@productcraft/platform-auth 0.0.2 → 0.0.4

package/dist/index.d.cts

@@ -13,6 +13,7 @@ interface paths {
             path?: never;
             cookie?: never;
         };
+        /** Public JWKS for verifying platform-issued JWTs (issuer `https://api.auth.productcraft.co`). */
         get: operations["JwksController_jwks"];
         put?: never;
         post?: never;
@@ -32,6 +33,7 @@ interface paths {
         get?: never;
         put?: never;
         post?: never;
+        /** Delete the calling account. Auto-promotes the oldest admin (or oldest non-self member) to owner in any workspace where the departing account is the sole owner. */
         delete: operations["AccountController_deleteAccount"];
         options?: never;
         head?: never;
@@ -81,6 +83,7 @@ interface paths {
         };
         get?: never;
         put?: never;
+        /** Request a password reset email. The response shape never reveals whether the email matched an account. */
         post: operations["PasswordController_requestPasswordReset"];
         delete?: never;
         options?: never;
@@ -97,6 +100,7 @@ interface paths {
         };
         get?: never;
         put?: never;
+        /** Reset password using the email-delivered reset token. */
         post: operations["PasswordController_resetPassword"];
         delete?: never;
         options?: never;
@@ -189,7 +193,7 @@ interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/introspect/workspaces/{workspaceId}": {
+    "/v1/introspect/workspaces/{workspace_id}": {
         parameters: {
             query?: never;
             header?: never;
@@ -292,7 +296,7 @@ interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/workspaces/{workspaceSlug}": {
+    "/v1/workspaces/{workspace_slug}": {
         parameters: {
             query?: never;
             header?: never;
@@ -311,7 +315,7 @@ interface paths {
         patch: operations["WorkspaceController_updateWorkspace"];
         trace?: never;
     };
-    "/v1/workspaces/{workspaceSlug}/api-keys": {
+    "/v1/workspaces/{workspace_slug}/api-keys": {
         parameters: {
             query?: never;
             header?: never;
@@ -329,23 +333,63 @@ interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/workspaces/{workspaceSlug}/api-keys/{id}": {
+    "/v1/workspaces/{workspace_slug}/api-keys/{id}": {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
+        /** Get a single PAK by id. */
         get: operations["PlatformApiKeyController_get"];
         put?: never;
         post?: never;
+        /** Revoke a PAK. Default behaviour: introspect returns null on the next upstream call; downstream services fail-closed within the 60s cache TTL window. Pass `?force=true` to additionally publish a Redis fan-out that evicts the matching cache entry across every PAK-consuming service immediately — use it when rotating a leaked PAK and the 60s window matters. */
         delete: operations["PlatformApiKeyController_revoke"];
         options?: never;
         head?: never;
+        /** Update a PAK’s name or description (does not touch bindings). */
         patch: operations["PlatformApiKeyController_update"];
         trace?: never;
     };
-    "/v1/workspaces/{workspaceSlug}/audit-logs": {
+    "/v1/workspaces/{workspace_slug}/api-keys/{id}/bindings": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        /** Replace the managed-policy bindings on a PAK. Re-runs caller-narrowing on the merged union of statements. */
+        patch: operations["PlatformApiKeyController_setBindings"];
+        trace?: never;
+    };
+    "/v1/workspaces/{workspace_slug}/audit-feed": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Unified workspace audit feed (cursor-paginated)
+         * @description Merged audit timeline across the workspace surfaces. v1 covers `workspace_audit` (this service); per-app Heimdall and per-community Agora rows arrive in a follow-up. Response shape is stable from v1 — clients can build against it today.
+         */
+        get: operations["WorkspaceAuditFeedController_listFeed"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/{workspace_slug}/audit-logs": {
         parameters: {
             query?: never;
             header?: never;
@@ -362,7 +406,7 @@ interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/workspaces/{workspaceSlug}/invites": {
+    "/v1/workspaces/{workspace_slug}/invites": {
         parameters: {
             query?: never;
             header?: never;
@@ -380,7 +424,7 @@ interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/workspaces/{workspaceSlug}/invites/{inviteId}": {
+    "/v1/workspaces/{workspace_slug}/invites/{invite_id}": {
         parameters: {
             query?: never;
             header?: never;
@@ -397,7 +441,7 @@ interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/workspaces/{workspaceSlug}/members": {
+    "/v1/workspaces/{workspace_slug}/members": {
         parameters: {
             query?: never;
             header?: never;
@@ -414,7 +458,7 @@ interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/workspaces/{workspaceSlug}/members/{accountId}": {
+    "/v1/workspaces/{workspace_slug}/members/{account_id}": {
         parameters: {
             query?: never;
             header?: never;
@@ -431,7 +475,7 @@ interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/workspaces/{workspaceSlug}/members/{accountId}/role": {
+    "/v1/workspaces/{workspace_slug}/members/{account_id}/role": {
         parameters: {
             query?: never;
             header?: never;
@@ -448,33 +492,33 @@ interface paths {
         patch: operations["WorkspaceController_updateMemberRole"];
         trace?: never;
     };
-    "/v1/workspaces/{workspaceSlug}/roles": {
+    "/v1/workspaces/{workspace_slug}/policies": {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        /** List all roles in a workspace */
-        get: operations["WorkspaceRoleController_list"];
+        /** List every managed policy in a workspace */
+        get: operations["WorkspacePolicyController_list"];
         put?: never;
-        /** Create a new custom role */
-        post: operations["WorkspaceRoleController_create"];
+        /** Create a managed policy */
+        post: operations["WorkspacePolicyController_create"];
         delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
-    "/v1/workspaces/{workspaceSlug}/roles/permissions/catalog": {
+    "/v1/workspaces/{workspace_slug}/policies/actions/catalog": {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        /** List every known workspace permission */
-        get: operations["WorkspaceRoleController_catalog"];
+        /** List every known workspace action (catalog of statement actions). */
+        get: operations["WorkspacePolicyController_catalog"];
         put?: never;
         post?: never;
         delete?: never;
@@ -483,7 +527,44 @@ interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/workspaces/{workspaceSlug}/roles/{roleId}": {
+    "/v1/workspaces/{workspace_slug}/policies/{policy_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get a managed policy by id */
+        get: operations["WorkspacePolicyController_get"];
+        put?: never;
+        post?: never;
+        /** Delete a managed policy. Cascades: API keys lose the binding (deny-all if no other bindings remain); roles fall back to their inline policy column. */
+        delete: operations["WorkspacePolicyController_delete"];
+        options?: never;
+        head?: never;
+        /** Update a managed policy */
+        patch: operations["WorkspacePolicyController_update"];
+        trace?: never;
+    };
+    "/v1/workspaces/{workspace_slug}/roles": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** List all roles in a workspace */
+        get: operations["WorkspaceRoleController_list"];
+        put?: never;
+        /** Create a new custom role */
+        post: operations["WorkspaceRoleController_create"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/{workspace_slug}/roles/{role_id}": {
         parameters: {
             query?: never;
             header?: never;
@@ -502,7 +583,7 @@ interface paths {
         patch: operations["WorkspaceRoleController_update"];
         trace?: never;
     };
-    "/v1/workspaces/{workspaceSlug}/services": {
+    "/v1/workspaces/{workspace_slug}/services": {
         parameters: {
             query?: never;
             header?: never;
@@ -519,7 +600,7 @@ interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/workspaces/{workspaceSlug}/services/{service}": {
+    "/v1/workspaces/{workspace_slug}/services/{service}": {
         parameters: {
             query?: never;
             header?: never;
@@ -537,7 +618,7 @@ interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/workspaces/{workspaceSlug}/services/{service}/settings": {
+    "/v1/workspaces/{workspace_slug}/services/{service}/settings": {
         parameters: {
             query?: never;
             header?: never;
@@ -564,6 +645,19 @@ interface components {
              */
             code: string;
         };
+        AuditFeedResponseDto: {
+            data: components["schemas"]["FeedItemDto"][];
+            pagination: components["schemas"]["PaginationDto"];
+            /** @description Per-source diagnostics so the UI / customer can see which sources contributed to this page and which are stubbed pending the cross-service fanout. */
+            sources: components["schemas"]["SourceDiagnosticDto"][];
+        };
+        BoundPolicySummaryDto: {
+            description: string | null;
+            /** Format: uuid */
+            id: string;
+            /** @example envoi-readonly */
+            name: string;
+        };
         CreatePakDto: {
             /** @description Optional description (e.g. which service uses the key). */
             description?: string;
@@ -572,15 +666,20 @@ interface components {
              * @example Production agora client
              */
             name: string;
-            /** @description IAM-style policy. List of statements that gate the key — each scoped to a set of actions + resources. */
-            policy: components["schemas"]["PolicyStatementDto"][];
+            /**
+             * @description IDs of managed policies (workspace_policy rows) to bind to this PAK. Bind one or more — the PAK's effective policy is the union of all bound statements.
+             * @example [
+             *       "11111111-1111-1111-1111-111111111111"
+             *     ]
+             */
+            policy_ids: string[];
         };
         CreateWorkspaceDto: {
             /**
              * @description Display name shown in console and on receipts.
              * @example Acme Corp
              */
-            displayName: string;
+            display_name: string;
             /**
              * @description URL-friendly slug. Lowercase alphanumerics, separated by hyphens. Used in URLs and as a stable handle.
              * @example acme-corp
@@ -597,19 +696,47 @@ interface components {
              * @description Hours until the invite expires. Defaults to 168 (7 days).
              * @example 168
              */
-            expiresInHours?: number;
+            expires_in_hours?: number;
             /**
              * @description Maximum number of accepts. Defaults to 1. Use higher values for "team link" invites.
              * @example 1
              */
-            maxUses?: number;
+            max_uses?: number;
             /**
              * @description System role shortcut: 'owner' | 'admin' | 'member'.
              * @enum {string}
              */
             role?: "owner" | "admin" | "member";
             /** @description UUID of the role to grant on accept. Use to target custom roles. */
-            roleId?: string;
+            role_id?: string;
+        };
+        CreateWorkspacePolicyDto: {
+            /**
+             * @description Optional human description. Pass `null` to clear an existing description on PATCH.
+             * @example Read-only access to all Envoi resources
+             */
+            description?: string | null;
+            /**
+             * @description Policy name (1-64 chars, alphanumeric + space/underscore/hyphen). Unique per workspace.
+             * @example envoi-readonly
+             */
+            name: string;
+            /**
+             * @description IAM-style policy. Empty array means "no permissions" — useful as a placeholder before granting any actions.
+             * @example [
+             *       {
+             *         "actions": [
+             *           "envoi.read",
+             *           "envoi.list"
+             *         ],
+             *         "effect": "allow",
+             *         "resources": [
+             *           "*"
+             *         ]
+             *       }
+             *     ]
+             */
+            policy: components["schemas"]["PolicyStatementDto"][];
         };
         CreateWorkspaceRoleDto: {
             /** @description Optional human-readable role description. */
@@ -620,18 +747,60 @@ interface components {
              */
             name: string;
             /**
-             * @description Permission strings (`<service>.<resource>.<action>`) granted to the role.
+             * @description IAM-style policy granting the role its permissions. Same wire shape as PAK policies. Omit or pass `[]` for a no-permissions role.
              * @example [
-             *       "envoi.template.read",
-             *       "envoi.message.read"
+             *       {
+             *         "actions": [
+             *           "envoi.*.read"
+             *         ],
+             *         "effect": "allow",
+             *         "resources": [
+             *           "*"
+             *         ]
+             *       }
              *     ]
              */
-            permissions?: string[];
+            policy?: components["schemas"]["PolicyStatementDto"][];
+            /**
+             * @description Optional managed-policy id to bind the role to. When set, the role's effective policy comes from the bound managed policy and `policy` (inline) must be omitted.
+             * @example 11111111-1111-1111-1111-111111111111
+             */
+            policy_id?: string | null;
         };
         EnableWorkspaceServiceDto: {
             /** @description Optional per-service settings blob captured at enable time. */
             settings?: Record<string, never>;
         };
+        FeedItemDto: {
+            /** @example workspace.member.removed */
+            action: string;
+            /** Format: uuid */
+            actor_id: string | null;
+            /**
+             * @description Actor classification — one of 'platform_user' | 'end_user' | 'm2m' | 'system' | 'pat' | 'api_key'.
+             * @example platform_user
+             */
+            actor_type: string;
+            /** @description Free-form metadata (jsonb). */
+            metadata: Record<string, never>;
+            /** @example workspace_membership */
+            resource: string;
+            /** Format: uuid */
+            resource_id: string | null;
+            /**
+             * @description Which audit table this row came from.
+             * @example workspace_audit
+             * @enum {string}
+             */
+            source: "workspace_audit" | "heimdall_audit" | "agora_moderation";
+            /**
+             * @description Stable per-source identifier. Used by the cursor to resume from the same point on the next page.
+             * @example 4e5f5c9e-b4ee-4401-9275-283feb66c178
+             */
+            source_ref: string;
+            /** Format: date-time */
+            timestamp: string;
+        };
         FeedbackResponseDto: {
             /**
              * @description Human-readable message
@@ -639,6 +808,139 @@ interface components {
              */
             message: string;
         };
+        IntrospectAccountDto: {
+            display_name: string | null;
+            email: string | null;
+            /**
+             * Format: date-time
+             * @description Timestamp when this account verified its primary email, or null if unverified.
+             */
+            email_verified_at: string | null;
+            /** Format: uuid */
+            id: string;
+            /** @description Account status (e.g. `active`, `suspended`). */
+            status: string;
+            username: string;
+        };
+        IntrospectApiKeyResponseDto: {
+            /** Format: uuid */
+            api_key_id: string;
+            /** Format: uuid */
+            created_by: string | null;
+            is_valid: boolean;
+            /** @description Merged effective policy across every managed policy bound to this PAK. */
+            policy: components["schemas"]["PolicyStatementDto"][];
+            /** Format: uuid */
+            workspace_id: string;
+        };
+        IntrospectPrincipalDto: {
+            email: string | null;
+            /** Format: uuid */
+            id: string;
+            name: string | null;
+            /** Format: uuid */
+            sub: string;
+        };
+        IntrospectResponseDto: {
+            account?: components["schemas"]["IntrospectAccountDto"] | null;
+            is_authenticated: boolean;
+            principal?: components["schemas"]["IntrospectPrincipalDto"] | null;
+            workspaces?: components["schemas"]["IntrospectWorkspaceListItemDto"][];
+        };
+        IntrospectRoleDto: {
+            /** Format: uuid */
+            id: string;
+            name: string;
+        };
+        IntrospectWorkspaceListItemDto: {
+            display_name: string;
+            /** Format: uuid */
+            id: string;
+            /**
+             * @description Caller’s role name in this workspace.
+             * @example owner
+             */
+            role: string;
+            /**
+             * @description Enabled services on this workspace.
+             * @example [
+             *       "envoi",
+             *       "rally"
+             *     ]
+             */
+            services: string[];
+            slug: string;
+        };
+        IntrospectWorkspaceResponseDto: {
+            /**
+             * Format: uuid
+             * @description Canonical workspace UUID. Only present for members — non-members get a uniform low-information response.
+             */
+            id?: string;
+            is_member: boolean;
+            /** @description Effective IAM-style policy for this caller in this workspace. */
+            policy: components["schemas"]["PolicyStatementDto"][];
+            role: components["schemas"]["IntrospectRoleDto"] | null;
+            /**
+             * @description Enabled services on this workspace.
+             * @example [
+             *       "envoi",
+             *       "rally"
+             *     ]
+             */
+            services: string[];
+        };
+        JwkDto: {
+            /**
+             * @description Signing algorithm (e.g. `RS256`).
+             * @example RS256
+             */
+            alg: string;
+            /**
+             * @description Key ID for matching the kid header on a JWT.
+             * @example k_2026_05_01
+             */
+            kid: string;
+            /**
+             * @description Key type (e.g. `RSA`).
+             * @example RSA
+             */
+            kty: string;
+            /**
+             * @description Key usage. Always `sig` for this endpoint.
+             * @example sig
+             */
+            use: string;
+        };
+        JwksResponseDto: {
+            /** @description Array of public JWKs. Token verifiers iterate these by `kid` to find the matching signer. */
+            keys: components["schemas"]["JwkDto"][];
+        };
+        ListManagedPoliciesResponseDto: {
+            data: components["schemas"]["ManagedPolicyResponseDto"][];
+        };
+        ListWorkspaceAuditLogsResponseDto: {
+            data: components["schemas"]["WorkspaceAuditLogEntryDto"][];
+            pagination: components["schemas"]["PaginationDto"];
+        };
+        ListWorkspaceInvitesResponseDto: {
+            data: components["schemas"]["WorkspaceInviteListItemDto"][];
+            pagination: components["schemas"]["PaginationDto"];
+        };
+        ListWorkspaceMembersResponseDto: {
+            data: components["schemas"]["WorkspaceMemberResponseDto"][];
+            pagination: components["schemas"]["PaginationDto"];
+        };
+        ListWorkspaceRolesResponseDto: {
+            data: components["schemas"]["WorkspaceRoleResponseDto"][];
+        };
+        ListWorkspaceServicesResponseDto: {
+            data: components["schemas"]["WorkspaceServiceStateDto"][];
+        };
+        ListWorkspacesResponseDto: {
+            data: components["schemas"]["WorkspaceListItemDto"][];
+            pagination: components["schemas"]["PaginationDto"];
+        };
         LogoutDto: {
             /**
              * @description Refresh token (JWT)
@@ -646,12 +948,74 @@ interface components {
              */
             refresh_token: string;
         };
+        ManagedPolicyDetailResponseDto: {
+            /** @description Counts of currently-bound consumers — surface this in delete-confirm UX so the operator sees cascade impact. */
+            binding_count: components["schemas"]["PolicyBindingCountDto"];
+            /** Format: date-time */
+            created_at: string;
+            /**
+             * Format: uuid
+             * @description Account that authored the row. Only revealed to callers with `workspace.audit.read`; plain members see null.
+             */
+            created_by: string | null;
+            description: string | null;
+            /** Format: uuid */
+            id: string;
+            /** @example envoi-readonly */
+            name: string;
+            /** @description IAM-style policy statements bound to this managed policy. */
+            policy: components["schemas"]["PolicyStatementDto"][];
+            /** Format: date-time */
+            updated_at: string;
+            /** Format: uuid */
+            workspace_id: string;
+        };
+        ManagedPolicyResponseDto: {
+            /** Format: date-time */
+            created_at: string;
+            /**
+             * Format: uuid
+             * @description Account that authored the row. Only revealed to callers with `workspace.audit.read`; plain members see null.
+             */
+            created_by: string | null;
+            description: string | null;
+            /** Format: uuid */
+            id: string;
+            /** @example envoi-readonly */
+            name: string;
+            /** @description IAM-style policy statements bound to this managed policy. */
+            policy: components["schemas"]["PolicyStatementDto"][];
+            /** Format: date-time */
+            updated_at: string;
+            /** Format: uuid */
+            workspace_id: string;
+        };
+        MintPakResponseDto: {
+            record: components["schemas"]["PublicApiKeyDto"];
+            /**
+             * @description The full plaintext PAK token. Returned ONCE — store it now; it cannot be retrieved later.
+             * @example pcft_live_abc123XYZ...
+             */
+            token: string;
+        };
+        PaginationDto: {
+            /** @example false */
+            has_more: boolean;
+            /** @example null */
+            next_cursor: string | null;
+        };
+        PolicyBindingCountDto: {
+            /** @description Number of platform API keys bound to this policy. */
+            pak: number;
+            /** @description Number of workspace roles bound to this policy. */
+            role: number;
+        };
         PolicyStatementDto: {
             /**
-             * @description Action strings the statement applies to (e.g. `agora.actor.read`). Wildcards: `agora.*`, `*`.
+             * @description Action strings the statement applies to. Wildcards (e.g. `agora.*`, `*.read`, `*`) supported per `actionMatches` semantics.
              * @example [
-             *       "agora.actor.read",
-             *       "agora.object.read"
+             *       "agora.read",
+             *       "agora.list"
              *     ]
              */
             actions: string[];
@@ -662,13 +1026,38 @@ interface components {
              */
             effect: "allow" | "deny";
             /**
-             * @description Resource URNs the statement applies to (e.g. `pcft:agora:community/<uuid>`). Wildcards allowed.
+             * @description Resource URNs the statement applies to. Use `["*"]` for workspace-wide. Per-resource scoping (e.g. `pcft:agora:community/<uuid>`) is supported by the PAK lane today; the workspace-role authoring API restricts this to `["*"]` for now (see `tasks/platform-auth-api/001`).
              * @example [
-             *       "pcft:agora:community/cccccccc-cccc-cccc-cccc-cccccccccccc"
+             *       "*"
              *     ]
              */
             resources: string[];
         };
+        PublicApiKeyDto: {
+            /** Format: date-time */
+            created_at: string;
+            /** Format: uuid */
+            created_by: string | null;
+            description: string | null;
+            /** Format: uuid */
+            id: string;
+            /** Format: date-time */
+            last_used_at: string | null;
+            name: string;
+            /** @description Managed policies currently bound to this PAK. */
+            policies: components["schemas"]["BoundPolicySummaryDto"][];
+            /** Format: date-time */
+            revoked_at: string | null;
+            /**
+             * @description The first ~14 chars of the token (prefix). Plaintext token is never returned after mint.
+             * @example pcft_live_abc123
+             */
+            token_prefix: string;
+            /** Format: date-time */
+            updated_at: string;
+            /** Format: uuid */
+            workspace_id: string;
+        };
         RefreshDto: {
             /**
              * @description Refresh token (JWT)
@@ -688,7 +1077,7 @@ interface components {
              * @description New password (min 8 characters)
              * @example MyNewPassword123
              */
-            newPassword: string;
+            new_password: string;
             /**
              * @description 6-digit reset token sent via email
              * @example 123456
@@ -700,19 +1089,19 @@ interface components {
              * @description Owning account identifier
              * @example acc_01HZY2F2B6N7M8Q9W4E6R2
              */
-            accountId: string;
+            account_id: string;
             /**
              * Format: date-time
              * @description Creation timestamp (ISO 8601)
              * @example 2025-09-20T12:34:56.000Z
              */
-            createdAt: string;
+            created_at: string;
             /**
              * Format: date-time
              * @description Expiration timestamp (ISO 8601)
              * @example 2025-09-21T12:34:56.000Z
              */
-            expiresAt: string;
+            expires_at: string;
             /**
              * @description Session identifier
              * @example sess_01HZY2G3A7M8Q9W4E6R2K1
@@ -728,12 +1117,16 @@ interface components {
              * @description Last time this session was used (ISO 8601) or null
              * @example 2025-09-20T18:00:00.000Z
              */
-            lastUsedAt: string | null;
+            last_used_at: string | null;
             /**
              * @description HTTP User-Agent string
              * @example Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
              */
-            userAgent: string | null;
+            user_agent: string | null;
+        };
+        SetBindingsDto: {
+            /** @description Replacement set of managed-policy IDs. Empty array is rejected — revoke the PAK to disable it. */
+            policy_ids: string[];
         };
         SignInDto: {
             /**
@@ -750,14 +1143,14 @@ interface components {
              * @description Session duration: "short" (24h), "long" (90d), or integer seconds (3600–7776000). Defaults to 30 days.
              * @example short
              */
-            sessionDuration?: Record<string, never>;
+            session_duration?: Record<string, never>;
         };
         SignUpDto: {
             /**
              * @description Display name
              * @example John Doe
              */
-            displayName?: string;
+            display_name?: string;
             /**
              * @description User email address
              * @example user@example.com
@@ -772,13 +1165,20 @@ interface components {
              * @description Session duration: "short" (24h), "long" (90d), or integer seconds (3600–7776000). Defaults to 30 days.
              * @example long
              */
-            sessionDuration?: Record<string, never>;
+            session_duration?: Record<string, never>;
             /**
              * @description Unique username (letters, numbers, dot, underscore, hyphen)
              * @example john_doe
              */
             username: string;
         };
+        SourceDiagnosticDto: {
+            count: number;
+            error?: string;
+            included: boolean;
+            /** @enum {string} */
+            source: "workspace_audit" | "heimdall_audit" | "agora_moderation";
+        };
         TokenResponseDto: {
             /**
              * @description Access token (JWT)
@@ -811,16 +1211,28 @@ interface components {
              * @description UUID of the role to assign. Use this to target custom roles.
              * @example 11111111-1111-4111-8111-111111111111
              */
-            roleId?: string;
+            role_id?: string;
+        };
+        UpdateMemberRoleResponseDto: {
+            /** Format: uuid */
+            account_id: string;
+            /** Format: uuid */
+            id: string;
+            /** Format: uuid */
+            invited_by: string | null;
+            /** Format: date-time */
+            joined_at: string;
+            /** Format: uuid */
+            role_id: string;
+            /** Format: uuid */
+            workspace_id: string;
         };
         UpdatePakDto: {
             description?: string | null;
             name?: string;
-            /** @description Replaces the policy entirely if provided. */
-            policy?: components["schemas"]["PolicyStatementDto"][];
         };
         UpdateWorkspaceDto: {
-            displayName?: string;
+            display_name?: string;
             /** @description Free-form workspace settings blob. */
             settings?: Record<string, never>;
             /**
@@ -829,11 +1241,41 @@ interface components {
              */
             slug?: string;
         };
+        UpdateWorkspacePolicyDto: {
+            /**
+             * @description Optional human description. Pass `null` to clear an existing description on PATCH.
+             * @example Read-only access to all Envoi resources
+             */
+            description?: string | null;
+            /**
+             * @description Policy name (1-64 chars, alphanumeric + space/underscore/hyphen). Unique per workspace.
+             * @example envoi-readonly
+             */
+            name?: string;
+            /**
+             * @description IAM-style policy. Empty array means "no permissions" — useful as a placeholder before granting any actions.
+             * @example [
+             *       {
+             *         "actions": [
+             *           "envoi.read",
+             *           "envoi.list"
+             *         ],
+             *         "effect": "allow",
+             *         "resources": [
+             *           "*"
+             *         ]
+             *       }
+             *     ]
+             */
+            policy?: components["schemas"]["PolicyStatementDto"][];
+        };
         UpdateWorkspaceRoleDto: {
             description?: string;
             name?: string;
-            /** @description Replaces the role permission set if provided. Omit to leave permissions unchanged. */
-            permissions?: string[];
+            /** @description Replaces the role policy if provided. Omit to leave policy unchanged. */
+            policy?: components["schemas"]["PolicyStatementDto"][];
+            /** @description Bind / unbind the role to a managed policy. UUID → bind, null → unbind, omit → leave unchanged. */
+            policy_id?: string | null;
         };
         VerifyCodeDto: {
             /**
@@ -842,6 +1284,190 @@ interface components {
              */
             code: string;
         };
+        WorkspaceActionCatalogResponseDto: {
+            /** @description Every known workspace action across all enabled service catalogs. */
+            actions: string[];
+        };
+        WorkspaceAuditLogEntryDto: {
+            /**
+             * @description Action identifier (e.g. `workspace.member.removed`).
+             * @example workspace.member.removed
+             */
+            action: string;
+            /** @description Account UUID of the actor, or null for system actions. */
+            actor_id: string | null;
+            /**
+             * @description Actor classification.
+             * @example platform_user
+             * @enum {string}
+             */
+            actor_type: "platform_user" | "system" | "pat";
+            /** Format: date-time */
+            created_at: string;
+            /** Format: uuid */
+            id: string;
+            /** @description Originating request IP, when available. */
+            ip: string | null;
+            /** @description Free-form metadata attached to the audit row (jsonb). */
+            metadata: Record<string, never>;
+            /**
+             * @description Resource type the action targeted.
+             * @example workspace_membership
+             */
+            resource: string;
+            /** Format: uuid */
+            resource_id: string | null;
+            /** Format: uuid */
+            workspace_id: string;
+        };
+        WorkspaceInviteListItemDto: {
+            /** @description Single-use invite code embedded in the invite URL. */
+            code: string;
+            /** Format: date-time */
+            created_at: string;
+            /** Format: uuid */
+            created_by: string;
+            /** Format: email */
+            email: string | null;
+            /** Format: date-time */
+            expires_at: string | null;
+            /** Format: uuid */
+            id: string;
+            max_uses: number | null;
+            /** Format: date-time */
+            revoked_at: string | null;
+            /** Format: uuid */
+            role_id: string | null;
+            role_name: string | null;
+            use_count: number;
+            /** Format: uuid */
+            workspace_id: string;
+        };
+        WorkspaceInviteResponseDto: {
+            /** @description Single-use invite code embedded in the invite URL. */
+            code: string;
+            /** Format: date-time */
+            created_at: string;
+            /** Format: uuid */
+            created_by: string;
+            /** Format: email */
+            email: string | null;
+            /** Format: date-time */
+            expires_at: string | null;
+            /** Format: uuid */
+            id: string;
+            max_uses: number | null;
+            /** Format: date-time */
+            revoked_at: string | null;
+            /** Format: uuid */
+            role_id: string | null;
+            use_count: number;
+            /** Format: uuid */
+            workspace_id: string;
+        };
+        WorkspaceListItemDto: {
+            /** Format: date-time */
+            created_at: string;
+            /** Format: uuid */
+            created_by: string;
+            /** @example Acme Corp */
+            display_name: string;
+            /** Format: uuid */
+            id: string;
+            /**
+             * @description Caller’s role name in this workspace.
+             * @example owner
+             */
+            member_role: string | null;
+            /**
+             * Format: uuid
+             * @description Caller’s workspace_role.id for this workspace.
+             */
+            member_role_id: string | null;
+            /** @description Free-form workspace settings blob. */
+            settings: Record<string, never>;
+            /** @example acme-corp */
+            slug: string;
+            /**
+             * @description Workspace status (e.g. `active`).
+             * @example active
+             */
+            status: string;
+            /** Format: date-time */
+            updated_at: string;
+        };
+        WorkspaceMemberResponseDto: {
+            /** Format: uuid */
+            account_id: string;
+            display_name: string | null;
+            /** Format: uuid */
+            id: string;
+            /** Format: date-time */
+            joined_at: string;
+            primary_email: string | null;
+            role: string;
+            /** Format: uuid */
+            role_id: string;
+            role_is_system: boolean;
+            username: string;
+        };
+        WorkspaceResponseDto: {
+            /** Format: date-time */
+            created_at: string;
+            /** Format: uuid */
+            created_by: string;
+            /** @example Acme Corp */
+            display_name: string;
+            /** Format: uuid */
+            id: string;
+            /** @description Free-form workspace settings blob. */
+            settings: Record<string, never>;
+            /** @example acme-corp */
+            slug: string;
+            /**
+             * @description Workspace status (e.g. `active`).
+             * @example active
+             */
+            status: string;
+            /** Format: date-time */
+            updated_at: string;
+        };
+        WorkspaceRoleResponseDto: {
+            description: string | null;
+            /** Format: uuid */
+            id: string;
+            /** @description True for built-in system roles (owner/admin/member); false for custom roles. */
+            is_system: boolean;
+            /** @description Role name. System role names are `owner`/`admin`/`member`. */
+            name: string;
+            /** @description Effective IAM-style policy. When `policy_id` is set this is the bound managed policy; otherwise it is the inline policy column. */
+            policy: components["schemas"]["PolicyStatementDto"][];
+            /**
+             * Format: uuid
+             * @description Managed policy ID if the role is bound to one, else null.
+             */
+            policy_id: string | null;
+        };
+        WorkspaceServiceStateDto: {
+            /** Format: date-time */
+            disabled_at: string | null;
+            /** Format: uuid */
+            disabled_by: string | null;
+            enabled: boolean;
+            /** Format: date-time */
+            enabled_at: string | null;
+            /** Format: uuid */
+            enabled_by: string | null;
+            /**
+             * @description Service identifier (e.g. `envoi`, `rally`, `agora`, `heimdall`).
+             * @example envoi
+             */
+            service: string;
+            /** @description Per-service settings blob (service-specific shape). */
+            settings: Record<string, never>;
+            /** Format: uuid */
+            workspace_id: string;
+        };
     };
     responses: never;
     parameters: never;
@@ -863,7 +1489,9 @@ interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["JwksResponseDto"];
+                };
             };
         };
     };
@@ -876,12 +1504,27 @@ interface operations {
         };
         requestBody?: never;
         responses: {
+            /** @description Account deleted. All sessions revoked. */
             204: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content?: never;
             };
+            /** @description The session lacks the required action for self-account deletion (defence-in-depth — the route is guarded but the cookie may be present without action access). */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description No account row exists for the session principal. Should never fire for a valid session — surfaced for SDKs. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
         };
     };
     AuthenticationController_logout: {
@@ -898,7 +1541,7 @@ interface operations {
         };
         responses: {
             /** @description Logout successful (no content) */
-            200: {
+            204: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -923,7 +1566,7 @@ interface operations {
         requestBody?: never;
         responses: {
             /** @description Logout successful (no content) */
-            200: {
+            204: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -951,6 +1594,7 @@ interface operations {
             };
         };
         responses: {
+            /** @description Reset request accepted. If the email matches an account, an email has been queued. */
             201: {
                 headers: {
                     [name: string]: unknown;
@@ -972,6 +1616,7 @@ interface operations {
             };
         };
         responses: {
+            /** @description Password reset; all active sessions revoked. */
             201: {
                 headers: {
                     [name: string]: unknown;
@@ -1086,7 +1731,9 @@ interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["IntrospectResponseDto"];
+                };
             };
         };
     };
@@ -1105,7 +1752,9 @@ interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["IntrospectApiKeyResponseDto"];
+                };
             };
         };
     };
@@ -1114,7 +1763,7 @@ interface operations {
             query?: never;
             header?: never;
             path: {
-                workspaceId: string;
+                workspace_id: string;
             };
             cookie?: never;
         };
@@ -1124,7 +1773,9 @@ interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["IntrospectWorkspaceResponseDto"];
+                };
             };
         };
     };
@@ -1229,7 +1880,9 @@ interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ListWorkspacesResponseDto"];
+                };
             };
         };
     };
@@ -1250,7 +1903,9 @@ interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["WorkspaceResponseDto"];
+                };
             };
         };
     };
@@ -1267,11 +1922,14 @@ interface operations {
             };
         };
         responses: {
+            /** @description The joined workspace. */
             201: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["WorkspaceResponseDto"];
+                };
             };
         };
     };
@@ -1280,7 +1938,7 @@ interface operations {
             query?: never;
             header?: never;
             path: {
-                workspaceSlug: string;
+                workspace_slug: string;
             };
             cookie?: never;
         };
@@ -1290,7 +1948,9 @@ interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["WorkspaceResponseDto"];
+                };
             };
         };
     };
@@ -1299,12 +1959,13 @@ interface operations {
             query?: never;
             header?: never;
             path: {
-                workspaceSlug: string;
+                workspace_slug: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
+            /** @description Workspace deleted. */
             204: {
                 headers: {
                     [name: string]: unknown;
@@ -1318,7 +1979,7 @@ interface operations {
             query?: never;
             header?: never;
             path: {
-                workspaceSlug: string;
+                workspace_slug: string;
             };
             cookie?: never;
         };
@@ -1333,7 +1994,9 @@ interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["WorkspaceResponseDto"];
+                };
             };
             /** @description Invalid slug or display name. */
             400: {
@@ -1363,7 +2026,7 @@ interface operations {
             query?: never;
             header?: never;
             path: {
-                workspaceSlug: string;
+                workspace_slug: string;
             };
             cookie?: never;
         };
@@ -1373,7 +2036,9 @@ interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["PublicApiKeyDto"][];
+                };
             };
         };
     };
@@ -1382,7 +2047,7 @@ interface operations {
             query?: never;
             header?: never;
             path: {
-                workspaceSlug: string;
+                workspace_slug: string;
             };
             cookie?: never;
         };
@@ -1396,7 +2061,9 @@ interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["MintPakResponseDto"];
+                };
             };
         };
     };
@@ -1405,7 +2072,7 @@ interface operations {
             query?: never;
             header?: never;
             path: {
-                workspaceSlug: string;
+                workspace_slug: string;
                 id: string;
             };
             cookie?: never;
@@ -1416,22 +2083,28 @@ interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["PublicApiKeyDto"];
+                };
             };
         };
     };
     PlatformApiKeyController_revoke: {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description When `true`, publish a `pak:revoked` Redis fan-out so subscribed services evict their caches immediately instead of waiting out the 60s TTL. */
+                force?: boolean;
+            };
             header?: never;
             path: {
-                workspaceSlug: string;
+                workspace_slug: string;
                 id: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
+            /** @description PAK revoked. */
             204: {
                 headers: {
                     [name: string]: unknown;
@@ -1445,7 +2118,7 @@ interface operations {
             query?: never;
             header?: never;
             path: {
-                workspaceSlug: string;
+                workspace_slug: string;
                 id: string;
             };
             cookie?: never;
@@ -1457,6 +2130,114 @@ interface operations {
         };
         responses: {
             200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["PublicApiKeyDto"];
+                };
+            };
+        };
+    };
+    PlatformApiKeyController_setBindings: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspace_slug: string;
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["SetBindingsDto"];
+            };
+        };
+        responses: {
+            /** @description Updated PAK with new bindings. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["PublicApiKeyDto"];
+                };
+            };
+            /** @description One of: bound > 25 policies; merged > 200 statements; one of the policy ids does not exist or lives in a different workspace. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Caller cannot grant one or more actions in the merged statement set. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description PAK not found in this workspace. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Empty bindings — revoke the PAK instead of leaving it unbound. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    WorkspaceAuditFeedController_listFeed: {
+        parameters: {
+            query?: {
+                /** @description ISO-8601 lower bound on `timestamp`. Items older than `since` are not returned. */
+                since?: string;
+                /** @description Opaque cursor from a previous response's `pagination.next_cursor`. Resumes the feed at the same merge boundary. */
+                cursor?: string;
+                /** @description Per-page cap. Clamped to 1..500; default 100. */
+                limit?: number;
+                /** @description Comma-separated subset of sources to include (e.g. `workspace_audit,heimdall_audit`). Omitted = all enabled sources. */
+                sources?: string;
+            };
+            header?: never;
+            path: {
+                workspace_slug: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AuditFeedResponseDto"];
+                };
+            };
+            /** @description Invalid query params — `since` not parseable as ISO-8601, or `sources` references an unknown source name. Unrecognized sources are silently dropped; an empty result set after that filter still returns 200. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description The caller is signed in but lacks `workspace.audit.read` for this workspace. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description The `:workspaceSlug` path param does not resolve to a workspace the caller can see. */
+            404: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -1472,7 +2253,7 @@ interface operations {
             };
             header?: never;
             path: {
-                workspaceSlug: string;
+                workspace_slug: string;
             };
             cookie?: never;
         };
@@ -1482,7 +2263,9 @@ interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ListWorkspaceAuditLogsResponseDto"];
+                };
             };
         };
     };
@@ -1494,7 +2277,7 @@ interface operations {
             };
             header?: never;
             path: {
-                workspaceSlug: string;
+                workspace_slug: string;
             };
             cookie?: never;
         };
@@ -1504,7 +2287,9 @@ interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ListWorkspaceInvitesResponseDto"];
+                };
             };
         };
     };
@@ -1513,7 +2298,7 @@ interface operations {
             query?: never;
             header?: never;
             path: {
-                workspaceSlug: string;
+                workspace_slug: string;
             };
             cookie?: never;
         };
@@ -1527,7 +2312,9 @@ interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["WorkspaceInviteResponseDto"];
+                };
             };
         };
     };
@@ -1536,13 +2323,14 @@ interface operations {
             query?: never;
             header?: never;
             path: {
-                workspaceSlug: string;
-                inviteId: string;
+                workspace_slug: string;
+                invite_id: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
+            /** @description Invite revoked. */
             204: {
                 headers: {
                     [name: string]: unknown;
@@ -1559,7 +2347,7 @@ interface operations {
             };
             header?: never;
             path: {
-                workspaceSlug: string;
+                workspace_slug: string;
             };
             cookie?: never;
         };
@@ -1569,7 +2357,9 @@ interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ListWorkspaceMembersResponseDto"];
+                };
             };
         };
     };
@@ -1578,13 +2368,14 @@ interface operations {
             query?: never;
             header?: never;
             path: {
-                workspaceSlug: string;
-                accountId: string;
+                workspace_slug: string;
+                account_id: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
+            /** @description Member removed. */
             204: {
                 headers: {
                     [name: string]: unknown;
@@ -1598,8 +2389,8 @@ interface operations {
             query?: never;
             header?: never;
             path: {
-                workspaceSlug: string;
-                accountId: string;
+                workspace_slug: string;
+                account_id: string;
             };
             cookie?: never;
         };
@@ -1613,16 +2404,18 @@ interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["UpdateMemberRoleResponseDto"];
+                };
             };
         };
     };
-    WorkspaceRoleController_list: {
+    WorkspacePolicyController_list: {
         parameters: {
             query?: never;
             header?: never;
             path: {
-                workspaceSlug: string;
+                workspace_slug: string;
             };
             cookie?: never;
         };
@@ -1632,26 +2425,38 @@ interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ListManagedPoliciesResponseDto"];
+                };
             };
         };
     };
-    WorkspaceRoleController_create: {
+    WorkspacePolicyController_create: {
         parameters: {
             query?: never;
             header?: never;
             path: {
-                workspaceSlug: string;
+                workspace_slug: string;
             };
             cookie?: never;
         };
         requestBody: {
             content: {
-                "application/json": components["schemas"]["CreateWorkspaceRoleDto"];
+                "application/json": components["schemas"]["CreateWorkspacePolicyDto"];
             };
         };
         responses: {
+            /** @description Policy created. */
             201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ManagedPolicyResponseDto"];
+                };
+            };
+            /** @description Name already in use. */
+            409: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -1659,18 +2464,50 @@ interface operations {
             };
         };
     };
-    WorkspaceRoleController_catalog: {
+    WorkspacePolicyController_catalog: {
         parameters: {
             query?: never;
             header?: never;
             path: {
-                workspaceSlug: string;
+                workspace_slug: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
             200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WorkspaceActionCatalogResponseDto"];
+                };
+            };
+        };
+    };
+    WorkspacePolicyController_get: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspace_slug: string;
+                policy_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Policy detail. `binding_count.{pak,role}` reports how many things are currently bound — surface this in delete-confirm UX. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ManagedPolicyDetailResponseDto"];
+                };
+            };
+            /** @description Policy not found in this workspace. */
+            404: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -1678,19 +2515,82 @@ interface operations {
             };
         };
     };
-    WorkspaceRoleController_get: {
+    WorkspacePolicyController_delete: {
         parameters: {
             query?: never;
             header?: never;
             path: {
-                workspaceSlug: string;
-                roleId: string;
+                workspace_slug: string;
+                policy_id: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
+            /** @description Policy deleted. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Policy not found in this workspace. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    WorkspacePolicyController_update: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspace_slug: string;
+                policy_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UpdateWorkspacePolicyDto"];
+            };
+        };
+        responses: {
+            /** @description Updated policy. */
             200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ManagedPolicyDetailResponseDto"];
+                };
+            };
+            /** @description Invalid policy shape, name, or condition block. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Caller cannot grant one or more requested actions. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Policy not found in this workspace. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Name already in use. */
+            409: {
                 headers: {
                     [name: string]: unknown;
                 };
@@ -1698,18 +2598,87 @@ interface operations {
             };
         };
     };
+    WorkspaceRoleController_list: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspace_slug: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ListWorkspaceRolesResponseDto"];
+                };
+            };
+        };
+    };
+    WorkspaceRoleController_create: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspace_slug: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateWorkspaceRoleDto"];
+            };
+        };
+        responses: {
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WorkspaceRoleResponseDto"];
+                };
+            };
+        };
+    };
+    WorkspaceRoleController_get: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                workspace_slug: string;
+                role_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WorkspaceRoleResponseDto"];
+                };
+            };
+        };
+    };
     WorkspaceRoleController_delete: {
         parameters: {
             query?: never;
             header?: never;
             path: {
-                workspaceSlug: string;
-                roleId: string;
+                workspace_slug: string;
+                role_id: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
+            /** @description Custom role deleted. */
             204: {
                 headers: {
                     [name: string]: unknown;
@@ -1723,8 +2692,8 @@ interface operations {
             query?: never;
             header?: never;
             path: {
-                workspaceSlug: string;
-                roleId: string;
+                workspace_slug: string;
+                role_id: string;
             };
             cookie?: never;
         };
@@ -1738,7 +2707,9 @@ interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["WorkspaceRoleResponseDto"];
+                };
             };
         };
     };
@@ -1747,7 +2718,7 @@ interface operations {
             query?: never;
             header?: never;
             path: {
-                workspaceSlug: string;
+                workspace_slug: string;
             };
             cookie?: never;
         };
@@ -1757,7 +2728,9 @@ interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ListWorkspaceServicesResponseDto"];
+                };
             };
         };
     };
@@ -1766,7 +2739,7 @@ interface operations {
             query?: never;
             header?: never;
             path: {
-                workspaceSlug: string;
+                workspace_slug: string;
                 service: string;
             };
             cookie?: never;
@@ -1781,7 +2754,9 @@ interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["WorkspaceServiceStateDto"];
+                };
             };
         };
     };
@@ -1790,13 +2765,14 @@ interface operations {
             query?: never;
             header?: never;
             path: {
-                workspaceSlug: string;
+                workspace_slug: string;
                 service: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
+            /** @description Service disabled. Settings preserved for re-enable. */
             204: {
                 headers: {
                     [name: string]: unknown;
@@ -1810,7 +2786,7 @@ interface operations {
             query?: never;
             header?: never;
             path: {
-                workspaceSlug: string;
+                workspace_slug: string;
                 service: string;
             };
             cookie?: never;
@@ -1828,7 +2804,9 @@ interface operations {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["WorkspaceServiceStateDto"];
+                };
             };
         };
     };