@productcraft/platform-auth 0.1.3 → 1.0.0

package/dist/index.js

@@ -1,14 +1,1750 @@
-import { makeClient, PC_BASE_URL } from '@productcraft/core';
+import { APIClient, PC_BASE_URL, createOpenAPIClient } from '@productcraft/core';
+export { APIConnectionError, APIError, APITimeoutError, APIUserAbortError, AuthenticationError, BadRequestError, ConfigurationError, ConflictError, IdempotencyKeyReuseError, InternalServerError, NotFoundError, PermissionDeniedError, ProductCraftError, RateLimitError, UnprocessableEntityError, WebhookVerificationError } from '@productcraft/core';
 
-// src/index.ts
-var PlatformAuth = class {
-  /** The underlying typed client. v0 surface — every endpoint reachable. */
-  client;
-  constructor(config = {}) {
-    this.client = makeClient(PC_BASE_URL.platformAuth, config);
+// src/_generated/client.ts
+
+// src/_generated/resources.ts
+function fillActor(params, bound) {
+  if (bound.actor_id === void 0) return params;
+  const p = params ?? {};
+  return p.actor_id === void 0 ? { ...p, actor_id: bound.actor_id } : p;
+}
+function formData(fields) {
+  const form = new FormData();
+  for (const [k, v] of Object.entries(fields ?? {})) {
+    if (v === void 0 || v === null) continue;
+    if (v instanceof Blob) form.append(k, v);
+    else form.append(k, typeof v === "object" ? JSON.stringify(v) : String(v));
+  }
+  return form;
+}
+var APIResource = class {
+  _client;
+  /** Path parameters (and `actor_id`) bound by the enclosing scope. */
+  _b;
+  constructor(client, bound = {}) {
+    this._client = client;
+    this._b = bound;
+  }
+};
+var AccountResource = class extends APIResource {
+  /**
+   * Delete the calling account. Auto-promotes the oldest admin (or oldest non-self member) to owner in any workspace where the departing account is the sole owner. Linked provider grants that require server-side revocation (Sign in with Apple) are revoked with the provider.
+   *
+   * @param options - Per-request options.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
+   * @throws {PermissionDeniedError} 403 FORBIDDEN: The session lacks the required action for self-account deletion (defence-in-depth — the route is guarded but the cookie may be present without action access).
+   * @throws {NotFoundError} 404 NOT_FOUND: No account row exists for the session principal. Should never fire for a valid session — surfaced for SDKs.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see DELETE /v1/account
+   * @see https://productcraft.co/docs/platform/api-reference#delete-v1-account
+   * @example
+   * ```ts
+   * await platform.account.erase();
+   * ```
+   */
+  erase(options) {
+    return this._client.request({ method: "DELETE", path: "/v1/account" }, options);
+  }
+};
+var ApiKeysResource = class extends APIResource {
+  /**
+   * Describe the workspace key making this request: its name, workspace, expiry and what it may do in plain sentences. Call it with `Authorization: Bearer pcft_live_…` to test a key right after minting it.
+   *
+   * @param options - Per-request options.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: No bearer, or the key is unknown, revoked or expired.
+   * @throws {PermissionDeniedError} 403 FORBIDDEN, WORKSPACE_KEY_REQUIRED: Signed in with a session or another token instead of a workspace key (`WORKSPACE_KEY_REQUIRED`). Send the `pcft_live_…` key as the bearer.
+   * @throws {NotFoundError} 404 NOT_FOUND, PAK_NOT_FOUND: The key was deleted while the request was in flight (`PAK_NOT_FOUND`).
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see GET /v1/api-keys/self
+   * @see https://productcraft.co/docs/platform/api-reference#get-v1-api-keys-self
+   * @example
+   * ```ts
+   * const apiKeySelf = await platform.apiKeys.self();
+   * ```
+   */
+  self(options) {
+    return this._client.request({ method: "GET", path: "/v1/api-keys/self" }, options);
+  }
+};
+var AuthPasswordResource = class extends APIResource {
+  /**
+   * Request a password reset email. Neither the response nor its timing reveals whether the email matched an account.
+   *
+   * @param params - `PlatformAuth.AuthPasswordRequestResetParams`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Body failed validation (`email` missing or not an email address). Depends only on the request shape, never on whether an account exists.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: more than 10 requests/min from this IP (strict `auth` bucket). `Retry-After` header set. Per-IP limit: rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see POST /v1/auth/password/request-reset
+   * @see https://productcraft.co/docs/platform/api-reference#post-v1-auth-password-request-reset
+   * @example
+   * ```ts
+   * await platform.auth.password.requestReset({ email: "user@example.com" });
+   * ```
+   */
+  requestReset(params, options) {
+    return this._client.request({ method: "POST", path: "/v1/auth/password/request-reset", body: params, public: true }, options);
+  }
+  /**
+   * Reset password using the email-delivered reset token.
+   *
+   * @param params - `PlatformAuth.AuthPasswordResetParams`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, PASSWORD_RESET_INVALID: Body failed validation, the new password fails the password policy, or the reset token is invalid or expired (`PASSWORD_RESET_INVALID`).
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: more than 10 requests/min from this IP (strict `auth` bucket). `Retry-After` header set. Per-IP limit: rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see POST /v1/auth/password/reset
+   * @see https://productcraft.co/docs/platform/api-reference#post-v1-auth-password-reset
+   * @example
+   * ```ts
+   * await platform.auth.password.reset({ new_password: "MyNewPassword123", token: "123456" });
+   * ```
+   */
+  reset(params, options) {
+    return this._client.request({ method: "POST", path: "/v1/auth/password/reset", body: params, public: true }, options);
+  }
+};
+var AuthResource = class extends APIResource {
+  #password;
+  get password() {
+    return this.#password ??= new AuthPasswordResource(this._client, this._b);
+  }
+  /**
+   * Logout by revoking refresh token
+   *
+   * @param params - `PlatformAuth.AuthLogoutParams`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failed or invalid token
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see POST /v1/auth/logout
+   * @see https://productcraft.co/docs/platform/api-reference#post-v1-auth-logout
+   * @example
+   * ```ts
+   * await platform.auth.logout({ refresh_token: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." });
+   * ```
+   */
+  logout(params, options) {
+    return this._client.request({ method: "POST", path: "/v1/auth/logout", body: params, public: true }, options);
+  }
+  /**
+   * Revoke the server-side session tied to the caller’s current access token
+   *
+   * @param options - Per-request options.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid access token
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see POST /v1/auth/logout-current
+   * @see https://productcraft.co/docs/platform/api-reference#post-v1-auth-logout-current
+   * @example
+   * ```ts
+   * await platform.auth.logoutCurrent();
+   * ```
+   */
+  logoutCurrent(options) {
+    return this._client.request({ method: "POST", path: "/v1/auth/logout-current" }, options);
+  }
+  /**
+   * Refresh access token using refresh token
+   *
+   * @param params - `PlatformAuth.AuthRefreshParams`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failed or invalid token
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see POST /v1/auth/refresh
+   * @see https://productcraft.co/docs/platform/api-reference#post-v1-auth-refresh
+   * @example
+   * ```ts
+   * const token = await platform.auth.refresh({ refresh_token: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." });
+   * ```
+   */
+  refresh(params, options) {
+    return this._client.request({ method: "POST", path: "/v1/auth/refresh", body: params, public: true }, options);
+  }
+  /**
+   * Sign in with email/username and password
+   *
+   * Every failed attempt answers `401 INVALID_CREDENTIALS`, whatever went wrong: unknown identifier, wrong password, an account with no password credential, an account locked out through a different identifier, an account an operator has blocked, and a wrong password against a suspended or deactivated account. The responses are deliberately identical in body, timing, DB round trips and Redis ops, so signin is not an account-existence oracle. See core/block/CLAUDE.md.
+   *
+   * @param params - `PlatformAuth.AuthSigninParams`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failed
+   * @throws {AuthenticationError} 401 UNAUTHORIZED, INVALID_CREDENTIALS: Invalid credentials (`INVALID_CREDENTIALS`). Returned for every failed attempt, including a correct password offered while the account is locked out or blocked, and a wrong password against a suspended or deactivated account. The body never says which.
+   * @throws {PermissionDeniedError} 403 FORBIDDEN, ACCOUNT_SUSPENDED, ACCOUNT_DEACTIVATED: The account is suspended (`ACCOUNT_SUSPENDED`) or deactivated (`ACCOUNT_DEACTIVATED`). Only reachable once the caller has proven the password — a wrong password against such an account is a 401.
+   * @throws {RateLimitError} 429 RATE_LIMITED, TOO_MANY_ATTEMPTS: Too many attempts for this identifier (`TOO_MANY_ATTEMPTS`). Two counters produce it, both keyed purely by the submitted identifier: a burst limit of 5 attempts per minute, and a 15-minute lock after 4 failed attempts. Both fire on the same attempt for a registered and an unregistered identifier. Per-IP limit: rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see POST /v1/auth/signin
+   * @see https://productcraft.co/docs/platform/api-reference#post-v1-auth-signin
+   * @example
+   * ```ts
+   * const token = await platform.auth.signin({ identifier: "user@example.com", password: "MySecurePassword123" });
+   * ```
+   */
+  signin(params, options) {
+    return this._client.request({ method: "POST", path: "/v1/auth/signin", body: params, public: true }, options);
+  }
+  /**
+   * Create a new account and sign in
+   *
+   * @param params - `PlatformAuth.AuthSignupParams`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failed
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see POST /v1/auth/signup
+   * @see https://productcraft.co/docs/platform/api-reference#post-v1-auth-signup
+   * @example
+   * ```ts
+   * const token = await platform.auth.signup({ email: "user@example.com", password: "MySecurePassword123", username: "john_doe" });
+   * ```
+   */
+  signup(params, options) {
+    return this._client.request({ method: "POST", path: "/v1/auth/signup", body: params, public: true }, options);
+  }
+};
+var IntrospectWorkspacesResource = class extends APIResource {
+  /**
+   * Introspect caller's membership + effective policy + enabled services in a workspace
+   *
+   * @param workspaceId - Id of the workspace.
+   * @param options - Per-request options.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing or invalid session. Also a session that has been signed out (`SESSION_REVOKED`).
+   * @throws {NotFoundError} 404 NOT_FOUND: Workspace not found (unknown slug or id). Known workspaces the caller is not a member of answer 200 with `is_member: false`.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see GET /v1/introspect/workspaces/{workspace_id}
+   * @see https://productcraft.co/docs/platform/api-reference#get-v1-introspect-workspaces-workspace-id
+   * @example
+   * ```ts
+   * const introspectWorkspace = await platform.introspect.workspaces.retrieve("workspace");
+   * ```
+   */
+  retrieve(workspaceId, options) {
+    return this._client.request({ method: "GET", path: "/v1/introspect/workspaces/{workspace_id}", pathParams: { workspace_id: workspaceId } }, options);
+  }
+};
+var IntrospectResource = class extends APIResource {
+  #workspaces;
+  get workspaces() {
+    return this.#workspaces ??= new IntrospectWorkspacesResource(this._client, this._b);
+  }
+  /**
+   * Resolve a Platform API Key (PAK) to its workspace + IAM-style policy. Downstream services use this with a 60s LRU cache and evaluate the policy via @repo/authz-nestjs evaluatePolicy().
+   *
+   * @param options - Per-request options.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or malformed `Authorization: Bearer` header, or the PAK is unknown, revoked or expired.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see POST /v1/introspect/api-key
+   * @see https://productcraft.co/docs/platform/api-reference#post-v1-introspect-api-key
+   * @example
+   * ```ts
+   * const introspectApiKey = await platform.introspect.apiKey();
+   * ```
+   */
+  apiKey(options) {
+    return this._client.request({ method: "POST", path: "/v1/introspect/api-key" }, options);
+  }
+  /**
+   * Introspect current user with workspace list
+   *
+   * @param options - Per-request options.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: more than 60 requests/min from this IP (default bucket). Anonymous callers, and callers whose session has been signed out, otherwise get 200 with `is_authenticated: false`, never 401. Per-IP limit: rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see GET /v1/introspect
+   * @see https://productcraft.co/docs/platform/api-reference#get-v1-introspect
+   * @example
+   * ```ts
+   * const introspect = await platform.introspect.retrieve();
+   * ```
+   */
+  retrieve(options) {
+    return this._client.request({ method: "GET", path: "/v1/introspect" }, options);
+  }
+};
+var MeAvatarResource = class extends APIResource {
+  /**
+   * Clear the caller's avatar and delete the stored object.
+   *
+   * @param options - Per-request options.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: No session.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see DELETE /v1/me/avatar
+   * @see https://productcraft.co/docs/platform/api-reference#delete-v1-me-avatar
+   * @example
+   * ```ts
+   * await platform.me.avatar.clear();
+   * ```
+   */
+  clear(options) {
+    return this._client.request({ method: "DELETE", path: "/v1/me/avatar" }, options);
+  }
+  /**
+   * Upload (or replace) the caller's avatar. PNG/JPEG/WEBP only — SVG is rejected because user-uploaded SVG from a productcraft.co origin is a stored-XSS vector. ≤2 MB. Magic bytes are sniffed; a mislabeled file is rejected.
+   *
+   * @param params - `PlatformAuth.MeAvatarUploadParams`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid file: wrong mimetype, oversized, or content does not match the declared type.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: No session.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see POST /v1/me/avatar
+   * @see https://productcraft.co/docs/platform/api-reference#post-v1-me-avatar
+   * @example
+   * ```ts
+   * const avatarUrl = await platform.me.avatar.upload({ file: new File(["…"], "image.png", { type: "image/png" }) });
+   * ```
+   */
+  upload(params, options) {
+    return this._client.request({ method: "POST", path: "/v1/me/avatar", body: formData(params) }, options);
+  }
+};
+var MeHiddenGuidesResource = class extends APIResource {
+  /**
+   * Hide a getting-started guide for the caller.
+   *
+   * Idempotent: hiding a guide that is already hidden returns it unchanged, with its first `hidden_at`. At most 200 are kept; hiding one more drops the oldest.
+   *
+   * @param key - The guide: a surface name, optionally followed by `:` and a resource id, e.g. `dashboard:<workspace id>` or `all`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: The key is not a valid guide key.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: No session.
+   * @throws {PermissionDeniedError} 403 FORBIDDEN: The caller authenticated with a non-human principal (e.g. a workspace API key). Hidden guides are a person's console preference.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see PUT /v1/me/hidden-guides/{key}
+   * @see https://productcraft.co/docs/platform/api-reference#put-v1-me-hidden-guides-key
+   * @example
+   * ```ts
+   * const hiddenGuide = await platform.me.hiddenGuides.hide("key");
+   * ```
+   */
+  hide(key, options) {
+    return this._client.request({ method: "PUT", path: "/v1/me/hidden-guides/{key}", pathParams: { key } }, options);
+  }
+  /**
+   * List the getting-started guides the caller has hidden.
+   *
+   * Every guide the caller has hidden in the console, newest first. Hiding is presentation only: the setup status behind a guide is unchanged.
+   *
+   * @param options - Per-request options.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: No session.
+   * @throws {PermissionDeniedError} 403 FORBIDDEN: The caller authenticated with a non-human principal (e.g. a workspace API key). Hidden guides are a person's console preference.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see GET /v1/me/hidden-guides
+   * @see https://productcraft.co/docs/platform/api-reference#get-v1-me-hidden-guides
+   * @example
+   * ```ts
+   * const hiddenGuides = await platform.me.hiddenGuides.list();
+   * ```
+   */
+  list(options) {
+    return this._client.request({ method: "GET", path: "/v1/me/hidden-guides" }, options);
+  }
+  /**
+   * Show every getting-started guide again.
+   *
+   * Removes every hidden guide for the caller, `all` included. Idempotent.
+   *
+   * @param options - Per-request options.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: No session.
+   * @throws {PermissionDeniedError} 403 FORBIDDEN: The caller authenticated with a non-human principal (e.g. a workspace API key). Hidden guides are a person's console preference.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see DELETE /v1/me/hidden-guides
+   * @see https://productcraft.co/docs/platform/api-reference#delete-v1-me-hidden-guides
+   * @example
+   * ```ts
+   * await platform.me.hiddenGuides.reset();
+   * ```
+   */
+  reset(options) {
+    return this._client.request({ method: "DELETE", path: "/v1/me/hidden-guides" }, options);
+  }
+  /**
+   * Show a hidden getting-started guide again.
+   *
+   * Idempotent: showing a guide that is not hidden is a no-op.
+   *
+   * @param key - The guide: a surface name, optionally followed by `:` and a resource id, e.g. `dashboard:<workspace id>` or `all`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: The key is not a valid guide key.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: No session.
+   * @throws {PermissionDeniedError} 403 FORBIDDEN: The caller authenticated with a non-human principal (e.g. a workspace API key). Hidden guides are a person's console preference.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see DELETE /v1/me/hidden-guides/{key}
+   * @see https://productcraft.co/docs/platform/api-reference#delete-v1-me-hidden-guides-key
+   * @example
+   * ```ts
+   * await platform.me.hiddenGuides.unhide("key");
+   * ```
+   */
+  unhide(key, options) {
+    return this._client.request({ method: "DELETE", path: "/v1/me/hidden-guides/{key}", pathParams: { key } }, options);
+  }
+};
+var MeProfileResource = class extends APIResource {
+  /**
+   * Update the caller's profile. Currently only `displayName` is editable. An empty body is a no-op that returns the current profile. Cookie/JWT only — this is a human-self-service surface, not a PAK-mutation surface.
+   *
+   * @param params - `PlatformAuth.MeProfileUpdateParams`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failed (e.g. displayName outside 1-128 chars).
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: No session.
+   * @throws {PermissionDeniedError} 403 FORBIDDEN: The caller authenticated with a non-human principal (e.g. PAK). Profile is per-human; only the human owner can mutate their own row.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see PATCH /v1/me/profile
+   * @see https://productcraft.co/docs/platform/api-reference#patch-v1-me-profile
+   * @example
+   * ```ts
+   * const meProfile = await platform.me.profile.update({ display_name: "string" });
+   * ```
+   */
+  update(params, options) {
+    return this._client.request({ method: "PATCH", path: "/v1/me/profile", body: params }, options);
+  }
+};
+var MeResource = class extends APIResource {
+  #avatar;
+  #hiddenGuides;
+  #profile;
+  get avatar() {
+    return this.#avatar ??= new MeAvatarResource(this._client, this._b);
+  }
+  get hiddenGuides() {
+    return this.#hiddenGuides ??= new MeHiddenGuidesResource(this._client, this._b);
+  }
+  get profile() {
+    return this.#profile ??= new MeProfileResource(this._client, this._b);
+  }
+  /**
+   * Read the caller's account profile.
+   *
+   * @param options - Per-request options.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: No session.
+   * @throws {NotFoundError} 404 NOT_FOUND: No account row for the session principal. Should never fire for a valid session — surfaced for SDKs.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see GET /v1/me
+   * @see https://productcraft.co/docs/platform/api-reference#get-v1-me
+   * @example
+   * ```ts
+   * const meProfile = await platform.me.retrieve();
+   * ```
+   */
+  retrieve(options) {
+    return this._client.request({ method: "GET", path: "/v1/me" }, options);
+  }
+};
+var OauthConnectionsResource = class extends APIResource {
+  /**
+   * Disconnect a client
+   *
+   * Revokes the whole grant family — the grant, its authorization codes, its refresh tokens and every live access token — in one transaction.
+   *
+   * @param grantId - Id of the grant.
+   * @param options - Per-request options.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
+   * @throws {NotFoundError} 404 NOT_FOUND: No such connection for this human.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see DELETE /v1/oauth/connections/{grant_id}
+   * @see https://productcraft.co/docs/platform/api-reference#delete-v1-oauth-connections-grant-id
+   * @example
+   * ```ts
+   * await platform.oauth.connections.delete("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b");
+   * ```
+   */
+  delete(grantId, options) {
+    return this._client.request({ method: "DELETE", path: "/v1/oauth/connections/{grant_id}", pathParams: { grant_id: grantId } }, options);
+  }
+  /**
+   * List clients this human has connected
+   *
+   * The user-facing half of revocation: which third-party clients hold a grant, in which workspace, carrying which policy.
+   *
+   * @param params - `PlatformAuth.OauthConnectionListParams`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see GET /v1/oauth/connections
+   * @see https://productcraft.co/docs/platform/api-reference#get-v1-oauth-connections
+   * @example
+   * ```ts
+   * for await (const connection of platform.oauth.connections.list()) {
+   *   console.log(connection);
+   * }
+   * const page = await platform.oauth.connections.list({}, { timeout: 5_000 });
+   * ```
+   */
+  list(params, options) {
+    return this._client.list({ method: "GET", path: "/v1/oauth/connections", query: params }, options);
+  }
+};
+var OauthWorkspacesConnectionsResource = class extends APIResource {
+  /**
+   * Disconnect a client on behalf of the workspace
+   *
+   * Revokes the whole grant family for a grant made by any member of this workspace — the lever a workspace owner needs when an employee leaves and their MCP client is still running. Requires `workspace.connection.revoke`.
+   *
+   * @param workspaceId - Id of the workspace.
+   * @param grantId - Id of the grant.
+   * @param options - Per-request options.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
+   * @throws {PermissionDeniedError} 403 FORBIDDEN: Not a member, or lacks `workspace.connection.revoke`.
+   * @throws {NotFoundError} 404 NOT_FOUND: No such connection in this workspace.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see DELETE /v1/oauth/workspaces/{workspace_id}/connections/{grant_id}
+   * @see https://productcraft.co/docs/platform/api-reference#delete-v1-oauth-workspaces-workspace-id-connections-grant-id
+   * @example
+   * ```ts
+   * await platform.oauth.workspaces.connections.delete("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b", "5d1e2f3a-4b5c-4d6e-8f70-8192a3b4c5d6");
+   * ```
+   */
+  delete(workspaceId, grantId, options) {
+    return this._client.request({ method: "DELETE", path: "/v1/oauth/workspaces/{workspace_id}/connections/{grant_id}", pathParams: { workspace_id: workspaceId, grant_id: grantId } }, options);
+  }
+  /**
+   * List every client connected to a workspace
+   *
+   * The workspace-side half of revocation, for owners and admins: every grant made against this workspace, by any member, including grants made by people who have since left. Requires `workspace.connection.read`.
+   *
+   * @param workspaceId - Id of the workspace.
+   * @param params - `PlatformAuth.OauthWorkspaceConnectionListParams`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
+   * @throws {PermissionDeniedError} 403 FORBIDDEN: Not a member, or lacks `workspace.connection.read`.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see GET /v1/oauth/workspaces/{workspace_id}/connections
+   * @see https://productcraft.co/docs/platform/api-reference#get-v1-oauth-workspaces-workspace-id-connections
+   * @example
+   * ```ts
+   * for await (const connection of platform.oauth.workspaces.connections.list("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b")) {
+   *   console.log(connection);
+   * }
+   * const page = await platform.oauth.workspaces.connections.list("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b", {}, { timeout: 5_000 });
+   * ```
+   */
+  list(workspaceId, params, options) {
+    return this._client.list({ method: "GET", path: "/v1/oauth/workspaces/{workspace_id}/connections", pathParams: { workspace_id: workspaceId }, query: params }, options);
+  }
+  /**
+   * Lift a workspace revocation so the member may reconnect
+   *
+   * A workspace revocation is durable: the member re-running the connect flow does not undo it, so an administrator has to. This clears the block only — every token minted under the old grant stays revoked and the member still has to approve a fresh consent screen. Requires `workspace.connection.revoke`.
+   *
+   * @param workspaceId - Id of the workspace.
+   * @param grantId - Id of the grant.
+   * @param options - Per-request options.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing or invalid session, or a session that has been signed out (`SESSION_REVOKED`).
+   * @throws {PermissionDeniedError} 403 FORBIDDEN: Not a member, or lacks `workspace.connection.revoke`.
+   * @throws {NotFoundError} 404 NOT_FOUND: No such connection in this workspace.
+   * @throws {ConflictError} 409 CONFLICT: The connection was not revoked by an administrator — there is nothing to lift.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see POST /v1/oauth/workspaces/{workspace_id}/connections/{grant_id}/restore
+   * @see https://productcraft.co/docs/platform/api-reference#post-v1-oauth-workspaces-workspace-id-connections-grant-id-restore
+   * @example
+   * ```ts
+   * await platform.oauth.workspaces.connections.restore("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b", "5d1e2f3a-4b5c-4d6e-8f70-8192a3b4c5d6");
+   * ```
+   */
+  restore(workspaceId, grantId, options) {
+    return this._client.request({ method: "POST", path: "/v1/oauth/workspaces/{workspace_id}/connections/{grant_id}/restore", pathParams: { workspace_id: workspaceId, grant_id: grantId } }, options);
+  }
+};
+var OauthWorkspacesResource = class extends APIResource {
+  #connections;
+  get connections() {
+    return this.#connections ??= new OauthWorkspacesConnectionsResource(this._client, this._b);
+  }
+};
+var OauthResource = class extends APIResource {
+  #connections;
+  #workspaces;
+  get connections() {
+    return this.#connections ??= new OauthConnectionsResource(this._client, this._b);
+  }
+  get workspaces() {
+    return this.#workspaces ??= new OauthWorkspacesResource(this._client, this._b);
+  }
+};
+var SessionsResource = class extends APIResource {
+  /**
+   * Revoke one of the caller's own sessions. Takes effect immediately — the refresh token stops working straight away, not at the end of its window.
+   *
+   * @param id - Id of the session.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `id` is not a UUID.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Unauthorized
+   * @throws {NotFoundError} 404 NOT_FOUND: No such session, or it belongs to somebody else — deliberately the same response, so this cannot be used to probe which session ids exist.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see DELETE /v1/session/{id}
+   * @see https://productcraft.co/docs/platform/api-reference#delete-v1-session-id
+   * @example
+   * ```ts
+   * const revokeSession = await platform.sessions.delete("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b");
+   * ```
+   */
+  delete(id, options) {
+    return this._client.request({ method: "DELETE", path: "/v1/session/{id}", pathParams: { id } }, options);
+  }
+  /**
+   * List active sessions
+   *
+   * @param options - Per-request options.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Unauthorized
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see GET /v1/session
+   * @see https://productcraft.co/docs/platform/api-reference#get-v1-session
+   * @example
+   * ```ts
+   * const result = await platform.sessions.list();
+   * ```
+   */
+  list(options) {
+    return this._client.request({ method: "GET", path: "/v1/session" }, options);
+  }
+  /**
+   * Sign out every other session of the caller, keeping the one this request was made with. Takes effect immediately for the revoked sessions. Idempotent: a repeat call revokes 0.
+   *
+   * @param options - Per-request options.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Unauthorized
+   * @throws {ConflictError} 409 CONFLICT: The access token maps to no session (minted before sessions tracked token ids), so the current session cannot be kept. Sign in again.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see POST /v1/session/revoke-others
+   * @see https://productcraft.co/docs/platform/api-reference#post-v1-session-revoke-others
+   * @example
+   * ```ts
+   * const revokeOtherSessions = await platform.sessions.revokeOthers();
+   * ```
+   */
+  revokeOthers(options) {
+    return this._client.request({ method: "POST", path: "/v1/session/revoke-others" }, options);
+  }
+};
+var StatsResource = class extends APIResource {
+  /**
+   * Workspace stats
+   *
+   * Member count, active platform API keys, admin changes in the window with a daily series, the last admin change and the last API-key use, for the console dashboard.
+   *
+   * Admin changes are workspace audit events that record a mutation. Reads (any action ending `.read`), sign-ins (`auth.signin.succeeded`) and MCP tool-call rows (`workspace.mcp_tool.*`) are not counted, so opening the console does not move the numbers. Days are UTC. Counts and timestamps only: no actor identifiers. Cached for up to 60 seconds (`generated_at`).
+   *
+   * @param params - `PlatformAuth.StatsRetrieveParams`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `window` is not one of 1d, 7d, 30d, or `workspaceId` is the slug of a workspace the caller can read rather than its UUID.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
+   * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member of the workspace (`NOT_A_MEMBER`) or lacks `workspace.audit.read` on it.
+   * @throws {NotFoundError} 404 NOT_FOUND: Workspace not found: no workspace has this id (or slug). Same answer as the service's other workspace routes.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see GET /v1/workspaces/{workspace_id}/stats
+   * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces-workspace-id-stats
+   * @example
+   * ```ts
+   * const workspaceStats = await platform.stats.retrieve();
+   * ```
+   */
+  retrieve(params, options) {
+    return this._client.request({ method: "GET", path: "/v1/workspaces/{workspace_id}/stats", query: params }, options);
+  }
+};
+var VerificationResource = class extends APIResource {
+  /**
+   * Resend verification email
+   *
+   * @param options - Per-request options.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Unauthorized
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see POST /v1/verification/resend
+   * @see https://productcraft.co/docs/platform/api-reference#post-v1-verification-resend
+   * @example
+   * ```ts
+   * const feedback = await platform.verification.resend();
+   * ```
+   */
+  resend(options) {
+    return this._client.request({ method: "POST", path: "/v1/verification/resend" }, options);
+  }
+  /**
+   * Verify an email code
+   *
+   * @param params - `PlatformAuth.VerificationVerifyParams`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid or expired verification code
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see POST /v1/verification/verify
+   * @see https://productcraft.co/docs/platform/api-reference#post-v1-verification-verify
+   * @example
+   * ```ts
+   * const feedback = await platform.verification.verify({ code: "a1b2c3d4…" });
+   * ```
+   */
+  verify(params, options) {
+    return this._client.request({ method: "POST", path: "/v1/verification/verify", body: params, public: true }, options);
+  }
+};
+var WellKnownResource = class extends APIResource {
+  /**
+   * Public JWKS for verifying platform-issued JWTs (issuer `https://api.auth.productcraft.co`).
+   *
+   * @param options - Per-request options.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see GET /.well-known/jwks.json
+   * @see https://productcraft.co/docs/platform/api-reference#get-well-known-jwks-json
+   * @example
+   * ```ts
+   * const jwks = await platform.wellKnown.jwks();
+   * ```
+   */
+  jwks(options) {
+    return this._client.request({ method: "GET", path: "/.well-known/jwks.json", public: true }, options);
+  }
+  /**
+   * OAuth 2.1 authorization server metadata (RFC 8414)
+   *
+   * Discovery document for third-party clients (Claude Desktop, Cursor, the ProductCraft MCP server). PKCE with `S256` is mandatory; no other code-challenge method is advertised or accepted. `scopes_supported` lists **presets**, not scopes: authority is the policy document on the grant (`authority_model`).
+   *
+   * @param options - Per-request options.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see GET /.well-known/oauth-authorization-server
+   * @see https://productcraft.co/docs/platform/api-reference#get-well-known-oauth-authorization-server
+   * @example
+   * ```ts
+   * const authorizationServerMetadata = await platform.wellKnown.oauthAuthorizationServer();
+   * ```
+   */
+  oauthAuthorizationServer(options) {
+    return this._client.request({ method: "GET", path: "/.well-known/oauth-authorization-server", public: true }, options);
+  }
+};
+var WorkspacesApiKeysPresetsResource = class extends APIResource {
+  /**
+   * List the ready-made permission sets a workspace key can be minted with (`preset` on create), each with a label, a description and what it allows in this workspace, in plain sentences. A preset a key has already used reads its stored policy, so edits show.
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param options - Per-request options.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, malformed or invalid session.
+   * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member of this workspace (`NOT_A_MEMBER`), or lacks `workspace.apikey.read`.
+   * @throws {NotFoundError} 404 NOT_FOUND: Workspace not found.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see GET /v1/workspaces/{workspace_slug}/api-keys/presets
+   * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces-workspace-slug-api-keys-presets
+   * @example
+   * ```ts
+   * for await (const preset of platform.workspaces.apiKeys.presets.list("workspace")) {
+   *   console.log(preset);
+   * }
+   * ```
+   */
+  list(workspaceSlug, options) {
+    return this._client.list({ method: "GET", path: "/v1/workspaces/{workspace_slug}/api-keys/presets", pathParams: { workspace_slug: workspaceSlug } }, options);
+  }
+};
+var WorkspacesApiKeysResource = class extends APIResource {
+  #presets;
+  get presets() {
+    return this.#presets ??= new WorkspacesApiKeysPresetsResource(this._client, this._b);
+  }
+  /**
+   * Mint a new PAK. Choose what it can do with `preset` (a ready-made set such as `mail-send`) or `policy_ids` (managed policies you wrote), never both. The plaintext `token` is returned ONCE — store it now, then call `GET /v1/api-keys/self` with it to check what it can do. The minter can grant at most their own effective permissions. Cookie/JWT only — PAKs cannot mint other PAKs. Send an `Idempotency-Key` to make a retry safe: a retry of a mint that succeeded mints nothing and answers `409 PAK_ALREADY_MINTED` with that key's `id` (the token itself is never cached).
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param params - `PlatformAuth.WorkspaceApiKeyCreateParams`.
+   * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, PAK_NAME_REQUIRED, PAK_NAME_TOO_LONG: Body failed validation (`VALIDATION_ERROR`): neither or both of `policy_ids` and `preset`, an unknown `preset`, an empty `policy_ids`, more than 25 policies, or a blank/overlong `name` (`PAK_NAME_REQUIRED` / `PAK_NAME_TOO_LONG`).
+   * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing, malformed or invalid session. Also a session that has been signed out (`SESSION_REVOKED`).
+   * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is a PAK (`pcft_live_*`) — mint requires a human-issued session; or is not a member (`NOT_A_MEMBER`), lacks `workspace.apikey.create`, or cannot grant one or more actions in the chosen preset or policies.
+   * @throws {NotFoundError} 404 NOT_FOUND, POLICY_NOT_FOUND: Workspace not found, or one of `policy_ids` does not exist in this workspace (`POLICY_NOT_FOUND`).
+   * @throws {ConflictError} 409 CONFLICT, PAK_ALREADY_MINTED, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: `PAK_ALREADY_MINTED`: this `Idempotency-Key` already minted a key (its `id` is in `details`); the token was shown once, so rotate that key for a new one. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see POST /v1/workspaces/{workspace_slug}/api-keys
+   * @see https://productcraft.co/docs/platform/api-reference#post-v1-workspaces-workspace-slug-api-keys
+   * @example
+   * ```ts
+   * const mintPak = await platform.workspaces.apiKeys.create("workspace", { name: "Production social client" });
+   * ```
+   */
+  create(workspaceSlug, params, options) {
+    return this._client.request({ method: "POST", path: "/v1/workspaces/{workspace_slug}/api-keys", pathParams: { workspace_slug: workspaceSlug }, body: params, idempotent: true }, options);
+  }
+  /**
+   * Revoke a PAK. Default behaviour: introspect returns null on the next upstream call; downstream services fail-closed within the 60s cache TTL window. Pass `?force=true` to additionally publish a Redis fan-out that evicts the matching cache entry across every PAK-consuming service immediately — use it when rotating a leaked PAK and the 60s window matters.
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param id - Id of the api key.
+   * @param params - `PlatformAuth.WorkspaceApiKeyDeleteParams`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `id` is not a UUID.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only). Also a session that has been signed out (`SESSION_REVOKED`).
+   * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member of this workspace (`NOT_A_MEMBER`), or lacks `workspace.apikey.delete`.
+   * @throws {NotFoundError} 404 NOT_FOUND, PAK_NOT_FOUND: Workspace not found, or PAK not found in this workspace (`PAK_NOT_FOUND`). Revoking an already-revoked PAK is a 204 no-op.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see DELETE /v1/workspaces/{workspace_slug}/api-keys/{id}
+   * @see https://productcraft.co/docs/platform/api-reference#delete-v1-workspaces-workspace-slug-api-keys-id
+   * @example
+   * ```ts
+   * await platform.workspaces.apiKeys.delete("workspace", "5d1e2f3a-4b5c-4d6e-8f70-8192a3b4c5d6");
+   * ```
+   */
+  delete(workspaceSlug, id, params, options) {
+    return this._client.request({ method: "DELETE", path: "/v1/workspaces/{workspace_slug}/api-keys/{id}", pathParams: { workspace_slug: workspaceSlug, id }, query: params }, options);
+  }
+  /**
+   * List the API keys in this workspace
+   *
+   * Newest first, as the standard cursor-paginated `{data, pagination}` envelope (20 per page, at most 100). Plaintext tokens are never returned, only prefixes and metadata.
+   *
+   * **Deprecated legacy shape:** a request that sends neither `limit` nor `cursor` gets a bare JSON array of every key (capped at 1000), unless its `User-Agent` is a ProductCraft SDK (`productcraft-…`), which always gets the envelope. The array is kept only for `@productcraft/platform-auth` 0.0.x clients and is removed in the platform API's next major version; send `limit` (or use an SDK).
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param params - `PlatformAuth.WorkspaceApiKeyListParams`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`, or `include_revoked` is not `true` or `false` (`VALIDATION_ERROR`).
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see GET /v1/workspaces/{workspace_slug}/api-keys
+   * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces-workspace-slug-api-keys
+   * @example
+   * ```ts
+   * for await (const apiKey of platform.workspaces.apiKeys.list("workspace")) {
+   *   console.log(apiKey);
+   * }
+   * const page = await platform.workspaces.apiKeys.list("workspace", {}, { timeout: 5_000 });
+   * ```
+   */
+  list(workspaceSlug, params, options) {
+    return this._client.list({ method: "GET", path: "/v1/workspaces/{workspace_slug}/api-keys", pathParams: { workspace_slug: workspaceSlug }, query: params }, options);
+  }
+  /**
+   * Describe the key a mint with this `preset` or these `policy_ids` would create, without creating anything: what it could do in plain sentences, and whether you may mint it. Read-only, so it takes no `Idempotency-Key`. Powers the review step of the console key wizard.
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param params - `PlatformAuth.WorkspaceApiKeyPreviewParams`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Body failed validation (`VALIDATION_ERROR`): neither or both of `policy_ids` and `preset`, an unknown `preset`, or an empty or oversized `policy_ids`.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing, malformed or invalid session. Also a session that has been signed out (`SESSION_REVOKED`).
+   * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is a PAK, is not a member (`NOT_A_MEMBER`), or lacks `workspace.apikey.create`. A key you could not mint is NOT a 403 here: it comes back with `grantable: false`.
+   * @throws {NotFoundError} 404 NOT_FOUND, POLICY_NOT_FOUND: Workspace not found, or one of `policy_ids` does not exist in this workspace (`POLICY_NOT_FOUND`).
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see POST /v1/workspaces/{workspace_slug}/api-keys/preview
+   * @see https://productcraft.co/docs/platform/api-reference#post-v1-workspaces-workspace-slug-api-keys-preview
+   * @example
+   * ```ts
+   * const pakGrantPreview = await platform.workspaces.apiKeys.preview("workspace", { policy_ids: ["11111111-1111-1111-1111-111111111111"] });
+   * ```
+   */
+  preview(workspaceSlug, params, options) {
+    return this._client.request({ method: "POST", path: "/v1/workspaces/{workspace_slug}/api-keys/preview", pathParams: { workspace_slug: workspaceSlug }, body: params }, options);
+  }
+  /**
+   * Get a single PAK by id.
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param id - Id of the api key.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `id` is not a UUID.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only).
+   * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member of this workspace (`NOT_A_MEMBER`), or lacks `workspace.apikey.read`.
+   * @throws {NotFoundError} 404 NOT_FOUND, PAK_NOT_FOUND: Workspace not found, or PAK not found in this workspace (`PAK_NOT_FOUND`).
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see GET /v1/workspaces/{workspace_slug}/api-keys/{id}
+   * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces-workspace-slug-api-keys-id
+   * @example
+   * ```ts
+   * const publicApiKey = await platform.workspaces.apiKeys.retrieve("workspace", "5d1e2f3a-4b5c-4d6e-8f70-8192a3b4c5d6");
+   * ```
+   */
+  retrieve(workspaceSlug, id, options) {
+    return this._client.request({ method: "GET", path: "/v1/workspaces/{workspace_slug}/api-keys/{id}", pathParams: { workspace_slug: workspaceSlug, id } }, options);
+  }
+  /**
+   * Mint a replacement for an existing PAK, carrying its name, description and policy bindings over. The outgoing key keeps working for `grace_hours` (24 by default) so a fleet can roll over without downtime. The plaintext `token` is returned ONCE. Cookie/JWT only — a PAK cannot rotate a PAK, for the same reason it cannot mint one.
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param id - Id of the api key.
+   * @param params - `PlatformAuth.WorkspaceApiKeyRotateParams`.
+   * @param options - Per-request options.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing or invalid session, or a session that has been signed out (`SESSION_REVOKED`).
+   * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller is a PAK (`pcft_live_*`), or cannot grant one or more actions in the bindings being carried across.
+   * @throws {NotFoundError} 404 NOT_FOUND: PAK not found in this workspace.
+   * @throws {ConflictError} 409 CONFLICT, PAK_REVOKED, PAK_EXPIRED: The key is revoked (`PAK_REVOKED`), already expired (`PAK_EXPIRED`), or has no policy bindings to carry across.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see POST /v1/workspaces/{workspace_slug}/api-keys/{id}/rotate
+   * @see https://productcraft.co/docs/platform/api-reference#post-v1-workspaces-workspace-slug-api-keys-id-rotate
+   * @example
+   * ```ts
+   * const rotatePak = await platform.workspaces.apiKeys.rotate("workspace", "5d1e2f3a-4b5c-4d6e-8f70-8192a3b4c5d6", { grace_hours: 24 });
+   * ```
+   */
+  rotate(workspaceSlug, id, params, options) {
+    return this._client.request({ method: "POST", path: "/v1/workspaces/{workspace_slug}/api-keys/{id}/rotate", pathParams: { workspace_slug: workspaceSlug, id }, body: params }, options);
+  }
+  /**
+   * Update a PAK’s name or description (does not touch bindings).
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param id - Id of the api key.
+   * @param params - `PlatformAuth.WorkspaceApiKeyUpdateParams`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, PAK_NAME_REQUIRED: `id` is not a UUID, body failed validation, or `name` is blank (`PAK_NAME_REQUIRED`).
+   * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only). Also a session that has been signed out (`SESSION_REVOKED`).
+   * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member of this workspace (`NOT_A_MEMBER`), or lacks `workspace.apikey.update`.
+   * @throws {NotFoundError} 404 NOT_FOUND, PAK_NOT_FOUND: Workspace not found, or PAK not found in this workspace (`PAK_NOT_FOUND`).
+   * @throws {ConflictError} 409 CONFLICT, PAK_REVOKED: PAK is revoked (`PAK_REVOKED`).
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see PATCH /v1/workspaces/{workspace_slug}/api-keys/{id}
+   * @see https://productcraft.co/docs/platform/api-reference#patch-v1-workspaces-workspace-slug-api-keys-id
+   * @example
+   * ```ts
+   * const publicApiKey = await platform.workspaces.apiKeys.update("workspace", "5d1e2f3a-4b5c-4d6e-8f70-8192a3b4c5d6", { description: "string" });
+   * ```
+   */
+  update(workspaceSlug, id, params, options) {
+    return this._client.request({ method: "PATCH", path: "/v1/workspaces/{workspace_slug}/api-keys/{id}", pathParams: { workspace_slug: workspaceSlug, id }, body: params }, options);
+  }
+  /**
+   * Replace the managed-policy bindings on a PAK. Re-runs caller-narrowing on the merged union of statements.
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param id - Id of the api key.
+   * @param params - `PlatformAuth.WorkspaceApiKeyUpdateBindingsParams`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: One of: bound > 25 policies; merged > 200 statements; one of the policy ids does not exist or lives in a different workspace.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing or invalid session, or a session that has been signed out (`SESSION_REVOKED`).
+   * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller cannot grant one or more actions in the merged statement set.
+   * @throws {NotFoundError} 404 NOT_FOUND: PAK not found in this workspace.
+   * @throws {ConflictError} 409 CONFLICT: Empty bindings — revoke the PAK instead of leaving it unbound.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see PATCH /v1/workspaces/{workspace_slug}/api-keys/{id}/bindings
+   * @see https://productcraft.co/docs/platform/api-reference#patch-v1-workspaces-workspace-slug-api-keys-id-bindings
+   * @example
+   * ```ts
+   * const publicApiKey = await platform.workspaces.apiKeys.updateBindings("workspace", "5d1e2f3a-4b5c-4d6e-8f70-8192a3b4c5d6", { policy_ids: ["string"] });
+   * ```
+   */
+  updateBindings(workspaceSlug, id, params, options) {
+    return this._client.request({ method: "PATCH", path: "/v1/workspaces/{workspace_slug}/api-keys/{id}/bindings", pathParams: { workspace_slug: workspaceSlug, id }, body: params }, options);
+  }
+};
+var WorkspacesAuditFeedResource = class extends APIResource {
+  /**
+   * Unified workspace audit feed (cursor-paginated)
+   *
+   * Audit timeline for workspace-scoped events — workspace, member, role, invite, service-activation, PAK and OAuth-consent mutations, plus successful sign-ins and completed password resets. Per-app Auth rows are NOT merged in: they live in another database with no cursor that spans both, and they are served by `GET /v1/apps/:appId/audit-logs` (paginated), `.../audit-logs/export` (streamed) and the per-app audit sink. The `sources` field reports that explicitly rather than implying a pending follow-up.
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param params - `PlatformAuth.WorkspaceAuditFeedListParams`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid query params — `actor_id` is not a well-formed UUID, or `cursor` is not a cursor this endpoint minted. `since`/`until` that do not parse as ISO-8601 are ignored rather than rejected, and `sources` silently drops unknown names; an empty result set after those filters still returns 200.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
+   * @throws {PermissionDeniedError} 403 FORBIDDEN: The caller is signed in but lacks `workspace.audit.read` for this workspace.
+   * @throws {NotFoundError} 404 NOT_FOUND: The `:workspaceSlug` path param does not resolve to a workspace the caller can see.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see GET /v1/workspaces/{workspace_slug}/audit-feed
+   * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces-workspace-slug-audit-feed
+   * @example
+   * ```ts
+   * for await (const auditFeed of platform.workspaces.auditFeed.list("workspace")) {
+   *   console.log(auditFeed);
+   * }
+   * const page = await platform.workspaces.auditFeed.list("workspace", {}, { timeout: 5_000 });
+   * ```
+   */
+  list(workspaceSlug, params, options) {
+    return this._client.list({ method: "GET", path: "/v1/workspaces/{workspace_slug}/audit-feed", pathParams: { workspace_slug: workspaceSlug }, query: fillActor(params, this._b) }, options);
+  }
+};
+var WorkspacesAuditLogsResource = class extends APIResource {
+  /**
+   * Stream the workspace audit log as NDJSON or CSV, applying the same `?action=` / `?actor_id=` / `?since=` / `?until=` filters as the list. Newest first. Reading the export is itself audited.
+   *
+   * The response is streamed: rows are walked in keyset batches and written as they are read, so neither the service nor the client holds the whole log. This is the SOC 2 / GDPR export the platform docs promise. Hard cap of 1,000,000 rows per call; a wider request is refused with 413 before any body is written, so a truncated file can never masquerade as a complete one.
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param params - `PlatformAuth.WorkspaceAuditLogExportParams`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `format`, or malformed `since` / `until`.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
+   * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `workspace.audit.read`.
+   * @throws {NotFoundError} 404 NOT_FOUND: Workspace not found.
+   * @throws {APIError} 413 PAYLOAD_TOO_LARGE: More than 1,000,000 rows match. Narrow the window with `since` / `until` and retry.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see GET /v1/workspaces/{workspace_slug}/audit-logs/export
+   * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces-workspace-slug-audit-logs-export
+   * @example
+   * ```ts
+   * const response = await platform.workspaces.auditLogs.export("workspace");
+   * const text = await response.text();
+   * ```
+   */
+  export(workspaceSlug, params, options) {
+    return this._client.request({ method: "GET", path: "/v1/workspaces/{workspace_slug}/audit-logs/export", pathParams: { workspace_slug: workspaceSlug }, query: fillActor(params, this._b), raw: true }, options);
+  }
+  /**
+   * List workspace audit log entries, newest first. Filter by `?action=`, `?actor_id=`, and/or the `?since=` / `?until=` date range. 20/page (max 100), cursor-paginated.
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param params - `PlatformAuth.WorkspaceAuditLogListParams`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`, `since`, or `until`.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see GET /v1/workspaces/{workspace_slug}/audit-logs
+   * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces-workspace-slug-audit-logs
+   * @example
+   * ```ts
+   * for await (const auditLog of platform.workspaces.auditLogs.list("workspace")) {
+   *   console.log(auditLog);
+   * }
+   * const page = await platform.workspaces.auditLogs.list("workspace", {}, { timeout: 5_000 });
+   * ```
+   */
+  list(workspaceSlug, params, options) {
+    return this._client.list({ method: "GET", path: "/v1/workspaces/{workspace_slug}/audit-logs", pathParams: { workspace_slug: workspaceSlug }, query: fillActor(params, this._b) }, options);
+  }
+};
+var WorkspacesAvatarResource = class extends APIResource {
+  /**
+   * Clear the workspace avatar and delete the stored object. Gated by `workspace.settings.update`.
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param options - Per-request options.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid session.
+   * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member of this workspace (`NOT_A_MEMBER`), or lacks `workspace.settings.update`.
+   * @throws {NotFoundError} 404 NOT_FOUND: Workspace not found (unknown slug or id).
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see DELETE /v1/workspaces/{workspace_slug}/avatar
+   * @see https://productcraft.co/docs/platform/api-reference#delete-v1-workspaces-workspace-slug-avatar
+   * @example
+   * ```ts
+   * await platform.workspaces.avatar.clear("workspace");
+   * ```
+   */
+  clear(workspaceSlug, options) {
+    return this._client.request({ method: "DELETE", path: "/v1/workspaces/{workspace_slug}/avatar", pathParams: { workspace_slug: workspaceSlug } }, options);
+  }
+  /**
+   * Upload (or replace) the workspace identity avatar. Gated by `workspace.settings.update` (owner + admin). PNG/JPEG/WEBP only, ≤2 MB, magic-byte sniffed. SVG is rejected (stored-XSS).
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param params - `PlatformAuth.WorkspaceAvatarUploadParams`.
+   * @param options - Per-request options.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
+   * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller is not a member of this workspace, or lacks workspace.settings.update.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see POST /v1/workspaces/{workspace_slug}/avatar
+   * @see https://productcraft.co/docs/platform/api-reference#post-v1-workspaces-workspace-slug-avatar
+   * @example
+   * ```ts
+   * const workspaceAvatarUrl = await platform.workspaces.avatar.upload("workspace", { file: new File(["…"], "image.png", { type: "image/png" }) });
+   * ```
+   */
+  upload(workspaceSlug, params, options) {
+    return this._client.request({ method: "POST", path: "/v1/workspaces/{workspace_slug}/avatar", pathParams: { workspace_slug: workspaceSlug }, body: formData(params) }, options);
+  }
+};
+var WorkspacesInvitesResource = class extends APIResource {
+  /**
+   * Accept a workspace invite by code. Cookie/JWT only — invite acceptance binds a human identity to a workspace.
+   *
+   * @param params - `PlatformAuth.WorkspaceInviteAcceptParams`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Body failed validation (`code` missing or empty).
+   * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing or invalid session. Also a session that has been signed out (`SESSION_REVOKED`).
+   * @throws {PermissionDeniedError} 403 FORBIDDEN, EMAIL_NOT_VERIFIED, INVITE_EMAIL_MISMATCH: Caller is a PAK (`pcft_live_*`), email not verified (`EMAIL_NOT_VERIFIED`), or the invite is restricted to a different email (`INVITE_EMAIL_MISMATCH`).
+   * @throws {NotFoundError} 404 NOT_FOUND, INVITE_INVALID: Invite code not found (`INVITE_INVALID`).
+   * @throws {ConflictError} 409 CONFLICT, ALREADY_A_MEMBER: Caller is already a member of this workspace (`ALREADY_A_MEMBER`).
+   * @throws {APIError} 410 GONE, INVITE_REVOKED, INVITE_EXPIRED, INVITE_EXHAUSTED: Invite revoked (`INVITE_REVOKED`), expired (`INVITE_EXPIRED`) or out of uses (`INVITE_EXHAUSTED`).
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: more than 10 requests/min from this IP (strict `auth` bucket). `Retry-After` header set. Per-IP limit: rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see POST /v1/workspaces/invites/accept
+   * @see https://productcraft.co/docs/platform/api-reference#post-v1-workspaces-invites-accept
+   * @example
+   * ```ts
+   * const workspace = await platform.workspaces.invites.accept({ code: "inv_…" });
+   * ```
+   */
+  accept(params, options) {
+    return this._client.request({ method: "POST", path: "/v1/workspaces/invites/accept", body: params }, options);
+  }
+  /**
+   * Create a workspace invite link. Cookie/JWT only — invites bring new humans into the workspace.
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param params - `PlatformAuth.WorkspaceInviteCreateParams`.
+   * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Body failed validation.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing or invalid session. Also a session that has been signed out (`SESSION_REVOKED`).
+   * @throws {PermissionDeniedError} 403 FORBIDDEN, EMAIL_NOT_VERIFIED, NOT_A_MEMBER, OWNER_ROLE_REQUIRED, MEMBER_RANK_EXCEEDED: Caller is a PAK (`pcft_live_*`), email not verified (`EMAIL_NOT_VERIFIED`), not a member (`NOT_A_MEMBER`), lacks `workspace.member.invite`, a non-owner tried to invite an owner (`OWNER_ROLE_REQUIRED`), or the role holds permissions the caller does not (`MEMBER_RANK_EXCEEDED`).
+   * @throws {NotFoundError} 404 NOT_FOUND, ROLE_NOT_FOUND: Workspace not found, or role not found in this workspace (`ROLE_NOT_FOUND`).
+   * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see POST /v1/workspaces/{workspace_slug}/invites
+   * @see https://productcraft.co/docs/platform/api-reference#post-v1-workspaces-workspace-slug-invites
+   * @example
+   * ```ts
+   * const workspaceInvite = await platform.workspaces.invites.create("workspace", { email: "alice@example.com" });
+   * ```
+   */
+  create(workspaceSlug, params, options) {
+    return this._client.request({ method: "POST", path: "/v1/workspaces/{workspace_slug}/invites", pathParams: { workspace_slug: workspaceSlug }, body: params, idempotent: true }, options);
+  }
+  /**
+   * Revoke a workspace invite. Cookie/JWT only.
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param inviteId - Id of the invite.
+   * @param options - Per-request options.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing or invalid session. Also a session that has been signed out (`SESSION_REVOKED`).
+   * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is a PAK (`pcft_live_*`), not a member of the invite’s workspace (`NOT_A_MEMBER`), or lacks `workspace.member.invite`.
+   * @throws {NotFoundError} 404 NOT_FOUND, INVITE_NOT_FOUND: Workspace not found, or invite not found (`INVITE_NOT_FOUND`).
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see DELETE /v1/workspaces/{workspace_slug}/invites/{invite_id}
+   * @see https://productcraft.co/docs/platform/api-reference#delete-v1-workspaces-workspace-slug-invites-invite-id
+   * @example
+   * ```ts
+   * await platform.workspaces.invites.delete("workspace", "invite");
+   * ```
+   */
+  delete(workspaceSlug, inviteId, options) {
+    return this._client.request({ method: "DELETE", path: "/v1/workspaces/{workspace_slug}/invites/{invite_id}", pathParams: { workspace_slug: workspaceSlug, invite_id: inviteId } }, options);
+  }
+  /**
+   * List workspace invites, newest first. Cursor-paginated.
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param params - `PlatformAuth.WorkspaceInviteListParams`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid session.
+   * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member of this workspace (`NOT_A_MEMBER`), or lacks `workspace.member.invite`.
+   * @throws {NotFoundError} 404 NOT_FOUND: Workspace not found (unknown slug or id).
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see GET /v1/workspaces/{workspace_slug}/invites
+   * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces-workspace-slug-invites
+   * @example
+   * ```ts
+   * for await (const invite of platform.workspaces.invites.list("workspace")) {
+   *   console.log(invite);
+   * }
+   * const page = await platform.workspaces.invites.list("workspace", {}, { timeout: 5_000 });
+   * ```
+   */
+  list(workspaceSlug, params, options) {
+    return this._client.list({ method: "GET", path: "/v1/workspaces/{workspace_slug}/invites", pathParams: { workspace_slug: workspaceSlug }, query: params }, options);
+  }
+};
+var WorkspacesMembersResource = class extends APIResource {
+  /**
+   * Remove a member from a workspace (or self-leave)
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param accountId - Id of the account.
+   * @param options - Per-request options.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing or invalid session. Also a session that has been signed out (`SESSION_REVOKED`).
+   * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER, MEMBER_RANK_EXCEEDED: Caller is not a member of this workspace (`NOT_A_MEMBER`), lacks `workspace.member.remove` (not required for self-leave), or the target outranks the caller (`MEMBER_RANK_EXCEEDED`: only an owner can remove an owner, and the target role's permissions must all be held by the caller).
+   * @throws {NotFoundError} 404 NOT_FOUND, NOT_A_MEMBER: Workspace not found, or target account is not a member (`NOT_A_MEMBER`).
+   * @throws {ConflictError} 409 CONFLICT, LAST_MEMBER, SOLE_OWNER: Target is the last member (`LAST_MEMBER`) or the sole owner (`SOLE_OWNER`).
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see DELETE /v1/workspaces/{workspace_slug}/members/{account_id}
+   * @see https://productcraft.co/docs/platform/api-reference#delete-v1-workspaces-workspace-slug-members-account-id
+   * @example
+   * ```ts
+   * await platform.workspaces.members.delete("workspace", "account");
+   * ```
+   */
+  delete(workspaceSlug, accountId, options) {
+    return this._client.request({ method: "DELETE", path: "/v1/workspaces/{workspace_slug}/members/{account_id}", pathParams: { workspace_slug: workspaceSlug, account_id: accountId } }, options);
+  }
+  /**
+   * List workspace members, oldest join first. Narrow with `?q=` (name / username / email substring) and/or `?role=`. Cursor-paginated.
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param params - `PlatformAuth.WorkspaceMemberListParams`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid session.
+   * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member of this workspace (`NOT_A_MEMBER`), or lacks `workspace.member.read`.
+   * @throws {NotFoundError} 404 NOT_FOUND: Workspace not found (unknown slug or id).
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see GET /v1/workspaces/{workspace_slug}/members
+   * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces-workspace-slug-members
+   * @example
+   * ```ts
+   * for await (const member of platform.workspaces.members.list("workspace")) {
+   *   console.log(member);
+   * }
+   * const page = await platform.workspaces.members.list("workspace", {}, { timeout: 5_000 });
+   * ```
+   */
+  list(workspaceSlug, params, options) {
+    return this._client.list({ method: "GET", path: "/v1/workspaces/{workspace_slug}/members", pathParams: { workspace_slug: workspaceSlug }, query: params }, options);
+  }
+  /**
+   * Update a member's role. Body: { roleId } or { role: "owner"|"admin"|"member" }.
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param accountId - Id of the account.
+   * @param params - `PlatformAuth.WorkspaceMemberUpdateRoleParams`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Body failed validation.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing or invalid session. Also a session that has been signed out (`SESSION_REVOKED`).
+   * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER, OWNER_ROLE_REQUIRED, MEMBER_RANK_EXCEEDED: Caller is not a member of this workspace (`NOT_A_MEMBER`), lacks `workspace.member.update-role`, a non-owner tried to assign the owner role or change an owner (`OWNER_ROLE_REQUIRED`), or a non-owner tried to change a role to or from one holding permissions the caller lacks (`MEMBER_RANK_EXCEEDED`). Admins may make admins, never owners.
+   * @throws {NotFoundError} 404 NOT_FOUND, NOT_A_MEMBER, ROLE_NOT_FOUND: Workspace not found, target account is not a member (`NOT_A_MEMBER`), or role not found in this workspace (`ROLE_NOT_FOUND`).
+   * @throws {ConflictError} 409 CONFLICT, SOLE_OWNER: Would demote the only owner (`SOLE_OWNER`). Assign another owner first.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see PATCH /v1/workspaces/{workspace_slug}/members/{account_id}/role
+   * @see https://productcraft.co/docs/platform/api-reference#patch-v1-workspaces-workspace-slug-members-account-id-role
+   * @example
+   * ```ts
+   * const updateMemberRole = await platform.workspaces.members.updateRole("workspace", "account", { role: "owner" });
+   * ```
+   */
+  updateRole(workspaceSlug, accountId, params, options) {
+    return this._client.request({ method: "PATCH", path: "/v1/workspaces/{workspace_slug}/members/{account_id}/role", pathParams: { workspace_slug: workspaceSlug, account_id: accountId }, body: params }, options);
+  }
+};
+var WorkspacesPoliciesActionsResource = class extends APIResource {
+  /**
+   * List every known workspace action (catalog of statement actions).
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param options - Per-request options.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only).
+   * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member of this workspace (`NOT_A_MEMBER`), or lacks `workspace.policy.read`.
+   * @throws {NotFoundError} 404 NOT_FOUND: Workspace not found (unknown slug or id).
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see GET /v1/workspaces/{workspace_slug}/policies/actions/catalog
+   * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces-workspace-slug-policies-actions-catalog
+   * @example
+   * ```ts
+   * const workspaceActionCatalog = await platform.workspaces.policies.actions.catalog("workspace");
+   * ```
+   */
+  catalog(workspaceSlug, options) {
+    return this._client.request({ method: "GET", path: "/v1/workspaces/{workspace_slug}/policies/actions/catalog", pathParams: { workspace_slug: workspaceSlug } }, options);
+  }
+};
+var WorkspacesPoliciesResource = class extends APIResource {
+  #actions;
+  get actions() {
+    return this.#actions ??= new WorkspacesPoliciesActionsResource(this._client, this._b);
+  }
+  /**
+   * Create a managed policy. Cookie/JWT only — policy authoring is a human-admin surface.
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param params - `PlatformAuth.WorkspacePolicyCreateParams`.
+   * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid policy shape, name, or condition block.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing or invalid session, or a session that has been signed out (`SESSION_REVOKED`).
+   * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member (`NOT_A_MEMBER`), lacks `workspace.policy.create` (owner and admin hold it by default), or the policy grants an action the caller does not hold.
+   * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Name already in use, or the workspace already has 100 policies. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see POST /v1/workspaces/{workspace_slug}/policies
+   * @see https://productcraft.co/docs/platform/api-reference#post-v1-workspaces-workspace-slug-policies
+   * @example
+   * ```ts
+   * const managedPolicy = await platform.workspaces.policies.create("workspace", {
+   *   name: "mail-readonly",
+   *   policy: [{ actions: ["mail.read", "mail.list"], effect: "allow", resources: ["*"] }],
+   * });
+   * ```
+   */
+  create(workspaceSlug, params, options) {
+    return this._client.request({ method: "POST", path: "/v1/workspaces/{workspace_slug}/policies", pathParams: { workspace_slug: workspaceSlug }, body: params, idempotent: true }, options);
+  }
+  /**
+   * Delete a managed policy. Cascades: API keys lose the binding (deny-all if no other bindings remain); roles fall back to their inline policy column. Owners and admins; a policy bound to a role, or a preset policy, only an owner can delete. Cookie/JWT only.
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param policyId - Id of the policy.
+   * @param options - Per-request options.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing or invalid session, or a session that has been signed out (`SESSION_REVOKED`).
+   * @throws {PermissionDeniedError} 403 FORBIDDEN, OWNER_ROLE_REQUIRED: Caller lacks `workspace.policy.delete`, or is not an owner and the policy is bound to a role or is a preset policy (`OWNER_ROLE_REQUIRED`).
+   * @throws {NotFoundError} 404 NOT_FOUND, POLICY_NOT_FOUND: Policy not found in this workspace (`POLICY_NOT_FOUND`).
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see DELETE /v1/workspaces/{workspace_slug}/policies/{policy_id}
+   * @see https://productcraft.co/docs/platform/api-reference#delete-v1-workspaces-workspace-slug-policies-policy-id
+   * @example
+   * ```ts
+   * const managedPolicyDeleted = await platform.workspaces.policies.delete("workspace", "5d1e2f3a-4b5c-4d6e-8f70-8192a3b4c5d6");
+   * ```
+   */
+  delete(workspaceSlug, policyId, options) {
+    return this._client.request({ method: "DELETE", path: "/v1/workspaces/{workspace_slug}/policies/{policy_id}", pathParams: { workspace_slug: workspaceSlug, policy_id: policyId } }, options);
+  }
+  /**
+   * List managed policies in a workspace, alphabetically. 20/page (max 100), cursor-paginated.
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param params - `PlatformAuth.WorkspacePolicyListParams`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see GET /v1/workspaces/{workspace_slug}/policies
+   * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces-workspace-slug-policies
+   * @example
+   * ```ts
+   * for await (const policy of platform.workspaces.policies.list("workspace")) {
+   *   console.log(policy);
+   * }
+   * const page = await platform.workspaces.policies.list("workspace", {}, { timeout: 5_000 });
+   * ```
+   */
+  list(workspaceSlug, params, options) {
+    return this._client.list({ method: "GET", path: "/v1/workspaces/{workspace_slug}/policies", pathParams: { workspace_slug: workspaceSlug }, query: params }, options);
+  }
+  /**
+   * Get a managed policy by id
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param policyId - Id of the policy.
+   * @param options - Per-request options.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
+   * @throws {NotFoundError} 404 NOT_FOUND: Policy not found in this workspace.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see GET /v1/workspaces/{workspace_slug}/policies/{policy_id}
+   * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces-workspace-slug-policies-policy-id
+   * @example
+   * ```ts
+   * const managedPolicyDetail = await platform.workspaces.policies.retrieve("workspace", "5d1e2f3a-4b5c-4d6e-8f70-8192a3b4c5d6");
+   * ```
+   */
+  retrieve(workspaceSlug, policyId, options) {
+    return this._client.request({ method: "GET", path: "/v1/workspaces/{workspace_slug}/policies/{policy_id}", pathParams: { workspace_slug: workspaceSlug, policy_id: policyId } }, options);
+  }
+  /**
+   * Update a managed policy. Owners and admins; a policy bound to a role, or a preset policy, only an owner can edit. Cookie/JWT only — policy authoring is a human-admin surface.
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param policyId - Id of the policy.
+   * @param params - `PlatformAuth.WorkspacePolicyUpdateParams`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid policy shape, name, or condition block.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing or invalid session, or a session that has been signed out (`SESSION_REVOKED`).
+   * @throws {PermissionDeniedError} 403 FORBIDDEN, OWNER_ROLE_REQUIRED: Caller lacks `workspace.policy.update`, cannot grant one or more requested actions, or is not an owner and the policy is bound to a role or is a preset policy (`OWNER_ROLE_REQUIRED`).
+   * @throws {NotFoundError} 404 NOT_FOUND, POLICY_NOT_FOUND: Policy not found in this workspace (`POLICY_NOT_FOUND`).
+   * @throws {ConflictError} 409 CONFLICT, POLICY_NAME_TAKEN: Name already in use (`POLICY_NAME_TAKEN`).
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see PATCH /v1/workspaces/{workspace_slug}/policies/{policy_id}
+   * @see https://productcraft.co/docs/platform/api-reference#patch-v1-workspaces-workspace-slug-policies-policy-id
+   * @example
+   * ```ts
+   * const managedPolicyDetail = await platform.workspaces.policies.update("workspace", "5d1e2f3a-4b5c-4d6e-8f70-8192a3b4c5d6", { description: "Read-only access to all Mail resources" });
+   * ```
+   */
+  update(workspaceSlug, policyId, params, options) {
+    return this._client.request({ method: "PATCH", path: "/v1/workspaces/{workspace_slug}/policies/{policy_id}", pathParams: { workspace_slug: workspaceSlug, policy_id: policyId }, body: params }, options);
+  }
+};
+var WorkspacesRolesResource = class extends APIResource {
+  /**
+   * Create a new custom role. Cookie/JWT only — role authoring is a human-admin surface.
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param params - `PlatformAuth.WorkspaceRoleCreateParams`.
+   * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, POLICY_INVALID: Body failed validation, invalid role name, malformed policy, both `policy_id` and `policy` sent, or an action pattern matches no known permission (`POLICY_INVALID`).
+   * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only). Also a session that has been signed out (`SESSION_REVOKED`).
+   * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER, ACTIONS_NOT_GRANTABLE: Caller is not a member of this workspace (`NOT_A_MEMBER`), lacks `workspace.role.create`, or the policy grants actions the caller does not hold (`ACTIONS_NOT_GRANTABLE`).
+   * @throws {NotFoundError} 404 NOT_FOUND, POLICY_NOT_FOUND: Workspace not found, or `policy_id` not found in this workspace (`POLICY_NOT_FOUND`).
+   * @throws {ConflictError} 409 CONFLICT, ROLE_NAME_TAKEN, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Role name already in use or reserved for a system role (`ROLE_NAME_TAKEN`). Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see POST /v1/workspaces/{workspace_slug}/roles
+   * @see https://productcraft.co/docs/platform/api-reference#post-v1-workspaces-workspace-slug-roles
+   * @example
+   * ```ts
+   * const workspaceRole = await platform.workspaces.roles.create("workspace", { name: "BillingAdmin" });
+   * ```
+   */
+  create(workspaceSlug, params, options) {
+    return this._client.request({ method: "POST", path: "/v1/workspaces/{workspace_slug}/roles", pathParams: { workspace_slug: workspaceSlug }, body: params, idempotent: true }, options);
+  }
+  /**
+   * Delete a custom role (fails if it has members). Cookie/JWT only — role authoring is a human-admin surface.
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param roleId - Id of the role.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `roleId` is not a UUID.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only). Also a session that has been signed out (`SESSION_REVOKED`).
+   * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member of this workspace (`NOT_A_MEMBER`), or lacks `workspace.role.delete`.
+   * @throws {NotFoundError} 404 NOT_FOUND, ROLE_NOT_FOUND: Workspace not found, or role not found in this workspace (`ROLE_NOT_FOUND`).
+   * @throws {ConflictError} 409 CONFLICT, ROLE_SYSTEM_IMMUTABLE, ROLE_HAS_MEMBERS: Role is a system role (`ROLE_SYSTEM_IMMUTABLE`) or still has members (`ROLE_HAS_MEMBERS`).
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see DELETE /v1/workspaces/{workspace_slug}/roles/{role_id}
+   * @see https://productcraft.co/docs/platform/api-reference#delete-v1-workspaces-workspace-slug-roles-role-id
+   * @example
+   * ```ts
+   * await platform.workspaces.roles.delete("workspace", "5d1e2f3a-4b5c-4d6e-8f70-8192a3b4c5d6");
+   * ```
+   */
+  delete(workspaceSlug, roleId, options) {
+    return this._client.request({ method: "DELETE", path: "/v1/workspaces/{workspace_slug}/roles/{role_id}", pathParams: { workspace_slug: workspaceSlug, role_id: roleId } }, options);
+  }
+  /**
+   * List roles in a workspace. System roles first, then alphabetical. 20/page (max 100), cursor-paginated.
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param params - `PlatformAuth.WorkspaceRoleListParams`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see GET /v1/workspaces/{workspace_slug}/roles
+   * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces-workspace-slug-roles
+   * @example
+   * ```ts
+   * for await (const role of platform.workspaces.roles.list("workspace")) {
+   *   console.log(role);
+   * }
+   * const page = await platform.workspaces.roles.list("workspace", {}, { timeout: 5_000 });
+   * ```
+   */
+  list(workspaceSlug, params, options) {
+    return this._client.list({ method: "GET", path: "/v1/workspaces/{workspace_slug}/roles", pathParams: { workspace_slug: workspaceSlug }, query: params }, options);
+  }
+  /**
+   * Get a role + its permissions
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param roleId - Id of the role.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `roleId` is not a UUID.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only).
+   * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member of this workspace (`NOT_A_MEMBER`), or lacks `workspace.role.read`.
+   * @throws {NotFoundError} 404 NOT_FOUND, ROLE_NOT_FOUND: Workspace not found, or role not found in this workspace (`ROLE_NOT_FOUND`).
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see GET /v1/workspaces/{workspace_slug}/roles/{role_id}
+   * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces-workspace-slug-roles-role-id
+   * @example
+   * ```ts
+   * const workspaceRole = await platform.workspaces.roles.retrieve("workspace", "5d1e2f3a-4b5c-4d6e-8f70-8192a3b4c5d6");
+   * ```
+   */
+  retrieve(workspaceSlug, roleId, options) {
+    return this._client.request({ method: "GET", path: "/v1/workspaces/{workspace_slug}/roles/{role_id}", pathParams: { workspace_slug: workspaceSlug, role_id: roleId } }, options);
+  }
+  /**
+   * Update a role or replace its permission set. Cookie/JWT only — role authoring is a human-admin surface.
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param roleId - Id of the role.
+   * @param params - `PlatformAuth.WorkspaceRoleUpdateParams`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `roleId` is not a UUID, body failed validation, malformed policy, both `policy_id` and `policy` sent, or an action pattern matches no known permission.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only). Also a session that has been signed out (`SESSION_REVOKED`).
+   * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER, ACTIONS_NOT_GRANTABLE: Caller is not a member of this workspace (`NOT_A_MEMBER`), lacks `workspace.role.update`, or the policy grants actions the caller does not hold (`ACTIONS_NOT_GRANTABLE`).
+   * @throws {NotFoundError} 404 NOT_FOUND, ROLE_NOT_FOUND, POLICY_NOT_FOUND: Workspace, role (`ROLE_NOT_FOUND`) or bound policy (`POLICY_NOT_FOUND`) not found in this workspace.
+   * @throws {ConflictError} 409 CONFLICT, ROLE_SYSTEM_IMMUTABLE, ROLE_NAME_TAKEN: System roles cannot be renamed, edited or bound (`ROLE_SYSTEM_IMMUTABLE`), or the new name is taken (`ROLE_NAME_TAKEN`).
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see PATCH /v1/workspaces/{workspace_slug}/roles/{role_id}
+   * @see https://productcraft.co/docs/platform/api-reference#patch-v1-workspaces-workspace-slug-roles-role-id
+   * @example
+   * ```ts
+   * const workspaceRole = await platform.workspaces.roles.update("workspace", "5d1e2f3a-4b5c-4d6e-8f70-8192a3b4c5d6", { description: "string" });
+   * ```
+   */
+  update(workspaceSlug, roleId, params, options) {
+    return this._client.request({ method: "PATCH", path: "/v1/workspaces/{workspace_slug}/roles/{role_id}", pathParams: { workspace_slug: workspaceSlug, role_id: roleId }, body: params }, options);
+  }
+};
+var WorkspacesServicesResource = class extends APIResource {
+  /**
+   * Disable a service (settings are retained)
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param service - The product: `auth`, `mail`, `waitlist`, `social` or `trawl`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, SERVICE_UNKNOWN: Unknown service name (`SERVICE_UNKNOWN`).
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only).
+   * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member of this workspace (`NOT_A_MEMBER`), or lacks `workspace.service.disable`.
+   * @throws {NotFoundError} 404 NOT_FOUND: Workspace not found (unknown slug or id).
+   * @throws {ConflictError} 409 CONFLICT, SERVICE_NOT_ENABLED: Service is not currently enabled (`SERVICE_NOT_ENABLED`).
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see DELETE /v1/workspaces/{workspace_slug}/services/{service}
+   * @see https://productcraft.co/docs/platform/api-reference#delete-v1-workspaces-workspace-slug-services-service
+   * @example
+   * ```ts
+   * await platform.workspaces.services.disable("workspace", "service");
+   * ```
+   */
+  disable(workspaceSlug, service, options) {
+    return this._client.request({ method: "DELETE", path: "/v1/workspaces/{workspace_slug}/services/{service}", pathParams: { workspace_slug: workspaceSlug, service } }, options);
+  }
+  /**
+   * Enable (or re-enable) a service for this workspace
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param service - The product: `auth`, `mail`, `waitlist`, `social` or `trawl`.
+   * @param params - `PlatformAuth.WorkspaceServiceEnableParams`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, SERVICE_UNKNOWN: Unknown service name (`SERVICE_UNKNOWN`) or body failed validation.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only).
+   * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member of this workspace (`NOT_A_MEMBER`), or lacks `workspace.service.enable`.
+   * @throws {NotFoundError} 404 NOT_FOUND: Workspace not found (unknown slug or id).
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see POST /v1/workspaces/{workspace_slug}/services/{service}
+   * @see https://productcraft.co/docs/platform/api-reference#post-v1-workspaces-workspace-slug-services-service
+   * @example
+   * ```ts
+   * const workspaceServiceState = await platform.workspaces.services.enable("workspace", "service", { settings: {} });
+   * ```
+   */
+  enable(workspaceSlug, service, params, options) {
+    return this._client.request({ method: "POST", path: "/v1/workspaces/{workspace_slug}/services/{service}", pathParams: { workspace_slug: workspaceSlug, service }, body: params }, options);
+  }
+  /**
+   * List services activated on this workspace. Complete — one row per product, not paginated.
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param options - Per-request options.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only).
+   * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member of this workspace (`NOT_A_MEMBER`), or lacks `workspace.service.read`.
+   * @throws {NotFoundError} 404 NOT_FOUND: Workspace not found (unknown slug or id).
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see GET /v1/workspaces/{workspace_slug}/services
+   * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces-workspace-slug-services
+   * @example
+   * ```ts
+   * const listWorkspaceServices = await platform.workspaces.services.list("workspace");
+   * ```
+   */
+  list(workspaceSlug, options) {
+    return this._client.request({ method: "GET", path: "/v1/workspaces/{workspace_slug}/services", pathParams: { workspace_slug: workspaceSlug } }, options);
+  }
+  /**
+   * Replace the settings jsonb for an active service
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param service - The product: `auth`, `mail`, `waitlist`, `social` or `trawl`.
+   * @param params - `PlatformAuth.WorkspaceServiceUpdateSettingsParams`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, SERVICE_UNKNOWN: Unknown service name (`SERVICE_UNKNOWN`).
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only).
+   * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member of this workspace (`NOT_A_MEMBER`), or lacks `workspace.service.enable`.
+   * @throws {NotFoundError} 404 NOT_FOUND, SERVICE_NOT_ACTIVATED: Workspace not found, or the service was never activated on it (`SERVICE_NOT_ACTIVATED`).
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see PATCH /v1/workspaces/{workspace_slug}/services/{service}/settings
+   * @see https://productcraft.co/docs/platform/api-reference#patch-v1-workspaces-workspace-slug-services-service-settings
+   * @example
+   * ```ts
+   * const workspaceServiceState = await platform.workspaces.services.updateSettings("workspace", "service", { default_sender: "noreply@acme.com" });
+   * ```
+   */
+  updateSettings(workspaceSlug, service, params, options) {
+    return this._client.request({ method: "PATCH", path: "/v1/workspaces/{workspace_slug}/services/{service}/settings", pathParams: { workspace_slug: workspaceSlug, service }, body: params }, options);
+  }
+};
+var WorkspacesResource = class extends APIResource {
+  #apiKeys;
+  #auditFeed;
+  #auditLogs;
+  #avatar;
+  #invites;
+  #members;
+  #policies;
+  #roles;
+  #services;
+  get apiKeys() {
+    return this.#apiKeys ??= new WorkspacesApiKeysResource(this._client, this._b);
+  }
+  get auditFeed() {
+    return this.#auditFeed ??= new WorkspacesAuditFeedResource(this._client, this._b);
+  }
+  get auditLogs() {
+    return this.#auditLogs ??= new WorkspacesAuditLogsResource(this._client, this._b);
+  }
+  get avatar() {
+    return this.#avatar ??= new WorkspacesAvatarResource(this._client, this._b);
+  }
+  get invites() {
+    return this.#invites ??= new WorkspacesInvitesResource(this._client, this._b);
+  }
+  get members() {
+    return this.#members ??= new WorkspacesMembersResource(this._client, this._b);
+  }
+  get policies() {
+    return this.#policies ??= new WorkspacesPoliciesResource(this._client, this._b);
+  }
+  get roles() {
+    return this.#roles ??= new WorkspacesRolesResource(this._client, this._b);
+  }
+  get services() {
+    return this.#services ??= new WorkspacesServicesResource(this._client, this._b);
+  }
+  /**
+   * Create a new workspace. Cookie/JWT only — PAKs are workspace-scoped credentials and cannot create new workspaces.
+   *
+   * @param params - `PlatformAuth.WorkspaceCreateParams`.
+   * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
+   * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller is a PAK (`pcft_live_*`). Workspace creation requires a human-issued session.
+   * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see POST /v1/workspaces
+   * @see https://productcraft.co/docs/platform/api-reference#post-v1-workspaces
+   * @example
+   * ```ts
+   * const workspace = await platform.workspaces.create({ display_name: "Acme Corp", slug: "acme-corp" });
+   * ```
+   */
+  create(params, options) {
+    return this._client.request({ method: "POST", path: "/v1/workspaces", body: params, idempotent: true }, options);
+  }
+  /**
+   * Delete a workspace (requires workspace.delete). Cookie/JWT only — irreversible workspace destruction needs a human-attributed audit row.
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param options - Per-request options.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing or invalid session, or a session that has been signed out (`SESSION_REVOKED`).
+   * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller is a PAK (`pcft_live_*`). Workspace deletion requires a human-issued session.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see DELETE /v1/workspaces/{workspace_slug}
+   * @see https://productcraft.co/docs/platform/api-reference#delete-v1-workspaces-workspace-slug
+   * @example
+   * ```ts
+   * await platform.workspaces.delete("workspace");
+   * ```
+   */
+  delete(workspaceSlug, options) {
+    return this._client.request({ method: "DELETE", path: "/v1/workspaces/{workspace_slug}", pathParams: { workspace_slug: workspaceSlug } }, options);
+  }
+  /**
+   * List workspaces the current user belongs to
+   *
+   * @param params - `PlatformAuth.WorkspaceListParams`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid session.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see GET /v1/workspaces
+   * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces
+   * @example
+   * ```ts
+   * for await (const workspace of platform.workspaces.list()) {
+   *   console.log(workspace);
+   * }
+   * const page = await platform.workspaces.list({}, { timeout: 5_000 });
+   * ```
+   */
+  list(params, options) {
+    return this._client.list({ method: "GET", path: "/v1/workspaces", query: params }, options);
+  }
+  /**
+   * Get workspace details
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param options - Per-request options.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid session.
+   * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member of this workspace (`NOT_A_MEMBER`).
+   * @throws {NotFoundError} 404 NOT_FOUND: Workspace not found (unknown slug or id).
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see GET /v1/workspaces/{workspace_slug}
+   * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces-workspace-slug
+   * @example
+   * ```ts
+   * const workspace = await platform.workspaces.retrieve("workspace");
+   * ```
+   */
+  retrieve(workspaceSlug, options) {
+    return this._client.request({ method: "GET", path: "/v1/workspaces/{workspace_slug}", pathParams: { workspace_slug: workspaceSlug } }, options);
+  }
+  /**
+   * Update workspace display name, slug, or settings. Slug renames broadcast a `workspace.renamed` event so denormalised consumers (waitlist-api) sync.
+   *
+   * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+   * @param params - `PlatformAuth.WorkspaceUpdateParams`.
+   * @param options - Per-request options.
+   * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid slug or display name.
+   * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
+   * @throws {NotFoundError} 404 NOT_FOUND: Workspace not found.
+   * @throws {ConflictError} 409 CONFLICT: Slug already taken by another workspace.
+   * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+   * @see PATCH /v1/workspaces/{workspace_slug}
+   * @see https://productcraft.co/docs/platform/api-reference#patch-v1-workspaces-workspace-slug
+   * @example
+   * ```ts
+   * const workspace = await platform.workspaces.update("workspace", { display_name: "string" });
+   * ```
+   */
+  update(workspaceSlug, params, options) {
+    return this._client.request({ method: "PATCH", path: "/v1/workspaces/{workspace_slug}", pathParams: { workspace_slug: workspaceSlug }, body: params }, options);
+  }
+};
+var PlatformAuthResources = class extends APIResource {
+  #account;
+  #apiKeys;
+  #auth;
+  #introspect;
+  #me;
+  #oauth;
+  #sessions;
+  #stats;
+  #verification;
+  #wellKnown;
+  #workspaces;
+  get account() {
+    return this.#account ??= new AccountResource(this._client, this._b);
+  }
+  get apiKeys() {
+    return this.#apiKeys ??= new ApiKeysResource(this._client, this._b);
+  }
+  get auth() {
+    return this.#auth ??= new AuthResource(this._client, this._b);
+  }
+  get introspect() {
+    return this.#introspect ??= new IntrospectResource(this._client, this._b);
+  }
+  get me() {
+    return this.#me ??= new MeResource(this._client, this._b);
+  }
+  get oauth() {
+    return this.#oauth ??= new OauthResource(this._client, this._b);
+  }
+  get sessions() {
+    return this.#sessions ??= new SessionsResource(this._client, this._b);
+  }
+  get stats() {
+    return this.#stats ??= new StatsResource(this._client, this._b);
+  }
+  get verification() {
+    return this.#verification ??= new VerificationResource(this._client, this._b);
+  }
+  get wellKnown() {
+    return this.#wellKnown ??= new WellKnownResource(this._client, this._b);
+  }
+  get workspaces() {
+    return this.#workspaces ??= new WorkspacesResource(this._client, this._b);
+  }
+};
+
+// src/_generated/types.ts
+var ApiKeyPresetKey = { values: ["mail-send", "waitlist-write", "trawl-jobs", "readonly", "full"] };
+var ApiKeyStatus = { values: ["active", "expired", "revoked"] };
+var AuditActorType = { values: ["platform_user", "system", "pat"] };
+var AuditFeedSource = { values: ["workspace_audit", "heimdall_audit", "agora_moderation"] };
+var McpProduct = { values: ["auth", "mail", "waitlist", "social", "trawl"] };
+var PolicyEffect = { values: ["allow", "deny"] };
+var StatsGranularity = { values: ["day"] };
+var StatsMetric = { values: ["audit_events"] };
+var StatsWindow = { values: ["1d", "7d", "30d"] };
+
+// src/_generated/client.ts
+var VERSION = "1.0.0" ;
+var PlatformAuth = class extends PlatformAuthResources {
+  #openapi;
+  constructor(options = {}) {
+    super(new APIClient(options, PC_BASE_URL.platformAuth, { name: "platform-auth", version: VERSION }));
+  }
+  /** The typed `openapi-fetch` escape hatch over the same credential and base URL. It does not retry. */
+  get client() {
+    return this.#openapi ??= createOpenAPIClient(this._client);
   }
 };
+((PlatformAuth2) => {
+  PlatformAuth2.ApiKeyPresetKey = ApiKeyPresetKey;
+  PlatformAuth2.ApiKeyStatus = ApiKeyStatus;
+  PlatformAuth2.AuditActorType = AuditActorType;
+  PlatformAuth2.AuditFeedSource = AuditFeedSource;
+  PlatformAuth2.McpProduct = McpProduct;
+  PlatformAuth2.PolicyEffect = PolicyEffect;
+  PlatformAuth2.StatsGranularity = StatsGranularity;
+  PlatformAuth2.StatsMetric = StatsMetric;
+  PlatformAuth2.StatsWindow = StatsWindow;
+})(PlatformAuth || (PlatformAuth = {}));
+var PlatformAuthErrorCode = { values: ["BAD_REQUEST", "VALIDATION_ERROR", "UNAUTHORIZED", "PAYMENT_REQUIRED", "FORBIDDEN", "NOT_FOUND", "METHOD_NOT_ALLOWED", "NOT_ACCEPTABLE", "REQUEST_TIMEOUT", "CONFLICT", "GONE", "PRECONDITION_FAILED", "PAYLOAD_TOO_LARGE", "UNSUPPORTED_MEDIA_TYPE", "UNPROCESSABLE_ENTITY", "PRECONDITION_REQUIRED", "RATE_LIMITED", "INTERNAL_SERVER_ERROR", "NOT_IMPLEMENTED", "BAD_GATEWAY", "SERVICE_UNAVAILABLE", "GATEWAY_TIMEOUT", "SERVICE_NOT_ENABLED", "INVALID_CREDENTIALS", "SESSION_REVOKED", "MCP_NOT_PERMITTED", "MCP_WORKSPACE_MISMATCH", "PAK_NOT_PERMITTED", "ACTIONS_NOT_GRANTABLE", "IDEMPOTENCY_KEY_REUSE", "IDEMPOTENCY_KEY_REQUIRED", "IDEMPOTENCY_IN_PROGRESS", "WEBHOOK_ENDPOINT_LIMIT", "WEBHOOK_ENDPOINT_NOT_FOUND", "WEBHOOK_ENDPOINT_NOT_SUBSCRIBED", "WEBHOOK_EVENT_NOT_FOUND", "WEBHOOK_EVENT_TYPE_UNKNOWN", "ACCOUNT_DEACTIVATED", "ACCOUNT_SUSPENDED", "ALREADY_A_MEMBER", "CROSS_ORIGIN_REJECTED", "EMAIL_NOT_VERIFIED", "INVITE_EMAIL_MISMATCH", "INVITE_EXHAUSTED", "INVITE_EXPIRED", "INVITE_INVALID", "INVITE_NOT_FOUND", "INVITE_REVOKED", "LAST_MEMBER", "MEMBER_RANK_EXCEEDED", "NOT_A_MEMBER", "OAUTH_GRANT_ADMIN_REVOKED", "OWNER_ROLE_REQUIRED", "PAK_ALREADY_MINTED", "PAK_EXPIRED", "PAK_NAME_REQUIRED", "PAK_NAME_TOO_LONG", "PAK_NOT_FOUND", "PAK_REVOKED", "PASSWORD_RESET_INVALID", "POLICY_INVALID", "POLICY_NAME_TAKEN", "POLICY_NOT_FOUND", "ROLE_HAS_MEMBERS", "ROLE_NAME_TAKEN", "ROLE_NOT_FOUND", "ROLE_SYSTEM_IMMUTABLE", "SERVICE_NOT_ACTIVATED", "SERVICE_UNKNOWN", "SOLE_OWNER", "TOO_MANY_ATTEMPTS", "WORKSPACE_KEY_REQUIRED"] };
 
-export { PlatformAuth };
+export { PlatformAuth, PlatformAuthErrorCode, PlatformAuth as default };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map