@dropthis/cli 0.25.0 → 0.27.0

package/node_modules/@dropthis/node/README.md

@@ -375,11 +375,29 @@ await dropthis.auth.logout(); // 204 No Content — data is null
 ### apiKeys
 
 ```typescript
-await dropthis.apiKeys.create({ label: "CI" });
+// Delegated key — account-scoped, follows the active workspace (the default)
+await dropthis.apiKeys.create({ label: "My key" });
+
+// Delegated key restricted to specific workspaces
+await dropthis.apiKeys.create({
+  label: "Dev only",
+  type: "delegated",
+  allowedWorkspaces: ["dev-team", "staging"],
+});
+
+// Service key pinned to one workspace — for CI/automation
+await dropthis.apiKeys.create({
+  label: "CI deploy",
+  type: "service",
+  workspace: "prod-team",
+});
+
 await dropthis.apiKeys.list();
 await dropthis.apiKeys.delete("key_abc123"); // 204 No Content — data is null
 ```
 
+`KeyType` is `"delegated" | "service"`. A `delegated` key acts on behalf of the owning account and can switch workspaces server-side via `workspaces.use()`; a `service` key is pinned to one workspace and is intended for CI/automation where a stable target is needed.
+
 ### account
 
 ```typescript
@@ -387,6 +405,11 @@ const { data } = await dropthis.account.get();
 // data.limits carries your plan's limits — use them to size a publish first:
 // { name, maxSizeBytes, defaultTtlSeconds, maxStorageBytes }
 
+// data.workspace identifies the workspace the API key is bound to:
+// { id, name, slug, kind: "personal" | "team", role: "owner" | "admin" | "member" }
+// A key minted in a team workspace publishes there automatically — the workspace's
+// shared custom domain routes the drop without any extra option.
+
 await dropthis.account.update({ displayName: "Jane Doe" });
 await dropthis.account.delete();
 ```
@@ -438,6 +461,48 @@ await dropthis.domains.update("drops.example.com", { default: true });
 await dropthis.domains.delete("drops.example.com");
 ```
 
+### workspaces
+
+`client.workspaces` lists and switches the active workspace for a delegated credential.
+
+```typescript
+// All workspaces the key has access to (isActive marks the current one)
+const { data } = await dropthis.workspaces.list();
+for (const ws of data.data) {
+  console.log(ws.slug, ws.kind, ws.isActive);
+}
+
+// The currently active workspace (null when none is active)
+const { data: active } = await dropthis.workspaces.active();
+
+// Switch the active workspace server-side (persisted on the api_keys row)
+await dropthis.workspaces.use("team-slug");   // slug or id
+```
+
+`workspaces.use()` only applies to `delegated` keys; `service` keys are pinned at creation.
+
+#### Targeting a workspace on publish
+
+Pass `workspace` in the publish options to target a specific workspace for that call:
+
+```typescript
+const { data } = await dropthis.drops.publish("<h1>Team report</h1>", {
+  workspace: "team-slug",
+});
+console.log(data.workspace); // { id, name, slug, kind } — owning workspace echoed on every drop
+```
+
+Set a client-level default so every publish goes to the same workspace without repeating it:
+
+```typescript
+const dropthis = new Dropthis({ apiKey: "sk_...", workspace: "team-slug" });
+
+// All publishes now target team-slug unless you pass a different workspace in options
+const { data } = await dropthis.drops.publish("./dist");
+```
+
+`DropthisEdge` honours the same `workspace` constructor option and publish option.
+
 ## Pricing tiers
 
 - **Free** — drops expire after 7 days, 5 MB per drop, 500 MB active storage, dropthis badge.
@@ -468,6 +533,7 @@ Key types exported from the package:
 import type {
   AccountLimits,
   AccountResponse,
+  AccountWorkspace,
   DropthisClientOptions,
   DropthisResult,
   DropthisErrorResponse,
@@ -488,6 +554,8 @@ import type {
   RevokeImpact,
   CreateUploadSessionRequest,
   CreateUploadSessionResponse,
+  Workspace,
+  DropWorkspace,
 } from "@dropthis/node";
 ```
 

package/node_modules/@dropthis/node/dist/{drops-BVoN5MaZ.d.cts → drops-YhYy2f6R.d.cts}

@@ -4,6 +4,12 @@ type DropthisClientOptions = {
     timeoutMs?: number;
     uploadTimeoutMs?: number;
     fetch?: typeof globalThis.fetch;
+    /**
+     * Default workspace slug or id applied to every publish/prepare call that
+     * does not supply its own `options.workspace`. Delegated credentials only;
+     * ignored by pinned service keys.
+     */
+    workspace?: string;
 };
 type RequestOptions = {
     authenticated?: boolean;
@@ -57,6 +63,17 @@ type TierInfo = {
 type Limitations = {
     actions: DropAction[];
 };
+/**
+ * Workspace context echoed on every drop response. Identifies which workspace
+ * the drop was published into (ADR 0066).
+ */
+type DropWorkspace = {
+    id: string;
+    name: string;
+    slug: string;
+    /** `personal` for a solo workspace, `team` for a shared team workspace. */
+    kind: string;
+};
 type DropResponse = {
     id: string;
     slug: string;
@@ -100,6 +117,8 @@ type DropResponse = {
      * To stream bytes through the SDK regardless of drop kind, use `drops.getContent()`.
      */
     rawUrl: string | null;
+    /** The workspace this drop belongs to (echoed from the server on every response). */
+    workspace: DropWorkspace;
 };
 type DropDeploymentResponse = {
     id: string;
@@ -163,11 +182,11 @@ type SessionResponse = {
     refreshToken?: string | null;
 };
 /**
- * Why an API key exists. `standard` keys are created by the user (CLI/SDK/manual);
- * `mcp_oauth` keys are minted per connected client by the MCP OAuth flow and carry a
- * more generous quota.
+ * Why an API key exists. `delegated` keys act on behalf of the owning account (scoped
+ * to the active workspace or an allowed set); `service` keys are pinned to a single
+ * workspace and are intended for CI/automation.
  */
-type KeyType = "standard" | "mcp_oauth";
+type KeyType = "delegated" | "service";
 /** What breaks when a key is revoked. */
 type RevokeImpact = "disconnects_app" | "breaks_automation";
 type ApiKeyResponse = {
@@ -212,6 +231,33 @@ type AccountUsage = {
     /** Number of custom domain hostnames currently in use. */
     customDomainsUsed: number;
 };
+/** The workspace a principal acts within (ADR 0066). For an sk_ API key, the workspace the key is bound to. */
+type AccountWorkspace = {
+    id: string;
+    name: string;
+    slug: string;
+    /** `personal` for a solo workspace, `team` when shared with other members. */
+    kind: string;
+    /** The calling account's role in this workspace: `owner`, `admin`, or `member`. */
+    role: string;
+};
+/**
+ * A workspace the caller belongs to or has delegated access to.
+ * Returned by `GET /v1/workspaces` and `PUT /v1/account/active-workspace`.
+ */
+type Workspace = {
+    id: string;
+    name: string;
+    slug: string;
+    /** `personal` for a solo workspace, `team` for a shared team workspace. */
+    kind: string;
+    /** The calling account's role in this workspace: `owner`, `admin`, or `member`. */
+    role: string;
+    /** The plan tier of this workspace. */
+    plan: string;
+    /** Whether this workspace is currently the caller's active workspace. */
+    isActive: boolean;
+};
 type AccountResponse = {
     id: string;
     email: string;
@@ -221,6 +267,7 @@ type AccountResponse = {
     createdAt: string;
     limits: AccountLimits;
     usage: AccountUsage;
+    workspace: AccountWorkspace;
     /** URL to upgrade the account; null if already on the highest tier. */
     upgradeUrl: string | null;
 };
@@ -262,6 +309,12 @@ type CreateUploadSessionRequest = {
     schemaVersion?: 1;
     files: UploadManifestFile[];
     entry?: string | null;
+    /**
+     * Target workspace slug or id for this upload session. Delegated credentials only;
+     * ignored by pinned service keys. Bound at session creation and inherited by the
+     * subsequent POST /drops call.
+     */
+    workspace?: string;
 };
 type UploadTarget = {
     /** Always `single_put` — one signed PUT per file is the upload contract. */
@@ -361,7 +414,16 @@ type RequestControls = {
     /** Fail if current revision doesn't match -- optimistic lock (update only). */
     ifRevision?: number;
 };
-type PublishOptions = DropOptions & PrepareOptions & RequestControls;
+type PublishOptions = DropOptions & PrepareOptions & RequestControls & {
+    /**
+     * Target workspace slug or id — publish/prepare only (a fresh drop's workspace).
+     * Delegated credentials only; ignored by pinned service keys. Falls back to the
+     * client-level `workspace` default when omitted. Not a settings field: it is NOT
+     * accepted by `updateSettings` (a drop never moves workspace) nor by `updateContent`
+     * (which stays in the drop's own workspace).
+     */
+    workspace?: string;
+};
 /**
  * Options for `drops.updateContent()` — content-only. A content update ships a new content version
  * and never changes drop settings (title, visibility, password, noindex, expiry, metadata); those
@@ -631,11 +693,15 @@ type PreparedPublishRequest = {
     files: PreparedUploadFile[];
     options: Record<string, unknown>;
     metadata?: Record<string, unknown>;
+    /** Target workspace slug or id (delegated credentials only). Bound at upload-session creation. */
+    workspace?: string;
 } | {
     kind: "source";
     sourceUrl: string;
     options: Record<string, unknown>;
     metadata?: Record<string, unknown>;
+    /** Target workspace slug or id (delegated credentials only). Forwarded as top-level field in POST /drops. */
+    workspace?: string;
 };
 /**
  * The canonical publish inputs that can be resolved with no filesystem access:
@@ -675,6 +741,12 @@ declare class ApiKeysResource {
     }>>;
     create(input: {
         label: string;
+        /** Key type: `"delegated"` (default on server) or `"service"` (pinned to a workspace). */
+        type?: KeyType;
+        /** Pin a `service` key to this workspace slug or id. */
+        workspace?: string;
+        /** Restrict a `delegated` key to these workspace slugs or ids. */
+        allowedWorkspaces?: string[];
     }): Promise<DropthisResult<ApiKeyCreatedResponse>>;
     /** Revoke an API key. 204 No Content — data is null on success. */
     delete(keyId: string): Promise<DropthisResult<null>>;
@@ -765,7 +837,8 @@ declare class CursorPage<T> implements ListPage<T> {
 declare class DropsResource<TInput = PublishInput> {
     private readonly transport;
     private readonly resolveInput;
-    constructor(transport: Transport, resolveInput: PublishInputResolver<TInput>);
+    private readonly defaultWorkspace?;
+    constructor(transport: Transport, resolveInput: PublishInputResolver<TInput>, defaultWorkspace?: string | undefined);
     /**
      * Publish content to a NEW permanent public URL; returns the created drop (with its `drop_…` id).
      * Use to publish / share / post / put online / make public a report, dashboard, site, or file.
@@ -841,4 +914,4 @@ declare class DropsResource<TInput = PublishInput> {
     delete(dropId: string): Promise<DropthisResult<null>>;
 }
 
-export { type AccountLimits as A, type PreparedUploadFile as B, type CreateUploadSessionRequest as C, type DeploymentContentFile as D, type EmailOtpResponse as E, type PublishFileInput as F, type GetContentOptions as G, type PublishInput as H, type InMemoryPublishInput as I, type PublishOptions as J, type KeyType as K, type Limitations as L, type RequestOptions as M, type NextHint as N, type RevokeImpact as O, type PrepareOptions as P, type SessionResponse as Q, type RequestControls as R, SHARED_POOL as S, type TierInfo as T, Transport as U, type UpdateContentOptions as V, type UploadManifestFile as W, type UploadSessionFileResponse as X, type UploadSessionResponse as Y, type UploadTarget as Z, AccountResource as a, type AccountResponse as b, type ActionResolve as c, ApiKeysResource as d, type CreateUploadSessionResponse as e, CursorPage as f, type DeploymentContentManifest as g, DeploymentsResource as h, type DnsRecord as i, type DomainDeletedResponse as j, type DomainListResponse as k, type DomainResponse as l, DomainsResource as m, type DropAction as n, type DropContentFile as o, type DropDeploymentResponse as p, type DropOptions as q, type DropResponse as r, DropsResource as s, type DropthisClientOptions as t, type DropthisErrorResponse as u, type DropthisResult as v, type ListDeploymentsParams as w, type ListDeploymentsResponse as x, type ListPage as y, type PreparedPublishRequest as z };
+export { type UploadTarget as $, type AccountLimits as A, type ListPage as B, type CreateUploadSessionRequest as C, type DeploymentContentFile as D, type EmailOtpResponse as E, type PreparedPublishRequest as F, type GetContentOptions as G, type PreparedUploadFile as H, type InMemoryPublishInput as I, type PublishFileInput as J, type KeyType as K, type Limitations as L, type PublishInput as M, type NextHint as N, type PublishOptions as O, type PrepareOptions as P, type RequestOptions as Q, type RequestControls as R, type RevokeImpact as S, SHARED_POOL as T, type SessionResponse as U, type TierInfo as V, Transport as W, type UpdateContentOptions as X, type UploadManifestFile as Y, type UploadSessionFileResponse as Z, type UploadSessionResponse as _, AccountResource as a, type Workspace as a0, type AccountResponse as b, type AccountWorkspace as c, type ActionResolve as d, ApiKeysResource as e, type CreateUploadSessionResponse as f, CursorPage as g, type DeploymentContentManifest as h, DeploymentsResource as i, type DnsRecord as j, type DomainDeletedResponse as k, type DomainListResponse as l, type DomainResponse as m, DomainsResource as n, type DropAction as o, type DropContentFile as p, type DropDeploymentResponse as q, type DropOptions as r, type DropResponse as s, type DropWorkspace as t, DropsResource as u, type DropthisClientOptions as v, type DropthisErrorResponse as w, type DropthisResult as x, type ListDeploymentsParams as y, type ListDeploymentsResponse as z };

package/node_modules/@dropthis/node/dist/{drops-BVoN5MaZ.d.ts → drops-YhYy2f6R.d.ts}

@@ -4,6 +4,12 @@ type DropthisClientOptions = {
     timeoutMs?: number;
     uploadTimeoutMs?: number;
     fetch?: typeof globalThis.fetch;
+    /**
+     * Default workspace slug or id applied to every publish/prepare call that
+     * does not supply its own `options.workspace`. Delegated credentials only;
+     * ignored by pinned service keys.
+     */
+    workspace?: string;
 };
 type RequestOptions = {
     authenticated?: boolean;
@@ -57,6 +63,17 @@ type TierInfo = {
 type Limitations = {
     actions: DropAction[];
 };
+/**
+ * Workspace context echoed on every drop response. Identifies which workspace
+ * the drop was published into (ADR 0066).
+ */
+type DropWorkspace = {
+    id: string;
+    name: string;
+    slug: string;
+    /** `personal` for a solo workspace, `team` for a shared team workspace. */
+    kind: string;
+};
 type DropResponse = {
     id: string;
     slug: string;
@@ -100,6 +117,8 @@ type DropResponse = {
      * To stream bytes through the SDK regardless of drop kind, use `drops.getContent()`.
      */
     rawUrl: string | null;
+    /** The workspace this drop belongs to (echoed from the server on every response). */
+    workspace: DropWorkspace;
 };
 type DropDeploymentResponse = {
     id: string;
@@ -163,11 +182,11 @@ type SessionResponse = {
     refreshToken?: string | null;
 };
 /**
- * Why an API key exists. `standard` keys are created by the user (CLI/SDK/manual);
- * `mcp_oauth` keys are minted per connected client by the MCP OAuth flow and carry a
- * more generous quota.
+ * Why an API key exists. `delegated` keys act on behalf of the owning account (scoped
+ * to the active workspace or an allowed set); `service` keys are pinned to a single
+ * workspace and are intended for CI/automation.
  */
-type KeyType = "standard" | "mcp_oauth";
+type KeyType = "delegated" | "service";
 /** What breaks when a key is revoked. */
 type RevokeImpact = "disconnects_app" | "breaks_automation";
 type ApiKeyResponse = {
@@ -212,6 +231,33 @@ type AccountUsage = {
     /** Number of custom domain hostnames currently in use. */
     customDomainsUsed: number;
 };
+/** The workspace a principal acts within (ADR 0066). For an sk_ API key, the workspace the key is bound to. */
+type AccountWorkspace = {
+    id: string;
+    name: string;
+    slug: string;
+    /** `personal` for a solo workspace, `team` when shared with other members. */
+    kind: string;
+    /** The calling account's role in this workspace: `owner`, `admin`, or `member`. */
+    role: string;
+};
+/**
+ * A workspace the caller belongs to or has delegated access to.
+ * Returned by `GET /v1/workspaces` and `PUT /v1/account/active-workspace`.
+ */
+type Workspace = {
+    id: string;
+    name: string;
+    slug: string;
+    /** `personal` for a solo workspace, `team` for a shared team workspace. */
+    kind: string;
+    /** The calling account's role in this workspace: `owner`, `admin`, or `member`. */
+    role: string;
+    /** The plan tier of this workspace. */
+    plan: string;
+    /** Whether this workspace is currently the caller's active workspace. */
+    isActive: boolean;
+};
 type AccountResponse = {
     id: string;
     email: string;
@@ -221,6 +267,7 @@ type AccountResponse = {
     createdAt: string;
     limits: AccountLimits;
     usage: AccountUsage;
+    workspace: AccountWorkspace;
     /** URL to upgrade the account; null if already on the highest tier. */
     upgradeUrl: string | null;
 };
@@ -262,6 +309,12 @@ type CreateUploadSessionRequest = {
     schemaVersion?: 1;
     files: UploadManifestFile[];
     entry?: string | null;
+    /**
+     * Target workspace slug or id for this upload session. Delegated credentials only;
+     * ignored by pinned service keys. Bound at session creation and inherited by the
+     * subsequent POST /drops call.
+     */
+    workspace?: string;
 };
 type UploadTarget = {
     /** Always `single_put` — one signed PUT per file is the upload contract. */
@@ -361,7 +414,16 @@ type RequestControls = {
     /** Fail if current revision doesn't match -- optimistic lock (update only). */
     ifRevision?: number;
 };
-type PublishOptions = DropOptions & PrepareOptions & RequestControls;
+type PublishOptions = DropOptions & PrepareOptions & RequestControls & {
+    /**
+     * Target workspace slug or id — publish/prepare only (a fresh drop's workspace).
+     * Delegated credentials only; ignored by pinned service keys. Falls back to the
+     * client-level `workspace` default when omitted. Not a settings field: it is NOT
+     * accepted by `updateSettings` (a drop never moves workspace) nor by `updateContent`
+     * (which stays in the drop's own workspace).
+     */
+    workspace?: string;
+};
 /**
  * Options for `drops.updateContent()` — content-only. A content update ships a new content version
  * and never changes drop settings (title, visibility, password, noindex, expiry, metadata); those
@@ -631,11 +693,15 @@ type PreparedPublishRequest = {
     files: PreparedUploadFile[];
     options: Record<string, unknown>;
     metadata?: Record<string, unknown>;
+    /** Target workspace slug or id (delegated credentials only). Bound at upload-session creation. */
+    workspace?: string;
 } | {
     kind: "source";
     sourceUrl: string;
     options: Record<string, unknown>;
     metadata?: Record<string, unknown>;
+    /** Target workspace slug or id (delegated credentials only). Forwarded as top-level field in POST /drops. */
+    workspace?: string;
 };
 /**
  * The canonical publish inputs that can be resolved with no filesystem access:
@@ -675,6 +741,12 @@ declare class ApiKeysResource {
     }>>;
     create(input: {
         label: string;
+        /** Key type: `"delegated"` (default on server) or `"service"` (pinned to a workspace). */
+        type?: KeyType;
+        /** Pin a `service` key to this workspace slug or id. */
+        workspace?: string;
+        /** Restrict a `delegated` key to these workspace slugs or ids. */
+        allowedWorkspaces?: string[];
     }): Promise<DropthisResult<ApiKeyCreatedResponse>>;
     /** Revoke an API key. 204 No Content — data is null on success. */
     delete(keyId: string): Promise<DropthisResult<null>>;
@@ -765,7 +837,8 @@ declare class CursorPage<T> implements ListPage<T> {
 declare class DropsResource<TInput = PublishInput> {
     private readonly transport;
     private readonly resolveInput;
-    constructor(transport: Transport, resolveInput: PublishInputResolver<TInput>);
+    private readonly defaultWorkspace?;
+    constructor(transport: Transport, resolveInput: PublishInputResolver<TInput>, defaultWorkspace?: string | undefined);
     /**
      * Publish content to a NEW permanent public URL; returns the created drop (with its `drop_…` id).
      * Use to publish / share / post / put online / make public a report, dashboard, site, or file.
@@ -841,4 +914,4 @@ declare class DropsResource<TInput = PublishInput> {
     delete(dropId: string): Promise<DropthisResult<null>>;
 }
 
-export { type AccountLimits as A, type PreparedUploadFile as B, type CreateUploadSessionRequest as C, type DeploymentContentFile as D, type EmailOtpResponse as E, type PublishFileInput as F, type GetContentOptions as G, type PublishInput as H, type InMemoryPublishInput as I, type PublishOptions as J, type KeyType as K, type Limitations as L, type RequestOptions as M, type NextHint as N, type RevokeImpact as O, type PrepareOptions as P, type SessionResponse as Q, type RequestControls as R, SHARED_POOL as S, type TierInfo as T, Transport as U, type UpdateContentOptions as V, type UploadManifestFile as W, type UploadSessionFileResponse as X, type UploadSessionResponse as Y, type UploadTarget as Z, AccountResource as a, type AccountResponse as b, type ActionResolve as c, ApiKeysResource as d, type CreateUploadSessionResponse as e, CursorPage as f, type DeploymentContentManifest as g, DeploymentsResource as h, type DnsRecord as i, type DomainDeletedResponse as j, type DomainListResponse as k, type DomainResponse as l, DomainsResource as m, type DropAction as n, type DropContentFile as o, type DropDeploymentResponse as p, type DropOptions as q, type DropResponse as r, DropsResource as s, type DropthisClientOptions as t, type DropthisErrorResponse as u, type DropthisResult as v, type ListDeploymentsParams as w, type ListDeploymentsResponse as x, type ListPage as y, type PreparedPublishRequest as z };
+export { type UploadTarget as $, type AccountLimits as A, type ListPage as B, type CreateUploadSessionRequest as C, type DeploymentContentFile as D, type EmailOtpResponse as E, type PreparedPublishRequest as F, type GetContentOptions as G, type PreparedUploadFile as H, type InMemoryPublishInput as I, type PublishFileInput as J, type KeyType as K, type Limitations as L, type PublishInput as M, type NextHint as N, type PublishOptions as O, type PrepareOptions as P, type RequestOptions as Q, type RequestControls as R, type RevokeImpact as S, SHARED_POOL as T, type SessionResponse as U, type TierInfo as V, Transport as W, type UpdateContentOptions as X, type UploadManifestFile as Y, type UploadSessionFileResponse as Z, type UploadSessionResponse as _, AccountResource as a, type Workspace as a0, type AccountResponse as b, type AccountWorkspace as c, type ActionResolve as d, ApiKeysResource as e, type CreateUploadSessionResponse as f, CursorPage as g, type DeploymentContentManifest as h, DeploymentsResource as i, type DnsRecord as j, type DomainDeletedResponse as k, type DomainListResponse as l, type DomainResponse as m, DomainsResource as n, type DropAction as o, type DropContentFile as p, type DropDeploymentResponse as q, type DropOptions as r, type DropResponse as s, type DropWorkspace as t, DropsResource as u, type DropthisClientOptions as v, type DropthisErrorResponse as w, type DropthisResult as x, type ListDeploymentsParams as y, type ListDeploymentsResponse as z };

package/node_modules/@dropthis/node/dist/edge.cjs

@@ -253,7 +253,8 @@ function buildStagedRequest(files, options, entry) {
   const manifest = {
     schemaVersion: 1,
     files: manifestFiles,
-    ...resolvedEntry ? { entry: resolvedEntry } : {}
+    ...resolvedEntry ? { entry: resolvedEntry } : {},
+    ...options.workspace !== void 0 ? { workspace: options.workspace } : {}
   };
   const prepared = {
     kind: "staged",
@@ -262,6 +263,7 @@ function buildStagedRequest(files, options, entry) {
     options: optionsBody(options)
   };
   if (options.metadata) prepared.metadata = options.metadata;
+  if (options.workspace !== void 0) prepared.workspace = options.workspace;
   return prepared;
 }
 function buildSourceRequest(sourceUrl, options) {
@@ -279,6 +281,7 @@ function buildSourceRequest(sourceUrl, options) {
     options: optionsBody(options)
   };
   if (options.metadata) prepared.metadata = options.metadata;
+  if (options.workspace !== void 0) prepared.workspace = options.workspace;
   return prepared;
 }
 function decodeBase64(value) {
@@ -503,6 +506,7 @@ async function publishSource(transport, prepared, finalPath, options = {}) {
       sourceUrl: prepared.sourceUrl,
       ...Object.keys(prepared.options).length > 0 ? { options: prepared.options } : {},
       ...prepared.metadata ? { metadata: prepared.metadata } : {},
+      ...prepared.workspace !== void 0 ? { workspace: prepared.workspace } : {},
       ...partialUpdateBody(options)
     },
     idempotencyKey: `${baseKey}:publish`,
@@ -537,7 +541,12 @@ var ApiKeysResource = class {
     return this.transport.request("GET", "/api-keys");
   }
   create(input) {
-    return this.transport.request("POST", "/api-keys", { body: input });
+    const body = { label: input.label };
+    if (input.type !== void 0) body.key_type = input.type;
+    if (input.workspace !== void 0) body.workspace = input.workspace;
+    if (input.allowedWorkspaces !== void 0)
+      body.allowed_workspace_ids = input.allowedWorkspaces;
+    return this.transport.request("POST", "/api-keys", { body });
   }
   /** Revoke an API key. 204 No Content — data is null on success. */
   delete(keyId) {
@@ -685,12 +694,14 @@ var CursorPage = class {
 
 // src/resources/drops.ts
 var DropsResource = class {
-  constructor(transport, resolveInput) {
+  constructor(transport, resolveInput, defaultWorkspace) {
     this.transport = transport;
     this.resolveInput = resolveInput;
+    this.defaultWorkspace = defaultWorkspace;
   }
   transport;
   resolveInput;
+  defaultWorkspace;
   /**
    * Publish content to a NEW permanent public URL; returns the created drop (with its `drop_…` id).
    * Use to publish / share / post / put online / make public a report, dashboard, site, or file.
@@ -708,13 +719,14 @@ var DropsResource = class {
    * collections. To stream bytes through the SDK for any drop kind, use {@link getContent}.
    */
   async publish(input, options = {}) {
+    const merged = this.defaultWorkspace !== void 0 && options.workspace === void 0 ? { ...options, workspace: this.defaultWorkspace } : options;
     let prepared;
     try {
-      prepared = await this.resolveInput(input, options);
+      prepared = await this.resolveInput(input, merged);
     } catch (e) {
       return toErrorResult(e);
     }
-    return prepared.kind === "source" ? publishSource(this.transport, prepared, "/drops", options) : publishStaged(this.transport, prepared, "/drops", options);
+    return prepared.kind === "source" ? publishSource(this.transport, prepared, "/drops", merged) : publishStaged(this.transport, prepared, "/drops", merged);
   }
   /**
    * Replace the content of an EXISTING drop, keeping its URL (ships a new deployment). Requires the
@@ -892,7 +904,7 @@ function toSnakeCase(value) {
 
 // src/transport.ts
 var DEFAULT_BASE_URL = "https://api.dropthis.app";
-var SDK_VERSION = "0.22.0";
+var SDK_VERSION = "0.24.0";
 var Transport = class {
   apiKey;
   baseUrl;
@@ -1132,6 +1144,8 @@ function booleanValue(value) {
 // src/edge.ts
 var DropthisEdge = class {
   transport;
+  /** Client-level workspace default; applied when a publish call omits `options.workspace`. */
+  defaultWorkspace;
   dropsResource;
   accountResource;
   apiKeysResource;
@@ -1139,10 +1153,15 @@ var DropthisEdge = class {
   domainsResource;
   constructor(options = {}) {
     this.transport = new Transport(options);
+    this.defaultWorkspace = typeof options === "string" ? void 0 : options.workspace;
   }
   get drops() {
     if (!this.dropsResource)
-      this.dropsResource = new DropsResource(this.transport, resolveInMemory);
+      this.dropsResource = new DropsResource(
+        this.transport,
+        resolveInMemory,
+        this.defaultWorkspace
+      );
     return this.dropsResource;
   }
   get account() {