@productcraft/platform-auth 0.0.13 → 0.1.0

package/README.md

@@ -22,9 +22,8 @@ The two are easy to confuse because both have "auth" in the name. Platform-Auth
 ```ts
 import { PlatformAuth } from "@productcraft/platform-auth";
 
-const platformAuth = new PlatformAuth({
-  auth: { type: "apiKey", key: process.env.PCFT_KEY! },
-});
+// Reads PRODUCTCRAFT_API_KEY from the environment
+const platformAuth = new PlatformAuth();
 
 // Resolve the caller's effective policy + enabled services for a workspace
 const { data } = await platformAuth.client.GET(
@@ -48,10 +47,24 @@ The `client` is an [`openapi-fetch`](https://openapi-ts.dev/openapi-fetch/) inst
 
 PAKs are workspace-scoped credentials — they read + introspect freely against the workspace they're bound to but cannot mint another PAK or reshape the human-admin surface. Cross-workspace probes by a PAK return the uniform non-member shape (no slug → UUID oracle).
 
+## Credentials from the environment
+
+Server-side, omit `auth` and the client reads your workspace key from the environment:
+
+```bash
+# .env
+PRODUCTCRAFT_API_KEY=pcft_live_...
+```
+
+- An explicit `auth` always wins over the environment.
+- Hosts are never read from the environment. Override them in code with `baseUrl`.
+- This is a server-only fallback. Never put a key in `NEXT_PUBLIC_*` or any other variable a bundler inlines into browser code.
+
 ## Configuration
 
 ```ts
 new PlatformAuth({
+  // Omit to use PRODUCTCRAFT_API_KEY from the environment
   auth: { type: "apiKey", key: "pcft_live_..." }
       | { type: "bearer", token: "eyJ..." }
       | { type: "cookie", value: "auth_token=..." },

package/dist/index.d.cts

@@ -319,6 +319,54 @@ interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/me/hidden-guides": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List the getting-started guides the caller has hidden.
+         * @description Every guide the caller has hidden in the console, newest first. Hiding is presentation only: the setup status behind a guide is unchanged.
+         */
+        get: operations["HiddenGuidesController_list"];
+        put?: never;
+        post?: never;
+        /**
+         * Show every getting-started guide again.
+         * @description Removes every hidden guide for the caller, `all` included. Idempotent.
+         */
+        delete: operations["HiddenGuidesController_showAll"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/me/hidden-guides/{key}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Hide a getting-started guide for the caller.
+         * @description Idempotent: hiding a guide that is already hidden returns it unchanged, with its first `hidden_at`. At most 200 are kept; hiding one more drops the oldest.
+         */
+        put: operations["HiddenGuidesController_hide"];
+        post?: never;
+        /**
+         * Show a hidden getting-started guide again.
+         * @description Idempotent: showing a guide that is not hidden is a no-op.
+         */
+        delete: operations["HiddenGuidesController_show"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/me/profile": {
         parameters: {
             query?: never;
@@ -345,7 +393,7 @@ interface paths {
         };
         /**
          * OAuth 2.1 authorization endpoint
-         * @description Requires PKCE with `code_challenge_method=S256`; `plain` and a missing challenge are both rejected. `redirect_uri` must match a registered URI exactly, with only the RFC 8252 §7.3 loopback port relaxation. Responds 302 either to sign-in (no session) or to the consent screen.
+         * @description Requires PKCE with `code_challenge_method=S256`; a session that has been signed out counts as no session; `plain` and a missing challenge are both rejected. `redirect_uri` must match a registered URI exactly, with only the RFC 8252 §7.3 loopback port relaxation. Responds 302 either to sign-in (no session) or to the consent screen.
          */
         get: operations["OAuthAuthorizeController_authorize"];
         put?: never;
@@ -1159,11 +1207,11 @@ interface paths {
         get: operations["WorkspacePolicyController_get"];
         put?: never;
         post?: never;
-        /** Delete a managed policy. Cascades: API keys lose the binding (deny-all if no other bindings remain); roles fall back to their inline policy column. Cookie/JWT only. */
+        /** Delete a managed policy. Cascades: API keys lose the binding (deny-all if no other bindings remain); roles fall back to their inline policy column. Owners and admins; a policy bound to a role, or a preset policy, only an owner can delete. Cookie/JWT only. */
         delete: operations["WorkspacePolicyController_delete"];
         options?: never;
         head?: never;
-        /** Update a managed policy. Cookie/JWT only — policy authoring is a human-admin surface. */
+        /** Update a managed policy. Owners and admins; a policy bound to a role, or a preset policy, only an owner can edit. Cookie/JWT only — policy authoring is a human-admin surface. */
         patch: operations["WorkspacePolicyController_update"];
         trace?: never;
     };
@@ -1929,6 +1977,22 @@ interface components {
              */
             message: string;
         };
+        HiddenGuideDto: {
+            /**
+             * Format: date-time
+             * @description When the guide was first hidden.
+             */
+            hidden_at: string;
+            /**
+             * @description The guide: a surface name, optionally followed by `:` and the id of the resource the guide belongs to. The console uses `dashboard:<workspace id>`, `auth_app:<app id>`, `waitlist_quickstart:<waitlist id>`, `waitlist_steps:<workspace id>`, `community_quickstart:<community id>`, `trawl_quickstart:<workspace id>`, `mail_quickstart:<workspace id>`, and `all` for "never show getting-started guides".
+             * @example auth_app:3f2c9a4e-8b1d-4c6e-9f2a-1b2c3d4e5f60
+             */
+            key: string;
+        };
+        HiddenGuidesDto: {
+            /** @description Every guide the caller has hidden, newest first. A bounded set (at most 200; hiding one more drops the oldest), so it is returned whole rather than paginated. */
+            guides: components["schemas"]["HiddenGuideDto"][];
+        };
         IntrospectAccountDto: {
             /** @description Public HTTPS URL of the uploaded avatar, or null when no avatar is set. */
             avatar_url: string | null;
@@ -1966,6 +2030,7 @@ interface components {
         };
         IntrospectResponseDto: {
             account?: components["schemas"]["IntrospectAccountDto"] | null;
+            /** @description False for an anonymous caller and for an access token whose session has been signed out. */
             is_authenticated: boolean;
             principal?: components["schemas"]["IntrospectPrincipalDto"] | null;
             workspaces?: components["schemas"]["IntrospectWorkspaceListItemDto"][];
@@ -2112,9 +2177,31 @@ interface components {
              */
             refresh_token: string;
         };
+        ManagedPolicyDeletedResponseDto: {
+            /**
+             * @description Live API keys that were bound to the policy and lost the binding. A key with no binding left falls back to deny-all.
+             * @example 3
+             */
+            bound_key_count: number;
+            /**
+             * @example true
+             * @enum {number}
+             */
+            deleted: true;
+            /**
+             * Format: uuid
+             * @description The deleted policy.
+             */
+            id: string;
+        };
         ManagedPolicyDetailResponseDto: {
             /** @description Counts of currently-bound consumers — surface this in delete-confirm UX so the operator sees cascade impact. */
             binding_count: components["schemas"]["PolicyBindingCountDto"];
+            /**
+             * @description Live (not revoked, not expired) API keys bound to this policy — the keys a save or delete affects. Show it in the confirm step before saving or deleting.
+             * @example 3
+             */
+            bound_key_count: number;
             /** Format: date-time */
             created_at: string;
             /**
@@ -3426,7 +3513,7 @@ interface operations {
                     "application/json": components["schemas"]["IntrospectResponseDto"];
                 };
             };
-            /** @description Rate limited: more than 60 requests/min from this IP (default bucket). Anonymous callers otherwise get 200 with `is_authenticated: false`, never 401. */
+            /** @description Rate limited: more than 60 requests/min from this IP (default bucket). Anonymous callers, and callers whose session has been signed out, otherwise get 200 with `is_authenticated: false`, never 401. */
             429: {
                 headers: {
                     [name: string]: unknown;
@@ -3486,7 +3573,7 @@ interface operations {
                     "application/json": components["schemas"]["IntrospectWorkspaceResponseDto"];
                 };
             };
-            /** @description Missing or invalid session. */
+            /** @description Missing or invalid session. Also a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -3617,6 +3704,177 @@ interface operations {
             };
         };
     };
+    HiddenGuidesController_list: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["HiddenGuidesDto"];
+                };
+            };
+            /** @description No session. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The caller authenticated with a non-human principal (e.g. a workspace API key). Hidden guides are a person's console preference. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    HiddenGuidesController_showAll: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Every guide shows again. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description No session. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The caller authenticated with a non-human principal (e.g. a workspace API key). Hidden guides are a person's console preference. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    HiddenGuidesController_hide: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The guide: a surface name, optionally followed by `:` and a resource id, e.g. `dashboard:<workspace id>` or `all`. */
+                key: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The guide is hidden. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["HiddenGuideDto"];
+                };
+            };
+            /** @description The key is not a valid guide key. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description No session. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The caller authenticated with a non-human principal (e.g. a workspace API key). Hidden guides are a person's console preference. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    HiddenGuidesController_show: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The guide: a surface name, optionally followed by `:` and a resource id, e.g. `dashboard:<workspace id>` or `all`. */
+                key: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The guide shows again (or was not hidden). */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description The key is not a valid guide key. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description No session. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The caller authenticated with a non-human principal (e.g. a workspace API key). Hidden guides are a person's console preference. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
     MeController_updateProfile: {
         parameters: {
             query?: never;
@@ -3807,7 +4065,7 @@ interface operations {
                     "application/json": components["schemas"]["ConsentRequestDto"];
                 };
             };
-            /** @description Missing, invalid or expired bearer token. */
+            /** @description Missing or invalid session, or a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -3877,7 +4135,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Missing, invalid or expired bearer token. */
+            /** @description Missing or invalid session, or a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -4439,7 +4697,7 @@ interface operations {
                 };
                 content?: never;
             };
-            /** @description Missing, invalid or expired bearer token. */
+            /** @description Missing or invalid session, or a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -4766,7 +5024,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Missing or invalid session. */
+            /** @description Missing or invalid session. Also a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -4950,7 +5208,7 @@ interface operations {
                 };
                 content?: never;
             };
-            /** @description Missing, invalid or expired bearer token. */
+            /** @description Missing or invalid session, or a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -5116,7 +5374,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Missing, malformed or invalid session. */
+            /** @description Missing, malformed or invalid session. Also a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -5225,7 +5483,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Missing, malformed or invalid session. */
+            /** @description Missing, malformed or invalid session. Also a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -5343,7 +5601,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only). */
+            /** @description Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only). Also a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -5405,7 +5663,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only). */
+            /** @description Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only). Also a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -5477,7 +5735,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Missing, invalid or expired bearer token. */
+            /** @description Missing or invalid session, or a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -5539,7 +5797,7 @@ interface operations {
                     "application/json": components["schemas"]["RotatePakResponseDto"];
                 };
             };
-            /** @description Missing, invalid or expired bearer token. */
+            /** @description Missing or invalid session, or a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -5970,7 +6228,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Missing or invalid session. */
+            /** @description Missing or invalid session. Also a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -5979,7 +6237,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Caller is a PAK (`pcft_live_*`), email not verified (`EMAIL_NOT_VERIFIED`), not a member (`NOT_A_MEMBER`), lacks `workspace.member.invite`, or a non-owner tried to invite an owner (`OWNER_ROLE_REQUIRED`). */
+            /** @description Caller is a PAK (`pcft_live_*`), email not verified (`EMAIL_NOT_VERIFIED`), not a member (`NOT_A_MEMBER`), lacks `workspace.member.invite`, a non-owner tried to invite an owner (`OWNER_ROLE_REQUIRED`), or the role holds permissions the caller does not (`MEMBER_RANK_EXCEEDED`). */
             403: {
                 headers: {
                     [name: string]: unknown;
@@ -6018,7 +6276,7 @@ interface operations {
                 };
                 content?: never;
             };
-            /** @description Missing or invalid session. */
+            /** @description Missing or invalid session. Also a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -6132,7 +6390,7 @@ interface operations {
                 };
                 content?: never;
             };
-            /** @description Missing or invalid session. */
+            /** @description Missing or invalid session. Also a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -6141,7 +6399,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Caller is not a member of this workspace (`NOT_A_MEMBER`), or lacks `workspace.member.remove` (not required for self-leave). */
+            /** @description Caller is not a member of this workspace (`NOT_A_MEMBER`), lacks `workspace.member.remove` (not required for self-leave), or the target outranks the caller (`MEMBER_RANK_EXCEEDED`: only an owner can remove an owner, and the target role's permissions must all be held by the caller). */
             403: {
                 headers: {
                     [name: string]: unknown;
@@ -6203,7 +6461,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Missing or invalid session. */
+            /** @description Missing or invalid session. Also a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -6212,7 +6470,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Caller is not a member of this workspace (`NOT_A_MEMBER`), lacks `workspace.member.update-role`, or a non-owner tried to assign the owner role or change an owner (`OWNER_ROLE_REQUIRED`). */
+            /** @description Caller is not a member of this workspace (`NOT_A_MEMBER`), lacks `workspace.member.update-role`, a non-owner tried to assign the owner role or change an owner (`OWNER_ROLE_REQUIRED`), or a non-owner tried to change a role to or from one holding permissions the caller lacks (`MEMBER_RANK_EXCEEDED`). Admins may make admins, never owners. */
             403: {
                 headers: {
                     [name: string]: unknown;
@@ -6310,7 +6568,16 @@ interface operations {
                     "application/json": components["schemas"]["ManagedPolicyResponseDto"];
                 };
             };
-            /** @description Missing, invalid or expired bearer token. */
+            /** @description Invalid policy shape, name, or condition block. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Missing or invalid session, or a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -6319,7 +6586,16 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Name already in use. */
+            /** @description Caller is not a member (`NOT_A_MEMBER`), lacks `workspace.policy.create` (owner and admin hold it by default), or the policy grants an action the caller does not hold. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Name already in use, or the workspace already has 100 policies. */
             409: {
                 headers: {
                     [name: string]: unknown;
@@ -6431,14 +6707,16 @@ interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description Policy deleted. */
-            204: {
+            /** @description Policy deleted. `bound_key_count` is the number of live API keys that lost the binding. */
+            200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ManagedPolicyDeletedResponseDto"];
+                };
             };
-            /** @description Missing, invalid or expired bearer token. */
+            /** @description Missing or invalid session, or a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -6447,7 +6725,16 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Policy not found in this workspace. */
+            /** @description Caller lacks `workspace.policy.delete`, or is not an owner and the policy is bound to a role or is a preset policy (`OWNER_ROLE_REQUIRED`). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Policy not found in this workspace (`POLICY_NOT_FOUND`). */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -6474,7 +6761,7 @@ interface operations {
             };
         };
         responses: {
-            /** @description Updated policy. */
+            /** @description Updated policy. `bound_key_count` is the number of live API keys the change applies to. */
             200: {
                 headers: {
                     [name: string]: unknown;
@@ -6492,7 +6779,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Missing, invalid or expired bearer token. */
+            /** @description Missing or invalid session, or a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -6501,7 +6788,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Caller cannot grant one or more requested actions. */
+            /** @description Caller lacks `workspace.policy.update`, cannot grant one or more requested actions, or is not an owner and the policy is bound to a role or is a preset policy (`OWNER_ROLE_REQUIRED`). */
             403: {
                 headers: {
                     [name: string]: unknown;
@@ -6510,7 +6797,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Policy not found in this workspace. */
+            /** @description Policy not found in this workspace (`POLICY_NOT_FOUND`). */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -6519,7 +6806,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Name already in use. */
+            /** @description Name already in use (`POLICY_NAME_TAKEN`). */
             409: {
                 headers: {
                     [name: string]: unknown;
@@ -6607,7 +6894,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only). */
+            /** @description Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only). Also a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -6731,7 +7018,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only). */
+            /** @description Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only). Also a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -6802,7 +7089,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only). */
+            /** @description Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only). Also a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;

package/dist/index.d.ts

@@ -319,6 +319,54 @@ interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/me/hidden-guides": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List the getting-started guides the caller has hidden.
+         * @description Every guide the caller has hidden in the console, newest first. Hiding is presentation only: the setup status behind a guide is unchanged.
+         */
+        get: operations["HiddenGuidesController_list"];
+        put?: never;
+        post?: never;
+        /**
+         * Show every getting-started guide again.
+         * @description Removes every hidden guide for the caller, `all` included. Idempotent.
+         */
+        delete: operations["HiddenGuidesController_showAll"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/me/hidden-guides/{key}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Hide a getting-started guide for the caller.
+         * @description Idempotent: hiding a guide that is already hidden returns it unchanged, with its first `hidden_at`. At most 200 are kept; hiding one more drops the oldest.
+         */
+        put: operations["HiddenGuidesController_hide"];
+        post?: never;
+        /**
+         * Show a hidden getting-started guide again.
+         * @description Idempotent: showing a guide that is not hidden is a no-op.
+         */
+        delete: operations["HiddenGuidesController_show"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/me/profile": {
         parameters: {
             query?: never;
@@ -345,7 +393,7 @@ interface paths {
         };
         /**
          * OAuth 2.1 authorization endpoint
-         * @description Requires PKCE with `code_challenge_method=S256`; `plain` and a missing challenge are both rejected. `redirect_uri` must match a registered URI exactly, with only the RFC 8252 §7.3 loopback port relaxation. Responds 302 either to sign-in (no session) or to the consent screen.
+         * @description Requires PKCE with `code_challenge_method=S256`; a session that has been signed out counts as no session; `plain` and a missing challenge are both rejected. `redirect_uri` must match a registered URI exactly, with only the RFC 8252 §7.3 loopback port relaxation. Responds 302 either to sign-in (no session) or to the consent screen.
          */
         get: operations["OAuthAuthorizeController_authorize"];
         put?: never;
@@ -1159,11 +1207,11 @@ interface paths {
         get: operations["WorkspacePolicyController_get"];
         put?: never;
         post?: never;
-        /** Delete a managed policy. Cascades: API keys lose the binding (deny-all if no other bindings remain); roles fall back to their inline policy column. Cookie/JWT only. */
+        /** Delete a managed policy. Cascades: API keys lose the binding (deny-all if no other bindings remain); roles fall back to their inline policy column. Owners and admins; a policy bound to a role, or a preset policy, only an owner can delete. Cookie/JWT only. */
         delete: operations["WorkspacePolicyController_delete"];
         options?: never;
         head?: never;
-        /** Update a managed policy. Cookie/JWT only — policy authoring is a human-admin surface. */
+        /** Update a managed policy. Owners and admins; a policy bound to a role, or a preset policy, only an owner can edit. Cookie/JWT only — policy authoring is a human-admin surface. */
         patch: operations["WorkspacePolicyController_update"];
         trace?: never;
     };
@@ -1929,6 +1977,22 @@ interface components {
              */
             message: string;
         };
+        HiddenGuideDto: {
+            /**
+             * Format: date-time
+             * @description When the guide was first hidden.
+             */
+            hidden_at: string;
+            /**
+             * @description The guide: a surface name, optionally followed by `:` and the id of the resource the guide belongs to. The console uses `dashboard:<workspace id>`, `auth_app:<app id>`, `waitlist_quickstart:<waitlist id>`, `waitlist_steps:<workspace id>`, `community_quickstart:<community id>`, `trawl_quickstart:<workspace id>`, `mail_quickstart:<workspace id>`, and `all` for "never show getting-started guides".
+             * @example auth_app:3f2c9a4e-8b1d-4c6e-9f2a-1b2c3d4e5f60
+             */
+            key: string;
+        };
+        HiddenGuidesDto: {
+            /** @description Every guide the caller has hidden, newest first. A bounded set (at most 200; hiding one more drops the oldest), so it is returned whole rather than paginated. */
+            guides: components["schemas"]["HiddenGuideDto"][];
+        };
         IntrospectAccountDto: {
             /** @description Public HTTPS URL of the uploaded avatar, or null when no avatar is set. */
             avatar_url: string | null;
@@ -1966,6 +2030,7 @@ interface components {
         };
         IntrospectResponseDto: {
             account?: components["schemas"]["IntrospectAccountDto"] | null;
+            /** @description False for an anonymous caller and for an access token whose session has been signed out. */
             is_authenticated: boolean;
             principal?: components["schemas"]["IntrospectPrincipalDto"] | null;
             workspaces?: components["schemas"]["IntrospectWorkspaceListItemDto"][];
@@ -2112,9 +2177,31 @@ interface components {
              */
             refresh_token: string;
         };
+        ManagedPolicyDeletedResponseDto: {
+            /**
+             * @description Live API keys that were bound to the policy and lost the binding. A key with no binding left falls back to deny-all.
+             * @example 3
+             */
+            bound_key_count: number;
+            /**
+             * @example true
+             * @enum {number}
+             */
+            deleted: true;
+            /**
+             * Format: uuid
+             * @description The deleted policy.
+             */
+            id: string;
+        };
         ManagedPolicyDetailResponseDto: {
             /** @description Counts of currently-bound consumers — surface this in delete-confirm UX so the operator sees cascade impact. */
             binding_count: components["schemas"]["PolicyBindingCountDto"];
+            /**
+             * @description Live (not revoked, not expired) API keys bound to this policy — the keys a save or delete affects. Show it in the confirm step before saving or deleting.
+             * @example 3
+             */
+            bound_key_count: number;
             /** Format: date-time */
             created_at: string;
             /**
@@ -3426,7 +3513,7 @@ interface operations {
                     "application/json": components["schemas"]["IntrospectResponseDto"];
                 };
             };
-            /** @description Rate limited: more than 60 requests/min from this IP (default bucket). Anonymous callers otherwise get 200 with `is_authenticated: false`, never 401. */
+            /** @description Rate limited: more than 60 requests/min from this IP (default bucket). Anonymous callers, and callers whose session has been signed out, otherwise get 200 with `is_authenticated: false`, never 401. */
             429: {
                 headers: {
                     [name: string]: unknown;
@@ -3486,7 +3573,7 @@ interface operations {
                     "application/json": components["schemas"]["IntrospectWorkspaceResponseDto"];
                 };
             };
-            /** @description Missing or invalid session. */
+            /** @description Missing or invalid session. Also a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -3617,6 +3704,177 @@ interface operations {
             };
         };
     };
+    HiddenGuidesController_list: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["HiddenGuidesDto"];
+                };
+            };
+            /** @description No session. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The caller authenticated with a non-human principal (e.g. a workspace API key). Hidden guides are a person's console preference. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    HiddenGuidesController_showAll: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Every guide shows again. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description No session. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The caller authenticated with a non-human principal (e.g. a workspace API key). Hidden guides are a person's console preference. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    HiddenGuidesController_hide: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The guide: a surface name, optionally followed by `:` and a resource id, e.g. `dashboard:<workspace id>` or `all`. */
+                key: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The guide is hidden. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["HiddenGuideDto"];
+                };
+            };
+            /** @description The key is not a valid guide key. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description No session. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The caller authenticated with a non-human principal (e.g. a workspace API key). Hidden guides are a person's console preference. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
+    HiddenGuidesController_show: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The guide: a surface name, optionally followed by `:` and a resource id, e.g. `dashboard:<workspace id>` or `all`. */
+                key: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The guide shows again (or was not hidden). */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description The key is not a valid guide key. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description No session. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description The caller authenticated with a non-human principal (e.g. a workspace API key). Hidden guides are a person's console preference. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+        };
+    };
     MeController_updateProfile: {
         parameters: {
             query?: never;
@@ -3807,7 +4065,7 @@ interface operations {
                     "application/json": components["schemas"]["ConsentRequestDto"];
                 };
             };
-            /** @description Missing, invalid or expired bearer token. */
+            /** @description Missing or invalid session, or a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -3877,7 +4135,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Missing, invalid or expired bearer token. */
+            /** @description Missing or invalid session, or a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -4439,7 +4697,7 @@ interface operations {
                 };
                 content?: never;
             };
-            /** @description Missing, invalid or expired bearer token. */
+            /** @description Missing or invalid session, or a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -4766,7 +5024,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Missing or invalid session. */
+            /** @description Missing or invalid session. Also a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -4950,7 +5208,7 @@ interface operations {
                 };
                 content?: never;
             };
-            /** @description Missing, invalid or expired bearer token. */
+            /** @description Missing or invalid session, or a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -5116,7 +5374,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Missing, malformed or invalid session. */
+            /** @description Missing, malformed or invalid session. Also a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -5225,7 +5483,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Missing, malformed or invalid session. */
+            /** @description Missing, malformed or invalid session. Also a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -5343,7 +5601,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only). */
+            /** @description Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only). Also a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -5405,7 +5663,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only). */
+            /** @description Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only). Also a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -5477,7 +5735,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Missing, invalid or expired bearer token. */
+            /** @description Missing or invalid session, or a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -5539,7 +5797,7 @@ interface operations {
                     "application/json": components["schemas"]["RotatePakResponseDto"];
                 };
             };
-            /** @description Missing, invalid or expired bearer token. */
+            /** @description Missing or invalid session, or a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -5970,7 +6228,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Missing or invalid session. */
+            /** @description Missing or invalid session. Also a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -5979,7 +6237,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Caller is a PAK (`pcft_live_*`), email not verified (`EMAIL_NOT_VERIFIED`), not a member (`NOT_A_MEMBER`), lacks `workspace.member.invite`, or a non-owner tried to invite an owner (`OWNER_ROLE_REQUIRED`). */
+            /** @description Caller is a PAK (`pcft_live_*`), email not verified (`EMAIL_NOT_VERIFIED`), not a member (`NOT_A_MEMBER`), lacks `workspace.member.invite`, a non-owner tried to invite an owner (`OWNER_ROLE_REQUIRED`), or the role holds permissions the caller does not (`MEMBER_RANK_EXCEEDED`). */
             403: {
                 headers: {
                     [name: string]: unknown;
@@ -6018,7 +6276,7 @@ interface operations {
                 };
                 content?: never;
             };
-            /** @description Missing or invalid session. */
+            /** @description Missing or invalid session. Also a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -6132,7 +6390,7 @@ interface operations {
                 };
                 content?: never;
             };
-            /** @description Missing or invalid session. */
+            /** @description Missing or invalid session. Also a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -6141,7 +6399,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Caller is not a member of this workspace (`NOT_A_MEMBER`), or lacks `workspace.member.remove` (not required for self-leave). */
+            /** @description Caller is not a member of this workspace (`NOT_A_MEMBER`), lacks `workspace.member.remove` (not required for self-leave), or the target outranks the caller (`MEMBER_RANK_EXCEEDED`: only an owner can remove an owner, and the target role's permissions must all be held by the caller). */
             403: {
                 headers: {
                     [name: string]: unknown;
@@ -6203,7 +6461,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Missing or invalid session. */
+            /** @description Missing or invalid session. Also a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -6212,7 +6470,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Caller is not a member of this workspace (`NOT_A_MEMBER`), lacks `workspace.member.update-role`, or a non-owner tried to assign the owner role or change an owner (`OWNER_ROLE_REQUIRED`). */
+            /** @description Caller is not a member of this workspace (`NOT_A_MEMBER`), lacks `workspace.member.update-role`, a non-owner tried to assign the owner role or change an owner (`OWNER_ROLE_REQUIRED`), or a non-owner tried to change a role to or from one holding permissions the caller lacks (`MEMBER_RANK_EXCEEDED`). Admins may make admins, never owners. */
             403: {
                 headers: {
                     [name: string]: unknown;
@@ -6310,7 +6568,16 @@ interface operations {
                     "application/json": components["schemas"]["ManagedPolicyResponseDto"];
                 };
             };
-            /** @description Missing, invalid or expired bearer token. */
+            /** @description Invalid policy shape, name, or condition block. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Missing or invalid session, or a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -6319,7 +6586,16 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Name already in use. */
+            /** @description Caller is not a member (`NOT_A_MEMBER`), lacks `workspace.policy.create` (owner and admin hold it by default), or the policy grants an action the caller does not hold. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Name already in use, or the workspace already has 100 policies. */
             409: {
                 headers: {
                     [name: string]: unknown;
@@ -6431,14 +6707,16 @@ interface operations {
         };
         requestBody?: never;
         responses: {
-            /** @description Policy deleted. */
-            204: {
+            /** @description Policy deleted. `bound_key_count` is the number of live API keys that lost the binding. */
+            200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ManagedPolicyDeletedResponseDto"];
+                };
             };
-            /** @description Missing, invalid or expired bearer token. */
+            /** @description Missing or invalid session, or a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -6447,7 +6725,16 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Policy not found in this workspace. */
+            /** @description Caller lacks `workspace.policy.delete`, or is not an owner and the policy is bound to a role or is a preset policy (`OWNER_ROLE_REQUIRED`). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponseDto"];
+                };
+            };
+            /** @description Policy not found in this workspace (`POLICY_NOT_FOUND`). */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -6474,7 +6761,7 @@ interface operations {
             };
         };
         responses: {
-            /** @description Updated policy. */
+            /** @description Updated policy. `bound_key_count` is the number of live API keys the change applies to. */
             200: {
                 headers: {
                     [name: string]: unknown;
@@ -6492,7 +6779,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Missing, invalid or expired bearer token. */
+            /** @description Missing or invalid session, or a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -6501,7 +6788,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Caller cannot grant one or more requested actions. */
+            /** @description Caller lacks `workspace.policy.update`, cannot grant one or more requested actions, or is not an owner and the policy is bound to a role or is a preset policy (`OWNER_ROLE_REQUIRED`). */
             403: {
                 headers: {
                     [name: string]: unknown;
@@ -6510,7 +6797,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Policy not found in this workspace. */
+            /** @description Policy not found in this workspace (`POLICY_NOT_FOUND`). */
             404: {
                 headers: {
                     [name: string]: unknown;
@@ -6519,7 +6806,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Name already in use. */
+            /** @description Name already in use (`POLICY_NAME_TAKEN`). */
             409: {
                 headers: {
                     [name: string]: unknown;
@@ -6607,7 +6894,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only). */
+            /** @description Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only). Also a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -6731,7 +7018,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only). */
+            /** @description Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only). Also a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;
@@ -6802,7 +7089,7 @@ interface operations {
                     "application/json": components["schemas"]["ErrorResponseDto"];
                 };
             };
-            /** @description Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only). */
+            /** @description Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only). Also a session that has been signed out (`SESSION_REVOKED`). */
             401: {
                 headers: {
                     [name: string]: unknown;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@productcraft/platform-auth",
-  "version": "0.0.13",
+  "version": "0.1.0",
   "description": "PlatformUser auth, workspaces, members, invites, roles + IAM policies, API keys, service activation, and the introspect endpoint every ProductCraft backend uses to resolve permissions. Generated from the production OpenAPI spec.",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -43,7 +43,7 @@
   },
   "dependencies": {
     "openapi-fetch": "^0.13.0",
-    "@productcraft/core": "^0.2.1"
+    "@productcraft/core": "^0.3.0"
   },
   "scripts": {
     "build": "tsup"