@productcraft/platform-auth 0.0.1

package/dist/index.d.ts

@@ -0,0 +1,1849 @@
+import { makeClient, PCClientConfig } from '@productcraft/core';
+
+/**
+ * This file was auto-generated by openapi-typescript.
+ * Do not make direct changes to the file.
+ */
+
+interface paths {
+    "/.well-known/jwks.json": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get: operations["JwksController_jwks"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/account": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        delete: operations["AccountController_deleteAccount"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/auth/logout": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Logout by revoking refresh token */
+        post: operations["AuthenticationController_logout"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/auth/logout-current": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Revoke the server-side session tied to the caller’s current access token */
+        post: operations["AuthenticationController_logoutCurrent"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/auth/password/request-reset": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post: operations["PasswordController_requestPasswordReset"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/auth/password/reset": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post: operations["PasswordController_resetPassword"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/auth/refresh": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Refresh access token using refresh token */
+        post: operations["AuthenticationController_refresh"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/auth/signin": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Sign in with email/username and password */
+        post: operations["AuthenticationController_signin"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/auth/signup": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Create a new account and sign in */
+        post: operations["AuthenticationController_signup"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/introspect": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Introspect current user with workspace list */
+        get: operations["IntrospectController_introspect"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/introspect/api-key": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Resolve a Platform API Key (PAK) to its workspace + IAM-style policy. Downstream services use this with a 60s LRU cache and evaluate the policy via @repo/authz-nestjs evaluatePolicy(). */
+        post: operations["IntrospectController_introspectApiKey"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/introspect/workspaces/{workspaceId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Introspect caller's membership + effective policy + enabled services in a workspace */
+        get: operations["IntrospectController_introspectWorkspace"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/session": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List active sessions */
+        get: operations["SessionController_getSessions"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/verification/resend": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Resend verification email */
+        post: operations["VerificationController_resend"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/verification/verify": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Verify an email code */
+        post: operations["VerificationController_verify"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List workspaces the current user belongs to */
+        get: operations["WorkspaceController_listWorkspaces"];
+        put?: never;
+        /** Create a new workspace */
+        post: operations["WorkspaceController_createWorkspace"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/invites/accept": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Accept a workspace invite by code */
+        post: operations["WorkspaceController_acceptInvite"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/{workspaceSlug}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get workspace details */
+        get: operations["WorkspaceController_getWorkspace"];
+        put?: never;
+        post?: never;
+        /** Delete a workspace (requires workspace.delete) */
+        delete: operations["WorkspaceController_deleteWorkspace"];
+        options?: never;
+        head?: never;
+        /** Update workspace display name, slug, or settings. Slug renames broadcast a `workspace.renamed` event so denormalised consumers (rally-api) sync. */
+        patch: operations["WorkspaceController_updateWorkspace"];
+        trace?: never;
+    };
+    "/v1/workspaces/{workspaceSlug}/api-keys": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List PAKs in this workspace. Plaintext tokens are NOT returned — only prefixes + metadata. */
+        get: operations["PlatformApiKeyController_list"];
+        put?: never;
+        /** Mint a new PAK. The plaintext `token` is returned ONCE — store it now. The minter can grant at most their own effective permissions. */
+        post: operations["PlatformApiKeyController_create"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/{workspaceSlug}/api-keys/{id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get: operations["PlatformApiKeyController_get"];
+        put?: never;
+        post?: never;
+        delete: operations["PlatformApiKeyController_revoke"];
+        options?: never;
+        head?: never;
+        patch: operations["PlatformApiKeyController_update"];
+        trace?: never;
+    };
+    "/v1/workspaces/{workspaceSlug}/audit-logs": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List workspace audit log entries */
+        get: operations["WorkspaceAuditController_listAuditLogs"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/{workspaceSlug}/invites": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List workspace invites */
+        get: operations["WorkspaceController_listInvites"];
+        put?: never;
+        /** Create a workspace invite link */
+        post: operations["WorkspaceController_createInvite"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/{workspaceSlug}/invites/{inviteId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /** Revoke a workspace invite */
+        delete: operations["WorkspaceController_revokeInvite"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/{workspaceSlug}/members": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List workspace members */
+        get: operations["WorkspaceController_listMembers"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/{workspaceSlug}/members/{accountId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        /** Remove a member from a workspace (or self-leave) */
+        delete: operations["WorkspaceController_removeMember"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/{workspaceSlug}/members/{accountId}/role": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        /** Update a member's role. Body: { roleId } or { role: "owner"|"admin"|"member" }. */
+        patch: operations["WorkspaceController_updateMemberRole"];
+        trace?: never;
+    };
+    "/v1/workspaces/{workspaceSlug}/roles": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List all roles in a workspace */
+        get: operations["WorkspaceRoleController_list"];
+        put?: never;
+        /** Create a new custom role */
+        post: operations["WorkspaceRoleController_create"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/{workspaceSlug}/roles/permissions/catalog": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List every known workspace permission */
+        get: operations["WorkspaceRoleController_catalog"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/{workspaceSlug}/roles/{roleId}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get a role + its permissions */
+        get: operations["WorkspaceRoleController_get"];
+        put?: never;
+        post?: never;
+        /** Delete a custom role (fails if it has members) */
+        delete: operations["WorkspaceRoleController_delete"];
+        options?: never;
+        head?: never;
+        /** Update a role or replace its permission set */
+        patch: operations["WorkspaceRoleController_update"];
+        trace?: never;
+    };
+    "/v1/workspaces/{workspaceSlug}/services": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List services activated on this workspace */
+        get: operations["WorkspaceServiceController_list"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/{workspaceSlug}/services/{service}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Enable (or re-enable) a service for this workspace */
+        post: operations["WorkspaceServiceController_enable"];
+        /** Disable a service (settings are retained) */
+        delete: operations["WorkspaceServiceController_disable"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/{workspaceSlug}/services/{service}/settings": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        /** Replace the settings jsonb for an active service */
+        patch: operations["WorkspaceServiceController_updateSettings"];
+        trace?: never;
+    };
+}
+interface components {
+    schemas: {
+        AcceptWorkspaceInviteDto: {
+            /**
+             * @description Invite code from the invite email / link.
+             * @example inv_…
+             */
+            code: string;
+        };
+        CreatePakDto: {
+            /** @description Optional description (e.g. which service uses the key). */
+            description?: string;
+            /**
+             * @description Human-readable PAK name (shown in the keys list).
+             * @example Production agora client
+             */
+            name: string;
+            /** @description IAM-style policy. List of statements that gate the key — each scoped to a set of actions + resources. */
+            policy: components["schemas"]["PolicyStatementDto"][];
+        };
+        CreateWorkspaceDto: {
+            /**
+             * @description Display name shown in console and on receipts.
+             * @example Acme Corp
+             */
+            displayName: string;
+            /**
+             * @description URL-friendly slug. Lowercase alphanumerics, separated by hyphens. Used in URLs and as a stable handle.
+             * @example acme-corp
+             */
+            slug: string;
+        };
+        CreateWorkspaceInviteDto: {
+            /**
+             * @description Optional invitee email. When set, the invite is locked to that address.
+             * @example alice@example.com
+             */
+            email?: string;
+            /**
+             * @description Hours until the invite expires. Defaults to 168 (7 days).
+             * @example 168
+             */
+            expiresInHours?: number;
+            /**
+             * @description Maximum number of accepts. Defaults to 1. Use higher values for "team link" invites.
+             * @example 1
+             */
+            maxUses?: number;
+            /**
+             * @description System role shortcut: 'owner' | 'admin' | 'member'.
+             * @enum {string}
+             */
+            role?: "owner" | "admin" | "member";
+            /** @description UUID of the role to grant on accept. Use to target custom roles. */
+            roleId?: string;
+        };
+        CreateWorkspaceRoleDto: {
+            /** @description Optional human-readable role description. */
+            description?: string;
+            /**
+             * @description Role name. Free-form; not URL-significant.
+             * @example BillingAdmin
+             */
+            name: string;
+            /**
+             * @description Permission strings (`<service>.<resource>.<action>`) granted to the role.
+             * @example [
+             *       "envoi.template.read",
+             *       "envoi.message.read"
+             *     ]
+             */
+            permissions?: string[];
+        };
+        EnableWorkspaceServiceDto: {
+            /** @description Optional per-service settings blob captured at enable time. */
+            settings?: Record<string, never>;
+        };
+        FeedbackResponseDto: {
+            /**
+             * @description Human-readable message
+             * @example Email verified successfully
+             */
+            message: string;
+        };
+        LogoutDto: {
+            /**
+             * @description Refresh token (JWT)
+             * @example eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
+             */
+            refresh_token: string;
+        };
+        PolicyStatementDto: {
+            /**
+             * @description Action strings the statement applies to (e.g. `agora.actor.read`). Wildcards: `agora.*`, `*`.
+             * @example [
+             *       "agora.actor.read",
+             *       "agora.object.read"
+             *     ]
+             */
+            actions: string[];
+            /**
+             * @description Whether the statement allows or denies the listed actions on the listed resources.
+             * @example allow
+             * @enum {string}
+             */
+            effect: "allow" | "deny";
+            /**
+             * @description Resource URNs the statement applies to (e.g. `pcft:agora:community/<uuid>`). Wildcards allowed.
+             * @example [
+             *       "pcft:agora:community/cccccccc-cccc-cccc-cccc-cccccccccccc"
+             *     ]
+             */
+            resources: string[];
+        };
+        RefreshDto: {
+            /**
+             * @description Refresh token (JWT)
+             * @example eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
+             */
+            refresh_token: string;
+        };
+        RequestPasswordResetDto: {
+            /**
+             * @description Email address to send reset token
+             * @example user@example.com
+             */
+            email: string;
+        };
+        ResetPasswordDto: {
+            /**
+             * @description New password (min 8 characters)
+             * @example MyNewPassword123
+             */
+            newPassword: string;
+            /**
+             * @description 6-digit reset token sent via email
+             * @example 123456
+             */
+            token: string;
+        };
+        SessionDto: {
+            /**
+             * @description Owning account identifier
+             * @example acc_01HZY2F2B6N7M8Q9W4E6R2
+             */
+            accountId: string;
+            /**
+             * Format: date-time
+             * @description Creation timestamp (ISO 8601)
+             * @example 2025-09-20T12:34:56.000Z
+             */
+            createdAt: string;
+            /**
+             * Format: date-time
+             * @description Expiration timestamp (ISO 8601)
+             * @example 2025-09-21T12:34:56.000Z
+             */
+            expiresAt: string;
+            /**
+             * @description Session identifier
+             * @example sess_01HZY2G3A7M8Q9W4E6R2K1
+             */
+            id: string;
+            /**
+             * @description Client IP address
+             * @example 203.0.113.42
+             */
+            ip: string | null;
+            /**
+             * Format: date-time
+             * @description Last time this session was used (ISO 8601) or null
+             * @example 2025-09-20T18:00:00.000Z
+             */
+            lastUsedAt: string | null;
+            /**
+             * @description HTTP User-Agent string
+             * @example Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
+             */
+            userAgent: string | null;
+        };
+        SignInDto: {
+            /**
+             * @description Email or username
+             * @example user@example.com
+             */
+            identifier: string;
+            /**
+             * @description User password
+             * @example MySecurePassword123
+             */
+            password: string;
+            /**
+             * @description Session duration: "short" (24h), "long" (90d), or integer seconds (3600–7776000). Defaults to 30 days.
+             * @example short
+             */
+            sessionDuration?: Record<string, never>;
+        };
+        SignUpDto: {
+            /**
+             * @description Display name
+             * @example John Doe
+             */
+            displayName?: string;
+            /**
+             * @description User email address
+             * @example user@example.com
+             */
+            email: string;
+            /**
+             * @description User password (min 8 characters)
+             * @example MySecurePassword123
+             */
+            password: string;
+            /**
+             * @description Session duration: "short" (24h), "long" (90d), or integer seconds (3600–7776000). Defaults to 30 days.
+             * @example long
+             */
+            sessionDuration?: Record<string, never>;
+            /**
+             * @description Unique username (letters, numbers, dot, underscore, hyphen)
+             * @example john_doe
+             */
+            username: string;
+        };
+        TokenResponseDto: {
+            /**
+             * @description Access token (JWT)
+             * @example eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
+             */
+            access_token: string;
+            /**
+             * @description Access token TTL in seconds
+             * @example 3600
+             */
+            expires_in: number;
+            /**
+             * @description Refresh token (JWT)
+             * @example eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
+             */
+            refresh_token?: string;
+            /**
+             * @description Token type
+             * @example Bearer
+             */
+            token_type: string;
+        };
+        UpdateMemberRoleDto: {
+            /**
+             * @description System role shortcut: 'owner' | 'admin' | 'member'. Either `roleId` or `role` must be supplied.
+             * @enum {string}
+             */
+            role?: "owner" | "admin" | "member";
+            /**
+             * @description UUID of the role to assign. Use this to target custom roles.
+             * @example 11111111-1111-4111-8111-111111111111
+             */
+            roleId?: string;
+        };
+        UpdatePakDto: {
+            description?: string | null;
+            name?: string;
+            /** @description Replaces the policy entirely if provided. */
+            policy?: components["schemas"]["PolicyStatementDto"][];
+        };
+        UpdateWorkspaceDto: {
+            displayName?: string;
+            /** @description Free-form workspace settings blob. */
+            settings?: Record<string, never>;
+            /**
+             * @description New URL-friendly slug. Same constraints as the create form. Renames are broadcast on the workspace events queue so denormalised consumers (rally-api, future product surfaces) can sync. Old URLs continue to resolve for one rename cycle.
+             * @example acme
+             */
+            slug?: string;
+        };
+        UpdateWorkspaceRoleDto: {
+            description?: string;
+            name?: string;
+            /** @description Replaces the role permission set if provided. Omit to leave permissions unchanged. */
+            permissions?: string[];
+        };
+        VerifyCodeDto: {
+            /**
+             * @description Verification code from the email link.
+             * @example a1b2c3d4…
+             */
+            code: string;
+        };
+    };
+    responses: never;
+    parameters: never;
+    requestBodies: never;
+    headers: never;
+    pathItems: never;
+}
+interface operations {
+    JwksController_jwks: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    AccountController_deleteAccount: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    AuthenticationController_logout: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["LogoutDto"];
+            };
+        };
+        responses: {
+            /** @description Logout successful (no content) */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Validation failed or invalid token */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    AuthenticationController_logoutCurrent: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Logout successful (no content) */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Missing or invalid access token */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    PasswordController_requestPasswordReset: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["RequestPasswordResetDto"];
+            };
+        };
+        responses: {
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    PasswordController_resetPassword: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["ResetPasswordDto"];
+            };
+        };
+        responses: {
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    AuthenticationController_refresh: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["RefreshDto"];
+            };
+        };
+        responses: {
+            /** @description Token response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["TokenResponseDto"];
+                };
+            };
+            /** @description Validation failed or invalid token */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    AuthenticationController_signin: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["SignInDto"];
+            };
+        };
+        responses: {
+            /** @description Token response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["TokenResponseDto"];
+                };
+            };
+            /** @description Validation failed */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    AuthenticationController_signup: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["SignUpDto"];
+            };
+        };
+        responses: {
+            /** @description Token response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["TokenResponseDto"];
+                };
+            };
+            /** @description Validation failed */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    IntrospectController_introspect: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    IntrospectController_introspectApiKey: {
+        parameters: {
+            query?: never;
+            header: {
+                authorization: string;
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    IntrospectController_introspectWorkspace: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    SessionController_getSessions: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Active sessions */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SessionDto"][];
+                };
+            };
+            /** @description Unauthorized */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    VerificationController_resend: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Verification email sent */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["FeedbackResponseDto"];
+                };
+            };
+            /** @description Unauthorized */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    VerificationController_verify: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["VerifyCodeDto"];
+            };
+        };
+        responses: {
+            /** @description Email verified successfully */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["FeedbackResponseDto"];
+                };
+            };
+            /** @description Invalid or expired verification code */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    WorkspaceController_listWorkspaces: {
+        parameters: {
+            query: {
+                limit: string;
+                cursor: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    WorkspaceController_createWorkspace: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateWorkspaceDto"];
+            };
+        };
+        responses: {
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    WorkspaceController_acceptInvite: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["AcceptWorkspaceInviteDto"];
+            };
+        };
+        responses: {
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    WorkspaceController_getWorkspace: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceSlug: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    WorkspaceController_deleteWorkspace: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceSlug: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    WorkspaceController_updateWorkspace: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceSlug: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UpdateWorkspaceDto"];
+            };
+        };
+        responses: {
+            /** @description Workspace updated. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Invalid slug or display name. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Workspace not found. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Slug already taken by another workspace. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    PlatformApiKeyController_list: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceSlug: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    PlatformApiKeyController_create: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceSlug: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreatePakDto"];
+            };
+        };
+        responses: {
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    PlatformApiKeyController_get: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceSlug: string;
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    PlatformApiKeyController_revoke: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceSlug: string;
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    PlatformApiKeyController_update: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceSlug: string;
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UpdatePakDto"];
+            };
+        };
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    WorkspaceAuditController_listAuditLogs: {
+        parameters: {
+            query: {
+                limit: string;
+                cursor: string;
+            };
+            header?: never;
+            path: {
+                workspaceSlug: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    WorkspaceController_listInvites: {
+        parameters: {
+            query: {
+                limit: string;
+                cursor: string;
+            };
+            header?: never;
+            path: {
+                workspaceSlug: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    WorkspaceController_createInvite: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceSlug: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateWorkspaceInviteDto"];
+            };
+        };
+        responses: {
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    WorkspaceController_revokeInvite: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceSlug: string;
+                inviteId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    WorkspaceController_listMembers: {
+        parameters: {
+            query: {
+                limit: string;
+                cursor: string;
+            };
+            header?: never;
+            path: {
+                workspaceSlug: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    WorkspaceController_removeMember: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceSlug: string;
+                accountId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    WorkspaceController_updateMemberRole: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceSlug: string;
+                accountId: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UpdateMemberRoleDto"];
+            };
+        };
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    WorkspaceRoleController_list: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceSlug: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    WorkspaceRoleController_create: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceSlug: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateWorkspaceRoleDto"];
+            };
+        };
+        responses: {
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    WorkspaceRoleController_catalog: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceSlug: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    WorkspaceRoleController_get: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceSlug: string;
+                roleId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    WorkspaceRoleController_delete: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceSlug: string;
+                roleId: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    WorkspaceRoleController_update: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceSlug: string;
+                roleId: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UpdateWorkspaceRoleDto"];
+            };
+        };
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    WorkspaceServiceController_list: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceSlug: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    WorkspaceServiceController_enable: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceSlug: string;
+                service: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["EnableWorkspaceServiceDto"];
+            };
+        };
+        responses: {
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    WorkspaceServiceController_disable: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceSlug: string;
+                service: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    WorkspaceServiceController_updateSettings: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspaceSlug: string;
+                service: string;
+            };
+            cookie?: never;
+        };
+        /** @description Replaces the per-service settings jsonb entirely. The body is the settings object itself (no wrapper). Service-specific shape — e.g. envoi tracks default sender, agora tracks ranking weights. */
+        requestBody: {
+            content: {
+                "application/json": {
+                    [key: string]: unknown;
+                };
+            };
+        };
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+}
+
+/**
+ * PlatformAuth — typed `openapi-fetch` client for every endpoint in
+ * `Specs/platform-auth.json`. Reach for `client.GET("/v1/...")` or
+ * `client.POST(...)`; request / response types come from the
+ * generated `paths` interface.
+ */
+declare class PlatformAuth {
+    /** The underlying typed client. v0 surface — every endpoint reachable. */
+    readonly client: ReturnType<typeof makeClient<paths>>;
+    constructor(config?: PCClientConfig);
+}
+
+export { PlatformAuth, type paths };