From aa31ec0068893da94a785419d8c06695b7260d2f Mon Sep 17 00:00:00 2001
From: Jeroen Rinzema <jeroen@rinzema.dev>
Date: Tue, 23 Jun 2026 00:00:38 +0200
Subject: [PATCH 1/5] feat!: require projectId and move client API under
 /projects/{projectId}

The Lunogram Client API now scopes every authenticated endpoint to a
project: `/api/client/...` becomes `/api/client/projects/{projectId}/...`.

- Add required `projectId: string` to `ClientProps` (and as the new second
  positional argument of the `Lunogram` constructor).
- Inject `/projects/{projectId}` centrally in `HttpHandler` so every current
  and future resource path is scoped automatically.
- Validate `projectId` at construction: non-empty and a valid UUID, else
  throw `ValidationError`.
- Update README, examples, and the e2e test; add a url.test.ts unit suite
  asserting the new path prefix and validation behaviour.

BREAKING CHANGE: clients must now be constructed with a project UUID, and all
Client API requests target `/api/client/projects/{projectId}/...`.
---
 README.md           |  32 ++++++++++++--
 package.json        |   1 +
 src/core/http.ts    |  14 +++++-
 src/index.ts        |   6 ++-
 src/types/common.ts |   5 +++
 src/utils/crypto.ts |   6 ++-
 test/e2e.test.ts    |   6 ++-
 test/url.test.ts    | 101 ++++++++++++++++++++++++++++++++++++++++++++
 8 files changed, 162 insertions(+), 9 deletions(-)
 create mode 100644 test/url.test.ts

diff --git a/README.md b/README.md
index d0fc288..53e7df0 100644
--- a/README.md
+++ b/README.md
@@ -22,7 +22,8 @@ npm install @lunogram/js-sdk
 ```typescript
 import { Lunogram } from '@lunogram/js-sdk'
 
-const lunogram = new Lunogram('your-api-key')
+// The project UUID is required and scopes every request to that project.
+const lunogram = new Lunogram('your-api-key', 'your-project-uuid')
 
 // Identify a user
 await lunogram.user.upsert({
@@ -46,6 +47,27 @@ await lunogram.organization.upsert({
 })
 ```
 
+## Project Scoping
+
+Every Lunogram Client API request is scoped to a single **project**. You supply
+the project UUID once, when constructing the client, and the SDK injects it into
+every request path automatically — you never pass it per call.
+
+All Client API endpoints live under `/api/client/projects/{projectId}/...`:
+
+| Operation                | Path                                                              |
+| ------------------------ | ----------------------------------------------------------------- |
+| Users                    | `/api/client/projects/{projectId}/users`                          |
+| User events              | `/api/client/projects/{projectId}/users/events`                   |
+| User scheduled           | `/api/client/projects/{projectId}/users/scheduled`                |
+| Organizations            | `/api/client/projects/{projectId}/organizations`                  |
+| Organization members     | `/api/client/projects/{projectId}/organizations/users`            |
+| Organization events      | `/api/client/projects/{projectId}/organizations/events`           |
+| Organization scheduled   | `/api/client/projects/{projectId}/organizations/scheduled`        |
+
+The `projectId` must be a valid UUID; the client throws a `ValidationError` at
+construction time if it is missing, empty, or malformed.
+
 ## Identity Model
 
 Users and organizations are identified by an array of `ExternalID` objects:
@@ -69,7 +91,10 @@ The SDK automatically generates an anonymous identifier for each session. When y
 ```typescript
 import { BrowserClient } from '@lunogram/js-sdk'
 
-const client = new BrowserClient({ apiKey: 'your-api-key' })
+const client = new BrowserClient({
+    apiKey: 'your-api-key',
+    projectId: 'your-project-uuid',
+})
 
 // anonymousId is auto-generated
 client.user.anonymousId
@@ -100,7 +125,7 @@ The SDK is also exposed on `window.Lunogram`:
 
 ```html
 <script>
-    const lunogram = new Lunogram('your-api-key')
+    const lunogram = new Lunogram('your-api-key', 'your-project-uuid')
     lunogram.user.upsert({
         identifier: [{ externalId: 'user-123' }],
         email: 'user@example.com',
@@ -115,6 +140,7 @@ import { Client } from '@lunogram/js-sdk'
 
 const client = new Client({
     apiKey: 'your-api-key',
+    projectId: 'your-project-uuid', // required — scopes all requests to this project
     urlEndpoint: 'https://your-api.com/api', // optional
 })
 
diff --git a/package.json b/package.json
index b721ce7..6eb1070 100644
--- a/package.json
+++ b/package.json
@@ -11,6 +11,7 @@
     "build:esm": "tsc --project ./tsconfig.module.json",
     "build:cjs": "tsc --project ./tsconfig.json",
     "lint": "eslint . --ext .ts",
+    "test": "vitest run test/url.test.ts",
     "test:e2e": "vitest run test/e2e.test.ts",
     "release:github": "pnpm publish --no-git-checks --registry=https://npm.pkg.github.com",
     "release:npm": "npm publish --access public --registry=https://registry.npmjs.org"
diff --git a/src/core/http.ts b/src/core/http.ts
index 9685aff..142e9f5 100644
--- a/src/core/http.ts
+++ b/src/core/http.ts
@@ -1,5 +1,5 @@
 import { ClientProps } from '../types'
-import { mapKeys } from '../utils'
+import { mapKeys, isUuid } from '../utils'
 import { DefaultEndpoint } from './constants'
 import {
     LunogramError,
@@ -23,10 +23,20 @@ const statusErrorFactories: Partial<Record<number, () => LunogramError>> = {
 export class HttpHandler {
     readonly #apiKey: string
     readonly #baseUrl: string
+    readonly #projectId: string
 
     constructor(props: ClientProps) {
+        const projectId = props.projectId?.trim()
+        if (!projectId) {
+            throw new ValidationError('A non-empty `projectId` is required to create a Lunogram client')
+        }
+        if (!isUuid(projectId)) {
+            throw new ValidationError('`projectId` must be a valid UUID')
+        }
+
         this.#apiKey = props.apiKey
         this.#baseUrl = props.urlEndpoint ?? DefaultEndpoint
+        this.#projectId = projectId
     }
 
     async get<T = unknown>(path: string, data?: unknown): Promise<T> {
@@ -42,7 +52,7 @@ export class HttpHandler {
     }
 
     async #request<T>(method: HttpMethod, path: string, data?: unknown): Promise<T> {
-        const url = `${this.#baseUrl}/client/${path}`
+        const url = `${this.#baseUrl}/client/projects/${this.#projectId}/${path}`
 
         try {
             const response = await fetch(url, {
diff --git a/src/index.ts b/src/index.ts
index c4d8915..0502e96 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -17,10 +17,12 @@ export class Lunogram {
     /**
      * Creates a new Lunogram instance.
      * @param apiKey - Your Lunogram API key
+     * @param projectId - The UUID of your Lunogram project (required). All
+     *                    Client API requests are scoped to this project.
      * @param urlEndpoint - Optional custom API endpoint URL
      */
-    constructor(apiKey: string, urlEndpoint?: string) {
-        this.client = new BrowserClient({ apiKey, urlEndpoint })
+    constructor(apiKey: string, projectId: string, urlEndpoint?: string) {
+        this.client = new BrowserClient({ apiKey, projectId, urlEndpoint })
     }
 
     /**
diff --git a/src/types/common.ts b/src/types/common.ts
index 112edfe..984b65e 100644
--- a/src/types/common.ts
+++ b/src/types/common.ts
@@ -2,5 +2,10 @@ export type JSONValue = string | number | boolean | null | { [key: string]: JSON
 
 export interface ClientProps {
     apiKey: string
+    /**
+     * The UUID of the Lunogram project. Required. Every Client API request is
+     * scoped to this project and issued under `/client/projects/{projectId}/...`.
+     */
+    projectId: string
     urlEndpoint?: string
 }
diff --git a/src/utils/crypto.ts b/src/utils/crypto.ts
index 336105f..b438172 100644
--- a/src/utils/crypto.ts
+++ b/src/utils/crypto.ts
@@ -1,5 +1,9 @@
-import { v4 as uuidv4 } from 'uuid'
+import { v4 as uuidv4, validate as uuidValidate } from 'uuid'
 
 export function generateUuid(): string {
     return uuidv4()
 }
+
+export function isUuid(value: string): boolean {
+    return uuidValidate(value)
+}
diff --git a/test/e2e.test.ts b/test/e2e.test.ts
index f9569f2..e0a50e7 100644
--- a/test/e2e.test.ts
+++ b/test/e2e.test.ts
@@ -2,6 +2,7 @@ import { describe, it, expect, beforeAll } from 'vitest'
 import { Client } from '../src'
 
 const apiKey = process.env.LUNOGRAM_API_KEY
+const projectId = process.env.LUNOGRAM_PROJECT_ID
 const urlEndpoint = process.env.LUNOGRAM_API_URL
 
 const userId = `test-user-${Date.now()}`
@@ -13,7 +14,10 @@ beforeAll(() => {
     if (!apiKey) {
         throw new Error('LUNOGRAM_API_KEY environment variable is required')
     }
-    client = new Client({ apiKey, urlEndpoint })
+    if (!projectId) {
+        throw new Error('LUNOGRAM_PROJECT_ID environment variable is required')
+    }
+    client = new Client({ apiKey, projectId, urlEndpoint })
 })
 
 describe('Users', () => {
diff --git a/test/url.test.ts b/test/url.test.ts
new file mode 100644
index 0000000..6e1030c
--- /dev/null
+++ b/test/url.test.ts
@@ -0,0 +1,101 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { Client, ValidationError } from '../src'
+
+const apiKey = 'test-api-key'
+const projectId = '11111111-1111-4111-8111-111111111111'
+const urlEndpoint = 'https://api.example.com/api'
+
+function mockFetch() {
+    return vi.fn(async () =>
+        new Response(JSON.stringify({}), {
+            status: 200,
+            headers: { 'Content-Type': 'application/json' },
+        }),
+    )
+}
+
+describe('Client API URL construction', () => {
+    let fetchMock: ReturnType<typeof mockFetch>
+
+    beforeEach(() => {
+        fetchMock = mockFetch()
+        vi.stubGlobal('fetch', fetchMock)
+    })
+
+    afterEach(() => {
+        vi.unstubAllGlobals()
+        vi.restoreAllMocks()
+    })
+
+    function lastUrl(): string {
+        const call = fetchMock.mock.calls.at(-1)
+        return String(call?.[0])
+    }
+
+    it('prefixes user requests with /client/projects/{projectId}', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+        await client.user.upsert({ identifier: [{ externalId: 'user-1' }] })
+        expect(lastUrl()).toBe(`${urlEndpoint}/client/projects/${projectId}/users`)
+    })
+
+    it('prefixes user events', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+        await client.user.events.post([{ name: 'evt', identifier: [{ externalId: 'u' }], data: {} }])
+        expect(lastUrl()).toBe(`${urlEndpoint}/client/projects/${projectId}/users/events`)
+    })
+
+    it('prefixes user scheduled', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+        await client.user.schedule.upsert({
+            name: 'r',
+            identifier: [{ externalId: 'u' }],
+            scheduledAt: new Date().toISOString(),
+        })
+        expect(lastUrl()).toBe(`${urlEndpoint}/client/projects/${projectId}/users/scheduled`)
+    })
+
+    it('prefixes organizations', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+        await client.organization.upsert({ identifier: [{ externalId: 'org-1' }] })
+        expect(lastUrl()).toBe(`${urlEndpoint}/client/projects/${projectId}/organizations`)
+    })
+
+    it('prefixes organization member operations (path override)', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+        await client.organization.addUser({
+            organization: { identifier: [{ externalId: 'org-1' }] },
+            user: { identifier: [{ externalId: 'user-1' }] },
+        })
+        expect(lastUrl()).toBe(`${urlEndpoint}/client/projects/${projectId}/organizations/users`)
+    })
+
+    it('prefixes organization events', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+        await client.organization.events.post([{ name: 'evt', identifier: [{ externalId: 'o' }], data: {} }])
+        expect(lastUrl()).toBe(`${urlEndpoint}/client/projects/${projectId}/organizations/events`)
+    })
+
+    it('does not double-prefix on repeated calls', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+        await client.user.upsert({ identifier: [{ externalId: 'a' }] })
+        await client.user.upsert({ identifier: [{ externalId: 'b' }] })
+        for (const call of fetchMock.mock.calls) {
+            expect(String(call[0])).toBe(`${urlEndpoint}/client/projects/${projectId}/users`)
+        }
+    })
+})
+
+describe('projectId validation', () => {
+    it('throws when projectId is missing', () => {
+        // @ts-expect-error projectId is required
+        expect(() => new Client({ apiKey, urlEndpoint })).toThrow(ValidationError)
+    })
+
+    it('throws when projectId is empty', () => {
+        expect(() => new Client({ apiKey, projectId: '   ', urlEndpoint })).toThrow(ValidationError)
+    })
+
+    it('throws when projectId is not a UUID', () => {
+        expect(() => new Client({ apiKey, projectId: 'not-a-uuid', urlEndpoint })).toThrow(ValidationError)
+    })
+})

From e049fab11b877440e3cf95e1bc8af1b06476d9a7 Mon Sep 17 00:00:00 2001
From: Jeroen Rinzema <jeroen@rinzema.dev>
Date: Tue, 23 Jun 2026 11:15:55 +0200
Subject: [PATCH 2/5] refactor!: generate the client layer from the OpenAPI
 spec

Migrate the SDK to spec-driven code generation with a layered design:

- Generated low-level layer (`src/gen/schema.ts`): all paths, operations and
  payload types are generated from the vendored OpenAPI spec via
  `openapi-typescript`. Committed, never hand-edited.
- Hand-written facade (`Lunogram` / `Client` / `BrowserClient` + resources):
  keeps the stable public API, camelCase ergonomics, auth, projectId UUID
  validation, browser support and the error hierarchy.

The transport is backed by `openapi-fetch` typed by the generated schema. The
`{projectID}` path param, `Bearer` auth header and camelCase->snake_case body
mapping are applied once in the transport/middleware, never per operation.

Spec is vendored at a pinned platform commit (no platform release needed); see
`spec/SOURCE.md`. CI gains a drift check (`pnpm generate` + `git diff`) and a
weekly `spec-sync` bump bot. Public API is unchanged from PR #7.
---
 .github/workflows/ci.yml                      |   27 +-
 .github/workflows/spec-sync.yml               |   80 +
 eslint.config.mjs                             |    5 +-
 package.json                                  |    3 +
 pnpm-lock.yaml                                |  222 +-
 spec/SOURCE.md                                |   38 +
 spec/client.yaml                              | 1779 ++++++++++++++++
 src/core/client.ts                            |   12 +-
 src/core/factory.ts                           |   12 +-
 src/core/http.ts                              |  111 -
 src/core/resources/base.ts                    |   63 +-
 src/core/resources/organizations/events.ts    |   13 +-
 .../resources/organizations/organization.ts   |   47 +-
 src/core/resources/organizations/scheduled.ts |   16 +-
 src/core/resources/users/events.ts            |   13 +-
 src/core/resources/users/scheduled.ts         |   16 +-
 src/core/resources/users/user.ts              |   27 +-
 src/core/transport.ts                         |  136 ++
 src/gen/schema.ts                             | 1892 +++++++++++++++++
 src/index.ts                                  |    2 +-
 src/platform/browser.ts                       |   20 +-
 test/url.test.ts                              |   52 +-
 22 files changed, 4384 insertions(+), 202 deletions(-)
 create mode 100644 .github/workflows/spec-sync.yml
 create mode 100644 spec/SOURCE.md
 create mode 100644 spec/client.yaml
 delete mode 100644 src/core/http.ts
 create mode 100644 src/core/transport.ts
 create mode 100644 src/gen/schema.ts

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 522f10b..6fe92a5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,14 +2,14 @@ name: CI
 
 on:
   push:
+  pull_request:
 
 jobs:
-  lint:
-    name: "Lint Code"
+  build:
+    name: "Build & Test"
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      packages: write
     steps:
       - uses: actions/checkout@v5
       - uses: pnpm/action-setup@v4
@@ -20,5 +20,24 @@ jobs:
         with:
           node-version: ${{ vars.NODEJS_VERSION }}
           cache: 'pnpm'
+
       - run: pnpm install
-      - run: pnpm run lint
\ No newline at end of file
+
+      # Drift check: regenerate the low-level layer from the vendored spec and
+      # fail if the committed output is stale. The generated code under
+      # `src/gen/` must always match `spec/client.yaml`.
+      - name: Generate client layer
+        run: pnpm generate
+      - name: Verify generated code is up to date
+        run: |
+          git diff --exit-code src/gen || {
+            echo "::error::Generated code in src/gen is out of date. Run 'pnpm generate' and commit the result."
+            exit 1
+          }
+
+      - name: Build
+        run: pnpm run build
+      - name: Lint
+        run: pnpm run lint
+      - name: Test
+        run: pnpm test
diff --git a/.github/workflows/spec-sync.yml b/.github/workflows/spec-sync.yml
new file mode 100644
index 0000000..d250475
--- /dev/null
+++ b/.github/workflows/spec-sync.yml
@@ -0,0 +1,80 @@
+name: Spec Sync
+
+# Bump bot for the vendored OpenAPI spec.
+#
+# Re-fetches `spec/client.yaml` from the pinned ref recorded in `spec/SOURCE.md`,
+# regenerates the low-level layer (`src/gen/`), and — if anything changed — opens
+# a PR. This keeps the SDK in step with the platform spec without a manual fetch.
+#
+# Note: this syncs *at the current pin*. Bumping the pin itself (e.g. to a new
+# release tag) is a manual edit to `spec/SOURCE.md` (and its raw URL below is
+# re-read from that file each run, so a bumped pin is picked up automatically).
+
+on:
+  schedule:
+    # Weekly, Monday 06:00 UTC.
+    - cron: "0 6 * * 1"
+  workflow_dispatch: {}
+
+jobs:
+  sync:
+    name: "Re-fetch spec & regenerate"
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v5
+      - uses: pnpm/action-setup@v4
+        with:
+          version: ${{ vars.PNPM_VERSION }}
+      - name: Set-up Node
+        uses: actions/setup-node@v5
+        with:
+          node-version: ${{ vars.NODEJS_VERSION }}
+          cache: 'pnpm'
+
+      - run: pnpm install
+
+      # The raw URL (repo + spec path + pinned ref) is single-sourced in
+      # spec/SOURCE.md; read it from the fenced ```...``` block there so the pin
+      # only ever lives in one place.
+      - name: Resolve spec URL from SOURCE.md
+        id: source
+        run: |
+          url="$(grep -Eo 'https://raw\.githubusercontent\.com/[^ )]+resources\.yml' spec/SOURCE.md | head -n1)"
+          if [ -z "$url" ]; then
+            echo "::error::Could not find the raw spec URL in spec/SOURCE.md"
+            exit 1
+          fi
+          echo "Spec URL: $url"
+          echo "url=$url" >> "$GITHUB_OUTPUT"
+
+      - name: Re-fetch spec
+        run: curl -fsSL "${{ steps.source.outputs.url }}" -o spec/client.yaml
+
+      - name: Regenerate client layer
+        run: pnpm generate
+
+      # Open (or update) a PR only when the vendored spec or generated output
+      # actually changed.
+      - name: Open PR on drift
+        uses: peter-evans/create-pull-request@v7
+        with:
+          add-paths: |
+            spec/client.yaml
+            src/gen/**
+          branch: chore/spec-sync
+          commit-message: "chore: sync OpenAPI spec & regenerate client layer"
+          title: "chore: sync OpenAPI spec & regenerate client layer"
+          body: |
+            Automated spec sync.
+
+            Re-fetched `spec/client.yaml` from the pinned ref in `spec/SOURCE.md`
+            and regenerated `src/gen/` via `pnpm generate`.
+
+            Review the diff and merge if the changes look correct. If the spec
+            should track a different ref, update `spec/SOURCE.md` first.
+          labels: |
+            dependencies
+            automated
diff --git a/eslint.config.mjs b/eslint.config.mjs
index 7cd1878..ae0f9b9 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -8,6 +8,9 @@ export default defineConfig(
   eslint.configs.recommended,
   tseslint.configs.recommended,
   {
-    ignores: ["lib/**", "node_modules/**", "dist/**"],
+    // `src/gen/**` is auto-generated by `pnpm generate` (openapi-typescript)
+    // and must not be hand-edited; exclude it from linting rather than tweaking
+    // the generated output.
+    ignores: ["lib/**", "node_modules/**", "dist/**", "src/gen/**"],
   },
 );
diff --git a/package.json b/package.json
index 6eb1070..2ae9b63 100644
--- a/package.json
+++ b/package.json
@@ -7,6 +7,7 @@
     "url": "https://github.com/lunogram/js-sdk"
   },
   "scripts": {
+    "generate": "openapi-typescript spec/client.yaml -o src/gen/schema.ts",
     "build": "rimraf lib/ && pnpm run build:esm && pnpm run build:cjs",
     "build:esm": "tsc --project ./tsconfig.module.json",
     "build:cjs": "tsc --project ./tsconfig.json",
@@ -51,6 +52,7 @@
     "@eslint/js": "^9.37.0",
     "@types/uuid": "^10.0.0",
     "eslint": "^9.37.0",
+    "openapi-typescript": "^7.13.0",
     "rimraf": "^6.0.1",
     "typescript": "^5.6.2",
     "typescript-eslint": "^8.46.0",
@@ -60,6 +62,7 @@
     "lib"
   ],
   "dependencies": {
+    "openapi-fetch": "^0.17.0",
     "tslib": "^2.8.1",
     "uuid": "^13.0.0"
   }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 1553e97..d1742d2 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -8,6 +8,9 @@ importers:
 
   .:
     dependencies:
+      openapi-fetch:
+        specifier: ^0.17.0
+        version: 0.17.0
       tslib:
         specifier: ^2.8.1
         version: 2.8.1
@@ -24,6 +27,9 @@ importers:
       eslint:
         specifier: ^9.37.0
         version: 9.37.0
+      openapi-typescript:
+        specifier: ^7.13.0
+        version: 7.13.0(typescript@5.9.3)
       rimraf:
         specifier: ^6.0.1
         version: 6.0.1
@@ -39,6 +45,14 @@ importers:
 
 packages:
 
+  '@babel/code-frame@7.29.7':
+    resolution: {integrity: sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-validator-identifier@7.29.7':
+    resolution: {integrity: sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==}
+    engines: {node: '>=6.9.0'}
+
   '@emnapi/core@1.9.1':
     resolution: {integrity: sha512-mukuNALVsoix/w1BJwFzwXBN/dHeejQtuVzcDsfOEsdpCumXb/E9j8w11h5S54tT1xhifGfbbSm/ICrObRb3KA==}
 
@@ -138,6 +152,16 @@ packages:
   '@oxc-project/types@0.122.0':
     resolution: {integrity: sha512-oLAl5kBpV4w69UtFZ9xqcmTi+GENWOcPF7FCrczTiBbmC0ibXxCwyvZGbO39rCVEuLGAZM84DH0pUIyyv/YJzA==}
 
+  '@redocly/ajv@8.11.2':
+    resolution: {integrity: sha512-io1JpnwtIcvojV7QKDUSIuMN/ikdOUd1ReEnUnMKGfDVridQZ31J0MmIuqwuRjWDZfmvr+Q0MqCcfHM2gTivOg==}
+
+  '@redocly/config@0.22.0':
+    resolution: {integrity: sha512-gAy93Ddo01Z3bHuVdPWfCwzgfaYgMdaZPcfL7JZ7hWJoK9V0lXDbigTWkhiPFAaLWzbOJ+kbUQG1+XwIm0KRGQ==}
+
+  '@redocly/openapi-core@1.34.15':
+    resolution: {integrity: sha512-HAwCnNyKcs5XGQqms+9t7OdAPM/5TDstmhF+0i7tdCFato2QKuYIlyWETwkXd8c5zbltr1oB+6y9NTeQLr2d6Q==}
+    engines: {node: '>=18.17.0', npm: '>=9.5.0'}
+
   '@rolldown/binding-android-arm64@1.0.0-rc.12':
     resolution: {integrity: sha512-pv1y2Fv0JybcykuiiD3qBOBdz6RteYojRFY1d+b95WVuzx211CRh+ytI/+9iVyWQ6koTh5dawe4S/yRfOFjgaA==}
     engines: {node: ^20.19.0 || >=22.12.0}
@@ -349,9 +373,17 @@ packages:
     engines: {node: '>=0.4.0'}
     hasBin: true
 
+  agent-base@7.1.4:
+    resolution: {integrity: sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==}
+    engines: {node: '>= 14'}
+
   ajv@6.12.6:
     resolution: {integrity: sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==}
 
+  ansi-colors@4.1.3:
+    resolution: {integrity: sha512-/6w/C21Pm1A7aZitlI5Ni/2J6FFQN8i1Cvz3kHABAAbw93v/NlvKdVOqz7CCWz/3iv/JplRSEEZ83XION15ovw==}
+    engines: {node: '>=6'}
+
   ansi-regex@5.0.1:
     resolution: {integrity: sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==}
     engines: {node: '>=8'}
@@ -400,6 +432,9 @@ packages:
     resolution: {integrity: sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==}
     engines: {node: '>=10'}
 
+  change-case@5.4.4:
+    resolution: {integrity: sha512-HRQyTk2/YPEkt9TnUPbOpr64Uw3KOicFWPVBb+xiHvd6eBx/qPr9xqfBFDT8P2vWsvvz4jbEkfDe71W3VyNu2w==}
+
   color-convert@2.0.1:
     resolution: {integrity: sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==}
     engines: {node: '>=7.0.0'}
@@ -407,6 +442,9 @@ packages:
   color-name@1.1.4:
     resolution: {integrity: sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==}
 
+  colorette@1.4.0:
+    resolution: {integrity: sha512-Y2oEozpomLn7Q3HFP7dpww7AtMJplbM9lGZP6RDfHqmbeRjiwRg4n6VM6j4KLmRke85uWEI7JqF17f3pqdRA0g==}
+
   concat-map@0.0.1:
     resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==}
 
@@ -575,6 +613,10 @@ packages:
     resolution: {integrity: sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==}
     engines: {node: '>=8'}
 
+  https-proxy-agent@7.0.6:
+    resolution: {integrity: sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==}
+    engines: {node: '>= 14'}
+
   ignore@5.3.2:
     resolution: {integrity: sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==}
     engines: {node: '>= 4'}
@@ -591,6 +633,10 @@ packages:
     resolution: {integrity: sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==}
     engines: {node: '>=0.8.19'}
 
+  index-to-position@1.2.0:
+    resolution: {integrity: sha512-Yg7+ztRkqslMAS2iFaU+Oa4KTSidr63OsFGlOrJoW981kIYO3CGCS3wA95P1mUi/IVSJkn0D479KTJpVpvFNuw==}
+    engines: {node: '>=18'}
+
   is-extglob@2.1.1:
     resolution: {integrity: sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==}
     engines: {node: '>=0.10.0'}
@@ -614,16 +660,30 @@ packages:
     resolution: {integrity: sha512-zptv57P3GpL+O0I7VdMJNBZCu+BPHVQUk55Ft8/QCJjTVxrnJHuVuX/0Bl2A6/+2oyR/ZMEuFKwmzqqZ/U5nPQ==}
     engines: {node: 20 || >=22}
 
+  js-levenshtein@1.1.6:
+    resolution: {integrity: sha512-X2BB11YZtrRqY4EnQcLX5Rh373zbK4alC1FW7D7MBhL2gtcC17cTnr6DmfHZeS0s2rTHjUTMMHfG7gO8SSdw+g==}
+    engines: {node: '>=0.10.0'}
+
+  js-tokens@4.0.0:
+    resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
+
   js-yaml@4.1.0:
     resolution: {integrity: sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==}
     hasBin: true
 
+  js-yaml@4.1.1:
+    resolution: {integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==}
+    hasBin: true
+
   json-buffer@3.0.1:
     resolution: {integrity: sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==}
 
   json-schema-traverse@0.4.1:
     resolution: {integrity: sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==}
 
+  json-schema-traverse@1.0.0:
+    resolution: {integrity: sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==}
+
   json-stable-stringify-without-jsonify@1.0.1:
     resolution: {integrity: sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==}
 
@@ -733,6 +793,10 @@ packages:
   minimatch@3.1.2:
     resolution: {integrity: sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==}
 
+  minimatch@5.1.9:
+    resolution: {integrity: sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==}
+    engines: {node: '>=10'}
+
   minimatch@9.0.5:
     resolution: {integrity: sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==}
     engines: {node: '>=16 || 14 >=14.17'}
@@ -755,6 +819,18 @@ packages:
   obug@2.1.1:
     resolution: {integrity: sha512-uTqF9MuPraAQ+IsnPf366RG4cP9RtUi7MLO1N3KEc+wb0a6yKpeL0lmk2IB1jY5KHPAlTc6T/JRdC/YqxHNwkQ==}
 
+  openapi-fetch@0.17.0:
+    resolution: {integrity: sha512-PsbZR1wAPcG91eEthKhN+Zn92FMHxv+/faECIwjXdxfTODGSGegYv0sc1Olz+HYPvKOuoXfp+0pA2XVt2cI0Ig==}
+
+  openapi-typescript-helpers@0.1.0:
+    resolution: {integrity: sha512-OKTGPthhivLw/fHz6c3OPtg72vi86qaMlqbJuVJ23qOvQ+53uw1n7HdmkJFibloF7QEjDrDkzJiOJuockM/ljw==}
+
+  openapi-typescript@7.13.0:
+    resolution: {integrity: sha512-EFP392gcqXS7ntPvbhBzbF8TyBA+baIYEm791Hy5YkjDYKTnk/Tn5OQeKm5BIZvJihpp8Zzr4hzx0Irde1LNGQ==}
+    hasBin: true
+    peerDependencies:
+      typescript: ^5.x
+
   optionator@0.9.4:
     resolution: {integrity: sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==}
     engines: {node: '>= 0.8.0'}
@@ -774,6 +850,10 @@ packages:
     resolution: {integrity: sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==}
     engines: {node: '>=6'}
 
+  parse-json@8.3.0:
+    resolution: {integrity: sha512-ybiGyvspI+fAoRQbIPRddCcSTV9/LsJbf0e/S85VLowVGzRmokfneg2kwVW/KU5rOXrPSbF1qAKPMgNTqqROQQ==}
+    engines: {node: '>=18'}
+
   path-exists@4.0.0:
     resolution: {integrity: sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==}
     engines: {node: '>=8'}
@@ -800,6 +880,10 @@ packages:
     resolution: {integrity: sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==}
     engines: {node: '>=12'}
 
+  pluralize@8.0.0:
+    resolution: {integrity: sha512-Nc3IT5yHzflTfbjgqWcCPpo7DaKy4FnpB0l/zCAW0Tc7jxAiuqSxHasntB3D7887LSrA93kDJ9IXovxJYxyLCA==}
+    engines: {node: '>=4'}
+
   postcss@8.5.8:
     resolution: {integrity: sha512-OW/rX8O/jXnm82Ey1k44pObPtdblfiuWnrd8X7GJ7emImCOstunGbXUpp7HdBrFQX6rJzn3sPT397Wp5aCwCHg==}
     engines: {node: ^10 || ^12 || >=14}
@@ -815,6 +899,10 @@ packages:
   queue-microtask@1.2.3:
     resolution: {integrity: sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==}
 
+  require-from-string@2.0.2:
+    resolution: {integrity: sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==}
+    engines: {node: '>=0.10.0'}
+
   resolve-from@4.0.0:
     resolution: {integrity: sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==}
     engines: {node: '>=4'}
@@ -886,6 +974,10 @@ packages:
     resolution: {integrity: sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==}
     engines: {node: '>=8'}
 
+  supports-color@10.2.2:
+    resolution: {integrity: sha512-SS+jx45GF1QjgEXQx4NJZV9ImqmO2NPz5FNsIHrsDjh2YsHnawpan7SNQ1o8NuhrbHZy9AZhIoCUiCeaW/C80g==}
+    engines: {node: '>=18'}
+
   supports-color@7.2.0:
     resolution: {integrity: sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==}
     engines: {node: '>=8'}
@@ -922,6 +1014,10 @@ packages:
     resolution: {integrity: sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==}
     engines: {node: '>= 0.8.0'}
 
+  type-fest@4.41.0:
+    resolution: {integrity: sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA==}
+    engines: {node: '>=16'}
+
   typescript-eslint@8.46.0:
     resolution: {integrity: sha512-6+ZrB6y2bT2DX3K+Qd9vn7OFOJR+xSLDj+Aw/N3zBwUt27uTw2sw2TE2+UcY1RiyBZkaGbTkVg9SSdPNUG6aUw==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
@@ -934,6 +1030,9 @@ packages:
     engines: {node: '>=14.17'}
     hasBin: true
 
+  uri-js-replace@1.0.1:
+    resolution: {integrity: sha512-W+C9NWNLFOoBI2QWDp4UT9pv65r2w5Cx+3sTYFvtMdDBxkKt1syCqsUdSFAChbEe1uK5TfS04wt/nGwmaeIQ0g==}
+
   uri-js@4.4.1:
     resolution: {integrity: sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==}
 
@@ -1041,12 +1140,27 @@ packages:
     resolution: {integrity: sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ==}
     engines: {node: '>=12'}
 
+  yaml-ast-parser@0.0.43:
+    resolution: {integrity: sha512-2PTINUwsRqSd+s8XxKaJWQlUuEMHJQyEuh2edBbW8KNJz0SJPwUSD2zRWqezFEdN7IzAgeuYHFUCF7o8zRdZ0A==}
+
+  yargs-parser@21.1.1:
+    resolution: {integrity: sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==}
+    engines: {node: '>=12'}
+
   yocto-queue@0.1.0:
     resolution: {integrity: sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==}
     engines: {node: '>=10'}
 
 snapshots:
 
+  '@babel/code-frame@7.29.7':
+    dependencies:
+      '@babel/helper-validator-identifier': 7.29.7
+      js-tokens: 4.0.0
+      picocolors: 1.1.1
+
+  '@babel/helper-validator-identifier@7.29.7': {}
+
   '@emnapi/core@1.9.1':
     dependencies:
       '@emnapi/wasi-threads': 1.2.0
@@ -1073,7 +1187,7 @@ snapshots:
   '@eslint/config-array@0.21.0':
     dependencies:
       '@eslint/object-schema': 2.1.6
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@10.2.2)
       minimatch: 3.1.2
     transitivePeerDependencies:
       - supports-color
@@ -1089,7 +1203,7 @@ snapshots:
   '@eslint/eslintrc@3.3.1':
     dependencies:
       ajv: 6.12.6
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@10.2.2)
       espree: 10.4.0
       globals: 14.0.0
       ignore: 5.3.2
@@ -1158,6 +1272,29 @@ snapshots:
 
   '@oxc-project/types@0.122.0': {}
 
+  '@redocly/ajv@8.11.2':
+    dependencies:
+      fast-deep-equal: 3.1.3
+      json-schema-traverse: 1.0.0
+      require-from-string: 2.0.2
+      uri-js-replace: 1.0.1
+
+  '@redocly/config@0.22.0': {}
+
+  '@redocly/openapi-core@1.34.15(supports-color@10.2.2)':
+    dependencies:
+      '@redocly/ajv': 8.11.2
+      '@redocly/config': 0.22.0
+      colorette: 1.4.0
+      https-proxy-agent: 7.0.6(supports-color@10.2.2)
+      js-levenshtein: 1.1.6
+      js-yaml: 4.1.1
+      minimatch: 5.1.9
+      pluralize: 8.0.0
+      yaml-ast-parser: 0.0.43
+    transitivePeerDependencies:
+      - supports-color
+
   '@rolldown/binding-android-arm64@1.0.0-rc.12':
     optional: true
 
@@ -1253,7 +1390,7 @@ snapshots:
       '@typescript-eslint/types': 8.46.0
       '@typescript-eslint/typescript-estree': 8.46.0(typescript@5.9.3)
       '@typescript-eslint/visitor-keys': 8.46.0
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@10.2.2)
       eslint: 9.37.0
       typescript: 5.9.3
     transitivePeerDependencies:
@@ -1263,7 +1400,7 @@ snapshots:
     dependencies:
       '@typescript-eslint/tsconfig-utils': 8.46.0(typescript@5.9.3)
       '@typescript-eslint/types': 8.46.0
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@10.2.2)
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
@@ -1282,7 +1419,7 @@ snapshots:
       '@typescript-eslint/types': 8.46.0
       '@typescript-eslint/typescript-estree': 8.46.0(typescript@5.9.3)
       '@typescript-eslint/utils': 8.46.0(eslint@9.37.0)(typescript@5.9.3)
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@10.2.2)
       eslint: 9.37.0
       ts-api-utils: 2.1.0(typescript@5.9.3)
       typescript: 5.9.3
@@ -1297,7 +1434,7 @@ snapshots:
       '@typescript-eslint/tsconfig-utils': 8.46.0(typescript@5.9.3)
       '@typescript-eslint/types': 8.46.0
       '@typescript-eslint/visitor-keys': 8.46.0
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@10.2.2)
       fast-glob: 3.3.3
       is-glob: 4.0.3
       minimatch: 9.0.5
@@ -1370,6 +1507,8 @@ snapshots:
 
   acorn@8.15.0: {}
 
+  agent-base@7.1.4: {}
+
   ajv@6.12.6:
     dependencies:
       fast-deep-equal: 3.1.3
@@ -1377,6 +1516,8 @@ snapshots:
       json-schema-traverse: 0.4.1
       uri-js: 4.4.1
 
+  ansi-colors@4.1.3: {}
+
   ansi-regex@5.0.1: {}
 
   ansi-regex@6.2.2: {}
@@ -1415,12 +1556,16 @@ snapshots:
       ansi-styles: 4.3.0
       supports-color: 7.2.0
 
+  change-case@5.4.4: {}
+
   color-convert@2.0.1:
     dependencies:
       color-name: 1.1.4
 
   color-name@1.1.4: {}
 
+  colorette@1.4.0: {}
+
   concat-map@0.0.1: {}
 
   convert-source-map@2.0.0: {}
@@ -1431,9 +1576,11 @@ snapshots:
       shebang-command: 2.0.0
       which: 2.0.2
 
-  debug@4.4.3:
+  debug@4.4.3(supports-color@10.2.2):
     dependencies:
       ms: 2.1.3
+    optionalDependencies:
+      supports-color: 10.2.2
 
   deep-is@0.1.4: {}
 
@@ -1476,7 +1623,7 @@ snapshots:
       ajv: 6.12.6
       chalk: 4.1.2
       cross-spawn: 7.0.6
-      debug: 4.4.3
+      debug: 4.4.3(supports-color@10.2.2)
       escape-string-regexp: 4.0.0
       eslint-scope: 8.4.0
       eslint-visitor-keys: 4.2.1
@@ -1595,6 +1742,13 @@ snapshots:
 
   has-flag@4.0.0: {}
 
+  https-proxy-agent@7.0.6(supports-color@10.2.2):
+    dependencies:
+      agent-base: 7.1.4
+      debug: 4.4.3(supports-color@10.2.2)
+    transitivePeerDependencies:
+      - supports-color
+
   ignore@5.3.2: {}
 
   ignore@7.0.5: {}
@@ -1606,6 +1760,8 @@ snapshots:
 
   imurmurhash@0.1.4: {}
 
+  index-to-position@1.2.0: {}
+
   is-extglob@2.1.1: {}
 
   is-fullwidth-code-point@3.0.0: {}
@@ -1622,14 +1778,24 @@ snapshots:
     dependencies:
       '@isaacs/cliui': 8.0.2
 
+  js-levenshtein@1.1.6: {}
+
+  js-tokens@4.0.0: {}
+
   js-yaml@4.1.0:
     dependencies:
       argparse: 2.0.1
 
+  js-yaml@4.1.1:
+    dependencies:
+      argparse: 2.0.1
+
   json-buffer@3.0.1: {}
 
   json-schema-traverse@0.4.1: {}
 
+  json-schema-traverse@1.0.0: {}
+
   json-stable-stringify-without-jsonify@1.0.1: {}
 
   keyv@4.5.4:
@@ -1717,6 +1883,10 @@ snapshots:
     dependencies:
       brace-expansion: 1.1.12
 
+  minimatch@5.1.9:
+    dependencies:
+      brace-expansion: 2.0.2
+
   minimatch@9.0.5:
     dependencies:
       brace-expansion: 2.0.2
@@ -1731,6 +1901,22 @@ snapshots:
 
   obug@2.1.1: {}
 
+  openapi-fetch@0.17.0:
+    dependencies:
+      openapi-typescript-helpers: 0.1.0
+
+  openapi-typescript-helpers@0.1.0: {}
+
+  openapi-typescript@7.13.0(typescript@5.9.3):
+    dependencies:
+      '@redocly/openapi-core': 1.34.15(supports-color@10.2.2)
+      ansi-colors: 4.1.3
+      change-case: 5.4.4
+      parse-json: 8.3.0
+      supports-color: 10.2.2
+      typescript: 5.9.3
+      yargs-parser: 21.1.1
+
   optionator@0.9.4:
     dependencies:
       deep-is: 0.1.4
@@ -1754,6 +1940,12 @@ snapshots:
     dependencies:
       callsites: 3.1.0
 
+  parse-json@8.3.0:
+    dependencies:
+      '@babel/code-frame': 7.29.7
+      index-to-position: 1.2.0
+      type-fest: 4.41.0
+
   path-exists@4.0.0: {}
 
   path-key@3.1.1: {}
@@ -1771,6 +1963,8 @@ snapshots:
 
   picomatch@4.0.4: {}
 
+  pluralize@8.0.0: {}
+
   postcss@8.5.8:
     dependencies:
       nanoid: 3.3.11
@@ -1783,6 +1977,8 @@ snapshots:
 
   queue-microtask@1.2.3: {}
 
+  require-from-string@2.0.2: {}
+
   resolve-from@4.0.0: {}
 
   reusify@1.1.0: {}
@@ -1860,6 +2056,8 @@ snapshots:
 
   strip-json-comments@3.1.1: {}
 
+  supports-color@10.2.2: {}
+
   supports-color@7.2.0:
     dependencies:
       has-flag: 4.0.0
@@ -1889,6 +2087,8 @@ snapshots:
     dependencies:
       prelude-ls: 1.2.1
 
+  type-fest@4.41.0: {}
+
   typescript-eslint@8.46.0(eslint@9.37.0)(typescript@5.9.3):
     dependencies:
       '@typescript-eslint/eslint-plugin': 8.46.0(@typescript-eslint/parser@8.46.0(eslint@9.37.0)(typescript@5.9.3))(eslint@9.37.0)(typescript@5.9.3)
@@ -1902,6 +2102,8 @@ snapshots:
 
   typescript@5.9.3: {}
 
+  uri-js-replace@1.0.1: {}
+
   uri-js@4.4.1:
     dependencies:
       punycode: 2.3.1
@@ -1969,4 +2171,8 @@ snapshots:
       string-width: 5.1.2
       strip-ansi: 7.1.2
 
+  yaml-ast-parser@0.0.43: {}
+
+  yargs-parser@21.1.1: {}
+
   yocto-queue@0.1.0: {}
diff --git a/spec/SOURCE.md b/spec/SOURCE.md
new file mode 100644
index 0000000..630e9e2
--- /dev/null
+++ b/spec/SOURCE.md
@@ -0,0 +1,38 @@
+# Spec source
+
+`spec/client.yaml` is **vendored** (committed) from the Lunogram platform repo.
+The SDK's low-level layer (`src/gen/schema.ts`) is generated from it via
+`pnpm generate`. Do not hand-edit either file.
+
+| Field        | Value                                                                                 |
+| ------------ | ------------------------------------------------------------------------------------- |
+| Source repo  | https://github.com/lunogram/platform                                                  |
+| Spec path    | `internal/http/controllers/v1/client/oapi/resources.yml`                              |
+| Pinned ref   | `a12f901dc98e7ced44efbad27a388e8bf5ee0f3a`                                            |
+
+Raw URL used by `spec-sync.yml` to re-fetch:
+
+```
+https://raw.githubusercontent.com/lunogram/platform/a12f901dc98e7ced44efbad27a388e8bf5ee0f3a/internal/http/controllers/v1/client/oapi/resources.yml
+```
+
+## About the pin
+
+The ref above is the head of platform **PR #262**'s branch — a branch/commit
+pin used during development. Pinning to a commit means **no platform release is
+required** to consume the spec: any ref (branch, tag, or SHA) is fetchable from
+the public repo via the raw URL.
+
+**TODO:** once the platform cuts a release that ships the client spec (e.g.
+`client.yaml` from a `v*.*.*` tag), flip the pinned ref to that tag for a stable,
+reproducible source.
+
+## How to bump the pin
+
+1. Update the **Pinned ref** value above (and the raw URL).
+2. Run `pnpm generate` to regenerate `src/gen/schema.ts`.
+3. Commit `spec/` and `src/gen/` together.
+
+The `spec-sync.yml` workflow automates re-fetching at the current pin and opens a
+PR when the spec or generated output drifts; bumping the pin itself is a manual
+edit to this file.
diff --git a/spec/client.yaml b/spec/client.yaml
new file mode 100644
index 0000000..5bdf2ca
--- /dev/null
+++ b/spec/client.yaml
@@ -0,0 +1,1779 @@
+openapi: 3.0.3
+info:
+  title: Lunogram Public API
+  description: API for ingesting data such as user profiles and events.
+  version: 1.0.0
+
+paths:
+  /api/client/projects/{projectID}/users:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    post:
+      summary: Upsert user
+      description: Used by client libraries to create or update a user profile. The project is taken from the projectID path parameter.
+      operationId: upsertUserClient
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/IdentifyRequest"
+      responses:
+        "200":
+          description: User upserted successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/User"
+        default:
+          $ref: "#/components/responses/Error"
+    delete:
+      summary: Delete user
+      description: |
+        Used by client libraries to delete a user by external_id or anonymous_id.
+        The project is taken from the projectID path parameter.
+      operationId: deleteUserClient
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DeleteUserRequest"
+      responses:
+        "204":
+          description: User deleted successfully
+        default:
+          $ref: "#/components/responses/Error"
+
+  /api/client/projects/{projectID}/users/events:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    post:
+      summary: Post user events
+      description: |
+        Used by client libraries to trigger events for a user that can be used to execute a step in a journey or update a virtual list.
+        Multiple events can be sent in a single request and are processed asynchronously.
+        Each event is handled independently: if one event fails to be accepted or processed, other events in the same request may still be published successfully.
+        Clients requiring deterministic retry or recovery behavior must submit events individually.
+        The project is taken from the projectID path parameter.
+      operationId: postUserEvents
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PostEventsRequest"
+      responses:
+        "202":
+          description: Events accepted for asynchronous processing
+        default:
+          $ref: "#/components/responses/Error"
+
+  /api/client/projects/{projectID}/users/inbox:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    post:
+      summary: Create user inbox messages
+      description: Creates one or more inbox messages for users identified by external identifiers. Messages are processed asynchronously.
+      operationId: postUserInboxMessages
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PostUserInboxMessagesRequest"
+      responses:
+        "202":
+          description: Inbox messages accepted for asynchronous processing
+        default:
+          $ref: "#/components/responses/Error"
+    get:
+      summary: Query user inbox messages
+      description: Returns visible, non-expired inbox messages for a user identified by source and external_id.
+      operationId: getUserInbox
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      parameters:
+        - name: source
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: external_id
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: status
+          in: query
+          schema:
+            type: string
+            enum: [unread, read, archived]
+        - name: tags
+          in: query
+          schema:
+            type: string
+          description: Comma-separated tag filter. All listed tags must be present.
+        - name: message_source
+          in: query
+          schema:
+            type: string
+        - name: priority
+          in: query
+          schema:
+            type: integer
+        - name: channel
+          in: query
+          required: true
+          schema:
+            $ref: "#/components/schemas/Channel"
+        - $ref: "#/components/parameters/Limit"
+        - $ref: "#/components/parameters/Offset"
+      responses:
+        "200":
+          description: User inbox messages retrieved successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/InboxMessageList"
+        default:
+          $ref: "#/components/responses/Error"
+
+  /api/client/projects/{projectID}/users/inbox/count:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    get:
+      summary: Count user inbox messages
+      description: Returns unread and total visible inbox message counts for a user.
+      operationId: getUserInboxCount
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      parameters:
+        - name: source
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: external_id
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: channel
+          in: query
+          required: true
+          schema:
+            $ref: "#/components/schemas/Channel"
+      responses:
+        "200":
+          description: User inbox count retrieved successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/InboxCount"
+        default:
+          $ref: "#/components/responses/Error"
+
+  /api/client/projects/{projectID}/users/inbox/read:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    post:
+      summary: Mark user inbox messages read
+      description: Marks one or more user inbox messages as read. Processed asynchronously.
+      operationId: postUserInboxRead
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/UserInboxMessageEvents"
+      responses:
+        "202":
+          description: Inbox read events accepted for asynchronous processing
+        default:
+          $ref: "#/components/responses/Error"
+
+  /api/client/projects/{projectID}/users/inbox/archived:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    post:
+      summary: Mark user inbox messages archived
+      description: Marks one or more user inbox messages as archived. Processed asynchronously.
+      operationId: postUserInboxArchived
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/UserInboxMessageEvents"
+      responses:
+        "202":
+          description: Inbox archived events accepted for asynchronous processing
+        default:
+          $ref: "#/components/responses/Error"
+
+  /api/client/projects/{projectID}/organizations:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    post:
+      summary: Upsert organization
+      description: |
+        Used by client libraries to create or update an organization by external_id.
+        The project is taken from the projectID path parameter.
+      operationId: upsertOrganizationClient
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/OrganizationRequest"
+      responses:
+        "200":
+          description: Organization upserted successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Organization"
+        default:
+          $ref: "#/components/responses/Error"
+    delete:
+      summary: Delete organization
+      description: |
+        Used by client libraries to delete an organization by external_id.
+        This will also remove all organization memberships.
+        The project is taken from the projectID path parameter.
+      operationId: deleteOrganizationClient
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DeleteOrganizationRequest"
+      responses:
+        "204":
+          description: Organization deleted successfully
+        default:
+          $ref: "#/components/responses/Error"
+
+  /api/client/projects/{projectID}/organizations/users:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    post:
+      summary: Add user to organization
+      description: |
+        Used by client libraries to add a user to an organization with optional org-specific data.
+        Both organization and user are identified by their external_id.
+        The project is taken from the projectID path parameter.
+      operationId: addOrganizationUserClient
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/OrganizationUserRequest"
+      responses:
+        "200":
+          description: User added to organization successfully
+        default:
+          $ref: "#/components/responses/Error"
+
+    delete:
+      summary: Remove user from organization
+      description: |
+        Used by client libraries to remove a user from an organization.
+        Both organization and user are identified by their external_id.
+        The project is taken from the projectID path parameter.
+      operationId: removeOrganizationUserClient
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/RemoveOrganizationUserRequest"
+      responses:
+        "204":
+          description: User removed from organization successfully
+        default:
+          $ref: "#/components/responses/Error"
+
+  /api/client/projects/{projectID}/users/scheduled:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    post:
+      summary: Upsert user scheduled
+      description: |
+        Used by client libraries to create or update a scheduled resource for a user.
+        The user is identified by external_id or anonymous_id.
+        This triggers journey entrance recalculation for any journeys that depend on the scheduled resource.
+        The project is taken from the projectID path parameter.
+      operationId: upsertUserScheduledClient
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/UpsertUserScheduledRequest"
+      responses:
+        "202":
+          description: Scheduled resource accepted for asynchronous processing
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ScheduledAccepted"
+        default:
+          $ref: "#/components/responses/Error"
+    delete:
+      summary: Delete user scheduled
+      description: |
+        Used by client libraries to delete all scheduled instances for a user with a given scheduled resource name.
+        The user is identified by external_id or anonymous_id.
+        This cancels any pending journey entrance states that depend on the scheduled resource.
+        The project is taken from the projectID path parameter.
+      operationId: deleteUserScheduledClient
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DeleteUserScheduledRequest"
+      responses:
+        "200":
+          description: User scheduled deleted successfully
+        default:
+          $ref: "#/components/responses/Error"
+
+  /api/client/projects/{projectID}/organizations/scheduled:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    post:
+      summary: Upsert organization scheduled
+      description: |
+        Used by client libraries to create or update a scheduled resource for an organization.
+        The organization is identified by external_id.
+        This triggers journey entrance recalculation for any journeys that depend on the scheduled resource.
+        The project is taken from the projectID path parameter.
+      operationId: upsertOrganizationScheduledClient
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/UpsertOrganizationScheduledRequest"
+      responses:
+        "202":
+          description: Scheduled resource accepted for asynchronous processing
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ScheduledAccepted"
+        default:
+          $ref: "#/components/responses/Error"
+    delete:
+      summary: Delete organization scheduled
+      description: |
+        Used by client libraries to delete all scheduled instances for an organization with a given scheduled resource name.
+        The organization is identified by external_id.
+        This cancels any pending journey entrance states that depend on the scheduled resource.
+        The project is taken from the projectID path parameter.
+      operationId: deleteOrganizationScheduledClient
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DeleteOrganizationScheduledRequest"
+      responses:
+        "200":
+          description: Organization scheduled deleted successfully
+        default:
+          $ref: "#/components/responses/Error"
+
+  /api/client/projects/{projectID}/organizations/events:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    post:
+      summary: Post organization events
+      description: |
+        Used by client libraries to trigger events on an organization.
+        The organization is identified by external_id.
+        Events are processed asynchronously and can trigger journeys for all users in the organization.
+        The project is taken from the projectID path parameter.
+      operationId: postOrganizationEventsClient
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PostOrganizationEventsRequest"
+      responses:
+        "202":
+          description: Events accepted for asynchronous processing
+        default:
+          $ref: "#/components/responses/Error"
+
+  /api/client/projects/{projectID}/organizations/inbox:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    post:
+      summary: Create organization inbox messages
+      description: Creates one or more inbox messages for organizations identified by external identifiers. Messages are processed asynchronously.
+      operationId: postOrganizationInboxMessages
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/PostOrganizationInboxMessagesRequest"
+      responses:
+        "202":
+          description: Inbox messages accepted for asynchronous processing
+        default:
+          $ref: "#/components/responses/Error"
+    get:
+      summary: Query organization inbox messages
+      description: Returns visible, non-expired inbox messages for an organization identified by source and external_id.
+      operationId: getOrganizationInbox
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      parameters:
+        - name: source
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: external_id
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: status
+          in: query
+          schema:
+            type: string
+            enum: [unread, read, archived]
+        - name: tags
+          in: query
+          schema:
+            type: string
+          description: Comma-separated tag filter. All listed tags must be present.
+        - name: message_source
+          in: query
+          schema:
+            type: string
+        - name: priority
+          in: query
+          schema:
+            type: integer
+        - name: channel
+          in: query
+          required: true
+          schema:
+            $ref: "#/components/schemas/Channel"
+        - $ref: "#/components/parameters/Limit"
+        - $ref: "#/components/parameters/Offset"
+      responses:
+        "200":
+          description: Organization inbox messages retrieved successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/InboxMessageList"
+        default:
+          $ref: "#/components/responses/Error"
+
+  /api/client/projects/{projectID}/organizations/inbox/count:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    get:
+      summary: Count organization inbox messages
+      description: Returns unread and total visible inbox message counts for an organization.
+      operationId: getOrganizationInboxCount
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      parameters:
+        - name: source
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: external_id
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: channel
+          in: query
+          required: true
+          schema:
+            $ref: "#/components/schemas/Channel"
+      responses:
+        "200":
+          description: Organization inbox count retrieved successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/InboxCount"
+        default:
+          $ref: "#/components/responses/Error"
+
+  /api/client/projects/{projectID}/organizations/inbox/read:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    post:
+      summary: Mark organization inbox messages read
+      description: Marks one or more organization inbox messages as read. Processed asynchronously.
+      operationId: postOrganizationInboxRead
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/OrganizationInboxMessageEvents"
+      responses:
+        "202":
+          description: Inbox read events accepted for asynchronous processing
+        default:
+          $ref: "#/components/responses/Error"
+
+  /api/client/projects/{projectID}/organizations/inbox/archived:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    post:
+      summary: Mark organization inbox messages archived
+      description: Marks one or more organization inbox messages as archived. Processed asynchronously.
+      operationId: postOrganizationInboxArchived
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/OrganizationInboxMessageEvents"
+      responses:
+        "202":
+          description: Inbox archived events accepted for asynchronous processing
+        default:
+          $ref: "#/components/responses/Error"
+
+  /unsubscribe/email:
+    get:
+      summary: Email unsubscribe page
+      description: |
+        Public endpoint for email unsubscribe links. Extracts user and campaign information
+        from the encoded URL and displays an unsubscribe confirmation page.
+      operationId: emailUnsubscribe
+      tags:
+        - Subscriptions
+      parameters:
+        - name: link
+          in: query
+          required: true
+          schema:
+            type: string
+          description: Encoded unsubscribe link with user and campaign data
+      responses:
+        "200":
+          description: Unsubscribe confirmation page
+          content:
+            text/html:
+              schema:
+                type: string
+
+  /preferences/{projectID}/{userID}:
+    get:
+      summary: Subscription preferences page
+      description: |
+        Public endpoint for users to view and manage their subscription preferences.
+        Shows all public subscriptions with current user state.
+      operationId: getPreferencesPage
+      tags:
+        - Subscriptions
+      parameters:
+        - name: projectID
+          in: path
+          required: true
+          schema:
+            type: string
+            format: uuid
+          description: The project ID
+        - name: userID
+          in: path
+          required: true
+          schema:
+            type: string
+            format: uuid
+          description: The user ID
+      responses:
+        "200":
+          description: Subscription preferences page
+          content:
+            text/html:
+              schema:
+                type: string
+
+    post:
+      summary: Update subscription preferences
+      description: |
+        Handles form submission to update user subscription preferences.
+        Redirects back to preferences page with success indicator.
+      operationId: updatePreferences
+      tags:
+        - Subscriptions
+      parameters:
+        - name: projectID
+          in: path
+          required: true
+          schema:
+            type: string
+            format: uuid
+          description: The project ID
+        - name: userID
+          in: path
+          required: true
+          schema:
+            type: string
+            format: uuid
+          description: The user ID
+      requestBody:
+        required: true
+        content:
+          application/x-www-form-urlencoded:
+            schema:
+              type: object
+              properties:
+                subscriptionIds:
+                  type: array
+                  items:
+                    type: string
+                    format: uuid
+                  description: Array of subscription IDs to keep subscribed
+      responses:
+        "302":
+          description: Redirect to preferences page with success indicator
+        "200":
+          description: Success response (for htmx partial updates)
+          content:
+            text/html:
+              schema:
+                type: string
+
+  /api/client/projects/{projectID}/users/devices:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    post:
+      summary: Register device
+      description: Register or update a device's push subscription. The project is taken from the projectID path parameter.
+      operationId: registerDevice
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DeviceRegistration"
+      responses:
+        "201":
+          description: Device registered successfully
+        default:
+          $ref: "#/components/responses/Error"
+
+  /api/client/projects/{projectID}/push/vapid:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    get:
+      summary: Get VAPID public key
+      description: Retrieves the VAPID public key for push notifications
+      operationId: getVapidPublicKey
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      responses:
+        "200":
+          description: VAPID public key retrieved successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/VapidPublicKey"
+        default:
+          $ref: "#/components/responses/Error"
+
+  /api/client/projects/{projectID}/auth-methods/{authMethodID}/sessions:
+    parameters:
+      - $ref: "#/components/parameters/ProjectID"
+    post:
+      summary: Mint a session token
+      description: |
+        Mints a short-lived session token for an end user, to be used from the
+        client. Called server-side with an API key; the session's permissions are
+        defined by the session auth method (policy) named in the path.
+      operationId: createSession
+      tags:
+        - Client
+      security:
+        - HttpBearerAuth: []
+      parameters:
+        - name: authMethodID
+          in: path
+          required: true
+          description: The session auth method (policy) that defines what the session may do.
+          schema:
+            type: string
+            format: uuid
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/CreateSession"
+      responses:
+        "201":
+          description: Session token minted successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/SessionToken"
+        default:
+          $ref: "#/components/responses/Error"
+
+components:
+  parameters:
+    ProjectID:
+      name: projectID
+      in: path
+      required: true
+      schema:
+        type: string
+        format: uuid
+      description: The project the request acts on. Must match the project the presented credential is authorized for.
+
+    Limit:
+      name: limit
+      in: query
+      required: false
+      schema:
+        type: integer
+        minimum: 1
+        maximum: 100
+        default: 20
+        x-go-type: PaginationLimit
+      description: Maximum number of items to return
+
+    Offset:
+      name: offset
+      in: query
+      required: false
+      schema:
+        type: integer
+        minimum: 0
+        default: 0
+        x-go-type: PaginationOffset
+      description: Number of items to skip
+
+  responses:
+    Error:
+      description: Error response
+      content:
+        application/json:
+          schema:
+            $ref: "#/components/schemas/Problem"
+
+  schemas:
+    CreateSession:
+      type: object
+      description: Request to mint a session token for an end user.
+      required:
+        - user_id
+      properties:
+        user_id:
+          type: string
+          description: The end user's external identifier (the session subject).
+          example: "user_12345"
+
+    SessionToken:
+      type: object
+      required:
+        - token
+        - expires_at
+      properties:
+        token:
+          type: string
+          description: The signed session token (a bearer token for the Client API).
+        expires_at:
+          type: string
+          format: date-time
+
+    Channel:
+      type: string
+      enum: [email, sms, push, inbox]
+
+    Problem:
+      type: object
+      required:
+        - title
+        - detail
+      properties:
+        title:
+          type: string
+          description: |
+            A short summary of the problem type. Written in English and readable for engineers, usually not suited for non technical stakeholders and not localized.
+          example: some title for the error situation
+        detail:
+          type: string
+          description: |
+            A human readable explanation specific to this occurrence of the problem that is helpful to locate the problem and give advice on how to proceed. Written in English and readable for engineers, usually not suited for non technical stakeholders and not localized.
+          example: some description for the error situation
+
+    ExternalID:
+      type: object
+      description: An external identifier with source and optional metadata
+      required:
+        - external_id
+      properties:
+        source:
+          type: string
+          default: "default"
+          example: "default"
+          description: Source of the identifier (e.g. "default", "anonymous", or a custom source). Defaults to "default" if not provided.
+        external_id:
+          type: string
+          minLength: 1
+          example: "user_12345"
+          description: The external identifier value
+        metadata:
+          type: object
+          additionalProperties: true
+          nullable: true
+          x-go-type: map[string]any
+          description: Optional metadata associated with this identifier
+
+    ExternalIDResponse:
+      type: object
+      description: An external identifier as returned in responses, including database ID and timestamps
+      required:
+        - id
+        - source
+        - external_id
+        - created_at
+        - updated_at
+      properties:
+        id:
+          type: string
+          format: uuid
+          example: "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
+        source:
+          type: string
+          example: "default"
+        external_id:
+          type: string
+          example: "user_12345"
+        metadata:
+          type: object
+          additionalProperties: true
+          nullable: true
+          x-go-type: map[string]any
+        created_at:
+          type: string
+          format: date-time
+          example: "2025-11-19T14:18:42.960Z"
+        updated_at:
+          type: string
+          format: date-time
+          example: "2025-11-23T17:20:00.021Z"
+
+    User:
+      type: object
+      required:
+        - id
+        - project_id
+        - identifier
+        - data
+        - has_push_device
+        - version
+        - created_at
+        - updated_at
+      properties:
+        id:
+          type: string
+          format: uuid
+          example: "9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d"
+        project_id:
+          type: string
+          format: uuid
+          example: "4c9d3163-7b64-4f9e-9068-d2e4b96be56b"
+        identifier:
+          type: array
+          items:
+            $ref: "#/components/schemas/ExternalIDResponse"
+          description: External identifiers associated with this user
+        email:
+          type: string
+          format: email
+          example: "user@example.com"
+          x-go-type: string
+        phone:
+          type: string
+          example: "+1234567890"
+          description: E.164 formatted phone number
+          x-go-type: string
+          format: phone
+        data:
+          type: object
+          additionalProperties: true
+          x-go-type: map[string]any
+          example:
+            first_name: "John"
+            last_name: "Doe"
+        timezone:
+          type: string
+          example: "America/New_York"
+        locale:
+          type: string
+          example: "en"
+        has_push_device:
+          type: boolean
+          example: false
+        version:
+          type: integer
+          example: 1
+          x-go-type: int32
+        created_at:
+          type: string
+          format: date-time
+          example: "2025-11-19T14:18:42.960Z"
+        updated_at:
+          type: string
+          format: date-time
+          example: "2025-11-23T17:20:00.021Z"
+
+    UserIdentifier:
+      type: array
+      description: One or more external identifiers to identify the user
+      minItems: 1
+      items:
+        $ref: "#/components/schemas/ExternalID"
+
+    OrganizationIdentifier:
+      type: array
+      description: One or more external identifiers to identify the organization
+      minItems: 1
+      items:
+        $ref: "#/components/schemas/ExternalID"
+
+    DeviceRegistration:
+      type: object
+      required:
+        - identifier
+        - device_id
+        - config
+      properties:
+        identifier:
+          $ref: "#/components/schemas/UserIdentifier"
+        device_id:
+          type: string
+        os:
+          type: string
+          enum: [web, ios, android]
+        os_version:
+          type: string
+        model:
+          type: string
+        app_version:
+          type: string
+        data:
+          type: object
+          additionalProperties: true
+          nullable: true
+          x-go-type: json.RawMessage
+          example:
+            app_channel: "beta"
+            locale: "en-US"
+        config:
+          type: object
+          properties:
+            token:
+              type: string
+              description: Device token for FCM or APNs
+            endpoint:
+              type: string
+              description: Web Push subscription endpoint URL
+            expiration_time:
+              type: string
+              format: date-time
+            keys:
+              type: object
+              required: [p256dh, auth]
+              properties:
+                p256dh:
+                  type: string
+                auth:
+                  type: string
+
+    VapidPublicKey:
+      type: object
+      required:
+        - public_key
+      properties:
+        public_key:
+          type: string
+          description: The VAPID public key
+
+    IdentifyRequest:
+      type: object
+      required:
+        - identifier
+      properties:
+        identifier:
+          $ref: "#/components/schemas/UserIdentifier"
+        email:
+          type: string
+          nullable: true
+          format: email
+          example: "user@example.com"
+          x-go-type: string
+        phone:
+          type: string
+          nullable: true
+          example: "+31612345678"
+          description: E.164 formatted phone number
+          x-go-type: string
+          format: phone
+        timezone:
+          type: string
+          nullable: true
+          example: "Europe/Amsterdam"
+        locale:
+          type: string
+          nullable: true
+          example: "nl-NL"
+        data:
+          type: object
+          additionalProperties: true
+          nullable: true
+          x-go-type: map[string]any
+          example:
+            first_name: "John"
+            last_name: "Smith"
+            has_completed_onboarding: true
+          description: User-specific attributes
+
+    PostEventsRequest:
+      type: array
+      minItems: 1
+      items:
+        $ref: "#/components/schemas/Event"
+
+    Event:
+      type: object
+      required:
+        - name
+        - data
+      properties:
+        name:
+          type: string
+          example: "purchase_completed"
+          description: The name of the event
+        identifier:
+          $ref: "#/components/schemas/UserIdentifier"
+        match:
+          type: object
+          additionalProperties: true
+          nullable: true
+          x-go-type: map[string]any
+          description: >-
+            JSONB containment filter to match users by their data attributes.
+            Mutually exclusive with identifier. When set, the event is delivered
+            to every user whose data column contains the given key/value pairs.
+          example:
+            plan: "enterprise"
+        data:
+          type: object
+          additionalProperties: true
+          x-go-type: map[string]any
+          example:
+            product_id: "prod_789"
+            amount: 99.99
+          description: Event-specific data
+
+    InboxMessageCreate:
+      type: object
+      required:
+        - target
+        - channel
+        - identifier
+      properties:
+        target:
+          $ref: "#/components/schemas/UserIdentifier"
+        identifier:
+          $ref: "#/components/schemas/ExternalID"
+          description: External identifier for the message. Required for idempotency and traceability back to the origin source.
+        channel:
+          $ref: "#/components/schemas/Channel"
+        sender_identity_id:
+          type: string
+          format: uuid
+          nullable: true
+          description: Required for email and sms messages. Push uses project push provider settings.
+        campaign_id:
+          type: string
+          format: uuid
+          nullable: true
+        broadcast_id:
+          type: string
+          format: uuid
+          nullable: true
+        content:
+          type: object
+          additionalProperties: true
+          nullable: true
+          x-go-type: json.RawMessage
+          description: Channel-specific payload content.
+        data:
+          type: object
+          additionalProperties: true
+          nullable: true
+          x-go-type: map[string]any
+        tags:
+          type: array
+          items:
+            type: string
+        priority:
+          type: integer
+          minimum: 1
+          maximum: 5
+          default: 3
+          x-go-type: int16
+        source:
+          type: string
+          nullable: true
+        scheduled_at:
+          type: string
+          format: date-time
+          nullable: true
+        expires_at:
+          type: string
+          format: date-time
+          nullable: true
+
+    OrganizationInboxMessageCreate:
+      type: object
+      required:
+        - target
+        - channel
+        - identifier
+      properties:
+        target:
+          $ref: "#/components/schemas/OrganizationIdentifier"
+        identifier:
+          $ref: "#/components/schemas/ExternalID"
+          description: External identifier for the message. Required for idempotency and traceability back to the origin source.
+        channel:
+          $ref: "#/components/schemas/Channel"
+        sender_identity_id:
+          type: string
+          format: uuid
+          nullable: true
+          description: Required for email and sms messages. Push uses project push provider settings.
+        campaign_id:
+          type: string
+          format: uuid
+          nullable: true
+        broadcast_id:
+          type: string
+          format: uuid
+          nullable: true
+        content:
+          type: object
+          additionalProperties: true
+          nullable: true
+          x-go-type: json.RawMessage
+          description: Channel-specific payload content.
+        data:
+          type: object
+          additionalProperties: true
+          nullable: true
+          x-go-type: map[string]any
+        tags:
+          type: array
+          items:
+            type: string
+        priority:
+          type: integer
+          minimum: 1
+          maximum: 5
+          default: 3
+          x-go-type: int16
+        source:
+          type: string
+          nullable: true
+        scheduled_at:
+          type: string
+          format: date-time
+          nullable: true
+        expires_at:
+          type: string
+          format: date-time
+          nullable: true
+
+    PostUserInboxMessagesRequest:
+      type: array
+      minItems: 1
+      maxItems: 100
+      items:
+        $ref: "#/components/schemas/InboxMessageCreate"
+
+    PostOrganizationInboxMessagesRequest:
+      type: array
+      minItems: 1
+      maxItems: 100
+      items:
+        $ref: "#/components/schemas/OrganizationInboxMessageCreate"
+
+    UserInboxMessageRef:
+      type: object
+      required:
+        - target
+        - message_id
+      properties:
+        target:
+          $ref: "#/components/schemas/UserIdentifier"
+        message_id:
+          type: string
+          format: uuid
+
+    OrganizationInboxMessageRef:
+      type: object
+      required:
+        - target
+        - message_id
+      properties:
+        target:
+          $ref: "#/components/schemas/OrganizationIdentifier"
+        message_id:
+          type: string
+          format: uuid
+
+    UserInboxMessageEvents:
+      type: array
+      minItems: 1
+      maxItems: 100
+      items:
+        $ref: "#/components/schemas/UserInboxMessageRef"
+
+    OrganizationInboxMessageEvents:
+      type: array
+      minItems: 1
+      maxItems: 100
+      items:
+        $ref: "#/components/schemas/OrganizationInboxMessageRef"
+
+    InboxMessage:
+      type: object
+      required:
+        - id
+        - project_id
+        - channel
+        - content
+        - data
+        - tags
+        - priority
+        - scheduled_at
+        - created_at
+        - updated_at
+      properties:
+        id:
+          type: string
+          format: uuid
+        project_id:
+          type: string
+          format: uuid
+        user_id:
+          type: string
+          format: uuid
+        organization_id:
+          type: string
+          format: uuid
+        external_id:
+          type: string
+          nullable: true
+          description: External identifier for the message, if one was provided at creation time.
+        channel:
+          $ref: "#/components/schemas/Channel"
+        sender_identity_id:
+          type: string
+          format: uuid
+          nullable: true
+        campaign_id:
+          type: string
+          format: uuid
+          nullable: true
+        broadcast_id:
+          type: string
+          format: uuid
+          nullable: true
+        content:
+          type: object
+          additionalProperties: true
+          x-go-type: json.RawMessage
+        data:
+          type: object
+          additionalProperties: true
+          x-go-type: json.RawMessage
+        tags:
+          type: array
+          items:
+            type: string
+        priority:
+          type: integer
+          minimum: 1
+          maximum: 5
+          x-go-type: int16
+        source:
+          type: string
+          nullable: true
+        scheduled_at:
+          type: string
+          format: date-time
+        expires_at:
+          type: string
+          format: date-time
+          nullable: true
+        read_at:
+          type: string
+          format: date-time
+          nullable: true
+        archived_at:
+          type: string
+          format: date-time
+          nullable: true
+        sent_at:
+          type: string
+          format: date-time
+          nullable: true
+        created_at:
+          type: string
+          format: date-time
+        updated_at:
+          type: string
+          format: date-time
+
+    InboxMessageList:
+      type: object
+      required:
+        - results
+        - total
+        - limit
+        - offset
+      properties:
+        results:
+          type: array
+          items:
+            $ref: "#/components/schemas/InboxMessage"
+        total:
+          type: integer
+        limit:
+          type: integer
+        offset:
+          type: integer
+
+    InboxCount:
+      type: object
+      required:
+        - unread
+        - total
+      properties:
+        unread:
+          type: integer
+        total:
+          type: integer
+
+    Organization:
+      type: object
+      required:
+        - id
+        - project_id
+        - identifier
+        - data
+        - version
+        - created_at
+        - updated_at
+      properties:
+        id:
+          type: string
+          format: uuid
+          example: "9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d"
+        project_id:
+          type: string
+          format: uuid
+          example: "4c9d3163-7b64-4f9e-9068-d2e4b96be56b"
+        identifier:
+          type: array
+          items:
+            $ref: "#/components/schemas/ExternalIDResponse"
+          description: External identifiers associated with this organization
+        name:
+          type: string
+          example: "Acme Corp"
+        data:
+          type: object
+          additionalProperties: true
+          x-go-type: map[string]any
+          example:
+            industry: "technology"
+            size: "enterprise"
+        version:
+          type: integer
+          example: 1
+          x-go-type: int32
+        created_at:
+          type: string
+          format: date-time
+          example: "2025-11-19T14:18:42.960Z"
+        updated_at:
+          type: string
+          format: date-time
+          example: "2025-11-23T17:20:00.021Z"
+
+    OrganizationRequest:
+      type: object
+      required:
+        - identifier
+      properties:
+        identifier:
+          $ref: "#/components/schemas/OrganizationIdentifier"
+        name:
+          type: string
+          nullable: true
+          example: "Acme Corp"
+        data:
+          type: object
+          additionalProperties: true
+          nullable: true
+          x-go-type: map[string]any
+          example:
+            industry: "technology"
+            size: "enterprise"
+
+    OrganizationUserRequest:
+      type: object
+      required:
+        - organization
+        - user
+      properties:
+        organization:
+          type: object
+          required:
+            - identifier
+          properties:
+            identifier:
+              $ref: "#/components/schemas/OrganizationIdentifier"
+        user:
+          type: object
+          required:
+            - identifier
+          properties:
+            identifier:
+              $ref: "#/components/schemas/UserIdentifier"
+        data:
+          type: object
+          additionalProperties: true
+          nullable: true
+          x-go-type: map[string]any
+          example:
+            role: "admin"
+            department: "engineering"
+          description: Organization-specific data for this user
+
+    DeleteUserRequest:
+      type: object
+      required:
+        - identifier
+      properties:
+        identifier:
+          $ref: "#/components/schemas/UserIdentifier"
+
+    DeleteOrganizationRequest:
+      type: object
+      required:
+        - identifier
+      properties:
+        identifier:
+          $ref: "#/components/schemas/OrganizationIdentifier"
+
+    RemoveOrganizationUserRequest:
+      type: object
+      required:
+        - organization
+        - user
+      properties:
+        organization:
+          type: object
+          required:
+            - identifier
+          properties:
+            identifier:
+              $ref: "#/components/schemas/OrganizationIdentifier"
+        user:
+          type: object
+          required:
+            - identifier
+          properties:
+            identifier:
+              $ref: "#/components/schemas/UserIdentifier"
+
+    PostOrganizationEventsRequest:
+      type: array
+      minItems: 1
+      items:
+        $ref: "#/components/schemas/OrganizationEvent"
+
+    OrganizationEvent:
+      type: object
+      required:
+        - name
+      properties:
+        identifier:
+          $ref: "#/components/schemas/OrganizationIdentifier"
+        match:
+          type: object
+          additionalProperties: true
+          nullable: true
+          x-go-type: map[string]any
+          description: >-
+            JSONB containment filter to match organizations by their data attributes.
+            Mutually exclusive with identifier. When set, the event is delivered
+            to every organization whose data column contains the given key/value pairs.
+          example:
+            plan: "enterprise"
+        name:
+          type: string
+          example: "subscription_upgraded"
+          description: The name of the event
+        data:
+          type: object
+          additionalProperties: true
+          nullable: true
+          x-go-type: map[string]any
+          example:
+            plan: "enterprise"
+            seats: 100
+          description: Event-specific data
+
+    UpsertUserScheduledRequest:
+      type: object
+      required:
+        - name
+      properties:
+        name:
+          type: string
+          example: "renewal_date"
+          description: The name of the scheduled resource
+        identifier:
+          $ref: "#/components/schemas/UserIdentifier"
+        scheduled_at:
+          type: string
+          format: date-time
+          nullable: true
+          example: "2025-12-25T10:00:00Z"
+          description: The time at which the scheduled resource is set to trigger. Required for single schedules.
+        start_at:
+          type: string
+          format: date-time
+          nullable: true
+          example: "2025-01-01T00:00:00Z"
+          description: Start time for recurring schedules. If omitted for recurring schedules, defaults to now.
+        interval:
+          type: string
+          nullable: true
+          example: "24h"
+          description: Interval for recurring schedules. When set, the schedule type is automatically set to recurring.
+        data:
+          type: object
+          additionalProperties: true
+          nullable: true
+          x-go-type: map[string]any
+          example:
+            plan: "pro"
+            amount: 29.99
+          description: Scheduled resource data
+
+    UpsertOrganizationScheduledRequest:
+      type: object
+      required:
+        - name
+        - identifier
+      properties:
+        name:
+          type: string
+          example: "contract_renewal"
+          description: The name of the scheduled resource
+        identifier:
+          $ref: "#/components/schemas/OrganizationIdentifier"
+        scheduled_at:
+          type: string
+          format: date-time
+          nullable: true
+          example: "2025-12-25T10:00:00Z"
+          description: The time at which the scheduled resource is set to trigger. Required for single schedules.
+        start_at:
+          type: string
+          format: date-time
+          nullable: true
+          example: "2025-01-01T00:00:00Z"
+          description: Start time for recurring schedules. If omitted for recurring schedules, defaults to now.
+        interval:
+          type: string
+          nullable: true
+          example: "24h"
+          description: Interval for recurring schedules. When set, the schedule type is automatically set to recurring.
+        data:
+          type: object
+          additionalProperties: true
+          nullable: true
+          x-go-type: map[string]any
+          example:
+            contract_type: "enterprise"
+            seats: 100
+          description: Scheduled resource data
+
+    DeleteUserScheduledRequest:
+      type: object
+      required:
+        - name
+      properties:
+        name:
+          type: string
+          example: "renewal_date"
+          description: The name of the scheduled resource to delete
+        identifier:
+          $ref: "#/components/schemas/UserIdentifier"
+
+    ScheduledAccepted:
+      type: object
+      required:
+        - id
+        - name
+        - scheduled_at
+      properties:
+        id:
+          type: string
+          format: uuid
+          example: "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
+          description: The unique identifier for the scheduled instance
+        name:
+          type: string
+          example: "trial_end"
+          description: The name of the scheduled resource
+        scheduled_at:
+          type: string
+          format: date-time
+          example: "2025-01-15T09:00:00Z"
+          description: The time at which the scheduled resource is set to trigger
+        data:
+          type: object
+          additionalProperties: true
+          nullable: true
+          x-go-type: "map[string]any"
+          description: Scheduled resource data
+
+    DeleteOrganizationScheduledRequest:
+      type: object
+      required:
+        - name
+        - identifier
+      properties:
+        name:
+          type: string
+          example: "contract_renewal"
+          description: The name of the scheduled resource to delete
+        identifier:
+          $ref: "#/components/schemas/OrganizationIdentifier"
+
+  securitySchemes:
+    HttpBearerAuth:
+      type: http
+      scheme: bearer
+      bearerFormat: JWT
+      description: JWT token for API authentication
diff --git a/src/core/client.ts b/src/core/client.ts
index a4f0303..9b59c52 100644
--- a/src/core/client.ts
+++ b/src/core/client.ts
@@ -1,20 +1,20 @@
 import { ClientProps } from '../types'
-import { HttpHandler } from './http'
+import { Transport } from './transport'
 import { createClientNamespace, ClientNamespace } from './factory'
 
 export class Client {
     readonly user: ClientNamespace['user']
     readonly organization: ClientNamespace['organization']
-    readonly #http: HttpHandler
+    readonly #transport: Transport
 
     constructor(props: ClientProps) {
-        this.#http = new HttpHandler(props)
-        const namespace = createClientNamespace(this.#http)
+        this.#transport = new Transport(props)
+        const namespace = createClientNamespace(this.#transport)
         this.user = namespace.user
         this.organization = namespace.organization
     }
 
-    protected get httpHandler(): HttpHandler {
-        return this.#http
+    protected get transport(): Transport {
+        return this.#transport
     }
 }
diff --git a/src/core/factory.ts b/src/core/factory.ts
index 99edaab..93d857b 100644
--- a/src/core/factory.ts
+++ b/src/core/factory.ts
@@ -1,4 +1,4 @@
-import { HttpHandler } from './http'
+import { Transport } from './transport'
 import { ClientProps } from '../types'
 import { UserResource, OrganizationResource } from './resources'
 
@@ -7,13 +7,13 @@ export interface ClientNamespace {
     organization: OrganizationResource
 }
 
-export function createClientNamespace(http: HttpHandler): ClientNamespace {
+export function createClientNamespace(transport: Transport): ClientNamespace {
     return {
-        user: new UserResource(http),
-        organization: new OrganizationResource(http),
+        user: new UserResource(transport),
+        organization: new OrganizationResource(transport),
     }
 }
 
-export function createHttpHandler(props: ClientProps): HttpHandler {
-    return new HttpHandler(props)
+export function createTransport(props: ClientProps): Transport {
+    return new Transport(props)
 }
diff --git a/src/core/http.ts b/src/core/http.ts
deleted file mode 100644
index 142e9f5..0000000
--- a/src/core/http.ts
+++ /dev/null
@@ -1,111 +0,0 @@
-import { ClientProps } from '../types'
-import { mapKeys, isUuid } from '../utils'
-import { DefaultEndpoint } from './constants'
-import {
-    LunogramError,
-    NetworkError,
-    RequestError,
-    UnauthorizedError,
-    ForbiddenError,
-    NotFoundError,
-    ValidationError,
-} from './errors'
-
-type HttpMethod = 'GET' | 'POST' | 'DELETE'
-
-const statusErrorFactories: Partial<Record<number, () => LunogramError>> = {
-    400: () => new ValidationError('Invalid request'),
-    401: () => new UnauthorizedError(),
-    403: () => new ForbiddenError(),
-    404: () => new NotFoundError(),
-}
-
-export class HttpHandler {
-    readonly #apiKey: string
-    readonly #baseUrl: string
-    readonly #projectId: string
-
-    constructor(props: ClientProps) {
-        const projectId = props.projectId?.trim()
-        if (!projectId) {
-            throw new ValidationError('A non-empty `projectId` is required to create a Lunogram client')
-        }
-        if (!isUuid(projectId)) {
-            throw new ValidationError('`projectId` must be a valid UUID')
-        }
-
-        this.#apiKey = props.apiKey
-        this.#baseUrl = props.urlEndpoint ?? DefaultEndpoint
-        this.#projectId = projectId
-    }
-
-    async get<T = unknown>(path: string, data?: unknown): Promise<T> {
-        return this.#request<T>('GET', path, data)
-    }
-
-    async post<T = unknown>(path: string, data?: unknown): Promise<T> {
-        return this.#request<T>('POST', path, data)
-    }
-
-    async delete<T = unknown>(path: string, data?: unknown): Promise<T> {
-        return this.#request<T>('DELETE', path, data)
-    }
-
-    async #request<T>(method: HttpMethod, path: string, data?: unknown): Promise<T> {
-        const url = `${this.#baseUrl}/client/projects/${this.#projectId}/${path}`
-
-        try {
-            const response = await fetch(url, {
-                method,
-                headers: {
-                    'Content-Type': 'application/json',
-                    'Authorization': `Bearer ${this.#apiKey}`,
-                },
-                body: data ? JSON.stringify(mapKeys(data)) : undefined,
-            })
-
-            return this.#handleResponse<T>(response)
-        } catch (error) {
-            if (error instanceof LunogramError) {
-                throw error
-            }
-
-            const message = error instanceof Error ? error.message : 'Unknown error'
-            throw new NetworkError(`Network request failed: ${message}`, error instanceof Error ? error : undefined)
-        }
-    }
-
-    async #handleResponse<T>(response: Response): Promise<T> {
-        if (!response.ok) {
-            throw await this.#mapError(response)
-        }
-
-        const contentType = response.headers.get('content-type')
-        if (!contentType || !contentType.includes('application/json')) {
-            return undefined as T
-        }
-
-        return response.json() as Promise<T>
-    }
-
-    async #mapError(response: Response): Promise<LunogramError> {
-        const status = response.status
-
-        const createError = statusErrorFactories[status]
-        if (createError) {
-            return createError()
-        }
-
-        let detail = `Request failed with status ${status}`
-        try {
-            const body = await response.json()
-            if (body?.detail) {
-                detail = body.detail
-            }
-        } catch {
-            // no parseable body
-        }
-
-        return new RequestError(status, detail)
-    }
-}
diff --git a/src/core/resources/base.ts b/src/core/resources/base.ts
index 5f418bf..6ef20dc 100644
--- a/src/core/resources/base.ts
+++ b/src/core/resources/base.ts
@@ -1,23 +1,62 @@
-import { HttpHandler } from '../http'
+import { Transport, TypedFetchClient } from '../transport'
+import { LunogramError, NetworkError } from '../errors'
 
+/**
+ * Base class for the hand-written resource facades.
+ *
+ * Resources call the spec-generated typed client ({@link TypedFetchClient})
+ * exposed by {@link Transport}. The `{projectID}` path parameter is injected
+ * here for every call ({@link withProject}) so individual methods only name
+ * their operation and payload — never the project scoping or the path prefix,
+ * which come from the generated layer.
+ */
 export abstract class BaseResource {
-    readonly #http: HttpHandler
+    protected readonly transport: Transport
 
-    constructor(http: HttpHandler) {
-        this.#http = http
+    constructor(transport: Transport) {
+        this.transport = transport
     }
 
-    protected abstract readonly endpoint: string
-
-    protected async get<T = unknown>(data?: unknown): Promise<T> {
-        return this.#http.get<T>(this.endpoint, data)
+    protected get client(): TypedFetchClient {
+        return this.transport.client
     }
 
-    protected async post<T = unknown>(data?: unknown, pathOverride?: string): Promise<T> {
-        return this.#http.post<T>(pathOverride ?? this.endpoint, data)
+    /**
+     * Build the request `params` object with the `{projectID}` path parameter
+     * filled in, merged with any extra path params an operation needs.
+     */
+    protected withProject<P extends Record<string, unknown> = Record<string, never>>(
+        path?: P,
+    ): { path: P & { projectID: string } } {
+        return { path: { ...(path as P), projectID: this.transport.projectId } }
     }
 
-    protected async remove<T = unknown>(data?: unknown, pathOverride?: string): Promise<T> {
-        return this.#http.delete<T>(pathOverride ?? this.endpoint, data)
+    /**
+     * Run a generated-client call and normalize the outcome: translate raw
+     * fetch failures into {@link NetworkError} and HTTP failures into the
+     * Lunogram error hierarchy (via {@link Transport.unwrap}).
+     *
+     * The generated client returns wire (snake_case) response types; the public
+     * facade types are camelCase. The SDK has always returned the raw JSON body
+     * typed as its camelCase type (responses are not re-mapped at runtime), so
+     * the result data is cast to the requested `T` at this single boundary.
+     */
+    protected async call<T>(
+        op: () => Promise<{ data?: unknown; error?: unknown; response: Response }>,
+    ): Promise<T> {
+        let result
+        try {
+            result = await op()
+        } catch (error) {
+            if (error instanceof LunogramError) {
+                throw error
+            }
+            const message = error instanceof Error ? error.message : 'Unknown error'
+            throw new NetworkError(
+                `Network request failed: ${message}`,
+                error instanceof Error ? error : undefined,
+            )
+        }
+        return this.transport.unwrap<T>(result as { data?: T; error?: unknown; response: Response })
     }
 }
diff --git a/src/core/resources/organizations/events.ts b/src/core/resources/organizations/events.ts
index 8e7face..c024d29 100644
--- a/src/core/resources/organizations/events.ts
+++ b/src/core/resources/organizations/events.ts
@@ -1,14 +1,17 @@
-import { OrganizationEvent } from "../../../types"
-import { BaseResource } from "../base"
+import { OrganizationEvent } from '../../../types'
+import { BaseResource } from '../base'
 
 export class OrganizationEventsResource extends BaseResource {
-    readonly endpoint = 'organizations/events'
-
     /**
      * Posts organization events for asynchronous processing.
      * @param data - Array of organization events
      */
     async post<T = unknown>(data: OrganizationEvent[]): Promise<T> {
-        return super.post(data)
+        return this.call<T>(() =>
+            this.client.POST('/api/client/projects/{projectID}/organizations/events', {
+                params: this.withProject(),
+                body: data as never,
+            }),
+        )
     }
 }
diff --git a/src/core/resources/organizations/organization.ts b/src/core/resources/organizations/organization.ts
index 19b291a..09cb7de 100644
--- a/src/core/resources/organizations/organization.ts
+++ b/src/core/resources/organizations/organization.ts
@@ -4,21 +4,20 @@ import {
     OrganizationResponse,
     OrganizationUserRequest,
     RemoveOrganizationUserRequest,
-} from "../../../types"
-import { BaseResource } from "../base"
-import { HttpHandler } from "../../http"
-import { OrganizationScheduledResource } from "./scheduled"
-import { OrganizationEventsResource } from "./events"
+} from '../../../types'
+import { BaseResource } from '../base'
+import { Transport } from '../../transport'
+import { OrganizationScheduledResource } from './scheduled'
+import { OrganizationEventsResource } from './events'
 
 export class OrganizationResource extends BaseResource {
-    readonly endpoint = 'organizations'
     readonly schedule: OrganizationScheduledResource
     readonly events: OrganizationEventsResource
 
-    constructor(http: HttpHandler) {
-        super(http)
-        this.schedule = new OrganizationScheduledResource(http)
-        this.events = new OrganizationEventsResource(http)
+    constructor(transport: Transport) {
+        super(transport)
+        this.schedule = new OrganizationScheduledResource(transport)
+        this.events = new OrganizationEventsResource(transport)
     }
 
     /**
@@ -27,7 +26,12 @@ export class OrganizationResource extends BaseResource {
      * @returns Promise resolving to the created/updated organization
      */
     async upsert(data: OrganizationRequest): Promise<OrganizationResponse> {
-        return this.post(data)
+        return this.call<OrganizationResponse>(() =>
+            this.client.POST('/api/client/projects/{projectID}/organizations', {
+                params: this.withProject(),
+                body: data as never,
+            }),
+        )
     }
 
     /**
@@ -36,7 +40,12 @@ export class OrganizationResource extends BaseResource {
      * @returns Promise resolving when organization is deleted
      */
     async delete(data: DeleteOrganizationRequest): Promise<void> {
-        return this.remove(data)
+        await this.call<void>(() =>
+            this.client.DELETE('/api/client/projects/{projectID}/organizations', {
+                params: this.withProject(),
+                body: data as never,
+            }),
+        )
     }
 
     /**
@@ -45,7 +54,12 @@ export class OrganizationResource extends BaseResource {
      * @returns Promise resolving when user is added
      */
     async addUser(data: OrganizationUserRequest): Promise<void> {
-        return this.post(data, 'organizations/users')
+        await this.call<void>(() =>
+            this.client.POST('/api/client/projects/{projectID}/organizations/users', {
+                params: this.withProject(),
+                body: data as never,
+            }),
+        )
     }
 
     /**
@@ -54,6 +68,11 @@ export class OrganizationResource extends BaseResource {
      * @returns Promise resolving when user is removed
      */
     async removeUser(data: RemoveOrganizationUserRequest): Promise<void> {
-        return this.remove(data, 'organizations/users')
+        await this.call<void>(() =>
+            this.client.DELETE('/api/client/projects/{projectID}/organizations/users', {
+                params: this.withProject(),
+                body: data as never,
+            }),
+        )
     }
 }
diff --git a/src/core/resources/organizations/scheduled.ts b/src/core/resources/organizations/scheduled.ts
index af2f77d..4addad6 100644
--- a/src/core/resources/organizations/scheduled.ts
+++ b/src/core/resources/organizations/scheduled.ts
@@ -9,15 +9,18 @@ import {
  * Resource for managing scheduled organization resources.
  */
 export class OrganizationScheduledResource extends BaseResource {
-    readonly endpoint = 'organizations/scheduled'
-
     /**
      * Creates or updates a scheduled resource for an organization.
      * @param data - Scheduled resource data including name, identifier, scheduledAt, interval, etc.
      * @returns Promise resolving to the accepted scheduled resource
      */
     async upsert(data: UpsertOrganizationScheduledRequest): Promise<ScheduledAcceptedResponse> {
-        return this.post(data)
+        return this.call<ScheduledAcceptedResponse>(() =>
+            this.client.POST('/api/client/projects/{projectID}/organizations/scheduled', {
+                params: this.withProject(),
+                body: data as never,
+            }),
+        )
     }
 
     /**
@@ -26,6 +29,11 @@ export class OrganizationScheduledResource extends BaseResource {
      * @returns Promise resolving when scheduled resource is deleted
      */
     async delete(data: DeleteOrganizationScheduledRequest): Promise<void> {
-        return this.remove(data)
+        await this.call<void>(() =>
+            this.client.DELETE('/api/client/projects/{projectID}/organizations/scheduled', {
+                params: this.withProject(),
+                body: data as never,
+            }),
+        )
     }
 }
diff --git a/src/core/resources/users/events.ts b/src/core/resources/users/events.ts
index 39c3c48..b17640f 100644
--- a/src/core/resources/users/events.ts
+++ b/src/core/resources/users/events.ts
@@ -1,14 +1,17 @@
-import { UserEvent } from "../../../types"
-import { BaseResource } from "../base"
+import { UserEvent } from '../../../types'
+import { BaseResource } from '../base'
 
 export class UserEventsResource extends BaseResource {
-    readonly endpoint = 'users/events'
-
     /**
      * Posts user events for asynchronous processing.
      * @param data - Array of user events
      */
     async post<T = unknown>(data: UserEvent[]): Promise<T> {
-        return super.post(data)
+        return this.call<T>(() =>
+            this.client.POST('/api/client/projects/{projectID}/users/events', {
+                params: this.withProject(),
+                body: data as never,
+            }),
+        )
     }
 }
diff --git a/src/core/resources/users/scheduled.ts b/src/core/resources/users/scheduled.ts
index bc033af..93a721f 100644
--- a/src/core/resources/users/scheduled.ts
+++ b/src/core/resources/users/scheduled.ts
@@ -9,15 +9,18 @@ import {
  * Resource for managing scheduled user resources.
  */
 export class UserScheduledResource extends BaseResource {
-    readonly endpoint = 'users/scheduled'
-
     /**
      * Creates or updates a scheduled resource for a user.
      * @param data - Scheduled resource data including name, identifier, scheduledAt, interval, etc.
      * @returns Promise resolving to the accepted scheduled resource
      */
     async upsert(data: UpsertUserScheduledRequest): Promise<ScheduledAcceptedResponse> {
-        return this.post(data)
+        return this.call<ScheduledAcceptedResponse>(() =>
+            this.client.POST('/api/client/projects/{projectID}/users/scheduled', {
+                params: this.withProject(),
+                body: data as never,
+            }),
+        )
     }
 
     /**
@@ -26,6 +29,11 @@ export class UserScheduledResource extends BaseResource {
      * @returns Promise resolving when scheduled resource is deleted
      */
     async delete(data: DeleteUserScheduledRequest): Promise<void> {
-        return this.remove(data)
+        await this.call<void>(() =>
+            this.client.DELETE('/api/client/projects/{projectID}/users/scheduled', {
+                params: this.withProject(),
+                body: data as never,
+            }),
+        )
     }
 }
diff --git a/src/core/resources/users/user.ts b/src/core/resources/users/user.ts
index 5af36fb..c923259 100644
--- a/src/core/resources/users/user.ts
+++ b/src/core/resources/users/user.ts
@@ -1,5 +1,5 @@
-import { BaseResource } from './../base'
-import { HttpHandler } from '../../http'
+import { BaseResource } from '../base'
+import { Transport } from '../../transport'
 import {
     UpsertUserRequest,
     DeleteUserRequest,
@@ -9,14 +9,13 @@ import { UserScheduledResource } from './scheduled'
 import { UserEventsResource } from './events'
 
 export class UserResource extends BaseResource {
-    readonly endpoint = 'users'
     readonly schedule: UserScheduledResource
     readonly events: UserEventsResource
 
-    constructor(http: HttpHandler) {
-        super(http)
-        this.schedule = new UserScheduledResource(http)
-        this.events = new UserEventsResource(http)
+    constructor(transport: Transport) {
+        super(transport)
+        this.schedule = new UserScheduledResource(transport)
+        this.events = new UserEventsResource(transport)
     }
 
     /**
@@ -25,7 +24,12 @@ export class UserResource extends BaseResource {
      * @returns Promise resolving to the created/updated user
      */
     async upsert(data: UpsertUserRequest): Promise<UserResponse> {
-        return this.post(data)
+        return this.call<UserResponse>(() =>
+            this.client.POST('/api/client/projects/{projectID}/users', {
+                params: this.withProject(),
+                body: data as never,
+            }),
+        )
     }
 
     /**
@@ -34,6 +38,11 @@ export class UserResource extends BaseResource {
      * @returns Promise resolving when user is deleted
      */
     async delete(data: DeleteUserRequest): Promise<void> {
-        return this.remove(data)
+        await this.call<void>(() =>
+            this.client.DELETE('/api/client/projects/{projectID}/users', {
+                params: this.withProject(),
+                body: data as never,
+            }),
+        )
     }
 }
diff --git a/src/core/transport.ts b/src/core/transport.ts
new file mode 100644
index 0000000..b1f45ee
--- /dev/null
+++ b/src/core/transport.ts
@@ -0,0 +1,136 @@
+import createClient, { type Client as FetchClient, type Middleware } from 'openapi-fetch'
+import type { paths } from '../gen/schema'
+import { ClientProps } from '../types'
+import { mapKeys, isUuid } from '../utils'
+import { DefaultEndpoint } from './constants'
+import {
+    LunogramError,
+    RequestError,
+    UnauthorizedError,
+    ForbiddenError,
+    NotFoundError,
+    ValidationError,
+} from './errors'
+
+/**
+ * Typed openapi-fetch client generated against the vendored OpenAPI spec
+ * (`src/gen/schema.ts`). Every operation, path and payload shape is derived
+ * from the spec; this module only adds the cross-cutting concerns the spec
+ * cannot express: auth, the project scoping, snake_case mapping and the
+ * Lunogram error hierarchy.
+ */
+export type TypedFetchClient = FetchClient<paths>
+
+const statusErrorFactories: Partial<Record<number, () => LunogramError>> = {
+    400: () => new ValidationError('Invalid request'),
+    401: () => new UnauthorizedError(),
+    403: () => new ForbiddenError(),
+    404: () => new NotFoundError(),
+}
+
+/**
+ * Derive the openapi-fetch base URL from the configured endpoint.
+ *
+ * The spec carries the `/api` prefix on every path
+ * (`/api/client/projects/{projectID}/...`), so the base URL must be the bare
+ * origin. The public `urlEndpoint` has historically included a trailing
+ * `/api`; we strip exactly one so both `https://host` and `https://host/api`
+ * resolve to the same, correct URL.
+ */
+function toBaseUrl(endpoint: string): string {
+    const trimmed = endpoint.replace(/\/+$/, '')
+    return trimmed.replace(/\/api$/, '')
+}
+
+/**
+ * Thin transport over openapi-fetch. The `projectID` path parameter is bound
+ * once here (via the public {@link Transport.projectId} getter that resources
+ * read) and the auth header + snake_case body mapping are applied centrally in
+ * middleware, so resource modules never repeat any of it.
+ */
+export class Transport {
+    readonly #client: TypedFetchClient
+    readonly #projectId: string
+
+    constructor(props: ClientProps) {
+        const projectId = props.projectId?.trim()
+        if (!projectId) {
+            throw new ValidationError('A non-empty `projectId` is required to create a Lunogram client')
+        }
+        if (!isUuid(projectId)) {
+            throw new ValidationError('`projectId` must be a valid UUID')
+        }
+
+        this.#projectId = projectId
+
+        const baseUrl = toBaseUrl(props.urlEndpoint ?? DefaultEndpoint)
+        this.#client = createClient<paths>({ baseUrl })
+
+        const apiKey = props.apiKey
+
+        // Auth + body mapping: applied to every request, once.
+        const middleware: Middleware = {
+            async onRequest({ request }) {
+                request.headers.set('Authorization', `Bearer ${apiKey}`)
+
+                // The public API speaks camelCase; the wire format is
+                // snake_case. Re-encode the JSON body centrally so resource
+                // modules can pass through their typed payloads untouched.
+                const contentType = request.headers.get('content-type')
+                if (contentType?.includes('application/json')) {
+                    const raw = await request.clone().text()
+                    if (raw) {
+                        const mapped = mapKeys(JSON.parse(raw))
+                        return new Request(request, { body: JSON.stringify(mapped) })
+                    }
+                }
+
+                return request
+            },
+        }
+        this.#client.use(middleware)
+    }
+
+    /**
+     * The validated project UUID. Resource modules pass this as the
+     * `{projectID}` path parameter so the spec-generated paths resolve under
+     * `/api/client/projects/{projectId}/...`.
+     */
+    get projectId(): string {
+        return this.#projectId
+    }
+
+    get client(): TypedFetchClient {
+        return this.#client
+    }
+
+    /**
+     * Map an openapi-fetch result onto the Lunogram return contract: throw the
+     * appropriate {@link LunogramError} on failure, otherwise return the parsed
+     * body (or `undefined` for empty/no-content responses).
+     */
+    unwrap<T>(result: { data?: T; error?: unknown; response: Response }): T {
+        const { data, error, response } = result
+        if (response.ok) {
+            return data as T
+        }
+        throw this.mapError(response, error)
+    }
+
+    private mapError(response: Response, body: unknown): LunogramError {
+        const status = response.status
+
+        const createError = statusErrorFactories[status]
+        if (createError) {
+            return createError()
+        }
+
+        let detail = `Request failed with status ${status}`
+        const problem = body as { detail?: string } | undefined
+        if (problem?.detail) {
+            detail = problem.detail
+        }
+
+        return new RequestError(status, detail)
+    }
+}
diff --git a/src/gen/schema.ts b/src/gen/schema.ts
new file mode 100644
index 0000000..8dc39b9
--- /dev/null
+++ b/src/gen/schema.ts
@@ -0,0 +1,1892 @@
+/**
+ * This file was auto-generated by openapi-typescript.
+ * Do not make direct changes to the file.
+ */
+
+export interface paths {
+    "/api/client/projects/{projectID}/users": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Upsert user
+         * @description Used by client libraries to create or update a user profile. The project is taken from the projectID path parameter.
+         */
+        post: operations["upsertUserClient"];
+        /**
+         * Delete user
+         * @description Used by client libraries to delete a user by external_id or anonymous_id.
+         *     The project is taken from the projectID path parameter.
+         */
+        delete: operations["deleteUserClient"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/users/events": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Post user events
+         * @description Used by client libraries to trigger events for a user that can be used to execute a step in a journey or update a virtual list.
+         *     Multiple events can be sent in a single request and are processed asynchronously.
+         *     Each event is handled independently: if one event fails to be accepted or processed, other events in the same request may still be published successfully.
+         *     Clients requiring deterministic retry or recovery behavior must submit events individually.
+         *     The project is taken from the projectID path parameter.
+         */
+        post: operations["postUserEvents"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/users/inbox": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        /**
+         * Query user inbox messages
+         * @description Returns visible, non-expired inbox messages for a user identified by source and external_id.
+         */
+        get: operations["getUserInbox"];
+        put?: never;
+        /**
+         * Create user inbox messages
+         * @description Creates one or more inbox messages for users identified by external identifiers. Messages are processed asynchronously.
+         */
+        post: operations["postUserInboxMessages"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/users/inbox/count": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        /**
+         * Count user inbox messages
+         * @description Returns unread and total visible inbox message counts for a user.
+         */
+        get: operations["getUserInboxCount"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/users/inbox/read": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Mark user inbox messages read
+         * @description Marks one or more user inbox messages as read. Processed asynchronously.
+         */
+        post: operations["postUserInboxRead"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/users/inbox/archived": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Mark user inbox messages archived
+         * @description Marks one or more user inbox messages as archived. Processed asynchronously.
+         */
+        post: operations["postUserInboxArchived"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/organizations": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Upsert organization
+         * @description Used by client libraries to create or update an organization by external_id.
+         *     The project is taken from the projectID path parameter.
+         */
+        post: operations["upsertOrganizationClient"];
+        /**
+         * Delete organization
+         * @description Used by client libraries to delete an organization by external_id.
+         *     This will also remove all organization memberships.
+         *     The project is taken from the projectID path parameter.
+         */
+        delete: operations["deleteOrganizationClient"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/organizations/users": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Add user to organization
+         * @description Used by client libraries to add a user to an organization with optional org-specific data.
+         *     Both organization and user are identified by their external_id.
+         *     The project is taken from the projectID path parameter.
+         */
+        post: operations["addOrganizationUserClient"];
+        /**
+         * Remove user from organization
+         * @description Used by client libraries to remove a user from an organization.
+         *     Both organization and user are identified by their external_id.
+         *     The project is taken from the projectID path parameter.
+         */
+        delete: operations["removeOrganizationUserClient"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/users/scheduled": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Upsert user scheduled
+         * @description Used by client libraries to create or update a scheduled resource for a user.
+         *     The user is identified by external_id or anonymous_id.
+         *     This triggers journey entrance recalculation for any journeys that depend on the scheduled resource.
+         *     The project is taken from the projectID path parameter.
+         */
+        post: operations["upsertUserScheduledClient"];
+        /**
+         * Delete user scheduled
+         * @description Used by client libraries to delete all scheduled instances for a user with a given scheduled resource name.
+         *     The user is identified by external_id or anonymous_id.
+         *     This cancels any pending journey entrance states that depend on the scheduled resource.
+         *     The project is taken from the projectID path parameter.
+         */
+        delete: operations["deleteUserScheduledClient"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/organizations/scheduled": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Upsert organization scheduled
+         * @description Used by client libraries to create or update a scheduled resource for an organization.
+         *     The organization is identified by external_id.
+         *     This triggers journey entrance recalculation for any journeys that depend on the scheduled resource.
+         *     The project is taken from the projectID path parameter.
+         */
+        post: operations["upsertOrganizationScheduledClient"];
+        /**
+         * Delete organization scheduled
+         * @description Used by client libraries to delete all scheduled instances for an organization with a given scheduled resource name.
+         *     The organization is identified by external_id.
+         *     This cancels any pending journey entrance states that depend on the scheduled resource.
+         *     The project is taken from the projectID path parameter.
+         */
+        delete: operations["deleteOrganizationScheduledClient"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/organizations/events": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Post organization events
+         * @description Used by client libraries to trigger events on an organization.
+         *     The organization is identified by external_id.
+         *     Events are processed asynchronously and can trigger journeys for all users in the organization.
+         *     The project is taken from the projectID path parameter.
+         */
+        post: operations["postOrganizationEventsClient"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/organizations/inbox": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        /**
+         * Query organization inbox messages
+         * @description Returns visible, non-expired inbox messages for an organization identified by source and external_id.
+         */
+        get: operations["getOrganizationInbox"];
+        put?: never;
+        /**
+         * Create organization inbox messages
+         * @description Creates one or more inbox messages for organizations identified by external identifiers. Messages are processed asynchronously.
+         */
+        post: operations["postOrganizationInboxMessages"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/organizations/inbox/count": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        /**
+         * Count organization inbox messages
+         * @description Returns unread and total visible inbox message counts for an organization.
+         */
+        get: operations["getOrganizationInboxCount"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/organizations/inbox/read": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Mark organization inbox messages read
+         * @description Marks one or more organization inbox messages as read. Processed asynchronously.
+         */
+        post: operations["postOrganizationInboxRead"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/organizations/inbox/archived": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Mark organization inbox messages archived
+         * @description Marks one or more organization inbox messages as archived. Processed asynchronously.
+         */
+        post: operations["postOrganizationInboxArchived"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/unsubscribe/email": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Email unsubscribe page
+         * @description Public endpoint for email unsubscribe links. Extracts user and campaign information
+         *     from the encoded URL and displays an unsubscribe confirmation page.
+         */
+        get: operations["emailUnsubscribe"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/preferences/{projectID}/{userID}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Subscription preferences page
+         * @description Public endpoint for users to view and manage their subscription preferences.
+         *     Shows all public subscriptions with current user state.
+         */
+        get: operations["getPreferencesPage"];
+        put?: never;
+        /**
+         * Update subscription preferences
+         * @description Handles form submission to update user subscription preferences.
+         *     Redirects back to preferences page with success indicator.
+         */
+        post: operations["updatePreferences"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/users/devices": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Register device
+         * @description Register or update a device's push subscription. The project is taken from the projectID path parameter.
+         */
+        post: operations["registerDevice"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/push/vapid": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        /**
+         * Get VAPID public key
+         * @description Retrieves the VAPID public key for push notifications
+         */
+        get: operations["getVapidPublicKey"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/client/projects/{projectID}/auth-methods/{authMethodID}/sessions": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Mint a session token
+         * @description Mints a short-lived session token for an end user, to be used from the
+         *     client. Called server-side with an API key; the session's permissions are
+         *     defined by the session auth method (policy) named in the path.
+         */
+        post: operations["createSession"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+}
+export type webhooks = Record<string, never>;
+export interface components {
+    schemas: {
+        /** @description Request to mint a session token for an end user. */
+        CreateSession: {
+            /**
+             * @description The end user's external identifier (the session subject).
+             * @example user_12345
+             */
+            user_id: string;
+        };
+        SessionToken: {
+            /** @description The signed session token (a bearer token for the Client API). */
+            token: string;
+            /** Format: date-time */
+            expires_at: string;
+        };
+        /** @enum {string} */
+        Channel: "email" | "sms" | "push" | "inbox";
+        Problem: {
+            /**
+             * @description A short summary of the problem type. Written in English and readable for engineers, usually not suited for non technical stakeholders and not localized.
+             * @example some title for the error situation
+             */
+            title: string;
+            /**
+             * @description A human readable explanation specific to this occurrence of the problem that is helpful to locate the problem and give advice on how to proceed. Written in English and readable for engineers, usually not suited for non technical stakeholders and not localized.
+             * @example some description for the error situation
+             */
+            detail: string;
+        };
+        /** @description An external identifier with source and optional metadata */
+        ExternalID: {
+            /**
+             * @description Source of the identifier (e.g. "default", "anonymous", or a custom source). Defaults to "default" if not provided.
+             * @default default
+             * @example default
+             */
+            source: string;
+            /**
+             * @description The external identifier value
+             * @example user_12345
+             */
+            external_id: string;
+            /** @description Optional metadata associated with this identifier */
+            metadata?: {
+                [key: string]: unknown;
+            } | null;
+        };
+        /** @description An external identifier as returned in responses, including database ID and timestamps */
+        ExternalIDResponse: {
+            /**
+             * Format: uuid
+             * @example a1b2c3d4-e5f6-7890-abcd-ef1234567890
+             */
+            id: string;
+            /** @example default */
+            source: string;
+            /** @example user_12345 */
+            external_id: string;
+            metadata?: {
+                [key: string]: unknown;
+            } | null;
+            /**
+             * Format: date-time
+             * @example 2025-11-19T14:18:42.960Z
+             */
+            created_at: string;
+            /**
+             * Format: date-time
+             * @example 2025-11-23T17:20:00.021Z
+             */
+            updated_at: string;
+        };
+        User: {
+            /**
+             * Format: uuid
+             * @example 9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d
+             */
+            id: string;
+            /**
+             * Format: uuid
+             * @example 4c9d3163-7b64-4f9e-9068-d2e4b96be56b
+             */
+            project_id: string;
+            /** @description External identifiers associated with this user */
+            identifier: components["schemas"]["ExternalIDResponse"][];
+            /**
+             * Format: email
+             * @example user@example.com
+             */
+            email?: string;
+            /**
+             * Format: phone
+             * @description E.164 formatted phone number
+             * @example +1234567890
+             */
+            phone?: string;
+            /**
+             * @example {
+             *       "first_name": "John",
+             *       "last_name": "Doe"
+             *     }
+             */
+            data: {
+                [key: string]: unknown;
+            };
+            /** @example America/New_York */
+            timezone?: string;
+            /** @example en */
+            locale?: string;
+            /** @example false */
+            has_push_device: boolean;
+            /** @example 1 */
+            version: number;
+            /**
+             * Format: date-time
+             * @example 2025-11-19T14:18:42.960Z
+             */
+            created_at: string;
+            /**
+             * Format: date-time
+             * @example 2025-11-23T17:20:00.021Z
+             */
+            updated_at: string;
+        };
+        /** @description One or more external identifiers to identify the user */
+        UserIdentifier: components["schemas"]["ExternalID"][];
+        /** @description One or more external identifiers to identify the organization */
+        OrganizationIdentifier: components["schemas"]["ExternalID"][];
+        DeviceRegistration: {
+            identifier: components["schemas"]["UserIdentifier"];
+            device_id: string;
+            /** @enum {string} */
+            os?: "web" | "ios" | "android";
+            os_version?: string;
+            model?: string;
+            app_version?: string;
+            /**
+             * @example {
+             *       "app_channel": "beta",
+             *       "locale": "en-US"
+             *     }
+             */
+            data?: {
+                [key: string]: unknown;
+            } | null;
+            config: {
+                /** @description Device token for FCM or APNs */
+                token?: string;
+                /** @description Web Push subscription endpoint URL */
+                endpoint?: string;
+                /** Format: date-time */
+                expiration_time?: string;
+                keys?: {
+                    p256dh: string;
+                    auth: string;
+                };
+            };
+        };
+        VapidPublicKey: {
+            /** @description The VAPID public key */
+            public_key: string;
+        };
+        IdentifyRequest: {
+            identifier: components["schemas"]["UserIdentifier"];
+            /**
+             * Format: email
+             * @example user@example.com
+             */
+            email?: string | null;
+            /**
+             * Format: phone
+             * @description E.164 formatted phone number
+             * @example +31612345678
+             */
+            phone?: string | null;
+            /** @example Europe/Amsterdam */
+            timezone?: string | null;
+            /** @example nl-NL */
+            locale?: string | null;
+            /**
+             * @description User-specific attributes
+             * @example {
+             *       "first_name": "John",
+             *       "last_name": "Smith",
+             *       "has_completed_onboarding": true
+             *     }
+             */
+            data?: {
+                [key: string]: unknown;
+            } | null;
+        };
+        PostEventsRequest: components["schemas"]["Event"][];
+        Event: {
+            /**
+             * @description The name of the event
+             * @example purchase_completed
+             */
+            name: string;
+            identifier?: components["schemas"]["UserIdentifier"];
+            /**
+             * @description JSONB containment filter to match users by their data attributes. Mutually exclusive with identifier. When set, the event is delivered to every user whose data column contains the given key/value pairs.
+             * @example {
+             *       "plan": "enterprise"
+             *     }
+             */
+            match?: {
+                [key: string]: unknown;
+            } | null;
+            /**
+             * @description Event-specific data
+             * @example {
+             *       "product_id": "prod_789",
+             *       "amount": 99.99
+             *     }
+             */
+            data: {
+                [key: string]: unknown;
+            };
+        };
+        InboxMessageCreate: {
+            target: components["schemas"]["UserIdentifier"];
+            /** @description External identifier for the message. Required for idempotency and traceability back to the origin source. */
+            identifier: components["schemas"]["ExternalID"];
+            channel: components["schemas"]["Channel"];
+            /**
+             * Format: uuid
+             * @description Required for email and sms messages. Push uses project push provider settings.
+             */
+            sender_identity_id?: string | null;
+            /** Format: uuid */
+            campaign_id?: string | null;
+            /** Format: uuid */
+            broadcast_id?: string | null;
+            /** @description Channel-specific payload content. */
+            content?: {
+                [key: string]: unknown;
+            } | null;
+            data?: {
+                [key: string]: unknown;
+            } | null;
+            tags?: string[];
+            /** @default 3 */
+            priority: number;
+            source?: string | null;
+            /** Format: date-time */
+            scheduled_at?: string | null;
+            /** Format: date-time */
+            expires_at?: string | null;
+        };
+        OrganizationInboxMessageCreate: {
+            target: components["schemas"]["OrganizationIdentifier"];
+            /** @description External identifier for the message. Required for idempotency and traceability back to the origin source. */
+            identifier: components["schemas"]["ExternalID"];
+            channel: components["schemas"]["Channel"];
+            /**
+             * Format: uuid
+             * @description Required for email and sms messages. Push uses project push provider settings.
+             */
+            sender_identity_id?: string | null;
+            /** Format: uuid */
+            campaign_id?: string | null;
+            /** Format: uuid */
+            broadcast_id?: string | null;
+            /** @description Channel-specific payload content. */
+            content?: {
+                [key: string]: unknown;
+            } | null;
+            data?: {
+                [key: string]: unknown;
+            } | null;
+            tags?: string[];
+            /** @default 3 */
+            priority: number;
+            source?: string | null;
+            /** Format: date-time */
+            scheduled_at?: string | null;
+            /** Format: date-time */
+            expires_at?: string | null;
+        };
+        PostUserInboxMessagesRequest: components["schemas"]["InboxMessageCreate"][];
+        PostOrganizationInboxMessagesRequest: components["schemas"]["OrganizationInboxMessageCreate"][];
+        UserInboxMessageRef: {
+            target: components["schemas"]["UserIdentifier"];
+            /** Format: uuid */
+            message_id: string;
+        };
+        OrganizationInboxMessageRef: {
+            target: components["schemas"]["OrganizationIdentifier"];
+            /** Format: uuid */
+            message_id: string;
+        };
+        UserInboxMessageEvents: components["schemas"]["UserInboxMessageRef"][];
+        OrganizationInboxMessageEvents: components["schemas"]["OrganizationInboxMessageRef"][];
+        InboxMessage: {
+            /** Format: uuid */
+            id: string;
+            /** Format: uuid */
+            project_id: string;
+            /** Format: uuid */
+            user_id?: string;
+            /** Format: uuid */
+            organization_id?: string;
+            /** @description External identifier for the message, if one was provided at creation time. */
+            external_id?: string | null;
+            channel: components["schemas"]["Channel"];
+            /** Format: uuid */
+            sender_identity_id?: string | null;
+            /** Format: uuid */
+            campaign_id?: string | null;
+            /** Format: uuid */
+            broadcast_id?: string | null;
+            content: {
+                [key: string]: unknown;
+            };
+            data: {
+                [key: string]: unknown;
+            };
+            tags: string[];
+            priority: number;
+            source?: string | null;
+            /** Format: date-time */
+            scheduled_at: string;
+            /** Format: date-time */
+            expires_at?: string | null;
+            /** Format: date-time */
+            read_at?: string | null;
+            /** Format: date-time */
+            archived_at?: string | null;
+            /** Format: date-time */
+            sent_at?: string | null;
+            /** Format: date-time */
+            created_at: string;
+            /** Format: date-time */
+            updated_at: string;
+        };
+        InboxMessageList: {
+            results: components["schemas"]["InboxMessage"][];
+            total: number;
+            limit: number;
+            offset: number;
+        };
+        InboxCount: {
+            unread: number;
+            total: number;
+        };
+        Organization: {
+            /**
+             * Format: uuid
+             * @example 9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d
+             */
+            id: string;
+            /**
+             * Format: uuid
+             * @example 4c9d3163-7b64-4f9e-9068-d2e4b96be56b
+             */
+            project_id: string;
+            /** @description External identifiers associated with this organization */
+            identifier: components["schemas"]["ExternalIDResponse"][];
+            /** @example Acme Corp */
+            name?: string;
+            /**
+             * @example {
+             *       "industry": "technology",
+             *       "size": "enterprise"
+             *     }
+             */
+            data: {
+                [key: string]: unknown;
+            };
+            /** @example 1 */
+            version: number;
+            /**
+             * Format: date-time
+             * @example 2025-11-19T14:18:42.960Z
+             */
+            created_at: string;
+            /**
+             * Format: date-time
+             * @example 2025-11-23T17:20:00.021Z
+             */
+            updated_at: string;
+        };
+        OrganizationRequest: {
+            identifier: components["schemas"]["OrganizationIdentifier"];
+            /** @example Acme Corp */
+            name?: string | null;
+            /**
+             * @example {
+             *       "industry": "technology",
+             *       "size": "enterprise"
+             *     }
+             */
+            data?: {
+                [key: string]: unknown;
+            } | null;
+        };
+        OrganizationUserRequest: {
+            organization: {
+                identifier: components["schemas"]["OrganizationIdentifier"];
+            };
+            user: {
+                identifier: components["schemas"]["UserIdentifier"];
+            };
+            /**
+             * @description Organization-specific data for this user
+             * @example {
+             *       "role": "admin",
+             *       "department": "engineering"
+             *     }
+             */
+            data?: {
+                [key: string]: unknown;
+            } | null;
+        };
+        DeleteUserRequest: {
+            identifier: components["schemas"]["UserIdentifier"];
+        };
+        DeleteOrganizationRequest: {
+            identifier: components["schemas"]["OrganizationIdentifier"];
+        };
+        RemoveOrganizationUserRequest: {
+            organization: {
+                identifier: components["schemas"]["OrganizationIdentifier"];
+            };
+            user: {
+                identifier: components["schemas"]["UserIdentifier"];
+            };
+        };
+        PostOrganizationEventsRequest: components["schemas"]["OrganizationEvent"][];
+        OrganizationEvent: {
+            identifier?: components["schemas"]["OrganizationIdentifier"];
+            /**
+             * @description JSONB containment filter to match organizations by their data attributes. Mutually exclusive with identifier. When set, the event is delivered to every organization whose data column contains the given key/value pairs.
+             * @example {
+             *       "plan": "enterprise"
+             *     }
+             */
+            match?: {
+                [key: string]: unknown;
+            } | null;
+            /**
+             * @description The name of the event
+             * @example subscription_upgraded
+             */
+            name: string;
+            /**
+             * @description Event-specific data
+             * @example {
+             *       "plan": "enterprise",
+             *       "seats": 100
+             *     }
+             */
+            data?: {
+                [key: string]: unknown;
+            } | null;
+        };
+        UpsertUserScheduledRequest: {
+            /**
+             * @description The name of the scheduled resource
+             * @example renewal_date
+             */
+            name: string;
+            identifier?: components["schemas"]["UserIdentifier"];
+            /**
+             * Format: date-time
+             * @description The time at which the scheduled resource is set to trigger. Required for single schedules.
+             * @example 2025-12-25T10:00:00Z
+             */
+            scheduled_at?: string | null;
+            /**
+             * Format: date-time
+             * @description Start time for recurring schedules. If omitted for recurring schedules, defaults to now.
+             * @example 2025-01-01T00:00:00Z
+             */
+            start_at?: string | null;
+            /**
+             * @description Interval for recurring schedules. When set, the schedule type is automatically set to recurring.
+             * @example 24h
+             */
+            interval?: string | null;
+            /**
+             * @description Scheduled resource data
+             * @example {
+             *       "plan": "pro",
+             *       "amount": 29.99
+             *     }
+             */
+            data?: {
+                [key: string]: unknown;
+            } | null;
+        };
+        UpsertOrganizationScheduledRequest: {
+            /**
+             * @description The name of the scheduled resource
+             * @example contract_renewal
+             */
+            name: string;
+            identifier: components["schemas"]["OrganizationIdentifier"];
+            /**
+             * Format: date-time
+             * @description The time at which the scheduled resource is set to trigger. Required for single schedules.
+             * @example 2025-12-25T10:00:00Z
+             */
+            scheduled_at?: string | null;
+            /**
+             * Format: date-time
+             * @description Start time for recurring schedules. If omitted for recurring schedules, defaults to now.
+             * @example 2025-01-01T00:00:00Z
+             */
+            start_at?: string | null;
+            /**
+             * @description Interval for recurring schedules. When set, the schedule type is automatically set to recurring.
+             * @example 24h
+             */
+            interval?: string | null;
+            /**
+             * @description Scheduled resource data
+             * @example {
+             *       "contract_type": "enterprise",
+             *       "seats": 100
+             *     }
+             */
+            data?: {
+                [key: string]: unknown;
+            } | null;
+        };
+        DeleteUserScheduledRequest: {
+            /**
+             * @description The name of the scheduled resource to delete
+             * @example renewal_date
+             */
+            name: string;
+            identifier?: components["schemas"]["UserIdentifier"];
+        };
+        ScheduledAccepted: {
+            /**
+             * Format: uuid
+             * @description The unique identifier for the scheduled instance
+             * @example a1b2c3d4-e5f6-7890-abcd-ef1234567890
+             */
+            id: string;
+            /**
+             * @description The name of the scheduled resource
+             * @example trial_end
+             */
+            name: string;
+            /**
+             * Format: date-time
+             * @description The time at which the scheduled resource is set to trigger
+             * @example 2025-01-15T09:00:00Z
+             */
+            scheduled_at: string;
+            /** @description Scheduled resource data */
+            data?: {
+                [key: string]: unknown;
+            } | null;
+        };
+        DeleteOrganizationScheduledRequest: {
+            /**
+             * @description The name of the scheduled resource to delete
+             * @example contract_renewal
+             */
+            name: string;
+            identifier: components["schemas"]["OrganizationIdentifier"];
+        };
+    };
+    responses: {
+        /** @description Error response */
+        Error: {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "application/json": components["schemas"]["Problem"];
+            };
+        };
+    };
+    parameters: {
+        /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+        ProjectID: string;
+        /** @description Maximum number of items to return */
+        Limit: number;
+        /** @description Number of items to skip */
+        Offset: number;
+    };
+    requestBodies: never;
+    headers: never;
+    pathItems: never;
+}
+export type $defs = Record<string, never>;
+export interface operations {
+    upsertUserClient: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["IdentifyRequest"];
+            };
+        };
+        responses: {
+            /** @description User upserted successfully */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["User"];
+                };
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    deleteUserClient: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["DeleteUserRequest"];
+            };
+        };
+        responses: {
+            /** @description User deleted successfully */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    postUserEvents: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["PostEventsRequest"];
+            };
+        };
+        responses: {
+            /** @description Events accepted for asynchronous processing */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    getUserInbox: {
+        parameters: {
+            query: {
+                source: string;
+                external_id: string;
+                status?: "unread" | "read" | "archived";
+                /** @description Comma-separated tag filter. All listed tags must be present. */
+                tags?: string;
+                message_source?: string;
+                priority?: number;
+                channel: components["schemas"]["Channel"];
+                /** @description Maximum number of items to return */
+                limit?: components["parameters"]["Limit"];
+                /** @description Number of items to skip */
+                offset?: components["parameters"]["Offset"];
+            };
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description User inbox messages retrieved successfully */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["InboxMessageList"];
+                };
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    postUserInboxMessages: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["PostUserInboxMessagesRequest"];
+            };
+        };
+        responses: {
+            /** @description Inbox messages accepted for asynchronous processing */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    getUserInboxCount: {
+        parameters: {
+            query: {
+                source: string;
+                external_id: string;
+                channel: components["schemas"]["Channel"];
+            };
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description User inbox count retrieved successfully */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["InboxCount"];
+                };
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    postUserInboxRead: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UserInboxMessageEvents"];
+            };
+        };
+        responses: {
+            /** @description Inbox read events accepted for asynchronous processing */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    postUserInboxArchived: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UserInboxMessageEvents"];
+            };
+        };
+        responses: {
+            /** @description Inbox archived events accepted for asynchronous processing */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    upsertOrganizationClient: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["OrganizationRequest"];
+            };
+        };
+        responses: {
+            /** @description Organization upserted successfully */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Organization"];
+                };
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    deleteOrganizationClient: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["DeleteOrganizationRequest"];
+            };
+        };
+        responses: {
+            /** @description Organization deleted successfully */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    addOrganizationUserClient: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["OrganizationUserRequest"];
+            };
+        };
+        responses: {
+            /** @description User added to organization successfully */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    removeOrganizationUserClient: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["RemoveOrganizationUserRequest"];
+            };
+        };
+        responses: {
+            /** @description User removed from organization successfully */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    upsertUserScheduledClient: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UpsertUserScheduledRequest"];
+            };
+        };
+        responses: {
+            /** @description Scheduled resource accepted for asynchronous processing */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ScheduledAccepted"];
+                };
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    deleteUserScheduledClient: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["DeleteUserScheduledRequest"];
+            };
+        };
+        responses: {
+            /** @description User scheduled deleted successfully */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    upsertOrganizationScheduledClient: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UpsertOrganizationScheduledRequest"];
+            };
+        };
+        responses: {
+            /** @description Scheduled resource accepted for asynchronous processing */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ScheduledAccepted"];
+                };
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    deleteOrganizationScheduledClient: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["DeleteOrganizationScheduledRequest"];
+            };
+        };
+        responses: {
+            /** @description Organization scheduled deleted successfully */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    postOrganizationEventsClient: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["PostOrganizationEventsRequest"];
+            };
+        };
+        responses: {
+            /** @description Events accepted for asynchronous processing */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    getOrganizationInbox: {
+        parameters: {
+            query: {
+                source: string;
+                external_id: string;
+                status?: "unread" | "read" | "archived";
+                /** @description Comma-separated tag filter. All listed tags must be present. */
+                tags?: string;
+                message_source?: string;
+                priority?: number;
+                channel: components["schemas"]["Channel"];
+                /** @description Maximum number of items to return */
+                limit?: components["parameters"]["Limit"];
+                /** @description Number of items to skip */
+                offset?: components["parameters"]["Offset"];
+            };
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Organization inbox messages retrieved successfully */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["InboxMessageList"];
+                };
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    postOrganizationInboxMessages: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["PostOrganizationInboxMessagesRequest"];
+            };
+        };
+        responses: {
+            /** @description Inbox messages accepted for asynchronous processing */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    getOrganizationInboxCount: {
+        parameters: {
+            query: {
+                source: string;
+                external_id: string;
+                channel: components["schemas"]["Channel"];
+            };
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Organization inbox count retrieved successfully */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["InboxCount"];
+                };
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    postOrganizationInboxRead: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["OrganizationInboxMessageEvents"];
+            };
+        };
+        responses: {
+            /** @description Inbox read events accepted for asynchronous processing */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    postOrganizationInboxArchived: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["OrganizationInboxMessageEvents"];
+            };
+        };
+        responses: {
+            /** @description Inbox archived events accepted for asynchronous processing */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    emailUnsubscribe: {
+        parameters: {
+            query: {
+                /** @description Encoded unsubscribe link with user and campaign data */
+                link: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Unsubscribe confirmation page */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/html": string;
+                };
+            };
+        };
+    };
+    getPreferencesPage: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project ID */
+                projectID: string;
+                /** @description The user ID */
+                userID: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Subscription preferences page */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/html": string;
+                };
+            };
+        };
+    };
+    updatePreferences: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project ID */
+                projectID: string;
+                /** @description The user ID */
+                userID: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/x-www-form-urlencoded": {
+                    /** @description Array of subscription IDs to keep subscribed */
+                    subscriptionIds?: string[];
+                };
+            };
+        };
+        responses: {
+            /** @description Success response (for htmx partial updates) */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/html": string;
+                };
+            };
+            /** @description Redirect to preferences page with success indicator */
+            302: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    registerDevice: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["DeviceRegistration"];
+            };
+        };
+        responses: {
+            /** @description Device registered successfully */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    getVapidPublicKey: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description VAPID public key retrieved successfully */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["VapidPublicKey"];
+                };
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+    createSession: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description The project the request acts on. Must match the project the presented credential is authorized for. */
+                projectID: components["parameters"]["ProjectID"];
+                /** @description The session auth method (policy) that defines what the session may do. */
+                authMethodID: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateSession"];
+            };
+        };
+        responses: {
+            /** @description Session token minted successfully */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["SessionToken"];
+                };
+            };
+            default: components["responses"]["Error"];
+        };
+    };
+}
diff --git a/src/index.ts b/src/index.ts
index 0502e96..7cdd671 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -2,7 +2,7 @@ import { BrowserClient } from './platform/browser'
 import { ClientNamespace } from './core/factory'
 
 export * from './core/client'
-export * from './core/http'
+export * from './core/transport'
 export * from './core/errors'
 export * from './core/resources'
 export * from './types'
diff --git a/src/platform/browser.ts b/src/platform/browser.ts
index 99e068c..8a89ffb 100644
--- a/src/platform/browser.ts
+++ b/src/platform/browser.ts
@@ -2,7 +2,7 @@ import { Client } from '../core/client'
 import { ClientProps, ExternalID } from '../types'
 import { generateUuid } from '../utils'
 import { UserResource } from '../core/resources/users/user'
-import { HttpHandler } from '../core/http'
+import { Transport } from '../core/transport'
 import {
     UpsertUserRequest,
     DeleteUserRequest,
@@ -19,8 +19,8 @@ import { UserScheduledResource } from '../core/resources/users/scheduled'
 class BrowserUserEventsResource extends UserEventsResource {
     readonly #getIdentifier: () => UserIdentifier
 
-    constructor(http: HttpHandler, getIdentifier: () => UserIdentifier) {
-        super(http)
+    constructor(transport: Transport, getIdentifier: () => UserIdentifier) {
+        super(transport)
         this.#getIdentifier = getIdentifier
     }
 
@@ -38,8 +38,8 @@ class BrowserUserEventsResource extends UserEventsResource {
 class BrowserUserScheduledResource extends UserScheduledResource {
     readonly #getIdentifier: () => UserIdentifier
 
-    constructor(http: HttpHandler, getIdentifier: () => UserIdentifier) {
-        super(http)
+    constructor(transport: Transport, getIdentifier: () => UserIdentifier) {
+        super(transport)
         this.#getIdentifier = getIdentifier
     }
 
@@ -70,11 +70,11 @@ class BrowserUserResource extends UserResource {
     override readonly events: BrowserUserEventsResource
     override readonly schedule: BrowserUserScheduledResource
 
-    constructor(http: HttpHandler) {
-        super(http)
+    constructor(transport: Transport) {
+        super(transport)
         this.#anonymousId = generateUuid()
-        this.events = new BrowserUserEventsResource(http, () => this.#buildIdentifier())
-        this.schedule = new BrowserUserScheduledResource(http, () => this.#buildIdentifier())
+        this.events = new BrowserUserEventsResource(transport, () => this.#buildIdentifier())
+        this.schedule = new BrowserUserScheduledResource(transport, () => this.#buildIdentifier())
     }
 
     #buildIdentifier(extraIdentifiers?: UserIdentifier): UserIdentifier {
@@ -139,6 +139,6 @@ export class BrowserClient extends Client {
 
     constructor(props: ClientProps) {
         super(props)
-        this.user = new BrowserUserResource(super.httpHandler)
+        this.user = new BrowserUserResource(super.transport)
     }
 }
diff --git a/test/url.test.ts b/test/url.test.ts
index 6e1030c..52abf8c 100644
--- a/test/url.test.ts
+++ b/test/url.test.ts
@@ -27,9 +27,18 @@ describe('Client API URL construction', () => {
         vi.restoreAllMocks()
     })
 
+    // openapi-fetch invokes the global fetch with a `Request` object rather
+    // than a URL string, so read the resolved URL off the request's `.url`.
+    function urlOf(input: unknown): string {
+        if (input instanceof Request) {
+            return input.url
+        }
+        return String(input)
+    }
+
     function lastUrl(): string {
         const call = fetchMock.mock.calls.at(-1)
-        return String(call?.[0])
+        return urlOf(call?.[0])
     }
 
     it('prefixes user requests with /client/projects/{projectId}', async () => {
@@ -80,11 +89,50 @@ describe('Client API URL construction', () => {
         await client.user.upsert({ identifier: [{ externalId: 'a' }] })
         await client.user.upsert({ identifier: [{ externalId: 'b' }] })
         for (const call of fetchMock.mock.calls) {
-            expect(String(call[0])).toBe(`${urlEndpoint}/client/projects/${projectId}/users`)
+            expect(urlOf(call[0])).toBe(`${urlEndpoint}/client/projects/${projectId}/users`)
         }
     })
 })
 
+describe('request encoding', () => {
+    let fetchMock: ReturnType<typeof mockFetch>
+
+    beforeEach(() => {
+        fetchMock = mockFetch()
+        vi.stubGlobal('fetch', fetchMock)
+    })
+
+    afterEach(() => {
+        vi.unstubAllGlobals()
+        vi.restoreAllMocks()
+    })
+
+    async function lastRequest(): Promise<Request> {
+        const call = fetchMock.mock.calls.at(-1)
+        return call?.[0] as Request
+    }
+
+    it('sends the Bearer auth header', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+        await client.user.upsert({ identifier: [{ externalId: 'user-1' }] })
+        const request = await lastRequest()
+        expect(request.headers.get('Authorization')).toBe(`Bearer ${apiKey}`)
+    })
+
+    it('maps the camelCase facade payload to snake_case on the wire', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+        await client.user.upsert({
+            identifier: [{ externalId: 'user-1' }],
+            email: 'a@b.com',
+        })
+        const body = await (await lastRequest()).clone().json()
+        expect(body).toEqual({
+            identifier: [{ external_id: 'user-1' }],
+            email: 'a@b.com',
+        })
+    })
+})
+
 describe('projectId validation', () => {
     it('throws when projectId is missing', () => {
         // @ts-expect-error projectId is required

From 01111bea5d2e94759372e36511d6becc74a25e8c Mon Sep 17 00:00:00 2001
From: Jeroen Rinzema <jeroen@rinzema.dev>
Date: Thu, 25 Jun 2026 12:15:46 +0200
Subject: [PATCH 3/5] feat: add inbox, devices, push and session client
 resources

Cover the remaining Client API endpoints in the hand-written facade now
that the low-level layer is generated from the OpenAPI spec:

- user & organization inbox (create, query, count, read, archived)
- user device registration for push subscriptions
- project VAPID public key
- end-user session token minting

In the browser client, device registration inherits the session
identifier the same way events and scheduled resources do.

Pin the vendored spec to the v0.1.0-rc.1 release asset (a stable,
immutable source) and drop the spec-sync workflow.
---
 .github/workflows/spec-sync.yml               |  80 -------------
 README.md                                     |  75 ++++++++++++
 spec/SOURCE.md                                |  44 +++----
 src/core/client.ts                            |   4 +
 src/core/factory.ts                           |   6 +-
 src/core/resources/inbox-query.ts             |  36 ++++++
 src/core/resources/index.ts                   |  17 ++-
 src/core/resources/organizations/inbox.ts     |  80 +++++++++++++
 src/core/resources/organizations/index.ts     |   3 +-
 .../resources/organizations/organization.ts   |   3 +
 src/core/resources/push.ts                    |  19 +++
 src/core/resources/sessions.ts                |  26 ++++
 src/core/resources/users/devices.ts           |  20 ++++
 src/core/resources/users/inbox.ts             |  80 +++++++++++++
 src/core/resources/users/index.ts             |   4 +-
 src/core/resources/users/user.ts              |   6 +
 src/index.ts                                  |  14 +++
 src/platform/browser.ts                       |  20 ++++
 src/types/device.ts                           |  38 ++++++
 src/types/inbox.ts                            | 111 ++++++++++++++++++
 src/types/index.ts                            |   3 +
 src/types/session.ts                          |  11 ++
 test/url.test.ts                              | 104 ++++++++++++++++
 23 files changed, 694 insertions(+), 110 deletions(-)
 delete mode 100644 .github/workflows/spec-sync.yml
 create mode 100644 src/core/resources/inbox-query.ts
 create mode 100644 src/core/resources/organizations/inbox.ts
 create mode 100644 src/core/resources/push.ts
 create mode 100644 src/core/resources/sessions.ts
 create mode 100644 src/core/resources/users/devices.ts
 create mode 100644 src/core/resources/users/inbox.ts
 create mode 100644 src/types/device.ts
 create mode 100644 src/types/inbox.ts
 create mode 100644 src/types/session.ts

diff --git a/.github/workflows/spec-sync.yml b/.github/workflows/spec-sync.yml
deleted file mode 100644
index d250475..0000000
--- a/.github/workflows/spec-sync.yml
+++ /dev/null
@@ -1,80 +0,0 @@
-name: Spec Sync
-
-# Bump bot for the vendored OpenAPI spec.
-#
-# Re-fetches `spec/client.yaml` from the pinned ref recorded in `spec/SOURCE.md`,
-# regenerates the low-level layer (`src/gen/`), and — if anything changed — opens
-# a PR. This keeps the SDK in step with the platform spec without a manual fetch.
-#
-# Note: this syncs *at the current pin*. Bumping the pin itself (e.g. to a new
-# release tag) is a manual edit to `spec/SOURCE.md` (and its raw URL below is
-# re-read from that file each run, so a bumped pin is picked up automatically).
-
-on:
-  schedule:
-    # Weekly, Monday 06:00 UTC.
-    - cron: "0 6 * * 1"
-  workflow_dispatch: {}
-
-jobs:
-  sync:
-    name: "Re-fetch spec & regenerate"
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-    steps:
-      - uses: actions/checkout@v5
-      - uses: pnpm/action-setup@v4
-        with:
-          version: ${{ vars.PNPM_VERSION }}
-      - name: Set-up Node
-        uses: actions/setup-node@v5
-        with:
-          node-version: ${{ vars.NODEJS_VERSION }}
-          cache: 'pnpm'
-
-      - run: pnpm install
-
-      # The raw URL (repo + spec path + pinned ref) is single-sourced in
-      # spec/SOURCE.md; read it from the fenced ```...``` block there so the pin
-      # only ever lives in one place.
-      - name: Resolve spec URL from SOURCE.md
-        id: source
-        run: |
-          url="$(grep -Eo 'https://raw\.githubusercontent\.com/[^ )]+resources\.yml' spec/SOURCE.md | head -n1)"
-          if [ -z "$url" ]; then
-            echo "::error::Could not find the raw spec URL in spec/SOURCE.md"
-            exit 1
-          fi
-          echo "Spec URL: $url"
-          echo "url=$url" >> "$GITHUB_OUTPUT"
-
-      - name: Re-fetch spec
-        run: curl -fsSL "${{ steps.source.outputs.url }}" -o spec/client.yaml
-
-      - name: Regenerate client layer
-        run: pnpm generate
-
-      # Open (or update) a PR only when the vendored spec or generated output
-      # actually changed.
-      - name: Open PR on drift
-        uses: peter-evans/create-pull-request@v7
-        with:
-          add-paths: |
-            spec/client.yaml
-            src/gen/**
-          branch: chore/spec-sync
-          commit-message: "chore: sync OpenAPI spec & regenerate client layer"
-          title: "chore: sync OpenAPI spec & regenerate client layer"
-          body: |
-            Automated spec sync.
-
-            Re-fetched `spec/client.yaml` from the pinned ref in `spec/SOURCE.md`
-            and regenerated `src/gen/` via `pnpm generate`.
-
-            Review the diff and merge if the changes look correct. If the spec
-            should track a different ref, update `spec/SOURCE.md` first.
-          labels: |
-            dependencies
-            automated
diff --git a/README.md b/README.md
index 53e7df0..c4f9268 100644
--- a/README.md
+++ b/README.md
@@ -60,10 +60,15 @@ All Client API endpoints live under `/api/client/projects/{projectId}/...`:
 | Users                    | `/api/client/projects/{projectId}/users`                          |
 | User events              | `/api/client/projects/{projectId}/users/events`                   |
 | User scheduled           | `/api/client/projects/{projectId}/users/scheduled`                |
+| User inbox               | `/api/client/projects/{projectId}/users/inbox`                    |
+| User devices             | `/api/client/projects/{projectId}/users/devices`                  |
 | Organizations            | `/api/client/projects/{projectId}/organizations`                  |
 | Organization members     | `/api/client/projects/{projectId}/organizations/users`            |
 | Organization events      | `/api/client/projects/{projectId}/organizations/events`           |
 | Organization scheduled   | `/api/client/projects/{projectId}/organizations/scheduled`        |
+| Organization inbox       | `/api/client/projects/{projectId}/organizations/inbox`            |
+| Push (VAPID key)         | `/api/client/projects/{projectId}/push/vapid`                     |
+| Sessions                 | `/api/client/projects/{projectId}/auth-methods/{authMethodId}/sessions` |
 
 The `projectId` must be a valid UUID; the client throws a `ValidationError` at
 construction time if it is missing, empty, or malformed.
@@ -205,6 +210,76 @@ await client.organization.schedule.upsert({
 })
 ```
 
+### Inbox
+
+Create, query, count and update inbox messages for users and organizations. The
+same surface is available under `client.organization.inbox.*`.
+
+```typescript
+// Create inbox messages (max 100 per call)
+await client.user.inbox.create([
+    {
+        target: [{ externalId: 'user-123' }],
+        identifier: { externalId: 'msg-1' },
+        channel: 'inbox',
+        content: { title: 'Welcome', body: 'Thanks for joining!' },
+    },
+])
+
+// Query a user's visible messages
+const { results, total } = await client.user.inbox.query({
+    source: 'default',
+    externalId: 'user-123',
+    channel: 'inbox',
+    status: 'unread',
+})
+
+// Unread / total counts
+const counts = await client.user.inbox.count({
+    source: 'default',
+    externalId: 'user-123',
+    channel: 'inbox',
+})
+
+// Mark messages read / archived
+await client.user.inbox.markRead([{ target: [{ externalId: 'user-123' }], messageId: 'msg-1' }])
+await client.user.inbox.markArchived([{ target: [{ externalId: 'user-123' }], messageId: 'msg-1' }])
+```
+
+### Devices & Push
+
+Register a device's push subscription and fetch the project's VAPID public key
+for Web Push. In the browser, the current session identifier is injected
+automatically.
+
+```typescript
+const { publicKey } = await client.push.getVapidPublicKey()
+
+await client.user.devices.register({
+    identifier: [{ externalId: 'user-123' }],
+    deviceId: 'device-1',
+    os: 'web',
+    config: {
+        endpoint: 'https://push.example.com/...',
+        keys: { p256dh: '...', auth: '...' },
+    },
+})
+```
+
+### Sessions
+
+Mint a short-lived session token for an end user, server-side, so the client can
+call the Client API directly. The permissions are defined by the session auth
+method (policy) named in the call.
+
+```typescript
+const session = await client.sessions.create('auth-method-uuid', {
+    userId: 'user-123',
+})
+
+// session.token is a bearer token for the Client API; session.expiresAt is its expiry
+```
+
 ### Multiple Identifiers
 
 You can pass multiple identifiers from different sources:
diff --git a/spec/SOURCE.md b/spec/SOURCE.md
index 630e9e2..8ea86fe 100644
--- a/spec/SOURCE.md
+++ b/spec/SOURCE.md
@@ -1,38 +1,32 @@
 # Spec source
 
-`spec/client.yaml` is **vendored** (committed) from the Lunogram platform repo.
-The SDK's low-level layer (`src/gen/schema.ts`) is generated from it via
-`pnpm generate`. Do not hand-edit either file.
+`spec/client.yaml` is **vendored** (committed) from a Lunogram platform
+**release**. The SDK's low-level layer (`src/gen/schema.ts`) is generated from
+it via `pnpm generate`. Do not hand-edit either file.
 
-| Field        | Value                                                                                 |
-| ------------ | ------------------------------------------------------------------------------------- |
-| Source repo  | https://github.com/lunogram/platform                                                  |
-| Spec path    | `internal/http/controllers/v1/client/oapi/resources.yml`                              |
-| Pinned ref   | `a12f901dc98e7ced44efbad27a388e8bf5ee0f3a`                                            |
+| Field       | Value                                |
+| ----------- | ------------------------------------ |
+| Source repo | https://github.com/lunogram/platform |
+| Pinned tag  | `v0.1.0-rc.1`                        |
+| Spec asset  | `client.yaml`                        |
 
-Raw URL used by `spec-sync.yml` to re-fetch:
+Release asset URL to re-fetch the spec:
 
 ```
-https://raw.githubusercontent.com/lunogram/platform/a12f901dc98e7ced44efbad27a388e8bf5ee0f3a/internal/http/controllers/v1/client/oapi/resources.yml
+https://github.com/lunogram/platform/releases/download/v0.1.0-rc.1/client.yaml
 ```
 
 ## About the pin
 
-The ref above is the head of platform **PR #262**'s branch — a branch/commit
-pin used during development. Pinning to a commit means **no platform release is
-required** to consume the spec: any ref (branch, tag, or SHA) is fetchable from
-the public repo via the raw URL.
-
-**TODO:** once the platform cuts a release that ships the client spec (e.g.
-`client.yaml` from a `v*.*.*` tag), flip the pinned ref to that tag for a stable,
-reproducible source.
+The SDK pins a specific platform **release tag**. Every tagged platform release
+publishes the client OpenAPI spec as a `client.yaml` asset (see the platform's
+`.github/workflows/release.yml` → `openapi-specs` job), so the spec is fetched
+from a stable, versioned, immutable source — no platform checkout or branch pin
+required.
 
 ## How to bump the pin
 
-1. Update the **Pinned ref** value above (and the raw URL).
-2. Run `pnpm generate` to regenerate `src/gen/schema.ts`.
-3. Commit `spec/` and `src/gen/` together.
-
-The `spec-sync.yml` workflow automates re-fetching at the current pin and opens a
-PR when the spec or generated output drifts; bumping the pin itself is a manual
-edit to this file.
+1. Update the **Pinned tag** value above and the release asset URL to the new tag.
+2. Re-fetch the spec into `spec/client.yaml` from the release asset URL above.
+3. Run `pnpm generate` to regenerate `src/gen/schema.ts`.
+4. Commit `spec/` and `src/gen/` together.
diff --git a/src/core/client.ts b/src/core/client.ts
index 9b59c52..4e4a07d 100644
--- a/src/core/client.ts
+++ b/src/core/client.ts
@@ -5,6 +5,8 @@ import { createClientNamespace, ClientNamespace } from './factory'
 export class Client {
     readonly user: ClientNamespace['user']
     readonly organization: ClientNamespace['organization']
+    readonly push: ClientNamespace['push']
+    readonly sessions: ClientNamespace['sessions']
     readonly #transport: Transport
 
     constructor(props: ClientProps) {
@@ -12,6 +14,8 @@ export class Client {
         const namespace = createClientNamespace(this.#transport)
         this.user = namespace.user
         this.organization = namespace.organization
+        this.push = namespace.push
+        this.sessions = namespace.sessions
     }
 
     protected get transport(): Transport {
diff --git a/src/core/factory.ts b/src/core/factory.ts
index 93d857b..132b359 100644
--- a/src/core/factory.ts
+++ b/src/core/factory.ts
@@ -1,16 +1,20 @@
 import { Transport } from './transport'
 import { ClientProps } from '../types'
-import { UserResource, OrganizationResource } from './resources'
+import { UserResource, OrganizationResource, PushResource, SessionResource } from './resources'
 
 export interface ClientNamespace {
     user: UserResource
     organization: OrganizationResource
+    push: PushResource
+    sessions: SessionResource
 }
 
 export function createClientNamespace(transport: Transport): ClientNamespace {
     return {
         user: new UserResource(transport),
         organization: new OrganizationResource(transport),
+        push: new PushResource(transport),
+        sessions: new SessionResource(transport),
     }
 }
 
diff --git a/src/core/resources/inbox-query.ts b/src/core/resources/inbox-query.ts
new file mode 100644
index 0000000..e899a50
--- /dev/null
+++ b/src/core/resources/inbox-query.ts
@@ -0,0 +1,36 @@
+import { InboxQuery, InboxCountQuery } from '../../types'
+
+/**
+ * Translate the camelCase {@link InboxQuery} facade into the snake_case query
+ * object the generated client expects. Query parameters (unlike JSON bodies)
+ * are not re-mapped by the transport middleware, so the wire keys are produced
+ * here. Undefined optionals are dropped so they never reach the query string.
+ */
+export function toInboxQuery(q: InboxQuery) {
+    return prune({
+        source: q.source,
+        external_id: q.externalId,
+        channel: q.channel,
+        status: q.status,
+        tags: q.tags,
+        message_source: q.messageSource,
+        priority: q.priority,
+        limit: q.limit,
+        offset: q.offset,
+    })
+}
+
+/** Translate the camelCase {@link InboxCountQuery} facade into the wire query. */
+export function toInboxCountQuery(q: InboxCountQuery) {
+    return {
+        source: q.source,
+        external_id: q.externalId,
+        channel: q.channel,
+    }
+}
+
+function prune<T extends Record<string, unknown>>(obj: T): T {
+    return Object.fromEntries(
+        Object.entries(obj).filter(([, value]) => value !== undefined),
+    ) as T
+}
diff --git a/src/core/resources/index.ts b/src/core/resources/index.ts
index 166de2f..69a116c 100644
--- a/src/core/resources/index.ts
+++ b/src/core/resources/index.ts
@@ -1,3 +1,16 @@
 export { BaseResource } from './base'
-export { UserResource, UserScheduledResource } from './users'
-export { OrganizationResource, OrganizationScheduledResource } from './organizations'
\ No newline at end of file
+export {
+    UserResource,
+    UserScheduledResource,
+    UserEventsResource,
+    UserInboxResource,
+    UserDevicesResource,
+} from './users'
+export {
+    OrganizationResource,
+    OrganizationScheduledResource,
+    OrganizationEventsResource,
+    OrganizationInboxResource,
+} from './organizations'
+export { PushResource } from './push'
+export { SessionResource } from './sessions'
\ No newline at end of file
diff --git a/src/core/resources/organizations/inbox.ts b/src/core/resources/organizations/inbox.ts
new file mode 100644
index 0000000..36914a5
--- /dev/null
+++ b/src/core/resources/organizations/inbox.ts
@@ -0,0 +1,80 @@
+import { BaseResource } from '../base'
+import {
+    OrganizationInboxMessageCreate,
+    InboxMessageList,
+    InboxCount,
+    InboxQuery,
+    InboxCountQuery,
+    OrganizationInboxMessageRef,
+} from '../../../types'
+import { toInboxQuery, toInboxCountQuery } from '../inbox-query'
+
+/**
+ * Resource for managing an organization's inbox messages.
+ */
+export class OrganizationInboxResource extends BaseResource {
+    /**
+     * Creates one or more inbox messages for organizations. Processed asynchronously.
+     * @param messages - Inbox messages to create (max 100)
+     */
+    async create(messages: OrganizationInboxMessageCreate[]): Promise<void> {
+        await this.call<void>(() =>
+            this.client.POST('/api/client/projects/{projectID}/organizations/inbox', {
+                params: this.withProject(),
+                body: messages as never,
+            }),
+        )
+    }
+
+    /**
+     * Returns visible, non-expired inbox messages for an organization.
+     * @param query - Filter including source, externalId and channel
+     * @returns Promise resolving to a paginated list of inbox messages
+     */
+    async query(query: InboxQuery): Promise<InboxMessageList> {
+        return this.call<InboxMessageList>(() =>
+            this.client.GET('/api/client/projects/{projectID}/organizations/inbox', {
+                params: { path: { projectID: this.transport.projectId }, query: toInboxQuery(query) },
+            }),
+        )
+    }
+
+    /**
+     * Returns unread and total visible inbox message counts for an organization.
+     * @param query - Filter including source, externalId and channel
+     * @returns Promise resolving to the inbox counts
+     */
+    async count(query: InboxCountQuery): Promise<InboxCount> {
+        return this.call<InboxCount>(() =>
+            this.client.GET('/api/client/projects/{projectID}/organizations/inbox/count', {
+                params: { path: { projectID: this.transport.projectId }, query: toInboxCountQuery(query) },
+            }),
+        )
+    }
+
+    /**
+     * Marks one or more organization inbox messages as read. Processed asynchronously.
+     * @param messages - References to the messages to mark read (max 100)
+     */
+    async markRead(messages: OrganizationInboxMessageRef[]): Promise<void> {
+        await this.call<void>(() =>
+            this.client.POST('/api/client/projects/{projectID}/organizations/inbox/read', {
+                params: this.withProject(),
+                body: messages as never,
+            }),
+        )
+    }
+
+    /**
+     * Marks one or more organization inbox messages as archived. Processed asynchronously.
+     * @param messages - References to the messages to mark archived (max 100)
+     */
+    async markArchived(messages: OrganizationInboxMessageRef[]): Promise<void> {
+        await this.call<void>(() =>
+            this.client.POST('/api/client/projects/{projectID}/organizations/inbox/archived', {
+                params: this.withProject(),
+                body: messages as never,
+            }),
+        )
+    }
+}
diff --git a/src/core/resources/organizations/index.ts b/src/core/resources/organizations/index.ts
index 237ff2c..50e521b 100644
--- a/src/core/resources/organizations/index.ts
+++ b/src/core/resources/organizations/index.ts
@@ -1,3 +1,4 @@
 export { OrganizationResource } from './organization'
 export { OrganizationScheduledResource } from './scheduled'
-export { OrganizationEventsResource } from './events'
\ No newline at end of file
+export { OrganizationEventsResource } from './events'
+export { OrganizationInboxResource } from './inbox'
\ No newline at end of file
diff --git a/src/core/resources/organizations/organization.ts b/src/core/resources/organizations/organization.ts
index 09cb7de..328c5ff 100644
--- a/src/core/resources/organizations/organization.ts
+++ b/src/core/resources/organizations/organization.ts
@@ -9,15 +9,18 @@ import { BaseResource } from '../base'
 import { Transport } from '../../transport'
 import { OrganizationScheduledResource } from './scheduled'
 import { OrganizationEventsResource } from './events'
+import { OrganizationInboxResource } from './inbox'
 
 export class OrganizationResource extends BaseResource {
     readonly schedule: OrganizationScheduledResource
     readonly events: OrganizationEventsResource
+    readonly inbox: OrganizationInboxResource
 
     constructor(transport: Transport) {
         super(transport)
         this.schedule = new OrganizationScheduledResource(transport)
         this.events = new OrganizationEventsResource(transport)
+        this.inbox = new OrganizationInboxResource(transport)
     }
 
     /**
diff --git a/src/core/resources/push.ts b/src/core/resources/push.ts
new file mode 100644
index 0000000..e954ebe
--- /dev/null
+++ b/src/core/resources/push.ts
@@ -0,0 +1,19 @@
+import { BaseResource } from './base'
+import { VapidPublicKey } from '../../types'
+
+/**
+ * Project-level resource for push notification configuration.
+ */
+export class PushResource extends BaseResource {
+    /**
+     * Retrieves the project's VAPID public key for Web Push.
+     * @returns Promise resolving to the VAPID public key
+     */
+    async getVapidPublicKey(): Promise<VapidPublicKey> {
+        return this.call<VapidPublicKey>(() =>
+            this.client.GET('/api/client/projects/{projectID}/push/vapid', {
+                params: this.withProject(),
+            }),
+        )
+    }
+}
diff --git a/src/core/resources/sessions.ts b/src/core/resources/sessions.ts
new file mode 100644
index 0000000..09be360
--- /dev/null
+++ b/src/core/resources/sessions.ts
@@ -0,0 +1,26 @@
+import { BaseResource } from './base'
+import { CreateSessionRequest, SessionToken } from '../../types'
+
+/**
+ * Project-level resource for minting end-user session tokens.
+ *
+ * Called server-side with an API key; the returned token is a short-lived
+ * bearer token for the Client API whose permissions are defined by the session
+ * auth method (policy) named by `authMethodId`.
+ */
+export class SessionResource extends BaseResource {
+    /**
+     * Mints a session token for an end user.
+     * @param authMethodId - The session auth method (policy) the session uses
+     * @param data - Request identifying the session subject (the end user)
+     * @returns Promise resolving to the minted session token
+     */
+    async create(authMethodId: string, data: CreateSessionRequest): Promise<SessionToken> {
+        return this.call<SessionToken>(() =>
+            this.client.POST('/api/client/projects/{projectID}/auth-methods/{authMethodID}/sessions', {
+                params: this.withProject({ authMethodID: authMethodId }),
+                body: data as never,
+            }),
+        )
+    }
+}
diff --git a/src/core/resources/users/devices.ts b/src/core/resources/users/devices.ts
new file mode 100644
index 0000000..92ebac0
--- /dev/null
+++ b/src/core/resources/users/devices.ts
@@ -0,0 +1,20 @@
+import { BaseResource } from '../base'
+import { DeviceRegistration } from '../../../types'
+
+/**
+ * Resource for registering a user's push-capable devices.
+ */
+export class UserDevicesResource extends BaseResource {
+    /**
+     * Registers or updates a device's push subscription for a user.
+     * @param data - Device registration including identifier, deviceId and config
+     */
+    async register(data: DeviceRegistration): Promise<void> {
+        await this.call<void>(() =>
+            this.client.POST('/api/client/projects/{projectID}/users/devices', {
+                params: this.withProject(),
+                body: data as never,
+            }),
+        )
+    }
+}
diff --git a/src/core/resources/users/inbox.ts b/src/core/resources/users/inbox.ts
new file mode 100644
index 0000000..9052da6
--- /dev/null
+++ b/src/core/resources/users/inbox.ts
@@ -0,0 +1,80 @@
+import { BaseResource } from '../base'
+import {
+    InboxMessageCreate,
+    InboxMessageList,
+    InboxCount,
+    InboxQuery,
+    InboxCountQuery,
+    UserInboxMessageRef,
+} from '../../../types'
+import { toInboxQuery, toInboxCountQuery } from '../inbox-query'
+
+/**
+ * Resource for managing a user's inbox messages.
+ */
+export class UserInboxResource extends BaseResource {
+    /**
+     * Creates one or more inbox messages for users. Processed asynchronously.
+     * @param messages - Inbox messages to create (max 100)
+     */
+    async create(messages: InboxMessageCreate[]): Promise<void> {
+        await this.call<void>(() =>
+            this.client.POST('/api/client/projects/{projectID}/users/inbox', {
+                params: this.withProject(),
+                body: messages as never,
+            }),
+        )
+    }
+
+    /**
+     * Returns visible, non-expired inbox messages for a user.
+     * @param query - Filter including source, externalId and channel
+     * @returns Promise resolving to a paginated list of inbox messages
+     */
+    async query(query: InboxQuery): Promise<InboxMessageList> {
+        return this.call<InboxMessageList>(() =>
+            this.client.GET('/api/client/projects/{projectID}/users/inbox', {
+                params: { path: { projectID: this.transport.projectId }, query: toInboxQuery(query) },
+            }),
+        )
+    }
+
+    /**
+     * Returns unread and total visible inbox message counts for a user.
+     * @param query - Filter including source, externalId and channel
+     * @returns Promise resolving to the inbox counts
+     */
+    async count(query: InboxCountQuery): Promise<InboxCount> {
+        return this.call<InboxCount>(() =>
+            this.client.GET('/api/client/projects/{projectID}/users/inbox/count', {
+                params: { path: { projectID: this.transport.projectId }, query: toInboxCountQuery(query) },
+            }),
+        )
+    }
+
+    /**
+     * Marks one or more user inbox messages as read. Processed asynchronously.
+     * @param messages - References to the messages to mark read (max 100)
+     */
+    async markRead(messages: UserInboxMessageRef[]): Promise<void> {
+        await this.call<void>(() =>
+            this.client.POST('/api/client/projects/{projectID}/users/inbox/read', {
+                params: this.withProject(),
+                body: messages as never,
+            }),
+        )
+    }
+
+    /**
+     * Marks one or more user inbox messages as archived. Processed asynchronously.
+     * @param messages - References to the messages to mark archived (max 100)
+     */
+    async markArchived(messages: UserInboxMessageRef[]): Promise<void> {
+        await this.call<void>(() =>
+            this.client.POST('/api/client/projects/{projectID}/users/inbox/archived', {
+                params: this.withProject(),
+                body: messages as never,
+            }),
+        )
+    }
+}
diff --git a/src/core/resources/users/index.ts b/src/core/resources/users/index.ts
index aea3ac6..6d72219 100644
--- a/src/core/resources/users/index.ts
+++ b/src/core/resources/users/index.ts
@@ -1,3 +1,5 @@
 export { UserResource } from './user'
 export { UserScheduledResource } from './scheduled'
-export { UserEventsResource } from './events'
\ No newline at end of file
+export { UserEventsResource } from './events'
+export { UserInboxResource } from './inbox'
+export { UserDevicesResource } from './devices'
\ No newline at end of file
diff --git a/src/core/resources/users/user.ts b/src/core/resources/users/user.ts
index c923259..b1be057 100644
--- a/src/core/resources/users/user.ts
+++ b/src/core/resources/users/user.ts
@@ -7,15 +7,21 @@ import {
 } from '../../../types'
 import { UserScheduledResource } from './scheduled'
 import { UserEventsResource } from './events'
+import { UserInboxResource } from './inbox'
+import { UserDevicesResource } from './devices'
 
 export class UserResource extends BaseResource {
     readonly schedule: UserScheduledResource
     readonly events: UserEventsResource
+    readonly inbox: UserInboxResource
+    readonly devices: UserDevicesResource
 
     constructor(transport: Transport) {
         super(transport)
         this.schedule = new UserScheduledResource(transport)
         this.events = new UserEventsResource(transport)
+        this.inbox = new UserInboxResource(transport)
+        this.devices = new UserDevicesResource(transport)
     }
 
     /**
diff --git a/src/index.ts b/src/index.ts
index 7cdd671..0712827 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -38,6 +38,20 @@ export class Lunogram {
     get organization(): ClientNamespace['organization'] {
         return this.client.organization
     }
+
+    /**
+     * Access push notification configuration (e.g. the VAPID public key).
+     */
+    get push(): ClientNamespace['push'] {
+        return this.client.push
+    }
+
+    /**
+     * Access session token minting for end users.
+     */
+    get sessions(): ClientNamespace['sessions'] {
+        return this.client.sessions
+    }
 }
 
 declare global {
diff --git a/src/platform/browser.ts b/src/platform/browser.ts
index 8a89ffb..db0cae5 100644
--- a/src/platform/browser.ts
+++ b/src/platform/browser.ts
@@ -12,9 +12,11 @@ import {
     UpsertUserScheduledRequest,
     DeleteUserScheduledRequest,
     ScheduledAcceptedResponse,
+    DeviceRegistration,
 } from '../types'
 import { UserEventsResource } from '../core/resources/users/events'
 import { UserScheduledResource } from '../core/resources/users/scheduled'
+import { UserDevicesResource } from '../core/resources/users/devices'
 
 class BrowserUserEventsResource extends UserEventsResource {
     readonly #getIdentifier: () => UserIdentifier
@@ -58,6 +60,22 @@ class BrowserUserScheduledResource extends UserScheduledResource {
     }
 }
 
+class BrowserUserDevicesResource extends UserDevicesResource {
+    readonly #getIdentifier: () => UserIdentifier
+
+    constructor(transport: Transport, getIdentifier: () => UserIdentifier) {
+        super(transport)
+        this.#getIdentifier = getIdentifier
+    }
+
+    async register(data: DeviceRegistration): Promise<void> {
+        return super.register({
+            ...data,
+            identifier: data.identifier ?? this.#getIdentifier(),
+        })
+    }
+}
+
 class BrowserUserResource extends UserResource {
     readonly #anonymousId: string
     /**
@@ -69,12 +87,14 @@ class BrowserUserResource extends UserResource {
     #externalId?: string
     override readonly events: BrowserUserEventsResource
     override readonly schedule: BrowserUserScheduledResource
+    override readonly devices: BrowserUserDevicesResource
 
     constructor(transport: Transport) {
         super(transport)
         this.#anonymousId = generateUuid()
         this.events = new BrowserUserEventsResource(transport, () => this.#buildIdentifier())
         this.schedule = new BrowserUserScheduledResource(transport, () => this.#buildIdentifier())
+        this.devices = new BrowserUserDevicesResource(transport, () => this.#buildIdentifier())
     }
 
     #buildIdentifier(extraIdentifiers?: UserIdentifier): UserIdentifier {
diff --git a/src/types/device.ts b/src/types/device.ts
new file mode 100644
index 0000000..0608f75
--- /dev/null
+++ b/src/types/device.ts
@@ -0,0 +1,38 @@
+import { JSONValue } from './common'
+import { UserIdentifier } from './request'
+
+/** Operating system a registered device runs on. */
+export type DeviceOS = 'web' | 'ios' | 'android'
+
+/** Web Push subscription keys. */
+export interface DeviceKeys {
+    p256dh: string
+    auth: string
+}
+
+/** Transport configuration for a device's push subscription. */
+export interface DeviceConfig {
+    /** Device token for FCM or APNs. */
+    token?: string
+    /** Web Push subscription endpoint URL. */
+    endpoint?: string
+    expirationTime?: string | null
+    keys?: DeviceKeys
+}
+
+/** Request to register or update a device's push subscription for a user. */
+export interface DeviceRegistration {
+    identifier: UserIdentifier
+    deviceId: string
+    config: DeviceConfig
+    os?: DeviceOS
+    osVersion?: string
+    model?: string
+    appVersion?: string
+    data?: Record<string, JSONValue> | null
+}
+
+/** The project's VAPID public key for Web Push. */
+export interface VapidPublicKey {
+    publicKey: string
+}
diff --git a/src/types/inbox.ts b/src/types/inbox.ts
new file mode 100644
index 0000000..e054a0d
--- /dev/null
+++ b/src/types/inbox.ts
@@ -0,0 +1,111 @@
+import { JSONValue } from './common'
+import { ExternalID, UserIdentifier, OrganizationIdentifier } from './request'
+
+/** Delivery channel for an inbox message. */
+export type Channel = 'email' | 'sms' | 'push' | 'inbox'
+
+/** Visibility status used to filter inbox queries. */
+export type InboxStatus = 'unread' | 'read' | 'archived'
+
+/** Fields shared by user and organization inbox message creation. */
+interface InboxMessageCreateBase {
+    /** External identifier for the message. Required for idempotency and traceability back to the origin source. */
+    identifier: ExternalID
+    channel: Channel
+    /** Required for email and sms messages. Push uses project push provider settings. */
+    senderIdentityId?: string | null
+    campaignId?: string | null
+    broadcastId?: string | null
+    /** Channel-specific payload content. */
+    content?: Record<string, JSONValue> | null
+    data?: Record<string, JSONValue> | null
+    tags?: string[]
+    /** Message priority from 1 (highest) to 5 (lowest). Defaults to 3. */
+    priority?: number
+    source?: string | null
+    scheduledAt?: string | null
+    expiresAt?: string | null
+}
+
+/** Request to create an inbox message for a user. */
+export interface InboxMessageCreate extends InboxMessageCreateBase {
+    target: UserIdentifier
+}
+
+/** Request to create an inbox message for an organization. */
+export interface OrganizationInboxMessageCreate extends InboxMessageCreateBase {
+    target: OrganizationIdentifier
+}
+
+/** An inbox message as returned by the API. */
+export interface InboxMessage {
+    id: string
+    projectId: string
+    userId?: string
+    organizationId?: string
+    /** External identifier for the message, if one was provided at creation time. */
+    externalId?: string | null
+    channel: Channel
+    senderIdentityId?: string | null
+    campaignId?: string | null
+    broadcastId?: string | null
+    content: Record<string, JSONValue>
+    data: Record<string, JSONValue>
+    tags: string[]
+    priority: number
+    source?: string | null
+    scheduledAt: string
+    expiresAt?: string | null
+    readAt?: string | null
+    archivedAt?: string | null
+    sentAt?: string | null
+    createdAt: string
+    updatedAt: string
+}
+
+/** A paginated list of inbox messages. */
+export interface InboxMessageList {
+    results: InboxMessage[]
+    total: number
+    limit: number
+    offset: number
+}
+
+/** Unread and total visible message counts for an inbox. */
+export interface InboxCount {
+    unread: number
+    total: number
+}
+
+/** Reference to a single user inbox message, used by read/archive operations. */
+export interface UserInboxMessageRef {
+    target: UserIdentifier
+    messageId: string
+}
+
+/** Reference to a single organization inbox message, used by read/archive operations. */
+export interface OrganizationInboxMessageRef {
+    target: OrganizationIdentifier
+    messageId: string
+}
+
+/** Filter for querying an inbox. `source`, `externalId` and `channel` are required. */
+export interface InboxQuery {
+    source: string
+    externalId: string
+    channel: Channel
+    status?: InboxStatus
+    /** Comma-separated tag filter. All listed tags must be present. */
+    tags?: string
+    messageSource?: string
+    priority?: number
+    limit?: number
+    offset?: number
+}
+
+/** Filter for counting inbox messages. All fields are required. */
+export interface InboxCountQuery {
+    source: string
+    externalId: string
+    channel: Channel
+}
diff --git a/src/types/index.ts b/src/types/index.ts
index a2bb2c8..baf9db1 100644
--- a/src/types/index.ts
+++ b/src/types/index.ts
@@ -1,3 +1,6 @@
 export * from './common'
 export * from './request'
 export * from './scheduled'
+export * from './inbox'
+export * from './device'
+export * from './session'
diff --git a/src/types/session.ts b/src/types/session.ts
new file mode 100644
index 0000000..4ecd1f0
--- /dev/null
+++ b/src/types/session.ts
@@ -0,0 +1,11 @@
+/** Request to mint a session token for an end user. */
+export interface CreateSessionRequest {
+    /** The end user's external identifier (the session subject). */
+    userId: string
+}
+
+/** A minted session token (a bearer token for the Client API). */
+export interface SessionToken {
+    token: string
+    expiresAt: string
+}
diff --git a/test/url.test.ts b/test/url.test.ts
index 52abf8c..3b5be5e 100644
--- a/test/url.test.ts
+++ b/test/url.test.ts
@@ -133,6 +133,110 @@ describe('request encoding', () => {
     })
 })
 
+describe('extended Client API endpoints', () => {
+    let fetchMock: ReturnType<typeof mockFetch>
+
+    beforeEach(() => {
+        fetchMock = mockFetch()
+        vi.stubGlobal('fetch', fetchMock)
+    })
+
+    afterEach(() => {
+        vi.unstubAllGlobals()
+        vi.restoreAllMocks()
+    })
+
+    function lastUrl(): string {
+        const call = fetchMock.mock.calls.at(-1)
+        const input = call?.[0]
+        return input instanceof Request ? input.url : String(input)
+    }
+
+    function lastPath(): string {
+        return new URL(lastUrl()).pathname
+    }
+
+    const base = `/api/client/projects/${projectId}`
+
+    it('prefixes user inbox create/query/count/read/archived', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+
+        await client.user.inbox.create([
+            { target: [{ externalId: 'u' }], identifier: { externalId: 'm1' }, channel: 'inbox' },
+        ])
+        expect(lastPath()).toBe(`${base}/users/inbox`)
+
+        await client.user.inbox.query({ source: 'default', externalId: 'u', channel: 'inbox' })
+        expect(lastPath()).toBe(`${base}/users/inbox`)
+
+        await client.user.inbox.count({ source: 'default', externalId: 'u', channel: 'inbox' })
+        expect(lastPath()).toBe(`${base}/users/inbox/count`)
+
+        await client.user.inbox.markRead([{ target: [{ externalId: 'u' }], messageId: 'm1' }])
+        expect(lastPath()).toBe(`${base}/users/inbox/read`)
+
+        await client.user.inbox.markArchived([{ target: [{ externalId: 'u' }], messageId: 'm1' }])
+        expect(lastPath()).toBe(`${base}/users/inbox/archived`)
+    })
+
+    it('maps inbox query params to snake_case on the wire', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+        await client.user.inbox.query({
+            source: 'default',
+            externalId: 'u',
+            channel: 'inbox',
+            messageSource: 'campaign',
+        })
+        const query = new URL(lastUrl()).searchParams
+        expect(query.get('external_id')).toBe('u')
+        expect(query.get('message_source')).toBe('campaign')
+        expect(query.get('channel')).toBe('inbox')
+    })
+
+    it('prefixes user device registration', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+        await client.user.devices.register({
+            identifier: [{ externalId: 'u' }],
+            deviceId: 'device-1',
+            config: { token: 'tok' },
+        })
+        expect(lastPath()).toBe(`${base}/users/devices`)
+    })
+
+    it('prefixes organization inbox operations', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+
+        await client.organization.inbox.create([
+            { target: [{ externalId: 'o' }], identifier: { externalId: 'm1' }, channel: 'inbox' },
+        ])
+        expect(lastPath()).toBe(`${base}/organizations/inbox`)
+
+        await client.organization.inbox.query({ source: 'default', externalId: 'o', channel: 'inbox' })
+        expect(lastPath()).toBe(`${base}/organizations/inbox`)
+    })
+
+    it('prefixes the VAPID public key endpoint', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+        await client.push.getVapidPublicKey()
+        expect(lastPath()).toBe(`${base}/push/vapid`)
+    })
+
+    it('prefixes session minting with the auth method in the path', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+        const authMethodId = '22222222-2222-4222-8222-222222222222'
+        await client.sessions.create(authMethodId, { userId: 'user-1' })
+        expect(lastPath()).toBe(`${base}/auth-methods/${authMethodId}/sessions`)
+    })
+
+    it('maps a session request body to snake_case on the wire', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+        await client.sessions.create('22222222-2222-4222-8222-222222222222', { userId: 'user-1' })
+        const call = fetchMock.mock.calls.at(-1)
+        const body = await (call?.[0] as Request).clone().json()
+        expect(body).toEqual({ user_id: 'user-1' })
+    })
+})
+
 describe('projectId validation', () => {
     it('throws when projectId is missing', () => {
         // @ts-expect-error projectId is required

From 76164212c527449d6ec1ab0bc5c02359dcf536b9 Mon Sep 17 00:00:00 2001
From: Jeroen Rinzema <jeroen@rinzema.dev>
Date: Thu, 25 Jun 2026 12:17:57 +0200
Subject: [PATCH 4/5] ci: pass LUNOGRAM_PROJECT_ID secret to the E2E job

The e2e suite requires a project ID now that the Client API is scoped
under /projects/{projectId}, but the workflow never passed one. Wire the
secret through so the suite can run once LUNOGRAM_PROJECT_ID is set in
repository secrets.
---
 .github/workflows/e2e.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index e05b6e8..b27e305 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -25,3 +25,4 @@ jobs:
         env:
           LUNOGRAM_API_KEY: ${{ secrets.LUNOGRAM_API_KEY }}
           LUNOGRAM_API_URL: ${{ secrets.LUNOGRAM_API_URL }}
+          LUNOGRAM_PROJECT_ID: ${{ secrets.LUNOGRAM_PROJECT_ID }}

From 626f3666972fb859ad591d9877a36df37441a628 Mon Sep 17 00:00:00 2001
From: Jeroen Rinzema <jeroen@rinzema.dev>
Date: Thu, 25 Jun 2026 17:38:55 +0200
Subject: [PATCH 5/5] test: cover the remaining endpoints and browser
 identifier injection
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- url.test.ts: assert routing/method for the previously untested facade
  methods (user/org delete, schedule delete, org scheduled, removeUser,
  org inbox count/read/archived).
- browser.test.ts (new): cover the browser SDK's signature feature — the
  auto anonymous id, sticky external id, identifier injection into events/
  scheduled/devices, the match-event exemption, and identifier merging.
- Run browser.test.ts in the `test` script alongside url.test.ts.
- Let the browser devices.register omit the identifier (so injection is
  usable, matching events/scheduled).
---
 package.json            |   2 +-
 src/platform/browser.ts |   4 +-
 test/browser.test.ts    | 123 ++++++++++++++++++++++++++++++++++++++++
 test/url.test.ts        |  52 +++++++++++++++++
 4 files changed, 179 insertions(+), 2 deletions(-)
 create mode 100644 test/browser.test.ts

diff --git a/package.json b/package.json
index 2ae9b63..4b0e8b9 100644
--- a/package.json
+++ b/package.json
@@ -12,7 +12,7 @@
     "build:esm": "tsc --project ./tsconfig.module.json",
     "build:cjs": "tsc --project ./tsconfig.json",
     "lint": "eslint . --ext .ts",
-    "test": "vitest run test/url.test.ts",
+    "test": "vitest run test/url.test.ts test/browser.test.ts",
     "test:e2e": "vitest run test/e2e.test.ts",
     "release:github": "pnpm publish --no-git-checks --registry=https://npm.pkg.github.com",
     "release:npm": "npm publish --access public --registry=https://registry.npmjs.org"
diff --git a/src/platform/browser.ts b/src/platform/browser.ts
index db0cae5..7e952eb 100644
--- a/src/platform/browser.ts
+++ b/src/platform/browser.ts
@@ -68,7 +68,9 @@ class BrowserUserDevicesResource extends UserDevicesResource {
         this.#getIdentifier = getIdentifier
     }
 
-    async register(data: DeviceRegistration): Promise<void> {
+    async register(
+        data: Omit<DeviceRegistration, 'identifier'> & { identifier?: UserIdentifier },
+    ): Promise<void> {
         return super.register({
             ...data,
             identifier: data.identifier ?? this.#getIdentifier(),
diff --git a/test/browser.test.ts b/test/browser.test.ts
new file mode 100644
index 0000000..b54628e
--- /dev/null
+++ b/test/browser.test.ts
@@ -0,0 +1,123 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { Lunogram } from '../src'
+
+const apiKey = 'test-api-key'
+const projectId = '11111111-1111-4111-8111-111111111111'
+const urlEndpoint = 'https://api.example.com/api'
+
+function mockFetch() {
+    return vi.fn(async () =>
+        new Response(JSON.stringify({}), {
+            status: 200,
+            headers: { 'Content-Type': 'application/json' },
+        }),
+    )
+}
+
+describe('Browser identifier injection', () => {
+    let fetchMock: ReturnType<typeof mockFetch>
+
+    beforeEach(() => {
+        fetchMock = mockFetch()
+        vi.stubGlobal('fetch', fetchMock)
+    })
+
+    afterEach(() => {
+        vi.unstubAllGlobals()
+        vi.restoreAllMocks()
+    })
+
+    async function lastBody() {
+        const call = fetchMock.mock.calls.at(-1)
+        return (call?.[0] as Request).clone().json()
+    }
+
+    const isAnon = (i: { source: string }) => i.source === 'anonymous'
+
+    it('injects an auto-generated anonymous identifier on upsert', async () => {
+        const lunogram = new Lunogram(apiKey, projectId, urlEndpoint)
+        await lunogram.user.upsert({ identifier: [{ externalId: 'user-1' }], email: 'a@b.com' })
+
+        const body = await lastBody()
+        expect(body.identifier).toEqual(
+            expect.arrayContaining([
+                expect.objectContaining({ source: 'anonymous' }),
+                expect.objectContaining({ source: 'default', external_id: 'user-1' }),
+            ]),
+        )
+        // the anonymous identifier value is a stable, non-empty session id
+        const anon = body.identifier.find(isAnon)
+        expect(typeof anon.external_id).toBe('string')
+        expect(anon.external_id.length).toBeGreaterThan(0)
+    })
+
+    it('makes the default external id sticky across subsequent calls', async () => {
+        const lunogram = new Lunogram(apiKey, projectId, urlEndpoint)
+        // identify once
+        await lunogram.user.upsert({ identifier: [{ externalId: 'user-1' }] })
+        // a later event carries no identifier — the SDK injects anonymous + sticky default
+        await lunogram.user.events.post([{ name: 'page_viewed', data: {} }])
+
+        const body = await lastBody()
+        expect(body[0].identifier).toEqual(
+            expect.arrayContaining([
+                expect.objectContaining({ source: 'anonymous' }),
+                expect.objectContaining({ source: 'default', external_id: 'user-1' }),
+            ]),
+        )
+    })
+
+    it('keeps the same anonymous id stable between calls', async () => {
+        const lunogram = new Lunogram(apiKey, projectId, urlEndpoint)
+        await lunogram.user.upsert({ identifier: [{ externalId: 'a' }] })
+        const first = (await lastBody()).identifier.find(isAnon).external_id
+        await lunogram.user.upsert({ identifier: [{ externalId: 'b' }] })
+        const second = (await lastBody()).identifier.find(isAnon).external_id
+        expect(second).toBe(first)
+    })
+
+    it('does NOT inject an identifier into match-based events', async () => {
+        const lunogram = new Lunogram(apiKey, projectId, urlEndpoint)
+        await lunogram.user.events.post([{ name: 'evt', match: { plan: 'pro' }, data: {} }])
+
+        const body = await lastBody()
+        expect(body[0].identifier).toBeUndefined()
+        expect(body[0].match).toEqual({ plan: 'pro' })
+    })
+
+    it('injects the session identifier into scheduled resources', async () => {
+        const lunogram = new Lunogram(apiKey, projectId, urlEndpoint)
+        await lunogram.user.schedule.upsert({ name: 'trial_end', scheduledAt: '2025-12-25T10:00:00Z' })
+
+        const body = await lastBody()
+        expect(body.identifier).toEqual(
+            expect.arrayContaining([expect.objectContaining({ source: 'anonymous' })]),
+        )
+    })
+
+    it('injects the session identifier into device registration', async () => {
+        const lunogram = new Lunogram(apiKey, projectId, urlEndpoint)
+        await lunogram.user.devices.register({ deviceId: 'device-1', config: { token: 'tok' } })
+
+        const body = await lastBody()
+        expect(body.device_id).toBe('device-1')
+        expect(body.identifier).toEqual(
+            expect.arrayContaining([expect.objectContaining({ source: 'anonymous' })]),
+        )
+    })
+
+    it('merges a caller-supplied identifier with the anonymous one', async () => {
+        const lunogram = new Lunogram(apiKey, projectId, urlEndpoint)
+        await lunogram.user.upsert({
+            identifier: [{ source: 'stripe', externalId: 'cus_123' }],
+        })
+
+        const body = await lastBody()
+        expect(body.identifier).toEqual(
+            expect.arrayContaining([
+                expect.objectContaining({ source: 'anonymous' }),
+                expect.objectContaining({ source: 'stripe', external_id: 'cus_123' }),
+            ]),
+        )
+    })
+})
diff --git a/test/url.test.ts b/test/url.test.ts
index 3b5be5e..726b9ef 100644
--- a/test/url.test.ts
+++ b/test/url.test.ts
@@ -235,6 +235,58 @@ describe('extended Client API endpoints', () => {
         const body = await (call?.[0] as Request).clone().json()
         expect(body).toEqual({ user_id: 'user-1' })
     })
+
+    function lastMethod(): string {
+        return (fetchMock.mock.calls.at(-1)?.[0] as Request).method
+    }
+
+    it('routes the remaining user + organization write endpoints', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+
+        await client.user.delete({ identifier: [{ externalId: 'u' }] })
+        expect(lastPath()).toBe(`${base}/users`)
+        expect(lastMethod()).toBe('DELETE')
+
+        await client.user.schedule.delete({ name: 'r', identifier: [{ externalId: 'u' }] })
+        expect(lastPath()).toBe(`${base}/users/scheduled`)
+        expect(lastMethod()).toBe('DELETE')
+
+        await client.organization.delete({ identifier: [{ externalId: 'o' }] })
+        expect(lastPath()).toBe(`${base}/organizations`)
+        expect(lastMethod()).toBe('DELETE')
+
+        await client.organization.removeUser({
+            organization: { identifier: [{ externalId: 'o' }] },
+            user: { identifier: [{ externalId: 'u' }] },
+        })
+        expect(lastPath()).toBe(`${base}/organizations/users`)
+        expect(lastMethod()).toBe('DELETE')
+
+        await client.organization.schedule.upsert({
+            name: 's',
+            identifier: [{ externalId: 'o' }],
+            scheduledAt: new Date().toISOString(),
+        })
+        expect(lastPath()).toBe(`${base}/organizations/scheduled`)
+        expect(lastMethod()).toBe('POST')
+
+        await client.organization.schedule.delete({ name: 's', identifier: [{ externalId: 'o' }] })
+        expect(lastPath()).toBe(`${base}/organizations/scheduled`)
+        expect(lastMethod()).toBe('DELETE')
+    })
+
+    it('routes the remaining organization inbox endpoints', async () => {
+        const client = new Client({ apiKey, projectId, urlEndpoint })
+
+        await client.organization.inbox.count({ source: 'default', externalId: 'o', channel: 'inbox' })
+        expect(lastPath()).toBe(`${base}/organizations/inbox/count`)
+
+        await client.organization.inbox.markRead([{ target: [{ externalId: 'o' }], messageId: 'm' }])
+        expect(lastPath()).toBe(`${base}/organizations/inbox/read`)
+
+        await client.organization.inbox.markArchived([{ target: [{ externalId: 'o' }], messageId: 'm' }])
+        expect(lastPath()).toBe(`${base}/organizations/inbox/archived`)
+    })
 })
 
 describe('projectId validation', () => {