@productcraft/waitlist 0.1.1 → 0.2.0

package/dist/index.d.ts

@@ -57,6 +57,30 @@ interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/workspaces/{workspace_id}/stats": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Waitlist stats for a workspace
+         * @description Waitlist count, total entries, signups in the window, the most recent signup and a daily signup series, across every waitlist in the workspace.
+         *
+         *     **Active** means a signup: a new waitlist entry.
+         *
+         *     Days are UTC. Counts only: no entrant emails, names, referrers or IPs. Cached for up to 60 seconds (`generated_at`).
+         */
+        get: operations["WorkspaceStatsController_get"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/workspaces/{workspace_id}/waitlist/settings": {
         parameters: {
             query?: never;
@@ -64,7 +88,10 @@ interface paths {
             path?: never;
             cookie?: never;
         };
-        /** Read workspace-level Waitlist defaults */
+        /**
+         * Read workspace-level Waitlist defaults
+         * @description The settings plus `email_setup` (whether Waitlist emails can go out and what is missing; the sender domain and template names are checked against Mail, cached for up to 60 seconds) and `skipped_sends` (emails not sent in the last 7 days because the setup was incomplete). Waitlist never falls back to a ProductCraft sender: an email that cannot go out is recorded, not sent.
+         */
         get: operations["SettingsController_get"];
         /** Update workspace-level Waitlist defaults */
         put: operations["SettingsController_update"];
@@ -75,6 +102,26 @@ interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/workspaces/{workspace_id}/waitlist/settings/notifications/{slot}/test": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Send me a test of one Waitlist email
+         * @description Sends the slot's real Mail template, with the workspace's real Waitlist sender (the workspace default or the custom address) and example values, to your own verified account address. It cannot be sent anywhere else. It uses your own Mail access, goes through the same send path as real emails, and shows up in Mail > Emails. At most 10 tests per person per hour. Not available to API keys (a key has no inbox).
+         */
+        post: operations["SettingsController_sendTest"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/workspaces/{workspace_id}/waitlists": {
         parameters: {
             query?: never;
@@ -85,7 +132,10 @@ interface paths {
         /** List waitlists in this workspace */
         get: operations["WaitlistController_list"];
         put?: never;
-        /** Create a waitlist (workspace-scoped) */
+        /**
+         * Create a waitlist (workspace-scoped)
+         * @description Pass `status: "active"` to accept public sign-ups straight away. Without it the waitlist starts as a draft, and the response says so in `accepting_signups: false` and `signups_note`.
+         */
         post: operations["WaitlistController_create"];
         delete?: never;
         options?: never;
@@ -136,7 +186,10 @@ interface paths {
             path?: never;
             cookie?: never;
         };
-        /** Aggregate counts, viral coefficient, top referrers + referrals */
+        /**
+         * Aggregate counts, viral coefficient, top referrers + referrals
+         * @description Test entries ("Add test signup") are left out unless `include_test=true`.
+         */
         get: operations["AnalyticsController_get"];
         put?: never;
         post?: never;
@@ -170,7 +223,7 @@ interface paths {
             path?: never;
             cookie?: never;
         };
-        /** List entries on a waitlist (paginated) */
+        /** List entries on a waitlist (queue-position order, cursor-paginated). Filterable by status, free-text search across email/name, and a created_at window. */
         get: operations["EntryController_list"];
         put?: never;
         post?: never;
@@ -204,7 +257,7 @@ interface paths {
             path?: never;
             cookie?: never;
         };
-        /** Total entry count for a waitlist */
+        /** Entry count for a waitlist (test entries left out unless include_test=true) */
         get: operations["EntryController_count"];
         put?: never;
         post?: never;
@@ -221,7 +274,7 @@ interface paths {
             path?: never;
             cookie?: never;
         };
-        /** Stream every entry as CSV (admin export) */
+        /** Stream every entry as CSV (admin export; test entries left out unless include_test=true) */
         get: operations["EntryController_exportCsv"];
         put?: never;
         post?: never;
@@ -267,6 +320,26 @@ interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/workspaces/{workspace_id}/waitlists/{waitlist_id}/test-entries": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Add a test signup
+         * @description Creates an entry marked `is_test` with a generated Amazon SES mailbox-simulator address (`success+test-…@simulator.amazonses.com`). Works on draft and paused waitlists and ignores `max_entries`. The entry shows in the entries list, takes a negative position, and is left out of counts, analytics, exports and webhooks unless asked. No email is sent unless `send_welcome_email` is true. Delete it like any other entry.
+         */
+        post: operations["TestEntryController_create"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/workspaces/{workspace_id}/waitlists/{waitlist_id}/variants": {
         parameters: {
             query?: never;
@@ -274,7 +347,7 @@ interface paths {
             path?: never;
             cookie?: never;
         };
-        /** List all variants on a waitlist */
+        /** List variants on a waitlist (cursor-paginated). BREAKING: this endpoint used to return a bare JSON array; it now returns the standard `{ data, pagination }` envelope. */
         get: operations["VariantController_list"];
         put?: never;
         /** Create a variant */
@@ -310,10 +383,18 @@ interface paths {
             path?: never;
             cookie?: never;
         };
-        /** List webhooks for the workspace (secrets masked) */
+        /**
+         * List webhooks for the workspace, newest first, cursor-paginated (secrets masked)
+         * @deprecated
+         * @description Deprecated: use `/v1/workspaces/{workspace_id}/webhooks/endpoints` (event descriptions, Send test that reports the result, event log, replay, rotation with a grace period). Responses carry `Deprecation: true` and `Sunset: Fri, 15 Jan 2027 00:00:00 GMT`.
+         */
         get: operations["WebhookController_list"];
         put?: never;
-        /** Create a workspace webhook. The response includes the per-row signing secret in clear EXACTLY ONCE — copy it now. */
+        /**
+         * Create a workspace webhook. The response includes the signing secret in clear EXACTLY ONCE — copy it now.
+         * @deprecated
+         * @description Deprecated: use `/v1/workspaces/{workspace_id}/webhooks/endpoints` (event descriptions, Send test that reports the result, event log, replay, rotation with a grace period). Responses carry `Deprecation: true` and `Sunset: Fri, 15 Jan 2027 00:00:00 GMT`.
+         */
         post: operations["WebhookController_create"];
         delete?: never;
         options?: never;
@@ -321,6 +402,172 @@ interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/workspaces/{workspace_id}/webhooks/endpoints": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List webhook endpoints, oldest first.
+         * @description At most 10, so this is always one page. Signing secrets are never returned here, only their last 4 characters.
+         */
+        get: operations["WebhooksController_waitlist_workspace_listEndpoints"];
+        put?: never;
+        /**
+         * Add a webhook endpoint. Returns its signing secret once.
+         * @description Deliveries are signed with the Standard Webhooks headers `webhook-id`, `webhook-timestamp` and `webhook-signature` (`v1,<base64 HMAC-SHA256 of "<id>.<timestamp>.<body>">`); the returned `whsec_…` secret works unchanged with any Standard Webhooks library. Failed deliveries are retried after 1 min, 5 min, 30 min, 2 h, 6 h and 24 h.
+         */
+        post: operations["WebhooksController_waitlist_workspace_createEndpoint"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/{workspace_id}/webhooks/endpoints/{endpoint_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get one webhook endpoint (without its secret). */
+        get: operations["WebhooksController_waitlist_workspace_getEndpoint"];
+        put?: never;
+        post?: never;
+        /**
+         * Delete a webhook endpoint.
+         * @description Queued retries are dropped. Its past attempts stay in the event log until the events expire.
+         */
+        delete: operations["WebhooksController_waitlist_workspace_deleteEndpoint"];
+        options?: never;
+        head?: never;
+        /**
+         * Change a webhook endpoint: URL, description, events, on/off.
+         * @description Only the fields sent change. `enabled: true` (or a new URL) also clears an automatic disable. Switching off cancels queued retries. The secret is unchanged; rotate it with `POST …/rotate-secret`.
+         */
+        patch: operations["WebhooksController_waitlist_workspace_updateEndpoint"];
+        trace?: never;
+    };
+    "/v1/workspaces/{workspace_id}/webhooks/endpoints/{endpoint_id}/rotate-secret": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Rotate the signing secret. The new one is returned once.
+         * @description For `grace_hours` (default 24) the previous secret keeps signing too: `webhook-signature` then lists one `v1,` signature per secret, so receivers can switch over without dropping a delivery.
+         */
+        post: operations["WebhooksController_waitlist_workspace_rotateSecret"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/{workspace_id}/webhooks/endpoints/{endpoint_id}/test": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Send a test event to this endpoint now and return the result.
+         * @description Delivers the catalogue example of `event_type`, signed like any delivery, with `"test": true` in the body. Works while the endpoint is switched off or not subscribed to that type, is logged in the event log, and is never retried or counted toward an automatic disable. Waits up to 15 s for your receiver.
+         */
+        post: operations["WebhooksController_waitlist_workspace_sendTest"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/{workspace_id}/webhooks/event-types": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List the events an endpoint can subscribe to.
+         * @description Each type with a plain description, its group and an example `data` object (what "Send test" delivers).
+         */
+        get: operations["WebhooksController_waitlist_workspace_listEventTypes"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/{workspace_id}/webhooks/events": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List webhook events, newest first (kept for 30 days).
+         * @description Every event logged while at least one endpoint existed, with the latest state per endpoint and when the next retry is due.
+         */
+        get: operations["WebhooksController_waitlist_workspace_listEvents"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/{workspace_id}/webhooks/events/{event_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get one webhook event with every delivery attempt. */
+        get: operations["WebhooksController_waitlist_workspace_getEvent"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/{workspace_id}/webhooks/events/{event_id}/replay": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Send a logged event again, to its endpoints or to one endpoint.
+         * @description Same body and `webhook-id`, freshly signed, to every switched-on endpoint that receives this event type now, or only to `endpoint_id`. Waits for the receivers (up to 15 s each) and returns the attempts. A success cancels a retry still queued for that endpoint.
+         */
+        post: operations["WebhooksController_waitlist_workspace_replay"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/workspaces/{workspace_id}/webhooks/{id}": {
         parameters: {
             query?: never;
@@ -328,15 +575,27 @@ interface paths {
             path?: never;
             cookie?: never;
         };
-        /** Get a webhook (secret masked) */
+        /**
+         * Get a webhook (secret masked)
+         * @deprecated
+         * @description Deprecated: use `/v1/workspaces/{workspace_id}/webhooks/endpoints` (event descriptions, Send test that reports the result, event log, replay, rotation with a grace period). Responses carry `Deprecation: true` and `Sunset: Fri, 15 Jan 2027 00:00:00 GMT`.
+         */
         get: operations["WebhookController_get"];
         put?: never;
         post?: never;
-        /** Delete a webhook */
+        /**
+         * Delete a webhook
+         * @deprecated
+         * @description Deprecated: use `/v1/workspaces/{workspace_id}/webhooks/endpoints` (event descriptions, Send test that reports the result, event log, replay, rotation with a grace period). Responses carry `Deprecation: true` and `Sunset: Fri, 15 Jan 2027 00:00:00 GMT`.
+         */
         delete: operations["WebhookController_remove"];
         options?: never;
         head?: never;
-        /** Update url / events / active flag */
+        /**
+         * Update url / events / active flag. `active: true` also clears an automatic switch-off.
+         * @deprecated
+         * @description Deprecated: use `/v1/workspaces/{workspace_id}/webhooks/endpoints` (event descriptions, Send test that reports the result, event log, replay, rotation with a grace period). Responses carry `Deprecation: true` and `Sunset: Fri, 15 Jan 2027 00:00:00 GMT`.
+         */
         patch: operations["WebhookController_update"];
         trace?: never;
     };
@@ -347,7 +606,11 @@ interface paths {
             path?: never;
             cookie?: never;
         };
-        /** Recent delivery attempts for a webhook (default 50, max 200, newest first) */
+        /**
+         * Delivery attempts for a webhook, newest first, cursor-paginated (default 50, max 200)
+         * @deprecated
+         * @description Deprecated: use `/v1/workspaces/{workspace_id}/webhooks/endpoints` (event descriptions, Send test that reports the result, event log, replay, rotation with a grace period). Responses carry `Deprecation: true` and `Sunset: Fri, 15 Jan 2027 00:00:00 GMT`.
+         */
         get: operations["WebhookController_recentDeliveries"];
         put?: never;
         post?: never;
@@ -366,7 +629,11 @@ interface paths {
         };
         get?: never;
         put?: never;
-        /** Rotate the signing secret. Returns the new secret in clear EXACTLY ONCE. */
+        /**
+         * Rotate the signing secret. Returns the new secret in clear EXACTLY ONCE; the old one stops at once.
+         * @deprecated
+         * @description Deprecated: use `/v1/workspaces/{workspace_id}/webhooks/endpoints` (event descriptions, Send test that reports the result, event log, replay, rotation with a grace period). Responses carry `Deprecation: true` and `Sunset: Fri, 15 Jan 2027 00:00:00 GMT`.
+         */
         post: operations["WebhookController_rotateSecret"];
         delete?: never;
         options?: never;
@@ -383,7 +650,11 @@ interface paths {
         };
         get?: never;
         put?: never;
-        /** Fire a synthetic test event to this webhook (asynchronous; check the destination logs) */
+        /**
+         * Send the example of an event to this webhook; the attempt shows in `/deliveries`
+         * @deprecated
+         * @description Deprecated: use `/v1/workspaces/{workspace_id}/webhooks/endpoints` (event descriptions, Send test that reports the result, event log, replay, rotation with a grace period). Responses carry `Deprecation: true` and `Sunset: Fri, 15 Jan 2027 00:00:00 GMT`.
+         */
         post: operations["WebhookController_fireTest"];
         delete?: never;
         options?: never;
@@ -394,6 +665,38 @@ interface paths {
 }
 interface components {
     schemas: {
+        AnalyticsTimelinePointDto: {
+            /** @description Signups on that day (0 for gap days). */
+            count: number;
+            /**
+             * @description UTC day, `YYYY-MM-DD`.
+             * @example 2026-08-01
+             */
+            date: string;
+        };
+        AnalyticsTimelineResponseDto: {
+            /** @enum {string} */
+            granularity: "day";
+            /** @description Oldest first; every day in [since, until) is present. */
+            points: components["schemas"]["AnalyticsTimelinePointDto"][];
+        };
+        AnalyticsTopReferralDto: {
+            /** @description `position - referral_count * referral_boost`, floored at 1. */
+            effective_position: number;
+            email: string;
+            /** Format: uuid */
+            id: string;
+            name: string;
+            /** @description Immutable signup position. */
+            position: number;
+            referral_code: string;
+            referral_count: number;
+        };
+        AnalyticsTopReferrerDto: {
+            count: number;
+            /** @description Free-text referrer value; null groups entries without one. */
+            referrer: string | null;
+        };
         BulkEntryActionDto: {
             /**
              * @description Action to apply to every id.
@@ -420,6 +723,25 @@ interface components {
              */
             send_email: boolean;
         };
+        BulkEntryActionResponseDto: {
+            failed: number;
+            /** @description Number of unique ids processed (after de-dupe). */
+            requested: number;
+            results: components["schemas"]["BulkEntryResultDto"][];
+            succeeded: number;
+        };
+        BulkEntryErrorDto: {
+            /** @description HTTP-style status code for the per-row failure. */
+            code: number;
+            message: string;
+        };
+        BulkEntryResultDto: {
+            error?: components["schemas"]["BulkEntryErrorDto"];
+            /** Format: uuid */
+            id: string;
+            /** @enum {string} */
+            status: "ok" | "error";
+        };
         CreateEntryDto: {
             /**
              * @description Email address
@@ -435,7 +757,7 @@ interface components {
              * @example Ada Lovelace
              */
             name: string;
-            /** @description reCAPTCHA v3 token; verified server-side when the waitlist has settings.recaptcha_site_key */
+            /** @description reCAPTCHA v3 token, created with the action `waitlist_signup`. Required when the waitlist has a reCAPTCHA site key; verified server-side with the secret key saved on the waitlist. */
             recaptcha_token?: string;
             /** @description Referral code from a prior signup; bumps that signup’s position when honoured */
             referral_code?: string;
@@ -447,6 +769,23 @@ interface components {
              */
             variant_id?: string;
         };
+        CreateTestEntryDto: {
+            /**
+             * @description Name on the test entry. Defaults to "Test signup".
+             * @example Test signup
+             */
+            name?: string;
+            /**
+             * @description Send the welcome email for this entry. It goes to the entry's mailbox-simulator address, which accepts it without delivering to a real inbox. Default `false`.
+             * @default false
+             */
+            send_welcome_email: boolean;
+            /**
+             * @description Send `entry.created` (and `entry.approved` when the waitlist auto-approves) to your webhook endpoints for this entry. The payload carries `is_test: true`. Default `false`.
+             * @default false
+             */
+            trigger_webhooks: boolean;
+        };
         CreateVariantDto: {
             /** @default true */
             active: boolean;
@@ -466,6 +805,15 @@ interface components {
             weight: number;
         };
         CreateWaitlistDto: {
+            /**
+             * @description Web origins (scheme and host, for example `https://acme.com` or `http://localhost:3000`) that browsers may submit public sign-ups from. `https://*.acme.com` matches any subdomain. An empty list means any origin. A browser request from another origin gets 403 `ORIGIN_NOT_ALLOWED`; server-side calls without an `Origin` header are not checked. Entries are normalised (lower case, no trailing slash, default port dropped).
+             * @default []
+             * @example [
+             *       "https://acme.com",
+             *       "https://*.acme.com"
+             *     ]
+             */
+            allowed_origins: string[];
             /** @description Description returned in the public waitlist payload — customer frontends typically render it under the display name on their signup form. */
             description?: string;
             /**
@@ -473,13 +821,19 @@ interface components {
              * @example Early Access Program
              */
             display_name: string;
-            /** @description Waitlist settings (max_entries, approval_required, custom_fields, confirmation_message, referral_boost) */
+            /** @description Waitlist settings (max_entries, approval_required, custom_fields, confirmation_message, referral_boost, referral_rewards, recaptcha_site_key). To turn on reCAPTCHA v3, send recaptcha_site_key together with recaptcha_secret_key (both from your reCAPTCHA admin console); the secret is stored encrypted and is never returned. Send recaptcha_site_key: null to turn it off. */
             settings?: Record<string, never>;
             /**
              * @description URL-safe slug
              * @example early-access
              */
             slug: string;
+            /**
+             * @description Start state. `active` accepts public sign-ups straight away; `draft` (the default) refuses them with 422 until the status is changed to `active`.
+             * @default draft
+             * @enum {string}
+             */
+            status: "draft" | "active";
         };
         CreateWebhookDto: {
             /** @description Disabled webhooks store events but never deliver */
@@ -495,6 +849,83 @@ interface components {
             /** @description Destination URL (must be https in prod) */
             url: string;
         };
+        CreateWebhookEndpointDto: {
+            /** @example Production receiver */
+            description?: string | null;
+            /**
+             * @description Create it switched off.
+             * @default true
+             */
+            enabled: boolean;
+            /**
+             * @description Event types from `GET …/webhooks/event-types`. Empty or omitted means every event, including types added later.
+             * @example [
+             *       "entry.created",
+             *       "entry.approved"
+             *     ]
+             */
+            event_types?: ("entry.created" | "entry.approved" | "entry.rejected")[];
+            /**
+             * Format: uri
+             * @description Where to send events: an absolute https:// URL on a public host.
+             * @example https://api.acme.com/webhooks
+             */
+            url: string;
+        };
+        EffectiveSenderDto: {
+            /**
+             * @description The From Waitlist emails go out with (a bare address or `Name <address>`); null when none is set, or when the workspace default could not be read (`verified: null`).
+             * @example Acme <hello@acme.com>
+             */
+            address: string | null;
+            /**
+             * @description The sender domain's live `verification_status` in Mail (`verified`, `pending`, `temporary_failure`, `failed`, …) in both modes, `deleted` when the domain behind the workspace default was removed, `not_found` for a custom sender domain that is gone (or receive-only), or null when unknown or there is no address. The shared `SenderDomainStatus` enum, the same in Mail and Auth.
+             * @example verified
+             */
+            domain_status: components["schemas"]["SenderDomainStatus"] | null;
+            /**
+             * @description `workspace`: the workspace default sender set in Mail. `custom`: the Waitlist sender domain + address.
+             * @example workspace
+             * @enum {string}
+             */
+            source: "workspace" | "custom";
+            /**
+             * @description Whether mail from this sender goes out right now, checked live in Mail (cached up to 60 seconds). null: not checked (your role cannot read Mail, or Mail did not answer).
+             * @example true
+             */
+            verified: boolean | null;
+        };
+        EmailSetupDto: {
+            /**
+             * @description Whether the sender domain and template names were checked against Mail on this read (results are cached for up to 60 seconds). `false` when Mail could not be asked, for example because the caller cannot read Mail domains or templates; nothing is reported missing on an unchecked item.
+             * @example true
+             */
+            mail_checked: boolean;
+            /**
+             * @description What is missing, in a fixed order. `not_enabled`: notifications are off. `no_sender_domain`: no sender domain is chosen, or the chosen one no longer exists in Mail (or is receive-only). `sender_domain_unverified`: the sender domain is not verified in Mail yet. `no_sender_address`: no From address is set. `no_template`: at least one email has no template, or its template was deleted in Mail; `missing_templates` says which. Empty when `state` is `ready`.
+             * @example [
+             *       "no_template"
+             *     ]
+             */
+            missing: ("not_enabled" | "no_sender_domain" | "sender_domain_unverified" | "no_sender_address" | "no_template")[];
+            /**
+             * @description The emails whose template is not set or no longer exists in Mail: `welcome` (on signup), `approved`, `rejected`.
+             * @example [
+             *       "welcome"
+             *     ]
+             */
+            missing_templates: ("welcome" | "approved" | "rejected")[];
+            /**
+             * @description `ready`: every piece is in place and emails go out. `incomplete`: notifications are on but something in `missing` stops some or all emails. `off`: notifications are off (`notifications_via_envoi = false`), so Waitlist sends no email and webhooks are the way to reach signups.
+             * @example incomplete
+             * @enum {string}
+             */
+            state: "ready" | "incomplete" | "off";
+        };
+        EntryCountResponseDto: {
+            /** @description Number of entries on the waitlist. Test entries are left out unless `include_test=true`. */
+            count: number;
+        };
         EntryListPaginationDto: {
             has_more: boolean;
             next_cursor: string | null;
@@ -510,8 +941,14 @@ interface components {
             interest: string | null;
             invited_at: string | null;
             invited_to_app_slug: string | null;
+            /**
+             * @description Made with "Add test signup". Test entries use a mailbox-simulator address and are left out of counts, analytics, exports and webhooks unless asked.
+             * @example false
+             */
+            is_test: boolean;
             metadata: Record<string, never>;
             name: string;
+            /** @description Place in the queue, from 1. Test entries have negative positions (-1, -2…) so they never take a real place. */
             position: number;
             referral_code: string;
             referral_count: number;
@@ -523,6 +960,23 @@ interface components {
             waitlist_id: string;
             workspace_id: string;
         };
+        ErrorResponseDto: {
+            /**
+             * @description Stable, machine-readable error code; branch on this, not on `message`. Always present. A route-specific code when the route defines one (e.g. `WEBHOOK_ENDPOINT_NOT_FOUND`, `SERVICE_NOT_ENABLED`), otherwise the generic code for the status: `BAD_REQUEST`, `VALIDATION_ERROR` (400 from request validation), `UNAUTHORIZED`, `FORBIDDEN`, `NOT_FOUND`, `CONFLICT`, `PAYLOAD_TOO_LARGE`, `UNPROCESSABLE_ENTITY`, `RATE_LIMITED`, `INTERNAL_SERVER_ERROR`, `SERVICE_UNAVAILABLE`.
+             * @example SERVICE_NOT_ENABLED
+             */
+            code: string;
+            /**
+             * @description Human-readable error message. May be a class-validator array on 400.
+             * @example Policy denies waitlist.read on pcft:workspace/7a0c2f7e-2b8d-4f7f-9a51-3f1f0e1f3c11
+             */
+            message: string | string[];
+            /**
+             * @description HTTP status code echoed in the body. Spelled `statusCode` (camelCase) in every ProductCraft API.
+             * @example 403
+             */
+            statusCode: number;
+        };
         InviteToAppDto: {
             /** @description Auth app slug to invite into; defaults to the workspace Waitlist settings default (`default_heimdall_app_slug`) */
             app_slug?: string;
@@ -532,23 +986,245 @@ interface components {
              */
             send_email: boolean;
         };
-        TestWebhookDto: {
+        InviteToAppResponseDto: {
+            /** @description The entry row after `invited_at` / `invited_to_app_slug` were stamped. */
+            entry: components["schemas"]["EntryResponseDto"];
+            /** @description Auth invite id created in the linked app. */
+            invite_id: string;
+            /** @description Invite acceptance URL, when the Auth app returned one. Baked into the approval email when send_email is enabled. */
+            invite_url?: string;
+        };
+        LegacyWebhookDeliveryAttemptDto: {
+            /** @description Which attempt this was for the event: 1 for the first delivery, then 2 to 7 for the automatic retries (1m, 5m, 30m, 2h, 6h and 24h after each failure). Retries keep the same `event_id`. A test or a replay is numbered in the same sequence. */
+            attempt_number: number;
+            /** Format: date-time */
+            attempted_at: string;
+            error_message: string | null;
+            /** @description Id of the event (`evt_…`), the same across retries. */
+            event_id: string;
+            /** @enum {string} */
+            event_type: "entry.created" | "entry.approved" | "entry.rejected";
+            /** Format: uuid */
+            id: string;
+            latency_ms: number | null;
+            response_body_truncated: string | null;
+            /** @description HTTP status from the destination; null when the request errored before a response. */
+            status_code: number | null;
+            /** Format: uuid */
+            webhook_id: string;
+        };
+        ListWebhookEndpointsResponseDto: {
+            data: components["schemas"]["WebhookEndpointDto"][];
+            /** @description Always one page (an endpoint limit applies). */
+            pagination: components["schemas"]["WebhookPaginationDto"];
+        };
+        ListWebhookEventTypesResponseDto: {
+            data: components["schemas"]["WebhookEventTypeDto"][];
+        };
+        ListWebhookEventsResponseDto: {
+            data: components["schemas"]["WebhookEventDto"][];
+            pagination: components["schemas"]["WebhookPaginationDto"];
+        };
+        NotificationTestResponseDto: {
             /**
-             * @description Event type to fire as a synthetic test
-             * @enum {string}
+             * @description The From it went out with.
+             * @example Acme <hello@acme.com>
              */
-            event: "entry.created" | "entry.approved" | "entry.rejected";
-            /** @description Waitlist UUID to reference in the synthetic payload. Defaults to a placeholder UUID when omitted. */
-            waitlist_id?: string;
+            from: string | null;
+            /**
+             * Format: uuid
+             * @description The Mail message id; look it up in Mail > Emails to follow delivery.
+             * @example 0d6c1c3e-5f2a-4b8e-9d17-3a4b5c6d7e8f
+             */
+            message_id: string | null;
+            /**
+             * @description The Mail template that was sent.
+             * @example waitlist-welcome
+             */
+            template_name: string;
+            /**
+             * Format: email
+             * @description Your own verified account address: tests only ever go to the person who asked.
+             * @example you@acme.com
+             */
+            to: string;
         };
-        UpdateEntryStatusDto: {
+        OriginNotAllowedErrorDto: {
             /**
-             * @description Target status
+             * @example ORIGIN_NOT_ALLOWED
              * @enum {string}
              */
-            status: "approved" | "rejected";
+            code: "ORIGIN_NOT_ALLOWED";
+            /** @example Sign-ups from https://evil.test are not allowed for this waitlist. Add the origin to the waitlist's allowed origins. */
+            message: string;
+            /**
+             * @description The `Origin` header the request carried.
+             * @example https://evil.test
+             */
+            origin: string;
+            /** @example 403 */
+            statusCode: number;
         };
-        UpdateSettingsDto: {
+        PaginationDto: {
+            /**
+             * @description True iff another page exists; if true, pass `next_cursor` on the next request.
+             * @example false
+             */
+            has_more: boolean;
+            /**
+             * @description Opaque cursor for the next page. `null` when no more pages are available.
+             * @example eyJwb3NpdGlvbiI6MjB9
+             */
+            next_cursor: string | null;
+        };
+        PublicEntryCreatedDto: {
+            /** Format: date-time */
+            created_at: string;
+            /** @description Visible position after applying the referral boost — "you would be #N if approved now". Equals `position` at signup time (no referrals yet), and always for a test sign-up. */
+            effective_position: number;
+            /** @description Normalised (lower-cased) email. */
+            email: string;
+            /**
+             * Format: uuid
+             * @description Entry id.
+             */
+            id: string;
+            /** @description `true` when the email is an Amazon SES mailbox-simulator address (`…@simulator.amazonses.com`). Such a sign-up is stored as a test entry: it is left out of counts, analytics, exports and webhooks, and only the welcome email (to the simulator) goes out. */
+            is_test: boolean;
+            name: string;
+            /** @description Immutable signup position (1-based order of signup). Negative for a test sign-up (`is_test: true`), which takes no place in line. */
+            position: number;
+            /** @description Referral code for this signup. Build your referral URL from it and pass it as `referral_code` on subsequent signups. */
+            referral_code: string;
+            /**
+             * @description `approved` when the waitlist auto-approves; `pending` when admin approval is required.
+             * @enum {string}
+             */
+            status: "pending" | "approved";
+        };
+        PublicLeaderboardEntryDto: {
+            /**
+             * @description Masked email, e.g. `a***@example.com`.
+             * @example a***@example.com
+             */
+            masked_email: string;
+            /** @description Signup position on the waitlist. */
+            position: number;
+            /** @description Number of honoured referrals. */
+            referral_count: number;
+        };
+        PublicReferralRewardMilestoneDto: {
+            /** @description Referral count that unlocks the reward. */
+            count: number;
+            /** @description Reward description shown to the signer-up. */
+            reward: string;
+        };
+        PublicReferralRewardsDto: {
+            /** @description Milestones sorted by count, ascending. Empty when the waitlist has no referral rewards configured. */
+            milestones: components["schemas"]["PublicReferralRewardMilestoneDto"][];
+        };
+        PublicWaitlistBrandDto: {
+            brand_logo_url: string | null;
+            brand_name: string | null;
+            /** @description Primary brand colour as #RRGGBB. */
+            primary_color: string | null;
+        };
+        PublicWaitlistCustomFieldDto: {
+            /** @description Stable field key. Submit values under this key in the entry `metadata` object. */
+            key: string;
+            /** @description Human-readable label for the field. */
+            label?: string;
+            /** @description Choices for select-style fields. */
+            options?: string[];
+            required?: boolean;
+            /** @description Field type hint (e.g. `text`, `select`). */
+            type?: string;
+        };
+        PublicWaitlistInfoDto: {
+            brand: components["schemas"]["PublicWaitlistBrandDto"];
+            /** @description Canonical workspace slug. When the request URL used a stale slug, compare with the URL slug and 301-redirect. */
+            canonical_workspace_slug: string;
+            /** @description Message to show after a successful signup. */
+            confirmation_message: string;
+            custom_fields: components["schemas"]["PublicWaitlistCustomFieldDto"][];
+            description: string | null;
+            /** @description Display name (active variant copy wins over the stored name). */
+            display_name: string;
+            /** @description reCAPTCHA v3 site key. When non-null, POST .../entries requires a `recaptcha_token` created with the action `waitlist_signup`. */
+            recaptcha_site_key: string | null;
+            referral_rewards: components["schemas"]["PublicReferralRewardsDto"];
+            /** @description Waitlist slug. */
+            slug: string;
+            /** @description Always `active` — non-active waitlists return 404. */
+            status: string;
+            /** @description Active A/B or locale variant served for this request; null when none configured. */
+            variant: components["schemas"]["PublicWaitlistVariantDto"] | null;
+            /** @description Workspace slug the request resolved against. */
+            workspace_slug: string;
+        };
+        PublicWaitlistVariantDto: {
+            /**
+             * Format: uuid
+             * @description Active variant id. Round-trip it as `variant_id` on POST .../entries to attribute the signup.
+             */
+            id: string;
+            /** @enum {string} */
+            kind: "ab" | "locale";
+            /** @description BCP-47 locale of the served copy. */
+            locale: string;
+        };
+        ReplayWebhookEventResponseDto: {
+            /** @description One attempt per endpoint it was sent to. */
+            attempts: components["schemas"]["WebhookDeliveryAttemptDto"][];
+            event_id: string;
+        };
+        RotateWebhookSecretDto: {
+            /**
+             * @description Hours the previous secret keeps signing too (0 ends it now).
+             * @default 24
+             */
+            grace_hours: number;
+        };
+        SendWebhookTestDto: {
+            /**
+             * @description Which event to send; its catalogue example is the `data`.
+             * @example entry.created
+             * @enum {string}
+             */
+            event_type: "entry.created" | "entry.approved" | "entry.rejected";
+        };
+        /** @enum {string} */
+        SenderDomainStatus: "not_started" | "pending" | "partially_verified" | "verified" | "temporary_failure" | "failed" | "disabled" | "deleted" | "not_found";
+        StatsSeriesPointDto: {
+            /**
+             * Format: date
+             * @description UTC calendar day.
+             * @example 2026-10-07
+             */
+            date: string;
+            /**
+             * @description Value for that day.
+             * @example 4
+             */
+            value: number;
+        };
+        TestWebhookDto: {
+            /**
+             * @description Event type to fire as a synthetic test
+             * @enum {string}
+             */
+            event: "entry.created" | "entry.approved" | "entry.rejected";
+            /** @description Accepted for older clients and ignored: the test delivers the event's example payload from `GET …/webhooks/event-types`. */
+            waitlist_id?: string;
+        };
+        UpdateEntryStatusDto: {
+            /**
+             * @description Target status
+             * @enum {string}
+             */
+            status: "approved" | "rejected";
+        };
+        UpdateSettingsDto: {
             /** @description Mail template name used for entry.approved notifications. Must already exist in the workspace template store. */
             approved_template_name?: string | null;
             /** @description Logo URL returned in the public waitlist payload. Customer frontends render it on their own signup form. */
@@ -557,16 +1233,25 @@ interface components {
             brand_name?: string;
             /** @description Auth consumer-app slug to invite approved entries into. null clears the link. */
             default_heimdall_app_slug?: string | null;
-            /** @description Verified sender address used as the From envelope on Waitlist notifications. Must belong to default_sender_domain_id. null clears the override. */
+            /**
+             * Format: email
+             * @description The From used when `sender_mode` is `custom` (kept, but unused, in `workspace` mode). Must belong to default_sender_domain_id. null clears it.
+             */
             default_sender_address?: string | null;
             /** @description Mail domain UUID to use as default sender for Waitlist notifications. null clears the override. */
             default_sender_domain_id?: string | null;
-            /** @description Route Waitlist notifications through the Mail service (workspace sender domain + per-event template selection) instead of staying silent. Requires default_sender_domain_id, default_sender_address, and a template name for every supported event. Default false; when off, Waitlist sends no notification emails and the customer is expected to handle email via the webhook lane. */
+            /** @description Route Waitlist notifications through the Mail service instead of staying silent. Needs a sender (the workspace default in `workspace` mode, or the custom domain + address) and a template for every event. Turning it on (from off) creates the default templates `waitlist-welcome`, `waitlist-approved` and `waitlist-rejected` in Mail for every empty slot, reusing a template that already has that name, with your own Mail access. Default false; when off, Waitlist sends no notification emails and the customer is expected to handle email via the webhook lane. */
             notifications_via_envoi?: boolean;
             /** @description Primary brand colour as #RRGGBB */
             primary_color?: string;
             /** @description Mail template name used for entry.rejected notifications. Must already exist in the workspace template store. */
             rejected_template_name?: string | null;
+            /**
+             * @description Where the From comes from. `workspace` (the default): the workspace default sender set in Mail, resolved at send time, so changing it in Mail changes it for every product. `custom`: `default_sender_domain_id` + `default_sender_address`. Sending `default_sender_address` without `sender_mode` sets `custom`; sending it as null sets `workspace`.
+             * @example workspace
+             * @enum {string}
+             */
+            sender_mode?: "workspace" | "custom";
             /** @description Mail template name used for entry.created notifications. Must already exist in the workspace template store. */
             welcome_template_name?: string | null;
         };
@@ -577,11 +1262,18 @@ interface components {
             weight?: number;
         };
         UpdateWaitlistDto: {
+            /**
+             * @description Web origins (scheme and host, for example `https://acme.com` or `http://localhost:3000`) that browsers may submit public sign-ups from. `https://*.acme.com` matches any subdomain. An empty list means any origin. A browser request from another origin gets 403 `ORIGIN_NOT_ALLOWED`; server-side calls without an `Origin` header are not checked. Entries are normalised (lower case, no trailing slash, default port dropped). Replaces the whole list; send `[]` to allow any origin again.
+             * @example [
+             *       "https://acme.com"
+             *     ]
+             */
+            allowed_origins?: string[];
             /** @description New description */
             description?: string;
             /** @description New display name */
             display_name?: string;
-            /** @description Updated settings (merged shallow) */
+            /** @description Updated settings, merged shallowly into the saved ones. Keys: max_entries, approval_required, custom_fields, confirmation_message, referral_boost, referral_rewards, recaptcha_site_key. To turn on reCAPTCHA v3, send recaptcha_site_key together with recaptcha_secret_key (both from your reCAPTCHA admin console); the secret is stored encrypted and is never returned. Send recaptcha_site_key: null to turn it off. */
             settings?: Record<string, never>;
         };
         UpdateWaitlistStatusDto: {
@@ -599,6 +1291,18 @@ interface components {
             /** @description New URL */
             url?: string;
         };
+        UpdateWebhookEndpointDto: {
+            description?: string | null;
+            /** @description Switch it on or off. Switching on also clears an automatic disable. */
+            enabled?: boolean;
+            /** @description Replaces the subscription. Event types from `GET …/webhooks/event-types`. Empty or omitted means every event, including types added later. */
+            event_types?: ("entry.created" | "entry.approved" | "entry.rejected")[];
+            /**
+             * Format: uri
+             * @example https://api.acme.com/webhooks
+             */
+            url?: string;
+        };
         VariantCopyDto: {
             confirmation_message?: string;
             description?: string;
@@ -606,6 +1310,7 @@ interface components {
         };
         VariantListResponseDto: {
             data: components["schemas"]["VariantResponseDto"][];
+            pagination: components["schemas"]["PaginationDto"];
         };
         VariantResponseDto: {
             active: boolean;
@@ -618,6 +1323,30 @@ interface components {
             waitlist_id: string;
             weight: number;
         };
+        WaitlistAnalyticsResponseDto: {
+            /**
+             * @description Entry counts keyed by status (`pending` / `approved` / `rejected`).
+             * @example {
+             *       "approved": 40,
+             *       "pending": 12,
+             *       "rejected": 3
+             *     }
+             */
+            by_status: {
+                [key: string]: number;
+            };
+            referred_count: number;
+            signups_this_month: number;
+            signups_this_week: number;
+            signups_today: number;
+            top_referrals: components["schemas"]["AnalyticsTopReferralDto"][];
+            top_referrers: components["schemas"]["AnalyticsTopReferrerDto"][];
+            total_entries: number;
+            /** @description referrals / total_entries — the K-factor proxy. 0 when no entries. */
+            viral_coefficient: number;
+            /** Format: uuid */
+            waitlist_id: string;
+        };
         WaitlistListPaginationDto: {
             has_more: boolean;
             next_cursor: string | null;
@@ -627,6 +1356,16 @@ interface components {
             pagination: components["schemas"]["WaitlistListPaginationDto"];
         };
         WaitlistResponseDto: {
+            /**
+             * @description Whether the public sign-up endpoint accepts entries right now (only an `active` waitlist does).
+             * @example false
+             */
+            accepting_signups: boolean;
+            /**
+             * @description Web origins (scheme and host, for example `https://acme.com` or `http://localhost:3000`) that browsers may submit public sign-ups from. `https://*.acme.com` matches any subdomain. An empty list means any origin. A browser request from another origin gets 403 `ORIGIN_NOT_ALLOWED`; server-side calls without an `Origin` header are not checked. Entries are normalised (lower case, no trailing slash, default port dropped).
+             * @example []
+             */
+            allowed_origins: string[];
             created_at: string;
             created_by: string;
             description: string | null;
@@ -635,8 +1374,13 @@ interface components {
             /** @example b1a4... */
             id: string;
             previous_workspace_slug: string | null;
-            /** @description Waitlist settings (max_entries, approval_required, custom_fields, confirmation_message, referral_boost). */
+            /** @description Waitlist settings (max_entries, approval_required, custom_fields, confirmation_message, referral_boost, referral_rewards, recaptcha_site_key). The reCAPTCHA secret key is never returned; recaptcha_secret_configured says whether one is saved. */
             settings: Record<string, never>;
+            /**
+             * @description Plain explanation when public sign-ups are refused, and how to open them; null when the waitlist is active.
+             * @example This waitlist is a draft, so public sign-ups are refused (422) until you change its status to active.
+             */
+            signups_note: string | null;
             /** @example early-access */
             slug: string;
             /** @enum {string} */
@@ -647,37 +1391,436 @@ interface components {
             /** @example acme */
             workspace_slug: string;
         };
+        WaitlistSettingsResponseDto: {
+            approved_template_name: string | null;
+            brand_logo_url: string | null;
+            brand_name: string | null;
+            /** @description Auth consumer-app slug approved entries are invited into. */
+            default_heimdall_app_slug: string | null;
+            /** @description The From used when `sender_mode` is `custom`. */
+            default_sender_address: string | null;
+            /**
+             * Format: uuid
+             * @description Mail domain UUID used as default sender for Waitlist notifications.
+             */
+            default_sender_domain_id: string | null;
+            /** @description The sender Waitlist emails actually go out from, with its live status in Mail. */
+            effective_sender: components["schemas"]["EffectiveSenderDto"];
+            /** @description Whether Waitlist emails can go out and, if not, what is missing. Computed on the server on every read. */
+            email_setup: components["schemas"]["EmailSetupDto"];
+            /** @description Whether Waitlist notifications are routed through the Mail service. */
+            notifications_via_envoi: boolean;
+            /** @description Primary brand colour as #RRGGBB */
+            primary_color: string | null;
+            rejected_template_name: string | null;
+            /**
+             * @description Where the From comes from: `workspace` (the workspace default sender set in Mail; the default) or `custom` (`default_sender_domain_id` + `default_sender_address`). Workspaces that had an address before this setting existed are `custom`.
+             * @example workspace
+             * @enum {string}
+             */
+            sender_mode: "workspace" | "custom";
+            /** @description Emails Waitlist did not send in the last 7 days because the setup was incomplete. */
+            skipped_sends: components["schemas"]["WaitlistSkippedEmailsDto"];
+            /**
+             * Format: date-time
+             * @description null when the workspace has no explicit settings row yet.
+             */
+            updated_at: string | null;
+            welcome_template_name: string | null;
+            /** Format: uuid */
+            workspace_id: string;
+        };
+        WaitlistSkippedEmailsDto: {
+            /**
+             * @description Emails not sent in the last 7 days because the setup was incomplete (`email_setup.missing`). Emails not sent because notifications are off are not counted.
+             * @example 3
+             */
+            count: number;
+            /**
+             * @deprecated
+             * @description The same number as `count`, under its old name. Read `count`.
+             * @example 3
+             */
+            last_7_days: number;
+            /**
+             * Format: date-time
+             * @description When the most recent counted email was skipped; null when none in the last 7 days.
+             */
+            last_at: string | null;
+        };
+        WaitlistStatsInWindowDto: {
+            /**
+             * @description Entries created in the requested window.
+             * @example 212
+             */
+            signups: number;
+        };
+        WaitlistStatsSeriesDto: {
+            /**
+             * @description Bucket width.
+             * @example day
+             * @enum {string}
+             */
+            granularity: "day";
+            /**
+             * @description New waitlist entries per UTC day across every waitlist in the workspace.
+             * @example signups
+             * @enum {string}
+             */
+            metric: "signups";
+            /** @description Dense and zero-filled: one point per UTC day in the window, oldest first, ending today. */
+            points: components["schemas"]["StatsSeriesPointDto"][];
+        };
+        WaitlistStatsTotalsDto: {
+            /**
+             * @description Entries across those waitlists, all time, in any status.
+             * @example 1380
+             */
+            entries: number;
+            /**
+             * @description Waitlists in the workspace, in any status.
+             * @example 2
+             */
+            waitlists: number;
+        };
+        WaitlistWorkspaceStatsDto: {
+            /**
+             * Format: date-time
+             * @description When these numbers were computed. Responses are cached for up to 60 seconds.
+             * @example 2026-10-07T09:00:00.000Z
+             */
+            generated_at: string;
+            /** @description Counts for the window. */
+            in_window: components["schemas"]["WaitlistStatsInWindowDto"];
+            /**
+             * Format: date-time
+             * @description Most recent signup on any of the workspace's waitlists. Null when there has never been one.
+             * @example 2026-10-07T08:41:12.000Z
+             */
+            last_activity_at: string | null;
+            /** @description Daily signups. */
+            series: components["schemas"]["WaitlistStatsSeriesDto"];
+            /** @description All-time counts. */
+            totals: components["schemas"]["WaitlistStatsTotalsDto"];
+            /**
+             * @description Window the counts cover.
+             * @example 30d
+             * @enum {string}
+             */
+            window: "1d" | "7d" | "30d";
+        };
         WebhookCreateResponseDto: {
+            /** @description Whether it receives events (`enabled` on the new routes). */
             active: boolean;
+            /** @description Set when it was switched off automatically after sustained failures. */
             auto_disabled_at: string | null;
             created_at: string;
+            /** @description Subscribed events (`event_types` on the new routes). */
             events: ("entry.created" | "entry.approved" | "entry.rejected")[];
+            /** @description Failed deliveries in a row (`consecutive_failures` on the new routes). */
             failure_count: number;
             first_failure_at: string | null;
             id: string;
+            /** @description When the latest attempt was made. */
             last_attempt_at: string | null;
+            /** @description HTTP status of the latest attempt. */
             last_status_code: number | null;
-            /** @description Plaintext signing secret returned EXACTLY ONCE on create + rotate. Persist immediately — it does not appear on subsequent GETs. */
+            /** @description The same secret as `signing_secret`, under the name older clients read. */
+            secret_one_time_reveal: string;
+            /** @description Always true: every webhook has a signing secret. */
+            secret_set?: boolean;
+            /** @description Plaintext signing secret (`whsec_…`), returned EXACTLY ONCE. Persist immediately; it does not appear on later reads. */
             signing_secret: string;
             url: string;
             workspace_id: string;
         };
+        WebhookDeliveryAttemptDto: {
+            /** @description 1 for the first delivery; retries and replays count up. */
+            attempt_number: number;
+            /** Format: date-time */
+            attempted_at: string;
+            /** Format: uuid */
+            endpoint_id: string;
+            /** @example request timed out */
+            error_message: string | null;
+            /** @example evt_3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f */
+            event_id: string;
+            /** @example user.created */
+            event_type: string;
+            /** Format: uuid */
+            id: string;
+            latency_ms: number | null;
+            /** @description The first 1 KiB of the response body. */
+            response_body: string | null;
+            /** @description HTTP status; null when no response came back. */
+            status_code: number | null;
+            /** @description True for a 2xx response. */
+            succeeded: boolean;
+            /**
+             * @description `automatic` (first delivery or a retry), `replay` or `test`.
+             * @enum {string}
+             */
+            trigger: "automatic" | "replay" | "test";
+            /**
+             * Format: uri
+             * @description Where it was sent.
+             */
+            url: string;
+        };
+        WebhookDeliveryListResponseDto: {
+            data: components["schemas"]["LegacyWebhookDeliveryAttemptDto"][];
+            pagination: components["schemas"]["PaginationDto"];
+        };
+        WebhookEndpointDto: {
+            /** @description Failed automatic deliveries in a row; a success resets it. */
+            consecutive_failures: number;
+            /** Format: date-time */
+            created_at: string;
+            /** @example Production receiver */
+            description: string | null;
+            /** Format: date-time */
+            disabled_at: string | null;
+            /** @enum {string|null} */
+            disabled_reason: "manual" | "failing" | null;
+            /** @description The on/off switch (`PATCH … { enabled }`). */
+            enabled: boolean;
+            /**
+             * @description Subscribed event types. Empty means every event, including types added later.
+             * @example []
+             */
+            event_types: string[];
+            /**
+             * Format: date-time
+             * @description Start of the current failure streak.
+             */
+            first_failure_at: string | null;
+            /** Format: uuid */
+            id: string;
+            /** @description True for endpoints carried over from the product's previous webhook system: they also receive the old signature header until its sunset date. */
+            legacy_signature: boolean;
+            /** @description True while the previous secret still signs too (after a rotation, for its grace period). */
+            prev_signing_secret_active: boolean;
+            /**
+             * Format: date-time
+             * @description Until then the previous secret signs too (after a rotation).
+             */
+            prev_signing_secret_expires_at: string | null;
+            /** @description Id of the owning workspace, app or community. */
+            scope_id: string;
+            /**
+             * @description What owns the endpoint: `workspace`, `app` or `community`.
+             * @example workspace
+             */
+            scope_type: string;
+            /**
+             * @description Last 4 characters of the signing secret.
+             * @example x9Q=
+             */
+            signing_secret_hint: string;
+            /**
+             * @description `enabled` receives events. `disabled` was switched off. `auto_disabled` was switched off after 20 failed deliveries in a row or 24 hours of failures; `PATCH { enabled: true }` turns it back on.
+             * @enum {string}
+             */
+            status: "enabled" | "disabled" | "auto_disabled";
+            /** Format: date-time */
+            updated_at: string;
+            /**
+             * Format: uri
+             * @example https://api.acme.com/webhooks
+             */
+            url: string;
+        };
+        WebhookEndpointWithSecretDto: {
+            /** @description Failed automatic deliveries in a row; a success resets it. */
+            consecutive_failures: number;
+            /** Format: date-time */
+            created_at: string;
+            /** @example Production receiver */
+            description: string | null;
+            /** Format: date-time */
+            disabled_at: string | null;
+            /** @enum {string|null} */
+            disabled_reason: "manual" | "failing" | null;
+            /** @description The on/off switch (`PATCH … { enabled }`). */
+            enabled: boolean;
+            /**
+             * @description Subscribed event types. Empty means every event, including types added later.
+             * @example []
+             */
+            event_types: string[];
+            /**
+             * Format: date-time
+             * @description Start of the current failure streak.
+             */
+            first_failure_at: string | null;
+            /** Format: uuid */
+            id: string;
+            /** @description True for endpoints carried over from the product's previous webhook system: they also receive the old signature header until its sunset date. */
+            legacy_signature: boolean;
+            /** @description True while the previous secret still signs too (after a rotation, for its grace period). */
+            prev_signing_secret_active: boolean;
+            /**
+             * Format: date-time
+             * @description Until then the previous secret signs too (after a rotation).
+             */
+            prev_signing_secret_expires_at: string | null;
+            /** @description Id of the owning workspace, app or community. */
+            scope_id: string;
+            /**
+             * @description What owns the endpoint: `workspace`, `app` or `community`.
+             * @example workspace
+             */
+            scope_type: string;
+            /**
+             * @description The signing secret, shown once: pass it unchanged to any Standard Webhooks verifier. Store it now; it cannot be shown again.
+             * @example whsec_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaSw
+             */
+            signing_secret: string;
+            /**
+             * @description Last 4 characters of the signing secret.
+             * @example x9Q=
+             */
+            signing_secret_hint: string;
+            /**
+             * @description `enabled` receives events. `disabled` was switched off. `auto_disabled` was switched off after 20 failed deliveries in a row or 24 hours of failures; `PATCH { enabled: true }` turns it back on.
+             * @enum {string}
+             */
+            status: "enabled" | "disabled" | "auto_disabled";
+            /** Format: date-time */
+            updated_at: string;
+            /**
+             * Format: uri
+             * @example https://api.acme.com/webhooks
+             */
+            url: string;
+        };
+        WebhookEventDeliveryDto: {
+            /** @description Number of the latest attempt; retries and replays count up. */
+            attempt_number: number;
+            /** Format: date-time */
+            attempted_at: string;
+            /** Format: uuid */
+            endpoint_id: string;
+            /**
+             * Format: date-time
+             * @description When the next automatic attempt is due; null when none is queued.
+             */
+            next_attempt_at: string | null;
+            status_code: number | null;
+            /** @description True when the latest attempt got a 2xx. */
+            succeeded: boolean;
+        };
+        WebhookEventDetailDto: {
+            /** @description Every attempt, newest first. */
+            attempts: components["schemas"]["WebhookDeliveryAttemptDto"][];
+            /** Format: date-time */
+            created_at: string;
+            /** @description Latest attempt per endpoint (an endpoint whose first attempt is still queued is not listed yet). */
+            deliveries: components["schemas"]["WebhookEventDeliveryDto"][];
+            /**
+             * @description Sent as `webhook-id`; the same on every retry and replay.
+             * @example evt_3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+             */
+            id: string;
+            /** @description The JSON body exactly as sent. */
+            payload: {
+                [key: string]: unknown;
+            };
+            /**
+             * @description `pending`: a delivery is queued. `failed`: the latest attempt to some endpoint failed and none is queued. `delivered`: every endpoint answered 2xx. `not_sent`: no endpoint subscribed.
+             * @enum {string}
+             */
+            status: "pending" | "delivered" | "failed" | "not_sent";
+            /** @description Made by "Send test". */
+            test: boolean;
+            /**
+             * @example entry.created
+             * @enum {string}
+             */
+            type: "entry.created" | "entry.approved" | "entry.rejected";
+        };
+        WebhookEventDto: {
+            /** Format: date-time */
+            created_at: string;
+            /** @description Latest attempt per endpoint (an endpoint whose first attempt is still queued is not listed yet). */
+            deliveries: components["schemas"]["WebhookEventDeliveryDto"][];
+            /**
+             * @description Sent as `webhook-id`; the same on every retry and replay.
+             * @example evt_3f0c3c1e-8a2b-4c55-9d3f-0a1b2c3d4e5f
+             */
+            id: string;
+            /** @description The JSON body exactly as sent. */
+            payload: {
+                [key: string]: unknown;
+            };
+            /**
+             * @description `pending`: a delivery is queued. `failed`: the latest attempt to some endpoint failed and none is queued. `delivered`: every endpoint answered 2xx. `not_sent`: no endpoint subscribed.
+             * @enum {string}
+             */
+            status: "pending" | "delivered" | "failed" | "not_sent";
+            /** @description Made by "Send test". */
+            test: boolean;
+            /**
+             * @example entry.created
+             * @enum {string}
+             */
+            type: "entry.created" | "entry.approved" | "entry.rejected";
+        };
+        WebhookEventTypeDto: {
+            /**
+             * @description Group shown in the event picker.
+             * @example Users
+             */
+            category: string;
+            /** @example A user signed up or was created by an admin. */
+            description: string;
+            /** @description An example `data` object; "Send test" delivers exactly this. */
+            example: {
+                [key: string]: unknown;
+            };
+            /**
+             * @example entry.created
+             * @enum {string}
+             */
+            type: "entry.created" | "entry.approved" | "entry.rejected";
+        };
         WebhookListResponseDto: {
             data: components["schemas"]["WebhookResponseDto"][];
+            pagination: components["schemas"]["PaginationDto"];
+        };
+        WebhookPaginationDto: {
+            /** @description Whether another page follows. */
+            has_more: boolean;
+            /** @description Pass as `cursor` to get the next page; null on the last page. */
+            next_cursor: string | null;
         };
         WebhookResponseDto: {
+            /** @description Whether it receives events (`enabled` on the new routes). */
             active: boolean;
+            /** @description Set when it was switched off automatically after sustained failures. */
             auto_disabled_at: string | null;
             created_at: string;
+            /** @description Subscribed events (`event_types` on the new routes). */
             events: ("entry.created" | "entry.approved" | "entry.rejected")[];
+            /** @description Failed deliveries in a row (`consecutive_failures` on the new routes). */
             failure_count: number;
             first_failure_at: string | null;
             id: string;
+            /** @description When the latest attempt was made. */
             last_attempt_at: string | null;
+            /** @description HTTP status of the latest attempt. */
             last_status_code: number | null;
+            /** @description Always true: every webhook has a signing secret. */
+            secret_set?: boolean;
             url: string;
             workspace_id: string;
         };
+        WebhookRotateSecretResponseDto: {
+            /** Format: uuid */
+            id: string;
+            /** @description New plaintext signing secret, returned EXACTLY ONCE. Persist immediately — it does not appear on subsequent GETs. */
+            secret: string;
+        };
     };
     responses: never;
     parameters: never;
@@ -706,14 +1849,18 @@ interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["PublicWaitlistInfoDto"];
+                };
             };
-            /** @description Waitlist not found or not active */
+            /** @description Code `WAITLIST_NOT_FOUND`: no such waitlist, not active, or its workspace was deleted. The answer is the same in every case. */
             404: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
         };
     };
@@ -733,47 +1880,68 @@ interface operations {
             };
         };
         responses: {
-            /** @description Entry created */
+            /** @description Entry created. Persist `referral_code` client-side to build the referral URL; `status` is `approved` when the waitlist auto-approves. A sign-up from an Amazon SES mailbox-simulator address (`…@simulator.amazonses.com`) is stored as a test entry (`is_test: true`, negative `position`), so test runs never land on the real list. */
             201: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["PublicEntryCreatedDto"];
+                };
             };
             /** @description Validation or spam check failed */
             400: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The request came from a web origin (`Origin` header) that is not on the waitlist's `allowed_origins` list. Requests without an `Origin` header (server-side calls) are not checked. A CORS preflight from such an origin gets the same 403. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["OriginNotAllowedErrorDto"];
+                };
             };
-            /** @description Waitlist not found */
+            /** @description Code `WAITLIST_NOT_FOUND`: no such waitlist, or its workspace was deleted. The answer is the same in both cases. */
             404: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
             /** @description Email already on this waitlist */
             409: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
             /** @description Waitlist is not active or is full */
             422: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
             /** @description Too many requests from this IP */
             429: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
         };
     };
@@ -797,14 +1965,71 @@ interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["PublicLeaderboardEntryDto"][];
+                };
             };
-            /** @description Waitlist not found or not active */
+            /** @description Code `WAITLIST_NOT_FOUND`: no such waitlist, not active, or its workspace was deleted. The answer is the same in every case. */
             404: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    WorkspaceStatsController_get: {
+        parameters: {
+            query?: {
+                /** @description Window for `in_window.signups` and the length of `series`, in UTC days ending today. */
+                window?: "1d" | "7d" | "30d";
+            };
+            header?: never;
+            path: {
+                /** @description Workspace id. */
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Waitlist stats. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WaitlistWorkspaceStatsDto"];
+                };
+            };
+            /** @description `window` is not one of 1d, 7d, 30d. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Caller lacks `waitlist.read` on the workspace, or Waitlist is not enabled on it (`SERVICE_NOT_ENABLED`). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Workspace not found: the id is unknown, is not a UUID, or is not visible to the caller. Same answer as the service's other workspace routes. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
         };
     };
@@ -819,26 +2044,41 @@ interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description Workspace Waitlist settings. */
+            /** @description Workspace Waitlist settings with the email setup state. */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["WaitlistSettingsResponseDto"];
+                };
+            };
+            /** @description No valid session or API key. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
             /** @description Caller lacks `waitlist.settings.read` on the workspace. */
             403: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
             /** @description Workspace does not exist or is not Waitlist-enabled. */
             404: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
         };
     };
@@ -857,33 +2097,158 @@ interface operations {
             };
         };
         responses: {
-            /** @description Updated workspace Waitlist settings. */
+            /** @description Updated workspace Waitlist settings with the email setup state. */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["WaitlistSettingsResponseDto"];
+                };
             };
             /** @description Validation failure on the patch body (per `UpdateSettingsDto`). */
             400: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description No valid session or API key. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
             /** @description Caller lacks `waitlist.settings.update` on the workspace. */
             403: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
             /** @description Workspace does not exist or is not Waitlist-enabled. */
             404: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    SettingsController_sendTest: {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description Stripe-style idempotency key. A retried request with the same key returns the first response instead of sending a second email. 24h TTL. */
+                "Idempotency-Key"?: string;
+            };
+            path: {
+                workspace_id: string;
+                /** @description The email to test. */
+                slot: "welcome" | "approved" | "rejected";
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Accepted by Mail and queued for delivery. */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["NotificationTestResponseDto"];
+                };
+            };
+            /** @description Unknown `slot`, or `workspaceId` is not a UUID. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description No valid session or API key. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Caller lacks `waitlist.settings.update`, or Mail refused the send for your role (you need Mail send access in this workspace). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Workspace not Waitlist-enabled, or the slot's template no longer exists in Mail. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Idempotency-Key reused with a different body (`IDEMPOTENCY_KEY_REUSE`). */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description `no_template`: the slot has no template. `no_sender_address`: custom sender mode with no address. */
+            412: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description `operator_email_unavailable`: the caller has no verified account email (API keys included). From Mail: `no_default_sender` (workspace mode and no default sender set in Mail), `from_domain_not_verified`, `domain_not_verified_by_provider`, a suppressed address, or a render failure. */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description More than 10 tests by you in the last hour (`RATE_LIMITED`), or over a Mail send limit. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description `MAIL_UNREACHABLE`: Mail did not answer. */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
         };
     };
@@ -942,26 +2307,32 @@ interface operations {
                     "application/json": components["schemas"]["WaitlistResponseDto"];
                 };
             };
-            /** @description Validation failure. */
+            /** @description Validation failure, including an `allowed_origins` entry that is not a plain origin. */
             400: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
             /** @description Caller lacks `waitlist.create`, or workspace has not enabled the `waitlist` service. */
             403: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
             /** @description Slug already taken in this workspace. */
             409: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
         };
     };
@@ -971,6 +2342,7 @@ interface operations {
             header?: never;
             path: {
                 id: string;
+                workspace_id: string;
             };
             cookie?: never;
         };
@@ -990,7 +2362,9 @@ interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
         };
     };
@@ -1000,6 +2374,7 @@ interface operations {
             header?: never;
             path: {
                 id: string;
+                workspace_id: string;
             };
             cookie?: never;
         };
@@ -1017,14 +2392,18 @@ interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
             /** @description Waitlist not found. */
             404: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
         };
     };
@@ -1034,6 +2413,7 @@ interface operations {
             header?: never;
             path: {
                 id: string;
+                workspace_id: string;
             };
             cookie?: never;
         };
@@ -1052,19 +2432,23 @@ interface operations {
                     "application/json": components["schemas"]["WaitlistResponseDto"];
                 };
             };
-            /** @description Validation failure. */
+            /** @description Validation failure, including an `allowed_origins` entry that is not a plain origin. */
             400: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
             /** @description Waitlist not found. */
             404: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
         };
     };
@@ -1074,6 +2458,7 @@ interface operations {
             header?: never;
             path: {
                 id: string;
+                workspace_id: string;
             };
             cookie?: never;
         };
@@ -1097,20 +2482,27 @@ interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
             /** @description Waitlist not found. */
             404: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
         };
     };
     AnalyticsController_get: {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description Count test entries ("Add test signup") too. Default `false`: they are left out. */
+                include_test?: boolean;
+            };
             header?: never;
             path: {
                 workspace_id: string;
@@ -1125,21 +2517,27 @@ interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["WaitlistAnalyticsResponseDto"];
+                };
             };
             /** @description Caller lacks `waitlist.read` on the workspace. */
             403: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
             /** @description Waitlist does not exist or is not in the path workspace. */
             404: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
         };
     };
@@ -1150,6 +2548,8 @@ interface operations {
                 since: string;
                 /** @description ISO-8601 exclusive end */
                 until: string;
+                /** @description Count test entries ("Add test signup") too. Default `false`: they are left out. */
+                include_test?: boolean;
             };
             header?: never;
             path: {
@@ -1165,28 +2565,36 @@ interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["AnalyticsTimelineResponseDto"];
+                };
             };
             /** @description `since` / `until` missing, malformed, or `until <= since`. */
             400: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
             /** @description Caller lacks `waitlist.read` on the workspace. */
             403: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
             /** @description Waitlist does not exist or is not in the path workspace. */
             404: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
         };
     };
@@ -1198,6 +2606,14 @@ interface operations {
                 cursor?: string;
                 /** @description Filter by status */
                 status?: string;
+                /** @description Case-insensitive substring match across the entry `email` OR `name`. Trimmed; blank means no filter. Composes (AND) with `status`, `since` and `until`. */
+                search?: string;
+                /** @description ISO-8601 inclusive lower bound on `created_at`. Malformed values are rejected with a 400. */
+                since?: string;
+                /** @description ISO-8601 exclusive upper bound on `created_at`. Must be after `since`. Malformed values are rejected with a 400. */
+                until?: string;
+                /** @description `true` lists only test entries ("Add test signup"), `false` only real ones. Omitted lists both; test entries come first (negative positions). */
+                is_test?: boolean;
             };
             header?: never;
             path: {
@@ -1217,19 +2633,32 @@ interface operations {
                     "application/json": components["schemas"]["EntryListResponseDto"];
                 };
             };
+            /** @description Invalid cursor, overlong `search`, malformed `since` / `until`, or `until <= since`. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
             /** @description Caller lacks `entry.read`, or workspace has not enabled the `waitlist` service. */
             403: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
             /** @description Waitlist not found in this workspace. */
             404: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
         };
     };
@@ -1254,34 +2683,45 @@ interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["BulkEntryActionResponseDto"];
+                };
             };
             /** @description Empty `ids`, more than 100 ids, or unknown action. */
             400: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
             /** @description Caller lacks `entry.update`. */
             403: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
             /** @description Waitlist not found. */
             404: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
         };
     };
     EntryController_count: {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description Count test entries ("Add test signup") too. Default `false`: they are left out. */
+                include_test?: boolean;
+            };
             header?: never;
             path: {
                 workspace_id: string;
@@ -1291,17 +2731,32 @@ interface operations {
         };
         requestBody?: never;
         responses: {
+            /** @description Entry count. */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
-            };
+                content: {
+                    "application/json": components["schemas"]["EntryCountResponseDto"];
+                };
+            };
+            /** @description Waitlist not found in this workspace. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     EntryController_exportCsv: {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description Count test entries ("Add test signup") too. Default `false`: they are left out. */
+                include_test?: boolean;
+            };
             header?: never;
             path: {
                 workspace_id: string;
@@ -1311,12 +2766,32 @@ interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description CSV stream */
+            /** @description text/csv stream — one header row + one row per entry. Content-Disposition: attachment. */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "text/csv": string;
+                };
+            };
+            /** @description Caller lacks `waitlist.export`. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Waitlist not found in this workspace. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
         };
     };
@@ -1347,7 +2822,9 @@ interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
         };
     };
@@ -1376,14 +2853,18 @@ interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
             /** @description Entry not found. */
             404: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
         };
     };
@@ -1418,232 +2899,1072 @@ interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
             /** @description Caller lacks `entry.update`. */
             403: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Entry not found in this waitlist. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    EntryController_inviteToApp: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspace_id: string;
+                waitlist_id: string;
+                entry_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["InviteToAppDto"];
+            };
+        };
+        responses: {
+            /** @description Invite created in Auth */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["InviteToAppResponseDto"];
+                };
+            };
+            /** @description No linked Auth app for this workspace */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    TestEntryController_create: {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description Idempotency key (24 h). A retry with the same key returns the first test entry instead of adding a second one. */
+                "Idempotency-Key"?: string;
+            };
+            path: {
+                workspace_id: string;
+                waitlist_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateTestEntryDto"];
+            };
+        };
+        responses: {
+            /** @description Test entry created. */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["EntryResponseDto"];
+                };
+            };
+            /** @description Validation failure. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Caller lacks `waitlist.update`, or workspace has not enabled the `waitlist` service. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Waitlist not found in this workspace. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Idempotency-Key reused with a different body. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The waitlist is closed. */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    VariantController_list: {
+        parameters: {
+            query?: {
+                /** @description Page size. Defaults to 20; values above 100 are clamped to 100. */
+                limit?: number;
+                /** @description Opaque cursor from the previous page's `pagination.next_cursor`. Omit for the first page. */
+                cursor?: string;
+            };
+            header?: never;
+            path: {
+                workspace_id: string;
+                waitlist_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Page of variants in (kind, locale, created_at) order with a pagination cursor. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["VariantListResponseDto"];
+                };
+            };
+            /** @description Invalid cursor. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Waitlist not found in this workspace */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    VariantController_create: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspace_id: string;
+                waitlist_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateVariantDto"];
+            };
+        };
+        responses: {
+            /** @description Variant created */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["VariantResponseDto"];
+                };
+            };
+            /** @description Validation failure */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Waitlist not found in this workspace */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    VariantController_remove: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspace_id: string;
+                waitlist_id: string;
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Variant deleted */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Variant not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    VariantController_update: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspace_id: string;
+                waitlist_id: string;
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UpdateVariantDto"];
+            };
+        };
+        responses: {
+            /** @description Variant updated */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["VariantResponseDto"];
+                };
+            };
+            /** @description Variant not found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    WebhookController_list: {
+        parameters: {
+            query?: {
+                /** @description Page size. Defaults to 20; values above 100 are clamped to 100. */
+                limit?: number;
+                /** @description Opaque cursor from the previous page's `pagination.next_cursor`. Omit for the first page. */
+                cursor?: string;
+            };
+            header?: never;
+            path: {
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Page of webhooks for the workspace. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WebhookListResponseDto"];
+                };
+            };
+            /** @description Invalid cursor. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    WebhookController_create: {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description Stripe-style idempotency key. The signing secret is returned exactly once; a retry without this header creates a second webhook + secret you never see the plaintext for. 24h TTL. */
+                "Idempotency-Key"?: string;
+            };
+            path: {
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateWebhookDto"];
+            };
+        };
+        responses: {
+            /** @description Webhook created. Includes plaintext `signing_secret` exactly once. */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WebhookCreateResponseDto"];
+                };
+            };
+            /** @description The workspace already has 10 webhooks. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    WebhooksController_waitlist_workspace_listEndpoints: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ListWebhookEndpointsResponseDto"];
+                };
+            };
+            /** @description The scope id in the path is malformed. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Missing or invalid bearer token. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Caller lacks `waitlist.webhook.read` (reads) or `waitlist.webhook.manage` (changes, Send test, replay), or Waitlist is not enabled for the workspace (`SERVICE_NOT_ENABLED`). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    WebhooksController_waitlist_workspace_createEndpoint: {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description Opaque client-generated string (1-256 chars, `[A-Za-z0-9_-:]`) that makes a retry of this request safe for 24 hours. The same key with a different body returns 409 `IDEMPOTENCY_KEY_REUSE`. */
+                "Idempotency-Key"?: string;
+            };
+            path: {
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateWebhookEndpointDto"];
+            };
+        };
+        responses: {
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WebhookEndpointWithSecretDto"];
+                };
+            };
+            /** @description Validation failure: URL not https with a public host, or an unknown event type (`WEBHOOK_EVENT_TYPE_UNKNOWN`). */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Missing or invalid bearer token. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Caller lacks `waitlist.webhook.read` (reads) or `waitlist.webhook.manage` (changes, Send test, replay), or Waitlist is not enabled for the workspace (`SERVICE_NOT_ENABLED`). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Already 10 endpoints (`WEBHOOK_ENDPOINT_LIMIT`), or Idempotency-Key reused with a different body (`IDEMPOTENCY_KEY_REUSE`). */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The URL points at a private, loopback or internal address. */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    WebhooksController_waitlist_workspace_getEndpoint: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspace_id: string;
+                endpoint_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WebhookEndpointDto"];
+                };
+            };
+            /** @description `endpoint_id` is not a UUID. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Missing or invalid bearer token. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Caller lacks `waitlist.webhook.read` (reads) or `waitlist.webhook.manage` (changes, Send test, replay), or Waitlist is not enabled for the workspace (`SERVICE_NOT_ENABLED`). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description No such endpoint here (`WEBHOOK_ENDPOINT_NOT_FOUND`). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    WebhooksController_waitlist_workspace_deleteEndpoint: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspace_id: string;
+                endpoint_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Deleted. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description `endpoint_id` is not a UUID. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Missing or invalid bearer token. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Caller lacks `waitlist.webhook.read` (reads) or `waitlist.webhook.manage` (changes, Send test, replay), or Waitlist is not enabled for the workspace (`SERVICE_NOT_ENABLED`). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description No such endpoint here (`WEBHOOK_ENDPOINT_NOT_FOUND`). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    WebhooksController_waitlist_workspace_updateEndpoint: {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description Opaque client-generated string (1-256 chars, `[A-Za-z0-9_-:]`) that makes a retry of this request safe for 24 hours. The same key with a different body returns 409 `IDEMPOTENCY_KEY_REUSE`. */
+                "Idempotency-Key"?: string;
+            };
+            path: {
+                workspace_id: string;
+                endpoint_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UpdateWebhookEndpointDto"];
+            };
+        };
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WebhookEndpointDto"];
+                };
+            };
+            /** @description Validation failure, or `endpoint_id` is not a UUID. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Missing or invalid bearer token. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Caller lacks `waitlist.webhook.read` (reads) or `waitlist.webhook.manage` (changes, Send test, replay), or Waitlist is not enabled for the workspace (`SERVICE_NOT_ENABLED`). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description No such endpoint here (`WEBHOOK_ENDPOINT_NOT_FOUND`). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Idempotency-Key reused with a different body (`IDEMPOTENCY_KEY_REUSE`). */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The new URL points at a private, loopback or internal address. */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    WebhooksController_waitlist_workspace_rotateSecret: {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description Opaque client-generated string (1-256 chars, `[A-Za-z0-9_-:]`) that makes a retry of this request safe for 24 hours. The same key with a different body returns 409 `IDEMPOTENCY_KEY_REUSE`. */
+                "Idempotency-Key"?: string;
+            };
+            path: {
+                workspace_id: string;
+                endpoint_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["RotateWebhookSecretDto"];
+            };
+        };
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WebhookEndpointWithSecretDto"];
+                };
+            };
+            /** @description `grace_hours` out of range, or `endpoint_id` is not a UUID. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Missing or invalid bearer token. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Caller lacks `waitlist.webhook.read` (reads) or `waitlist.webhook.manage` (changes, Send test, replay), or Waitlist is not enabled for the workspace (`SERVICE_NOT_ENABLED`). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description No such endpoint here (`WEBHOOK_ENDPOINT_NOT_FOUND`). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Idempotency-Key reused with a different body (`IDEMPOTENCY_KEY_REUSE`). */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    WebhooksController_waitlist_workspace_sendTest: {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description Opaque client-generated string (1-256 chars, `[A-Za-z0-9_-:]`) that makes a retry of this request safe for 24 hours. The same key with a different body returns 409 `IDEMPOTENCY_KEY_REUSE`. */
+                "Idempotency-Key"?: string;
+            };
+            path: {
+                workspace_id: string;
+                endpoint_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["SendWebhookTestDto"];
+            };
+        };
+        responses: {
+            /** @description The attempt, successful or not. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WebhookDeliveryAttemptDto"];
+                };
+            };
+            /** @description Unknown `event_type`, or `endpoint_id` is not a UUID. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Missing or invalid bearer token. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Caller lacks `waitlist.webhook.read` (reads) or `waitlist.webhook.manage` (changes, Send test, replay), or Waitlist is not enabled for the workspace (`SERVICE_NOT_ENABLED`). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description No such endpoint here (`WEBHOOK_ENDPOINT_NOT_FOUND`). */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
-            /** @description Entry not found in this waitlist. */
-            404: {
+            /** @description Idempotency-Key reused with a different body (`IDEMPOTENCY_KEY_REUSE`). */
+            409: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
         };
     };
-    EntryController_inviteToApp: {
+    WebhooksController_waitlist_workspace_listEventTypes: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 workspace_id: string;
-                waitlist_id: string;
-                entry_id: string;
             };
             cookie?: never;
         };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["InviteToAppDto"];
-            };
-        };
+        requestBody?: never;
         responses: {
-            /** @description Invite created in Auth */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ListWebhookEventTypesResponseDto"];
+                };
             };
-            /** @description No linked Auth app for this workspace */
-            422: {
+            /** @description Missing or invalid bearer token. */
+            401: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Caller lacks `waitlist.webhook.read` (reads) or `waitlist.webhook.manage` (changes, Send test, replay), or Waitlist is not enabled for the workspace (`SERVICE_NOT_ENABLED`). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
         };
     };
-    VariantController_list: {
+    WebhooksController_waitlist_workspace_listEvents: {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description Only these types. Repeat the parameter or comma-separate. */
+                type?: ("entry.created" | "entry.approved" | "entry.rejected")[];
+                /** @description Only events sent (or queued) to this endpoint. */
+                endpoint_id?: string;
+                status?: "pending" | "delivered" | "failed" | "not_sent";
+                /** @description Only events created at or after this instant. */
+                created_after?: string;
+                /** @description Only events created before this instant. */
+                created_before?: string;
+                limit?: number;
+                /** @description The previous page's `pagination.next_cursor`. */
+                cursor?: string;
+            };
             header?: never;
             path: {
                 workspace_id: string;
-                waitlist_id: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Bare array of variants */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["VariantListResponseDto"];
+                    "application/json": components["schemas"]["ListWebhookEventsResponseDto"];
                 };
             };
-        };
-    };
-    VariantController_create: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                workspace_id: string;
-                waitlist_id: string;
-            };
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["CreateVariantDto"];
-            };
-        };
-        responses: {
-            /** @description Variant created */
-            201: {
+            /** @description Invalid filter value or cursor. */
+            400: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["VariantResponseDto"];
+                    "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Validation failure */
-            400: {
+            /** @description Missing or invalid bearer token. */
+            401: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
-            /** @description Waitlist not found in this workspace */
-            404: {
+            /** @description Caller lacks `waitlist.webhook.read` (reads) or `waitlist.webhook.manage` (changes, Send test, replay), or Waitlist is not enabled for the workspace (`SERVICE_NOT_ENABLED`). */
+            403: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
         };
     };
-    VariantController_remove: {
+    WebhooksController_waitlist_workspace_getEvent: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 workspace_id: string;
-                waitlist_id: string;
-                id: string;
+                /** @description The event id, `evt_<uuid>`. */
+                event_id: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Variant deleted */
-            204: {
+            200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["WebhookEventDetailDto"];
+                };
             };
-            /** @description Variant not found */
-            404: {
+            /** @description `event_id` is not `evt_<uuid>`. */
+            400: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
-            };
-        };
-    };
-    VariantController_update: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                workspace_id: string;
-                waitlist_id: string;
-                id: string;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["UpdateVariantDto"];
+            /** @description Missing or invalid bearer token. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
-        };
-        responses: {
-            /** @description Variant updated */
-            200: {
+            /** @description Caller lacks `waitlist.webhook.read` (reads) or `waitlist.webhook.manage` (changes, Send test, replay), or Waitlist is not enabled for the workspace (`SERVICE_NOT_ENABLED`). */
+            403: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["VariantResponseDto"];
+                    "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Variant not found */
+            /** @description No such event here (`WEBHOOK_EVENT_NOT_FOUND`); events are kept for 30 days. */
             404: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
         };
     };
-    WebhookController_list: {
+    WebhooksController_waitlist_workspace_replay: {
         parameters: {
-            query?: never;
-            header?: never;
+            query?: {
+                /** @description Send to this endpoint only. */
+                endpoint_id?: string;
+            };
+            header?: {
+                /** @description Opaque client-generated string (1-256 chars, `[A-Za-z0-9_-:]`) that makes a retry of this request safe for 24 hours. The same key with a different body returns 409 `IDEMPOTENCY_KEY_REUSE`. */
+                "Idempotency-Key"?: string;
+            };
             path: {
                 workspace_id: string;
+                /** @description The event id, `evt_<uuid>`. */
+                event_id: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Webhooks for the workspace. */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["WebhookListResponseDto"];
+                    "application/json": components["schemas"]["ReplayWebhookEventResponseDto"];
                 };
             };
-        };
-    };
-    WebhookController_create: {
-        parameters: {
-            query?: never;
-            header?: {
-                /** @description Stripe-style idempotency key. The signing secret is returned exactly once; a retry without this header creates a second webhook + secret you never see the plaintext for. 24h TTL. */
-                "Idempotency-Key"?: string;
+            /** @description `event_id` is not `evt_<uuid>`, or `endpoint_id` is not a UUID. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
-            path: {
-                workspace_id: string;
+            /** @description Missing or invalid bearer token. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["CreateWebhookDto"];
+            /** @description Caller lacks `waitlist.webhook.read` (reads) or `waitlist.webhook.manage` (changes, Send test, replay), or Waitlist is not enabled for the workspace (`SERVICE_NOT_ENABLED`). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
-        };
-        responses: {
-            /** @description Webhook created. Includes plaintext `signing_secret` exactly once. */
-            201: {
+            /** @description No such event here (`WEBHOOK_EVENT_NOT_FOUND`); events are kept for 30 days. Or No such endpoint here (`WEBHOOK_ENDPOINT_NOT_FOUND`). */
+            404: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["WebhookCreateResponseDto"];
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description `endpoint_id` is switched off or does not receive this event type (`WEBHOOK_ENDPOINT_NOT_SUBSCRIBED`), or Idempotency-Key reused with a different body (`IDEMPOTENCY_KEY_REUSE`). */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
         };
@@ -1660,7 +3981,7 @@ interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description Webhook row. */
+            /** @description Webhook. */
             200: {
                 headers: {
                     [name: string]: unknown;
@@ -1669,12 +3990,23 @@ interface operations {
                     "application/json": components["schemas"]["WebhookResponseDto"];
                 };
             };
+            /** @description `id` is not a UUID. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
             /** @description Webhook not found. */
             404: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
         };
     };
@@ -1690,12 +4022,22 @@ interface operations {
         };
         requestBody?: never;
         responses: {
+            /** @description Deleted. */
             204: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content?: never;
             };
+            /** @description Webhook not found. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
     WebhookController_update: {
@@ -1714,17 +4056,36 @@ interface operations {
             };
         };
         responses: {
+            /** @description Updated webhook (secret masked). */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["WebhookResponseDto"];
+                };
+            };
+            /** @description Webhook not found. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
         };
     };
     WebhookController_recentDeliveries: {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description Page size. Defaults to 50; values above 200 are clamped to 200. */
+                limit?: number;
+                /** @description Opaque cursor from the previous page's `pagination.next_cursor`. Omit for the first page. */
+                cursor?: string;
+                /** @description `success` is a 2xx response; `failed` is everything else, including attempts that got no response at all (null `status_code`). Unrecognised values are rejected with a 400. */
+                status?: "success" | "failed";
+            };
             header?: never;
             path: {
                 workspace_id: string;
@@ -1734,12 +4095,32 @@ interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description `{ data: Array<{ id, event_id, event_type, attempt_number, status_code, response_body, error_message, latency_ms, created_at }> }` */
+            /** @description Delivery attempts, newest first. */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["WebhookDeliveryListResponseDto"];
+                };
+            };
+            /** @description Invalid cursor or unknown `status` filter. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Webhook not found. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
         };
     };
@@ -1755,11 +4136,23 @@ interface operations {
         };
         requestBody?: never;
         responses: {
+            /** @description Secret rotated. Includes the new plaintext secret exactly once. */
             201: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["WebhookRotateSecretResponseDto"];
+                };
+            };
+            /** @description Webhook not found. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
             };
         };
     };
@@ -1779,12 +4172,31 @@ interface operations {
             };
         };
         responses: {
+            /** @description Sent. Read the outcome from `/deliveries`. */
             202: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content?: never;
             };
+            /** @description Webhook not found. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The webhook is switched off. */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
         };
     };
 }