@cboxdk/id-js 0.17.0 → 0.18.0

package/dist/management.cjs

@@ -0,0 +1,4372 @@
+'use strict';
+
+// src/errors.ts
+var CboxIdError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = new.target.name;
+  }
+};
+var ConfigurationError = class extends CboxIdError {
+};
+
+// src/management/errors.ts
+var CboxIdApiError = class extends CboxIdError {
+  /** HTTP status. */
+  status;
+  /** The stable machine code, e.g. `validation_failed`, `slug_taken`, `not_found`. */
+  error;
+  /**
+   * On `validation_failed` only: the offending request fields, each mapped to its messages
+   * (`{ name: ['The name field is required.'] }`). Empty otherwise.
+   */
+  errors;
+  /** The id the server served the request under (`request_id`, else `X-Request-Id`). Quote it when reporting a problem. */
+  requestId;
+  /** Seconds to wait, off `Retry-After` — set on a `429` the client gave up retrying. */
+  retryAfter;
+  constructor(init) {
+    super(init.message);
+    this.status = init.status;
+    this.error = init.error;
+    this.errors = init.errors ?? {};
+    this.requestId = init.requestId ?? null;
+    this.retryAfter = init.retryAfter;
+  }
+  /** Whether this is a `422 validation_failed` with field errors. */
+  get isValidationError() {
+    return this.error === "validation_failed";
+  }
+};
+var ManagementNetworkError = class extends CboxIdError {
+  constructor(message, idempotencyKey, options) {
+    super(message);
+    this.idempotencyKey = idempotencyKey;
+    if (options && "cause" in options) {
+      this.cause = options.cause;
+    }
+  }
+  idempotencyKey;
+};
+var ApprovalError = class extends CboxIdError {
+  constructor(message, reason, approval) {
+    super(message);
+    this.reason = reason;
+    this.approval = approval;
+  }
+  reason;
+  approval;
+};
+var ApprovalDeniedError = class extends ApprovalError {
+  constructor(approval) {
+    super(`Approval ${approval.id} was denied.`, "denied", approval);
+  }
+};
+var ApprovalExpiredError = class extends ApprovalError {
+  constructor(approval) {
+    super(`Approval ${approval.id} expired before it was approved.`, "expired", approval);
+  }
+};
+
+// src/management/transport.ts
+var KEY_PREFIX = {
+  environment: "cbid_env_",
+  workspace: "cbid_ws_",
+  platform: null,
+  account: null
+};
+var APPROVAL_MOUNT = {
+  environment: "",
+  workspace: "/workspace",
+  platform: "/platform",
+  account: "/me"
+};
+var WRITE_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+var MAX_APPROVAL_ROUNDS = 3;
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function uuid() {
+  if (typeof crypto.randomUUID === "function") {
+    return crypto.randomUUID();
+  }
+  const bytes = crypto.getRandomValues(new Uint8Array(16));
+  bytes[6] = bytes[6] & 15 | 64;
+  bytes[8] = bytes[8] & 63 | 128;
+  const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+function retryAfterMs(headers) {
+  const raw = headers.get("retry-after")?.trim();
+  if (raw === void 0 || raw === "") {
+    return void 0;
+  }
+  if (/^\d+$/.test(raw)) {
+    return Number(raw) * 1e3;
+  }
+  const date = Date.parse(raw);
+  return Number.isNaN(date) ? void 0 : Math.max(0, date - Date.now());
+}
+function sleep(ms, signal) {
+  if (ms <= 0) {
+    return signal?.aborted ? Promise.reject(signal.reason) : Promise.resolve();
+  }
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+      reject(signal.reason);
+      return;
+    }
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(signal?.reason);
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+function normalizeBaseUrl(raw) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new ConfigurationError("Management client `baseUrl` is not a valid URL.");
+  }
+  const loopback = ["localhost", "127.0.0.1", "[::1]", "::1"].includes(url.hostname);
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+    throw new ConfigurationError(`Management client \`baseUrl\` must be https (got ${url.protocol}//${url.hostname}).`);
+  }
+  const path = url.pathname.replace(/\/+$/, "");
+  return `${url.origin}${path.endsWith("/api/v1") ? path : `${path}/api/v1`}`;
+}
+function appendQuery(params, key, value) {
+  if (value === void 0 || value === null) {
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const item of value) {
+      appendQuery(params, `${key}[]`, item);
+    }
+    return;
+  }
+  if (typeof value === "boolean") {
+    params.append(key, value ? "1" : "0");
+    return;
+  }
+  params.append(key, typeof value === "object" ? JSON.stringify(value) : String(value));
+}
+async function readJson(response) {
+  const text = await response.text();
+  if (text === "") {
+    return void 0;
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
+var ManagementTransport = class {
+  plane;
+  baseUrl;
+  #options;
+  #fetch;
+  #maxRetries;
+  #baseDelayMs;
+  #maxDelayMs;
+  #dpopNonce;
+  constructor(plane, options, defaultBaseUrl) {
+    const baseUrl = options.baseUrl ?? defaultBaseUrl;
+    if (baseUrl === void 0 || baseUrl === "") {
+      throw new ConfigurationError(`The ${plane} management client needs a \`baseUrl\` (the environment's own host).`);
+    }
+    const hasKey = options.apiKey !== void 0;
+    const hasToken = options.accessToken !== void 0;
+    if (hasKey === hasToken) {
+      throw new ConfigurationError("Pass exactly one of `apiKey` and `accessToken` to a management client.");
+    }
+    if (hasKey) {
+      const key = options.apiKey ?? "";
+      const expected = KEY_PREFIX[plane];
+      if (key === "") {
+        throw new ConfigurationError("Management client `apiKey` is empty.");
+      }
+      if (expected === null) {
+        throw new ConfigurationError(
+          `The ${plane} plane accepts no management key \u2014 only an access token a person delegated (\`accessToken\`).`
+        );
+      }
+      const wrong = Object.values(KEY_PREFIX).find((prefix) => prefix !== null && prefix !== expected && key.startsWith(prefix));
+      if (wrong !== void 0) {
+        throw new ConfigurationError(`A \`${wrong}\u2026\` key cannot call the ${plane} plane; it takes \`${expected}\u2026\` keys.`);
+      }
+      if (options.dpop !== void 0) {
+        throw new ConfigurationError("`dpop` applies to an `accessToken`, not a management key.");
+      }
+    }
+    if (options.environment !== void 0) {
+      if (plane !== "environment") {
+        throw new ConfigurationError(`\`environment\` applies to the environment plane, not the ${plane} plane.`);
+      }
+      if (options.environment === "") {
+        throw new ConfigurationError("Management client `environment` is empty.");
+      }
+      if (hasKey) {
+        throw new ConfigurationError(
+          "`environment` names the environment for a root access token. A `cbid_env_\u2026` key is bound to its own environment's host: use that host as `baseUrl` instead."
+        );
+      }
+    }
+    this.plane = plane;
+    this.baseUrl = normalizeBaseUrl(baseUrl);
+    this.#options = options;
+    this.#fetch = options.fetch ?? ((input, init) => fetch(input, init));
+    this.#maxRetries = Math.max(0, options.retry?.maxRetries ?? 3);
+    this.#baseDelayMs = Math.max(0, options.retry?.baseDelayMs ?? 500);
+    this.#maxDelayMs = Math.max(0, options.retry?.maxDelayMs ?? 3e4);
+  }
+  /** Run one operation. Generated methods call this; so can you, with an operation spec. */
+  async call(op, pathArgs, input, options) {
+    const url = this.#url(op, pathArgs, op.body ? void 0 : input);
+    const payload = op.body ? input : void 0;
+    const idempotencyKey = WRITE_METHODS.has(op.method) ? options?.idempotencyKey ?? uuid() : void 0;
+    const send = {
+      idempotencyKey,
+      approvalId: options?.approvalId,
+      signal: options?.signal,
+      headers: options?.headers
+    };
+    const context = { action: op.action, danger: op.danger, method: op.method, path: op.path };
+    const response = await this.#send(op.method, url, payload, send);
+    const held = await this.#heldApproval(response);
+    if (held !== null && options?.approval === "return") {
+      const result = {
+        pending: true,
+        status: 202,
+        approval: held.approval,
+        idempotencyKey,
+        action: op.action,
+        resume: (resumeOptions) => this.#approveAndRepeat(op.method, url, payload, { ...send, signal: resumeOptions?.signal ?? send.signal }, held, context, false)
+      };
+      return result;
+    }
+    if (held !== null) {
+      return await this.#approveAndRepeat(op.method, url, payload, send, held, context, true);
+    }
+    return await this.#result(response, idempotencyKey);
+  }
+  /**
+   * Every item of a paged list, fetching pages as the iteration reaches them. Works for both
+   * cursor (`after` / `meta.next_cursor`) and numbered (`page` / `meta.next_page`) lists.
+   */
+  async *paginate(op, pathArgs, input, options) {
+    let query = { ...input ?? {} };
+    for (; ; ) {
+      const page = await this.call(op, pathArgs, query, {
+        ...options,
+        approval: "wait"
+      });
+      const items = Array.isArray(page.data) ? page.data : [];
+      yield* items;
+      const meta = page.meta;
+      if (items.length === 0 || meta?.has_more !== true) {
+        return;
+      }
+      if (op.pagination === "page") {
+        const current = typeof query.page === "number" ? query.page : Number(query.page ?? 1);
+        query = { ...query, page: meta.next_page ?? current + 1 };
+      } else {
+        if (typeof meta.next_cursor !== "string" || meta.next_cursor === "") {
+          return;
+        }
+        query = { ...query, after: meta.next_cursor };
+      }
+    }
+  }
+  /**
+   * An escape hatch for a route the generated surface does not cover. `path` is relative to
+   * `/api/v1`. Writes get an `Idempotency-Key` and the approval loop like any operation.
+   */
+  request(method, path, input, options) {
+    const op = {
+      action: null,
+      operationId: null,
+      method,
+      path,
+      pathParams: [],
+      scope: null,
+      danger: null,
+      approval: true,
+      body: input?.body !== void 0,
+      pagination: null
+    };
+    return this.call(op, [], input?.body ?? input?.query, options);
+  }
+  #url(op, pathArgs, query) {
+    let index = 0;
+    const path = op.path.replace(/\{([^}]+)\}/g, (_, name) => {
+      const value = pathArgs[index++];
+      if (value === void 0 || value === "") {
+        throw new TypeError(`${op.action ?? op.path}: missing path parameter \`${name}\`.`);
+      }
+      return encodeURIComponent(value);
+    });
+    const url = new URL(`${this.baseUrl}${path}`);
+    if (isRecord(query)) {
+      for (const [key, value] of Object.entries(query)) {
+        appendQuery(url.searchParams, key, value);
+      }
+    }
+    return url.toString();
+  }
+  async #headers(method, url, send, hasBody) {
+    const headers = new Headers({ ...this.#options.headers, ...send.headers });
+    headers.set("accept", "application/json");
+    if (hasBody) {
+      headers.set("content-type", "application/json");
+    }
+    if (send.idempotencyKey !== void 0) {
+      headers.set("idempotency-key", send.idempotencyKey);
+    }
+    if (send.approvalId !== void 0) {
+      headers.set("cbox-approval", send.approvalId);
+    }
+    if (this.#options.environment !== void 0) {
+      headers.set("cbox-environment", this.#options.environment);
+    }
+    if (this.#options.apiKey !== void 0) {
+      headers.set("authorization", `Bearer ${this.#options.apiKey}`);
+      return headers;
+    }
+    const source = this.#options.accessToken;
+    const token = typeof source === "function" ? await source() : source;
+    if (typeof token !== "string" || token === "") {
+      throw new ConfigurationError("The management client `accessToken` provider returned no token.");
+    }
+    const dpop = this.#options.dpop;
+    if (dpop === void 0) {
+      headers.set("authorization", `Bearer ${token}`);
+      return headers;
+    }
+    headers.set("authorization", `DPoP ${token}`);
+    headers.set(
+      "dpop",
+      await dpop.proof({
+        method,
+        url,
+        accessToken: token,
+        ...this.#dpopNonce !== void 0 ? { nonce: this.#dpopNonce } : {}
+      })
+    );
+    return headers;
+  }
+  /** One HTTP exchange, plus the single DPoP-nonce challenge retry RFC 9449 §8 describes. */
+  async #exchange(method, url, payload, send) {
+    for (let nonceRetry = 0; ; nonceRetry++) {
+      const headers = await this.#headers(method, url, send, payload !== void 0);
+      const timeout = AbortSignal.timeout(this.#options.timeoutMs ?? 3e4);
+      const signal = send.signal ? AbortSignal.any([send.signal, timeout]) : timeout;
+      const init = { method, headers, signal };
+      if (payload !== void 0) {
+        init.body = JSON.stringify(payload);
+      }
+      const response = await this.#fetch(url, init);
+      const nonce = response.headers.get("dpop-nonce");
+      if (nonce !== null && this.#options.dpop !== void 0) {
+        const challenged = response.status === 401 && nonce !== this.#dpopNonce && nonceRetry === 0;
+        this.#dpopNonce = nonce;
+        if (challenged) {
+          await response.body?.cancel();
+          continue;
+        }
+      }
+      return response;
+    }
+  }
+  async #shouldRetry(response) {
+    if (response.status >= 500 || response.status === 429) {
+      return true;
+    }
+    if (response.status === 409) {
+      const body = await readJson(response.clone());
+      return isRecord(body) && body.error === "idempotency_in_progress";
+    }
+    return false;
+  }
+  #backoff(attempt) {
+    const exponential = this.#baseDelayMs * 2 ** attempt;
+    return Math.min(this.#maxDelayMs, exponential / 2 + Math.random() * (exponential / 2));
+  }
+  /** Send with retries. Every attempt carries the SAME Idempotency-Key, so a write lands once. */
+  async #send(method, url, payload, send) {
+    for (let attempt = 0; ; attempt++) {
+      let response;
+      try {
+        response = await this.#exchange(method, url, payload, send);
+      } catch (error) {
+        if (send.signal?.aborted) {
+          throw send.signal.reason ?? error;
+        }
+        if (error instanceof CboxIdError || attempt >= this.#maxRetries) {
+          if (error instanceof CboxIdError) {
+            throw error;
+          }
+          throw new ManagementNetworkError(
+            `${method} ${new URL(url).pathname} failed: ${error instanceof Error ? error.message : String(error)}`,
+            send.idempotencyKey,
+            { cause: error }
+          );
+        }
+        await sleep(this.#backoff(attempt), send.signal);
+        continue;
+      }
+      if (attempt >= this.#maxRetries || !await this.#shouldRetry(response)) {
+        return response;
+      }
+      const delay = retryAfterMs(response.headers) ?? this.#backoff(attempt);
+      if (delay > this.#maxDelayMs) {
+        return response;
+      }
+      await response.body?.cancel();
+      await sleep(delay, send.signal);
+    }
+  }
+  async #heldApproval(response) {
+    if (response.status !== 202) {
+      return null;
+    }
+    const body = await readJson(response.clone());
+    if (!isRecord(body) || body.error !== "approval_required" || !isRecord(body.approval)) {
+      return null;
+    }
+    const approval = body.approval;
+    if (typeof approval.id !== "string" || approval.id === "") {
+      return null;
+    }
+    return {
+      approval: {
+        id: approval.id,
+        status: typeof approval.status === "string" ? approval.status : "pending",
+        binding_code: typeof approval.binding_code === "string" ? approval.binding_code : "",
+        expires_at: typeof approval.expires_at === "string" ? approval.expires_at : "",
+        poll_url: typeof approval.poll_url === "string" ? approval.poll_url : `${this.baseUrl}${APPROVAL_MOUNT[this.plane]}/action-approvals/${encodeURIComponent(approval.id)}`
+      },
+      retryAfter: retryAfterMs(response.headers)
+    };
+  }
+  async #approveAndRepeat(method, url, payload, send, first, context, notify) {
+    let held = first;
+    for (let round = 1; ; round++) {
+      if (notify || round > 1) {
+        await this.#options.onApprovalRequired?.(held.approval, context);
+      }
+      await this.#awaitApproval(held.approval, held.retryAfter, send.signal);
+      const response = await this.#send(method, url, payload, { ...send, approvalId: held.approval.id });
+      const again = await this.#heldApproval(response);
+      if (again === null) {
+        return this.#result(response, send.idempotencyKey);
+      }
+      if (round >= MAX_APPROVAL_ROUNDS) {
+        throw new ApprovalError(
+          `The request was held for approval ${round} times; giving up.`,
+          "consumed",
+          again.approval
+        );
+      }
+      held = again;
+    }
+  }
+  /** Poll an approval until the person decides. Resolves on `approved`; throws otherwise. */
+  async #awaitApproval(approval, initialDelay, signal) {
+    const pollUrl = new URL(approval.poll_url, this.baseUrl);
+    if (pollUrl.origin !== new URL(this.baseUrl).origin) {
+      throw new CboxIdError(`Refusing to poll approval ${approval.id} at another origin (${pollUrl.origin}).`);
+    }
+    const fallback = Math.max(0, this.#options.approvalPollIntervalMs ?? 2e3);
+    const expiresAt = Date.parse(approval.expires_at);
+    let delay = initialDelay ?? fallback;
+    for (; ; ) {
+      await sleep(Math.min(delay, 6e4), signal);
+      const response = await this.#send("GET", pollUrl.toString(), void 0, { signal });
+      if (!response.ok) {
+        throw await this.#error(response);
+      }
+      const body = await readJson(response);
+      const data = isRecord(body) && isRecord(body.data) ? body.data : {};
+      const status = typeof data.status === "string" ? data.status : "pending";
+      switch (status) {
+        case "approved":
+          return;
+        case "denied":
+          throw new ApprovalDeniedError(approval);
+        case "expired":
+          throw new ApprovalExpiredError(approval);
+        case "consumed":
+          throw new ApprovalError(`Approval ${approval.id} was already used by another request.`, "consumed", approval);
+      }
+      if (!Number.isNaN(expiresAt) && Date.now() > expiresAt + 3e4) {
+        throw new ApprovalExpiredError(approval);
+      }
+      delay = retryAfterMs(response.headers) ?? fallback;
+    }
+  }
+  async #result(response, idempotencyKey) {
+    if (!response.ok) {
+      throw await this.#error(response);
+    }
+    const body = response.status === 204 ? void 0 : await readJson(response);
+    const envelope = isRecord(body) && "data" in body;
+    return {
+      pending: false,
+      status: response.status,
+      data: envelope ? body.data : body,
+      meta: envelope ? body.meta : void 0,
+      body,
+      replayed: response.headers.get("idempotent-replayed")?.toLowerCase() === "true",
+      idempotencyKey,
+      requestId: response.headers.get("x-request-id"),
+      headers: response.headers
+    };
+  }
+  async #error(response) {
+    const body = await readJson(response);
+    const fields = isRecord(body) ? body : {};
+    const code = typeof fields.error === "string" ? fields.error : `http_${response.status}`;
+    const message = typeof fields.message === "string" ? fields.message : typeof fields.error_description === "string" ? fields.error_description : `HTTP ${response.status}`;
+    const errors = {};
+    if (isRecord(fields.errors)) {
+      for (const [field, messages] of Object.entries(fields.errors)) {
+        errors[field] = Array.isArray(messages) ? messages.map(String) : [String(messages)];
+      }
+    }
+    const retryAfter = retryAfterMs(response.headers);
+    const requestId = typeof fields.request_id === "string" && fields.request_id !== "" ? fields.request_id : response.headers.get("x-request-id");
+    return new CboxIdApiError({
+      status: response.status,
+      error: code,
+      message,
+      errors,
+      requestId,
+      retryAfter: retryAfter === void 0 ? void 0 : Math.ceil(retryAfter / 1e3)
+    });
+  }
+};
+
+// src/management/generated/environment.ts
+var environmentOperations = {
+  "access_reviews.close": { action: "access_reviews.close", operationId: "access_reviews_close", method: "POST", path: "/access-reviews/{id}/close", pathParams: ["id"], scope: "governance:write", danger: "destructive", approval: true, body: true, pagination: null },
+  "access_reviews.create": { action: "access_reviews.create", operationId: "access_reviews_create", method: "POST", path: "/access-reviews", pathParams: [], scope: "governance:write", danger: "write", approval: true, body: true, pagination: null },
+  "access_reviews.get": { action: "access_reviews.get", operationId: "access_reviews_get", method: "GET", path: "/access-reviews/{id}", pathParams: ["id"], scope: "governance:read", danger: "read", approval: true, body: false, pagination: null },
+  "access_reviews.items.decide": { action: "access_reviews.items.decide", operationId: "access_reviews_items_decide", method: "POST", path: "/access-reviews/{id}/items/{item_id}", pathParams: ["id", "item_id"], scope: "governance:write", danger: "write", approval: true, body: true, pagination: null },
+  "access_reviews.items.list": { action: "access_reviews.items.list", operationId: "access_reviews_items_list", method: "GET", path: "/access-reviews/{id}/items", pathParams: ["id"], scope: "governance:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "access_reviews.list": { action: "access_reviews.list", operationId: "access_reviews_list", method: "GET", path: "/access-reviews", pathParams: [], scope: "governance:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "action_approvals.get": { action: null, operationId: null, method: "GET", path: "/action-approvals/{id}", pathParams: ["id"], scope: null, danger: null, approval: false, body: false, pagination: null },
+  "api_keys.list": { action: "api_keys.list", operationId: "api_keys_list", method: "GET", path: "/organizations/{organization_id}/api-keys", pathParams: ["organization_id"], scope: "api_keys:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "api_keys.revoke": { action: "api_keys.revoke", operationId: "api_keys_revoke", method: "DELETE", path: "/api-keys/{id}", pathParams: ["id"], scope: "api_keys:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "apis.create": { action: "apis.create", operationId: null, method: "POST", path: "/apis", pathParams: [], scope: "apis:write", danger: "write", approval: true, body: true, pagination: null },
+  "apis.delete": { action: "apis.delete", operationId: null, method: "DELETE", path: "/apis/{id}", pathParams: ["id"], scope: "apis:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "apis.get": { action: "apis.get", operationId: null, method: "GET", path: "/apis/{id}", pathParams: ["id"], scope: "apis:read", danger: "read", approval: true, body: false, pagination: null },
+  "apis.list": { action: "apis.list", operationId: null, method: "GET", path: "/apis", pathParams: [], scope: "apis:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "apis.scopes.define": { action: "apis.scopes.define", operationId: "apis_scopes_define", method: "PUT", path: "/apis/{id}/scopes/{key}", pathParams: ["id", "key"], scope: "apis:write", danger: "write", approval: true, body: true, pagination: null },
+  "apis.scopes.remove": { action: "apis.scopes.remove", operationId: "apis_scopes_remove", method: "DELETE", path: "/apis/{id}/scopes/{key}", pathParams: ["id", "key"], scope: "apis:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "apis.update": { action: "apis.update", operationId: null, method: "PATCH", path: "/apis/{id}", pathParams: ["id"], scope: "apis:write", danger: "write", approval: true, body: true, pagination: null },
+  "approvals.deny": { action: "approvals.deny", operationId: "approvals_deny", method: "POST", path: "/agent-requests/{request_id}/deny", pathParams: ["request_id"], scope: "approvals:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "approvals.list": { action: "approvals.list", operationId: "approvals_list", method: "GET", path: "/agent-requests", pathParams: [], scope: "approvals:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "apps.blueprint": { action: "apps.blueprint", operationId: "apps_blueprint", method: "GET", path: "/apps/{id}/blueprint", pathParams: ["id"], scope: "apps:read", danger: "read", approval: true, body: false, pagination: null },
+  "apps.copy": { action: "apps.copy", operationId: "apps_copy", method: "POST", path: "/apps/{id}/copy", pathParams: ["id"], scope: "apps:write", danger: "critical", approval: true, body: true, pagination: null },
+  "apps.create": { action: "apps.create", operationId: "apps_create", method: "POST", path: "/apps", pathParams: [], scope: "apps:write", danger: "critical", approval: true, body: true, pagination: null },
+  "apps.delete": { action: "apps.delete", operationId: "apps_delete", method: "DELETE", path: "/apps/{id}", pathParams: ["id"], scope: "apps:write", danger: "critical", approval: true, body: false, pagination: null },
+  "apps.get": { action: "apps.get", operationId: "apps_get", method: "GET", path: "/apps/{id}", pathParams: ["id"], scope: "apps:read", danger: "read", approval: true, body: false, pagination: null },
+  "apps.list": { action: "apps.list", operationId: "apps_list", method: "GET", path: "/apps", pathParams: [], scope: "apps:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "apps.manifest.set": { action: "apps.manifest.set", operationId: "apps_manifest_set", method: "PUT", path: "/apps/{id}/manifest", pathParams: ["id"], scope: "apps:write", danger: "write", approval: true, body: true, pagination: null },
+  "apps.manifest.sync": { action: "apps.manifest.sync", operationId: "apps_manifest_sync", method: "POST", path: "/apps/{id}/manifest/sync", pathParams: ["id"], scope: "apps:write", danger: "write", approval: true, body: false, pagination: null },
+  "apps.scopes.set": { action: "apps.scopes.set", operationId: "apps_scopes_set", method: "PUT", path: "/apps/{id}/scopes", pathParams: ["id"], scope: "apps:write", danger: "write", approval: true, body: true, pagination: null },
+  "apps.secrets.list": { action: "apps.secrets.list", operationId: "apps_secrets_list", method: "GET", path: "/apps/{id}/secrets", pathParams: ["id"], scope: "apps:read", danger: "read", approval: true, body: false, pagination: null },
+  "apps.secrets.revoke": { action: "apps.secrets.revoke", operationId: "apps_secrets_revoke", method: "DELETE", path: "/apps/{id}/secrets/{secret_id}", pathParams: ["id", "secret_id"], scope: "apps:write", danger: "critical", approval: true, body: false, pagination: null },
+  "apps.secrets.rotate": { action: "apps.secrets.rotate", operationId: "apps_secrets_rotate", method: "POST", path: "/apps/{id}/secrets", pathParams: ["id"], scope: "apps:write", danger: "critical", approval: true, body: true, pagination: null },
+  "apps.settings.api_key_prefix": { action: "apps.settings.api_key_prefix", operationId: "apps_settings_api_key_prefix", method: "PUT", path: "/apps/{id}/settings/api-key-prefix", pathParams: ["id"], scope: "apps:write", danger: "write", approval: true, body: true, pagination: null },
+  "apps.settings.backchannel_logout": { action: "apps.settings.backchannel_logout", operationId: "apps_settings_backchannel_logout", method: "PUT", path: "/apps/{id}/settings/backchannel-logout", pathParams: ["id"], scope: "apps:write", danger: "write", approval: true, body: true, pagination: null },
+  "apps.settings.token_exchange": { action: "apps.settings.token_exchange", operationId: "apps_settings_token_exchange", method: "PUT", path: "/apps/{id}/settings/token-exchange", pathParams: ["id"], scope: "apps:write", danger: "write", approval: true, body: true, pagination: null },
+  "apps.settings.token_lifetime": { action: "apps.settings.token_lifetime", operationId: "apps_settings_token_lifetime", method: "PUT", path: "/apps/{id}/settings/token-lifetime", pathParams: ["id"], scope: "apps:write", danger: "write", approval: true, body: true, pagination: null },
+  "apps.update": { action: "apps.update", operationId: "apps_update", method: "PATCH", path: "/apps/{id}", pathParams: ["id"], scope: "apps:write", danger: "write", approval: true, body: true, pagination: null },
+  "audit_logs.events.create": { action: "audit_logs.events.create", operationId: "audit_logs_events_create", method: "POST", path: "/audit-logs/events", pathParams: [], scope: "audit_logs:write", danger: "write", approval: true, body: true, pagination: null },
+  "audit_logs.events.list": { action: "audit_logs.events.list", operationId: "audit_logs_events_list", method: "GET", path: "/audit-logs/events", pathParams: [], scope: "audit_logs:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "audit_logs.exports.create": { action: "audit_logs.exports.create", operationId: "audit_logs_exports_create", method: "POST", path: "/audit-logs/exports", pathParams: [], scope: "audit_logs:export", danger: "write", approval: true, body: true, pagination: null },
+  "audit_logs.exports.get": { action: "audit_logs.exports.get", operationId: "audit_logs_exports_get", method: "GET", path: "/audit-logs/exports/{id}", pathParams: ["id"], scope: "audit_logs:read", danger: "read", approval: true, body: false, pagination: null },
+  "audit_logs.schemas.create": { action: "audit_logs.schemas.create", operationId: "audit_logs_schemas_create", method: "POST", path: "/audit-logs/schemas", pathParams: [], scope: "audit_logs:manage", danger: "write", approval: true, body: true, pagination: null },
+  "audit_logs.schemas.delete": { action: "audit_logs.schemas.delete", operationId: "audit_logs_schemas_delete", method: "DELETE", path: "/audit-logs/schemas/{action}", pathParams: ["action"], scope: "audit_logs:manage", danger: "destructive", approval: true, body: false, pagination: null },
+  "audit_logs.schemas.get": { action: "audit_logs.schemas.get", operationId: "audit_logs_schemas_get", method: "GET", path: "/audit-logs/schemas/{action}", pathParams: ["action"], scope: "audit_logs:read", danger: "read", approval: true, body: false, pagination: null },
+  "audit_logs.schemas.list": { action: "audit_logs.schemas.list", operationId: "audit_logs_schemas_list", method: "GET", path: "/audit-logs/schemas", pathParams: [], scope: "audit_logs:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "audit_logs.schemas.update": { action: "audit_logs.schemas.update", operationId: "audit_logs_schemas_update", method: "PUT", path: "/audit-logs/schemas/{action}", pathParams: ["action"], scope: "audit_logs:manage", danger: "write", approval: true, body: true, pagination: null },
+  "audit_logs.settings.get": { action: "audit_logs.settings.get", operationId: "audit_logs_settings_get", method: "GET", path: "/audit-logs/settings", pathParams: [], scope: "audit_logs:read", danger: "read", approval: true, body: false, pagination: null },
+  "audit_logs.settings.update": { action: "audit_logs.settings.update", operationId: "audit_logs_settings_update", method: "PATCH", path: "/audit-logs/settings", pathParams: [], scope: "audit_logs:manage", danger: "destructive", approval: true, body: true, pagination: null },
+  "audit_logs.verify": { action: "audit_logs.verify", operationId: "audit_logs_verify", method: "GET", path: "/audit-logs/verify", pathParams: [], scope: "audit_logs:read", danger: "read", approval: true, body: false, pagination: null },
+  "audit.list": { action: "audit.list", operationId: "audit_list", method: "GET", path: "/audit-log", pathParams: [], scope: "audit:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "branding.appearance.get": { action: "branding.appearance.get", operationId: "branding_appearance_get", method: "GET", path: "/branding/appearance", pathParams: [], scope: "branding:read", danger: "read", approval: true, body: false, pagination: null },
+  "branding.appearance.set": { action: "branding.appearance.set", operationId: "branding_appearance_set", method: "PUT", path: "/branding/appearance", pathParams: [], scope: "branding:write", danger: "write", approval: true, body: true, pagination: null },
+  "branding.whitelabel.get": { action: "branding.whitelabel.get", operationId: "branding_whitelabel_get", method: "GET", path: "/branding/whitelabel", pathParams: [], scope: "branding:read", danger: "read", approval: true, body: false, pagination: null },
+  "branding.whitelabel.set": { action: "branding.whitelabel.set", operationId: "branding_whitelabel_set", method: "PUT", path: "/branding/whitelabel", pathParams: [], scope: "branding:write", danger: "write", approval: true, body: true, pagination: null },
+  "directories.connect": { action: "directories.connect", operationId: "directories_connect", method: "POST", path: "/directories/connect", pathParams: [], scope: "directory_sync:write", danger: "critical", approval: true, body: true, pagination: null },
+  "directories.create": { action: "directories.create", operationId: "directories_create", method: "POST", path: "/directories", pathParams: [], scope: "directory_sync:write", danger: "critical", approval: true, body: true, pagination: null },
+  "directories.delete": { action: "directories.delete", operationId: "directories_delete", method: "DELETE", path: "/directories/{id}", pathParams: ["id"], scope: "directory_sync:write", danger: "destructive", approval: true, body: true, pagination: null },
+  "directories.get": { action: "directories.get", operationId: "directories_get", method: "GET", path: "/directories/{id}", pathParams: ["id"], scope: "directory_sync:read", danger: "read", approval: true, body: false, pagination: null },
+  "directories.groups.list": { action: "directories.groups.list", operationId: "directories_groups_list", method: "GET", path: "/directories/{id}/groups", pathParams: ["id"], scope: "directory_sync:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "directories.groups.map": { action: "directories.groups.map", operationId: "directories_groups_map", method: "POST", path: "/directories/{id}/group-roles", pathParams: ["id"], scope: "directory_sync:write", danger: "write", approval: true, body: true, pagination: null },
+  "directories.list": { action: "directories.list", operationId: "directories_list", method: "GET", path: "/directories", pathParams: [], scope: "directory_sync:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "directories.status.set": { action: "directories.status.set", operationId: "directories_status_set", method: "POST", path: "/directories/{id}/status", pathParams: ["id"], scope: "directory_sync:write", danger: "write", approval: true, body: true, pagination: null },
+  "directories.token.rotate": { action: "directories.token.rotate", operationId: "directories_token_rotate", method: "POST", path: "/directories/{id}/rotate", pathParams: ["id"], scope: "directory_sync:write", danger: "critical", approval: true, body: true, pagination: null },
+  "directories.update": { action: "directories.update", operationId: "directories_update", method: "PATCH", path: "/directories/{id}", pathParams: ["id"], scope: "directory_sync:write", danger: "write", approval: true, body: true, pagination: null },
+  "domains.add": { action: "domains.add", operationId: "domains_add", method: "POST", path: "/domains", pathParams: [], scope: "domains:write", danger: "write", approval: true, body: true, pagination: null },
+  "domains.get": { action: "domains.get", operationId: "domains_get", method: "GET", path: "/domains", pathParams: [], scope: "domains:read", danger: "read", approval: true, body: false, pagination: null },
+  "domains.remove": { action: "domains.remove", operationId: "domains_remove", method: "DELETE", path: "/domains", pathParams: [], scope: "domains:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "domains.verify": { action: "domains.verify", operationId: "domains_verify", method: "POST", path: "/domains/verify", pathParams: [], scope: "domains:write", danger: "write", approval: true, body: false, pagination: null },
+  "events.list": { action: "events.list", operationId: "events_list", method: "GET", path: "/events", pathParams: [], scope: "events:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "frontend_keys.create": { action: "frontend_keys.create", operationId: "frontend_keys_create", method: "POST", path: "/frontend-keys", pathParams: [], scope: "frontend_keys:write", danger: "write", approval: true, body: true, pagination: null },
+  "frontend_keys.list": { action: "frontend_keys.list", operationId: "frontend_keys_list", method: "GET", path: "/frontend-keys", pathParams: [], scope: "frontend_keys:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "frontend_keys.revoke": { action: "frontend_keys.revoke", operationId: "frontend_keys_revoke", method: "DELETE", path: "/frontend-keys/{id}", pathParams: ["id"], scope: "frontend_keys:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "frontend_keys.set_origins": { action: "frontend_keys.set_origins", operationId: "frontend_keys_set_origins", method: "PUT", path: "/frontend-keys/{id}/origins", pathParams: ["id"], scope: "frontend_keys:write", danger: "write", approval: true, body: true, pagination: null },
+  "hooks.create": { action: "hooks.create", operationId: "hooks_create", method: "POST", path: "/hooks", pathParams: [], scope: "hooks:write", danger: "critical", approval: true, body: true, pagination: null },
+  "hooks.delete": { action: "hooks.delete", operationId: "hooks_delete", method: "DELETE", path: "/hooks/{id}", pathParams: ["id"], scope: "hooks:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "hooks.get": { action: "hooks.get", operationId: "hooks_get", method: "GET", path: "/hooks/{id}", pathParams: ["id"], scope: "hooks:read", danger: "read", approval: true, body: false, pagination: null },
+  "hooks.list": { action: "hooks.list", operationId: "hooks_list", method: "GET", path: "/hooks", pathParams: [], scope: "hooks:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "hooks.update": { action: "hooks.update", operationId: "hooks_update", method: "PATCH", path: "/hooks/{id}", pathParams: ["id"], scope: "hooks:write", danger: "critical", approval: true, body: true, pagination: null },
+  "invitations.list": { action: "invitations.list", operationId: "invitations_list", method: "GET", path: "/organizations/{organization_id}/invitations", pathParams: ["organization_id"], scope: "invitations:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "invitations.resend": { action: "invitations.resend", operationId: "invitations_resend", method: "POST", path: "/organizations/{organization_id}/invitations/{invitation_id}/resend", pathParams: ["organization_id", "invitation_id"], scope: "invitations:write", danger: "write", approval: true, body: false, pagination: null },
+  "invitations.revoke": { action: "invitations.revoke", operationId: "invitations_revoke", method: "DELETE", path: "/organizations/{organization_id}/invitations/{invitation_id}", pathParams: ["organization_id", "invitation_id"], scope: "invitations:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "invitations.send": { action: "invitations.send", operationId: "invitations_send", method: "POST", path: "/organizations/{organization_id}/invitations", pathParams: ["organization_id"], scope: "invitations:write", danger: "write", approval: true, body: true, pagination: null },
+  "keys.create": { action: "keys.create", operationId: "keys_create", method: "POST", path: "/keys", pathParams: [], scope: "keys:write", danger: "critical", approval: true, body: true, pagination: null },
+  "keys.list": { action: "keys.list", operationId: "keys_list", method: "GET", path: "/keys", pathParams: [], scope: "keys:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "keys.revoke": { action: "keys.revoke", operationId: "keys_revoke", method: "DELETE", path: "/keys/{id}", pathParams: ["id"], scope: "keys:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "keys.rotate": { action: "keys.rotate", operationId: "keys_rotate", method: "POST", path: "/keys/{id}/rotate", pathParams: ["id"], scope: "keys:write", danger: "critical", approval: true, body: true, pagination: null },
+  "legacy_login.approve": { action: "legacy_login.approve", operationId: "legacy_login_approve", method: "POST", path: "/legacy-login/approve", pathParams: [], scope: "signin:write", danger: "critical", approval: true, body: false, pagination: null },
+  "legacy_login.get": { action: "legacy_login.get", operationId: "legacy_login_get", method: "GET", path: "/legacy-login", pathParams: [], scope: "signin:read", danger: "read", approval: true, body: false, pagination: null },
+  "legacy_login.probe": { action: "legacy_login.probe", operationId: "legacy_login_probe", method: "POST", path: "/legacy-login/probe", pathParams: [], scope: "signin:write", danger: "write", approval: true, body: true, pagination: null },
+  "legacy_login.revoke": { action: "legacy_login.revoke", operationId: "legacy_login_revoke", method: "POST", path: "/legacy-login/revoke", pathParams: [], scope: "signin:write", danger: "critical", approval: true, body: false, pagination: null },
+  "log_streams.create": { action: "log_streams.create", operationId: "log_streams_create", method: "POST", path: "/log-streams", pathParams: [], scope: "log_streams:write", danger: "critical", approval: true, body: true, pagination: null },
+  "log_streams.delete": { action: "log_streams.delete", operationId: "log_streams_delete", method: "DELETE", path: "/log-streams/{id}", pathParams: ["id"], scope: "log_streams:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "log_streams.get": { action: "log_streams.get", operationId: "log_streams_get", method: "GET", path: "/log-streams/{id}", pathParams: ["id"], scope: "log_streams:read", danger: "read", approval: true, body: false, pagination: null },
+  "log_streams.list": { action: "log_streams.list", operationId: "log_streams_list", method: "GET", path: "/log-streams", pathParams: [], scope: "log_streams:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "log_streams.test": { action: "log_streams.test", operationId: "log_streams_test", method: "POST", path: "/log-streams/{id}/test", pathParams: ["id"], scope: "log_streams:write", danger: "write", approval: true, body: false, pagination: null },
+  "log_streams.update": { action: "log_streams.update", operationId: "log_streams_update", method: "PATCH", path: "/log-streams/{id}", pathParams: ["id"], scope: "log_streams:write", danger: "critical", approval: true, body: true, pagination: null },
+  "members.add": { action: "members.add", operationId: "members_add", method: "POST", path: "/organizations/{organization_id}/members", pathParams: ["organization_id"], scope: "members:write", danger: "write", approval: true, body: true, pagination: null },
+  "members.list": { action: "members.list", operationId: "members_list", method: "GET", path: "/organizations/{organization_id}/members", pathParams: ["organization_id"], scope: "members:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "members.remove": { action: "members.remove", operationId: "members_remove", method: "DELETE", path: "/organizations/{organization_id}/members/{user_id}", pathParams: ["organization_id", "user_id"], scope: "members:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "members.roles.grant": { action: "members.roles.grant", operationId: "members_roles_grant", method: "PUT", path: "/organizations/{organization_id}/members/{user_id}/roles/{role_id}", pathParams: ["organization_id", "user_id", "role_id"], scope: "roles:write", danger: "write", approval: true, body: false, pagination: null },
+  "members.roles.list": { action: "members.roles.list", operationId: "members_roles_list", method: "GET", path: "/organizations/{organization_id}/members/{user_id}/roles", pathParams: ["organization_id", "user_id"], scope: "roles:read", danger: "read", approval: true, body: false, pagination: null },
+  "members.roles.revoke": { action: "members.roles.revoke", operationId: "members_roles_revoke", method: "DELETE", path: "/organizations/{organization_id}/members/{user_id}/roles/{role_id}", pathParams: ["organization_id", "user_id", "role_id"], scope: "roles:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "members.update": { action: "members.update", operationId: "members_update", method: "PATCH", path: "/organizations/{organization_id}/members/{user_id}", pathParams: ["organization_id", "user_id"], scope: "members:write", danger: "write", approval: true, body: true, pagination: null },
+  "organizations.create": { action: "organizations.create", operationId: "organizations_create", method: "POST", path: "/organizations", pathParams: [], scope: "organizations:write", danger: "write", approval: true, body: true, pagination: null },
+  "organizations.delete": { action: "organizations.delete", operationId: "organizations_delete", method: "DELETE", path: "/organizations/{id}", pathParams: ["id"], scope: "organizations:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "organizations.domains.add": { action: "organizations.domains.add", operationId: "organizations_domains_add", method: "POST", path: "/organizations/{organization_id}/domains", pathParams: ["organization_id"], scope: "organizations:write", danger: "write", approval: true, body: true, pagination: null },
+  "organizations.domains.capture": { action: "organizations.domains.capture", operationId: "organizations_domains_capture", method: "PUT", path: "/organizations/{organization_id}/domains/{domain_id}/capture", pathParams: ["organization_id", "domain_id"], scope: "organizations:write", danger: "critical", approval: true, body: true, pagination: null },
+  "organizations.domains.list": { action: "organizations.domains.list", operationId: "organizations_domains_list", method: "GET", path: "/organizations/{organization_id}/domains", pathParams: ["organization_id"], scope: "organizations:read", danger: "read", approval: true, body: false, pagination: null },
+  "organizations.domains.remove": { action: "organizations.domains.remove", operationId: "organizations_domains_remove", method: "DELETE", path: "/organizations/{organization_id}/domains/{domain_id}", pathParams: ["organization_id", "domain_id"], scope: "organizations:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "organizations.domains.verify": { action: "organizations.domains.verify", operationId: "organizations_domains_verify", method: "POST", path: "/organizations/{organization_id}/domains/{domain_id}/verify", pathParams: ["organization_id", "domain_id"], scope: "organizations:write", danger: "write", approval: true, body: false, pagination: null },
+  "organizations.get": { action: "organizations.get", operationId: "organizations_get", method: "GET", path: "/organizations/{id}", pathParams: ["id"], scope: "organizations:read", danger: "read", approval: true, body: false, pagination: null },
+  "organizations.list": { action: "organizations.list", operationId: "organizations_list", method: "GET", path: "/organizations", pathParams: [], scope: "organizations:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "organizations.portal_links.create": { action: "organizations.portal_links.create", operationId: "organizations_portal_links_create", method: "POST", path: "/organizations/{organization_id}/portal-links", pathParams: ["organization_id"], scope: "portal_links:write", danger: "critical", approval: true, body: true, pagination: null },
+  "organizations.portal_links.list": { action: "organizations.portal_links.list", operationId: "organizations_portal_links_list", method: "GET", path: "/organizations/{organization_id}/portal-links", pathParams: ["organization_id"], scope: "portal_links:read", danger: "read", approval: true, body: false, pagination: null },
+  "organizations.portal_links.revoke": { action: "organizations.portal_links.revoke", operationId: "organizations_portal_links_revoke", method: "DELETE", path: "/organizations/{organization_id}/portal-links/{id}", pathParams: ["organization_id", "id"], scope: "portal_links:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "organizations.reactivate": { action: "organizations.reactivate", operationId: "organizations_reactivate", method: "POST", path: "/organizations/{id}/reactivate", pathParams: ["id"], scope: "organizations:write", danger: "write", approval: true, body: false, pagination: null },
+  "organizations.suspend": { action: "organizations.suspend", operationId: "organizations_suspend", method: "POST", path: "/organizations/{id}/suspend", pathParams: ["id"], scope: "organizations:write", danger: "write", approval: true, body: false, pagination: null },
+  "organizations.transfer_ownership": { action: "organizations.transfer_ownership", operationId: "organizations_transfer_ownership", method: "POST", path: "/organizations/{id}/transfer-ownership", pathParams: ["id"], scope: "organizations:write", danger: "critical", approval: true, body: true, pagination: null },
+  "organizations.update": { action: "organizations.update", operationId: "organizations_update", method: "PATCH", path: "/organizations/{id}", pathParams: ["id"], scope: "organizations:write", danger: "write", approval: true, body: true, pagination: null },
+  "permissions.create": { action: "permissions.create", operationId: "permissions_create", method: "POST", path: "/permissions", pathParams: [], scope: "role_definitions:write", danger: "write", approval: true, body: true, pagination: null },
+  "permissions.delete": { action: "permissions.delete", operationId: "permissions_delete", method: "DELETE", path: "/permissions/{id}", pathParams: ["id"], scope: "role_definitions:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "permissions.list": { action: "permissions.list", operationId: "permissions_list", method: "GET", path: "/permissions", pathParams: [], scope: "roles:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "permissions.update": { action: "permissions.update", operationId: "permissions_update", method: "PATCH", path: "/permissions/{id}", pathParams: ["id"], scope: "role_definitions:write", danger: "write", approval: true, body: true, pagination: null },
+  "provisioning.targets.create": { action: "provisioning.targets.create", operationId: "provisioning_targets_create", method: "POST", path: "/provisioning-targets", pathParams: [], scope: "provisioning:write", danger: "critical", approval: true, body: true, pagination: null },
+  "provisioning.targets.delete": { action: "provisioning.targets.delete", operationId: "provisioning_targets_delete", method: "DELETE", path: "/provisioning-targets/{id}", pathParams: ["id"], scope: "provisioning:write", danger: "destructive", approval: true, body: true, pagination: null },
+  "provisioning.targets.get": { action: "provisioning.targets.get", operationId: "provisioning_targets_get", method: "GET", path: "/provisioning-targets/{id}", pathParams: ["id"], scope: "provisioning:read", danger: "read", approval: true, body: false, pagination: null },
+  "provisioning.targets.list": { action: "provisioning.targets.list", operationId: "provisioning_targets_list", method: "GET", path: "/provisioning-targets", pathParams: [], scope: "provisioning:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "provisioning.targets.status.set": { action: "provisioning.targets.status.set", operationId: "provisioning_targets_status_set", method: "POST", path: "/provisioning-targets/{id}/status", pathParams: ["id"], scope: "provisioning:write", danger: "write", approval: true, body: true, pagination: null },
+  "roles.create": { action: "roles.create", operationId: "roles_create", method: "POST", path: "/roles", pathParams: [], scope: "role_definitions:write", danger: "write", approval: true, body: true, pagination: null },
+  "roles.delete": { action: "roles.delete", operationId: "roles_delete", method: "DELETE", path: "/roles/{id}", pathParams: ["id"], scope: "role_definitions:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "roles.get": { action: "roles.get", operationId: "roles_get", method: "GET", path: "/roles/{id}", pathParams: ["id"], scope: "roles:read", danger: "read", approval: true, body: false, pagination: null },
+  "roles.list": { action: "roles.list", operationId: "roles_list", method: "GET", path: "/roles", pathParams: [], scope: "roles:read", danger: "read", approval: true, body: false, pagination: null },
+  "roles.permissions.grant": { action: "roles.permissions.grant", operationId: "roles_permissions_grant", method: "PUT", path: "/roles/{id}/permissions/{permission_id}", pathParams: ["id", "permission_id"], scope: "role_definitions:write", danger: "write", approval: true, body: false, pagination: null },
+  "roles.permissions.revoke": { action: "roles.permissions.revoke", operationId: "roles_permissions_revoke", method: "DELETE", path: "/roles/{id}/permissions/{permission_id}", pathParams: ["id", "permission_id"], scope: "role_definitions:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "roles.update": { action: "roles.update", operationId: "roles_update", method: "PATCH", path: "/roles/{id}", pathParams: ["id"], scope: "role_definitions:write", danger: "write", approval: true, body: true, pagination: null },
+  "saml_apps.create": { action: "saml_apps.create", operationId: "saml_apps_create", method: "POST", path: "/saml-apps", pathParams: [], scope: "saml_apps:write", danger: "critical", approval: true, body: true, pagination: null },
+  "saml_apps.delete": { action: "saml_apps.delete", operationId: "saml_apps_delete", method: "DELETE", path: "/saml-apps/{id}", pathParams: ["id"], scope: "saml_apps:write", danger: "critical", approval: true, body: false, pagination: null },
+  "saml_apps.get": { action: "saml_apps.get", operationId: "saml_apps_get", method: "GET", path: "/saml-apps/{id}", pathParams: ["id"], scope: "saml_apps:read", danger: "read", approval: true, body: false, pagination: null },
+  "saml_apps.list": { action: "saml_apps.list", operationId: "saml_apps_list", method: "GET", path: "/saml-apps", pathParams: [], scope: "saml_apps:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "saml_apps.update": { action: "saml_apps.update", operationId: "saml_apps_update", method: "PATCH", path: "/saml-apps/{id}", pathParams: ["id"], scope: "saml_apps:write", danger: "critical", approval: true, body: true, pagination: null },
+  "signin.policy.get": { action: "signin.policy.get", operationId: "signin_policy_get", method: "GET", path: "/sign-in/policy", pathParams: [], scope: "signin:read", danger: "read", approval: true, body: false, pagination: null },
+  "signin.policy.inherit": { action: "signin.policy.inherit", operationId: "signin_policy_inherit", method: "DELETE", path: "/sign-in/policy/organizations/{organization_id}", pathParams: ["organization_id"], scope: "signin:write", danger: "critical", approval: true, body: false, pagination: null },
+  "signin.policy.update": { action: "signin.policy.update", operationId: "signin_policy_update", method: "PATCH", path: "/sign-in/policy", pathParams: [], scope: "signin:write", danger: "critical", approval: true, body: true, pagination: null },
+  "signin.self_service_signup.set": { action: "signin.self_service_signup.set", operationId: "signin_self_service_signup_set", method: "PUT", path: "/sign-in/self-service-signup", pathParams: [], scope: "signin:write", danger: "critical", approval: true, body: true, pagination: null },
+  "signin.social.delete": { action: "signin.social.delete", operationId: "signin_social_delete", method: "DELETE", path: "/sign-in/social-providers/{id}", pathParams: ["id"], scope: "signin:write", danger: "critical", approval: true, body: true, pagination: null },
+  "signin.social.list": { action: "signin.social.list", operationId: "signin_social_list", method: "GET", path: "/sign-in/social-providers", pathParams: [], scope: "signin:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "signin.social.set": { action: "signin.social.set", operationId: "signin_social_set", method: "POST", path: "/sign-in/social-providers", pathParams: [], scope: "signin:write", danger: "critical", approval: true, body: true, pagination: null },
+  "sod_policies.create": { action: "sod_policies.create", operationId: "sod_policies_create", method: "POST", path: "/sod-policies", pathParams: [], scope: "governance:write", danger: "write", approval: true, body: true, pagination: null },
+  "sod_policies.delete": { action: "sod_policies.delete", operationId: "sod_policies_delete", method: "DELETE", path: "/sod-policies/{id}", pathParams: ["id"], scope: "governance:write", danger: "critical", approval: true, body: true, pagination: null },
+  "sod_policies.get": { action: "sod_policies.get", operationId: "sod_policies_get", method: "GET", path: "/sod-policies/{id}", pathParams: ["id"], scope: "governance:read", danger: "read", approval: true, body: false, pagination: null },
+  "sod_policies.list": { action: "sod_policies.list", operationId: "sod_policies_list", method: "GET", path: "/sod-policies", pathParams: [], scope: "governance:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "sod_policies.status.set": { action: "sod_policies.status.set", operationId: "sod_policies_status_set", method: "POST", path: "/sod-policies/{id}/status", pathParams: ["id"], scope: "governance:write", danger: "critical", approval: true, body: true, pagination: null },
+  "sso.connections.activate": { action: "sso.connections.activate", operationId: "sso_connections_activate", method: "POST", path: "/sso/connections/{id}/activate", pathParams: ["id"], scope: "sso:write", danger: "critical", approval: true, body: true, pagination: null },
+  "sso.connections.certificates.activate": { action: "sso.connections.certificates.activate", operationId: "sso_connections_certificates_activate", method: "POST", path: "/sso/connections/{id}/certificates/activate", pathParams: ["id"], scope: "sso:write", danger: "critical", approval: true, body: true, pagination: null },
+  "sso.connections.certificates.list": { action: "sso.connections.certificates.list", operationId: "sso_connections_certificates_list", method: "GET", path: "/sso/connections/{id}/certificates", pathParams: ["id"], scope: "sso:read", danger: "read", approval: true, body: false, pagination: null },
+  "sso.connections.certificates.stage": { action: "sso.connections.certificates.stage", operationId: "sso_connections_certificates_stage", method: "POST", path: "/sso/connections/{id}/certificates", pathParams: ["id"], scope: "sso:write", danger: "critical", approval: true, body: true, pagination: null },
+  "sso.connections.create": { action: "sso.connections.create", operationId: "sso_connections_create", method: "POST", path: "/sso/connections", pathParams: [], scope: "sso:write", danger: "write", approval: true, body: true, pagination: null },
+  "sso.connections.delete": { action: "sso.connections.delete", operationId: "sso_connections_delete", method: "DELETE", path: "/sso/connections/{id}", pathParams: ["id"], scope: "sso:write", danger: "critical", approval: true, body: true, pagination: null },
+  "sso.connections.disable": { action: "sso.connections.disable", operationId: "sso_connections_disable", method: "POST", path: "/sso/connections/{id}/disable", pathParams: ["id"], scope: "sso:write", danger: "critical", approval: true, body: true, pagination: null },
+  "sso.connections.get": { action: "sso.connections.get", operationId: "sso_connections_get", method: "GET", path: "/sso/connections/{id}", pathParams: ["id"], scope: "sso:read", danger: "read", approval: true, body: false, pagination: null },
+  "sso.connections.list": { action: "sso.connections.list", operationId: "sso_connections_list", method: "GET", path: "/sso/connections", pathParams: [], scope: "sso:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "sso.connections.require_sso": { action: "sso.connections.require_sso", operationId: "sso_connections_require_sso", method: "POST", path: "/sso/connections/{id}/require-sso", pathParams: ["id"], scope: "sso:write", danger: "critical", approval: true, body: true, pagination: null },
+  "sso.connections.update": { action: "sso.connections.update", operationId: "sso_connections_update", method: "PATCH", path: "/sso/connections/{id}", pathParams: ["id"], scope: "sso:write", danger: "critical", approval: true, body: true, pagination: null },
+  "sso.domains.capture": { action: "sso.domains.capture", operationId: "sso_domains_capture", method: "POST", path: "/sso/domains/{id}/capture", pathParams: ["id"], scope: "sso:write", danger: "critical", approval: true, body: true, pagination: null },
+  "sso.domains.create": { action: "sso.domains.create", operationId: "sso_domains_create", method: "POST", path: "/sso/domains", pathParams: [], scope: "sso:write", danger: "write", approval: true, body: true, pagination: null },
+  "sso.domains.delete": { action: "sso.domains.delete", operationId: "sso_domains_delete", method: "DELETE", path: "/sso/domains/{id}", pathParams: ["id"], scope: "sso:write", danger: "destructive", approval: true, body: true, pagination: null },
+  "sso.domains.list": { action: "sso.domains.list", operationId: "sso_domains_list", method: "GET", path: "/sso/domains", pathParams: [], scope: "sso:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "sso.domains.verify": { action: "sso.domains.verify", operationId: "sso_domains_verify", method: "POST", path: "/sso/domains/{id}/verify", pathParams: ["id"], scope: "sso:write", danger: "write", approval: true, body: true, pagination: null },
+  "sso.saml_metadata.import": { action: "sso.saml_metadata.import", operationId: "sso_saml_metadata_import", method: "POST", path: "/sso/saml-metadata", pathParams: [], scope: "sso:write", danger: "write", approval: true, body: true, pagination: null },
+  "support_sessions.end": { action: "support_sessions.end", operationId: "support_sessions_end", method: "DELETE", path: "/support-sessions/{id}", pathParams: ["id"], scope: "support:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "support_sessions.start": { action: "support_sessions.start", operationId: "support_sessions_start", method: "POST", path: "/support-sessions", pathParams: [], scope: "support:write", danger: "critical", approval: true, body: true, pagination: null },
+  "token_vault.grants.create": { action: "token_vault.grants.create", operationId: "token_vault_grants_create", method: "POST", path: "/token-vault/secrets/{id}/grants", pathParams: ["id"], scope: "token_vault:write", danger: "critical", approval: true, body: true, pagination: null },
+  "token_vault.grants.delete": { action: "token_vault.grants.delete", operationId: "token_vault_grants_delete", method: "DELETE", path: "/token-vault/secrets/{id}/grants/{client_id}", pathParams: ["id", "client_id"], scope: "token_vault:write", danger: "destructive", approval: true, body: true, pagination: null },
+  "token_vault.secrets.create": { action: "token_vault.secrets.create", operationId: "token_vault_secrets_create", method: "POST", path: "/token-vault/secrets", pathParams: [], scope: "token_vault:write", danger: "write", approval: true, body: true, pagination: null },
+  "token_vault.secrets.get": { action: "token_vault.secrets.get", operationId: "token_vault_secrets_get", method: "GET", path: "/token-vault/secrets/{id}", pathParams: ["id"], scope: "token_vault:read", danger: "read", approval: true, body: false, pagination: null },
+  "token_vault.secrets.list": { action: "token_vault.secrets.list", operationId: "token_vault_secrets_list", method: "GET", path: "/token-vault/secrets", pathParams: [], scope: "token_vault:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "token_vault.secrets.revoke": { action: "token_vault.secrets.revoke", operationId: "token_vault_secrets_revoke", method: "POST", path: "/token-vault/secrets/{id}/revoke", pathParams: ["id"], scope: "token_vault:write", danger: "destructive", approval: true, body: true, pagination: null },
+  "token_vault.secrets.rotate": { action: "token_vault.secrets.rotate", operationId: "token_vault_secrets_rotate", method: "POST", path: "/token-vault/secrets/{id}/rotate", pathParams: ["id"], scope: "token_vault:write", danger: "critical", approval: true, body: true, pagination: null },
+  "users.create": { action: "users.create", operationId: "users_create", method: "POST", path: "/users", pathParams: [], scope: "users:write", danger: "write", approval: true, body: true, pagination: null },
+  "users.deactivate": { action: "users.deactivate", operationId: "users_deactivate", method: "DELETE", path: "/users/{id}", pathParams: ["id"], scope: "users:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "users.environment_roles.get": { action: "users.environment_roles.get", operationId: "users_environment_roles_get", method: "GET", path: "/users/{id}/environment-roles/{role_id}", pathParams: ["id", "role_id"], scope: "roles:read", danger: "read", approval: true, body: false, pagination: null },
+  "users.environment_roles.grant": { action: "users.environment_roles.grant", operationId: "users_environment_roles_grant", method: "PUT", path: "/users/{id}/environment-roles/{role_id}", pathParams: ["id", "role_id"], scope: "roles:write", danger: "critical", approval: true, body: false, pagination: null },
+  "users.environment_roles.list": { action: "users.environment_roles.list", operationId: "users_environment_roles_list", method: "GET", path: "/users/{id}/environment-roles", pathParams: ["id"], scope: "roles:read", danger: "read", approval: true, body: false, pagination: null },
+  "users.environment_roles.revoke": { action: "users.environment_roles.revoke", operationId: "users_environment_roles_revoke", method: "DELETE", path: "/users/{id}/environment-roles/{role_id}", pathParams: ["id", "role_id"], scope: "roles:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "users.erase": { action: "users.erase", operationId: "users_erase", method: "POST", path: "/users/{id}/erase", pathParams: ["id"], scope: "users:erase", danger: "critical", approval: true, body: false, pagination: null },
+  "users.get": { action: "users.get", operationId: "users_get", method: "GET", path: "/users/{id}", pathParams: ["id"], scope: "users:read", danger: "read", approval: true, body: false, pagination: null },
+  "users.list": { action: "users.list", operationId: "users_list", method: "GET", path: "/users", pathParams: [], scope: "users:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "users.mfa.reset": { action: "users.mfa.reset", operationId: "users_mfa_reset", method: "DELETE", path: "/users/{id}/mfa", pathParams: ["id"], scope: "users:write", danger: "critical", approval: true, body: false, pagination: null },
+  "users.password_reset.send": { action: "users.password_reset.send", operationId: "users_password_reset_send", method: "POST", path: "/users/{id}/password-reset", pathParams: ["id"], scope: "users:write", danger: "write", approval: true, body: false, pagination: null },
+  "users.password.set": { action: "users.password.set", operationId: "users_password_set", method: "POST", path: "/users/{id}/password", pathParams: ["id"], scope: "users:write", danger: "critical", approval: true, body: true, pagination: null },
+  "users.reactivate": { action: "users.reactivate", operationId: "users_reactivate", method: "POST", path: "/users/{id}/reactivate", pathParams: ["id"], scope: "users:write", danger: "write", approval: true, body: false, pagination: null },
+  "users.sessions.list": { action: "users.sessions.list", operationId: "users_sessions_list", method: "GET", path: "/users/{id}/sessions", pathParams: ["id"], scope: "users:read", danger: "read", approval: true, body: false, pagination: null },
+  "users.sessions.revoke": { action: "users.sessions.revoke", operationId: "users_sessions_revoke", method: "DELETE", path: "/users/{id}/sessions/{session_id}", pathParams: ["id", "session_id"], scope: "users:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "users.sessions.revoke_all": { action: "users.sessions.revoke_all", operationId: "users_sessions_revoke_all", method: "DELETE", path: "/users/{id}/sessions", pathParams: ["id"], scope: "users:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "users.update": { action: "users.update", operationId: "users_update", method: "PATCH", path: "/users/{id}", pathParams: ["id"], scope: "users:write", danger: "critical", approval: true, body: true, pagination: null },
+  "users.verification.send": { action: "users.verification.send", operationId: "users_verification_send", method: "POST", path: "/users/{id}/verification", pathParams: ["id"], scope: "users:write", danger: "write", approval: true, body: false, pagination: null },
+  "users.verify": { action: "users.verify", operationId: "users_verify", method: "POST", path: "/users/{id}/verify", pathParams: ["id"], scope: "users:write", danger: "critical", approval: true, body: false, pagination: null },
+  "webhooks.create": { action: "webhooks.create", operationId: "webhooks_create", method: "POST", path: "/webhooks", pathParams: [], scope: "webhooks:write", danger: "critical", approval: true, body: true, pagination: null },
+  "webhooks.delete": { action: "webhooks.delete", operationId: "webhooks_delete", method: "DELETE", path: "/webhooks/{id}", pathParams: ["id"], scope: "webhooks:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "webhooks.get": { action: "webhooks.get", operationId: "webhooks_get", method: "GET", path: "/webhooks/{id}", pathParams: ["id"], scope: "webhooks:read", danger: "read", approval: true, body: false, pagination: null },
+  "webhooks.list": { action: "webhooks.list", operationId: "webhooks_list", method: "GET", path: "/webhooks", pathParams: [], scope: "webhooks:read", danger: "read", approval: true, body: false, pagination: "cursor" },
+  "webhooks.pause": { action: "webhooks.pause", operationId: "webhooks_pause", method: "POST", path: "/webhooks/{id}/pause", pathParams: ["id"], scope: "webhooks:write", danger: "write", approval: true, body: false, pagination: null },
+  "webhooks.resume": { action: "webhooks.resume", operationId: "webhooks_resume", method: "POST", path: "/webhooks/{id}/resume", pathParams: ["id"], scope: "webhooks:write", danger: "write", approval: true, body: false, pagination: null },
+  "webhooks.secret.rotate": { action: "webhooks.secret.rotate", operationId: "webhooks_secret_rotate", method: "POST", path: "/webhooks/{id}/rotate", pathParams: ["id"], scope: "webhooks:write", danger: "critical", approval: true, body: false, pagination: null },
+  "webhooks.signature_scheme.change": { action: "webhooks.signature_scheme.change", operationId: "webhooks_signature_scheme_change", method: "POST", path: "/webhooks/{id}/signature-scheme", pathParams: ["id"], scope: "webhooks:write", danger: "destructive", approval: true, body: true, pagination: null },
+  "webhooks.update": { action: "webhooks.update", operationId: "webhooks_update", method: "PATCH", path: "/webhooks/{id}", pathParams: ["id"], scope: "webhooks:write", danger: "write", approval: true, body: true, pagination: null }
+};
+var EnvironmentClient = class {
+  /** The transport every method runs on — authentication, retries, approvals. */
+  transport;
+  constructor(options) {
+    this.transport = new ManagementTransport("environment", options);
+  }
+  /** Call a route by method and path (relative to `/api/v1`) — for anything not generated. */
+  request(method, path, input, options) {
+    return this.transport.request(method, path, input, options);
+  }
+  accessReviews = {
+    /**
+     * Close an access review and apply it: every revoke is carried out, and undecided items get the review's pending policy (revoke by default).
+     *
+     * Requires scope `governance:write`. Danger: destructive.
+     *
+     * `POST /access-reviews/{id}/close` · action `access_reviews.close`
+     * @scope `governance:write`
+     * @danger destructive
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    close: (id, body, options) => this.transport.call(environmentOperations["access_reviews.close"], [id], body, options),
+    /**
+     * Open an access review of one organization's roles and memberships — or of staff roles — for someone to certify or revoke.
+     *
+     * Requires scope `governance:write`. Danger: write.
+     *
+     * `POST /access-reviews` · action `access_reviews.create`
+     * @scope `governance:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    create: (body, options) => this.transport.call(environmentOperations["access_reviews.create"], [], body, options),
+    /**
+     * Read one access review: its status, due date, pending-item policy and item count.
+     *
+     * Requires scope `governance:read`. Danger: read.
+     *
+     * `GET /access-reviews/{id}` · action `access_reviews.get`
+     * @scope `governance:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    get: (id, query, options) => this.transport.call(environmentOperations["access_reviews.get"], [id], query, options),
+    /**
+     * List access reviews (certification campaigns), open and closed, optionally those covering one organization.
+     *
+     * Requires scope `governance:read`. Danger: read.
+     *
+     * `GET /access-reviews` · action `access_reviews.list`
+     * @scope `governance:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    list: (query, options) => this.transport.call(environmentOperations["access_reviews.list"], [], query, options),
+    /** Every item of `access_reviews.list`, fetching pages as the iteration reaches them. */
+    listAll: (query, options) => this.transport.paginate(environmentOperations["access_reviews.list"], [], query, options),
+    items: {
+      /**
+       * Certify or revoke one item of an open access review. Revokes are applied when the review closes.
+       *
+       * Requires scope `governance:write`. Danger: write.
+       *
+       * `POST /access-reviews/{id}/items/{item_id}` · action `access_reviews.items.decide`
+       * @scope `governance:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      decide: (id, itemId, body, options) => this.transport.call(environmentOperations["access_reviews.items.decide"], [id, itemId], body, options),
+      /**
+       * List the items an access review asks someone to certify or revoke: who holds what, and the decision on each.
+       *
+       * Requires scope `governance:read`. Danger: read.
+       *
+       * `GET /access-reviews/{id}/items` · action `access_reviews.items.list`
+       * @scope `governance:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      list: (id, query, options) => this.transport.call(environmentOperations["access_reviews.items.list"], [id], query, options),
+      /** Every item of `access_reviews.items.list`, fetching pages as the iteration reaches them. */
+      listAll: (id, query, options) => this.transport.paginate(environmentOperations["access_reviews.items.list"], [id], query, options)
+    }
+  };
+  actionApprovals = {
+    /**
+     * Where an approval this key asked for stands
+     *
+     * Any key may poll the approvals it raised, and only those: another key's id is a 404.
+     * `status` is `pending`, `approved`, `denied`, `expired` or `consumed`.
+     *
+     * `GET /action-approvals/{id}`
+     */
+    get: (id, options) => this.transport.call(environmentOperations["action_approvals.get"], [id], void 0, options)
+  };
+  apiKeys = {
+    /**
+     * List the API keys an organization's members created for your apps
+     *
+     * Requires scope `api_keys:read`. Revoked and expired keys are included, marked by
+     * `status`. Never the key itself. Narrow to one app with `?client_id=`.
+     *
+     * `GET /organizations/{organization_id}/api-keys` · action `api_keys.list`
+     * @scope `api_keys:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    list: (organizationId, query, options) => this.transport.call(environmentOperations["api_keys.list"], [organizationId], query, options),
+    /** Every item of `api_keys.list`, fetching pages as the iteration reaches them. */
+    listAll: (organizationId, query, options) => this.transport.paginate(environmentOperations["api_keys.list"], [organizationId], query, options),
+    /**
+     * Revoke a member API key
+     *
+     * Requires scope `api_keys:write`. The key stops verifying at once. Idempotent — an
+     * already-revoked key is a 204 too. Recorded as `api_key.revoked`, with this
+     * management key as the actor.
+     *
+     * `DELETE /api-keys/{id}` · action `api_keys.revoke`
+     * @scope `api_keys:write`
+     * @danger destructive
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    revoke: (id, options) => this.transport.call(environmentOperations["api_keys.revoke"], [id], void 0, options)
+  };
+  apis = {
+    /**
+     * Register an API and its scopes
+     *
+     * Requires scope `apis:write`. Registering an API is the environment's act; no tenant
+     * surface can. `identifier` is an absolute URI (RFC 8707) and becomes the token's
+     * `aud`. Scope keys are unique across the environment. `client_id` links the app whose
+     * roles and permissions the API enforces, and must have the API's owner.
+     * `organization_id` makes the API one organization's; left out, the environment owns
+     * it. Refusals are `422 invalid_api` with the reason.
+     *
+     * `POST /apis` · action `apis.create`
+     * @scope `apis:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    create: (body, options) => this.transport.call(environmentOperations["apis.create"], [], body, options),
+    /**
+     * Delete an API and its scopes
+     *
+     * Requires scope `apis:write`. Tokens already minted for it keep their `aud` until they
+     * expire; apps holding its scope keys keep them as plain scopes.
+     *
+     * `DELETE /apis/{id}` · action `apis.delete`
+     * @scope `apis:write`
+     * @danger destructive
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    delete: (id, options) => this.transport.call(environmentOperations["apis.delete"], [id], void 0, options),
+    /**
+     * Get an API
+     *
+     * Requires scope `apis:read`.
+     *
+     * `GET /apis/{id}` · action `apis.get`
+     * @scope `apis:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    get: (id, options) => this.transport.call(environmentOperations["apis.get"], [id], void 0, options),
+    /**
+     * List registered APIs
+     *
+     * Requires scope `apis:read`.
+     *
+     * `GET /apis` · action `apis.list`
+     * @scope `apis:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    list: (query, options) => this.transport.call(environmentOperations["apis.list"], [], query, options),
+    /** Every item of `apis.list`, fetching pages as the iteration reaches them. */
+    listAll: (query, options) => this.transport.paginate(environmentOperations["apis.list"], [], query, options),
+    /**
+     * Change an API
+     *
+     * Requires scope `apis:write`. Any of: `name`; `client_id` (null unlinks the app);
+     * `scopes`, which is the **complete** set afterwards — scopes named are added or
+     * updated, scopes left out are removed. All or nothing. The identifier never changes:
+     * register a new API instead.
+     *
+     * `PATCH /apis/{id}` · action `apis.update`
+     * @scope `apis:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    update: (id, body, options) => this.transport.call(environmentOperations["apis.update"], [id], body, options),
+    scopes: {
+      /**
+       * Add a scope to an API, or change the description or tenant access of one it owns.
+       *
+       * Requires scope `apis:write`. Danger: write.
+       *
+       * `PUT /apis/{id}/scopes/{key}` · action `apis.scopes.define`
+       * @scope `apis:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      define: (id, key, body, options) => this.transport.call(environmentOperations["apis.scopes.define"], [id, key], body, options),
+      /**
+       * Remove a scope from an API. Apps holding it keep it as a plain scope that no longer reaches the API.
+       *
+       * Requires scope `apis:write`. Danger: destructive.
+       *
+       * `DELETE /apis/{id}/scopes/{key}` · action `apis.scopes.remove`
+       * @scope `apis:write`
+       * @danger destructive
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      remove: (id, key, options) => this.transport.call(environmentOperations["apis.scopes.remove"], [id, key], void 0, options)
+    }
+  };
+  approvals = {
+    /**
+     * Deny a pending approval request (CIBA) for the person it was raised for: the agent gets access_denied and no token.
+     *
+     * Requires scope `approvals:write`. Danger: destructive.
+     *
+     * `POST /agent-requests/{request_id}/deny` · action `approvals.deny`
+     * @scope `approvals:write`
+     * @danger destructive
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    deny: (requestId, options) => this.transport.call(environmentOperations["approvals.deny"], [requestId], void 0, options),
+    /**
+     * List the pending requests from agents to act as one of this environment's people (CIBA): which app, for whom, and what it asks.
+     *
+     * Requires scope `approvals:read`. Danger: read.
+     *
+     * `GET /agent-requests` · action `approvals.list`
+     * @scope `approvals:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    list: (query, options) => this.transport.call(environmentOperations["approvals.list"], [], query, options),
+    /** Every item of `approvals.list`, fetching pages as the iteration reaches them. */
+    listAll: (query, options) => this.transport.paginate(environmentOperations["approvals.list"], [], query, options)
+  };
+  apps = {
+    /**
+     * Export an app's configuration as a blueprint
+     *
+     * Requires scope `apps:read`. `{id}` is the app's id or its `client_id`. The document
+     * carries the app's settings and none of its identity or credentials: no client id,
+     * no secret, no key set, no owning organization. `POST /apps` with it as `blueprint`
+     * creates the same app in another environment.
+     *
+     * `GET /apps/{id}/blueprint` · action `apps.blueprint`
+     * @scope `apps:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    blueprint: (id, options) => this.transport.call(environmentOperations["apps.blueprint"], [id], void 0, options),
+    /**
+     * Copy an app into another environment of this project, with a new client id and secret there. A person on the environment console only; a key exports the blueprint instead.
+     *
+     * Requires scope `apps:write`. Danger: critical.
+     *
+     * `POST /apps/{id}/copy` · action `apps.copy`
+     * @scope `apps:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    copy: (id, body, options) => this.transport.call(environmentOperations["apps.copy"], [id], body, options),
+    /**
+     * Register an app
+     *
+     * Requires scope `apps:write`. Two ways to describe it:
+     *
+     * - **From a blueprint** — send `GET /apps/{id}/blueprint`'s document from another
+     *   environment as `blueprint` (promote staging to production). `name`,
+     *   `redirect_uris` and `post_logout_redirect_uris` beside it replace the
+     *   blueprint's own, since those usually name the environment it came from. A
+     *   `private_key_jwt` blueprint needs `jwks`.
+     * - **Short form** — `name` and `type` (`web`, `spa`, `cli`, `service`, `agent`; default
+     *   `web`), which decide the client type, grants and default scopes as the console's
+     *   "Create app" does. `advanced` takes `client_type` and `grant_types`.
+     *
+     * The response carries `client_secret` for an app that authenticates with one —
+     * **once**. Only its hash is kept, and an idempotent replay returns `client_secret: null`.
+     *
+     * A platform scope reserved for the console (`vault.manage`, `decisions:read`) is
+     * refused (`scope_not_grantable`), as is a registered API's scope this app's owner may
+     * not hold. Danger: critical — it mints a credential.
+     *
+     * `POST /apps` · action `apps.create`
+     * @scope `apps:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    create: (body, options) => this.transport.call(environmentOperations["apps.create"], [], body, options),
+    /**
+     * Delete an app and every secret it holds. Anything signing in as it stops working immediately.
+     *
+     * Requires scope `apps:write`. Danger: critical.
+     *
+     * `DELETE /apps/{id}` · action `apps.delete`
+     * @scope `apps:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    delete: (id, options) => this.transport.call(environmentOperations["apps.delete"], [id], void 0, options),
+    /**
+     * Get one app (OAuth client) by its id or its client_id: its kind, grants, redirect URIs, scopes and settings. Never a secret.
+     *
+     * Requires scope `apps:read`. Danger: read.
+     *
+     * `GET /apps/{id}` · action `apps.get`
+     * @scope `apps:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    get: (id, options) => this.transport.call(environmentOperations["apps.get"], [id], void 0, options),
+    /**
+     * List apps
+     *
+     * Requires scope `apps:read`. Never a secret.
+     *
+     * `GET /apps` · action `apps.list`
+     * @scope `apps:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    list: (query, options) => this.transport.call(environmentOperations["apps.list"], [], query, options),
+    /** Every item of `apps.list`, fetching pages as the iteration reaches them. */
+    listAll: (query, options) => this.transport.paginate(environmentOperations["apps.list"], [], query, options),
+    /**
+     * Rename an app and replace its redirect URIs or sign-out redirect URIs. Fields left out are unchanged.
+     *
+     * Requires scope `apps:write`. Danger: write.
+     *
+     * `PATCH /apps/{id}` · action `apps.update`
+     * @scope `apps:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    update: (id, body, options) => this.transport.call(environmentOperations["apps.update"], [id], body, options),
+    manifest: {
+      /**
+       * Set or clear the URL an app publishes its roles-and-permissions manifest at. Does not fetch it; apps.manifest.sync does.
+       *
+       * Requires scope `apps:write`. Danger: write.
+       *
+       * `PUT /apps/{id}/manifest` · action `apps.manifest.set`
+       * @scope `apps:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      set: (id, body, options) => this.transport.call(environmentOperations["apps.manifest.set"], [id], body, options),
+      /**
+       * Fetch an app's published manifest now and sync the roles and permissions it declares.
+       *
+       * Requires scope `apps:write`. Danger: write.
+       *
+       * `POST /apps/{id}/manifest/sync` · action `apps.manifest.sync`
+       * @scope `apps:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      sync: (id, options) => this.transport.call(environmentOperations["apps.manifest.sync"], [id], void 0, options)
+    },
+    scopes: {
+      /**
+       * Replace an app's complete scope set — the ceiling of what it may request, applied from its next token.
+       *
+       * Requires scope `apps:write`. Danger: write.
+       *
+       * `PUT /apps/{id}/scopes` · action `apps.scopes.set`
+       * @scope `apps:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      set: (id, body, options) => this.transport.call(environmentOperations["apps.scopes.set"], [id], body, options)
+    },
+    secrets: {
+      /**
+       * List an app's live client secrets
+       *
+       * Requires scope `apps:read`. Every live secret, newest first: its id (what
+       * `DELETE /apps/{id}/secrets/{secret_id}` names), the characters it ends in, and its
+       * dates — never a secret. `expires_at` is set on one a rotation replaced, still working
+       * through its overlap. An app holds a handful at most, so there is no page to turn.
+       *
+       * `GET /apps/{id}/secrets` · action `apps.secrets.list`
+       * @scope `apps:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      list: (id, options) => this.transport.call(environmentOperations["apps.secrets.list"], [id], void 0, options),
+      /**
+       * Revoke one of an app's client secrets immediately. Never its last live secret — rotate that instead.
+       *
+       * Requires scope `apps:write`. Danger: critical.
+       *
+       * `DELETE /apps/{id}/secrets/{secret_id}` · action `apps.secrets.revoke`
+       * @scope `apps:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      revoke: (id, secretId, options) => this.transport.call(environmentOperations["apps.secrets.revoke"], [id, secretId], void 0, options),
+      /**
+       * Mint a new client secret for an app and retire the current ones after grace_seconds (0 = at once). The new secret is returned once.
+       *
+       * Requires scope `apps:write`. Danger: critical.
+       *
+       * `POST /apps/{id}/secrets` · action `apps.secrets.rotate`
+       * @scope `apps:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      rotate: (id, body, options) => this.transport.call(environmentOperations["apps.secrets.rotate"], [id], body, options)
+    },
+    settings: {
+      /**
+       * Set the prefix of an app's customer API keys (acme_live), which lets its users create keys for it, or null to stop new keys.
+       *
+       * Requires scope `apps:write`. Danger: write.
+       *
+       * `PUT /apps/{id}/settings/api-key-prefix` · action `apps.settings.api_key_prefix`
+       * @scope `apps:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      apiKeyPrefix: (id, body, options) => this.transport.call(environmentOperations["apps.settings.api_key_prefix"], [id], body, options),
+      /**
+       * Set or clear the URI an app is sent a logout token at when somebody signs out (OIDC Back-Channel Logout).
+       *
+       * Requires scope `apps:write`. Danger: write.
+       *
+       * `PUT /apps/{id}/settings/backchannel-logout` · action `apps.settings.backchannel_logout`
+       * @scope `apps:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      backchannelLogout: (id, body, options) => this.transport.call(environmentOperations["apps.settings.backchannel_logout"], [id], body, options),
+      /**
+       * Turn token exchange (RFC 8693) on or off for a confidential app.
+       *
+       * Requires scope `apps:write`. Danger: write.
+       *
+       * `PUT /apps/{id}/settings/token-exchange` · action `apps.settings.token_exchange`
+       * @scope `apps:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      tokenExchange: (id, body, options) => this.transport.call(environmentOperations["apps.settings.token_exchange"], [id], body, options),
+      /**
+       * Set how long an app's access tokens live, in seconds, or null for the install's default.
+       *
+       * Requires scope `apps:write`. Danger: write.
+       *
+       * `PUT /apps/{id}/settings/token-lifetime` · action `apps.settings.token_lifetime`
+       * @scope `apps:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      tokenLifetime: (id, body, options) => this.transport.call(environmentOperations["apps.settings.token_lifetime"], [id], body, options)
+    }
+  };
+  auditLogs = {
+    /**
+     * Re-hash one organization's audit-event chain (from the oldest event retention kept, or from_sequence) and report whether every event is unchanged and in place.
+     *
+     * Requires scope `audit_logs:read`. Danger: read.
+     *
+     * `GET /audit-logs/verify` · action `audit_logs.verify`
+     * @scope `audit_logs:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    verify: (query, options) => this.transport.call(environmentOperations["audit_logs.verify"], [], query, options),
+    events: {
+      /**
+       * Record 1–100 audit events your app's users caused, each for one of your organizations (customers); checked against the action's schema when it has one and appended to that organization's tamper-evident chain. Send an Idempotency-Key.
+       *
+       * Requires scope `audit_logs:write`. Danger: write.
+       *
+       * `POST /audit-logs/events` · action `audit_logs.events.create`
+       * @scope `audit_logs:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      create: (body, options) => this.transport.call(environmentOperations["audit_logs.events.create"], [], body, options),
+      /**
+       * Read audit events newest first, for one organization or the whole environment, filtered by action, actor, target and time range; pass `next_cursor` as `after` to page.
+       *
+       * Requires scope `audit_logs:read`. Danger: read.
+       *
+       * `GET /audit-logs/events` · action `audit_logs.events.list`
+       * @scope `audit_logs:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      list: (query, options) => this.transport.call(environmentOperations["audit_logs.events.list"], [], query, options),
+      /** Every item of `audit_logs.events.list`, fetching pages as the iteration reaches them. */
+      listAll: (query, options) => this.transport.paginate(environmentOperations["audit_logs.events.list"], [], query, options)
+    },
+    exports: {
+      /**
+       * Start a CSV export of audit events (same filters as the list). It is written on the queue: poll audit_logs.exports.get until state is ready, then download from its short-lived url.
+       *
+       * Requires scope `audit_logs:export`. Danger: write.
+       *
+       * `POST /audit-logs/exports` · action `audit_logs.exports.create`
+       * @scope `audit_logs:export`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      create: (body, options) => this.transport.call(environmentOperations["audit_logs.exports.create"], [], body, options),
+      /**
+       * Read an audit-log export's state; once ready it carries a signed download url valid for a few minutes (read it again for a fresh one).
+       *
+       * Requires scope `audit_logs:read`. Danger: read.
+       *
+       * `GET /audit-logs/exports/{id}` · action `audit_logs.exports.get`
+       * @scope `audit_logs:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      get: (id, options) => this.transport.call(environmentOperations["audit_logs.exports.get"], [id], void 0, options)
+    },
+    schemas: {
+      /**
+       * Define the schema one audit-log action's events must match — allowed target types and metadata schemas (a subset of JSON Schema). Events of that action are then validated on arrival.
+       *
+       * Requires scope `audit_logs:manage`. Danger: write.
+       *
+       * `POST /audit-logs/schemas` · action `audit_logs.schemas.create`
+       * @scope `audit_logs:manage`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      create: (body, options) => this.transport.call(environmentOperations["audit_logs.schemas.create"], [], body, options),
+      /**
+       * Delete an audit-log action's schema. Its events are then accepted unchecked — or refused, if the environment is in strict mode.
+       *
+       * Requires scope `audit_logs:manage`. Danger: destructive.
+       *
+       * `DELETE /audit-logs/schemas/{action}` · action `audit_logs.schemas.delete`
+       * @scope `audit_logs:manage`
+       * @danger destructive
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      delete: (action, options) => this.transport.call(environmentOperations["audit_logs.schemas.delete"], [action], void 0, options),
+      /**
+       * Read the schema one audit-log action's events are validated against.
+       *
+       * Requires scope `audit_logs:read`. Danger: read.
+       *
+       * `GET /audit-logs/schemas/{action}` · action `audit_logs.schemas.get`
+       * @scope `audit_logs:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      get: (action, options) => this.transport.call(environmentOperations["audit_logs.schemas.get"], [action], void 0, options),
+      /**
+       * List the audit-log schemas this environment validates events against, one per action.
+       *
+       * Requires scope `audit_logs:read`. Danger: read.
+       *
+       * `GET /audit-logs/schemas` · action `audit_logs.schemas.list`
+       * @scope `audit_logs:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      list: (query, options) => this.transport.call(environmentOperations["audit_logs.schemas.list"], [], query, options),
+      /** Every item of `audit_logs.schemas.list`, fetching pages as the iteration reaches them. */
+      listAll: (query, options) => this.transport.paginate(environmentOperations["audit_logs.schemas.list"], [], query, options),
+      /**
+       * Replace an audit-log action's schema with a new version (omitted parts are removed). Recorded events keep the version they were checked against.
+       *
+       * Requires scope `audit_logs:manage`. Danger: write.
+       *
+       * `PUT /audit-logs/schemas/{action}` · action `audit_logs.schemas.update`
+       * @scope `audit_logs:manage`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      update: (action, body, options) => this.transport.call(environmentOperations["audit_logs.schemas.update"], [action], body, options)
+    },
+    settings: {
+      /**
+       * Read this environment's audit-log settings: retention in days and whether strict schemas are on.
+       *
+       * Requires scope `audit_logs:read`. Danger: read.
+       *
+       * `GET /audit-logs/settings` · action `audit_logs.settings.get`
+       * @scope `audit_logs:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      get: (options) => this.transport.call(environmentOperations["audit_logs.settings.get"], [], void 0, options),
+      /**
+       * Change this environment's audit-log retention (days, 1–3650) and strict mode. Shortening retention deletes older events at the next daily prune — irreversibly.
+       *
+       * Requires scope `audit_logs:manage`. Danger: destructive.
+       *
+       * `PATCH /audit-logs/settings` · action `audit_logs.settings.update`
+       * @scope `audit_logs:manage`
+       * @danger destructive
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      update: (body, options) => this.transport.call(environmentOperations["audit_logs.settings.update"], [], body, options)
+    }
+  };
+  audit = {
+    /**
+     * Read this environment's audit trail oldest first, optionally narrowed by action, actor type or organization; pass the last id as `after` to page.
+     *
+     * Requires scope `audit:read`. Danger: read.
+     *
+     * `GET /audit-log` · action `audit.list`
+     * @scope `audit:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    list: (query, options) => this.transport.call(environmentOperations["audit.list"], [], query, options),
+    /** Every item of `audit.list`, fetching pages as the iteration reaches them. */
+    listAll: (query, options) => this.transport.paginate(environmentOperations["audit.list"], [], query, options)
+  };
+  branding = {
+    appearance: {
+      /**
+       * Read the hosted sign-in theme: the environment default, or one organization's own.
+       *
+       * Requires scope `branding:read`. Danger: read.
+       *
+       * `GET /branding/appearance` · action `branding.appearance.get`
+       * @scope `branding:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      get: (query, options) => this.transport.call(environmentOperations["branding.appearance.get"], [], query, options),
+      /**
+       * Set the hosted sign-in theme (preset, colours, corners, type, logo) for the environment default or one organization.
+       *
+       * Requires scope `branding:write`. Danger: write.
+       *
+       * `PUT /branding/appearance` · action `branding.appearance.set`
+       * @scope `branding:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      set: (body, options) => this.transport.call(environmentOperations["branding.appearance.set"], [], body, options)
+    },
+    whitelabel: {
+      /**
+       * Read the white-label branding (palette, app name, email sender, logo) of the environment default or one organization.
+       *
+       * Requires scope `branding:read`. Danger: read.
+       *
+       * `GET /branding/whitelabel` · action `branding.whitelabel.get`
+       * @scope `branding:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      get: (query, options) => this.transport.call(environmentOperations["branding.whitelabel.get"], [], query, options),
+      /**
+       * Save the white-label branding (palette, app name, email sender, welcome email) of the environment default or one organization.
+       *
+       * Requires scope `branding:write`. Danger: write.
+       *
+       * `PUT /branding/whitelabel` · action `branding.whitelabel.set`
+       * @scope `branding:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      set: (body, options) => this.transport.call(environmentOperations["branding.whitelabel.set"], [], body, options)
+    }
+  };
+  directories = {
+    /**
+     * Connect a Google Workspace or Microsoft Entra directory to sync an organization's people from, verifying the credentials first. Runs the first sync.
+     *
+     * Requires scope `directory_sync:write`. Danger: critical.
+     *
+     * `POST /directories/connect` · action `directories.connect`
+     * @scope `directory_sync:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    connect: (body, options) => this.transport.call(environmentOperations["directories.connect"], [], body, options),
+    /**
+     * Register a SCIM directory for an organization. Answers the SCIM base URL and a bearer token, shown once.
+     *
+     * Requires scope `directory_sync:write`. Danger: critical.
+     *
+     * `POST /directories` · action `directories.create`
+     * @scope `directory_sync:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    create: (body, options) => this.transport.call(environmentOperations["directories.create"], [], body, options),
+    /**
+     * Delete an inbound directory. Its token stops working; the people it provisioned keep their accounts.
+     *
+     * Requires scope `directory_sync:write`. Danger: destructive.
+     *
+     * `DELETE /directories/{id}` · action `directories.delete`
+     * @scope `directory_sync:write`
+     * @danger destructive
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    delete: (id, body, options) => this.transport.call(environmentOperations["directories.delete"], [id], body, options),
+    /**
+     * Read one inbound directory: its provider, status, SCIM base URL and last sync error. Never its token or credentials.
+     *
+     * Requires scope `directory_sync:read`. Danger: read.
+     *
+     * `GET /directories/{id}` · action `directories.get`
+     * @scope `directory_sync:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    get: (id, query, options) => this.transport.call(environmentOperations["directories.get"], [id], query, options),
+    /**
+     * List the directories (SCIM, Google Workspace, Microsoft Entra) syncing people in, optionally for one organization, with their last sync error.
+     *
+     * Requires scope `directory_sync:read`. Danger: read.
+     *
+     * `GET /directories` · action `directories.list`
+     * @scope `directory_sync:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    list: (query, options) => this.transport.call(environmentOperations["directories.list"], [], query, options),
+    /** Every item of `directories.list`, fetching pages as the iteration reaches them. */
+    listAll: (query, options) => this.transport.paginate(environmentOperations["directories.list"], [], query, options),
+    /**
+     * Rename an inbound directory.
+     *
+     * Requires scope `directory_sync:write`. Danger: write.
+     *
+     * `PATCH /directories/{id}` · action `directories.update`
+     * @scope `directory_sync:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    update: (id, body, options) => this.transport.call(environmentOperations["directories.update"], [id], body, options),
+    groups: {
+      /**
+       * List the groups a directory has synced, with the role ids each group is mapped onto.
+       *
+       * Requires scope `directory_sync:read`. Danger: read.
+       *
+       * `GET /directories/{id}/groups` · action `directories.groups.list`
+       * @scope `directory_sync:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      list: (id, query, options) => this.transport.call(environmentOperations["directories.groups.list"], [id], query, options),
+      /** Every item of `directories.groups.list`, fetching pages as the iteration reaches them. */
+      listAll: (id, query, options) => this.transport.paginate(environmentOperations["directories.groups.list"], [id], query, options),
+      /**
+       * Map a directory group onto a role (everyone in the group holds it as membership syncs), or unmap it.
+       *
+       * Requires scope `directory_sync:write`. Danger: write.
+       *
+       * `POST /directories/{id}/group-roles` · action `directories.groups.map`
+       * @scope `directory_sync:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      map: (id, body, options) => this.transport.call(environmentOperations["directories.groups.map"], [id], body, options)
+    },
+    status: {
+      /**
+       * Pause or resume an inbound directory's provisioning.
+       *
+       * Requires scope `directory_sync:write`. Danger: write.
+       *
+       * `POST /directories/{id}/status` · action `directories.status.set`
+       * @scope `directory_sync:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      set: (id, body, options) => this.transport.call(environmentOperations["directories.status.set"], [id], body, options)
+    },
+    token: {
+      /**
+       * Issue a new bearer token for a SCIM directory, returned once. The old token stops working immediately.
+       *
+       * Requires scope `directory_sync:write`. Danger: critical.
+       *
+       * `POST /directories/{id}/rotate` · action `directories.token.rotate`
+       * @scope `directory_sync:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      rotate: (id, body, options) => this.transport.call(environmentOperations["directories.token.rotate"], [id], body, options)
+    }
+  };
+  domains = {
+    /**
+     * Start serving this environment on a custom domain: returns the DNS TXT record that proves you control it.
+     *
+     * Requires scope `domains:write`. Danger: write.
+     *
+     * `POST /domains` · action `domains.add`
+     * @scope `domains:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    add: (body, options) => this.transport.call(environmentOperations["domains.add"], [], body, options),
+    /**
+     * Read this environment's custom domain, and the DNS TXT record that proves a pending one.
+     *
+     * Requires scope `domains:read`. Danger: read.
+     *
+     * `GET /domains` · action `domains.get`
+     * @scope `domains:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    get: (options) => this.transport.call(environmentOperations["domains.get"], [], void 0, options),
+    /**
+     * Stop serving this environment on its custom domain. Anything using that domain stops reaching the environment.
+     *
+     * Requires scope `domains:write`. Danger: destructive.
+     *
+     * `DELETE /domains` · action `domains.remove`
+     * @scope `domains:write`
+     * @danger destructive
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    remove: (options) => this.transport.call(environmentOperations["domains.remove"], [], void 0, options),
+    /**
+     * Look for the pending domain's DNS TXT record and, once it is visible, serve this environment on that domain.
+     *
+     * Requires scope `domains:write`. Danger: write.
+     *
+     * `POST /domains/verify` · action `domains.verify`
+     * @scope `domains:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    verify: (options) => this.transport.call(environmentOperations["domains.verify"], [], void 0, options)
+  };
+  events = {
+    /**
+     * Read this environment's domain events (the facts webhooks deliver) oldest first; pass the last id as `after` to poll for new ones.
+     *
+     * Requires scope `events:read`. Danger: read.
+     *
+     * `GET /events` · action `events.list`
+     * @scope `events:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    list: (query, options) => this.transport.call(environmentOperations["events.list"], [], query, options),
+    /** Every item of `events.list`, fetching pages as the iteration reaches them. */
+    listAll: (query, options) => this.transport.paginate(environmentOperations["events.list"], [], query, options)
+  };
+  frontendKeys = {
+    /**
+     * Create a publishable frontend key for a browser app, usable only from the origins listed. The key is public by design.
+     *
+     * Requires scope `frontend_keys:write`. Danger: write.
+     *
+     * `POST /frontend-keys` · action `frontend_keys.create`
+     * @scope `frontend_keys:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    create: (body, options) => this.transport.call(environmentOperations["frontend_keys.create"], [], body, options),
+    /**
+     * List the publishable frontend keys browser apps present to the Frontend API, in full, with their allowed origins.
+     *
+     * Requires scope `frontend_keys:read`. Danger: read.
+     *
+     * `GET /frontend-keys` · action `frontend_keys.list`
+     * @scope `frontend_keys:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    list: (query, options) => this.transport.call(environmentOperations["frontend_keys.list"], [], query, options),
+    /** Every item of `frontend_keys.list`, fetching pages as the iteration reaches them. */
+    listAll: (query, options) => this.transport.paginate(environmentOperations["frontend_keys.list"], [], query, options),
+    /**
+     * Revoke a publishable frontend key. Pages still holding it stop working immediately.
+     *
+     * Requires scope `frontend_keys:write`. Danger: destructive.
+     *
+     * `DELETE /frontend-keys/{id}` · action `frontend_keys.revoke`
+     * @scope `frontend_keys:write`
+     * @danger destructive
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    revoke: (id, options) => this.transport.call(environmentOperations["frontend_keys.revoke"], [id], void 0, options),
+    /**
+     * Replace the exact list of origins allowed to present a publishable frontend key. Live on the next request.
+     *
+     * Requires scope `frontend_keys:write`. Danger: write.
+     *
+     * `PUT /frontend-keys/{id}/origins` · action `frontend_keys.set_origins`
+     * @scope `frontend_keys:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    setOrigins: (id, body, options) => this.transport.call(environmentOperations["frontend_keys.set_origins"], [id], body, options)
+  };
+  hooks = {
+    /**
+     * Register a hook at a hook point (token minting, login, registration, password change). Returns its signing secret once.
+     *
+     * Requires scope `hooks:write`. Danger: critical.
+     *
+     * `POST /hooks` · action `hooks.create`
+     * @scope `hooks:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    create: (body, options) => this.transport.call(environmentOperations["hooks.create"], [], body, options),
+    /**
+     * Remove a hook. It is no longer called at its hook point.
+     *
+     * Requires scope `hooks:write`. Danger: destructive.
+     *
+     * `DELETE /hooks/{id}` · action `hooks.delete`
+     * @scope `hooks:write`
+     * @danger destructive
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    delete: (id, options) => this.transport.call(environmentOperations["hooks.delete"], [id], void 0, options),
+    /**
+     * Get one hook: its URL, hook point, owner and whether it is active. Never its signing secret.
+     *
+     * Requires scope `hooks:read`. Danger: read.
+     *
+     * `GET /hooks/{id}` · action `hooks.get`
+     * @scope `hooks:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    get: (id, options) => this.transport.call(environmentOperations["hooks.get"], [id], void 0, options),
+    /**
+     * List the hooks — endpoints called during sign-in and token issuance — with their hook point, owner and whether each is active.
+     *
+     * Requires scope `hooks:read`. Danger: read.
+     *
+     * `GET /hooks` · action `hooks.list`
+     * @scope `hooks:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    list: (query, options) => this.transport.call(environmentOperations["hooks.list"], [], query, options),
+    /** Every item of `hooks.list`, fetching pages as the iteration reaches them. */
+    listAll: (query, options) => this.transport.paginate(environmentOperations["hooks.list"], [], query, options),
+    /**
+     * Pause (active: false) or activate (active: true) a hook.
+     *
+     * Requires scope `hooks:write`. Danger: critical.
+     *
+     * `PATCH /hooks/{id}` · action `hooks.update`
+     * @scope `hooks:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    update: (id, body, options) => this.transport.call(environmentOperations["hooks.update"], [id], body, options)
+  };
+  invitations = {
+    /**
+     * List an organization's pending invitations
+     *
+     * Requires scope `invitations:read`. Pending and unexpired only.
+     *
+     * `GET /organizations/{organization_id}/invitations` · action `invitations.list`
+     * @scope `invitations:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    list: (organizationId, query, options) => this.transport.call(environmentOperations["invitations.list"], [organizationId], query, options),
+    /** Every item of `invitations.list`, fetching pages as the iteration reaches them. */
+    listAll: (organizationId, query, options) => this.transport.paginate(environmentOperations["invitations.list"], [organizationId], query, options),
+    /**
+     * Mail a pending invitation again
+     *
+     * Requires scope `invitations:write`. On a **fresh link**: only a hash of the old one is
+     * kept, so it cannot be re-sent, and the reason people ask is usually that it expired.
+     * The response is the NEW invitation — its `id` replaces the old one, which stops
+     * working. Its roles and app context move with it.
+     *
+     * One re-send per address per minute (`429 too_soon`); `409 not_pending` for one that
+     * was accepted, withdrawn or has expired; `503 mail_failed` keeps the invitation.
+     *
+     * `POST /organizations/{organization_id}/invitations/{invitation_id}/resend` · action `invitations.resend`
+     * @scope `invitations:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    resend: (organizationId, invitationId, options) => this.transport.call(environmentOperations["invitations.resend"], [organizationId, invitationId], void 0, options),
+    /**
+     * Withdraw a pending invitation
+     *
+     * Requires scope `invitations:write`. The link stops working, and the roles parked
+     * for it go with it. `409 not_pending` for one already accepted, withdrawn or expired.
+     *
+     * `DELETE /organizations/{organization_id}/invitations/{invitation_id}` · action `invitations.revoke`
+     * @scope `invitations:write`
+     * @danger destructive
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    revoke: (organizationId, invitationId, options) => this.transport.call(environmentOperations["invitations.revoke"], [organizationId, invitationId], void 0, options),
+    /**
+     * Invite someone to the organization
+     *
+     * Requires scope `invitations:write`. Mails a link; the person joins when they open it
+     * and confirm. Inviting an address again replaces its earlier pending invitation.
+     *
+     * - `role` — `admin` or `member` (default `member`). Never `owner`.
+     * - `roles` — access roles granted when the invitation is accepted: role ids, or your
+     *   app's manifest **keys** when `client_id` names the app that declared them. Only
+     *   roles the organization's own administrators could grant are accepted: a **staff
+     *   role** is refused (`422 role_not_assignable`) — grant it after they join, with
+     *   `PUT …/members/{user_id}/roles/{role_id}`.
+     * - `client_id` + `return_to` — after accepting, the person is sent to `return_to`,
+     *   which must be on one of that app's registered redirect-URI origins (checked again
+     *   when the invitation is accepted).
+     * - `inviter_name` — who the mail says it is from. Defaults to the app's name, or the
+     *   environment's.
+     *
+     * Refusals: `409 already_member`, `409 access_role_conflict` (segregation of duties),
+     * `422 unknown_role`, `422 role_not_assignable`, `422 unknown_app`,
+     * `422 return_without_app`, `422 return_to_malformed`, `422 return_to_not_registered`,
+     * `503 mail_failed` (nothing was created — retry).
+     *
+     * `POST /organizations/{organization_id}/invitations` · action `invitations.send`
+     * @scope `invitations:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    send: (organizationId, body, options) => this.transport.call(environmentOperations["invitations.send"], [organizationId], body, options)
+  };
+  keys = {
+    /**
+     * Mint a management key for this environment, at most as wide as the caller. The value is returned once, as `token`.
+     *
+     * Requires scope `keys:write`. Danger: critical.
+     *
+     * `POST /keys` · action `keys.create`
+     * @scope `keys:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    create: (body, options) => this.transport.call(environmentOperations["keys.create"], [], body, options),
+    /**
+     * List this environment's management keys (names, scopes, parents, expiry, last use — never their values).
+     *
+     * Requires scope `keys:read`. Danger: read.
+     *
+     * `GET /keys` · action `keys.list`
+     * @scope `keys:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    list: (query, options) => this.transport.call(environmentOperations["keys.list"], [], query, options),
+    /** Every item of `keys.list`, fetching pages as the iteration reaches them. */
+    listAll: (query, options) => this.transport.paginate(environmentOperations["keys.list"], [], query, options),
+    /**
+     * Revoke a management key and every key it minted, immediately.
+     *
+     * Requires scope `keys:write`. Danger: destructive.
+     *
+     * `DELETE /keys/{id}` · action `keys.revoke`
+     * @scope `keys:write`
+     * @danger destructive
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    revoke: (id, options) => this.transport.call(environmentOperations["keys.revoke"], [id], void 0, options),
+    /**
+     * Rotate a management key: mint a successor with the same scopes and retire the old one after a grace period.
+     *
+     * Requires scope `keys:write`. Danger: critical.
+     *
+     * `POST /keys/{id}/rotate` · action `keys.rotate`
+     * @scope `keys:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    rotate: (id, body, options) => this.transport.call(environmentOperations["keys.rotate"], [id], body, options)
+  };
+  legacyLogin = {
+    /**
+     * Approve the declared legacy login endpoint: sign-ins for people not yet migrated, with their passwords, go to that URL.
+     *
+     * Requires scope `signin:write`. Danger: critical.
+     *
+     * `POST /legacy-login/approve` · action `legacy_login.approve`
+     * @scope `signin:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    approve: (options) => this.transport.call(environmentOperations["legacy_login.approve"], [], void 0, options),
+    /**
+     * Read the legacy login endpoint an app declared for migration, and whether it is approved to receive sign-ins.
+     *
+     * Requires scope `signin:read`. Danger: read.
+     *
+     * `GET /legacy-login` · action `legacy_login.get`
+     * @scope `signin:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    get: (options) => this.transport.call(environmentOperations["legacy_login.get"], [], void 0, options),
+    /**
+     * Ask the declared legacy login endpoint whether it knows an address — your own — to test it before approving. Sends no password.
+     *
+     * Requires scope `signin:write`. Danger: write.
+     *
+     * `POST /legacy-login/probe` · action `legacy_login.probe`
+     * @scope `signin:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    probe: (body, options) => this.transport.call(environmentOperations["legacy_login.probe"], [], body, options),
+    /**
+     * Withdraw the legacy login approval. People not yet migrated can no longer sign in; the declaration stays on file.
+     *
+     * Requires scope `signin:write`. Danger: critical.
+     *
+     * `POST /legacy-login/revoke` · action `legacy_login.revoke`
+     * @scope `signin:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    revoke: (options) => this.transport.call(environmentOperations["legacy_login.revoke"], [], void 0, options)
+  };
+  logStreams = {
+    /**
+     * Stream the audit trail to a SIEM (Splunk, Elastic, Graylog, CEF, JSON), Datadog, or an S3 or GCS bucket. A generated HMAC key is returned once.
+     *
+     * Requires scope `log_streams:write`. Danger: critical.
+     *
+     * `POST /log-streams` · action `log_streams.create`
+     * @scope `log_streams:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    create: (body, options) => this.transport.call(environmentOperations["log_streams.create"], [], body, options),
+    /**
+     * Delete an audit log stream. Nothing more is delivered to its endpoint.
+     *
+     * Requires scope `log_streams:write`. Danger: destructive.
+     *
+     * `DELETE /log-streams/{id}` · action `log_streams.delete`
+     * @scope `log_streams:write`
+     * @danger destructive
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    delete: (id, options) => this.transport.call(environmentOperations["log_streams.delete"], [id], void 0, options),
+    /**
+     * Get one audit log stream: destination, endpoint, auth scheme, owner and health. Never its secret.
+     *
+     * Requires scope `log_streams:read`. Danger: read.
+     *
+     * `GET /log-streams/{id}` · action `log_streams.get`
+     * @scope `log_streams:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    get: (id, options) => this.transport.call(environmentOperations["log_streams.get"], [id], void 0, options),
+    /**
+     * List the SIEM destinations this environment's audit trail is streamed to, and whether each is enabled. Never a secret.
+     *
+     * Requires scope `log_streams:read`. Danger: read.
+     *
+     * `GET /log-streams` · action `log_streams.list`
+     * @scope `log_streams:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    list: (query, options) => this.transport.call(environmentOperations["log_streams.list"], [], query, options),
+    /** Every item of `log_streams.list`, fetching pages as the iteration reaches them. */
+    listAll: (query, options) => this.transport.paginate(environmentOperations["log_streams.list"], [], query, options),
+    /**
+     * Send one test event to a log stream now and report whether the destination accepted it, and if not, why.
+     *
+     * Requires scope `log_streams:write`. Danger: write.
+     *
+     * `POST /log-streams/{id}/test` · action `log_streams.test`
+     * @scope `log_streams:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    test: (id, options) => this.transport.call(environmentOperations["log_streams.test"], [id], void 0, options),
+    /**
+     * Change an audit log stream's name, destination, endpoint, options or credential (re-validated; resets its circuit breaker), or disable (enabled: false) / resume (enabled: true) it.
+     *
+     * Requires scope `log_streams:write`. Danger: critical.
+     *
+     * `PATCH /log-streams/{id}` · action `log_streams.update`
+     * @scope `log_streams:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    update: (id, body, options) => this.transport.call(environmentOperations["log_streams.update"], [id], body, options)
+  };
+  members = {
+    /**
+     * Add an existing user as a member
+     *
+     * Requires scope `members:write`. Straight in — no invitation, no mail. Name the user by
+     * `user_id` or by `email`; they must exist in this environment (`422 user_not_found`).
+     * A suspended or archived organization takes no new members (`409 organization_inactive`).
+     *
+     * `roles` grants access roles at the same time — ids, or your app's manifest keys with
+     * `client_id` — with the environment's authority (staff roles included). One the
+     * organization cannot hold is `422 role_not_assignable`; a segregation-of-duties
+     * conflict is `409 role_conflict`, and nothing is added.
+     *
+     * `role` is `admin` or `member` (default `member`). `owner` is never assignable:
+     * ownership moves with `transfer-ownership`.
+     *
+     * **Idempotent for the same role**: repeating the request answers `200` with the
+     * existing membership. A member on a *different* role is `409 already_member` — change
+     * the role with `PATCH`.
+     *
+     * `POST /organizations/{organization_id}/members` · action `members.add`
+     * @scope `members:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    add: (organizationId, body, options) => this.transport.call(environmentOperations["members.add"], [organizationId], body, options),
+    /**
+     * List an organization's members
+     *
+     * Requires scope `members:read`. Every membership, whatever its status, oldest first.
+     *
+     * `GET /organizations/{organization_id}/members` · action `members.list`
+     * @scope `members:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    list: (organizationId, query, options) => this.transport.call(environmentOperations["members.list"], [organizationId], query, options),
+    /** Every item of `members.list`, fetching pages as the iteration reaches them. */
+    listAll: (organizationId, query, options) => this.transport.paginate(environmentOperations["members.list"], [organizationId], query, options),
+    /**
+     * Remove a member
+     *
+     * Requires scope `members:write`. The member's roles in the organization go with the
+     * membership. Removing the only owner is refused with `409 last_owner`.
+     *
+     * `DELETE /organizations/{organization_id}/members/{user_id}` · action `members.remove`
+     * @scope `members:write`
+     * @danger destructive
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    remove: (organizationId, userId, options) => this.transport.call(environmentOperations["members.remove"], [organizationId, userId], void 0, options),
+    /**
+     * Change a member's role
+     *
+     * Requires scope `members:write`. `role` is `admin` or `member`. Demoting the only
+     * owner is refused with `409 last_owner` — transfer ownership first.
+     *
+     * `PATCH /organizations/{organization_id}/members/{user_id}` · action `members.update`
+     * @scope `members:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    update: (organizationId, userId, body, options) => this.transport.call(environmentOperations["members.update"], [organizationId, userId], body, options),
+    roles: {
+      /**
+       * Grant a member a role in the organization
+       *
+       * Requires scope `roles:write`. Idempotent.
+       *
+       * **This API grants with the environment's authority.** It is your backend, so it may
+       * grant any role the organization can hold — including a **staff role**
+       * (`tenant_assignable: false`), such as your support lead's "Support" role at one
+       * customer. An organization's own administrators still cannot: their console, their
+       * invitations and their directory mappings refuse staff roles, and nothing here
+       * changes that.
+       *
+       * Refusals: `422 role_not_assignable` (another organization's role, or one from an app
+       * this organization cannot use), `409 role_conflict` (segregation of duties).
+       *
+       * `PUT /organizations/{organization_id}/members/{user_id}/roles/{role_id}` · action `members.roles.grant`
+       * @scope `roles:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      grant: (organizationId, userId, roleId, query, options) => this.transport.call(environmentOperations["members.roles.grant"], [organizationId, userId, roleId], query, options),
+      /**
+       * List the roles a member holds in the organization
+       *
+       * Requires scope `roles:read`. Roles granted AT this organization. Roles a person holds
+       * everywhere in the environment (staff) are listed under
+       * `/users/{id}/environment-roles`.
+       *
+       * `GET /organizations/{organization_id}/members/{user_id}/roles` · action `members.roles.list`
+       * @scope `roles:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      list: (organizationId, userId, options) => this.transport.call(environmentOperations["members.roles.list"], [organizationId, userId], void 0, options),
+      /**
+       * Take a role back from a member
+       *
+       * Requires scope `roles:write`. Idempotent — a role the member does not hold is a 204 too.
+       *
+       * `DELETE /organizations/{organization_id}/members/{user_id}/roles/{role_id}` · action `members.roles.revoke`
+       * @scope `roles:write`
+       * @danger destructive
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      revoke: (organizationId, userId, roleId, query, options) => this.transport.call(environmentOperations["members.roles.revoke"], [organizationId, userId, roleId], query, options)
+    }
+  };
+  organizations = {
+    /**
+     * Create an organization, optionally with its owner
+     *
+     * Requires scope `organizations:write`.
+     *
+     * `POST /organizations` · action `organizations.create`
+     * @scope `organizations:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    create: (body, options) => this.transport.call(environmentOperations["organizations.create"], [], body, options),
+    /**
+     * Archive an organization
+     *
+     * Requires scope `organizations:write`. **Archives** rather than erases: the status
+     * becomes `deleted`, every member loses access from their next request, the rows stay
+     * for the audit trail, and `organization.deleted` is announced. Idempotent — archiving
+     * an archived organization answers with it unchanged.
+     *
+     * Refused with `409 owns_products` for an organization that owns identity-provider
+     * projects on this platform (a platform customer, not a tenant of your app).
+     *
+     * `DELETE /organizations/{id}` · action `organizations.delete`
+     * @scope `organizations:write`
+     * @danger destructive
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    delete: (id, options) => this.transport.call(environmentOperations["organizations.delete"], [id], void 0, options),
+    /**
+     * Get an organization
+     *
+     * Requires scope `organizations:read`.
+     *
+     * `GET /organizations/{id}` · action `organizations.get`
+     * @scope `organizations:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    get: (id, options) => this.transport.call(environmentOperations["organizations.get"], [id], void 0, options),
+    /**
+     * List organizations
+     *
+     * Requires scope `organizations:read`. A page at a time, archived ones included. Narrow
+     * with `q` (a fragment of the name or slug) or `status`.
+     *
+     * `GET /organizations` · action `organizations.list`
+     * @scope `organizations:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    list: (query, options) => this.transport.call(environmentOperations["organizations.list"], [], query, options),
+    /** Every item of `organizations.list`, fetching pages as the iteration reaches them. */
+    listAll: (query, options) => this.transport.paginate(environmentOperations["organizations.list"], [], query, options),
+    /**
+     * Lift an organization's suspension so its members can sign in again.
+     *
+     * Requires scope `organizations:write`. Danger: write.
+     *
+     * `POST /organizations/{id}/reactivate` · action `organizations.reactivate`
+     * @scope `organizations:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    reactivate: (id, options) => this.transport.call(environmentOperations["organizations.reactivate"], [id], void 0, options),
+    /**
+     * Suspend an organization: its members cannot sign in to it until it is reactivated.
+     *
+     * Requires scope `organizations:write`. Danger: write.
+     *
+     * `POST /organizations/{id}/suspend` · action `organizations.suspend`
+     * @scope `organizations:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    suspend: (id, options) => this.transport.call(environmentOperations["organizations.suspend"], [id], void 0, options),
+    /**
+     * Make a member the organization's owner
+     *
+     * Requires scope `organizations:write`. The new owner must be an **active** member.
+     * With one current owner this is a hand-over: the previous owner stays on as `admin`.
+     * An organization with no owner (created without `owner_user_id`) gets its first; one
+     * with several (from before ownership was transfer-only) ends with exactly one, the
+     * others stepping down to `admin`.
+     *
+     * Refusals: `422 not_a_member`, `409 not_active`, `409 already_owner`.
+     *
+     * `POST /organizations/{id}/transfer-ownership` · action `organizations.transfer_ownership`
+     * @scope `organizations:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    transferOwnership: (id, body, options) => this.transport.call(environmentOperations["organizations.transfer_ownership"], [id], body, options),
+    /**
+     * Rename an organization, change its slug, or replace its metadata
+     *
+     * Requires scope `organizations:write`. A field left out is left alone; a request
+     * that changes nothing answers with the organization as it is and records nothing.
+     * A change is announced as the `organization.updated` webhook and recorded on the
+     * organization's trail as `organization.renamed`, with the values before and after.
+     *
+     * `PATCH /organizations/{id}` · action `organizations.update`
+     * @scope `organizations:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    update: (id, body, options) => this.transport.call(environmentOperations["organizations.update"], [id], body, options),
+    domains: {
+      /**
+       * Claim an email domain (acme.com) for an organization. Returns the DNS TXT record to publish before verifying it.
+       *
+       * Requires scope `organizations:write`. Danger: write.
+       *
+       * `POST /organizations/{organization_id}/domains` · action `organizations.domains.add`
+       * @scope `organizations:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      add: (organizationId, body, options) => this.transport.call(environmentOperations["organizations.domains.add"], [organizationId], body, options),
+      /**
+       * Turn capture on or off for a verified domain: with it on, everyone with an address there signs in through the organization's SSO.
+       *
+       * Requires scope `organizations:write`. Danger: critical.
+       *
+       * `PUT /organizations/{organization_id}/domains/{domain_id}/capture` · action `organizations.domains.capture`
+       * @scope `organizations:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      capture: (organizationId, domainId, body, options) => this.transport.call(environmentOperations["organizations.domains.capture"], [organizationId, domainId], body, options),
+      /**
+       * List the email domains an organization claims
+       *
+       * Requires scope `organizations:read`. Verified or not, each with the DNS TXT record
+       * that proves it (`record_name`, `record_value`). A handful at most; not paged.
+       *
+       * `GET /organizations/{organization_id}/domains` · action `organizations.domains.list`
+       * @scope `organizations:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      list: (organizationId, options) => this.transport.call(environmentOperations["organizations.domains.list"], [organizationId], void 0, options),
+      /**
+       * Remove a claimed email domain from an organization. Capture on it ends.
+       *
+       * Requires scope `organizations:write`. Danger: destructive.
+       *
+       * `DELETE /organizations/{organization_id}/domains/{domain_id}` · action `organizations.domains.remove`
+       * @scope `organizations:write`
+       * @danger destructive
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      remove: (organizationId, domainId, options) => this.transport.call(environmentOperations["organizations.domains.remove"], [organizationId, domainId], void 0, options),
+      /**
+       * Check a claimed domain's DNS TXT record and mark the domain verified if it is published.
+       *
+       * Requires scope `organizations:write`. Danger: write.
+       *
+       * `POST /organizations/{organization_id}/domains/{domain_id}/verify` · action `organizations.domains.verify`
+       * @scope `organizations:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      verify: (organizationId, domainId, options) => this.transport.call(environmentOperations["organizations.domains.verify"], [organizationId, domainId], void 0, options)
+    },
+    portalLinks: {
+      /**
+       * Create a one-time Admin Portal link an organization's IT administrator uses to set up SSO, directory sync, domain verification, log streams or SAML certificate renewal, or to read its audit logs, without an account. The URL is shown once.
+       *
+       * Requires scope `portal_links:write`. Danger: critical.
+       *
+       * `POST /organizations/{organization_id}/portal-links` · action `organizations.portal_links.create`
+       * @scope `portal_links:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      create: (organizationId, body, options) => this.transport.call(environmentOperations["organizations.portal_links.create"], [organizationId], body, options),
+      /**
+       * List an organization's Admin Portal links
+       *
+       * Requires scope `portal_links:read`. Danger: read. The links minted in the last 30
+       * days, newest first — every link that can still be opened is among them, since a link
+       * waits a week at most. Each says what it opens, who minted it, whom it was mailed to
+       * and where it stands (`status`). Never the link itself: it was shown once, when it was
+       * minted, and only its hash is kept. Not paged.
+       *
+       * `GET /organizations/{organization_id}/portal-links` · action `organizations.portal_links.list`
+       * @scope `portal_links:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      list: (organizationId, options) => this.transport.call(environmentOperations["organizations.portal_links.list"], [organizationId], void 0, options),
+      /**
+       * Withdraw an Admin Portal link: it can no longer be opened, and a setup session it already opened ends on its next request. What was already set up through it stays.
+       *
+       * Requires scope `portal_links:write`. Danger: destructive.
+       *
+       * `DELETE /organizations/{organization_id}/portal-links/{id}` · action `organizations.portal_links.revoke`
+       * @scope `portal_links:write`
+       * @danger destructive
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      revoke: (organizationId, id, options) => this.transport.call(environmentOperations["organizations.portal_links.revoke"], [organizationId, id], void 0, options)
+    }
+  };
+  permissions = {
+    /**
+     * Author a manual `feature:action` permission, shared with the environment (organization_id null) or one organization's own.
+     *
+     * Requires scope `role_definitions:write`. Danger: write.
+     *
+     * `POST /permissions` · action `permissions.create`
+     * @scope `role_definitions:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    create: (body, options) => this.transport.call(environmentOperations["permissions.create"], [], body, options),
+    /**
+     * Delete a manual permission: every role carrying it loses it first.
+     *
+     * Requires scope `role_definitions:write`. Danger: destructive.
+     *
+     * `DELETE /permissions/{id}` · action `permissions.delete`
+     * @scope `role_definitions:write`
+     * @danger destructive
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    delete: (id, options) => this.transport.call(environmentOperations["permissions.delete"], [id], void 0, options),
+    /**
+     * List the permission catalogue roles are composed from, a page at a time. Narrow by `client_id` (one app's), `organization_id` (what it can see) or a `q` fragment.
+     *
+     * Requires scope `roles:read`. Danger: read.
+     *
+     * `GET /permissions` · action `permissions.list`
+     * @scope `roles:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    list: (query, options) => this.transport.call(environmentOperations["permissions.list"], [], query, options),
+    /** Every item of `permissions.list`, fetching pages as the iteration reaches them. */
+    listAll: (query, options) => this.transport.paginate(environmentOperations["permissions.list"], [], query, options),
+    /**
+     * Change a manual permission's description, and on the shared tier whether organizations may use it. The key itself never changes.
+     *
+     * Requires scope `role_definitions:write`. Danger: write.
+     *
+     * `PATCH /permissions/{id}` · action `permissions.update`
+     * @scope `role_definitions:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    update: (id, body, options) => this.transport.call(environmentOperations["permissions.update"], [id], body, options)
+  };
+  provisioning = {
+    targets: {
+      /**
+       * Register a downstream app this platform pushes an organization's people to over SCIM, or every organization's with environment_wide.
+       *
+       * Requires scope `provisioning:write`. Danger: critical.
+       *
+       * `POST /provisioning-targets` · action `provisioning.targets.create`
+       * @scope `provisioning:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      create: (body, options) => this.transport.call(environmentOperations["provisioning.targets.create"], [], body, options),
+      /**
+       * Delete a downstream SCIM target. Nothing more is pushed to it.
+       *
+       * Requires scope `provisioning:write`. Danger: destructive.
+       *
+       * `DELETE /provisioning-targets/{id}` · action `provisioning.targets.delete`
+       * @scope `provisioning:write`
+       * @danger destructive
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      delete: (id, body, options) => this.transport.call(environmentOperations["provisioning.targets.delete"], [id], body, options),
+      /**
+       * Read one downstream SCIM target: its URL, auth scheme, status and last error. Never its credential.
+       *
+       * Requires scope `provisioning:read`. Danger: read.
+       *
+       * `GET /provisioning-targets/{id}` · action `provisioning.targets.get`
+       * @scope `provisioning:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      get: (id, query, options) => this.transport.call(environmentOperations["provisioning.targets.get"], [id], query, options),
+      /**
+       * List the downstream SCIM targets people are provisioned to, optionally for one organization, with their failures. Never their credentials.
+       *
+       * Requires scope `provisioning:read`. Danger: read.
+       *
+       * `GET /provisioning-targets` · action `provisioning.targets.list`
+       * @scope `provisioning:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      list: (query, options) => this.transport.call(environmentOperations["provisioning.targets.list"], [], query, options),
+      /** Every item of `provisioning.targets.list`, fetching pages as the iteration reaches them. */
+      listAll: (query, options) => this.transport.paginate(environmentOperations["provisioning.targets.list"], [], query, options),
+      status: {
+        /**
+         * Pause or resume pushing people to a downstream SCIM target.
+         *
+         * Requires scope `provisioning:write`. Danger: write.
+         *
+         * `POST /provisioning-targets/{id}/status` · action `provisioning.targets.status.set`
+         * @scope `provisioning:write`
+         * @danger write
+         * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+         */
+        set: (id, body, options) => this.transport.call(environmentOperations["provisioning.targets.status.set"], [id], body, options)
+      }
+    }
+  };
+  roles = {
+    /**
+     * Define a role for one organization, or (organization_id null) for the whole environment, optionally scoped to one app, with its opening permissions.
+     *
+     * Requires scope `role_definitions:write`. Danger: write.
+     *
+     * `POST /roles` · action `roles.create`
+     * @scope `role_definitions:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    create: (body, options) => this.transport.call(environmentOperations["roles.create"], [], body, options),
+    /**
+     * Delete a role: everyone who holds it loses it. An app-declared role is removed from the app's manifest instead.
+     *
+     * Requires scope `role_definitions:write`. Danger: destructive.
+     *
+     * `DELETE /roles/{id}` · action `roles.delete`
+     * @scope `role_definitions:write`
+     * @danger destructive
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    delete: (id, options) => this.transport.call(environmentOperations["roles.delete"], [id], void 0, options),
+    /**
+     * Get one role and the permissions it carries. Name it by id, or by manifest `key` with `client_id`.
+     *
+     * Requires scope `roles:read`. Danger: read.
+     *
+     * `GET /roles/{id}` · action `roles.get`
+     * @scope `roles:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    get: (id, query, options) => this.transport.call(environmentOperations["roles.get"], [id], query, options),
+    /**
+     * List roles
+     *
+     * Requires scope `roles:read`. Every role that can still be granted, ordered by name,
+     * with the permissions each carries. Not paginated. `?client_id=` narrows to one
+     * app's roles; `?organization_id=` to what can be granted in that organization.
+     *
+     * `GET /roles` · action `roles.list`
+     * @scope `roles:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    list: (query, options) => this.transport.call(environmentOperations["roles.list"], [], query, options),
+    /**
+     * Rename a role or change its description. An app-declared role is changed in the app's manifest instead.
+     *
+     * Requires scope `role_definitions:write`. Danger: write.
+     *
+     * `PATCH /roles/{id}` · action `roles.update`
+     * @scope `role_definitions:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    update: (id, body, options) => this.transport.call(environmentOperations["roles.update"], [id], body, options),
+    permissions: {
+      /**
+       * Add a permission to a role: everyone holding the role gains it. The permission must be unscoped or declared by the role's own app.
+       *
+       * Requires scope `role_definitions:write`. Danger: write.
+       *
+       * `PUT /roles/{id}/permissions/{permission_id}` · action `roles.permissions.grant`
+       * @scope `role_definitions:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      grant: (id, permissionId, options) => this.transport.call(environmentOperations["roles.permissions.grant"], [id, permissionId], void 0, options),
+      /**
+       * Remove a permission from a role: everyone holding the role loses it.
+       *
+       * Requires scope `role_definitions:write`. Danger: destructive.
+       *
+       * `DELETE /roles/{id}/permissions/{permission_id}` · action `roles.permissions.revoke`
+       * @scope `role_definitions:write`
+       * @danger destructive
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      revoke: (id, permissionId, options) => this.transport.call(environmentOperations["roles.permissions.revoke"], [id, permissionId], void 0, options)
+    }
+  };
+  samlApps = {
+    /**
+     * Register a SAML app that signs people in with their account here. Decides where assertions — and their attributes — are sent.
+     *
+     * Requires scope `saml_apps:write`. Danger: critical.
+     *
+     * `POST /saml-apps` · action `saml_apps.create`
+     * @scope `saml_apps:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    create: (body, options) => this.transport.call(environmentOperations["saml_apps.create"], [], body, options),
+    /**
+     * Remove a SAML app. People can no longer sign in to it with their account here.
+     *
+     * Requires scope `saml_apps:write`. Danger: critical.
+     *
+     * `DELETE /saml-apps/{id}` · action `saml_apps.delete`
+     * @scope `saml_apps:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    delete: (id, options) => this.transport.call(environmentOperations["saml_apps.delete"], [id], void 0, options),
+    /**
+     * Read one SAML app: its entity id, ACS URL, NameID and attribute mappings. Never its certificate.
+     *
+     * Requires scope `saml_apps:read`. Danger: read.
+     *
+     * `GET /saml-apps/{id}` · action `saml_apps.get`
+     * @scope `saml_apps:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    get: (id, options) => this.transport.call(environmentOperations["saml_apps.get"], [id], void 0, options),
+    /**
+     * List the SAML apps that trust this environment as their identity provider.
+     *
+     * Requires scope `saml_apps:read`. Danger: read.
+     *
+     * `GET /saml-apps` · action `saml_apps.list`
+     * @scope `saml_apps:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    list: (query, options) => this.transport.call(environmentOperations["saml_apps.list"], [], query, options),
+    /** Every item of `saml_apps.list`, fetching pages as the iteration reaches them. */
+    listAll: (query, options) => this.transport.paginate(environmentOperations["saml_apps.list"], [], query, options),
+    /**
+     * Change a SAML app's entity id, ACS URL, NameID, attribute mappings, signing certificate or owning organization.
+     *
+     * Requires scope `saml_apps:write`. Danger: critical.
+     *
+     * `PATCH /saml-apps/{id}` · action `saml_apps.update`
+     * @scope `saml_apps:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    update: (id, body, options) => this.transport.call(environmentOperations["saml_apps.update"], [id], body, options)
+  };
+  signin = {
+    policy: {
+      /**
+       * Read the authentication policy (password, MFA, SSO, lockout): the environment baseline, or one organization's effective rules and override.
+       *
+       * Requires scope `signin:read`. Danger: read.
+       *
+       * `GET /sign-in/policy` · action `signin.policy.get`
+       * @scope `signin:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      get: (query, options) => this.transport.call(environmentOperations["signin.policy.get"], [], query, options),
+      /**
+       * Drop one organization's authentication policy override, so it inherits the environment baseline again.
+       *
+       * Requires scope `signin:write`. Danger: critical.
+       *
+       * `DELETE /sign-in/policy/organizations/{organization_id}` · action `signin.policy.inherit`
+       * @scope `signin:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      inherit: (organizationId, options) => this.transport.call(environmentOperations["signin.policy.inherit"], [organizationId], void 0, options),
+      /**
+       * Change the authentication policy of the environment baseline, or tighten one organization's override. Requiring SSO signs out password sessions.
+       *
+       * Requires scope `signin:write`. Danger: critical.
+       *
+       * `PATCH /sign-in/policy` · action `signin.policy.update`
+       * @scope `signin:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      update: (body, options) => this.transport.call(environmentOperations["signin.policy.update"], [], body, options)
+    },
+    selfServiceSignup: {
+      /**
+       * Switch self-service sign-up on or off: whether people can create an account and their own organization in this environment.
+       *
+       * Requires scope `signin:write`. Danger: critical.
+       *
+       * `PUT /sign-in/self-service-signup` · action `signin.self_service_signup.set`
+       * @scope `signin:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      set: (body, options) => this.transport.call(environmentOperations["signin.self_service_signup.set"], [], body, options)
+    },
+    social: {
+      /**
+       * Stop offering a social login provider. People who used it keep their accounts.
+       *
+       * Requires scope `signin:write`. Danger: critical.
+       *
+       * `DELETE /sign-in/social-providers/{id}` · action `signin.social.delete`
+       * @scope `signin:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      delete: (id, body, options) => this.transport.call(environmentOperations["signin.social.delete"], [id], body, options),
+      /**
+       * List the social login providers (Google, GitHub, Apple…) enabled in this environment, optionally for one organization.
+       *
+       * Requires scope `signin:read`. Danger: read.
+       *
+       * `GET /sign-in/social-providers` · action `signin.social.list`
+       * @scope `signin:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      list: (query, options) => this.transport.call(environmentOperations["signin.social.list"], [], query, options),
+      /** Every item of `signin.social.list`, fetching pages as the iteration reaches them. */
+      listAll: (query, options) => this.transport.paginate(environmentOperations["signin.social.list"], [], query, options),
+      /**
+       * Enable a social login provider (Google, GitHub, Apple…) for one organization with its client credentials. The secret is never returned.
+       *
+       * Requires scope `signin:write`. Danger: critical.
+       *
+       * `POST /sign-in/social-providers` · action `signin.social.set`
+       * @scope `signin:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      set: (body, options) => this.transport.call(environmentOperations["signin.social.set"], [], body, options)
+    }
+  };
+  sodPolicies = {
+    /**
+     * Define a role-conflict rule: two or more roles no one person may hold together. Enforced on every grant from now on.
+     *
+     * Requires scope `governance:write`. Danger: write.
+     *
+     * `POST /sod-policies` · action `sod_policies.create`
+     * @scope `governance:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    create: (body, options) => this.transport.call(environmentOperations["sod_policies.create"], [], body, options),
+    /**
+     * Remove a role-conflict rule. Grants it refused are allowed from then on.
+     *
+     * Requires scope `governance:write`. Danger: critical.
+     *
+     * `DELETE /sod-policies/{id}` · action `sod_policies.delete`
+     * @scope `governance:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    delete: (id, body, options) => this.transport.call(environmentOperations["sod_policies.delete"], [id], body, options),
+    /**
+     * Read one role-conflict rule: the roles no one person may hold together, and whether it is enforced.
+     *
+     * Requires scope `governance:read`. Danger: read.
+     *
+     * `GET /sod-policies/{id}` · action `sod_policies.get`
+     * @scope `governance:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    get: (id, query, options) => this.transport.call(environmentOperations["sod_policies.get"], [id], query, options),
+    /**
+     * List role-conflict (segregation of duties) rules: sets of roles no one person may hold together. Optionally those binding one organization.
+     *
+     * Requires scope `governance:read`. Danger: read.
+     *
+     * `GET /sod-policies` · action `sod_policies.list`
+     * @scope `governance:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    list: (query, options) => this.transport.call(environmentOperations["sod_policies.list"], [], query, options),
+    /** Every item of `sod_policies.list`, fetching pages as the iteration reaches them. */
+    listAll: (query, options) => this.transport.paginate(environmentOperations["sod_policies.list"], [], query, options),
+    status: {
+      /**
+       * Enforce a role-conflict rule, or stop enforcing it — switched off, grants that break it are allowed again.
+       *
+       * Requires scope `governance:write`. Danger: critical.
+       *
+       * `POST /sod-policies/{id}/status` · action `sod_policies.status.set`
+       * @scope `governance:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      set: (id, body, options) => this.transport.call(environmentOperations["sod_policies.status.set"], [id], body, options)
+    }
+  };
+  sso = {
+    connections: {
+      /**
+       * Activate an SSO connection: people whose email domain routes to it start signing in through it.
+       *
+       * Requires scope `sso:write`. Danger: critical.
+       *
+       * `POST /sso/connections/{id}/activate` · action `sso.connections.activate`
+       * @scope `sso:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      activate: (id, body, options) => this.transport.call(environmentOperations["sso.connections.activate"], [id], body, options),
+      /**
+       * Connect an organization's SAML or OIDC identity provider as a draft. Activate it to start signing people in through it.
+       *
+       * Requires scope `sso:write`. Danger: write.
+       *
+       * `POST /sso/connections` · action `sso.connections.create`
+       * @scope `sso:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      create: (body, options) => this.transport.call(environmentOperations["sso.connections.create"], [], body, options),
+      /**
+       * Delete an SSO connection and its settings. Where SSO is required, its people cannot sign in until another is activated.
+       *
+       * Requires scope `sso:write`. Danger: critical.
+       *
+       * `DELETE /sso/connections/{id}` · action `sso.connections.delete`
+       * @scope `sso:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      delete: (id, body, options) => this.transport.call(environmentOperations["sso.connections.delete"], [id], body, options),
+      /**
+       * Disable an SSO connection without deleting it. Where SSO is required, its people cannot sign in until it is re-activated.
+       *
+       * Requires scope `sso:write`. Danger: critical.
+       *
+       * `POST /sso/connections/{id}/disable` · action `sso.connections.disable`
+       * @scope `sso:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      disable: (id, body, options) => this.transport.call(environmentOperations["sso.connections.disable"], [id], body, options),
+      /**
+       * Read one SSO connection: its type, status, entity ids, URLs, issuer and client id. Never a certificate or secret.
+       *
+       * Requires scope `sso:read`. Danger: read.
+       *
+       * `GET /sso/connections/{id}` · action `sso.connections.get`
+       * @scope `sso:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      get: (id, query, options) => this.transport.call(environmentOperations["sso.connections.get"], [id], query, options),
+      /**
+       * List the SAML and OIDC connections organizations sign in through, optionally for one organization. Never a certificate or secret.
+       *
+       * Requires scope `sso:read`. Danger: read.
+       *
+       * `GET /sso/connections` · action `sso.connections.list`
+       * @scope `sso:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      list: (query, options) => this.transport.call(environmentOperations["sso.connections.list"], [], query, options),
+      /** Every item of `sso.connections.list`, fetching pages as the iteration reaches them. */
+      listAll: (query, options) => this.transport.paginate(environmentOperations["sso.connections.list"], [], query, options),
+      /**
+       * Require single sign-on for the organization an SSO connection belongs to. Ends every password session there.
+       *
+       * Requires scope `sso:write`. Danger: critical.
+       *
+       * `POST /sso/connections/{id}/require-sso` · action `sso.connections.require_sso`
+       * @scope `sso:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      requireSso: (id, body, options) => this.transport.call(environmentOperations["sso.connections.require_sso"], [id], body, options),
+      /**
+       * Change an SSO connection's name or identity-provider settings. Secrets left out keep the ones on file.
+       *
+       * Requires scope `sso:write`. Danger: critical.
+       *
+       * `PATCH /sso/connections/{id}` · action `sso.connections.update`
+       * @scope `sso:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      update: (id, body, options) => this.transport.call(environmentOperations["sso.connections.update"], [id], body, options),
+      certificates: {
+        /**
+         * Make a staged SAML signing certificate the connection's primary. The certificate it replaces stops being trusted.
+         *
+         * Requires scope `sso:write`. Danger: critical.
+         *
+         * `POST /sso/connections/{id}/certificates/activate` · action `sso.connections.certificates.activate`
+         * @scope `sso:write`
+         * @danger critical
+         * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+         */
+        activate: (id, body, options) => this.transport.call(environmentOperations["sso.connections.certificates.activate"], [id], body, options),
+        /**
+         * List a SAML connection's signing certificates — primary and staged — with each one's fingerprint and expiry.
+         *
+         * Requires scope `sso:read`. Danger: read.
+         *
+         * `GET /sso/connections/{id}/certificates` · action `sso.connections.certificates.list`
+         * @scope `sso:read`
+         * @danger read
+         * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+         */
+        list: (id, query, options) => this.transport.call(environmentOperations["sso.connections.certificates.list"], [id], query, options),
+        /**
+         * Stage a SAML connection's new IdP signing certificate (PEM or IdP metadata) beside the current one, so a renewal has no outage. Activate it once the IdP signs with it.
+         *
+         * Requires scope `sso:write`. Danger: critical.
+         *
+         * `POST /sso/connections/{id}/certificates` · action `sso.connections.certificates.stage`
+         * @scope `sso:write`
+         * @danger critical
+         * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+         */
+        stage: (id, body, options) => this.transport.call(environmentOperations["sso.connections.certificates.stage"], [id], body, options)
+      }
+    },
+    domains: {
+      /**
+       * Turn capture on or off for a verified domain: captured, everyone with an address at it must sign in through the organization's SSO.
+       *
+       * Requires scope `sso:write`. Danger: critical.
+       *
+       * `POST /sso/domains/{id}/capture` · action `sso.domains.capture`
+       * @scope `sso:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      capture: (id, body, options) => this.transport.call(environmentOperations["sso.domains.capture"], [id], body, options),
+      /**
+       * Claim an email domain for an organization's single sign-on, and get the DNS TXT record to publish to prove it.
+       *
+       * Requires scope `sso:write`. Danger: write.
+       *
+       * `POST /sso/domains` · action `sso.domains.create`
+       * @scope `sso:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      create: (body, options) => this.transport.call(environmentOperations["sso.domains.create"], [], body, options),
+      /**
+       * Remove a claimed email domain. Its people stop being routed to the organization's SSO connection.
+       *
+       * Requires scope `sso:write`. Danger: destructive.
+       *
+       * `DELETE /sso/domains/{id}` · action `sso.domains.delete`
+       * @scope `sso:write`
+       * @danger destructive
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      delete: (id, body, options) => this.transport.call(environmentOperations["sso.domains.delete"], [id], body, options),
+      /**
+       * List the email domains organizations claimed for single sign-on, whether each is verified and captured, and the DNS record that proves an unverified one.
+       *
+       * Requires scope `sso:read`. Danger: read.
+       *
+       * `GET /sso/domains` · action `sso.domains.list`
+       * @scope `sso:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      list: (query, options) => this.transport.call(environmentOperations["sso.domains.list"], [], query, options),
+      /** Every item of `sso.domains.list`, fetching pages as the iteration reaches them. */
+      listAll: (query, options) => this.transport.paginate(environmentOperations["sso.domains.list"], [], query, options),
+      /**
+       * Check a claimed domain's DNS TXT record now. Answers the domain, with verified true once the record is found.
+       *
+       * Requires scope `sso:write`. Danger: write.
+       *
+       * `POST /sso/domains/{id}/verify` · action `sso.domains.verify`
+       * @scope `sso:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      verify: (id, body, options) => this.transport.call(environmentOperations["sso.domains.verify"], [id], body, options)
+    },
+    samlMetadata: {
+      /**
+       * Parse an identity provider's SAML metadata (XML or a metadata URL) into the entity id, SSO URL and certificate a SAML connection needs. Stores nothing.
+       *
+       * Requires scope `sso:write`. Danger: write.
+       *
+       * `POST /sso/saml-metadata` · action `sso.saml_metadata.import`
+       * @scope `sso:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      import: (body, options) => this.transport.call(environmentOperations["sso.saml_metadata.import"], [], body, options)
+    }
+  };
+  supportSessions = {
+    /**
+     * End a support session now: every token it issued is revoked.
+     *
+     * Requires scope `support:write`. Danger: destructive.
+     *
+     * `DELETE /support-sessions/{id}` · action `support_sessions.end`
+     * @scope `support:write`
+     * @danger destructive
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    end: (id, options) => this.transport.call(environmentOperations["support_sessions.end"], [id], void 0, options),
+    /**
+     * Start a support session
+     *
+     * Requires scope `support:write`. A member of your staff (`actor_user_id`) signs in to
+     * one of your apps (`client_id`) AS one of a customer's users (`user_id` in
+     * `organization_id`), for a stated `reason`, for at most 60 minutes.
+     *
+     * The actor must hold your app's own `support:impersonate` permission through an
+     * **environment-wide** grant (see `PUT /users/{id}/environment-roles/{role_id}`);
+     * otherwise `403 not_permitted`. The app must be a first-party app the environment
+     * owns that uses the authorization-code grant (`422 client_not_eligible`). The target
+     * must be an active member (`422 target_not_member`) of an active organization
+     * (`409 organization_inactive`).
+     *
+     * Send `redirect_uri` (registered for the app) and a PKCE S256 `code_challenge` to get
+     * the first authorization `code` in the response. Your app redeems it at `/oauth/token`
+     * with the verifier; every token carries `act: {"sub": actor_user_id}` and there is
+     * never a refresh token. The session is audited on the customer's trail and the
+     * environment's, and announced as the `support_session.started` webhook.
+     *
+     * `scopes` in the response are exactly what every token of the session carries: the
+     * ones asked for (or, with none, the app's registration), never `offline_access`, and
+     * audienced the way the token endpoint audiences them — once any of them belongs to a
+     * registered API, the token is for that API and a scope no API registered (such as
+     * `apps.manifest`) is left out. Scopes of two registered APIs cannot be audienced to
+     * one token and are refused before the session starts (`422 invalid_target`).
+     *
+     * `POST /support-sessions` · action `support_sessions.start`
+     * @scope `support:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    start: (body, options) => this.transport.call(environmentOperations["support_sessions.start"], [], body, options)
+  };
+  tokenVault = {
+    grants: {
+      /**
+       * Grant an app (by OAuth client id) the right to lease a stored credential.
+       *
+       * Requires scope `token_vault:write`. Danger: critical.
+       *
+       * `POST /token-vault/secrets/{id}/grants` · action `token_vault.grants.create`
+       * @scope `token_vault:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      create: (id, body, options) => this.transport.call(environmentOperations["token_vault.grants.create"], [id], body, options),
+      /**
+       * Withdraw an app's right to lease a stored credential.
+       *
+       * Requires scope `token_vault:write`. Danger: destructive.
+       *
+       * `DELETE /token-vault/secrets/{id}/grants/{client_id}` · action `token_vault.grants.delete`
+       * @scope `token_vault:write`
+       * @danger destructive
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      delete: (id, clientId, body, options) => this.transport.call(environmentOperations["token_vault.grants.delete"], [id, clientId], body, options)
+    },
+    secrets: {
+      /**
+       * Store a downstream credential (a third-party API key) in an organization's token vault, or the environment's own. The value is sealed and never returned.
+       *
+       * Requires scope `token_vault:write`. Danger: write.
+       *
+       * `POST /token-vault/secrets` · action `token_vault.secrets.create`
+       * @scope `token_vault:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      create: (body, options) => this.transport.call(environmentOperations["token_vault.secrets.create"], [], body, options),
+      /**
+       * Read one stored credential and the client ids granted to lease it. Never its value.
+       *
+       * Requires scope `token_vault:read`. Danger: read.
+       *
+       * `GET /token-vault/secrets/{id}` · action `token_vault.secrets.get`
+       * @scope `token_vault:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      get: (id, query, options) => this.transport.call(environmentOperations["token_vault.secrets.get"], [id], query, options),
+      /**
+       * List the downstream credentials stored in an organization's token vault (or the environment's own): names, providers, status. Never a value.
+       *
+       * Requires scope `token_vault:read`. Danger: read.
+       *
+       * `GET /token-vault/secrets` · action `token_vault.secrets.list`
+       * @scope `token_vault:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      list: (query, options) => this.transport.call(environmentOperations["token_vault.secrets.list"], [], query, options),
+      /** Every item of `token_vault.secrets.list`, fetching pages as the iteration reaches them. */
+      listAll: (query, options) => this.transport.paginate(environmentOperations["token_vault.secrets.list"], [], query, options),
+      /**
+       * Revoke a stored credential permanently. No app can lease it again.
+       *
+       * Requires scope `token_vault:write`. Danger: destructive.
+       *
+       * `POST /token-vault/secrets/{id}/revoke` · action `token_vault.secrets.revoke`
+       * @scope `token_vault:write`
+       * @danger destructive
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      revoke: (id, body, options) => this.transport.call(environmentOperations["token_vault.secrets.revoke"], [id], body, options),
+      /**
+       * Replace a stored credential's value. Every later lease hands out the new one. The value is never returned.
+       *
+       * Requires scope `token_vault:write`. Danger: critical.
+       *
+       * `POST /token-vault/secrets/{id}/rotate` · action `token_vault.secrets.rotate`
+       * @scope `token_vault:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      rotate: (id, body, options) => this.transport.call(environmentOperations["token_vault.secrets.rotate"], [id], body, options)
+    }
+  };
+  users = {
+    /**
+     * Create a user
+     *
+     * Requires scope `users:write`. Password is optional — omit it to create a passwordless identity the user completes via an invite/magic-link.
+     *
+     * `POST /users` · action `users.create`
+     * @scope `users:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    create: (body, options) => this.transport.call(environmentOperations["users.create"], [], body, options),
+    /**
+     * Deactivate a user
+     *
+     * Requires scope `users:write`. A **soft disable** — the identity can no longer
+     * authenticate, but is never hard-deleted — and every OAuth grant they hold is
+     * revoked, which reactivating them does not bring back. Returns the user in its new
+     * `disabled` state. Idempotent. The console's "Deactivate" is this action.
+     *
+     * `DELETE /users/{id}` · action `users.deactivate`
+     * @scope `users:write`
+     * @danger destructive
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    deactivate: (id, options) => this.transport.call(environmentOperations["users.deactivate"], [id], void 0, options),
+    /**
+     * Erase a person (GDPR Art. 17): revoke their sessions and tokens, delete their credentials, memberships and personal data, and pseudonymise their account. Cannot be undone.
+     *
+     * Requires scope `users:erase`. Danger: critical.
+     *
+     * `POST /users/{id}/erase` · action `users.erase`
+     * @scope `users:erase`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    erase: (id, options) => this.transport.call(environmentOperations["users.erase"], [id], void 0, options),
+    /**
+     * Get a user
+     *
+     * Requires scope `users:read`.
+     *
+     * `GET /users/{id}` · action `users.get`
+     * @scope `users:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    get: (id, options) => this.transport.call(environmentOperations["users.get"], [id], void 0, options),
+    /**
+     * List users
+     *
+     * Requires scope `users:read`. A page at a time, in id order. Narrow it the ways you
+     * look for somebody: `email` (exactly that address, case-insensitive), `q` (a fragment
+     * of the address or the name) and `status`. Filters combine.
+     *
+     * `GET /users` · action `users.list`
+     * @scope `users:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    list: (query, options) => this.transport.call(environmentOperations["users.list"], [], query, options),
+    /** Every item of `users.list`, fetching pages as the iteration reaches them. */
+    listAll: (query, options) => this.transport.paginate(environmentOperations["users.list"], [], query, options),
+    /**
+     * Reactivate a deactivated user so they can sign in again. Grants revoked on deactivation stay revoked.
+     *
+     * Requires scope `users:write`. Danger: write.
+     *
+     * `POST /users/{id}/reactivate` · action `users.reactivate`
+     * @scope `users:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    reactivate: (id, options) => this.transport.call(environmentOperations["users.reactivate"], [id], void 0, options),
+    /**
+     * Change a user's name and/or email address. A changed address must be verified again.
+     *
+     * Requires scope `users:write`. Danger: critical.
+     *
+     * `PATCH /users/{id}` · action `users.update`
+     * @scope `users:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    update: (id, body, options) => this.transport.call(environmentOperations["users.update"], [id], body, options),
+    /**
+     * Mark a user's email address verified without the emailed link. It can then be used to recover the account.
+     *
+     * Requires scope `users:write`. Danger: critical.
+     *
+     * `POST /users/{id}/verify` · action `users.verify`
+     * @scope `users:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    verify: (id, options) => this.transport.call(environmentOperations["users.verify"], [id], void 0, options),
+    environmentRoles: {
+      /**
+       * Whether a user holds a role everywhere
+       *
+       * Requires scope `roles:read`. `200` with the grant, or `404` when it is not held.
+       *
+       * `GET /users/{id}/environment-roles/{role_id}` · action `users.environment_roles.get`
+       * @scope `roles:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      get: (id, roleId, query, options) => this.transport.call(environmentOperations["users.environment_roles.get"], [id, roleId], query, options),
+      /**
+       * Grant a role everywhere in the environment (staff)
+       *
+       * Requires scope `roles:write`. Idempotent. For your own people who act across every
+       * customer. Any role that belongs to no organization may be granted this way: an
+       * app-agnostic one reaches every app's tokens, one your app declared reaches only
+       * your app's. An organization's own role is refused with `422 role_not_assignable`; a
+       * grant that would form a segregation-of-duties conflict in any organization the
+       * person belongs to with `409 role_conflict`.
+       *
+       * `PUT /users/{id}/environment-roles/{role_id}` · action `users.environment_roles.grant`
+       * @scope `roles:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      grant: (id, roleId, query, options) => this.transport.call(environmentOperations["users.environment_roles.grant"], [id, roleId], query, options),
+      /**
+       * List the roles a user holds everywhere (staff)
+       *
+       * Requires scope `roles:read`.
+       *
+       * `GET /users/{id}/environment-roles` · action `users.environment_roles.list`
+       * @scope `roles:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      list: (id, options) => this.transport.call(environmentOperations["users.environment_roles.list"], [id], void 0, options),
+      /**
+       * Take back an environment-wide grant
+       *
+       * Requires scope `roles:write`. Idempotent.
+       *
+       * `DELETE /users/{id}/environment-roles/{role_id}` · action `users.environment_roles.revoke`
+       * @scope `roles:write`
+       * @danger destructive
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      revoke: (id, roleId, query, options) => this.transport.call(environmentOperations["users.environment_roles.revoke"], [id, roleId], query, options)
+    },
+    mfa: {
+      /**
+       * Reset a user's two-factor authentication: their authenticator and recovery codes are removed and they must enrol again.
+       *
+       * Requires scope `users:write`. Danger: critical.
+       *
+       * `DELETE /users/{id}/mfa` · action `users.mfa.reset`
+       * @scope `users:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      reset: (id, options) => this.transport.call(environmentOperations["users.mfa.reset"], [id], void 0, options)
+    },
+    passwordReset: {
+      /**
+       * Mail a user a password-reset link at their own address.
+       *
+       * Requires scope `users:write`. Danger: write.
+       *
+       * `POST /users/{id}/password-reset` · action `users.password_reset.send`
+       * @scope `users:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      send: (id, options) => this.transport.call(environmentOperations["users.password_reset.send"], [id], void 0, options)
+    },
+    password: {
+      /**
+       * Set a user's password, temporary by default, and mail it to them unless told not to. Signs them out according to `revoke`.
+       *
+       * Requires scope `users:write`. Danger: critical.
+       *
+       * `POST /users/{id}/password` · action `users.password.set`
+       * @scope `users:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      set: (id, body, options) => this.transport.call(environmentOperations["users.password.set"], [id], body, options)
+    },
+    sessions: {
+      /**
+       * List a user's live sign-in sessions
+       *
+       * Requires scope `users:read`. The fifty most recently active, newest first — enough to
+       * recognise a device and end one (`DELETE /users/{id}/sessions/{session_id}`), not a log.
+       * `impersonation` marks a session somebody else opened as this person.
+       *
+       * `GET /users/{id}/sessions` · action `users.sessions.list`
+       * @scope `users:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      list: (id, options) => this.transport.call(environmentOperations["users.sessions.list"], [id], void 0, options),
+      /**
+       * End one of a user's sign-in sessions.
+       *
+       * Requires scope `users:write`. Danger: destructive.
+       *
+       * `DELETE /users/{id}/sessions/{session_id}` · action `users.sessions.revoke`
+       * @scope `users:write`
+       * @danger destructive
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      revoke: (id, sessionId, options) => this.transport.call(environmentOperations["users.sessions.revoke"], [id, sessionId], void 0, options),
+      /**
+       * Sign a user out everywhere: end every session and revoke every OAuth grant they hold.
+       *
+       * Requires scope `users:write`. Danger: destructive.
+       *
+       * `DELETE /users/{id}/sessions` · action `users.sessions.revoke_all`
+       * @scope `users:write`
+       * @danger destructive
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      revokeAll: (id, options) => this.transport.call(environmentOperations["users.sessions.revoke_all"], [id], void 0, options)
+    },
+    verification: {
+      /**
+       * Mail a user the link that verifies their email address. Does nothing for an address already verified.
+       *
+       * Requires scope `users:write`. Danger: write.
+       *
+       * `POST /users/{id}/verification` · action `users.verification.send`
+       * @scope `users:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      send: (id, options) => this.transport.call(environmentOperations["users.verification.send"], [id], void 0, options)
+    }
+  };
+  webhooks = {
+    /**
+     * Register a webhook endpoint for one organization or the whole environment. Returns its signing secret once.
+     *
+     * Requires scope `webhooks:write`. Danger: critical.
+     *
+     * `POST /webhooks` · action `webhooks.create`
+     * @scope `webhooks:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    create: (body, options) => this.transport.call(environmentOperations["webhooks.create"], [], body, options),
+    /**
+     * Delete a webhook endpoint. It stops receiving events at once.
+     *
+     * Requires scope `webhooks:write`. Danger: destructive.
+     *
+     * `DELETE /webhooks/{id}` · action `webhooks.delete`
+     * @scope `webhooks:write`
+     * @danger destructive
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    delete: (id, options) => this.transport.call(environmentOperations["webhooks.delete"], [id], void 0, options),
+    /**
+     * Get one webhook endpoint: URL, owner, subscribed events, health. Never its signing secret.
+     *
+     * Requires scope `webhooks:read`. Danger: read.
+     *
+     * `GET /webhooks/{id}` · action `webhooks.get`
+     * @scope `webhooks:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    get: (id, options) => this.transport.call(environmentOperations["webhooks.get"], [id], void 0, options),
+    /**
+     * List the webhook endpoints registered in this environment: URL, owner, subscribed events and whether each is active.
+     *
+     * Requires scope `webhooks:read`. Danger: read.
+     *
+     * `GET /webhooks` · action `webhooks.list`
+     * @scope `webhooks:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    list: (query, options) => this.transport.call(environmentOperations["webhooks.list"], [], query, options),
+    /** Every item of `webhooks.list`, fetching pages as the iteration reaches them. */
+    listAll: (query, options) => this.transport.paginate(environmentOperations["webhooks.list"], [], query, options),
+    /**
+     * Pause a webhook endpoint: it stops receiving events until resumed.
+     *
+     * Requires scope `webhooks:write`. Danger: write.
+     *
+     * `POST /webhooks/{id}/pause` · action `webhooks.pause`
+     * @scope `webhooks:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    pause: (id, options) => this.transport.call(environmentOperations["webhooks.pause"], [id], void 0, options),
+    /**
+     * Resume a paused webhook endpoint: it receives events again.
+     *
+     * Requires scope `webhooks:write`. Danger: write.
+     *
+     * `POST /webhooks/{id}/resume` · action `webhooks.resume`
+     * @scope `webhooks:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    resume: (id, options) => this.transport.call(environmentOperations["webhooks.resume"], [id], void 0, options),
+    /**
+     * Change a webhook endpoint's URL and/or the events it subscribes to.
+     *
+     * Requires scope `webhooks:write`. Danger: write.
+     *
+     * `PATCH /webhooks/{id}` · action `webhooks.update`
+     * @scope `webhooks:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    update: (id, body, options) => this.transport.call(environmentOperations["webhooks.update"], [id], body, options),
+    secret: {
+      /**
+       * Issue a new signing secret for a webhook endpoint, returned once. The old secret stops verifying immediately.
+       *
+       * Requires scope `webhooks:write`. Danger: critical.
+       *
+       * `POST /webhooks/{id}/rotate` · action `webhooks.secret.rotate`
+       * @scope `webhooks:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      rotate: (id, options) => this.transport.call(environmentOperations["webhooks.secret.rotate"], [id], void 0, options)
+    },
+    signatureScheme: {
+      /**
+       * Change how a webhook endpoint's deliveries are signed (cbox or standard_webhooks). No new secret is issued: a hex secret is used as whsec_ + base64 of itself. Update the receiver first.
+       *
+       * Requires scope `webhooks:write`. Danger: destructive.
+       *
+       * `POST /webhooks/{id}/signature-scheme` · action `webhooks.signature_scheme.change`
+       * @scope `webhooks:write`
+       * @danger destructive
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      change: (id, body, options) => this.transport.call(environmentOperations["webhooks.signature_scheme.change"], [id], body, options)
+    }
+  };
+};
+
+// src/management/generated/workspace.ts
+var workspaceOperations = {
+  "action_approvals.get": { action: null, operationId: null, method: "GET", path: "/workspace/action-approvals/{id}", pathParams: ["id"], scope: null, danger: null, approval: false, body: false, pagination: null },
+  "environments.create": { action: "environments.create", operationId: "environments_create", method: "POST", path: "/workspace/environments", pathParams: [], scope: "environments:write", danger: "critical", approval: true, body: true, pagination: null },
+  "environments.domain.remove": { action: "environments.domain.remove", operationId: "environments_domain_remove", method: "DELETE", path: "/workspace/environments/{environment_id}/domain", pathParams: ["environment_id"], scope: "environments:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "environments.domain.request": { action: "environments.domain.request", operationId: "environments_domain_request", method: "POST", path: "/workspace/environments/{environment_id}/domain", pathParams: ["environment_id"], scope: "environments:write", danger: "write", approval: true, body: true, pagination: null },
+  "environments.domain.verify": { action: "environments.domain.verify", operationId: "environments_domain_verify", method: "POST", path: "/workspace/environments/{environment_id}/domain/verify", pathParams: ["environment_id"], scope: "environments:write", danger: "write", approval: true, body: false, pagination: null },
+  "environments.list": { action: "environments.list", operationId: "environments_list", method: "GET", path: "/workspace/environments", pathParams: [], scope: "workspace:read", danger: "read", approval: true, body: false, pagination: "page" },
+  "keys.environment.create": { action: "keys.environment.create", operationId: "keys_environment_create", method: "POST", path: "/workspace/environments/{environment_id}/keys", pathParams: ["environment_id"], scope: "keys:write", danger: "critical", approval: true, body: true, pagination: null },
+  "keys.environment.revoke": { action: "keys.environment.revoke", operationId: "keys_environment_revoke", method: "DELETE", path: "/workspace/environments/{environment_id}/keys/{id}", pathParams: ["environment_id", "id"], scope: "keys:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "keys.workspace.create": { action: "keys.workspace.create", operationId: "keys_workspace_create", method: "POST", path: "/workspace/keys", pathParams: [], scope: "keys:write", danger: "critical", approval: true, body: true, pagination: null },
+  "keys.workspace.list": { action: "keys.workspace.list", operationId: "keys_workspace_list", method: "GET", path: "/workspace/keys", pathParams: [], scope: "workspace:read", danger: "read", approval: true, body: false, pagination: "page" },
+  "keys.workspace.revoke": { action: "keys.workspace.revoke", operationId: "keys_workspace_revoke", method: "DELETE", path: "/workspace/keys/{id}", pathParams: ["id"], scope: "keys:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "projects.create": { action: "projects.create", operationId: "projects_create", method: "POST", path: "/workspace/projects", pathParams: [], scope: "projects:write", danger: "write", approval: true, body: true, pagination: null },
+  "projects.list": { action: "projects.list", operationId: "projects_list", method: "GET", path: "/workspace/projects", pathParams: [], scope: "workspace:read", danger: "read", approval: true, body: false, pagination: null },
+  "projects.reactivate": { action: "projects.reactivate", operationId: "projects_reactivate", method: "POST", path: "/workspace/projects/{id}/reactivate", pathParams: ["id"], scope: "projects:write", danger: "write", approval: true, body: false, pagination: null },
+  "projects.rename": { action: "projects.rename", operationId: "projects_rename", method: "PATCH", path: "/workspace/projects/{id}", pathParams: ["id"], scope: "projects:write", danger: "write", approval: true, body: true, pagination: null },
+  "projects.suspend": { action: "projects.suspend", operationId: "projects_suspend", method: "POST", path: "/workspace/projects/{id}/suspend", pathParams: ["id"], scope: "projects:write", danger: "write", approval: true, body: false, pagination: null },
+  "projects.verification.resend": { action: "projects.verification.resend", operationId: "projects_verification_resend", method: "POST", path: "/workspace/projects/verification/resend", pathParams: [], scope: "projects:write", danger: "write", approval: true, body: false, pagination: null },
+  "team.environment_access": { action: "team.environment_access", operationId: "team_environment_access", method: "PUT", path: "/workspace/members/{id}/access", pathParams: ["id"], scope: "team:write", danger: "write", approval: true, body: true, pagination: null },
+  "team.invitations.list": { action: "team.invitations.list", operationId: "team_invitations_list", method: "GET", path: "/workspace/invitations", pathParams: [], scope: "team:read", danger: "read", approval: true, body: false, pagination: null },
+  "team.invitations.resend": { action: "team.invitations.resend", operationId: "team_invitations_resend", method: "POST", path: "/workspace/invitations/{id}/resend", pathParams: ["id"], scope: "team:write", danger: "write", approval: true, body: false, pagination: null },
+  "team.invitations.revoke": { action: "team.invitations.revoke", operationId: "team_invitations_revoke", method: "DELETE", path: "/workspace/invitations/{id}", pathParams: ["id"], scope: "team:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "team.invite": { action: "team.invite", operationId: "team_invite", method: "POST", path: "/workspace/members", pathParams: [], scope: "team:write", danger: "write", approval: true, body: true, pagination: null },
+  "team.list": { action: "team.list", operationId: "team_list", method: "GET", path: "/workspace/members", pathParams: [], scope: "team:read", danger: "read", approval: true, body: false, pagination: "page" },
+  "team.remove": { action: "team.remove", operationId: "team_remove", method: "DELETE", path: "/workspace/members/{id}", pathParams: ["id"], scope: "team:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "team.role": { action: "team.role", operationId: "team_role", method: "PATCH", path: "/workspace/members/{id}/role", pathParams: ["id"], scope: "team:write", danger: "write", approval: true, body: true, pagination: null },
+  "team.transfer_ownership": { action: "team.transfer_ownership", operationId: "team_transfer_ownership", method: "POST", path: "/workspace/members/{id}/transfer-ownership", pathParams: ["id"], scope: "team:write", danger: "critical", approval: true, body: false, pagination: null },
+  "workspace.get": { action: "workspace.get", operationId: "workspace_get", method: "GET", path: "/workspace", pathParams: [], scope: "workspace:read", danger: "read", approval: true, body: false, pagination: null },
+  "workspace.settings.update": { action: "workspace.settings.update", operationId: "workspace_settings_update", method: "PATCH", path: "/workspace", pathParams: [], scope: "settings:write", danger: "write", approval: true, body: true, pagination: null }
+};
+var WorkspaceClient = class {
+  /** The transport every method runs on — authentication, retries, approvals. */
+  transport;
+  constructor(options) {
+    this.transport = new ManagementTransport("workspace", options, "https://api.cboxid.com");
+  }
+  /** Call a route by method and path (relative to `/api/v1`) — for anything not generated. */
+  request(method, path, input, options) {
+    return this.transport.request(method, path, input, options);
+  }
+  actionApprovals = {
+    /**
+     * Where an approval this key asked for stands
+     *
+     * Any workspace key — or a member's token — may poll the approvals it raised, and only
+     * those: another credential's id is a 404. `status` is `pending`, `approved`, `denied`, `expired` or `consumed`.
+     *
+     * `GET /workspace/action-approvals/{id}`
+     */
+    get: (id, options) => this.transport.call(workspaceOperations["action_approvals.get"], [id], void 0, options)
+  };
+  environments = {
+    /**
+     * Create an environment
+     *
+     * Requires scope `environments:write` and the `manage-environments` capability
+     * (owner/admin/developer). Danger: critical — with `initial_key` it mints a credential.
+     *
+     * With `initial_key`, the environment's first management key is minted in the same
+     * call and returned once as `initial_key.token` — enough for an agent holding one
+     * workspace key to stand an environment up and start configuring it on the
+     * environment's own host. An idempotent replay returns `initial_key.token: null`.
+     *
+     * `POST /workspace/environments` · action `environments.create`
+     * @scope `environments:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    create: (body, options) => this.transport.call(workspaceOperations["environments.create"], [], body, options),
+    /**
+     * List environments
+     *
+     * Requires scope `workspace:read` (any role).
+     *
+     * `GET /workspace/environments` · action `environments.list`
+     * @scope `workspace:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    list: (query, options) => this.transport.call(workspaceOperations["environments.list"], [], query, options),
+    /** Every item of `environments.list`, fetching pages as the iteration reaches them. */
+    listAll: (query, options) => this.transport.paginate(workspaceOperations["environments.list"], [], query, options),
+    domain: {
+      /**
+       * Stop serving one of the workspace's environments on its custom domain. Anything using that domain stops reaching it.
+       *
+       * Requires scope `environments:write` and a role that may `manage-environments`. Danger: destructive.
+       *
+       * `DELETE /workspace/environments/{environment_id}/domain` · action `environments.domain.remove`
+       * @scope `environments:write`
+       * @danger destructive
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      remove: (environmentId, options) => this.transport.call(workspaceOperations["environments.domain.remove"], [environmentId], void 0, options),
+      /**
+       * Start serving one of the workspace's environments on a custom domain: returns the DNS TXT record that proves you control it.
+       *
+       * Requires scope `environments:write` and a role that may `manage-environments`. Danger: write.
+       *
+       * `POST /workspace/environments/{environment_id}/domain` · action `environments.domain.request`
+       * @scope `environments:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      request: (environmentId, body, options) => this.transport.call(workspaceOperations["environments.domain.request"], [environmentId], body, options),
+      /**
+       * Look for the pending domain's DNS TXT record and, once it is visible, serve the environment on that domain.
+       *
+       * Requires scope `environments:write` and a role that may `manage-environments`. Danger: write.
+       *
+       * `POST /workspace/environments/{environment_id}/domain/verify` · action `environments.domain.verify`
+       * @scope `environments:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      verify: (environmentId, options) => this.transport.call(workspaceOperations["environments.domain.verify"], [environmentId], void 0, options)
+    }
+  };
+  keys = {
+    environment: {
+      /**
+       * Mint a management key for one of the workspace's environments, with the scopes it needs. The value is returned once, as `token`.
+       *
+       * Requires scope `keys:write` and a role that may `manage-environments`. Danger: critical.
+       *
+       * `POST /workspace/environments/{environment_id}/keys` · action `keys.environment.create`
+       * @scope `keys:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      create: (environmentId, body, options) => this.transport.call(workspaceOperations["keys.environment.create"], [environmentId], body, options),
+      /**
+       * Revoke one of an environment's management keys; whatever uses it stops immediately.
+       *
+       * Requires scope `keys:write` and a role that may `manage-environments`. Danger: destructive.
+       *
+       * `DELETE /workspace/environments/{environment_id}/keys/{id}` · action `keys.environment.revoke`
+       * @scope `keys:write`
+       * @danger destructive
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      revoke: (environmentId, id, options) => this.transport.call(workspaceOperations["keys.environment.revoke"], [environmentId, id], void 0, options)
+    },
+    workspace: {
+      /**
+       * Mint a workspace key with a role and optional scopes, never wider than the caller. The value is returned once, as `token`.
+       *
+       * Requires scope `keys:write` and a role that may `manage-environments` and `manage-members`. Danger: critical.
+       *
+       * `POST /workspace/keys` · action `keys.workspace.create`
+       * @scope `keys:write`
+       * @danger critical
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      create: (body, options) => this.transport.call(workspaceOperations["keys.workspace.create"], [], body, options),
+      /**
+       * List the workspace's keys, newest first, revoked ones included — names, roles, scopes and expiry, never their values.
+       *
+       * Requires scope `workspace:read` and a role that may `manage-members`. Danger: read.
+       *
+       * `GET /workspace/keys` · action `keys.workspace.list`
+       * @scope `workspace:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      list: (query, options) => this.transport.call(workspaceOperations["keys.workspace.list"], [], query, options),
+      /** Every item of `keys.workspace.list`, fetching pages as the iteration reaches them. */
+      listAll: (query, options) => this.transport.paginate(workspaceOperations["keys.workspace.list"], [], query, options),
+      /**
+       * Revoke a workspace key, and every key it minted on either plane (workspace keys and environment management keys, all the way down); whatever uses them stops immediately.
+       *
+       * Requires scope `keys:write` and a role that may `manage-environments` and `manage-members`. Danger: destructive.
+       *
+       * `DELETE /workspace/keys/{id}` · action `keys.workspace.revoke`
+       * @scope `keys:write`
+       * @danger destructive
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      revoke: (id, options) => this.transport.call(workspaceOperations["keys.workspace.revoke"], [id], void 0, options)
+    }
+  };
+  projects = {
+    /**
+     * Create a project
+     *
+     * Stand up another independently-billed IdP product. Requires scope `projects:write` and the `manage-environments` capability (owner/admin/developer).
+     *
+     * `POST /workspace/projects` · action `projects.create`
+     * @scope `projects:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    create: (body, options) => this.transport.call(workspaceOperations["projects.create"], [], body, options),
+    /**
+     * List projects
+     *
+     * Requires scope `workspace:read` (any role). The workspace's projects (IdP products). Each carries its own plan and environment allowance.
+     *
+     * `GET /workspace/projects` · action `projects.list`
+     * @scope `workspace:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    list: (options) => this.transport.call(workspaceOperations["projects.list"], [], void 0, options),
+    /**
+     * Reactivate a suspended project, so environments can be added to it again.
+     *
+     * Requires scope `projects:write` and a role that may `manage-environments`. Danger: write.
+     *
+     * `POST /workspace/projects/{id}/reactivate` · action `projects.reactivate`
+     * @scope `projects:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    reactivate: (id, options) => this.transport.call(workspaceOperations["projects.reactivate"], [id], void 0, options),
+    /**
+     * Rename a project.
+     *
+     * Requires scope `projects:write` and a role that may `manage-environments`. Danger: write.
+     *
+     * `PATCH /workspace/projects/{id}` · action `projects.rename`
+     * @scope `projects:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    rename: (id, body, options) => this.transport.call(workspaceOperations["projects.rename"], [id], body, options),
+    /**
+     * Suspend a project: its environments stay live, but no new ones can be added until it is reactivated.
+     *
+     * Requires scope `projects:write` and a role that may `manage-environments`. Danger: write.
+     *
+     * `POST /workspace/projects/{id}/suspend` · action `projects.suspend`
+     * @scope `projects:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    suspend: (id, options) => this.transport.call(workspaceOperations["projects.suspend"], [id], void 0, options),
+    verification: {
+      /**
+       * Re-send the signup confirmation the workspace's first environment is waiting on, to the owner's address on file.
+       *
+       * Requires scope `projects:write` and a role that may `manage-environments`. Danger: write.
+       *
+       * `POST /workspace/projects/verification/resend` · action `projects.verification.resend`
+       * @scope `projects:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      resend: (options) => this.transport.call(workspaceOperations["projects.verification.resend"], [], void 0, options)
+    }
+  };
+  team = {
+    /**
+     * Set which of the workspace's environments a team member reaches: all of them, or the listed ones.
+     *
+     * Requires scope `team:write` and a role that may `manage-members`. Danger: write.
+     *
+     * `PUT /workspace/members/{id}/access` · action `team.environment_access`
+     * @scope `team:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    environmentAccess: (id, body, options) => this.transport.call(workspaceOperations["team.environment_access"], [id], body, options),
+    /**
+     * Invite a member
+     *
+     * Requires scope `team:write` and the `manage-members` capability (owner/admin). Invites the address onto the
+     * workspace's team — the same invitation the console's Team page sends: a mail naming
+     * this key as the inviter and the role, with a signed link on which the invitee sets a
+     * password and is signed in. Owner is never invited; ownership is transferred. An
+     * earlier pending invitation for the same address is superseded. List, re-send and
+     * withdraw it under `/workspace/invitations`.
+     *
+     * `POST /workspace/members` · action `team.invite`
+     * @scope `team:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    invite: (body, options) => this.transport.call(workspaceOperations["team.invite"], [], body, options),
+    /**
+     * List members
+     *
+     * Requires scope `team:read` and the `read-members` capability (owner/admin/viewer). The roster is PII — a developer key is refused.
+     *
+     * `GET /workspace/members` · action `team.list`
+     * @scope `team:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    list: (query, options) => this.transport.call(workspaceOperations["team.list"], [], query, options),
+    /** Every item of `team.list`, fetching pages as the iteration reaches them. */
+    listAll: (query, options) => this.transport.paginate(workspaceOperations["team.list"], [], query, options),
+    /**
+     * Remove a member from the workspace's team. The owner is never removed; transfer ownership first.
+     *
+     * Requires scope `team:write` and a role that may `manage-members`. Danger: destructive.
+     *
+     * `DELETE /workspace/members/{id}` · action `team.remove`
+     * @scope `team:write`
+     * @danger destructive
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    remove: (id, options) => this.transport.call(workspaceOperations["team.remove"], [id], void 0, options),
+    /**
+     * Change a team member's role (admin, developer, member or viewer). The owner's role changes only by transferring ownership.
+     *
+     * Requires scope `team:write` and a role that may `manage-members`. Danger: write.
+     *
+     * `PATCH /workspace/members/{id}/role` · action `team.role`
+     * @scope `team:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    role: (id, body, options) => this.transport.call(workspaceOperations["team.role"], [id], body, options),
+    /**
+     * Make another member the workspace's owner; the current owner stays on as an admin. Only the owner, signed in, may do this.
+     *
+     * Requires scope `team:write` and a role that may `manage-members`. Danger: critical.
+     *
+     * `POST /workspace/members/{id}/transfer-ownership` · action `team.transfer_ownership`
+     * @scope `team:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    transferOwnership: (id, options) => this.transport.call(workspaceOperations["team.transfer_ownership"], [id], void 0, options),
+    invitations: {
+      /**
+       * List pending invitations
+       *
+       * Requires scope `team:read` and the `read-members` capability. The team's invitations nobody has accepted yet, newest first (at most 100).
+       *
+       * `GET /workspace/invitations` · action `team.invitations.list`
+       * @scope `team:read`
+       * @danger read
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      list: (options) => this.transport.call(workspaceOperations["team.invitations.list"], [], void 0, options),
+      /**
+       * Re-send an invitation
+       *
+       * Requires scope `team:write` and the `manage-members` capability. Mails a fresh link; the earlier link stops
+       * working and the invitation gets a new `id`. At most once a minute per address
+       * (`429`, `too_soon`). If the mail server refuses, the earlier invitation is kept (`503`).
+       *
+       * `POST /workspace/invitations/{id}/resend` · action `team.invitations.resend`
+       * @scope `team:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      resend: (id, options) => this.transport.call(workspaceOperations["team.invitations.resend"], [id], void 0, options),
+      /**
+       * Withdraw an invitation
+       *
+       * Requires scope `team:write` and the `manage-members` capability. The link stops working. An invitation that is not pending in this workspace is a `404`.
+       *
+       * `DELETE /workspace/invitations/{id}` · action `team.invitations.revoke`
+       * @scope `team:write`
+       * @danger destructive
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      revoke: (id, options) => this.transport.call(workspaceOperations["team.invitations.revoke"], [id], void 0, options)
+    }
+  };
+  workspace = {
+    /**
+     * Get the workspace
+     *
+     * Requires scope `workspace:read` (any role). Returns the workspace's identity. The `projects` block (each project's plan/allowance) is included only for keys whose role can read billing (owner/admin/viewer — not developer).
+     *
+     * `GET /workspace` · action `workspace.get`
+     * @scope `workspace:read`
+     * @danger read
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    get: (options) => this.transport.call(workspaceOperations["workspace.get"], [], void 0, options),
+    settings: {
+      /**
+       * Rename the workspace.
+       *
+       * Requires scope `settings:write` and a role that may `manage-members`. Danger: write.
+       *
+       * `PATCH /workspace` · action `workspace.settings.update`
+       * @scope `settings:write`
+       * @danger write
+       * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+       */
+      update: (body, options) => this.transport.call(workspaceOperations["workspace.settings.update"], [], body, options)
+    }
+  };
+};
+
+// src/management/generated/platform.ts
+var platformOperations = {
+  "action_approvals.get": { action: null, operationId: null, method: "GET", path: "/platform/action-approvals/{id}", pathParams: ["id"], scope: null, danger: null, approval: false, body: false, pagination: null },
+  "platform.environments.create": { action: "platform.environments.create", operationId: "platform_environments_create", method: "POST", path: "/platform/environments", pathParams: [], scope: "operator:environments:write", danger: "critical", approval: true, body: true, pagination: null },
+  "platform.environments.provision": { action: "platform.environments.provision", operationId: "platform_environments_provision", method: "POST", path: "/platform/environments/{environment_id}/provision", pathParams: ["environment_id"], scope: "operator:environments:write", danger: "critical", approval: true, body: true, pagination: null },
+  "platform.operators.create": { action: "platform.operators.create", operationId: "platform_operators_create", method: "POST", path: "/platform/operators", pathParams: [], scope: "operator:operators:write", danger: "critical", approval: true, body: true, pagination: null },
+  "platform.operators.set_status": { action: "platform.operators.set_status", operationId: "platform_operators_set_status", method: "PUT", path: "/platform/operators/{operator_id}/status", pathParams: ["operator_id"], scope: "operator:operators:write", danger: "critical", approval: true, body: true, pagination: null },
+  "platform.organizations.create": { action: "platform.organizations.create", operationId: "platform_organizations_create", method: "POST", path: "/platform/environments/{environment_id}/organizations", pathParams: ["environment_id"], scope: "operator:organizations:write", danger: "critical", approval: true, body: true, pagination: null },
+  "platform.organizations.move": { action: "platform.organizations.move", operationId: "platform_organizations_move", method: "PUT", path: "/platform/environments/{environment_id}/organizations/{organization_id}/parent", pathParams: ["environment_id", "organization_id"], scope: "operator:organizations:write", danger: "critical", approval: true, body: true, pagination: null },
+  "platform.organizations.set_status": { action: "platform.organizations.set_status", operationId: "platform_organizations_set_status", method: "PUT", path: "/platform/environments/{environment_id}/organizations/{organization_id}/status", pathParams: ["environment_id", "organization_id"], scope: "operator:organizations:write", danger: "critical", approval: true, body: true, pagination: null },
+  "platform.workspaces.create": { action: "platform.workspaces.create", operationId: "platform_workspaces_create", method: "POST", path: "/platform/workspaces", pathParams: [], scope: "operator:workspaces:write", danger: "critical", approval: true, body: true, pagination: null },
+  "platform.workspaces.set_status": { action: "platform.workspaces.set_status", operationId: "platform_workspaces_set_status", method: "PUT", path: "/platform/workspaces/{workspace_id}/status", pathParams: ["workspace_id"], scope: "operator:workspaces:write", danger: "critical", approval: true, body: true, pagination: null }
+};
+var PlatformClient = class {
+  /** The transport every method runs on — authentication, retries, approvals. */
+  transport;
+  constructor(options) {
+    this.transport = new ManagementTransport("platform", options, "https://api.cboxid.com");
+  }
+  /** Call a route by method and path (relative to `/api/v1`) — for anything not generated. */
+  request(method, path, input, options) {
+    return this.transport.request(method, path, input, options);
+  }
+  actionApprovals = {
+    /**
+     * Where an approval you asked for stands
+     *
+     * The `poll_url` of a `202 approval_required`: an approval this token raised, and only those — another token's id is a 404. `status` is `pending`, `approved`, `denied`, `expired` or `consumed`.
+     *
+     * `GET /platform/action-approvals/{id}`
+     */
+    get: (id, options) => this.transport.call(platformOperations["action_approvals.get"], [id], void 0, options)
+  };
+  environments = {
+    /**
+     * Create an environment on the deployment, with its own signing key. A domain is verified separately, by DNS.
+     *
+     * Requires scope `operator:environments:write` on an access token delegated by an active platform operator. No management key is accepted. Danger: critical.
+     *
+     * `POST /platform/environments` · action `platform.environments.create`
+     * @scope `operator:environments:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    create: (body, options) => this.transport.call(platformOperations["platform.environments.create"], [], body, options),
+    /**
+     * Bootstrap an environment with its first organization and an owner administrator, so people can sign in to it.
+     *
+     * Requires scope `operator:environments:write` on an access token delegated by an active platform operator. No management key is accepted. Danger: critical.
+     *
+     * `POST /platform/environments/{environment_id}/provision` · action `platform.environments.provision`
+     * @scope `operator:environments:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    provision: (environmentId, body, options) => this.transport.call(platformOperations["platform.environments.provision"], [environmentId], body, options)
+  };
+  operators = {
+    /**
+     * Add a platform operator: a person with authority over the whole deployment.
+     *
+     * Requires scope `operator:operators:write` on an access token delegated by an active platform operator. No management key is accepted. Danger: critical.
+     *
+     * `POST /platform/operators` · action `platform.operators.create`
+     * @scope `operator:operators:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    create: (body, options) => this.transport.call(platformOperations["platform.operators.create"], [], body, options),
+    /**
+     * Suspend a platform operator, or reactivate one. Never yourself, and never the last active operator.
+     *
+     * Requires scope `operator:operators:write` on an access token delegated by an active platform operator. No management key is accepted. Danger: critical.
+     *
+     * `PUT /platform/operators/{operator_id}/status` · action `platform.operators.set_status`
+     * @scope `operator:operators:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    setStatus: (operatorId, body, options) => this.transport.call(platformOperations["platform.operators.set_status"], [operatorId], body, options)
+  };
+  organizations = {
+    /**
+     * Create an organization inside an environment, optionally under a parent organization of the same environment.
+     *
+     * Requires scope `operator:organizations:write` on an access token delegated by an active platform operator. No management key is accepted. Danger: critical.
+     *
+     * `POST /platform/environments/{environment_id}/organizations` · action `platform.organizations.create`
+     * @scope `operator:organizations:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    create: (environmentId, body, options) => this.transport.call(platformOperations["platform.organizations.create"], [environmentId], body, options),
+    /**
+     * Move an organization under another organization of the same environment, or to the top of its hierarchy.
+     *
+     * Requires scope `operator:organizations:write` on an access token delegated by an active platform operator. No management key is accepted. Danger: critical.
+     *
+     * `PUT /platform/environments/{environment_id}/organizations/{organization_id}/parent` · action `platform.organizations.move`
+     * @scope `operator:organizations:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    move: (environmentId, organizationId, body, options) => this.transport.call(platformOperations["platform.organizations.move"], [environmentId, organizationId], body, options),
+    /**
+     * Suspend an organization inside an environment (its members can no longer sign in to it) or reactivate it.
+     *
+     * Requires scope `operator:organizations:write` on an access token delegated by an active platform operator. No management key is accepted. Danger: critical.
+     *
+     * `PUT /platform/environments/{environment_id}/organizations/{organization_id}/status` · action `platform.organizations.set_status`
+     * @scope `operator:organizations:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    setStatus: (environmentId, organizationId, body, options) => this.transport.call(platformOperations["platform.organizations.set_status"], [environmentId, organizationId], body, options)
+  };
+  workspaces = {
+    /**
+     * Create a workspace with its owner, first project and first environment; the owner is emailed a link to set their password.
+     *
+     * Requires scope `operator:workspaces:write` on an access token delegated by an active platform operator. No management key is accepted. Danger: critical.
+     *
+     * `POST /platform/workspaces` · action `platform.workspaces.create`
+     * @scope `operator:workspaces:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    create: (body, options) => this.transport.call(platformOperations["platform.workspaces.create"], [], body, options),
+    /**
+     * Suspend a workspace (its people can no longer sign in, its environments stop serving) or reactivate it.
+     *
+     * Requires scope `operator:workspaces:write` on an access token delegated by an active platform operator. No management key is accepted. Danger: critical.
+     *
+     * `PUT /platform/workspaces/{workspace_id}/status` · action `platform.workspaces.set_status`
+     * @scope `operator:workspaces:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    setStatus: (workspaceId, body, options) => this.transport.call(platformOperations["platform.workspaces.set_status"], [workspaceId], body, options)
+  };
+};
+
+// src/management/generated/account.ts
+var accountOperations = {
+  "action_approvals.get": { action: null, operationId: null, method: "GET", path: "/me/action-approvals/{id}", pathParams: ["id"], scope: null, danger: null, approval: false, body: false, pagination: null },
+  "account.api_keys.create": { action: "account.api_keys.create", operationId: "account_api_keys_create", method: "POST", path: "/me/organizations/{organization_id}/api-keys", pathParams: ["organization_id"], scope: "account:api_keys:write", danger: "critical", approval: true, body: true, pagination: null },
+  "account.api_keys.revoke": { action: "account.api_keys.revoke", operationId: "account_api_keys_revoke", method: "DELETE", path: "/me/organizations/{organization_id}/api-keys/{key_id}", pathParams: ["organization_id", "key_id"], scope: "account:api_keys:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "account.applications.revoke": { action: "account.applications.revoke", operationId: "account_applications_revoke", method: "DELETE", path: "/me/applications/{client_id}", pathParams: ["client_id"], scope: "account:applications:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "account.devices.remove": { action: "account.devices.remove", operationId: "account_devices_remove", method: "DELETE", path: "/me/devices/{device_id}", pathParams: ["device_id"], scope: "account:devices:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "account.organizations.leave": { action: "account.organizations.leave", operationId: "account_organizations_leave", method: "POST", path: "/me/organizations/{organization_id}/leave", pathParams: ["organization_id"], scope: "account:organizations:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "account.passkeys.remove": { action: "account.passkeys.remove", operationId: "account_passkeys_remove", method: "DELETE", path: "/me/passkeys/{passkey_id}", pathParams: ["passkey_id"], scope: "account:sign_in:write", danger: "critical", approval: true, body: false, pagination: null },
+  "account.profile.update": { action: "account.profile.update", operationId: "account_profile_update", method: "PATCH", path: "/me/profile", pathParams: [], scope: "account:profile:write", danger: "write", approval: true, body: true, pagination: null },
+  "account.sessions.revoke": { action: "account.sessions.revoke", operationId: "account_sessions_revoke", method: "DELETE", path: "/me/sessions/{session_id}", pathParams: ["session_id"], scope: "account:sessions:write", danger: "destructive", approval: true, body: false, pagination: null },
+  "account.sessions.revoke_others": { action: "account.sessions.revoke_others", operationId: "account_sessions_revoke_others", method: "POST", path: "/me/sessions/revoke-others", pathParams: [], scope: "account:sessions:write", danger: "critical", approval: true, body: false, pagination: null },
+  "account.social.unlink": { action: "account.social.unlink", operationId: "account_social_unlink", method: "DELETE", path: "/me/social/{provider}", pathParams: ["provider"], scope: "account:sign_in:write", danger: "critical", approval: true, body: false, pagination: null }
+};
+var AccountClient = class {
+  /** The transport every method runs on — authentication, retries, approvals. */
+  transport;
+  constructor(options) {
+    this.transport = new ManagementTransport("account", options);
+  }
+  /** Call a route by method and path (relative to `/api/v1`) — for anything not generated. */
+  request(method, path, input, options) {
+    return this.transport.request(method, path, input, options);
+  }
+  actionApprovals = {
+    /**
+     * Where an approval you asked for stands
+     *
+     * The `poll_url` of a `202 approval_required`: an approval this token raised, and only those — another token's id is a 404. `status` is `pending`, `approved`, `denied`, `expired` or `consumed`.
+     *
+     * `GET /me/action-approvals/{id}`
+     */
+    get: (id, options) => this.transport.call(accountOperations["action_approvals.get"], [id], void 0, options)
+  };
+  apiKeys = {
+    /**
+     * Create an API key of your own for one of this environment's apps, in an organization you belong to. The value is returned once, as `token`.
+     *
+     * Requires scope `account:api_keys:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: critical.
+     *
+     * `POST /me/organizations/{organization_id}/api-keys` · action `account.api_keys.create`
+     * @scope `account:api_keys:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    create: (organizationId, body, options) => this.transport.call(accountOperations["account.api_keys.create"], [organizationId], body, options),
+    /**
+     * Revoke one of your own API keys.
+     *
+     * Requires scope `account:api_keys:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: destructive.
+     *
+     * `DELETE /me/organizations/{organization_id}/api-keys/{key_id}` · action `account.api_keys.revoke`
+     * @scope `account:api_keys:write`
+     * @danger destructive
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    revoke: (organizationId, keyId, options) => this.transport.call(accountOperations["account.api_keys.revoke"], [organizationId, keyId], void 0, options)
+  };
+  applications = {
+    /**
+     * Withdraw an application's access to your account; it must ask you again to act as you.
+     *
+     * Requires scope `account:applications:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: destructive.
+     *
+     * `DELETE /me/applications/{client_id}` · action `account.applications.revoke`
+     * @scope `account:applications:write`
+     * @danger destructive
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    revoke: (clientId, options) => this.transport.call(accountOperations["account.applications.revoke"], [clientId], void 0, options)
+  };
+  devices = {
+    /**
+     * Remove one of your trusted devices; it is no longer asked to approve anything.
+     *
+     * Requires scope `account:devices:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: destructive.
+     *
+     * `DELETE /me/devices/{device_id}` · action `account.devices.remove`
+     * @scope `account:devices:write`
+     * @danger destructive
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    remove: (deviceId, options) => this.transport.call(accountOperations["account.devices.remove"], [deviceId], void 0, options)
+  };
+  organizations = {
+    /**
+     * Leave one of your own organizations. The last owner cannot leave — transfer ownership first.
+     *
+     * Requires scope `account:organizations:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: destructive.
+     *
+     * `POST /me/organizations/{organization_id}/leave` · action `account.organizations.leave`
+     * @scope `account:organizations:write`
+     * @danger destructive
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    leave: (organizationId, options) => this.transport.call(accountOperations["account.organizations.leave"], [organizationId], void 0, options)
+  };
+  passkeys = {
+    /**
+     * Remove one of your passkeys.
+     *
+     * Requires scope `account:sign_in:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: critical.
+     *
+     * `DELETE /me/passkeys/{passkey_id}` · action `account.passkeys.remove`
+     * @scope `account:sign_in:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    remove: (passkeyId, options) => this.transport.call(accountOperations["account.passkeys.remove"], [passkeyId], void 0, options)
+  };
+  profile = {
+    /**
+     * Change the display name on your own account.
+     *
+     * Requires scope `account:profile:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: write.
+     *
+     * `PATCH /me/profile` · action `account.profile.update`
+     * @scope `account:profile:write`
+     * @danger write
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    update: (body, options) => this.transport.call(accountOperations["account.profile.update"], [], body, options)
+  };
+  sessions = {
+    /**
+     * Sign out one of your own sessions.
+     *
+     * Requires scope `account:sessions:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: destructive.
+     *
+     * `DELETE /me/sessions/{session_id}` · action `account.sessions.revoke`
+     * @scope `account:sessions:write`
+     * @danger destructive
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    revoke: (sessionId, options) => this.transport.call(accountOperations["account.sessions.revoke"], [sessionId], void 0, options),
+    /**
+     * Sign out every one of your sessions except the one you are using.
+     *
+     * Requires scope `account:sessions:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: critical.
+     *
+     * `POST /me/sessions/revoke-others` · action `account.sessions.revoke_others`
+     * @scope `account:sessions:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    revokeOthers: (options) => this.transport.call(accountOperations["account.sessions.revoke_others"], [], void 0, options)
+  };
+  social = {
+    /**
+     * Disconnect a social account from yours — never the last way you can sign in.
+     *
+     * Requires scope `account:sign_in:write` on an access token you delegated; it acts on your own account only. No management key is accepted. Danger: critical.
+     *
+     * `DELETE /me/social/{provider}` · action `account.social.unlink`
+     * @scope `account:sign_in:write`
+     * @danger critical
+     * May be held for approval (`202 approval_required`); waited on unless `approval: 'return'`.
+     */
+    unlink: (provider, options) => this.transport.call(accountOperations["account.social.unlink"], [provider], void 0, options)
+  };
+};
+
+// src/management/dpop.ts
+var encoder = new TextEncoder();
+function base64url(bytes) {
+  const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+  let binary = "";
+  for (const byte of view) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function sha256(input) {
+  return base64url(await crypto.subtle.digest("SHA-256", encoder.encode(input)));
+}
+async function generateDPoPKeyPair() {
+  return crypto.subtle.generateKey({ name: "ECDSA", namedCurve: "P-256" }, false, ["sign", "verify"]);
+}
+async function createDPoPSigner(keyPair) {
+  const exported = await crypto.subtle.exportKey("jwk", keyPair.publicKey);
+  const { crv, x, y } = exported;
+  if (exported.kty !== "EC" || crv !== "P-256" || typeof x !== "string" || typeof y !== "string") {
+    throw new TypeError("A DPoP key must be an ECDSA P-256 key pair.");
+  }
+  const jwk = { crv, kty: "EC", x, y };
+  const jkt = await sha256(JSON.stringify(jwk));
+  return {
+    jkt,
+    async proof({ method, url, accessToken, nonce }) {
+      const target = new URL(url);
+      const header = { typ: "dpop+jwt", alg: "ES256", jwk };
+      const payload = {
+        jti: crypto.randomUUID(),
+        htm: method.toUpperCase(),
+        // RFC 9449 §4.2: the URI without query and fragment.
+        htu: `${target.origin}${target.pathname}`,
+        iat: Math.floor(Date.now() / 1e3),
+        ath: await sha256(accessToken)
+      };
+      if (nonce !== void 0) {
+        payload.nonce = nonce;
+      }
+      const signingInput = `${base64url(encoder.encode(JSON.stringify(header)))}.${base64url(encoder.encode(JSON.stringify(payload)))}`;
+      const signature = await crypto.subtle.sign(
+        { name: "ECDSA", hash: "SHA-256" },
+        keyPair.privateKey,
+        encoder.encode(signingInput)
+      );
+      return `${signingInput}.${base64url(signature)}`;
+    }
+  };
+}
+
+// src/management/audit-logs.ts
+var MAX_AUDIT_BATCH = 100;
+var AUDIT_CHAIN_GENESIS = "0".repeat(64);
+function uuid2() {
+  return crypto.randomUUID();
+}
+var AuditLogger = class {
+  #client;
+  #batchSize;
+  #onError;
+  #buffer = [];
+  #queue = [];
+  #sending = Promise.resolve();
+  #timer;
+  #closed = false;
+  constructor(client, options = {}) {
+    const batchSize = options.batchSize ?? MAX_AUDIT_BATCH;
+    if (!Number.isInteger(batchSize) || batchSize < 1 || batchSize > MAX_AUDIT_BATCH) {
+      throw new RangeError(`batchSize must be 1\u2013${MAX_AUDIT_BATCH}.`);
+    }
+    this.#client = client;
+    this.#batchSize = batchSize;
+    this.#onError = options.onError;
+    const interval = options.flushIntervalMs ?? 5e3;
+    if (interval > 0) {
+      this.#timer = setInterval(() => this.#background(), interval);
+      this.#timer.unref?.();
+    }
+  }
+  /** Events buffered or queued, not yet acknowledged by the server. */
+  get pending() {
+    return this.#buffer.length + this.#queue.reduce((n, batch) => n + batch.events.length, 0);
+  }
+  /** Buffer one event. A full batch is sent in the background. */
+  record(event) {
+    if (this.#closed) {
+      throw new CboxIdError("This AuditLogger is closed.");
+    }
+    this.#buffer.push({ ...event, occurred_at: event.occurred_at ?? (/* @__PURE__ */ new Date()).toISOString() });
+    if (this.#buffer.length >= this.#batchSize) {
+      this.#background();
+    }
+  }
+  /** Send everything buffered, and resolve once the server has it. Throws if a batch fails. */
+  flush() {
+    this.#cut();
+    const run = this.#sending.catch(() => void 0).then(() => this.#drain());
+    this.#sending = run;
+    return run;
+  }
+  /** Stop the interval and flush. */
+  async close() {
+    this.#closed = true;
+    if (this.#timer !== void 0) {
+      clearInterval(this.#timer);
+      this.#timer = void 0;
+    }
+    await this.flush();
+  }
+  #background() {
+    this.flush().catch((error) => {
+      this.#onError?.(error, this.#queue[0]?.events ?? []);
+    });
+  }
+  /** Move the buffer into batches, each with the key every resend of it will carry. */
+  #cut() {
+    while (this.#buffer.length > 0) {
+      this.#queue.push({ events: this.#buffer.splice(0, this.#batchSize), idempotencyKey: uuid2() });
+    }
+  }
+  async #drain() {
+    while (this.#queue.length > 0) {
+      const batch = this.#queue[0];
+      await this.#client.auditLogs.events.create({ events: batch.events }, { idempotencyKey: batch.idempotencyKey });
+      this.#queue.shift();
+    }
+  }
+};
+var AuditLogExportError = class extends CboxIdError {
+  constructor(message, auditExport) {
+    super(message);
+    this.auditExport = auditExport;
+  }
+  auditExport;
+};
+function sleep2(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+      reject(signal.reason);
+      return;
+    }
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(signal?.reason);
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+async function exportAuditLogs(client, filters = {}, options = {}) {
+  const call = {
+    ...options.signal !== void 0 ? { signal: options.signal } : {}
+  };
+  const created = await client.auditLogs.exports.create(filters, {
+    ...call,
+    ...options.idempotencyKey !== void 0 ? { idempotencyKey: options.idempotencyKey } : {}
+  });
+  const deadline = Date.now() + (options.timeoutMs ?? 6e5);
+  const interval = Math.max(0, options.pollIntervalMs ?? 2e3);
+  let current = created.data;
+  for (; ; ) {
+    switch (current.state) {
+      case "ready":
+        return current;
+      case "failed":
+      case "expired":
+        throw new AuditLogExportError(`Audit log export ${current.id} is ${current.state}.`, current);
+    }
+    if (Date.now() >= deadline) {
+      throw new AuditLogExportError(`Audit log export ${current.id} was not ready in time.`, current);
+    }
+    await sleep2(interval, options.signal);
+    current = (await client.auditLogs.exports.get(current.id, call)).data;
+  }
+}
+var encoder2 = new TextEncoder();
+function compareBytes(a, b) {
+  const x = encoder2.encode(a);
+  const y = encoder2.encode(b);
+  const n = Math.min(x.length, y.length);
+  for (let i = 0; i < n; i++) {
+    if (x[i] !== y[i]) return x[i] - y[i];
+  }
+  return x.length - y.length;
+}
+function phpFloat(value) {
+  if (!Number.isFinite(value)) {
+    throw new TypeError("Canonical JSON cannot encode NaN or Infinity.");
+  }
+  if (Object.is(value, -0)) return "-0";
+  if (Number.isSafeInteger(value)) return String(value);
+  const sign = value < 0 ? "-" : "";
+  const [mantissa, exp] = Math.abs(value).toExponential().split("e");
+  const digits = mantissa.replace(".", "");
+  const exponent = Number(exp);
+  const decpt = exponent + 1;
+  if (decpt < -3 || decpt > 17) {
+    return `${sign}${digits[0]}.${digits.slice(1) || "0"}e${exponent < 0 ? "-" : "+"}${Math.abs(exponent)}`;
+  }
+  if (decpt <= 0) return `${sign}0.${"0".repeat(-decpt)}${digits}`;
+  if (decpt >= digits.length) return `${sign}${digits}${"0".repeat(decpt - digits.length)}`;
+  return `${sign}${digits.slice(0, decpt)}.${digits.slice(decpt)}`;
+}
+function canonicalJson(value) {
+  if (value === null || value === void 0) return "null";
+  if (typeof value === "boolean") return value ? "true" : "false";
+  if (typeof value === "number") return phpFloat(value);
+  if (typeof value === "string") return JSON.stringify(value).replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
+  if (Array.isArray(value)) {
+    return `[${value.map(canonicalJson).join(",")}]`;
+  }
+  if (typeof value === "object") {
+    const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => compareBytes(a, b));
+    if (entries.length === 0) return "[]";
+    if (entries.every(([key], index) => key === String(index))) {
+      return `[${entries.map(([, v]) => canonicalJson(v)).join(",")}]`;
+    }
+    return `{${entries.map(([k, v]) => `${canonicalJson(k)}:${canonicalJson(v)}`).join(",")}}`;
+  }
+  throw new TypeError(`Canonical JSON cannot encode a ${typeof value}.`);
+}
+function metadataOf(value) {
+  if (Array.isArray(value)) return value.length > 0 ? value : null;
+  if (typeof value === "object" && value !== null) return Object.keys(value).length > 0 ? value : null;
+  return null;
+}
+function auditEventDocument(event) {
+  const actor = event.actor ?? {};
+  const context = event.context ?? {};
+  return {
+    id: event.id,
+    organization_id: event.organization_id,
+    sequence: event.sequence,
+    action: event.action,
+    occurred_at: event.occurred_at,
+    actor: { id: actor.id ?? null, type: actor.type ?? null, name: actor.name ?? null, metadata: metadataOf(actor.metadata) },
+    targets: (event.targets ?? []).map((target) => ({
+      id: target.id ?? null,
+      type: target.type ?? null,
+      name: target.name ?? null,
+      metadata: metadataOf(target.metadata)
+    })),
+    context: { location: context.location ?? null, user_agent: context.user_agent ?? null },
+    metadata: metadataOf(event.metadata)
+  };
+}
+async function auditEventHash(previousHash, event) {
+  const digest = await crypto.subtle.digest("SHA-256", encoder2.encode(previousHash + canonicalJson(auditEventDocument(event))));
+  return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function verifyAuditChain(events, options = {}) {
+  const all = [];
+  for await (const event of events) {
+    all.push(event);
+  }
+  all.sort((a, b) => a.sequence - b.sequence);
+  const first = all[0];
+  let previous = options.previousHash ?? (first === void 0 || first.sequence === 1 ? AUDIT_CHAIN_GENESIS : first.prev_hash);
+  let expected = first?.sequence ?? 1;
+  let verified = 0;
+  const result = (reason) => ({
+    valid: reason === null,
+    verified_count: verified,
+    first_sequence: verified === 0 ? null : first.sequence,
+    last_sequence: verified === 0 ? null : expected - 1,
+    broken_at_sequence: reason === null ? null : expected,
+    reason
+  });
+  for (const event of all) {
+    if (event.sequence !== expected) return result("missing");
+    if (event.prev_hash !== previous) return result("link");
+    if (await auditEventHash(previous, event) !== event.hash) return result("hash");
+    previous = event.hash;
+    expected++;
+    verified++;
+  }
+  return result(null);
+}
+async function verifyAuditLogChain(client, query, options = {}) {
+  return verifyAuditChain(client.auditLogs.events.listAll({ ...query, order: "asc" }), options);
+}
+
+exports.AUDIT_CHAIN_GENESIS = AUDIT_CHAIN_GENESIS;
+exports.AccountClient = AccountClient;
+exports.ApprovalDeniedError = ApprovalDeniedError;
+exports.ApprovalError = ApprovalError;
+exports.ApprovalExpiredError = ApprovalExpiredError;
+exports.AuditLogExportError = AuditLogExportError;
+exports.AuditLogger = AuditLogger;
+exports.CboxIdApiError = CboxIdApiError;
+exports.CboxIdError = CboxIdError;
+exports.ConfigurationError = ConfigurationError;
+exports.EnvironmentClient = EnvironmentClient;
+exports.MAX_AUDIT_BATCH = MAX_AUDIT_BATCH;
+exports.ManagementNetworkError = ManagementNetworkError;
+exports.ManagementTransport = ManagementTransport;
+exports.PlatformClient = PlatformClient;
+exports.WorkspaceClient = WorkspaceClient;
+exports.accountOperations = accountOperations;
+exports.auditEventDocument = auditEventDocument;
+exports.auditEventHash = auditEventHash;
+exports.canonicalJson = canonicalJson;
+exports.createDPoPSigner = createDPoPSigner;
+exports.environmentOperations = environmentOperations;
+exports.exportAuditLogs = exportAuditLogs;
+exports.generateDPoPKeyPair = generateDPoPKeyPair;
+exports.platformOperations = platformOperations;
+exports.retryAfterMs = retryAfterMs;
+exports.verifyAuditChain = verifyAuditChain;
+exports.verifyAuditLogChain = verifyAuditLogChain;
+exports.workspaceOperations = workspaceOperations;
+//# sourceMappingURL=management.cjs.map
+//# sourceMappingURL=management.cjs.map