@productcraft/platform-auth 0.2.0 → 1.0.0

package/dist/index.d.ts

@@ -1,11 +1,15 @@
-import { makeClient, PCClientConfig } from '@productcraft/core';
+import { LastResponse, APIClient, RequestOptions, APIPromise, PagePromise, ClientOptions, PollOptions } from '@productcraft/core';
+export { APIConnectionError, APIError, APITimeoutError, APIUserAbortError, AuthenticationError, BadRequestError, ConfigurationError, ConflictError, IdempotencyKeyReuseError, InternalServerError, NotFoundError, PermissionDeniedError, ProductCraftError, RateLimitError, UnprocessableEntityError, WebhookVerificationError } from '@productcraft/core';
+import { Client } from 'openapi-fetch';
 
-/**
- * This file was auto-generated by openapi-typescript.
- * Do not make direct changes to the file.
- */
+/** Error codes this API documents. Open: codes added later still type-check. See https://productcraft.co/docs/errors. */
+type PlatformAuthErrorCode = "BAD_REQUEST" | "VALIDATION_ERROR" | "UNAUTHORIZED" | "PAYMENT_REQUIRED" | "FORBIDDEN" | "NOT_FOUND" | "METHOD_NOT_ALLOWED" | "NOT_ACCEPTABLE" | "REQUEST_TIMEOUT" | "CONFLICT" | "GONE" | "PRECONDITION_FAILED" | "PAYLOAD_TOO_LARGE" | "UNSUPPORTED_MEDIA_TYPE" | "UNPROCESSABLE_ENTITY" | "PRECONDITION_REQUIRED" | "RATE_LIMITED" | "INTERNAL_SERVER_ERROR" | "NOT_IMPLEMENTED" | "BAD_GATEWAY" | "SERVICE_UNAVAILABLE" | "GATEWAY_TIMEOUT" | "SERVICE_NOT_ENABLED" | "INVALID_CREDENTIALS" | "SESSION_REVOKED" | "MCP_NOT_PERMITTED" | "MCP_WORKSPACE_MISMATCH" | "PAK_NOT_PERMITTED" | "ACTIONS_NOT_GRANTABLE" | "IDEMPOTENCY_KEY_REUSE" | "IDEMPOTENCY_KEY_REQUIRED" | "IDEMPOTENCY_IN_PROGRESS" | "WEBHOOK_ENDPOINT_LIMIT" | "WEBHOOK_ENDPOINT_NOT_FOUND" | "WEBHOOK_ENDPOINT_NOT_SUBSCRIBED" | "WEBHOOK_EVENT_NOT_FOUND" | "WEBHOOK_EVENT_TYPE_UNKNOWN" | "ACCOUNT_DEACTIVATED" | "ACCOUNT_SUSPENDED" | "ALREADY_A_MEMBER" | "CROSS_ORIGIN_REJECTED" | "EMAIL_NOT_VERIFIED" | "INVITE_EMAIL_MISMATCH" | "INVITE_EXHAUSTED" | "INVITE_EXPIRED" | "INVITE_INVALID" | "INVITE_NOT_FOUND" | "INVITE_REVOKED" | "LAST_MEMBER" | "MEMBER_RANK_EXCEEDED" | "NOT_A_MEMBER" | "OAUTH_GRANT_ADMIN_REVOKED" | "OWNER_ROLE_REQUIRED" | "PAK_ALREADY_MINTED" | "PAK_EXPIRED" | "PAK_NAME_REQUIRED" | "PAK_NAME_TOO_LONG" | "PAK_NOT_FOUND" | "PAK_REVOKED" | "PASSWORD_RESET_INVALID" | "POLICY_INVALID" | "POLICY_NAME_TAKEN" | "POLICY_NOT_FOUND" | "ROLE_HAS_MEMBERS" | "ROLE_NAME_TAKEN" | "ROLE_NOT_FOUND" | "ROLE_SYSTEM_IMMUTABLE" | "SERVICE_NOT_ACTIVATED" | "SERVICE_UNKNOWN" | "SOLE_OWNER" | "TOO_MANY_ATTEMPTS" | "WORKSPACE_KEY_REQUIRED" | (string & {});
+declare const PlatformAuthErrorCode: {
+    values: readonly ["BAD_REQUEST", "VALIDATION_ERROR", "UNAUTHORIZED", "PAYMENT_REQUIRED", "FORBIDDEN", "NOT_FOUND", "METHOD_NOT_ALLOWED", "NOT_ACCEPTABLE", "REQUEST_TIMEOUT", "CONFLICT", "GONE", "PRECONDITION_FAILED", "PAYLOAD_TOO_LARGE", "UNSUPPORTED_MEDIA_TYPE", "UNPROCESSABLE_ENTITY", "PRECONDITION_REQUIRED", "RATE_LIMITED", "INTERNAL_SERVER_ERROR", "NOT_IMPLEMENTED", "BAD_GATEWAY", "SERVICE_UNAVAILABLE", "GATEWAY_TIMEOUT", "SERVICE_NOT_ENABLED", "INVALID_CREDENTIALS", "SESSION_REVOKED", "MCP_NOT_PERMITTED", "MCP_WORKSPACE_MISMATCH", "PAK_NOT_PERMITTED", "ACTIONS_NOT_GRANTABLE", "IDEMPOTENCY_KEY_REUSE", "IDEMPOTENCY_KEY_REQUIRED", "IDEMPOTENCY_IN_PROGRESS", "WEBHOOK_ENDPOINT_LIMIT", "WEBHOOK_ENDPOINT_NOT_FOUND", "WEBHOOK_ENDPOINT_NOT_SUBSCRIBED", "WEBHOOK_EVENT_NOT_FOUND", "WEBHOOK_EVENT_TYPE_UNKNOWN", "ACCOUNT_DEACTIVATED", "ACCOUNT_SUSPENDED", "ALREADY_A_MEMBER", "CROSS_ORIGIN_REJECTED", "EMAIL_NOT_VERIFIED", "INVITE_EMAIL_MISMATCH", "INVITE_EXHAUSTED", "INVITE_EXPIRED", "INVITE_INVALID", "INVITE_NOT_FOUND", "INVITE_REVOKED", "LAST_MEMBER", "MEMBER_RANK_EXCEEDED", "NOT_A_MEMBER", "OAUTH_GRANT_ADMIN_REVOKED", "OWNER_ROLE_REQUIRED", "PAK_ALREADY_MINTED", "PAK_EXPIRED", "PAK_NAME_REQUIRED", "PAK_NAME_TOO_LONG", "PAK_NOT_FOUND", "PAK_REVOKED", "PASSWORD_RESET_INVALID", "POLICY_INVALID", "POLICY_NAME_TAKEN", "POLICY_NOT_FOUND", "ROLE_HAS_MEMBERS", "ROLE_NAME_TAKEN", "ROLE_NOT_FOUND", "ROLE_SYSTEM_IMMUTABLE", "SERVICE_NOT_ACTIVATED", "SERVICE_UNKNOWN", "SOLE_OWNER", "TOO_MANY_ATTEMPTS", "WORKSPACE_KEY_REQUIRED"];
+};
 
-interface paths {
+// Generated by scripts/gen-sdk.mjs from Specs/platform-auth.json. Do not edit.
+type paths = {
     "/.well-known/jwks.json": {
         parameters: {
             query?: never;
@@ -1309,8 +1313,8 @@ interface paths {
         patch: operations["WorkspaceServiceController_updateSettings"];
         trace?: never;
     };
-}
-interface components {
+};
+type components = {
     schemas: {
         AcceptWorkspaceInviteDto: {
             /**
@@ -2754,7 +2758,7 @@ interface components {
              * @default 24
              * @example 24
              */
-            grace_hours: number;
+            grace_hours?: number;
         };
         RotatePakResponseDto: {
             /**
@@ -3461,7 +3465,7 @@ interface components {
         RequestId: string;
     };
     pathItems: never;
-}
+};
 interface operations {
     JwksController_jwks: {
         parameters: {
@@ -9619,16 +9623,1966 @@ interface operations {
     };
 }
 
+type IsUnion<T, U = T> = T extends unknown ? ([U] extends [T] ? false : true) : never;
+type OpenString<T extends string> = string extends T ? T : true extends IsUnion<T> ? T | (string & {}) : T;
+type OpenValue<T> = [T] extends [string] ? OpenString<T> : T extends readonly (infer I)[] ? Open<I>[] : T extends object ? {
+    [K in keyof T]: Open<T[K]>;
+} : T;
+/** A response type: string-literal unions also accept values added after this SDK was built. */
+type Open<T> = OpenValue<Exclude<T, null | undefined>> | Extract<T, null | undefined>;
+/** What a method resolves to: the parsed body plus non-enumerable `lastResponse`. */
+type WithLastResponse<T> = T & {
+    readonly lastResponse: LastResponse;
+};
+type ApiKeyPresetKey = components["schemas"]["ApiKeyPresetKey"];
+declare const ApiKeyPresetKey: {
+    values: readonly ["mail-send", "waitlist-write", "trawl-jobs", "readonly", "full"];
+};
+type ApiKeyStatus = components["schemas"]["ApiKeyStatus"];
+declare const ApiKeyStatus: {
+    values: readonly ["active", "expired", "revoked"];
+};
+type AuditActorType = components["schemas"]["AuditActorType"];
+declare const AuditActorType: {
+    values: readonly ["platform_user", "system", "pat"];
+};
+type AuditFeedSource = components["schemas"]["AuditFeedSource"];
+declare const AuditFeedSource: {
+    values: readonly ["workspace_audit", "heimdall_audit", "agora_moderation"];
+};
+type McpProduct = components["schemas"]["McpProduct"];
+declare const McpProduct: {
+    values: readonly ["auth", "mail", "waitlist", "social", "trawl"];
+};
+type PolicyEffect = components["schemas"]["PolicyEffect"];
+declare const PolicyEffect: {
+    values: readonly ["allow", "deny"];
+};
+type StatsGranularity = components["schemas"]["StatsGranularity"];
+declare const StatsGranularity: {
+    values: readonly ["day"];
+};
+type StatsMetric = components["schemas"]["StatsMetric"];
+declare const StatsMetric: {
+    values: readonly ["audit_events"];
+};
+type StatsWindow = components["schemas"]["StatsWindow"];
+declare const StatsWindow: {
+    values: readonly ["1d", "7d", "30d"];
+};
+type ApiKeySelf = Open<components["schemas"]["ApiKeySelfResponseDto"]>;
+type ApiKeySelfWorkspace = Open<components["schemas"]["ApiKeySelfWorkspaceDto"]>;
+type AuditFeed = Open<components["schemas"]["AuditFeedResponseDto"]>;
+type AuthorizationServerMetadata = Open<components["schemas"]["AuthorizationServerMetadataDto"]>;
+type AvatarUrl = Open<components["schemas"]["AvatarUrlResponseDto"]>;
+type BoundPolicySummary = Open<components["schemas"]["BoundPolicySummaryDto"]>;
+type ConnectedClient = Open<components["schemas"]["ConnectedClientDto"]>;
+type ConnectedClientList = Open<components["schemas"]["ConnectedClientListDto"]>;
+type FeedItem = Open<components["schemas"]["FeedItemDto"]>;
+type Feedback = Open<components["schemas"]["FeedbackResponseDto"]>;
+type HiddenGuide = Open<components["schemas"]["HiddenGuideDto"]>;
+type HiddenGuides = Open<components["schemas"]["HiddenGuidesDto"]>;
+type IntrospectAccount = Open<components["schemas"]["IntrospectAccountDto"]>;
+type IntrospectApiKey = Open<components["schemas"]["IntrospectApiKeyResponseDto"]>;
+type IntrospectPrincipal = Open<components["schemas"]["IntrospectPrincipalDto"]>;
+type Introspect = Open<components["schemas"]["IntrospectResponseDto"]>;
+type IntrospectRole = Open<components["schemas"]["IntrospectRoleDto"]>;
+type IntrospectWorkspaceListItem = Open<components["schemas"]["IntrospectWorkspaceListItemDto"]>;
+type IntrospectWorkspace = Open<components["schemas"]["IntrospectWorkspaceResponseDto"]>;
+type Jwk = Open<components["schemas"]["JwkDto"]>;
+type Jwks = Open<components["schemas"]["JwksResponseDto"]>;
+type ListManagedPolicies = Open<components["schemas"]["ListManagedPoliciesResponseDto"]>;
+type ListPakPresets = Open<components["schemas"]["ListPakPresetsResponseDto"]>;
+type ListPlatformApiKeys = Open<components["schemas"]["ListPlatformApiKeysResponseDto"]>;
+type ListWorkspaceAuditLogs = Open<components["schemas"]["ListWorkspaceAuditLogsResponseDto"]>;
+type ListWorkspaceInvites = Open<components["schemas"]["ListWorkspaceInvitesResponseDto"]>;
+type ListWorkspaceMembers = Open<components["schemas"]["ListWorkspaceMembersResponseDto"]>;
+type ListWorkspaceRoles = Open<components["schemas"]["ListWorkspaceRolesResponseDto"]>;
+type ListWorkspaceServices = Open<components["schemas"]["ListWorkspaceServicesResponseDto"]>;
+type ListWorkspaces = Open<components["schemas"]["ListWorkspacesResponseDto"]>;
+type ManagedPolicyDeleted = Open<components["schemas"]["ManagedPolicyDeletedResponseDto"]>;
+type ManagedPolicyDetail = Open<components["schemas"]["ManagedPolicyDetailResponseDto"]>;
+type ManagedPolicy = Open<components["schemas"]["ManagedPolicyResponseDto"]>;
+type MeProfile = Open<components["schemas"]["MeProfileDto"]>;
+type MintPak = Open<components["schemas"]["MintPakResponseDto"]>;
+type Pagination = Open<components["schemas"]["PaginationDto"]>;
+type PakGrantPreview = Open<components["schemas"]["PakGrantPreviewDto"]>;
+type PakPreset = Open<components["schemas"]["PakPresetDto"]>;
+type PolicyBindingCount = Open<components["schemas"]["PolicyBindingCountDto"]>;
+type PolicyStatement = Open<components["schemas"]["PolicyStatementDto"]>;
+type PublicApiKey = Open<components["schemas"]["PublicApiKeyDto"]>;
+type RevokeOtherSessions = Open<components["schemas"]["RevokeOtherSessionsResponseDto"]>;
+type RevokeSession = Open<components["schemas"]["RevokeSessionResponseDto"]>;
+type RotatePak = Open<components["schemas"]["RotatePakResponseDto"]>;
+type Session = Open<components["schemas"]["SessionDto"]>;
+type SourceDiagnostic = Open<components["schemas"]["SourceDiagnosticDto"]>;
+type StatsSeriesPoint = Open<components["schemas"]["StatsSeriesPointDto"]>;
+type Token = Open<components["schemas"]["TokenResponseDto"]>;
+type UpdateMemberRole = Open<components["schemas"]["UpdateMemberRoleResponseDto"]>;
+type WorkspaceActionCatalog = Open<components["schemas"]["WorkspaceActionCatalogResponseDto"]>;
+type WorkspaceAuditLogEntry = Open<components["schemas"]["WorkspaceAuditLogEntryDto"]>;
+type WorkspaceAvatarUrl = Open<components["schemas"]["WorkspaceAvatarUrlResponseDto"]>;
+type WorkspaceInviteListItem = Open<components["schemas"]["WorkspaceInviteListItemDto"]>;
+type WorkspaceInvite = Open<components["schemas"]["WorkspaceInviteResponseDto"]>;
+type WorkspaceListItem = Open<components["schemas"]["WorkspaceListItemDto"]>;
+type WorkspaceMember = Open<components["schemas"]["WorkspaceMemberResponseDto"]>;
+type Workspace = Open<components["schemas"]["WorkspaceResponseDto"]>;
+type WorkspaceRole = Open<components["schemas"]["WorkspaceRoleResponseDto"]>;
+type WorkspaceServiceState = Open<components["schemas"]["WorkspaceServiceStateDto"]>;
+type WorkspaceStats = Open<components["schemas"]["WorkspaceStatsDto"]>;
+type WorkspaceStatsInWindow = Open<components["schemas"]["WorkspaceStatsInWindowDto"]>;
+type WorkspaceStatsSeries = Open<components["schemas"]["WorkspaceStatsSeriesDto"]>;
+type WorkspaceStatsTotals = Open<components["schemas"]["WorkspaceStatsTotalsDto"]>;
+/** Params for `auth.logout` (POST /v1/auth/logout). */
+type AuthLogoutParams = NonNullable<paths["/v1/auth/logout"]["post"]["requestBody"]>["content"]["application/json"];
+/** Params for `auth.password.requestReset` (POST /v1/auth/password/request-reset). */
+type AuthPasswordRequestResetParams = NonNullable<paths["/v1/auth/password/request-reset"]["post"]["requestBody"]>["content"]["application/json"];
+/** Params for `auth.password.reset` (POST /v1/auth/password/reset). */
+type AuthPasswordResetParams = NonNullable<paths["/v1/auth/password/reset"]["post"]["requestBody"]>["content"]["application/json"];
+/** Params for `auth.refresh` (POST /v1/auth/refresh). */
+type AuthRefreshParams = NonNullable<paths["/v1/auth/refresh"]["post"]["requestBody"]>["content"]["application/json"];
+/** Params for `auth.signin` (POST /v1/auth/signin). */
+type AuthSigninParams = NonNullable<paths["/v1/auth/signin"]["post"]["requestBody"]>["content"]["application/json"];
+/** Params for `auth.signup` (POST /v1/auth/signup). */
+type AuthSignupParams = NonNullable<paths["/v1/auth/signup"]["post"]["requestBody"]>["content"]["application/json"];
+/** Params for `me.avatar.upload` (POST /v1/me/avatar). */
+type MeAvatarUploadParams = {
+    file: Blob;
+};
+/** Params for `me.profile.update` (PATCH /v1/me/profile). */
+type MeProfileUpdateParams = NonNullable<paths["/v1/me/profile"]["patch"]["requestBody"]>["content"]["application/json"];
+/** Params for `oauth.connections.list` (GET /v1/oauth/connections). */
+type OauthConnectionListParams = NonNullable<paths["/v1/oauth/connections"]["get"]["parameters"]["query"]>;
+/** Params for `oauth.workspaces.connections.list` (GET /v1/oauth/workspaces/{workspace_id}/connections). */
+type OauthWorkspaceConnectionListParams = NonNullable<paths["/v1/oauth/workspaces/{workspace_id}/connections"]["get"]["parameters"]["query"]>;
+/** Response of `sessions.list`. */
+type SessionListResponse = Open<paths["/v1/session"]["get"]["responses"][200]["content"]["application/json"]>;
+/** Params for `verification.verify` (POST /v1/verification/verify). */
+type VerificationVerifyParams = NonNullable<paths["/v1/verification/verify"]["post"]["requestBody"]>["content"]["application/json"];
+/** Params for `workspaces.list` (GET /v1/workspaces). */
+type WorkspaceListParams = NonNullable<paths["/v1/workspaces"]["get"]["parameters"]["query"]>;
+/** Params for `workspaces.create` (POST /v1/workspaces). */
+type WorkspaceCreateParams = NonNullable<paths["/v1/workspaces"]["post"]["requestBody"]>["content"]["application/json"];
+/** Params for `workspaces.invites.accept` (POST /v1/workspaces/invites/accept). */
+type WorkspaceInviteAcceptParams = NonNullable<paths["/v1/workspaces/invites/accept"]["post"]["requestBody"]>["content"]["application/json"];
+/** Params for `stats.retrieve` (GET /v1/workspaces/{workspace_id}/stats). */
+type StatsRetrieveParams = NonNullable<paths["/v1/workspaces/{workspace_id}/stats"]["get"]["parameters"]["query"]>;
+/** Params for `workspaces.update` (PATCH /v1/workspaces/{workspace_slug}). */
+type WorkspaceUpdateParams = NonNullable<paths["/v1/workspaces/{workspace_slug}"]["patch"]["requestBody"]>["content"]["application/json"];
+/** Params for `workspaces.apiKeys.list` (GET /v1/workspaces/{workspace_slug}/api-keys). */
+type WorkspaceApiKeyListParams = NonNullable<paths["/v1/workspaces/{workspace_slug}/api-keys"]["get"]["parameters"]["query"]>;
+/** Params for `workspaces.apiKeys.create` (POST /v1/workspaces/{workspace_slug}/api-keys). */
+type WorkspaceApiKeyCreateParams = NonNullable<paths["/v1/workspaces/{workspace_slug}/api-keys"]["post"]["requestBody"]>["content"]["application/json"];
+/** Params for `workspaces.apiKeys.preview` (POST /v1/workspaces/{workspace_slug}/api-keys/preview). */
+type WorkspaceApiKeyPreviewParams = NonNullable<paths["/v1/workspaces/{workspace_slug}/api-keys/preview"]["post"]["requestBody"]>["content"]["application/json"];
+/** Params for `workspaces.apiKeys.update` (PATCH /v1/workspaces/{workspace_slug}/api-keys/{id}). */
+type WorkspaceApiKeyUpdateParams = NonNullable<paths["/v1/workspaces/{workspace_slug}/api-keys/{id}"]["patch"]["requestBody"]>["content"]["application/json"];
+/** Params for `workspaces.apiKeys.delete` (DELETE /v1/workspaces/{workspace_slug}/api-keys/{id}). */
+type WorkspaceApiKeyDeleteParams = NonNullable<paths["/v1/workspaces/{workspace_slug}/api-keys/{id}"]["delete"]["parameters"]["query"]>;
+/** Params for `workspaces.apiKeys.updateBindings` (PATCH /v1/workspaces/{workspace_slug}/api-keys/{id}/bindings). */
+type WorkspaceApiKeyUpdateBindingsParams = NonNullable<paths["/v1/workspaces/{workspace_slug}/api-keys/{id}/bindings"]["patch"]["requestBody"]>["content"]["application/json"];
+/** Params for `workspaces.apiKeys.rotate` (POST /v1/workspaces/{workspace_slug}/api-keys/{id}/rotate). */
+type WorkspaceApiKeyRotateParams = NonNullable<paths["/v1/workspaces/{workspace_slug}/api-keys/{id}/rotate"]["post"]["requestBody"]>["content"]["application/json"];
+/** Params for `workspaces.auditFeed.list` (GET /v1/workspaces/{workspace_slug}/audit-feed). */
+type WorkspaceAuditFeedListParams = NonNullable<paths["/v1/workspaces/{workspace_slug}/audit-feed"]["get"]["parameters"]["query"]>;
+/** Params for `workspaces.auditLogs.list` (GET /v1/workspaces/{workspace_slug}/audit-logs). */
+type WorkspaceAuditLogListParams = NonNullable<paths["/v1/workspaces/{workspace_slug}/audit-logs"]["get"]["parameters"]["query"]>;
+/** Params for `workspaces.auditLogs.export` (GET /v1/workspaces/{workspace_slug}/audit-logs/export). */
+type WorkspaceAuditLogExportParams = NonNullable<paths["/v1/workspaces/{workspace_slug}/audit-logs/export"]["get"]["parameters"]["query"]>;
+/** Params for `workspaces.avatar.upload` (POST /v1/workspaces/{workspace_slug}/avatar). */
+type WorkspaceAvatarUploadParams = {
+    file: Blob;
+};
+/** Params for `workspaces.invites.list` (GET /v1/workspaces/{workspace_slug}/invites). */
+type WorkspaceInviteListParams = NonNullable<paths["/v1/workspaces/{workspace_slug}/invites"]["get"]["parameters"]["query"]>;
+/** Params for `workspaces.invites.create` (POST /v1/workspaces/{workspace_slug}/invites). */
+type WorkspaceInviteCreateParams = NonNullable<paths["/v1/workspaces/{workspace_slug}/invites"]["post"]["requestBody"]>["content"]["application/json"];
+/** Params for `workspaces.members.list` (GET /v1/workspaces/{workspace_slug}/members). */
+type WorkspaceMemberListParams = NonNullable<paths["/v1/workspaces/{workspace_slug}/members"]["get"]["parameters"]["query"]>;
+/** Params for `workspaces.members.updateRole` (PATCH /v1/workspaces/{workspace_slug}/members/{account_id}/role). */
+type WorkspaceMemberUpdateRoleParams = NonNullable<paths["/v1/workspaces/{workspace_slug}/members/{account_id}/role"]["patch"]["requestBody"]>["content"]["application/json"];
+/** Params for `workspaces.policies.list` (GET /v1/workspaces/{workspace_slug}/policies). */
+type WorkspacePolicyListParams = NonNullable<paths["/v1/workspaces/{workspace_slug}/policies"]["get"]["parameters"]["query"]>;
+/** Params for `workspaces.policies.create` (POST /v1/workspaces/{workspace_slug}/policies). */
+type WorkspacePolicyCreateParams = NonNullable<paths["/v1/workspaces/{workspace_slug}/policies"]["post"]["requestBody"]>["content"]["application/json"];
+/** Params for `workspaces.policies.update` (PATCH /v1/workspaces/{workspace_slug}/policies/{policy_id}). */
+type WorkspacePolicyUpdateParams = NonNullable<paths["/v1/workspaces/{workspace_slug}/policies/{policy_id}"]["patch"]["requestBody"]>["content"]["application/json"];
+/** Params for `workspaces.roles.list` (GET /v1/workspaces/{workspace_slug}/roles). */
+type WorkspaceRoleListParams = NonNullable<paths["/v1/workspaces/{workspace_slug}/roles"]["get"]["parameters"]["query"]>;
+/** Params for `workspaces.roles.create` (POST /v1/workspaces/{workspace_slug}/roles). */
+type WorkspaceRoleCreateParams = NonNullable<paths["/v1/workspaces/{workspace_slug}/roles"]["post"]["requestBody"]>["content"]["application/json"];
+/** Params for `workspaces.roles.update` (PATCH /v1/workspaces/{workspace_slug}/roles/{role_id}). */
+type WorkspaceRoleUpdateParams = NonNullable<paths["/v1/workspaces/{workspace_slug}/roles/{role_id}"]["patch"]["requestBody"]>["content"]["application/json"];
+/** Params for `workspaces.services.enable` (POST /v1/workspaces/{workspace_slug}/services/{service}). */
+type WorkspaceServiceEnableParams = NonNullable<paths["/v1/workspaces/{workspace_slug}/services/{service}"]["post"]["requestBody"]>["content"]["application/json"];
+/** Params for `workspaces.services.updateSettings` (PATCH /v1/workspaces/{workspace_slug}/services/{service}/settings). */
+type WorkspaceServiceUpdateSettingsParams = NonNullable<paths["/v1/workspaces/{workspace_slug}/services/{service}/settings"]["patch"]["requestBody"]>["content"]["application/json"];
+
+type Bound = Readonly<Record<string, string | undefined>>;
+declare class APIResource {
+    protected readonly _client: APIClient;
+    /** Path parameters (and `actor_id`) bound by the enclosing scope. */
+    protected readonly _b: Bound;
+    constructor(client: APIClient, bound?: Bound);
+}
+/** `account` */
+declare class AccountResource extends APIResource {
+    /**
+     * Delete the calling account. Auto-promotes the oldest admin (or oldest non-self member) to owner in any workspace where the departing account is the sole owner. Linked provider grants that require server-side revocation (Sign in with Apple) are revoked with the provider.
+     *
+     * @param options - Per-request options.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
+     * @throws {PermissionDeniedError} 403 FORBIDDEN: The session lacks the required action for self-account deletion (defence-in-depth — the route is guarded but the cookie may be present without action access).
+     * @throws {NotFoundError} 404 NOT_FOUND: No account row exists for the session principal. Should never fire for a valid session — surfaced for SDKs.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see DELETE /v1/account
+     * @see https://productcraft.co/docs/platform/api-reference#delete-v1-account
+     * @example
+     * ```ts
+     * await platform.account.erase();
+     * ```
+     */
+    erase(options?: RequestOptions): APIPromise<void>;
+}
+/** `apiKeys` */
+declare class ApiKeysResource extends APIResource {
+    /**
+     * Describe the workspace key making this request: its name, workspace, expiry and what it may do in plain sentences. Call it with `Authorization: Bearer pcft_live_…` to test a key right after minting it.
+     *
+     * @param options - Per-request options.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: No bearer, or the key is unknown, revoked or expired.
+     * @throws {PermissionDeniedError} 403 FORBIDDEN, WORKSPACE_KEY_REQUIRED: Signed in with a session or another token instead of a workspace key (`WORKSPACE_KEY_REQUIRED`). Send the `pcft_live_…` key as the bearer.
+     * @throws {NotFoundError} 404 NOT_FOUND, PAK_NOT_FOUND: The key was deleted while the request was in flight (`PAK_NOT_FOUND`).
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see GET /v1/api-keys/self
+     * @see https://productcraft.co/docs/platform/api-reference#get-v1-api-keys-self
+     * @example
+     * ```ts
+     * const apiKeySelf = await platform.apiKeys.self();
+     * ```
+     */
+    self(options?: RequestOptions): APIPromise<WithLastResponse<ApiKeySelf>>;
+}
+/** `auth.password` */
+declare class AuthPasswordResource extends APIResource {
+    /**
+     * Request a password reset email. Neither the response nor its timing reveals whether the email matched an account.
+     *
+     * @param params - `PlatformAuth.AuthPasswordRequestResetParams`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Body failed validation (`email` missing or not an email address). Depends only on the request shape, never on whether an account exists.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: more than 10 requests/min from this IP (strict `auth` bucket). `Retry-After` header set. Per-IP limit: rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see POST /v1/auth/password/request-reset
+     * @see https://productcraft.co/docs/platform/api-reference#post-v1-auth-password-request-reset
+     * @example
+     * ```ts
+     * await platform.auth.password.requestReset({ email: "user@example.com" });
+     * ```
+     */
+    requestReset(params: AuthPasswordRequestResetParams, options?: RequestOptions): APIPromise<void>;
+    /**
+     * Reset password using the email-delivered reset token.
+     *
+     * @param params - `PlatformAuth.AuthPasswordResetParams`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, PASSWORD_RESET_INVALID: Body failed validation, the new password fails the password policy, or the reset token is invalid or expired (`PASSWORD_RESET_INVALID`).
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: more than 10 requests/min from this IP (strict `auth` bucket). `Retry-After` header set. Per-IP limit: rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see POST /v1/auth/password/reset
+     * @see https://productcraft.co/docs/platform/api-reference#post-v1-auth-password-reset
+     * @example
+     * ```ts
+     * await platform.auth.password.reset({ new_password: "MyNewPassword123", token: "123456" });
+     * ```
+     */
+    reset(params: AuthPasswordResetParams, options?: RequestOptions): APIPromise<void>;
+}
+/** `auth` */
+declare class AuthResource extends APIResource {
+    #private;
+    get password(): AuthPasswordResource;
+    /**
+     * Logout by revoking refresh token
+     *
+     * @param params - `PlatformAuth.AuthLogoutParams`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failed or invalid token
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see POST /v1/auth/logout
+     * @see https://productcraft.co/docs/platform/api-reference#post-v1-auth-logout
+     * @example
+     * ```ts
+     * await platform.auth.logout({ refresh_token: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." });
+     * ```
+     */
+    logout(params: AuthLogoutParams, options?: RequestOptions): APIPromise<void>;
+    /**
+     * Revoke the server-side session tied to the caller’s current access token
+     *
+     * @param options - Per-request options.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid access token
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see POST /v1/auth/logout-current
+     * @see https://productcraft.co/docs/platform/api-reference#post-v1-auth-logout-current
+     * @example
+     * ```ts
+     * await platform.auth.logoutCurrent();
+     * ```
+     */
+    logoutCurrent(options?: RequestOptions): APIPromise<void>;
+    /**
+     * Refresh access token using refresh token
+     *
+     * @param params - `PlatformAuth.AuthRefreshParams`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failed or invalid token
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see POST /v1/auth/refresh
+     * @see https://productcraft.co/docs/platform/api-reference#post-v1-auth-refresh
+     * @example
+     * ```ts
+     * const token = await platform.auth.refresh({ refresh_token: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." });
+     * ```
+     */
+    refresh(params: AuthRefreshParams, options?: RequestOptions): APIPromise<WithLastResponse<Token>>;
+    /**
+     * Sign in with email/username and password
+     *
+     * Every failed attempt answers `401 INVALID_CREDENTIALS`, whatever went wrong: unknown identifier, wrong password, an account with no password credential, an account locked out through a different identifier, an account an operator has blocked, and a wrong password against a suspended or deactivated account. The responses are deliberately identical in body, timing, DB round trips and Redis ops, so signin is not an account-existence oracle. See core/block/CLAUDE.md.
+     *
+     * @param params - `PlatformAuth.AuthSigninParams`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failed
+     * @throws {AuthenticationError} 401 UNAUTHORIZED, INVALID_CREDENTIALS: Invalid credentials (`INVALID_CREDENTIALS`). Returned for every failed attempt, including a correct password offered while the account is locked out or blocked, and a wrong password against a suspended or deactivated account. The body never says which.
+     * @throws {PermissionDeniedError} 403 FORBIDDEN, ACCOUNT_SUSPENDED, ACCOUNT_DEACTIVATED: The account is suspended (`ACCOUNT_SUSPENDED`) or deactivated (`ACCOUNT_DEACTIVATED`). Only reachable once the caller has proven the password — a wrong password against such an account is a 401.
+     * @throws {RateLimitError} 429 RATE_LIMITED, TOO_MANY_ATTEMPTS: Too many attempts for this identifier (`TOO_MANY_ATTEMPTS`). Two counters produce it, both keyed purely by the submitted identifier: a burst limit of 5 attempts per minute, and a 15-minute lock after 4 failed attempts. Both fire on the same attempt for a registered and an unregistered identifier. Per-IP limit: rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see POST /v1/auth/signin
+     * @see https://productcraft.co/docs/platform/api-reference#post-v1-auth-signin
+     * @example
+     * ```ts
+     * const token = await platform.auth.signin({ identifier: "user@example.com", password: "MySecurePassword123" });
+     * ```
+     */
+    signin(params: AuthSigninParams, options?: RequestOptions): APIPromise<WithLastResponse<Token>>;
+    /**
+     * Create a new account and sign in
+     *
+     * @param params - `PlatformAuth.AuthSignupParams`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failed
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see POST /v1/auth/signup
+     * @see https://productcraft.co/docs/platform/api-reference#post-v1-auth-signup
+     * @example
+     * ```ts
+     * const token = await platform.auth.signup({ email: "user@example.com", password: "MySecurePassword123", username: "john_doe" });
+     * ```
+     */
+    signup(params: AuthSignupParams, options?: RequestOptions): APIPromise<WithLastResponse<Token>>;
+}
+/** `introspect.workspaces` */
+declare class IntrospectWorkspacesResource extends APIResource {
+    /**
+     * Introspect caller's membership + effective policy + enabled services in a workspace
+     *
+     * @param workspaceId - Id of the workspace.
+     * @param options - Per-request options.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing or invalid session. Also a session that has been signed out (`SESSION_REVOKED`).
+     * @throws {NotFoundError} 404 NOT_FOUND: Workspace not found (unknown slug or id). Known workspaces the caller is not a member of answer 200 with `is_member: false`.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see GET /v1/introspect/workspaces/{workspace_id}
+     * @see https://productcraft.co/docs/platform/api-reference#get-v1-introspect-workspaces-workspace-id
+     * @example
+     * ```ts
+     * const introspectWorkspace = await platform.introspect.workspaces.retrieve("workspace");
+     * ```
+     */
+    retrieve(workspaceId: string, options?: RequestOptions): APIPromise<WithLastResponse<IntrospectWorkspace>>;
+}
+/** `introspect` */
+declare class IntrospectResource extends APIResource {
+    #private;
+    get workspaces(): IntrospectWorkspacesResource;
+    /**
+     * Resolve a Platform API Key (PAK) to its workspace + IAM-style policy. Downstream services use this with a 60s LRU cache and evaluate the policy via @repo/authz-nestjs evaluatePolicy().
+     *
+     * @param options - Per-request options.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or malformed `Authorization: Bearer` header, or the PAK is unknown, revoked or expired.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see POST /v1/introspect/api-key
+     * @see https://productcraft.co/docs/platform/api-reference#post-v1-introspect-api-key
+     * @example
+     * ```ts
+     * const introspectApiKey = await platform.introspect.apiKey();
+     * ```
+     */
+    apiKey(options?: RequestOptions): APIPromise<WithLastResponse<IntrospectApiKey>>;
+    /**
+     * Introspect current user with workspace list
+     *
+     * @param options - Per-request options.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: more than 60 requests/min from this IP (default bucket). Anonymous callers, and callers whose session has been signed out, otherwise get 200 with `is_authenticated: false`, never 401. Per-IP limit: rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see GET /v1/introspect
+     * @see https://productcraft.co/docs/platform/api-reference#get-v1-introspect
+     * @example
+     * ```ts
+     * const introspect = await platform.introspect.retrieve();
+     * ```
+     */
+    retrieve(options?: RequestOptions): APIPromise<WithLastResponse<Introspect>>;
+}
+/** `me.avatar` */
+declare class MeAvatarResource extends APIResource {
+    /**
+     * Clear the caller's avatar and delete the stored object.
+     *
+     * @param options - Per-request options.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: No session.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see DELETE /v1/me/avatar
+     * @see https://productcraft.co/docs/platform/api-reference#delete-v1-me-avatar
+     * @example
+     * ```ts
+     * await platform.me.avatar.clear();
+     * ```
+     */
+    clear(options?: RequestOptions): APIPromise<void>;
+    /**
+     * Upload (or replace) the caller's avatar. PNG/JPEG/WEBP only — SVG is rejected because user-uploaded SVG from a productcraft.co origin is a stored-XSS vector. ≤2 MB. Magic bytes are sniffed; a mislabeled file is rejected.
+     *
+     * @param params - `PlatformAuth.MeAvatarUploadParams`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid file: wrong mimetype, oversized, or content does not match the declared type.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: No session.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see POST /v1/me/avatar
+     * @see https://productcraft.co/docs/platform/api-reference#post-v1-me-avatar
+     * @example
+     * ```ts
+     * const avatarUrl = await platform.me.avatar.upload({ file: new File(["…"], "image.png", { type: "image/png" }) });
+     * ```
+     */
+    upload(params: MeAvatarUploadParams, options?: RequestOptions): APIPromise<WithLastResponse<AvatarUrl>>;
+}
+/** `me.hiddenGuides` */
+declare class MeHiddenGuidesResource extends APIResource {
+    /**
+     * Hide a getting-started guide for the caller.
+     *
+     * Idempotent: hiding a guide that is already hidden returns it unchanged, with its first `hidden_at`. At most 200 are kept; hiding one more drops the oldest.
+     *
+     * @param key - The guide: a surface name, optionally followed by `:` and a resource id, e.g. `dashboard:<workspace id>` or `all`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: The key is not a valid guide key.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: No session.
+     * @throws {PermissionDeniedError} 403 FORBIDDEN: The caller authenticated with a non-human principal (e.g. a workspace API key). Hidden guides are a person's console preference.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see PUT /v1/me/hidden-guides/{key}
+     * @see https://productcraft.co/docs/platform/api-reference#put-v1-me-hidden-guides-key
+     * @example
+     * ```ts
+     * const hiddenGuide = await platform.me.hiddenGuides.hide("key");
+     * ```
+     */
+    hide(key: string, options?: RequestOptions): APIPromise<WithLastResponse<HiddenGuide>>;
+    /**
+     * List the getting-started guides the caller has hidden.
+     *
+     * Every guide the caller has hidden in the console, newest first. Hiding is presentation only: the setup status behind a guide is unchanged.
+     *
+     * @param options - Per-request options.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: No session.
+     * @throws {PermissionDeniedError} 403 FORBIDDEN: The caller authenticated with a non-human principal (e.g. a workspace API key). Hidden guides are a person's console preference.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see GET /v1/me/hidden-guides
+     * @see https://productcraft.co/docs/platform/api-reference#get-v1-me-hidden-guides
+     * @example
+     * ```ts
+     * const hiddenGuides = await platform.me.hiddenGuides.list();
+     * ```
+     */
+    list(options?: RequestOptions): APIPromise<WithLastResponse<HiddenGuides>>;
+    /**
+     * Show every getting-started guide again.
+     *
+     * Removes every hidden guide for the caller, `all` included. Idempotent.
+     *
+     * @param options - Per-request options.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: No session.
+     * @throws {PermissionDeniedError} 403 FORBIDDEN: The caller authenticated with a non-human principal (e.g. a workspace API key). Hidden guides are a person's console preference.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see DELETE /v1/me/hidden-guides
+     * @see https://productcraft.co/docs/platform/api-reference#delete-v1-me-hidden-guides
+     * @example
+     * ```ts
+     * await platform.me.hiddenGuides.reset();
+     * ```
+     */
+    reset(options?: RequestOptions): APIPromise<void>;
+    /**
+     * Show a hidden getting-started guide again.
+     *
+     * Idempotent: showing a guide that is not hidden is a no-op.
+     *
+     * @param key - The guide: a surface name, optionally followed by `:` and a resource id, e.g. `dashboard:<workspace id>` or `all`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: The key is not a valid guide key.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: No session.
+     * @throws {PermissionDeniedError} 403 FORBIDDEN: The caller authenticated with a non-human principal (e.g. a workspace API key). Hidden guides are a person's console preference.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see DELETE /v1/me/hidden-guides/{key}
+     * @see https://productcraft.co/docs/platform/api-reference#delete-v1-me-hidden-guides-key
+     * @example
+     * ```ts
+     * await platform.me.hiddenGuides.unhide("key");
+     * ```
+     */
+    unhide(key: string, options?: RequestOptions): APIPromise<void>;
+}
+/** `me.profile` */
+declare class MeProfileResource extends APIResource {
+    /**
+     * Update the caller's profile. Currently only `displayName` is editable. An empty body is a no-op that returns the current profile. Cookie/JWT only — this is a human-self-service surface, not a PAK-mutation surface.
+     *
+     * @param params - `PlatformAuth.MeProfileUpdateParams`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Validation failed (e.g. displayName outside 1-128 chars).
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: No session.
+     * @throws {PermissionDeniedError} 403 FORBIDDEN: The caller authenticated with a non-human principal (e.g. PAK). Profile is per-human; only the human owner can mutate their own row.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see PATCH /v1/me/profile
+     * @see https://productcraft.co/docs/platform/api-reference#patch-v1-me-profile
+     * @example
+     * ```ts
+     * const meProfile = await platform.me.profile.update({ display_name: "string" });
+     * ```
+     */
+    update(params?: MeProfileUpdateParams, options?: RequestOptions): APIPromise<WithLastResponse<MeProfile>>;
+}
+/** `me` */
+declare class MeResource extends APIResource {
+    #private;
+    get avatar(): MeAvatarResource;
+    get hiddenGuides(): MeHiddenGuidesResource;
+    get profile(): MeProfileResource;
+    /**
+     * Read the caller's account profile.
+     *
+     * @param options - Per-request options.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: No session.
+     * @throws {NotFoundError} 404 NOT_FOUND: No account row for the session principal. Should never fire for a valid session — surfaced for SDKs.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see GET /v1/me
+     * @see https://productcraft.co/docs/platform/api-reference#get-v1-me
+     * @example
+     * ```ts
+     * const meProfile = await platform.me.retrieve();
+     * ```
+     */
+    retrieve(options?: RequestOptions): APIPromise<WithLastResponse<MeProfile>>;
+}
+/** `oauth.connections` */
+declare class OauthConnectionsResource extends APIResource {
+    /**
+     * Disconnect a client
+     *
+     * Revokes the whole grant family — the grant, its authorization codes, its refresh tokens and every live access token — in one transaction.
+     *
+     * @param grantId - Id of the grant.
+     * @param options - Per-request options.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
+     * @throws {NotFoundError} 404 NOT_FOUND: No such connection for this human.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see DELETE /v1/oauth/connections/{grant_id}
+     * @see https://productcraft.co/docs/platform/api-reference#delete-v1-oauth-connections-grant-id
+     * @example
+     * ```ts
+     * await platform.oauth.connections.delete("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b");
+     * ```
+     */
+    delete(grantId: string, options?: RequestOptions): APIPromise<void>;
+    /**
+     * List clients this human has connected
+     *
+     * The user-facing half of revocation: which third-party clients hold a grant, in which workspace, carrying which policy.
+     *
+     * @param params - `PlatformAuth.OauthConnectionListParams`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see GET /v1/oauth/connections
+     * @see https://productcraft.co/docs/platform/api-reference#get-v1-oauth-connections
+     * @example
+     * ```ts
+     * for await (const connection of platform.oauth.connections.list()) {
+     *   console.log(connection);
+     * }
+     * const page = await platform.oauth.connections.list({}, { timeout: 5_000 });
+     * ```
+     */
+    list(params?: OauthConnectionListParams, options?: RequestOptions): PagePromise<ConnectedClient>;
+}
+/** `oauth.workspaces.connections` */
+declare class OauthWorkspacesConnectionsResource extends APIResource {
+    /**
+     * Disconnect a client on behalf of the workspace
+     *
+     * Revokes the whole grant family for a grant made by any member of this workspace — the lever a workspace owner needs when an employee leaves and their MCP client is still running. Requires `workspace.connection.revoke`.
+     *
+     * @param workspaceId - Id of the workspace.
+     * @param grantId - Id of the grant.
+     * @param options - Per-request options.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
+     * @throws {PermissionDeniedError} 403 FORBIDDEN: Not a member, or lacks `workspace.connection.revoke`.
+     * @throws {NotFoundError} 404 NOT_FOUND: No such connection in this workspace.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see DELETE /v1/oauth/workspaces/{workspace_id}/connections/{grant_id}
+     * @see https://productcraft.co/docs/platform/api-reference#delete-v1-oauth-workspaces-workspace-id-connections-grant-id
+     * @example
+     * ```ts
+     * await platform.oauth.workspaces.connections.delete("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b", "5d1e2f3a-4b5c-4d6e-8f70-8192a3b4c5d6");
+     * ```
+     */
+    delete(workspaceId: string, grantId: string, options?: RequestOptions): APIPromise<void>;
+    /**
+     * List every client connected to a workspace
+     *
+     * The workspace-side half of revocation, for owners and admins: every grant made against this workspace, by any member, including grants made by people who have since left. Requires `workspace.connection.read`.
+     *
+     * @param workspaceId - Id of the workspace.
+     * @param params - `PlatformAuth.OauthWorkspaceConnectionListParams`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
+     * @throws {PermissionDeniedError} 403 FORBIDDEN: Not a member, or lacks `workspace.connection.read`.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see GET /v1/oauth/workspaces/{workspace_id}/connections
+     * @see https://productcraft.co/docs/platform/api-reference#get-v1-oauth-workspaces-workspace-id-connections
+     * @example
+     * ```ts
+     * for await (const connection of platform.oauth.workspaces.connections.list("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b")) {
+     *   console.log(connection);
+     * }
+     * const page = await platform.oauth.workspaces.connections.list("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b", {}, { timeout: 5_000 });
+     * ```
+     */
+    list(workspaceId: string, params?: OauthWorkspaceConnectionListParams, options?: RequestOptions): PagePromise<ConnectedClient>;
+    /**
+     * Lift a workspace revocation so the member may reconnect
+     *
+     * A workspace revocation is durable: the member re-running the connect flow does not undo it, so an administrator has to. This clears the block only — every token minted under the old grant stays revoked and the member still has to approve a fresh consent screen. Requires `workspace.connection.revoke`.
+     *
+     * @param workspaceId - Id of the workspace.
+     * @param grantId - Id of the grant.
+     * @param options - Per-request options.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing or invalid session, or a session that has been signed out (`SESSION_REVOKED`).
+     * @throws {PermissionDeniedError} 403 FORBIDDEN: Not a member, or lacks `workspace.connection.revoke`.
+     * @throws {NotFoundError} 404 NOT_FOUND: No such connection in this workspace.
+     * @throws {ConflictError} 409 CONFLICT: The connection was not revoked by an administrator — there is nothing to lift.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see POST /v1/oauth/workspaces/{workspace_id}/connections/{grant_id}/restore
+     * @see https://productcraft.co/docs/platform/api-reference#post-v1-oauth-workspaces-workspace-id-connections-grant-id-restore
+     * @example
+     * ```ts
+     * await platform.oauth.workspaces.connections.restore("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b", "5d1e2f3a-4b5c-4d6e-8f70-8192a3b4c5d6");
+     * ```
+     */
+    restore(workspaceId: string, grantId: string, options?: RequestOptions): APIPromise<void>;
+}
+/** `oauth.workspaces` */
+declare class OauthWorkspacesResource extends APIResource {
+    #private;
+    get connections(): OauthWorkspacesConnectionsResource;
+}
+/** `oauth` */
+declare class OauthResource extends APIResource {
+    #private;
+    get connections(): OauthConnectionsResource;
+    get workspaces(): OauthWorkspacesResource;
+}
+/** `sessions` */
+declare class SessionsResource extends APIResource {
+    /**
+     * Revoke one of the caller's own sessions. Takes effect immediately — the refresh token stops working straight away, not at the end of its window.
+     *
+     * @param id - Id of the session.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `id` is not a UUID.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Unauthorized
+     * @throws {NotFoundError} 404 NOT_FOUND: No such session, or it belongs to somebody else — deliberately the same response, so this cannot be used to probe which session ids exist.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see DELETE /v1/session/{id}
+     * @see https://productcraft.co/docs/platform/api-reference#delete-v1-session-id
+     * @example
+     * ```ts
+     * const revokeSession = await platform.sessions.delete("3f0c1a2b-4c5d-4e6f-8a9b-0c1d2e3f4a5b");
+     * ```
+     */
+    delete(id: string, options?: RequestOptions): APIPromise<WithLastResponse<RevokeSession>>;
+    /**
+     * List active sessions
+     *
+     * @param options - Per-request options.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Unauthorized
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see GET /v1/session
+     * @see https://productcraft.co/docs/platform/api-reference#get-v1-session
+     * @example
+     * ```ts
+     * const result = await platform.sessions.list();
+     * ```
+     */
+    list(options?: RequestOptions): APIPromise<WithLastResponse<SessionListResponse>>;
+    /**
+     * Sign out every other session of the caller, keeping the one this request was made with. Takes effect immediately for the revoked sessions. Idempotent: a repeat call revokes 0.
+     *
+     * @param options - Per-request options.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Unauthorized
+     * @throws {ConflictError} 409 CONFLICT: The access token maps to no session (minted before sessions tracked token ids), so the current session cannot be kept. Sign in again.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see POST /v1/session/revoke-others
+     * @see https://productcraft.co/docs/platform/api-reference#post-v1-session-revoke-others
+     * @example
+     * ```ts
+     * const revokeOtherSessions = await platform.sessions.revokeOthers();
+     * ```
+     */
+    revokeOthers(options?: RequestOptions): APIPromise<WithLastResponse<RevokeOtherSessions>>;
+}
+/** `stats` */
+declare class StatsResource extends APIResource {
+    /**
+     * Workspace stats
+     *
+     * Member count, active platform API keys, admin changes in the window with a daily series, the last admin change and the last API-key use, for the console dashboard.
+     *
+     * Admin changes are workspace audit events that record a mutation. Reads (any action ending `.read`), sign-ins (`auth.signin.succeeded`) and MCP tool-call rows (`workspace.mcp_tool.*`) are not counted, so opening the console does not move the numbers. Days are UTC. Counts and timestamps only: no actor identifiers. Cached for up to 60 seconds (`generated_at`).
+     *
+     * @param params - `PlatformAuth.StatsRetrieveParams`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `window` is not one of 1d, 7d, 30d, or `workspaceId` is the slug of a workspace the caller can read rather than its UUID.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
+     * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member of the workspace (`NOT_A_MEMBER`) or lacks `workspace.audit.read` on it.
+     * @throws {NotFoundError} 404 NOT_FOUND: Workspace not found: no workspace has this id (or slug). Same answer as the service's other workspace routes.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see GET /v1/workspaces/{workspace_id}/stats
+     * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces-workspace-id-stats
+     * @example
+     * ```ts
+     * const workspaceStats = await platform.stats.retrieve();
+     * ```
+     */
+    retrieve(params?: StatsRetrieveParams, options?: RequestOptions): APIPromise<WithLastResponse<WorkspaceStats>>;
+}
+/** `verification` */
+declare class VerificationResource extends APIResource {
+    /**
+     * Resend verification email
+     *
+     * @param options - Per-request options.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Unauthorized
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see POST /v1/verification/resend
+     * @see https://productcraft.co/docs/platform/api-reference#post-v1-verification-resend
+     * @example
+     * ```ts
+     * const feedback = await platform.verification.resend();
+     * ```
+     */
+    resend(options?: RequestOptions): APIPromise<WithLastResponse<Feedback>>;
+    /**
+     * Verify an email code
+     *
+     * @param params - `PlatformAuth.VerificationVerifyParams`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid or expired verification code
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see POST /v1/verification/verify
+     * @see https://productcraft.co/docs/platform/api-reference#post-v1-verification-verify
+     * @example
+     * ```ts
+     * const feedback = await platform.verification.verify({ code: "a1b2c3d4…" });
+     * ```
+     */
+    verify(params: VerificationVerifyParams, options?: RequestOptions): APIPromise<WithLastResponse<Feedback>>;
+}
+/** `wellKnown` */
+declare class WellKnownResource extends APIResource {
+    /**
+     * Public JWKS for verifying platform-issued JWTs (issuer `https://api.auth.productcraft.co`).
+     *
+     * @param options - Per-request options.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see GET /.well-known/jwks.json
+     * @see https://productcraft.co/docs/platform/api-reference#get-well-known-jwks-json
+     * @example
+     * ```ts
+     * const jwks = await platform.wellKnown.jwks();
+     * ```
+     */
+    jwks(options?: RequestOptions): APIPromise<WithLastResponse<Jwks>>;
+    /**
+     * OAuth 2.1 authorization server metadata (RFC 8414)
+     *
+     * Discovery document for third-party clients (Claude Desktop, Cursor, the ProductCraft MCP server). PKCE with `S256` is mandatory; no other code-challenge method is advertised or accepted. `scopes_supported` lists **presets**, not scopes: authority is the policy document on the grant (`authority_model`).
+     *
+     * @param options - Per-request options.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see GET /.well-known/oauth-authorization-server
+     * @see https://productcraft.co/docs/platform/api-reference#get-well-known-oauth-authorization-server
+     * @example
+     * ```ts
+     * const authorizationServerMetadata = await platform.wellKnown.oauthAuthorizationServer();
+     * ```
+     */
+    oauthAuthorizationServer(options?: RequestOptions): APIPromise<WithLastResponse<AuthorizationServerMetadata>>;
+}
+/** `workspaces.apiKeys.presets` */
+declare class WorkspacesApiKeysPresetsResource extends APIResource {
+    /**
+     * List the ready-made permission sets a workspace key can be minted with (`preset` on create), each with a label, a description and what it allows in this workspace, in plain sentences. A preset a key has already used reads its stored policy, so edits show.
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param options - Per-request options.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, malformed or invalid session.
+     * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member of this workspace (`NOT_A_MEMBER`), or lacks `workspace.apikey.read`.
+     * @throws {NotFoundError} 404 NOT_FOUND: Workspace not found.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see GET /v1/workspaces/{workspace_slug}/api-keys/presets
+     * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces-workspace-slug-api-keys-presets
+     * @example
+     * ```ts
+     * for await (const preset of platform.workspaces.apiKeys.presets.list("workspace")) {
+     *   console.log(preset);
+     * }
+     * ```
+     */
+    list(workspaceSlug: string, options?: RequestOptions): PagePromise<PakPreset>;
+}
+/** `workspaces.apiKeys` */
+declare class WorkspacesApiKeysResource extends APIResource {
+    #private;
+    get presets(): WorkspacesApiKeysPresetsResource;
+    /**
+     * Mint a new PAK. Choose what it can do with `preset` (a ready-made set such as `mail-send`) or `policy_ids` (managed policies you wrote), never both. The plaintext `token` is returned ONCE — store it now, then call `GET /v1/api-keys/self` with it to check what it can do. The minter can grant at most their own effective permissions. Cookie/JWT only — PAKs cannot mint other PAKs. Send an `Idempotency-Key` to make a retry safe: a retry of a mint that succeeded mints nothing and answers `409 PAK_ALREADY_MINTED` with that key's `id` (the token itself is never cached).
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param params - `PlatformAuth.WorkspaceApiKeyCreateParams`.
+     * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, PAK_NAME_REQUIRED, PAK_NAME_TOO_LONG: Body failed validation (`VALIDATION_ERROR`): neither or both of `policy_ids` and `preset`, an unknown `preset`, an empty `policy_ids`, more than 25 policies, or a blank/overlong `name` (`PAK_NAME_REQUIRED` / `PAK_NAME_TOO_LONG`).
+     * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing, malformed or invalid session. Also a session that has been signed out (`SESSION_REVOKED`).
+     * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is a PAK (`pcft_live_*`) — mint requires a human-issued session; or is not a member (`NOT_A_MEMBER`), lacks `workspace.apikey.create`, or cannot grant one or more actions in the chosen preset or policies.
+     * @throws {NotFoundError} 404 NOT_FOUND, POLICY_NOT_FOUND: Workspace not found, or one of `policy_ids` does not exist in this workspace (`POLICY_NOT_FOUND`).
+     * @throws {ConflictError} 409 CONFLICT, PAK_ALREADY_MINTED, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: `PAK_ALREADY_MINTED`: this `Idempotency-Key` already minted a key (its `id` is in `details`); the token was shown once, so rotate that key for a new one. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see POST /v1/workspaces/{workspace_slug}/api-keys
+     * @see https://productcraft.co/docs/platform/api-reference#post-v1-workspaces-workspace-slug-api-keys
+     * @example
+     * ```ts
+     * const mintPak = await platform.workspaces.apiKeys.create("workspace", { name: "Production social client" });
+     * ```
+     */
+    create(workspaceSlug: string, params: WorkspaceApiKeyCreateParams, options?: RequestOptions): APIPromise<WithLastResponse<MintPak>>;
+    /**
+     * Revoke a PAK. Default behaviour: introspect returns null on the next upstream call; downstream services fail-closed within the 60s cache TTL window. Pass `?force=true` to additionally publish a Redis fan-out that evicts the matching cache entry across every PAK-consuming service immediately — use it when rotating a leaked PAK and the 60s window matters.
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param id - Id of the api key.
+     * @param params - `PlatformAuth.WorkspaceApiKeyDeleteParams`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `id` is not a UUID.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only). Also a session that has been signed out (`SESSION_REVOKED`).
+     * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member of this workspace (`NOT_A_MEMBER`), or lacks `workspace.apikey.delete`.
+     * @throws {NotFoundError} 404 NOT_FOUND, PAK_NOT_FOUND: Workspace not found, or PAK not found in this workspace (`PAK_NOT_FOUND`). Revoking an already-revoked PAK is a 204 no-op.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see DELETE /v1/workspaces/{workspace_slug}/api-keys/{id}
+     * @see https://productcraft.co/docs/platform/api-reference#delete-v1-workspaces-workspace-slug-api-keys-id
+     * @example
+     * ```ts
+     * await platform.workspaces.apiKeys.delete("workspace", "5d1e2f3a-4b5c-4d6e-8f70-8192a3b4c5d6");
+     * ```
+     */
+    delete(workspaceSlug: string, id: string, params?: WorkspaceApiKeyDeleteParams, options?: RequestOptions): APIPromise<void>;
+    /**
+     * List the API keys in this workspace
+     *
+     * Newest first, as the standard cursor-paginated `{data, pagination}` envelope (20 per page, at most 100). Plaintext tokens are never returned, only prefixes and metadata.
+     *
+     * **Deprecated legacy shape:** a request that sends neither `limit` nor `cursor` gets a bare JSON array of every key (capped at 1000), unless its `User-Agent` is a ProductCraft SDK (`productcraft-…`), which always gets the envelope. The array is kept only for `@productcraft/platform-auth` 0.0.x clients and is removed in the platform API's next major version; send `limit` (or use an SDK).
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param params - `PlatformAuth.WorkspaceApiKeyListParams`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`, or `include_revoked` is not `true` or `false` (`VALIDATION_ERROR`).
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see GET /v1/workspaces/{workspace_slug}/api-keys
+     * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces-workspace-slug-api-keys
+     * @example
+     * ```ts
+     * for await (const apiKey of platform.workspaces.apiKeys.list("workspace")) {
+     *   console.log(apiKey);
+     * }
+     * const page = await platform.workspaces.apiKeys.list("workspace", {}, { timeout: 5_000 });
+     * ```
+     */
+    list(workspaceSlug: string, params?: WorkspaceApiKeyListParams, options?: RequestOptions): PagePromise<PublicApiKey>;
+    /**
+     * Describe the key a mint with this `preset` or these `policy_ids` would create, without creating anything: what it could do in plain sentences, and whether you may mint it. Read-only, so it takes no `Idempotency-Key`. Powers the review step of the console key wizard.
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param params - `PlatformAuth.WorkspaceApiKeyPreviewParams`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Body failed validation (`VALIDATION_ERROR`): neither or both of `policy_ids` and `preset`, an unknown `preset`, or an empty or oversized `policy_ids`.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing, malformed or invalid session. Also a session that has been signed out (`SESSION_REVOKED`).
+     * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is a PAK, is not a member (`NOT_A_MEMBER`), or lacks `workspace.apikey.create`. A key you could not mint is NOT a 403 here: it comes back with `grantable: false`.
+     * @throws {NotFoundError} 404 NOT_FOUND, POLICY_NOT_FOUND: Workspace not found, or one of `policy_ids` does not exist in this workspace (`POLICY_NOT_FOUND`).
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see POST /v1/workspaces/{workspace_slug}/api-keys/preview
+     * @see https://productcraft.co/docs/platform/api-reference#post-v1-workspaces-workspace-slug-api-keys-preview
+     * @example
+     * ```ts
+     * const pakGrantPreview = await platform.workspaces.apiKeys.preview("workspace", { policy_ids: ["11111111-1111-1111-1111-111111111111"] });
+     * ```
+     */
+    preview(workspaceSlug: string, params?: WorkspaceApiKeyPreviewParams, options?: RequestOptions): APIPromise<WithLastResponse<PakGrantPreview>>;
+    /**
+     * Get a single PAK by id.
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param id - Id of the api key.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `id` is not a UUID.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only).
+     * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member of this workspace (`NOT_A_MEMBER`), or lacks `workspace.apikey.read`.
+     * @throws {NotFoundError} 404 NOT_FOUND, PAK_NOT_FOUND: Workspace not found, or PAK not found in this workspace (`PAK_NOT_FOUND`).
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see GET /v1/workspaces/{workspace_slug}/api-keys/{id}
+     * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces-workspace-slug-api-keys-id
+     * @example
+     * ```ts
+     * const publicApiKey = await platform.workspaces.apiKeys.retrieve("workspace", "5d1e2f3a-4b5c-4d6e-8f70-8192a3b4c5d6");
+     * ```
+     */
+    retrieve(workspaceSlug: string, id: string, options?: RequestOptions): APIPromise<WithLastResponse<PublicApiKey>>;
+    /**
+     * Mint a replacement for an existing PAK, carrying its name, description and policy bindings over. The outgoing key keeps working for `grace_hours` (24 by default) so a fleet can roll over without downtime. The plaintext `token` is returned ONCE. Cookie/JWT only — a PAK cannot rotate a PAK, for the same reason it cannot mint one.
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param id - Id of the api key.
+     * @param params - `PlatformAuth.WorkspaceApiKeyRotateParams`.
+     * @param options - Per-request options.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing or invalid session, or a session that has been signed out (`SESSION_REVOKED`).
+     * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller is a PAK (`pcft_live_*`), or cannot grant one or more actions in the bindings being carried across.
+     * @throws {NotFoundError} 404 NOT_FOUND: PAK not found in this workspace.
+     * @throws {ConflictError} 409 CONFLICT, PAK_REVOKED, PAK_EXPIRED: The key is revoked (`PAK_REVOKED`), already expired (`PAK_EXPIRED`), or has no policy bindings to carry across.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see POST /v1/workspaces/{workspace_slug}/api-keys/{id}/rotate
+     * @see https://productcraft.co/docs/platform/api-reference#post-v1-workspaces-workspace-slug-api-keys-id-rotate
+     * @example
+     * ```ts
+     * const rotatePak = await platform.workspaces.apiKeys.rotate("workspace", "5d1e2f3a-4b5c-4d6e-8f70-8192a3b4c5d6", { grace_hours: 24 });
+     * ```
+     */
+    rotate(workspaceSlug: string, id: string, params?: WorkspaceApiKeyRotateParams, options?: RequestOptions): APIPromise<WithLastResponse<RotatePak>>;
+    /**
+     * Update a PAK’s name or description (does not touch bindings).
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param id - Id of the api key.
+     * @param params - `PlatformAuth.WorkspaceApiKeyUpdateParams`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, PAK_NAME_REQUIRED: `id` is not a UUID, body failed validation, or `name` is blank (`PAK_NAME_REQUIRED`).
+     * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only). Also a session that has been signed out (`SESSION_REVOKED`).
+     * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member of this workspace (`NOT_A_MEMBER`), or lacks `workspace.apikey.update`.
+     * @throws {NotFoundError} 404 NOT_FOUND, PAK_NOT_FOUND: Workspace not found, or PAK not found in this workspace (`PAK_NOT_FOUND`).
+     * @throws {ConflictError} 409 CONFLICT, PAK_REVOKED: PAK is revoked (`PAK_REVOKED`).
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see PATCH /v1/workspaces/{workspace_slug}/api-keys/{id}
+     * @see https://productcraft.co/docs/platform/api-reference#patch-v1-workspaces-workspace-slug-api-keys-id
+     * @example
+     * ```ts
+     * const publicApiKey = await platform.workspaces.apiKeys.update("workspace", "5d1e2f3a-4b5c-4d6e-8f70-8192a3b4c5d6", { description: "string" });
+     * ```
+     */
+    update(workspaceSlug: string, id: string, params?: WorkspaceApiKeyUpdateParams, options?: RequestOptions): APIPromise<WithLastResponse<PublicApiKey>>;
+    /**
+     * Replace the managed-policy bindings on a PAK. Re-runs caller-narrowing on the merged union of statements.
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param id - Id of the api key.
+     * @param params - `PlatformAuth.WorkspaceApiKeyUpdateBindingsParams`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: One of: bound > 25 policies; merged > 200 statements; one of the policy ids does not exist or lives in a different workspace.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing or invalid session, or a session that has been signed out (`SESSION_REVOKED`).
+     * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller cannot grant one or more actions in the merged statement set.
+     * @throws {NotFoundError} 404 NOT_FOUND: PAK not found in this workspace.
+     * @throws {ConflictError} 409 CONFLICT: Empty bindings — revoke the PAK instead of leaving it unbound.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see PATCH /v1/workspaces/{workspace_slug}/api-keys/{id}/bindings
+     * @see https://productcraft.co/docs/platform/api-reference#patch-v1-workspaces-workspace-slug-api-keys-id-bindings
+     * @example
+     * ```ts
+     * const publicApiKey = await platform.workspaces.apiKeys.updateBindings("workspace", "5d1e2f3a-4b5c-4d6e-8f70-8192a3b4c5d6", { policy_ids: ["string"] });
+     * ```
+     */
+    updateBindings(workspaceSlug: string, id: string, params: WorkspaceApiKeyUpdateBindingsParams, options?: RequestOptions): APIPromise<WithLastResponse<PublicApiKey>>;
+}
+/** `workspaces.auditFeed` */
+declare class WorkspacesAuditFeedResource extends APIResource {
+    /**
+     * Unified workspace audit feed (cursor-paginated)
+     *
+     * Audit timeline for workspace-scoped events — workspace, member, role, invite, service-activation, PAK and OAuth-consent mutations, plus successful sign-ins and completed password resets. Per-app Auth rows are NOT merged in: they live in another database with no cursor that spans both, and they are served by `GET /v1/apps/:appId/audit-logs` (paginated), `.../audit-logs/export` (streamed) and the per-app audit sink. The `sources` field reports that explicitly rather than implying a pending follow-up.
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param params - `PlatformAuth.WorkspaceAuditFeedListParams`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid query params — `actor_id` is not a well-formed UUID, or `cursor` is not a cursor this endpoint minted. `since`/`until` that do not parse as ISO-8601 are ignored rather than rejected, and `sources` silently drops unknown names; an empty result set after those filters still returns 200.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
+     * @throws {PermissionDeniedError} 403 FORBIDDEN: The caller is signed in but lacks `workspace.audit.read` for this workspace.
+     * @throws {NotFoundError} 404 NOT_FOUND: The `:workspaceSlug` path param does not resolve to a workspace the caller can see.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see GET /v1/workspaces/{workspace_slug}/audit-feed
+     * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces-workspace-slug-audit-feed
+     * @example
+     * ```ts
+     * for await (const auditFeed of platform.workspaces.auditFeed.list("workspace")) {
+     *   console.log(auditFeed);
+     * }
+     * const page = await platform.workspaces.auditFeed.list("workspace", {}, { timeout: 5_000 });
+     * ```
+     */
+    list(workspaceSlug: string, params?: WorkspaceAuditFeedListParams, options?: RequestOptions): PagePromise<FeedItem>;
+}
+/** `workspaces.auditLogs` */
+declare class WorkspacesAuditLogsResource extends APIResource {
+    /**
+     * Stream the workspace audit log as NDJSON or CSV, applying the same `?action=` / `?actor_id=` / `?since=` / `?until=` filters as the list. Newest first. Reading the export is itself audited.
+     *
+     * The response is streamed: rows are walked in keyset batches and written as they are read, so neither the service nor the client holds the whole log. This is the SOC 2 / GDPR export the platform docs promise. Hard cap of 1,000,000 rows per call; a wider request is refused with 413 before any body is written, so a truncated file can never masquerade as a complete one.
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param params - `PlatformAuth.WorkspaceAuditLogExportParams`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Unknown `format`, or malformed `since` / `until`.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
+     * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller lacks `workspace.audit.read`.
+     * @throws {NotFoundError} 404 NOT_FOUND: Workspace not found.
+     * @throws {APIError} 413 PAYLOAD_TOO_LARGE: More than 1,000,000 rows match. Narrow the window with `since` / `until` and retry.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see GET /v1/workspaces/{workspace_slug}/audit-logs/export
+     * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces-workspace-slug-audit-logs-export
+     * @example
+     * ```ts
+     * const response = await platform.workspaces.auditLogs.export("workspace");
+     * const text = await response.text();
+     * ```
+     */
+    export(workspaceSlug: string, params?: WorkspaceAuditLogExportParams, options?: RequestOptions): APIPromise<Response>;
+    /**
+     * List workspace audit log entries, newest first. Filter by `?action=`, `?actor_id=`, and/or the `?since=` / `?until=` date range. 20/page (max 100), cursor-paginated.
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param params - `PlatformAuth.WorkspaceAuditLogListParams`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`, `since`, or `until`.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see GET /v1/workspaces/{workspace_slug}/audit-logs
+     * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces-workspace-slug-audit-logs
+     * @example
+     * ```ts
+     * for await (const auditLog of platform.workspaces.auditLogs.list("workspace")) {
+     *   console.log(auditLog);
+     * }
+     * const page = await platform.workspaces.auditLogs.list("workspace", {}, { timeout: 5_000 });
+     * ```
+     */
+    list(workspaceSlug: string, params?: WorkspaceAuditLogListParams, options?: RequestOptions): PagePromise<WorkspaceAuditLogEntry>;
+}
+/** `workspaces.avatar` */
+declare class WorkspacesAvatarResource extends APIResource {
+    /**
+     * Clear the workspace avatar and delete the stored object. Gated by `workspace.settings.update`.
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param options - Per-request options.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid session.
+     * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member of this workspace (`NOT_A_MEMBER`), or lacks `workspace.settings.update`.
+     * @throws {NotFoundError} 404 NOT_FOUND: Workspace not found (unknown slug or id).
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see DELETE /v1/workspaces/{workspace_slug}/avatar
+     * @see https://productcraft.co/docs/platform/api-reference#delete-v1-workspaces-workspace-slug-avatar
+     * @example
+     * ```ts
+     * await platform.workspaces.avatar.clear("workspace");
+     * ```
+     */
+    clear(workspaceSlug: string, options?: RequestOptions): APIPromise<void>;
+    /**
+     * Upload (or replace) the workspace identity avatar. Gated by `workspace.settings.update` (owner + admin). PNG/JPEG/WEBP only, ≤2 MB, magic-byte sniffed. SVG is rejected (stored-XSS).
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param params - `PlatformAuth.WorkspaceAvatarUploadParams`.
+     * @param options - Per-request options.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
+     * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller is not a member of this workspace, or lacks workspace.settings.update.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see POST /v1/workspaces/{workspace_slug}/avatar
+     * @see https://productcraft.co/docs/platform/api-reference#post-v1-workspaces-workspace-slug-avatar
+     * @example
+     * ```ts
+     * const workspaceAvatarUrl = await platform.workspaces.avatar.upload("workspace", { file: new File(["…"], "image.png", { type: "image/png" }) });
+     * ```
+     */
+    upload(workspaceSlug: string, params: WorkspaceAvatarUploadParams, options?: RequestOptions): APIPromise<WithLastResponse<WorkspaceAvatarUrl>>;
+}
+/** `workspaces.invites` */
+declare class WorkspacesInvitesResource extends APIResource {
+    /**
+     * Accept a workspace invite by code. Cookie/JWT only — invite acceptance binds a human identity to a workspace.
+     *
+     * @param params - `PlatformAuth.WorkspaceInviteAcceptParams`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Body failed validation (`code` missing or empty).
+     * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing or invalid session. Also a session that has been signed out (`SESSION_REVOKED`).
+     * @throws {PermissionDeniedError} 403 FORBIDDEN, EMAIL_NOT_VERIFIED, INVITE_EMAIL_MISMATCH: Caller is a PAK (`pcft_live_*`), email not verified (`EMAIL_NOT_VERIFIED`), or the invite is restricted to a different email (`INVITE_EMAIL_MISMATCH`).
+     * @throws {NotFoundError} 404 NOT_FOUND, INVITE_INVALID: Invite code not found (`INVITE_INVALID`).
+     * @throws {ConflictError} 409 CONFLICT, ALREADY_A_MEMBER: Caller is already a member of this workspace (`ALREADY_A_MEMBER`).
+     * @throws {APIError} 410 GONE, INVITE_REVOKED, INVITE_EXPIRED, INVITE_EXHAUSTED: Invite revoked (`INVITE_REVOKED`), expired (`INVITE_EXPIRED`) or out of uses (`INVITE_EXHAUSTED`).
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: more than 10 requests/min from this IP (strict `auth` bucket). `Retry-After` header set. Per-IP limit: rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see POST /v1/workspaces/invites/accept
+     * @see https://productcraft.co/docs/platform/api-reference#post-v1-workspaces-invites-accept
+     * @example
+     * ```ts
+     * const workspace = await platform.workspaces.invites.accept({ code: "inv_…" });
+     * ```
+     */
+    accept(params: WorkspaceInviteAcceptParams, options?: RequestOptions): APIPromise<WithLastResponse<Workspace>>;
+    /**
+     * Create a workspace invite link. Cookie/JWT only — invites bring new humans into the workspace.
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param params - `PlatformAuth.WorkspaceInviteCreateParams`.
+     * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Body failed validation.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing or invalid session. Also a session that has been signed out (`SESSION_REVOKED`).
+     * @throws {PermissionDeniedError} 403 FORBIDDEN, EMAIL_NOT_VERIFIED, NOT_A_MEMBER, OWNER_ROLE_REQUIRED, MEMBER_RANK_EXCEEDED: Caller is a PAK (`pcft_live_*`), email not verified (`EMAIL_NOT_VERIFIED`), not a member (`NOT_A_MEMBER`), lacks `workspace.member.invite`, a non-owner tried to invite an owner (`OWNER_ROLE_REQUIRED`), or the role holds permissions the caller does not (`MEMBER_RANK_EXCEEDED`).
+     * @throws {NotFoundError} 404 NOT_FOUND, ROLE_NOT_FOUND: Workspace not found, or role not found in this workspace (`ROLE_NOT_FOUND`).
+     * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see POST /v1/workspaces/{workspace_slug}/invites
+     * @see https://productcraft.co/docs/platform/api-reference#post-v1-workspaces-workspace-slug-invites
+     * @example
+     * ```ts
+     * const workspaceInvite = await platform.workspaces.invites.create("workspace", { email: "alice@example.com" });
+     * ```
+     */
+    create(workspaceSlug: string, params?: WorkspaceInviteCreateParams, options?: RequestOptions): APIPromise<WithLastResponse<WorkspaceInvite>>;
+    /**
+     * Revoke a workspace invite. Cookie/JWT only.
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param inviteId - Id of the invite.
+     * @param options - Per-request options.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing or invalid session. Also a session that has been signed out (`SESSION_REVOKED`).
+     * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is a PAK (`pcft_live_*`), not a member of the invite’s workspace (`NOT_A_MEMBER`), or lacks `workspace.member.invite`.
+     * @throws {NotFoundError} 404 NOT_FOUND, INVITE_NOT_FOUND: Workspace not found, or invite not found (`INVITE_NOT_FOUND`).
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see DELETE /v1/workspaces/{workspace_slug}/invites/{invite_id}
+     * @see https://productcraft.co/docs/platform/api-reference#delete-v1-workspaces-workspace-slug-invites-invite-id
+     * @example
+     * ```ts
+     * await platform.workspaces.invites.delete("workspace", "invite");
+     * ```
+     */
+    delete(workspaceSlug: string, inviteId: string, options?: RequestOptions): APIPromise<void>;
+    /**
+     * List workspace invites, newest first. Cursor-paginated.
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param params - `PlatformAuth.WorkspaceInviteListParams`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid session.
+     * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member of this workspace (`NOT_A_MEMBER`), or lacks `workspace.member.invite`.
+     * @throws {NotFoundError} 404 NOT_FOUND: Workspace not found (unknown slug or id).
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see GET /v1/workspaces/{workspace_slug}/invites
+     * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces-workspace-slug-invites
+     * @example
+     * ```ts
+     * for await (const invite of platform.workspaces.invites.list("workspace")) {
+     *   console.log(invite);
+     * }
+     * const page = await platform.workspaces.invites.list("workspace", {}, { timeout: 5_000 });
+     * ```
+     */
+    list(workspaceSlug: string, params?: WorkspaceInviteListParams, options?: RequestOptions): PagePromise<WorkspaceInviteListItem>;
+}
+/** `workspaces.members` */
+declare class WorkspacesMembersResource extends APIResource {
+    /**
+     * Remove a member from a workspace (or self-leave)
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param accountId - Id of the account.
+     * @param options - Per-request options.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing or invalid session. Also a session that has been signed out (`SESSION_REVOKED`).
+     * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER, MEMBER_RANK_EXCEEDED: Caller is not a member of this workspace (`NOT_A_MEMBER`), lacks `workspace.member.remove` (not required for self-leave), or the target outranks the caller (`MEMBER_RANK_EXCEEDED`: only an owner can remove an owner, and the target role's permissions must all be held by the caller).
+     * @throws {NotFoundError} 404 NOT_FOUND, NOT_A_MEMBER: Workspace not found, or target account is not a member (`NOT_A_MEMBER`).
+     * @throws {ConflictError} 409 CONFLICT, LAST_MEMBER, SOLE_OWNER: Target is the last member (`LAST_MEMBER`) or the sole owner (`SOLE_OWNER`).
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see DELETE /v1/workspaces/{workspace_slug}/members/{account_id}
+     * @see https://productcraft.co/docs/platform/api-reference#delete-v1-workspaces-workspace-slug-members-account-id
+     * @example
+     * ```ts
+     * await platform.workspaces.members.delete("workspace", "account");
+     * ```
+     */
+    delete(workspaceSlug: string, accountId: string, options?: RequestOptions): APIPromise<void>;
+    /**
+     * List workspace members, oldest join first. Narrow with `?q=` (name / username / email substring) and/or `?role=`. Cursor-paginated.
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param params - `PlatformAuth.WorkspaceMemberListParams`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid session.
+     * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member of this workspace (`NOT_A_MEMBER`), or lacks `workspace.member.read`.
+     * @throws {NotFoundError} 404 NOT_FOUND: Workspace not found (unknown slug or id).
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see GET /v1/workspaces/{workspace_slug}/members
+     * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces-workspace-slug-members
+     * @example
+     * ```ts
+     * for await (const member of platform.workspaces.members.list("workspace")) {
+     *   console.log(member);
+     * }
+     * const page = await platform.workspaces.members.list("workspace", {}, { timeout: 5_000 });
+     * ```
+     */
+    list(workspaceSlug: string, params?: WorkspaceMemberListParams, options?: RequestOptions): PagePromise<WorkspaceMember>;
+    /**
+     * Update a member's role. Body: { roleId } or { role: "owner"|"admin"|"member" }.
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param accountId - Id of the account.
+     * @param params - `PlatformAuth.WorkspaceMemberUpdateRoleParams`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Body failed validation.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing or invalid session. Also a session that has been signed out (`SESSION_REVOKED`).
+     * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER, OWNER_ROLE_REQUIRED, MEMBER_RANK_EXCEEDED: Caller is not a member of this workspace (`NOT_A_MEMBER`), lacks `workspace.member.update-role`, a non-owner tried to assign the owner role or change an owner (`OWNER_ROLE_REQUIRED`), or a non-owner tried to change a role to or from one holding permissions the caller lacks (`MEMBER_RANK_EXCEEDED`). Admins may make admins, never owners.
+     * @throws {NotFoundError} 404 NOT_FOUND, NOT_A_MEMBER, ROLE_NOT_FOUND: Workspace not found, target account is not a member (`NOT_A_MEMBER`), or role not found in this workspace (`ROLE_NOT_FOUND`).
+     * @throws {ConflictError} 409 CONFLICT, SOLE_OWNER: Would demote the only owner (`SOLE_OWNER`). Assign another owner first.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see PATCH /v1/workspaces/{workspace_slug}/members/{account_id}/role
+     * @see https://productcraft.co/docs/platform/api-reference#patch-v1-workspaces-workspace-slug-members-account-id-role
+     * @example
+     * ```ts
+     * const updateMemberRole = await platform.workspaces.members.updateRole("workspace", "account", { role: "owner" });
+     * ```
+     */
+    updateRole(workspaceSlug: string, accountId: string, params?: WorkspaceMemberUpdateRoleParams, options?: RequestOptions): APIPromise<WithLastResponse<UpdateMemberRole>>;
+}
+/** `workspaces.policies.actions` */
+declare class WorkspacesPoliciesActionsResource extends APIResource {
+    /**
+     * List every known workspace action (catalog of statement actions).
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param options - Per-request options.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only).
+     * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member of this workspace (`NOT_A_MEMBER`), or lacks `workspace.policy.read`.
+     * @throws {NotFoundError} 404 NOT_FOUND: Workspace not found (unknown slug or id).
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see GET /v1/workspaces/{workspace_slug}/policies/actions/catalog
+     * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces-workspace-slug-policies-actions-catalog
+     * @example
+     * ```ts
+     * const workspaceActionCatalog = await platform.workspaces.policies.actions.catalog("workspace");
+     * ```
+     */
+    catalog(workspaceSlug: string, options?: RequestOptions): APIPromise<WithLastResponse<WorkspaceActionCatalog>>;
+}
+/** `workspaces.policies` */
+declare class WorkspacesPoliciesResource extends APIResource {
+    #private;
+    get actions(): WorkspacesPoliciesActionsResource;
+    /**
+     * Create a managed policy. Cookie/JWT only — policy authoring is a human-admin surface.
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param params - `PlatformAuth.WorkspacePolicyCreateParams`.
+     * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid policy shape, name, or condition block.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing or invalid session, or a session that has been signed out (`SESSION_REVOKED`).
+     * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member (`NOT_A_MEMBER`), lacks `workspace.policy.create` (owner and admin hold it by default), or the policy grants an action the caller does not hold.
+     * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Name already in use, or the workspace already has 100 policies. Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see POST /v1/workspaces/{workspace_slug}/policies
+     * @see https://productcraft.co/docs/platform/api-reference#post-v1-workspaces-workspace-slug-policies
+     * @example
+     * ```ts
+     * const managedPolicy = await platform.workspaces.policies.create("workspace", {
+     *   name: "mail-readonly",
+     *   policy: [{ actions: ["mail.read", "mail.list"], effect: "allow", resources: ["*"] }],
+     * });
+     * ```
+     */
+    create(workspaceSlug: string, params: WorkspacePolicyCreateParams, options?: RequestOptions): APIPromise<WithLastResponse<ManagedPolicy>>;
+    /**
+     * Delete a managed policy. Cascades: API keys lose the binding (deny-all if no other bindings remain); roles fall back to their inline policy column. Owners and admins; a policy bound to a role, or a preset policy, only an owner can delete. Cookie/JWT only.
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param policyId - Id of the policy.
+     * @param options - Per-request options.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing or invalid session, or a session that has been signed out (`SESSION_REVOKED`).
+     * @throws {PermissionDeniedError} 403 FORBIDDEN, OWNER_ROLE_REQUIRED: Caller lacks `workspace.policy.delete`, or is not an owner and the policy is bound to a role or is a preset policy (`OWNER_ROLE_REQUIRED`).
+     * @throws {NotFoundError} 404 NOT_FOUND, POLICY_NOT_FOUND: Policy not found in this workspace (`POLICY_NOT_FOUND`).
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see DELETE /v1/workspaces/{workspace_slug}/policies/{policy_id}
+     * @see https://productcraft.co/docs/platform/api-reference#delete-v1-workspaces-workspace-slug-policies-policy-id
+     * @example
+     * ```ts
+     * const managedPolicyDeleted = await platform.workspaces.policies.delete("workspace", "5d1e2f3a-4b5c-4d6e-8f70-8192a3b4c5d6");
+     * ```
+     */
+    delete(workspaceSlug: string, policyId: string, options?: RequestOptions): APIPromise<WithLastResponse<ManagedPolicyDeleted>>;
+    /**
+     * List managed policies in a workspace, alphabetically. 20/page (max 100), cursor-paginated.
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param params - `PlatformAuth.WorkspacePolicyListParams`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see GET /v1/workspaces/{workspace_slug}/policies
+     * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces-workspace-slug-policies
+     * @example
+     * ```ts
+     * for await (const policy of platform.workspaces.policies.list("workspace")) {
+     *   console.log(policy);
+     * }
+     * const page = await platform.workspaces.policies.list("workspace", {}, { timeout: 5_000 });
+     * ```
+     */
+    list(workspaceSlug: string, params?: WorkspacePolicyListParams, options?: RequestOptions): PagePromise<ManagedPolicy>;
+    /**
+     * Get a managed policy by id
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param policyId - Id of the policy.
+     * @param options - Per-request options.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
+     * @throws {NotFoundError} 404 NOT_FOUND: Policy not found in this workspace.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see GET /v1/workspaces/{workspace_slug}/policies/{policy_id}
+     * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces-workspace-slug-policies-policy-id
+     * @example
+     * ```ts
+     * const managedPolicyDetail = await platform.workspaces.policies.retrieve("workspace", "5d1e2f3a-4b5c-4d6e-8f70-8192a3b4c5d6");
+     * ```
+     */
+    retrieve(workspaceSlug: string, policyId: string, options?: RequestOptions): APIPromise<WithLastResponse<ManagedPolicyDetail>>;
+    /**
+     * Update a managed policy. Owners and admins; a policy bound to a role, or a preset policy, only an owner can edit. Cookie/JWT only — policy authoring is a human-admin surface.
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param policyId - Id of the policy.
+     * @param params - `PlatformAuth.WorkspacePolicyUpdateParams`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid policy shape, name, or condition block.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing or invalid session, or a session that has been signed out (`SESSION_REVOKED`).
+     * @throws {PermissionDeniedError} 403 FORBIDDEN, OWNER_ROLE_REQUIRED: Caller lacks `workspace.policy.update`, cannot grant one or more requested actions, or is not an owner and the policy is bound to a role or is a preset policy (`OWNER_ROLE_REQUIRED`).
+     * @throws {NotFoundError} 404 NOT_FOUND, POLICY_NOT_FOUND: Policy not found in this workspace (`POLICY_NOT_FOUND`).
+     * @throws {ConflictError} 409 CONFLICT, POLICY_NAME_TAKEN: Name already in use (`POLICY_NAME_TAKEN`).
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see PATCH /v1/workspaces/{workspace_slug}/policies/{policy_id}
+     * @see https://productcraft.co/docs/platform/api-reference#patch-v1-workspaces-workspace-slug-policies-policy-id
+     * @example
+     * ```ts
+     * const managedPolicyDetail = await platform.workspaces.policies.update("workspace", "5d1e2f3a-4b5c-4d6e-8f70-8192a3b4c5d6", { description: "Read-only access to all Mail resources" });
+     * ```
+     */
+    update(workspaceSlug: string, policyId: string, params?: WorkspacePolicyUpdateParams, options?: RequestOptions): APIPromise<WithLastResponse<ManagedPolicyDetail>>;
+}
+/** `workspaces.roles` */
+declare class WorkspacesRolesResource extends APIResource {
+    /**
+     * Create a new custom role. Cookie/JWT only — role authoring is a human-admin surface.
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param params - `PlatformAuth.WorkspaceRoleCreateParams`.
+     * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, POLICY_INVALID: Body failed validation, invalid role name, malformed policy, both `policy_id` and `policy` sent, or an action pattern matches no known permission (`POLICY_INVALID`).
+     * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only). Also a session that has been signed out (`SESSION_REVOKED`).
+     * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER, ACTIONS_NOT_GRANTABLE: Caller is not a member of this workspace (`NOT_A_MEMBER`), lacks `workspace.role.create`, or the policy grants actions the caller does not hold (`ACTIONS_NOT_GRANTABLE`).
+     * @throws {NotFoundError} 404 NOT_FOUND, POLICY_NOT_FOUND: Workspace not found, or `policy_id` not found in this workspace (`POLICY_NOT_FOUND`).
+     * @throws {ConflictError} 409 CONFLICT, ROLE_NAME_TAKEN, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Role name already in use or reserved for a system role (`ROLE_NAME_TAKEN`). Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see POST /v1/workspaces/{workspace_slug}/roles
+     * @see https://productcraft.co/docs/platform/api-reference#post-v1-workspaces-workspace-slug-roles
+     * @example
+     * ```ts
+     * const workspaceRole = await platform.workspaces.roles.create("workspace", { name: "BillingAdmin" });
+     * ```
+     */
+    create(workspaceSlug: string, params: WorkspaceRoleCreateParams, options?: RequestOptions): APIPromise<WithLastResponse<WorkspaceRole>>;
+    /**
+     * Delete a custom role (fails if it has members). Cookie/JWT only — role authoring is a human-admin surface.
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param roleId - Id of the role.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `roleId` is not a UUID.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only). Also a session that has been signed out (`SESSION_REVOKED`).
+     * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member of this workspace (`NOT_A_MEMBER`), or lacks `workspace.role.delete`.
+     * @throws {NotFoundError} 404 NOT_FOUND, ROLE_NOT_FOUND: Workspace not found, or role not found in this workspace (`ROLE_NOT_FOUND`).
+     * @throws {ConflictError} 409 CONFLICT, ROLE_SYSTEM_IMMUTABLE, ROLE_HAS_MEMBERS: Role is a system role (`ROLE_SYSTEM_IMMUTABLE`) or still has members (`ROLE_HAS_MEMBERS`).
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see DELETE /v1/workspaces/{workspace_slug}/roles/{role_id}
+     * @see https://productcraft.co/docs/platform/api-reference#delete-v1-workspaces-workspace-slug-roles-role-id
+     * @example
+     * ```ts
+     * await platform.workspaces.roles.delete("workspace", "5d1e2f3a-4b5c-4d6e-8f70-8192a3b4c5d6");
+     * ```
+     */
+    delete(workspaceSlug: string, roleId: string, options?: RequestOptions): APIPromise<void>;
+    /**
+     * List roles in a workspace. System roles first, then alphabetical. 20/page (max 100), cursor-paginated.
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param params - `PlatformAuth.WorkspaceRoleListParams`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see GET /v1/workspaces/{workspace_slug}/roles
+     * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces-workspace-slug-roles
+     * @example
+     * ```ts
+     * for await (const role of platform.workspaces.roles.list("workspace")) {
+     *   console.log(role);
+     * }
+     * const page = await platform.workspaces.roles.list("workspace", {}, { timeout: 5_000 });
+     * ```
+     */
+    list(workspaceSlug: string, params?: WorkspaceRoleListParams, options?: RequestOptions): PagePromise<WorkspaceRole>;
+    /**
+     * Get a role + its permissions
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param roleId - Id of the role.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `roleId` is not a UUID.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only).
+     * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member of this workspace (`NOT_A_MEMBER`), or lacks `workspace.role.read`.
+     * @throws {NotFoundError} 404 NOT_FOUND, ROLE_NOT_FOUND: Workspace not found, or role not found in this workspace (`ROLE_NOT_FOUND`).
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see GET /v1/workspaces/{workspace_slug}/roles/{role_id}
+     * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces-workspace-slug-roles-role-id
+     * @example
+     * ```ts
+     * const workspaceRole = await platform.workspaces.roles.retrieve("workspace", "5d1e2f3a-4b5c-4d6e-8f70-8192a3b4c5d6");
+     * ```
+     */
+    retrieve(workspaceSlug: string, roleId: string, options?: RequestOptions): APIPromise<WithLastResponse<WorkspaceRole>>;
+    /**
+     * Update a role or replace its permission set. Cookie/JWT only — role authoring is a human-admin surface.
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param roleId - Id of the role.
+     * @param params - `PlatformAuth.WorkspaceRoleUpdateParams`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: `roleId` is not a UUID, body failed validation, malformed policy, both `policy_id` and `policy` sent, or an action pattern matches no known permission.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only). Also a session that has been signed out (`SESSION_REVOKED`).
+     * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER, ACTIONS_NOT_GRANTABLE: Caller is not a member of this workspace (`NOT_A_MEMBER`), lacks `workspace.role.update`, or the policy grants actions the caller does not hold (`ACTIONS_NOT_GRANTABLE`).
+     * @throws {NotFoundError} 404 NOT_FOUND, ROLE_NOT_FOUND, POLICY_NOT_FOUND: Workspace, role (`ROLE_NOT_FOUND`) or bound policy (`POLICY_NOT_FOUND`) not found in this workspace.
+     * @throws {ConflictError} 409 CONFLICT, ROLE_SYSTEM_IMMUTABLE, ROLE_NAME_TAKEN: System roles cannot be renamed, edited or bound (`ROLE_SYSTEM_IMMUTABLE`), or the new name is taken (`ROLE_NAME_TAKEN`).
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see PATCH /v1/workspaces/{workspace_slug}/roles/{role_id}
+     * @see https://productcraft.co/docs/platform/api-reference#patch-v1-workspaces-workspace-slug-roles-role-id
+     * @example
+     * ```ts
+     * const workspaceRole = await platform.workspaces.roles.update("workspace", "5d1e2f3a-4b5c-4d6e-8f70-8192a3b4c5d6", { description: "string" });
+     * ```
+     */
+    update(workspaceSlug: string, roleId: string, params?: WorkspaceRoleUpdateParams, options?: RequestOptions): APIPromise<WithLastResponse<WorkspaceRole>>;
+}
+/** `workspaces.services` */
+declare class WorkspacesServicesResource extends APIResource {
+    /**
+     * Disable a service (settings are retained)
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param service - The product: `auth`, `mail`, `waitlist`, `social` or `trawl`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, SERVICE_UNKNOWN: Unknown service name (`SERVICE_UNKNOWN`).
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only).
+     * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member of this workspace (`NOT_A_MEMBER`), or lacks `workspace.service.disable`.
+     * @throws {NotFoundError} 404 NOT_FOUND: Workspace not found (unknown slug or id).
+     * @throws {ConflictError} 409 CONFLICT, SERVICE_NOT_ENABLED: Service is not currently enabled (`SERVICE_NOT_ENABLED`).
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see DELETE /v1/workspaces/{workspace_slug}/services/{service}
+     * @see https://productcraft.co/docs/platform/api-reference#delete-v1-workspaces-workspace-slug-services-service
+     * @example
+     * ```ts
+     * await platform.workspaces.services.disable("workspace", "service");
+     * ```
+     */
+    disable(workspaceSlug: string, service: string, options?: RequestOptions): APIPromise<void>;
+    /**
+     * Enable (or re-enable) a service for this workspace
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param service - The product: `auth`, `mail`, `waitlist`, `social` or `trawl`.
+     * @param params - `PlatformAuth.WorkspaceServiceEnableParams`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, SERVICE_UNKNOWN: Unknown service name (`SERVICE_UNKNOWN`) or body failed validation.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only).
+     * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member of this workspace (`NOT_A_MEMBER`), or lacks `workspace.service.enable`.
+     * @throws {NotFoundError} 404 NOT_FOUND: Workspace not found (unknown slug or id).
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see POST /v1/workspaces/{workspace_slug}/services/{service}
+     * @see https://productcraft.co/docs/platform/api-reference#post-v1-workspaces-workspace-slug-services-service
+     * @example
+     * ```ts
+     * const workspaceServiceState = await platform.workspaces.services.enable("workspace", "service", { settings: {} });
+     * ```
+     */
+    enable(workspaceSlug: string, service: string, params?: WorkspaceServiceEnableParams, options?: RequestOptions): APIPromise<WithLastResponse<WorkspaceServiceState>>;
+    /**
+     * List services activated on this workspace. Complete — one row per product, not paginated.
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param options - Per-request options.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only).
+     * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member of this workspace (`NOT_A_MEMBER`), or lacks `workspace.service.read`.
+     * @throws {NotFoundError} 404 NOT_FOUND: Workspace not found (unknown slug or id).
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see GET /v1/workspaces/{workspace_slug}/services
+     * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces-workspace-slug-services
+     * @example
+     * ```ts
+     * const listWorkspaceServices = await platform.workspaces.services.list("workspace");
+     * ```
+     */
+    list(workspaceSlug: string, options?: RequestOptions): APIPromise<WithLastResponse<ListWorkspaceServices>>;
+    /**
+     * Replace the settings jsonb for an active service
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param service - The product: `auth`, `mail`, `waitlist`, `social` or `trawl`.
+     * @param params - `PlatformAuth.WorkspaceServiceUpdateSettingsParams`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR, SERVICE_UNKNOWN: Unknown service name (`SERVICE_UNKNOWN`).
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, malformed or invalid session, or a PAK bearer (this route accepts cookie/JWT sessions only).
+     * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member of this workspace (`NOT_A_MEMBER`), or lacks `workspace.service.enable`.
+     * @throws {NotFoundError} 404 NOT_FOUND, SERVICE_NOT_ACTIVATED: Workspace not found, or the service was never activated on it (`SERVICE_NOT_ACTIVATED`).
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see PATCH /v1/workspaces/{workspace_slug}/services/{service}/settings
+     * @see https://productcraft.co/docs/platform/api-reference#patch-v1-workspaces-workspace-slug-services-service-settings
+     * @example
+     * ```ts
+     * const workspaceServiceState = await platform.workspaces.services.updateSettings("workspace", "service", { default_sender: "noreply@acme.com" });
+     * ```
+     */
+    updateSettings(workspaceSlug: string, service: string, params?: WorkspaceServiceUpdateSettingsParams, options?: RequestOptions): APIPromise<WithLastResponse<WorkspaceServiceState>>;
+}
+/** `workspaces` */
+declare class WorkspacesResource extends APIResource {
+    #private;
+    get apiKeys(): WorkspacesApiKeysResource;
+    get auditFeed(): WorkspacesAuditFeedResource;
+    get auditLogs(): WorkspacesAuditLogsResource;
+    get avatar(): WorkspacesAvatarResource;
+    get invites(): WorkspacesInvitesResource;
+    get members(): WorkspacesMembersResource;
+    get policies(): WorkspacesPoliciesResource;
+    get roles(): WorkspacesRolesResource;
+    get services(): WorkspacesServicesResource;
+    /**
+     * Create a new workspace. Cookie/JWT only — PAKs are workspace-scoped credentials and cannot create new workspaces.
+     *
+     * @param params - `PlatformAuth.WorkspaceCreateParams`.
+     * @param options - Per-request options (an Idempotency-Key is sent automatically; override with `idempotencyKey`).
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
+     * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller is a PAK (`pcft_live_*`). Workspace creation requires a human-issued session.
+     * @throws {ConflictError} 409 CONFLICT, IDEMPOTENCY_KEY_REUSE, IDEMPOTENCY_IN_PROGRESS: Idempotency: `IDEMPOTENCY_KEY_REUSE` when this `Idempotency-Key` was already used with a different body or route; `IDEMPOTENCY_IN_PROGRESS` while another request with the same key is still running (retry after `Retry-After` seconds, with the same key).
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see POST /v1/workspaces
+     * @see https://productcraft.co/docs/platform/api-reference#post-v1-workspaces
+     * @example
+     * ```ts
+     * const workspace = await platform.workspaces.create({ display_name: "Acme Corp", slug: "acme-corp" });
+     * ```
+     */
+    create(params: WorkspaceCreateParams, options?: RequestOptions): APIPromise<WithLastResponse<Workspace>>;
+    /**
+     * Delete a workspace (requires workspace.delete). Cookie/JWT only — irreversible workspace destruction needs a human-attributed audit row.
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param options - Per-request options.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED, SESSION_REVOKED: Missing or invalid session, or a session that has been signed out (`SESSION_REVOKED`).
+     * @throws {PermissionDeniedError} 403 FORBIDDEN: Caller is a PAK (`pcft_live_*`). Workspace deletion requires a human-issued session.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see DELETE /v1/workspaces/{workspace_slug}
+     * @see https://productcraft.co/docs/platform/api-reference#delete-v1-workspaces-workspace-slug
+     * @example
+     * ```ts
+     * await platform.workspaces.delete("workspace");
+     * ```
+     */
+    delete(workspaceSlug: string, options?: RequestOptions): APIPromise<void>;
+    /**
+     * List workspaces the current user belongs to
+     *
+     * @param params - `PlatformAuth.WorkspaceListParams`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Malformed `cursor`.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid session.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see GET /v1/workspaces
+     * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces
+     * @example
+     * ```ts
+     * for await (const workspace of platform.workspaces.list()) {
+     *   console.log(workspace);
+     * }
+     * const page = await platform.workspaces.list({}, { timeout: 5_000 });
+     * ```
+     */
+    list(params?: WorkspaceListParams, options?: RequestOptions): PagePromise<WorkspaceListItem>;
+    /**
+     * Get workspace details
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param options - Per-request options.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing or invalid session.
+     * @throws {PermissionDeniedError} 403 FORBIDDEN, NOT_A_MEMBER: Caller is not a member of this workspace (`NOT_A_MEMBER`).
+     * @throws {NotFoundError} 404 NOT_FOUND: Workspace not found (unknown slug or id).
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see GET /v1/workspaces/{workspace_slug}
+     * @see https://productcraft.co/docs/platform/api-reference#get-v1-workspaces-workspace-slug
+     * @example
+     * ```ts
+     * const workspace = await platform.workspaces.retrieve("workspace");
+     * ```
+     */
+    retrieve(workspaceSlug: string, options?: RequestOptions): APIPromise<WithLastResponse<Workspace>>;
+    /**
+     * Update workspace display name, slug, or settings. Slug renames broadcast a `workspace.renamed` event so denormalised consumers (waitlist-api) sync.
+     *
+     * @param workspaceSlug - Slug of the workspace. Platform routes name the workspace by slug, positionally in the SDK (`platform.workspaces.retrieve("acme")`); the product APIs bind `workspace_id` instead.
+     * @param params - `PlatformAuth.WorkspaceUpdateParams`.
+     * @param options - Per-request options.
+     * @throws {BadRequestError} 400 BAD_REQUEST, VALIDATION_ERROR: Invalid slug or display name.
+     * @throws {AuthenticationError} 401 UNAUTHORIZED: Missing, invalid or expired bearer token.
+     * @throws {NotFoundError} 404 NOT_FOUND: Workspace not found.
+     * @throws {ConflictError} 409 CONFLICT: Slug already taken by another workspace.
+     * @throws {RateLimitError} 429 RATE_LIMITED: Rate limited: too many requests from this client IP in the last 60 seconds (`RATE_LIMITED`); wait `Retry-After` seconds.
+     * @see PATCH /v1/workspaces/{workspace_slug}
+     * @see https://productcraft.co/docs/platform/api-reference#patch-v1-workspaces-workspace-slug
+     * @example
+     * ```ts
+     * const workspace = await platform.workspaces.update("workspace", { display_name: "string" });
+     * ```
+     */
+    update(workspaceSlug: string, params?: WorkspaceUpdateParams, options?: RequestOptions): APIPromise<WithLastResponse<Workspace>>;
+}
+/** `platform` */
+declare class PlatformAuthResources extends APIResource {
+    #private;
+    get account(): AccountResource;
+    get apiKeys(): ApiKeysResource;
+    get auth(): AuthResource;
+    get introspect(): IntrospectResource;
+    get me(): MeResource;
+    get oauth(): OauthResource;
+    get sessions(): SessionsResource;
+    get stats(): StatsResource;
+    get verification(): VerificationResource;
+    get wellKnown(): WellKnownResource;
+    get workspaces(): WorkspacesResource;
+}
+
+type __RequestOptions = RequestOptions;
+type __PollOptions = PollOptions;
+type __ApiKeyPresetKey = ApiKeyPresetKey;
+type __ApiKeyStatus = ApiKeyStatus;
+type __AuditActorType = AuditActorType;
+type __AuditFeedSource = AuditFeedSource;
+type __McpProduct = McpProduct;
+type __PolicyEffect = PolicyEffect;
+type __StatsGranularity = StatsGranularity;
+type __StatsMetric = StatsMetric;
+type __StatsWindow = StatsWindow;
+type __ApiKeySelf = ApiKeySelf;
+type __ApiKeySelfWorkspace = ApiKeySelfWorkspace;
+type __AuditFeed = AuditFeed;
+type __AuthorizationServerMetadata = AuthorizationServerMetadata;
+type __AvatarUrl = AvatarUrl;
+type __BoundPolicySummary = BoundPolicySummary;
+type __ConnectedClient = ConnectedClient;
+type __ConnectedClientList = ConnectedClientList;
+type __FeedItem = FeedItem;
+type __Feedback = Feedback;
+type __HiddenGuide = HiddenGuide;
+type __HiddenGuides = HiddenGuides;
+type __IntrospectAccount = IntrospectAccount;
+type __IntrospectApiKey = IntrospectApiKey;
+type __IntrospectPrincipal = IntrospectPrincipal;
+type __Introspect = Introspect;
+type __IntrospectRole = IntrospectRole;
+type __IntrospectWorkspaceListItem = IntrospectWorkspaceListItem;
+type __IntrospectWorkspace = IntrospectWorkspace;
+type __Jwk = Jwk;
+type __Jwks = Jwks;
+type __ListManagedPolicies = ListManagedPolicies;
+type __ListPakPresets = ListPakPresets;
+type __ListPlatformApiKeys = ListPlatformApiKeys;
+type __ListWorkspaceAuditLogs = ListWorkspaceAuditLogs;
+type __ListWorkspaceInvites = ListWorkspaceInvites;
+type __ListWorkspaceMembers = ListWorkspaceMembers;
+type __ListWorkspaceRoles = ListWorkspaceRoles;
+type __ListWorkspaceServices = ListWorkspaceServices;
+type __ListWorkspaces = ListWorkspaces;
+type __ManagedPolicyDeleted = ManagedPolicyDeleted;
+type __ManagedPolicyDetail = ManagedPolicyDetail;
+type __ManagedPolicy = ManagedPolicy;
+type __MeProfile = MeProfile;
+type __MintPak = MintPak;
+type __Pagination = Pagination;
+type __PakGrantPreview = PakGrantPreview;
+type __PakPreset = PakPreset;
+type __PolicyBindingCount = PolicyBindingCount;
+type __PolicyStatement = PolicyStatement;
+type __PublicApiKey = PublicApiKey;
+type __RevokeOtherSessions = RevokeOtherSessions;
+type __RevokeSession = RevokeSession;
+type __RotatePak = RotatePak;
+type __Session = Session;
+type __SourceDiagnostic = SourceDiagnostic;
+type __StatsSeriesPoint = StatsSeriesPoint;
+type __Token = Token;
+type __UpdateMemberRole = UpdateMemberRole;
+type __WorkspaceActionCatalog = WorkspaceActionCatalog;
+type __WorkspaceAuditLogEntry = WorkspaceAuditLogEntry;
+type __WorkspaceAvatarUrl = WorkspaceAvatarUrl;
+type __WorkspaceInviteListItem = WorkspaceInviteListItem;
+type __WorkspaceInvite = WorkspaceInvite;
+type __WorkspaceListItem = WorkspaceListItem;
+type __WorkspaceMember = WorkspaceMember;
+type __Workspace = Workspace;
+type __WorkspaceRole = WorkspaceRole;
+type __WorkspaceServiceState = WorkspaceServiceState;
+type __WorkspaceStats = WorkspaceStats;
+type __WorkspaceStatsInWindow = WorkspaceStatsInWindow;
+type __WorkspaceStatsSeries = WorkspaceStatsSeries;
+type __WorkspaceStatsTotals = WorkspaceStatsTotals;
+type __AuthLogoutParams = AuthLogoutParams;
+type __AuthPasswordRequestResetParams = AuthPasswordRequestResetParams;
+type __AuthPasswordResetParams = AuthPasswordResetParams;
+type __AuthRefreshParams = AuthRefreshParams;
+type __AuthSigninParams = AuthSigninParams;
+type __AuthSignupParams = AuthSignupParams;
+type __MeAvatarUploadParams = MeAvatarUploadParams;
+type __MeProfileUpdateParams = MeProfileUpdateParams;
+type __OauthConnectionListParams = OauthConnectionListParams;
+type __OauthWorkspaceConnectionListParams = OauthWorkspaceConnectionListParams;
+type __SessionListResponse = SessionListResponse;
+type __VerificationVerifyParams = VerificationVerifyParams;
+type __WorkspaceListParams = WorkspaceListParams;
+type __WorkspaceCreateParams = WorkspaceCreateParams;
+type __WorkspaceInviteAcceptParams = WorkspaceInviteAcceptParams;
+type __StatsRetrieveParams = StatsRetrieveParams;
+type __WorkspaceUpdateParams = WorkspaceUpdateParams;
+type __WorkspaceApiKeyListParams = WorkspaceApiKeyListParams;
+type __WorkspaceApiKeyCreateParams = WorkspaceApiKeyCreateParams;
+type __WorkspaceApiKeyPreviewParams = WorkspaceApiKeyPreviewParams;
+type __WorkspaceApiKeyUpdateParams = WorkspaceApiKeyUpdateParams;
+type __WorkspaceApiKeyDeleteParams = WorkspaceApiKeyDeleteParams;
+type __WorkspaceApiKeyUpdateBindingsParams = WorkspaceApiKeyUpdateBindingsParams;
+type __WorkspaceApiKeyRotateParams = WorkspaceApiKeyRotateParams;
+type __WorkspaceAuditFeedListParams = WorkspaceAuditFeedListParams;
+type __WorkspaceAuditLogListParams = WorkspaceAuditLogListParams;
+type __WorkspaceAuditLogExportParams = WorkspaceAuditLogExportParams;
+type __WorkspaceAvatarUploadParams = WorkspaceAvatarUploadParams;
+type __WorkspaceInviteListParams = WorkspaceInviteListParams;
+type __WorkspaceInviteCreateParams = WorkspaceInviteCreateParams;
+type __WorkspaceMemberListParams = WorkspaceMemberListParams;
+type __WorkspaceMemberUpdateRoleParams = WorkspaceMemberUpdateRoleParams;
+type __WorkspacePolicyListParams = WorkspacePolicyListParams;
+type __WorkspacePolicyCreateParams = WorkspacePolicyCreateParams;
+type __WorkspacePolicyUpdateParams = WorkspacePolicyUpdateParams;
+type __WorkspaceRoleListParams = WorkspaceRoleListParams;
+type __WorkspaceRoleCreateParams = WorkspaceRoleCreateParams;
+type __WorkspaceRoleUpdateParams = WorkspaceRoleUpdateParams;
+type __WorkspaceServiceEnableParams = WorkspaceServiceEnableParams;
+type __WorkspaceServiceUpdateSettingsParams = WorkspaceServiceUpdateSettingsParams;
+type __ErrorCode = PlatformAuthErrorCode;
 /**
- * PlatformAuth — typed `openapi-fetch` client for every endpoint in
- * `Specs/platform-auth.json`. Reach for `client.GET("/v1/...")` or
- * `client.POST(...)`; request / response types come from the
- * generated `paths` interface.
+ * ProductCraft Platform API client (workspaces, members, roles, policies, API keys and introspection). Every method is generated from the API's OpenAPI document.
+ *
+ * @example
+ * ```ts
+ * import { PlatformAuth } from "@productcraft/platform-auth";
+ * const platform = new PlatformAuth({ apiKey: process.env.PRODUCTCRAFT_API_KEY });
+ * ```
  */
-declare class PlatformAuth {
-    /** The underlying typed client. v0 surface — every endpoint reachable. */
-    readonly client: ReturnType<typeof makeClient<paths>>;
-    constructor(config?: PCClientConfig);
+declare class PlatformAuth extends PlatformAuthResources {
+    #private;
+    constructor(options?: ClientOptions);
+    /** The typed `openapi-fetch` escape hatch over the same credential and base URL. It does not retry. */
+    get client(): Client<paths>;
+}
+/** Public types: `PlatformAuth.ApiKeySelf`, `PlatformAuth.AuthLogoutParams`, … */
+declare namespace PlatformAuth {
+    type RequestOptions = __RequestOptions;
+    type PollOptions = __PollOptions;
+    type ApiKeyPresetKey = __ApiKeyPresetKey;
+    const ApiKeyPresetKey: {
+        values: readonly ["mail-send", "waitlist-write", "trawl-jobs", "readonly", "full"];
+    };
+    type ApiKeyStatus = __ApiKeyStatus;
+    const ApiKeyStatus: {
+        values: readonly ["active", "expired", "revoked"];
+    };
+    type AuditActorType = __AuditActorType;
+    const AuditActorType: {
+        values: readonly ["platform_user", "system", "pat"];
+    };
+    type AuditFeedSource = __AuditFeedSource;
+    const AuditFeedSource: {
+        values: readonly ["workspace_audit", "heimdall_audit", "agora_moderation"];
+    };
+    type McpProduct = __McpProduct;
+    const McpProduct: {
+        values: readonly ["auth", "mail", "waitlist", "social", "trawl"];
+    };
+    type PolicyEffect = __PolicyEffect;
+    const PolicyEffect: {
+        values: readonly ["allow", "deny"];
+    };
+    type StatsGranularity = __StatsGranularity;
+    const StatsGranularity: {
+        values: readonly ["day"];
+    };
+    type StatsMetric = __StatsMetric;
+    const StatsMetric: {
+        values: readonly ["audit_events"];
+    };
+    type StatsWindow = __StatsWindow;
+    const StatsWindow: {
+        values: readonly ["1d", "7d", "30d"];
+    };
+    type ApiKeySelf = __ApiKeySelf;
+    type ApiKeySelfWorkspace = __ApiKeySelfWorkspace;
+    type AuditFeed = __AuditFeed;
+    type AuthorizationServerMetadata = __AuthorizationServerMetadata;
+    type AvatarUrl = __AvatarUrl;
+    type BoundPolicySummary = __BoundPolicySummary;
+    type ConnectedClient = __ConnectedClient;
+    type ConnectedClientList = __ConnectedClientList;
+    type FeedItem = __FeedItem;
+    type Feedback = __Feedback;
+    type HiddenGuide = __HiddenGuide;
+    type HiddenGuides = __HiddenGuides;
+    type IntrospectAccount = __IntrospectAccount;
+    type IntrospectApiKey = __IntrospectApiKey;
+    type IntrospectPrincipal = __IntrospectPrincipal;
+    type Introspect = __Introspect;
+    type IntrospectRole = __IntrospectRole;
+    type IntrospectWorkspaceListItem = __IntrospectWorkspaceListItem;
+    type IntrospectWorkspace = __IntrospectWorkspace;
+    type Jwk = __Jwk;
+    type Jwks = __Jwks;
+    type ListManagedPolicies = __ListManagedPolicies;
+    type ListPakPresets = __ListPakPresets;
+    type ListPlatformApiKeys = __ListPlatformApiKeys;
+    type ListWorkspaceAuditLogs = __ListWorkspaceAuditLogs;
+    type ListWorkspaceInvites = __ListWorkspaceInvites;
+    type ListWorkspaceMembers = __ListWorkspaceMembers;
+    type ListWorkspaceRoles = __ListWorkspaceRoles;
+    type ListWorkspaceServices = __ListWorkspaceServices;
+    type ListWorkspaces = __ListWorkspaces;
+    type ManagedPolicyDeleted = __ManagedPolicyDeleted;
+    type ManagedPolicyDetail = __ManagedPolicyDetail;
+    type ManagedPolicy = __ManagedPolicy;
+    type MeProfile = __MeProfile;
+    type MintPak = __MintPak;
+    type Pagination = __Pagination;
+    type PakGrantPreview = __PakGrantPreview;
+    type PakPreset = __PakPreset;
+    type PolicyBindingCount = __PolicyBindingCount;
+    type PolicyStatement = __PolicyStatement;
+    type PublicApiKey = __PublicApiKey;
+    type RevokeOtherSessions = __RevokeOtherSessions;
+    type RevokeSession = __RevokeSession;
+    type RotatePak = __RotatePak;
+    type Session = __Session;
+    type SourceDiagnostic = __SourceDiagnostic;
+    type StatsSeriesPoint = __StatsSeriesPoint;
+    type Token = __Token;
+    type UpdateMemberRole = __UpdateMemberRole;
+    type WorkspaceActionCatalog = __WorkspaceActionCatalog;
+    type WorkspaceAuditLogEntry = __WorkspaceAuditLogEntry;
+    type WorkspaceAvatarUrl = __WorkspaceAvatarUrl;
+    type WorkspaceInviteListItem = __WorkspaceInviteListItem;
+    type WorkspaceInvite = __WorkspaceInvite;
+    type WorkspaceListItem = __WorkspaceListItem;
+    type WorkspaceMember = __WorkspaceMember;
+    type Workspace = __Workspace;
+    type WorkspaceRole = __WorkspaceRole;
+    type WorkspaceServiceState = __WorkspaceServiceState;
+    type WorkspaceStats = __WorkspaceStats;
+    type WorkspaceStatsInWindow = __WorkspaceStatsInWindow;
+    type WorkspaceStatsSeries = __WorkspaceStatsSeries;
+    type WorkspaceStatsTotals = __WorkspaceStatsTotals;
+    type AuthLogoutParams = __AuthLogoutParams;
+    type AuthPasswordRequestResetParams = __AuthPasswordRequestResetParams;
+    type AuthPasswordResetParams = __AuthPasswordResetParams;
+    type AuthRefreshParams = __AuthRefreshParams;
+    type AuthSigninParams = __AuthSigninParams;
+    type AuthSignupParams = __AuthSignupParams;
+    type MeAvatarUploadParams = __MeAvatarUploadParams;
+    type MeProfileUpdateParams = __MeProfileUpdateParams;
+    type OauthConnectionListParams = __OauthConnectionListParams;
+    type OauthWorkspaceConnectionListParams = __OauthWorkspaceConnectionListParams;
+    type SessionListResponse = __SessionListResponse;
+    type VerificationVerifyParams = __VerificationVerifyParams;
+    type WorkspaceListParams = __WorkspaceListParams;
+    type WorkspaceCreateParams = __WorkspaceCreateParams;
+    type WorkspaceInviteAcceptParams = __WorkspaceInviteAcceptParams;
+    type StatsRetrieveParams = __StatsRetrieveParams;
+    type WorkspaceUpdateParams = __WorkspaceUpdateParams;
+    type WorkspaceApiKeyListParams = __WorkspaceApiKeyListParams;
+    type WorkspaceApiKeyCreateParams = __WorkspaceApiKeyCreateParams;
+    type WorkspaceApiKeyPreviewParams = __WorkspaceApiKeyPreviewParams;
+    type WorkspaceApiKeyUpdateParams = __WorkspaceApiKeyUpdateParams;
+    type WorkspaceApiKeyDeleteParams = __WorkspaceApiKeyDeleteParams;
+    type WorkspaceApiKeyUpdateBindingsParams = __WorkspaceApiKeyUpdateBindingsParams;
+    type WorkspaceApiKeyRotateParams = __WorkspaceApiKeyRotateParams;
+    type WorkspaceAuditFeedListParams = __WorkspaceAuditFeedListParams;
+    type WorkspaceAuditLogListParams = __WorkspaceAuditLogListParams;
+    type WorkspaceAuditLogExportParams = __WorkspaceAuditLogExportParams;
+    type WorkspaceAvatarUploadParams = __WorkspaceAvatarUploadParams;
+    type WorkspaceInviteListParams = __WorkspaceInviteListParams;
+    type WorkspaceInviteCreateParams = __WorkspaceInviteCreateParams;
+    type WorkspaceMemberListParams = __WorkspaceMemberListParams;
+    type WorkspaceMemberUpdateRoleParams = __WorkspaceMemberUpdateRoleParams;
+    type WorkspacePolicyListParams = __WorkspacePolicyListParams;
+    type WorkspacePolicyCreateParams = __WorkspacePolicyCreateParams;
+    type WorkspacePolicyUpdateParams = __WorkspacePolicyUpdateParams;
+    type WorkspaceRoleListParams = __WorkspaceRoleListParams;
+    type WorkspaceRoleCreateParams = __WorkspaceRoleCreateParams;
+    type WorkspaceRoleUpdateParams = __WorkspaceRoleUpdateParams;
+    type WorkspaceServiceEnableParams = __WorkspaceServiceEnableParams;
+    type WorkspaceServiceUpdateSettingsParams = __WorkspaceServiceUpdateSettingsParams;
+    type ErrorCode = __ErrorCode;
 }
 
-export { PlatformAuth, type paths };
+export { PlatformAuth, PlatformAuthErrorCode, type components, PlatformAuth as default, type paths };