infrawrench-sdk 0.1.1

data/lib/infrawrench/client.rb

@@ -0,0 +1,4112 @@
+# frozen_string_literal: true
+
+# infrawrench-sdk v0.1.1 | MIT | Copyright (c) 2026 Infrawrench LLC
+# https://github.com/Infrawrench/Infrawrench
+#
+# Generated from the Infrawrench API OpenAPI 3.1 spec (API version 0.1.1).
+#
+# DO NOT EDIT. Regenerate with:
+#   pnpm --filter @infrawrench/web generate:sdk
+#
+# Internal routes are absent by construction: the generator consumes the same
+# published spec that /openapi.json serves, which drops every operation
+# marked x-internal.
+
+module Infrawrench
+  # `client.accounts.credentials`
+  class AccountsCredentialsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Fetch the decrypted credentials for an account
+    #
+    # Returns the credentials map as it was originally submitted. Sensitive —
+    # gate access carefully.
+    #
+    # _Requires permission: `secrets:read`._
+    #
+    # GET /api/org/{orgId}/accounts/{id}/credentials
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/accounts/{id}/credentials",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # Rotate the credentials an account uses to talk to the upstream provider
+    #
+    # Replaces the encrypted credentials blob in place. Used to swap a stale or
+    # narrowly-scoped token for a freshly-minted one without recreating the
+    # account (preserves existing resources, pins, dashboards, sync history).
+    #
+    # _Requires permission: `secrets:write`._
+    #
+    # PUT /api/org/{orgId}/accounts/{id}/credentials
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param body [Hash] Request body, shaped as `Hash`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def update(id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "PUT",
+        path: "/api/org/{orgId}/accounts/{id}/credentials",
+        path_params: { "orgId" => org_id, "id" => id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.accounts.sync_type`
+  class AccountsSyncTypeNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Sync a single resource type and return its resources
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # POST /api/org/{orgId}/accounts/{id}/sync-type/{typeId}
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 500: Server error
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param type_id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<Resource>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(id:, type_id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/accounts/{id}/sync-type/{typeId}",
+        path_params: { "orgId" => org_id, "id" => id, "typeId" => type_id },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.accounts`
+  class AccountsNamespace
+    # @return [AccountsCredentialsNamespace] `client.accounts.credentials`
+    attr_reader :credentials
+    # @return [AccountsSyncTypeNamespace] `client.accounts.sync_type`
+    attr_reader :sync_type
+
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+      @credentials = AccountsCredentialsNamespace.new(@transport)
+      @sync_type = AccountsSyncTypeNamespace.new(@transport)
+    end
+
+    # Create an account
+    #
+    # Stores encrypted credentials and triggers a first sync. `syncError` is set
+    # if the initial sync failed (the account row is still created).
+    #
+    # _Requires permission: `accounts:write`._
+    #
+    # POST /api/org/{orgId}/accounts
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `CreateAccountRequest & Hash`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `CreateAccountResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/accounts",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Delete an account
+    #
+    # _Requires permission: `accounts:delete`._
+    #
+    # DELETE /api/org/{orgId}/accounts/{id}
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/accounts/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # Account metadata + resource type list
+    #
+    # _Requires permission: `accounts:read`._
+    #
+    # GET /api/org/{orgId}/accounts/{id}/detail
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `AccountDetail` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def detail(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/accounts/{id}/detail",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # List accounts in this organization
+    #
+    # _Requires permission: `accounts:read`._
+    #
+    # GET /api/org/{orgId}/accounts
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<Account>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def list(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/accounts",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # List installed plugins and their credential fields
+    #
+    # _Requires permission: `accounts:read`._
+    #
+    # GET /api/org/{orgId}/accounts/plugins
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<PluginSummary>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def plugins(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/accounts/plugins",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # List cached resources for an account
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # GET /api/org/{orgId}/accounts/{id}/resources
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param top_level_only [String, nil] If `true`, only resources with no `parentResourceId`
+    #   are returned.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<Resource>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def resources(id:, org_id: nil, top_level_only: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/accounts/{id}/resources",
+        path_params: { "orgId" => org_id, "id" => id },
+        query: { "topLevelOnly" => top_level_only },
+        request_options: request_options
+      )
+    end
+
+    # Sync all resource types for an account
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # POST /api/org/{orgId}/accounts/{id}/sync
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `SyncResponse` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def sync(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/accounts/{id}/sync",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # Update an account (rename and/or change bastion binding)
+    #
+    # _Requires permission: `accounts:write`._
+    #
+    # PATCH /api/org/{orgId}/accounts/{id}
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param body [Hash] Request body, shaped as `UpdateAccountRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `UpdatedAccount` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def update(id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "PATCH",
+        path: "/api/org/{orgId}/accounts/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.agents.sessions`
+  class AgentsSessionsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Create an agent session
+    #
+    # _Requires permission: `resources:write`._
+    #
+    # POST /api/org/{orgId}/agents/sessions
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `CreateAgentSession`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `AgentSession` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/agents/sessions",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Delete an agent session and destroy its VM
+    #
+    # _Requires permission: `resources:delete`._
+    #
+    # DELETE /api/org/{orgId}/agents/sessions/{id}
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 502: The provider refused to delete the VM
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/agents/sessions/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # List agent sessions
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # GET /api/org/{orgId}/agents/sessions
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<AgentSession>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def list(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/agents/sessions",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Return the command and working directory for an agent session
+    #
+    # _Requires permission: `resources:execute`._
+    #
+    # POST /api/org/{orgId}/agents/sessions/{id}/open
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def open(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/agents/sessions/{id}/open",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # Return reconciliation branch metadata
+    #
+    # _Requires permission: `resources:execute`._
+    #
+    # POST /api/org/{orgId}/agents/sessions/{id}/reconcile
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def reconcile(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/agents/sessions/{id}/reconcile",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.agents.settings`
+  class AgentsSettingsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Get saved Agents defaults
+    #
+    # _Requires permission: `accounts:read`._
+    #
+    # GET /api/org/{orgId}/agents/settings
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash, nil] Parsed JSON, shaped as `AgentSettings` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/agents/settings",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Save Agents defaults
+    #
+    # _Requires permission: `accounts:write`._
+    #
+    # PUT /api/org/{orgId}/agents/settings
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `AgentSettings & Hash`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `AgentSettings & Hash` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def update(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "PUT",
+        path: "/api/org/{orgId}/agents/settings",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.agents`
+  class AgentsNamespace
+    # @return [AgentsSessionsNamespace] `client.agents.sessions`
+    attr_reader :sessions
+    # @return [AgentsSettingsNamespace] `client.agents.settings`
+    attr_reader :settings
+
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+      @sessions = AgentsSessionsNamespace.new(@transport)
+      @settings = AgentsSettingsNamespace.new(@transport)
+    end
+
+    # List accounts whose plugins can create agent VMs
+    #
+    # _Requires permission: `accounts:read`._
+    #
+    # GET /api/org/{orgId}/agents/accounts
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<AgentVmAccount>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def accounts(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/agents/accounts",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.api_keys`
+  class ApiKeysNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Create an API key (plaintext returned once)
+    #
+    # POST /api/org/{orgId}/api-keys
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `CreateApiKeyRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `CreatedApiKey` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/api-keys",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # List API keys (no plaintext)
+    #
+    # GET /api/org/{orgId}/api-keys
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<ApiKey>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def list(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/api-keys",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Revoke an API key
+    #
+    # POST /api/org/{orgId}/api-keys/{id}/revoke
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def revoke(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/api-keys/{id}/revoke",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # Rotate an API key (revokes old, returns new)
+    #
+    # POST /api/org/{orgId}/api-keys/{id}/rotate
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `CreatedApiKey` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def rotate(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/api-keys/{id}/rotate",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.artifacts`
+  class ArtifactsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # List artifact-registry items for a resource
+    #
+    # _Requires permission: `storage:read`._
+    #
+    # POST /api/org/{orgId}/artifacts/list
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 500: Server error
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `ArtifactsListRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `JsonObject` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def list(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/artifacts/list",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.associations`
+  class AssociationsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Wire one resource's output into another resource's secret field
+    #
+    # _Requires permission: `secrets:write`._
+    #
+    # POST /api/org/{orgId}/associations
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `AssociationRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/associations",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Set a secret field to a literal plaintext value
+    #
+    # _Requires permission: `secrets:write`._
+    #
+    # POST /api/org/{orgId}/associations/literal
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `LiteralAssociationRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def literal(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/associations/literal",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.audit_logs`
+  class AuditLogsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # List audit log entries (paginated, filterable)
+    #
+    # _Requires permission: `audit:read`._
+    #
+    # GET /api/org/{orgId}/audit-logs
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param page [Integer, nil]
+    # @param page_size [Integer, nil]
+    # @param action [String, nil]
+    # @param entity_type [String, nil]
+    # @param user_id [String, nil]
+    # @param from [String, nil]
+    # @param to [String, nil]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `AuditResponse` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(
+      org_id: nil,
+      page: nil,
+      page_size: nil,
+      action: nil,
+      entity_type: nil,
+      user_id: nil,
+      from: nil,
+      to: nil,
+      request_options: nil
+    )
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/audit-logs",
+        path_params: { "orgId" => org_id },
+        query: {
+          "page" => page,
+          "pageSize" => page_size,
+          "action" => action,
+          "entityType" => entity_type,
+          "userId" => user_id,
+          "from" => from,
+          "to" => to
+        },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.auth`
+  class AuthNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Current session + onboarding status
+    #
+    # GET /api/auth/me
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Session` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def me(request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/auth/me",
+        request_options: request_options
+      )
+    end
+
+    # Organizations the current user belongs to
+    #
+    # GET /api/auth/orgs
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<OrgMembership>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def orgs(request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/auth/orgs",
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.bastions`
+  class BastionsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Register a new bastion (returns the enrollment token once)
+    #
+    # _Requires permission: `bastions:write`._
+    #
+    # POST /api/org/{orgId}/bastions
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `CreateBastionRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `CreateBastionResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/bastions",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Revoke a bastion — accounts referencing it have their bastion binding
+    # cleared
+    #
+    # _Requires permission: `bastions:write`._
+    #
+    # DELETE /api/org/{orgId}/bastions/{id}
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/bastions/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # List bastion agents registered to this org
+    #
+    # _Requires permission: `bastions:read`._
+    #
+    # GET /api/org/{orgId}/bastions
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<Bastion>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def list(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/bastions",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.billing`
+  class BillingNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Start a Stripe Checkout session
+    #
+    # Rejected with 400 for complimentary organizations — they are never billed.
+    #
+    # _Requires permission: `billing:write`._
+    #
+    # POST /api/org/{orgId}/billing/checkout
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 500: Server error
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `StripeRedirectUrl` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def checkout(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/billing/checkout",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Get a Stripe customer portal URL
+    #
+    # _Requires permission: `billing:write`._
+    #
+    # POST /api/org/{orgId}/billing/portal
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `StripeRedirectUrl` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def portal(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/billing/portal",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Get the org's billing status (complimentary flag + subscription or `null`)
+    #
+    # _Requires permission: `billing:read`._
+    #
+    # GET /api/org/{orgId}/billing/status
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `BillingStatus` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def status(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/billing/status",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.budgets`
+  class BudgetsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Create a budget
+    #
+    # POST /api/org/{orgId}/budgets
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `BudgetInput`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `BudgetFull` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/budgets",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Delete a budget
+    #
+    # DELETE /api/org/{orgId}/budgets/{id}
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/budgets/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # Alert event history for a budget
+    #
+    # GET /api/org/{orgId}/budgets/{id}/events
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<BudgetAlertEvent>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def events(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/budgets/{id}/events",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # Get a budget with current-month status
+    #
+    # GET /api/org/{orgId}/budgets/{id}
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `BudgetFull` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/budgets/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # List budgets with current-month actuals and forecasts
+    #
+    # GET /api/org/{orgId}/budgets
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<BudgetWithStatus>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def list(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/budgets",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Update a budget
+    #
+    # PUT /api/org/{orgId}/budgets/{id}
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param body [Hash] Request body, shaped as `BudgetInput`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `BudgetFull` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def update(id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "PUT",
+        path: "/api/org/{orgId}/budgets/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.connect`
+  class ConnectNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Deploy env vars from a source resource to an SSH target
+    #
+    # _Requires permission: `resources:execute`._
+    #
+    # POST /api/org/{orgId}/connect/env-deploy
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `ConnectEnvDeployRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def env_deploy(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/connect/env-deploy",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Materialize source outputs as a secret in the target (e.g. K8s)
+    #
+    # _Requires permission: `resources:write`._
+    #
+    # POST /api/org/{orgId}/connect/secret-export
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `ConnectSecretExportRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def secret_export(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/connect/secret-export",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # List secret-export templates and target capabilities
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # POST /api/org/{orgId}/connect/templates
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `ConnectTemplatesRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `ConnectTemplatesResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def templates(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/connect/templates",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.costs`
+  class CostsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # List distinct values for a cost dimension
+    #
+    # Feeds the filter and group-by pickers. Pass dimension=tag-keys for tag
+    # keys; dimension=tag requires tagKey.
+    #
+    # GET /api/org/{orgId}/costs/dimensions
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param dimension [String]
+    # @param tag_key [String, nil]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `CostDimensionValues` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def dimensions(dimension:, org_id: nil, tag_key: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/costs/dimensions",
+        path_params: { "orgId" => org_id },
+        query: { "dimension" => dimension, "tagKey" => tag_key },
+        request_options: request_options
+      )
+    end
+
+    # Query aggregated cost series
+    #
+    # Aggregates collected provider spend into per-bucket, per-group series for
+    # cost graphs. Currencies are never merged; mixed-currency orgs get one
+    # series per currency. Optionally returns a previous-period comparison and a
+    # trend forecast.
+    #
+    # POST /api/org/{orgId}/costs/query
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `CostQueryRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `CostQueryResponse` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def query(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/costs/query",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Per-account cost collection status
+    #
+    # Which accounts support cost collection, whether their history backfill has
+    # completed, and the ingested date coverage.
+    #
+    # GET /api/org/{orgId}/costs/status
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def status(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/costs/status",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.dashboards.default`
+  class DashboardsDefaultNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Get-or-create the default dashboard with its pins
+    #
+    # _Requires permission: `dashboards:read`._
+    #
+    # GET /api/org/{orgId}/dashboards/default/full
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `DashboardWithPins` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def full(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/dashboards/default/full",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.dashboards.pin`
+  class DashboardsPinNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Pin a resource to a dashboard
+    #
+    # _Requires permission: `dashboards:write`._
+    #
+    # POST /api/org/{orgId}/dashboards/pin
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `PinRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/dashboards/pin",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Full enriched pin data + cached probe status
+    #
+    # _Requires permission: `dashboards:read`._
+    #
+    # GET /api/org/{orgId}/dashboards/pin/{pinId}
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param pin_id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `PinFull` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(pin_id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/dashboards/pin/{pinId}",
+        path_params: { "orgId" => org_id, "pinId" => pin_id },
+        request_options: request_options
+      )
+    end
+
+    # Historical metric series for a pinned resource
+    #
+    # Returns per-series metric points between fromMs and toMs. The backend
+    # auto-routes between raw, 1-minute, and 1-hour rollups based on span: ≤2h
+    # raw, ≤7d 1m, >7d 1h.
+    #
+    # GET /api/org/{orgId}/dashboards/pin/{pinId}/range
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param pin_id [String]
+    # @param from_ms [Integer, nil, nil]
+    # @param to_ms [Integer, nil, nil]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `PinRangeResponse` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def range(pin_id:, org_id: nil, from_ms: nil, to_ms: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/dashboards/pin/{pinId}/range",
+        path_params: { "orgId" => org_id, "pinId" => pin_id },
+        query: { "fromMs" => from_ms, "toMs" => to_ms },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.dashboards.widgets`
+  class DashboardsWidgetsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Add a cost-graph or budget widget to a dashboard
+    #
+    # POST /api/org/{orgId}/dashboards/widgets
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `CreateWidgetRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `DashboardWidgetFull` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/dashboards/widgets",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Remove a widget from a dashboard
+    #
+    # DELETE /api/org/{orgId}/dashboards/widgets/{widgetId}
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param widget_id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(widget_id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/dashboards/widgets/{widgetId}",
+        path_params: { "orgId" => org_id, "widgetId" => widget_id },
+        request_options: request_options
+      )
+    end
+
+    # Update a widget's title, config, or layout
+    #
+    # PATCH /api/org/{orgId}/dashboards/widgets/{widgetId}
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param widget_id [String]
+    # @param body [Hash] Request body, shaped as `UpdateWidgetRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `DashboardWidgetFull` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def update(widget_id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "PATCH",
+        path: "/api/org/{orgId}/dashboards/widgets/{widgetId}",
+        path_params: { "orgId" => org_id, "widgetId" => widget_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.dashboards`
+  class DashboardsNamespace
+    # @return [DashboardsDefaultNamespace] `client.dashboards.default`
+    attr_reader :default
+    # @return [DashboardsPinNamespace] `client.dashboards.pin`
+    attr_reader :pin
+    # @return [DashboardsWidgetsNamespace] `client.dashboards.widgets`
+    attr_reader :widgets
+
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+      @default = DashboardsDefaultNamespace.new(@transport)
+      @pin = DashboardsPinNamespace.new(@transport)
+      @widgets = DashboardsWidgetsNamespace.new(@transport)
+    end
+
+    # Create a dashboard
+    #
+    # _Requires permission: `dashboards:write`._
+    #
+    # POST /api/org/{orgId}/dashboards
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `Hash`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `DashboardFull` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/dashboards",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Delete a dashboard
+    #
+    # Cannot delete the default dashboard.
+    #
+    # _Requires permission: `dashboards:write`._
+    #
+    # DELETE /api/org/{orgId}/dashboards/{id}
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/dashboards/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # Get a dashboard with its pins
+    #
+    # _Requires permission: `dashboards:read`._
+    #
+    # GET /api/org/{orgId}/dashboards/{id}
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `DashboardWithPins` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/dashboards/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # List dashboards
+    #
+    # _Requires permission: `dashboards:read`._
+    #
+    # GET /api/org/{orgId}/dashboards
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<Dashboard>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def list(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/dashboards",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Read cached stats/metrics for dashboard cards
+    #
+    # _Requires permission: `dashboards:read`._
+    #
+    # POST /api/org/{orgId}/dashboards/probe
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `ProbeRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def probe(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/dashboards/probe",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Rename a dashboard
+    #
+    # _Requires permission: `dashboards:write`._
+    #
+    # POST /api/org/{orgId}/dashboards/{id}/rename
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param body [Hash] Request body, shaped as `Hash`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def rename(id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/dashboards/{id}/rename",
+        path_params: { "orgId" => org_id, "id" => id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Reorder dashboard cards
+    #
+    # Persists the order of a dashboard's grid. Pass `cards` to order resource
+    # pins, workflow pins, and widgets as one sequence; `resourceIds` orders
+    # resource pins alone.
+    #
+    # _Requires permission: `dashboards:write`._
+    #
+    # POST /api/org/{orgId}/dashboards/{id}/reorder
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param body [Hash] Request body, shaped as `ReorderRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def reorder(id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/dashboards/{id}/reorder",
+        path_params: { "orgId" => org_id, "id" => id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Unpin a resource
+    #
+    # _Requires permission: `dashboards:write`._
+    #
+    # POST /api/org/{orgId}/dashboards/unpin
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `UnpinRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def unpin(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/dashboards/unpin",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Validate workspace tab targets still exist
+    #
+    # _Requires permission: `dashboards:read`._
+    #
+    # POST /api/org/{orgId}/dashboards/validate-tabs
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `ValidateTabsRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `ValidateTabsResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def validate_tabs(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/dashboards/validate-tabs",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Pin a workflow's metrics to a dashboard
+    #
+    # POST /api/org/{orgId}/dashboards/workflow-pin
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `WorkflowPinRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def workflow_pin(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/dashboards/workflow-pin",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Unpin a workflow from a dashboard
+    #
+    # POST /api/org/{orgId}/dashboards/workflow-unpin
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `WorkflowPinRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def workflow_unpin(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/dashboards/workflow-unpin",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.docker`
+  class DockerNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Run a Docker daemon operation
+    #
+    # _Requires permission: `resources:execute`._
+    #
+    # POST /api/org/{orgId}/docker/command
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `DockerCommandRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `DockerCommandResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def command(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/docker/command",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.invitations.by_token`
+  class InvitationsByTokenNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Get invitation details by token
+    #
+    # GET /api/invitations/by-token/{token}
+    #
+    # Raises on 404: Not found
+    #
+    # @param token [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `InvitationDetail` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(token:, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/invitations/by-token/{token}",
+        path_params: { "token" => token },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.invitations`
+  class InvitationsNamespace
+    # @return [InvitationsByTokenNamespace] `client.invitations.by_token`
+    attr_reader :by_token
+
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+      @by_token = InvitationsByTokenNamespace.new(@transport)
+    end
+
+    # Accept an invitation
+    #
+    # POST /api/invitations/accept
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 403: Forbidden
+    #
+    # @param body [Hash] Request body, shaped as `AcceptInvitationRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `AcceptInvitationResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def accept(body:, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/invitations/accept",
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.kv`
+  class KvNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Run a Redis-style KV command
+    #
+    # _Requires permission: `resources:execute`._
+    #
+    # POST /api/org/{orgId}/kv/command
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `KvCommandRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `KvCommandResponse` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def command(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/kv/command",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.orgs`
+  class OrgsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Create a new organization
+    #
+    # The caller becomes the `owner` of the new organization.
+    #
+    # POST /api/orgs
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # @param body [Hash] Request body, shaped as `CreateOrgRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Organization` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(body:, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/orgs",
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.profile.email_change`
+  class ProfileEmailChangeNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Redeem an email change code
+    #
+    # On success the account's email is the new address and it is marked
+    # verified.
+    #
+    # POST /api/profile/email-change/confirm
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # Raises on 403: Recent sign-in required. Send the user through sign-in
+    # again and retry; the request itself was well-formed.
+    #
+    # @param body [Hash, nil] Request body, shaped as `Hash`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def confirm(body: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/profile/email-change/confirm",
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Send a confirmation code to a new email address
+    #
+    # Starts an email change. The code goes to the new address and the account
+    # keeps its current address until `/api/profile/email-change/confirm`
+    # redeems it, so an abandoned or mistyped change is harmless.
+    #
+    # POST /api/profile/email-change
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # Raises on 403: Recent sign-in required. Send the user through sign-in
+    # again and retry; the request itself was well-formed.
+    #
+    # @param body [Hash, nil] Request body, shaped as `Hash`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(body: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/profile/email-change",
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.profile.mfa`
+  class ProfileMfaNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Issue a fresh challenge for a factor
+    #
+    # POST /api/profile/mfa/{factorId}/challenge
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # Raises on 404: Not found
+    #
+    # @param factor_id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def challenge(factor_id:, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/profile/mfa/{factorId}/challenge",
+        path_params: { "factorId" => factor_id },
+        request_options: request_options
+      )
+    end
+
+    # Begin TOTP enrolment
+    #
+    # Creates the factor and a first challenge. The factor only becomes usable
+    # once a code is verified; abandon the flow by DELETEing the returned
+    # `factorId`.
+    #
+    # POST /api/profile/mfa
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # Raises on 403: Recent sign-in required. Send the user through sign-in
+    # again and retry; the request itself was well-formed.
+    #
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `TotpEnrollment` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/profile/mfa",
+        request_options: request_options
+      )
+    end
+
+    # Remove an authentication factor
+    #
+    # DELETE /api/profile/mfa/{factorId}
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # Raises on 403: Recent sign-in required. Send the user through sign-in
+    # again and retry; the request itself was well-formed.
+    #
+    # Raises on 404: Not found
+    #
+    # @param factor_id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(factor_id:, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/profile/mfa/{factorId}",
+        path_params: { "factorId" => factor_id },
+        request_options: request_options
+      )
+    end
+
+    # List enrolled authentication factors
+    #
+    # Includes factors whose enrolment was never confirmed — WorkOS does not
+    # expose a verified flag.
+    #
+    # GET /api/profile/mfa
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<AuthFactor>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def list(request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/profile/mfa",
+        request_options: request_options
+      )
+    end
+
+    # Verify a code against a challenge
+    #
+    # POST /api/profile/mfa/{factorId}/verify
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # Raises on 404: Not found
+    #
+    # @param factor_id [String]
+    # @param body [Hash, nil] Request body, shaped as `Hash`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def verify(factor_id:, body: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/profile/mfa/{factorId}/verify",
+        path_params: { "factorId" => factor_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.profile.sessions`
+  class ProfileSessionsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Revoke one session
+    #
+    # Refuses the session making the request — use sign-out for that.
+    #
+    # DELETE /api/profile/sessions/{sessionId}
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # Raises on 404: Not found
+    #
+    # @param session_id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(session_id:, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/profile/sessions/{sessionId}",
+        path_params: { "sessionId" => session_id },
+        request_options: request_options
+      )
+    end
+
+    # List the signed-in user's active sessions
+    #
+    # GET /api/profile/sessions
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<UserSession>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def list(request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/profile/sessions",
+        request_options: request_options
+      )
+    end
+
+    # Revoke every session except the current one
+    #
+    # POST /api/profile/sessions/revoke-others
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # Raises on 403: Recent sign-in required. Send the user through sign-in
+    # again and retry; the request itself was well-formed.
+    #
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def revoke_others(request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/profile/sessions/revoke-others",
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.profile`
+  class ProfileNamespace
+    # @return [ProfileEmailChangeNamespace] `client.profile.email_change`
+    attr_reader :email_change
+    # @return [ProfileMfaNamespace] `client.profile.mfa`
+    attr_reader :mfa
+    # @return [ProfileSessionsNamespace] `client.profile.sessions`
+    attr_reader :sessions
+
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+      @email_change = ProfileEmailChangeNamespace.new(@transport)
+      @mfa = ProfileMfaNamespace.new(@transport)
+      @sessions = ProfileSessionsNamespace.new(@transport)
+    end
+
+    # The signed-in user's account profile
+    #
+    # User-scoped, not organization-scoped: one WorkOS identity is shared across
+    # every organization the user belongs to.
+    #
+    # GET /api/profile
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Profile` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/profile",
+        request_options: request_options
+      )
+    end
+
+    # Mint a password reset link for the signed-in user
+    #
+    # Returns a one-time AuthKit-hosted reset URL rather than emailing it — the
+    # caller already holds a valid session for the account. Also the way to set
+    # a first password on an SSO or OAuth-only account.
+    #
+    # POST /api/profile/password-reset
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # Raises on 403: Recent sign-in required. Send the user through sign-in
+    # again and retry; the request itself was well-formed.
+    #
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def password_reset(request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/profile/password-reset",
+        request_options: request_options
+      )
+    end
+
+    # Re-send the email verification message
+    #
+    # POST /api/profile/send-verification-email
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def send_verification_email(request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/profile/send-verification-email",
+        request_options: request_options
+      )
+    end
+
+    # Update the signed-in user's name
+    #
+    # PATCH /api/profile
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 401: Unauthenticated
+    #
+    # @param body [Hash, nil] Request body, shaped as `Hash`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `ProfileSummary` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def update(body: nil, request_options: nil)
+      @transport.request(
+        http_method: "PATCH",
+        path: "/api/profile",
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.resources.manifest`
+  class ResourcesManifestNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Apply an edited manifest to a resource
+    #
+    # _Requires permission: `resources:write`._
+    #
+    # POST /api/org/{orgId}/resources/{pluginId}/{typeId}/manifest
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param plugin_id [String]
+    # @param type_id [String]
+    # @param body [Hash] Request body, shaped as `ApplyManifestRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(plugin_id:, type_id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/resources/{pluginId}/{typeId}/manifest",
+        path_params: { "orgId" => org_id, "pluginId" => plugin_id, "typeId" => type_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Fetch the raw manifest (YAML/JSON) for a resource
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # GET /api/org/{orgId}/resources/{pluginId}/{typeId}/manifest
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param plugin_id [String]
+    # @param type_id [String]
+    # @param resource_id [String]
+    # @param account_id [String]
+    # @param parent_resource_id [String, nil]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Manifest` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(
+      plugin_id:,
+      type_id:,
+      resource_id:,
+      account_id:,
+      org_id: nil,
+      parent_resource_id: nil,
+      request_options: nil
+    )
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/resources/{pluginId}/{typeId}/manifest",
+        path_params: { "orgId" => org_id, "pluginId" => plugin_id, "typeId" => type_id },
+        query: {
+          "resourceId" => resource_id,
+          "accountId" => account_id,
+          "parentResourceId" => parent_resource_id
+        },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.resources.secret_versions`
+  class ResourcesSecretVersionsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Reveal the plaintext value of a specific version (one-time)
+    #
+    # _Requires permission: `secrets:read`._
+    #
+    # POST /api/org/{orgId}/resources/{pluginId}/{typeId}/secret-versions/access
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param plugin_id [String]
+    # @param type_id [String]
+    # @param body [Hash] Request body, shaped as `SecretAccessRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `SecretAccessResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def access(plugin_id:, type_id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/resources/{pluginId}/{typeId}/secret-versions/access",
+        path_params: { "orgId" => org_id, "pluginId" => plugin_id, "typeId" => type_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Add a new secret version
+    #
+    # _Requires permission: `secrets:write`._
+    #
+    # POST /api/org/{orgId}/resources/{pluginId}/{typeId}/secret-versions/add
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param plugin_id [String]
+    # @param type_id [String]
+    # @param body [Hash] Request body, shaped as `SecretAddRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `SecretVersionResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def add(plugin_id:, type_id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/resources/{pluginId}/{typeId}/secret-versions/add",
+        path_params: { "orgId" => org_id, "pluginId" => plugin_id, "typeId" => type_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # List secret versions for a versioned-secret resource
+    #
+    # _Requires permission: `secrets:read`._
+    #
+    # GET /api/org/{orgId}/resources/{pluginId}/{typeId}/secret-versions
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param plugin_id [String]
+    # @param type_id [String]
+    # @param resource_id [String]
+    # @param account_id [String]
+    # @param parent_resource_id [String, nil]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `SecretVersionsResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def get(
+      plugin_id:,
+      type_id:,
+      resource_id:,
+      account_id:,
+      org_id: nil,
+      parent_resource_id: nil,
+      request_options: nil
+    )
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/resources/{pluginId}/{typeId}/secret-versions",
+        path_params: { "orgId" => org_id, "pluginId" => plugin_id, "typeId" => type_id },
+        query: {
+          "resourceId" => resource_id,
+          "accountId" => account_id,
+          "parentResourceId" => parent_resource_id
+        },
+        request_options: request_options
+      )
+    end
+
+    # Enable/disable/destroy a secret version
+    #
+    # _Requires permission: `secrets:write`._
+    #
+    # POST /api/org/{orgId}/resources/{pluginId}/{typeId}/secret-versions/modify
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param plugin_id [String]
+    # @param type_id [String]
+    # @param body [Hash] Request body, shaped as `SecretModifyRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `SecretVersionResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def modify(plugin_id:, type_id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/resources/{pluginId}/{typeId}/secret-versions/modify",
+        path_params: { "orgId" => org_id, "pluginId" => plugin_id, "typeId" => type_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.resources`
+  class ResourcesNamespace
+    # @return [ResourcesManifestNamespace] `client.resources.manifest`
+    attr_reader :manifest
+    # @return [ResourcesSecretVersionsNamespace] `client.resources.secret_versions`
+    attr_reader :secret_versions
+
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+      @manifest = ResourcesManifestNamespace.new(@transport)
+      @secret_versions = ResourcesSecretVersionsNamespace.new(@transport)
+    end
+
+    # Attach a resource onto another (e.g. disk → VM)
+    #
+    # _Requires permission: `resources:write`._
+    #
+    # POST /api/org/{orgId}/resources/attach
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `AttachRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def attach(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/resources/attach",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Create a new resource via its plugin
+    #
+    # _Requires permission: `resources:write`._
+    #
+    # POST /api/org/{orgId}/resources/create
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `CreateResourceRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `CreateResourceResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/resources/create",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Get the dynamic create form for a resource type
+    #
+    # Calls the plugin's `getCreateConfig`. The returned `CreateResourceConfig`
+    # is plugin-shaped — see `JsonObject`.
+    #
+    # _Requires permission: `resources:write`._
+    #
+    # POST /api/org/{orgId}/resources/create-config
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `CreateConfigRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `JsonObject` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create_config(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/resources/create-config",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Cost estimate for the current create form values
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # POST /api/org/{orgId}/resources/create-cost-estimate
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `CreateCostEstimateRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create_cost_estimate(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/resources/create-cost-estimate",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Pricing per size for a create form
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # POST /api/org/{orgId}/resources/create-pricing
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `CreatePricingRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create_pricing(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/resources/create-pricing",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Delete a resource via the plugin
+    #
+    # _Requires permission: `resources:delete`._
+    #
+    # DELETE /api/org/{orgId}/resources/{pluginId}/{typeId}
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param plugin_id [String]
+    # @param type_id [String]
+    # @param resource_id [String]
+    # @param account_id [String]
+    # @param parent_resource_id [String, nil]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(
+      plugin_id:,
+      type_id:,
+      resource_id:,
+      account_id:,
+      org_id: nil,
+      parent_resource_id: nil,
+      request_options: nil
+    )
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/resources/{pluginId}/{typeId}",
+        path_params: { "orgId" => org_id, "pluginId" => plugin_id, "typeId" => type_id },
+        query: {
+          "resourceId" => resource_id,
+          "accountId" => account_id,
+          "parentResourceId" => parent_resource_id
+        },
+        request_options: request_options
+      )
+    end
+
+    # Get human-readable describe text for a resource
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # POST /api/org/{orgId}/resources/{pluginId}/{typeId}/describe
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param plugin_id [String]
+    # @param type_id [String]
+    # @param body [Hash] Request body, shaped as `DescribeRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `DescribeResponse` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def describe(plugin_id:, type_id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/resources/{pluginId}/{typeId}/describe",
+        path_params: { "orgId" => org_id, "pluginId" => plugin_id, "typeId" => type_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Full resource detail page payload
+    #
+    # Performs a live `listResources` against the provider, falls back to DB on
+    # failure, and returns the plugin's `renderDetail` schema plus host-derived
+    # flags (SQL/KV/SSH availability, child resources, peer panes, etc).
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # GET /api/org/{orgId}/resources/{pluginId}/{typeId}/detail
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param plugin_id [String]
+    # @param type_id [String]
+    # @param resource_id [String]
+    # @param account_id [String, nil]
+    # @param parent_resource_id [String, nil]
+    # @param include_peer_panes [String, nil] Default true. If false, peer panes are returned as
+    #   stubs.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `ResourceDetail` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def detail(
+      plugin_id:,
+      type_id:,
+      resource_id:,
+      org_id: nil,
+      account_id: nil,
+      parent_resource_id: nil,
+      include_peer_panes: nil,
+      request_options: nil
+    )
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/resources/{pluginId}/{typeId}/detail",
+        path_params: { "orgId" => org_id, "pluginId" => plugin_id, "typeId" => type_id },
+        query: {
+          "resourceId" => resource_id,
+          "accountId" => account_id,
+          "parentResourceId" => parent_resource_id,
+          "includePeerPanes" => include_peer_panes
+        },
+        request_options: request_options
+      )
+    end
+
+    # Export a credential file for a resource (one-time reveal)
+    #
+    # _Requires permission: `secrets:read`._
+    #
+    # POST /api/org/{orgId}/resources/{pluginId}/{typeId}/export-credential
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param plugin_id [String]
+    # @param type_id [String]
+    # @param body [Hash] Request body, shaped as `ExportCredentialRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `CredentialExport` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def export_credential(plugin_id:, type_id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/resources/{pluginId}/{typeId}/export-credential",
+        path_params: { "orgId" => org_id, "pluginId" => plugin_id, "typeId" => type_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Execute an in-form field action (e.g. generate an IAM role)
+    #
+    # Calls the plugin's `executeFieldAction`. Returns `{ value }` to assign to
+    # the field; for `select` fields the optional `option` should be spliced
+    # into the options list so the new value can be displayed.
+    #
+    # POST /api/org/{orgId}/resources/field-action
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `FieldActionRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `FieldActionResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def field_action(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/resources/field-action",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Bulk-import resources from YAML (kubectl apply -f equivalent)
+    #
+    # _Requires permission: `resources:write`._
+    #
+    # POST /api/org/{orgId}/resources/{pluginId}/import-yaml
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param plugin_id [String]
+    # @param body [Hash] Request body, shaped as `ImportYamlRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `JsonObject` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def import_yaml(plugin_id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/resources/{pluginId}/import-yaml",
+        path_params: { "orgId" => org_id, "pluginId" => plugin_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Invoke a plugin-defined action on a resource
+    #
+    # _Requires permission: `resources:write`._
+    #
+    # POST /api/org/{orgId}/resources/invoke-action
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `InvokeActionRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def invoke_action(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/resources/invoke-action",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Fetch logs for a resource
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # POST /api/org/{orgId}/resources/{pluginId}/{typeId}/logs
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param plugin_id [String]
+    # @param type_id [String]
+    # @param body [Hash] Request body, shaped as `LogsRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `LogsResponse` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def logs(plugin_id:, type_id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/resources/{pluginId}/{typeId}/logs",
+        path_params: { "orgId" => org_id, "pluginId" => plugin_id, "typeId" => type_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Fetch metric series for a resource
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # POST /api/org/{orgId}/resources/{pluginId}/{typeId}/metrics
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param plugin_id [String]
+    # @param type_id [String]
+    # @param body [Hash] Request body, shaped as `MetricsRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `MetricsResponse` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def metrics(plugin_id:, type_id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/resources/{pluginId}/{typeId}/metrics",
+        path_params: { "orgId" => org_id, "pluginId" => plugin_id, "typeId" => type_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Run a NoSQL document-browser command (e.g. MongoDB shell)
+    #
+    # _Requires permission: `resources:execute`._
+    #
+    # POST /api/org/{orgId}/resources/nosql-command
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `NoSqlCommandRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def nosql_command(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/resources/nosql-command",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Lazy-fetch peer-integration panes for a resource
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # POST /api/org/{orgId}/resources/{pluginId}/{typeId}/peer-panes
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param plugin_id [String]
+    # @param type_id [String]
+    # @param body [Hash] Request body, shaped as `PeerPanesRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<PeerPane>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def peer_panes(plugin_id:, type_id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/resources/{pluginId}/{typeId}/peer-panes",
+        path_params: { "orgId" => org_id, "pluginId" => plugin_id, "typeId" => type_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Fetch options for a `resource-picker` field
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # POST /api/org/{orgId}/resources/picker-resources
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `PickerResourcesRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<PickerResource>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def picker_resources(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/resources/picker-resources",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Update a resource via its plugin
+    #
+    # Applies the supplied field changes upstream and persists the refreshed
+    # fields/display name to the DB. The body's `fields` map only carries the
+    # keys the caller actually changed.
+    #
+    # POST /api/org/{orgId}/resources/update
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `UpdateResourceRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `UpdateResourceResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def update(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/resources/update",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.search`
+  class SearchNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Search resources (capped at 50 hits) and workflows across the org
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # GET /api/org/{orgId}/search
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param q [String, nil]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<SearchHit>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def list(org_id: nil, q: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/search",
+        path_params: { "orgId" => org_id },
+        query: { "q" => q },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.sftp`
+  class SftpNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Delete a file or directory over SFTP
+    #
+    # _Requires permission: `storage:write`._
+    #
+    # POST /api/org/{orgId}/sftp/delete
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 500: Server error
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `SftpDeleteRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/sftp/delete",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Download one or many files via SFTP (zipped if more than one)
+    #
+    # _Requires permission: `storage:read`._
+    #
+    # GET /api/org/{orgId}/v1/sftp/download
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 500: Server error
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param account_id [String]
+    # @param paths [String] JSON-encoded array of remote paths
+    # @param base_path [String, nil]
+    # @param ssh_key_id [String, nil]
+    # @param ssh_host [String, nil]
+    # @param ssh_username [String, nil]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [String] Raw response bytes.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def download(
+      account_id:,
+      paths:,
+      org_id: nil,
+      base_path: nil,
+      ssh_key_id: nil,
+      ssh_host: nil,
+      ssh_username: nil,
+      request_options: nil
+    )
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/v1/sftp/download",
+        path_params: { "orgId" => org_id },
+        query: {
+          "accountId" => account_id,
+          "paths" => paths,
+          "basePath" => base_path,
+          "sshKeyId" => ssh_key_id,
+          "sshHost" => ssh_host,
+          "sshUsername" => ssh_username
+        },
+        accept: :binary,
+        request_options: request_options
+      )
+    end
+
+    # List a directory over SFTP
+    #
+    # _Requires permission: `storage:read`._
+    #
+    # POST /api/org/{orgId}/sftp/list
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 500: Server error
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `SftpListRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<SftpEntry>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def list(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/sftp/list",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Create a directory over SFTP
+    #
+    # _Requires permission: `storage:write`._
+    #
+    # POST /api/org/{orgId}/sftp/mkdir
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 500: Server error
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `SftpPathRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def mkdir(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/sftp/mkdir",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Upload a file via SFTP
+    #
+    # _Requires permission: `storage:write`._
+    #
+    # POST /api/org/{orgId}/v1/sftp/upload
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Sent as `multipart/form-data`; `file` carries the file bytes.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def upload(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/v1/sftp/upload",
+        path_params: { "orgId" => org_id },
+        form: body,
+        form_files: ["file"],
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.sql`
+  class SqlNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Dry-run cost estimate (e.g. BigQuery byte scan)
+    #
+    # _Requires permission: `resources:read`._
+    #
+    # POST /api/org/{orgId}/sql/estimate
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `SqlEstimateRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `JsonObject` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def estimate(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/sql/estimate",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Run an INSERT/UPDATE/DELETE/DDL statement
+    #
+    # _Requires permission: `resources:execute`._
+    #
+    # POST /api/org/{orgId}/sql/execute
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `SqlExecuteRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `SqlExecuteResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def execute(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/sql/execute",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Run a read-only SQL query
+    #
+    # Routes to the right driver: REST `executeQuery` (BigQuery, Databricks),
+    # per-resource SQL driver (Neon, Turso) or account-level SQL driver
+    # (Postgres, MySQL).
+    #
+    # _Requires permission: `resources:execute`._
+    #
+    # POST /api/org/{orgId}/sql/query
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `SqlQueryRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `SqlQueryResponse | JsonObject` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def query(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/sql/query",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.ssh_keys`
+  class SshKeysNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Generate a new Ed25519 keypair (private key returned once)
+    #
+    # _Requires permission: `ssh-keys:write`._
+    #
+    # POST /api/org/{orgId}/ssh-keys
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `GenerateSshKeyRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `GeneratedSshKey` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/ssh-keys",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Delete an SSH key (owner only)
+    #
+    # _Requires permission: `ssh-keys:write`._
+    #
+    # DELETE /api/org/{orgId}/ssh-keys/{id}
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/ssh-keys/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # Import an existing public key
+    #
+    # _Requires permission: `ssh-keys:write`._
+    #
+    # POST /api/org/{orgId}/ssh-keys/import
+    #
+    # Raises on 400: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `ImportSshKeyRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `ImportedSshKey` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def import(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/ssh-keys/import",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # List org SSH keys
+    #
+    # _Requires permission: `ssh-keys:read`._
+    #
+    # GET /api/org/{orgId}/ssh-keys
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<SshKey>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def list(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/ssh-keys",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.ssh_tunnels`
+  class SshTunnelsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # List active tunnels for this org
+    #
+    # _Requires permission: `resources:execute`._
+    #
+    # GET /api/org/{orgId}/ssh-tunnels/active
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def active(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/ssh-tunnels/active",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Close a tunnel by id
+    #
+    # _Requires permission: `resources:execute`._
+    #
+    # POST /api/org/{orgId}/ssh-tunnels/close
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `Hash`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def close(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/ssh-tunnels/close",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Create an account whose traffic is tunneled over SSH
+    #
+    # Verifies the SSH connection works before persisting.
+    #
+    # _Requires permission: `accounts:write`._
+    #
+    # POST /api/org/{orgId}/ssh-tunnels/create-account
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `SshTunnelCreateAccountRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `SshTunnelCreateAccountResponse` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create_account(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/ssh-tunnels/create-account",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Run a command over SSH using an org SSH key
+    #
+    # _Requires permission: `resources:execute`._
+    #
+    # POST /api/org/{orgId}/ssh-tunnels/exec
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `SshExecRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `SshExecResponse` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def exec(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/ssh-tunnels/exec",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Re-open the tunnel for an existing account
+    #
+    # _Requires permission: `resources:execute`._
+    #
+    # POST /api/org/{orgId}/ssh-tunnels/open
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `Hash`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Hash` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def open(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/ssh-tunnels/open",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.storage`
+  class StorageNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Delete a storage object
+    #
+    # _Requires permission: `storage:write`._
+    #
+    # POST /api/org/{orgId}/storage/delete
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `StoragePathRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/storage/delete",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Download one or many objects (zipped if more than one)
+    #
+    # _Requires permission: `storage:read`._
+    #
+    # GET /api/org/{orgId}/v1/storage/download
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 500: Server error
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param account_id [String]
+    # @param bucket [String]
+    # @param keys [String] JSON-encoded array of object keys, e.g. `["a.txt","b.txt"]`
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [String] Raw response bytes.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def download(account_id:, bucket:, keys:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/v1/storage/download",
+        path_params: { "orgId" => org_id },
+        query: { "accountId" => account_id, "bucket" => bucket, "keys" => keys },
+        accept: :binary,
+        request_options: request_options
+      )
+    end
+
+    # List objects in a bucket / prefix
+    #
+    # _Requires permission: `storage:read`._
+    #
+    # POST /api/org/{orgId}/storage/list
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `StorageListRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<StorageObject>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def list(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/storage/list",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Create a folder marker in a bucket
+    #
+    # _Requires permission: `storage:write`._
+    #
+    # POST /api/org/{orgId}/storage/mkdir
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `StoragePathRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def mkdir(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/storage/mkdir",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Upload a file to object storage
+    #
+    # Multipart/form-data. Plugin must implement `uploadStorageObject`.
+    #
+    # _Requires permission: `storage:write`._
+    #
+    # POST /api/org/{orgId}/v1/storage/upload
+    #
+    # Raises on 400: Bad request
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Sent as `multipart/form-data`; `file` carries the file bytes.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def upload(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/v1/storage/upload",
+        path_params: { "orgId" => org_id },
+        form: body,
+        form_files: ["file"],
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.team.invitations`
+  class TeamInvitationsNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Create an invitation (token valid for 7 days)
+    #
+    # _Requires permission: `team:invite`._
+    #
+    # POST /api/org/{orgId}/team/invitations
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `InviteRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `InviteResponse` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/team/invitations",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Revoke a pending invitation
+    #
+    # _Requires permission: `team:invite`._
+    #
+    # DELETE /api/org/{orgId}/team/invitations/{id}
+    #
+    # Raises on 404: Not found
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/team/invitations/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # List pending and historical invitations
+    #
+    # _Requires permission: `team:read`._
+    #
+    # GET /api/org/{orgId}/team/invitations
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<Invitation>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def list(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/team/invitations",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.team.members`
+  class TeamMembersNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Remove a member from the org
+    #
+    # _Requires permission: `team:remove`._
+    #
+    # DELETE /api/org/{orgId}/team/members/{id}
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/team/members/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # List org members
+    #
+    # _Requires permission: `team:read`._
+    #
+    # GET /api/org/{orgId}/team/members
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<OrgMember>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def list(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/team/members",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Change a member's role
+    #
+    # _Requires permission: `team:role:write`._
+    #
+    # PATCH /api/org/{orgId}/team/members/{id}/role
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param body [Hash] Request body, shaped as `RoleChangeRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def role(id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "PATCH",
+        path: "/api/org/{orgId}/team/members/{id}/role",
+        path_params: { "orgId" => org_id, "id" => id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.team.roles`
+  class TeamRolesNamespace
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+    end
+
+    # Create a custom role
+    #
+    # _Requires permission: `team:role:write`._
+    #
+    # POST /api/org/{orgId}/team/roles
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param body [Hash] Request body, shaped as `RoleCreateRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Role` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def create(body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "POST",
+        path: "/api/org/{orgId}/team/roles",
+        path_params: { "orgId" => org_id },
+        body: body,
+        request_options: request_options
+      )
+    end
+
+    # Delete a custom role (must have no members or pending invitations)
+    #
+    # _Requires permission: `team:role:write`._
+    #
+    # DELETE /api/org/{orgId}/team/roles/{id}
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 409: Conflict
+    #
+    # Raises on 422: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Ok` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def delete(id:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "DELETE",
+        path: "/api/org/{orgId}/team/roles/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        request_options: request_options
+      )
+    end
+
+    # List roles (system + custom)
+    #
+    # _Requires permission: `team:read`._
+    #
+    # GET /api/org/{orgId}/team/roles
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Array<Hash>] Parsed JSON, shaped as `Array<Role>` — see
+    #   `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def list(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/team/roles",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # Edit a custom role
+    #
+    # _Requires permission: `team:role:write`._
+    #
+    # PATCH /api/org/{orgId}/team/roles/{id}
+    #
+    # Raises on 404: Not found
+    #
+    # Raises on 422: Bad request
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param id [String]
+    # @param body [Hash] Request body, shaped as `RoleUpdateRequest`.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `Role` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def update(id:, body:, org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "PATCH",
+        path: "/api/org/{orgId}/team/roles/{id}",
+        path_params: { "orgId" => org_id, "id" => id },
+        body: body,
+        request_options: request_options
+      )
+    end
+  end
+
+  # `client.team`
+  class TeamNamespace
+    # @return [TeamInvitationsNamespace] `client.team.invitations`
+    attr_reader :invitations
+    # @return [TeamMembersNamespace] `client.team.members`
+    attr_reader :members
+    # @return [TeamRolesNamespace] `client.team.roles`
+    attr_reader :roles
+
+    # @api private
+    # @param transport [Transport]
+    def initialize(transport)
+      @transport = transport
+      @invitations = TeamInvitationsNamespace.new(@transport)
+      @members = TeamMembersNamespace.new(@transport)
+      @roles = TeamRolesNamespace.new(@transport)
+    end
+
+    # Current user's effective permissions and role
+    #
+    # GET /api/org/{orgId}/team/me
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `MeResponse` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def me(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/team/me",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+
+    # List all permission strings the server recognises
+    #
+    # _Requires permission: `team:read`._
+    #
+    # GET /api/org/{orgId}/team/permissions
+    #
+    # @param org_id [String, nil] Organization id. Defaults to the `org_id` the client was
+    #   constructed with.
+    # @param request_options [Hash, nil] Per-call `:headers`, `:timeout` and `:open_timeout`.
+    # @return [Hash] Parsed JSON, shaped as `PermissionCatalog` — see `sig/infrawrench/sdk.rbs`.
+    # @raise [Infrawrench::ApiError] On any non-2xx response.
+    def permissions(org_id: nil, request_options: nil)
+      @transport.request(
+        http_method: "GET",
+        path: "/api/org/{orgId}/team/permissions",
+        path_params: { "orgId" => org_id },
+        request_options: request_options
+      )
+    end
+  end
+
+  # A client for the Infrawrench API.
+  #
+  #     client = Infrawrench::APIV1Client.new(
+  #       api_key: ENV.fetch("INFRAWRENCH_API_KEY"),
+  #       org_id: ENV.fetch("INFRAWRENCH_ORG_ID")
+  #     )
+  #     client.accounts
+  #
+  class APIV1Client
+    # @return [Transport] Shared request plumbing. Reach for this only to
+    #   inspect the resolved base URL.
+    attr_reader :transport
+    # @return [AccountsNamespace] `client.accounts`
+    attr_reader :accounts
+    # @return [AgentsNamespace] `client.agents`
+    attr_reader :agents
+    # @return [ApiKeysNamespace] `client.api_keys`
+    attr_reader :api_keys
+    # @return [ArtifactsNamespace] `client.artifacts`
+    attr_reader :artifacts
+    # @return [AssociationsNamespace] `client.associations`
+    attr_reader :associations
+    # @return [AuditLogsNamespace] `client.audit_logs`
+    attr_reader :audit_logs
+    # @return [AuthNamespace] `client.auth`
+    attr_reader :auth
+    # @return [BastionsNamespace] `client.bastions`
+    attr_reader :bastions
+    # @return [BillingNamespace] `client.billing`
+    attr_reader :billing
+    # @return [BudgetsNamespace] `client.budgets`
+    attr_reader :budgets
+    # @return [ConnectNamespace] `client.connect`
+    attr_reader :connect
+    # @return [CostsNamespace] `client.costs`
+    attr_reader :costs
+    # @return [DashboardsNamespace] `client.dashboards`
+    attr_reader :dashboards
+    # @return [DockerNamespace] `client.docker`
+    attr_reader :docker
+    # @return [InvitationsNamespace] `client.invitations`
+    attr_reader :invitations
+    # @return [KvNamespace] `client.kv`
+    attr_reader :kv
+    # @return [OrgsNamespace] `client.orgs`
+    attr_reader :orgs
+    # @return [ProfileNamespace] `client.profile`
+    attr_reader :profile
+    # @return [ResourcesNamespace] `client.resources`
+    attr_reader :resources
+    # @return [SearchNamespace] `client.search`
+    attr_reader :search
+    # @return [SftpNamespace] `client.sftp`
+    attr_reader :sftp
+    # @return [SqlNamespace] `client.sql`
+    attr_reader :sql
+    # @return [SshKeysNamespace] `client.ssh_keys`
+    attr_reader :ssh_keys
+    # @return [SshTunnelsNamespace] `client.ssh_tunnels`
+    attr_reader :ssh_tunnels
+    # @return [StorageNamespace] `client.storage`
+    attr_reader :storage
+    # @return [TeamNamespace] `client.team`
+    attr_reader :team
+
+    # @param options [Hash] Client configuration — `:base_url`, `:api_key`,
+    #   `:org_id`, `:headers`, `:timeout`, `:open_timeout` and `:http_handler`.
+    #   See {Transport#initialize}, which owns the list.
+    def initialize(**options)
+      @transport = Transport.new(**options)
+      @accounts = AccountsNamespace.new(@transport)
+      @agents = AgentsNamespace.new(@transport)
+      @api_keys = ApiKeysNamespace.new(@transport)
+      @artifacts = ArtifactsNamespace.new(@transport)
+      @associations = AssociationsNamespace.new(@transport)
+      @audit_logs = AuditLogsNamespace.new(@transport)
+      @auth = AuthNamespace.new(@transport)
+      @bastions = BastionsNamespace.new(@transport)
+      @billing = BillingNamespace.new(@transport)
+      @budgets = BudgetsNamespace.new(@transport)
+      @connect = ConnectNamespace.new(@transport)
+      @costs = CostsNamespace.new(@transport)
+      @dashboards = DashboardsNamespace.new(@transport)
+      @docker = DockerNamespace.new(@transport)
+      @invitations = InvitationsNamespace.new(@transport)
+      @kv = KvNamespace.new(@transport)
+      @orgs = OrgsNamespace.new(@transport)
+      @profile = ProfileNamespace.new(@transport)
+      @resources = ResourcesNamespace.new(@transport)
+      @search = SearchNamespace.new(@transport)
+      @sftp = SftpNamespace.new(@transport)
+      @sql = SqlNamespace.new(@transport)
+      @ssh_keys = SshKeysNamespace.new(@transport)
+      @ssh_tunnels = SshTunnelsNamespace.new(@transport)
+      @storage = StorageNamespace.new(@transport)
+      @team = TeamNamespace.new(@transport)
+    end
+  end
+end