spiral-sdk 0.1.11

// Generated by tools/service-contracts/rust.py. Do not edit.
#![doc = "Generated reqwest client with typed errors and streaming bodies."]

use async_trait::async_trait;
use futures::{Stream, TryStreamExt, stream};
use reqwest::Url;
use reqwest_middleware::ClientWithMiddleware;
use spiral_contract::auth::AuthHeader;
use spiral_contract::call::{CallError, ServiceFailure};
use spiral_contract::error::ErrorEnvelope;

use crate::api::organization::OrganizationApi;
use crate::api::organization::objects::*;
use crate::http::default_http_client;
/// HTTP client for the organization service.
#[derive(Clone)]
pub struct OrganizationClient {
    http: ClientWithMiddleware,
    base: Url,
}

impl std::fmt::Debug for OrganizationClient {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.debug_struct("OrganizationClient")
            .field("base", &self.base)
            .finish_non_exhaustive()
    }
}

impl OrganizationClient {
    /// Create a redirect-disabled client; base may contain a deployment prefix.
    pub fn new(base: &str) -> Result<Self, CallError<OrganizationError>> {
        let http = default_http_client().map_err(CallError::transport)?;
        Self::from_http(base, http)
    }
    /// Use an existing connection pool with redirects disabled.
    pub fn from_http(
        base: &str,
        http: impl Into<ClientWithMiddleware>,
    ) -> Result<Self, CallError<OrganizationError>> {
        Self::from_transport(base, http.into())
    }
    /// Use a host-owned connection pool and instrumentation. Redirects must be disabled.
    pub fn from_transport(
        base: &str,
        http: ClientWithMiddleware,
    ) -> Result<Self, CallError<OrganizationError>> {
        let base = Url::parse(base)
            .map_err(|_| CallError::<OrganizationError>::protocol("invalid base URL"))?;
        if !matches!(base.scheme(), "http" | "https")
            || base.host_str().is_none()
            || !base.username().is_empty()
            || base.password().is_some()
            || base.query().is_some()
            || base.fragment().is_some()
        {
            return Err(CallError::<OrganizationError>::protocol("invalid base URL"));
        }
        Ok(Self { http, base })
    }
    /// Replace the host-owned connection pool and instrumentation. Redirects must be disabled.
    pub fn with_transport(mut self, http: ClientWithMiddleware) -> Self {
        self.http = http;
        self
    }
    /// Supply transport instrumentation or custom connection policy.
    ///
    /// The caller must disable redirects to protect bearer credentials.
    pub fn with_http(mut self, http: impl Into<ClientWithMiddleware>) -> Self {
        self.http = http.into();
        self
    }
    /// Create an Organization for the authenticated user. Existing Organization membership prevents
    /// creating another.
    pub async fn create_organization_http(
        &self,
        auth_header: AuthHeader,
        request: CreateOrganizationRequest,
    ) -> Result<CreateOrganizationResponse, CallError<OrganizationError>> {
        let mut url = self.base.clone();
        {
            let mut path = url.path_segments_mut().map_err(|_| {
                CallError::<OrganizationError>::protocol("base URL cannot contain path segments")
            })?;
            path.pop_if_empty();
            path.push("api");
            path.push("organizations");
        }
        let builder = self.http.post(url).header("accept", "application/json");
        let builder = builder.header("authorization", auth_header.as_str());
        let builder = builder
            .header("content-type", "application/json")
            .json(&request);
        let response = self.send(builder, "application/json").await?;
        let status = response.status().as_u16();
        let bytes = bounded_body(response, 8 * 1024 * 1024).await?;
        serde_json::from_slice(&bytes)
            .map_err(|_| CallError::protocol_response(status, "invalid JSON response"))
    }
    /// Open an account administration setting with Organization configure permission.
    pub async fn create_portal_link_http(
        &self,
        auth_header: AuthHeader,
        request: PortalLinkRequest,
    ) -> Result<PortalLink, CallError<OrganizationError>> {
        let mut url = self.base.clone();
        {
            let mut path = url.path_segments_mut().map_err(|_| {
                CallError::<OrganizationError>::protocol("base URL cannot contain path segments")
            })?;
            path.pop_if_empty();
            path.push("api");
            path.push("organizations");
            path.push("portal-links");
        }
        let builder = self.http.post(url).header("accept", "application/json");
        let builder = builder.header("authorization", auth_header.as_str());
        let builder = builder
            .header("content-type", "application/json")
            .json(&request);
        let response = self.send(builder, "application/json").await?;
        let status = response.status().as_u16();
        let bytes = bounded_body(response, 8 * 1024 * 1024).await?;
        serde_json::from_slice(&bytes)
            .map_err(|_| CallError::protocol_response(status, "invalid JSON response"))
    }
    /// Deactivate a membership with manage-users permission. The last owner cannot be deactivated.
    pub async fn deactivate_member_http(
        &self,
        auth_header: AuthHeader,
        user_id: String,
    ) -> Result<(), CallError<OrganizationError>> {
        let mut url = self.base.clone();
        {
            let mut path = url.path_segments_mut().map_err(|_| {
                CallError::<OrganizationError>::protocol("base URL cannot contain path segments")
            })?;
            path.pop_if_empty();
            path.push("api");
            path.push("organizations");
            path.push("members");
            let segment = user_id.to_string();
            if matches!(segment.as_str(), "." | "..") {
                return Err(CallError::<OrganizationError>::protocol("dot path segment"));
            }
            path.push(&segment);
            path.push("deactivate");
        }
        let builder = self.http.post(url).header("accept", "application/json");
        let builder = builder.header("authorization", auth_header.as_str());
        let response = self.send(builder, "application/json").await?;
        let status = response.status().as_u16();
        let bytes = bounded_body(response, 8 * 1024 * 1024).await?;
        serde_json::from_slice(&bytes)
            .map_err(|_| CallError::protocol_response(status, "invalid JSON response"))
    }
    /// Deactivate an Organization with platform administer permission.
    pub async fn deactivate_organization_http(
        &self,
        auth_header: AuthHeader,
        organization_id: String,
    ) -> Result<(), CallError<OrganizationError>> {
        let mut url = self.base.clone();
        {
            let mut path = url.path_segments_mut().map_err(|_| {
                CallError::<OrganizationError>::protocol("base URL cannot contain path segments")
            })?;
            path.pop_if_empty();
            path.push("api");
            path.push("organizations");
            path.push("admin");
            let segment = organization_id.to_string();
            if matches!(segment.as_str(), "." | "..") {
                return Err(CallError::<OrganizationError>::protocol("dot path segment"));
            }
            path.push(&segment);
            path.push("deactivate");
        }
        let builder = self.http.post(url).header("accept", "application/json");
        let builder = builder.header("authorization", auth_header.as_str());
        let response = self.send(builder, "application/json").await?;
        let status = response.status().as_u16();
        let bytes = bounded_body(response, 8 * 1024 * 1024).await?;
        serde_json::from_slice(&bytes)
            .map_err(|_| CallError::protocol_response(status, "invalid JSON response"))
    }
    /// Invite a user to the active Organization with invite permission.
    pub async fn invite_member_http(
        &self,
        auth_header: AuthHeader,
        request: InviteMemberRequest,
    ) -> Result<InvitationResponse, CallError<OrganizationError>> {
        let mut url = self.base.clone();
        {
            let mut path = url.path_segments_mut().map_err(|_| {
                CallError::<OrganizationError>::protocol("base URL cannot contain path segments")
            })?;
            path.pop_if_empty();
            path.push("api");
            path.push("organizations");
            path.push("invitations");
        }
        let builder = self.http.post(url).header("accept", "application/json");
        let builder = builder.header("authorization", auth_header.as_str());
        let builder = builder
            .header("content-type", "application/json")
            .json(&request);
        let response = self.send(builder, "application/json").await?;
        let status = response.status().as_u16();
        let bytes = bounded_body(response, 8 * 1024 * 1024).await?;
        serde_json::from_slice(&bytes)
            .map_err(|_| CallError::protocol_response(status, "invalid JSON response"))
    }
    /// List the active Organization invitations with invite permission. Page size defaults to 10
    /// and must be 1..=100.
    pub async fn list_invitations_http(
        &self,
        auth_header: AuthHeader,
        request: ListMembersRequest,
    ) -> Result<InvitationPage, CallError<OrganizationError>> {
        let mut url = self.base.clone();
        {
            let mut path = url.path_segments_mut().map_err(|_| {
                CallError::<OrganizationError>::protocol("base URL cannot contain path segments")
            })?;
            path.pop_if_empty();
            path.push("api");
            path.push("organizations");
            path.push("invitations");
        }
        let builder = self.http.get(url).header("accept", "application/json");
        let builder = builder.header("authorization", auth_header.as_str());
        let builder = builder.query(&request);
        let response = self.send(builder, "application/json").await?;
        let status = response.status().as_u16();
        let bytes = bounded_body(response, 8 * 1024 * 1024).await?;
        serde_json::from_slice(&bytes)
            .map_err(|_| CallError::protocol_response(status, "invalid JSON response"))
    }
    /// Fetch pages lazily, retaining the request filters and stopping when the token is absent.
    /// Dropping the stream cancels an active request; no later page is prefetched.
    pub fn list_invitations_pages<'a>(
        &'a self,
        auth_header: &'a AuthHeader,
        request: ListMembersRequest,
    ) -> impl Stream<Item = Result<InvitationPage, CallError<OrganizationError>>> + 'a {
        stream::try_unfold(Some(request), move |request| async move {
            let Some(mut request) = request else {
                return Ok(None);
            };
            let page = self
                .list_invitations_http(auth_header.clone(), request.clone())
                .await?;
            let next = page.next_page_token.clone();
            if next
                .as_ref()
                .is_some_and(|token| token.is_empty() || Some(token) == request.page_token.as_ref())
            {
                return Err(CallError::<OrganizationError>::protocol(
                    "invalid pagination token",
                ));
            }
            request.page_token = next;
            let next_request = request.page_token.is_some().then_some(request);
            Ok(Some((page, next_request)))
        })
    }
    /// Yield items lazily, continuing across empty pages that have a continuation token.
    pub fn list_invitations_items<'a>(
        &'a self,
        auth_header: &'a AuthHeader,
        request: ListMembersRequest,
    ) -> impl Stream<Item = Result<Invitation, CallError<OrganizationError>>> + 'a {
        self.list_invitations_pages(auth_header, request)
            .map_ok(|page| {
                stream::iter(
                    page.items
                        .into_iter()
                        .map(Ok::<_, CallError<OrganizationError>>),
                )
            })
            .try_flatten()
    }
    /// List the active Organization members with list-users permission. Each page reauthorizes the
    /// caller.
    pub async fn list_members_http(
        &self,
        auth_header: AuthHeader,
        request: ListMembersRequest,
    ) -> Result<MemberPage, CallError<OrganizationError>> {
        let mut url = self.base.clone();
        {
            let mut path = url.path_segments_mut().map_err(|_| {
                CallError::<OrganizationError>::protocol("base URL cannot contain path segments")
            })?;
            path.pop_if_empty();
            path.push("api");
            path.push("organizations");
            path.push("members");
        }
        let builder = self.http.get(url).header("accept", "application/json");
        let builder = builder.header("authorization", auth_header.as_str());
        let builder = builder.query(&request);
        let response = self.send(builder, "application/json").await?;
        let status = response.status().as_u16();
        let bytes = bounded_body(response, 8 * 1024 * 1024).await?;
        serde_json::from_slice(&bytes)
            .map_err(|_| CallError::protocol_response(status, "invalid JSON response"))
    }
    /// Fetch pages lazily, retaining the request filters and stopping when the token is absent.
    /// Dropping the stream cancels an active request; no later page is prefetched.
    pub fn list_members_pages<'a>(
        &'a self,
        auth_header: &'a AuthHeader,
        request: ListMembersRequest,
    ) -> impl Stream<Item = Result<MemberPage, CallError<OrganizationError>>> + 'a {
        stream::try_unfold(Some(request), move |request| async move {
            let Some(mut request) = request else {
                return Ok(None);
            };
            let page = self
                .list_members_http(auth_header.clone(), request.clone())
                .await?;
            let next = page.next_page_token.clone();
            if next
                .as_ref()
                .is_some_and(|token| token.is_empty() || Some(token) == request.page_token.as_ref())
            {
                return Err(CallError::<OrganizationError>::protocol(
                    "invalid pagination token",
                ));
            }
            request.page_token = next;
            let next_request = request.page_token.is_some().then_some(request);
            Ok(Some((page, next_request)))
        })
    }
    /// Yield items lazily, continuing across empty pages that have a continuation token.
    pub fn list_members_items<'a>(
        &'a self,
        auth_header: &'a AuthHeader,
        request: ListMembersRequest,
    ) -> impl Stream<Item = Result<Member, CallError<OrganizationError>>> + 'a {
        self.list_members_pages(auth_header, request)
            .map_ok(|page| {
                stream::iter(
                    page.items
                        .into_iter()
                        .map(Ok::<_, CallError<OrganizationError>>),
                )
            })
            .try_flatten()
    }
    /// List the authenticated user memberships in ascending Organization ID order. Requires a
    /// first-party user credential.
    pub async fn list_memberships_http(
        &self,
        auth_header: AuthHeader,
        request: ListMembershipsRequest,
    ) -> Result<MembershipPage, CallError<OrganizationError>> {
        let mut url = self.base.clone();
        {
            let mut path = url.path_segments_mut().map_err(|_| {
                CallError::<OrganizationError>::protocol("base URL cannot contain path segments")
            })?;
            path.pop_if_empty();
            path.push("api");
            path.push("organizations");
        }
        let builder = self.http.get(url).header("accept", "application/json");
        let builder = builder.header("authorization", auth_header.as_str());
        let builder = builder.query(&request);
        let response = self.send(builder, "application/json").await?;
        let status = response.status().as_u16();
        let bytes = bounded_body(response, 8 * 1024 * 1024).await?;
        serde_json::from_slice(&bytes)
            .map_err(|_| CallError::protocol_response(status, "invalid JSON response"))
    }
    /// Fetch pages lazily, retaining the request filters and stopping when the token is absent.
    /// Dropping the stream cancels an active request; no later page is prefetched.
    pub fn list_memberships_pages<'a>(
        &'a self,
        auth_header: &'a AuthHeader,
        request: ListMembershipsRequest,
    ) -> impl Stream<Item = Result<MembershipPage, CallError<OrganizationError>>> + 'a {
        stream::try_unfold(Some(request), move |request| async move {
            let Some(mut request) = request else {
                return Ok(None);
            };
            let page = self
                .list_memberships_http(auth_header.clone(), request.clone())
                .await?;
            let next = page.next_page_token.clone();
            if next
                .as_ref()
                .is_some_and(|token| token.is_empty() || Some(token) == request.page_token.as_ref())
            {
                return Err(CallError::<OrganizationError>::protocol(
                    "invalid pagination token",
                ));
            }
            request.page_token = next;
            let next_request = request.page_token.is_some().then_some(request);
            Ok(Some((page, next_request)))
        })
    }
    /// Yield items lazily, continuing across empty pages that have a continuation token.
    pub fn list_memberships_items<'a>(
        &'a self,
        auth_header: &'a AuthHeader,
        request: ListMembershipsRequest,
    ) -> impl Stream<Item = Result<Membership, CallError<OrganizationError>>> + 'a {
        self.list_memberships_pages(auth_header, request)
            .map_ok(|page| {
                stream::iter(
                    page.items
                        .into_iter()
                        .map(Ok::<_, CallError<OrganizationError>>),
                )
            })
            .try_flatten()
    }
    /// List Organization records in ascending ID order with platform administer permission.
    pub async fn list_organizations_http(
        &self,
        auth_header: AuthHeader,
        request: ListOrganizationsRequest,
    ) -> Result<OrganizationPage, CallError<OrganizationError>> {
        let mut url = self.base.clone();
        {
            let mut path = url.path_segments_mut().map_err(|_| {
                CallError::<OrganizationError>::protocol("base URL cannot contain path segments")
            })?;
            path.pop_if_empty();
            path.push("api");
            path.push("organizations");
            path.push("admin");
        }
        let builder = self.http.get(url).header("accept", "application/json");
        let builder = builder.header("authorization", auth_header.as_str());
        let builder = builder.query(&request);
        let response = self.send(builder, "application/json").await?;
        let status = response.status().as_u16();
        let bytes = bounded_body(response, 8 * 1024 * 1024).await?;
        serde_json::from_slice(&bytes)
            .map_err(|_| CallError::protocol_response(status, "invalid JSON response"))
    }
    /// Fetch pages lazily, retaining the request filters and stopping when the token is absent.
    /// Dropping the stream cancels an active request; no later page is prefetched.
    pub fn list_organizations_pages<'a>(
        &'a self,
        auth_header: &'a AuthHeader,
        request: ListOrganizationsRequest,
    ) -> impl Stream<Item = Result<OrganizationPage, CallError<OrganizationError>>> + 'a {
        stream::try_unfold(Some(request), move |request| async move {
            let Some(mut request) = request else {
                return Ok(None);
            };
            let page = self
                .list_organizations_http(auth_header.clone(), request.clone())
                .await?;
            let next = page.next_page_token.clone();
            if next
                .as_ref()
                .is_some_and(|token| token.is_empty() || Some(token) == request.page_token.as_ref())
            {
                return Err(CallError::<OrganizationError>::protocol(
                    "invalid pagination token",
                ));
            }
            request.page_token = next;
            let next_request = request.page_token.is_some().then_some(request);
            Ok(Some((page, next_request)))
        })
    }
    /// Yield items lazily, continuing across empty pages that have a continuation token.
    pub fn list_organizations_items<'a>(
        &'a self,
        auth_header: &'a AuthHeader,
        request: ListOrganizationsRequest,
    ) -> impl Stream<Item = Result<OrganizationDetails, CallError<OrganizationError>>> + 'a {
        self.list_organizations_pages(auth_header, request)
            .map_ok(|page| {
                stream::iter(
                    page.items
                        .into_iter()
                        .map(Ok::<_, CallError<OrganizationError>>),
                )
            })
            .try_flatten()
    }
    /// Reactivate an Organization with platform administer permission.
    pub async fn reactivate_organization_http(
        &self,
        auth_header: AuthHeader,
        organization_id: String,
    ) -> Result<(), CallError<OrganizationError>> {
        let mut url = self.base.clone();
        {
            let mut path = url.path_segments_mut().map_err(|_| {
                CallError::<OrganizationError>::protocol("base URL cannot contain path segments")
            })?;
            path.pop_if_empty();
            path.push("api");
            path.push("organizations");
            path.push("admin");
            let segment = organization_id.to_string();
            if matches!(segment.as_str(), "." | "..") {
                return Err(CallError::<OrganizationError>::protocol("dot path segment"));
            }
            path.push(&segment);
            path.push("reactivate");
        }
        let builder = self.http.post(url).header("accept", "application/json");
        let builder = builder.header("authorization", auth_header.as_str());
        let response = self.send(builder, "application/json").await?;
        let status = response.status().as_u16();
        let bytes = bounded_body(response, 8 * 1024 * 1024).await?;
        serde_json::from_slice(&bytes)
            .map_err(|_| CallError::protocol_response(status, "invalid JSON response"))
    }
    /// Read the active Organization storage default with Organization configure permission.
    pub async fn read_config_http(
        &self,
        auth_header: AuthHeader,
    ) -> Result<OrganizationConfig, CallError<OrganizationError>> {
        let mut url = self.base.clone();
        {
            let mut path = url.path_segments_mut().map_err(|_| {
                CallError::<OrganizationError>::protocol("base URL cannot contain path segments")
            })?;
            path.pop_if_empty();
            path.push("api");
            path.push("organizations");
            path.push("config");
        }
        let builder = self.http.get(url).header("accept", "application/json");
        let builder = builder.header("authorization", auth_header.as_str());
        let response = self.send(builder, "application/json").await?;
        let status = response.status().as_u16();
        let bytes = bounded_body(response, 8 * 1024 * 1024).await?;
        serde_json::from_slice(&bytes)
            .map_err(|_| CallError::protocol_response(status, "invalid JSON response"))
    }
    /// Read the authenticated user identity and active Organization. Workload, service and
    /// delegated credentials are refused.
    pub async fn read_identity_http(
        &self,
        auth_header: AuthHeader,
    ) -> Result<Identity, CallError<OrganizationError>> {
        let mut url = self.base.clone();
        {
            let mut path = url.path_segments_mut().map_err(|_| {
                CallError::<OrganizationError>::protocol("base URL cannot contain path segments")
            })?;
            path.pop_if_empty();
            path.push("api");
            path.push("organizations");
            path.push("me");
        }
        let builder = self.http.get(url).header("accept", "application/json");
        let builder = builder.header("authorization", auth_header.as_str());
        let response = self.send(builder, "application/json").await?;
        let status = response.status().as_u16();
        let bytes = bounded_body(response, 8 * 1024 * 1024).await?;
        serde_json::from_slice(&bytes)
            .map_err(|_| CallError::protocol_response(status, "invalid JSON response"))
    }
    /// Resend an invitation owned by the active Organization with invite permission.
    pub async fn resend_invitation_http(
        &self,
        auth_header: AuthHeader,
        invitation_id: String,
    ) -> Result<InvitationResponse, CallError<OrganizationError>> {
        let mut url = self.base.clone();
        {
            let mut path = url.path_segments_mut().map_err(|_| {
                CallError::<OrganizationError>::protocol("base URL cannot contain path segments")
            })?;
            path.pop_if_empty();
            path.push("api");
            path.push("organizations");
            path.push("invitations");
            let segment = invitation_id.to_string();
            if matches!(segment.as_str(), "." | "..") {
                return Err(CallError::<OrganizationError>::protocol("dot path segment"));
            }
            path.push(&segment);
            path.push("resend");
        }
        let builder = self.http.post(url).header("accept", "application/json");
        let builder = builder.header("authorization", auth_header.as_str());
        let response = self.send(builder, "application/json").await?;
        let status = response.status().as_u16();
        let bytes = bounded_body(response, 8 * 1024 * 1024).await?;
        serde_json::from_slice(&bytes)
            .map_err(|_| CallError::protocol_response(status, "invalid JSON response"))
    }
    /// Revoke an invitation owned by the active Organization with invite permission.
    pub async fn revoke_invitation_http(
        &self,
        auth_header: AuthHeader,
        invitation_id: String,
    ) -> Result<(), CallError<OrganizationError>> {
        let mut url = self.base.clone();
        {
            let mut path = url.path_segments_mut().map_err(|_| {
                CallError::<OrganizationError>::protocol("base URL cannot contain path segments")
            })?;
            path.pop_if_empty();
            path.push("api");
            path.push("organizations");
            path.push("invitations");
            let segment = invitation_id.to_string();
            if matches!(segment.as_str(), "." | "..") {
                return Err(CallError::<OrganizationError>::protocol("dot path segment"));
            }
            path.push(&segment);
            path.push("revoke");
        }
        let builder = self.http.post(url).header("accept", "application/json");
        let builder = builder.header("authorization", auth_header.as_str());
        let response = self.send(builder, "application/json").await?;
        let status = response.status().as_u16();
        let bytes = bounded_body(response, 8 * 1024 * 1024).await?;
        serde_json::from_slice(&bytes)
            .map_err(|_| CallError::protocol_response(status, "invalid JSON response"))
    }
    /// Set a member role with manage-users permission. The last owner cannot be demoted.
    pub async fn set_member_role_http(
        &self,
        auth_header: AuthHeader,
        user_id: String,
        request: SetMemberRoleRequest,
    ) -> Result<(), CallError<OrganizationError>> {
        let mut url = self.base.clone();
        {
            let mut path = url.path_segments_mut().map_err(|_| {
                CallError::<OrganizationError>::protocol("base URL cannot contain path segments")
            })?;
            path.pop_if_empty();
            path.push("api");
            path.push("organizations");
            path.push("members");
            let segment = user_id.to_string();
            if matches!(segment.as_str(), "." | "..") {
                return Err(CallError::<OrganizationError>::protocol("dot path segment"));
            }
            path.push(&segment);
            path.push("role");
        }
        let builder = self.http.put(url).header("accept", "application/json");
        let builder = builder.header("authorization", auth_header.as_str());
        let builder = builder
            .header("content-type", "application/json")
            .json(&request);
        let response = self.send(builder, "application/json").await?;
        let status = response.status().as_u16();
        let bytes = bounded_body(response, 8 * 1024 * 1024).await?;
        serde_json::from_slice(&bytes)
            .map_err(|_| CallError::protocol_response(status, "invalid JSON response"))
    }
    /// Synchronize one provider page of memberships for the specified Organization with platform
    /// administer permission. Only active memberships are stored; an empty result can still have a
    /// continuation. Page size defaults to 10 and must be 1..=100.
    pub async fn sync_memberships_http(
        &self,
        auth_header: AuthHeader,
        organization_id: String,
        request: ListMembersRequest,
    ) -> Result<MembershipPage, CallError<OrganizationError>> {
        let mut url = self.base.clone();
        {
            let mut path = url.path_segments_mut().map_err(|_| {
                CallError::<OrganizationError>::protocol("base URL cannot contain path segments")
            })?;
            path.pop_if_empty();
            path.push("api");
            path.push("organizations");
            path.push("admin");
            let segment = organization_id.to_string();
            if matches!(segment.as_str(), "." | "..") {
                return Err(CallError::<OrganizationError>::protocol("dot path segment"));
            }
            path.push(&segment);
            path.push("memberships");
            path.push("sync");
        }
        let builder = self.http.post(url).header("accept", "application/json");
        let builder = builder.header("authorization", auth_header.as_str());
        let builder = builder
            .header("content-type", "application/json")
            .json(&request);
        let response = self.send(builder, "application/json").await?;
        let status = response.status().as_u16();
        let bytes = bounded_body(response, 8 * 1024 * 1024).await?;
        serde_json::from_slice(&bytes)
            .map_err(|_| CallError::protocol_response(status, "invalid JSON response"))
    }
    /// Fetch pages lazily, retaining the request filters and stopping when the token is absent.
    /// Dropping the stream cancels an active request; no later page is prefetched.
    pub fn sync_memberships_pages<'a>(
        &'a self,
        auth_header: &'a AuthHeader,
        organization_id: String,
        request: ListMembersRequest,
    ) -> impl Stream<Item = Result<MembershipPage, CallError<OrganizationError>>> + 'a {
        stream::try_unfold(Some(request), move |request| {
            #[allow(
                clippy::clone_on_copy,
                reason = "Hosts may implement Copy for generated aliases; pagination also supports Clone aliases."
            )]
            let organization_id = organization_id.clone();
            async move {
                let Some(mut request) = request else {
                    return Ok(None);
                };
                let page = self
                    .sync_memberships_http(auth_header.clone(), organization_id, request.clone())
                    .await?;
                let next = page.next_page_token.clone();
                if next.as_ref().is_some_and(|token| {
                    token.is_empty() || Some(token) == request.page_token.as_ref()
                }) {
                    return Err(CallError::<OrganizationError>::protocol(
                        "invalid pagination token",
                    ));
                }
                request.page_token = next;
                let next_request = request.page_token.is_some().then_some(request);
                Ok(Some((page, next_request)))
            }
        })
    }
    /// Yield items lazily, continuing across empty pages that have a continuation token.
    pub fn sync_memberships_items<'a>(
        &'a self,
        auth_header: &'a AuthHeader,
        organization_id: String,
        request: ListMembersRequest,
    ) -> impl Stream<Item = Result<Membership, CallError<OrganizationError>>> + 'a {
        self.sync_memberships_pages(auth_header, organization_id, request)
            .map_ok(|page| {
                stream::iter(
                    page.items
                        .into_iter()
                        .map(Ok::<_, CallError<OrganizationError>>),
                )
            })
            .try_flatten()
    }
    /// Synchronize one live provider page with platform administer permission. Page size defaults
    /// to 10 and must be 1..=100. Repeat with the continuation until absent.
    pub async fn sync_organizations_http(
        &self,
        auth_header: AuthHeader,
        request: ListMembersRequest,
    ) -> Result<OrganizationIdPage, CallError<OrganizationError>> {
        let mut url = self.base.clone();
        {
            let mut path = url.path_segments_mut().map_err(|_| {
                CallError::<OrganizationError>::protocol("base URL cannot contain path segments")
            })?;
            path.pop_if_empty();
            path.push("api");
            path.push("organizations");
            path.push("admin");
            path.push("sync");
        }
        let builder = self.http.post(url).header("accept", "application/json");
        let builder = builder.header("authorization", auth_header.as_str());
        let builder = builder
            .header("content-type", "application/json")
            .json(&request);
        let response = self.send(builder, "application/json").await?;
        let status = response.status().as_u16();
        let bytes = bounded_body(response, 8 * 1024 * 1024).await?;
        serde_json::from_slice(&bytes)
            .map_err(|_| CallError::protocol_response(status, "invalid JSON response"))
    }
    /// Fetch pages lazily, retaining the request filters and stopping when the token is absent.
    /// Dropping the stream cancels an active request; no later page is prefetched.
    pub fn sync_organizations_pages<'a>(
        &'a self,
        auth_header: &'a AuthHeader,
        request: ListMembersRequest,
    ) -> impl Stream<Item = Result<OrganizationIdPage, CallError<OrganizationError>>> + 'a {
        stream::try_unfold(Some(request), move |request| async move {
            let Some(mut request) = request else {
                return Ok(None);
            };
            let page = self
                .sync_organizations_http(auth_header.clone(), request.clone())
                .await?;
            let next = page.next_page_token.clone();
            if next
                .as_ref()
                .is_some_and(|token| token.is_empty() || Some(token) == request.page_token.as_ref())
            {
                return Err(CallError::<OrganizationError>::protocol(
                    "invalid pagination token",
                ));
            }
            request.page_token = next;
            let next_request = request.page_token.is_some().then_some(request);
            Ok(Some((page, next_request)))
        })
    }
    /// Yield items lazily, continuing across empty pages that have a continuation token.
    pub fn sync_organizations_items<'a>(
        &'a self,
        auth_header: &'a AuthHeader,
        request: ListMembersRequest,
    ) -> impl Stream<Item = Result<String, CallError<OrganizationError>>> + 'a {
        self.sync_organizations_pages(auth_header, request)
            .map_ok(|page| {
                stream::iter(
                    page.items
                        .into_iter()
                        .map(Ok::<_, CallError<OrganizationError>>),
                )
            })
            .try_flatten()
    }
    /// Set the active Organization storage default with Organization configure permission.
    /// Plaintext storage keys are vaulted before persistence.
    pub async fn write_config_http(
        &self,
        auth_header: AuthHeader,
        request: OrganizationConfig,
    ) -> Result<OrganizationConfig, CallError<OrganizationError>> {
        let mut url = self.base.clone();
        {
            let mut path = url.path_segments_mut().map_err(|_| {
                CallError::<OrganizationError>::protocol("base URL cannot contain path segments")
            })?;
            path.pop_if_empty();
            path.push("api");
            path.push("organizations");
            path.push("config");
        }
        let builder = self.http.put(url).header("accept", "application/json");
        let builder = builder.header("authorization", auth_header.as_str());
        let builder = builder
            .header("content-type", "application/json")
            .json(&request);
        let response = self.send(builder, "application/json").await?;
        let status = response.status().as_u16();
        let bytes = bounded_body(response, 8 * 1024 * 1024).await?;
        serde_json::from_slice(&bytes)
            .map_err(|_| CallError::protocol_response(status, "invalid JSON response"))
    }
    async fn send(
        &self,
        builder: reqwest_middleware::RequestBuilder,
        expected_media: &str,
    ) -> Result<reqwest::Response, CallError<OrganizationError>> {
        let response = builder
            .timeout(std::time::Duration::from_secs(60))
            .send()
            .await
            .map_err(CallError::transport)?;
        let status = response.status();
        if !status.is_success() {
            let status = status.as_u16();
            let content_type = response
                .headers()
                .get("content-type")
                .and_then(|value| value.to_str().ok())
                .map(str::to_owned);
            let (bytes, truncated) = bounded_error_body::<OrganizationError>(
                response,
                64 * 1024,
                status,
                content_type.clone(),
            )
            .await?;
            if truncated {
                return Err(CallError::unknown_remote(status, content_type, bytes, true));
            }
            return match serde_json::from_slice::<ErrorEnvelope>(&bytes) {
                Ok(envelope) => Err(CallError::Service(ServiceFailure::remote(status, envelope))),
                Err(_) => Err(CallError::unknown_remote(
                    status,
                    content_type,
                    bytes,
                    false,
                )),
            };
        }
        if !media_matches(&response, expected_media) {
            return Err(CallError::protocol_response(
                status.as_u16(),
                "unexpected response media type",
            ));
        }
        Ok(response)
    }
}

fn media_matches(response: &reqwest::Response, expected: &str) -> bool {
    response
        .headers()
        .get("content-type")
        .and_then(|value| value.to_str().ok())
        .and_then(|value| value.split(';').next())
        .is_some_and(|value| value.trim().eq_ignore_ascii_case(expected))
}

async fn bounded_body(
    mut response: reqwest::Response,
    limit: usize,
) -> Result<Vec<u8>, CallError<OrganizationError>> {
    let status = response.status().as_u16();
    let mut result = Vec::new();
    while let Some(chunk) = response
        .chunk()
        .await
        .map_err(|error| CallError::transport_response(status, error))?
    {
        if chunk.len() > limit.saturating_sub(result.len()) {
            return Err(CallError::protocol_response(
                status,
                "response exceeds JSON size limit",
            ));
        }
        result.extend_from_slice(&chunk);
    }
    Ok(result)
}

async fn bounded_error_body<E>(
    mut response: reqwest::Response,
    limit: usize,
    status: u16,
    content_type: Option<String>,
) -> Result<(Vec<u8>, bool), CallError<E>> {
    let mut result = Vec::new();
    loop {
        let chunk = response.chunk().await.map_err(|error| {
            CallError::unreadable_remote(status, content_type.clone(), result.clone(), error)
        })?;
        let Some(chunk) = chunk else {
            return Ok((result, false));
        };
        let remaining = limit.saturating_sub(result.len());
        if chunk.len() > remaining {
            result.extend_from_slice(&chunk[..remaining]);
            return Ok((result, true));
        }
        result.extend_from_slice(&chunk);
    }
}
#[async_trait]
impl OrganizationApi for OrganizationClient {
    async fn create_organization(
        &self,
        auth_header: AuthHeader,
        request: CreateOrganizationRequest,
    ) -> Result<CreateOrganizationResponse, CallError<OrganizationError>> {
        let response = Self::create_organization_http(self, auth_header, request).await?;
        Ok(response)
    }
    async fn create_portal_link(
        &self,
        auth_header: AuthHeader,
        request: PortalLinkRequest,
    ) -> Result<PortalLink, CallError<OrganizationError>> {
        let response = Self::create_portal_link_http(self, auth_header, request).await?;
        Ok(response)
    }
    async fn deactivate_member(
        &self,
        auth_header: AuthHeader,
        user_id: String,
    ) -> Result<(), CallError<OrganizationError>> {
        let response = Self::deactivate_member_http(self, auth_header, user_id).await?;
        Ok(response)
    }
    async fn deactivate_organization(
        &self,
        auth_header: AuthHeader,
        organization_id: String,
    ) -> Result<(), CallError<OrganizationError>> {
        let response =
            Self::deactivate_organization_http(self, auth_header, organization_id).await?;
        Ok(response)
    }
    async fn invite_member(
        &self,
        auth_header: AuthHeader,
        request: InviteMemberRequest,
    ) -> Result<InvitationResponse, CallError<OrganizationError>> {
        let response = Self::invite_member_http(self, auth_header, request).await?;
        Ok(response)
    }
    async fn list_invitations(
        &self,
        auth_header: AuthHeader,
        request: ListMembersRequest,
    ) -> Result<InvitationPage, CallError<OrganizationError>> {
        let response = Self::list_invitations_http(self, auth_header, request).await?;
        Ok(response)
    }
    async fn list_members(
        &self,
        auth_header: AuthHeader,
        request: ListMembersRequest,
    ) -> Result<MemberPage, CallError<OrganizationError>> {
        let response = Self::list_members_http(self, auth_header, request).await?;
        Ok(response)
    }
    async fn list_memberships(
        &self,
        auth_header: AuthHeader,
        request: ListMembershipsRequest,
    ) -> Result<MembershipPage, CallError<OrganizationError>> {
        let response = Self::list_memberships_http(self, auth_header, request).await?;
        Ok(response)
    }
    async fn list_organizations(
        &self,
        auth_header: AuthHeader,
        request: ListOrganizationsRequest,
    ) -> Result<OrganizationPage, CallError<OrganizationError>> {
        let response = Self::list_organizations_http(self, auth_header, request).await?;
        Ok(response)
    }
    async fn reactivate_organization(
        &self,
        auth_header: AuthHeader,
        organization_id: String,
    ) -> Result<(), CallError<OrganizationError>> {
        let response =
            Self::reactivate_organization_http(self, auth_header, organization_id).await?;
        Ok(response)
    }
    async fn read_config(
        &self,
        auth_header: AuthHeader,
    ) -> Result<OrganizationConfig, CallError<OrganizationError>> {
        let response = Self::read_config_http(self, auth_header).await?;
        Ok(response)
    }
    async fn read_identity(
        &self,
        auth_header: AuthHeader,
    ) -> Result<Identity, CallError<OrganizationError>> {
        let response = Self::read_identity_http(self, auth_header).await?;
        Ok(response)
    }
    async fn resend_invitation(
        &self,
        auth_header: AuthHeader,
        invitation_id: String,
    ) -> Result<InvitationResponse, CallError<OrganizationError>> {
        let response = Self::resend_invitation_http(self, auth_header, invitation_id).await?;
        Ok(response)
    }
    async fn revoke_invitation(
        &self,
        auth_header: AuthHeader,
        invitation_id: String,
    ) -> Result<(), CallError<OrganizationError>> {
        let response = Self::revoke_invitation_http(self, auth_header, invitation_id).await?;
        Ok(response)
    }
    async fn set_member_role(
        &self,
        auth_header: AuthHeader,
        user_id: String,
        request: SetMemberRoleRequest,
    ) -> Result<(), CallError<OrganizationError>> {
        let response = Self::set_member_role_http(self, auth_header, user_id, request).await?;
        Ok(response)
    }
    async fn sync_memberships(
        &self,
        auth_header: AuthHeader,
        organization_id: String,
        request: ListMembersRequest,
    ) -> Result<MembershipPage, CallError<OrganizationError>> {
        let response =
            Self::sync_memberships_http(self, auth_header, organization_id, request).await?;
        Ok(response)
    }
    async fn sync_organizations(
        &self,
        auth_header: AuthHeader,
        request: ListMembersRequest,
    ) -> Result<OrganizationIdPage, CallError<OrganizationError>> {
        let response = Self::sync_organizations_http(self, auth_header, request).await?;
        Ok(response)
    }
    async fn write_config(
        &self,
        auth_header: AuthHeader,
        request: OrganizationConfig,
    ) -> Result<OrganizationConfig, CallError<OrganizationError>> {
        let response = Self::write_config_http(self, auth_header, request).await?;
        Ok(response)
    }
}