@workos/oagen-emitters 0.11.0 → 0.12.1

package/dist/plugin.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.mts","names":[],"sources":["../src/plugin.ts"],"mappings":";;;cAyBa,oBAAA,EAAsB,IAAA,CAAK,WAAA"}
+{"version":3,"file":"plugin.d.mts","names":[],"sources":["../src/plugin.ts"],"mappings":";;;cA0Ba,oBAAA,EAAsB,IAAI,CAAC,WAAA"}

package/dist/plugin.mjs

@@ -1,2 +1,2 @@
-import { t as workosEmittersPlugin } from "./plugin-DW3cnedr.mjs";
+import { t as workosEmittersPlugin } from "./plugin-CmfzawTp.mjs";
 export { workosEmittersPlugin };

package/docs/sdk-architecture/rust.md

@@ -0,0 +1,323 @@
+# Rust SDK Architecture
+
+Scenario B (fresh) — no backwards-compatibility constraints.
+Reference idioms drawn from popular Rust SDK ecosystems (e.g., `octocrab`, `stripe-rust`,
+`aws-sdk-rust`) — async-first with `reqwest` + `tokio`, `serde` for serialization,
+`thiserror` for the error hierarchy.
+
+## Architecture Overview
+
+Single crate (e.g., `workos`). All public types are re-exported from the crate root via
+`src/lib.rs`. Consumers use `workos::Client::new(api_key)` and call resource methods like
+`client.organizations().create_organization(params).await?`.
+
+- **Client**: `Client` struct holding an `Arc<ClientInner>` so it is cheap to clone and
+  share across tasks. Constructed via `Client::new(api_key)` or `Client::builder()`.
+- **Resources**: Per-mount-group handle structs (e.g., `OrganizationsResource<'a>`)
+  borrowing the `Client` and exposing methods.
+- **Models**: `#[derive(Debug, Clone, Serialize, Deserialize)]` structs with
+  `#[serde(rename_all = "snake_case")]` and per-field `#[serde(rename = "...")]` when the
+  IR field name does not match the Rust ident.
+- **Enums**: Real Rust `enum`s with `#[serde(rename_all = "snake_case")]` (or per-variant
+  `#[serde(rename = "...")]`) — not string constants.
+- **Params**: One `*Params` struct per operation with `#[serde(skip_serializing_if = "Option::is_none")]`
+  on every optional field. Builders are not generated by default; users construct with
+  struct-init syntax or `..Default::default()`.
+- **Errors**: Single `Error` enum derived with `thiserror::Error` covering `Api`,
+  `Network`, `Decode`, `Builder`, and per-status convenience variants.
+- **Pagination**: A `Pagination<T>` page wrapper plus an async stream iterator
+  (`futures::Stream`) for auto-paging.
+- **HTTP**: `reqwest::Client` (async), JSON via `serde_json`, retries with exponential
+  backoff on 429/5xx (configurable on the client builder).
+
+## Naming Conventions
+
+| IR Name                    | Rust Name                | Context                                          |
+| -------------------------- | ------------------------ | ------------------------------------------------ |
+| `Organization` (model)     | `Organization`           | Struct type                                      |
+| `organization` (file)      | `organization.rs`        | Module file (snake_case)                         |
+| `listUsers` (method)       | `list_users`             | Method (snake_case)                              |
+| `user_id` (field)          | `user_id`                | Struct field (snake_case, no acronym hacks)      |
+| `Status` (enum)            | `Status`                 | Enum type                                        |
+| `active` (enum value)      | `Status::Active`         | Variant: PascalCase                              |
+| `Organizations` (service)  | `OrganizationsResource`  | Resource handle struct                           |
+| `organizations` (accessor) | `client.organizations()` | Method on `Client` returning the resource handle |
+
+### Casing rules
+
+Rust convention: types and enum variants `PascalCase`, fields/methods/modules
+`snake_case`, constants `SCREAMING_SNAKE_CASE`. Acronyms are _not_ preserved — `ID` →
+`id`, `URL` → `url`, `JWT` → `jwt` — matching the standard library and `serde` ecosystem.
+
+## Type Mapping
+
+| IR TypeRef                      | Rust Type                                                                             |
+| ------------------------------- | ------------------------------------------------------------------------------------- |
+| `primitive:string`              | `String`                                                                              |
+| `primitive:string:date`         | `String`                                                                              |
+| `primitive:string:date-time`    | `String`                                                                              |
+| `primitive:string:uuid`         | `String`                                                                              |
+| `primitive:string:binary`       | `Vec<u8>`                                                                             |
+| `primitive:integer`             | `i64`                                                                                 |
+| `primitive:integer:int32`       | `i32`                                                                                 |
+| `primitive:number`              | `f64`                                                                                 |
+| `primitive:boolean`             | `bool`                                                                                |
+| `primitive:unknown`             | `serde_json::Value`                                                                   |
+| `array<T>`                      | `Vec<T>`                                                                              |
+| `map<V>`                        | `std::collections::HashMap<String, V>`                                                |
+| `nullable<T>`                   | `Option<T>`                                                                           |
+| `model:Foo`                     | `Foo`                                                                                 |
+| `enum:Bar`                      | `Bar`                                                                                 |
+| `union<A,B>` (discriminated)    | Rust enum `Either { A(A), B(B) }` with `#[serde(tag = "...")]`                        |
+| `union<A,B>` (no discriminator) | `#[serde(untagged)]` enum                                                             |
+| `literal:"foo"`                 | `String` (default; literal preserved in serde rename only when used as discriminator) |
+
+Optional fields (`required: false`) are wrapped in `Option<...>` independent of nullability.
+
+## Model Pattern
+
+```rust
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Organization {
+    pub id: String,
+    pub name: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub domain: Option<String>,
+    pub created_at: String,
+}
+```
+
+- `Debug` + `Clone` always derived.
+- `Serialize` + `Deserialize` always derived.
+- Optional fields skip serialization when `None` to avoid sending `null` for absent
+  values.
+
+## Enum Pattern
+
+```rust
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum Status {
+    Active,
+    Inactive,
+    Pending,
+}
+```
+
+When raw values do not match `snake_case` lowercase variants, per-variant
+`#[serde(rename = "exact_value")]` is emitted. `Copy` is derived only when all variants
+are unit (no payload).
+
+## Resource / Client Pattern
+
+```rust
+// src/client.rs
+use std::sync::Arc;
+
+#[derive(Clone)]
+pub struct Client {
+    inner: Arc<ClientInner>,
+}
+
+pub(crate) struct ClientInner {
+    pub(crate) http: reqwest::Client,
+    pub(crate) base_url: String,
+    pub(crate) api_key: String,
+}
+
+impl Client {
+    pub fn new(api_key: impl Into<String>) -> Self {
+        Self::builder().api_key(api_key).build()
+    }
+
+    pub fn builder() -> ClientBuilder { ClientBuilder::default() }
+
+    pub fn organizations(&self) -> OrganizationsResource<'_> {
+        OrganizationsResource { client: self }
+    }
+}
+```
+
+```rust
+// src/resources/organizations.rs
+pub struct OrganizationsResource<'a> {
+    pub(crate) client: &'a Client,
+}
+
+impl OrganizationsResource<'_> {
+    pub async fn create_organization(
+        &self,
+        params: CreateOrganizationParams,
+    ) -> Result<Organization, Error> {
+        self.client.request_json(
+            reqwest::Method::POST,
+            "/organizations",
+            Some(&params),
+        ).await
+    }
+}
+```
+
+- Resource methods are `async fn` and return `Result<T, Error>`.
+- Path parameters are positional Rust args; query/body parameters are folded into a
+  single `*Params` struct passed by value.
+- The shared HTTP plumbing (`request_json`, `request_empty`, query string serialization,
+  retry) lives on `ClientInner` so resources stay thin.
+
+## Pagination Pattern
+
+```rust
+#[derive(Debug, Clone, Deserialize)]
+pub struct Page<T> {
+    pub data: Vec<T>,
+    pub list_metadata: ListMetadata,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct ListMetadata {
+    pub before: Option<String>,
+    pub after: Option<String>,
+}
+```
+
+A future iteration may add a `futures::Stream`-based auto-pager; v1 returns a single
+page and lets callers loop on `list_metadata.after`.
+
+## Error Pattern
+
+```rust
+use thiserror::Error;
+
+#[derive(Debug, Error)]
+pub enum Error {
+    #[error("API error {status}: {message}")]
+    Api {
+        status: u16,
+        code: Option<String>,
+        message: String,
+    },
+    #[error("network error: {0}")]
+    Network(#[from] reqwest::Error),
+    #[error("decode error: {0}")]
+    Decode(#[from] serde_json::Error),
+    #[error("invalid request: {0}")]
+    Builder(String),
+}
+```
+
+Status-specific helpers (`is_unauthorized()`, `is_not_found()`, `is_rate_limited()`) are
+provided as inherent methods on `Error`. The `Api` variant always carries the raw HTTP
+status so callers can match on numeric ranges.
+
+## Retry Logic
+
+Retries live on `ClientInner::request`:
+
+- Retry on 429 and 5xx status codes.
+- Exponential backoff with jitter: `base * 2^n + rand(0..jitter)`.
+- Defaults: `max_retries = 3`, `base = 100ms`, `max_delay = 5s` (overridable on
+  `ClientBuilder`).
+- Network errors (`reqwest::Error::is_connect()` / `is_timeout()`) are also retried.
+
+## Test Pattern
+
+```rust
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use wiremock::matchers::{method, path};
+    use wiremock::{Mock, MockServer, ResponseTemplate};
+
+    #[tokio::test]
+    async fn create_organization_success() {
+        let server = MockServer::start().await;
+        let body = include_str!("../tests/fixtures/organization.json");
+        Mock::given(method("POST")).and(path("/organizations"))
+            .respond_with(ResponseTemplate::new(200).set_body_string(body))
+            .mount(&server).await;
+
+        let client = Client::builder()
+            .api_key("test")
+            .base_url(server.uri())
+            .build();
+        let org = client.organizations()
+            .create_organization(CreateOrganizationParams { name: "Acme".into(), ..Default::default() })
+            .await.unwrap();
+
+        assert_eq!(org.name, "Acme");
+    }
+}
+```
+
+Tests use the built-in `cargo test` harness with `#[tokio::test]` for async cases and
+`wiremock` for HTTP mocking. JSON fixtures live under `tests/fixtures/` and are pulled in
+with `include_str!` so no I/O is required at test time.
+
+## Structural Guidelines
+
+| Concern               | Choice                                                   |
+| --------------------- | -------------------------------------------------------- |
+| Edition               | `2024` (falls back to `2021` if compiler too old)        |
+| HTTP client           | `reqwest` (async, default features minus blocking)       |
+| Async runtime         | `tokio` 1.x with `rt-multi-thread` and `macros` features |
+| JSON                  | `serde` + `serde_json`                                   |
+| Error derive          | `thiserror`                                              |
+| Stream / future utils | `futures` (only when paginated streams are emitted)      |
+| Test framework        | `cargo test` (built-in)                                  |
+| HTTP mocking          | `wiremock` (dev-dependency)                              |
+| Async tests           | `#[tokio::test]`                                         |
+| Linting               | `cargo clippy -- -D warnings`                            |
+| Formatting            | `cargo fmt`                                              |
+| Package manager       | `cargo`                                                  |
+| Build tool            | `cargo`                                                  |
+| Documentation         | Rustdoc (`///` doc comments)                             |
+
+## Directory Structure
+
+```
+{output}/
+├── Cargo.toml
+├── README.md                   (placeholder; only emitted if missing)
+├── src/
+│   ├── lib.rs                  (crate root: re-exports public surface, doc-comment, prelude)
+│   ├── client.rs               (Client, ClientBuilder, ClientInner, request plumbing)
+│   ├── error.rs                (Error enum + helpers)
+│   ├── models/
+│   │   ├── mod.rs              (re-exports each model module)
+│   │   ├── organization.rs
+│   │   └── ...
+│   ├── enums/
+│   │   ├── mod.rs
+│   │   ├── status.rs
+│   │   └── ...
+│   ├── resources/
+│   │   ├── mod.rs              (re-exports each resource handle)
+│   │   ├── organizations.rs
+│   │   └── ...
+│   └── pagination.rs           (Page<T>, ListMetadata)
+└── tests/
+    ├── common/
+    │   └── mod.rs              (shared test helpers, fixture loader)
+    ├── fixtures/
+    │   ├── organization.json
+    │   └── ...
+    └── organizations_test.rs
+```
+
+One file per model and one file per resource. The crate root (`lib.rs`) is the public
+surface that the `rust` extractor reads.
+
+## Auto-generated File Header
+
+Every generated file begins with:
+
+```rust
+// Code generated by oagen. DO NOT EDIT.
+```
+
+`Cargo.toml` uses the TOML-style equivalent (`# Code generated by oagen. DO NOT EDIT.`)
+and JSON fixtures skip the header (`headerPlacement: 'skip'`).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@workos/oagen-emitters",
-  "version": "0.11.0",
+  "version": "0.12.1",
   "description": "WorkOS' oagen emitters",
   "license": "MIT",
   "author": "WorkOS",
@@ -38,22 +38,22 @@
     "prepare": "husky"
   },
   "devDependencies": {
-    "@commitlint/cli": "^20.5.3",
-    "@commitlint/config-conventional": "^20.5.3",
-    "@types/node": "^25.6.0",
+    "@commitlint/cli": "^21.0.1",
+    "@commitlint/config-conventional": "^21.0.1",
+    "@types/node": "^25.7.0",
     "husky": "^9.1.7",
-    "oxfmt": "^0.48.0",
-    "oxlint": "^1.63.0",
+    "oxfmt": "^0.49.0",
+    "oxlint": "^1.64.0",
     "prettier": "^3.8.3",
-    "tsdown": "^0.21.10",
+    "tsdown": "^0.22.0",
     "tsx": "^4.21.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.5"
+    "vitest": "^4.1.6"
   },
   "engines": {
     "node": ">=24.10.0"
   },
   "dependencies": {
-    "@workos/oagen": "^0.18.1"
+    "@workos/oagen": "^0.18.2"
   }
 }

package/src/index.ts

@@ -5,6 +5,7 @@ export { goEmitter } from './go/index.js';
 export { dotnetEmitter } from './dotnet/index.js';
 export { kotlinEmitter } from './kotlin/index.js';
 export { rubyEmitter } from './ruby/index.js';
+export { rustEmitter } from './rust/index.js';
 
 export { nodeExtractor } from './compat/extractors/node.js';
 export { rubyExtractor } from './compat/extractors/ruby.js';

package/src/plugin.ts

@@ -8,6 +8,7 @@ import { goEmitter } from './go/index.js';
 import { dotnetEmitter } from './dotnet/index.js';
 import { kotlinEmitter } from './kotlin/index.js';
 import { rubyEmitter } from './ruby/index.js';
+import { rustEmitter } from './rust/index.js';
 import { nodeExtractor } from './compat/extractors/node.js';
 import { rubyExtractor } from './compat/extractors/ruby.js';
 import { pythonExtractor } from './compat/extractors/python.js';
@@ -24,7 +25,7 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const smokeDir = path.resolve(__dirname, '..', 'smoke');
 
 export const workosEmittersPlugin: Pick<OagenConfig, 'emitters' | 'extractors' | 'smokeRunners'> = {
-  emitters: [nodeEmitter, pythonEmitter, phpEmitter, goEmitter, dotnetEmitter, kotlinEmitter, rubyEmitter],
+  emitters: [nodeEmitter, pythonEmitter, phpEmitter, goEmitter, dotnetEmitter, kotlinEmitter, rubyEmitter, rustEmitter],
   extractors: [
     nodeExtractor,
     rubyExtractor,

package/src/python/path-expression.ts

@@ -1,4 +1,4 @@
-import { parsePathTemplate, hasPathParams } from '../shared/path-template.js';
+import { parsePathTemplate, type PathSegment } from '../shared/path-template.js';
 import { fieldName } from './naming.js';
 
 export interface PythonPathOptions {
@@ -7,46 +7,95 @@ export interface PythonPathOptions {
 }
 
 /**
- * Build the Python f-string that the SDK passes to the request layer.
+ * Build the Python tuple expression that the SDK passes to the request layer.
  *
- * Every {paramName} placeholder is wrapped in
- * `urllib.parse.quote(str(...), safe="")` so that an unencoded "/" or "../"
- * in a caller-supplied id cannot be normalized by the underlying HTTP
- * transport into a different endpoint of the WorkOS API while still
- * authenticated with the application's API key. `safe=""` is critical:
- * the stdlib default of `safe="/"` does NOT encode "/" and would leave the
- * traversal vector open.
+ * The returned expression is a tuple of per-segment values. The request layer
+ * (`_BaseWorkOSClient._encode_path`) URL-encodes each element with `safe=""`
+ * before joining with "/", so a caller-supplied id containing "/" or "../"
+ * cannot escape its intended segment. This is the structural fix that lets
+ * the request layer make a real guarantee instead of inspecting an already-
+ * concatenated path string.
  *
- * Generated files using this helper must import `quote` (e.g.
- * `from urllib.parse import quote`).
+ *   "/orgs"                        → `("orgs",)`
+ *   "/orgs/{id}"                   → `("orgs", str(id))`
+ *   "/orgs/{id}/users/{uid}"       → `("orgs", str(id), "users", str(uid))`
+ *   "/orgs/{id}" with id ∈ enums   → `("orgs", str(enum_value(id)))`
  *
- *   "/orgs"                        → `"orgs"`
- *   "/orgs/{id}"                   → `f"orgs/{quote(str(id), safe='')}"`
- *   "/orgs/{id}" with id ∈ enums   → `f"orgs/{quote(str(enum_value(id)), safe='')}"`
+ * Mixed segments (e.g. literal text adjacent to a placeholder within a single
+ * path component) are emitted as a Python f-string element. Per-segment
+ * encoding is still applied to the whole element by the request layer; this
+ * is rare in WorkOS specs but is handled deterministically.
  */
 export function buildPythonPathExpression(rawPath: string, options: PythonPathOptions = {}): string {
   const segments = parsePathTemplate(rawPath, { stripLeadingSlash: true });
-  if (segments.length === 0) return '""';
-  if (!hasPathParams(segments)) {
-    const literal = (segments[0] as { value: string }).value;
-    return `"${escapePyDoubleQuoted(literal)}"`;
-  }
+  if (segments.length === 0) return '()';
 
-  const enums = options.enumParams;
-  let body = '';
+  const components = splitIntoComponents(segments);
+  const parts = components.map((c) => emitComponent(c, options.enumParams));
+  return parts.length === 1 ? `(${parts[0]!},)` : `(${parts.join(', ')})`;
+}
+
+type Subpiece = { kind: 'literal'; value: string } | { kind: 'param'; name: string };
+
+/**
+ * Split a parsed path template into one component per "/"-separated piece.
+ * Each component is a list of literal / param subpieces; multi-subpiece
+ * components occur only for mixed segments like `foo{id}bar`.
+ */
+function splitIntoComponents(segments: PathSegment[]): Subpiece[][] {
+  const components: Subpiece[][] = [[]];
   for (const seg of segments) {
     if (seg.kind === 'literal') {
-      body += escapePyDoubleQuoted(seg.value);
+      const parts = seg.value.split('/');
+      const first = parts[0];
+      if (first !== undefined && first !== '') {
+        components[components.length - 1]!.push({ kind: 'literal', value: first });
+      }
+      for (let i = 1; i < parts.length; i++) {
+        components.push([]);
+        const part = parts[i];
+        if (part !== undefined && part !== '') {
+          components[components.length - 1]!.push({ kind: 'literal', value: part });
+        }
+      }
     } else {
-      const varName = fieldName(seg.name);
-      const inner = enums?.has(seg.name) ? `enum_value(${varName})` : varName;
-      body += `{quote(str(${inner}), safe='')}`;
+      components[components.length - 1]!.push({ kind: 'param', name: seg.name });
+    }
+  }
+  // Drop a trailing empty component if the path ended with a separator.
+  while (components.length > 1 && components[components.length - 1]!.length === 0) {
+    components.pop();
+  }
+  return components;
+}
+
+function emitComponent(component: Subpiece[], enumParams?: ReadonlySet<string>): string {
+  if (component.length === 1) {
+    const only = component[0]!;
+    if (only.kind === 'literal') return `"${escapePyDoubleQuoted(only.value)}"`;
+    const varName = fieldName(only.name);
+    const inner = enumParams?.has(only.name) ? `enum_value(${varName})` : varName;
+    return `str(${inner})`;
+  }
+  // Mixed component — fall back to an f-string. The request layer still
+  // URL-encodes the resulting element as a single segment.
+  let body = '';
+  for (const piece of component) {
+    if (piece.kind === 'literal') {
+      body += escapeFStringLiteral(piece.value);
+    } else {
+      const varName = fieldName(piece.name);
+      const inner = enumParams?.has(piece.name) ? `enum_value(${varName})` : varName;
+      body += `{${inner}}`;
     }
   }
   return `f"${body}"`;
 }
 
 function escapePyDoubleQuoted(literal: string): string {
-  // f-strings: backslash, double-quote, and "{"/"}" all need escaping
+  return literal.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+}
+
+function escapeFStringLiteral(literal: string): string {
   return literal.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\{/g, '{{').replace(/\}/g, '}}');
 }

package/src/python/resources.ts

@@ -1023,15 +1023,6 @@ export function generateResources(services: Service[], ctx: EmitterContext): Gen
     lines.push('');
     lines.push('from typing import TYPE_CHECKING, Any, Dict, List, Literal, Optional, Type, Union, cast');
 
-    // urllib.parse.quote is needed whenever any operation has a path parameter,
-    // so each interpolated id can be URL-encoded with safe="" before being
-    // concatenated into the request path.
-    const hasAnyPathParam =
-      allOperations.some((op) => op.pathParams.length > 0) || allOperations.some((op) => /\{[^{}]+\}/.test(op.path));
-    if (hasAnyPathParam) {
-      lines.push('from urllib.parse import quote');
-    }
-
     lines.push('');
     lines.push('if TYPE_CHECKING:');
     lines.push(`    from ${importPrefix}_client import AsyncWorkOSClient, WorkOSClient`);

package/src/rust/client.ts

@@ -0,0 +1,62 @@
+import type { ApiSpec, EmitterContext, GeneratedFile } from '@workos/oagen';
+import type { UnionRegistry } from './type-map.js';
+import { moduleName } from './naming.js';
+import { groupByMount } from '../shared/resolved-ops.js';
+import { mountStructName } from './resources.js';
+
+/**
+ * The Rust emitter only generates spec-derived endpoint logic. The HTTP
+ * client (`src/client.rs`), crate root (`src/lib.rs`), error types
+ * (`src/error.rs`), pagination helpers (`src/pagination.rs`), and
+ * `Cargo.toml` are hand-maintained in the live SDK — analogous to a
+ * `Gemfile` in Ruby.
+ *
+ * This pass runs last (after `generateModels` and `generateResources`) so
+ * the shared {@link UnionRegistry} has collected every synthesised oneOf
+ * union before being rendered into `src/models/_unions.rs`.
+ *
+ * It also emits `src/resources_api.rs`, an auxiliary `impl Client { ... }`
+ * block that exposes one accessor method per mount target. Keeping the
+ * accessors in a generated file lets `src/client.rs` remain hand-maintained
+ * without drifting as services mount/unmount.
+ */
+export function generateClient(_spec: ApiSpec, ctx: EmitterContext, registry: UnionRegistry): GeneratedFile[] {
+  const files: GeneratedFile[] = [];
+
+  // _unions.rs — emitted unconditionally so the models barrel reference
+  // keeps the same shape across runs.
+  const unionsContent = registry.size() > 0 ? registry.render() : '// No oneOf-style unions registered.\n';
+  files.push({ path: 'src/models/_unions.rs', content: unionsContent, overwriteExisting: true });
+
+  // resources_api.rs — `impl Client { fn user_management() -> ... }`.
+  files.push({ path: 'src/resources_api.rs', content: renderResourcesApi(ctx), overwriteExisting: true });
+
+  return files;
+}
+
+function renderResourcesApi(ctx: EmitterContext): string {
+  const groups = groupByMount(ctx);
+  const targets: { accessor: string; struct: string }[] = [];
+  for (const [mountName, group] of groups) {
+    if (group.operations.length === 0) continue;
+    targets.push({ accessor: moduleName(mountName), struct: mountStructName(mountName) });
+  }
+  targets.sort((a, b) => a.accessor.localeCompare(b.accessor));
+
+  const lines: string[] = [];
+  lines.push('use crate::client::Client;');
+  for (const { struct } of targets) {
+    lines.push(`use crate::resources::${struct};`);
+  }
+  lines.push('');
+  lines.push('impl Client {');
+  targets.forEach(({ accessor, struct }, i) => {
+    lines.push(`    /// Access the \`${accessor}\` resource.`);
+    lines.push(`    pub fn ${accessor}(&self) -> ${struct}<'_> {`);
+    lines.push(`        ${struct} { client: self }`);
+    lines.push('    }');
+    if (i < targets.length - 1) lines.push('');
+  });
+  lines.push('}');
+  return lines.join('\n') + '\n';
+}