chars).
@@ -31773,13 +32116,16 @@ declare class AppRolesResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-roles-assign
      * @example
      * ```ts
-     * const appMembership = await auth.admin.app("app").roles.assign({ account_id: "string", role: "admin" });
+     * const appMembership = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").roles.assign({ account_id: "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", role: "admin" });
      * ```
      */
     assign(params: RoleAssignParams, options?: RequestOptions): APIPromise<WithLastResponse<AppMembership>>;
     /**
      * Create a new role (no permissions yet — set them via PUT /:roleName/permissions)
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.AppScopedRoleCreateParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure (`name` 1-64 chars, `description` up to 256).
@@ -31792,13 +32138,16 @@ declare class AppRolesResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-roles
      * @example
      * ```ts
-     * const role = await auth.admin.app("app").roles.create({ name: "editor" });
+     * const role = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").roles.create({ name: "editor" });
      * ```
      */
     create(params: AppScopedRoleCreateParams, options?: RequestOptions): APIPromise<WithLastResponse<Role>>;
     /**
      * Delete a custom role
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param roleName - Name of the role (e.g. `admin`).
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -31810,13 +32159,16 @@ declare class AppRolesResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-roles-role-name
      * @example
      * ```ts
-     * await auth.admin.app("app").roles.delete("role_name");
+     * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").roles.delete("admin");
      * ```
      */
     delete(roleName: string, options?: RequestOptions): APIPromise<void>;
     /**
      * List all roles in an app. Filter by `?search=` on the role name.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.AppScopedRoleListParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`.
@@ -31828,16 +32180,19 @@ declare class AppRolesResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-roles
      * @example
      * ```ts
-     * for await (const role of auth.admin.app("app").roles.list()) {
+     * for await (const role of auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").roles.list()) {
      *   console.log(role);
      * }
-     * const page = await auth.admin.app("app").roles.list({}, { timeout: 5_000 });
+     * const page = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").roles.list({}, { timeout: 5_000 });
      * ```
      */
     list(params?: AppScopedRoleListParams, options?: RequestOptions): PagePromise<Role>;
     /**
      * Get role details with permissions
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param roleName - Name of the role (e.g. `admin`).
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -31848,13 +32203,16 @@ declare class AppRolesResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-roles-role-name
      * @example
      * ```ts
-     * const roleWithPermissions = await auth.admin.app("app").roles.retrieve("role_name");
+     * const roleWithPermissions = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").roles.retrieve("admin");
      * ```
      */
     retrieve(roleName: string, options?: RequestOptions): APIPromise<WithLastResponse<RoleWithPermissions>>;
     /**
      * Update role name or description
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param roleName - Name of the role (e.g. `admin`).
      * @param params - `Auth.AppScopedRoleUpdateParams`.
      * @param options - Per-request options.
@@ -31867,13 +32225,16 @@ declare class AppRolesResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-roles-role-name
      * @example
      * ```ts
-     * const role = await auth.admin.app("app").roles.update("role_name", { description: "Updated description" });
+     * const role = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").roles.update("admin", { description: "Updated description" });
      * ```
      */
     update(roleName: string, params?: AppScopedRoleUpdateParams, options?: RequestOptions): APIPromise<WithLastResponse<Role>>;
     /**
      * Set permissions for a role (caller-narrowed: caller must hold every requested permission)
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param roleName - Name of the role (e.g. `admin`).
      * @param params - `Auth.AppScopedRoleUpdatePermissionsParams`.
      * @param options - Per-request options.
@@ -31886,7 +32247,7 @@ declare class AppRolesResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#put-v1-apps-app-id-roles-role-name-permissions
      * @example
      * ```ts
-     * const result = await auth.admin.app("app").roles.updatePermissions("role_name", { permissions: ["user.read", "role.create"] });
+     * const result = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").roles.updatePermissions("admin", { permissions: ["user.read", "role.create"] });
      * ```
      */
     updatePermissions(roleName: string, params: AppScopedRoleUpdatePermissionsParams, options?: RequestOptions): APIPromise<WithLastResponse<AppScopedRoleUpdatePermissionsResponse>>;
@@ -31916,6 +32277,9 @@ declare class AppSetupStatusResource extends APIResource {
      *
      * Rows, in order: `signups` (attention while sign-ups are off), `redirect_origins` (blocked until at least one site may start sign-in), one `provider_<id>` row per switched-on sign-in provider (blocked while its status is blocked), `email` (sender chosen and a template for every email; attention while emails are off), `api_key` (attention until an active app key exists), `webhook` (attention until an endpoint has accepted a delivery), and `passkeys` (only while passkeys are on; blocked when no allowed redirect origin is on the passkey site). `complete` is true once no row is `not_set` or `blocked`. Each `fix.href` is a console path to the exact setting. Computed on every request from stored settings, plus the workspace default sender read from Mail with your own access when emails use it: nothing here calls DNS or a sign-in provider (a provider whose last credential check was rejected shows as blocked). A ready provider row carries `test.action: sign_in.try`: run it with `POST /v1/apps/{appId}/sign-in-tests` `{ method: "oauth", provider }`.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
      * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.
@@ -31925,7 +32289,7 @@ declare class AppSetupStatusResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-setup-status
      * @example
      * ```ts
-     * const setupStatus = await auth.admin.app("app").setupStatus.retrieve();
+     * const setupStatus = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").setupStatus.retrieve();
      * ```
      */
     retrieve(options?: RequestOptions): APIPromise<WithLastResponse<SetupStatus>>;
@@ -31937,6 +32301,9 @@ declare class AppSignInTestsResource extends APIResource {
      *
      * For `oauth`, the server first checks what it can on its own (an allowed redirect origin, saved credentials, and the provider credential check). If one fails, the test comes back `failed` at once with the fix. Otherwise open `start_url` in a popup: the person signs in at the provider, the provider returns to Auth, Auth resolves who it is exactly as a real sign-in would, records `would_sign_in_existing` or `would_create` (or the provider error mapped to its fix), creates no account and issues no token, then sends the popup to the console result page. Poll `GET …/sign-in-tests/{id}` until `state` is not `pending`. Works with a provider that is saved but not switched on yet. For `password` / `otp`, the test runs now: it checks the sign-up or sign-in rules for your own email and sends the real email to your own verified address. At most 20 tests per app per hour; tests are deleted after 24 hours.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.SignInTestCreateParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, CUSTOM_DOMAIN_OAUTH_ONLY: Unknown `method` or provider, `provider` missing for `oauth`, or `custom_domain` on a `password` / `otp` test (`CUSTOM_DOMAIN_OAUTH_ONLY`).
@@ -31949,7 +32316,7 @@ declare class AppSignInTestsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-sign-in-tests
      * @example
      * ```ts
-     * const signInTest = await auth.admin.app("app").signInTests.create({ method: "oauth" });
+     * const signInTest = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").signInTests.create({ method: "oauth" });
      * ```
      */
     create(params: SignInTestCreateParams, options?: RequestOptions): APIPromise<WithLastResponse<SignInTest>>;
@@ -31958,6 +32325,9 @@ declare class AppSignInTestsResource extends APIResource {
      *
      * Poll this after opening `start_url`. `state` turns `succeeded` (with `outcome` and `identity`) or `failed` (with `error.fix`). A test that is never finished turns `failed` with code `expired` 15 minutes after it was created.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param testId - Id of the test.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `testId` is not a UUID.
@@ -31969,7 +32339,7 @@ declare class AppSignInTestsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-sign-in-tests-test-id
      * @example
      * ```ts
-     * const signInTest = await auth.admin.app("app").signInTests.retrieve("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b");
+     * const signInTest = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").signInTests.retrieve("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     retrieve(testId: string, options?: RequestOptions): APIPromise<WithLastResponse<SignInTest>>;
@@ -31981,6 +32351,9 @@ declare class AppTenantApiKeysConfigResource extends APIResource {
      *
      * Includes the platform kill switch `suspended`. Requires `auth.read` on the app.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
      * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app.
@@ -31990,7 +32363,7 @@ declare class AppTenantApiKeysConfigResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-tenant-api-keys-config
      * @example
      * ```ts
-     * const tenantApiKeysConfig = await auth.admin.app("app").tenantApiKeys.config.retrieve();
+     * const tenantApiKeysConfig = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenantApiKeys.config.retrieve();
      * ```
      */
     retrieve(options?: RequestOptions): APIPromise<WithLastResponse<TenantApiKeysConfig>>;
@@ -31999,6 +32372,9 @@ declare class AppTenantApiKeysConfigResource extends APIResource {
      *
      * Fields you leave out keep their stored value. `suspended: true` is the kill switch: introspection answers `{"active": false}` for every key of the app at once, and key management is refused, until you set it back to `false`. The app's own config push (`PUT /:appSlug/v1/tenant-api-keys/config`) can never change it. Requires `auth.update` on the app.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.AppScopedTenantApiKeyConfigUpdateParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, TENANT_API_KEYS_SCOPE_INVALID, TENANT_API_KEYS_UNKNOWN_ROLE, TENANT_API_KEY_EXPIRY_INVALID, TENANT_API_KEYS_NO_SCOPES: `VALIDATION_ERROR`, `TENANT_API_KEYS_SCOPE_INVALID`, `TENANT_API_KEYS_UNKNOWN_ROLE`, `TENANT_API_KEY_EXPIRY_INVALID`, `TENANT_API_KEYS_NO_SCOPES`, or a malformed `Idempotency-Key`.
@@ -32011,7 +32387,7 @@ declare class AppTenantApiKeysConfigResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#put-v1-apps-app-id-tenant-api-keys-config
      * @example
      * ```ts
-     * const tenantApiKeysConfig = await auth.admin.app("app").tenantApiKeys.config.update({ default_expiry_days: 7 });
+     * const tenantApiKeysConfig = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenantApiKeys.config.update({ default_expiry_days: 7 });
      * ```
      */
     update(params?: AppScopedTenantApiKeyConfigUpdateParams, options?: RequestOptions): APIPromise<WithLastResponse<TenantApiKeysConfig>>;
@@ -32025,6 +32401,9 @@ declare class AppTenantApiKeysResource extends APIResource {
      *
      * Immediate and final; recorded as revoked by you (`revoked_by_type: platform_user`) in the key and in the audit log. Idempotent: revoking a revoked key is a 204 that changes nothing. Requires `auth.revoke` on the app.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param keyId - Key id (UUID) or display id (`tak_…`).
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -32035,7 +32414,7 @@ declare class AppTenantApiKeysResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-tenant-api-keys-key-id
      * @example
      * ```ts
-     * await auth.admin.app("app").tenantApiKeys.delete("key");
+     * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenantApiKeys.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     delete(keyId: string, options?: RequestOptions): APIPromise<void>;
@@ -32044,6 +32423,9 @@ declare class AppTenantApiKeysResource extends APIResource {
      *
      * Every tenant of the app, newest first, cursor-paginated (20 per page, max 100). Secrets are never returned. Each key names its creator (`created_by`), and its `status` is `orphaned` when it is neither revoked nor expired but its creator left the tenant or the tenant is not active (introspection refuses it). Requires `auth.read` on the app.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.AppScopedTenantApiKeyListParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `status` or malformed `cursor`.
@@ -32055,10 +32437,10 @@ declare class AppTenantApiKeysResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-tenant-api-keys
      * @example
      * ```ts
-     * for await (const tenantApiKey of auth.admin.app("app").tenantApiKeys.list()) {
+     * for await (const tenantApiKey of auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenantApiKeys.list()) {
      *   console.log(tenantApiKey);
      * }
-     * const page = await auth.admin.app("app").tenantApiKeys.list({}, { timeout: 5_000 });
+     * const page = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenantApiKeys.list({}, { timeout: 5_000 });
      * ```
      */
     list(params?: AppScopedTenantApiKeyListParams, options?: RequestOptions): PagePromise<PlatformTenantApiKey>;
@@ -32068,6 +32450,9 @@ declare class AppTenantsInvitesResource extends APIResource {
     /**
      * Invite an email address into a tenant. Returns the plaintext code once; only its SHA-256 digest is stored.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param tenantId - Id of the tenant.
      * @param params - `Auth.AppScopedTenantInviteCreateParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
@@ -32080,13 +32465,16 @@ declare class AppTenantsInvitesResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-tenants-tenant-id-invites
      * @example
      * ```ts
-     * const createTenantInvite = await auth.admin.app("app").tenants.invites.create("tenant", { email: "alice@example.com", role_name: "member" });
+     * const createTenantInvite = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenants.invites.create("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { email: "alice@example.com", role_name: "member" });
      * ```
      */
     create(tenantId: string, params: AppScopedTenantInviteCreateParams, options?: RequestOptions): APIPromise<WithLastResponse<CreateTenantInvite>>;
     /**
      * Revoke a pending invite. Idempotent — a second revoke is a 204 no-op and fires no second webhook.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param tenantId - Id of the tenant.
      * @param inviteId - Id of the invite.
      * @param options - Per-request options.
@@ -32097,13 +32485,16 @@ declare class AppTenantsInvitesResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-tenants-tenant-id-invites-invite-id
      * @example
      * ```ts
-     * await auth.admin.app("app").tenants.invites.delete("tenant", "invite");
+     * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenants.invites.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     delete(tenantId: string, inviteId: string, options?: RequestOptions): APIPromise<void>;
     /**
      * List a tenant's invites, newest first. Optional `?status=pending|revoked|expired|used`. Codes are never returned.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param tenantId - Id of the tenant.
      * @param params - `Auth.AppScopedTenantInviteListParams`.
      * @param options - Per-request options.
@@ -32115,10 +32506,10 @@ declare class AppTenantsInvitesResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-tenants-tenant-id-invites
      * @example
      * ```ts
-     * for await (const invite of auth.admin.app("app").tenants.invites.list("tenant")) {
+     * for await (const invite of auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenants.invites.list("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f")) {
      *   console.log(invite);
      * }
-     * const page = await auth.admin.app("app").tenants.invites.list("tenant", {}, { timeout: 5_000 });
+     * const page = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenants.invites.list("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", {}, { timeout: 5_000 });
      * ```
      */
     list(tenantId: string, params?: AppScopedTenantInviteListParams, options?: RequestOptions): PagePromise<TenantInvite>;
@@ -32128,6 +32519,9 @@ declare class AppTenantsMembersResource extends APIResource {
     /**
      * Add a member to a tenant.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param tenantId - Id of the tenant.
      * @param params - `Auth.AppScopedTenantMemberCreateParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
@@ -32141,13 +32535,16 @@ declare class AppTenantsMembersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-tenants-tenant-id-members
      * @example
      * ```ts
-     * const addMember = await auth.admin.app("app").tenants.members.create("tenant", { role_name: "member" });
+     * const addMember = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenants.members.create("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { role_name: "member" });
      * ```
      */
     create(tenantId: string, params: AppScopedTenantMemberCreateParams, options?: RequestOptions): APIPromise<WithLastResponse<AddMember>>;
     /**
      * Remove a member from a tenant.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param tenantId - Id of the tenant.
      * @param accountId - Id of the account.
      * @param options - Per-request options.
@@ -32159,13 +32556,16 @@ declare class AppTenantsMembersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-tenants-tenant-id-members-account-id
      * @example
      * ```ts
-     * await auth.admin.app("app").tenants.members.delete("tenant", "account");
+     * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenants.members.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     delete(tenantId: string, accountId: string, options?: RequestOptions): APIPromise<void>;
     /**
      * List members of a tenant, newest membership first. Filter by `?search=` and/or `?role=`.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param tenantId - Id of the tenant.
      * @param params - `Auth.AppScopedTenantMemberListParams`.
      * @param options - Per-request options.
@@ -32178,16 +32578,19 @@ declare class AppTenantsMembersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-tenants-tenant-id-members
      * @example
      * ```ts
-     * for await (const member of auth.admin.app("app").tenants.members.list("tenant")) {
+     * for await (const member of auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenants.members.list("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f")) {
      *   console.log(member);
      * }
-     * const page = await auth.admin.app("app").tenants.members.list("tenant", {}, { timeout: 5_000 });
+     * const page = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenants.members.list("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", {}, { timeout: 5_000 });
      * ```
      */
     list(tenantId: string, params?: AppScopedTenantMemberListParams, options?: RequestOptions): PagePromise<TenantMembership>;
     /**
      * Change a member's role inside a tenant.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param tenantId - Id of the tenant.
      * @param accountId - Id of the account.
      * @param params - `Auth.AppScopedTenantMemberUpdateParams`.
@@ -32201,7 +32604,7 @@ declare class AppTenantsMembersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-tenants-tenant-id-members-account-id
      * @example
      * ```ts
-     * const tenantMembership = await auth.admin.app("app").tenants.members.update("tenant", "account", { role_name: "admin" });
+     * const tenantMembership = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenants.members.update("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { role_name: "admin" });
      * ```
      */
     update(tenantId: string, accountId: string, params: AppScopedTenantMemberUpdateParams, options?: RequestOptions): APIPromise<WithLastResponse<TenantMembership>>;
@@ -32214,6 +32617,9 @@ declare class AppTenantsResource extends APIResource {
     /**
      * Create a tenant in this app. Auth-admin lane; requires auth.tenant.create on the app URN.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.AppScopedTenantCreateParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid body, empty `displayName`, or `slug` not 1-64 chars of [a-z0-9-].
@@ -32226,13 +32632,16 @@ declare class AppTenantsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-tenants
      * @example
      * ```ts
-     * const tenant = await auth.admin.app("app").tenants.create({ display_name: "Acme Co" });
+     * const tenant = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenants.create({ display_name: "Acme Co" });
      * ```
      */
     create(params: AppScopedTenantCreateParams, options?: RequestOptions): APIPromise<WithLastResponse<Tenant>>;
     /**
      * Delete a tenant.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param tenantId - Id of the tenant.
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -32243,13 +32652,16 @@ declare class AppTenantsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-tenants-tenant-id
      * @example
      * ```ts
-     * await auth.admin.app("app").tenants.delete("tenant");
+     * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenants.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     delete(tenantId: string, options?: RequestOptions): APIPromise<void>;
     /**
      * List tenants in this app, paginated by created_at desc.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.AppScopedTenantListParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `status` value.
@@ -32261,16 +32673,19 @@ declare class AppTenantsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-tenants
      * @example
      * ```ts
-     * for await (const tenant of auth.admin.app("app").tenants.list()) {
+     * for await (const tenant of auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenants.list()) {
      *   console.log(tenant);
      * }
-     * const page = await auth.admin.app("app").tenants.list({}, { timeout: 5_000 });
+     * const page = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenants.list({}, { timeout: 5_000 });
      * ```
      */
     list(params?: AppScopedTenantListParams, options?: RequestOptions): PagePromise<Tenant>;
     /**
      * Get a single tenant by id or display id.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param tenantId - Id of the tenant.
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -32281,13 +32696,16 @@ declare class AppTenantsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-tenants-tenant-id
      * @example
      * ```ts
-     * const tenant = await auth.admin.app("app").tenants.retrieve("tenant");
+     * const tenant = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenants.retrieve("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     retrieve(tenantId: string, options?: RequestOptions): APIPromise<WithLastResponse<Tenant>>;
     /**
      * Update a tenant (display_name, slug, status, metadata).
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param tenantId - Id of the tenant.
      * @param params - `Auth.AppScopedTenantUpdateParams`.
      * @param options - Per-request options.
@@ -32301,7 +32719,7 @@ declare class AppTenantsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-tenants-tenant-id
      * @example
      * ```ts
-     * const tenant = await auth.admin.app("app").tenants.update("tenant", { display_name: "string" });
+     * const tenant = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").tenants.update("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { display_name: "Acme Inc" });
      * ```
      */
     update(tenantId: string, params?: AppScopedTenantUpdateParams, options?: RequestOptions): APIPromise<WithLastResponse<Tenant>>;
@@ -32311,6 +32729,9 @@ declare class AppUnverifiedAccountExpiryResource extends APIResource {
     /**
      * Get the unverified-account expiry setting and how many accounts it deleted in the last 30 days.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
      * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.
@@ -32320,7 +32741,7 @@ declare class AppUnverifiedAccountExpiryResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-unverified-account-expiry
      * @example
      * ```ts
-     * const unverifiedAccountExpiryStatus = await auth.admin.app("app").unverifiedAccountExpiry.retrieve();
+     * const unverifiedAccountExpiryStatus = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").unverifiedAccountExpiry.retrieve();
      * ```
      */
     retrieve(options?: RequestOptions): APIPromise<WithLastResponse<UnverifiedAccountExpiryStatus>>;
@@ -32329,6 +32750,9 @@ declare class AppUnverifiedAccountExpiryResource extends APIResource {
      *
      * Permanently deletes every account that qualifies under the app's `unverified_account_ttl_days`, exactly as the nightly job does: each deletion is audited as `auth.account.expired_unverified` and fires `user.deleted` with `reason: "unverified_expired"`. Use `dry_run: true` to preview.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.UnverifiedAccountExpiryRunParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure (`min_age_minutes` out of range).
@@ -32342,7 +32766,7 @@ declare class AppUnverifiedAccountExpiryResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-unverified-account-expiry-run
      * @example
      * ```ts
-     * const unverifiedAccountExpiryRun = await auth.admin.app("app").unverifiedAccountExpiry.run({ dry_run: false });
+     * const unverifiedAccountExpiryRun = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").unverifiedAccountExpiry.run({ dry_run: false });
      * ```
      */
     run(params?: UnverifiedAccountExpiryRunParams, options?: RequestOptions): APIPromise<WithLastResponse<UnverifiedAccountExpiryRun>>;
@@ -32354,6 +32778,9 @@ declare class AppWebauthnConfigResource extends APIResource {
      *
      * Returns defaults with `enabled: false` and a null `rp_id` when passkeys have never been configured for the app.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
      * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` on this app, or the app is suspended or archived.
@@ -32363,13 +32790,16 @@ declare class AppWebauthnConfigResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-webauthn-config
      * @example
      * ```ts
-     * const webauthnConfig = await auth.admin.app("app").webauthnConfig.retrieve();
+     * const webauthnConfig = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").webauthnConfig.retrieve();
      * ```
      */
     retrieve(options?: RequestOptions): APIPromise<WithLastResponse<WebauthnConfig>>;
     /**
      * Set the per-app passkey (WebAuthn) relying-party settings.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.WebauthnConfigUpdateParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `rp_id` is malformed, or is not a registrable suffix of any origin in `allowed_redirect_origins`.
@@ -32381,7 +32811,7 @@ declare class AppWebauthnConfigResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#put-v1-apps-app-id-webauthn-config
      * @example
      * ```ts
-     * const webauthnConfig = await auth.admin.app("app").webauthnConfig.update({ enabled: true, rp_id: "example.com" });
+     * const webauthnConfig = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").webauthnConfig.update({ enabled: true, rp_id: "example.com" });
      * ```
      */
     update(params: WebauthnConfigUpdateParams, options?: RequestOptions): APIPromise<WithLastResponse<WebauthnConfig>>;
@@ -32393,6 +32823,9 @@ declare class AppWebhooksEndpointsResource extends APIResource {
      *
      * Deliveries are signed with the Standard Webhooks headers `webhook-id`, `webhook-timestamp` and `webhook-signature` (`v1,<base64 HMAC-SHA256 of "<id>.<timestamp>.<body>">`); the returned `whsec_…` secret works unchanged with any Standard Webhooks library. Failed deliveries are retried after 1 min, 5 min, 30 min, 2 h, 6 h and 24 h.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.WebhookEndpointCreateParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, WEBHOOK_EVENT_TYPE_UNKNOWN: Validation failure: URL not https with a public host, or an unknown event type (`WEBHOOK_EVENT_TYPE_UNKNOWN`).
@@ -32406,7 +32839,7 @@ declare class AppWebhooksEndpointsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-webhooks-endpoints
      * @example
      * ```ts
-     * const webhookEndpointWithSecret = await auth.admin.app("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b").webhooks.endpoints.create({ url: "https://api.acme.com/webhooks" });
+     * const webhookEndpointWithSecret = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").webhooks.endpoints.create({ url: "https://api.acme.com/webhooks" });
      * ```
      */
     create(params: WebhookEndpointCreateParams, options?: RequestOptions): APIPromise<WithLastResponse<WebhookEndpointWithSecret>>;
@@ -32415,6 +32848,9 @@ declare class AppWebhooksEndpointsResource extends APIResource {
      *
      * Queued retries are dropped. Its past attempts stay in the event log until the events expire.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param endpointId - Id of the endpoint.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `endpoint_id` is not a UUID.
@@ -32426,7 +32862,7 @@ declare class AppWebhooksEndpointsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#delete-v1-apps-app-id-webhooks-endpoints-endpoint-id
      * @example
      * ```ts
-     * await auth.admin.app("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b").webhooks.endpoints.delete("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b");
+     * await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").webhooks.endpoints.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     delete(endpointId: string, options?: RequestOptions): APIPromise<void>;
@@ -32435,6 +32871,9 @@ declare class AppWebhooksEndpointsResource extends APIResource {
      *
      * At most 10, so this is always one page. Signing secrets are never returned here, only their last 4 characters.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: The scope id in the path is malformed.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
@@ -32445,7 +32884,7 @@ declare class AppWebhooksEndpointsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-webhooks-endpoints
      * @example
      * ```ts
-     * for await (const endpoint of auth.admin.app("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b").webhooks.endpoints.list()) {
+     * for await (const endpoint of auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").webhooks.endpoints.list()) {
      *   console.log(endpoint);
      * }
      * ```
@@ -32456,6 +32895,9 @@ declare class AppWebhooksEndpointsResource extends APIResource {
      *
      * The endpoint's URL, subscription, on/off state, failure streak and the last 4 characters of its signing secret. The full secret is only returned when the endpoint is created or its secret is rotated.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param endpointId - Id of the endpoint.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `endpoint_id` is not a UUID.
@@ -32467,7 +32909,7 @@ declare class AppWebhooksEndpointsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-webhooks-endpoints-endpoint-id
      * @example
      * ```ts
-     * const webhookEndpoint = await auth.admin.app("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b").webhooks.endpoints.retrieve("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b");
+     * const webhookEndpoint = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").webhooks.endpoints.retrieve("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     retrieve(endpointId: string, options?: RequestOptions): APIPromise<WithLastResponse<WebhookEndpoint>>;
@@ -32476,6 +32918,9 @@ declare class AppWebhooksEndpointsResource extends APIResource {
      *
      * For `grace_hours` (default 24) the previous secret keeps signing too: `webhook-signature` then lists one `v1,` signature per secret, so receivers can switch over without dropping a delivery.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param endpointId - Id of the endpoint.
      * @param params - `Auth.WebhookEndpointRotateSecretParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
@@ -32489,7 +32934,7 @@ declare class AppWebhooksEndpointsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-webhooks-endpoints-endpoint-id-rotate-secret
      * @example
      * ```ts
-     * const webhookEndpointWithSecret = await auth.admin.app("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b").webhooks.endpoints.rotateSecret("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b", { grace_hours: 24 });
+     * const webhookEndpointWithSecret = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").webhooks.endpoints.rotateSecret("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { grace_hours: 24 });
      * ```
      */
     rotateSecret(endpointId: string, params?: WebhookEndpointRotateSecretParams, options?: RequestOptions): APIPromise<WithLastResponse<WebhookEndpointWithSecret>>;
@@ -32498,6 +32943,9 @@ declare class AppWebhooksEndpointsResource extends APIResource {
      *
      * Delivers the catalogue example of `event_type`, signed like any delivery, with `"test": true` in the body. Works while the endpoint is switched off or not subscribed to that type, is logged in the event log, and is never retried or counted toward an automatic disable. Waits up to 15 s for your receiver.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param endpointId - Id of the endpoint.
      * @param params - `Auth.WebhookEndpointTestParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
@@ -32511,7 +32959,7 @@ declare class AppWebhooksEndpointsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-webhooks-endpoints-endpoint-id-test
      * @example
      * ```ts
-     * const webhookDeliveryAttempt = await auth.admin.app("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b").webhooks.endpoints.test("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b", { event_type: "user.signup" });
+     * const webhookDeliveryAttempt = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").webhooks.endpoints.test("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { event_type: "user.signup" });
      * ```
      */
     test(endpointId: string, params: WebhookEndpointTestParams, options?: RequestOptions): APIPromise<WithLastResponse<WebhookDeliveryAttempt>>;
@@ -32520,6 +32968,9 @@ declare class AppWebhooksEndpointsResource extends APIResource {
      *
      * Only the fields sent change. `enabled: true` (or a new URL) also clears an automatic disable. Switching off cancels queued retries. The secret is unchanged; rotate it with `POST …/rotate-secret`.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param endpointId - Id of the endpoint.
      * @param params - `Auth.WebhookEndpointUpdateParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
@@ -32534,7 +32985,7 @@ declare class AppWebhooksEndpointsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-webhooks-endpoints-endpoint-id
      * @example
      * ```ts
-     * const webhookEndpoint = await auth.admin.app("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b").webhooks.endpoints.update("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b", { description: "Production receiver" });
+     * const webhookEndpoint = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").webhooks.endpoints.update("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { description: "Production receiver" });
      * ```
      */
     update(endpointId: string, params?: WebhookEndpointUpdateParams, options?: RequestOptions): APIPromise<WithLastResponse<WebhookEndpoint>>;
@@ -32546,6 +32997,9 @@ declare class AppWebhooksEventTypesResource extends APIResource {
      *
      * Each type with a plain description, its group and an example `data` object (what "Send test" delivers).
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid bearer token.
      * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `auth.read` (reads) or `auth.update` (changes, Send test, replay), or the app is suspended or archived.
@@ -32555,7 +33009,7 @@ declare class AppWebhooksEventTypesResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-webhooks-event-types
      * @example
      * ```ts
-     * const listWebhookEventTypes = await auth.admin.app("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b").webhooks.eventTypes.list();
+     * const listWebhookEventTypes = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").webhooks.eventTypes.list();
      * ```
      */
     list(options?: RequestOptions): APIPromise<WithLastResponse<ListWebhookEventTypes>>;
@@ -32567,6 +33021,9 @@ declare class AppWebhooksEventsResource extends APIResource {
      *
      * Every event logged while at least one endpoint existed, with the latest state per endpoint and when the next retry is due.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.WebhookEventListParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid filter value or cursor.
@@ -32578,10 +33035,10 @@ declare class AppWebhooksEventsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-webhooks-events
      * @example
      * ```ts
-     * for await (const event of auth.admin.app("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b").webhooks.events.list()) {
+     * for await (const event of auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").webhooks.events.list()) {
      *   console.log(event);
      * }
-     * const page = await auth.admin.app("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b").webhooks.events.list({}, { timeout: 5_000 });
+     * const page = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").webhooks.events.list({}, { timeout: 5_000 });
      * ```
      */
     list(params?: WebhookEventListParams, options?: RequestOptions): PagePromise<WebhookEvent>;
@@ -32590,6 +33047,9 @@ declare class AppWebhooksEventsResource extends APIResource {
      *
      * Same body and `webhook-id`, freshly signed, to every switched-on endpoint that receives this event type now, or only to `endpoint_id`. Waits for the receivers (up to 15 s each) and returns the attempts. A success cancels a retry still queued for that endpoint.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param eventId - The event id, `evt_<uuid>`.
      * @param params - `Auth.WebhookEventReplayParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
@@ -32603,7 +33063,7 @@ declare class AppWebhooksEventsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-webhooks-events-event-id-replay
      * @example
      * ```ts
-     * const replayWebhookEvent = await auth.admin.app("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b").webhooks.events.replay("event");
+     * const replayWebhookEvent = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").webhooks.events.replay("evt_3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     replay(eventId: string, params?: WebhookEventReplayParams, options?: RequestOptions): APIPromise<WithLastResponse<ReplayWebhookEvent>>;
@@ -32612,6 +33072,9 @@ declare class AppWebhooksEventsResource extends APIResource {
      *
      * The event as it was sent (`type`, `data`) and every delivery attempt to every endpoint, with its trigger, HTTP status, error and the start of the response body. Use it to debug a receiver, then `replay` to send it again.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param eventId - The event id, `evt_<uuid>`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `event_id` is not `evt_<uuid>`.
@@ -32623,7 +33086,7 @@ declare class AppWebhooksEventsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-v1-apps-app-id-webhooks-events-event-id
      * @example
      * ```ts
-     * const webhookEventDetail = await auth.admin.app("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b").webhooks.events.retrieve("event");
+     * const webhookEventDetail = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").webhooks.events.retrieve("evt_3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     retrieve(eventId: string, options?: RequestOptions): APIPromise<WithLastResponse<WebhookEventDetail>>;
@@ -32665,6 +33128,9 @@ declare class AuthApp extends APIResource {
     /**
      * Create a second app in the same workspace whose configuration matches this one — the "staging app" flow. Copies the auth config, roles, permissions, notification settings and the webhook target (with a NEW signing secret), and optionally tenants. Never copies credentials, end-users, sessions, signing keys, federated provider configs or audit history.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.CloneParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failure, or the slug matches the source.
@@ -32677,13 +33143,16 @@ declare class AuthApp extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-v1-apps-app-id-clone
      * @example
      * ```ts
-     * const cloneApp = await auth.admin.app("app").clone({ environment: "staging", slug: "acme-app-staging" });
+     * const cloneApp = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").clone({ environment: "staging", slug: "acme-app-staging" });
      * ```
      */
     clone(params: CloneParams, options?: RequestOptions): APIPromise<WithLastResponse<CloneApp>>;
     /**
      * Update app status (active, suspended, archived)
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.UpdateStatusParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid status transition (e.g. archived → active).
@@ -32695,7 +33164,7 @@ declare class AuthApp extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#patch-v1-apps-app-id-status
      * @example
      * ```ts
-     * const app = await auth.admin.app("app").updateStatus({ status: "suspended" });
+     * const app = await auth.admin.app("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f").updateStatus({ status: "suspended" });
      * ```
      */
     updateStatus(params: UpdateStatusParams, options?: RequestOptions): APIPromise<WithLastResponse<App>>;
@@ -32802,6 +33271,9 @@ declare class ConsumerMeActivityResource extends APIResource {
      *
      * Login events, password changes, and other security-relevant records, scoped to this EndUser.
      *
+     * Credential: `end_user_token`.
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.
      * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
@@ -32809,7 +33281,7 @@ declare class ConsumerMeActivityResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-me-activity
      * @example
      * ```ts
-     * for await (const activity of auth.consumer("app").me.activity.list()) {
+     * for await (const activity of auth.consumer("my-app").me.activity.list()) {
      *   console.log(activity);
      * }
      * ```
@@ -32823,6 +33295,9 @@ declare class ConsumerMeContactsResource extends APIResource {
      *
      * Adds an email or phone contact to the EndUser. The contact starts unverified and non-primary. Verification is a separate flow — call /auth/request-verification with the contact value and the customer's PAK to mint a code, then submit via /auth/verify.
      *
+     * Credential: `end_user_token`.
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param params - `Auth.MeContactCreateParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: unsupported `type`, invalid email, or empty/over-long `value`.
@@ -32833,13 +33308,16 @@ declare class ConsumerMeContactsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-contacts
      * @example
      * ```ts
-     * const meContact = await auth.consumer("app").me.contacts.create({ type: "email", value: "string" });
+     * const meContact = await auth.consumer("my-app").me.contacts.create({ type: "email", value: "ada@example.com" });
      * ```
      */
     create(params: MeContactCreateParams, options?: RequestOptions): APIPromise<WithLastResponse<MeContact>>;
     /**
      * Delete a contact
      *
+     * Credential: `end_user_token`.
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param id - Id of the contact.
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.
@@ -32850,13 +33328,16 @@ declare class ConsumerMeContactsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-me-contacts-id
      * @example
      * ```ts
-     * await auth.consumer("app").me.contacts.delete("id");
+     * await auth.consumer("my-app").me.contacts.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     delete(id: string, options?: RequestOptions): APIPromise<void>;
     /**
      * List the EndUser's contacts
      *
+     * Credential: `end_user_token`.
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.
      * @throws {RateLimitError} 429 RATE_LIMITED: Per-IP rate limit (`RATE_LIMITED`): the general bucket, 60 requests per minute per IP. Adding, verifying or removing a contact is in the strict `auth` bucket (10 per minute).
@@ -32864,7 +33345,7 @@ declare class ConsumerMeContactsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-me-contacts
      * @example
      * ```ts
-     * const meContacts = await auth.consumer("app").me.contacts.list();
+     * const meContacts = await auth.consumer("my-app").me.contacts.list();
      * ```
      */
     list(options?: RequestOptions): APIPromise<WithLastResponse<MeContacts>>;
@@ -32873,6 +33354,9 @@ declare class ConsumerMeContactsResource extends APIResource {
      *
      * Demotes the previous primary of the same type. Refused (409) when the target contact is unverified — promoting an unverified contact would let an attacker who registered the contact bypass verification by routing reset codes through it.
      *
+     * Credential: `end_user_token`.
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param id - Id of the contact.
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.
@@ -32883,7 +33367,7 @@ declare class ConsumerMeContactsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-contacts-id-promote
      * @example
      * ```ts
-     * await auth.consumer("app").me.contacts.promote("id");
+     * await auth.consumer("my-app").me.contacts.promote("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     promote(id: string, options?: RequestOptions): APIPromise<void>;
@@ -32895,6 +33379,9 @@ declare class ConsumerMeMfaFactorsResource extends APIResource {
      *
      * Creates a pending factor and returns the type-specific enrollment payload. TOTP: the otpauth URI, QR data URL, and shared secret; confirm with two consecutive codes. Email: a 6-digit code is sent to the bound verified email contact (primary by default, `contact_id` to override); confirm with that single code. The factor stays disabled until `/factors/:id/verify` succeeds.
      *
+     * Credential: `end_user_token`.
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param params - `Auth.MeMfaFactorCreateParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: unsupported `type`, over-long `label`, or `contact_id` is not a UUID.
@@ -32907,7 +33394,7 @@ declare class ConsumerMeMfaFactorsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-mfa-factors
      * @example
      * ```ts
-     * const startEnrollment = await auth.consumer("app").me.mfa.factors.create({ type: "totp" });
+     * const startEnrollment = await auth.consumer("my-app").me.mfa.factors.create({ type: "totp" });
      * ```
      */
     create(params: MeMfaFactorCreateParams, options?: RequestOptions): APIPromise<WithLastResponse<StartEnrollment>>;
@@ -32916,6 +33403,9 @@ declare class ConsumerMeMfaFactorsResource extends APIResource {
      *
      * Soft-disable. The row is preserved (with `disabled_at` set) for audit. Has no effect on existing sessions — their `amr` claim still reflects whatever satisfied sign-in at the time. Disabling the only enabled factor removes the MFA requirement on future sign-ins.
      *
+     * Credential: `end_user_token`.
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param id - Id of the factor.
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.
@@ -32925,7 +33415,7 @@ declare class ConsumerMeMfaFactorsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-me-mfa-factors-id
      * @example
      * ```ts
-     * await auth.consumer("app").me.mfa.factors.delete("id");
+     * await auth.consumer("my-app").me.mfa.factors.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     delete(id: string, options?: RequestOptions): APIPromise<void>;
@@ -32934,6 +33424,9 @@ declare class ConsumerMeMfaFactorsResource extends APIResource {
      *
      * Includes factors in any state (pending enrollment + enabled). Disabled factors are not listed.
      *
+     * Credential: `end_user_token`.
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.
      * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
@@ -32941,7 +33434,7 @@ declare class ConsumerMeMfaFactorsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-me-mfa-factors
      * @example
      * ```ts
-     * const factorList = await auth.consumer("app").me.mfa.factors.list();
+     * const factorList = await auth.consumer("my-app").me.mfa.factors.list();
      * ```
      */
     list(options?: RequestOptions): APIPromise<WithLastResponse<FactorList>>;
@@ -32950,6 +33443,9 @@ declare class ConsumerMeMfaFactorsResource extends APIResource {
      *
      * TOTP: submit two `codes` from consecutive 30-second windows. Email: submit the emailed 6-digit `code`. On success the factor flips to enabled, recovery codes are minted (returned once), and prior recovery codes for the account are invalidated. Subsequent calls with the same `:id` fail with 400.
      *
+     * Credential: `end_user_token`.
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param id - Id of the factor.
      * @param params - `Auth.MeMfaFactorVerifyParams`.
      * @param options - Per-request options.
@@ -32960,7 +33456,7 @@ declare class ConsumerMeMfaFactorsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-mfa-factors-id-verify
      * @example
      * ```ts
-     * const confirmEnrollment = await auth.consumer("app").me.mfa.factors.verify("id", { code: "123456" });
+     * const confirmEnrollment = await auth.consumer("my-app").me.mfa.factors.verify("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { code: "123456" });
      * ```
      */
     verify(id: string, params?: MeMfaFactorVerifyParams, options?: RequestOptions): APIPromise<WithLastResponse<ConfirmEnrollment>>;
@@ -32972,6 +33468,9 @@ declare class ConsumerMeMfaRecoveryCodesResource extends APIResource {
      *
      * Mints a fresh set of single-use recovery codes and invalidates every prior code for the account. The new codes are returned once — store them now.
      *
+     * Credential: `end_user_token`.
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.
      * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
@@ -32979,7 +33478,7 @@ declare class ConsumerMeMfaRecoveryCodesResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-mfa-recovery-codes-regenerate
      * @example
      * ```ts
-     * const recoveryCodes = await auth.consumer("app").me.mfa.recoveryCodes.regenerate();
+     * const recoveryCodes = await auth.consumer("my-app").me.mfa.recoveryCodes.regenerate();
      * ```
      */
     regenerate(options?: RequestOptions): APIPromise<WithLastResponse<RecoveryCodes>>;
@@ -32991,6 +33490,9 @@ declare class ConsumerMeMfaStepUpWebauthnResource extends APIResource {
      *
      * Mints a single-use WebAuthn challenge for the enabled passkeys on this account and returns the `publicKey` member for `navigator.credentials.get()`. Submit the result to `/step-up` as `credential`. Refused while step-up is locked on this session — a locked session must not be able to keep minting challenges.
      *
+     * Credential: `end_user_token`.
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: No passkey is enrolled on this account.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -33000,7 +33502,7 @@ declare class ConsumerMeMfaStepUpWebauthnResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-mfa-step-up-webauthn-options
      * @example
      * ```ts
-     * const webauthnOptions = await auth.consumer("app").me.mfa.stepUp.webauthn.options();
+     * const webauthnOptions = await auth.consumer("my-app").me.mfa.stepUp.webauthn.options();
      * ```
      */
     options(options?: RequestOptions): APIPromise<WithLastResponse<WebauthnOptions>>;
@@ -33014,6 +33516,9 @@ declare class ConsumerMeMfaStepUpResource extends APIResource {
      *
      * Mints a single-use 6-digit code against one of the account's enabled email factors and delivers it to the bound address. Follow with `/step-up` submitting the code. Codes expire after 5 minutes; sends are throttled per contact (30s between sends, shared with the sign-in path). Refused while step-up is locked on this session.
      *
+     * Credential: `end_user_token`.
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param params - `Auth.MeMfaStepUpSendCodeParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Account has no enabled email factor (or the named factor is not an email factor).
@@ -33025,7 +33530,7 @@ declare class ConsumerMeMfaStepUpResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-mfa-step-up-send-code
      * @example
      * ```ts
-     * const stepUpSendCode = await auth.consumer("app").me.mfa.stepUp.sendCode({ factor_id: "9b2f6c1e-0d6a-4a63-9a43-2f1c3e4d5a6b" });
+     * const stepUpSendCode = await auth.consumer("my-app").me.mfa.stepUp.sendCode({ factor_id: "9b2f6c1e-0d6a-4a63-9a43-2f1c3e4d5a6b" });
      * ```
      */
     sendCode(params?: MeMfaStepUpSendCodeParams, options?: RequestOptions): APIPromise<WithLastResponse<StepUpSendCode>>;
@@ -33034,6 +33539,9 @@ declare class ConsumerMeMfaStepUpResource extends APIResource {
      *
      * Verify a fresh code (TOTP, emailed via `/step-up/send-code`, or recovery) against any enabled factor on the account, and update the session's `auth_methods` + `mfa_at`. Call `/auth/refresh` after this to mint a token whose claims reflect the new state. Customers reading `mfa_at` from access tokens to gate sensitive actions should require a `/step-up` + refresh cycle when the timestamp is older than their policy window. 5 consecutive wrong codes lock step-up on this session for 15 minutes.
      *
+     * Credential: `end_user_token`.
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param params - `Auth.MeMfaStepUpVerifyParams`.
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Code did not match any enabled factor or recovery code.
@@ -33043,7 +33551,7 @@ declare class ConsumerMeMfaStepUpResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-mfa-step-up
      * @example
      * ```ts
-     * const stepUp = await auth.consumer("app").me.mfa.stepUp.verify({ code: "123456" });
+     * const stepUp = await auth.consumer("my-app").me.mfa.stepUp.verify({ code: "123456" });
      * ```
      */
     verify(params?: MeMfaStepUpVerifyParams, options?: RequestOptions): APIPromise<WithLastResponse<StepUp>>;
@@ -33062,6 +33570,9 @@ declare class ConsumerMeSessionsResource extends APIResource {
      *
      * Sign the EndUser out of one device. The session's refresh token is destroyed; its access token expires on its TTL. Requires the `session.revoke` permission when the app's `enforce_app_permissions` flag is on; otherwise (the default) any valid token can call this. Self-revoke (revoking your own session as a member with no perms) is something to enforce separately if needed; this guard does not exempt the principal from the role check.
      *
+     * Credential: `end_user_token`.
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param id - Id of the session.
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.
@@ -33071,7 +33582,7 @@ declare class ConsumerMeSessionsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-me-sessions-id
      * @example
      * ```ts
-     * await auth.consumer("app").me.sessions.delete("id");
+     * await auth.consumer("my-app").me.sessions.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     delete(id: string, options?: RequestOptions): APIPromise<void>;
@@ -33080,6 +33591,9 @@ declare class ConsumerMeSessionsResource extends APIResource {
      *
      * Each session includes a `current` flag identifying the one belonging to the bearer token used for this request.
      *
+     * Credential: `end_user_token`.
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.
      * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
@@ -33087,7 +33601,7 @@ declare class ConsumerMeSessionsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-me-sessions
      * @example
      * ```ts
-     * for await (const session of auth.consumer("app").me.sessions.list()) {
+     * for await (const session of auth.consumer("my-app").me.sessions.list()) {
      *   console.log(session);
      * }
      * ```
@@ -33101,6 +33615,9 @@ declare class ConsumerMeTenantInvitesResource extends APIResource {
      *
      * Adds the caller to the invited tenant with the role the invite names, and consumes the invite. Requires the invited address to be one of the caller's own VERIFIED email contacts in this app — holding the code is not sufficient, because whoever minted the invite also holds it, and an unverified contact is not proof of owning the address. A refused accept leaves the invite redeemable.
      *
+     * Credential: `end_user_token`.
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param params - `Auth.MeTenantInviteAcceptParams`.
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -33113,7 +33630,7 @@ declare class ConsumerMeTenantInvitesResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-tenant-invites-accept
      * @example
      * ```ts
-     * const acceptedTenantInvite = await auth.consumer("app").me.tenantInvites.accept({ code: "tinv_9dK2mQ7pR4vXbN1sT6yZ0hLcJeW3fAgU" });
+     * const acceptedTenantInvite = await auth.consumer("my-app").me.tenantInvites.accept({ code: "tinv_9dK2mQ7pR4vXbN1sT6yZ0hLcJeW3fAgU" });
      * ```
      */
     accept(params: MeTenantInviteAcceptParams, options?: RequestOptions): APIPromise<WithLastResponse<AcceptedTenantInvite>>;
@@ -33125,6 +33642,9 @@ declare class ConsumerMeTenantsResource extends APIResource {
      *
      * Returns each tenant the caller is a member of, including the tenant slug + display name and the member's role. Powers a tenant-switcher UI on the customer's product.
      *
+     * Credential: `end_user_token`.
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing / invalid bearer, or the session behind the token is revoked, expired or no longer exists.
      * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app exists but is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`). Decided by `AppStatusGuard` before the handler runs.
@@ -33134,7 +33654,7 @@ declare class ConsumerMeTenantsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-auth-me-tenants
      * @example
      * ```ts
-     * const myTenants = await auth.consumer("app").me.tenants.list();
+     * const myTenants = await auth.consumer("my-app").me.tenants.list();
      * ```
      */
     list(options?: RequestOptions): APIPromise<WithLastResponse<MyTenants>>;
@@ -33153,6 +33673,9 @@ declare class ConsumerMeResource extends APIResource {
      *
      * Verifies `current_password`, sets the new hash, and revokes every OTHER active session for the account (the calling session is preserved). 401 if the current password is wrong or the account has no password credential — admin-provisioned accounts without an initial password should use the reset flow instead. The new password is held to exactly the same policy as signup: the app's length + character-class rules, the common-password deny-list, and the breach corpus.
      *
+     * Credential: `end_user_token`.
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param params - `Auth.MeChangePasswordParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, PASSWORD_TOO_COMMON, PASSWORD_BREACHED: The new password fails the app-configured policy, is on the common-password deny-list (`PASSWORD_TOO_COMMON`), appears in a public breach corpus (`PASSWORD_BREACHED`), or is identical to the current one.
@@ -33163,7 +33686,10 @@ declare class ConsumerMeResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-change-password
      * @example
      * ```ts
-     * await auth.consumer("app").me.changePassword({ current_password: "string", new_password: "string" });
+     * await auth.consumer("my-app").me.changePassword({
+     *   current_password: "correct horse battery staple",
+     *   new_password: "a new long passphrase 42",
+     * });
      * ```
      */
     changePassword(params: MeChangePasswordParams, options?: RequestOptions): APIPromise<void>;
@@ -33172,6 +33698,9 @@ declare class ConsumerMeResource extends APIResource {
      *
      * Removes the EndUser, all sessions, and all related records inside this app. Cannot be undone. The app audit log keeps one `auth.account.deleted` row (`via: self`; username and email domain only, never the address), and `user.deleted` fires with `via: "self"`.
      *
+     * Credential: `end_user_token`.
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.
      * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
@@ -33179,7 +33708,7 @@ declare class ConsumerMeResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-me
      * @example
      * ```ts
-     * await auth.consumer("app").me.deleteAccount();
+     * await auth.consumer("my-app").me.deleteAccount();
      * ```
      */
     deleteAccount(options?: RequestOptions): APIPromise<void>;
@@ -33188,6 +33717,9 @@ declare class ConsumerMeResource extends APIResource {
      *
      * Clears both the uploaded avatar and any provider-captured picture, and deletes the stored object. A later Google/GitHub sign-in re-populates the provider picture — that is "sync from provider" behavior, by design.
      *
+     * Credential: `end_user_token`.
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.
      * @throws {NotFoundError} 404 NOT_FOUND, ACCOUNT_NOT_FOUND: Account not found in this app (`ACCOUNT_NOT_FOUND`).
@@ -33196,7 +33728,7 @@ declare class ConsumerMeResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-me-avatar
      * @example
      * ```ts
-     * await auth.consumer("app").me.deleteAvatar();
+     * await auth.consumer("my-app").me.deleteAvatar();
      * ```
      */
     deleteAvatar(options?: RequestOptions): APIPromise<void>;
@@ -33205,6 +33737,9 @@ declare class ConsumerMeResource extends APIResource {
      *
      * Returns the union of the app-level role permissions and the tenant-level role permissions (when the token carries an `org_id`). Resolved per-request through a 60-second LRU — role-permission edits propagate within ~1 minute. Use this instead of decoding a `permissions[]` claim from the JWT, which is no longer included. M2M tokens cannot call this — use `POST /:appSlug/v1/oauth/introspect` to inspect M2M scopes.
      *
+     * Credential: `end_user_token`.
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token, unknown or inactive app, or the account/session is no longer active.
      * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
@@ -33212,7 +33747,7 @@ declare class ConsumerMeResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-me-permissions
      * @example
      * ```ts
-     * const mePermissions = await auth.consumer("app").me.permissions();
+     * const mePermissions = await auth.consumer("my-app").me.permissions();
      * ```
      */
     permissions(options?: RequestOptions): APIPromise<WithLastResponse<MePermissions>>;
@@ -33221,6 +33756,9 @@ declare class ConsumerMeResource extends APIResource {
      *
      * Returns the EndUser identity, app membership, and role name. The flat `permissions[]` array is intentionally NOT included — permissions resolve from the role on demand. Call `GET /me/permissions` for the flat list when the client needs it for UI gating.
      *
+     * Credential: `end_user_token`.
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
      * @throws {NotFoundError} 404 NOT_FOUND: Account not found.
@@ -33229,7 +33767,7 @@ declare class ConsumerMeResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-me
      * @example
      * ```ts
-     * const meProfile = await auth.consumer("app").me.retrieve();
+     * const meProfile = await auth.consumer("my-app").me.retrieve();
      * ```
      */
     retrieve(options?: RequestOptions): APIPromise<WithLastResponse<MeProfile>>;
@@ -33238,6 +33776,9 @@ declare class ConsumerMeResource extends APIResource {
      *
      * Editable fields: `display_name` and `username`. The username is unique per app (case-insensitive, same rule as signup); sending the current username is a no-op. Usernames cannot be cleared.
      *
+     * Credential: `end_user_token`.
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param params - `Auth.MeUpdateParams`.
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -33247,7 +33788,7 @@ declare class ConsumerMeResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#patch-app-slug-v1-me
      * @example
      * ```ts
-     * const meUpdatedAccount = await auth.consumer("app").me.update({ display_name: "Ada Lovelace" });
+     * const meUpdatedAccount = await auth.consumer("my-app").me.update({ display_name: "Ada Lovelace" });
      * ```
      */
     update(params?: MeUpdateParams, options?: RequestOptions): APIPromise<WithLastResponse<MeUpdatedAccount>>;
@@ -33256,6 +33797,9 @@ declare class ConsumerMeResource extends APIResource {
      *
      * PNG/JPEG/WEBP only — SVG is rejected (stored-XSS vector). ≤2 MB. Magic bytes are sniffed; a mislabeled file is rejected. The image is re-encoded server-side (orientation baked in, all metadata incl. EXIF/GPS stripped, bounded to 512×512, webp). An uploaded avatar takes precedence over a provider-captured picture.
      *
+     * Credential: `end_user_token`.
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param params - `Auth.MeUploadAvatarParams`.
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -33266,7 +33810,7 @@ declare class ConsumerMeResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-me-avatar
      * @example
      * ```ts
-     * const avatarUrl = await auth.consumer("app").me.uploadAvatar({ file: new File(["…"], "image.png", { type: "image/png" }) });
+     * const avatarUrl = await auth.consumer("my-app").me.uploadAvatar({ file: new File(["…"], "image.png", { type: "image/png" }) });
      * ```
      */
     uploadAvatar(params: MeUploadAvatarParams, options?: RequestOptions): APIPromise<WithLastResponse<AvatarUrl>>;
@@ -33321,7 +33865,7 @@ declare class ConsumerMfaWebauthnResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-mfa-webauthn-options
      * @example
      * ```ts
-     * const consumerWebauthnOptions = await auth.consumer("app").mfa.webauthn.options({ mfa_token: "string" });
+     * const consumerWebauthnOptions = await auth.consumer("my-app").mfa.webauthn.options({ mfa_token: "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f" });
      * ```
      */
     options(params: MfaWebauthnOptionsParams, options?: RequestOptions): APIPromise<WithLastResponse<ConsumerWebauthnOptions>>;
@@ -33348,7 +33892,7 @@ declare class ConsumerMfaResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-mfa-enroll
      * @example
      * ```ts
-     * const startEnrollment = await auth.consumer("app").mfa.enroll({ mfa_token: "string", type: "totp" });
+     * const startEnrollment = await auth.consumer("my-app").mfa.enroll({ mfa_token: "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", type: "totp" });
      * ```
      */
     enroll(params: MfaEnrollParams, options?: RequestOptions): APIPromise<WithLastResponse<StartEnrollment>>;
@@ -33370,7 +33914,10 @@ declare class ConsumerMfaResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-mfa-recover
      * @example
      * ```ts
-     * const consumerToken = await auth.consumer("app").mfa.recover({ mfa_token: "string", recovery_code: "1a2b-3c4d-5e6f-7890" });
+     * const consumerToken = await auth.consumer("my-app").mfa.recover({
+     *   mfa_token: "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f",
+     *   recovery_code: "1a2b-3c4d-5e6f-7890",
+     * });
      * ```
      */
     recover(params: MfaRecoverParams, options?: RequestOptions): APIPromise<WithLastResponse<ConsumerToken>>;
@@ -33393,7 +33940,10 @@ declare class ConsumerMfaResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-mfa-send-code
      * @example
      * ```ts
-     * const consumerMfaSendCode = await auth.consumer("app").mfa.sendCode({ factor_id: "9b2f6c1e-0d6a-4a63-9a43-2f1c3e4d5a6b", mfa_token: "string" });
+     * const consumerMfaSendCode = await auth.consumer("my-app").mfa.sendCode({
+     *   factor_id: "9b2f6c1e-0d6a-4a63-9a43-2f1c3e4d5a6b",
+     *   mfa_token: "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f",
+     * });
      * ```
      */
     sendCode(params: MfaSendCodeParams, options?: RequestOptions): APIPromise<WithLastResponse<ConsumerMfaSendCode>>;
@@ -33414,7 +33964,7 @@ declare class ConsumerMfaResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-mfa-verify
      * @example
      * ```ts
-     * const consumerToken = await auth.consumer("app").mfa.verify({ mfa_token: "string" });
+     * const consumerToken = await auth.consumer("my-app").mfa.verify({ mfa_token: "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f" });
      * ```
      */
     verify(params: MfaVerifyParams, options?: RequestOptions): APIPromise<WithLastResponse<ConsumerToken>>;
@@ -33435,7 +33985,10 @@ declare class ConsumerMfaResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-mfa-enroll-verify
      * @example
      * ```ts
-     * const consumerMfaEnrollVerify = await auth.consumer("app").mfa.verifyEnrollment({ factor_id: "9b2f6c1e-0d6a-4a63-9a43-2f1c3e4d5a6b", mfa_token: "string" });
+     * const consumerMfaEnrollVerify = await auth.consumer("my-app").mfa.verifyEnrollment({
+     *   factor_id: "9b2f6c1e-0d6a-4a63-9a43-2f1c3e4d5a6b",
+     *   mfa_token: "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f",
+     * });
      * ```
      */
     verifyEnrollment(params: MfaVerifyEnrollmentParams, options?: RequestOptions): APIPromise<WithLastResponse<ConsumerMfaEnrollVerify>>;
@@ -33447,6 +34000,10 @@ declare class ConsumerOauthResource extends APIResource {
      *
      * OAuth 2.0 token introspection. Send the access token via `Authorization: Bearer <token>` and receive either `{ active: false }` (invalid / expired / wrong app, or a session that is revoked, past its `expires_at`, or gone because the end user was deleted) or the active claim set including `scopes` (M2M) or `role` (EndUser), `exp`, `iat`, `iss`, `aid`. The body `token` field is optional and, if present, must match the bearer — RFC 7662 allows a separate `token` body field but we deliberately refuse cross-token introspection so a stolen token can't be probed against another active credential. The endpoint accepts both M2M and EndUser tokens — use it as the canonical way for a service to know what its own token can do, instead of decoding the JWT by hand. Returns 401 when the bearer is missing.
      *
+     * Credential: one of `m2m_token`, `end_user_token`.
+     * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param params - `Auth.OauthIntrospectParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed in the global `ValidationPipe`.
@@ -33459,7 +34016,7 @@ declare class ConsumerOauthResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-oauth-introspect
      * @example
      * ```ts
-     * const introspect = await auth.consumer("app").oauth.introspect({ token: "string" });
+     * const introspect = await auth.consumer("my-app").oauth.introspect({ token: "eyJhbGciOiJSUzI1NiIsImtpZCI6ImsxIn0.eyJzdWIiOiJ1c3JfMSJ9.c2lnbmF0dXJl" });
      * ```
      */
     introspect(params?: OauthIntrospectParams, options?: RequestOptions): APIPromise<WithLastResponse<Introspect>>;
@@ -33480,9 +34037,9 @@ declare class ConsumerOauthResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-oauth-token
      * @example
      * ```ts
-     * const oAuthToken = await auth.consumer("app").oauth.token({
+     * const oAuthToken = await auth.consumer("my-app").oauth.token({
      *   client_id: "m2m_a1b2c3d4e5f6...",
-     *   client_secret: "string",
+     *   client_secret: "the-secret-returned-by-credentials-create",
      *   grant_type: "client_credentials",
      * });
      * ```
@@ -33514,7 +34071,7 @@ declare class ConsumerPasskeyResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-passkey-options
      * @example
      * ```ts
-     * const consumerWebauthnOptions = await auth.consumer("app").passkey.options({ tenant_id: "9b2f6c1e-0d6a-4a63-9a43-2f1c3e4d5a6b" });
+     * const consumerWebauthnOptions = await auth.consumer("my-app").passkey.options({ tenant_id: "9b2f6c1e-0d6a-4a63-9a43-2f1c3e4d5a6b" });
      * ```
      */
     options(params?: PasskeyOptionsParams, options?: RequestOptions): APIPromise<WithLastResponse<ConsumerWebauthnOptions>>;
@@ -33535,7 +34092,7 @@ declare class ConsumerPasskeyResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-passkey-verify
      * @example
      * ```ts
-     * const consumerToken = await auth.consumer("app").passkey.verify({ credential: {} });
+     * const consumerToken = await auth.consumer("my-app").passkey.verify({ credential: {} });
      * ```
      */
     verify(params: PasskeyVerifyParams, options?: RequestOptions): APIPromise<WithLastResponse<ConsumerToken>>;
@@ -33547,6 +34104,11 @@ declare class ConsumerPermissionsResource extends APIResource {
      *
      * Inserts a `<resource>.<action>` row in the per-app permission catalogue. The resource and action segments must each match `^[a-z][a-z0-9_-]{1,47}$`. Conflicts with a system permission name return 409. Customers usually then bind the new permission to a role via `PUT /admin/roles/:roleName/permissions`.
      *
+     * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.
+     * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.
+     * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param params - `Auth.ConsumerScopedPermissionCreateParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -33556,7 +34118,7 @@ declare class ConsumerPermissionsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-admin-permissions
      * @example
      * ```ts
-     * const consumerAdminPermission = await auth.consumer("app").permissions.create({ action: "read", resource: "project" });
+     * const consumerAdminPermission = await auth.consumer("my-app").permissions.create({ action: "read", resource: "project" });
      * ```
      */
     create(params: ConsumerScopedPermissionCreateParams, options?: RequestOptions): APIPromise<WithLastResponse<ConsumerAdminPermission>>;
@@ -33565,6 +34127,11 @@ declare class ConsumerPermissionsResource extends APIResource {
      *
      * The `permissionKey` path parameter is the literal `<resource>.<action>` string. System permissions cannot be deleted — attempts return 403. Removing a permission also removes every `role_permission` row that bound it (cascade); role lookups dropped of that perm on the next request.
      *
+     * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.
+     * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.
+     * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param permissionKey - Permission key, `resource.action` (e.g. `invoice.read`).
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: permissionKey must be in `resource.action` format.
@@ -33576,7 +34143,7 @@ declare class ConsumerPermissionsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-admin-permissions-permission-key
      * @example
      * ```ts
-     * await auth.consumer("app").permissions.delete("permission_key");
+     * await auth.consumer("my-app").permissions.delete("invoice.read");
      * ```
      */
     delete(permissionKey: string, options?: RequestOptions): APIPromise<void>;
@@ -33585,6 +34152,11 @@ declare class ConsumerPermissionsResource extends APIResource {
      *
      * Returns the union of system permissions (shared across every app — `is_system: true` in the response) and any custom entries this app has defined (`is_system: false`). Useful for driving a role-editor UI that picks from the full catalogue.
      *
+     * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.
+     * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.
+     * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired Consumer-API bearer: an EndUser or M2M token, or an app API key (`hdk_live_*` / `hdk_test_*`); or the account, session, M2M client or key is no longer active, or the key belongs to another app.
      * @throws {PermissionDeniedError} 403 FORBIDDEN, APP_SUSPENDED, APP_ARCHIVED: The app is suspended or archived (`APP_SUSPENDED` / `APP_ARCHIVED`), or the caller lacks `permission.read`: an app API key always needs it in its permissions; a role or M2M scopes need it once the app enforces permissions.
@@ -33594,7 +34166,7 @@ declare class ConsumerPermissionsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-admin-permissions
      * @example
      * ```ts
-     * const result = await auth.consumer("app").permissions.list();
+     * const result = await auth.consumer("my-app").permissions.list();
      * ```
      */
     list(options?: RequestOptions): APIPromise<WithLastResponse<ConsumerScopedPermissionListResponse>>;
@@ -33606,6 +34178,11 @@ declare class ConsumerRolesResource extends APIResource {
      *
      * Creates a role with no permissions bound yet. Use `PUT /:roleName/permissions` to attach a permission set after creation — that route also runs caller-narrowing so an EndUser admin can't grant verbs they don't themselves hold.
      *
+     * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.
+     * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.
+     * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param params - `Auth.ConsumerScopedRoleCreateParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -33615,7 +34192,7 @@ declare class ConsumerRolesResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-admin-roles
      * @example
      * ```ts
-     * const consumerRole = await auth.consumer("app").roles.create({ name: "editor" });
+     * const consumerRole = await auth.consumer("my-app").roles.create({ name: "editor" });
      * ```
      */
     create(params: ConsumerScopedRoleCreateParams, options?: RequestOptions): APIPromise<WithLastResponse<ConsumerRole>>;
@@ -33624,6 +34201,11 @@ declare class ConsumerRolesResource extends APIResource {
      *
      * System roles (`owner`, `admin`, `member`) cannot be deleted — attempts return 403. Roles currently assigned to any member return 409 `ROLE_IN_USE`; reassign the affected members first.
      *
+     * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.
+     * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.
+     * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param roleName - Name of the role (e.g. `admin`).
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -33634,7 +34216,7 @@ declare class ConsumerRolesResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-admin-roles-role-name
      * @example
      * ```ts
-     * await auth.consumer("app").roles.delete("role_name");
+     * await auth.consumer("my-app").roles.delete("admin");
      * ```
      */
     delete(roleName: string, options?: RequestOptions): APIPromise<void>;
@@ -33643,6 +34225,11 @@ declare class ConsumerRolesResource extends APIResource {
      *
      * Cursor-paginated by `created_at`. Use the returned `next_cursor` in subsequent calls — offset pagination is not exposed.
      *
+     * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.
+     * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.
+     * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param params - `Auth.ConsumerScopedRoleListParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`.
@@ -33654,10 +34241,10 @@ declare class ConsumerRolesResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-admin-roles
      * @example
      * ```ts
-     * for await (const role of auth.consumer("app").roles.list()) {
+     * for await (const role of auth.consumer("my-app").roles.list()) {
      *   console.log(role);
      * }
-     * const page = await auth.consumer("app").roles.list({}, { timeout: 5_000 });
+     * const page = await auth.consumer("my-app").roles.list({}, { timeout: 5_000 });
      * ```
      */
     list(params?: ConsumerScopedRoleListParams, options?: RequestOptions): PagePromise<ConsumerRole>;
@@ -33666,6 +34253,11 @@ declare class ConsumerRolesResource extends APIResource {
      *
      * Returns the role plus the flat `permissions[]` array currently bound. Use this to drive a "configure role" UI in the customer product without having to call `/permissions` separately.
      *
+     * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.
+     * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.
+     * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param roleName - Name of the role (e.g. `admin`).
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -33675,7 +34267,7 @@ declare class ConsumerRolesResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-admin-roles-role-name
      * @example
      * ```ts
-     * const consumerRoleWithPermissions = await auth.consumer("app").roles.retrieve("role_name");
+     * const consumerRoleWithPermissions = await auth.consumer("my-app").roles.retrieve("admin");
      * ```
      */
     retrieve(roleName: string, options?: RequestOptions): APIPromise<WithLastResponse<ConsumerRoleWithPermissions>>;
@@ -33684,6 +34276,11 @@ declare class ConsumerRolesResource extends APIResource {
      *
      * Renames are intentionally NOT supported — the role name is part of every issued EndUser JWT, so changing it would silently break live sessions. Create a new role and migrate users instead.
      *
+     * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.
+     * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.
+     * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param roleName - Name of the role (e.g. `admin`).
      * @param params - `Auth.ConsumerScopedRoleUpdateParams`.
      * @param options - Per-request options.
@@ -33694,7 +34291,7 @@ declare class ConsumerRolesResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#patch-app-slug-v1-admin-roles-role-name
      * @example
      * ```ts
-     * const consumerRole = await auth.consumer("app").roles.update("role_name", { description: "Updated description" });
+     * const consumerRole = await auth.consumer("my-app").roles.update("admin", { description: "Updated description" });
      * ```
      */
     update(roleName: string, params?: ConsumerScopedRoleUpdateParams, options?: RequestOptions): APIPromise<WithLastResponse<ConsumerRole>>;
@@ -33703,6 +34300,11 @@ declare class ConsumerRolesResource extends APIResource {
      *
      * Destructive — the role's permission set is replaced wholesale with the supplied array. Caller-narrowed: the caller must hold every permission in the request, otherwise 403 `Cannot grant actions you don't have: ...`. For EndUser callers the caller-held set is their app-membership role's effective permissions. For M2M callers the held set is the token's `scopes[]` claim — the M2M cannot grant a role any verb that wasn't configured on the M2M credential. Unknown permission strings return 400.
      *
+     * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.
+     * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.
+     * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param roleName - Name of the role (e.g. `admin`).
      * @param params - `Auth.ConsumerScopedRoleUpdatePermissionsParams`.
      * @param options - Per-request options.
@@ -33715,7 +34317,7 @@ declare class ConsumerRolesResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#put-app-slug-v1-admin-roles-role-name-permissions
      * @example
      * ```ts
-     * const result = await auth.consumer("app").roles.updatePermissions("role_name", { permissions: ["user.read", "role.create"] });
+     * const result = await auth.consumer("my-app").roles.updatePermissions("admin", { permissions: ["user.read", "role.create"] });
      * ```
      */
     updatePermissions(roleName: string, params: ConsumerScopedRoleUpdatePermissionsParams, options?: RequestOptions): APIPromise<WithLastResponse<ConsumerScopedRoleUpdatePermissionsResponse>>;
@@ -33727,6 +34329,9 @@ declare class ConsumerTenantApiKeysConfigResource extends APIResource {
      *
      * Requires `auth.tenant.api_keys.configure` on the app.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, malformed or revoked Platform API Key (`Authorization: Bearer pcft_live_…`).
      * @throws {PermissionDeniedError} 403 FORBIDDEN, PAK_WORKSPACE_MISMATCH: `PAK_WORKSPACE_MISMATCH` (the PAK belongs to another workspace than the app), or the PAK's policy does not allow `auth.tenant.api_keys.configure` on `pcft:heimdall:app/<appId>`.
@@ -33737,7 +34342,7 @@ declare class ConsumerTenantApiKeysConfigResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-tenant-api-keys-config
      * @example
      * ```ts
-     * const tenantApiKeysConfig = await auth.consumer("app").tenantApiKeys.config.retrieve();
+     * const tenantApiKeysConfig = await auth.consumer("my-app").tenantApiKeys.config.retrieve();
      * ```
      */
     retrieve(options?: RequestOptions): APIPromise<WithLastResponse<TenantApiKeysConfig>>;
@@ -33746,6 +34351,9 @@ declare class ConsumerTenantApiKeysConfigResource extends APIResource {
      *
      * Call it on boot: your code is the source of truth for the scopes a key can carry. Fields you leave out keep their stored value. `suspended` is the platform's kill switch: this route never changes it, and a body that carries it is refused. Requires `auth.tenant.api_keys.configure` on the app.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.ConsumerScopedTenantApiKeyConfigUpdateParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, TENANT_API_KEYS_SCOPE_INVALID, TENANT_API_KEYS_UNKNOWN_ROLE, TENANT_API_KEY_EXPIRY_INVALID, TENANT_API_KEYS_NO_SCOPES, TENANT_API_KEYS_SUSPENDED_NOT_WRITABLE: `VALIDATION_ERROR`, `TENANT_API_KEYS_SCOPE_INVALID` (`details.scopes`), `TENANT_API_KEYS_UNKNOWN_ROLE` (`details.roles`: `manage_roles` names a role this app does not have), `TENANT_API_KEY_EXPIRY_INVALID`, `TENANT_API_KEYS_NO_SCOPES` (enabling with no scope), `TENANT_API_KEYS_SUSPENDED_NOT_WRITABLE` (the body carries `suspended`), or a malformed `Idempotency-Key`.
@@ -33758,7 +34366,7 @@ declare class ConsumerTenantApiKeysConfigResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#put-app-slug-v1-tenant-api-keys-config
      * @example
      * ```ts
-     * const tenantApiKeysConfig = await auth.consumer("app").tenantApiKeys.config.update({ default_expiry_days: 7 });
+     * const tenantApiKeysConfig = await auth.consumer("my-app").tenantApiKeys.config.update({ default_expiry_days: 7 });
      * ```
      */
     update(params?: ConsumerScopedTenantApiKeyConfigUpdateParams, options?: RequestOptions): APIPromise<WithLastResponse<TenantApiKeysConfig>>;
@@ -33772,6 +34380,9 @@ declare class ConsumerTenantApiKeysResource extends APIResource {
      *
      * Returns the secret ONCE (`key`). Scopes must be grantable by the app and held by your own tenant role. At most 25 active keys per tenant. If the app requires recent MFA, verify a factor first (403 `step_up_required`). Responses carry `Cache-Control: no-store`.
      *
+     * Credential: `end_user_token`.
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param params - `Auth.TenantApiKeyCreateParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, TENANT_API_KEY_SCOPE_NOT_GRANTABLE, TENANT_API_KEY_EXPIRY_INVALID: `VALIDATION_ERROR`, `TENANT_API_KEY_SCOPE_NOT_GRANTABLE` (`details.scopes`), `TENANT_API_KEY_EXPIRY_INVALID` (`details.allowed`), or a malformed `Idempotency-Key`.
@@ -33784,7 +34395,7 @@ declare class ConsumerTenantApiKeysResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-tenant-api-keys
      * @example
      * ```ts
-     * const tenantApiKeyWithSecret = await auth.consumer("app").tenantApiKeys.create({ name: "CI e2e", scopes: ["disputes.read", "audit.read"] });
+     * const tenantApiKeyWithSecret = await auth.consumer("my-app").tenantApiKeys.create({ name: "CI e2e", scopes: ["disputes.read", "audit.read"] });
      * ```
      */
     create(params: TenantApiKeyCreateParams, options?: RequestOptions): APIPromise<WithLastResponse<TenantApiKeyWithSecret>>;
@@ -33793,6 +34404,9 @@ declare class ConsumerTenantApiKeysResource extends APIResource {
      *
      * Immediate and final. Idempotent: revoking a revoked key is a 204 that changes nothing.
      *
+     * Credential: `end_user_token`.
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param keyId - Key id (UUID) or display id (`tak_…`).
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid end-user bearer token (M2M tokens, PAKs and API keys are refused).
@@ -33803,7 +34417,7 @@ declare class ConsumerTenantApiKeysResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-tenant-api-keys-key-id
      * @example
      * ```ts
-     * await auth.consumer("app").tenantApiKeys.delete("key");
+     * await auth.consumer("my-app").tenantApiKeys.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     delete(keyId: string, options?: RequestOptions): APIPromise<void>;
@@ -33812,6 +34426,9 @@ declare class ConsumerTenantApiKeysResource extends APIResource {
      *
      * For your backend: is this `pctk_` key, presented to YOUR API, usable right now, for which tenant and with which scopes? A key of another app is `{"active": false}`. Cache answers by the key's SHA-256: positives up to 30 s (never past `expires_at`), negatives up to 60 s. Intersect `scopes` with the permissions of `created_by.tenant_role` in your app. Requires `auth.tenant.api_keys.introspect` on the app. Not audited per call; `last_used_at` records use (5-minute granularity). This route has its own per-app rate bucket (1200 calls a minute by default), separate from your PAK's other calls; over it the answer is 429 with `Retry-After`, never a false `active: false`, so keep serving keys you hold a fresh positive for.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.TenantApiKeyIntrospectParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `key` missing or not a string.
@@ -33824,7 +34441,7 @@ declare class ConsumerTenantApiKeysResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-tenant-api-keys-introspect
      * @example
      * ```ts
-     * const tenantApiKeyIntrospection = await auth.consumer("app").tenantApiKeys.introspect({ key: "pctk_live_4fQ2aZ0000000000000000000000000000000000000_1a2B3c" });
+     * const tenantApiKeyIntrospection = await auth.consumer("my-app").tenantApiKeys.introspect({ key: "pctk_live_4fQ2aZ0000000000000000000000000000000000000_1a2B3c" });
      * ```
      */
     introspect(params: TenantApiKeyIntrospectParams, options?: RequestOptions): APIPromise<WithLastResponse<TenantApiKeyIntrospection>>;
@@ -33833,6 +34450,9 @@ declare class ConsumerTenantApiKeysResource extends APIResource {
      *
      * Newest first, cursor-paginated (20 per page, max 100). Secrets are never returned; `key_prefix` and `last4` identify a key.
      *
+     * Credential: `end_user_token`.
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param params - `Auth.ConsumerScopedTenantApiKeyListParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `status` or malformed `cursor`.
@@ -33844,10 +34464,10 @@ declare class ConsumerTenantApiKeysResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-tenant-api-keys
      * @example
      * ```ts
-     * for await (const tenantApiKey of auth.consumer("app").tenantApiKeys.list()) {
+     * for await (const tenantApiKey of auth.consumer("my-app").tenantApiKeys.list()) {
      *   console.log(tenantApiKey);
      * }
-     * const page = await auth.consumer("app").tenantApiKeys.list({}, { timeout: 5_000 });
+     * const page = await auth.consumer("my-app").tenantApiKeys.list({}, { timeout: 5_000 });
      * ```
      */
     list(params?: ConsumerScopedTenantApiKeyListParams, options?: RequestOptions): PagePromise<TenantApiKey>;
@@ -33856,6 +34476,9 @@ declare class ConsumerTenantApiKeysResource extends APIResource {
      *
      * Mints a replacement with the same name and scopes and returns its secret ONCE. You become the replacement's creator, so its scopes must be within your own tenant role. The outgoing key is revoked now (`grace_hours: 0`, the default) or keeps working for up to 24 hours. To kill a leaked key, revoke it. Responses carry `Cache-Control: no-store`.
      *
+     * Credential: `end_user_token`.
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param keyId - Key id (UUID) or display id (`tak_…`).
      * @param params - `Auth.TenantApiKeyRotateParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
@@ -33869,7 +34492,7 @@ declare class ConsumerTenantApiKeysResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-tenant-api-keys-key-id-rotate
      * @example
      * ```ts
-     * const tenantApiKeyWithSecret = await auth.consumer("app").tenantApiKeys.rotate("key", { expires_in_days: 7 });
+     * const tenantApiKeyWithSecret = await auth.consumer("my-app").tenantApiKeys.rotate("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { expires_in_days: 7 });
      * ```
      */
     rotate(keyId: string, params?: TenantApiKeyRotateParams, options?: RequestOptions): APIPromise<WithLastResponse<TenantApiKeyWithSecret>>;
@@ -33878,6 +34501,9 @@ declare class ConsumerTenantApiKeysResource extends APIResource {
      *
      * For your own audit trail: record why a key you saw go inactive died (revoked in the console, creator left the tenant, expired, keys suspended). Only keys of this app; another app's key is 404. Requires `auth.tenant.api_keys.introspect` on the app.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param keyId - Key id (UUID) or display id (`tak_…`), as `introspect` returned it.
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, malformed or revoked Platform API Key (`Authorization: Bearer pcft_live_…`).
@@ -33889,7 +34515,7 @@ declare class ConsumerTenantApiKeysResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-tenant-api-keys-key-id-status
      * @example
      * ```ts
-     * const tenantApiKeyStatus = await auth.consumer("app").tenantApiKeys.status("key");
+     * const tenantApiKeyStatus = await auth.consumer("my-app").tenantApiKeys.status("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     status(keyId: string, options?: RequestOptions): APIPromise<WithLastResponse<TenantApiKeyStatus>>;
@@ -33901,6 +34527,9 @@ declare class ConsumerTenantsInvitesResource extends APIResource {
      *
      * Unlike `POST /members`, nothing is granted until the invitee accepts at `POST /:appSlug/v1/auth/accept-tenant-invite`. Only a SHA-256 digest of the code is stored, so the `code` in this response is unrecoverable afterwards.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param tenantId - Id of the tenant.
      * @param params - `Auth.ConsumerScopedTenantInviteCreateParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
@@ -33914,13 +34543,16 @@ declare class ConsumerTenantsInvitesResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-tenants-tenant-id-invites
      * @example
      * ```ts
-     * const createTenantInvite = await auth.consumer("app").tenants.invites.create("tenant", { email: "alice@example.com", role_name: "member" });
+     * const createTenantInvite = await auth.consumer("my-app").tenants.invites.create("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { email: "alice@example.com", role_name: "member" });
      * ```
      */
     create(tenantId: string, params: ConsumerScopedTenantInviteCreateParams, options?: RequestOptions): APIPromise<WithLastResponse<CreateTenantInvite>>;
     /**
      * Revoke a pending invite. Idempotent — revoking an already-revoked invite is a 204 no-op and fires no second webhook. PAK must hold auth.tenant.members.remove.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param tenantId - Id of the tenant.
      * @param inviteId - Id of the invite.
      * @param options - Per-request options.
@@ -33931,7 +34563,7 @@ declare class ConsumerTenantsInvitesResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-tenants-tenant-id-invites-invite-id
      * @example
      * ```ts
-     * await auth.consumer("app").tenants.invites.delete("tenant", "invite");
+     * await auth.consumer("my-app").tenants.invites.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     delete(tenantId: string, inviteId: string, options?: RequestOptions): APIPromise<void>;
@@ -33940,6 +34572,9 @@ declare class ConsumerTenantsInvitesResource extends APIResource {
      *
      * Codes are never returned here — only the digest is stored. Use `status=pending` to show outstanding invitations.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param tenantId - Id of the tenant.
      * @param params - `Auth.ConsumerScopedTenantInviteListParams`.
      * @param options - Per-request options.
@@ -33951,10 +34586,10 @@ declare class ConsumerTenantsInvitesResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-tenants-tenant-id-invites
      * @example
      * ```ts
-     * for await (const invite of auth.consumer("app").tenants.invites.list("tenant")) {
+     * for await (const invite of auth.consumer("my-app").tenants.invites.list("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f")) {
      *   console.log(invite);
      * }
-     * const page = await auth.consumer("app").tenants.invites.list("tenant", {}, { timeout: 5_000 });
+     * const page = await auth.consumer("my-app").tenants.invites.list("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", {}, { timeout: 5_000 });
      * ```
      */
     list(tenantId: string, params?: ConsumerScopedTenantInviteListParams, options?: RequestOptions): PagePromise<TenantInvite>;
@@ -33964,6 +34599,9 @@ declare class ConsumerTenantsMembersResource extends APIResource {
     /**
      * Add a member to a tenant. Pass `accountId` for an existing user, or `email` (+ optional `display_name`/`username`) to auto-create the account inline. PAK must hold auth.tenant.members.add.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param tenantId - Id of the tenant.
      * @param params - `Auth.ConsumerScopedTenantMemberCreateParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
@@ -33976,13 +34614,16 @@ declare class ConsumerTenantsMembersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-tenants-tenant-id-members
      * @example
      * ```ts
-     * const consumerAddMember = await auth.consumer("app").tenants.members.create("tenant", { role_name: "member" });
+     * const consumerAddMember = await auth.consumer("my-app").tenants.members.create("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { role_name: "member" });
      * ```
      */
     create(tenantId: string, params: ConsumerScopedTenantMemberCreateParams, options?: RequestOptions): APIPromise<WithLastResponse<ConsumerAddMember>>;
     /**
      * Remove a member from a tenant. The underlying account row stays in the app — only the tenant_membership row is deleted. PAK must hold auth.tenant.members.remove.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param tenantId - Id of the tenant.
      * @param accountId - Id of the account.
      * @param options - Per-request options.
@@ -33993,13 +34634,16 @@ declare class ConsumerTenantsMembersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-tenants-tenant-id-members-account-id
      * @example
      * ```ts
-     * await auth.consumer("app").tenants.members.delete("tenant", "account");
+     * await auth.consumer("my-app").tenants.members.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     delete(tenantId: string, accountId: string, options?: RequestOptions): APIPromise<void>;
     /**
      * List members of a tenant. Cursor-paginated by joined_at desc. Filter by `?search=` and/or `?role=`. PAK must hold auth.tenant.read.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param tenantId - Id of the tenant.
      * @param params - `Auth.ConsumerScopedTenantMemberListParams`.
      * @param options - Per-request options.
@@ -34013,16 +34657,19 @@ declare class ConsumerTenantsMembersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-tenants-tenant-id-members
      * @example
      * ```ts
-     * for await (const member of auth.consumer("app").tenants.members.list("tenant")) {
+     * for await (const member of auth.consumer("my-app").tenants.members.list("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f")) {
      *   console.log(member);
      * }
-     * const page = await auth.consumer("app").tenants.members.list("tenant", {}, { timeout: 5_000 });
+     * const page = await auth.consumer("my-app").tenants.members.list("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", {}, { timeout: 5_000 });
      * ```
      */
     list(tenantId: string, params?: ConsumerScopedTenantMemberListParams, options?: RequestOptions): PagePromise<ConsumerTenantMembership>;
     /**
      * Change a member's role. PAK must hold auth.tenant.members.update-role.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param tenantId - Id of the tenant.
      * @param accountId - Id of the account.
      * @param params - `Auth.ConsumerScopedTenantMemberUpdateParams`.
@@ -34035,7 +34682,7 @@ declare class ConsumerTenantsMembersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#patch-app-slug-v1-tenants-tenant-id-members-account-id
      * @example
      * ```ts
-     * const consumerTenantMembership = await auth.consumer("app").tenants.members.update("tenant", "account", { role_name: "admin" });
+     * const consumerTenantMembership = await auth.consumer("my-app").tenants.members.update("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { role_name: "admin" });
      * ```
      */
     update(tenantId: string, accountId: string, params: ConsumerScopedTenantMemberUpdateParams, options?: RequestOptions): APIPromise<WithLastResponse<ConsumerTenantMembership>>;
@@ -34048,6 +34695,9 @@ declare class ConsumerTenantsResource extends APIResource {
     /**
      * Create a tenant inside this app. Returns the new tenant with a `display_id` (`tnt_<12hex>`). PAK must hold auth.tenant.create.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.ConsumerScopedTenantCreateParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid display_name or slug.
@@ -34060,13 +34710,16 @@ declare class ConsumerTenantsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-tenants
      * @example
      * ```ts
-     * const consumerTenant = await auth.consumer("app").tenants.create({ display_name: "Acme Co" });
+     * const consumerTenant = await auth.consumer("my-app").tenants.create({ display_name: "Acme Co" });
      * ```
      */
     create(params: ConsumerScopedTenantCreateParams, options?: RequestOptions): APIPromise<WithLastResponse<ConsumerTenant>>;
     /**
      * Delete a tenant. Cascades to tenant_membership rows; account rows are unaffected. PAK must hold auth.tenant.delete.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param tenantId - Id of the tenant.
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -34076,13 +34729,16 @@ declare class ConsumerTenantsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-tenants-tenant-id
      * @example
      * ```ts
-     * await auth.consumer("app").tenants.delete("tenant");
+     * await auth.consumer("my-app").tenants.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     delete(tenantId: string, options?: RequestOptions): APIPromise<void>;
     /**
      * List tenants in this app, paginated by created_at desc. PAK must hold auth.tenant.read.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.ConsumerScopedTenantListParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid `status` filter or malformed `cursor`.
@@ -34095,16 +34751,19 @@ declare class ConsumerTenantsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-tenants
      * @example
      * ```ts
-     * for await (const tenant of auth.consumer("app").tenants.list()) {
+     * for await (const tenant of auth.consumer("my-app").tenants.list()) {
      *   console.log(tenant);
      * }
-     * const page = await auth.consumer("app").tenants.list({}, { timeout: 5_000 });
+     * const page = await auth.consumer("my-app").tenants.list({}, { timeout: 5_000 });
      * ```
      */
     list(params?: ConsumerScopedTenantListParams, options?: RequestOptions): PagePromise<ConsumerTenant>;
     /**
      * Fetch a single tenant by its UUID or `tnt_<12hex>` display id. PAK must hold auth.tenant.read.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param tenantId - Id of the tenant.
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -34114,13 +34773,16 @@ declare class ConsumerTenantsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-tenants-tenant-id
      * @example
      * ```ts
-     * const consumerTenant = await auth.consumer("app").tenants.retrieve("tenant");
+     * const consumerTenant = await auth.consumer("my-app").tenants.retrieve("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     retrieve(tenantId: string, options?: RequestOptions): APIPromise<WithLastResponse<ConsumerTenant>>;
     /**
      * Patch a tenant. Any subset of {display_name, slug, status, metadata}. PAK must hold auth.tenant.update.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param tenantId - Id of the tenant.
      * @param params - `Auth.ConsumerScopedTenantUpdateParams`.
      * @param options - Per-request options.
@@ -34133,7 +34795,7 @@ declare class ConsumerTenantsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#patch-app-slug-v1-tenants-tenant-id
      * @example
      * ```ts
-     * const consumerTenant = await auth.consumer("app").tenants.update("tenant", { display_name: "string" });
+     * const consumerTenant = await auth.consumer("my-app").tenants.update("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { display_name: "Acme Inc" });
      * ```
      */
     update(tenantId: string, params?: ConsumerScopedTenantUpdateParams, options?: RequestOptions): APIPromise<WithLastResponse<ConsumerTenant>>;
@@ -34145,6 +34807,9 @@ declare class ConsumerUsersFactorsResource extends APIResource {
      *
      * Creates the factor in the enabled state. TOTP: returns the cleartext secret + otpauth URI + recovery codes in the response — intended for synthetic-account-style flows where the caller bundles credentials and ships them out once. Email: binds the user's verified email contact (primary by default, `contact_id` to override; 412 when unverified) and returns the masked address + recovery codes — sign-in codes are then delivered on demand via `/auth/mfa/send-code`.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param userId - Id of the user.
      * @param params - `Auth.UserFactorCreateParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
@@ -34159,13 +34824,16 @@ declare class ConsumerUsersFactorsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-users-user-id-factors
      * @example
      * ```ts
-     * const adminProvisionFactor = await auth.consumer("app").users.factors.create("user", { type: "totp" });
+     * const adminProvisionFactor = await auth.consumer("my-app").users.factors.create("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { type: "totp" });
      * ```
      */
     create(userId: string, params: UserFactorCreateParams, options?: RequestOptions): APIPromise<WithLastResponse<AdminProvisionFactor>>;
     /**
      * Disable a user's MFA factor
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param userId - Id of the user.
      * @param factorId - Id of the factor.
      * @param options - Per-request options.
@@ -34178,13 +34846,16 @@ declare class ConsumerUsersFactorsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-users-user-id-factors-factor-id
      * @example
      * ```ts
-     * await auth.consumer("app").users.factors.delete("user", "factor");
+     * await auth.consumer("my-app").users.factors.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     delete(userId: string, factorId: string, options?: RequestOptions): APIPromise<void>;
     /**
      * List a user's MFA factors
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param userId - Id of the user.
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing bearer token, or the Platform API Key is malformed, unknown or revoked.
@@ -34196,7 +34867,7 @@ declare class ConsumerUsersFactorsResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-users-user-id-factors
      * @example
      * ```ts
-     * const factorList = await auth.consumer("app").users.factors.list("user");
+     * const factorList = await auth.consumer("my-app").users.factors.list("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     list(userId: string, options?: RequestOptions): APIPromise<WithLastResponse<FactorList>>;
@@ -34212,6 +34883,11 @@ declare class ConsumerUsersResource extends APIResource {
      *
      * What is NOT distinct: the password policy. A supplied `password` goes through the same app-configured rules, the same common-password deny-list and the same breach check as `/auth/signup`.
      *
+     * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.
+     * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.
+     * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param params - `Auth.UserCreateParams`.
      * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, PASSWORD_TOO_COMMON, PASSWORD_BREACHED: Invalid email, unknown role, or a password that fails the app policy — `PASSWORD_TOO_COMMON` / `PASSWORD_BREACHED`.
@@ -34223,7 +34899,7 @@ declare class ConsumerUsersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-admin-users
      * @example
      * ```ts
-     * const consumerAdminCreatedUser = await auth.consumer("app").users.create({ email: "string" });
+     * const consumerAdminCreatedUser = await auth.consumer("my-app").users.create({ email: "ada@example.com" });
      * ```
      */
     create(params: UserCreateParams, options?: RequestOptions): APIPromise<WithLastResponse<ConsumerAdminCreatedUser>>;
@@ -34232,6 +34908,11 @@ declare class ConsumerUsersResource extends APIResource {
      *
      * Removes the account, its sessions, contacts, and tenant memberships. Audit rows are preserved, and the deletion itself is audited as `auth.account.deleted` with `via: consumer_admin` and the caller as actor. Fires `user.deleted` with `via: "consumer_admin"`.
      *
+     * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.
+     * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.
+     * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param userId - Id of the user.
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired Consumer-API bearer: an EndUser or M2M token, or an app API key (`hdk_live_*` / `hdk_test_*`); or the account, session, M2M client or key is no longer active, or the key belongs to another app.
@@ -34242,7 +34923,7 @@ declare class ConsumerUsersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#delete-app-slug-v1-admin-users-user-id
      * @example
      * ```ts
-     * await auth.consumer("app").users.delete("user");
+     * await auth.consumer("my-app").users.delete("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     delete(userId: string, options?: RequestOptions): APIPromise<void>;
@@ -34251,6 +34932,11 @@ declare class ConsumerUsersResource extends APIResource {
      *
      * Cursor-paginated. Supports the same `status` and `search` filters as the auth-admin equivalent. Use the cursor in subsequent calls — Auth does not expose offset pagination.
      *
+     * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.
+     * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.
+     * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param params - `Auth.UserListParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`, or a cursor issued for a different sort order.
@@ -34262,16 +34948,21 @@ declare class ConsumerUsersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-admin-users
      * @example
      * ```ts
-     * for await (const user of auth.consumer("app").users.list()) {
+     * for await (const user of auth.consumer("my-app").users.list()) {
      *   console.log(user);
      * }
-     * const page = await auth.consumer("app").users.list({}, { timeout: 5_000 });
+     * const page = await auth.consumer("my-app").users.list({}, { timeout: 5_000 });
      * ```
      */
     list(params?: UserListParams, options?: RequestOptions): PagePromise<ConsumerAdminEndUser>;
     /**
      * Read one end-user
      *
+     * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.
+     * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.
+     * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param userId - Id of the user.
      * @param options - Per-request options.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
@@ -34281,7 +34972,7 @@ declare class ConsumerUsersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-v1-admin-users-user-id
      * @example
      * ```ts
-     * const consumerAdminEndUser = await auth.consumer("app").users.retrieve("user");
+     * const consumerAdminEndUser = await auth.consumer("my-app").users.retrieve("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f");
      * ```
      */
     retrieve(userId: string, options?: RequestOptions): APIPromise<WithLastResponse<ConsumerAdminEndUser>>;
@@ -34290,6 +34981,11 @@ declare class ConsumerUsersResource extends APIResource {
      *
      * Email update promotes an existing contact to primary (not for creating new contacts — that goes through the per-contact flow).
      *
+     * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.
+     * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.
+     * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param userId - Id of the user.
      * @param params - `Auth.UserUpdateParams`.
      * @param options - Per-request options.
@@ -34302,7 +34998,7 @@ declare class ConsumerUsersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#patch-app-slug-v1-admin-users-user-id
      * @example
      * ```ts
-     * const consumerAdminEndUser = await auth.consumer("app").users.update("user", { display_name: "string" });
+     * const consumerAdminEndUser = await auth.consumer("my-app").users.update("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { display_name: "Ada Lovelace" });
      * ```
      */
     update(userId: string, params?: UserUpdateParams, options?: RequestOptions): APIPromise<WithLastResponse<ConsumerAdminEndUser>>;
@@ -34311,6 +35007,11 @@ declare class ConsumerUsersResource extends APIResource {
      *
      * Sets `app_membership.role_id` for the target user. For M2M callers the assignable role is bounded by the token's scopes (the guard already enforced `role.assign`); the role's own permission set is NOT additionally narrowed against the M2M scopes because M2M scopes are typically broader than per-user role perms by design (a backend cron with `user.list` + `role.assign` SHOULD be able to promote a user into a role carrying any per-app perm). EndUser admins are bounded by their own role's perms transitively — they couldn't authenticate as an admin without holding the perm.
      *
+     * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.
+     * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.
+     * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param userId - Id of the user.
      * @param params - `Auth.UserUpdateRoleParams`.
      * @param options - Per-request options.
@@ -34323,7 +35024,7 @@ declare class ConsumerUsersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#patch-app-slug-v1-admin-users-user-id-role
      * @example
      * ```ts
-     * const consumerAdminRoleAssignment = await auth.consumer("app").users.updateRole("user", { role_name: "string" });
+     * const consumerAdminRoleAssignment = await auth.consumer("my-app").users.updateRole("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { role_name: "member" });
      * ```
      */
     updateRole(userId: string, params: UserUpdateRoleParams, options?: RequestOptions): APIPromise<WithLastResponse<ConsumerAdminRoleAssignment>>;
@@ -34332,6 +35033,11 @@ declare class ConsumerUsersResource extends APIResource {
      *
      * Setting status to `suspended` or `deactivated` also revokes all active sessions for the user (same behaviour as the auth-admin equivalent).
      *
+     * Credential: one of `app_api_key`, `m2m_token`, `end_user_token`.
+     * - `app_api_key`: An app API key (`hdk_live_…` or `hdk_test_…`) minted for this app (`POST /v1/apps/{app_id}/api-keys`). Its permissions are always enforced. A workspace key is refused.
+     * - `m2m_token`: An access token from this app's client-credentials grant (`POST /{app_slug}/v1/oauth/token`).
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param userId - Id of the user.
      * @param params - `Auth.UserUpdateStatusParams`.
      * @param options - Per-request options.
@@ -34344,7 +35050,7 @@ declare class ConsumerUsersResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#patch-app-slug-v1-admin-users-user-id-status
      * @example
      * ```ts
-     * const consumerAdminEndUser = await auth.consumer("app").users.updateStatus("user", { status: "active" });
+     * const consumerAdminEndUser = await auth.consumer("my-app").users.updateStatus("3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f", { status: "active" });
      * ```
      */
     updateStatus(userId: string, params: UserUpdateStatusParams, options?: RequestOptions): APIPromise<WithLastResponse<ConsumerAdminEndUser>>;
@@ -34367,7 +35073,7 @@ declare class ConsumerVerifyResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-authorize
      * @example
      * ```ts
-     * const authorize = await auth.consumer("app").verify.authorize({ permission: "string" });
+     * const authorize = await auth.consumer("my-app").verify.authorize({ permission: "invoice.read" });
      * ```
      */
     authorize(params?: VerifyAuthorizeParams, options?: RequestOptions): APIPromise<WithLastResponse<Authorize>>;
@@ -34387,7 +35093,7 @@ declare class ConsumerVerifyResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-authorize-batch
      * @example
      * ```ts
-     * const authorizeBatch = await auth.consumer("app").verify.authorizeBatch({ checks: [{}] });
+     * const authorizeBatch = await auth.consumer("my-app").verify.authorizeBatch({ checks: [{}] });
      * ```
      */
     authorizeBatch(params: VerifyAuthorizeBatchParams, options?: RequestOptions): APIPromise<WithLastResponse<AuthorizeBatch>>;
@@ -34407,7 +35113,7 @@ declare class ConsumerVerifyResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-verify
      * @example
      * ```ts
-     * const verify = await auth.consumer("app").verify.token({ token: "string" });
+     * const verify = await auth.consumer("my-app").verify.token({ token: "eyJhbGciOiJSUzI1NiIsImtpZCI6ImsxIn0.eyJzdWIiOiJ1c3JfMSJ9.c2lnbmF0dXJl" });
      * ```
      */
     token(params?: VerifyTokenParams, options?: RequestOptions): APIPromise<WithLastResponse<Verify>>;
@@ -34432,7 +35138,7 @@ declare class ConsumerWellKnownResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-well-known-jwks-json
      * @example
      * ```ts
-     * const jwks = await auth.consumer("app").wellKnown.jwks();
+     * const jwks = await auth.consumer("my-app").wellKnown.jwks();
      * ```
      */
     jwks(options?: RequestOptions): APIPromise<WithLastResponse<Jwks>>;
@@ -34448,7 +35154,7 @@ declare class ConsumerWellKnownResource extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#get-app-slug-well-known-openid-configuration
      * @example
      * ```ts
-     * const openIdConfiguration = await auth.consumer("app").wellKnown.openidConfiguration();
+     * const openIdConfiguration = await auth.consumer("my-app").wellKnown.openidConfiguration();
      * ```
      */
     openidConfiguration(options?: RequestOptions): APIPromise<WithLastResponse<OpenIdConfiguration>>;
@@ -34488,7 +35194,7 @@ declare class AuthConsumer extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-accept-invite
      * @example
      * ```ts
-     * const result = await auth.consumer("app").acceptInvite({ code: "inv_x7H2k3jLqXr", password: "CorrectHorseBatteryStaple" });
+     * const result = await auth.consumer("my-app").acceptInvite({ code: "inv_x7H2k3jLqXr", password: "CorrectHorseBatteryStaple" });
      * ```
      */
     acceptInvite(params: AcceptInviteParams, options?: RequestOptions): APIPromise<WithLastResponse<AcceptInviteResponse>>;
@@ -34511,7 +35217,7 @@ declare class AuthConsumer extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-accept-tenant-invite
      * @example
      * ```ts
-     * const consumerToken = await auth.consumer("app").acceptTenantInvite({ code: "tinv_9dK2mQ7pR4vXbN1sT6yZ0hLcJeW3fAgU", password: "CorrectHorseBatteryStaple" });
+     * const consumerToken = await auth.consumer("my-app").acceptTenantInvite({ code: "tinv_9dK2mQ7pR4vXbN1sT6yZ0hLcJeW3fAgU", password: "CorrectHorseBatteryStaple" });
      * ```
      */
     acceptTenantInvite(params: AcceptTenantInviteParams, options?: RequestOptions): APIPromise<WithLastResponse<ConsumerToken>>;
@@ -34527,7 +35233,7 @@ declare class AuthConsumer extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-oauth-exchange
      * @example
      * ```ts
-     * const exchange = await auth.consumer("app").exchangeProviderCode({ code: "string" });
+     * const exchange = await auth.consumer("my-app").exchangeProviderCode({ code: "hc_8f14e45fceea167a5a36dedd4bea2543" });
      * ```
      */
     exchangeProviderCode(params: ExchangeProviderCodeParams, options?: RequestOptions): APIPromise<WithLastResponse<Exchange>>;
@@ -34548,7 +35254,9 @@ declare class AuthConsumer extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-logout
      * @example
      * ```ts
-     * await auth.consumer("app").logout({ refresh_token: "string" });
+     * await auth.consumer("my-app").logout({
+     *   refresh_token: "eyJhbGciOiJSUzI1NiIsImtpZCI6ImsxIn0.eyJ0eXAiOiJyZWZyZXNoIn0.c2lnbmF0dXJl",
+     * });
      * ```
      */
     logout(params: LogoutParams, options?: RequestOptions): APIPromise<void>;
@@ -34569,7 +35277,9 @@ declare class AuthConsumer extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-refresh
      * @example
      * ```ts
-     * const consumerToken = await auth.consumer("app").refresh({ refresh_token: "string" });
+     * const consumerToken = await auth.consumer("my-app").refresh({
+     *   refresh_token: "eyJhbGciOiJSUzI1NiIsImtpZCI6ImsxIn0.eyJ0eXAiOiJyZWZyZXNoIn0.c2lnbmF0dXJl",
+     * });
      * ```
      */
     refresh(params: RefreshParams, options?: RequestOptions): APIPromise<WithLastResponse<ConsumerToken>>;
@@ -34582,6 +35292,9 @@ declare class AuthConsumer extends APIResource {
      *
      * Renamed from /auth/request-reset.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.RequestPasswordResetParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Provide exactly one of `email` or `phone`, or request validation failed in the global `ValidationPipe`.
@@ -34594,7 +35307,7 @@ declare class AuthConsumer extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-request-password-reset
      * @example
      * ```ts
-     * const consumerCodeIssue = await auth.consumer("app").requestPasswordReset({ email: "jane@example.com" });
+     * const consumerCodeIssue = await auth.consumer("my-app").requestPasswordReset({ email: "jane@example.com" });
      * ```
      */
     requestPasswordReset(params?: RequestPasswordResetParams, options?: RequestOptions): APIPromise<WithLastResponse<ConsumerCodeIssue>>;
@@ -34607,6 +35320,9 @@ declare class AuthConsumer extends APIResource {
      *
      * Issuing a code invalidates any previously issued, unconsumed code for the same contact — including the one auto-emailed at signup. Only the most recently minted code is accepted.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.RequestVerificationParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Provide exactly one of `email` or `phone`, or request validation failed in the global `ValidationPipe`.
@@ -34619,7 +35335,7 @@ declare class AuthConsumer extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-request-verification
      * @example
      * ```ts
-     * const consumerCodeIssue = await auth.consumer("app").requestVerification({ email: "jane@example.com" });
+     * const consumerCodeIssue = await auth.consumer("my-app").requestVerification({ email: "jane@example.com" });
      * ```
      */
     requestVerification(params?: RequestVerificationParams, options?: RequestOptions): APIPromise<WithLastResponse<ConsumerCodeIssue>>;
@@ -34641,7 +35357,7 @@ declare class AuthConsumer extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-reset-password
      * @example
      * ```ts
-     * await auth.consumer("app").resetPassword({ code: "123456", new_password: "string" });
+     * await auth.consumer("my-app").resetPassword({ code: "123456", new_password: "a new long passphrase 42" });
      * ```
      */
     resetPassword(params: ResetPasswordParams, options?: RequestOptions): APIPromise<void>;
@@ -34650,6 +35366,9 @@ declare class AuthConsumer extends APIResource {
      *
      * Same shape as `send-verification-email` but for the reset slot. PAK perm: `auth.user.password-reset.send-email`. Same loud precondition errors. Email-only.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.SendPasswordResetEmailParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.
@@ -34664,7 +35383,7 @@ declare class AuthConsumer extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-send-password-reset-email
      * @example
      * ```ts
-     * const consumerCodeDispatch = await auth.consumer("app").sendPasswordResetEmail({ email: "jane@example.com" });
+     * const consumerCodeDispatch = await auth.consumer("my-app").sendPasswordResetEmail({ email: "jane@example.com" });
      * ```
      */
     sendPasswordResetEmail(params: SendPasswordResetEmailParams, options?: RequestOptions): APIPromise<WithLastResponse<ConsumerCodeDispatch>>;
@@ -34686,6 +35405,9 @@ declare class AuthConsumer extends APIResource {
      *
      * Issuing a code invalidates any previously issued, unconsumed code for the same contact — including the one auto-emailed at signup. Only the most recently minted code is accepted.
      *
+     * Credential: `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.SendVerificationEmailParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.
@@ -34700,7 +35422,7 @@ declare class AuthConsumer extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-send-verification-email
      * @example
      * ```ts
-     * const consumerCodeDispatch = await auth.consumer("app").sendVerificationEmail({ email: "jane@example.com" });
+     * const consumerCodeDispatch = await auth.consumer("my-app").sendVerificationEmail({ email: "jane@example.com" });
      * ```
      */
     sendVerificationEmail(params: SendVerificationEmailParams, options?: RequestOptions): APIPromise<WithLastResponse<ConsumerCodeDispatch>>;
@@ -34722,7 +35444,7 @@ declare class AuthConsumer extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-signin
      * @example
      * ```ts
-     * const result = await auth.consumer("app").signin({ identifier: "jane_doe", password: "string" });
+     * const result = await auth.consumer("my-app").signin({ identifier: "jane_doe", password: "correct horse battery staple" });
      * ```
      */
     signin(params: SigninParams, options?: RequestOptions): APIPromise<WithLastResponse<SigninResponse>>;
@@ -34741,7 +35463,10 @@ declare class AuthConsumer extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-oauth-provider
      * @example
      * ```ts
-     * const result = await auth.consumer("app").signinWithProvider("provider", { id_token: "string", nonce: "string" });
+     * const result = await auth.consumer("my-app").signinWithProvider("google", {
+     *   id_token: "eyJhbGciOiJSUzI1NiIsImtpZCI6ImsxIn0.eyJzdWIiOiJ1c3JfMSJ9.c2lnbmF0dXJl",
+     *   nonce: "n-0S6_WzA2Mj",
+     * });
      * ```
      */
     signinWithProvider(provider: string, params: SigninWithProviderParams, options?: RequestOptions): APIPromise<WithLastResponse<SigninWithProviderResponse>>;
@@ -34754,11 +35479,14 @@ declare class AuthConsumer extends APIResource {
      *
      * When the app has bot protection on (`auth_config.bot_protection`, Cloudflare Turnstile or hCaptcha), send the widget response as `bot_protection_token`. Auth verifies it with the provider before it looks at the email, username or password, and refuses the sign-up when the token is missing (400 `BOT_PROTECTION_REQUIRED`), rejected (403 `BOT_PROTECTION_FAILED`) or cannot be checked (503 `BOT_PROTECTION_UNAVAILABLE`; no account is created). This applies to PAK-authenticated calls too: a backend forwards the token its browser received.
      *
+     * Credential (optional): `workspace_key`.
+     * - `workspace_key`: A workspace API key (`pcft_live_…`, what the SDKs read from `PRODUCTCRAFT_API_KEY`) or a signed-in ProductCraft platform session token. Its workspace policy decides what it may do.
+     *
      * @param params - `Auth.SignupParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, BOT_PROTECTION_REQUIRED: `BOT_PROTECTION_REQUIRED`: the app has bot protection on and the request carried no `bot_protection_token`. Also: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.
      * @throws {AuthenticationError} 401 UNAUTHORIZED: The app sets `signup_requires_pak` and no Platform API Key was presented on `Authorization: Bearer`.
-     * @throws {PermissionDeniedError} 403 FORBIDDEN, BOT_PROTECTION_FAILED, APP_SUSPENDED, APP_ARCHIVED: `BOT_PROTECTION_FAILED`: the bot-protection provider rejected the `bot_protection_token` (bad, expired or already used), or the hostname it reported is not one of the app's `bot_protection.expected_hostnames`; render a fresh widget and retry. Otherwise: signup is disabled for this app, the email domain is not on the app's allow-list, the presented PAK belongs to a different workspace, or its policy denies `auth.signup.create` on this app. Also returned when the app itself is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`).
+     * @throws {PermissionDeniedError} 403 FORBIDDEN, BOT_PROTECTION_FAILED, APP_SUSPENDED, APP_ARCHIVED: `BOT_PROTECTION_FAILED`: the bot-protection provider rejected the `bot_protection_token` (bad, expired or already used), or the hostname it reported is not one of the app's `bot_protection.expected_hostnames`; render a fresh widget and retry. Otherwise: signup is disabled for this app (new apps start with `signup_enabled: false`; turn it on with `PATCH /v1/apps/{app_id}/auth-config`), the email domain is not on the app's allow-list, the presented PAK belongs to a different workspace, or its policy denies `auth.signup.create` on this app. Also returned when the app itself is suspended (`APP_SUSPENDED`) or archived (`APP_ARCHIVED`).
      * @throws {NotFoundError} 404 NOT_FOUND: The `:appSlug` in the path matches no app (or no live rename alias for one). This is about the **app**, not the account — it is decided before any identifier, code or credential in the body is looked at, so it is never a signal about whether an account or a contact exists.
      * @throws {ConflictError} 409 CONFLICT: Email or username already in use in this app, or the app has no workspace binding and therefore cannot accept a PAK signup.
      * @throws {APIError} 415 UNSUPPORTED_MEDIA_TYPE: The request body was sent as `application/x-www-form-urlencoded` (`UNSUPPORTED_MEDIA_TYPE`). This API is JSON-only: a form body is a CORS-simple request that skips preflight, so accepting one would widen the CSRF surface. Send `application/json`. Rejected in `main.ts` before routing, on every non-GET request.
@@ -34768,7 +35496,7 @@ declare class AuthConsumer extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-signup
      * @example
      * ```ts
-     * const result = await auth.consumer("app").signup({ email: "jane@example.com", password: "CorrectHorseBatteryStaple", username: "john_doe" });
+     * const result = await auth.consumer("my-app").signup({ email: "jane@example.com", password: "CorrectHorseBatteryStaple", username: "john_doe" });
      * ```
      */
     signup(params: SignupParams, options?: RequestOptions): APIPromise<WithLastResponse<SignupResponse>>;
@@ -34777,6 +35505,9 @@ declare class AuthConsumer extends APIResource {
      *
      * Re-issues the EndUser's access + refresh tokens with the new `org_id` + `org_role` claims, after verifying the caller holds a tenant_membership for the target tenant. The session row is updated to the new tenant so subsequent refreshes preserve the context. The new access token keeps the session's `amr` and `mfa_at` (as `/auth/refresh` does), so a sign-in that completed MFA still proves it after a switch. Refresh-token rotation runs as usual; the previous refresh token enters the standard 60-second grace window.
      *
+     * Credential: `end_user_token`.
+     * - `end_user_token`: An end user's access token for this app, from `signin`, `signup` or `refresh`. Acts as that user.
+     *
      * @param params - `Auth.SwitchTenantParams`.
      * @param options - Per-request options.
      * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Request validation failed: a required body field is missing, has the wrong type, or fails its format constraint. Produced by the global `ValidationPipe` before the handler runs; the response body lists the offending fields.
@@ -34789,7 +35520,7 @@ declare class AuthConsumer extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-switch-tenant
      * @example
      * ```ts
-     * const consumerToken = await auth.consumer("app").switchTenant({ tenant_id: "string" });
+     * const consumerToken = await auth.consumer("my-app").switchTenant({ tenant_id: "3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f" });
      * ```
      */
     switchTenant(params: SwitchTenantParams, options?: RequestOptions): APIPromise<WithLastResponse<ConsumerToken>>;
@@ -34812,12 +35543,74 @@ declare class AuthConsumer extends APIResource {
      * @see https://productcraft.co/docs/auth/api-reference#post-app-slug-v1-auth-verify
      * @example
      * ```ts
-     * const consumerVerify = await auth.consumer("app").verifyEmail({ code: "123456" });
+     * const consumerVerify = await auth.consumer("my-app").verifyEmail({ code: "123456" });
      * ```
      */
     verifyEmail(params: VerifyEmailParams, options?: RequestOptions): APIPromise<WithLastResponse<ConsumerVerify>>;
 }
 
+/**
+ * Structural copies of the jose types that appear in this package's public
+ * declarations (`AuthGetKeyFn`, `AuthClaims`).
+ *
+ * jose 6 ships ESM-only declarations. If our .d.cts imported them, a
+ * CommonJS consumer on moduleResolution node16/nodenext would get TS1479,
+ * and tsup cannot inline a dependency's types. These copies keep the public
+ * types self-contained; tests/jose-compat.ts proves they stay assignable to
+ * and from jose's own (so `jose.jwtVerify(token, scope.jwks.getKey)` works).
+ */
+/** A WebCrypto key, as jose 6 defines it. */
+type CryptoKey = Extract<Awaited<ReturnType<typeof crypto.subtle.generateKey>>, {
+    type: string;
+}>;
+/** JOSE header parameters of a JWS (jose's `JWSHeaderParameters`). */
+interface JWSHeaderParameters {
+    kid?: string;
+    x5t?: string;
+    x5c?: string[];
+    x5u?: string;
+    jku?: string;
+    jwk?: {
+        kty?: string;
+        crv?: string;
+        x?: string;
+        y?: string;
+        e?: string;
+        n?: string;
+        alg?: string;
+        pub?: string;
+    };
+    typ?: string;
+    cty?: string;
+    alg?: string;
+    b64?: boolean;
+    crit?: string[];
+    [propName: string]: unknown;
+}
+/** A JWT's protected header (jose's `JWTHeaderParameters`). */
+interface JWTHeaderParameters extends JWSHeaderParameters {
+    alg: string;
+    b64?: true;
+}
+/** A flattened JWS (jose's `FlattenedJWSInput`). */
+interface FlattenedJWSInput {
+    header?: JWSHeaderParameters;
+    payload: string | Uint8Array;
+    protected?: string;
+    signature: string;
+}
+/** Registered JWT claims, open to any others (jose's `JWTPayload`). */
+interface JWTPayload {
+    iss?: string;
+    sub?: string;
+    aud?: string | string[];
+    jti?: string;
+    nbf?: number;
+    exp?: number;
+    iat?: number;
+    [propName: string]: unknown;
+}
+
 /**
  * In-process JWKS cache for a single app's `/.well-known/jwks.json`.
  *
@@ -35732,6 +36525,7 @@ type __UserSignupEvent = UserSignupEvent;
 type __UserSuspendedEvent = UserSuspendedEvent;
 type __UnknownWebhookEvent = UnknownWebhookEvent;
 type __UnwrapWebhookEvent = UnwrapWebhookEvent;
+type __WebhookSignParams = WebhookSignParams;
 type __WebhookUnwrapParams = WebhookUnwrapParams;
 /**
  * ProductCraft Auth API client (apps, end users, roles, sign-in flows, sessions, MFA and tenants). Every method is generated from the API's OpenAPI document.
@@ -36357,6 +37151,7 @@ declare namespace Auth {
     type UserSuspendedEvent = __UserSuspendedEvent;
     type UnknownWebhookEvent = __UnknownWebhookEvent;
     type UnwrapWebhookEvent = __UnwrapWebhookEvent;
+    type WebhookSignParams = __WebhookSignParams;
     type WebhookUnwrapParams = __WebhookUnwrapParams;
 }